syzbot

map[Fixes:map[Hash:1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Title:Linux-2.6.12-rc2] KernelBranch:master KernelCommit:5d6919055dec134de3c40167a490f33c74c12581 KernelRepo:git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git PatchDescription:jfs: fix slab-use-after-free in lbmIODone

A KASAN slab-use-after-free was reported in lbmIODone(). The root cause
is a race condition between lbmRead() and the bio completion handler
lbmIODone(). In lbmRead(), wait_event() is used to wait for the I/O
completion locklessly. When the READ bio completes, lbmIODone() clears
the lbmREAD flag and wakes up the waiter before setting the lbmDONE flag
and releasing the LCACHE_LOCK. Because wait_event() evaluates its
condition locklessly, lbmRead() can wake up and return immediately after
the wakeup, before lbmIODone() has finished its execution.

The caller of lbmRead() (e.g., lmLogShutdown()) can then reuse the same
buffer for a WRITE bio. Meanwhile, the original lbmIODone() resumes and
erroneously sets the lbmDONE flag on the reused buffer. This causes a
subsequent lbmIOWait() on the new WRITE bio to return early and free the
buffer. When the WRITE bio actually completes, lbmIODone() accesses the
freed buffer, triggering the use-after-free.

Fix this by replacing the lockless wait_event() in lbmRead() with
lbmIOWait(bp, 0). lbmIOWait() properly synchronizes with lbmIODone() by
acquiring LCACHE_LOCK before checking the condition, ensuring lbmRead()
will block until lbmIODone() has completely finished. As an added
benefit, lbmIOWait() correctly returns -EIO if the bio completes with an
error, whereas the previous implementation unconditionally returned 0. PatchDiff:diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
index 306165e61..cf62a8564 100644
--- a/fs/jfs/jfs_logmgr.c
+++ b/fs/jfs/jfs_logmgr.c
@@ -1984,9 +1984,7 @@ static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp)
 		submit_bio(bio);
 	}
 
-	wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));
-
-	return 0;
+	return lbmIOWait(bp, 0);
 }
 
 
 Recipients:[map[Email:jfs-discussion@lists.sourceforge.net Name: To:true] map[Email:linux-kernel@vger.kernel.org Name: To:false] map[Email:shaggy@kernel.org Name:Dave Kleikamp To:true]]]

map[KernelBranch:master KernelCommit:5d6919055dec134de3c40167a490f33c74c12581 KernelRepo:git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git]

map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE 

#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <setjmp.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

#include <linux/loop.h>

#ifndef __NR_memfd_create
#define __NR_memfd_create 319
#endif

static unsigned long long procid;

//% This code is derived from puff.{c,h}, found in the zlib development. The
//% original files come with the following copyright notice:

//% Copyright (C) 2002-2013 Mark Adler, all rights reserved
//% version 2.3, 21 Jan 2013
//% This software is provided 'as-is', without any express or implied
//% warranty.  In no event will the author be held liable for any damages
//% arising from the use of this software.
//% Permission is granted to anyone to use this software for any purpose,
//% including commercial applications, and to alter it and redistribute it
//% freely, subject to the following restrictions:
//% 1. The origin of this software must not be misrepresented; you must not
//%    claim that you wrote the original software. If you use this software
//%    in a product, an acknowledgment in the product documentation would be
//%    appreciated but is not required.
//% 2. Altered source versions must be plainly marked as such, and must not be
//%    misrepresented as being the original software.
//% 3. This notice may not be removed or altered from any source distribution.
//% Mark Adler    madler@alumni.caltech.edu

//% BEGIN CODE DERIVED FROM puff.{c,h}

#define MAXBITS 15
#define MAXLCODES 286
#define MAXDCODES 30
#define MAXCODES (MAXLCODES + MAXDCODES)
#define FIXLCODES 288

struct puff_state {
	unsigned char* out;
	unsigned long outlen;
	unsigned long outcnt;
	const unsigned char* in;
	unsigned long inlen;
	unsigned long incnt;
	int bitbuf;
	int bitcnt;
	jmp_buf env;
};
static int puff_bits(struct puff_state* s, int need)
{
	long val = s->bitbuf;
	while (s->bitcnt < need) {
		if (s->incnt == s->inlen)
			longjmp(s->env, 1);
		val |= (long)(s->in[s->incnt++]) << s->bitcnt;
		s->bitcnt += 8;
	}
	s->bitbuf = (int)(val >> need);
	s->bitcnt -= need;
	return (int)(val & ((1L << need) - 1));
}
static int puff_stored(struct puff_state* s)
{
	s->bitbuf = 0;
	s->bitcnt = 0;
	if (s->incnt + 4 > s->inlen)
		return 2;
	unsigned len = s->in[s->incnt++];
	len |= s->in[s->incnt++] << 8;
	if (s->in[s->incnt++] != (~len & 0xff) ||
	    s->in[s->incnt++] != ((~len >> 8) & 0xff))
		return -2;
	if (s->incnt + len > s->inlen)
		return 2;
	if (s->outcnt + len > s->outlen)
		return 1;
	for (; len--; s->outcnt++, s->incnt++) {
		if (s->in[s->incnt])
			s->out[s->outcnt] = s->in[s->incnt];
	}
	return 0;
}
struct puff_huffman {
	short* count;
	short* symbol;
};
static int puff_decode(struct puff_state* s, const struct puff_huffman* h)
{
	int first = 0;
	int index = 0;
	int bitbuf = s->bitbuf;
	int left = s->bitcnt;
	int code = first = index = 0;
	int len = 1;
	short* next = h->count + 1;
	while (1) {
		while (left--) {
			code |= bitbuf & 1;
			bitbuf >>= 1;
			int count = *next++;
			if (code - count < first) {
				s->bitbuf = bitbuf;
				s->bitcnt = (s->bitcnt - len) & 7;
				return h->symbol[index + (code - first)];
			}
			index += count;
			first += count;
			first <<= 1;
			code <<= 1;
			len++;
		}
		left = (MAXBITS + 1) - len;
		if (left == 0)
			break;
		if (s->incnt == s->inlen)
			longjmp(s->env, 1);
		bitbuf = s->in[s->incnt++];
		if (left > 8)
			left = 8;
	}
	return -10;
}
static int puff_construct(struct puff_huffman* h, const short* length, int n)
{
	int len;
	for (len = 0; len <= MAXBITS; len++)
		h->count[len] = 0;
	int symbol;
	for (symbol = 0; symbol < n; symbol++)
		(h->count[length[symbol]])++;
	if (h->count[0] == n)
		return 0;
	int left = 1;
	for (len = 1; len <= MAXBITS; len++) {
		left <<= 1;
		left -= h->count[len];
		if (left < 0)
			return left;
	}
	short offs[MAXBITS + 1];
	offs[1] = 0;
	for (len = 1; len < MAXBITS; len++)
		offs[len + 1] = offs[len] + h->count[len];
	for (symbol = 0; symbol < n; symbol++)
		if (length[symbol] != 0)
			h->symbol[offs[length[symbol]]++] = symbol;
	return left;
}
static int puff_codes(struct puff_state* s,
		      const struct puff_huffman* lencode,
		      const struct puff_huffman* distcode)
{
	static const short lens[29] = {
				       3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31,
				       35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258};
	static const short lext[29] = {
				       0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2,
				       3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0};
	static const short dists[30] = {
					1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193,
					257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145,
					8193, 12289, 16385, 24577};
	static const short dext[30] = {
				       0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6,
				       7, 7, 8, 8, 9, 9, 10, 10, 11, 11,
				       12, 12, 13, 13};
	int symbol;
	do {
		symbol = puff_decode(s, lencode);
		if (symbol < 0)
			return symbol;
		if (symbol < 256) {
			if (s->outcnt == s->outlen)
				return 1;
			if (symbol)
				s->out[s->outcnt] = symbol;
			s->outcnt++;
		} else if (symbol > 256) {
			symbol -= 257;
			if (symbol >= 29)
				return -10;
			int len = lens[symbol] + puff_bits(s, lext[symbol]);
			symbol = puff_decode(s, distcode);
			if (symbol < 0)
				return symbol;
			unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]);
			if (dist > s->outcnt)
				return -11;
			if (s->outcnt + len > s->outlen)
				return 1;
			while (len--) {
				if (dist <= s->outcnt && s->out[s->outcnt - dist])
					s->out[s->outcnt] = s->out[s->outcnt - dist];
				s->outcnt++;
			}
		}
	} while (symbol != 256);
	return 0;
}
static int puff_fixed(struct puff_state* s)
{
	static int virgin = 1;
	static short lencnt[MAXBITS + 1], lensym[FIXLCODES];
	static short distcnt[MAXBITS + 1], distsym[MAXDCODES];
	static struct puff_huffman lencode, distcode;
	if (virgin) {
		lencode.count = lencnt;
		lencode.symbol = lensym;
		distcode.count = distcnt;
		distcode.symbol = distsym;
		short lengths[FIXLCODES];
		int symbol;
		for (symbol = 0; symbol < 144; symbol++)
			lengths[symbol] = 8;
		for (; symbol < 256; symbol++)
			lengths[symbol] = 9;
		for (; symbol < 280; symbol++)
			lengths[symbol] = 7;
		for (; symbol < FIXLCODES; symbol++)
			lengths[symbol] = 8;
		puff_construct(&lencode, lengths, FIXLCODES);
		for (symbol = 0; symbol < MAXDCODES; symbol++)
			lengths[symbol] = 5;
		puff_construct(&distcode, lengths, MAXDCODES);
		virgin = 0;
	}
	return puff_codes(s, &lencode, &distcode);
}
static int puff_dynamic(struct puff_state* s)
{
	static const short order[19] =
	    {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
	int nlen = puff_bits(s, 5) + 257;
	int ndist = puff_bits(s, 5) + 1;
	int ncode = puff_bits(s, 4) + 4;
	if (nlen > MAXLCODES || ndist > MAXDCODES)
		return -3;
	short lengths[MAXCODES];
	int index;
	for (index = 0; index < ncode; index++)
		lengths[order[index]] = puff_bits(s, 3);
	for (; index < 19; index++)
		lengths[order[index]] = 0;
	short lencnt[MAXBITS + 1], lensym[MAXLCODES];
	struct puff_huffman lencode = {lencnt, lensym};
	int err = puff_construct(&lencode, lengths, 19);
	if (err != 0)
		return -4;
	index = 0;
	while (index < nlen + ndist) {
		int symbol;
		int len;
		symbol = puff_decode(s, &lencode);
		if (symbol < 0)
			return symbol;
		if (symbol < 16)
			lengths[index++] = symbol;
		else {
			len = 0;
			if (symbol == 16) {
				if (index == 0)
					return -5;
				len = lengths[index - 1];
				symbol = 3 + puff_bits(s, 2);
			} else if (symbol == 17)
				symbol = 3 + puff_bits(s, 3);
			else
				symbol = 11 + puff_bits(s, 7);
			if (index + symbol > nlen + ndist)
				return -6;
			while (symbol--)
				lengths[index++] = len;
		}
	}
	if (lengths[256] == 0)
		return -9;
	err = puff_construct(&lencode, lengths, nlen);
	if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1]))
		return -7;
	short distcnt[MAXBITS + 1], distsym[MAXDCODES];
	struct puff_huffman distcode = {distcnt, distsym};
	err = puff_construct(&distcode, lengths + nlen, ndist);
	if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1]))
		return -8;
	return puff_codes(s, &lencode, &distcode);
}
static int puff(
    unsigned char* dest,
    unsigned long* destlen,
    const unsigned char* source,
    unsigned long sourcelen)
{
	struct puff_state s = {
	    .out = dest,
	    .outlen = *destlen,
	    .outcnt = 0,
	    .in = source,
	    .inlen = sourcelen,
	    .incnt = 0,
	    .bitbuf = 0,
	    .bitcnt = 0,
	};
	int err;
	if (setjmp(s.env) != 0)
		err = 2;
	else {
		int last;
		do {
			last = puff_bits(&s, 1);
			int type = puff_bits(&s, 2);
			err = type == 0 ? puff_stored(&s) : (type == 1 ? puff_fixed(&s) : (type == 2 ? puff_dynamic(&s) : -1));
			if (err != 0)
				break;
		} while (!last);
	}
	*destlen = s.outcnt;
	return err;
}

//% END CODE DERIVED FROM puff.{c,h}

#define ZLIB_HEADER_WIDTH 2

static int puff_zlib_to_file(const unsigned char* source, unsigned long sourcelen, int dest_fd)
{
	if (sourcelen < ZLIB_HEADER_WIDTH)
		return 0;
	source += ZLIB_HEADER_WIDTH;
	sourcelen -= ZLIB_HEADER_WIDTH;
	const unsigned long max_destlen = 132 << 20;
	void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ, MAP_PRIVATE | MAP_ANON, -1, 0);
	if (ret == MAP_FAILED)
		return -1;
	unsigned char* dest = (unsigned char*)ret;
	unsigned long destlen = max_destlen;
	int err = puff(dest, &destlen, source, sourcelen);
	if (err) {
		munmap(dest, max_destlen);
		errno = -err;
		return -1;
	}
	if (write(dest_fd, dest, destlen) != (ssize_t)destlen) {
		munmap(dest, max_destlen);
		return -1;
	}
	return munmap(dest, max_destlen);
}

static int setup_loop_device(unsigned char* data, unsigned long size, const char* loopname, int* loopfd_p)
{
	int err = 0, loopfd = -1;
	int memfd = syscall(__NR_memfd_create, "syzkaller", 0);
	if (memfd == -1) {
		err = errno;
		goto error;
	}
	if (puff_zlib_to_file(data, size, memfd)) {
		err = errno;
		goto error_close_memfd;
	}
	loopfd = open(loopname, O_RDWR);
	if (loopfd == -1) {
		err = errno;
		goto error_close_memfd;
	}
	if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
		if (errno != EBUSY) {
			err = errno;
			goto error_close_loop;
		}
		ioctl(loopfd, LOOP_CLR_FD, 0);
		usleep(1000);
		if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
			err = errno;
			goto error_close_loop;
		}
	}
	close(memfd);
	*loopfd_p = loopfd;
	return 0;

error_close_loop:
	close(loopfd);
error_close_memfd:
	close(memfd);
error:
	errno = err;
	return -1;
}

static void reset_loop_device(const char* loopname)
{
	int loopfd = open(loopname, O_RDWR);
	if (loopfd == -1) {
		return;
	}
	if (ioctl(loopfd, LOOP_CLR_FD, 0)) {
	}
	close(loopfd);
}

static long syz_mount_image(
    volatile long fsarg,
    volatile long dir,
    volatile long flags,
    volatile long optsarg,
    volatile long change_dir,
    volatile unsigned long size,
    volatile long image)
{
	unsigned char* data = (unsigned char*)image;
	int res = -1, err = 0, need_loop_device = !!size;
	char* mount_opts = (char*)optsarg;
	char* target = (char*)dir;
	char* fs = (char*)fsarg;
	char* source = NULL;
	char loopname[64];
	if (need_loop_device) {
		int loopfd;
		memset(loopname, 0, sizeof(loopname));
		snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid);
		if (setup_loop_device(data, size, loopname, &loopfd) == -1)
			return -1;
		close(loopfd);
		source = loopname;
	}
	mkdir(target, 0777);
	char opts[256];
	memset(opts, 0, sizeof(opts));
	if (strlen(mount_opts) > (sizeof(opts) - 32)) {
	}
	strncpy(opts, mount_opts, sizeof(opts) - 32);
	if (strcmp(fs, "iso9660") == 0) {
		flags |= MS_RDONLY;
	} else if (strncmp(fs, "ext", 3) == 0) {
		bool has_remount_ro = false;
		char* remount_ro_start = strstr(opts, "errors=remount-ro");
		if (remount_ro_start != NULL) {
			char after = *(remount_ro_start + strlen("errors=remount-ro"));
			char before = remount_ro_start == opts ? '\0' : *(remount_ro_start - 1);
			has_remount_ro = ((before == '\0' || before == ',') && (after == '\0' || after == ','));
		}
		if (strstr(opts, "errors=panic") || !has_remount_ro)
			strcat(opts, ",errors=continue");
	} else if (strcmp(fs, "xfs") == 0) {
		strcat(opts, ",nouuid");
	} else if (strncmp(fs, "gfs2", 4) == 0 && (strstr(opts, "errors=panic") || strstr(opts, "debug"))) {
		strcat(opts, ",errors=withdraw");
	}
	res = mount(source, target, fs, flags, opts);
	if (res == -1) {
		err = errno;
		goto error_clear_loop;
	}
	res = open(target, O_RDONLY | O_DIRECTORY);
	if (res == -1) {
		err = errno;
		goto error_clear_loop;
	}
	if (change_dir) {
		res = chdir(target);
		if (res == -1) {
			err = errno;
		}
	}

error_clear_loop:
	if (need_loop_device)
		reset_loop_device(loopname);
	errno = err;
	return res;
}

uint64_t r[1] = {0xffffffffffffffff};

int main(void)
{
		syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	const char* reason;
	(void)reason;
				intptr_t res = 0;
	if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
//  syz_mount_image$jfs arguments: [
//    fs: ptr[in, buffer] {
//      buffer: {6a 66 73 00} (length 0x4)
//    }
//    dir: ptr[in, buffer] {
//      buffer: {2e 2f 62 75 73 00} (length 0x6)
//    }
//    flags: mount_flags = 0xc802 (8 bytes)
//    opts: ptr[inout, array[ANYUNION]] {
//      array[ANYUNION] {
//        union ANYUNION {
//          ANYRES32: ANYRES32 (resource)
//        }
//      }
//    }
//    chdir: int8 = 0x1 (1 bytes)
//    size: len = 0x5fd0 (8 bytes)
//    img: ptr[in, buffer] {
//      buffer: (compressed buffer with length 0x5fd0)
//    }
//  ]
//  returns fd_dir
memcpy((void*)0x200000000400, "jfs\000", 4);
memcpy((void*)0x200000000000, "./bus\000", 6);
*(uint32_t*)0x200000000100 = 0;
memcpy((void*)0x200000006440, "\x78\x9c\xec\xdd\xcb\x6f\x1d\x57\x1d\x07\xf0\xdf\x7d\xf8\xfa\x51\x48\xa3\x0a\x55\x21\x62\xe1\xa6\x50\x5a\x4a\xf3\x4e\xa0\xbc\x9a\xb2\x60\x01\x48\x20\xa1\xac\x49\xe4\xba\x55\x20\x05\x94\xa4\x88\x56\x11\x71\x95\x05\x62\xc1\xe3\x4f\x80\x4d\x37\x2c\xfa\x8f\x94\x7f\x01\xf1\x07\x10\x29\x61\x55\x09\xca\xa0\xb1\xcf\x49\xc6\xe3\xeb\x5c\xa7\x89\xef\xdc\xeb\xf3\xf9\x48\xce\xcc\x6f\xce\x8c\x7d\x26\x5f\x8f\xef\x63\x66\xee\x09\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\xbe\xff\xbd\x9f\x9c\xea\x45\xc4\xa5\x5f\xa7\x05\x87\x23\x3e\x13\x83\x88\x7e\xc4\x72\x5d\xaf\x46\x3d\x73\x21\xaf\x3f\x8c\x88\x23\xb1\xd9\x1c\xcf\x46\xc4\x60\x31\xa2\xde\x7e\xf3\x9f\xa7\x23\xce\x46\xc4\x47\x87\x22\xee\xde\xbb\xb9\x56\x2f\x3e\xbd\xc7\x7e\x9c\x3b\x79\xe3\xda\x27\x3f\xf8\xee\x3f\x7e\xf7\xa7\xdb\x47\x7e\xf6\xc6\x4f\x3f\x68\xb7\xff\xf8\x73\x67\x3e\xfc\xfd\xad\x88\xc3\x3f\x7a\xf5\xc3\x4f\x6e\x3d\x99\x7d\x07\x00\x00\x80\x52\x54\x55\x55\xf5\xd2\xcb\xfc\xa3\xe9\xf5\x7d\xbf\xeb\x4e\x01\x00\x53\x91\x1f\xff\xab\x24\x2f\x57\xab\xd5\x6a\xf5\x13\xad\xff\xd8\x9f\xad\xfe\xa8\x0b\xad\x9b\xaa\xf1\x6e\x35\x8b\x88\xd8\x68\x6e\x53\x3f\x67\x70\x3a\x1e\x00\xe6\xcc\x46\x7c\xdc\x75\x17\xe8\x90\xfc\x8b\x36\x8c\x88\xa7\xba\xee\x04\x30\xd3\x7a\x5d\x77\x80\x7d\x71\xf7\xde\xcd\xb5\x5e\xca\xb7\xd7\x7c\x3c\x58\xdd\x6a\xcf\xef\x53\x6e\xcb\x7f\xa3\x77\xff\xfe\x8e\xdd\xa6\x93\xb4\xaf\x31\x99\xd6\xef\xd7\xed\x18\xc4\x33\xbb\xf4\x67\x79\x4a\x7d\x98\x25\x39\xff\x7e\x3b\xff\x4b\x5b\xed\xa3\xb4\xde\x7e\xe7\x3f\x2d\xbb\xe5\x3f\xda\xba\xf5\xa9\x38\x39\xff\x41\x3b\xff\x96\x6d\xf9\xff\x39\x22\xe6\x36\xff\xfe\xd8\xfc\x4b\x95\xf3\x1f\x3e\x4a\xfe\x1b\x83\x39\x3e\xfe\xe5\x0f\x00\x00\x00\x00\xc0\xc1\x97\xdf\xff\x3f\xdc\xf1\xf9\xdf\xc5\xc7\xdf\x95\x3d\x79\xd8\xf9\xdf\xd5\x29\xf5\x01\x00\x00\x00\x00\x00\x00\x00\x9e\xb4\xc7\x1d\xff\xef\x3e\xe3\xff\x01\x00\x00\xc0\xcc\xaa\x5f\xab\xd7\xfe\x72\xe8\xc1\xb2\xdd\x3e\x8b\xad\x5e\x7e\xb1\x17\xf1\xd9\xd6\xfa\x40\x61\xd2\xcd\x32\x2b\x5d\xf7\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x4a\x32\xdc\xba\x86\xf7\x62\x2f\x62\x61\x31\x22\x56\x56\xaa\xaa\xaa\xbf\x9a\xda\xf5\xa3\x7a\xdc\xed\xe7\x5d\xe9\xfb\x0f\x25\xeb\xfa\x8f\x3c\x00\x00\x6c\xf9\xe8\x50\xeb\x5e\xfe\x5e\xc4\x52\x44\x5c\x4c\x9f\xf5\xb7\xb0\xb2\xb2\x52\x55\x4b\xcb\x2b\xd5\x4a\xb5\xbc\x98\x9f\xcf\x8e\x16\x97\xaa\xe5\xc6\xeb\xda\x3c\xad\x97\x2d\x8e\xf6\xf0\x84\x78\x38\xaa\xea\x6f\xb6\xd4\xd8\xae\x69\xd2\xeb\xe5\x49\xed\xed\xef\x57\xff\xac\x51\x35\xd8\x43\xc7\xa6\xa3\xc3\xc0\x01\x20\x22\xb6\x1e\x8d\xee\x7a\x44\x3a\x60\xaa\xea\xe9\xe8\xfa\x59\x0e\xf3\xc1\xf1\x7f\xf0\x38\xfe\xd9\x8b\xae\x7f\x4f\x01\x00\x00\x80\xfd\x57\x55\x55\xd5\x4b\x1f\xe7\x7d\x34\x9d\xf3\xef\x77\xdd\x29\x00\x60\x1a\x96\xf2\xe3\x7f\xfb\xbc\x80\x5a\xad\x56\x3f\x4e\xfd\xce\x8c\xf5\x47\xad\x56\xef\x54\x8d\x77\xab\x59\x44\xc4\x46\x73\x9b\xfa\x39\x83\xe1\xf8\x01\x60\xce\x6c\xc4\xc7\x5d\x77\x81\x0e\xc9\xbf\x68\xc3\x88\x38\xd2\x75\x27\x80\x99\xd6\xeb\xba\x03\xec\x8b\xbb\xf7\x6e\xae\xf5\x52\xbe\xbd\xe6\xe3\x41\x1a\xdf\x3d\x5f\x0b\xb2\x2d\xff\x8d\xde\xe6\x76\x79\xfb\x71\xd3\x49\xda\xd7\x98\x4c\xeb\xf7\xeb\x76\x0c\xe2\x99\x5d\xfa\xf3\xec\x94\xfa\x30\x4b\x72\xfe\xfd\x76\xfe\x97\xb6\xda\x47\x69\xbd\xfd\xce\x7f\x5a\x76\xcb\xbf\xde\xcf\xc3\x1d\xf4\xa7\x6b\x39\xff\x41\x3b\xff\x96\x83\x93\x7f\x7f\x6c\xfe\xa5\xca\xf9\x0f\x1f\x29\xff\x81\xfc\x01\x00\x00\x00\x00\x60\x86\xe5\xf7\xff\x0f\x3f\xfc\xfc\xef\xd2\xb6\x8d\x0e\xe8\xf9\xdf\xd5\x29\xf5\x01\x00\x00\x00\x00\x00\x00\x00\x9e\xb4\xbb\xf7\x6e\xae\xe5\xfb\x5e\xf3\xf9\xff\x2f\x8c\x59\xaf\xd7\x9c\x73\xff\xe7\x81\x91\xf3\xef\xed\x39\x7f\xf7\xff\x1e\x24\x39\xff\x7e\x3b\xff\xd6\x05\x39\x83\xc6\xfc\x9d\xd7\x1f\xe4\xff\xef\x7b\x37\xd7\x3e\xb8\xf1\xaf\xcf\xe7\xe9\xcc\xe7\xbf\x30\x18\xd5\x3f\x7b\xa1\xd7\x1f\x0c\xd3\x35\x3f\xd5\xc2\x9b\x71\x25\xae\xc6\x7a\x9c\xdc\xb1\xfe\x70\x5b\xfb\xa9\x1d\xed\x0b\xdb\xda\x4f\x4f\x68\x3f\xb3\xa3\x7d\x54\xb7\x2f\xe7\xf6\xe3\xb1\x16\xbf\x8c\xab\xf1\xc6\xfd\xf6\xc5\x09\x17\x46\x2d\x4d\x68\xaf\x26\xb4\xe7\xfc\x07\x8e\xff\x22\xe5\xfc\x87\x8d\xaf\x3a\xff\x95\xd4\xde\x6b\x4d\x6b\x77\xde\xef\xef\x38\xee\x9b\xd3\x71\x3f\xe7\xc2\xdf\xfe\xfb\xc2\xce\xa3\x6b\xfa\x6e\xc7\xe0\xfe\xbe\x35\xd5\xfb\x77\xac\x83\xfe\x6c\xfe\x9f\x3c\x35\x8a\x77\xae\xaf\x5f\x3b\xfe\x9b\xcb\x37\x6e\x5c\x3b\x15\x69\xb2\x6d\xe9\xe9\x48\x93\x27\x2c\xe7\xbf\x90\xbe\x72\xfe\x2f\x3e\xbf\xd5\x9e\xff\xee\x37\x8f\xd7\x3b\xef\x8f\x1e\x39\xff\x59\x71\x3b\x86\xbb\xe6\xff\x7c\x63\xbe\xde\xdf\x97\xa6\xdc\xb7\x2e\xe4\xfc\x47\xe9\x2b\xe7\x9f\x1f\x81\xc6\x1f\xff\xf3\x9c\xff\xee\xc7\xff\xcb\x1d\xf4\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1e\xa6\xaa\xaa\xcd\x5b\x44\x2f\x44\xc4\xf9\x74\xff\x4f\x57\xf7\x66\x02\x00\x53\xf5\x87\x1f\xa6\x99\x2a\x09\xb5\x5a\xad\x56\xab\xd5\x73\x53\xf7\xd2\xb2\xbd\xae\xdf\x54\x8d\xf7\x5a\xb3\x68\x8d\x04\xb8\xf9\x9e\xc1\x6f\xc7\x7d\x33\x00\x60\x96\xfd\x2f\x22\xfe\xd9\x75\x27\xe8\x8c\xfc\x0b\x96\x3f\xef\xaf\x9e\x7e\xb1\xeb\xce\x00\x53\x75\xfd\xdd\xf7\x7e\x7e\xf9\xea\xd5\xf5\x6b\xd7\xbb\xee\x09\x00\x00\x00\x00\x00\x00\x00\xf0\x69\xe5\xf1\x3f\x57\x1b\xe3\x3f\x6f\x5e\x07\xd4\x1a\x37\x7a\xdb\xf8\xaf\xaf\xc7\xea\xdc\x8e\xff\xd9\x1f\x0d\x36\xc7\x3a\x4f\x3b\xf4\x5c\x3c\x7c\xfc\xef\x63\xf1\xf0\xf1\xbf\x87\x13\x7e\xde\xc2\x84\xf6\xd1\x84\xf6\xc5\x09\xed\x4b\x13\xda\xc7\xde\xe8\xd1\x90\xf3\x7f\x2e\x65\x9c\xf3\x3f\x9a\x76\xac\xa4\xf1\x5f\x5f\xec\xa0\x3f\x5d\xcb\xf9\x1f\x4b\x63\x3d\xe7\xfc\xbf\xdc\x5a\xaf\x99\x7f\xf5\xd7\x79\xce\xbf\xbf\x2d\xff\x13\x37\xde\xfe\xd5\x89\xeb\xef\xbe\xf7\xca\x95\xb7\x2f\xbf\xb5\xfe\xd6\xfa\x2f\x4e\x9d\x3c\x7f\xf6\xcc\xb9\xb3\x67\xce\x9d\x3b\xf1\xe6\x95\xab\xeb\x27\xb7\xfe\xed\xb0\xc7\xfb\x2b\xe7\x9f\xc7\xbe\x76\x1d\x68\x59\x72\xfe\x39\x73\xf9\x97\x25\xe7\xff\xa5\x54\xcb\xbf\x2c\x39\xff\x17\x52\x2d\xff\xb2\xe4\xfc\xf3\xf3\x3d\xf9\x97\x25\xe7\x9f\x5f\xfb\xc8\xbf\x2c\x39\xff\x97\x52\x2d\xff\xb2\xe4\xfc\xbf\x92\x6a\xf9\x97\x25\xe7\xff\x72\x7a\x2b\x51\xfe\x65\xc9\xf9\x7f\x35\xd5\xf2\x2f\x4b\xce\xff\x95\x54\xcb\xbf\x2c\x39\xff\xe3\xa9\x96\x7f\x59\x72\xfe\x27\x52\x2d\xff\xb2\xe4\xfc\xf3\x19\x2e\xf9\x97\x25\xe7\x9f\xaf\x6c\x90\x7f\x59\x72\xfe\xa7\x53\x2d\xff\xb2\xe4\xfc\xcf\xa4\x5a\xfe\x65\xc9\xf9\x9f\x4d\xb5\xfc\xcb\x92\xf3\x3f\x97\x6a\xf9\x97\x25\xe7\x7f\x3e\xd5\xf2\x2f\x4b\xce\xff\x6b\xa9\x96\x7f\x59\x72\xfe\x5f\x4f\xb5\xfc\xcb\x92\xf3\x7f\x35\xd5\xf2\x2f\x4b\xce\xff\x1b\xa9\x96\x7f\x59\x72\xfe\xdf\x4c\xb5\xfc\xcb\x92\xf3\xff\x56\xaa\xe5\x5f\x96\x9c\xff\xb7\x53\x2d\xff\xb2\xe4\xfc\xbf\x93\x6a\xf9\x97\x25\xe7\xff\x5a\xaa\xe5\x5f\x96\x07\x9f\xff\x6f\x66\xca\x33\xff\xf9\x7b\xc4\x0c\x74\xc3\x8c\x99\x71\x33\x5d\xff\x65\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xda\xa6\x71\x39\x71\xd7\xfb\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfc\x9f\x1d\x38\x10\x00\x00\x00\x00\x00\xf2\x7f\x6d\x84\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\x2a\xec\xc0\x81\x00\x00\x00\x00\x00\x90\xff\x6b\x23\x54\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x61\xef\xee\x62\xe4\x3a\xeb\x33\x80\x9f\xfd\xb2\xd7\x4e\x20\x2e\x09\x21\x04\x43\xd6\x8e\x13\x0c\xd9\x78\x77\xfd\x95\x98\x60\x30\x9f\x4d\x43\x4b\xd3\x40\x68\x69\x43\x1d\x63\xaf\x1d\x83\xbf\xea\x5d\x43\x12\x45\xcd\xa6\x49\xdb\x20\x22\x35\x52\xb9\x48\x2f\x4a\x01\x51\x84\xd4\x56\x89\x10\x52\xa9\x94\xa2\x48\x45\x6a\xef\x9a\x2b\x50\x6e\x50\x2b\xe5\xc2\x52\x93\xca\x44\xd0\x8a\x8a\x64\xab\x33\xe7\x7d\xdf\x9d\x99\x9d\x9d\xd9\xb5\xbd\xf6\x99\x73\x7e\xbf\x28\xfe\x7b\x67\xce\xcc\xbc\x73\xe6\xcc\xec\x3e\x6b\x3d\x33\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x34\xdb\xf4\x91\xe9\x3f\x1f\xc8\xb2\x2c\xff\xbf\xf1\xc7\x86\x2c\xbb\x32\xff\xfb\xba\x6c\x5f\xfe\xe5\xdc\xee\xcb\xbd\x42\x00\x00\x00\xe0\x42\xbd\xde\xf8\xf3\xef\xaf\x4a\x27\xec\x5b\xc6\x85\x9a\xb6\xf9\xd7\x77\xfd\xfb\xf7\xe7\xe7\xe7\xe7\xb3\xcf\xbf\x76\xf6\x8d\xbf\x9c\x9f\x4f\x67\x8c\x65\xd9\xd0\xda\x2c\x6b\x9c\x17\xfd\xdb\x2f\x7f\x31\xdf\xbc\x4d\xf0\x78\x36\x3a\x30\xd8\xf4\xf5\x60\x8f\x9b\x1f\xea\x71\xfe\x70\x8f\xf3\x47\x7a\x9c\xbf\xa6\xc7\xf9\x6b\x7b\x9c\x3f\xda\xe3\xfc\x45\x3b\x60\x91\x75\xc5\xef\x63\x1a\x57\xb6\xa5\xf1\xd7\x0d\xc5\x2e\xcd\xae\xc9\x46\x1a\xe7\x6d\xe9\x70\xa9\xc7\x07\xd6\x0e\x0e\xc6\xdf\xe5\x34\x0c\x34\x2e\x33\x3f\x72\x38\x3b\x9a\x1d\xcb\xa6\xb3\xc9\x45\x97\x19\x68\xfc\x97\x65\xcf\x6f\xca\x6f\xeb\xce\x2c\xde\xd6\x60\xd3\x6d\x6d\xcc\xb2\xec\xdc\xcf\x1e\x39\x18\xd7\x30\x10\xf6\xf1\x96\xac\xe5\xc6\x1a\x9a\x1f\xbb\x57\x3f\x94\x8d\xbd\xf6\xb3\x47\x0e\x7e\x67\xf6\x95\xb7\x77\x9a\x3d\x77\xc3\xa2\x95\x66\xd9\xd6\xcd\xf9\x3a\x9f\xc8\xb2\x85\x5f\x57\x65\x03\xd9\xda\xb4\x4f\xe2\x3a\x07\x9b\xd6\xb9\xb1\xc3\x3a\x87\x5a\xd6\x39\xd0\xb8\x5c\xfe\xf7\xf6\x75\x9e\x5b\xe6\x3a\xe3\xfd\x1e\x0d\xeb\x7c\xb1\xcb\x3a\x37\x86\xd3\x1e\xbc\x31\xcb\xb2\xb9\x6c\xc9\x6d\xda\x3d\x9e\x0d\x66\xeb\xdb\x6e\x35\xed\xef\xd1\xe2\x88\xc8\xaf\x23\x7f\x28\xdf\x92\x0d\xaf\xe8\x38\xd9\xb4\x8c\xe3\x24\xbf\xcc\xcb\x37\xb6\x1e\x27\xed\xc7\x64\xdc\xff\x9b\xc2\x3e\x19\x5e\x62\x0d\xcd\x0f\xc7\xab\x8f\xad\x59\xb4\xdf\xcf\xf7\x38\xc9\xef\x75\x19\x8e\xd5\xfc\xba\xef\xce\x6f\x74\x74\xb4\xf9\x57\xab\x2d\xc7\x6a\xbe\xcd\x23\x37\x2d\x7d\x0c\x74\x7c\xec\x3a\x1c\x03\xe9\x58\x6e\x3a\x06\x36\xf7\x3a\x06\x06\xd7\x0c\x35\x8e\x81\xc1\x85\x35\x6f\x6e\x39\x06\xa6\x16\x5d\x66\x30\x1b\x68\xdc\xd6\xd9\x9b\xba\x1f\x03\x13\xb3\xc7\x4f\x4d\xcc\x3c\xf4\xf0\xad\x47\x8f\x1f\x38\x32\x7d\x64\xfa\xc4\xd4\xe4\xee\x9d\x3b\x76\xed\xdc\xb1\x6b\xd7\xc4\xe1\xa3\xc7\xa6\x27\x8b\x3f\x57\xb6\x4b\xfb\xc8\xfa\x6c\x30\x1d\x83\x9b\xc3\x6b\x4d\x3c\x06\xdf\xdd\xb6\x6d\xf3\x21\x39\xff\xcd\x8b\xf7\x3c\x18\x2d\xc9\xf3\x20\xbf\xef\x9f\xbe\x39\x5f\xd0\x95\x83\xd9\x12\xc7\x78\xbe\xcd\x13\x5b\x2f\xfc\x79\x90\xbe\xef\x37\x3d\x0f\x86\x9b\x9e\x07\x1d\x5f\x53\x3b\x3c\x0f\x86\x97\xf1\x3c\xc8\xb7\x39\xb7\x75\x79\xdf\x33\x87\x9b\xfe\xef\xb4\x86\xd5\x7a\x2d\xdc\xd0\x74\x0c\x5c\xce\xef\x87\xf9\x6d\xde\xf7\x9e\xa5\x5f\x0b\x37\x86\x75\x3d\xf9\xde\x95\x7e\x3f\x1c\x5a\x74\x0c\xc4\xbb\x35\x10\x9e\x7b\xf9\x29\xe9\xe7\xbd\xd1\xdb\xc3\x7e\x59\x7c\x5c\x5c\x9f\x9f\x71\xc5\x9a\xec\xcc\xcc\xf4\xe9\x6d\x0f\x1e\x98\x9d\x3d\x3d\x95\x85\x71\x49\x5c\xdd\xf4\x58\xb5\x1f\x2f\xeb\x9b\xee\x53\xb6\xe8\x78\x19\x5c\xf1\xf1\xb2\xef\xef\x7e\x75\xf3\xf5\x1d\x4e\xdf\x10\xf6\xd5\xe8\x2d\xdd\x1f\xab\x7c\x9b\x9d\xe3\xdd\x1f\xab\xc6\xab\x7b\xeb\xfe\x5c\x93\x15\xfb\xb3\xe5\xd4\xed\x59\x18\x17\xd9\xa5\xde\x9f\x9d\xbe\x9b\xe5\xfb\x33\x65\x89\x2e\xfb\x33\xdf\xe6\x89\x5b\x2f\xfc\x67\xc1\x94\x4b\x9a\x5e\xff\x46\x7a\xbd\xfe\x0d\x8d\x0c\x17\xaf\x7f\x43\x69\x6f\x8c\xb4\xbc\xfe\x2d\x7e\x68\x86\x1a\x2b\xcb\xb2\x73\xb7\x2e\xef\xf5\x6f\x24\xfc\x7f\xa9\x5f\xff\xae\x29\xc9\xeb\x5f\xbe\xaf\xee\xdb\xd6\xfd\x18\xc8\xb7\x79\x72\x62\xa5\xc7\xc0\x70\xd7\xd7\xbf\x1b\xc3\x1c\x08\xeb\x79\x4f\x48\x0c\xa3\x4d\xb9\xff\x8d\xc6\xf9\x73\xc5\x61\xda\xf4\x58\xf6\x3c\x6e\x86\x87\x47\xc2\x71\x33\x1c\x6f\xb1\xf5\xb8\xd9\xb1\xe8\x32\xf9\xb5\xe5\xb7\xbd\x75\xf2\xfc\x8e\x9b\xad\x37\xb6\x3e\x56\x2d\x3f\xb7\x54\xf0\xb8\xc9\xf7\xd5\xd7\x26\xbb\x1f\x37\xf9\x36\x2f\x4c\x5d\xf8\x6b\xc7\xba\xf8\xd7\xa6\xd7\x8e\x35\xbd\x8e\x81\x91\xa1\x35\xf9\x7a\x47\xd2\x41\x50\xbc\xde\xcd\xaf\x8b\xc7\xc0\xb6\xec\x60\x76\x32\x3b\x96\x1d\x4a\x97\xc9\x1f\xe5\xfc\xb6\xc6\xb7\x2f\xef\x18\x58\x13\xfe\xbf\xd4\xaf\x1d\xd7\x95\xe4\x18\xc8\xf7\xd5\x33\xdb\xbb\x1f\x03\xf9\x36\x3f\xda\x71\x71\x7f\x76\xda\x1a\x4e\x49\xdb\x34\xfd\xec\xd4\xfe\xfb\x85\xa5\x32\xff\xf5\xc3\x0b\xd7\xd7\xbe\xdb\x2e\x76\xe6\xcf\xd7\xf9\xd1\x1f\x7f\x32\x9d\xd6\x29\x43\xe4\xdb\xbc\xb2\x73\xa5\x39\xa3\xfb\x7e\xba\x25\x9c\x72\x45\x87\xfd\xd4\xfe\xfc\x59\xea\x98\x3e\x94\x5d\x9a\xfd\x74\x5d\x58\xe7\xb1\x5d\xdd\x7f\x37\x95\x6f\x73\xcd\xee\x65\x1e\x4f\xfb\xb2\x2c\x7b\x69\xea\xa5\xc6\xef\xbb\xc2\xef\x77\xbf\x77\xe6\xc7\xdf\x6f\xf9\xbd\x6f\xa7\xdf\x29\xbf\x34\xf5\xd2\x5d\x13\xf7\xfc\x64\x25\xeb\x07\x00\xe0\xfc\xbd\xd1\xf8\x73\x6e\x4d\xf1\xb3\x66\xd3\xbf\x58\x2f\xe7\xdf\xff\x01\x00\x00\x80\xbe\x10\x73\xff\x60\x98\x89\xfc\x0f\x00\x00\x00\x95\x11\x73\xff\x50\x98\x89\xfc\x0f\x00\x00\x00\x95\x11\x73\xff\x70\x98\x49\x4d\xf2\xff\x03\xb7\xef\x79\xf6\xf5\x47\xb3\xf4\x6e\x80\xf3\x41\x3c\x3f\xee\x86\xbb\x3f\x50\x6c\x17\x3b\xde\x73\xe1\xeb\xb1\xf9\x05\xf9\xe9\x1f\xfe\xf6\xc8\xb3\x5f\x79\x74\x79\xb7\x3d\x98\x65\xd9\xaf\xee\x7a\x47\xc7\xed\x1f\xf8\x40\x5c\x57\xe1\x54\x5c\xe7\xfb\x5a\x4f\x5f\xe4\xba\x1b\x96\x75\xfb\xf7\xdf\xbb\xb0\x5d\xf3\xfb\x27\x9c\xdb\x53\x5c\x7f\xbc\x3f\xcb\x3d\x0c\x62\x57\xf9\xf9\x89\xed\x8d\xeb\x1d\x7b\x68\xaa\x31\x5f\xb8\x2b\x6b\xcc\x7b\xe6\x9e\x7c\xbc\xb8\xfe\xe2\xeb\xb8\xfd\xd9\x1d\xc5\xf6\x7f\x1d\xde\xb4\x64\xdf\xe1\x81\x96\xcb\x6f\x0d\xeb\xd9\x12\xe6\x58\x78\x4f\x99\xbb\xf7\x2d\xec\x87\x7c\xc6\xcb\x3d\xbb\xf1\x5d\xff\x72\xf5\x67\x16\x6e\x2f\x5e\x6e\x60\xf3\x9b\x1b\x77\xf3\x99\x3f\x2e\xae\x37\xbe\x47\xd4\xd3\x57\x17\xdb\xc7\xfb\xbd\xd4\xfa\xff\xf9\xab\xdf\x7d\x36\xdf\xfe\xc1\x9b\x3a\xaf\xff\xd1\xc1\xce\xeb\x3f\x1b\xae\xf7\xe5\x30\x7f\xb9\xb7\xd8\xbe\x79\x9f\x7f\xa5\x69\xfd\x7f\x1a\xd6\x1f\x6f\x2f\x5e\x6e\xdb\xb7\x7e\xd8\x71\xfd\xcf\xbd\xad\xd8\xfe\xb9\x70\x5c\x7c\x23\xcc\xf6\xf5\x7f\xe8\x2f\xde\xf9\x7a\xa7\xc7\x2b\xde\xce\xbe\x3b\x8a\xcb\xc5\xdb\x9f\xfc\x9f\x9d\x8d\xcb\xc5\xeb\x8b\xd7\xdf\xbe\xfe\xd1\x47\xa7\x5a\xf6\x47\xfb\xf5\xbf\xf0\x5a\x71\x3d\x7b\xbf\xf4\xf3\xa1\xe6\xed\xe3\xe9\xf1\x76\xa2\xfb\xef\x68\x3d\xbe\x07\xc2\xe3\xdb\xd2\x23\xcf\xb2\xec\xbb\x7f\x96\xb5\xec\xe7\xec\xfd\xc5\xe5\xfe\xa9\x6d\xfd\xf1\xfa\x4e\xdd\xd1\x79\xfd\xb7\xb4\xad\xf3\xd4\xc0\x0d\x8d\xcb\x2f\xdc\x9f\x0d\x2d\xf7\xeb\xeb\x7f\xbb\xbd\xe3\xfd\x8d\xeb\xd9\xf7\x0f\x1b\x5a\xee\xcf\xd3\x1f\x0b\xfb\xef\xb5\x89\x1f\xe5\xd7\x7b\xf6\x9e\x70\x3c\x86\xf3\xff\xef\xc5\xe2\xfa\xda\xdf\xcb\xf4\xb9\x8f\xb5\xbe\xde\xc4\xed\xbf\xb1\xa1\x78\xde\xc6\xeb\x9b\x68\x5b\xff\xd3\x6d\xeb\x9f\xbb\x21\xdf\x77\xbd\xd7\x7f\xe7\x6b\xc5\xfa\x9f\xfb\xe0\xda\x96\xf5\xef\xfb\x78\x38\x9e\xee\x2c\x66\xaf\xf5\x1f\xf9\x9b\xab\x5a\x2e\xff\xcd\xef\x14\x8f\xc7\xe9\x2f\x8f\x9f\x38\x39\x73\xe6\xe8\xa1\xa6\xbd\xda\xfc\x3c\x5e\x3b\xba\x6e\xfd\x15\x57\xbe\xe9\xcd\x57\x85\xd7\xd2\xf6\xaf\xf7\x9f\x9c\x7d\x60\xfa\xf4\xd8\xe4\xd8\x64\x96\x8d\xf5\xe1\x5b\x06\xae\xf6\xfa\xbf\x15\xe6\x7f\x17\x63\xee\xe2\xdf\x42\xe1\x27\x3f\x2f\x8e\xbb\xa7\x3e\x51\x7c\xdf\x7a\xf7\x2f\x8a\xaf\x9f\x0e\xa7\xdf\x1f\x1e\xcf\xf8\xfd\xf1\xeb\x7f\x35\xd2\x72\xbc\xb6\x3f\xee\x73\x1f\x2c\xe6\x85\xae\xff\xbd\x61\x1d\xcb\xf5\xb6\xaf\xfe\xe7\x0d\xcb\xda\xf0\xec\xe7\x9e\x3f\xf3\x8f\x7f\xf2\x4a\xfb\xcf\x05\xf1\xfe\x9c\x7a\xeb\x68\xe3\xfe\x3d\xb3\xe9\xda\xc6\x79\x03\x2f\x14\xe7\xb7\xbf\x5e\xf5\xf2\x1f\x6f\x6d\x7d\x5e\xff\x74\x78\xb2\x31\x7f\x10\xf6\xeb\x7c\x78\x67\xe6\xcd\xd7\x16\xb7\xd7\x7e\xfd\xf1\xbd\x49\x9e\xfa\x54\xf1\xfc\x8d\x3f\xc9\xc5\xcb\x67\x6d\xef\x27\xb2\x61\xa8\xf5\x7e\x5c\xe8\xfa\x7f\x1a\x7e\x8e\xf9\xe1\x75\xad\xaf\x7f\xf1\xf8\xf8\xc1\xa3\x6d\xef\xe6\xbc\x21\x1b\xc8\x97\x30\x17\x5e\x1f\xb2\xb9\xe2\xfc\xb8\x55\xdc\xdf\x4f\x9d\xbb\xb6\xe3\xed\xc5\xf7\xe1\xc9\xe6\xde\xbe\x92\x65\x2e\x69\xe6\xa1\x99\x89\x63\x47\x4f\x9c\x79\x70\x62\x76\x7a\x66\x76\x62\xe6\xa1\x87\xf7\x1f\x3f\x79\xe6\xc4\xec\xfe\xc6\x7b\x97\xee\xff\x42\xaf\xcb\x2f\x3c\xbf\xd7\x37\x9e\xdf\x87\xa6\x77\xef\xcc\x1a\xcf\xf6\x93\xc5\x58\x65\x97\x7b\xfd\xa7\xee\x3d\x78\xe8\xb6\xc9\x9b\x0f\x4d\x1f\x3e\x70\xe6\xf0\xec\xbd\xa7\xa6\x4f\x1f\x39\x38\x33\x73\x70\xfa\xd0\xcc\xcd\x07\x0e\x1f\x9e\xfe\x72\xaf\xcb\x1f\x3d\xb4\x77\x6a\xfb\x9e\x1d\xb7\x6d\x1f\x3f\x72\xf4\xd0\xde\xdb\xf7\xec\xd9\xb1\x67\xfc\xe8\x89\x93\xf9\x32\x8a\x45\xf5\xb0\x7b\xf2\x8b\xe3\x27\x4e\xef\x6f\x5c\x64\x66\xef\xce\x3d\x53\xbb\x76\xed\x9c\x1c\x3f\x7e\xf2\xd0\xf4\xde\xdb\x26\x27\xc7\xcf\xf4\xba\x7c\xe3\x7b\xd3\x78\x7e\xe9\x2f\x8d\x9f\x9e\x3e\x76\x60\xf6\xe8\xf1\xe9\xf1\x99\xa3\x0f\x4f\xef\x9d\xda\xb3\x7b\xf7\xf6\x9e\xef\xfe\x78\xfc\xd4\xe1\x99\xb1\x89\xd3\x67\x4e\x4c\x9c\x99\x99\x3e\x3d\x51\xdc\x97\xb1\xd9\xc6\xc9\xf9\xf7\xbe\x5e\x97\xa7\x1e\x66\x4e\x86\xd7\xbb\x36\x03\xe1\xa7\xf3\xcf\xde\xb2\x3b\xbd\x3f\x6e\xee\xdb\x8f\x2d\x79\x55\xc5\x26\xad\x3f\x9e\x66\xaf\x86\xf7\x82\x8a\xdf\xdf\x7a\x7d\x1d\x73\xff\x48\x98\x49\x4d\xf2\x3f\x00\x00\x00\xd4\x41\xcc\xfd\xe1\x8d\xff\x17\xce\x90\xff\x01\x00\x00\xa0\x32\x62\xee\x5f\x1b\x66\x22\xff\x03\x00\x00\x40\x65\xc4\xdc\x5f\x24\xff\xd1\xf4\xf1\xef\x75\xc9\xff\x17\xab\xff\xff\x98\xfe\x7f\x83\xfe\xbf\xfe\x7f\xa6\xff\x9f\xe8\xff\xeb\xff\x67\xfa\xff\xfa\xff\x3d\xe8\xff\xeb\xff\xf7\xf3\xfa\xf5\xff\xf5\xff\xe9\xad\x6c\xfd\xff\x90\xfb\xb3\x75\x59\xe6\xdf\xff\x01\x00\x00\xa0\xa2\x62\xee\x5f\x1f\x66\x22\xff\x03\x00\x00\x40\x65\xc4\xdc\x7f\x45\x98\x89\xfc\x0f\x00\x00\x00\x95\x11\x73\xff\x95\x61\x26\x35\xc9\xff\x3e\xff\x5f\xff\x5f\xff\xbf\x5b\xff\x3f\x6e\xab\xff\x9f\xe9\xff\x97\xa1\xff\xbf\xe5\xbf\xf4\xff\x17\xd1\xff\xd7\xff\xcf\xf4\xff\xcf\xdb\xe5\xee\xcf\xf7\xfb\xfa\x4b\xd8\xff\x5f\xa7\xff\x4f\xd9\xac\x42\xff\x7f\x6d\xf3\x89\x2b\xed\xff\xc7\xdc\xff\xa6\x30\x93\x9a\xe4\x7f\x00\x00\x00\xa8\x83\x98\xfb\xdf\x1c\x66\x22\xff\x03\x00\x00\x40\x65\xc4\xdc\x7f\x55\x98\x89\xfc\x0f\x00\x00\x00\x95\x11\x73\xff\x86\x30\x93\x9a\xe4\x7f\xfd\x7f\xfd\x7f\xfd\x7f\x9f\xff\xaf\xff\xdf\x37\xfd\x7f\x9f\xff\xdf\x81\xfe\xbf\xfe\x7f\xa6\xff\x7f\xde\x2e\x77\x7f\xbe\xdf\xd7\x5f\xc2\xfe\xbf\xcf\xff\xa7\x74\xca\xf6\xf9\xff\x31\xf7\xff\x5a\x98\x49\x4d\xf2\x3f\x00\x00\x00\xd4\x41\xcc\xfd\x6f\x09\x33\x91\xff\x01\x00\x00\xa0\x32\x62\xee\xbf\x3a\xcc\x44\xfe\x07\x00\x00\x80\xca\x88\xb9\xff\x9a\x30\x93\x9a\xe4\xff\x7a\xf6\xff\x5f\xce\xb2\x4c\xff\x3f\xd3\xff\xd7\xff\x6f\x5b\xa7\xfe\xbf\xfe\xff\x6a\xd0\xff\xd7\xff\xef\x46\xff\x5f\xff\xbf\x9f\xd7\xaf\xff\xaf\xff\x4f\x6f\x65\xeb\xff\xc7\xdc\xff\xd6\x30\x93\x9a\xe4\x7f\x00\x00\x00\xa8\x83\x98\xfb\xaf\x0d\x33\x91\xff\x01\x00\x00\xa0\x32\x62\xee\x7f\x5b\x98\x89\xfc\x0f\x00\x00\x00\x95\x11\x73\xff\x75\x61\x26\x35\xc9\xff\xf5\xec\xff\xfb\xfc\x7f\xfd\xff\x82\xfe\x7f\xeb\x3a\xf5\xff\xf5\xff\x57\x83\xfe\xbf\xfe\x7f\x37\xfa\xff\xfa\xff\xfd\xbc\x7e\xfd\x7f\xfd\x7f\x7a\x2b\x5b\xff\x3f\xe6\xfe\xb7\x87\x99\xd4\x24\xff\x03\x00\x00\x40\x1d\xc4\xdc\x7f\x7d\x98\x89\xfc\x0f\x00\x00\x00\x95\x11\x73\xff\x3b\xc2\x4c\xe4\x7f\x00\x00\x00\xa8\x8c\x98\xfb\x37\x86\x99\xd4\x24\xff\xeb\xff\xeb\xff\xeb\xff\xeb\xff\xeb\xff\xeb\xff\xaf\xa6\xfe\xea\xff\x0f\x2e\x79\x8e\xfe\x7f\x41\xff\xbf\xd5\xc5\xeb\xff\xcf\x2d\x2c\x40\xff\xbf\x6f\xd6\xaf\xff\xaf\xff\x4f\x6f\x65\xeb\xff\xc7\xdc\xff\xce\x30\x93\x9a\xe4\x7f\x00\x00\x00\xa8\x83\x98\xfb\xdf\x15\x66\x22\xff\x03\x00\x00\x40\x65\xc4\xdc\x7f\x43\x98\x89\xfc\x0f\x00\x00\x00\x95\x11\x73\xff\x58\x98\x49\x4d\xf2\xbf\xfe\xbf\xfe\xbf\xfe\xbf\xfe\xbf\xfe\xbf\xfe\xff\x6a\xea\xaf\xfe\xff\xd2\xf4\xff\x0b\xfa\xff\xad\x7c\xfe\xbf\xfe\xbf\xfe\xbf\xfe\x3f\xdd\x95\xad\xff\x1f\x73\xff\xa6\x30\x93\x9a\xe4\x7f\x00\x00\x00\xa8\x83\x98\xfb\x37\x87\x99\xc8\xff\x00\x00\x00\x50\x19\x31\xf7\xdf\x18\x66\x22\xff\x03\x00\x00\x40\x65\xc4\xdc\xbf\x25\xcc\xa4\x26\xf9\x5f\xff\x5f\xff\x5f\xff\x5f\xff\x5f\xff\x5f\xff\x7f\x35\xe9\xff\xeb\xff\x77\xa3\xff\xaf\xff\xdf\xcf\xeb\xd7\xff\xd7\xff\xa7\xb7\xb2\xf5\xff\x63\xee\xbf\x29\xcc\xa4\x26\xf9\x1f\x00\x00\x00\xea\x20\xe6\xfe\x9b\xc3\x4c\xe4\x7f\x00\x00\x00\xa8\x8c\x98\xfb\xdf\x1d\x66\x22\xff\x03\x00\x00\x40\x65\xc4\xdc\xbf\x35\xcc\xa4\x26\xf9\x5f\xff\x5f\xff\x5f\xff\xbf\x8f\xfb\xff\x43\xfa\xff\x99\xfe\x7f\xe9\xe9\xff\xeb\xff\x77\xa3\xff\xaf\xff\xdf\xcf\xeb\xd7\xff\xd7\xff\xa7\xb7\xb2\xf5\xff\x63\xee\x7f\x4f\x98\x49\x4d\xf2\x3f\x00\x00\x00\xd4\x41\xcc\xfd\xef\x0d\x33\x91\xff\x01\x00\x00\xa0\x32\x62\xee\xbf\x25\xcc\x44\xfe\x07\x00\x00\x80\xca\x88\xb9\x7f\x3c\xcc\xa4\x26\xf9\x5f\xff\x5f\xff\x5f\xff\xbf\x8f\xfb\xff\x3e\xff\xbf\x65\xfd\xfa\xff\xe5\xa4\xff\xaf\xff\xdf\x8d\xfe\xbf\xfe\x7f\x3f\xaf\x5f\xff\x5f\xff\x9f\xde\xca\xd6\xff\x8f\xb9\xff\xd6\x30\x93\x9a\xe4\x7f\x00\x00\x00\xa8\x83\x98\xfb\xb7\x85\x99\xc8\xff\x00\x00\x00\x50\x19\x31\xf7\x4f\x84\x99\xc8\xff\x00\x00\x00\x50\x19\x31\xf7\x4f\x86\x99\xd4\x24\xff\xeb\xff\xeb\xff\xeb\xff\xeb\xff\xeb\xff\xeb\xff\xaf\x26\xfd\x7f\xfd\xff\x6e\xf4\xff\xf5\xff\xfb\x79\xfd\xfa\xff\xfa\xff\xf4\x56\xb6\xfe\x7f\xcc\xfd\x53\x61\x26\x35\xc9\xff\x00\x00\x00\x50\x07\x31\xf7\x6f\x0f\x33\x91\xff\x01\x00\x00\xa0\x32\x62\xee\xdf\x11\x66\x22\xff\x03\x00\x00\x40\x65\xc4\xdc\xbf\x33\xcc\xa4\x26\xf9\xbf\x4f\xfa\xff\xdb\x52\x01\x4a\xff\x5f\xff\x5f\xff\x5f\xff\x5f\xff\xbf\xaf\xe8\xff\xeb\xff\x77\xa3\xff\xaf\xff\xdf\xcf\xeb\xd7\xff\xd7\xff\xa7\xd5\x60\x87\xd3\xca\xd6\xff\x8f\xb9\x7f\x57\x98\x49\x4d\xf2\x3f\x00\x00\x00\xd4\x41\xcc\xfd\xbb\xc3\x4c\xe4\x7f\x00\x00\x00\xa8\x8c\x98\xfb\x6f\x0b\x33\x91\xff\x01\x00\x00\xa0\x32\x62\xee\xbf\x3d\xcc\xa4\x26\xf9\xbf\x4f\xfa\xff\x3e\xff\x5f\xff\x5f\xff\xbf\x89\xfe\xbf\xfe\x7f\x3f\xd1\xff\x2f\x69\xff\x7f\xa0\xc7\x4d\xe9\xff\x2f\x8b\xfe\xbf\xfe\xbf\xfe\xbf\xfe\x3f\xdd\x95\xad\xff\x1f\x73\xff\x9e\x30\x93\x9a\xe4\x7f\x00\x00\x00\xa8\x83\x98\xfb\xdf\x17\x66\x22\xff\x03\x00\x00\x40\x65\xc4\xdc\x7f\x47\x98\x89\xfc\x0f\x00\x00\x00\x7d\xa5\xd3\xe7\x10\x46\x31\xf7\xbf\x3f\xcc\xa4\x26\xf9\x5f\xff\xbf\xea\xfd\xff\xf9\xb5\xfa\xff\xfa\xff\xfa\xff\xdd\xd7\xaf\xff\xbf\xba\xf4\xff\x4b\xda\xff\xef\x45\xff\x7f\x59\xf4\xff\xf5\xff\xf5\xff\xf5\xff\xe9\xae\x6c\xfd\xff\x98\xfb\xf7\x86\x99\xd4\x24\xff\x03\x00\x00\x40\x1d\xc4\xdc\xff\x81\x30\x13\xf9\x1f\x00\x00\x00\x2a\x23\xe6\xfe\x0f\x86\x99\xc8\xff\x00\x00\x00\x50\x19\x31\xf7\xef\x0b\x33\xa9\x49\xfe\xd7\xff\xaf\x7a\xff\xdf\xe7\xff\xeb\xff\xeb\xff\xf7\x5a\xbf\xfe\xff\xea\xd2\xff\xd7\xff\xef\x46\xff\xbf\x3f\xfb\xff\xe1\xc7\x16\xfd\xff\x12\xf5\xff\xf3\x63\x48\xff\x9f\x32\x2a\x5b\xff\x3f\xe6\xfe\x0f\x85\x99\xd4\x24\xff\x03\x00\x00\x40\x1d\xc4\xdc\xff\xe1\x30\x13\xf9\x1f\x00\x00\x00\x2a\x23\xe6\xfe\x8f\x84\x99\xc8\xff\x00\x00\x00\x50\x19\x31\xf7\x7f\x34\xcc\xa4\x26\xf9\x5f\xff\x5f\xff\x5f\xff\x5f\xff\x5f\xff\x5f\xff\x7f\x35\xe9\xff\xaf\x5a\xff\xbf\xf1\x52\xa8\xff\x5f\xd0\xff\x3f\x3f\x2b\xe9\xcf\xaf\xe9\x70\x79\xfd\xff\xf2\xf4\xff\x7d\xfe\x3f\x65\x55\xb6\xfe\x7f\xcc\xfd\x1f\x0b\x33\xa9\x49\xfe\x07\x00\x00\x80\x3a\x88\xb9\xff\xe3\x61\x26\xf2\x3f\x00\x00\x00\x54\x46\xcc\xfd\xbf\x1e\x66\x22\xff\x03\x00\x00\x40\x65\xc4\xdc\x7f\x67\x98\x49\x4d\xf2\xbf\xfe\xbf\xfe\xbf\xfe\xbf\xfe\xbf\xfe\xbf\xfe\xff\x6a\xd2\xff\x5f\x59\xff\xff\x7f\x57\xd8\x3f\xd7\xff\x2f\xe8\xff\x9f\x9f\xcb\xdd\x9f\xef\xf7\xf5\xeb\xff\xeb\xff\xd3\x5b\xd9\xfa\xff\x31\xf7\xff\x46\x98\x49\x4d\xf2\x3f\x00\x00\x00\xd4\x41\xcc\xfd\x77\x85\x99\xc8\xff\x00\x00\x00\x50\x19\x31\xf7\x7f\x22\xcc\x44\xfe\x07\x00\x00\x80\x3e\xd3\xe9\x13\x4b\x0b\x31\xf7\xff\x66\x98\x49\x4d\xf2\x7f\xff\xf5\xff\xc7\xfa\xb2\xff\x3f\x98\xae\x5f\xff\x5f\xff\x5f\xff\x5f\xff\x5f\xff\xff\x62\xaa\x5a\xff\x7f\xa5\xeb\xd2\xff\x2f\xe8\xff\x9f\x9f\xcb\xdd\x9f\xef\xf7\xf5\xeb\xff\xeb\xff\xd3\x5b\xd9\xfa\xff\x31\xf7\xff\x56\x98\x49\x4d\xf2\x3f\x00\x00\x00\xd4\x41\xcc\xfd\x9f\x0c\x33\x91\xff\x01\x00\x00\xa0\x32\x62\xee\xff\xed\x30\x13\xf9\x1f\x00\x00\x00\x2a\x23\xe6\xfe\xbb\xc3\x4c\x6a\x92\xff\x2f\x76\xff\xbf\xfd\xf2\xdd\xf8\xfc\x7f\xfd\xff\x4c\xff\x5f\xff\x5f\xff\x5f\xff\xff\x02\xe9\xff\xeb\xff\x67\xfa\xff\xe7\xed\x72\xf7\xe7\xfb\x7d\xfd\xfa\xff\xfa\xff\xf4\x56\xb6\xfe\x7f\xcc\xfd\xbf\x13\x66\x52\x93\xfc\x0f\x00\x00\x00\x75\x10\x73\xff\x3d\x61\x26\xf2\x3f\x00\x00\x00\x94\xd4\x03\x2b\xbe\x44\xcc\xfd\x9f\x0a\x33\x91\xff\x01\x00\x00\xa0\x32\x62\xee\xff\x74\x98\x49\x4d\xf2\x7f\xff\x7d\xfe\xbf\xfe\xbf\xfe\xbf\xfe\xbf\xfe\xbf\xfe\x7f\x3f\xd1\xff\xd7\xff\xef\x46\xff\x5f\xff\xbf\x9f\xd7\xaf\xff\xaf\xff\x4f\x6f\x65\xeb\xff\xc7\xdc\x7f\x6f\x98\x49\x4d\xf2\x3f\x00\x00\x00\xd4\x41\xcc\xfd\x9f\x09\x33\x91\xff\x01\x00\x00\xa0\x32\x62\xee\xff\xdd\x30\x13\xf9\x1f\x00\x00\x00\x2a\x23\xe6\xfe\xdf\x0b\x33\xa9\x49\xfe\xd7\xff\xd7\xff\xd7\xff\xd7\xff\xd7\xff\xd7\xff\x5f\x4d\xfa\xff\x8b\xfb\xff\xf9\x6b\x98\xfe\x7f\x41\xff\x5f\xff\xbf\x9f\xd7\xaf\xff\xaf\xff\x4f\x6f\x65\xeb\xff\xc7\xdc\xff\xd9\x30\x93\x9a\xe4\x7f\x00\x00\x00\xa8\x83\x98\xfb\x7f\x3f\xcc\x44\xfe\x07\x00\x00\x80\xca\x88\xb9\xff\x0f\xc2\x4c\xe4\x7f\x00\x00\x00\xa8\x8c\x98\xfb\xef\x0b\x33\xa9\x49\xfe\xd7\xff\xd7\xff\xd7\xff\xd7\xff\xd7\xff\xd7\xff\x5f\x4d\xfa\xff\x3e\xff\xbf\x1b\xfd\x7f\xfd\xff\x7e\x5e\xbf\xfe\xbf\xfe\x3f\xbd\x95\xad\xff\x1f\x73\xff\xe7\xc2\x4c\x6a\x92\xff\x01\x00\x00\xa0\x0e\x62\xee\xff\xc3\x30\x13\xf9\x1f\x00\x00\x00\x2a\x23\xe6\xfe\xfd\x61\x26\xf2\x3f\x00\x00\x00\x54\x46\xcc\xfd\xf7\x87\x99\xd4\x24\xff\xeb\xff\x97\xb7\xff\xff\x35\xfd\x7f\xfd\x7f\xfd\xff\x96\xfd\xa9\xff\xaf\xff\xdf\x89\xfe\xbf\xfe\x7f\xa6\xff\x7f\xde\x2e\x77\x7f\xbe\xdf\xd7\xaf\xff\xaf\xff\x4f\x6f\x65\xeb\xff\xc7\xdc\x7f\x20\xcc\x64\x5f\xeb\xcd\x00\x00\x00\x00\xfd\x2b\xe6\xfe\xcf\x87\x99\xd4\xe4\xdf\xff\x01\x00\x00\xa0\x0e\x62\xee\x3f\x18\x66\x22\xff\x03\x00\x00\x40\x65\xc4\xdc\x7f\x28\xcc\xa4\x26\xf9\x5f\xff\xbf\xbc\xfd\x7f\x9f\xff\xaf\xff\x7f\xe9\xfb\xff\xd9\xa0\xfe\xff\xc2\xe9\xfa\xff\x17\x87\xfe\xbf\xfe\x7f\x37\xfa\xff\xfa\xff\xfd\xbc\x7e\xfd\x7f\xfd\x7f\x7a\x2b\x5b\xff\x3f\xe6\xfe\xe9\x30\x93\x9a\xe4\x7f\x00\x00\x00\xa8\x83\x98\xfb\x0f\x87\x99\xc8\xff\x00\x00\x00\x50\x19\x31\xf7\x1f\x09\x33\x91\xff\x01\x00\x00\xa0\x32\x62\xee\x7f\x20\xcc\xa4\x26\xf9\x5f\xff\x5f\xff\x5f\xff\xbf\xb6\xfd\xff\x17\xbf\xd7\xb6\x4e\x9f\xff\xaf\xff\xbf\x1a\xf4\xff\xf5\xff\xbb\xd1\xff\xd7\xff\xbf\xd0\xf5\xaf\x8d\x7f\xd7\xff\xd7\xff\xa7\x94\xca\xd6\xff\x8f\xb9\xff\x68\x98\x49\x4d\xf2\x3f\x00\x00\x00\xd4\x41\xcc\xfd\x5f\x08\x33\x91\xff\x01\x00\x00\xa0\x32\x62\xee\xff\x62\x98\x89\xfc\x0f\x00\x00\x00\x95\x11\x73\xff\xb1\x30\x93\x9a\xe4\x7f\xfd\x7f\xfd\x7f\xfd\xff\xda\xf6\xff\x3b\x7c\xfe\x7f\x87\xfe\xff\xba\x85\xdb\xd5\xff\xd7\xff\x3f\x1f\xfa\xff\xfa\xff\xdd\xe8\xff\xeb\xff\xf7\xf3\xfa\xf5\xff\xf5\xff\xe9\xad\x6c\xfd\xff\x98\xfb\x8f\x87\x99\xd4\x24\xff\x03\x00\x00\x40\x1d\xc4\xdc\x7f\x22\xcc\x44\xfe\x07\x00\x00\x80\xca\x88\xb9\xff\x64\x98\x89\xfc\x0f\x00\x00\x00\x95\x11\x73\xff\xa9\x30\x93\x9a\xe4\x7f\xfd\xff\x95\xf5\xff\x07\x96\xe8\x06\xea\xff\x77\x5e\xbf\xfe\x7f\x05\xfa\xff\x4d\x96\xdb\xff\x8f\x05\x66\xfd\x7f\xfd\xff\x4c\xff\x5f\xff\xbf\x07\xfd\x7f\xfd\xff\x7e\x5e\xbf\xfe\xbf\xfe\x3f\xbd\x95\xad\xff\x1f\x73\xff\x1f\x85\x99\xd4\x24\xff\x03\x00\x00\x40\x1d\xc4\xdc\x7f\x3a\xcc\x44\xfe\x07\x00\x00\x80\xca\x88\xb9\x7f\x26\xcc\x44\xfe\x07\x00\x00\x80\xca\x88\xb9\x7f\x36\xcc\xa4\x26\xf9\x5f\xff\xdf\xe7\xff\xeb\xff\xeb\xff\x5f\xec\xfe\x7f\xa4\xff\xaf\xff\xff\xff\xec\xdd\xe7\x92\x66\x65\xd5\xc7\xe1\x87\x81\xc1\xa1\x2c\xab\x3c\x04\x4e\xc1\x23\xd0\x33\xf0\xab\x5f\xad\xf2\x08\xac\x32\x27\x30\x63\x56\x8c\x88\x59\xcc\x09\xb3\x62\xce\x39\xe7\x9c\x33\x8a\x39\x56\x61\xd1\xbd\xd6\xc2\x6e\xbb\xf7\xee\x9e\xe9\xa7\x7b\xef\x7b\x5d\xd7\x07\xd6\xfb\x0e\x50\xdc\x38\xa3\xd6\xbf\xf0\x57\x7b\xa3\xff\xd7\xff\xcf\xd0\xff\xeb\xff\xd7\xfc\x7e\xfd\xbf\xfe\x9f\x79\x4b\xeb\xff\x73\xf7\x3f\x20\x6e\x69\xb2\xff\x01\x00\x00\xa0\x83\xdc\xfd\x0f\x8c\x5b\xec\x7f\x00\x00\x00\x18\x46\xee\xfe\x07\xc5\x2d\xf6\x3f\x00\x00\x00\x0c\x23\x77\xff\x83\xe3\x96\x26\xfb\x5f\xff\xaf\xff\xd7\xff\xeb\xff\xf5\xff\xfa\xff\x6d\xd2\xff\xeb\xff\xa7\xe8\xff\xf5\xff\x6b\x7e\xbf\xfe\xff\xf8\xfd\xff\x95\xfb\xfe\x33\x85\xf1\x2d\xad\xff\xcf\xdd\xff\x90\xb8\xa5\xc9\xfe\x07\x00\x00\x80\x0e\x72\xf7\x3f\x34\x6e\xb1\xff\x01\x00\x00\x60\x18\xb9\xfb\x1f\x16\xb7\xd8\xff\x00\x00\x00\x30\x8c\xdc\xfd\x0f\x8f\x5b\x9a\xec\x7f\xfd\xbf\xfe\x5f\xff\xaf\xff\xd7\xff\xeb\xff\xb7\x49\xff\xaf\xff\x9f\xa2\xff\xd7\xff\xaf\xf9\xfd\xfa\x7f\xdf\xff\x67\xde\xd2\xfa\xff\xdc\xfd\x8f\x88\x5b\x9a\xec\x7f\x00\x00\x00\xe8\x20\x77\xff\x23\xe3\x16\xfb\x1f\x00\x00\x00\x86\x91\xbb\xff\x51\x71\x8b\xfd\x0f\x00\x00\x00\xc3\xc8\xdd\x7f\x4d\xdc\xd2\x64\xff\xeb\xff\xf5\xff\xfa\xff\x15\xf6\xff\x57\xe8\xff\xf5\xff\xeb\xa1\xff\xd7\xff\x4f\xd1\xff\xeb\xff\xd7\xfc\x7e\xfd\xbf\xfe\x9f\x79\x4b\xeb\xff\x73\xf7\x5f\x1b\xb7\x34\xd9\xff\x00\x00\x00\xd0\x41\xee\xfe\x47\xc7\x2d\xf6\x3f\x00\x00\x00\x0c\x23\x77\xff\x63\xe2\x16\xfb\x1f\x00\x00\x00\x86\x91\xbb\xff\xb1\x71\x4b\x93\xfd\xaf\xff\xd7\xff\xeb\xff\x57\xd8\xff\xfb\xfe\xbf\xfe\x7f\x45\xf4\xff\xfa\xff\x29\xfa\x7f\xfd\xff\x9a\xdf\xaf\xff\xd7\xff\x33\x6f\x69\xfd\x7f\xee\xfe\xc7\xc5\x2d\x4d\xf6\x3f\x00\x00\x00\x74\x90\xbb\xff\xf1\x71\x8b\xfd\x0f\x00\x00\x00\xc3\xc8\xdd\xff\x84\xb8\xc5\xfe\x07\x00\x00\x80\x61\xe4\xee\x7f\x62\xdc\xd2\x64\xff\xeb\xff\xf5\xff\xfa\x7f\xfd\xbf\xfe\x5f\xff\xbf\x4d\xfa\x7f\xfd\xff\x14\xfd\xbf\xfe\x7f\xcd\xef\xd7\xff\xeb\xff\x99\xb7\xf5\xfe\xff\xde\xd7\xed\xdc\xa3\xf6\xff\xb9\xfb\xaf\x8b\x5b\x9a\xec\x7f\x00\x00\x00\xe8\x20\x77\xff\x93\xe2\x16\xfb\x1f\x00\x00\x00\x86\x91\xbb\xff\xc9\x71\x8b\xfd\x0f\x00\x00\x00\xc3\xc8\xdd\xff\x94\xb8\xa5\xc9\xfe\xd7\xff\xeb\xff\xef\xec\xff\x6f\xbf\x4c\xff\xaf\xff\xd7\xff\xdf\xf9\xe3\xfa\xff\x93\xa1\xff\xd7\xff\x4f\xd1\xff\xeb\xff\xd7\xfc\x7e\xfd\xbf\xfe\x9f\x79\x5b\xef\xff\x67\x7a\xff\xfd\xff\x7f\xee\xfe\xa7\xc6\x2d\x4d\xf6\x3f\x00\x00\x00\x74\x90\xbb\xff\x69\x71\x8b\xfd\x0f\x00\x00\x00\xc3\xc8\xdd\xff\xf4\xb8\xc5\xfe\x07\x00\x00\x80\x61\xe4\xee\x7f\x46\xdc\xd2\x64\xff\xeb\xff\xf5\xff\xbe\xff\xaf\xff\xd7\xff\xeb\xff\xb7\x49\xff\xbf\xd8\xfe\x7f\xff\xbf\xf5\xf6\xd2\xff\x1f\x89\xfe\x5f\xff\x7f\x58\xff\x7f\xcf\x23\xbc\x5f\xff\x4f\x07\x4b\xeb\xff\x73\xf7\x3f\x33\x6e\x69\xb2\xff\x01\x00\x00\xa0\x83\xdc\xfd\xcf\x8a\x5b\xec\x7f\x00\x00\x00\x18\x46\xee\xfe\xeb\xe3\x16\xfb\x1f\x00\x00\x00\x86\x91\xbb\xff\xd9\x71\x4b\x93\xfd\xaf\xff\xd7\xff\xeb\xff\xf5\xff\x7b\xfb\xff\x73\x2d\xfb\xff\x3b\x7e\x4c\xff\xbf\x1d\xfa\xff\xc5\xf6\xff\xd3\xf4\xff\x47\xa2\xff\xd7\xff\xfb\xfe\xbf\xfe\x9f\x69\x4b\xeb\xff\x73\xf7\x3f\x27\x6e\x69\xb2\xff\x01\x00\x00\xa0\x83\xdc\xfd\xcf\x8d\x5b\xec\x7f\x00\x00\x00\x18\x46\xee\xfe\xe7\xc5\x2d\xf6\x3f\x00\x00\x00\x0c\x23\x77\xff\xf3\xe3\x96\x26\xfb\x5f\xff\xaf\xff\xd7\xff\xeb\xff\x2f\xe9\xfb\xff\x97\x8f\xd1\xff\xfb\xfe\xff\xf6\xac\xac\xff\xbf\xf2\xb0\xdf\xa1\xff\xdf\xa5\xff\xdf\x4b\xff\xaf\xff\xd7\xff\xeb\xff\x99\xb6\xb4\xfe\x3f\x77\xff\x0b\xe2\x96\x26\xfb\x1f\x00\x00\x00\x86\x77\x6e\x53\xbb\xff\x86\xb8\xc5\xfe\x07\x00\x00\x80\x61\xe4\xee\x7f\x61\xdc\x62\xff\x03\x00\x00\xc0\x30\x72\xf7\xdf\x18\xb7\x34\xd9\xff\xfa\x7f\xfd\xbf\xfe\x5f\xff\x7f\x49\xfd\xff\x20\xdf\xff\xd7\xff\x6f\xcf\xca\xfa\xff\x43\xe9\xff\x77\x9d\x55\xff\xbf\xd1\xff\xd7\xdf\x8b\xfe\x7f\x39\xef\xd7\xff\xeb\xff\x99\xb7\xb4\xfe\x3f\x77\xff\x8b\xe2\x96\x26\xfb\x1f\x00\x00\x00\x3a\xc8\xdd\xff\xe2\xb8\xc5\xfe\x07\x00\x00\x80\x61\xe4\xee\x7f\x49\xdc\x62\xff\x03\x00\x00\xc0\x30\x72\xf7\xbf\x34\x6e\x69\xb2\xff\xf5\xff\xfa\x7f\xfd\xbf\xfe\x5f\xff\xaf\xff\xdf\x26\xfd\xbf\xfe\x7f\x8a\xef\xff\xeb\xff\xd7\xfc\x7e\xfd\xbf\xfe\x9f\x79\x4b\xeb\xff\x73\xf7\xbf\x2c\x6e\x69\xb2\xff\x01\x00\x00\x60\x00\xe7\xe7\xfe\x80\xdc\xfd\x2f\x8f\x5b\xec\x7f\x00\x00\x00\x18\x46\xee\xfe\x57\xc4\x2d\xf6\x3f\x00\x00\x00\x0c\x23\x77\xff\x2b\xe3\x96\xfd\xfb\xff\xdc\x69\xbe\xea\xf4\xe8\xff\xf5\xff\xfa\x7f\xfd\xbf\xfe\x5f\xff\xbf\x4d\xfa\x7f\xfd\xff\x14\xfd\xff\xc1\xfd\xff\x85\x43\xfe\x7a\x43\xf5\xff\x37\xdc\xb8\xee\xf7\xeb\xff\xf5\xff\x1c\xc9\xd2\xfa\xff\xdc\xfd\x37\xc5\x2d\xfe\xf9\x3f\x00\x00\x00\x0c\x23\x77\xff\xab\xe2\x16\xfb\x1f\x00\x00\x00\x86\x91\xbb\xff\xd5\x71\x8b\xfd\x0f\x00\x00\x00\xc3\xc8\xdd\xff\x9a\xb8\xa5\xc9\xfe\x3f\xac\xff\xbf\xed\xae\xbb\xbf\x5f\xff\x7f\x34\xfa\xff\x83\xdf\xaf\xff\xd7\xff\xeb\xff\xf5\xff\xcb\xee\xff\xf7\xff\x6a\x38\x9c\xfe\x7f\x97\xfe\x7f\x2f\xdf\xff\xf7\xfd\x7f\xfd\xbf\xfe\x9f\x69\x4b\xeb\xff\x73\xf7\xbf\x36\x6e\x69\xb2\xff\x01\x00\x00\xa0\x83\xdc\xfd\xaf\x8b\x5b\xec\x7f\x00\x00\x00\x18\x46\xee\xfe\xd7\xc7\x2d\xf6\x3f\x00\x00\x00\x0c\x23\x77\xff\x1b\xe2\x96\x26\xfb\xff\xe4\xbf\xff\x7f\xb5\xfe\x5f\xff\xaf\xff\x8f\xab\xff\xd7\xff\xeb\xff\x97\xde\xff\x1f\x9d\xfe\x7f\x97\xfe\x7f\x2f\xfd\xbf\xfe\x5f\xff\xaf\xff\x67\xda\xd2\xfa\xff\xdc\xfd\x6f\x8c\x5b\x9a\xec\x7f\x00\x00\x00\xe8\x20\x77\xff\x9b\xe2\x16\xfb\x1f\x00\x00\x00\x86\x91\xbb\xff\xcd\x71\x8b\xfd\x0f\x00\x00\x00\xc3\xc8\xdd\xff\x96\xb8\xa5\xc9\xfe\x3f\xf9\xfe\xdf\xf7\xff\xf5\xff\xc7\xec\xff\xcf\xe9\xff\x93\xfe\x3f\x7e\x5e\xf5\xff\xfa\xff\x63\xd0\xff\xeb\xff\x37\xfa\xff\x8b\x76\xd6\xfd\xfc\xda\xdf\xaf\xff\xd7\xff\x33\x6f\x69\xfd\x7f\xee\xfe\x9b\x77\xa6\x5e\xbf\xfd\x0f\x00\x00\x00\x1d\xdc\xbc\xf3\xdb\x0b\x9b\xb7\xc6\x2d\xf6\x3f\x00\x00\x00\x0c\x23\x77\xff\xdb\xe2\x16\xfb\x1f\x00\x00\x00\x86\x91\xbb\xff\xed\x71\x4b\x93\xfd\xaf\xff\xd7\xff\x9f\x79\xff\xef\xfb\xff\x45\xff\x1f\x3f\xaf\xfa\x7f\xfd\xff\x31\xe8\xff\xf5\xff\x1b\xfd\xff\x45\x3b\xeb\x7e\x7e\xed\xef\xd7\xff\xeb\xff\x99\xb7\xb4\xfe\x3f\x77\xff\x3b\xe2\x96\x26\xfb\x1f\x00\x00\x00\x3a\xc8\xdd\xff\xce\xb8\xc5\xfe\x07\x00\x00\x80\x61\xc4\xee\xdf\xfd\x1f\xbf\xdb\xff\x00\x00\x00\x30\xa4\x77\xed\xfc\xf6\xc2\xe6\xdd\x71\x4b\x93\xfd\xdf\xb8\xff\xbf\xfa\x52\xfb\xff\xab\xfe\xe7\xff\xd6\xff\x1f\xfc\x7e\xfd\xff\x89\xf4\xff\x37\xef\xff\xb5\xa7\xff\xd7\xff\xaf\x89\xfe\x5f\xff\x3f\x45\xff\xaf\xff\x5f\xf3\xfb\x97\xd3\xff\xc7\x0f\x5c\xa3\xff\x67\x79\x96\xd6\xff\xe7\xee\x7f\x4f\xdc\xd2\x64\xff\x03\x00\x00\x40\x07\xb9\xfb\xdf\x1b\xb7\xd8\xff\x00\x00\x00\x30\x8c\xdc\xfd\xb7\xc4\x2d\xf6\x3f\x00\x00\x00\x0c\x23\x77\xff\xfb\xe2\x96\x26\xfb\xbf\x71\xff\x3f\xc8\xf7\xff\xef\x7b\x6b\xbc\x40\xff\x3f\x6e\xff\xef\xfb\xff\x71\xf5\xff\xfa\xff\x83\xe8\xff\xf5\xff\x1b\xfd\xff\x45\x3b\xeb\x7e\x7e\xed\xef\x5f\x4e\xff\xef\xfb\xff\x2c\xd7\xd2\xfa\xff\xdc\xfd\xef\x8f\x5b\x9a\xec\x7f\x00\x00\x00\xe8\x20\x77\xff\x07\xe2\x16\xfb\x1f\x00\x00\x00\x86\x91\xbb\xff\x83\x71\x8b\xfd\x0f\x00\x00\x00\xc3\xc8\xdd\xff\xa1\xb8\xa5\xc9\xfe\xd7\xff\xaf\xbd\xff\xf7\xfd\x7f\xfd\xbf\xfe\x5f\xff\xbf\x6c\xfa\x7f\xfd\xff\x14\xfd\xbf\xfe\x7f\xcd\xef\xd7\xff\xeb\xff\x99\xb7\xb4\xfe\x3f\x77\xff\x87\xe3\x96\x26\xfb\x1f\x00\x00\x00\x3a\xc8\xdd\xff\x91\xb8\xc5\xfe\x07\x00\x00\x80\x61\xe4\xee\xff\x68\xdc\x62\xff\x03\x00\x00\xc0\x30\x72\xf7\x7f\x2c\x6e\x69\xb2\xff\xf5\xff\xfa\xff\x6d\xf5\xff\x77\xfc\x45\xf4\xff\x4d\xfa\xff\x6b\xf5\xff\x1b\xfd\xff\xa1\xf4\xff\xfa\xff\x29\xfa\x7f\xfd\xff\x9a\xdf\xaf\xff\xd7\xff\x33\x6f\x69\xfd\x7f\xee\xfe\x8f\xc7\x2d\x4d\xf6\x3f\x00\x00\x00\x74\x90\xbb\xff\x13\x71\x8b\xfd\x0f\x00\x00\x00\xc3\xc8\xdd\xff\xc9\xb8\xc5\xfe\x07\x00\x00\x80\x61\xe4\xee\xff\x54\xdc\x70\x8f\xbb\x9d\xdd\x93\x4e\xd6\xf9\x43\x7e\x3c\x7a\x73\xfd\xbf\xfe\xdf\xf7\xff\x57\xd6\xff\xdf\x7d\x81\xfd\xbf\xef\xff\xef\xd0\xff\x1f\x4c\xff\xaf\xff\x9f\xa2\xff\xd7\xff\xaf\xf9\xfd\xfa\x7f\xfd\x3f\xf3\x96\xd6\xff\xe7\xee\xff\x74\xdc\xe2\x9f\xff\x03\x00\x00\xc0\x30\x72\xf7\x7f\x26\x6e\xb1\xff\x01\x00\x00\x60\x18\xb9\xfb\x3f\x1b\xb7\xd8\xff\x00\x00\x00\x30\x8c\xdc\xfd\x9f\x8b\x5b\x9a\xec\x7f\xfd\xbf\xfe\xff\xd4\xfb\xff\x7d\xff\xda\xe9\xff\xef\xfc\xf3\x8e\xf9\xfd\xff\xab\xf4\xff\x7b\xdf\xaf\xff\x5f\x26\xfd\xbf\xfe\x7f\x8a\xfe\x5f\xff\xbf\xe6\xf7\xeb\xff\xf5\xff\xcc\x5b\x5a\xff\x9f\xbb\xff\xf3\x71\x4b\x93\xfd\x0f\x00\x00\x00\x1d\xe4\xee\xff\x42\xdc\x62\xff\x03\x00\x00\xc0\x30\x72\xf7\x7f\x31\x6e\xb1\xff\x01\x00\x00\x60\x18\xb9\xfb\xbf\x14\xb7\x34\xd9\xff\xfa\x7f\xfd\x7f\xa7\xef\xff\xdf\x7e\xd9\xde\x9f\xaf\x95\xf7\xff\xbe\xff\xbf\xef\xfd\xfa\xff\x65\xd2\xff\xeb\xff\xa7\xe8\xff\xf5\xff\x6b\x7e\xbf\xfe\x5f\xff\xcf\xbc\xa5\xf5\xff\xb9\xfb\xbf\x1c\xb7\x34\xd9\xff\x00\x00\x00\xd0\x41\xee\xfe\xaf\xc4\x2d\xf6\x3f\x00\x00\x00\xac\xcf\x85\x83\x7f\x38\x77\xff\x57\xf7\xff\x41\xf6\x3f\x00\x00\x00\x0c\x23\x77\xff\xd7\xe2\x96\x26\xfb\x5f\xff\xaf\xff\xef\xd4\xff\xef\xff\xf9\xd2\xff\xef\x7d\xa7\xfe\x5f\xff\xbf\x0d\xfa\x7f\xfd\xff\x14\xfd\xbf\xfe\xff\xf4\xde\x7f\xc5\x89\xbf\x5f\xff\xaf\xff\x67\xde\xd2\xfa\xff\xdc\xfd\x5f\x8f\x5b\x9a\xec\x7f\x00\x00\x00\xe8\x20\x77\xff\x37\xe2\x16\xfb\x1f\x00\x00\x00\x86\x91\xbb\xff\x9b\x71\x8b\xfd\x0f\x00\x00\x00\xc3\xc8\xdd\xff\xad\xb8\xa5\xc9\xfe\x1f\xb9\xff\x9f\xfa\xc3\xf4\xff\xbb\xf4\xff\xfa\xff\x8d\xfe\x5f\xff\xbf\x65\xfa\x7f\xfd\xff\x14\xfd\xbf\xfe\x7f\xcd\xef\xd7\xff\xeb\xff\x99\xb7\xb4\xfe\x3f\x77\xff\xb7\xe3\x96\x7b\x6d\x36\xc7\xfa\x2f\x00\x00\x00\x00\x60\xb1\x72\xf7\x7f\x27\x6e\x69\xf2\xcf\xff\x01\x00\x00\xa0\x83\xdc\xfd\xdf\x8d\x5b\xec\x7f\x00\x00\x00\x18\x46\xee\xfe\xef\xc5\x2d\x4d\xf6\xff\xc8\xfd\xff\x14\xfd\xff\x2e\xfd\xbf\xfe\x7f\xa3\xff\xd7\xff\x6f\x99\xfe\x5f\xff\x3f\x45\xff\xaf\xff\x5f\xf3\xfb\xf5\xff\xfa\x7f\xe6\x9d\x51\xff\x7f\x7e\x73\x48\xff\x9f\xbb\xff\xfb\x71\x4b\x93\xfd\x0f\x00\x00\x00\x1d\xe4\xee\xff\x41\xdc\x62\xff\x03\x00\x00\xc0\x30\x72\xf7\xff\x30\x6e\xb1\xff\x01\x00\x00\x60\x18\xb9\xfb\x7f\x14\xb7\x8c\xb3\xff\xef\x77\xcb\xc4\xef\xd4\xff\x9f\x78\xff\xbf\xf3\x8b\x48\xff\xbf\x9b\x8c\xe9\xff\xf5\xff\xfa\x7f\xfd\xbf\xfe\x5f\xff\x3f\x45\xff\xaf\xff\x5f\xf3\xfb\xf5\xff\xfa\x7f\xe6\x2d\xed\xfb\xff\xb9\xfb\x7f\x1c\xb7\x8c\xb3\xff\x01\x00\x00\xa0\xbd\xdc\xfd\x3f\x89\x5b\xec\x7f\x00\x00\x00\x18\x46\xee\xfe\x9f\xc6\x2d\xf6\x3f\x00\x00\x00\x0c\x23\x77\xff\xcf\xe2\x96\x26\xfb\x5f\xff\xef\xfb\xff\xbe\xff\xdf\xaa\xff\xbf\x7c\xa3\xff\xd7\xff\x9f\x32\xfd\xbf\xfe\x7f\x8a\xfe\x5f\xff\xbf\xe6\xf7\xeb\xff\xf5\xff\xcc\x5b\x5a\xff\x9f\xbb\xff\xe7\x71\x4b\x93\xfd\x0f\x00\x00\x00\x1d\xe4\xee\xff\x45\xdc\x62\xff\x03\x00\x00\xc0\x30\x72\xf7\xff\x32\x6e\xb1\xff\x01\x00\x00\x60\x18\xb9\xfb\x7f\x15\xb7\x34\xd9\xff\xfa\x7f\xfd\xbf\xfe\xbf\x55\xff\xef\xfb\xff\xfa\xff\x53\xa7\xff\xd7\xff\x4f\xd1\xff\xeb\xff\xd7\xfc\xfe\xec\xff\xf3\xd7\x9d\xfe\x5f\xff\xcf\xff\x5b\x5a\xff\x9f\xbb\xff\xd7\x71\x4b\x93\xfd\x0f\x00\x00\x00\x1d\xe4\xee\xff\x4d\xdc\x62\xff\x03\x00\x00\xc0\x30\x72\xf7\xff\x36\x6e\xb1\xff\x01\x00\x00\x60\x18\xb9\xfb\x7f\x17\xb7\x34\xd9\xff\xfa\x7f\xfd\xbf\xfe\x5f\xff\xaf\xff\xd7\xff\x6f\x93\xfe\x5f\xff\x3f\x45\xff\xaf\xff\x5f\xf3\xfb\x7d\xff\x5f\xff\xcf\xbc\xa5\xf5\xff\xb9\xfb\x6f\x8d\x5b\x9a\xec\x7f\x00\x00\x00\xe8\x20\x77\xff\xef\xe3\x16\xfb\x1f\x00\x00\x00\x86\x91\xbb\xff\x0f\x71\x8b\xfd\x0f\x00\x00\x00\xc3\xc8\xdd\x7f\x5b\xdc\xd2\x64\xff\x5f\x42\xff\x7f\x9f\xfb\x6f\xf6\xfc\x29\xfa\x7f\xfd\xff\x72\xfa\xff\xbb\xe8\xff\xf5\xff\xfa\xff\xa5\xd0\xff\xeb\xff\xa7\xe8\xff\xf5\xff\x6b\x7e\xbf\xfe\x5f\xff\xcf\xbc\xa5\xf5\xff\xb9\xfb\xff\x18\xb7\x34\xd9\xff\x00\x00\x00\xd0\x41\xee\xfe\x3f\xc5\x2d\xf6\x3f\x00\x00\x00\x0c\x23\x77\xff\x9f\xe3\x16\xfb\x1f\x00\x00\x00\x86\x91\xbb\xff\x2f\x71\x4b\x93\xfd\xef\xfb\xff\xfa\xff\xe3\xf7\xff\xe7\xeb\xef\x7b\xb1\xfd\xbf\xef\xff\xeb\xff\xf5\xff\x8b\x31\x6e\xff\x7f\xa5\xfe\x5f\xff\x7f\xc9\xfd\xff\xf5\x37\xed\xfe\xb0\xfe\x7f\x9d\xef\xd7\xff\xeb\xff\x99\xb7\xb4\xfe\x3f\x77\xff\x5f\xe3\x96\x26\xfb\x1f\x00\x00\x00\x3a\xc8\xdd\xff\xb7\xb8\xc5\xfe\x07\x00\x00\x80\x61\xe4\xee\xff\x7b\xdc\x62\xff\x03\x00\x00\xc0\x30\x72\xf7\xff\x23\x6e\x69\xb2\xff\xf5\xff\xfa\xff\x21\xbf\xff\xaf\xff\xd7\xff\xeb\xff\x17\x63\xdc\xfe\xdf\xf7\xff\xf5\xff\xbe\xff\xaf\xff\xd7\xff\xeb\xff\x99\xb3\xb4\xfe\x3f\x77\xff\x3f\xe3\x96\x26\xfb\x1f\x00\x00\x00\x3a\xc8\xdd\xff\xaf\xb8\xc5\xfe\x07\x00\x00\x80\x61\xe4\xee\xff\x77\xdc\x62\xff\x03\x00\x00\xc0\x30\x72\xf7\xff\x27\x6e\x69\xb2\xff\xf5\xff\xfa\x7f\xfd\xbf\xfe\x5f\xff\xaf\xff\xdf\x26\xfd\xbf\xfe\x7f\x8a\xfe\x5f\xff\xbf\xe6\xf7\xeb\xff\xf5\xff\xcc\x5b\x5a\xff\x9f\xbb\xff\xbf\x01\x00\x00\xff\xff\x55\x6b\x33\xb0", 24528);
syz_mount_image(/*fs=*/0x200000000400, /*dir=*/0x200000000000, /*flags=MS_REC|MS_SILENT|MS_NOSUID|MS_NODIRATIME*/0xc802, /*opts=*/0x200000000100, /*chdir=*/1, /*size=*/0x5fd0, /*img=*/0x200000006440);
//  openat arguments: [
//    fd: fd_dir (resource)
//    file: ptr[in, buffer] {
//      buffer: {2e 00} (length 0x2)
//    }
//    flags: open_flags = 0x0 (4 bytes)
//    mode: open_mode = 0x0 (2 bytes)
//  ]
//  returns fd
memcpy((void*)0x2000000000c0, ".\000", 2);
	res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x2000000000c0ul, /*flags=*/0, /*mode=*/0);
	if (res != -1)
		r[0] = res;
//  ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY arguments: [
//    fd: fd_dir (resource)
//    cmd: const = 0xc0185879 (4 bytes)
//    arg: ptr[inout, fscrypt_remove_key_arg] {
//      fscrypt_remove_key_arg {
//        key_spec: union fscrypt_key_specifier {
//          desc: fscrypt_key_specifier__by_descriptor {
//            type: const = 0x4100 (4 bytes)
//            reserved: const = 0x0 (4 bytes)
//            descriptor: union fscrypt_key_descriptor {
//              desc3: buffer: {e8 da b9 92 34 bb 31 2e} (length 0x8)
//            }
//            reserved2: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x18)
//          }
//        }
//        removal_status_flags: int32 = 0x0 (4 bytes)
//        reserved: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x14)
//      }
//    }
//  ]
*(uint32_t*)0x200000000080 = 0x4100;
*(uint32_t*)0x200000000084 = 0;
memcpy((void*)0x200000000088, "\350\332\271\2224\2731.", 8);
memset((void*)0x200000000090, 0, 24);
memset((void*)0x2000000000ac, 0, 20);
	syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0xc0185879, /*arg=*/0x200000000080ul);
//  syz_mount_image$vfat arguments: [
//    fs: ptr[in, buffer] {
//      buffer: {76 66 61 74 00} (length 0x5)
//    }
//    dir: ptr[in, buffer] {
//      buffer: {13 13 77 c5 fc 35 d4 14 54 d5 d4 1d 29 ad 1a 60 29 59 81 46 e6 be 16 6e 41 ad 0d bd 40 54 03 3c 9f 33 bb da 82 24 a2 f3 d7 72 e7 63 6e 48 b3 3c bf 70 83 72 e8 f1 b9 93 3e c5 12 77 43 be 22 06 20 9e f0 2d f9 cb f2 f6 e8 80 d3 38 2f 00} (length 0x4e)
//    }
//    flags: mount_flags = 0x2b1247d (8 bytes)
//    opts: nil
//    chdir: int8 = 0xfc (1 bytes)
//    size: len = 0x0 (8 bytes)
//    img: ptr[in, buffer] {
//      buffer: (compressed buffer with length 0x0)
//    }
//  ]
//  returns fd_dir
memcpy((void*)0x200000000200, "vfat\000", 5);
memcpy((void*)0x2000000002c0, "\023\023w\305\3745\324\024T\325\324\035)\255\032`)Y\201F\346\276\026nA\255\r\275@T\003<\2373\273\332\202$\242\363\327r\347cnH\263<\277p\203r\350\361\271\223>\305\022wC\276\"\006 \236\360-\371\313\362\366\350\200\3238/\000", 78);
syz_mount_image(/*fs=*/0x200000000200, /*dir=*/0x2000000002c0, /*flags=MS_LAZYTIME|MS_I_VERSION|MS_SHARED|MS_POSIXACL|MS_SYNCHRONOUS|MS_REMOUNT|MS_RELATIME|0x244d*/0x2b1247d, /*opts=*/0, /*chdir=*/0xfc, /*size=*/0, /*img=*/0x2000000000c0);
	return 0;
}
]

map[KernelSrc:/app/workdir/cache/src/ecd8bb68855fdd08aa08215ac485989bac875215]

map[KernelObj:/app/workdir/cache/build/8a299da574d0b44c2d9b3ddde72913163b5aa892]

map[ReproducedBugTitle:KASAN: slab-use-after-free Read in lbmIODone ReproducedCrashReport:==================================================================
BUG: KASAN: slab-use-after-free in lbmIODone+0x1312/0x16c0 fs/jfs/jfs_logmgr.c:2192
Read of size 4 at addr ffff888049ebf608 by task ktimers/0/16

CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #1 PREEMPT_{RT,(full)} 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 lbmIODone+0x1312/0x16c0 fs/jfs/jfs_logmgr.c:2192
 blk_update_request+0x57e/0xe60 block/blk-mq.c:1016
 blk_mq_end_request+0x3e/0x70 block/blk-mq.c:1178
 blk_complete_reqs block/blk-mq.c:1253 [inline]
 blk_done_softirq+0x10a/0x160 block/blk-mq.c:1258
 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 run_ktimerd+0x69/0x100 kernel/softirq.c:1151
 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 6219:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x3a6/0x690 mm/slub.c:5419
 kmalloc_noprof include/linux/slab.h:950 [inline]
 lbmLogInit fs/jfs/jfs_logmgr.c:1819 [inline]
 lmLogInit+0x3e5/0x1a00 fs/jfs/jfs_logmgr.c:1267
 open_inline_log fs/jfs/jfs_logmgr.c:1173 [inline]
 lmLogOpen+0x4e1/0xfa0 fs/jfs/jfs_logmgr.c:1067
 jfs_mount_rw+0xee/0x670 fs/jfs/jfs_mount.c:257
 jfs_fill_super+0x754/0xd80 fs/jfs/super.c:532
 get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1694
 vfs_get_tree+0x92/0x2a0 fs/super.c:1754
 fc_mount fs/namespace.c:1193 [inline]
 do_new_mount_fc fs/namespace.c:3758 [inline]
 do_new_mount+0x341/0xd30 fs/namespace.c:3834
 do_mount fs/namespace.c:4167 [inline]
 __do_sys_mount fs/namespace.c:4383 [inline]
 __se_sys_mount+0x31d/0x420 fs/namespace.c:4360
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 6106:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2689 [inline]
 slab_free mm/slub.c:6250 [inline]
 kfree+0x1c5/0x6c0 mm/slub.c:6565
 lbmLogShutdown fs/jfs/jfs_logmgr.c:1862 [inline]
 lmLogShutdown+0x456/0x850 fs/jfs/jfs_logmgr.c:1681
 lmLogClose+0x28a/0x520 fs/jfs/jfs_logmgr.c:1457
 jfs_umount+0x2fb/0x3d0 fs/jfs/jfs_umount.c:124
 jfs_put_super+0x8c/0x190 fs/jfs/super.c:194
 generic_shutdown_super+0x13d/0x2d0 fs/super.c:646
 kill_block_super+0x44/0x90 fs/super.c:1725
 deactivate_locked_super+0xbc/0x130 fs/super.c:476
 cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
 task_work_run+0x1d9/0x270 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
 exit_to_user_mode_loop+0xf3/0x4d0 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888049ebf600
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 8 bytes inside of
 freed 256-byte region [ffff888049ebf600, ffff888049ebf700)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x49ebe
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x480000000000040(head|node=1|zone=1)
page_type: f5(slab)
raw: 0480000000000040 ffff888019c41b40 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 0480000000000040 ffff888019c41b40 dead000000000100 dead000000000122
head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 0480000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5588, tgid 5588 (udevd), ts 65263897590, free_ts 59786995144
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x231/0x280 mm/page_alloc.c:1858
 prep_new_page mm/page_alloc.c:1866 [inline]
 get_page_from_freelist+0x27c8/0x2840 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5226
 alloc_slab_page mm/slub.c:3278 [inline]
 allocate_slab+0x77/0x660 mm/slub.c:3467
 new_slab mm/slub.c:3525 [inline]
 refill_objects+0x33c/0x3d0 mm/slub.c:7255
 refill_sheaf mm/slub.c:2816 [inline]
 __pcs_replace_empty_main+0x373/0x720 mm/slub.c:4651
 alloc_from_pcs mm/slub.c:4749 [inline]
 slab_alloc_node mm/slub.c:4883 [inline]
 __kmalloc_cache_noprof+0x44e/0x690 mm/slub.c:5414
 kmalloc_noprof include/linux/slab.h:950 [inline]
 kzalloc_noprof include/linux/slab.h:1188 [inline]
 smk_fetch+0x95/0x140 security/smack/smack_lsm.c:285
 smack_d_instantiate+0x757/0x990 security/smack/smack_lsm.c:3653
 security_d_instantiate+0x106/0x1d0 security/security.c:3704
 d_splice_alias_ops+0x71/0x370 fs/dcache.c:3141
 __lookup_slow+0x2d2/0x440 fs/namei.c:1915
 lookup_slow+0x53/0x70 fs/namei.c:1932
 walk_component fs/namei.c:2278 [inline]
 lookup_last fs/namei.c:2785 [inline]
 path_lookupat+0x3f5/0x8c0 fs/namei.c:2809
 filename_lookup+0x256/0x5d0 fs/namei.c:2838
 vfs_statx+0x115/0x570 fs/stat.c:353
page last free pid 5606 tgid 5606 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1402 [inline]
 __free_frozen_pages+0xf48/0x1080 mm/page_alloc.c:2943
 __slab_free+0x252/0x2a0 mm/slub.c:5612
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4569 [inline]
 slab_alloc_node mm/slub.c:4898 [inline]
 __do_kmalloc_node mm/slub.c:5294 [inline]
 __kmalloc_noprof+0x399/0x7b0 mm/slub.c:5307
 kmalloc_noprof include/linux/slab.h:954 [inline]
 kzalloc_noprof include/linux/slab.h:1188 [inline]
 tomoyo_encode2 security/tomoyo/realpath.c:45 [inline]
 tomoyo_encode+0x28b/0x550 security/tomoyo/realpath.c:80
 tomoyo_mount_acl security/tomoyo/mount.c:152 [inline]
 tomoyo_mount_permission+0x4c1/0x9d0 security/tomoyo/mount.c:239
 security_sb_mount+0xe4/0x320 security/security.c:1088
 path_mount+0xbc/0x1000 fs/namespace.c:4096
 do_mount fs/namespace.c:4167 [inline]
 __do_sys_mount fs/namespace.c:4383 [inline]
 __se_sys_mount+0x31d/0x420 fs/namespace.c:4360
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888049ebf500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888049ebf580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888049ebf600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                      ^
 ffff888049ebf680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888049ebf700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
 ReproducedFaultInjection:]

map[Index:codesearch-index]

gemini-3.1-pro-preview

You are an experienced Linux kernel developer tasked with debugging a kernel crash root cause.
You need to provide a detailed explanation of the root cause for another developer to be
able to write a fix for the bug based on your explanation. Include all relevant details
into the response: function/struct/field/etc names, code snippets, line numbers,
macro/enum values, etc.



Prefer calling several tools at the same time to save round-trips.

The crash is:

==================================================================
BUG: KASAN: slab-use-after-free in lbmIODone+0x1312/0x16c0 fs/jfs/jfs_logmgr.c:2192
Read of size 4 at addr ffff888049ebf608 by task ktimers/0/16

CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #1 PREEMPT_{RT,(full)} 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 lbmIODone+0x1312/0x16c0 fs/jfs/jfs_logmgr.c:2192
 blk_update_request+0x57e/0xe60 block/blk-mq.c:1016
 blk_mq_end_request+0x3e/0x70 block/blk-mq.c:1178
 blk_complete_reqs block/blk-mq.c:1253 [inline]
 blk_done_softirq+0x10a/0x160 block/blk-mq.c:1258
 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 run_ktimerd+0x69/0x100 kernel/softirq.c:1151
 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 6219:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x3a6/0x690 mm/slub.c:5419
 kmalloc_noprof include/linux/slab.h:950 [inline]
 lbmLogInit fs/jfs/jfs_logmgr.c:1819 [inline]
 lmLogInit+0x3e5/0x1a00 fs/jfs/jfs_logmgr.c:1267
 open_inline_log fs/jfs/jfs_logmgr.c:1173 [inline]
 lmLogOpen+0x4e1/0xfa0 fs/jfs/jfs_logmgr.c:1067
 jfs_mount_rw+0xee/0x670 fs/jfs/jfs_mount.c:257
 jfs_fill_super+0x754/0xd80 fs/jfs/super.c:532
 get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1694
 vfs_get_tree+0x92/0x2a0 fs/super.c:1754
 fc_mount fs/namespace.c:1193 [inline]
 do_new_mount_fc fs/namespace.c:3758 [inline]
 do_new_mount+0x341/0xd30 fs/namespace.c:3834
 do_mount fs/namespace.c:4167 [inline]
 __do_sys_mount fs/namespace.c:4383 [inline]
 __se_sys_mount+0x31d/0x420 fs/namespace.c:4360
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 6106:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2689 [inline]
 slab_free mm/slub.c:6250 [inline]
 kfree+0x1c5/0x6c0 mm/slub.c:6565
 lbmLogShutdown fs/jfs/jfs_logmgr.c:1862 [inline]
 lmLogShutdown+0x456/0x850 fs/jfs/jfs_logmgr.c:1681
 lmLogClose+0x28a/0x520 fs/jfs/jfs_logmgr.c:1457
 jfs_umount+0x2fb/0x3d0 fs/jfs/jfs_umount.c:124
 jfs_put_super+0x8c/0x190 fs/jfs/super.c:194
 generic_shutdown_super+0x13d/0x2d0 fs/super.c:646
 kill_block_super+0x44/0x90 fs/super.c:1725
 deactivate_locked_super+0xbc/0x130 fs/super.c:476
 cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
 task_work_run+0x1d9/0x270 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
 exit_to_user_mode_loop+0xf3/0x4d0 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888049ebf600
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 8 bytes inside of
 freed 256-byte region [ffff888049ebf600, ffff888049ebf700)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x49ebe
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x480000000000040(head|node=1|zone=1)
page_type: f5(slab)
raw: 0480000000000040 ffff888019c41b40 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 0480000000000040 ffff888019c41b40 dead000000000100 dead000000000122
head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 0480000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5588, tgid 5588 (udevd), ts 65263897590, free_ts 59786995144
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x231/0x280 mm/page_alloc.c:1858
 prep_new_page mm/page_alloc.c:1866 [inline]
 get_page_from_freelist+0x27c8/0x2840 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5226
 alloc_slab_page mm/slub.c:3278 [inline]
 allocate_slab+0x77/0x660 mm/slub.c:3467
 new_slab mm/slub.c:3525 [inline]
 refill_objects+0x33c/0x3d0 mm/slub.c:7255
 refill_sheaf mm/slub.c:2816 [inline]
 __pcs_replace_empty_main+0x373/0x720 mm/slub.c:4651
 alloc_from_pcs mm/slub.c:4749 [inline]
 slab_alloc_node mm/slub.c:4883 [inline]
 __kmalloc_cache_noprof+0x44e/0x690 mm/slub.c:5414
 kmalloc_noprof include/linux/slab.h:950 [inline]
 kzalloc_noprof include/linux/slab.h:1188 [inline]
 smk_fetch+0x95/0x140 security/smack/smack_lsm.c:285
 smack_d_instantiate+0x757/0x990 security/smack/smack_lsm.c:3653
 security_d_instantiate+0x106/0x1d0 security/security.c:3704
 d_splice_alias_ops+0x71/0x370 fs/dcache.c:3141
 __lookup_slow+0x2d2/0x440 fs/namei.c:1915
 lookup_slow+0x53/0x70 fs/namei.c:1932
 walk_component fs/namei.c:2278 [inline]
 lookup_last fs/namei.c:2785 [inline]
 path_lookupat+0x3f5/0x8c0 fs/namei.c:2809
 filename_lookup+0x256/0x5d0 fs/namei.c:2838
 vfs_statx+0x115/0x570 fs/stat.c:353
page last free pid 5606 tgid 5606 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1402 [inline]
 __free_frozen_pages+0xf48/0x1080 mm/page_alloc.c:2943
 __slab_free+0x252/0x2a0 mm/slub.c:5612
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4569 [inline]
 slab_alloc_node mm/slub.c:4898 [inline]
 __do_kmalloc_node mm/slub.c:5294 [inline]
 __kmalloc_noprof+0x399/0x7b0 mm/slub.c:5307
 kmalloc_noprof include/linux/slab.h:954 [inline]
 kzalloc_noprof include/linux/slab.h:1188 [inline]
 tomoyo_encode2 security/tomoyo/realpath.c:45 [inline]
 tomoyo_encode+0x28b/0x550 security/tomoyo/realpath.c:80
 tomoyo_mount_acl security/tomoyo/mount.c:152 [inline]
 tomoyo_mount_permission+0x4c1/0x9d0 security/tomoyo/mount.c:239
 security_sb_mount+0xe4/0x320 security/security.c:1088
 path_mount+0xbc/0x1000 fs/namespace.c:4096
 do_mount fs/namespace.c:4167 [inline]
 __do_sys_mount fs/namespace.c:4383 [inline]
 __se_sys_mount+0x31d/0x420 fs/namespace.c:4360
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888049ebf500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888049ebf580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888049ebf600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                      ^
 ffff888049ebf680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888049ebf700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================


The following C code is a draft of the vulnerable syscall sequence. Keep in mind that
it may lack the precise threading, sandboxing, and some arguments of a working reproducer:

// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE 

#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <setjmp.h>
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>

#include <linux/loop.h>

#ifndef __NR_memfd_create
#define __NR_memfd_create 319
#endif

static unsigned long long procid;

//% This code is derived from puff.{c,h}, found in the zlib development. The
//% original files come with the following copyright notice:

//% Copyright (C) 2002-2013 Mark Adler, all rights reserved
//% version 2.3, 21 Jan 2013
//% This software is provided 'as-is', without any express or implied
//% warranty.  In no event will the author be held liable for any damages
//% arising from the use of this software.
//% Permission is granted to anyone to use this software for any purpose,
//% including commercial applications, and to alter it and redistribute it
//% freely, subject to the following restrictions:
//% 1. The origin of this software must not be misrepresented; you must not
//%    claim that you wrote the original software. If you use this software
//%    in a product, an acknowledgment in the product documentation would be
//%    appreciated but is not required.
//% 2. Altered source versions must be plainly marked as such, and must not be
//%    misrepresented as being the original software.
//% 3. This notice may not be removed or altered from any source distribution.
//% Mark Adler    madler@alumni.caltech.edu

//% BEGIN CODE DERIVED FROM puff.{c,h}

#define MAXBITS 15
#define MAXLCODES 286
#define MAXDCODES 30
#define MAXCODES (MAXLCODES + MAXDCODES)
#define FIXLCODES 288

struct puff_state {
	unsigned char* out;
	unsigned long outlen;
	unsigned long outcnt;
	const unsigned char* in;
	unsigned long inlen;
	unsigned long incnt;
	int bitbuf;
	int bitcnt;
	jmp_buf env;
};
static int puff_bits(struct puff_state* s, int need)
{
	long val = s->bitbuf;
	while (s->bitcnt < need) {
		if (s->incnt == s->inlen)
			longjmp(s->env, 1);
		val |= (long)(s->in[s->incnt++]) << s->bitcnt;
		s->bitcnt += 8;
	}
	s->bitbuf = (int)(val >> need);
	s->bitcnt -= need;
	return (int)(val & ((1L << need) - 1));
}
static int puff_stored(struct puff_state* s)
{
	s->bitbuf = 0;
	s->bitcnt = 0;
	if (s->incnt + 4 > s->inlen)
		return 2;
	unsigned len = s->in[s->incnt++];
	len |= s->in[s->incnt++] << 8;
	if (s->in[s->incnt++] != (~len & 0xff) ||
	    s->in[s->incnt++] != ((~len >> 8) & 0xff))
		return -2;
	if (s->incnt + len > s->inlen)
		return 2;
	if (s->outcnt + len > s->outlen)
		return 1;
	for (; len--; s->outcnt++, s->incnt++) {
		if (s->in[s->incnt])
			s->out[s->outcnt] = s->in[s->incnt];
	}
	return 0;
}
struct puff_huffman {
	short* count;
	short* symbol;
};
static int puff_decode(struct puff_state* s, const struct puff_huffman* h)
{
	int first = 0;
	int index = 0;
	int bitbuf = s->bitbuf;
	int left = s->bitcnt;
	int code = first = index = 0;
	int len = 1;
	short* next = h->count + 1;
	while (1) {
		while (left--) {
			code |= bitbuf & 1;
			bitbuf >>= 1;
			int count = *next++;
			if (code - count < first) {
				s->bitbuf = bitbuf;
				s->bitcnt = (s->bitcnt - len) & 7;
				return h->symbol[index + (code - first)];
			}
			index += count;
			first += count;
			first <<= 1;
			code <<= 1;
			len++;
		}
		left = (MAXBITS + 1) - len;
		if (left == 0)
			break;
		if (s->incnt == s->inlen)
			longjmp(s->env, 1);
		bitbuf = s->in[s->incnt++];
		if (left > 8)
			left = 8;
	}
	return -10;
}
static int puff_construct(struct puff_huffman* h, const short* length, int n)
{
	int len;
	for (len = 0; len <= MAXBITS; len++)
		h->count[len] = 0;
	int symbol;
	for (symbol = 0; symbol < n; symbol++)
		(h->count[length[symbol]])++;
	if (h->count[0] == n)
		return 0;
	int left = 1;
	for (len = 1; len <= MAXBITS; len++) {
		left <<= 1;
		left -= h->count[len];
		if (left < 0)
			return left;
	}
	short offs[MAXBITS + 1];
	offs[1] = 0;
	for (len = 1; len < MAXBITS; len++)
		offs[len + 1] = offs[len] + h->count[len];
	for (symbol = 0; symbol < n; symbol++)
		if (length[symbol] != 0)
			h->symbol[offs[length[symbol]]++] = symbol;
	return left;
}
static int puff_codes(struct puff_state* s,
		      const struct puff_huffman* lencode,
		      const struct puff_huffman* distcode)
{
	static const short lens[29] = {
				       3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31,
				       35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258};
	static const short lext[29] = {
				       0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2,
				       3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0};
	static const short dists[30] = {
					1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193,
					257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145,
					8193, 12289, 16385, 24577};
	static const short dext[30] = {
				       0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6,
				       7, 7, 8, 8, 9, 9, 10, 10, 11, 11,
				       12, 12, 13, 13};
	int symbol;
	do {
		symbol = puff_decode(s, lencode);
		if (symbol < 0)
			return symbol;
		if (symbol < 256) {
			if (s->outcnt == s->outlen)
				return 1;
			if (symbol)
				s->out[s->outcnt] = symbol;
			s->outcnt++;
		} else if (symbol > 256) {
			symbol -= 257;
			if (symbol >= 29)
				return -10;
			int len = lens[symbol] + puff_bits(s, lext[symbol]);
			symbol = puff_decode(s, distcode);
			if (symbol < 0)
				return symbol;
			unsigned dist = dists[symbol] + puff_bits(s, dext[symbol]);
			if (dist > s->outcnt)
				return -11;
			if (s->outcnt + len > s->outlen)
				return 1;
			while (len--) {
				if (dist <= s->outcnt && s->out[s->outcnt - dist])
					s->out[s->outcnt] = s->out[s->outcnt - dist];
				s->outcnt++;
			}
		}
	} while (symbol != 256);
	return 0;
}
static int puff_fixed(struct puff_state* s)
{
	static int virgin = 1;
	static short lencnt[MAXBITS + 1], lensym[FIXLCODES];
	static short distcnt[MAXBITS + 1], distsym[MAXDCODES];
	static struct puff_huffman lencode, distcode;
	if (virgin) {
		lencode.count = lencnt;
		lencode.symbol = lensym;
		distcode.count = distcnt;
		distcode.symbol = distsym;
		short lengths[FIXLCODES];
		int symbol;
		for (symbol = 0; symbol < 144; symbol++)
			lengths[symbol] = 8;
		for (; symbol < 256; symbol++)
			lengths[symbol] = 9;
		for (; symbol < 280; symbol++)
			lengths[symbol] = 7;
		for (; symbol < FIXLCODES; symbol++)
			lengths[symbol] = 8;
		puff_construct(&lencode, lengths, FIXLCODES);
		for (symbol = 0; symbol < MAXDCODES; symbol++)
			lengths[symbol] = 5;
		puff_construct(&distcode, lengths, MAXDCODES);
		virgin = 0;
	}
	return puff_codes(s, &lencode, &distcode);
}
static int puff_dynamic(struct puff_state* s)
{
	static const short order[19] =
	    {16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15};
	int nlen = puff_bits(s, 5) + 257;
	int ndist = puff_bits(s, 5) + 1;
	int ncode = puff_bits(s, 4) + 4;
	if (nlen > MAXLCODES || ndist > MAXDCODES)
		return -3;
	short lengths[MAXCODES];
	int index;
	for (index = 0; index < ncode; index++)
		lengths[order[index]] = puff_bits(s, 3);
	for (; index < 19; index++)
		lengths[order[index]] = 0;
	short lencnt[MAXBITS + 1], lensym[MAXLCODES];
	struct puff_huffman lencode = {lencnt, lensym};
	int err = puff_construct(&lencode, lengths, 19);
	if (err != 0)
		return -4;
	index = 0;
	while (index < nlen + ndist) {
		int symbol;
		int len;
		symbol = puff_decode(s, &lencode);
		if (symbol < 0)
			return symbol;
		if (symbol < 16)
			lengths[index++] = symbol;
		else {
			len = 0;
			if (symbol == 16) {
				if (index == 0)
					return -5;
				len = lengths[index - 1];
				symbol = 3 + puff_bits(s, 2);
			} else if (symbol == 17)
				symbol = 3 + puff_bits(s, 3);
			else
				symbol = 11 + puff_bits(s, 7);
			if (index + symbol > nlen + ndist)
				return -6;
			while (symbol--)
				lengths[index++] = len;
		}
	}
	if (lengths[256] == 0)
		return -9;
	err = puff_construct(&lencode, lengths, nlen);
	if (err && (err < 0 || nlen != lencode.count[0] + lencode.count[1]))
		return -7;
	short distcnt[MAXBITS + 1], distsym[MAXDCODES];
	struct puff_huffman distcode = {distcnt, distsym};
	err = puff_construct(&distcode, lengths + nlen, ndist);
	if (err && (err < 0 || ndist != distcode.count[0] + distcode.count[1]))
		return -8;
	return puff_codes(s, &lencode, &distcode);
}
static int puff(
    unsigned char* dest,
    unsigned long* destlen,
    const unsigned char* source,
    unsigned long sourcelen)
{
	struct puff_state s = {
	    .out = dest,
	    .outlen = *destlen,
	    .outcnt = 0,
	    .in = source,
	    .inlen = sourcelen,
	    .incnt = 0,
	    .bitbuf = 0,
	    .bitcnt = 0,
	};
	int err;
	if (setjmp(s.env) != 0)
		err = 2;
	else {
		int last;
		do {
			last = puff_bits(&s, 1);
			int type = puff_bits(&s, 2);
			err = type == 0 ? puff_stored(&s) : (type == 1 ? puff_fixed(&s) : (type == 2 ? puff_dynamic(&s) : -1));
			if (err != 0)
				break;
		} while (!last);
	}
	*destlen = s.outcnt;
	return err;
}

//% END CODE DERIVED FROM puff.{c,h}

#define ZLIB_HEADER_WIDTH 2

static int puff_zlib_to_file(const unsigned char* source, unsigned long sourcelen, int dest_fd)
{
	if (sourcelen < ZLIB_HEADER_WIDTH)
		return 0;
	source += ZLIB_HEADER_WIDTH;
	sourcelen -= ZLIB_HEADER_WIDTH;
	const unsigned long max_destlen = 132 << 20;
	void* ret = mmap(0, max_destlen, PROT_WRITE | PROT_READ, MAP_PRIVATE | MAP_ANON, -1, 0);
	if (ret == MAP_FAILED)
		return -1;
	unsigned char* dest = (unsigned char*)ret;
	unsigned long destlen = max_destlen;
	int err = puff(dest, &destlen, source, sourcelen);
	if (err) {
		munmap(dest, max_destlen);
		errno = -err;
		return -1;
	}
	if (write(dest_fd, dest, destlen) != (ssize_t)destlen) {
		munmap(dest, max_destlen);
		return -1;
	}
	return munmap(dest, max_destlen);
}

static int setup_loop_device(unsigned char* data, unsigned long size, const char* loopname, int* loopfd_p)
{
	int err = 0, loopfd = -1;
	int memfd = syscall(__NR_memfd_create, "syzkaller", 0);
	if (memfd == -1) {
		err = errno;
		goto error;
	}
	if (puff_zlib_to_file(data, size, memfd)) {
		err = errno;
		goto error_close_memfd;
	}
	loopfd = open(loopname, O_RDWR);
	if (loopfd == -1) {
		err = errno;
		goto error_close_memfd;
	}
	if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
		if (errno != EBUSY) {
			err = errno;
			goto error_close_loop;
		}
		ioctl(loopfd, LOOP_CLR_FD, 0);
		usleep(1000);
		if (ioctl(loopfd, LOOP_SET_FD, memfd)) {
			err = errno;
			goto error_close_loop;
		}
	}
	close(memfd);
	*loopfd_p = loopfd;
	return 0;

error_close_loop:
	close(loopfd);
error_close_memfd:
	close(memfd);
error:
	errno = err;
	return -1;
}

static void reset_loop_device(const char* loopname)
{
	int loopfd = open(loopname, O_RDWR);
	if (loopfd == -1) {
		return;
	}
	if (ioctl(loopfd, LOOP_CLR_FD, 0)) {
	}
	close(loopfd);
}

static long syz_mount_image(
    volatile long fsarg,
    volatile long dir,
    volatile long flags,
    volatile long optsarg,
    volatile long change_dir,
    volatile unsigned long size,
    volatile long image)
{
	unsigned char* data = (unsigned char*)image;
	int res = -1, err = 0, need_loop_device = !!size;
	char* mount_opts = (char*)optsarg;
	char* target = (char*)dir;
	char* fs = (char*)fsarg;
	char* source = NULL;
	char loopname[64];
	if (need_loop_device) {
		int loopfd;
		memset(loopname, 0, sizeof(loopname));
		snprintf(loopname, sizeof(loopname), "/dev/loop%llu", procid);
		if (setup_loop_device(data, size, loopname, &loopfd) == -1)
			return -1;
		close(loopfd);
		source = loopname;
	}
	mkdir(target, 0777);
	char opts[256];
	memset(opts, 0, sizeof(opts));
	if (strlen(mount_opts) > (sizeof(opts) - 32)) {
	}
	strncpy(opts, mount_opts, sizeof(opts) - 32);
	if (strcmp(fs, "iso9660") == 0) {
		flags |= MS_RDONLY;
	} else if (strncmp(fs, "ext", 3) == 0) {
		bool has_remount_ro = false;
		char* remount_ro_start = strstr(opts, "errors=remount-ro");
		if (remount_ro_start != NULL) {
			char after = *(remount_ro_start + strlen("errors=remount-ro"));
			char before = remount_ro_start == opts ? '\0' : *(remount_ro_start - 1);
			has_remount_ro = ((before == '\0' || before == ',') && (after == '\0' || after == ','));
		}
		if (strstr(opts, "errors=panic") || !has_remount_ro)
			strcat(opts, ",errors=continue");
	} else if (strcmp(fs, "xfs") == 0) {
		strcat(opts, ",nouuid");
	} else if (strncmp(fs, "gfs2", 4) == 0 && (strstr(opts, "errors=panic") || strstr(opts, "debug"))) {
		strcat(opts, ",errors=withdraw");
	}
	res = mount(source, target, fs, flags, opts);
	if (res == -1) {
		err = errno;
		goto error_clear_loop;
	}
	res = open(target, O_RDONLY | O_DIRECTORY);
	if (res == -1) {
		err = errno;
		goto error_clear_loop;
	}
	if (change_dir) {
		res = chdir(target);
		if (res == -1) {
			err = errno;
		}
	}

error_clear_loop:
	if (need_loop_device)
		reset_loop_device(loopname);
	errno = err;
	return res;
}

uint64_t r[1] = {0xffffffffffffffff};

int main(void)
{
		syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	const char* reason;
	(void)reason;
				intptr_t res = 0;
	if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
//  syz_mount_image$jfs arguments: [
//    fs: ptr[in, buffer] {
//      buffer: {6a 66 73 00} (length 0x4)
//    }
//    dir: ptr[in, buffer] {
//      buffer: {2e 2f 62 75 73 00} (length 0x6)
//    }
//    flags: mount_flags = 0xc802 (8 bytes)
//    opts: ptr[inout, array[ANYUNION]] {
//      array[ANYUNION] {
//        union ANYUNION {
//          ANYRES32: ANYRES32 (resource)
//        }
//      }
//    }
//    chdir: int8 = 0x1 (1 bytes)
//    size: len = 0x5fd0 (8 bytes)
//    img: ptr[in, buffer] {
//      buffer: (compressed buffer with length 0x5fd0)
//    }
//  ]
//  returns fd_dir
memcpy((void*)0x200000000400, "jfs\000", 4);
memcpy((void*)0x200000000000, "./bus\000", 6);
*(uint32_t*)0x200000000100 = 0;
memcpy((void*)0x200000006440, "\x78\x9c\xec\xdd\xcb\x6f\x1d\x57\x1d\x07\xf0\xdf\x7d\xf8\xfa\x51\x48\xa3\x0a\x55\x21\x62\xe1\xa6\x50\x5a\x4a\xf3\x4e\xa0\xbc\x9a\xb2\x60\x01\x48\x20\xa1\xac\x49\xe4\xba\x55\x20\x05\x94\xa4\x88\x56\x11\x71\x95\x05\x62\xc1\xe3\x4f\x80\x4d\x37\x2c\xfa\x8f\x94\x7f\x01\xf1\x07\x10\x29\x61\x55\x09\xca\xa0\xb1\xcf\x49\xc6\xe3\xeb\x5c\xa7\x89\xef\xdc\xeb\xf3\xf9\x48\xce\xcc\x6f\xce\x8c\x7d\x26\x5f\x8f\xef\x63\x66\xee\x09\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x20\xbe\xff\xbd\x9f\x9c\xea\x45\xc4\xa5\x5f\xa7\x05\x87\x23\x3e\x13\x83\x88\x7e\xc4\x72\x5d\xaf\x46\x3d\x73\x21\xaf\x3f\x8c\x88\x23\xb1\xd9\x1c\xcf\x46\xc4\x60\x31\xa2\xde\x7e\xf3\x9f\xa7\x23\xce\x46\xc4\x47\x87\x22\xee\xde\xbb\xb9\x56\x2f\x3e\xbd\xc7\x7e\x9c\x3b\x79\xe3\xda\x27\x3f\xf8\xee\x3f\x7e\xf7\xa7\xdb\x47\x7e\xf6\xc6\x4f\x3f\x68\xb7\xff\xf8\x73\x67\x3e\xfc\xfd\xad\x88\xc3\x3f\x7a\xf5\xc3\x4f\x6e\x3d\x99\x7d\x07\x00\x00\x80\x52\x54\x55\x55\xf5\xd2\xcb\xfc\xa3\xe9\xf5\x7d\xbf\xeb\x4e\x01\x00\x53\x91\x1f\xff\xab\x24\x2f\x57\xab\xd5\x6a\xf5\x13\xad\xff\xd8\x9f\xad\xfe\xa8\x0b\xad\x9b\xaa\xf1\x6e\x35\x8b\x88\xd8\x68\x6e\x53\x3f\x67\x70\x3a\x1e\x00\xe6\xcc\x46\x7c\xdc\x75\x17\xe8\x90\xfc\x8b\x36\x8c\x88\xa7\xba\xee\x04\x30\xd3\x7a\x5d\x77\x80\x7d\x71\xf7\xde\xcd\xb5\x5e\xca\xb7\xd7\x7c\x3c\x58\xdd\x6a\xcf\xef\x53\x6e\xcb\x7f\xa3\x77\xff\xfe\x8e\xdd\xa6\x93\xb4\xaf\x31\x99\xd6\xef\xd7\xed\x18\xc4\x33\xbb\xf4\x67\x79\x4a\x7d\x98\x25\x39\xff\x7e\x3b\xff\x4b\x5b\xed\xa3\xb4\xde\x7e\xe7\x3f\x2d\xbb\xe5\x3f\xda\xba\xf5\xa9\x38\x39\xff\x41\x3b\xff\x96\x6d\xf9\xff\x39\x22\xe6\x36\xff\xfe\xd8\xfc\x4b\x95\xf3\x1f\x3e\x4a\xfe\x1b\x83\x39\x3e\xfe\xe5\x0f\x00\x00\x00\x00\xc0\xc1\x97\xdf\xff\x3f\xdc\xf1\xf9\xdf\xc5\xc7\xdf\x95\x3d\x79\xd8\xf9\xdf\xd5\x29\xf5\x01\x00\x00\x00\x00\x00\x00\x00\x9e\xb4\xc7\x1d\xff\xef\x3e\xe3\xff\x01\x00\x00\xc0\xcc\xaa\x5f\xab\xd7\xfe\x72\xe8\xc1\xb2\xdd\x3e\x8b\xad\x5e\x7e\xb1\x17\xf1\xd9\xd6\xfa\x40\x61\xd2\xcd\x32\x2b\x5d\xf7\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x4a\x32\xdc\xba\x86\xf7\x62\x2f\x62\x61\x31\x22\x56\x56\xaa\xaa\xaa\xbf\x9a\xda\xf5\xa3\x7a\xdc\xed\xe7\x5d\xe9\xfb\x0f\x25\xeb\xfa\x8f\x3c\x00\x00\x6c\xf9\xe8\x50\xeb\x5e\xfe\x5e\xc4\x52\x44\x5c\x4c\x9f\xf5\xb7\xb0\xb2\xb2\x52\x55\x4b\xcb\x2b\xd5\x4a\xb5\xbc\x98\x9f\xcf\x8e\x16\x97\xaa\xe5\xc6\xeb\xda\x3c\xad\x97\x2d\x8e\xf6\xf0\x84\x78\x38\xaa\xea\x6f\xb6\xd4\xd8\xae\x69\xd2\xeb\xe5\x49\xed\xed\xef\x57\xff\xac\x51\x35\xd8\x43\xc7\xa6\xa3\xc3\xc0\x01\x20\x22\xb6\x1e\x8d\xee\x7a\x44\x3a\x60\xaa\xea\xe9\xe8\xfa\x59\x0e\xf3\xc1\xf1\x7f\xf0\x38\xfe\xd9\x8b\xae\x7f\x4f\x01\x00\x00\x80\xfd\x57\x55\x55\xd5\x4b\x1f\xe7\x7d\x34\x9d\xf3\xef\x77\xdd\x29\x00\x60\x1a\x96\xf2\xe3\x7f\xfb\xbc\x80\x5a\xad\x56\x3f\x4e\xfd\xce\x8c\xf5\x47\xad\x56\xef\x54\x8d\x77\xab\x59\x44\xc4\x46\x73\x9b\xfa\x39\x83\xe1\xf8\x01\x60\xce\x6c\xc4\xc7\x5d\x77\x81\x0e\xc9\xbf\x68\xc3\x88\x38\xd2\x75\x27\x80\x99\xd6\xeb\xba\x03\xec\x8b\xbb\xf7\x6e\xae\xf5\x52\xbe\xbd\xe6\xe3\x41\x1a\xdf\x3d\x5f\x0b\xb2\x2d\xff\x8d\xde\xe6\x76\x79\xfb\x71\xd3\x49\xda\xd7\x98\x4c\xeb\xf7\xeb\x76\x0c\xe2\x99\x5d\xfa\xf3\xec\x94\xfa\x30\x4b\x72\xfe\xfd\x76\xfe\x97\xb6\xda\x47\x69\xbd\xfd\xce\x7f\x5a\x76\xcb\xbf\xde\xcf\xc3\x1d\xf4\xa7\x6b\x39\xff\x41\x3b\xff\x96\x83\x93\x7f\x7f\x6c\xfe\xa5\xca\xf9\x0f\x1f\x29\xff\x81\xfc\x01\x00\x00\x00\x00\x60\x86\xe5\xf7\xff\x0f\x3f\xfc\xfc\xef\xd2\xb6\x8d\x0e\xe8\xf9\xdf\xd5\x29\xf5\x01\x00\x00\x00\x00\x00\x00\x00\x9e\xb4\xbb\xf7\x6e\xae\xe5\xfb\x5e\xf3\xf9\xff\x2f\x8c\x59\xaf\xd7\x9c\x73\xff\xe7\x81\x91\xf3\xef\xed\x39\x7f\xf7\xff\x1e\x24\x39\xff\x7e\x3b\xff\xd6\x05\x39\x83\xc6\xfc\x9d\xd7\x1f\xe4\xff\xef\x7b\x37\xd7\x3e\xb8\xf1\xaf\xcf\xe7\xe9\xcc\xe7\xbf\x30\x18\xd5\x3f\x7b\xa1\xd7\x1f\x0c\xd3\x35\x3f\xd5\xc2\x9b\x71\x25\xae\xc6\x7a\x9c\xdc\xb1\xfe\x70\x5b\xfb\xa9\x1d\xed\x0b\xdb\xda\x4f\x4f\x68\x3f\xb3\xa3\x7d\x54\xb7\x2f\xe7\xf6\xe3\xb1\x16\xbf\x8c\xab\xf1\xc6\xfd\xf6\xc5\x09\x17\x46\x2d\x4d\x68\xaf\x26\xb4\xe7\xfc\x07\x8e\xff\x22\xe5\xfc\x87\x8d\xaf\x3a\xff\x95\xd4\xde\x6b\x4d\x6b\x77\xde\xef\xef\x38\xee\x9b\xd3\x71\x3f\xe7\xc2\xdf\xfe\xfb\xc2\xce\xa3\x6b\xfa\x6e\xc7\xe0\xfe\xbe\x35\xd5\xfb\x77\xac\x83\xfe\x6c\xfe\x9f\x3c\x35\x8a\x77\xae\xaf\x5f\x3b\xfe\x9b\xcb\x37\x6e\x5c\x3b\x15\x69\xb2\x6d\xe9\xe9\x48\x93\x27\x2c\xe7\xbf\x90\xbe\x72\xfe\x2f\x3e\xbf\xd5\x9e\xff\xee\x37\x8f\xd7\x3b\xef\x8f\x1e\x39\xff\x59\x71\x3b\x86\xbb\xe6\xff\x7c\x63\xbe\xde\xdf\x97\xa6\xdc\xb7\x2e\xe4\xfc\x47\xe9\x2b\xe7\x9f\x1f\x81\xc6\x1f\xff\xf3\x9c\xff\xee\xc7\xff\xcb\x1d\xf4\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1e\xa6\xaa\xaa\xcd\x5b\x44\x2f\x44\xc4\xf9\x74\xff\x4f\x57\xf7\x66\x02\x00\x53\xf5\x87\x1f\xa6\x99\x2a\x09\xb5\x5a\xad\x56\xab\xd5\x73\x53\xf7\xd2\xb2\xbd\xae\xdf\x54\x8d\xf7\x5a\xb3\x68\x8d\x04\xb8\xf9\x9e\xc1\x6f\xc7\x7d\x33\x00\x60\x96\xfd\x2f\x22\xfe\xd9\x75\x27\xe8\x8c\xfc\x0b\x96\x3f\xef\xaf\x9e\x7e\xb1\xeb\xce\x00\x53\x75\xfd\xdd\xf7\x7e\x7e\xf9\xea\xd5\xf5\x6b\xd7\xbb\xee\x09\x00\x00\x00\x00\x00\x00\x00\xf0\x69\xe5\xf1\x3f\x57\x1b\xe3\x3f\x6f\x5e\x07\xd4\x1a\x37\x7a\xdb\xf8\xaf\xaf\xc7\xea\xdc\x8e\xff\xd9\x1f\x0d\x36\xc7\x3a\x4f\x3b\xf4\x5c\x3c\x7c\xfc\xef\x63\xf1\xf0\xf1\xbf\x87\x13\x7e\xde\xc2\x84\xf6\xd1\x84\xf6\xc5\x09\xed\x4b\x13\xda\xc7\xde\xe8\xd1\x90\xf3\x7f\x2e\x65\x9c\xf3\x3f\x9a\x76\xac\xa4\xf1\x5f\x5f\xec\xa0\x3f\x5d\xcb\xf9\x1f\x4b\x63\x3d\xe7\xfc\xbf\xdc\x5a\xaf\x99\x7f\xf5\xd7\x79\xce\xbf\xbf\x2d\xff\x13\x37\xde\xfe\xd5\x89\xeb\xef\xbe\xf7\xca\x95\xb7\x2f\xbf\xb5\xfe\xd6\xfa\x2f\x4e\x9d\x3c\x7f\xf6\xcc\xb9\xb3\x67\xce\x9d\x3b\xf1\xe6\x95\xab\xeb\x27\xb7\xfe\xed\xb0\xc7\xfb\x2b\xe7\x9f\xc7\xbe\x76\x1d\x68\x59\x72\xfe\x39\x73\xf9\x97\x25\xe7\xff\xa5\x54\xcb\xbf\x2c\x39\xff\x17\x52\x2d\xff\xb2\xe4\xfc\xf3\xf3\x3d\xf9\x97\x25\xe7\x9f\x5f\xfb\xc8\xbf\x2c\x39\xff\x97\x52\x2d\xff\xb2\xe4\xfc\xbf\x92\x6a\xf9\x97\x25\xe7\xff\x72\x7a\x2b\x51\xfe\x65\xc9\xf9\x7f\x35\xd5\xf2\x2f\x4b\xce\xff\x95\x54\xcb\xbf\x2c\x39\xff\xe3\xa9\x96\x7f\x59\x72\xfe\x27\x52\x2d\xff\xb2\xe4\xfc\xf3\x19\x2e\xf9\x97\x25\xe7\x9f\xaf\x6c\x90\x7f\x59\x72\xfe\xa7\x53\x2d\xff\xb2\xe4\xfc\xcf\xa4\x5a\xfe\x65\xc9\xf9\x9f\x4d\xb5\xfc\xcb\x92\xf3\x3f\x97\x6a\xf9\x97\x25\xe7\x7f\x3e\xd5\xf2\x2f\x4b\xce\xff\x6b\xa9\x96\x7f\x59\x72\xfe\x5f\x4f\xb5\xfc\xcb\x92\xf3\x7f\x35\xd5\xf2\x2f\x4b\xce\xff\x1b\xa9\x96\x7f\x59\x72\xfe\xdf\x4c\xb5\xfc\xcb\x92\xf3\xff\x56\xaa\xe5\x5f\x96\x9c\xff\xb7\x53\x2d\xff\xb2\xe4\xfc\xbf\x93\x6a\xf9\x97\x25\xe7\xff\x5a\xaa\xe5\x5f\x96\x07\x9f\xff\x6f\x66\xca\x33\xff\xf9\x7b\xc4\x0c\x74\xc3\x8c\x99\x71\x33\x5d\xff\x65\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xda\xa6\x71\x39\x71\xd7\xfb\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfc\x9f\x1d\x38\x10\x00\x00\x00\x00\x00\xf2\x7f\x6d\x84\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\x2a\xec\xc0\x81\x00\x00\x00\x00\x00\x90\xff\x6b\x23\x54\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x55\x61\xef\xee\x62\xe4\x3a\xeb\x33\x80\x9f\xfd\xb2\xd7\x4e\x20\x2e\x09\x21\x04\x43\xd6\x8e\x13\x0c\xd9\x78\x77\xfd\x95\x98\x60\x30\x9f\x4d\x43\x4b\xd3\x40\x68\x69\x43\x1d\x63\xaf\x1d\x83\xbf\xea\x5d\x43\x12\x45\xcd\xa6\x49\xdb\x20\x22\x35\x52\xb9\x48\x2f\x4a\x01\x51\x84\xd4\x56\x89\x10\x52\xa9\x94\xa2\x48\x45\x6a\xef\x9a\x2b\x50\x6e\x50\x2b\xe5\xc2\x52\x93\xca\x44\xd0\x8a\x8a\x64\xab\x33\xe7\x7d\xdf\x9d\x99\x9d\x9d\xd9\xb5\xbd\xf6\x99\x73\x7e\xbf\x28\xfe\x7b\x67\xce\xcc\xbc\x73\xe6\xcc\xec\x3e\x6b\x3d\x33\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x34\xdb\xf4\x91\xe9\x3f\x1f\xc8\xb2\x2c\xff\xbf\xf1\xc7\x86\x2c\xbb\x32\xff\xfb\xba\x6c\x5f\xfe\xe5\xdc\xee\xcb\xbd\x42\x00\x00\x00\xe0\x42\xbd\xde\xf8\xf3\xef\xaf\x4a\x27\xec\x5b\xc6\x85\x9a\xb6\xf9\xd7\x77\xfd\xfb\xf7\xe7\xe7\xe7\xe7\xb3\xcf\xbf\x76\xf6\x8d\xbf\x9c\x9f\x4f\x67\x8c\x65\xd9\xd0\xda\x2c\x6b\x9c\x17\xfd\xdb\x2f\x7f\x31\xdf\xbc\x4d\xf0\x78\x36\x3a\x30\xd8\xf4\xf5\x60\x8f\x9b\x1f\xea\x71\xfe\x70\x8f\xf3\x47\x7a\x9c\xbf\xa6\xc7\xf9\x6b\x7b\x9c\x3f\xda\xe3\xfc\x45\x3b\x60\x91\x75\xc5\xef\x63\x1a\x57\xb6\xa5\xf1\xd7\x0d\xc5\x2e\xcd\xae\xc9\x46\x1a\xe7\x6d\xe9\x70\xa9\xc7\x07\xd6\x0e\x0e\xc6\xdf\xe5\x34\x0c\x34\x2e\x33\x3f\x72\x38\x3b\x9a\x1d\xcb\xa6\xb3\xc9\x45\x97\x19\x68\xfc\x97\x65\xcf\x6f\xca\x6f\xeb\xce\x2c\xde\xd6\x60\xd3\x6d\x6d\xcc\xb2\xec\xdc\xcf\x1e\x39\x18\xd7\x30\x10\xf6\xf1\x96\xac\xe5\xc6\x1a\x9a\x1f\xbb\x57\x3f\x94\x8d\xbd\xf6\xb3\x47\x0e\x7e\x67\xf6\x95\xb7\x77\x9a\x3d\x77\xc3\xa2\x95\x66\xd9\xd6\xcd\xf9\x3a\x9f\xc8\xb2\x85\x5f\x57\x65\x03\xd9\xda\xb4\x4f\xe2\x3a\x07\x9b\xd6\xb9\xb1\xc3\x3a\x87\x5a\xd6\x39\xd0\xb8\x5c\xfe\xf7\xf6\x75\x9e\x5b\xe6\x3a\xe3\xfd\x1e\x0d\xeb\x7c\xb1\xcb\x3a\x37\x86\xd3\x1e\xbc\x31\xcb\xb2\xb9\x6c\xc9\x6d\xda\x3d\x9e\x0d\x66\xeb\xdb\x6e\x35\xed\xef\xd1\xe2\x88\xc8\xaf\x23\x7f\x28\xdf\x92\x0d\xaf\xe8\x38\xd9\xb4\x8c\xe3\x24\xbf\xcc\xcb\x37\xb6\x1e\x27\xed\xc7\x64\xdc\xff\x9b\xc2\x3e\x19\x5e\x62\x0d\xcd\x0f\xc7\xab\x8f\xad\x59\xb4\xdf\xcf\xf7\x38\xc9\xef\x75\x19\x8e\xd5\xfc\xba\xef\xce\x6f\x74\x74\xb4\xf9\x57\xab\x2d\xc7\x6a\xbe\xcd\x23\x37\x2d\x7d\x0c\x74\x7c\xec\x3a\x1c\x03\xe9\x58\x6e\x3a\x06\x36\xf7\x3a\x06\x06\xd7\x0c\x35\x8e\x81\xc1\x85\x35\x6f\x6e\x39\x06\xa6\x16\x5d\x66\x30\x1b\x68\xdc\xd6\xd9\x9b\xba\x1f\x03\x13\xb3\xc7\x4f\x4d\xcc\x3c\xf4\xf0\xad\x47\x8f\x1f\x38\x32\x7d\x64\xfa\xc4\xd4\xe4\xee\x9d\x3b\x76\xed\xdc\xb1\x6b\xd7\xc4\xe1\xa3\xc7\xa6\x27\x8b\x3f\x57\xb6\x4b\xfb\xc8\xfa\x6c\x30\x1d\x83\x9b\xc3\x6b\x4d\x3c\x06\xdf\xdd\xb6\x6d\xf3\x21\x39\xff\xcd\x8b\xf7\x3c\x18\x2d\xc9\xf3\x20\xbf\xef\x9f\xbe\x39\x5f\xd0\x95\x83\xd9\x12\xc7\x78\xbe\xcd\x13\x5b\x2f\xfc\x79\x90\xbe\xef\x37\x3d\x0f\x86\x9b\x9e\x07\x1d\x5f\x53\x3b\x3c\x0f\x86\x97\xf1\x3c\xc8\xb7\x39\xb7\x75\x79\xdf\x33\x87\x9b\xfe\xef\xb4\x86\xd5\x7a\x2d\xdc\xd0\x74\x0c\x5c\xce\xef\x87\xf9\x6d\xde\xf7\x9e\xa5\x5f\x0b\x37\x86\x75\x3d\xf9\xde\x95\x7e\x3f\x1c\x5a\x74\x0c\xc4\xbb\x35\x10\x9e\x7b\xf9\x29\xe9\xe7\xbd\xd1\xdb\xc3\x7e\x59\x7c\x5c\x5c\x9f\x9f\x71\xc5\x9a\xec\xcc\xcc\xf4\xe9\x6d\x0f\x1e\x98\x9d\x3d\x3d\x95\x85\x71\x49\x5c\xdd\xf4\x58\xb5\x1f\x2f\xeb\x9b\xee\x53\xb6\xe8\x78\x19\x5c\xf1\xf1\xb2\xef\xef\x7e\x75\xf3\xf5\x1d\x4e\xdf\x10\xf6\xd5\xe8\x2d\xdd\x1f\xab\x7c\x9b\x9d\xe3\xdd\x1f\xab\xc6\xab\x7b\xeb\xfe\x5c\x93\x15\xfb\xb3\xe5\xd4\xed\x59\x18\x17\xd9\xa5\xde\x9f\x9d\xbe\x9b\xe5\xfb\x33\x65\x89\x2e\xfb\x33\xdf\xe6\x89\x5b\x2f\xfc\x67\xc1\x94\x4b\x9a\x5e\xff\x46\x7a\xbd\xfe\x0d\x8d\x0c\x17\xaf\x7f\x43\x69\x6f\x8c\xb4\xbc\xfe\x2d\x7e\x68\x86\x1a\x2b\xcb\xb2\x73\xb7\x2e\xef\xf5\x6f\x24\xfc\x7f\xa9\x5f\xff\xae\x29\xc9\xeb\x5f\xbe\xaf\xee\xdb\xd6\xfd\x18\xc8\xb7\x79\x72\x62\xa5\xc7\xc0\x70\xd7\xd7\xbf\x1b\xc3\x1c\x08\xeb\x79\x4f\x48\x0c\xa3\x4d\xb9\xff\x8d\xc6\xf9\x73\xc5\x61\xda\xf4\x58\xf6\x3c\x6e\x86\x87\x47\xc2\x71\x33\x1c\x6f\xb1\xf5\xb8\xd9\xb1\xe8\x32\xf9\xb5\xe5\xb7\xbd\x75\xf2\xfc\x8e\x9b\xad\x37\xb6\x3e\x56\x2d\x3f\xb7\x54\xf0\xb8\xc9\xf7\xd5\xd7\x26\xbb\x1f\x37\xf9\x36\x2f\x4c\x5d\xf8\x6b\xc7\xba\xf8\xd7\xa6\xd7\x8e\x35\xbd\x8e\x81\x91\xa1\x35\xf9\x7a\x47\xd2\x41\x50\xbc\xde\xcd\xaf\x8b\xc7\xc0\xb6\xec\x60\x76\x32\x3b\x96\x1d\x4a\x97\xc9\x1f\xe5\xfc\xb6\xc6\xb7\x2f\xef\x18\x58\x13\xfe\xbf\xd4\xaf\x1d\xd7\x95\xe4\x18\xc8\xf7\xd5\x33\xdb\xbb\x1f\x03\xf9\x36\x3f\xda\x71\x71\x7f\x76\xda\x1a\x4e\x49\xdb\x34\xfd\xec\xd4\xfe\xfb\x85\xa5\x32\xff\xf5\xc3\x0b\xd7\xd7\xbe\xdb\x2e\x76\xe6\xcf\xd7\xf9\xd1\x1f\x7f\x32\x9d\xd6\x29\x43\xe4\xdb\xbc\xb2\x73\xa5\x39\xa3\xfb\x7e\xba\x25\x9c\x72\x45\x87\xfd\xd4\xfe\xfc\x59\xea\x98\x3e\x94\x5d\x9a\xfd\x74\x5d\x58\xe7\xb1\x5d\xdd\x7f\x37\x95\x6f\x73\xcd\xee\x65\x1e\x4f\xfb\xb2\x2c\x7b\x69\xea\xa5\xc6\xef\xbb\xc2\xef\x77\xbf\x77\xe6\xc7\xdf\x6f\xf9\xbd\x6f\xa7\xdf\x29\xbf\x34\xf5\xd2\x5d\x13\xf7\xfc\x64\x25\xeb\x07\x00\xe0\xfc\xbd\xd1\xf8\x73\x6e\x4d\xf1\xb3\x66\xd3\xbf\x58\x2f\xe7\xdf\xff\x01\x00\x00\x80\xbe\x10\x73\xff\x60\x98\x89\xfc\x0f\x00\x00\x00\x95\x11\x73\xff\x50\x98\x89\xfc\x0f\x00\x00\x00\x95\x11\x73\xff\x70\x98\x49\x4d\xf2\xff\x03\xb7\xef\x79\xf6\xf5\x47\xb3\xf4\x6e\x80\xf3\x41\x3c\x3f\xee\x86\xbb\x3f\x50\x6c\x17\x3b\xde\x73\xe1\xeb\xb1\xf9\x05\xf9\xe9\x1f\xfe\xf6\xc8\xb3\x5f\x79\x74\x79\xb7\x3d\x98\x65\xd9\xaf\xee\x7a\x47\xc7\xed\x1f\xf8\x40\x5c\x57\xe1\x54\x5c\xe7\xfb\x5a\x4f\x5f\xe4\xba\x1b\x96\x75\xfb\xf7\xdf\xbb\xb0\x5d\xf3\xfb\x27\x9c\xdb\x53\x5c\x7f\xbc\x3f\xcb\x3d\x0c\x62\x57\xf9\xf9\x89\xed\x8d\xeb\x1d\x7b\x68\xaa\x31\x5f\xb8\x2b\x6b\xcc\x7b\xe6\x9e\x7c\xbc\xb8\xfe\xe2\xeb\xb8\xfd\xd9\x1d\xc5\xf6\x7f\x1d\xde\xb4\x64\xdf\xe1\x81\x96\xcb\x6f\x0d\xeb\xd9\x12\xe6\x58\x78\x4f\x99\xbb\xf7\x2d\xec\x87\x7c\xc6\xcb\x3d\xbb\xf1\x5d\xff\x72\xf5\x67\x16\x6e\x2f\x5e\x6e\x60\xf3\x9b\x1b\x77\xf3\x99\x3f\x2e\xae\x37\xbe\x47\xd4\xd3\x57\x17\xdb\xc7\xfb\xbd\xd4\xfa\xff\xf9\xab\xdf\x7d\x36\xdf\xfe\xc1\x9b\x3a\xaf\xff\xd1\xc1\xce\xeb\x3f\x1b\xae\xf7\xe5\x30\x7f\xb9\xb7\xd8\xbe\x79\x9f\x7f\xa5\x69\xfd\x7f\x1a\xd6\x1f\x6f\x2f\x5e\x6e\xdb\xb7\x7e\xd8\x71\xfd\xcf\xbd\xad\xd8\xfe\xb9\x70\x5c\x7c\x23\xcc\xf6\xf5\x7f\xe8\x2f\xde\xf9\x7a\xa7\xc7\x2b\xde\xce\xbe\x3b\x8a\xcb\xc5\xdb\x9f\xfc\x9f\x9d\x8d\xcb\xc5\xeb\x8b\xd7\xdf\xbe\xfe\xd1\x47\xa7\x5a\xf6\x47\xfb\xf5\xbf\xf0\x5a\x71\x3d\x7b\xbf\xf4\xf3\xa1\xe6\xed\xe3\xe9\xf1\x76\xa2\xfb\xef\x68\x3d\xbe\x07\xc2\xe3\xdb\xd2\x23\xcf\xb2\xec\xbb\x7f\x96\xb5\xec\xe7\xec\xfd\xc5\xe5\xfe\xa9\x6d\xfd\xf1\xfa\x4e\xdd\xd1\x79\xfd\xb7\xb4\xad\xf3\xd4\xc0\x0d\x8d\xcb\x2f\xdc\x9f\x0d\x2d\xf7\xeb\xeb\x7f\xbb\xbd\xe3\xfd\x8d\xeb\xd9\xf7\x0f\x1b\x5a\xee\xcf\xd3\x1f\x0b\xfb\xef\xb5\x89\x1f\xe5\xd7\x7b\xf6\x9e\x70\x3c\x86\xf3\xff\xef\xc5\xe2\xfa\xda\xdf\xcb\xf4\xb9\x8f\xb5\xbe\xde\xc4\xed\xbf\xb1\xa1\x78\xde\xc6\xeb\x9b\x68\x5b\xff\xd3\x6d\xeb\x9f\xbb\x21\xdf\x77\xbd\xd7\x7f\xe7\x6b\xc5\xfa\x9f\xfb\xe0\xda\x96\xf5\xef\xfb\x78\x38\x9e\xee\x2c\x66\xaf\xf5\x1f\xf9\x9b\xab\x5a\x2e\xff\xcd\xef\x14\x8f\xc7\xe9\x2f\x8f\x9f\x38\x39\x73\xe6\xe8\xa1\xa6\xbd\xda\xfc\x3c\x5e\x3b\xba\x6e\xfd\x15\x57\xbe\xe9\xcd\x57\x85\xd7\xd2\xf6\xaf\xf7\x9f\x9c\x7d\x60\xfa\xf4\xd8\xe4\xd8\x64\x96\x8d\xf5\xe1\x5b\x06\xae\xf6\xfa\xbf\x15\xe6\x7f\x17\x63\xee\xe2\xdf\x42\xe1\x27\x3f\x2f\x8e\xbb\xa7\x3e\x51\x7c\xdf\x7a\xf7\x2f\x8a\xaf\x9f\x0e\xa7\xdf\x1f\x1e\xcf\xf8\xfd\xf1\xeb\x7f\x35\xd2\x72\xbc\xb6\x3f\xee\x73\x1f\x2c\xe6\x85\xae\xff\xbd\x61\x1d\xcb\xf5\xb6\xaf\xfe\xe7\x0d\xcb\xda\xf0\xec\xe7\x9e\x3f\xf3\x8f\x7f\xf2\x4a\xfb\xcf\x05\xf1\xfe\x9c\x7a\xeb\x68\xe3\xfe\x3d\xb3\xe9\xda\xc6\x79\x03\x2f\x14\xe7\xb7\xbf\x5e\xf5\xf2\x1f\x6f\x6d\x7d\x5e\xff\x74\x78\xb2\x31\x7f\x10\xf6\xeb\x7c\x78\x67\xe6\xcd\xd7\x16\xb7\xd7\x7e\xfd\xf1\xbd\x49\x9e\xfa\x54\xf1\xfc\x8d\x3f\xc9\xc5\xcb\x67\x6d\xef\x27\xb2\x61\xa8\xf5\x7e\x5c\xe8\xfa\x7f\x1a\x7e\x8e\xf9\xe1\x75\xad\xaf\x7f\xf1\xf8\xf8\xc1\xa3\x6d\xef\xe6\xbc\x21\x1b\xc8\x97\x30\x17\x5e\x1f\xb2\xb9\xe2\xfc\xb8\x55\xdc\xdf\x4f\x9d\xbb\xb6\xe3\xed\xc5\xf7\xe1\xc9\xe6\xde\xbe\x92\x65\x2e\x69\xe6\xa1\x99\x89\x63\x47\x4f\x9c\x79\x70\x62\x76\x7a\x66\x76\x62\xe6\xa1\x87\xf7\x1f\x3f\x79\xe6\xc4\xec\xfe\xc6\x7b\x97\xee\xff\x42\xaf\xcb\x2f\x3c\xbf\xd7\x37\x9e\xdf\x87\xa6\x77\xef\xcc\x1a\xcf\xf6\x93\xc5\x58\x65\x97\x7b\xfd\xa7\xee\x3d\x78\xe8\xb6\xc9\x9b\x0f\x4d\x1f\x3e\x70\xe6\xf0\xec\xbd\xa7\xa6\x4f\x1f\x39\x38\x33\x73\x70\xfa\xd0\xcc\xcd\x07\x0e\x1f\x9e\xfe\x72\xaf\xcb\x1f\x3d\xb4\x77\x6a\xfb\x9e\x1d\xb7\x6d\x1f\x3f\x72\xf4\xd0\xde\xdb\xf7\xec\xd9\xb1\x67\xfc\xe8\x89\x93\xf9\x32\x8a\x45\xf5\xb0\x7b\xf2\x8b\xe3\x27\x4e\xef\x6f\x5c\x64\x66\xef\xce\x3d\x53\xbb\x76\xed\x9c\x1c\x3f\x7e\xf2\xd0\xf4\xde\xdb\x26\x27\xc7\xcf\xf4\xba\x7c\xe3\x7b\xd3\x78\x7e\xe9\x2f\x8d\x9f\x9e\x3e\x76\x60\xf6\xe8\xf1\xe9\xf1\x99\xa3\x0f\x4f\xef\x9d\xda\xb3\x7b\xf7\xf6\x9e\xef\xfe\x78\xfc\xd4\xe1\x99\xb1\x89\xd3\x67\x4e\x4c\x9c\x99\x99\x3e\x3d\x51\xdc\x97\xb1\xd9\xc6\xc9\xf9\xf7\xbe\x5e\x97\xa7\x1e\x66\x4e\x86\xd7\xbb\x36\x03\xe1\xa7\xf3\xcf\xde\xb2\x3b\xbd\x3f\x6e\xee\xdb\x8f\x2d\x79\x55\xc5\x26\xad\x3f\x9e\x66\xaf\x86\xf7\x82\x8a\xdf\xdf\x7a\x7d\x1d\x73\xff\x48\x98\x49\x4d\xf2\x3f\x00\x00\x00\xd4\x41\xcc\xfd\xe1\x8d\xff\x17\xce\x90\xff\x01\x00\x00\xa0\x32\x62\xee\x5f\x1b\x66\x22\xff\x03\x00\x00\x40\x65\xc4\xdc\x5f\x24\xff\xd1\xf4\xf1\xef\x75\xc9\xff\x17\xab\xff\xff\x98\xfe\x7f\x83\xfe\xbf\xfe\x7f\xa6\xff\x9f\xe8\xff\xeb\xff\x67\xfa\xff\xfa\xff\x3d\xe8\xff\xeb\xff\xf7\xf3\xfa\xf5\xff\xf5\xff\xe9\xad\x6c\xfd\xff\x90\xfb\xb3\x75\x59\xe6\xdf\xff\x01\x00\x00\xa0\xa2\x62\xee\x5f\x1f\x66\x22\xff\x03\x00\x00\x40\x65\xc4\xdc\x7f\x45\x98\x89\xfc\x0f\x00\x00\x00\x95\x11\x73\xff\x95\x61\x26\x35\xc9\xff\x3e\xff\x5f\xff\x5f\xff\xbf\x5b\xff\x3f\x6e\xab\xff\x9f\xe9\xff\x97\xa1\xff\xbf\xe5\xbf\xf4\xff\x17\xd1\xff\xd7\xff\xcf\xf4\xff\xcf\xdb\xe5\xee\xcf\xf7\xfb\xfa\x4b\xd8\xff\x5f\xa7\xff\x4f\xd9\xac\x42\xff\x7f\x6d\xf3\x89\x2b\xed\xff\xc7\xdc\xff\xa6\x30\x93\x9a\xe4\x7f\x00\x00\x00\xa8\x83\x98\xfb\xdf\x1c\x66\x22\xff\x03\x00\x00\x40\x65\xc4\xdc\x7f\x55\x98\x89\xfc\x0f\x00\x00\x00\x95\x11\x73\xff\x86\x30\x93\x9a\xe4\x7f\xfd\x7f\xfd\x7f\xfd\x7f\x9f\xff\xaf\xff\xdf\x37\xfd\x7f\x9f\xff\xdf\x81\xfe\xbf\xfe\x7f\xa6\xff\x7f\xde\x2e\x77\x7f\xbe\xdf\xd7\x5f\xc2\xfe\xbf\xcf\xff\xa7\x74\xca\xf6\xf9\xff\x31\xf7\xff\x5a\x98\x49\x4d\xf2\x3f\x00\x00\x00\xd4\x41\xcc\xfd\x6f\x09\x33\x91\xff\x01\x00\x00\xa0\x32\x62\xee\xbf\x3a\xcc\x44\xfe\x07\x00\x00\x80\xca\x88\xb9\xff\x9a\x30\x93\x9a\xe4\xff\x7a\xf6\xff\x5f\xce\xb2\x4c\xff\x3f\xd3\xff\xd7\xff\x6f\x5b\xa7\xfe\xbf\xfe\xff\x6a\xd0\xff\xd7\xff\xef\x46\xff\x5f\xff\xbf\x9f\xd7\xaf\xff\xaf\xff\x4f\x6f\x65\xeb\xff\xc7\xdc\xff\xd6\x30\x93\x9a\xe4\x7f\x00\x00\x00\xa8\x83\x98\xfb\xaf\x0d\x33\x91\xff\x01\x00\x00\xa0\x32\x62\xee\x7f\x5b\x98\x89\xfc\x0f\x00\x00\x00\x95\x11\x73\xff\x75\x61\x26\x35\xc9\xff\xf5\xec\xff\xfb\xfc\x7f\xfd\xff\x82\xfe\x7f\xeb\x3a\xf5\xff\xf5\xff\x57\x83\xfe\xbf\xfe\x7f\x37\xfa\xff\xfa\xff\xfd\xbc\x7e\xfd\x7f\xfd\x7f\x7a\x2b\x5b\xff\x3f\xe6\xfe\xb7\x87\x99\xd4\x24\xff\x03\x00\x00\x40\x1d\xc4\xdc\x7f\x7d\x98\x89\xfc\x0f\x00\x00\x00\x95\x11\x73\xff\x3b\xc2\x4c\xe4\x7f\x00\x00\x00\xa8\x8c\x98\xfb\x37\x86\x99\xd4\x24\xff\xeb\xff\xeb\xff\xeb\xff\xeb\xff\xeb\xff\xeb\xff\xaf\xa6\xfe\xea\xff\x0f\x2e\x79\x8e\xfe\x7f\x41\xff\xbf\xd5\xc5\xeb\xff\xcf\x2d\x2c\x40\xff\xbf\x6f\xd6\xaf\xff\xaf\xff\x4f\x6f\x65\xeb\xff\xc7\xdc\xff\xce\x30\x93\x9a\xe4\x7f\x00\x00\x00\xa8\x83\x98\xfb\xdf\x15\x66\x22\xff\x03\x00\x00\x40\x65\xc4\xdc\x7f\x43\x98\x89\xfc\x0f\x00\x00\x00\x95\x11\x73\xff\x58\x98\x49\x4d\xf2\xbf\xfe\xbf\xfe\xbf\xfe\xbf\xfe\xbf\xfe\xbf\xfe\xff\x6a\xea\xaf\xfe\xff\xd2\xf4\xff\x0b\xfa\xff\xad\x7c\xfe\xbf\xfe\xbf\xfe\xbf\xfe\x3f\xdd\x95\xad\xff\x1f\x73\xff\xa6\x30\x93\x9a\xe4\x7f\x00\x00\x00\xa8\x83\x98\xfb\x37\x87\x99\xc8\xff\x00\x00\x00\x50\x19\x31\xf7\xdf\x18\x66\x22\xff\x03\x00\x00\x40\x65\xc4\xdc\xbf\x25\xcc\xa4\x26\xf9\x5f\xff\x5f\xff\x5f\xff\x5f\xff\x5f\xff\x5f\xff\x7f\x35\xe9\xff\xeb\xff\x77\xa3\xff\xaf\xff\xdf\xcf\xeb\xd7\xff\xd7\xff\xa7\xb7\xb2\xf5\xff\x63\xee\xbf\x29\xcc\xa4\x26\xf9\x1f\x00\x00\x00\xea\x20\xe6\xfe\x9b\xc3\x4c\xe4\x7f\x00\x00\x00\xa8\x8c\x98\xfb\xdf\x1d\x66\x22\xff\x03\x00\x00\x40\x65\xc4\xdc\xbf\x35\xcc\xa4\x26\xf9\x5f\xff\x5f\xff\x5f\xff\xbf\x8f\xfb\xff\x43\xfa\xff\x99\xfe\x7f\xe9\xe9\xff\xeb\xff\x77\xa3\xff\xaf\xff\xdf\xcf\xeb\xd7\xff\xd7\xff\xa7\xb7\xb2\xf5\xff\x63\xee\x7f\x4f\x98\x49\x4d\xf2\x3f\x00\x00\x00\xd4\x41\xcc\xfd\xef\x0d\x33\x91\xff\x01\x00\x00\xa0\x32\x62\xee\xbf\x25\xcc\x44\xfe\x07\x00\x00\x80\xca\x88\xb9\x7f\x3c\xcc\xa4\x26\xf9\x5f\xff\x5f\xff\x5f\xff\xbf\x8f\xfb\xff\x3e\xff\xbf\x65\xfd\xfa\xff\xe5\xa4\xff\xaf\xff\xdf\x8d\xfe\xbf\xfe\x7f\x3f\xaf\x5f\xff\x5f\xff\x9f\xde\xca\xd6\xff\x8f\xb9\xff\xd6\x30\x93\x9a\xe4\x7f\x00\x00\x00\xa8\x83\x98\xfb\xb7\x85\x99\xc8\xff\x00\x00\x00\x50\x19\x31\xf7\x4f\x84\x99\xc8\xff\x00\x00\x00\x50\x19\x31\xf7\x4f\x86\x99\xd4\x24\xff\xeb\xff\xeb\xff\xeb\xff\xeb\xff\xeb\xff\xeb\xff\xaf\x26\xfd\x7f\xfd\xff\x6e\xf4\xff\xf5\xff\xfb\x79\xfd\xfa\xff\xfa\xff\xf4\x56\xb6\xfe\x7f\xcc\xfd\x53\x61\x26\x35\xc9\xff\x00\x00\x00\x50\x07\x31\xf7\x6f\x0f\x33\x91\xff\x01\x00\x00\xa0\x32\x62\xee\xdf\x11\x66\x22\xff\x03\x00\x00\x40\x65\xc4\xdc\xbf\x33\xcc\xa4\x26\xf9\xbf\x4f\xfa\xff\xdb\x52\x01\x4a\xff\x5f\xff\x5f\xff\x5f\xff\x5f\xff\xbf\xaf\xe8\xff\xeb\xff\x77\xa3\xff\xaf\xff\xdf\xcf\xeb\xd7\xff\xd7\xff\xa7\xd5\x60\x87\xd3\xca\xd6\xff\x8f\xb9\x7f\x57\x98\x49\x4d\xf2\x3f\x00\x00\x00\xd4\x41\xcc\xfd\xbb\xc3\x4c\xe4\x7f\x00\x00\x00\xa8\x8c\x98\xfb\x6f\x0b\x33\x91\xff\x01\x00\x00\xa0\x32\x62\xee\xbf\x3d\xcc\xa4\x26\xf9\xbf\x4f\xfa\xff\x3e\xff\x5f\xff\x5f\xff\xbf\x89\xfe\xbf\xfe\x7f\x3f\xd1\xff\x2f\x69\xff\x7f\xa0\xc7\x4d\xe9\xff\x2f\x8b\xfe\xbf\xfe\xbf\xfe\xbf\xfe\x3f\xdd\x95\xad\xff\x1f\x73\xff\x9e\x30\x93\x9a\xe4\x7f\x00\x00\x00\xa8\x83\x98\xfb\xdf\x17\x66\x22\xff\x03\x00\x00\x40\x65\xc4\xdc\x7f\x47\x98\x89\xfc\x0f\x00\x00\x00\x7d\xa5\xd3\xe7\x10\x46\x31\xf7\xbf\x3f\xcc\xa4\x26\xf9\x5f\xff\xbf\xea\xfd\xff\xf9\xb5\xfa\xff\xfa\xff\xfa\xff\xdd\xd7\xaf\xff\xbf\xba\xf4\xff\x4b\xda\xff\xef\x45\xff\x7f\x59\xf4\xff\xf5\xff\xf5\xff\xf5\xff\xe9\xae\x6c\xfd\xff\x98\xfb\xf7\x86\x99\xd4\x24\xff\x03\x00\x00\x40\x1d\xc4\xdc\xff\x81\x30\x13\xf9\x1f\x00\x00\x00\x2a\x23\xe6\xfe\x0f\x86\x99\xc8\xff\x00\x00\x00\x50\x19\x31\xf7\xef\x0b\x33\xa9\x49\xfe\xd7\xff\xaf\x7a\xff\xdf\xe7\xff\xeb\xff\xeb\xff\xf7\x5a\xbf\xfe\xff\xea\xd2\xff\xd7\xff\xef\x46\xff\xbf\x3f\xfb\xff\xe1\xc7\x16\xfd\xff\x12\xf5\xff\xf3\x63\x48\xff\x9f\x32\x2a\x5b\xff\x3f\xe6\xfe\x0f\x85\x99\xd4\x24\xff\x03\x00\x00\x40\x1d\xc4\xdc\xff\xe1\x30\x13\xf9\x1f\x00\x00\x00\x2a\x23\xe6\xfe\x8f\x84\x99\xc8\xff\x00\x00\x00\x50\x19\x31\xf7\x7f\x34\xcc\xa4\x26\xf9\x5f\xff\x5f\xff\x5f\xff\x5f\xff\x5f\xff\x5f\xff\x7f\x35\xe9\xff\xaf\x5a\xff\xbf\xf1\x52\xa8\xff\x5f\xd0\xff\x3f\x3f\x2b\xe9\xcf\xaf\xe9\x70\x79\xfd\xff\xf2\xf4\xff\x7d\xfe\x3f\x65\x55\xb6\xfe\x7f\xcc\xfd\x1f\x0b\x33\xa9\x49\xfe\x07\x00\x00\x80\x3a\x88\xb9\xff\xe3\x61\x26\xf2\x3f\x00\x00\x00\x54\x46\xcc\xfd\xbf\x1e\x66\x22\xff\x03\x00\x00\x40\x65\xc4\xdc\x7f\x67\x98\x49\x4d\xf2\xbf\xfe\xbf\xfe\xbf\xfe\xbf\xfe\xbf\xfe\xbf\xfe\xff\x6a\xd2\xff\x5f\x59\xff\xff\x7f\x57\xd8\x3f\xd7\xff\x2f\xe8\xff\x9f\x9f\xcb\xdd\x9f\xef\xf7\xf5\xeb\xff\xeb\xff\xd3\x5b\xd9\xfa\xff\x31\xf7\xff\x46\x98\x49\x4d\xf2\x3f\x00\x00\x00\xd4\x41\xcc\xfd\x77\x85\x99\xc8\xff\x00\x00\x00\x50\x19\x31\xf7\x7f\x22\xcc\x44\xfe\x07\x00\x00\x80\x3e\xd3\xe9\x13\x4b\x0b\x31\xf7\xff\x66\x98\x49\x4d\xf2\x7f\xff\xf5\xff\xc7\xfa\xb2\xff\x3f\x98\xae\x5f\xff\x5f\xff\x5f\xff\x5f\xff\x5f\xff\xff\x62\xaa\x5a\xff\x7f\xa5\xeb\xd2\xff\x2f\xe8\xff\x9f\x9f\xcb\xdd\x9f\xef\xf7\xf5\xeb\xff\xeb\xff\xd3\x5b\xd9\xfa\xff\x31\xf7\xff\x56\x98\x49\x4d\xf2\x3f\x00\x00\x00\xd4\x41\xcc\xfd\x9f\x0c\x33\x91\xff\x01\x00\x00\xa0\x32\x62\xee\xff\xed\x30\x13\xf9\x1f\x00\x00\x00\x2a\x23\xe6\xfe\xbb\xc3\x4c\x6a\x92\xff\x2f\x76\xff\xbf\xfd\xf2\xdd\xf8\xfc\x7f\xfd\xff\x4c\xff\x5f\xff\x5f\xff\x5f\xff\xff\x02\xe9\xff\xeb\xff\x67\xfa\xff\xe7\xed\x72\xf7\xe7\xfb\x7d\xfd\xfa\xff\xfa\xff\xf4\x56\xb6\xfe\x7f\xcc\xfd\xbf\x13\x66\x52\x93\xfc\x0f\x00\x00\x00\x75\x10\x73\xff\x3d\x61\x26\xf2\x3f\x00\x00\x00\x94\xd4\x03\x2b\xbe\x44\xcc\xfd\x9f\x0a\x33\x91\xff\x01\x00\x00\xa0\x32\x62\xee\xff\x74\x98\x49\x4d\xf2\x7f\xff\x7d\xfe\xbf\xfe\xbf\xfe\xbf\xfe\xbf\xfe\xbf\xfe\x7f\x3f\xd1\xff\xd7\xff\xef\x46\xff\x5f\xff\xbf\x9f\xd7\xaf\xff\xaf\xff\x4f\x6f\x65\xeb\xff\xc7\xdc\x7f\x6f\x98\x49\x4d\xf2\x3f\x00\x00\x00\xd4\x41\xcc\xfd\x9f\x09\x33\x91\xff\x01\x00\x00\xa0\x32\x62\xee\xff\xdd\x30\x13\xf9\x1f\x00\x00\x00\x2a\x23\xe6\xfe\xdf\x0b\x33\xa9\x49\xfe\xd7\xff\xd7\xff\xd7\xff\xd7\xff\xd7\xff\xd7\xff\x5f\x4d\xfa\xff\x8b\xfb\xff\xf9\x6b\x98\xfe\x7f\x41\xff\x5f\xff\xbf\x9f\xd7\xaf\xff\xaf\xff\x4f\x6f\x65\xeb\xff\xc7\xdc\xff\xd9\x30\x93\x9a\xe4\x7f\x00\x00\x00\xa8\x83\x98\xfb\x7f\x3f\xcc\x44\xfe\x07\x00\x00\x80\xca\x88\xb9\xff\x0f\xc2\x4c\xe4\x7f\x00\x00\x00\xa8\x8c\x98\xfb\xef\x0b\x33\xa9\x49\xfe\xd7\xff\xd7\xff\xd7\xff\xd7\xff\xd7\xff\xd7\xff\x5f\x4d\xfa\xff\x3e\xff\xbf\x1b\xfd\x7f\xfd\xff\x7e\x5e\xbf\xfe\xbf\xfe\x3f\xbd\x95\xad\xff\x1f\x73\xff\xe7\xc2\x4c\x6a\x92\xff\x01\x00\x00\xa0\x0e\x62\xee\xff\xc3\x30\x13\xf9\x1f\x00\x00\x00\x2a\x23\xe6\xfe\xfd\x61\x26\xf2\x3f\x00\x00\x00\x54\x46\xcc\xfd\xf7\x87\x99\xd4\x24\xff\xeb\xff\x97\xb7\xff\xff\x35\xfd\x7f\xfd\x7f\xfd\xff\x96\xfd\xa9\xff\xaf\xff\xdf\x89\xfe\xbf\xfe\x7f\xa6\xff\x7f\xde\x2e\x77\x7f\xbe\xdf\xd7\xaf\xff\xaf\xff\x4f\x6f\x65\xeb\xff\xc7\xdc\x7f\x20\xcc\x64\x5f\xeb\xcd\x00\x00\x00\x00\xfd\x2b\xe6\xfe\xcf\x87\x99\xd4\xe4\xdf\xff\x01\x00\x00\xa0\x0e\x62\xee\x3f\x18\x66\x22\xff\x03\x00\x00\x40\x65\xc4\xdc\x7f\x28\xcc\xa4\x26\xf9\x5f\xff\xbf\xbc\xfd\x7f\x9f\xff\xaf\xff\x7f\xe9\xfb\xff\xd9\xa0\xfe\xff\xc2\xe9\xfa\xff\x17\x87\xfe\xbf\xfe\x7f\x37\xfa\xff\xfa\xff\xfd\xbc\x7e\xfd\x7f\xfd\x7f\x7a\x2b\x5b\xff\x3f\xe6\xfe\xe9\x30\x93\x9a\xe4\x7f\x00\x00\x00\xa8\x83\x98\xfb\x0f\x87\x99\xc8\xff\x00\x00\x00\x50\x19\x31\xf7\x1f\x09\x33\x91\xff\x01\x00\x00\xa0\x32\x62\xee\x7f\x20\xcc\xa4\x26\xf9\x5f\xff\x5f\xff\x5f\xff\xbf\xb6\xfd\xff\x17\xbf\xd7\xb6\x4e\x9f\xff\xaf\xff\xbf\x1a\xf4\xff\xf5\xff\xbb\xd1\xff\xd7\xff\xbf\xd0\xf5\xaf\x8d\x7f\xd7\xff\xd7\xff\xa7\x94\xca\xd6\xff\x8f\xb9\xff\x68\x98\x49\x4d\xf2\x3f\x00\x00\x00\xd4\x41\xcc\xfd\x5f\x08\x33\x91\xff\x01\x00\x00\xa0\x32\x62\xee\xff\x62\x98\x89\xfc\x0f\x00\x00\x00\x95\x11\x73\xff\xb1\x30\x93\x9a\xe4\x7f\xfd\x7f\xfd\x7f\xfd\xff\xda\xf6\xff\x3b\x7c\xfe\x7f\x87\xfe\xff\xba\x85\xdb\xd5\xff\xd7\xff\x3f\x1f\xfa\xff\xfa\xff\xdd\xe8\xff\xeb\xff\xf7\xf3\xfa\xf5\xff\xf5\xff\xe9\xad\x6c\xfd\xff\x98\xfb\x8f\x87\x99\xd4\x24\xff\x03\x00\x00\x40\x1d\xc4\xdc\x7f\x22\xcc\x44\xfe\x07\x00\x00\x80\xca\x88\xb9\xff\x64\x98\x89\xfc\x0f\x00\x00\x00\x95\x11\x73\xff\xa9\x30\x93\x9a\xe4\x7f\xfd\xff\x95\xf5\xff\x07\x96\xe8\x06\xea\xff\x77\x5e\xbf\xfe\x7f\x05\xfa\xff\x4d\x96\xdb\xff\x8f\x05\x66\xfd\x7f\xfd\xff\x4c\xff\x5f\xff\xbf\x07\xfd\x7f\xfd\xff\x7e\x5e\xbf\xfe\xbf\xfe\x3f\xbd\x95\xad\xff\x1f\x73\xff\x1f\x85\x99\xd4\x24\xff\x03\x00\x00\x40\x1d\xc4\xdc\x7f\x3a\xcc\x44\xfe\x07\x00\x00\x80\xca\x88\xb9\x7f\x26\xcc\x44\xfe\x07\x00\x00\x80\xca\x88\xb9\x7f\x36\xcc\xa4\x26\xf9\x5f\xff\xdf\xe7\xff\xeb\xff\xeb\xff\x5f\xec\xfe\x7f\xa4\xff\xaf\xff\xff\xff\xec\xdd\xe7\x92\x66\x65\xd5\xc7\xe1\x87\x81\xc1\xa1\x2c\xab\x3c\x04\x4e\xc1\x23\xd0\x33\xf0\xab\x5f\xad\xf2\x08\xac\x32\x27\x30\x63\x56\x8c\x88\x59\xcc\x09\xb3\x62\xce\x39\xe7\x9c\x33\x8a\x39\x56\x61\xd1\xbd\xd6\xc2\x6e\xbb\xf7\xee\x9e\xe9\xa7\x7b\xef\x7b\x5d\xd7\x07\xd6\xfb\x0e\x50\xdc\x38\xa3\xd6\xbf\xf0\x57\x7b\xa3\xff\xd7\xff\xcf\xd0\xff\xeb\xff\xd7\xfc\x7e\xfd\xbf\xfe\x9f\x79\x4b\xeb\xff\x73\xf7\x3f\x20\x6e\x69\xb2\xff\x01\x00\x00\xa0\x83\xdc\xfd\x0f\x8c\x5b\xec\x7f\x00\x00\x00\x18\x46\xee\xfe\x07\xc5\x2d\xf6\x3f\x00\x00\x00\x0c\x23\x77\xff\x83\xe3\x96\x26\xfb\x5f\xff\xaf\xff\xd7\xff\xeb\xff\xf5\xff\xfa\xff\x6d\xd2\xff\xeb\xff\xa7\xe8\xff\xf5\xff\x6b\x7e\xbf\xfe\xff\xf8\xfd\xff\x95\xfb\xfe\x33\x85\xf1\x2d\xad\xff\xcf\xdd\xff\x90\xb8\xa5\xc9\xfe\x07\x00\x00\x80\x0e\x72\xf7\x3f\x34\x6e\xb1\xff\x01\x00\x00\x60\x18\xb9\xfb\x1f\x16\xb7\xd8\xff\x00\x00\x00\x30\x8c\xdc\xfd\x0f\x8f\x5b\x9a\xec\x7f\xfd\xbf\xfe\x5f\xff\xaf\xff\xd7\xff\xeb\xff\xb7\x49\xff\xaf\xff\x9f\xa2\xff\xd7\xff\xaf\xf9\xfd\xfa\x7f\xdf\xff\x67\xde\xd2\xfa\xff\xdc\xfd\x8f\x88\x5b\x9a\xec\x7f\x00\x00\x00\xe8\x20\x77\xff\x23\xe3\x16\xfb\x1f\x00\x00\x00\x86\x91\xbb\xff\x51\x71\x8b\xfd\x0f\x00\x00\x00\xc3\xc8\xdd\x7f\x4d\xdc\xd2\x64\xff\xeb\xff\xf5\xff\xfa\xff\x15\xf6\xff\x57\xe8\xff\xf5\xff\xeb\xa1\xff\xd7\xff\x4f\xd1\xff\xeb\xff\xd7\xfc\x7e\xfd\xbf\xfe\x9f\x79\x4b\xeb\xff\x73\xf7\x5f\x1b\xb7\x34\xd9\xff\x00\x00\x00\xd0\x41\xee\xfe\x47\xc7\x2d\xf6\x3f\x00\x00\x00\x0c\x23\x77\xff\x63\xe2\x16\xfb\x1f\x00\x00\x00\x86\x91\xbb\xff\xb1\x71\x4b\x93\xfd\xaf\xff\xd7\xff\xeb\xff\x57\xd8\xff\xfb\xfe\xbf\xfe\x7f\x45\xf4\xff\xfa\xff\x29\xfa\x7f\xfd\xff\x9a\xdf\xaf\xff\xd7\xff\x33\x6f\x69\xfd\x7f\xee\xfe\xc7\xc5\x2d\x4d\xf6\x3f\x00\x00\x00\x74\x90\xbb\xff\xf1\x71\x8b\xfd\x0f\x00\x00\x00\xc3\xc8\xdd\xff\x84\xb8\xc5\xfe\x07\x00\x00\x80\x61\xe4\xee\x7f\x62\xdc\xd2\x64\xff\xeb\xff\xf5\xff\xfa\x7f\xfd\xbf\xfe\x5f\xff\xbf\x4d\xfa\x7f\xfd\xff\x14\xfd\xbf\xfe\x7f\xcd\xef\xd7\xff\xeb\xff\x99\xb7\xf5\xfe\xff\xde\xd7\xed\xdc\xa3\xf6\xff\xb9\xfb\xaf\x8b\x5b\x9a\xec\x7f\x00\x00\x00\xe8\x20\x77\xff\x93\xe2\x16\xfb\x1f\x00\x00\x00\x86\x91\xbb\xff\xc9\x71\x8b\xfd\x0f\x00\x00\x00\xc3\xc8\xdd\xff\x94\xb8\xa5\xc9\xfe\xd7\xff\xeb\xff\xef\xec\xff\x6f\xbf\x4c\xff\xaf\xff\xd7\xff\xdf\xf9\xe3\xfa\xff\x93\xa1\xff\xd7\xff\x4f\xd1\xff\xeb\xff\xd7\xfc\x7e\xfd\xbf\xfe\x9f\x79\x5b\xef\xff\x67\x7a\xff\xfd\xff\x7f\xee\xfe\xa7\xc6\x2d\x4d\xf6\x3f\x00\x00\x00\x74\x90\xbb\xff\x69\x71\x8b\xfd\x0f\x00\x00\x00\xc3\xc8\xdd\xff\xf4\xb8\xc5\xfe\x07\x00\x00\x80\x61\xe4\xee\x7f\x46\xdc\xd2\x64\xff\xeb\xff\xf5\xff\xbe\xff\xaf\xff\xd7\xff\xeb\xff\xb7\x49\xff\xbf\xd8\xfe\x7f\xff\xbf\xf5\xf6\xd2\xff\x1f\x89\xfe\x5f\xff\x7f\x58\xff\x7f\xcf\x23\xbc\x5f\xff\x4f\x07\x4b\xeb\xff\x73\xf7\x3f\x33\x6e\x69\xb2\xff\x01\x00\x00\xa0\x83\xdc\xfd\xcf\x8a\x5b\xec\x7f\x00\x00\x00\x18\x46\xee\xfe\xeb\xe3\x16\xfb\x1f\x00\x00\x00\x86\x91\xbb\xff\xd9\x71\x4b\x93\xfd\xaf\xff\xd7\xff\xeb\xff\xf5\xff\x7b\xfb\xff\x73\x2d\xfb\xff\x3b\x7e\x4c\xff\xbf\x1d\xfa\xff\xc5\xf6\xff\xd3\xf4\xff\x47\xa2\xff\xd7\xff\xfb\xfe\xbf\xfe\x9f\x69\x4b\xeb\xff\x73\xf7\x3f\x27\x6e\x69\xb2\xff\x01\x00\x00\xa0\x83\xdc\xfd\xcf\x8d\x5b\xec\x7f\x00\x00\x00\x18\x46\xee\xfe\xe7\xc5\x2d\xf6\x3f\x00\x00\x00\x0c\x23\x77\xff\xf3\xe3\x96\x26\xfb\x5f\xff\xaf\xff\xd7\xff\xeb\xff\x2f\xe9\xfb\xff\x97\x8f\xd1\xff\xfb\xfe\xff\xf6\xac\xac\xff\xbf\xf2\xb0\xdf\xa1\xff\xdf\xa5\xff\xdf\x4b\xff\xaf\xff\xd7\xff\xeb\xff\x99\xb6\xb4\xfe\x3f\x77\xff\x0b\xe2\x96\x26\xfb\x1f\x00\x00\x00\x86\x77\x6e\x53\xbb\xff\x86\xb8\xc5\xfe\x07\x00\x00\x80\x61\xe4\xee\x7f\x61\xdc\x62\xff\x03\x00\x00\xc0\x30\x72\xf7\xdf\x18\xb7\x34\xd9\xff\xfa\x7f\xfd\xbf\xfe\x5f\xff\x7f\x49\xfd\xff\x20\xdf\xff\xd7\xff\x6f\xcf\xca\xfa\xff\x43\xe9\xff\x77\x9d\x55\xff\xbf\xd1\xff\xd7\xdf\x8b\xfe\x7f\x39\xef\xd7\xff\xeb\xff\x99\xb7\xb4\xfe\x3f\x77\xff\x8b\xe2\x96\x26\xfb\x1f\x00\x00\x00\x3a\xc8\xdd\xff\xe2\xb8\xc5\xfe\x07\x00\x00\x80\x61\xe4\xee\x7f\x49\xdc\x62\xff\x03\x00\x00\xc0\x30\x72\xf7\xbf\x34\x6e\x69\xb2\xff\xf5\xff\xfa\x7f\xfd\xbf\xfe\x5f\xff\xaf\xff\xdf\x26\xfd\xbf\xfe\x7f\x8a\xef\xff\xeb\xff\xd7\xfc\x7e\xfd\xbf\xfe\x9f\x79\x4b\xeb\xff\x73\xf7\xbf\x2c\x6e\x69\xb2\xff\x01\x00\x00\x60\x00\xe7\xe7\xfe\x80\xdc\xfd\x2f\x8f\x5b\xec\x7f\x00\x00\x00\x18\x46\xee\xfe\x57\xc4\x2d\xf6\x3f\x00\x00\x00\x0c\x23\x77\xff\x2b\xe3\x96\xfd\xfb\xff\xdc\x69\xbe\xea\xf4\xe8\xff\xf5\xff\xfa\x7f\xfd\xbf\xfe\x5f\xff\xbf\x4d\xfa\x7f\xfd\xff\x14\xfd\xff\xc1\xfd\xff\x85\x43\xfe\x7a\x43\xf5\xff\x37\xdc\xb8\xee\xf7\xeb\xff\xf5\xff\x1c\xc9\xd2\xfa\xff\xdc\xfd\x37\xc5\x2d\xfe\xf9\x3f\x00\x00\x00\x0c\x23\x77\xff\xab\xe2\x16\xfb\x1f\x00\x00\x00\x86\x91\xbb\xff\xd5\x71\x8b\xfd\x0f\x00\x00\x00\xc3\xc8\xdd\xff\x9a\xb8\xa5\xc9\xfe\x3f\xac\xff\xbf\xed\xae\xbb\xbf\x5f\xff\x7f\x34\xfa\xff\x83\xdf\xaf\xff\xd7\xff\xeb\xff\xf5\xff\xcb\xee\xff\xf7\xff\x6a\x38\x9c\xfe\x7f\x97\xfe\x7f\x2f\xdf\xff\xf7\xfd\x7f\xfd\xbf\xfe\x9f\x69\x4b\xeb\xff\x73\xf7\xbf\x36\x6e\x69\xb2\xff\x01\x00\x00\xa0\x83\xdc\xfd\xaf\x8b\x5b\xec\x7f\x00\x00\x00\x18\x46\xee\xfe\xd7\xc7\x2d\xf6\x3f\x00\x00\x00\x0c\x23\x77\xff\x1b\xe2\x96\x26\xfb\xff\xe4\xbf\xff\x7f\xb5\xfe\x5f\xff\xaf\xff\x8f\xab\xff\xd7\xff\xeb\xff\x97\xde\xff\x1f\x9d\xfe\x7f\x97\xfe\x7f\x2f\xfd\xbf\xfe\x5f\xff\xaf\xff\x67\xda\xd2\xfa\xff\xdc\xfd\x6f\x8c\x5b\x9a\xec\x7f\x00\x00\x00\xe8\x20\x77\xff\x9b\xe2\x16\xfb\x1f\x00\x00\x00\x86\x91\xbb\xff\xcd\x71\x8b\xfd\x0f\x00\x00\x00\xc3\xc8\xdd\xff\x96\xb8\xa5\xc9\xfe\x3f\xf9\xfe\xdf\xf7\xff\xf5\xff\xc7\xec\xff\xcf\xe9\xff\x93\xfe\x3f\x7e\x5e\xf5\xff\xfa\xff\x63\xd0\xff\xeb\xff\x37\xfa\xff\x8b\x76\xd6\xfd\xfc\xda\xdf\xaf\xff\xd7\xff\x33\x6f\x69\xfd\x7f\xee\xfe\x9b\x77\xa6\x5e\xbf\xfd\x0f\x00\x00\x00\x1d\xdc\xbc\xf3\xdb\x0b\x9b\xb7\xc6\x2d\xf6\x3f\x00\x00\x00\x0c\x23\x77\xff\xdb\xe2\x16\xfb\x1f\x00\x00\x00\x86\x91\xbb\xff\xed\x71\x4b\x93\xfd\xaf\xff\xd7\xff\x9f\x79\xff\xef\xfb\xff\x45\xff\x1f\x3f\xaf\xfa\x7f\xfd\xff\x31\xe8\xff\xf5\xff\x1b\xfd\xff\x45\x3b\xeb\x7e\x7e\xed\xef\xd7\xff\xeb\xff\x99\xb7\xb4\xfe\x3f\x77\xff\x3b\xe2\x96\x26\xfb\x1f\x00\x00\x00\x3a\xc8\xdd\xff\xce\xb8\xc5\xfe\x07\x00\x00\x80\x61\xc4\xee\xdf\xfd\x1f\xbf\xdb\xff\x00\x00\x00\x30\xa4\x77\xed\xfc\xf6\xc2\xe6\xdd\x71\x4b\x93\xfd\xdf\xb8\xff\xbf\xfa\x52\xfb\xff\xab\xfe\xe7\xff\xd6\xff\x1f\xfc\x7e\xfd\xff\x89\xf4\xff\x37\xef\xff\xb5\xa7\xff\xd7\xff\xaf\x89\xfe\x5f\xff\x3f\x45\xff\xaf\xff\x5f\xf3\xfb\x97\xd3\xff\xc7\x0f\x5c\xa3\xff\x67\x79\x96\xd6\xff\xe7\xee\x7f\x4f\xdc\xd2\x64\xff\x03\x00\x00\x40\x07\xb9\xfb\xdf\x1b\xb7\xd8\xff\x00\x00\x00\x30\x8c\xdc\xfd\xb7\xc4\x2d\xf6\x3f\x00\x00\x00\x0c\x23\x77\xff\xfb\xe2\x96\x26\xfb\xbf\x71\xff\x3f\xc8\xf7\xff\xef\x7b\x6b\xbc\x40\xff\x3f\x6e\xff\xef\xfb\xff\x71\xf5\xff\xfa\xff\x83\xe8\xff\xf5\xff\x1b\xfd\xff\x45\x3b\xeb\x7e\x7e\xed\xef\x5f\x4e\xff\xef\xfb\xff\x2c\xd7\xd2\xfa\xff\xdc\xfd\xef\x8f\x5b\x9a\xec\x7f\x00\x00\x00\xe8\x20\x77\xff\x07\xe2\x16\xfb\x1f\x00\x00\x00\x86\x91\xbb\xff\x83\x71\x8b\xfd\x0f\x00\x00\x00\xc3\xc8\xdd\xff\xa1\xb8\xa5\xc9\xfe\xd7\xff\xaf\xbd\xff\xf7\xfd\x7f\xfd\xbf\xfe\x5f\xff\xbf\x6c\xfa\x7f\xfd\xff\x14\xfd\xbf\xfe\x7f\xcd\xef\xd7\xff\xeb\xff\x99\xb7\xb4\xfe\x3f\x77\xff\x87\xe3\x96\x26\xfb\x1f\x00\x00\x00\x3a\xc8\xdd\xff\x91\xb8\xc5\xfe\x07\x00\x00\x80\x61\xe4\xee\xff\x68\xdc\x62\xff\x03\x00\x00\xc0\x30\x72\xf7\x7f\x2c\x6e\x69\xb2\xff\xf5\xff\xfa\xff\x6d\xf5\xff\x77\xfc\x45\xf4\xff\x4d\xfa\xff\x6b\xf5\xff\x1b\xfd\xff\xa1\xf4\xff\xfa\xff\x29\xfa\x7f\xfd\xff\x9a\xdf\xaf\xff\xd7\xff\x33\x6f\x69\xfd\x7f\xee\xfe\x8f\xc7\x2d\x4d\xf6\x3f\x00\x00\x00\x74\x90\xbb\xff\x13\x71\x8b\xfd\x0f\x00\x00\x00\xc3\xc8\xdd\xff\xc9\xb8\xc5\xfe\x07\x00\x00\x80\x61\xe4\xee\xff\x54\xdc\x70\x8f\xbb\x9d\xdd\x93\x4e\xd6\xf9\x43\x7e\x3c\x7a\x73\xfd\xbf\xfe\xdf\xf7\xff\x57\xd6\xff\xdf\x7d\x81\xfd\xbf\xef\xff\xef\xd0\xff\x1f\x4c\xff\xaf\xff\x9f\xa2\xff\xd7\xff\xaf\xf9\xfd\xfa\x7f\xfd\x3f\xf3\x96\xd6\xff\xe7\xee\xff\x74\xdc\xe2\x9f\xff\x03\x00\x00\xc0\x30\x72\xf7\x7f\x26\x6e\xb1\xff\x01\x00\x00\x60\x18\xb9\xfb\x3f\x1b\xb7\xd8\xff\x00\x00\x00\x30\x8c\xdc\xfd\x9f\x8b\x5b\x9a\xec\x7f\xfd\xbf\xfe\xff\xd4\xfb\xff\x7d\xff\xda\xe9\xff\xef\xfc\xf3\x8e\xf9\xfd\xff\xab\xf4\xff\x7b\xdf\xaf\xff\x5f\x26\xfd\xbf\xfe\x7f\x8a\xfe\x5f\xff\xbf\xe6\xf7\xeb\xff\xf5\xff\xcc\x5b\x5a\xff\x9f\xbb\xff\xf3\x71\x4b\x93\xfd\x0f\x00\x00\x00\x1d\xe4\xee\xff\x42\xdc\x62\xff\x03\x00\x00\xc0\x30\x72\xf7\x7f\x31\x6e\xb1\xff\x01\x00\x00\x60\x18\xb9\xfb\xbf\x14\xb7\x34\xd9\xff\xfa\x7f\xfd\x7f\xa7\xef\xff\xdf\x7e\xd9\xde\x9f\xaf\x95\xf7\xff\xbe\xff\xbf\xef\xfd\xfa\xff\x65\xd2\xff\xeb\xff\xa7\xe8\xff\xf5\xff\x6b\x7e\xbf\xfe\x5f\xff\xcf\xbc\xa5\xf5\xff\xb9\xfb\xbf\x1c\xb7\x34\xd9\xff\x00\x00\x00\xd0\x41\xee\xfe\xaf\xc4\x2d\xf6\x3f\x00\x00\x00\xac\xcf\x85\x83\x7f\x38\x77\xff\x57\xf7\xff\x41\xf6\x3f\x00\x00\x00\x0c\x23\x77\xff\xd7\xe2\x96\x26\xfb\x5f\xff\xaf\xff\xef\xd4\xff\xef\xff\xf9\xd2\xff\xef\x7d\xa7\xfe\x5f\xff\xbf\x0d\xfa\x7f\xfd\xff\x14\xfd\xbf\xfe\xff\xf4\xde\x7f\xc5\x89\xbf\x5f\xff\xaf\xff\x67\xde\xd2\xfa\xff\xdc\xfd\x5f\x8f\x5b\x9a\xec\x7f\x00\x00\x00\xe8\x20\x77\xff\x37\xe2\x16\xfb\x1f\x00\x00\x00\x86\x91\xbb\xff\x9b\x71\x8b\xfd\x0f\x00\x00\x00\xc3\xc8\xdd\xff\xad\xb8\xa5\xc9\xfe\x1f\xb9\xff\x9f\xfa\xc3\xf4\xff\xbb\xf4\xff\xfa\xff\x8d\xfe\x5f\xff\xbf\x65\xfa\x7f\xfd\xff\x14\xfd\xbf\xfe\x7f\xcd\xef\xd7\xff\xeb\xff\x99\xb7\xb4\xfe\x3f\x77\xff\xb7\xe3\x96\x7b\x6d\x36\xc7\xfa\x2f\x00\x00\x00\x00\x60\xb1\x72\xf7\x7f\x27\x6e\x69\xf2\xcf\xff\x01\x00\x00\xa0\x83\xdc\xfd\xdf\x8d\x5b\xec\x7f\x00\x00\x00\x18\x46\xee\xfe\xef\xc5\x2d\x4d\xf6\xff\xc8\xfd\xff\x14\xfd\xff\x2e\xfd\xbf\xfe\x7f\xa3\xff\xd7\xff\x6f\x99\xfe\x5f\xff\x3f\x45\xff\xaf\xff\x5f\xf3\xfb\xf5\xff\xfa\x7f\xe6\x9d\x51\xff\x7f\x7e\x73\x48\xff\x9f\xbb\xff\xfb\x71\x4b\x93\xfd\x0f\x00\x00\x00\x1d\xe4\xee\xff\x41\xdc\x62\xff\x03\x00\x00\xc0\x30\x72\xf7\xff\x30\x6e\xb1\xff\x01\x00\x00\x60\x18\xb9\xfb\x7f\x14\xb7\x8c\xb3\xff\xef\x77\xcb\xc4\xef\xd4\xff\x9f\x78\xff\xbf\xf3\x8b\x48\xff\xbf\x9b\x8c\xe9\xff\xf5\xff\xfa\x7f\xfd\xbf\xfe\x5f\xff\x3f\x45\xff\xaf\xff\x5f\xf3\xfb\xf5\xff\xfa\x7f\xe6\x2d\xed\xfb\xff\xb9\xfb\x7f\x1c\xb7\x8c\xb3\xff\x01\x00\x00\xa0\xbd\xdc\xfd\x3f\x89\x5b\xec\x7f\x00\x00\x00\x18\x46\xee\xfe\x9f\xc6\x2d\xf6\x3f\x00\x00\x00\x0c\x23\x77\xff\xcf\xe2\x96\x26\xfb\x5f\xff\xef\xfb\xff\xbe\xff\xdf\xaa\xff\xbf\x7c\xa3\xff\xd7\xff\x9f\x32\xfd\xbf\xfe\x7f\x8a\xfe\x5f\xff\xbf\xe6\xf7\xeb\xff\xf5\xff\xcc\x5b\x5a\xff\x9f\xbb\xff\xe7\x71\x4b\x93\xfd\x0f\x00\x00\x00\x1d\xe4\xee\xff\x45\xdc\x62\xff\x03\x00\x00\xc0\x30\x72\xf7\xff\x32\x6e\xb1\xff\x01\x00\x00\x60\x18\xb9\xfb\x7f\x15\xb7\x34\xd9\xff\xfa\x7f\xfd\xbf\xfe\xbf\x55\xff\xef\xfb\xff\xfa\xff\x53\xa7\xff\xd7\xff\x4f\xd1\xff\xeb\xff\xd7\xfc\xfe\xec\xff\xf3\xd7\x9d\xfe\x5f\xff\xcf\xff\x5b\x5a\xff\x9f\xbb\xff\xd7\x71\x4b\x93\xfd\x0f\x00\x00\x00\x1d\xe4\xee\xff\x4d\xdc\x62\xff\x03\x00\x00\xc0\x30\x72\xf7\xff\x36\x6e\xb1\xff\x01\x00\x00\x60\x18\xb9\xfb\x7f\x17\xb7\x34\xd9\xff\xfa\x7f\xfd\xbf\xfe\x5f\xff\xaf\xff\xd7\xff\x6f\x93\xfe\x5f\xff\x3f\x45\xff\xaf\xff\x5f\xf3\xfb\x7d\xff\x5f\xff\xcf\xbc\xa5\xf5\xff\xb9\xfb\x6f\x8d\x5b\x9a\xec\x7f\x00\x00\x00\xe8\x20\x77\xff\xef\xe3\x16\xfb\x1f\x00\x00\x00\x86\x91\xbb\xff\x0f\x71\x8b\xfd\x0f\x00\x00\x00\xc3\xc8\xdd\x7f\x5b\xdc\xd2\x64\xff\x5f\x42\xff\x7f\x9f\xfb\x6f\xf6\xfc\x29\xfa\x7f\xfd\xff\x72\xfa\xff\xbb\xe8\xff\xf5\xff\xfa\xff\xa5\xd0\xff\xeb\xff\xa7\xe8\xff\xf5\xff\x6b\x7e\xbf\xfe\x5f\xff\xcf\xbc\xa5\xf5\xff\xb9\xfb\xff\x18\xb7\x34\xd9\xff\x00\x00\x00\xd0\x41\xee\xfe\x3f\xc5\x2d\xf6\x3f\x00\x00\x00\x0c\x23\x77\xff\x9f\xe3\x16\xfb\x1f\x00\x00\x00\x86\x91\xbb\xff\x2f\x71\x4b\x93\xfd\xef\xfb\xff\xfa\xff\xe3\xf7\xff\xe7\xeb\xef\x7b\xb1\xfd\xbf\xef\xff\xeb\xff\xf5\xff\x8b\x31\x6e\xff\x7f\xa5\xfe\x5f\xff\x7f\xc9\xfd\xff\xf5\x37\xed\xfe\xb0\xfe\x7f\x9d\xef\xd7\xff\xeb\xff\x99\xb7\xb4\xfe\x3f\x77\xff\x5f\xe3\x96\x26\xfb\x1f\x00\x00\x00\x3a\xc8\xdd\xff\xb7\xb8\xc5\xfe\x07\x00\x00\x80\x61\xe4\xee\xff\x7b\xdc\x62\xff\x03\x00\x00\xc0\x30\x72\xf7\xff\x23\x6e\x69\xb2\xff\xf5\xff\xfa\xff\x21\xbf\xff\xaf\xff\xd7\xff\xeb\xff\x17\x63\xdc\xfe\xdf\xf7\xff\xf5\xff\xbe\xff\xaf\xff\xd7\xff\xeb\xff\x99\xb3\xb4\xfe\x3f\x77\xff\x3f\xe3\x96\x26\xfb\x1f\x00\x00\x00\x3a\xc8\xdd\xff\xaf\xb8\xc5\xfe\x07\x00\x00\x80\x61\xe4\xee\xff\x77\xdc\x62\xff\x03\x00\x00\xc0\x30\x72\xf7\xff\x27\x6e\x69\xb2\xff\xf5\xff\xfa\x7f\xfd\xbf\xfe\x5f\xff\xaf\xff\xdf\x26\xfd\xbf\xfe\x7f\x8a\xfe\x5f\xff\xbf\xe6\xf7\xeb\xff\xf5\xff\xcc\x5b\x5a\xff\x9f\xbb\xff\xbf\x01\x00\x00\xff\xff\x55\x6b\x33\xb0", 24528);
syz_mount_image(/*fs=*/0x200000000400, /*dir=*/0x200000000000, /*flags=MS_REC|MS_SILENT|MS_NOSUID|MS_NODIRATIME*/0xc802, /*opts=*/0x200000000100, /*chdir=*/1, /*size=*/0x5fd0, /*img=*/0x200000006440);
//  openat arguments: [
//    fd: fd_dir (resource)
//    file: ptr[in, buffer] {
//      buffer: {2e 00} (length 0x2)
//    }
//    flags: open_flags = 0x0 (4 bytes)
//    mode: open_mode = 0x0 (2 bytes)
//  ]
//  returns fd
memcpy((void*)0x2000000000c0, ".\000", 2);
	res = syscall(__NR_openat, /*fd=*/0xffffff9c, /*file=*/0x2000000000c0ul, /*flags=*/0, /*mode=*/0);
	if (res != -1)
		r[0] = res;
//  ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY arguments: [
//    fd: fd_dir (resource)
//    cmd: const = 0xc0185879 (4 bytes)
//    arg: ptr[inout, fscrypt_remove_key_arg] {
//      fscrypt_remove_key_arg {
//        key_spec: union fscrypt_key_specifier {
//          desc: fscrypt_key_specifier__by_descriptor {
//            type: const = 0x4100 (4 bytes)
//            reserved: const = 0x0 (4 bytes)
//            descriptor: union fscrypt_key_descriptor {
//              desc3: buffer: {e8 da b9 92 34 bb 31 2e} (length 0x8)
//            }
//            reserved2: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x18)
//          }
//        }
//        removal_status_flags: int32 = 0x0 (4 bytes)
//        reserved: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x14)
//      }
//    }
//  ]
*(uint32_t*)0x200000000080 = 0x4100;
*(uint32_t*)0x200000000084 = 0;
memcpy((void*)0x200000000088, "\350\332\271\2224\2731.", 8);
memset((void*)0x200000000090, 0, 24);
memset((void*)0x2000000000ac, 0, 20);
	syscall(__NR_ioctl, /*fd=*/r[0], /*cmd=*/0xc0185879, /*arg=*/0x200000000080ul);
//  syz_mount_image$vfat arguments: [
//    fs: ptr[in, buffer] {
//      buffer: {76 66 61 74 00} (length 0x5)
//    }
//    dir: ptr[in, buffer] {
//      buffer: {13 13 77 c5 fc 35 d4 14 54 d5 d4 1d 29 ad 1a 60 29 59 81 46 e6 be 16 6e 41 ad 0d bd 40 54 03 3c 9f 33 bb da 82 24 a2 f3 d7 72 e7 63 6e 48 b3 3c bf 70 83 72 e8 f1 b9 93 3e c5 12 77 43 be 22 06 20 9e f0 2d f9 cb f2 f6 e8 80 d3 38 2f 00} (length 0x4e)
//    }
//    flags: mount_flags = 0x2b1247d (8 bytes)
//    opts: nil
//    chdir: int8 = 0xfc (1 bytes)
//    size: len = 0x0 (8 bytes)
//    img: ptr[in, buffer] {
//      buffer: (compressed buffer with length 0x0)
//    }
//  ]
//  returns fd_dir
memcpy((void*)0x200000000200, "vfat\000", 5);
memcpy((void*)0x2000000002c0, "\023\023w\305\3745\324\024T\325\324\035)\255\032`)Y\201F\346\276\026nA\255\r\275@T\003<\2373\273\332\202$\242\363\327r\347cnH\263<\277p\203r\350\361\271\223>\305\022wC\276\"\006 \236\360-\371\313\362\366\350\200\3238/\000", 78);
syz_mount_image(/*fs=*/0x200000000200, /*dir=*/0x2000000002c0, /*flags=MS_LAZYTIME|MS_I_VERSION|MS_SHARED|MS_POSIXACL|MS_SYNCHRONOUS|MS_REMOUNT|MS_RELATIME|0x244d*/0x2b1247d, /*opts=*/0, /*chdir=*/0xfc, /*size=*/0, /*img=*/0x2000000000c0);
	return 0;
}

The root cause of this KASAN slab-use-after-free is a concurrency bug (race condition) between `lbmRead()` and the bio completion handler `lbmIODone()`. 

### Detailed Explanation

1. **The Lockless Wait:**
   In `fs/jfs/jfs_logmgr.c`, `lbmRead()` submits a READ bio and waits for its completion using `wait_event()`:
   ```c
   wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));
   return 0;
   ```
   The `wait_event()` macro evaluates its condition `(bp->l_flag != lbmREAD)` locklessly.

2. **The Premature Wakeup:**
   When the READ bio completes, the block layer calls `lbmIODone()`. This function acquires the `LCACHE_LOCK` spinlock, clears the `lbmREAD` flag, and wakes up the waiter:
   ```c
   	if (bp->l_flag & lbmREAD) {
   		bp->l_flag &= ~lbmREAD;

   		/* wakeup I/O initiator */
   		LCACHE_WAKEUP(&bp->l_ioevent);

   		goto out;
   	}
   ```
   Crucially, it does this **before** it sets the `lbmDONE` flag and releases the lock at the `out:` label:
   ```c
   out:
   	bp->l_flag |= lbmDONE;
   	LCACHE_UNLOCK(flags);
   ```

3. **The Race and Reuse:**
   Because `wait_event()` is lockless, the thread executing `lbmRead()` wakes up immediately after `LCACHE_WAKEUP` is called, sees that `lbmREAD` is cleared, and returns. 
   
   The caller of `lbmRead()` (in this crash, `lmLogShutdown()`) then proceeds to reuse the exact same `bp` for a WRITE bio by calling `lbmDirectWrite()`. `lbmDirectWrite()` overwrites `bp->l_flag` with new flags (e.g., `lbmWRITE | lbmRELEASE | lbmSYNC | lbmDIRECT`), which clears any previous state.

4. **The State Corruption:**
   `lmLogShutdown()` then calls `lbmIOWait(bp, lbmFREE)` to wait for the new WRITE bio to complete. `lbmIOWait()` waits for the `lbmDONE` flag to be set.
   
   Meanwhile, the original READ bio's `lbmIODone()` resumes execution, reaches the `out:` label, executes `bp->l_flag |= lbmDONE;`, and unlocks `LCACHE_LOCK`. **This erroneously sets the `lbmDONE` flag on the reused `bp`!**

5. **The Use-After-Free:**
   `lbmIOWait()` sees the `lbmDONE` flag, incorrectly assumes the WRITE bio has completed, and returns early. It then calls `lbmfree(bp)` to put it on the freelist. `lmLogShutdown()` subsequently calls `lbmLogShutdown()`, which frees the `bp` via `kfree()`.
   
   Later, the WRITE bio actually completes, and `lbmIODone()` is called on the freed `bp`. It attempts to read `bp->l_flag` (which is at offset 8 in `struct lbuf`), triggering the KASAN slab-use-after-free report.

### How to Fix

The fix is to replace the lockless `wait_event()` in `lbmRead()` with `lbmIOWait(bp, 0)`. 

`lbmIOWait()` uses `LCACHE_SLEEP_COND()`, which properly synchronizes with `lbmIODone()` by acquiring `LCACHE_LOCK` before checking the condition. This ensures `lbmRead()` will block on the spinlock and not return until `lbmIODone()` has completely finished and unlocked `LCACHE_LOCK`. 

As an added benefit, `lbmIOWait()` correctly returns `-EIO` if the bio completes with an error, whereas the current `lbmRead()` unconditionally returns `0`, ignoring I/O errors.

```c
--- a/fs/jfs/jfs_logmgr.c
+++ b/fs/jfs/jfs_logmgr.c
@@ -1984,9 +1984,7 @@ static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp)
 		submit_bio(bio);
 	}
 
-	wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));
-
-	return 0;
+	return lbmIOWait(bp, 0);
 }
```

gemini-3.1-pro-preview

							input: 103863
							output: 45
							thoughts: 112
						

**Analyzing a KASAN Slab-Use-After-Free in JFS**

Okay, so we've got a KASAN slab-use-after-free bug, specifically in `lbmIODone`. It's happening in `fs/jfs/jfs_logmgr.c` at line 2192.  The crash manifests when reading a size of 4 bytes from memory address `ffff888049ebf608`. Right, so this suggests the memory location has been corrupted or deallocated and we're attempting to access it.  Digging deeper, the object that's causing the problem was initially allocated by `lbmLogInit` and later freed by `lbmLogShutdown`. This makes pinpointing the timeframe in which the memory is becoming freed a high priority. Let's start by scrutinizing the code for `lbmIODone` in `fs/jfs/jfs_logmgr.c`. Time to see what's going on in that function and how it's interacting with the allocated and deallocated objects.

map[ContextFile:fs/jfs/jfs_logmgr.c IncludeLines:true Name:lbmIODone]

map[SourceCode:2162:	/*
2163:	 *	lbmIODone()
2164:	 *
2165:	 * executed at INTIODONE level
2166:	 */
2167:	static void lbmIODone(struct bio *bio)
2168:	{
2169:		struct lbuf *bp = bio->bi_private;
2170:		struct lbuf *nextbp, *tail;
2171:		struct jfs_log *log;
2172:		unsigned long flags;
2173:	
2174:		/*
2175:		 * get back jfs buffer bound to the i/o buffer
2176:		 */
2177:		jfs_info("lbmIODone: bp:0x%p flag:0x%x", bp, bp->l_flag);
2178:	
2179:		LCACHE_LOCK(flags);		/* disable+lock */
2180:	
2181:		if (bio->bi_status) {
2182:			bp->l_flag |= lbmERROR;
2183:	
2184:			jfs_err("lbmIODone: I/O error in JFS log");
2185:		}
2186:	
2187:		bio_put(bio);
2188:	
2189:		/*
2190:		 *	pagein completion
2191:		 */
2192:		if (bp->l_flag & lbmREAD) {
2193:			bp->l_flag &= ~lbmREAD;
2194:	
2195:			/* wakeup I/O initiator */
2196:			LCACHE_WAKEUP(&bp->l_ioevent);
2197:	
2198:			goto out;
2199:		}
2200:	
2201:		/*
2202:		 *	pageout completion
2203:		 *
2204:		 * the bp at the head of write queue has completed pageout.
2205:		 *
2206:		 * if single-commit/full-page pageout, remove the current buffer
2207:		 * from head of pageout queue, and redrive pageout with
2208:		 * the new buffer at head of pageout queue;
2209:		 * otherwise, the partial-page pageout buffer stays at
2210:		 * the head of pageout queue to be redriven for pageout
2211:		 * by lmGroupCommit() until full-page pageout is completed.
2212:		 */
2213:		bp->l_flag &= ~lbmWRITE;
2214:		INCREMENT(lmStat.pagedone);
2215:	
2216:		/* update committed lsn */
2217:		log = bp->l_log;
2218:		log->clsn = (bp->l_pn << L2LOGPSIZE) + bp->l_ceor;
2219:	
2220:		if (bp->l_flag & lbmDIRECT) {
2221:			LCACHE_WAKEUP(&bp->l_ioevent);
2222:			goto out;
2223:		}
2224:	
2225:		tail = log->wqueue;
2226:	
2227:		/* single element queue */
2228:		if (bp == tail) {
2229:			/* remove head buffer of full-page pageout
2230:			 * from log device write queue
2231:			 */
2232:			if (bp->l_flag & lbmRELEASE) {
2233:				log->wqueue = NULL;
2234:				bp->l_wqnext = NULL;
2235:			}
2236:		}
2237:		/* multi element queue */
2238:		else {
2239:			/* remove head buffer of full-page pageout
2240:			 * from log device write queue
2241:			 */
2242:			if (bp->l_flag & lbmRELEASE) {
2243:				nextbp = tail->l_wqnext = bp->l_wqnext;
2244:				bp->l_wqnext = NULL;
2245:	
2246:				/*
2247:				 * redrive pageout of next page at head of write queue:
2248:				 * redrive next page without any bound tblk
2249:				 * (i.e., page w/o any COMMIT records), or
2250:				 * first page of new group commit which has been
2251:				 * queued after current page (subsequent pageout
2252:				 * is performed synchronously, except page without
2253:				 * any COMMITs) by lmGroupCommit() as indicated
2254:				 * by lbmWRITE flag;
2255:				 */
2256:				if (nextbp->l_flag & lbmWRITE) {
2257:					/*
2258:					 * We can't do the I/O at interrupt time.
2259:					 * The jfsIO thread can do it
2260:					 */
2261:					lbmRedrive(nextbp);
2262:				}
2263:			}
2264:		}
2265:	
2266:		/*
2267:		 *	synchronous pageout:
2268:		 *
2269:		 * buffer has not necessarily been removed from write queue
2270:		 * (e.g., synchronous write of partial-page with COMMIT):
2271:		 * leave buffer for i/o initiator to dispose
2272:		 */
2273:		if (bp->l_flag & lbmSYNC) {
2274:			/* wakeup I/O initiator */
2275:			LCACHE_WAKEUP(&bp->l_ioevent);
2276:		}
2277:	
2278:		/*
2279:		 *	Group Commit pageout:
2280:		 */
2281:		else if (bp->l_flag & lbmGC) {
2282:			LCACHE_UNLOCK(flags);
2283:			lmPostGC(bp);
2284:			LCACHE_LOCK(flags);		/* disable+lock */
2285:		}
2286:	
2287:		/*
2288:		 *	asynchronous pageout:
2289:		 *
2290:		 * buffer must have been removed from write queue:
2291:		 * insert buffer at head of freelist where it can be recycled
2292:		 */
2293:		else {
2294:			assert(bp->l_flag & lbmRELEASE);
2295:			assert(bp->l_flag & lbmFREE);
2296:			lbmfree(bp);
2297:		}
2298:	
2299:	out:
2300:		bp->l_flag |= lbmDONE;
2301:		LCACHE_UNLOCK(flags);
2302:	}
 SourceFile:fs/jfs/jfs_logmgr.c]

gemini-3.1-pro-preview

							input: 106179
							output: 45
							thoughts: 72
						

Here's my analysis of this crash, distilled into my internal thought process:

**Debugging a Memory Access Violation**

Okay, so the crash happened at line 2192: `if (bp->l_flag & lbmREAD) {`.  That immediately tells me a likely memory access violation is occurring.  I see that `bp` is referencing `bio->bi_private`. Right, so this `bp` object is derived from `bio` somehow. My initial thought is it's a use-after-free scenario, which is a common cause of these kinds of errors. The code is trying to access `bp->l_flag`, but `bp` is no longer valid.

The key clue now is *where* `bp` was deallocated. The text tells me it was freed by `lbmLogShutdown`. This is very significant.  Now I need to understand the lifecycle of `bp`. I need to look closely at both `lbmLogShutdown` and `lbmLogInit` to see how `bp` is initialized, used, and, critically, deallocated. I need to trace the object through its allocation and deallocation lifecycle, looking for any race conditions, double-frees, or other memory management issues. My next step is to examine the code around these functions.

map[ContextFile:fs/jfs/jfs_logmgr.c IncludeLines:true Name:lbmLogInit]

map[SourceCode:1779:	/*
1780:	 *	lbmLogInit()
1781:	 *
1782:	 * initialize per log I/O setup at lmLogInit()
1783:	 */
1784:	static int lbmLogInit(struct jfs_log * log)
1785:	{				/* log inode */
1786:		int i;
1787:		struct lbuf *lbuf;
1788:	
1789:		jfs_info("lbmLogInit: log:0x%p", log);
1790:	
1791:		/* initialize current buffer cursor */
1792:		log->bp = NULL;
1793:	
1794:		/* initialize log device write queue */
1795:		log->wqueue = NULL;
1796:	
1797:		/*
1798:		 * Each log has its own buffer pages allocated to it.  These are
1799:		 * not managed by the page cache.  This ensures that a transaction
1800:		 * writing to the log does not block trying to allocate a page from
1801:		 * the page cache (for the log).  This would be bad, since page
1802:		 * allocation waits on the kswapd thread that may be committing inodes
1803:		 * which would cause log activity.  Was that clear?  I'm trying to
1804:		 * avoid deadlock here.
1805:		 */
1806:		init_waitqueue_head(&log->free_wait);
1807:	
1808:		log->lbuf_free = NULL;
1809:	
1810:		for (i = 0; i < LOGPAGES;) {
1811:			char *buffer;
1812:			uint offset;
1813:			struct page *page = alloc_page(GFP_KERNEL | __GFP_ZERO);
1814:	
1815:			if (!page)
1816:				goto error;
1817:			buffer = page_address(page);
1818:			for (offset = 0; offset < PAGE_SIZE; offset += LOGPSIZE) {
1819:				lbuf = kmalloc_obj(struct lbuf);
1820:				if (lbuf == NULL) {
1821:					if (offset == 0)
1822:						__free_page(page);
1823:					goto error;
1824:				}
1825:				if (offset) /* we already have one reference */
1826:					get_page(page);
1827:				lbuf->l_offset = offset;
1828:				lbuf->l_ldata = buffer + offset;
1829:				lbuf->l_page = page;
1830:				lbuf->l_log = log;
1831:				init_waitqueue_head(&lbuf->l_ioevent);
1832:	
1833:				lbuf->l_freelist = log->lbuf_free;
1834:				log->lbuf_free = lbuf;
1835:				i++;
1836:			}
1837:		}
1838:	
1839:		return (0);
1840:	
1841:	      error:
1842:		lbmLogShutdown(log);
1843:		return -ENOMEM;
1844:	}
 SourceFile:fs/jfs/jfs_logmgr.c]

gemini-3.1-pro-preview

							input: 107520
							output: 45
							thoughts: 7
						

Okay, here's my interpretation of that thought process, tailored for an expert audience, and written in the first person:

**Analyzing the `lbmLogShutdown` Function**

Alright, let's break this down. The mention of `lbmLogShutdown` immediately flags a critical area: the orderly termination of logging services within a larger system. My immediate concern is always with *what* needs to be gracefully shut down, and *why* this specific function is involved. Is this the primary logging mechanism? Or is it part of a more complex shutdown sequence involving multiple logging components (e.g., file appenders, network log servers, potentially even in-memory buffers that need flushing)?

I'm thinking about the potential impact of a premature or incomplete shutdown. Data loss is the biggest danger here, of course. Are we dealing with buffered writes? If so, the flushing strategy is paramount. What's the timeout? How robust is the error handling if a flush fails? Is there any guaranteed persistence layer that's invoked, and if so, how is that coordinated? I need to know how resilient the system is to abrupt failures during shutdown, power outages, and so on.

Then, there's the question of resource cleanup. Are file handles closed? Network connections severed gracefully? Memory freed? Ignoring these aspects can lead to resource leaks, file corruption, or even denial-of-service scenarios if left unchecked, and in a production system I have zero tolerance for these sorts of problems.

Thinking further, what are the dependencies of this logging system? Does `lbmLogShutdown` need to wait for other subsystems to finalize their operations before it can safely proceed? If so, how is the coordination implemented? Are we using mutexes, semaphores, or condition variables? Deadlocks are a nightmare, and with an expert-level view, I want to anticipate and prevent them.

Finally, I'm already mentally running through potential debugging scenarios. What kind of logging does the logging shutdown itself produce? Is it detailed enough to identify the root cause of issues if the shutdown fails or hangs? Are there any metrics exposed that I can use to monitor the shutdown process and measure its performance? In an ideal world, I'd also have hooks into any monitoring systems to alert me when `lbmLogShutdown` is invoked, so I could monitor the resulting metrics.

map[ContextFile:fs/jfs/jfs_logmgr.c IncludeLines:true Name:lbmLogShutdown]

map[SourceCode:1847:	/*
1848:	 *	lbmLogShutdown()
1849:	 *
1850:	 * finalize per log I/O setup at lmLogShutdown()
1851:	 */
1852:	static void lbmLogShutdown(struct jfs_log * log)
1853:	{
1854:		struct lbuf *lbuf;
1855:	
1856:		jfs_info("lbmLogShutdown: log:0x%p", log);
1857:	
1858:		lbuf = log->lbuf_free;
1859:		while (lbuf) {
1860:			struct lbuf *next = lbuf->l_freelist;
1861:			__free_page(lbuf->l_page);
1862:			kfree(lbuf);
1863:			lbuf = next;
1864:		}
1865:	}
 SourceFile:fs/jfs/jfs_logmgr.c]

gemini-3.1-pro-preview

							input: 108349
							output: 44
							thoughts: 118
						

**Analyzing a Potential Use-After-Free Vulnerability**

Okay, so we've got a crash, and it looks like a classic use-after-free situation in `lbmIODone`. That rings alarm bells immediately. The function `lbmIODone` is being called as a bio completion callback, which means it's running after an I/O operation finishes. Now, I have a feeling this could tie into `lbmLogShutdown`. I remember that function frees all the `lbuf`s held in `log->lbuf_free`.

Here's where it gets interesting. If an I/O is still in flight, its associated `lbuf` might *not* be in `log->lbuf_free` yet, right? So, what happens if we call `lbmLogShutdown` *before* those I/Os finish? Could `lbmLogShutdown` be freeing memory that `lbmIODone` is expecting to use? That's a definite possibility. It's a race condition waiting to happen.

The key question is, does `lbmLogShutdown` synchronize in any way to wait for all I/Os to complete? We need to verify how `lmLogShutdown` itself is implemented to see. Let me check that function now.

map[ContextFile:fs/jfs/jfs_logmgr.c IncludeLines:true Name:lmLogShutdown]

map[SourceCode:1614:	/*
1615:	 * NAME:	lmLogShutdown()
1616:	 *
1617:	 * FUNCTION:	log shutdown at last LogClose().
1618:	 *
1619:	 *		write log syncpt record.
1620:	 *		update super block to set redone flag to 0.
1621:	 *
1622:	 * PARAMETER:	log	- log inode
1623:	 *
1624:	 * RETURN:	0	- success
1625:	 *
1626:	 * serialization: single last close thread
1627:	 */
1628:	int lmLogShutdown(struct jfs_log * log)
1629:	{
1630:		int rc;
1631:		struct lrd lrd;
1632:		int lsn;
1633:		struct logsuper *logsuper;
1634:		struct lbuf *bpsuper;
1635:		struct lbuf *bp;
1636:		struct logpage *lp;
1637:	
1638:		jfs_info("lmLogShutdown: log:0x%p", log);
1639:	
1640:		jfs_flush_journal(log, 2);
1641:	
1642:		/*
1643:		 * write the last SYNCPT record with syncpoint = 0
1644:		 * (i.e., log redo up to HERE !)
1645:		 */
1646:		lrd.logtid = 0;
1647:		lrd.backchain = 0;
1648:		lrd.type = cpu_to_le16(LOG_SYNCPT);
1649:		lrd.length = 0;
1650:		lrd.log.syncpt.sync = 0;
1651:	
1652:		lsn = lmWriteRecord(log, NULL, &lrd, NULL);
1653:		bp = log->bp;
1654:		lp = (struct logpage *) bp->l_ldata;
1655:		lp->h.eor = lp->t.eor = cpu_to_le16(bp->l_eor);
1656:		lbmWrite(log, log->bp, lbmWRITE | lbmRELEASE | lbmSYNC, 0);
1657:		lbmIOWait(log->bp, lbmFREE);
1658:		log->bp = NULL;
1659:	
1660:		/*
1661:		 * synchronous update log superblock
1662:		 * mark log state as shutdown cleanly
1663:		 * (i.e., Log does not need to be replayed).
1664:		 */
1665:		if ((rc = lbmRead(log, 1, &bpsuper)))
1666:			goto out;
1667:	
1668:		logsuper = (struct logsuper *) bpsuper->l_ldata;
1669:		logsuper->state = cpu_to_le32(LOGREDONE);
1670:		logsuper->end = cpu_to_le32(lsn);
1671:		lbmDirectWrite(log, bpsuper, lbmWRITE | lbmRELEASE | lbmSYNC);
1672:		rc = lbmIOWait(bpsuper, lbmFREE);
1673:	
1674:		jfs_info("lmLogShutdown: lsn:0x%x page:%d eor:%d",
1675:			 lsn, log->page, log->eor);
1676:	
1677:	      out:
1678:		/*
1679:		 * shutdown per log i/o
1680:		 */
1681:		lbmLogShutdown(log);
1682:	
1683:		if (rc) {
1684:			jfs_warn("lmLogShutdown: exit(%d)", rc);
1685:		}
1686:		return rc;
1687:	}
 SourceFile:fs/jfs/jfs_logmgr.c]

gemini-3.1-pro-preview

							input: 109902
							output: 44
							thoughts: 366
						

**Debugging a Post-Unmount I/O Race in JFS**

Okay, so I'm staring at this kernel stack trace, and it's pointing to a crash during `jfs_umount`. Specifically, I'm seeing a `kfree` happening within `lbmLogShutdown`, and that's triggered by `lmLogShutdown`. I need to figure out the control flow here. Hold on... I see that `lbmLogShutdown` can also be called from the error path of `lbmLogInit`. Hmm, this is interesting, because then `lbmLogShutdown` is called from two places.

The really problematic part is that the crash itself is originating inside `lbmIODone`, meaning a block I/O is completing *after* the JFS unmount has already freed some crucial `lbuf` data. I'm seeing this go through `blk_update_request` -> `blk_mq_end_request` -> `run_ktimerd`, all the way down to `blk_done_softirq`. This is a classic race condition scenario. The question is *why* is there an I/O in flight after the umount is initiated? I need to track down how these I/Os are being initiated.

Time to start tracing through `lbmRead`, `lbmWrite`, and `lbmDirectWrite`. I need to understand what's happening to the logging buffers, and how these operations interact with the unmount process. Looks like I have some work to do.

map[ContextFile:fs/jfs/jfs_logmgr.c IncludeLines:true Name:lbmRead]

map[SourceCode:1956:	/*
1957:	 *	lbmRead()
1958:	 */
1959:	static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp)
1960:	{
1961:		struct bio *bio;
1962:		struct lbuf *bp;
1963:	
1964:		/*
1965:		 * allocate a log buffer
1966:		 */
1967:		*bpp = bp = lbmAllocate(log, pn);
1968:		jfs_info("lbmRead: bp:0x%p pn:0x%x", bp, pn);
1969:	
1970:		bp->l_flag |= lbmREAD;
1971:	
1972:		bio = bio_alloc(file_bdev(log->bdev_file), 1, REQ_OP_READ, GFP_NOFS);
1973:		bio->bi_iter.bi_sector = bp->l_blkno << (log->l2bsize - 9);
1974:		__bio_add_page(bio, bp->l_page, LOGPSIZE, bp->l_offset);
1975:		BUG_ON(bio->bi_iter.bi_size != LOGPSIZE);
1976:	
1977:		bio->bi_end_io = lbmIODone;
1978:		bio->bi_private = bp;
1979:		/*check if journaling to disk has been disabled*/
1980:		if (log->no_integrity) {
1981:			bio->bi_iter.bi_size = 0;
1982:			lbmIODone(bio);
1983:		} else {
1984:			submit_bio(bio);
1985:		}
1986:	
1987:		wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));
1988:	
1989:		return 0;
1990:	}
 SourceFile:fs/jfs/jfs_logmgr.c]

gemini-3.1-pro-preview

							input: 111218
							output: 44
							thoughts: 297
						

**Debugging a Read Operation's Synchronization**

Okay, so I'm looking at this `lbmRead` function and how it waits for the I/O to complete. The code uses `wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));`. Right, so this wait condition checks if `bp->l_flag` is *not* equal to `lbmREAD`. But that seems... off. Let me think.

The function `lbmIODone` is where the read completion is signaled. Inside `lbmIODone`, if the `lbmREAD` flag is set, it clears it: `bp->l_flag &= ~lbmREAD;` and then wakes up the waiting process using `LCACHE_WAKEUP(&bp->l_ioevent)`. Ah, but the *condition* in `lbmRead` uses inequality.

The problem is that if `bp->l_flag` has *other* flags set alongside `lbmREAD`, the condition `bp->l_flag != lbmREAD` would immediately evaluate to true, and the wait would prematurely end. It's not checking for *exclusivity* of `lbmREAD`. So, if `lbmDONE` gets set, but `lbmREAD` *also* is still set (perhaps due to a race condition or some other subtle bug), the `lbmRead` wait won't wait for the read to complete, it'll just... exit. That's definitely wrong.

Hold on, I need to understand what initializes `bp->l_flag`. Let me quickly check the `lbmAllocate` function. I *assume* that it zero's it out, but I need to make sure. That could be a key to the problem. The read isn't waiting until the read is done, because the flags aren't being set correctly.

map[ContextFile:fs/jfs/jfs_logmgr.c IncludeLines:true Name:lbmAllocate]

map[SourceCode:1868:	/*
1869:	 *	lbmAllocate()
1870:	 *
1871:	 * allocate an empty log buffer
1872:	 */
1873:	static struct lbuf *lbmAllocate(struct jfs_log * log, int pn)
1874:	{
1875:		struct lbuf *bp;
1876:		unsigned long flags;
1877:	
1878:		/*
1879:		 * recycle from log buffer freelist if any
1880:		 */
1881:		LCACHE_LOCK(flags);
1882:		LCACHE_SLEEP_COND(log->free_wait, (bp = log->lbuf_free), flags);
1883:		log->lbuf_free = bp->l_freelist;
1884:		LCACHE_UNLOCK(flags);
1885:	
1886:		bp->l_flag = 0;
1887:	
1888:		bp->l_wqnext = NULL;
1889:		bp->l_freelist = NULL;
1890:	
1891:		bp->l_pn = pn;
1892:		bp->l_blkno = log->base + (pn << (L2LOGPSIZE - log->l2bsize));
1893:		bp->l_ceor = 0;
1894:	
1895:		return bp;
1896:	}
 SourceFile:fs/jfs/jfs_logmgr.c]

gemini-3.1-pro-preview

							input: 112391
							output: 45
							thoughts: 988
						

**Race Condition Analysis in JFS Log Handling**

Okay, let's break this down. I see a potential race condition in the JFS log handling code, specifically between `lbmRead` and `lbmIODone`.  My initial thought is that the code's intended to read from a log buffer (`bp`).  `bp->l_flag` is initially cleared, then set to `lbmREAD`.  `wait_event` then waits until `bp->l_flag` is not `lbmREAD`, which seems reasonable.

The concern comes in when I consider the I/O completion path, `lbmIODone`. Specifically, what happens if `bio->bi_status` is set? If there's an I/O error, the code sets `bp->l_flag` to include `lbmERROR`. The critical point is that this means `bp->l_flag` becomes `lbmREAD | lbmERROR`.  This condition makes the check `bp->l_flag != lbmREAD` *true*.

If the `wait_event` is running on another CPU, it can return immediately after it checks and sees that the condition is met, without being woken up by `LCACHE_WAKEUP`. But the wait condition is checked without holding the `LCACHE_LOCK`. This means that if `lbmIODone` is still running, it might still have the lock, meaning that the `bp` could be accessed concurrently.

Looking at the code, in `lbmIODone`, if `bio->bi_status` is set, `bp->l_flag` becomes `lbmREAD | lbmERROR`.  The following `if (bp->l_flag & lbmREAD)` block *clears* the `lbmREAD` flag, and then it wakes up waiting processes. So, if `wait_event` wakes up *before* `lbmIODone` clears `lbmREAD`, the condition becomes true and `lbmRead` returns prematurely.

This is worrisome because the `lbmIODone` executes in a softirq context, and *holds* `LCACHE_LOCK`.  `lbmRead`, on the other hand, *does not* hold the lock during the `wait_event`.  So, there's a window where `lbmRead` might see `bp->l_flag != lbmREAD` (because of the error set in `lbmIODone`), return, and the caller (potentially `lmLogShutdown`) continues, maybe even freeing `bp` *before* `lbmIODone` is done.  The code then calls `lbmDirectWrite`, and the caller uses the returned value.

However, after a quick look, `lbmRead` always returns 0:
```c
	wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));

	return 0;
```
If `lbmRead` returns 0, the next lines are executed:
```c
	logsuper = (struct logsuper *) bpsuper->l_ldata;
	logsuper->state = cpu_to_le32(LOGREDONE);
	logsuper->end = cpu_to_le32(lsn);
	lbmDirectWrite(log, bpsuper, lbmWRITE | lbmRELEASE | lbmSYNC);
	rc = lbmIOWait(bpsuper, lbmFREE);
```
So, if the `wait_event` condition returns early, `bpsuper` might be freed, and any concurrent accesses can cause a crash.

The critical issue is the lack of proper synchronization between `lbmRead` and `lbmIODone` concerning the `bp` structure. The `wait_event`'s condition check happens outside the lock. The error flag's side effect is that `lbmRead` wakes up immediately if it has an error. Therefore, I believe there's a race condition where the `bp` can be accessed concurrently or freed prematurely. The potential result could be data corruption or a kernel panic.

map[ContextFile:fs/jfs/jfs_logmgr.c IncludeLines:true Name:lbmDirectWrite]

map[SourceCode:2070:	/*
2071:	 *	lbmDirectWrite()
2072:	 *
2073:	 * initiate pageout bypassing write queue for sidestream
2074:	 * (e.g., log superblock) write;
2075:	 */
2076:	static void lbmDirectWrite(struct jfs_log * log, struct lbuf * bp, int flag)
2077:	{
2078:		jfs_info("lbmDirectWrite: bp:0x%p flag:0x%x pn:0x%x",
2079:			 bp, flag, bp->l_pn);
2080:	
2081:		/*
2082:		 * initialize buffer for device driver
2083:		 */
2084:		bp->l_flag = flag | lbmDIRECT;
2085:	
2086:		/* map the logical block address to physical block address */
2087:		bp->l_blkno =
2088:		    log->base + (bp->l_pn << (L2LOGPSIZE - log->l2bsize));
2089:	
2090:		/*
2091:		 *	initiate pageout of the page
2092:		 */
2093:		lbmStartIO(bp);
2094:	}
 SourceFile:fs/jfs/jfs_logmgr.c]

gemini-3.1-pro-preview

							input: 114690
							output: 46
							thoughts: 598
						

**My Analysis of a Potential Use-After-Free in the JFS Logging Manager**

Okay, let's break this down. I see that `lbmDirectWrite` is setting the `l_flag` in the `bp` structure with the `lbmDIRECT` flag. The problem is, if `lbmIODone` is still running when this happens, it might see the modified `l_flag` *before* it's done processing. And it looks like that's precisely what's happening.

`lbmIODone` checks for the `lbmREAD` flag: `if (bp->l_flag & lbmREAD)`. The critical thing is that if `lbmDirectWrite` has already set `bp->l_flag` with the `lbmDIRECT` flag, then `lbmREAD` is *no longer* set. Because of the direct write logic.

So, `lbmIODone` *should* fall through that `if` statement. And it *should* proceed to what appears to be a write completion. It decrements the `WRITE` flag, updates the committed LSN, and then checks for `lbmDIRECT`. If `lbmDIRECT` is set (which it will be), it calls `LCACHE_WAKEUP` and returns.

But wait, here's where it gets interesting and where the bug lies. `lbmIODone` is called *for the READ bio*! If it erroneously processes this as a write completion, it will wake up whatever thread is waiting on the write's `wait_event`. That can't be good.

Now, let's consider the timing. What if `lbmIODone` is delayed even further? Imagine it's at `bio_put(bio)` and then `lbmDirectWrite` calls `lbmStartIO(bp)` which creates a new bio and submits it. The new bio completes and *again* calls `lbmIODone`! This is where the use-after-free appears to occur.

And the crash analysis confirms my suspicion. The KASAN report shows a slab-use-after-free in `lbmIODone` at the problematic line: `if (bp->l_flag & lbmREAD)`. The report states that the code is attempting to read the `bp` structure *after it's been freed*. The crash is happening because the system is attempting to dereference the now-invalid memory location pointed to by `bp`.

So, the critical question is, how did `bp` get freed? It appears that if `lbmRead` returns, then `lbmDirectWrite` can be called, and then `lbmIOWait`. This is likely where the `bp` is freed and why the crash occurs.

In summary, the race condition and the use-after-free stems from the interaction between `lbmDirectWrite` modifying the `l_flag` and then the concurrent processing in `lbmIODone`. The delayed processing and the potential for multiple calls to `lbmIODone` on different bios is the crux of the problem.

map[ContextFile:fs/jfs/jfs_logmgr.c IncludeLines:true Name:lbmIOWait]

map[SourceCode:2137:	/*
2138:	 *	lbmIOWait()
2139:	 */
2140:	static int lbmIOWait(struct lbuf * bp, int flag)
2141:	{
2142:		unsigned long flags;
2143:		int rc = 0;
2144:	
2145:		jfs_info("lbmIOWait1: bp:0x%p flag:0x%x:0x%x", bp, bp->l_flag, flag);
2146:	
2147:		LCACHE_LOCK(flags);		/* disable+lock */
2148:	
2149:		LCACHE_SLEEP_COND(bp->l_ioevent, (bp->l_flag & lbmDONE), flags);
2150:	
2151:		rc = (bp->l_flag & lbmERROR) ? -EIO : 0;
2152:	
2153:		if (flag & lbmFREE)
2154:			lbmfree(bp);
2155:	
2156:		LCACHE_UNLOCK(flags);	/* unlock+enable */
2157:	
2158:		jfs_info("lbmIOWait2: bp:0x%p flag:0x%x:0x%x", bp, bp->l_flag, flag);
2159:		return rc;
2160:	}
 SourceFile:fs/jfs/jfs_logmgr.c]

gemini-3.1-pro-preview

							input: 116413
							output: 44
							thoughts: 63
						

Here's my understanding of the process, breaking it down step-by-step:

**My Perspective on `lbmIOWait`**

Okay, so `lbmIOWait` is all about handling the completion of an I/O operation. Essentially, I'm sitting here, waiting, watching for the `bp` (buffer pointer) to indicate that its current task is finished. The key here is checking `bp->l_flag` against `lbmDONE`. Once that bit is set, it signals the I/O is truly done, I can proceed.

Now, here's where it gets interesting. I then need to determine what to do with that buffer. I look at the `flag` variable, checking if the `lbmFREE` bit is set. If `lbmFREE` *is* set, I know this buffer is eligible to be released. This is where `lbmfree(bp)` comes into play. I hand it off to `lbmfree`.

Aha! `lbmfree` isn't just freeing it up into oblivion, it's putting the `bp` buffer back into the `log->lbuf_free` list. So it's not a complete free, but a return to a free pool managed by the log structure, ready for reuse. Good design. It's essentially a memory management optimization, preventing constant `malloc` and `free` calls by recycling buffers. The free pool becomes key to performance here.

map[ContextFile:fs/jfs/jfs_logmgr.c IncludeLines:true Name:lbmfree]

map[SourceCode:1915:	static void lbmfree(struct lbuf * bp)
1916:	{
1917:		struct jfs_log *log = bp->l_log;
1918:	
1919:		assert(bp->l_wqnext == NULL);
1920:	
1921:		/*
1922:		 * return the buffer to head of freelist
1923:		 */
1924:		bp->l_freelist = log->lbuf_free;
1925:		log->lbuf_free = bp;
1926:	
1927:		wake_up(&log->free_wait);
1928:		return;
1929:	}
 SourceFile:fs/jfs/jfs_logmgr.c]

gemini-3.1-pro-preview

							input: 117059
							output: 44
							thoughts: 1723
						

**Analyzing a Potential Use-After-Free in JFS Logging**

Okay, let's break this down. My initial thought was that a `bp` (buffer pointer) was being freed prematurely. `lbmfree` puts the `bp` into `log->lbuf_free`, and `lmLogShutdown` calls `lbmLogShutdown`, which then frees all the `lbuf`s in `log->lbuf_free` using `kfree(lbuf)`. Seems straightforward. The key is when is this `bp` considered done? `lbmIOWait` returning suggests `bp->l_flag & lbmDONE` is true. `lbmIODone` is the one setting `lbmDONE` at the end of its processing. That signals completion.

The immediate concern, however, comes from the potential for the function to execute after the buffer is freed. How can `lbmIODone` be executing if the `bp` is freed? Maybe there are two bios for the same `bp`? `lbmRead` submits a bio. However, `lbmRead` uses `wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));` if `bio->bi_status` has an error. If an error happens, `bp->l_flag` becomes `lbmREAD | lbmERROR`. The wait condition then becomes true: `(bp->l_flag != lbmREAD)`. So the code immediately wakes up. And in an error case, `lbmRead` unconditionally returns 0.

Then, `lmLogShutdown` continues and calls `lbmDirectWrite`, which submits a *new* bio for the same `bp`.  This introduces the possibility of a race condition: the first `lbmIODone` might still be running. Analyzing `lbmIODone` again reveals it acquires a lock, checks for an error, `bio_put`, checks if it was a read, clears `lbmREAD`, and then calls `LCACHE_WAKEUP`, sets `lbmDONE`, and unlocks.

Crucially, the `wait_event` in `lbmRead` cannot wake up until `LCACHE_WAKEUP` is called because `LCACHE_WAKEUP` wakes up `wait_event`. `wait_event` checks the condition without locks. `bp->l_flag` is initially `lbmREAD`.  Then, if an error, `lbmIODone` sets `lbmERROR`, clears `lbmREAD`, and then `LCACHE_WAKEUP` is called. So `wait_event` wakes up, sees `bp->l_flag` is `lbmERROR | lbmDONE` (or whatever), which is `!= lbmREAD`, and returns. This means `lbmIODone` *finishes completely* before `lbmRead` returns! `lbmDirectWrite` submits a second bio, and `lbmIOWait` waits for it. Then `lbmIODone` is called again. It's a write, so it sets `lbmDONE` and calls `LCACHE_WAKEUP`, waking up the `lbmIOWait`, which frees the `bp`. So far, so good: no use-after-free.

So, how does the use-after-free happen?

What if `lbmRead` is called, but is interrupted *after* submitting the bio? The `wait_event` is not interruptible; it's `wait_event`, not `wait_event_interruptible`. So it cannot return early due to signals.

Then, the critical question: is there any other way `wait_event` can return early? What if `bp->l_flag` is *not* `lbmREAD` initially? In `lbmAllocate`, `bp->l_flag` is set to 0, and then in `lbmRead`, it's made `lbmREAD`.

Wait, what if `lbmRead` is called while journaling to disk is disabled? There's a check:
```c
if (log->no_integrity) {
	bio->bi_iter.bi_size = 0;
	lbmIODone(bio);
} else {
	submit_bio(bio);
}
```
If `log->no_integrity` is true, `lbmIODone(bio)` is called synchronously. The `wait_event` immediately sees `bp->l_flag != lbmREAD` and returns! That means `lbmRead` returns, and can exit before the bio has even started!

Let's look at the crash: The task is `ktimers/0/16`, meaning it's in a soft

map[ContextFile:fs/jfs/jfs_logmgr.c IncludeLines:true Name:lbmWrite]

map[SourceCode:1993:	/*
1994:	 *	lbmWrite()
1995:	 *
1996:	 * buffer at head of pageout queue stays after completion of
1997:	 * partial-page pageout and redriven by explicit initiation of
1998:	 * pageout by caller until full-page pageout is completed and
1999:	 * released.
2000:	 *
2001:	 * device driver i/o done redrives pageout of new buffer at
2002:	 * head of pageout queue when current buffer at head of pageout
2003:	 * queue is released at the completion of its full-page pageout.
2004:	 *
2005:	 * LOGGC_LOCK() serializes lbmWrite() by lmNextPage() and lmGroupCommit().
2006:	 * LCACHE_LOCK() serializes xflag between lbmWrite() and lbmIODone()
2007:	 */
2008:	static void lbmWrite(struct jfs_log * log, struct lbuf * bp, int flag,
2009:			     int cant_block)
2010:	{
2011:		struct lbuf *tail;
2012:		unsigned long flags;
2013:	
2014:		jfs_info("lbmWrite: bp:0x%p flag:0x%x pn:0x%x", bp, flag, bp->l_pn);
2015:	
2016:		/* map the logical block address to physical block address */
2017:		bp->l_blkno =
2018:		    log->base + (bp->l_pn << (L2LOGPSIZE - log->l2bsize));
2019:	
2020:		LCACHE_LOCK(flags);		/* disable+lock */
2021:	
2022:		/*
2023:		 * initialize buffer for device driver
2024:		 */
2025:		bp->l_flag = flag;
2026:	
2027:		/*
2028:		 *	insert bp at tail of write queue associated with log
2029:		 *
2030:		 * (request is either for bp already/currently at head of queue
2031:		 * or new bp to be inserted at tail)
2032:		 */
2033:		tail = log->wqueue;
2034:	
2035:		/* is buffer not already on write queue ? */
2036:		if (bp->l_wqnext == NULL) {
2037:			/* insert at tail of wqueue */
2038:			if (tail == NULL) {
2039:				log->wqueue = bp;
2040:				bp->l_wqnext = bp;
2041:			} else {
2042:				log->wqueue = bp;
2043:				bp->l_wqnext = tail->l_wqnext;
2044:				tail->l_wqnext = bp;
2045:			}
2046:	
2047:			tail = bp;
2048:		}
2049:	
2050:		/* is buffer at head of wqueue and for write ? */
2051:		if ((bp != tail->l_wqnext) || !(flag & lbmWRITE)) {
2052:			LCACHE_UNLOCK(flags);	/* unlock+enable */
2053:			return;
2054:		}
2055:	
2056:		LCACHE_UNLOCK(flags);	/* unlock+enable */
2057:	
2058:		if (cant_block)
2059:			lbmRedrive(bp);
2060:		else if (flag & lbmSYNC)
2061:			lbmStartIO(bp);
2062:		else {
2063:			LOGGC_UNLOCK(log);
2064:			lbmStartIO(bp);
2065:			LOGGC_LOCK(log);
2066:		}
2067:	}
 SourceFile:fs/jfs/jfs_logmgr.c]

gemini-3.1-pro-preview

							input: 120956
							output: 48
							thoughts: 225
						

**Analyzing the `lbmWrite` and `lbmIOWait` Sequence**

Okay, let's break this down. I'm seeing that `lbmWrite` is responsible for setting `bp->l_flag` within `LCACHE_LOCK`. Specifically, if I pass `lbmWRITE | lbmRELEASE | lbmSYNC` to `lbmWrite`, it sets `bp->l_flag` to that combination. After that, it invokes `lbmStartIO(bp)`.

Now, the interesting part. `lmLogShutdown` calls `lbmWrite` with those specific flags *and* then immediately calls `lbmIOWait`. My concern is whether we're getting an ordering conflict. `lbmIOWait` is the part I'm really curious about because it waits for `bp->l_flag` to have the `lbmDONE` flag set, which presumably indicates I/O completion.

Okay, let me trace through `lbmIOWait`. It looks like it uses `LCACHE_SLEEP_COND`, and that's probably a macro. I'll need to figure out what that macro does to fully grasp the synchronization mechanism here. Specifically, I need to see how `lbmDONE` is set and how `LCACHE_SLEEP_COND` interacts with it.

requested entity does not exist

map[ContextFile:fs/jfs/jfs_logmgr.c IncludeLines:true Name:LCACHE_SLEEP_COND]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 121535
							output: 21
							thoughts: 29
						

Okay, here's my take on those thoughts, framed as a first-person expert summary:

**Digging into the JFS Log Manager**

Alright, time to get my hands dirty. I'm thinking I need to find the definition or usage of `LCACHE_SLEEP_COND`, and since I know it's likely related to the logging aspect of JFS, I'll start by drilling into `fs/jfs/jfs_logmgr.c`. I have a feeling that's the right place to find where this conditional variable is being used to manage locking or synchronization in the journal cache. I'm expecting to find its definition there, and probably some associated locking semantics involving `wake_up()` or `wait_event()` (or similar). Given the naming convention, it screams "sleep condition," so I'm expecting to find that this is related to waiting on log cache operations. Let's see what's actually going on in that part of the file. Time to fire up the editor.

map[Expression:LCACHE_SLEEP_COND]

map[Output:fs/jfs/jfs_logmgr.c=102=static DEFINE_SPINLOCK(jfsLCacheLock);
--
fs/jfs/jfs_logmgr.c-109- */
fs/jfs/jfs_logmgr.c:110:#define LCACHE_SLEEP_COND(wq, cond, flags)	\
fs/jfs/jfs_logmgr.c-111-do {						\
--
fs/jfs/jfs_logmgr.c=1873=static struct lbuf *lbmAllocate(struct jfs_log * log, int pn)
--
fs/jfs/jfs_logmgr.c-1881-	LCACHE_LOCK(flags);
fs/jfs/jfs_logmgr.c:1882:	LCACHE_SLEEP_COND(log->free_wait, (bp = log->lbuf_free), flags);
fs/jfs/jfs_logmgr.c-1883-	log->lbuf_free = bp->l_freelist;
--
fs/jfs/jfs_logmgr.c=2140=static int lbmIOWait(struct lbuf * bp, int flag)
--
fs/jfs/jfs_logmgr.c-2148-
fs/jfs/jfs_logmgr.c:2149:	LCACHE_SLEEP_COND(bp->l_ioevent, (bp->l_flag & lbmDONE), flags);
fs/jfs/jfs_logmgr.c-2150-
]

gemini-3.1-pro-preview

							input: 122199
							output: 23
							thoughts: 15
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Analyzing the `LCACHE_SLEEP_COND` Definition**

Alright, let's dive into this `LCACHE_SLEEP_COND` definition. I immediately think: "Okay, another sleep condition in the cache layer. I need to understand what's being synchronized here, what resource it's protecting, and how it relates to the broader concurrency model." My experience tells me this is probably involved with managing cache entries, potentially handling eviction, or maybe even dealing with contention on the cache lock itself. I'm already anticipating questions about potential deadlock scenarios, whether it's fair or priority-based, and how it interacts with other locking mechanisms in the system. The specifics of the definition are what matter now, but my mind is already running through potential implications for performance and reliability. I'll be looking for clues about the underlying data structures and the operations that trigger the sleep or wake-up signals. Let's see what the code reveals.

map[Expression:#define LCACHE_SLEEP_COND]

map[Output:fs/jfs/jfs_logmgr.c=102=static DEFINE_SPINLOCK(jfsLCacheLock);
--
fs/jfs/jfs_logmgr.c-109- */
fs/jfs/jfs_logmgr.c:110:#define LCACHE_SLEEP_COND(wq, cond, flags)	\
fs/jfs/jfs_logmgr.c-111-do {						\
]

gemini-3.1-pro-preview

							input: 122575
							output: 24
							thoughts: 28
						

Okay, here's my interpretation of what's going on in those lines of `fs/jfs/jfs_logmgr.c`, from my perspective as an expert:

**Diving into the JFS Log Manager**

Alright, I need to get a handle on what's happening within that JFS log manager code. Specifically, let's zero in on lines 110-120 in `fs/jfs/jfs_logmgr.c`. Right, so this is probably a crucial section dealing with... well, based on the filename and function context, this section likely involves managing the JFS log, perhaps interactions with log buffers, checkpointing, or possibly error handling related to log writes. My immediate expectation is that these lines will be related to synchronizing the log, making sure updates are written to persistent storage, or dealing with log buffer allocation and deallocation within the logging process, but I need to read the code to be sure. I'm already anticipating some of the nuances of JFS's logging implementation – how it handles atomicity, consistency, and the potential for recovery in case of system crashes. I'm expecting to see calls to lower-level functions that interact directly with the disk or other persistent storage devices. Time to dig in and see if this hunch is correct.

map[Expression:#define LCACHE_SLEEP_COND.*]

map[Output:fs/jfs/jfs_logmgr.c=102=static DEFINE_SPINLOCK(jfsLCacheLock);
--
fs/jfs/jfs_logmgr.c-109- */
fs/jfs/jfs_logmgr.c:110:#define LCACHE_SLEEP_COND(wq, cond, flags)	\
fs/jfs/jfs_logmgr.c-111-do {						\
]

gemini-3.1-pro-preview

							input: 123025
							output: 27
							thoughts: 8
						

Okay, here's my attempt at summarizing the thought process, tailored for an expert audience, and written in the first person:

**Direct File Access: Initial Assessment**

Alright, so the first step here is pretty clear: let's go straight to the source. Let's see if we can read the file directly. I'm thinking, instead of any intermediate steps or parsing layers, if we can access the file data directly, we can avoid any potential data loss. I’m betting this will give me the most complete and immediate perspective. Efficiency is key, right? This initial direct access will allow me to cut down time on more basic things.

map[File:fs/jfs/jfs_logmgr.c]

map[Contents:// SPDX-License-Identifier: GPL-2.0-or-later
/*
 *   Copyright (C) International Business Machines Corp., 2000-2004
 *   Portions Copyright (C) Christoph Hellwig, 2001-2002
 */

/*
 *	jfs_logmgr.c: log manager
 *
 * for related information, see transaction manager (jfs_txnmgr.c), and
 * recovery manager (jfs_logredo.c).
 *
 * note: for detail, RTFS.
 *
 *	log buffer manager:
 * special purpose buffer manager supporting log i/o requirements.
 * per log serial pageout of logpage
 * queuing i/o requests and redrive i/o at iodone
 * maintain current logpage buffer
 * no caching since append only
 * appropriate jfs buffer cache buffers as needed
 *
 *	group commit:
 * transactions which wrote COMMIT records in the same in-memory
 * log page during the pageout of previous/current log page(s) are
 * committed together by the pageout of the page.
 *
 *	TBD lazy commit:
 * transactions are committed asynchronously when the log page
 * containing it COMMIT is paged out when it becomes full;
 *
 *	serialization:
 * . a per log lock serialize log write.
 * . a per log lock serialize group commit.
 * . a per log lock serialize log open/close;
 *
 *	TBD log integrity:
 * careful-write (ping-pong) of last logpage to recover from crash
 * in overwrite.
 * detection of split (out-of-order) write of physical sectors
 * of last logpage via timestamp at end of each sector
 * with its mirror data array at trailer).
 *
 *	alternatives:
 * lsn - 64-bit monotonically increasing integer vs
 * 32-bit lspn and page eor.
 */

#include <linux/fs.h>
#include <linux/blkdev.h>
#include <linux/interrupt.h>
#include <linux/completion.h>
#include <linux/kthread.h>
#include <linux/buffer_head.h>		/* for sync_blockdev() */
#include <linux/bio.h>
#include <linux/freezer.h>
#include <linux/export.h>
#include <linux/delay.h>
#include <linux/mutex.h>
#include <linux/seq_file.h>
#include <linux/slab.h>
#include "jfs_incore.h"
#include "jfs_filsys.h"
#include "jfs_metapage.h"
#include "jfs_superblock.h"
#include "jfs_txnmgr.h"
#include "jfs_debug.h"


/*
 * lbuf's ready to be redriven.  Protected by log_redrive_lock (jfsIO thread)
 */
static struct lbuf *log_redrive_list;
static DEFINE_SPINLOCK(log_redrive_lock);




/*
 *	log group commit serialization (per log)
 */

#define LOGGC_LOCK_INIT(log)	spin_lock_init(&(log)->gclock)
#define LOGGC_LOCK(log)		spin_lock_irq(&(log)->gclock)
#define LOGGC_UNLOCK(log)	spin_unlock_irq(&(log)->gclock)
#define LOGGC_WAKEUP(tblk)	wake_up_all(&(tblk)->gcwait)

/*
 *	log sync serialization (per log)
 */
#define	LOGSYNC_DELTA(logsize)		min((logsize)/8, 128*LOGPSIZE)
#define	LOGSYNC_BARRIER(logsize)	((logsize)/4)
/*
#define	LOGSYNC_DELTA(logsize)		min((logsize)/4, 256*LOGPSIZE)
#define	LOGSYNC_BARRIER(logsize)	((logsize)/2)
*/


/*
 *	log buffer cache synchronization
 */
static DEFINE_SPINLOCK(jfsLCacheLock);

#define	LCACHE_LOCK(flags)	spin_lock_irqsave(&jfsLCacheLock, flags)
#define	LCACHE_UNLOCK(flags)	spin_unlock_irqrestore(&jfsLCacheLock, flags)

/*
 * See __SLEEP_COND in jfs_locks.h
 */
#define LCACHE_SLEEP_COND(wq, cond, flags)	\
do {						\
	if (cond)				\
		break;				\
	__SLEEP_COND(wq, cond, LCACHE_LOCK(flags), LCACHE_UNLOCK(flags)); \
} while (0)

#define	LCACHE_WAKEUP(event)	wake_up(event)


/*
 *	lbuf buffer cache (lCache) control
 */
/* log buffer manager pageout control (cumulative, inclusive) */
#define	lbmREAD		0x0001
#define	lbmWRITE	0x0002	/* enqueue at tail of write queue;
				 * init pageout if at head of queue;
				 */
#define	lbmRELEASE	0x0004	/* remove from write queue
				 * at completion of pageout;
				 * do not free/recycle it yet:
				 * caller will free it;
				 */
#define	lbmSYNC		0x0008	/* do not return to freelist
				 * when removed from write queue;
				 */
#define lbmFREE		0x0010	/* return to freelist
				 * at completion of pageout;
				 * the buffer may be recycled;
				 */
#define	lbmDONE		0x0020
#define	lbmERROR	0x0040
#define lbmGC		0x0080	/* lbmIODone to perform post-GC processing
				 * of log page
				 */
#define lbmDIRECT	0x0100

/*
 * Global list of active external journals
 */
static LIST_HEAD(jfs_external_logs);
static struct jfs_log *dummy_log;
static DEFINE_MUTEX(jfs_log_mutex);

/*
 * forward references
 */
static int lmWriteRecord(struct jfs_log * log, struct tblock * tblk,
			 struct lrd * lrd, struct tlock * tlck);

static int lmNextPage(struct jfs_log * log);
static int lmLogFileSystem(struct jfs_log * log, struct jfs_sb_info *sbi,
			   int activate);

static int open_inline_log(struct super_block *sb);
static int open_dummy_log(struct super_block *sb);
static int lbmLogInit(struct jfs_log * log);
static void lbmLogShutdown(struct jfs_log * log);
static struct lbuf *lbmAllocate(struct jfs_log * log, int);
static void lbmFree(struct lbuf * bp);
static void lbmfree(struct lbuf * bp);
static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp);
static void lbmWrite(struct jfs_log * log, struct lbuf * bp, int flag, int cant_block);
static void lbmDirectWrite(struct jfs_log * log, struct lbuf * bp, int flag);
static int lbmIOWait(struct lbuf * bp, int flag);
static bio_end_io_t lbmIODone;
static void lbmStartIO(struct lbuf * bp);
static void lmGCwrite(struct jfs_log * log, int cant_block);
static int lmLogSync(struct jfs_log * log, int hard_sync);



/*
 *	statistics
 */
#ifdef CONFIG_JFS_STATISTICS
static struct lmStat {
	uint commit;		/* # of commit */
	uint pagedone;		/* # of page written */
	uint submitted;		/* # of pages submitted */
	uint full_page;		/* # of full pages submitted */
	uint partial_page;	/* # of partial pages submitted */
} lmStat;
#endif

static void write_special_inodes(struct jfs_log *log,
				 int (*writer)(struct address_space *))
{
	struct jfs_sb_info *sbi;

	list_for_each_entry(sbi, &log->sb_list, log_list) {
		/* These pointers can be NULL before list_del during umount */
		if (sbi->ipbmap)
			writer(sbi->ipbmap->i_mapping);
		if (sbi->ipimap)
			writer(sbi->ipimap->i_mapping);
		if (sbi->direct_inode)
			writer(sbi->direct_inode->i_mapping);
	}
}

/*
 * NAME:	lmLog()
 *
 * FUNCTION:	write a log record;
 *
 * PARAMETER:
 *
 * RETURN:	lsn - offset to the next log record to write (end-of-log);
 *		-1  - error;
 *
 * note: todo: log error handler
 */
int lmLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
	  struct tlock * tlck)
{
	int lsn;
	int diffp, difft;
	struct metapage *mp = NULL;
	unsigned long flags;

	jfs_info("lmLog: log:0x%p tblk:0x%p, lrd:0x%p tlck:0x%p",
		 log, tblk, lrd, tlck);

	LOG_LOCK(log);

	/* log by (out-of-transaction) JFS ? */
	if (tblk == NULL)
		goto writeRecord;

	/* log from page ? */
	if (tlck == NULL ||
	    tlck->type & tlckBTROOT || (mp = tlck->mp) == NULL)
		goto writeRecord;

	/*
	 *	initialize/update page/transaction recovery lsn
	 */
	lsn = log->lsn;

	LOGSYNC_LOCK(log, flags);

	/*
	 * initialize page lsn if first log write of the page
	 */
	if (mp->lsn == 0) {
		mp->log = log;
		mp->lsn = lsn;
		log->count++;

		/* insert page at tail of logsynclist */
		list_add_tail(&mp->synclist, &log->synclist);
	}

	/*
	 *	initialize/update lsn of tblock of the page
	 *
	 * transaction inherits oldest lsn of pages associated
	 * with allocation/deallocation of resources (their
	 * log records are used to reconstruct allocation map
	 * at recovery time: inode for inode allocation map,
	 * B+-tree index of extent descriptors for block
	 * allocation map);
	 * allocation map pages inherit transaction lsn at
	 * commit time to allow forwarding log syncpt past log
	 * records associated with allocation/deallocation of
	 * resources only after persistent map of these map pages
	 * have been updated and propagated to home.
	 */
	/*
	 * initialize transaction lsn:
	 */
	if (tblk->lsn == 0) {
		/* inherit lsn of its first page logged */
		tblk->lsn = mp->lsn;
		log->count++;

		/* insert tblock after the page on logsynclist */
		list_add(&tblk->synclist, &mp->synclist);
	}
	/*
	 * update transaction lsn:
	 */
	else {
		/* inherit oldest/smallest lsn of page */
		logdiff(diffp, mp->lsn, log);
		logdiff(difft, tblk->lsn, log);
		if (diffp < difft) {
			/* update tblock lsn with page lsn */
			tblk->lsn = mp->lsn;

			/* move tblock after page on logsynclist */
			list_move(&tblk->synclist, &mp->synclist);
		}
	}

	LOGSYNC_UNLOCK(log, flags);

	/*
	 *	write the log record
	 */
      writeRecord:
	lsn = lmWriteRecord(log, tblk, lrd, tlck);

	/*
	 * forward log syncpt if log reached next syncpt trigger
	 */
	logdiff(diffp, lsn, log);
	if (diffp >= log->nextsync)
		lsn = lmLogSync(log, 0);

	/* update end-of-log lsn */
	log->lsn = lsn;

	LOG_UNLOCK(log);

	/* return end-of-log address */
	return lsn;
}

/*
 * NAME:	lmWriteRecord()
 *
 * FUNCTION:	move the log record to current log page
 *
 * PARAMETER:	cd	- commit descriptor
 *
 * RETURN:	end-of-log address
 *
 * serialization: LOG_LOCK() held on entry/exit
 */
static int
lmWriteRecord(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
	      struct tlock * tlck)
{
	int lsn = 0;		/* end-of-log address */
	struct lbuf *bp;	/* dst log page buffer */
	struct logpage *lp;	/* dst log page */
	caddr_t dst;		/* destination address in log page */
	int dstoffset;		/* end-of-log offset in log page */
	int freespace;		/* free space in log page */
	caddr_t p;		/* src meta-data page */
	caddr_t src;
	int srclen;
	int nbytes;		/* number of bytes to move */
	int i;
	int len;
	struct linelock *linelock;
	struct lv *lv;
	struct lvd *lvd;
	int l2linesize;

	len = 0;

	/* retrieve destination log page to write */
	bp = (struct lbuf *) log->bp;
	lp = (struct logpage *) bp->l_ldata;
	dstoffset = log->eor;

	/* any log data to write ? */
	if (tlck == NULL)
		goto moveLrd;

	/*
	 *	move log record data
	 */
	/* retrieve source meta-data page to log */
	if (tlck->flag & tlckPAGELOCK) {
		p = (caddr_t) (tlck->mp->data);
		linelock = (struct linelock *) & tlck->lock;
	}
	/* retrieve source in-memory inode to log */
	else if (tlck->flag & tlckINODELOCK) {
		if (tlck->type & tlckDTREE)
			p = (caddr_t) &JFS_IP(tlck->ip)->i_dtroot;
		else
			p = (caddr_t) &JFS_IP(tlck->ip)->i_xtroot;
		linelock = (struct linelock *) & tlck->lock;
	}
	else {
		jfs_err("lmWriteRecord: UFO tlck:0x%p", tlck);
		return 0;	/* Probably should trap */
	}
	l2linesize = linelock->l2linesize;

      moveData:
	ASSERT(linelock->index <= linelock->maxcnt);

	lv = linelock->lv;
	for (i = 0; i < linelock->index; i++, lv++) {
		if (lv->length == 0)
			continue;

		/* is page full ? */
		if (dstoffset >= LOGPSIZE - LOGPTLRSIZE) {
			/* page become full: move on to next page */
			lmNextPage(log);

			bp = log->bp;
			lp = (struct logpage *) bp->l_ldata;
			dstoffset = LOGPHDRSIZE;
		}

		/*
		 * move log vector data
		 */
		src = (u8 *) p + (lv->offset << l2linesize);
		srclen = lv->length << l2linesize;
		len += srclen;
		while (srclen > 0) {
			freespace = (LOGPSIZE - LOGPTLRSIZE) - dstoffset;
			nbytes = min(freespace, srclen);
			dst = (caddr_t) lp + dstoffset;
			memcpy(dst, src, nbytes);
			dstoffset += nbytes;

			/* is page not full ? */
			if (dstoffset < LOGPSIZE - LOGPTLRSIZE)
				break;

			/* page become full: move on to next page */
			lmNextPage(log);

			bp = (struct lbuf *) log->bp;
			lp = (struct logpage *) bp->l_ldata;
			dstoffset = LOGPHDRSIZE;

			srclen -= nbytes;
			src += nbytes;
		}

		/*
		 * move log vector descriptor
		 */
		len += 4;
		lvd = (struct lvd *) ((caddr_t) lp + dstoffset);
		lvd->offset = cpu_to_le16(lv->offset);
		lvd->length = cpu_to_le16(lv->length);
		dstoffset += 4;
		jfs_info("lmWriteRecord: lv offset:%d length:%d",
			 lv->offset, lv->length);
	}

	if ((i = linelock->next)) {
		linelock = (struct linelock *) lid_to_tlock(i);
		goto moveData;
	}

	/*
	 *	move log record descriptor
	 */
      moveLrd:
	lrd->length = cpu_to_le16(len);

	src = (caddr_t) lrd;
	srclen = LOGRDSIZE;

	while (srclen > 0) {
		freespace = (LOGPSIZE - LOGPTLRSIZE) - dstoffset;
		nbytes = min(freespace, srclen);
		dst = (caddr_t) lp + dstoffset;
		memcpy(dst, src, nbytes);

		dstoffset += nbytes;
		srclen -= nbytes;

		/* are there more to move than freespace of page ? */
		if (srclen)
			goto pageFull;

		/*
		 * end of log record descriptor
		 */

		/* update last log record eor */
		log->eor = dstoffset;
		bp->l_eor = dstoffset;
		lsn = (log->page << L2LOGPSIZE) + dstoffset;

		if (lrd->type & cpu_to_le16(LOG_COMMIT)) {
			tblk->clsn = lsn;
			jfs_info("wr: tclsn:0x%x, beor:0x%x", tblk->clsn,
				 bp->l_eor);

			INCREMENT(lmStat.commit);	/* # of commit */

			/*
			 * enqueue tblock for group commit:
			 *
			 * enqueue tblock of non-trivial/synchronous COMMIT
			 * at tail of group commit queue
			 * (trivial/asynchronous COMMITs are ignored by
			 * group commit.)
			 */
			LOGGC_LOCK(log);

			/* init tblock gc state */
			tblk->flag = tblkGC_QUEUE;
			tblk->bp = log->bp;
			tblk->pn = log->page;
			tblk->eor = log->eor;

			/* enqueue transaction to commit queue */
			list_add_tail(&tblk->cqueue, &log->cqueue);

			LOGGC_UNLOCK(log);
		}

		jfs_info("lmWriteRecord: lrd:0x%04x bp:0x%p pn:%d eor:0x%x",
			le16_to_cpu(lrd->type), log->bp, log->page, dstoffset);

		/* page not full ? */
		if (dstoffset < LOGPSIZE - LOGPTLRSIZE)
			return lsn;

	      pageFull:
		/* page become full: move on to next page */
		lmNextPage(log);

		bp = (struct lbuf *) log->bp;
		lp = (struct logpage *) bp->l_ldata;
		dstoffset = LOGPHDRSIZE;
		src += nbytes;
	}

	return lsn;
}


/*
 * NAME:	lmNextPage()
 *
 * FUNCTION:	write current page and allocate next page.
 *
 * PARAMETER:	log
 *
 * RETURN:	0
 *
 * serialization: LOG_LOCK() held on entry/exit
 */
static int lmNextPage(struct jfs_log * log)
{
	struct logpage *lp;
	int lspn;		/* log sequence page number */
	int pn;			/* current page number */
	struct lbuf *bp;
	struct lbuf *nextbp;
	struct tblock *tblk;

	/* get current log page number and log sequence page number */
	pn = log->page;
	bp = log->bp;
	lp = (struct logpage *) bp->l_ldata;
	lspn = le32_to_cpu(lp->h.page);

	LOGGC_LOCK(log);

	/*
	 *	write or queue the full page at the tail of write queue
	 */
	/* get the tail tblk on commit queue */
	if (list_empty(&log->cqueue))
		tblk = NULL;
	else
		tblk = list_entry(log->cqueue.prev, struct tblock, cqueue);

	/* every tblk who has COMMIT record on the current page,
	 * and has not been committed, must be on commit queue
	 * since tblk is queued at commit queueu at the time
	 * of writing its COMMIT record on the page before
	 * page becomes full (even though the tblk thread
	 * who wrote COMMIT record may have been suspended
	 * currently);
	 */

	/* is page bound with outstanding tail tblk ? */
	if (tblk && tblk->pn == pn) {
		/* mark tblk for end-of-page */
		tblk->flag |= tblkGC_EOP;

		if (log->cflag & logGC_PAGEOUT) {
			/* if page is not already on write queue,
			 * just enqueue (no lbmWRITE to prevent redrive)
			 * buffer to wqueue to ensure correct serial order
			 * of the pages since log pages will be added
			 * continuously
			 */
			if (bp->l_wqnext == NULL)
				lbmWrite(log, bp, 0, 0);
		} else {
			/*
			 * No current GC leader, initiate group commit
			 */
			log->cflag |= logGC_PAGEOUT;
			lmGCwrite(log, 0);
		}
	}
	/* page is not bound with outstanding tblk:
	 * init write or mark it to be redriven (lbmWRITE)
	 */
	else {
		/* finalize the page */
		bp->l_ceor = bp->l_eor;
		lp->h.eor = lp->t.eor = cpu_to_le16(bp->l_ceor);
		lbmWrite(log, bp, lbmWRITE | lbmRELEASE | lbmFREE, 0);
	}
	LOGGC_UNLOCK(log);

	/*
	 *	allocate/initialize next page
	 */
	/* if log wraps, the first data page of log is 2
	 * (0 never used, 1 is superblock).
	 */
	log->page = (pn == log->size - 1) ? 2 : pn + 1;
	log->eor = LOGPHDRSIZE;	/* ? valid page empty/full at logRedo() */

	/* allocate/initialize next log page buffer */
	nextbp = lbmAllocate(log, log->page);
	nextbp->l_eor = log->eor;
	log->bp = nextbp;

	/* initialize next log page */
	lp = (struct logpage *) nextbp->l_ldata;
	lp->h.page = lp->t.page = cpu_to_le32(lspn + 1);
	lp->h.eor = lp->t.eor = cpu_to_le16(LOGPHDRSIZE);

	return 0;
}


/*
 * NAME:	lmGroupCommit()
 *
 * FUNCTION:	group commit
 *	initiate pageout of the pages with COMMIT in the order of
 *	page number - redrive pageout of the page at the head of
 *	pageout queue until full page has been written.
 *
 * RETURN:
 *
 * NOTE:
 *	LOGGC_LOCK serializes log group commit queue, and
 *	transaction blocks on the commit queue.
 *	N.B. LOG_LOCK is NOT held during lmGroupCommit().
 */
int lmGroupCommit(struct jfs_log * log, struct tblock * tblk)
{
	int rc = 0;

	LOGGC_LOCK(log);

	/* group committed already ? */
	if (tblk->flag & tblkGC_COMMITTED) {
		if (tblk->flag & tblkGC_ERROR)
			rc = -EIO;

		LOGGC_UNLOCK(log);
		return rc;
	}
	jfs_info("lmGroup Commit: tblk = 0x%p, gcrtc = %d", tblk, log->gcrtc);

	if (tblk->xflag & COMMIT_LAZY)
		tblk->flag |= tblkGC_LAZY;

	if ((!(log->cflag & logGC_PAGEOUT)) && (!list_empty(&log->cqueue)) &&
	    (!(tblk->xflag & COMMIT_LAZY) || test_bit(log_FLUSH, &log->flag)
	     || jfs_tlocks_low)) {
		/*
		 * No pageout in progress
		 *
		 * start group commit as its group leader.
		 */
		log->cflag |= logGC_PAGEOUT;

		lmGCwrite(log, 0);
	}

	if (tblk->xflag & COMMIT_LAZY) {
		/*
		 * Lazy transactions can leave now
		 */
		LOGGC_UNLOCK(log);
		return 0;
	}

	/* lmGCwrite gives up LOGGC_LOCK, check again */

	if (tblk->flag & tblkGC_COMMITTED) {
		if (tblk->flag & tblkGC_ERROR)
			rc = -EIO;

		LOGGC_UNLOCK(log);
		return rc;
	}

	/* upcount transaction waiting for completion
	 */
	log->gcrtc++;
	tblk->flag |= tblkGC_READY;

	__SLEEP_COND(tblk->gcwait, (tblk->flag & tblkGC_COMMITTED),
		     LOGGC_LOCK(log), LOGGC_UNLOCK(log));

	/* removed from commit queue */
	if (tblk->flag & tblkGC_ERROR)
		rc = -EIO;

	LOGGC_UNLOCK(log);
	return rc;
}

/*
 * NAME:	lmGCwrite()
 *
 * FUNCTION:	group commit write
 *	initiate write of log page, building a group of all transactions
 *	with commit records on that page.
 *
 * RETURN:	None
 *
 * NOTE:
 *	LOGGC_LOCK must be held by caller.
 *	N.B. LOG_LOCK is NOT held during lmGroupCommit().
 */
static void lmGCwrite(struct jfs_log * log, int cant_write)
{
	struct lbuf *bp;
	struct logpage *lp;
	int gcpn;		/* group commit page number */
	struct tblock *tblk;
	struct tblock *xtblk = NULL;

	/*
	 * build the commit group of a log page
	 *
	 * scan commit queue and make a commit group of all
	 * transactions with COMMIT records on the same log page.
	 */
	/* get the head tblk on the commit queue */
	gcpn = list_entry(log->cqueue.next, struct tblock, cqueue)->pn;

	list_for_each_entry(tblk, &log->cqueue, cqueue) {
		if (tblk->pn != gcpn)
			break;

		xtblk = tblk;

		/* state transition: (QUEUE, READY) -> COMMIT */
		tblk->flag |= tblkGC_COMMIT;
	}
	tblk = xtblk;		/* last tblk of the page */

	/*
	 * pageout to commit transactions on the log page.
	 */
	bp = (struct lbuf *) tblk->bp;
	lp = (struct logpage *) bp->l_ldata;
	/* is page already full ? */
	if (tblk->flag & tblkGC_EOP) {
		/* mark page to free at end of group commit of the page */
		tblk->flag &= ~tblkGC_EOP;
		tblk->flag |= tblkGC_FREE;
		bp->l_ceor = bp->l_eor;
		lp->h.eor = lp->t.eor = cpu_to_le16(bp->l_ceor);
		lbmWrite(log, bp, lbmWRITE | lbmRELEASE | lbmGC,
			 cant_write);
		INCREMENT(lmStat.full_page);
	}
	/* page is not yet full */
	else {
		bp->l_ceor = tblk->eor;	/* ? bp->l_ceor = bp->l_eor; */
		lp->h.eor = lp->t.eor = cpu_to_le16(bp->l_ceor);
		lbmWrite(log, bp, lbmWRITE | lbmGC, cant_write);
		INCREMENT(lmStat.partial_page);
	}
}

/*
 * NAME:	lmPostGC()
 *
 * FUNCTION:	group commit post-processing
 *	Processes transactions after their commit records have been written
 *	to disk, redriving log I/O if necessary.
 *
 * RETURN:	None
 *
 * NOTE:
 *	This routine is called a interrupt time by lbmIODone
 */
static void lmPostGC(struct lbuf * bp)
{
	unsigned long flags;
	struct jfs_log *log = bp->l_log;
	struct logpage *lp;
	struct tblock *tblk, *temp;

	//LOGGC_LOCK(log);
	spin_lock_irqsave(&log->gclock, flags);
	/*
	 * current pageout of group commit completed.
	 *
	 * remove/wakeup transactions from commit queue who were
	 * group committed with the current log page
	 */
	list_for_each_entry_safe(tblk, temp, &log->cqueue, cqueue) {
		if (!(tblk->flag & tblkGC_COMMIT))
			break;
		/* if transaction was marked GC_COMMIT then
		 * it has been shipped in the current pageout
		 * and made it to disk - it is committed.
		 */

		if (bp->l_flag & lbmERROR)
			tblk->flag |= tblkGC_ERROR;

		/* remove it from the commit queue */
		list_del(&tblk->cqueue);
		tblk->flag &= ~tblkGC_QUEUE;

		if (tblk == log->flush_tblk) {
			/* we can stop flushing the log now */
			clear_bit(log_FLUSH, &log->flag);
			log->flush_tblk = NULL;
		}

		jfs_info("lmPostGC: tblk = 0x%p, flag = 0x%x", tblk,
			 tblk->flag);

		if (!(tblk->xflag & COMMIT_FORCE))
			/*
			 * Hand tblk over to lazy commit thread
			 */
			txLazyUnlock(tblk);
		else {
			/* state transition: COMMIT -> COMMITTED */
			tblk->flag |= tblkGC_COMMITTED;

			if (tblk->flag & tblkGC_READY)
				log->gcrtc--;

			LOGGC_WAKEUP(tblk);
		}

		/* was page full before pageout ?
		 * (and this is the last tblk bound with the page)
		 */
		if (tblk->flag & tblkGC_FREE)
			lbmFree(bp);
		/* did page become full after pageout ?
		 * (and this is the last tblk bound with the page)
		 */
		else if (tblk->flag & tblkGC_EOP) {
			/* finalize the page */
			lp = (struct logpage *) bp->l_ldata;
			bp->l_ceor = bp->l_eor;
			lp->h.eor = lp->t.eor = cpu_to_le16(bp->l_eor);
			jfs_info("lmPostGC: calling lbmWrite");
			lbmWrite(log, bp, lbmWRITE | lbmRELEASE | lbmFREE,
				 1);
		}

	}

	/* are there any transactions who have entered lnGroupCommit()
	 * (whose COMMITs are after that of the last log page written.
	 * They are waiting for new group commit (above at (SLEEP 1))
	 * or lazy transactions are on a full (queued) log page,
	 * select the latest ready transaction as new group leader and
	 * wake her up to lead her group.
	 */
	if ((!list_empty(&log->cqueue)) &&
	    ((log->gcrtc > 0) || (tblk->bp->l_wqnext != NULL) ||
	     test_bit(log_FLUSH, &log->flag) || jfs_tlocks_low))
		/*
		 * Call lmGCwrite with new group leader
		 */
		lmGCwrite(log, 1);

	/* no transaction are ready yet (transactions are only just
	 * queued (GC_QUEUE) and not entered for group commit yet).
	 * the first transaction entering group commit
	 * will elect herself as new group leader.
	 */
	else
		log->cflag &= ~logGC_PAGEOUT;

	//LOGGC_UNLOCK(log);
	spin_unlock_irqrestore(&log->gclock, flags);
	return;
}

/*
 * NAME:	lmLogSync()
 *
 * FUNCTION:	write log SYNCPT record for specified log
 *	if new sync address is available
 *	(normally the case if sync() is executed by back-ground
 *	process).
 *	calculate new value of i_nextsync which determines when
 *	this code is called again.
 *
 * PARAMETERS:	log	- log structure
 *		hard_sync - 1 to force all metadata to be written
 *
 * RETURN:	0
 *
 * serialization: LOG_LOCK() held on entry/exit
 */
static int lmLogSync(struct jfs_log * log, int hard_sync)
{
	int logsize;
	int written;		/* written since last syncpt */
	int free;		/* free space left available */
	int delta;		/* additional delta to write normally */
	int more;		/* additional write granted */
	struct lrd lrd;
	int lsn;
	struct logsyncblk *lp;
	unsigned long flags;

	/* push dirty metapages out to disk */
	if (hard_sync)
		write_special_inodes(log, filemap_fdatawrite);
	else
		write_special_inodes(log, filemap_flush);

	/*
	 *	forward syncpt
	 */
	/* if last sync is same as last syncpt,
	 * invoke sync point forward processing to update sync.
	 */

	if (log->sync == log->syncpt) {
		LOGSYNC_LOCK(log, flags);
		if (list_empty(&log->synclist))
			log->sync = log->lsn;
		else {
			lp = list_entry(log->synclist.next,
					struct logsyncblk, synclist);
			log->sync = lp->lsn;
		}
		LOGSYNC_UNLOCK(log, flags);

	}

	/* if sync is different from last syncpt,
	 * write a SYNCPT record with syncpt = sync.
	 * reset syncpt = sync
	 */
	if (log->sync != log->syncpt) {
		lrd.logtid = 0;
		lrd.backchain = 0;
		lrd.type = cpu_to_le16(LOG_SYNCPT);
		lrd.length = 0;
		lrd.log.syncpt.sync = cpu_to_le32(log->sync);
		lsn = lmWriteRecord(log, NULL, &lrd, NULL);

		log->syncpt = log->sync;
	} else
		lsn = log->lsn;

	/*
	 *	setup next syncpt trigger (SWAG)
	 */
	logsize = log->logsize;

	logdiff(written, lsn, log);
	free = logsize - written;
	delta = LOGSYNC_DELTA(logsize);
	more = min(free / 2, delta);
	if (more < 2 * LOGPSIZE) {
		jfs_warn("\n ... Log Wrap ... Log Wrap ... Log Wrap ...\n");
		/*
		 *	log wrapping
		 *
		 * option 1 - panic ? No.!
		 * option 2 - shutdown file systems
		 *	      associated with log ?
		 * option 3 - extend log ?
		 * option 4 - second chance
		 *
		 * mark log wrapped, and continue.
		 * when all active transactions are completed,
		 * mark log valid for recovery.
		 * if crashed during invalid state, log state
		 * implies invalid log, forcing fsck().
		 */
		/* mark log state log wrap in log superblock */
		/* log->state = LOGWRAP; */

		/* reset sync point computation */
		log->syncpt = log->sync = lsn;
		log->nextsync = delta;
	} else
		/* next syncpt trigger = written + more */
		log->nextsync = written + more;

	/* if number of bytes written from last sync point is more
	 * than 1/4 of the log size, stop new transactions from
	 * starting until all current transactions are completed
	 * by setting syncbarrier flag.
	 */
	if (!test_bit(log_SYNCBARRIER, &log->flag) &&
	    (written > LOGSYNC_BARRIER(logsize)) && log->active) {
		set_bit(log_SYNCBARRIER, &log->flag);
		jfs_info("log barrier on: lsn=0x%x syncpt=0x%x", lsn,
			 log->syncpt);
		/*
		 * We may have to initiate group commit
		 */
		jfs_flush_journal(log, 0);
	}

	return lsn;
}

/*
 * NAME:	jfs_syncpt
 *
 * FUNCTION:	write log SYNCPT record for specified log
 *
 * PARAMETERS:	log	  - log structure
 *		hard_sync - set to 1 to force metadata to be written
 */
void jfs_syncpt(struct jfs_log *log, int hard_sync)
{	LOG_LOCK(log);
	if (!test_bit(log_QUIESCE, &log->flag))
		lmLogSync(log, hard_sync);
	LOG_UNLOCK(log);
}

/*
 * NAME:	lmLogOpen()
 *
 * FUNCTION:	open the log on first open;
 *	insert filesystem in the active list of the log.
 *
 * PARAMETER:	ipmnt	- file system mount inode
 *		iplog	- log inode (out)
 *
 * RETURN:
 *
 * serialization:
 */
int lmLogOpen(struct super_block *sb)
{
	int rc;
	struct file *bdev_file;
	struct jfs_log *log;
	struct jfs_sb_info *sbi = JFS_SBI(sb);

	if (sbi->flag & JFS_NOINTEGRITY)
		return open_dummy_log(sb);

	if (sbi->mntflag & JFS_INLINELOG)
		return open_inline_log(sb);

	mutex_lock(&jfs_log_mutex);
	list_for_each_entry(log, &jfs_external_logs, journal_list) {
		if (file_bdev(log->bdev_file)->bd_dev == sbi->logdev) {
			if (!uuid_equal(&log->uuid, &sbi->loguuid)) {
				jfs_warn("wrong uuid on JFS journal");
				mutex_unlock(&jfs_log_mutex);
				return -EINVAL;
			}
			/*
			 * add file system to log active file system list
			 */
			if ((rc = lmLogFileSystem(log, sbi, 1))) {
				mutex_unlock(&jfs_log_mutex);
				return rc;
			}
			goto journal_found;
		}
	}

	if (!(log = kzalloc_obj(struct jfs_log))) {
		mutex_unlock(&jfs_log_mutex);
		return -ENOMEM;
	}
	INIT_LIST_HEAD(&log->sb_list);
	init_waitqueue_head(&log->syncwait);

	/*
	 *	external log as separate logical volume
	 *
	 * file systems to log may have n-to-1 relationship;
	 */

	bdev_file = bdev_file_open_by_dev(sbi->logdev,
			BLK_OPEN_READ | BLK_OPEN_WRITE, log, NULL);
	if (IS_ERR(bdev_file)) {
		rc = PTR_ERR(bdev_file);
		goto free;
	}

	log->bdev_file = bdev_file;
	uuid_copy(&log->uuid, &sbi->loguuid);

	/*
	 * initialize log:
	 */
	if ((rc = lmLogInit(log)))
		goto close;

	list_add(&log->journal_list, &jfs_external_logs);

	/*
	 * add file system to log active file system list
	 */
	if ((rc = lmLogFileSystem(log, sbi, 1)))
		goto shutdown;

journal_found:
	LOG_LOCK(log);
	list_add(&sbi->log_list, &log->sb_list);
	sbi->log = log;
	LOG_UNLOCK(log);

	mutex_unlock(&jfs_log_mutex);
	return 0;

	/*
	 *	unwind on error
	 */
      shutdown:		/* unwind lbmLogInit() */
	list_del(&log->journal_list);
	lbmLogShutdown(log);

      close:		/* close external log device */
	bdev_fput(bdev_file);

      free:		/* free log descriptor */
	mutex_unlock(&jfs_log_mutex);
	kfree(log);

	jfs_warn("lmLogOpen: exit(%d)", rc);
	return rc;
}

static int open_inline_log(struct super_block *sb)
{
	struct jfs_log *log;
	int rc;

	if (!(log = kzalloc_obj(struct jfs_log)))
		return -ENOMEM;
	INIT_LIST_HEAD(&log->sb_list);
	init_waitqueue_head(&log->syncwait);

	set_bit(log_INLINELOG, &log->flag);
	log->bdev_file = sb->s_bdev_file;
	log->base = addressPXD(&JFS_SBI(sb)->logpxd);
	log->size = lengthPXD(&JFS_SBI(sb)->logpxd) >>
	    (L2LOGPSIZE - sb->s_blocksize_bits);
	log->l2bsize = sb->s_blocksize_bits;
	ASSERT(L2LOGPSIZE >= sb->s_blocksize_bits);

	/*
	 * initialize log.
	 */
	if ((rc = lmLogInit(log))) {
		kfree(log);
		jfs_warn("lmLogOpen: exit(%d)", rc);
		return rc;
	}

	list_add(&JFS_SBI(sb)->log_list, &log->sb_list);
	JFS_SBI(sb)->log = log;

	return rc;
}

static int open_dummy_log(struct super_block *sb)
{
	int rc;

	mutex_lock(&jfs_log_mutex);
	if (!dummy_log) {
		dummy_log = kzalloc_obj(struct jfs_log);
		if (!dummy_log) {
			mutex_unlock(&jfs_log_mutex);
			return -ENOMEM;
		}
		INIT_LIST_HEAD(&dummy_log->sb_list);
		init_waitqueue_head(&dummy_log->syncwait);
		dummy_log->no_integrity = 1;
		/* Make up some stuff */
		dummy_log->size = 1024;
		rc = lmLogInit(dummy_log);
		if (rc) {
			kfree(dummy_log);
			dummy_log = NULL;
			mutex_unlock(&jfs_log_mutex);
			return rc;
		}
	}

	LOG_LOCK(dummy_log);
	list_add(&JFS_SBI(sb)->log_list, &dummy_log->sb_list);
	JFS_SBI(sb)->log = dummy_log;
	LOG_UNLOCK(dummy_log);
	mutex_unlock(&jfs_log_mutex);

	return 0;
}

/*
 * NAME:	lmLogInit()
 *
 * FUNCTION:	log initialization at first log open.
 *
 *	logredo() (or logformat()) should have been run previously.
 *	initialize the log from log superblock.
 *	set the log state in the superblock to LOGMOUNT and
 *	write SYNCPT log record.
 *
 * PARAMETER:	log	- log structure
 *
 * RETURN:	0	- if ok
 *		-EINVAL	- bad log magic number or superblock dirty
 *		error returned from logwait()
 *
 * serialization: single first open thread
 */
int lmLogInit(struct jfs_log * log)
{
	int rc = 0;
	struct lrd lrd;
	struct logsuper *logsuper;
	struct lbuf *bpsuper;
	struct lbuf *bp;
	struct logpage *lp;
	int lsn = 0;

	jfs_info("lmLogInit: log:0x%p", log);

	/* initialize the group commit serialization lock */
	LOGGC_LOCK_INIT(log);

	/* allocate/initialize the log write serialization lock */
	LOG_LOCK_INIT(log);

	LOGSYNC_LOCK_INIT(log);

	INIT_LIST_HEAD(&log->synclist);

	INIT_LIST_HEAD(&log->cqueue);
	log->flush_tblk = NULL;

	log->count = 0;

	/*
	 * initialize log i/o
	 */
	if ((rc = lbmLogInit(log)))
		return rc;

	if (!test_bit(log_INLINELOG, &log->flag))
		log->l2bsize = L2LOGPSIZE;

	/* check for disabled journaling to disk */
	if (log->no_integrity) {
		/*
		 * Journal pages will still be filled.  When the time comes
		 * to actually do the I/O, the write is not done, and the
		 * endio routine is called directly.
		 */
		bp = lbmAllocate(log , 0);
		log->bp = bp;
		bp->l_pn = bp->l_eor = 0;
	} else {
		/*
		 * validate log superblock
		 */
		if ((rc = lbmRead(log, 1, &bpsuper)))
			goto errout10;

		logsuper = (struct logsuper *) bpsuper->l_ldata;

		if (logsuper->magic != cpu_to_le32(LOGMAGIC)) {
			jfs_warn("*** Log Format Error ! ***");
			rc = -EINVAL;
			goto errout20;
		}

		/* logredo() should have been run successfully. */
		if (logsuper->state != cpu_to_le32(LOGREDONE)) {
			jfs_warn("*** Log Is Dirty ! ***");
			rc = -EINVAL;
			goto errout20;
		}

		/* initialize log from log superblock */
		if (test_bit(log_INLINELOG,&log->flag)) {
			if (log->size != le32_to_cpu(logsuper->size)) {
				rc = -EINVAL;
				goto errout20;
			}
			jfs_info("lmLogInit: inline log:0x%p base:0x%Lx size:0x%x",
				 log, (unsigned long long)log->base, log->size);
		} else {
			if (!uuid_equal(&logsuper->uuid, &log->uuid)) {
				jfs_warn("wrong uuid on JFS log device");
				rc = -EINVAL;
				goto errout20;
			}
			log->size = le32_to_cpu(logsuper->size);
			log->l2bsize = le32_to_cpu(logsuper->l2bsize);
			jfs_info("lmLogInit: external log:0x%p base:0x%Lx size:0x%x",
				 log, (unsigned long long)log->base, log->size);
		}

		log->page = le32_to_cpu(logsuper->end) / LOGPSIZE;
		log->eor = le32_to_cpu(logsuper->end) - (LOGPSIZE * log->page);

		/*
		 * initialize for log append write mode
		 */
		/* establish current/end-of-log page/buffer */
		if ((rc = lbmRead(log, log->page, &bp)))
			goto errout20;

		lp = (struct logpage *) bp->l_ldata;

		jfs_info("lmLogInit: lsn:0x%x page:%d eor:%d:%d",
			 le32_to_cpu(logsuper->end), log->page, log->eor,
			 le16_to_cpu(lp->h.eor));

		log->bp = bp;
		bp->l_pn = log->page;
		bp->l_eor = log->eor;

		/* if current page is full, move on to next page */
		if (log->eor >= LOGPSIZE - LOGPTLRSIZE)
			lmNextPage(log);

		/*
		 * initialize log syncpoint
		 */
		/*
		 * write the first SYNCPT record with syncpoint = 0
		 * (i.e., log redo up to HERE !);
		 * remove current page from lbm write queue at end of pageout
		 * (to write log superblock update), but do not release to
		 * freelist;
		 */
		lrd.logtid = 0;
		lrd.backchain = 0;
		lrd.type = cpu_to_le16(LOG_SYNCPT);
		lrd.length = 0;
		lrd.log.syncpt.sync = 0;
		lsn = lmWriteRecord(log, NULL, &lrd, NULL);
		bp = log->bp;
		bp->l_ceor = bp->l_eor;
		lp = (struct logpage *) bp->l_ldata;
		lp->h.eor = lp->t.eor = cpu_to_le16(bp->l_eor);
		lbmWrite(log, bp, lbmWRITE | lbmSYNC, 0);
		if ((rc = lbmIOWait(bp, 0)))
			goto errout30;

		/*
		 * update/write superblock
		 */
		logsuper->state = cpu_to_le32(LOGMOUNT);
		log->serial = le32_to_cpu(logsuper->serial) + 1;
		logsuper->serial = cpu_to_le32(log->serial);
		lbmDirectWrite(log, bpsuper, lbmWRITE | lbmRELEASE | lbmSYNC);
		if ((rc = lbmIOWait(bpsuper, lbmFREE)))
			goto errout30;
	}

	/* initialize logsync parameters */
	log->logsize = (log->size - 2) << L2LOGPSIZE;
	log->lsn = lsn;
	log->syncpt = lsn;
	log->sync = log->syncpt;
	log->nextsync = LOGSYNC_DELTA(log->logsize);

	jfs_info("lmLogInit: lsn:0x%x syncpt:0x%x sync:0x%x",
		 log->lsn, log->syncpt, log->sync);

	/*
	 * initialize for lazy/group commit
	 */
	log->clsn = lsn;

	return 0;

	/*
	 *	unwind on error
	 */
      errout30:		/* release log page */
	log->wqueue = NULL;
	bp->l_wqnext = NULL;
	lbmFree(bp);

      errout20:		/* release log superblock */
	lbmFree(bpsuper);

      errout10:		/* unwind lbmLogInit() */
	lbmLogShutdown(log);

	jfs_warn("lmLogInit: exit(%d)", rc);
	return rc;
}


/*
 * NAME:	lmLogClose()
 *
 * FUNCTION:	remove file system <ipmnt> from active list of log <iplog>
 *		and close it on last close.
 *
 * PARAMETER:	sb	- superblock
 *
 * RETURN:	errors from subroutines
 *
 * serialization:
 */
int lmLogClose(struct super_block *sb)
{
	struct jfs_sb_info *sbi = JFS_SBI(sb);
	struct jfs_log *log = sbi->log;
	struct file *bdev_file;
	int rc = 0;

	jfs_info("lmLogClose: log:0x%p", log);

	mutex_lock(&jfs_log_mutex);
	LOG_LOCK(log);
	list_del(&sbi->log_list);
	LOG_UNLOCK(log);
	sbi->log = NULL;

	/*
	 * We need to make sure all of the "written" metapages
	 * actually make it to disk
	 */
	sync_blockdev(sb->s_bdev);

	if (test_bit(log_INLINELOG, &log->flag)) {
		/*
		 *	in-line log in host file system
		 */
		rc = lmLogShutdown(log);
		kfree(log);
		goto out;
	}

	if (!log->no_integrity)
		lmLogFileSystem(log, sbi, 0);

	if (!list_empty(&log->sb_list))
		goto out;

	/*
	 * TODO: ensure that the dummy_log is in a state to allow
	 * lbmLogShutdown to deallocate all the buffers and call
	 * kfree against dummy_log.  For now, leave dummy_log & its
	 * buffers in memory, and resuse if another no-integrity mount
	 * is requested.
	 */
	if (log->no_integrity)
		goto out;

	/*
	 *	external log as separate logical volume
	 */
	list_del(&log->journal_list);
	bdev_file = log->bdev_file;
	rc = lmLogShutdown(log);

	bdev_fput(bdev_file);

	kfree(log);

      out:
	mutex_unlock(&jfs_log_mutex);
	jfs_info("lmLogClose: exit(%d)", rc);
	return rc;
}


/*
 * NAME:	jfs_flush_journal()
 *
 * FUNCTION:	initiate write of any outstanding transactions to the journal
 *		and optionally wait until they are all written to disk
 *
 *		wait == 0  flush until latest txn is committed, don't wait
 *		wait == 1  flush until latest txn is committed, wait
 *		wait > 1   flush until all txn's are complete, wait
 */
void jfs_flush_journal(struct jfs_log *log, int wait)
{
	int i;
	struct tblock *target = NULL;

	/* jfs_write_inode may call us during read-only mount */
	if (!log)
		return;

	jfs_info("jfs_flush_journal: log:0x%p wait=%d", log, wait);

	LOGGC_LOCK(log);

	if (!list_empty(&log->cqueue)) {
		/*
		 * This ensures that we will keep writing to the journal as long
		 * as there are unwritten commit records
		 */
		target = list_entry(log->cqueue.prev, struct tblock, cqueue);

		if (test_bit(log_FLUSH, &log->flag)) {
			/*
			 * We're already flushing.
			 * if flush_tblk is NULL, we are flushing everything,
			 * so leave it that way.  Otherwise, update it to the
			 * latest transaction
			 */
			if (log->flush_tblk)
				log->flush_tblk = target;
		} else {
			/* Only flush until latest transaction is committed */
			log->flush_tblk = target;
			set_bit(log_FLUSH, &log->flag);

			/*
			 * Initiate I/O on outstanding transactions
			 */
			if (!(log->cflag & logGC_PAGEOUT)) {
				log->cflag |= logGC_PAGEOUT;
				lmGCwrite(log, 0);
			}
		}
	}
	if ((wait > 1) || test_bit(log_SYNCBARRIER, &log->flag)) {
		/* Flush until all activity complete */
		set_bit(log_FLUSH, &log->flag);
		log->flush_tblk = NULL;
	}

	if (wait && target && !(target->flag & tblkGC_COMMITTED)) {
		DECLARE_WAITQUEUE(__wait, current);

		add_wait_queue(&target->gcwait, &__wait);
		set_current_state(TASK_UNINTERRUPTIBLE);
		LOGGC_UNLOCK(log);
		schedule();
		LOGGC_LOCK(log);
		remove_wait_queue(&target->gcwait, &__wait);
	}
	LOGGC_UNLOCK(log);

	if (wait < 2)
		return;

	write_special_inodes(log, filemap_fdatawrite);

	/*
	 * If there was recent activity, we may need to wait
	 * for the lazycommit thread to catch up
	 */
	if ((!list_empty(&log->cqueue)) || !list_empty(&log->synclist)) {
		for (i = 0; i < 200; i++) {	/* Too much? */
			msleep(250);
			write_special_inodes(log, filemap_fdatawrite);
			if (list_empty(&log->cqueue) &&
			    list_empty(&log->synclist))
				break;
		}
	}
	assert(list_empty(&log->cqueue));

#ifdef CONFIG_JFS_DEBUG
	if (!list_empty(&log->synclist)) {
		struct logsyncblk *lp;

		printk(KERN_ERR "jfs_flush_journal: synclist not empty\n");
		list_for_each_entry(lp, &log->synclist, synclist) {
			if (lp->xflag & COMMIT_PAGE) {
				struct metapage *mp = (struct metapage *)lp;
				print_hex_dump(KERN_ERR, "metapage: ",
					       DUMP_PREFIX_ADDRESS, 16, 4,
					       mp, sizeof(struct metapage), 0);
				print_hex_dump(KERN_ERR, "page: ",
					       DUMP_PREFIX_ADDRESS, 16,
					       sizeof(long), mp->folio,
					       sizeof(struct page), 0);
			} else
				print_hex_dump(KERN_ERR, "tblock:",
					       DUMP_PREFIX_ADDRESS, 16, 4,
					       lp, sizeof(struct tblock), 0);
		}
	}
#else
	WARN_ON(!list_empty(&log->synclist));
#endif
	clear_bit(log_FLUSH, &log->flag);
}

/*
 * NAME:	lmLogShutdown()
 *
 * FUNCTION:	log shutdown at last LogClose().
 *
 *		write log syncpt record.
 *		update super block to set redone flag to 0.
 *
 * PARAMETER:	log	- log inode
 *
 * RETURN:	0	- success
 *
 * serialization: single last close thread
 */
int lmLogShutdown(struct jfs_log * log)
{
	int rc;
	struct lrd lrd;
	int lsn;
	struct logsuper *logsuper;
	struct lbuf *bpsuper;
	struct lbuf *bp;
	struct logpage *lp;

	jfs_info("lmLogShutdown: log:0x%p", log);

	jfs_flush_journal(log, 2);

	/*
	 * write the last SYNCPT record with syncpoint = 0
	 * (i.e., log redo up to HERE !)
	 */
	lrd.logtid = 0;
	lrd.backchain = 0;
	lrd.type = cpu_to_le16(LOG_SYNCPT);
	lrd.length = 0;
	lrd.log.syncpt.sync = 0;

	lsn = lmWriteRecord(log, NULL, &lrd, NULL);
	bp = log->bp;
	lp = (struct logpage *) bp->l_ldata;
	lp->h.eor = lp->t.eor = cpu_to_le16(bp->l_eor);
	lbmWrite(log, log->bp, lbmWRITE | lbmRELEASE | lbmSYNC, 0);
	lbmIOWait(log->bp, lbmFREE);
	log->bp = NULL;

	/*
	 * synchronous update log superblock
	 * mark log state as shutdown cleanly
	 * (i.e., Log does not need to be replayed).
	 */
	if ((rc = lbmRead(log, 1, &bpsuper)))
		goto out;

	logsuper = (struct logsuper *) bpsuper->l_ldata;
	logsuper->state = cpu_to_le32(LOGREDONE);
	logsuper->end = cpu_to_le32(lsn);
	lbmDirectWrite(log, bpsuper, lbmWRITE | lbmRELEASE | lbmSYNC);
	rc = lbmIOWait(bpsuper, lbmFREE);

	jfs_info("lmLogShutdown: lsn:0x%x page:%d eor:%d",
		 lsn, log->page, log->eor);

      out:
	/*
	 * shutdown per log i/o
	 */
	lbmLogShutdown(log);

	if (rc) {
		jfs_warn("lmLogShutdown: exit(%d)", rc);
	}
	return rc;
}


/*
 * NAME:	lmLogFileSystem()
 *
 * FUNCTION:	insert (<activate> = true)/remove (<activate> = false)
 *	file system into/from log active file system list.
 *
 * PARAMETE:	log	- pointer to logs inode.
 *		fsdev	- kdev_t of filesystem.
 *		serial	- pointer to returned log serial number
 *		activate - insert/remove device from active list.
 *
 * RETURN:	0	- success
 *		errors returned by vms_iowait().
 */
static int lmLogFileSystem(struct jfs_log * log, struct jfs_sb_info *sbi,
			   int activate)
{
	int rc = 0;
	int i;
	struct logsuper *logsuper;
	struct lbuf *bpsuper;
	uuid_t *uuid = &sbi->uuid;

	/*
	 * insert/remove file system device to log active file system list.
	 */
	if ((rc = lbmRead(log, 1, &bpsuper)))
		return rc;

	logsuper = (struct logsuper *) bpsuper->l_ldata;
	if (activate) {
		for (i = 0; i < MAX_ACTIVE; i++)
			if (uuid_is_null(&logsuper->active[i].uuid)) {
				uuid_copy(&logsuper->active[i].uuid, uuid);
				sbi->aggregate = i;
				break;
			}
		if (i == MAX_ACTIVE) {
			jfs_warn("Too many file systems sharing journal!");
			lbmFree(bpsuper);
			return -EMFILE;	/* Is there a better rc? */
		}
	} else {
		for (i = 0; i < MAX_ACTIVE; i++)
			if (uuid_equal(&logsuper->active[i].uuid, uuid)) {
				uuid_copy(&logsuper->active[i].uuid,
					  &uuid_null);
				break;
			}
		if (i == MAX_ACTIVE) {
			jfs_warn("Somebody stomped on the journal!");
			lbmFree(bpsuper);
			return -EIO;
		}

	}

	/*
	 * synchronous write log superblock:
	 *
	 * write sidestream bypassing write queue:
	 * at file system mount, log super block is updated for
	 * activation of the file system before any log record
	 * (MOUNT record) of the file system, and at file system
	 * unmount, all meta data for the file system has been
	 * flushed before log super block is updated for deactivation
	 * of the file system.
	 */
	lbmDirectWrite(log, bpsuper, lbmWRITE | lbmRELEASE | lbmSYNC);
	rc = lbmIOWait(bpsuper, lbmFREE);

	return rc;
}

/*
 *		log buffer manager (lbm)
 *		------------------------
 *
 * special purpose buffer manager supporting log i/o requirements.
 *
 * per log write queue:
 * log pageout occurs in serial order by fifo write queue and
 * restricting to a single i/o in pregress at any one time.
 * a circular singly-linked list
 * (log->wrqueue points to the tail, and buffers are linked via
 * bp->wrqueue field), and
 * maintains log page in pageout ot waiting for pageout in serial pageout.
 */

/*
 *	lbmLogInit()
 *
 * initialize per log I/O setup at lmLogInit()
 */
static int lbmLogInit(struct jfs_log * log)
{				/* log inode */
	int i;
	struct lbuf *lbuf;

	jfs_info("lbmLogInit: log:0x%p", log);

	/* initialize current buffer cursor */
	log->bp = NULL;

	/* initialize log device write queue */
	log->wqueue = NULL;

	/*
	 * Each log has its own buffer pages allocated to it.  These are
	 * not managed by the page cache.  This ensures that a transaction
	 * writing to the log does not block trying to allocate a page from
	 * the page cache (for the log).  This would be bad, since page
	 * allocation waits on the kswapd thread that may be committing inodes
	 * which would cause log activity.  Was that clear?  I'm trying to
	 * avoid deadlock here.
	 */
	init_waitqueue_head(&log->free_wait);

	log->lbuf_free = NULL;

	for (i = 0; i < LOGPAGES;) {
		char *buffer;
		uint offset;
		struct page *page = alloc_page(GFP_KERNEL | __GFP_ZERO);

		if (!page)
			goto error;
		buffer = page_address(page);
		for (offset = 0; offset < PAGE_SIZE; offset += LOGPSIZE) {
			lbuf = kmalloc_obj(struct lbuf);
			if (lbuf == NULL) {
				if (offset == 0)
					__free_page(page);
				goto error;
			}
			if (offset) /* we already have one reference */
				get_page(page);
			lbuf->l_offset = offset;
			lbuf->l_ldata = buffer + offset;
			lbuf->l_page = page;
			lbuf->l_log = log;
			init_waitqueue_head(&lbuf->l_ioevent);

			lbuf->l_freelist = log->lbuf_free;
			log->lbuf_free = lbuf;
			i++;
		}
	}

	return (0);

      error:
	lbmLogShutdown(log);
	return -ENOMEM;
}


/*
 *	lbmLogShutdown()
 *
 * finalize per log I/O setup at lmLogShutdown()
 */
static void lbmLogShutdown(struct jfs_log * log)
{
	struct lbuf *lbuf;

	jfs_info("lbmLogShutdown: log:0x%p", log);

	lbuf = log->lbuf_free;
	while (lbuf) {
		struct lbuf *next = lbuf->l_freelist;
		__free_page(lbuf->l_page);
		kfree(lbuf);
		lbuf = next;
	}
}


/*
 *	lbmAllocate()
 *
 * allocate an empty log buffer
 */
static struct lbuf *lbmAllocate(struct jfs_log * log, int pn)
{
	struct lbuf *bp;
	unsigned long flags;

	/*
	 * recycle from log buffer freelist if any
	 */
	LCACHE_LOCK(flags);
	LCACHE_SLEEP_COND(log->free_wait, (bp = log->lbuf_free), flags);
	log->lbuf_free = bp->l_freelist;
	LCACHE_UNLOCK(flags);

	bp->l_flag = 0;

	bp->l_wqnext = NULL;
	bp->l_freelist = NULL;

	bp->l_pn = pn;
	bp->l_blkno = log->base + (pn << (L2LOGPSIZE - log->l2bsize));
	bp->l_ceor = 0;

	return bp;
}


/*
 *	lbmFree()
 *
 * release a log buffer to freelist
 */
static void lbmFree(struct lbuf * bp)
{
	unsigned long flags;

	LCACHE_LOCK(flags);

	lbmfree(bp);

	LCACHE_UNLOCK(flags);
}

static void lbmfree(struct lbuf * bp)
{
	struct jfs_log *log = bp->l_log;

	assert(bp->l_wqnext == NULL);

	/*
	 * return the buffer to head of freelist
	 */
	bp->l_freelist = log->lbuf_free;
	log->lbuf_free = bp;

	wake_up(&log->free_wait);
	return;
}


/*
 * NAME:	lbmRedrive
 *
 * FUNCTION:	add a log buffer to the log redrive list
 *
 * PARAMETER:
 *	bp	- log buffer
 *
 * NOTES:
 *	Takes log_redrive_lock.
 */
static inline void lbmRedrive(struct lbuf *bp)
{
	unsigned long flags;

	spin_lock_irqsave(&log_redrive_lock, flags);
	bp->l_redrive_next = log_redrive_list;
	log_redrive_list = bp;
	spin_unlock_irqrestore(&log_redrive_lock, flags);

	wake_up_process(jfsIOthread);
}


/*
 *	lbmRead()
 */
static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp)
{
	struct bio *bio;
	struct lbuf *bp;

	/*
	 * allocate a log buffer
	 */
	*bpp = bp = lbmAllocate(log, pn);
	jfs_info("lbmRead: bp:0x%p pn:0x%x", bp, pn);

	bp->l_flag |= lbmREAD;

	bio = bio_alloc(file_bdev(log->bdev_file), 1, REQ_OP_READ, GFP_NOFS);
	bio->bi_iter.bi_sector = bp->l_blkno << (log->l2bsize - 9);
	__bio_add_page(bio, bp->l_page, LOGPSIZE, bp->l_offset);
	BUG_ON(bio->bi_iter.bi_size != LOGPSIZE);

	bio->bi_end_io = lbmIODone;
	bio->bi_private = bp;
	/*check if journaling to disk has been disabled*/
	if (log->no_integrity) {
		bio->bi_iter.bi_size = 0;
		lbmIODone(bio);
	} else {
		submit_bio(bio);
	}

	wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));

	return 0;
}


/*
 *	lbmWrite()
 *
 * buffer at head of pageout queue stays after completion of
 * partial-page pageout and redriven by explicit initiation of
 * pageout by caller until full-page pageout is completed and
 * released.
 *
 * device driver i/o done redrives pageout of new buffer at
 * head of pageout queue when current buffer at head of pageout
 * queue is released at the completion of its full-page pageout.
 *
 * LOGGC_LOCK() serializes lbmWrite() by lmNextPage() and lmGroupCommit().
 * LCACHE_LOCK() serializes xflag between lbmWrite() and lbmIODone()
 */
static void lbmWrite(struct jfs_log * log, struct lbuf * bp, int flag,
		     int cant_block)
{
	struct lbuf *tail;
	unsigned long flags;

	jfs_info("lbmWrite: bp:0x%p flag:0x%x pn:0x%x", bp, flag, bp->l_pn);

	/* map the logical block address to physical block address */
	bp->l_blkno =
	    log->base + (bp->l_pn << (L2LOGPSIZE - log->l2bsize));

	LCACHE_LOCK(flags);		/* disable+lock */

	/*
	 * initialize buffer for device driver
	 */
	bp->l_flag = flag;

	/*
	 *	insert bp at tail of write queue associated with log
	 *
	 * (request is either for bp already/currently at head of queue
	 * or new bp to be inserted at tail)
	 */
	tail = log->wqueue;

	/* is buffer not already on write queue ? */
	if (bp->l_wqnext == NULL) {
		/* insert at tail of wqueue */
		if (tail == NULL) {
			log->wqueue = bp;
			bp->l_wqnext = bp;
		} else {
			log->wqueue = bp;
			bp->l_wqnext = tail->l_wqnext;
			tail->l_wqnext = bp;
		}

		tail = bp;
	}

	/* is buffer at head of wqueue and for write ? */
	if ((bp != tail->l_wqnext) || !(flag & lbmWRITE)) {
		LCACHE_UNLOCK(flags);	/* unlock+enable */
		return;
	}

	LCACHE_UNLOCK(flags);	/* unlock+enable */

	if (cant_block)
		lbmRedrive(bp);
	else if (flag & lbmSYNC)
		lbmStartIO(bp);
	else {
		LOGGC_UNLOCK(log);
		lbmStartIO(bp);
		LOGGC_LOCK(log);
	}
}


/*
 *	lbmDirectWrite()
 *
 * initiate pageout bypassing write queue for sidestream
 * (e.g., log superblock) write;
 */
static void lbmDirectWrite(struct jfs_log * log, struct lbuf * bp, int flag)
{
	jfs_info("lbmDirectWrite: bp:0x%p flag:0x%x pn:0x%x",
		 bp, flag, bp->l_pn);

	/*
	 * initialize buffer for device driver
	 */
	bp->l_flag = flag | lbmDIRECT;

	/* map the logical block address to physical block address */
	bp->l_blkno =
	    log->base + (bp->l_pn << (L2LOGPSIZE - log->l2bsize));

	/*
	 *	initiate pageout of the page
	 */
	lbmStartIO(bp);
}


/*
 * NAME:	lbmStartIO()
 *
 * FUNCTION:	Interface to DD strategy routine
 *
 * RETURN:	none
 *
 * serialization: LCACHE_LOCK() is NOT held during log i/o;
 */
static void lbmStartIO(struct lbuf * bp)
{
	struct bio *bio;
	struct jfs_log *log = bp->l_log;
	struct block_device *bdev = NULL;

	jfs_info("lbmStartIO");

	if (!log->no_integrity)
		bdev = file_bdev(log->bdev_file);

	bio = bio_alloc(bdev, 1, REQ_OP_WRITE | REQ_SYNC,
			GFP_NOFS);
	bio->bi_iter.bi_sector = bp->l_blkno << (log->l2bsize - 9);
	__bio_add_page(bio, bp->l_page, LOGPSIZE, bp->l_offset);
	BUG_ON(bio->bi_iter.bi_size != LOGPSIZE);

	bio->bi_end_io = lbmIODone;
	bio->bi_private = bp;

	/* check if journaling to disk has been disabled */
	if (log->no_integrity) {
		bio->bi_iter.bi_size = 0;
		lbmIODone(bio);
	} else {
		submit_bio(bio);
		INCREMENT(lmStat.submitted);
	}
}


/*
 *	lbmIOWait()
 */
static int lbmIOWait(struct lbuf * bp, int flag)
{
	unsigned long flags;
	int rc = 0;

	jfs_info("lbmIOWait1: bp:0x%p flag:0x%x:0x%x", bp, bp->l_flag, flag);

	LCACHE_LOCK(flags);		/* disable+lock */

	LCACHE_SLEEP_COND(bp->l_ioevent, (bp->l_flag & lbmDONE), flags);

	rc = (bp->l_flag & lbmERROR) ? -EIO : 0;

	if (flag & lbmFREE)
		lbmfree(bp);

	LCACHE_UNLOCK(flags);	/* unlock+enable */

	jfs_info("lbmIOWait2: bp:0x%p flag:0x%x:0x%x", bp, bp->l_flag, flag);
	return rc;
}

/*
 *	lbmIODone()
 *
 * executed at INTIODONE level
 */
static void lbmIODone(struct bio *bio)
{
	struct lbuf *bp = bio->bi_private;
	struct lbuf *nextbp, *tail;
	struct jfs_log *log;
	unsigned long flags;

	/*
	 * get back jfs buffer bound to the i/o buffer
	 */
	jfs_info("lbmIODone: bp:0x%p flag:0x%x", bp, bp->l_flag);

	LCACHE_LOCK(flags);		/* disable+lock */

	if (bio->bi_status) {
		bp->l_flag |= lbmERROR;

		jfs_err("lbmIODone: I/O error in JFS log");
	}

	bio_put(bio);

	/*
	 *	pagein completion
	 */
	if (bp->l_flag & lbmREAD) {
		bp->l_flag &= ~lbmREAD;

		/* wakeup I/O initiator */
		LCACHE_WAKEUP(&bp->l_ioevent);

		goto out;
	}

	/*
	 *	pageout completion
	 *
	 * the bp at the head of write queue has completed pageout.
	 *
	 * if single-commit/full-page pageout, remove the current buffer
	 * from head of pageout queue, and redrive pageout with
	 * the new buffer at head of pageout queue;
	 * otherwise, the partial-page pageout buffer stays at
	 * the head of pageout queue to be redriven for pageout
	 * by lmGroupCommit() until full-page pageout is completed.
	 */
	bp->l_flag &= ~lbmWRITE;
	INCREMENT(lmStat.pagedone);

	/* update committed lsn */
	log = bp->l_log;
	log->clsn = (bp->l_pn << L2LOGPSIZE) + bp->l_ceor;

	if (bp->l_flag & lbmDIRECT) {
		LCACHE_WAKEUP(&bp->l_ioevent);
		goto out;
	}

	tail = log->wqueue;

	/* single element queue */
	if (bp == tail) {
		/* remove head buffer of full-page pageout
		 * from log device write queue
		 */
		if (bp->l_flag & lbmRELEASE) {
			log->wqueue = NULL;
			bp->l_wqnext = NULL;
		}
	}
	/* multi element queue */
	else {
		/* remove head buffer of full-page pageout
		 * from log device write queue
		 */
		if (bp->l_flag & lbmRELEASE) {
			nextbp = tail->l_wqnext = bp->l_wqnext;
			bp->l_wqnext = NULL;

			/*
			 * redrive pageout of next page at head of write queue:
			 * redrive next page without any bound tblk
			 * (i.e., page w/o any COMMIT records), or
			 * first page of new group commit which has been
			 * queued after current page (subsequent pageout
			 * is performed synchronously, except page without
			 * any COMMITs) by lmGroupCommit() as indicated
			 * by lbmWRITE flag;
			 */
			if (nextbp->l_flag & lbmWRITE) {
				/*
				 * We can't do the I/O at interrupt time.
				 * The jfsIO thread can do it
				 */
				lbmRedrive(nextbp);
			}
		}
	}

	/*
	 *	synchronous pageout:
	 *
	 * buffer has not necessarily been removed from write queue
	 * (e.g., synchronous write of partial-page with COMMIT):
	 * leave buffer for i/o initiator to dispose
	 */
	if (bp->l_flag & lbmSYNC) {
		/* wakeup I/O initiator */
		LCACHE_WAKEUP(&bp->l_ioevent);
	}

	/*
	 *	Group Commit pageout:
	 */
	else if (bp->l_flag & lbmGC) {
		LCACHE_UNLOCK(flags);
		lmPostGC(bp);
		LCACHE_LOCK(flags);		/* disable+lock */
	}

	/*
	 *	asynchronous pageout:
	 *
	 * buffer must have been removed from write queue:
	 * insert buffer at head of freelist where it can be recycled
	 */
	else {
		assert(bp->l_flag & lbmRELEASE);
		assert(bp->l_flag & lbmFREE);
		lbmfree(bp);
	}

out:
	bp->l_flag |= lbmDONE;
	LCACHE_UNLOCK(flags);
}

int jfsIOWait(void *arg)
{
	struct lbuf *bp;

	set_freezable();
	do {
		spin_lock_irq(&log_redrive_lock);
		while ((bp = log_redrive_list)) {
			log_redrive_list = bp->l_redrive_next;
			bp->l_redrive_next = NULL;
			spin_unlock_irq(&log_redrive_lock);
			lbmStartIO(bp);
			spin_lock_irq(&log_redrive_lock);
		}

		if (freezing(current)) {
			spin_unlock_irq(&log_redrive_lock);
			try_to_freeze();
		} else {
			set_current_state(TASK_INTERRUPTIBLE);
			spin_unlock_irq(&log_redrive_lock);
			schedule();
		}
	} while (!kthread_should_stop());

	jfs_info("jfsIOWait being killed!");
	return 0;
}

/*
 * NAME:	lmLogFormat()/jfs_logform()
 *
 * FUNCTION:	format file system log
 *
 * PARAMETERS:
 *	log	- volume log
 *	logAddress - start address of log space in FS block
 *	logSize	- length of log space in FS block;
 *
 * RETURN:	0	- success
 *		-EIO	- i/o error
 *
 * XXX: We're synchronously writing one page at a time.  This needs to
 *	be improved by writing multiple pages at once.
 */
int lmLogFormat(struct jfs_log *log, s64 logAddress, int logSize)
{
	int rc = -EIO;
	struct jfs_sb_info *sbi;
	struct logsuper *logsuper;
	struct logpage *lp;
	int lspn;		/* log sequence page number */
	struct lrd *lrd_ptr;
	int npages = 0;
	struct lbuf *bp;

	jfs_info("lmLogFormat: logAddress:%Ld logSize:%d",
		 (long long)logAddress, logSize);

	sbi = list_entry(log->sb_list.next, struct jfs_sb_info, log_list);

	/* allocate a log buffer */
	bp = lbmAllocate(log, 1);

	npages = logSize >> sbi->l2nbperpage;

	/*
	 *	log space:
	 *
	 * page 0 - reserved;
	 * page 1 - log superblock;
	 * page 2 - log data page: A SYNC log record is written
	 *	    into this page at logform time;
	 * pages 3-N - log data page: set to empty log data pages;
	 */
	/*
	 *	init log superblock: log page 1
	 */
	logsuper = (struct logsuper *) bp->l_ldata;

	logsuper->magic = cpu_to_le32(LOGMAGIC);
	logsuper->version = cpu_to_le32(LOGVERSION);
	logsuper->state = cpu_to_le32(LOGREDONE);
	logsuper->flag = cpu_to_le32(sbi->mntflag);	/* ? */
	logsuper->size = cpu_to_le32(npages);
	logsuper->bsize = cpu_to_le32(sbi->bsize);
	logsuper->l2bsize = cpu_to_le32(sbi->l2bsize);
	logsuper->end = cpu_to_le32(2 * LOGPSIZE + LOGPHDRSIZE + LOGRDSIZE);

	bp->l_flag = lbmWRITE | lbmSYNC | lbmDIRECT;
	bp->l_blkno = logAddress + sbi->nbperpage;
	lbmStartIO(bp);
	if ((rc = lbmIOWait(bp, 0)))
		goto exit;

	/*
	 *	init pages 2 to npages-1 as log data pages:
	 *
	 * log page sequence number (lpsn) initialization:
	 *
	 * pn:   0     1     2     3                 n-1
	 *       +-----+-----+=====+=====+===.....===+=====+
	 * lspn:             N-1   0     1           N-2
	 *                   <--- N page circular file ---->
	 *
	 * the N (= npages-2) data pages of the log is maintained as
	 * a circular file for the log records;
	 * lpsn grows by 1 monotonically as each log page is written
	 * to the circular file of the log;
	 * and setLogpage() will not reset the page number even if
	 * the eor is equal to LOGPHDRSIZE. In order for binary search
	 * still work in find log end process, we have to simulate the
	 * log wrap situation at the log format time.
	 * The 1st log page written will have the highest lpsn. Then
	 * the succeeding log pages will have ascending order of
	 * the lspn starting from 0, ... (N-2)
	 */
	lp = (struct logpage *) bp->l_ldata;
	/*
	 * initialize 1st log page to be written: lpsn = N - 1,
	 * write a SYNCPT log record is written to this page
	 */
	lp->h.page = lp->t.page = cpu_to_le32(npages - 3);
	lp->h.eor = lp->t.eor = cpu_to_le16(LOGPHDRSIZE + LOGRDSIZE);

	lrd_ptr = (struct lrd *) &lp->data;
	lrd_ptr->logtid = 0;
	lrd_ptr->backchain = 0;
	lrd_ptr->type = cpu_to_le16(LOG_SYNCPT);
	lrd_ptr->length = 0;
	lrd_ptr->log.syncpt.sync = 0;

	bp->l_blkno += sbi->nbperpage;
	bp->l_flag = lbmWRITE | lbmSYNC | lbmDIRECT;
	lbmStartIO(bp);
	if ((rc = lbmIOWait(bp, 0)))
		goto exit;

	/*
	 *	initialize succeeding log pages: lpsn = 0, 1, ..., (N-2)
	 */
	for (lspn = 0; lspn < npages - 3; lspn++) {
		lp->h.page = lp->t.page = cpu_to_le32(lspn);
		lp->h.eor = lp->t.eor = cpu_to_le16(LOGPHDRSIZE);

		bp->l_blkno += sbi->nbperpage;
		bp->l_flag = lbmWRITE | lbmSYNC | lbmDIRECT;
		lbmStartIO(bp);
		if ((rc = lbmIOWait(bp, 0)))
			goto exit;
	}

	rc = 0;
exit:
	/*
	 *	finalize log
	 */
	/* release the buffer */
	lbmFree(bp);

	return rc;
}

#ifdef CONFIG_JFS_STATISTICS
int jfs_lmstats_proc_show(struct seq_file *m, void *v)
{
	seq_printf(m,
		       "JFS Logmgr stats\n"
		       "================\n"
		       "commits = %d\n"
		       "writes submitted = %d\n"
		       "writes completed = %d\n"
		       "full pages submitted = %d\n"
		       "partial pages submitted = %d\n",
		       lmStat.commit,
		       lmStat.submitted,
		       lmStat.pagedone,
		       lmStat.full_page,
		       lmStat.partial_page);
	return 0;
}
#endif /* CONFIG_JFS_STATISTICS */
]

gemini-3.1-pro-preview

							input: 145530
							output: 46
							thoughts: 4374
						

**Race Condition Identified in JFS LCACHE Shutdown Path**

Okay, here's the breakdown of what I've found, walking through the logic step-by-step to expose a potential use-after-free vulnerability:

I'm starting by looking at `lbmIOWait` which checks the `lbmDONE` flag, and I see it may free the buffer. Meanwhile, `lbmIODone` sets the `lbmDONE` flag and unlocks the lock, it looks like `lbmIODone` calls `LCACHE_WAKEUP` to wake up the process. The sleeping condition in `LCACHE_SLEEP_COND`, in `lbmIOWait`, confirms the wakeup logic.

`lbmIODone` calls `LCACHE_WAKEUP` before setting `lbmDONE`. The woken-up process will then try to reacquire the lock, which ensures that it doesn't proceed until `lbmIODone` is done. Now, `lbmIODone` is holding the lock at this point, until it's unlocked, and `bp->l_flag` has lbmDONE. That means `lbmIOWait` acquires the lock, the condition is true, and it can break out and do its stuff.

`lbmLogShutdown` calls `lbmLogShutdown`, and that frees `bp` with `kfree`. But, here I am looking for the use-after-free, where would it be? In `lbmIODone`, that sets `lbmDONE` and unlocks the lock, signaling that it is done. That is when the issue starts to appear.

Looking at `lbmIODone` again: if it's a READ, it calls `LCACHE_WAKEUP` and `goto out`. I'm starting to get to the core problem here: `wait_event` in `lbmRead` doesn't acquire a lock! It checks the condition without any locks, and the condition becomes true IMMEDIATELY after `lbmIODone` clears `lbmREAD`. Therefore `wait_event` wakes up and returns. Here is the race. The timing is so important. `wait_event` wakes up, checks the condition (which is true), and returns, and `lbmIODone` is still executing.

Specifically, the `wait_event` wakes up because `LCACHE_WAKEUP` is called *before* `bp->l_flag |= lbmDONE;` and *before* `LCACHE_UNLOCK(flags);`. `wait_event` gets woken up, checks `bp->l_flag != lbmREAD` (which is true now that it's cleared), and returns. And then `lbmRead` returns. And `lmLogShutdown` calls `lbmDirectWrite` on `bpsuper`, the same `bp` that was just read, and calls `lbmIOWait`.

It's clear now, `lbmDirectWrite` gets called, and now things start to break.

`lbmDirectWrite` calls `lbmStartIO(bp)` which submits a NEW bio, and then `lbmIOWait` waits for `lbmDONE`. But `lbmIODone` for the READ bio is still running at `goto out;`! It has to set `bp->l_flag |= lbmDONE;` and `LCACHE_UNLOCK(flags);`. If `lbmDirectWrite` has already been called and overwritten `bp->l_flag`, the bits have been overwritten! The READ bio's `lbmIODone` does `bp->l_flag |= lbmDONE;`. Now the `lbmDONE` flag is set! And because `lbmIOWait` waits for `bp->l_flag & lbmDONE`, it assumes the WRITE bio has completed, and returns, calling `lbmfree(bp)`.

So, `lbmIOWait` is returning early, and calls `lbmfree(bp)`, and `lmLogShutdown` calls `lbmLogShutdown` that calls `kfree(bp)`. But the WRITE bio is still in flight! The issue is when the WRITE bio completes, the interrupt handler calls `lbmIODone` for that bio. But `bp` has already been freed, and `lbmIODone` accesses `bp->l_flag`.

This is the sequence of events. The `lbmRead` allocates `bp`, and `lbmIODone` executes the clearing of `lbmREAD`, which causes an early return, and overwrites the `bp->l_flag`. The core of the problem is in `lbmIODone`. Let's confirm that `wait_event` really doesn't take the lock, and yes, it's just

requested entity does not exist

map[ContextFile:fs/jfs/jfs_logmgr.c IncludeLines:true Name:__SLEEP_COND]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 150996
							output: 45
							thoughts: 26
						

Okay, here's my attempt at summarizing that thought process, tailored for an expert audience:

**Investigating a Sleep Condition in JFS Locking**

Alright, time to dive in. My immediate thought is to track down the definition of `__SLEEP_COND`. It's a pretty strong indicator we're dealing with some kind of sleep condition in the JFS file system's locking mechanisms. Given my experience, I'm betting this is a crucial piece of the puzzle for understanding how the system handles contention and synchronization. My first stop, of course, is the JFS source tree. I know that `fs/jfs/` is where the core JFS implementation lives, and based on the likely scenario, `jfs_locks.h` is the prime location for these sorts of definitions. That header file is the most likely spot where this specific sleep condition is documented or, at the least, declared. I'll get that open and start my search. It could be an enum, a macro, or a bitfield. Let's see what we find.

requested entity does not exist

map[ContextFile:fs/jfs/jfs_locks.h IncludeLines:true Name:__SLEEP_COND]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 151313
							output: 21
							thoughts: 12
						

Here's my take on those thoughts:

**Analyzing Code for Sleep Conditions**

Okay, so I'm thinking, let's dive into this code. Specifically, I need to understand how the system handles sleep states. My gut feeling is that I'm going to find the relevant logic by searching for a specific macro, something like `__SLEEP_COND`. That's a pretty common naming convention, and it's a good starting point for locating conditional code related to sleep management. It's a quick and dirty way to get my bearings and see where this specific system is implementing its sleep conditions. Let's see what we can find. I expect this will be a good entry point to understand how sleep is controlled within the system.

map[Expression:#define __SLEEP_COND]

map[Output:fs/jfs/jfs_lock.h-21- */
fs/jfs/jfs_lock.h:22:#define __SLEEP_COND(wq, cond, lock_cmd, unlock_cmd)	\
fs/jfs/jfs_lock.h-23-do {							\
]

gemini-3.1-pro-preview

							input: 151588
							output: 22
							thoughts: 25
						

Okay, let's dive into this. I'm going to take a look at the code, specifically the `fs/jfs/jfs_lock.h` file and focus on lines 22 through 35. I want to see what kind of locking mechanisms are defined or mentioned there. Given my expertise in filesystems, I'm expecting to see data structures related to mutexes, spinlocks, reader-writer locks, or some other form of concurrency control. I'm probably looking for the declarations of lock structures, macros for lock acquisition and release, or maybe even some comments describing their intended use within the JFS context. Understanding how JFS handles concurrency is crucial for performance and data integrity, so I'll be paying close attention to the specific types of locks used and how they're intended to be used. Hopefully, these lines will give me a clear picture of the locking strategy at play.

map[Expression:#define __SLEEP_COND.*]

map[Output:fs/jfs/jfs_lock.h-21- */
fs/jfs/jfs_lock.h:22:#define __SLEEP_COND(wq, cond, lock_cmd, unlock_cmd)	\
fs/jfs/jfs_lock.h-23-do {							\
]

gemini-3.1-pro-preview

							input: 151912
							output: 26
							thoughts: 19
						

Here's my take on the `fs/jfs/jfs_lock.h` file:

**Diving into the JFS Lock Header**

Alright, let's crack open this `jfs_lock.h` file. It's obviously central to the JFS journaling file system's locking mechanisms. Given my experience, I'm expecting to see the core structures that manage concurrency control within JFS. I'm looking for the definitions of things like mutexes, spinlocks, read-write locks, or perhaps more sophisticated lock implementations tailored to the specific needs of a journaling filesystem.

I anticipate it to detail how JFS ensures data integrity and consistency during both normal operations and, critically, during recovery scenarios. I’ll be paying close attention to any fine-grained locking strategies, as well as the larger scope locking, because this will allow me to understand the potential performance bottlenecks that might exist when accessing JFS. I'm keen to spot details that are different from other filesystems. The interplay between various locks—for inode operations, block allocation, journaling operations—should be crucial. I'll be looking for how they achieve deadlock prevention, and where they leverage things like lock hierarchies to simplify things. Finally, I'll be on the lookout for any clever tricks or optimizations they've implemented to minimize contention and maximize throughput. This will be where the magic, or the headaches, of JFS resides.

map[File:fs/jfs/jfs_lock.h]

map[Contents:/* SPDX-License-Identifier: GPL-2.0-or-later */
/*
 *   Copyright (C) International Business Machines Corp., 2000-2001
 *   Portions Copyright (C) Christoph Hellwig, 2001-2002
 */
#ifndef _H_JFS_LOCK
#define _H_JFS_LOCK

#include <linux/spinlock.h>
#include <linux/mutex.h>
#include <linux/sched.h>

/*
 *	jfs_lock.h
 */

/*
 * Conditional sleep where condition is protected by spinlock
 *
 * lock_cmd and unlock_cmd take and release the spinlock
 */
#define __SLEEP_COND(wq, cond, lock_cmd, unlock_cmd)	\
do {							\
	DECLARE_WAITQUEUE(__wait, current);		\
							\
	add_wait_queue(&wq, &__wait);			\
	for (;;) {					\
		set_current_state(TASK_UNINTERRUPTIBLE);\
		if (cond)				\
			break;				\
		unlock_cmd;				\
		io_schedule();				\
		lock_cmd;				\
	}						\
	__set_current_state(TASK_RUNNING);			\
	remove_wait_queue(&wq, &__wait);		\
} while (0)

#endif				/* _H_JFS_LOCK */
]

gemini-3.1-pro-preview

							input: 152605
							output: 21
							thoughts: 2300
						

**Analysis of a Race Condition in the JFS Log Buffer Management**

Okay, let's break this down. My initial thought process zeroes in on a potential race condition related to how the log buffer is managed, specifically focusing on the interaction between `lbmRead`, `lbmIODone`, and the locking mechanisms. I'm seeing that `__SLEEP_COND` is at the core of the issue with `lbmIOWait`. The way that `cond` is evaluated _inside_ the locked region is crucial for the DIRECT case, but `lbmRead` uses `wait_event`, which is immediately raising flags! I see that, with `wait_event`, the check `bp->l_flag != lbmREAD` is happening without any locking. That's immediately ringing alarm bells.

The key insight is the timing: `lbmIODone` is clearing `lbmREAD` and waking up the waiter *before* it sets `lbmDONE` and releases the lock. The code flow shows that a `lbmDirectWrite` can overwrite `bp->l_flag` while `lbmIODone` is still doing its thing. It's essentially interleaving a buffer's operations between a read and a write, which is creating the race. If `lbmDirectWrite` sets a new flag that includes `lbmDIRECT` after `lbmIODone` clears `lbmREAD` but before it sets `lbmDONE`, the subsequent `lbmIOWait` might complete before the write finishes. Which can result in a write to an invalid address!

The proposed fix, putting `bp->l_flag |= lbmDONE;` before `LCACHE_WAKEUP(&bp->l_ioevent);` seems spot-on. It would synchronize the states, preventing `lbmDirectWrite` from stomping on the flag before it is stable. Because it will ensure the read has completed, and the flag has been set before moving on to the `lbmIOWait`. I've double checked that the other `LCACHE_WAKEUP` calls are not at risk, because those use the locking.

The exploration of why `lbmRead` uses `wait_event` instead of `lbmIOWait` is interesting. It makes me question the design choices. I realize it's returning 0 unconditionally. But using `lbmIOWait` (and checking for `lbmERROR`) is actually a more robust way to handle this. It will allow errors to propagate properly. So it's not only a bug fix, but also a code improvement!

map[Name:lbmRead]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:lmLogFileSystem SourceFile:fs/jfs/jfs_logmgr.c SourceLine:1716] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:lmLogInit SourceFile:fs/jfs/jfs_logmgr.c SourceLine:1287] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:lmLogInit SourceFile:fs/jfs/jfs_logmgr.c SourceLine:1332] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:lmLogShutdown SourceFile:fs/jfs/jfs_logmgr.c SourceLine:1665]] TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 155711
							output: 42
							thoughts: 1710
						

**Analyzing and Refactoring `lbmRead` in the JFS Log Manager**

Okay, let's dive into this `lbmRead` function. Looking at line 1287, I see the check for `lbmRead` and potential error handling via `goto errout10`. My initial thought is that the existing error handling should be sufficient for `-EIO`. However, I have a concern about how `lbmIOWait` might interact with the `lbmDONE` flag. I remember that `lbmIOWait` uses `LCACHE_SLEEP_COND`, and this doesn't clear `lbmDONE`. It just returns an error code based on `lbmERROR`.

I need to confirm if `bp->l_flag` still contains `lbmDONE` after `lbmIOWait`. If it does, and if `lbmDirectWrite` then overwrites `bp->l_flag` (which it appears to with the `=` assignment, thereby clearing `lbmDONE`), then we should be fine, and any races are eliminated. The `lbmStartIO` and `lbmIOWait` sequence looks safe. However, I have a nagging feeling. I have to verify if there's a race with `lbmIODone`, if it still exists.

Let's trace: if `lbmRead` uses `lbmIOWait`, the code will wait for `bp->l_flag & lbmDONE`. The `LCACHE_SLEEP_COND` will acquire the `LCACHE_LOCK` before checking. Now, I have to consider `lbmIODone`. `lbmIODone` *also* holds `LCACHE_LOCK` when it calls `LCACHE_WAKEUP`. Therefore, `lbmIOWait` will block on `LCACHE_LOCK` until `lbmIODone` unlocks it, and *then* the lock will be acquired, by which point `lbmIODone` has already set `bp->l_flag |= lbmDONE;`. So `lbmIOWait` acquires the lock, sees the `lbmDONE` flag, and can return correctly. The rest of the sequence is fine: `lbmDirectWrite` clears `lbmDONE`, and then a subsequent `lbmIOWait` will block as expected. Race eliminated!

Now I'm questioning why the original author used `wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));` instead of `lbmIOWait(bp, 0)`. I can only guess that perhaps `lbmIOWait` was added later, or there was a particular reason for using this custom wait function. However, the existing implementation is suboptimal, so I'm thinking if we replace `wait_event` with `lbmIOWait(bp, 0)`, we should not only fix the race but also handle I/O errors correctly. The question now is if we can make the change.

I'm looking at the `lbmRead` code now. If I substitute `wait_event` with `lbmIOWait(bp, 0)`, then `lbmIOWait` *already* returns the error code: `(bp->l_flag & lbmERROR) ? -EIO : 0;`. This means the simple change: `return lbmIOWait(bp, 0);` should suffice! I just need to make sure that the `lbmIOWait` function is visible, so I'm checking that it's defined.

I've confirmed that `lbmIOWait` is defined and there is a forward declaration. So, yes, we *can* call `lbmIOWait(bp, 0)`! Now, the only remaining thing is to check if `lbmIODone` sets the `lbmDONE` flag for reads. If it doesn't, we are back to square one.

I'm checking `lbmIODone`'s code. Here we go: It *does* set `lbmDONE` at the `out:` label after handling `lbmREAD`. Therefore, `lbmIOWait` will wait for the correct condition. So, the refactor should work. I've re-examined the code, and there's no obvious reason to avoid this change. Let's look at the history of `lbmRead` for any surprises.

map[Count:10 SourcePath:fs/jfs/jfs_logmgr.c SymbolName:lbmRead]

map[Output:1da177e4c3f4 Linux-2.6.12-rc2
]

gemini-3.1-pro-preview

							input: 158458
							output: 22
							thoughts: 260
						

**Analyzing the Synchronous `lbmIODone` Scenario**

Okay, so I'm thinking about this `lbmRead` function and how it interacts with `lbmIOWait`. This is something that has been an issue since the very beginning of the Git project, or at least it seems that way sometimes. If we change `lbmRead` to use `lbmIOWait`, there's a specific scenario that needs careful consideration: what if `lbmIODone` is called synchronously? I'm picturing the code block where if `log->no_integrity` is true, then `lbmIODone` is executed right away.

In that synchronous case, `lbmIODone` acquires the `LCACHE_LOCK`, clears the `lbmREAD` flag, calls `LCACHE_WAKEUP`, sets the `lbmDONE` flag, and then unlocks the `LCACHE_LOCK`. Next, `lbmRead` calls `lbmIOWait(bp, 0)`. `lbmIOWait`, of course, then acquires the same `LCACHE_LOCK`. It then checks `bp->l_flag & lbmDONE`, which, because of the synchronous nature of `lbmIODone`, will be true! So it won't sleep, it unlocks the `LCACHE_LOCK`, and it returns 0.

Wait a second… that all works perfectly! Everything aligns, and there is no race condition in this scenario.

I need to confirm that there's no other situation where `wait_event` is used for the `lbuf`. I'll run a quick grep to make sure there are no unexpected uses of that.

map[Expression:wait_event.*l_ioevent]

map[Output:fs/jfs/jfs_logmgr.c=1959=static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp)
--
fs/jfs/jfs_logmgr.c-1986-
fs/jfs/jfs_logmgr.c:1987:	wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));
fs/jfs/jfs_logmgr.c-1988-
]

gemini-3.1-pro-preview

							input: 159236
							output: 44
							thoughts: 1961
						

**Okay, let's break this down.** My initial thought was to scrutinize the `lbmRead` function. The code seemed suspicious, and I had a hunch that `lbmIOWait` might be the better approach to handling I/O completion. I wanted to verify whether `lbmIOWait` clears the `lbmDONE` flag, but then realized it does not need to, as the flag is always reset when a buffer is reused. This suggested a straightforward fix: replace the wait in `lbmRead` with a call to `lbmIOWait`.

My next step was to analyze the potential side effects of this change. Specifically, I considered error handling. Would returning an `-EIO` from `lbmRead` break anything? The code shows `lmLogInit`, `lmLogShutdown`, and `lmLogFileSystem` call `lbmRead`, and they all handle a potential `-EIO` error correctly by unwinding and/or returning the error. So, returning `-EIO` in this instance would be the right thing to do!

Now, the main concern I have is, does the context in which `lbmRead` is called allow `lbmIOWait` to sleep? Since `lbmRead` is called from process contexts like `lmLogInit` and friends, which can sleep, the use of `LCACHE_SLEEP_COND`, which in turn calls `io_schedule()`, within `lbmIOWait` should be perfectly acceptable.

Finally, I began digging deeper, to see if there were any other locations in the code where the setting of `lbmDONE` could be problematic. I examined `lbmIODone`, looking at different scenarios based on the buffer's flags (`lbmDIRECT`, `lbmSYNC`, and `lbmGC`). The first two paths looked fine, but then I encountered a potential hazard in the `lbmGC` path, where there's a lock release/acquire around the call to `lmPostGC`.

My mind started racing. Could `lmPostGC` free the buffer? And if so, what happens in `lbmIODone` after that? I reviewed `lmPostGC` and saw that under certain conditions (`tblkGC_FREE` or `tblkGC_EOP`), `lbmFree` is indeed called. This means the buffer is put onto the free list, and then `lbmIODone` is executed *after* the buffer is freed. Even if the buffer is on the free list, `lbmIODone` still tries to set `lbmDONE` on it! What a mess. 

Then I thought, even if the buffer is on the free list, does that mean a different thread can allocate it via `lbmAllocate`? And if so, what happens when we set `bp->l_flag |= lbmDONE;`?
This could potentially corrupt the flag of the buffer if it is reallocated! This requires immediate attention!

map[ContextFile:fs/jfs/jfs_logmgr.c IncludeLines:true Name:lmPostGC]

map[SourceCode: 788:	/*
 789:	 * NAME:	lmPostGC()
 790:	 *
 791:	 * FUNCTION:	group commit post-processing
 792:	 *	Processes transactions after their commit records have been written
 793:	 *	to disk, redriving log I/O if necessary.
 794:	 *
 795:	 * RETURN:	None
 796:	 *
 797:	 * NOTE:
 798:	 *	This routine is called a interrupt time by lbmIODone
 799:	 */
 800:	static void lmPostGC(struct lbuf * bp)
 801:	{
 802:		unsigned long flags;
 803:		struct jfs_log *log = bp->l_log;
 804:		struct logpage *lp;
 805:		struct tblock *tblk, *temp;
 806:	
 807:		//LOGGC_LOCK(log);
 808:		spin_lock_irqsave(&log->gclock, flags);
 809:		/*
 810:		 * current pageout of group commit completed.
 811:		 *
 812:		 * remove/wakeup transactions from commit queue who were
 813:		 * group committed with the current log page
 814:		 */
 815:		list_for_each_entry_safe(tblk, temp, &log->cqueue, cqueue) {
 816:			if (!(tblk->flag & tblkGC_COMMIT))
 817:				break;
 818:			/* if transaction was marked GC_COMMIT then
 819:			 * it has been shipped in the current pageout
 820:			 * and made it to disk - it is committed.
 821:			 */
 822:	
 823:			if (bp->l_flag & lbmERROR)
 824:				tblk->flag |= tblkGC_ERROR;
 825:	
 826:			/* remove it from the commit queue */
 827:			list_del(&tblk->cqueue);
 828:			tblk->flag &= ~tblkGC_QUEUE;
 829:	
 830:			if (tblk == log->flush_tblk) {
 831:				/* we can stop flushing the log now */
 832:				clear_bit(log_FLUSH, &log->flag);
 833:				log->flush_tblk = NULL;
 834:			}
 835:	
 836:			jfs_info("lmPostGC: tblk = 0x%p, flag = 0x%x", tblk,
 837:				 tblk->flag);
 838:	
 839:			if (!(tblk->xflag & COMMIT_FORCE))
 840:				/*
 841:				 * Hand tblk over to lazy commit thread
 842:				 */
 843:				txLazyUnlock(tblk);
 844:			else {
 845:				/* state transition: COMMIT -> COMMITTED */
 846:				tblk->flag |= tblkGC_COMMITTED;
 847:	
 848:				if (tblk->flag & tblkGC_READY)
 849:					log->gcrtc--;
 850:	
 851:				LOGGC_WAKEUP(tblk);
 852:			}
 853:	
 854:			/* was page full before pageout ?
 855:			 * (and this is the last tblk bound with the page)
 856:			 */
 857:			if (tblk->flag & tblkGC_FREE)
 858:				lbmFree(bp);
 859:			/* did page become full after pageout ?
 860:			 * (and this is the last tblk bound with the page)
 861:			 */
 862:			else if (tblk->flag & tblkGC_EOP) {
 863:				/* finalize the page */
 864:				lp = (struct logpage *) bp->l_ldata;
 865:				bp->l_ceor = bp->l_eor;
 866:				lp->h.eor = lp->t.eor = cpu_to_le16(bp->l_eor);
 867:				jfs_info("lmPostGC: calling lbmWrite");
 868:				lbmWrite(log, bp, lbmWRITE | lbmRELEASE | lbmFREE,
 869:					 1);
 870:			}
 871:	
 872:		}
 873:	
 874:		/* are there any transactions who have entered lnGroupCommit()
 875:		 * (whose COMMITs are after that of the last log page written.
 876:		 * They are waiting for new group commit (above at (SLEEP 1))
 877:		 * or lazy transactions are on a full (queued) log page,
 878:		 * select the latest ready transaction as new group leader and
 879:		 * wake her up to lead her group.
 880:		 */
 881:		if ((!list_empty(&log->cqueue)) &&
 882:		    ((log->gcrtc > 0) || (tblk->bp->l_wqnext != NULL) ||
 883:		     test_bit(log_FLUSH, &log->flag) || jfs_tlocks_low))
 884:			/*
 885:			 * Call lmGCwrite with new group leader
 886:			 */
 887:			lmGCwrite(log, 1);
 888:	
 889:		/* no transaction are ready yet (transactions are only just
 890:		 * queued (GC_QUEUE) and not entered for group commit yet).
 891:		 * the first transaction entering group commit
 892:		 * will elect herself as new group leader.
 893:		 */
 894:		else
 895:			log->cflag &= ~logGC_PAGEOUT;
 896:	
 897:		//LOGGC_UNLOCK(log);
 898:		spin_unlock_irqrestore(&log->gclock, flags);
 899:		return;
 900:	}
 SourceFile:fs/jfs/jfs_logmgr.c]

gemini-3.1-pro-preview

							input: 163582
							output: 43
							thoughts: 7676
						

**Analysis of a Race Condition in JFS Logging**

Okay, so I've been digging into this JFS logging code, and I think I've found a pretty nasty race condition. It seems to stem from how `lbmRead` interacts with `lbmIODone`. The key issue is `lbmRead` uses a `wait_event` condition that's not properly synchronized with what's happening in `lbmIODone`.

Here's the breakdown: `lbmRead` submits a read request and then waits using `wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD))`. `lbmIODone`, when the read completes, clears the `lbmREAD` flag, wakes up the waiter with `LCACHE_WAKEUP`, and sets `lbmDONE` at the end. The problem is that the `LCACHE_WAKEUP` call *before* setting the `lbmDONE` flag in `lbmIODone` creates a race. The `wait_event` in `lbmRead` can return prematurely because the condition `bp->l_flag != lbmREAD` is satisfied before `lbmIODone` actually finishes its work.

The critical issue is that `lbmRead` *returns* early, without waiting for the `lbmDONE` flag. This allows subsequent code, like during a log shutdown, to reuse the same buffer (`bp`). Specifically, `lmLogShutdown` calls `lbmDirectWrite`, which reuses the same buffer for a write operation (e.g. `bpsuper`). When this `lbmDirectWrite` is done, it will have a different value of `bp->l_flag` than the read operation, overwriting the DONE value. `lbmIODone` is called on the old buffer, and sets `lbmDONE` on a buffer that has been freed and potentially reallocated, and the write I/O also completes. The crash happens in the WRITE bio's `lbmIODone` because it's operating on a freed buffer, leading to a use-after-free error when it checks `bp->l_flag`.

Now, the fix. The solution is simple in theory: change `lbmRead` to use `lbmIOWait(bp, 0)` instead of `wait_event`. This is safer for two reasons:
1. `lbmIOWait` acquires `LCACHE_LOCK` before checking the `lbmDONE` flag. Since `lbmIODone` sets `lbmDONE` while holding the `LCACHE_LOCK`, this guarantees proper synchronization.
2. `lbmIOWait` now returns `-EIO` if an I/O error happened in `lbmRead`, whereas the current version silently ignores I/O errors and always returns 0.

I've checked the usage of `lbmRead` and `lbmIOWait`, and everything looks clean. No callers rely on `bp->l_flag` having a specific state after `lbmRead` returns, and all callers will handle a negative error return.

I've also double-checked `lbmIODone` to ensure no other bugs exist after the change.

Finally, I analyzed the call stack again and confirmed the stack trace lines up with my analysis. This confirms the crash originates from the problematic synchronization between `lbmRead` and `lbmIODone`.

map[ContextFile:fs/jfs/jfs_logmgr.c IncludeLines:true Name:lbuf]

map[SourceCode: 438:	/*
 439:	 *		log cache buffer header
 440:	 */
 441:	struct lbuf {
 442:		struct jfs_log *l_log;	/* 4: log associated with buffer */
 443:	
 444:		/*
 445:		 * data buffer base area
 446:		 */
 447:		uint l_flag;		/* 4: pageout control flags */
 448:	
 449:		struct lbuf *l_wqnext;	/* 4: write queue link */
 450:		struct lbuf *l_freelist;	/* 4: freelistlink */
 451:	
 452:		int l_pn;		/* 4: log page number */
 453:		int l_eor;		/* 4: log record eor */
 454:		int l_ceor;		/* 4: committed log record eor */
 455:	
 456:		s64 l_blkno;		/* 8: log page block number */
 457:		caddr_t l_ldata;	/* 4: data page */
 458:		struct page *l_page;	/* The page itself */
 459:		uint l_offset;		/* Offset of l_ldata within the page */
 460:	
 461:		wait_queue_head_t l_ioevent;	/* 4: i/o done event */
 462:	};
 SourceFile:fs/jfs/jfs_logmgr.h]

gemini-3.1-pro-preview

							input: 172468
							output: 17
							thoughts: 927
						

**Analyzing the JFS KASAN Use-After-Free**

Okay, so I've got this KASAN report, and it looks like a classic use-after-free issue. I've confirmed that the buggy address, 8 bytes into the freed region, lines up perfectly with the `l_flag` offset of an `lbm_buffer` struct. Let's break this down systematically.

1.  **Root Cause Summary**: This use-after-free stems from a race condition between `lbmRead()` and `lbmIODone()`. Essentially, `lbmRead()` uses a lockless `wait_event()` to await the completion of a READ bio. The problem is that `lbmIODone()`, when the READ bio completes, clears the `lbmREAD` flag and wakes the waiter *before* setting the `lbmDONE` flag and releasing the `LCACHE_LOCK`. This leaves a window where `lbmRead()` can prematurely return while `lbmIODone()` is still in the process of finalizing operations.

2.  **Detailed Sequence of Events**:
    *   `lmLogShutdown()` initiates by calling `lbmRead()` to read the log superblock.
    *   `lbmRead()` allocates a log buffer (`bp`), sets `bp->l_flag` to `lbmREAD`, submits the READ bio, and then it immediately waits using `wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD))`.
    *   The READ bio completes, which in turn calls `lbmIODone()`. The critical steps here are: the lock `LCACHE_LOCK` is acquired. the `lbmREAD` flag is cleared from `bp->l_flag`, and `LCACHE_WAKEUP(&bp->l_ioevent)` is called.
    *   `wait_event()` in `lbmRead()` wakes up, checks `bp->l_flag != lbmREAD` (which is now true), and it returns immediately. This is the race window.
    *   `lmLogShutdown()` proceeds to reuse *the same* `bp` for a WRITE bio by calling `lbmDirectWrite()`.
    *   `lbmDirectWrite()` overwrites the contents of `bp->l_flag`, effectively removing any flags set, and submits the WRITE bio.
    *   `lmLogShutdown()` then calls `lbmIOWait(bp, lbmFREE)` to wait for the WRITE bio. `lbmIOWait()` checks for the `bp->l_flag & lbmDONE` flag.
    *   Now, back in the original READ bio's `lbmIODone()`, after clearing the flag and waking the waiter, the execution reaches the `out:` label, where `bp->l_flag |= lbmDONE;` is executed. The lock `LCACHE_LOCK` is released.
    *   This is the critical error! It erroneously sets the `lbmDONE` flag on the *reused* `bp`.
    *   `lbmIOWait()` sees this `lbmDONE` flag and mistakenly assumes the WRITE bio is complete, and the function returns early.
    *   `lbmIOWait()` calls `lbmfree(bp)`, and `lmLogShutdown()` calls `lbmLogShutdown()`, which then frees the `bp` with `kfree()`.
    *   Later, when the WRITE bio finally completes, `lbmIODone()` is called, but it's called on the *freed* `bp`. This access to `bp->l_flag` at offset 8 (the `l_flag` field) triggers the KASAN slab-use-after-free because we have accessed the memory after we've freed it.

3.  **Proposed Fix**: The solution is straightforward. Replace the lockless `wait_event()` in `lbmRead()` with `lbmIOWait(bp, 0)`. `lbmIOWait()` is using the more robust `LCACHE_SLEEP_COND()`, which *does* synchronize with `lbmIODone()` via the `LCACHE_LOCK`. This ensures that `lbmRead()` *waits* until `lbmIODone()` has completed its work and released `LCACHE_LOCK`. Furthermore, it also fixes an error where `lbmRead()` unconditionally returned 0, ignoring I/O errors; `lbmIOWait()` correctly returns `-EIO` on I/O error.

Now, let's just make sure there are no other instances of `wait_event` being used in JFS that might have similar synchronization issues. This could be a recurring pattern.

map[Expression:wait_event]

map[Output:
Full output is too long, showing 500 out of 13189 lines.
Use more precise expression if possible.

[Documentation/driver-api/nfc/nfc-hci.rst=236=Internally, execution is asynchronous. So all this API does is to enqueue the
 Documentation/driver-api/nfc/nfc-hci.rst:237:HCI command, setup a local wait queue on stack, and wait_event() for completion.
 Documentation/driver-api/nfc/nfc-hci.rst-238-The wait is not interruptible because it is guaranteed that the command will
 --
 Documentation/driver-api/parport-lowlevel.rst=9=Global functions::
 --
 Documentation/driver-api/parport-lowlevel.rst-22-  parport_poll_peripheral
 Documentation/driver-api/parport-lowlevel.rst:23:  parport_wait_event
 Documentation/driver-api/parport-lowlevel.rst-24-  parport_negotiate
 --
 Documentation/driver-api/parport-lowlevel.rst=742=parport_wait_peripheral
 --
 Documentation/driver-api/parport-lowlevel.rst-745-
 Documentation/driver-api/parport-lowlevel.rst:746:parport_wait_event - wait for an event on a port
 Documentation/driver-api/parport-lowlevel.rst-747-------------------------------------------------
 --
 Documentation/driver-api/parport-lowlevel.rst=749=SYNOPSIS
 --
 Documentation/driver-api/parport-lowlevel.rst-755-
 Documentation/driver-api/parport-lowlevel.rst:756:	int parport_wait_event (struct parport *port, signed long timeout)
 Documentation/driver-api/parport-lowlevel.rst-757-
 --
 Documentation/kernel-hacking/hacking.rst=516=put yourself in the queue before checking the condition. There is a
 Documentation/kernel-hacking/hacking.rst:517:macro to do this: wait_event_interruptible()
 Documentation/kernel-hacking/hacking.rst-518-(``include/linux/wait.h``) The first argument is the wait queue head, and
 --
 Documentation/kernel-hacking/hacking.rst=520=this expression is true, or ``-ERESTARTSYS`` if a signal is received. The
 Documentation/kernel-hacking/hacking.rst:521:wait_event() version ignores signals.
 Documentation/kernel-hacking/hacking.rst-522-
 --
 Documentation/memory-barriers.txt=2185=interpolate the memory barrier in the right place, for example:
 Documentation/memory-barriers.txt-2186-
 Documentation/memory-barriers.txt:2187:	wait_event();
 Documentation/memory-barriers.txt:2188:	wait_event_cmd();
 Documentation/memory-barriers.txt:2189:	wait_event_exclusive_cmd();
 Documentation/memory-barriers.txt:2190:	wait_event_interruptible();
 Documentation/memory-barriers.txt:2191:	wait_event_interruptible_exclusive();
 Documentation/memory-barriers.txt:2192:	wait_event_interruptible_timeout();
 Documentation/memory-barriers.txt:2193:	wait_event_killable();
 Documentation/memory-barriers.txt:2194:	wait_event_timeout();
 Documentation/memory-barriers.txt-2195-	wait_on_bit();
 --
 Documentation/power/freezing-of-tasks.rst=45=signal-handling code, but the freezable kernel threads need to call it
 Documentation/power/freezing-of-tasks.rst:46:explicitly in suitable places or use the wait_event_freezable() or
 Documentation/power/freezing-of-tasks.rst:47:wait_event_freezable_timeout() macros (defined in include/linux/wait.h)
 Documentation/power/freezing-of-tasks.rst-48-that put the task to sleep (TASK_INTERRUPTIBLE) or freeze it (TASK_FROZEN) if
 --
 Documentation/power/freezing-of-tasks.rst=50=like the following one::
 --
 Documentation/power/freezing-of-tasks.rst-56-
 Documentation/power/freezing-of-tasks.rst:57:		wait_event_freezable(oom_reaper_wait, oom_reaper_list != NULL);
 Documentation/power/freezing-of-tasks.rst-58-		spin_lock_irq(&oom_reaper_lock);
 --
 Documentation/power/freezing-of-tasks.rst=74=kernel threads must call try_to_freeze() somewhere or use one of the
 Documentation/power/freezing-of-tasks.rst:75:wait_event_freezable() and wait_event_freezable_timeout() macros.
 Documentation/power/freezing-of-tasks.rst-76-
 --
 Documentation/power/freezing-of-tasks.rst=108=directly is not allowed).  From this point it is regarded as freezable
 Documentation/power/freezing-of-tasks.rst:109:and must call try_to_freeze() or variants of wait_event_freezable() in a
 Documentation/power/freezing-of-tasks.rst-110-suitable place.
 --
 Documentation/scsi/ChangeLog.lpfc=98=Changes from 20050215 to 20050223
 --
 Documentation/scsi/ChangeLog.lpfc-134-	* Fix comment for lpfc_sli_iocb_cmd_type to fit within 80 columns.
 Documentation/scsi/ChangeLog.lpfc:135:	* Replaced wait_event() with wait_event_interruptible().
 Documentation/scsi/ChangeLog.lpfc:136:	  wait_event() puts the woker thread in an UNINTERRUPTIBLE state
 Documentation/scsi/ChangeLog.lpfc-137-	  causing it to figure in load average calculations. Also add a
 Documentation/scsi/ChangeLog.lpfc:138:	  BUG_ON to the ret code of wait_event_interruptible() since the
 Documentation/scsi/ChangeLog.lpfc-139-	  premise is that the worker thread is signal-immune.
 --
 Documentation/scsi/ChangeLog.lpfc=319=Changes from 20041229 to 20050110
 --
 Documentation/scsi/ChangeLog.lpfc-349-	  information
 Documentation/scsi/ChangeLog.lpfc:350:	* Added use of wait_event to work with kthread interface.
 Documentation/scsi/ChangeLog.lpfc-351-	* Ensure that scsi_transport_fc.h is always pulled in by
 --
 Documentation/translations/it_IT/kernel-hacking/hacking.rst=549=mettervi in coda prima di verificare la condizione. Esiste una macro
 Documentation/translations/it_IT/kernel-hacking/hacking.rst:550:a questo scopo: :c:func:`wait_event_interruptible()` (``include/linux/wait.h``).
 Documentation/translations/it_IT/kernel-hacking/hacking.rst-551-Il primo argomento è la testa della coda d'attesa, e il secondo è
 --
 Documentation/translations/it_IT/kernel-hacking/hacking.rst=553=espressione è vera, altrimenti ``-ERESTARTSYS`` se è stato ricevuto un segnale.
 Documentation/translations/it_IT/kernel-hacking/hacking.rst:554:La versione :c:func:`wait_event()` ignora i segnali.
 Documentation/translations/it_IT/kernel-hacking/hacking.rst-555-
 --
 Documentation/translations/sp_SP/memory-barriers.txt=2280=correcto:
 Documentation/translations/sp_SP/memory-barriers.txt-2281-
 Documentation/translations/sp_SP/memory-barriers.txt:2282:	wait_event();
 Documentation/translations/sp_SP/memory-barriers.txt:2283:	wait_event_interruptible();
 Documentation/translations/sp_SP/memory-barriers.txt:2284:	wait_event_interruptible_exclusive();
 Documentation/translations/sp_SP/memory-barriers.txt:2285:	wait_event_interruptible_timeout();
 Documentation/translations/sp_SP/memory-barriers.txt:2286:	wait_event_killable();
 Documentation/translations/sp_SP/memory-barriers.txt:2287:	wait_event_timeout();
 Documentation/translations/sp_SP/memory-barriers.txt-2288-	wait_on_bit();
 --
 Documentation/translations/zh_CN/kernel-hacking/hacking.rst=347=CPU上运行。
 --
 Documentation/translations/zh_CN/kernel-hacking/hacking.rst-434-将自己放在等待队列中相当复杂，因为你必须在检查条件之前将自己放入队列中。有一
 Documentation/translations/zh_CN/kernel-hacking/hacking.rst:435:个宏可以来执行此操作： :c:func:`wait_event_interruptible()`
 Documentation/translations/zh_CN/kernel-hacking/hacking.rst-436-（ ``include/linux/wait.h`` ）第一个参数是等待队列头，第二个参数是计算的表达
 Documentation/translations/zh_CN/kernel-hacking/hacking.rst-437-式；当该表达式为true时宏返回0，或者在接收到信号时返回 ``-ERESTARTSYS`` 。
 Documentation/translations/zh_CN/kernel-hacking/hacking.rst:438::c:func:`wait_event()` 版本会忽略信号。
 Documentation/translations/zh_CN/kernel-hacking/hacking.rst-439-
 --
 arch/arm/common/bL_switcher.c=270=static int bL_switcher_thread(void *arg)
 --
 arch/arm/common/bL_switcher.c-282-			flush_signals(current);
 arch/arm/common/bL_switcher.c:283:		wait_event_interruptible(t->wq,
 arch/arm/common/bL_switcher.c-284-				t->wanted_cluster != -1 ||
 --
 arch/arm/mach-pxa/am200epd.c=308=static void am200_set_stdby(struct metronomefb_par *par, int state)
 --
 arch/arm/mach-pxa/am200epd.c-312-
 arch/arm/mach-pxa/am200epd.c:313:static int am200_wait_event(struct metronomefb_par *par)
 arch/arm/mach-pxa/am200epd.c-314-{
 arch/arm/mach-pxa/am200epd.c:315:	return wait_event_timeout(par->waitq, gpio_get_value(RDY_GPIO_PIN), HZ);
 arch/arm/mach-pxa/am200epd.c-316-}
 arch/arm/mach-pxa/am200epd.c-317-
 arch/arm/mach-pxa/am200epd.c:318:static int am200_wait_event_intr(struct metronomefb_par *par)
 arch/arm/mach-pxa/am200epd.c-319-{
 arch/arm/mach-pxa/am200epd.c:320:	return wait_event_interruptible_timeout(par->waitq,
 arch/arm/mach-pxa/am200epd.c-321-					gpio_get_value(RDY_GPIO_PIN), HZ);
 --
 arch/arm/mach-pxa/am200epd.c=324=static struct metronome_board am200_board = {
 --
 arch/arm/mach-pxa/am200epd.c-330-	.set_stdby		= am200_set_stdby,
 arch/arm/mach-pxa/am200epd.c:331:	.met_wait_event		= am200_wait_event,
 arch/arm/mach-pxa/am200epd.c:332:	.met_wait_event_intr	= am200_wait_event_intr,
 arch/arm/mach-pxa/am200epd.c-333-	.get_panel_type		= am200_get_panel_type,
 --
 arch/arm/mach-pxa/am300epd.c=97=static char *gpio_names[] = { "PWR", "CFG", "RDY", "DC", "RST", "RD", "WR",
 --
 arch/arm/mach-pxa/am300epd.c-99-
 arch/arm/mach-pxa/am300epd.c:100:static int am300_wait_event(struct broadsheetfb_par *par)
 arch/arm/mach-pxa/am300epd.c-101-{
 arch/arm/mach-pxa/am300epd.c-102-	/* todo: improve err recovery */
 arch/arm/mach-pxa/am300epd.c:103:	wait_event(par->waitq, gpio_get_value(RDY_GPIO_PIN));
 arch/arm/mach-pxa/am300epd.c-104-	return 0;
 --
 arch/arm/mach-pxa/am300epd.c=107=static int am300_init_gpio_regs(struct broadsheetfb_par *par)
 --
 arch/arm/mach-pxa/am300epd.c-155-	msleep(10);
 arch/arm/mach-pxa/am300epd.c:156:	am300_wait_event(par);
 arch/arm/mach-pxa/am300epd.c-157-
 --
 arch/arm/mach-pxa/am300epd.c=252=static struct broadsheet_board am300_board = {
 --
 arch/arm/mach-pxa/am300epd.c-258-	.set_ctl		= am300_set_ctl,
 arch/arm/mach-pxa/am300epd.c:259:	.wait_for_rdy		= am300_wait_event,
 arch/arm/mach-pxa/am300epd.c-260-	.get_panel_type		= am300_get_panel_type,
 --
 arch/arm/mach-rpc/ecard.c=262=ecard_task(void * unused)
 --
 arch/arm/mach-rpc/ecard.c-275-
 arch/arm/mach-rpc/ecard.c:276:		wait_event_interruptible(ecard_wait, ecard_req != NULL);
 arch/arm/mach-rpc/ecard.c-277-
 --
 arch/arm64/kvm/arm.c=1007=static void kvm_vcpu_sleep(struct kvm_vcpu *vcpu)
 --
 arch/arm64/kvm/arm.c-1010-
 arch/arm64/kvm/arm.c:1011:	rcuwait_wait_event(wait,
 arch/arm64/kvm/arm.c-1012-			   (!kvm_arm_vcpu_stopped(vcpu)) && (!vcpu->arch.pause),
 --
 arch/m68k/atari/stdma.c=104=void stdma_lock(irq_handler_t handler, void *data)
 --
 arch/m68k/atari/stdma.c-108-	 buffers) */
 arch/m68k/atari/stdma.c:109:	wait_event(stdma_wait, stdma_try_lock(handler, data));
 arch/m68k/atari/stdma.c-110-}
 --
 arch/mips/kernel/rtlx.c=91=int rtlx_open(int index, int can_sleep)
 --
 arch/mips/kernel/rtlx.c-112-			if (can_sleep) {
 arch/mips/kernel/rtlx.c:113:				ret = __wait_event_interruptible(
 arch/mips/kernel/rtlx.c-114-					channel_wqs[index].lx_queue,
 --
 arch/mips/kernel/rtlx.c=192=unsigned int rtlx_read_poll(int index, int can_sleep)
 --
 arch/mips/kernel/rtlx.c-203-		if (can_sleep) {
 arch/mips/kernel/rtlx.c:204:			int ret = __wait_event_interruptible(
 arch/mips/kernel/rtlx.c-205-				channel_wqs[index].lx_queue,
 --
 arch/mips/kernel/rtlx.c=373=static ssize_t file_write(struct file *file, const char __user *buffer,
 --
 arch/mips/kernel/rtlx.c-384-
 arch/mips/kernel/rtlx.c:385:		ret = __wait_event_interruptible(channel_wqs[minor].rt_queue,
 arch/mips/kernel/rtlx.c-386-					   rtlx_write_poll(minor));
 --
 arch/mips/math-emu/dsemul.c=75=static int alloc_emuframe(void)
 --
 arch/mips/math-emu/dsemul.c-105-		spin_unlock(&mm_ctx->bd_emupage_lock);
 arch/mips/math-emu/dsemul.c:106:		if (!wait_event_killable(mm_ctx->bd_emupage_queue,
 arch/mips/math-emu/dsemul.c-107-			!bitmap_full(mm_ctx->bd_emupage_allocmap,
 --
 arch/mips/sibyte/common/sb_tbprof.c=360=static int sbprof_zbprof_stop(void)
 --
 arch/mips/sibyte/common/sb_tbprof.c-372-		pr_debug(DEVNAME ": wait for disarm\n");
 arch/mips/sibyte/common/sb_tbprof.c:373:		err = wait_event_interruptible(sbp.tb_sync, !sbp.tb_armed);
 arch/mips/sibyte/common/sb_tbprof.c-374-		pr_debug(DEVNAME ": disarm complete, stat %d\n", err);
 --
 arch/mips/sibyte/common/sb_tbprof.c=491=static long sbprof_tb_ioctl(struct file *filp,
 --
 arch/mips/sibyte/common/sb_tbprof.c-510-	case SBPROF_ZBWAITFULL: {
 arch/mips/sibyte/common/sb_tbprof.c:511:		err = wait_event_interruptible(sbp.tb_read, TB_FULL);
 arch/mips/sibyte/common/sb_tbprof.c-512-		if (err)
 --
 arch/powerpc/kernel/rtasd.c=301=static ssize_t rtas_log_read(struct file * file, char __user * buf,
 --
 arch/powerpc/kernel/rtasd.c-340-		spin_unlock_irqrestore(&rtasd_log_lock, s);
 arch/powerpc/kernel/rtasd.c:341:		error = wait_event_interruptible(rtas_log_wait, rtas_log_size);
 arch/powerpc/kernel/rtasd.c-342-		if (error)
 --
 arch/powerpc/platforms/83xx/suspend.c=263=static int agent_thread_fn(void *data)
 --
 arch/powerpc/platforms/83xx/suspend.c-267-	while (1) {
 arch/powerpc/platforms/83xx/suspend.c:268:		wait_event_freezable(agent_wq, pci_pm_state >= 2);
 arch/powerpc/platforms/83xx/suspend.c-269-
 --
 arch/powerpc/platforms/cell/spufs/spufs.h=294=extern char *isolated_loader;
 --
 arch/powerpc/platforms/cell/spufs/spufs.h-297- * spufs_wait
 arch/powerpc/platforms/cell/spufs/spufs.h:298: *	Same as wait_event_interruptible(), except that here
 arch/powerpc/platforms/cell/spufs/spufs.h-299- *	we need to call spu_release(ctx) before sleeping, and
 --
 arch/powerpc/platforms/powernv/opal-async.c=128=int opal_async_wait_response(uint64_t token, struct opal_msg *msg)
 --
 arch/powerpc/platforms/powernv/opal-async.c-140-	/*
 arch/powerpc/platforms/powernv/opal-async.c:141:	 * There is no need to mark the token as dispatched, wait_event()
 arch/powerpc/platforms/powernv/opal-async.c-142-	 * will block until the token completes.
 --
 arch/powerpc/platforms/powernv/opal-async.c-148-	opal_wake_poller();
 arch/powerpc/platforms/powernv/opal-async.c:149:	wait_event(opal_async_wait, opal_async_tokens[token].state
 arch/powerpc/platforms/powernv/opal-async.c-150-			== ASYNC_TOKEN_COMPLETED);
 --
 arch/powerpc/platforms/powernv/opal-async.c=157=int opal_async_wait_response_interruptible(uint64_t token, struct opal_msg *msg)
 --
 arch/powerpc/platforms/powernv/opal-async.c-173-	 * The first time this gets called we mark the token as DISPATCHED
 arch/powerpc/platforms/powernv/opal-async.c:174:	 * so that if wait_event_interruptible() returns not zero and the
 arch/powerpc/platforms/powernv/opal-async.c-175-	 * caller frees the token, we know not to actually free the token
 --
 arch/powerpc/platforms/powernv/opal-async.c-200-	opal_wake_poller();
 arch/powerpc/platforms/powernv/opal-async.c:201:	ret = wait_event_interruptible(opal_async_wait,
 arch/powerpc/platforms/powernv/opal-async.c-202-			opal_async_tokens[token].state ==
 --
 arch/powerpc/platforms/powernv/opal-prd.c=159=static ssize_t opal_prd_read(struct file *file, char __user *buf,
 --
 arch/powerpc/platforms/powernv/opal-prd.c-191-
 arch/powerpc/platforms/powernv/opal-prd.c:192:		rc = wait_event_interruptible(opal_prd_msg_wait,
 arch/powerpc/platforms/powernv/opal-prd.c-193-				!opal_msg_queue_empty());
 --
 arch/powerpc/platforms/ps3/device-init.c=725=static int ps3_notification_read_write(struct ps3_notification_device *dev,
 --
 arch/powerpc/platforms/ps3/device-init.c-744-
 arch/powerpc/platforms/ps3/device-init.c:745:	rcuwait_wait_event(&dev->wait, dev->done || kthread_should_stop(), TASK_IDLE);
 arch/powerpc/platforms/ps3/device-init.c-746-
 --
 arch/powerpc/platforms/pseries/rtas-work-area.c=81=struct rtas_work_area * __ref __rtas_work_area_alloc(size_t size)
 --
 arch/powerpc/platforms/pseries/rtas-work-area.c-102-	mutex_lock(&rwa_state.mutex);
 arch/powerpc/platforms/pseries/rtas-work-area.c:103:	wait_event(rwa_state.wqh,
 arch/powerpc/platforms/pseries/rtas-work-area.c-104-		   (addr = gen_pool_alloc(rwa_state.gen_pool, size)) != 0);
 --
 arch/riscv/kvm/vcpu.c=663=static int kvm_riscv_check_vcpu_requests(struct kvm_vcpu *vcpu)
 --
 arch/riscv/kvm/vcpu.c-669-			kvm_vcpu_srcu_read_unlock(vcpu);
 arch/riscv/kvm/vcpu.c:670:			rcuwait_wait_event(wait,
 arch/riscv/kvm/vcpu.c-671-				(!kvm_riscv_vcpu_stopped(vcpu)) && (!vcpu->arch.pause),
 --
 arch/s390/kvm/priv.c=398=static int handle_ipte_interlock(struct kvm_vcpu *vcpu)
 --
 arch/s390/kvm/priv.c-402-		return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 arch/s390/kvm/priv.c:403:	wait_event(vcpu->kvm->arch.ipte_wq, !ipte_lock_held(vcpu->kvm));
 arch/s390/kvm/priv.c-404-	kvm_s390_retry_instr(vcpu);
 --
 arch/s390/lib/test_unwind.c=319=static noinline int unwindme_func4(struct unwindme *u)
 --
 arch/s390/lib/test_unwind.c-324-		complete(&u->task_ready);
 arch/s390/lib/test_unwind.c:325:		wait_event(u->task_wq, kthread_should_park());
 arch/s390/lib/test_unwind.c-326-		kthread_parkme();
 --
 arch/s390/mm/cmm.c=161=static int cmm_thread(void *dummy)
 --
 arch/s390/mm/cmm.c-165-	while (1) {
 arch/s390/mm/cmm.c:166:		rc = wait_event_interruptible(cmm_thread_wait,
 arch/s390/mm/cmm.c-167-			cmm_pages != cmm_pages_target ||
 --
 arch/sh/drivers/dma/dma-api.c=125=void dma_wait_for_completion(unsigned int chan)
 --
 arch/sh/drivers/dma/dma-api.c-130-	if (channel->flags & DMA_TEI_CAPABLE) {
 arch/sh/drivers/dma/dma-api.c:131:		wait_event(channel->wait_queue,
 arch/sh/drivers/dma/dma-api.c-132-			   (info->ops->get_residue(channel) == 0));
 --
 arch/x86/kernel/apm_32.c=1433=static ssize_t do_read(struct file *fp, char __user *buf, size_t count, loff_t *ppos)
 --
 arch/x86/kernel/apm_32.c-1445-		return -EAGAIN;
 arch/x86/kernel/apm_32.c:1446:	wait_event_interruptible(apm_waitqueue, !queue_empty(as));
 arch/x86/kernel/apm_32.c-1447-	i = count;
 --
 arch/x86/kernel/apm_32.c=1489=static long do_ioctl(struct file *filp, u_int cmd, u_long arg)
 --
 arch/x86/kernel/apm_32.c-1525-			mutex_unlock(&apm_mutex);
 arch/x86/kernel/apm_32.c:1526:			wait_event_interruptible(apm_suspend_waitqueue,
 arch/x86/kernel/apm_32.c-1527-					as->suspend_wait == 0);
 --
 arch/x86/kernel/cpu/sgx/main.c=399=static int ksgxd(void *p)
 --
 arch/x86/kernel/cpu/sgx/main.c-413-
 arch/x86/kernel/cpu/sgx/main.c:414:		wait_event_freezable(ksgxd_waitq,
 arch/x86/kernel/cpu/sgx/main.c-415-				     kthread_should_stop() ||
 --
 arch/x86/platform/intel/iosf_mbi.c=214=void iosf_mbi_punit_acquire(void)
 --
 arch/x86/platform/intel/iosf_mbi.c-219-		mutex_unlock(&iosf_mbi_pmic_access_mutex);
 arch/x86/platform/intel/iosf_mbi.c:220:		wait_event(iosf_mbi_pmic_access_waitq,
 arch/x86/platform/intel/iosf_mbi.c-221-			   iosf_mbi_pmic_i2c_access_count == 0);
 --
 arch/x86/platform/intel/iosf_mbi.c=312=int iosf_mbi_block_punit_i2c_access(void)
 --
 arch/x86/platform/intel/iosf_mbi.c-324-		mutex_unlock(&iosf_mbi_pmic_access_mutex);
 arch/x86/platform/intel/iosf_mbi.c:325:		wait_event(iosf_mbi_pmic_access_waitq,
 arch/x86/platform/intel/iosf_mbi.c-326-			   iosf_mbi_pmic_punit_access_count == 0);
 --
 block/blk-core.c=304=int blk_queue_enter(struct request_queue *q, blk_mq_req_flags_t flags)
 --
 block/blk-core.c-319-		smp_rmb();
 block/blk-core.c:320:		wait_event(q->mq_freeze_wq,
 block/blk-core.c-321-			   (!q->mq_freeze_depth &&
 --
 block/blk-core.c=333=int __bio_queue_enter(struct request_queue *q, struct bio *bio)
 --
 block/blk-core.c-352-		smp_rmb();
 block/blk-core.c:353:		wait_event(q->mq_freeze_wq,
 block/blk-core.c-354-			   (!q->mq_freeze_depth &&
 --
 block/blk-crypto-profile.c=246=blk_status_t blk_crypto_get_keyslot(struct blk_crypto_profile *profile,
 --
 block/blk-crypto-profile.c-284-		blk_crypto_hw_exit(profile);
 block/blk-crypto-profile.c:285:		wait_event(profile->idle_slots_wait_queue,
 block/blk-crypto-profile.c-286-			   !list_empty(&profile->idle_slots));
 --
 block/blk-mq.c=189=void blk_mq_freeze_queue_wait(struct request_queue *q)
 block/blk-mq.c-190-{
 block/blk-mq.c:191:	wait_event(q->mq_freeze_wq, percpu_ref_is_zero(&q->q_usage_counter));
 block/blk-mq.c-192-}
 --
 block/blk-mq.c=195=int blk_mq_freeze_queue_wait_timeout(struct request_queue *q,
 --
 block/blk-mq.c-197-{
 block/blk-mq.c:198:	return wait_event_timeout(q->mq_freeze_wq,
 block/blk-mq.c-199-					percpu_ref_is_zero(&q->q_usage_counter),
 --
 crypto/af_alg.c=778=static int af_alg_wait_for_wmem(struct sock *sk, unsigned int flags)
 --
 crypto/af_alg.c-793-		timeout = MAX_SCHEDULE_TIMEOUT;
 crypto/af_alg.c:794:		if (sk_wait_event(sk, &timeout, af_alg_writable(sk), &wait)) {
 crypto/af_alg.c-795-			err = 0;
 --
 crypto/af_alg.c=835=int af_alg_wait_for_data(struct sock *sk, unsigned flags, unsigned min)
 --
 crypto/af_alg.c-852-		timeout = MAX_SCHEDULE_TIMEOUT;
 crypto/af_alg.c:853:		if (sk_wait_event(sk, &timeout,
 crypto/af_alg.c-854-				  ctx->init && (!ctx->more ||
 --
 crypto/jitterentropy-testing.c=121=static int jent_testing_reader(struct jent_testing *data, u32 *boot,
 --
 crypto/jitterentropy-testing.c-147-
 crypto/jitterentropy-testing.c:148:			wait_event_interruptible(data->read_wait,
 crypto/jitterentropy-testing.c-149-						 jent_testing_have_data(data));
 --
 drivers/accel/amdxdna/aie2_ctx.c=744=void aie2_hwctx_fini(struct amdxdna_hwctx *hwctx)
 --
 drivers/accel/amdxdna/aie2_ctx.c-762-	/* Wait for all submitted jobs to be completed or canceled */
 drivers/accel/amdxdna/aie2_ctx.c:763:	wait_event(hwctx->priv->job_free_wq,
 drivers/accel/amdxdna/aie2_ctx.c-764-		   atomic64_read(&hwctx->job_submit_cnt) ==
 --
 drivers/accel/ivpu/ivpu_ipc.c=248=int ivpu_ipc_receive(struct ivpu_device *vdev, struct ivpu_ipc_consumer *cons,
 --
 drivers/accel/ivpu/ivpu_ipc.c-257-
 drivers/accel/ivpu/ivpu_ipc.c:258:	wait_ret = wait_event_timeout(cons->rx_msg_wq,
 drivers/accel/ivpu/ivpu_ipc.c-259-				      ivpu_ipc_rx_need_wakeup(cons),
 --
 drivers/accel/qaic/qaic_control.c=298=static void save_dbc_buf(struct qaic_device *qdev, struct ioctl_resources *resources,
 --
 drivers/accel/qaic/qaic_control.c-303-	if (resources->buf) {
 drivers/accel/qaic/qaic_control.c:304:		wait_event_interruptible(qdev->dbc[dbc_id].dbc_release, !qdev->dbc[dbc_id].in_use);
 drivers/accel/qaic/qaic_control.c-305-		qdev->dbc[dbc_id].req_q_base = resources->buf;
 --
 drivers/acpi/acpi_dbg.c=300=static ssize_t acpi_aml_write_log(const char *msg)
 --
 drivers/acpi/acpi_dbg.c-312-		if (ret == -EAGAIN) {
 drivers/acpi/acpi_dbg.c:313:			ret = wait_event_interruptible(acpi_aml_io.wait,
 drivers/acpi/acpi_dbg.c-314-				acpi_aml_kern_writable());
 --
 drivers/acpi/acpi_dbg.c=340=static ssize_t acpi_aml_read_cmd(char *msg, size_t count)
 --
 drivers/acpi/acpi_dbg.c-356-		if (ret == -EAGAIN) {
 drivers/acpi/acpi_dbg.c:357:			ret = wait_event_interruptible(acpi_aml_io.wait,
 drivers/acpi/acpi_dbg.c-358-				acpi_aml_kern_readable());
 --
 drivers/acpi/acpi_dbg.c=528=static int acpi_aml_release(struct inode *inode, struct file *file)
 --
 drivers/acpi/acpi_dbg.c-549-		 */
 drivers/acpi/acpi_dbg.c:550:		wait_event(acpi_aml_io.wait, !acpi_aml_busy());
 drivers/acpi/acpi_dbg.c-551-
 --
 drivers/acpi/acpi_dbg.c-557-		acpi_terminate_debugger();
 drivers/acpi/acpi_dbg.c:558:		wait_event(acpi_aml_io.wait, !acpi_aml_used());
 drivers/acpi/acpi_dbg.c-559-		pr_debug("Debugger thread terminated.\n");
 --
 drivers/acpi/acpi_dbg.c=599=static ssize_t acpi_aml_read(struct file *file, char __user *buf,
 --
 drivers/acpi/acpi_dbg.c-616-			else {
 drivers/acpi/acpi_dbg.c:617:				ret = wait_event_interruptible(acpi_aml_io.wait,
 drivers/acpi/acpi_dbg.c-618-					acpi_aml_user_readable());
 --
 drivers/acpi/acpi_dbg.c=669=static ssize_t acpi_aml_write(struct file *file, const char __user *buf,
 --
 drivers/acpi/acpi_dbg.c-686-			else {
 drivers/acpi/acpi_dbg.c:687:				ret = wait_event_interruptible(acpi_aml_io.wait,
 drivers/acpi/acpi_dbg.c-688-					acpi_aml_user_writable());
 --
 drivers/acpi/acpica/acinterp.h=309=acpi_status
 drivers/acpi/acpica/acinterp.h:310:acpi_ex_system_wait_event(union acpi_operand_object *time,
 drivers/acpi/acpica/acinterp.h-311-			  union acpi_operand_object *obj_desc);
 --
 drivers/acpi/acpica/evgpe.c=626=acpi_ev_detect_gpe(struct acpi_namespace_node *gpe_device,
 --
 drivers/acpi/acpica/evgpe.c-711-		 * 2. The GPE handler is expected to be flushed by
 drivers/acpi/acpica/evgpe.c:712:		 *    acpi_os_wait_events_complete() before the
 drivers/acpi/acpica/evgpe.c-713-		 *    destruction.
 --
 drivers/acpi/acpica/evxface.c=211=acpi_remove_notify_handler(acpi_handle device,
 --
 drivers/acpi/acpica/evxface.c-258-
 drivers/acpi/acpica/evxface.c:259:				acpi_os_wait_events_complete();
 drivers/acpi/acpica/evxface.c-260-			}
 --
 drivers/acpi/acpica/evxface.c-318-
 drivers/acpi/acpica/evxface.c:319:			acpi_os_wait_events_complete();
 drivers/acpi/acpica/evxface.c-320-			acpi_ut_remove_reference(handler_obj);
 --
 drivers/acpi/acpica/evxface.c=905=acpi_remove_gpe_handler(acpi_handle gpe_device,
 --
 drivers/acpi/acpica/evxface.c-990-
 drivers/acpi/acpica/evxface.c:991:	acpi_os_wait_events_complete();
 drivers/acpi/acpica/evxface.c-992-
 --
 drivers/acpi/acpica/exoparg2.c=465=acpi_status acpi_ex_opcode_2A_0T_1R(struct acpi_walk_state *walk_state)
 --
 drivers/acpi/acpica/exoparg2.c-516-
 drivers/acpi/acpica/exoparg2.c:517:		status = acpi_ex_system_wait_event(operand[1], operand[0]);
 drivers/acpi/acpica/exoparg2.c-518-		if (status == AE_TIME) {
 --
 drivers/acpi/acpica/exsystem.c=202=acpi_status acpi_ex_system_signal_event(union acpi_operand_object * obj_desc)
 --
 drivers/acpi/acpica/exsystem.c-217- *
 drivers/acpi/acpica/exsystem.c:218: * FUNCTION:    acpi_ex_system_wait_event
 drivers/acpi/acpica/exsystem.c-219- *
 --
 drivers/acpi/acpica/exsystem.c=231=acpi_status
 drivers/acpi/acpica/exsystem.c:232:acpi_ex_system_wait_event(union acpi_operand_object *time_desc,
 drivers/acpi/acpica/exsystem.c-233-			  union acpi_operand_object *obj_desc)
 --
 drivers/acpi/acpica/exsystem.c-236-
 drivers/acpi/acpica/exsystem.c:237:	ACPI_FUNCTION_TRACE(ex_system_wait_event);
 drivers/acpi/acpica/exsystem.c-238-
 --
 drivers/acpi/bus.c=646=static void acpi_device_remove_notify_handler(struct acpi_device *device,
 --
 drivers/acpi/bus.c-654-
 drivers/acpi/bus.c:655:	acpi_os_wait_events_complete();
 drivers/acpi/bus.c-656-}
 --
 drivers/acpi/bus.c=673=void acpi_dev_remove_notify_handler(struct acpi_device *adev,
 --
 drivers/acpi/bus.c-677-	acpi_remove_notify_handler(adev->handle, handler_type, handler);
 drivers/acpi/bus.c:678:	acpi_os_wait_events_complete();
 drivers/acpi/bus.c-679-}
 --
 drivers/acpi/button.c=672=static void acpi_button_remove(struct platform_device *pdev)
 --
 drivers/acpi/button.c-692-	}
 drivers/acpi/button.c:693:	acpi_os_wait_events_complete();
 drivers/acpi/button.c-694-
 --
 drivers/acpi/cppc_acpi.c=1893=int cppc_set_perf(int cpu, struct cppc_perf_ctrls *perf_ctrls)
 --
 drivers/acpi/cppc_acpi.c-2007-			/* Wait until pcc_write_cnt is updated by send_pcc_cmd */
 drivers/acpi/cppc_acpi.c:2008:			wait_event(pcc_ss_data->pcc_write_wait_q,
 drivers/acpi/cppc_acpi.c-2009-				   cpc_desc->write_cmd_id != pcc_ss_data->pcc_write_cnt);
 --
 drivers/acpi/ec.c=722=static int ec_guard(struct acpi_ec *ec)
 --
 drivers/acpi/ec.c-747-				break;
 drivers/acpi/ec.c:748:			if (wait_event_timeout(ec->wait,
 drivers/acpi/ec.c-749-					       ec_transaction_completed(ec),
 --
 drivers/acpi/ec.c=989=static void acpi_ec_stop(struct acpi_ec *ec, bool suspending)
 --
 drivers/acpi/ec.c-997-		spin_unlock_irqrestore(&ec->lock, flags);
 drivers/acpi/ec.c:998:		wait_event(ec->wait, acpi_ec_stopped(ec));
 drivers/acpi/ec.c-999-		spin_lock_irqsave(&ec->lock, flags);
]
]

gemini-3.1-pro-preview

							input: 186004
							output: 1089
							thoughts: 1004
						

**JFS Concurrency Bug Analysis and Fix**

Okay, so I've taken a look at this JFS issue, and it's a classic concurrency problem centered around the misuse of `wait_event`.  It's a straightforward analysis, really.  The core of the issue lies in how `lbmRead` uses `wait_event` to wait for a read BIO to complete. `wait_event` is a standard macro, but in this context, it's problematic because it checks a condition (`bp->l_flag != lbmREAD`) that's *protected* by a spinlock, but the `wait_event` itself doesn't acquire that lock.

The sequence breaks down like this: In `lbmIODone`, when the read BIO completes, `LCACHE_LOCK` is held, `lbmREAD` is cleared, and then `LCACHE_WAKEUP` is called to wake up the waiter (the code in `lbmRead`). Crucially, the code then *immediately* continues to unlock `LCACHE_LOCK` and set `lbmDONE`, all while still under the protection of the spinlock.  The problem is that the waiter in `lbmRead` wakes up before `lbmDONE` is set. So, the waiter in `lbmRead` checks the condition locklessly, immediately sees the `lbmREAD` flag has been cleared, and returns.

Now, things get hairy. The code calling `lbmRead` then reuses the same `bp` (buffer pointer) for a WRITE BIO via `lbmDirectWrite`. `lbmDirectWrite` overwrites the `bp->l_flag` with flags for the WRITE.  Later, the code calls `lbmIOWait` to wait for the WRITE BIO to complete, which is waiting for `bp->l_flag & lbmDONE`. Meanwhile, the original read BIO's `lbmIODone` continues and *finally* sets `lbmDONE` *after* the waiter in `lbmRead` has returned.  Because of this, the `lbmDONE` flag is set on a *reused* buffer. The code in `lbmIOWait` then sees the mistakenly set `lbmDONE` and returns early. Ultimately, because the `bp` has been reused and now has an erroneous `lbmDONE` flag, a use-after-free occurs when the *actual* WRITE BIO completes. This triggers a KASAN slab-use-after-free due to accessing the freed memory, specifically `bp->l_flag`.

The fix is elegant:  replace the lockless `wait_event` with `lbmIOWait(bp, 0)`. `lbmIOWait` uses `LCACHE_SLEEP_COND`, which *does* acquire the `LCACHE_LOCK` before checking the condition. This ensures that `lbmRead` doesn't return until `lbmIODone` has completely finished, including releasing the lock and correctly setting `lbmDONE`. In addition, this change correctly handles and returns any I/O errors that might occur. This is a solid, straightforward fix to eliminate the race condition. I'm satisfied with this analysis and the proposed patch.

map[KernelScratchSrc:/app/workdir/cache/tmp/tmp3355034503]

gemini-3.1-pro-preview

You are an experienced Linux kernel developer tasked with creating a fix for a kernel bug.
You will be given a crash report, and an initial explanation of the root cause done by another
kernel expert.

Use the codeeditor tool to do code edits.
Note: you will not see your changes when looking at the code using codesearch tools.

Your final reply should contain explanation of what you did in the patch and why
(details not present in the initial explanation of the bug).

Your fix must not just prevent the given crash, but also be the best fix for the underlying
root cause from the software engineering point of view. There can be several ways to fix the
same bug. Consider alternatives, and pick the best one. For example, additional checks may be
added at different locations/functions, it's usually better to place them earlier in the
execution to avoid multiple checks at various locations later.

Frequently the same coding mistake is done in several locations in the source code.
Check if your fix should be extended/applied to similar cases around to fix other similar bugs.
But don't go too wide, don't try to fix problems kernel-wide, fix similar issues
in the same file only.

If you are changing post-conditions of a function, consider all callers of the functions,
and if they need to be updated to handle new post-conditions. For example, if you make
a function that previously never returned a NULL, return NULL, consider if callers
need to be updated to handle NULL return value.



Prefer calling several tools at the same time to save round-trips.

The crash that corresponds to the bug is:

==================================================================
BUG: KASAN: slab-use-after-free in lbmIODone+0x1312/0x16c0 fs/jfs/jfs_logmgr.c:2192
Read of size 4 at addr ffff888049ebf608 by task ktimers/0/16

CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #1 PREEMPT_{RT,(full)} 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 lbmIODone+0x1312/0x16c0 fs/jfs/jfs_logmgr.c:2192
 blk_update_request+0x57e/0xe60 block/blk-mq.c:1016
 blk_mq_end_request+0x3e/0x70 block/blk-mq.c:1178
 blk_complete_reqs block/blk-mq.c:1253 [inline]
 blk_done_softirq+0x10a/0x160 block/blk-mq.c:1258
 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 run_ktimerd+0x69/0x100 kernel/softirq.c:1151
 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 6219:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x3a6/0x690 mm/slub.c:5419
 kmalloc_noprof include/linux/slab.h:950 [inline]
 lbmLogInit fs/jfs/jfs_logmgr.c:1819 [inline]
 lmLogInit+0x3e5/0x1a00 fs/jfs/jfs_logmgr.c:1267
 open_inline_log fs/jfs/jfs_logmgr.c:1173 [inline]
 lmLogOpen+0x4e1/0xfa0 fs/jfs/jfs_logmgr.c:1067
 jfs_mount_rw+0xee/0x670 fs/jfs/jfs_mount.c:257
 jfs_fill_super+0x754/0xd80 fs/jfs/super.c:532
 get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1694
 vfs_get_tree+0x92/0x2a0 fs/super.c:1754
 fc_mount fs/namespace.c:1193 [inline]
 do_new_mount_fc fs/namespace.c:3758 [inline]
 do_new_mount+0x341/0xd30 fs/namespace.c:3834
 do_mount fs/namespace.c:4167 [inline]
 __do_sys_mount fs/namespace.c:4383 [inline]
 __se_sys_mount+0x31d/0x420 fs/namespace.c:4360
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 6106:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2689 [inline]
 slab_free mm/slub.c:6250 [inline]
 kfree+0x1c5/0x6c0 mm/slub.c:6565
 lbmLogShutdown fs/jfs/jfs_logmgr.c:1862 [inline]
 lmLogShutdown+0x456/0x850 fs/jfs/jfs_logmgr.c:1681
 lmLogClose+0x28a/0x520 fs/jfs/jfs_logmgr.c:1457
 jfs_umount+0x2fb/0x3d0 fs/jfs/jfs_umount.c:124
 jfs_put_super+0x8c/0x190 fs/jfs/super.c:194
 generic_shutdown_super+0x13d/0x2d0 fs/super.c:646
 kill_block_super+0x44/0x90 fs/super.c:1725
 deactivate_locked_super+0xbc/0x130 fs/super.c:476
 cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
 task_work_run+0x1d9/0x270 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
 exit_to_user_mode_loop+0xf3/0x4d0 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888049ebf600
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 8 bytes inside of
 freed 256-byte region [ffff888049ebf600, ffff888049ebf700)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x49ebe
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x480000000000040(head|node=1|zone=1)
page_type: f5(slab)
raw: 0480000000000040 ffff888019c41b40 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 0480000000000040 ffff888019c41b40 dead000000000100 dead000000000122
head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 0480000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5588, tgid 5588 (udevd), ts 65263897590, free_ts 59786995144
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x231/0x280 mm/page_alloc.c:1858
 prep_new_page mm/page_alloc.c:1866 [inline]
 get_page_from_freelist+0x27c8/0x2840 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5226
 alloc_slab_page mm/slub.c:3278 [inline]
 allocate_slab+0x77/0x660 mm/slub.c:3467
 new_slab mm/slub.c:3525 [inline]
 refill_objects+0x33c/0x3d0 mm/slub.c:7255
 refill_sheaf mm/slub.c:2816 [inline]
 __pcs_replace_empty_main+0x373/0x720 mm/slub.c:4651
 alloc_from_pcs mm/slub.c:4749 [inline]
 slab_alloc_node mm/slub.c:4883 [inline]
 __kmalloc_cache_noprof+0x44e/0x690 mm/slub.c:5414
 kmalloc_noprof include/linux/slab.h:950 [inline]
 kzalloc_noprof include/linux/slab.h:1188 [inline]
 smk_fetch+0x95/0x140 security/smack/smack_lsm.c:285
 smack_d_instantiate+0x757/0x990 security/smack/smack_lsm.c:3653
 security_d_instantiate+0x106/0x1d0 security/security.c:3704
 d_splice_alias_ops+0x71/0x370 fs/dcache.c:3141
 __lookup_slow+0x2d2/0x440 fs/namei.c:1915
 lookup_slow+0x53/0x70 fs/namei.c:1932
 walk_component fs/namei.c:2278 [inline]
 lookup_last fs/namei.c:2785 [inline]
 path_lookupat+0x3f5/0x8c0 fs/namei.c:2809
 filename_lookup+0x256/0x5d0 fs/namei.c:2838
 vfs_statx+0x115/0x570 fs/stat.c:353
page last free pid 5606 tgid 5606 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1402 [inline]
 __free_frozen_pages+0xf48/0x1080 mm/page_alloc.c:2943
 __slab_free+0x252/0x2a0 mm/slub.c:5612
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4569 [inline]
 slab_alloc_node mm/slub.c:4898 [inline]
 __do_kmalloc_node mm/slub.c:5294 [inline]
 __kmalloc_noprof+0x399/0x7b0 mm/slub.c:5307
 kmalloc_noprof include/linux/slab.h:954 [inline]
 kzalloc_noprof include/linux/slab.h:1188 [inline]
 tomoyo_encode2 security/tomoyo/realpath.c:45 [inline]
 tomoyo_encode+0x28b/0x550 security/tomoyo/realpath.c:80
 tomoyo_mount_acl security/tomoyo/mount.c:152 [inline]
 tomoyo_mount_permission+0x4c1/0x9d0 security/tomoyo/mount.c:239
 security_sb_mount+0xe4/0x320 security/security.c:1088
 path_mount+0xbc/0x1000 fs/namespace.c:4096
 do_mount fs/namespace.c:4167 [inline]
 __do_sys_mount fs/namespace.c:4383 [inline]
 __se_sys_mount+0x31d/0x420 fs/namespace.c:4360
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888049ebf500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888049ebf580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888049ebf600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                      ^
 ffff888049ebf680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888049ebf700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================


The explanation of the root cause of the bug is:

The root cause of this KASAN slab-use-after-free is a concurrency bug (race condition) between `lbmRead()` and the bio completion handler `lbmIODone()`. 

### Detailed Explanation

1. **The Lockless Wait:**
   In `fs/jfs/jfs_logmgr.c`, `lbmRead()` submits a READ bio and waits for its completion using `wait_event()`:
   ```c
   wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));
   return 0;
   ```
   The `wait_event()` macro evaluates its condition `(bp->l_flag != lbmREAD)` locklessly.

2. **The Premature Wakeup:**
   When the READ bio completes, the block layer calls `lbmIODone()`. This function acquires the `LCACHE_LOCK` spinlock, clears the `lbmREAD` flag, and wakes up the waiter:
   ```c
   	if (bp->l_flag & lbmREAD) {
   		bp->l_flag &= ~lbmREAD;

   		/* wakeup I/O initiator */
   		LCACHE_WAKEUP(&bp->l_ioevent);

   		goto out;
   	}
   ```
   Crucially, it does this **before** it sets the `lbmDONE` flag and releases the lock at the `out:` label:
   ```c
   out:
   	bp->l_flag |= lbmDONE;
   	LCACHE_UNLOCK(flags);
   ```

3. **The Race and Reuse:**
   Because `wait_event()` is lockless, the thread executing `lbmRead()` wakes up immediately after `LCACHE_WAKEUP` is called, sees that `lbmREAD` is cleared, and returns. 
   
   The caller of `lbmRead()` (in this crash, `lmLogShutdown()`) then proceeds to reuse the exact same `bp` for a WRITE bio by calling `lbmDirectWrite()`. `lbmDirectWrite()` overwrites `bp->l_flag` with new flags (e.g., `lbmWRITE | lbmRELEASE | lbmSYNC | lbmDIRECT`), which clears any previous state.

4. **The State Corruption:**
   `lmLogShutdown()` then calls `lbmIOWait(bp, lbmFREE)` to wait for the new WRITE bio to complete. `lbmIOWait()` waits for the `lbmDONE` flag to be set.
   
   Meanwhile, the original READ bio's `lbmIODone()` resumes execution, reaches the `out:` label, executes `bp->l_flag |= lbmDONE;`, and unlocks `LCACHE_LOCK`. **This erroneously sets the `lbmDONE` flag on the reused `bp`!**

5. **The Use-After-Free:**
   `lbmIOWait()` sees the `lbmDONE` flag, incorrectly assumes the WRITE bio has completed, and returns early. It then calls `lbmfree(bp)` to put it on the freelist. `lmLogShutdown()` subsequently calls `lbmLogShutdown()`, which frees the `bp` via `kfree()`.
   
   Later, the WRITE bio actually completes, and `lbmIODone()` is called on the freed `bp`. It attempts to read `bp->l_flag` (which is at offset 8 in `struct lbuf`), triggering the KASAN slab-use-after-free report.

### How to Fix

The fix is to replace the lockless `wait_event()` in `lbmRead()` with `lbmIOWait(bp, 0)`. 

`lbmIOWait()` uses `LCACHE_SLEEP_COND()`, which properly synchronizes with `lbmIODone()` by acquiring `LCACHE_LOCK` before checking the condition. This ensures `lbmRead()` will block on the spinlock and not return until `lbmIODone()` has completely finished and unlocked `LCACHE_LOCK`. 

As an added benefit, `lbmIOWait()` correctly returns `-EIO` if the bio completes with an error, whereas the current `lbmRead()` unconditionally returns `0`, ignoring I/O errors.

```c
--- a/fs/jfs/jfs_logmgr.c
+++ b/fs/jfs/jfs_logmgr.c
@@ -1984,9 +1984,7 @@ static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp)
 		submit_bio(bio);
 	}
 
-	wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));
-
-	return 0;
+	return lbmIOWait(bp, 0);
 }
```

I have applied the fix to replace the lockless `wait_event()` with `lbmIOWait(bp, 0)` in `lbmRead()`.

### What was done:
I edited `fs/jfs/jfs_logmgr.c` to modify `lbmRead()` as follows:
```c
@@ -1984,9 +1984,7 @@ static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp)
 		submit_bio(bio);
 	}
 
-	wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));
-
-	return 0;
+	return lbmIOWait(bp, 0);
 }
```

### Why this is the best fix:
1. **Proper Synchronization:** `lbmIOWait()` uses the `LCACHE_SLEEP_COND()` macro, which acquires the `LCACHE_LOCK` spinlock before checking the condition (`bp->l_flag & lbmDONE`). Since `lbmIODone()` sets the `lbmDONE` flag and unlocks `LCACHE_LOCK` at the very end of its execution, `lbmIOWait()` will block on the spinlock and wait until `lbmIODone()` has completely finished. This eliminates the race condition where `lbmRead()` returns early and the buffer is reused before `lbmIODone()` finishes modifying it.
2. **Error Handling Improvement:** The original `lbmRead()` implementation unconditionally returned `0` on completion, ignoring any I/O errors that might have occurred during the read operation. `lbmIOWait()` correctly checks for the `lbmERROR` flag and returns `-EIO` if the bio completed with an error. All callers of `lbmRead()` (such as `lmLogInit()`, `lmLogFileSystem()`, and `lmLogShutdown()`) already check the return value of `lbmRead()` and handle errors correctly (e.g., by jumping to error recovery labels), so this change improves the overall robustness of the JFS log manager without requiring any changes to the callers.
3. **Consistency:** Other functions that initiate I/O in the JFS log manager (like `lbmDirectWrite()` and `lbmWrite()` with the `lbmSYNC` flag) already use `lbmIOWait()` to wait for completion. Updating `lbmRead()` to use the same mechanism brings consistency to the codebase. I also verified that there are no other places in the file that misuse `wait_event()` on `bp->l_ioevent`.

gemini-3.1-pro-preview

							input: 9308
							output: 44
							thoughts: 306
						

**Analyzing a KASAN Slab-Use-After-Free in JFS Logging**

Okay, so I'm digging into this KASAN slab-use-after-free in the JFS logging code, specifically in `lbmIODone` within `fs/jfs/jfs_logmgr.c`. The root of the problem, as I see it, is a classic race condition between `lbmRead()` and `lbmIODone()`.  It hinges on how `lbmRead()` handles waiting for I/O completion.  It uses that `wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));` construct, which I immediately notice is lockless in its condition check.

That's where the trouble begins. `lbmIODone()` comes in, clears the `lbmREAD` flag, and wakes up the waiting process. *Then*, and this is crucial, it sets `lbmDONE` and releases the `LCACHE_LOCK`. Because the initial wait in `lbmRead()` is lockless, the function can actually return *before* `lbmIODone()` finishes its whole sequence. So the code returns from wait, and *then* the caller reuses `bp` for a WRITE bio. Now we have an issue, as `lbmIODone()` sets the `lbmDONE` flag on a `bp` that's effectively already been reallocated. This causes `lbmIOWait()` to return prematurely, freeing `bp` while a WRITE bio is still in flight. Then, when that WRITE bio completes, the call back to `lbmIODone()` hits a freed `bp`.

This use-after-free scenario.

The proposed solution - and I think it's spot on - is to replace the problematic `wait_event()` call in `lbmRead()` with `lbmIOWait(bp, 0)`. I need to compare `lbmRead()` and `lbmIOWait()` in `fs/jfs/jfs_logmgr.c` so I can understand the exact semantic difference and why this will resolve the issue. Let me dig into the code itself...

map[ContextFile:fs/jfs/jfs_logmgr.c IncludeLines:true Name:lbmRead]

map[SourceCode:1956:	/*
1957:	 *	lbmRead()
1958:	 */
1959:	static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp)
1960:	{
1961:		struct bio *bio;
1962:		struct lbuf *bp;
1963:	
1964:		/*
1965:		 * allocate a log buffer
1966:		 */
1967:		*bpp = bp = lbmAllocate(log, pn);
1968:		jfs_info("lbmRead: bp:0x%p pn:0x%x", bp, pn);
1969:	
1970:		bp->l_flag |= lbmREAD;
1971:	
1972:		bio = bio_alloc(file_bdev(log->bdev_file), 1, REQ_OP_READ, GFP_NOFS);
1973:		bio->bi_iter.bi_sector = bp->l_blkno << (log->l2bsize - 9);
1974:		__bio_add_page(bio, bp->l_page, LOGPSIZE, bp->l_offset);
1975:		BUG_ON(bio->bi_iter.bi_size != LOGPSIZE);
1976:	
1977:		bio->bi_end_io = lbmIODone;
1978:		bio->bi_private = bp;
1979:		/*check if journaling to disk has been disabled*/
1980:		if (log->no_integrity) {
1981:			bio->bi_iter.bi_size = 0;
1982:			lbmIODone(bio);
1983:		} else {
1984:			submit_bio(bio);
1985:		}
1986:	
1987:		wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));
1988:	
1989:		return 0;
1990:	}
 SourceFile:fs/jfs/jfs_logmgr.c]

gemini-3.1-pro-preview

							input: 10708
							output: 46
							thoughts: 14
						

Okay, let's dive into this.

**Examining `lbmIOWait()`**

Alright, I need to understand this `lbmIOWait()` function. I'm already pretty familiar with the overall system architecture, so let's see how this piece fits in. What specific I/O operations are being waited on here? Is this related to disk access, network latency, or something else entirely within the larger LBM (likely Large Broadcast Messaging) framework? I'm curious about the specific context this wait occurs in. What are the calling functions and what is the typical control flow? A deep understanding of these aspects would reveal where this becomes a potential bottleneck, and the data it accesses. Is it CPU-bound, or is the I/O truly the issue? What are the implications for overall latency and throughput if it's slow? I need to analyze this function within the broader context of the system's performance metrics and the LBM's stated goals. I'll need to check the surrounding code for any potential optimizations that might alleviate I/O contention. Let's dig in and figure out the specifics.

map[ContextFile:fs/jfs/jfs_logmgr.c IncludeLines:true Name:lbmIOWait]

map[SourceCode:2137:	/*
2138:	 *	lbmIOWait()
2139:	 */
2140:	static int lbmIOWait(struct lbuf * bp, int flag)
2141:	{
2142:		unsigned long flags;
2143:		int rc = 0;
2144:	
2145:		jfs_info("lbmIOWait1: bp:0x%p flag:0x%x:0x%x", bp, bp->l_flag, flag);
2146:	
2147:		LCACHE_LOCK(flags);		/* disable+lock */
2148:	
2149:		LCACHE_SLEEP_COND(bp->l_ioevent, (bp->l_flag & lbmDONE), flags);
2150:	
2151:		rc = (bp->l_flag & lbmERROR) ? -EIO : 0;
2152:	
2153:		if (flag & lbmFREE)
2154:			lbmfree(bp);
2155:	
2156:		LCACHE_UNLOCK(flags);	/* unlock+enable */
2157:	
2158:		jfs_info("lbmIOWait2: bp:0x%p flag:0x%x:0x%x", bp, bp->l_flag, flag);
2159:		return rc;
2160:	}
 SourceFile:fs/jfs/jfs_logmgr.c]

gemini-3.1-pro-preview

							input: 11419
							output: 45
							thoughts: 182
						

**Analyzing the lbm I/O Completion Flow**

Okay, so let's walk through this `lbm` I/O process. The core of it seems to be that `lbmIOWait` is waiting for the `lbmDONE` flag to be set. This is the crucial point. Now, looking at `lbmRead`, the `bp->l_flag` is initially set to `lbmREAD`. That makes sense. The real question is, how and when does this transition?

Ah, right, `lbmIODone`. Okay, it looks like `lbmIODone` is the key. Within `lbmIODone`, there's a conditional check: `if (bp->l_flag & lbmREAD)`. This confirms that when the I/O completes (potentially a read operation), if the `lbmREAD` flag is set... bingo, we're on the right track!

The crucial part is the code I see inside that conditional: It clears the `lbmREAD` flag, *then* it wakes up the I/O initiator through `LCACHE_WAKEUP`. And then, importantly, it immediately jumps to `out:`.

At `out:`, `bp->l_flag |= lbmDONE;` is the critical line. This sets the `lbmDONE` flag regardless of whether it was a read or write bios. `LCACHE_UNLOCK(flags)` unlocks and this completes the function.

So, *yes*, `lbmDONE` *is* indeed set for read BIOs as well, as part of the completion process. I was concerned about a race condition, but it looks like the synchronization is handled correctly. Now, I need to go deeper into `lbmIODone` itself to be sure there are no other issues.

map[ContextFile:fs/jfs/jfs_logmgr.c IncludeLines:true Name:lbmIODone]

map[SourceCode:2162:	/*
2163:	 *	lbmIODone()
2164:	 *
2165:	 * executed at INTIODONE level
2166:	 */
2167:	static void lbmIODone(struct bio *bio)
2168:	{
2169:		struct lbuf *bp = bio->bi_private;
2170:		struct lbuf *nextbp, *tail;
2171:		struct jfs_log *log;
2172:		unsigned long flags;
2173:	
2174:		/*
2175:		 * get back jfs buffer bound to the i/o buffer
2176:		 */
2177:		jfs_info("lbmIODone: bp:0x%p flag:0x%x", bp, bp->l_flag);
2178:	
2179:		LCACHE_LOCK(flags);		/* disable+lock */
2180:	
2181:		if (bio->bi_status) {
2182:			bp->l_flag |= lbmERROR;
2183:	
2184:			jfs_err("lbmIODone: I/O error in JFS log");
2185:		}
2186:	
2187:		bio_put(bio);
2188:	
2189:		/*
2190:		 *	pagein completion
2191:		 */
2192:		if (bp->l_flag & lbmREAD) {
2193:			bp->l_flag &= ~lbmREAD;
2194:	
2195:			/* wakeup I/O initiator */
2196:			LCACHE_WAKEUP(&bp->l_ioevent);
2197:	
2198:			goto out;
2199:		}
2200:	
2201:		/*
2202:		 *	pageout completion
2203:		 *
2204:		 * the bp at the head of write queue has completed pageout.
2205:		 *
2206:		 * if single-commit/full-page pageout, remove the current buffer
2207:		 * from head of pageout queue, and redrive pageout with
2208:		 * the new buffer at head of pageout queue;
2209:		 * otherwise, the partial-page pageout buffer stays at
2210:		 * the head of pageout queue to be redriven for pageout
2211:		 * by lmGroupCommit() until full-page pageout is completed.
2212:		 */
2213:		bp->l_flag &= ~lbmWRITE;
2214:		INCREMENT(lmStat.pagedone);
2215:	
2216:		/* update committed lsn */
2217:		log = bp->l_log;
2218:		log->clsn = (bp->l_pn << L2LOGPSIZE) + bp->l_ceor;
2219:	
2220:		if (bp->l_flag & lbmDIRECT) {
2221:			LCACHE_WAKEUP(&bp->l_ioevent);
2222:			goto out;
2223:		}
2224:	
2225:		tail = log->wqueue;
2226:	
2227:		/* single element queue */
2228:		if (bp == tail) {
2229:			/* remove head buffer of full-page pageout
2230:			 * from log device write queue
2231:			 */
2232:			if (bp->l_flag & lbmRELEASE) {
2233:				log->wqueue = NULL;
2234:				bp->l_wqnext = NULL;
2235:			}
2236:		}
2237:		/* multi element queue */
2238:		else {
2239:			/* remove head buffer of full-page pageout
2240:			 * from log device write queue
2241:			 */
2242:			if (bp->l_flag & lbmRELEASE) {
2243:				nextbp = tail->l_wqnext = bp->l_wqnext;
2244:				bp->l_wqnext = NULL;
2245:	
2246:				/*
2247:				 * redrive pageout of next page at head of write queue:
2248:				 * redrive next page without any bound tblk
2249:				 * (i.e., page w/o any COMMIT records), or
2250:				 * first page of new group commit which has been
2251:				 * queued after current page (subsequent pageout
2252:				 * is performed synchronously, except page without
2253:				 * any COMMITs) by lmGroupCommit() as indicated
2254:				 * by lbmWRITE flag;
2255:				 */
2256:				if (nextbp->l_flag & lbmWRITE) {
2257:					/*
2258:					 * We can't do the I/O at interrupt time.
2259:					 * The jfsIO thread can do it
2260:					 */
2261:					lbmRedrive(nextbp);
2262:				}
2263:			}
2264:		}
2265:	
2266:		/*
2267:		 *	synchronous pageout:
2268:		 *
2269:		 * buffer has not necessarily been removed from write queue
2270:		 * (e.g., synchronous write of partial-page with COMMIT):
2271:		 * leave buffer for i/o initiator to dispose
2272:		 */
2273:		if (bp->l_flag & lbmSYNC) {
2274:			/* wakeup I/O initiator */
2275:			LCACHE_WAKEUP(&bp->l_ioevent);
2276:		}
2277:	
2278:		/*
2279:		 *	Group Commit pageout:
2280:		 */
2281:		else if (bp->l_flag & lbmGC) {
2282:			LCACHE_UNLOCK(flags);
2283:			lmPostGC(bp);
2284:			LCACHE_LOCK(flags);		/* disable+lock */
2285:		}
2286:	
2287:		/*
2288:		 *	asynchronous pageout:
2289:		 *
2290:		 * buffer must have been removed from write queue:
2291:		 * insert buffer at head of freelist where it can be recycled
2292:		 */
2293:		else {
2294:			assert(bp->l_flag & lbmRELEASE);
2295:			assert(bp->l_flag & lbmFREE);
2296:			lbmfree(bp);
2297:		}
2298:	
2299:	out:
2300:		bp->l_flag |= lbmDONE;
2301:		LCACHE_UNLOCK(flags);
2302:	}
 SourceFile:fs/jfs/jfs_logmgr.c]

gemini-3.1-pro-preview

							input: 13957
							output: 22
							thoughts: 414
						

**Analyzing the Proposed JFS Log Manager Fix**

Okay, so I'm looking at this proposed patch for the JFS log manager. The original code used `wait_event` directly on `bp->l_ioevent` after submitting a bio. The change replaces that with a call to `lbmIOWait(bp, 0)`. My initial thought is to figure out the behavior change and if this resolves any potential issues.

First, I need to understand what `lbmIOWait` does. Right, it waits for `bp->l_flag` to have the `lbmDONE` bit set. The question is how that bit gets set, and when. Looking at the code, `lbmDONE` is indeed set by `lbmIODone`, right at the end. Okay, that makes sense.

So now, let's step through the logic. The key seems to be the order of operations. `lbmIODone` sets `lbmDONE`, *after* the I/O completion, and before unlocking the cache lock `LCACHE_UNLOCK`. Inside `lbmIOWait` will block on `LCACHE_SLEEP_COND` until `bp->l_flag & lbmDONE` is true. `lbmIOWait` acquires `LCACHE_LOCK` first, so the wait happens while the lock is already held. When `lbmIODone` is executed, the `lbmDONE` flag is set *after* the I/O is done. Thus, `lbmIOWait` will block until I/O finishes and `lbmDONE` is set. Furthermore, `lbmIODone` then unlocks `LCACHE_LOCK`. Consequently, `lbmIOWait` will correctly wait, since it locks the lock before checking the wait condition, thus the wait condition correctly reflects when `LCACHE_LOCK` is unlocked by `lbmIODone`. This ensures proper synchronization and prevents any race conditions that might have existed in the original `wait_event` call.

Now, to be really thorough, let's check for any other instances where `wait_event` is being used on `bp->l_ioevent` in this code base. This patch might resolve an issue, but we need to verify there aren't similar problematic usages elsewhere.

requested entity does not exist

map[Name:l_ioevent]

map[References:<nil> TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 14906
							output: 25
							thoughts: 17
						

Here's my attempt at summarizing the thought process, tailored for an expert audience and written in the first person:

**Decoding the `l_ioevent` Structure Member**

Okay, so I'm looking at this code and trying to get a handle on how this I/O is being handled. And then it hits me: *`l_ioevent`*. Wait a second, isn't that a field… yeah, that's right, that's a field within `struct lbuf`. I remember seeing that definition somewhere... Probably in the header files for the low level I/O stuff. Aha! That means the event handling, whatever it is, is *directly* associated with the `lbuf` structure, and therefore the buffer itself. It's not some separate structure, or global, or something passed around. That simplifies things a bit; I can focus my analysis on that particular struct definition and likely get most of what I need. Knowing that helps, because I can look at the code that works with `lbuf` and that gives me more information of what is going on.

map[Name:lbuf::l_ioevent]

map[References:[map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:lbmIODone SourceFile:fs/jfs/jfs_logmgr.c SourceLine:2196] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:lbmIODone SourceFile:fs/jfs/jfs_logmgr.c SourceLine:2221] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:lbmIODone SourceFile:fs/jfs/jfs_logmgr.c SourceLine:2275] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:lbmIOWait SourceFile:fs/jfs/jfs_logmgr.c SourceLine:2149] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:lbmIOWait SourceFile:fs/jfs/jfs_logmgr.c SourceLine:2149] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:lbmLogInit SourceFile:fs/jfs/jfs_logmgr.c SourceLine:1831] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:lbmRead SourceFile:fs/jfs/jfs_logmgr.c SourceLine:1987] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:lbmRead SourceFile:fs/jfs/jfs_logmgr.c SourceLine:1987]] TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 15662
							output: 48
							thoughts: 59
						

Okay, let's see what I'm thinking here...

**Decoding the IO Wait State**

Right, so I'm focusing on the `lbmRead` function – it's the only place I'm seeing a `wait_event` call directly operating on `l_ioevent`. Hold on, though... isn't `lbmIOWait` also using a sleep condition? Specifically, `LCACHE_SLEEP_COND`. I need to refresh my memory on what that macro represents. It's time to dig into the definition of `LCACHE_SLEEP_COND` and see how it fits into the broader I/O wait mechanism here. I need to understand the relationship between `l_ioevent` and `LCACHE_SLEEP_COND`.

requested entity does not exist

map[ContextFile:fs/jfs/jfs_logmgr.c IncludeLines:true Name:LCACHE_SLEEP_COND]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 15956
							output: 21
							thoughts: 14
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Analyzing the Code - Likely a Macro**

Alright, my initial instinct screams "macro" on this one. Given the context, the behavior likely hinges on a pre-processing or code generation step. So, before I start digging into the intricacies of whatever language this is, my first move is going to be to verify that suspicion. I'm going to reach for `grep` immediately. I'll need to pinpoint the name and definition with precision. A quick search of the codebase, ideally scoped to the relevant files, will give me a very high probability of identifying the potential macro. That should give me a solid starting point for deeper analysis.

map[Expression:LCACHE_SLEEP_COND]

map[Output:fs/jfs/jfs_logmgr.c=102=static DEFINE_SPINLOCK(jfsLCacheLock);
--
fs/jfs/jfs_logmgr.c-109- */
fs/jfs/jfs_logmgr.c:110:#define LCACHE_SLEEP_COND(wq, cond, flags)	\
fs/jfs/jfs_logmgr.c-111-do {						\
--
fs/jfs/jfs_logmgr.c=1873=static struct lbuf *lbmAllocate(struct jfs_log * log, int pn)
--
fs/jfs/jfs_logmgr.c-1881-	LCACHE_LOCK(flags);
fs/jfs/jfs_logmgr.c:1882:	LCACHE_SLEEP_COND(log->free_wait, (bp = log->lbuf_free), flags);
fs/jfs/jfs_logmgr.c-1883-	log->lbuf_free = bp->l_freelist;
--
fs/jfs/jfs_logmgr.c=2140=static int lbmIOWait(struct lbuf * bp, int flag)
--
fs/jfs/jfs_logmgr.c-2148-
fs/jfs/jfs_logmgr.c:2149:	LCACHE_SLEEP_COND(bp->l_ioevent, (bp->l_flag & lbmDONE), flags);
fs/jfs/jfs_logmgr.c-2150-
]

gemini-3.1-pro-preview

							input: 16540
							output: 22
							thoughts: 16
						

Here's my attempt at summarizing the thought process, tailored for an expert audience:

**Analyzing the `LCACHE_SLEEP_COND` Definition**

Okay, so I'm looking at `LCACHE_SLEEP_COND`. My initial instinct is to dig into its definition, see precisely what this macro represents. Is it a conditional variable related to the lcache subsystem? Likely, given the name. I'm assuming it's probably designed to allow threads waiting on lcache resources to sleep efficiently. I want to confirm whether it uses a standard kernel primitive (like `pthread_cond_t` or something more specialized to the OS). The key is to understand the synchronization mechanism here. I need to figure out:

*   **What resource is it protecting?** Is this related to memory management within the lcache, some form of lock on an entry, or something else entirely?
*   **What are the wait and signal semantics?** Are we dealing with broadcast or signal, and what's the expected usage pattern? If it's a broadcast, I'll need to double check any potential wakeup-thundering herd problems.
*   **How is it being used in conjunction with other primitives?** I'm expecting this `LCACHE_SLEEP_COND` is paired with a mutex. I'll probably be looking for the corresponding lock/unlock operations as well to see how contention is being handled. This is key for understanding the critical sections protected by the sleep condition.
*   **What are any specific OS-dependent implementation details?** I might be looking for any OS-specific primitives if this isn't a simple POSIX implementation of a condition variable. I'll need to check the OS-specific header files if any.

I need the exact definition. That will tell me everything I need to know about the wait/wakeup mechanism.

map[Expression:define LCACHE_SLEEP_COND]

map[Output:fs/jfs/jfs_logmgr.c=102=static DEFINE_SPINLOCK(jfsLCacheLock);
--
fs/jfs/jfs_logmgr.c-109- */
fs/jfs/jfs_logmgr.c:110:#define LCACHE_SLEEP_COND(wq, cond, flags)	\
fs/jfs/jfs_logmgr.c-111-do {						\
]

gemini-3.1-pro-preview

							input: 17090
							output: 21
							thoughts: 28
						

Okay, let's dive into this. Here's my take on those lines from `fs/jfs/jfs_logmgr.c`, considering I'm trying to grok what's happening.

**Analyzing JFS Log Manager's Core Operation: Lines 110-120**

Alright, I'm focusing in on lines 110-120 of the `jfs_logmgr.c` file. Given my expertise, I'm expecting this section to touch upon some fundamental aspect of the JFS log management. I'm guessing this might be related to a critical operation, perhaps managing transaction commits, log buffer allocation/deallocation, or the handling of log data structures. I need to understand this to have a deeper comprehension of how the file system maintains its consistency guarantees. I'm looking for the essential steps or checks carried out, specifically the interactions with the logging system that are being performed in this scope of the code. Is it reading, writing, or flushing? Are any critical data structures accessed or updated? I'm hoping to quickly identify the crucial logic flow here to get a sense of its efficiency and potential bottlenecks or vulnerabilities.

map[Expression:LCACHE_SLEEP_COND]

map[Output:fs/jfs/jfs_logmgr.c=102=static DEFINE_SPINLOCK(jfsLCacheLock);
--
fs/jfs/jfs_logmgr.c-109- */
fs/jfs/jfs_logmgr.c:110:#define LCACHE_SLEEP_COND(wq, cond, flags)	\
fs/jfs/jfs_logmgr.c-111-do {						\
--
fs/jfs/jfs_logmgr.c=1873=static struct lbuf *lbmAllocate(struct jfs_log * log, int pn)
--
fs/jfs/jfs_logmgr.c-1881-	LCACHE_LOCK(flags);
fs/jfs/jfs_logmgr.c:1882:	LCACHE_SLEEP_COND(log->free_wait, (bp = log->lbuf_free), flags);
fs/jfs/jfs_logmgr.c-1883-	log->lbuf_free = bp->l_freelist;
--
fs/jfs/jfs_logmgr.c=2140=static int lbmIOWait(struct lbuf * bp, int flag)
--
fs/jfs/jfs_logmgr.c-2148-
fs/jfs/jfs_logmgr.c:2149:	LCACHE_SLEEP_COND(bp->l_ioevent, (bp->l_flag & lbmDONE), flags);
fs/jfs/jfs_logmgr.c-2150-
]

gemini-3.1-pro-preview

							input: 17786
							output: 27
							thoughts: 10
						

Okay, here's my attempt at summarizing the thought process, tailored for an expert audience, and delivered in the first person:

**Analyzing the Macro's Context**

Hold on a minute. I need to take a step back and get the bigger picture. I'm used to analyzing the core logic, but without seeing the entire macro, I'm working with a major blind spot. Knowing the specific context, like input variables, target environments, and the macro's ultimate purpose, is going to dramatically shape how I approach this. Before I even begin to formulate ideas on its structure and possible optimization I need to understand what this macro is intended to do. It's tough to make any real assumptions or provide helpful insights without that. I can't start diagnosing or offering solutions until I can see the forest *and* the trees, in this case, the specific code and the way in which it is used. I'll need a comprehensive view of the entire thing before I can give a really solid analysis.

map[File:fs/jfs/jfs_logmgr.c]

map[Contents:// SPDX-License-Identifier: GPL-2.0-or-later
/*
 *   Copyright (C) International Business Machines Corp., 2000-2004
 *   Portions Copyright (C) Christoph Hellwig, 2001-2002
 */

/*
 *	jfs_logmgr.c: log manager
 *
 * for related information, see transaction manager (jfs_txnmgr.c), and
 * recovery manager (jfs_logredo.c).
 *
 * note: for detail, RTFS.
 *
 *	log buffer manager:
 * special purpose buffer manager supporting log i/o requirements.
 * per log serial pageout of logpage
 * queuing i/o requests and redrive i/o at iodone
 * maintain current logpage buffer
 * no caching since append only
 * appropriate jfs buffer cache buffers as needed
 *
 *	group commit:
 * transactions which wrote COMMIT records in the same in-memory
 * log page during the pageout of previous/current log page(s) are
 * committed together by the pageout of the page.
 *
 *	TBD lazy commit:
 * transactions are committed asynchronously when the log page
 * containing it COMMIT is paged out when it becomes full;
 *
 *	serialization:
 * . a per log lock serialize log write.
 * . a per log lock serialize group commit.
 * . a per log lock serialize log open/close;
 *
 *	TBD log integrity:
 * careful-write (ping-pong) of last logpage to recover from crash
 * in overwrite.
 * detection of split (out-of-order) write of physical sectors
 * of last logpage via timestamp at end of each sector
 * with its mirror data array at trailer).
 *
 *	alternatives:
 * lsn - 64-bit monotonically increasing integer vs
 * 32-bit lspn and page eor.
 */

#include <linux/fs.h>
#include <linux/blkdev.h>
#include <linux/interrupt.h>
#include <linux/completion.h>
#include <linux/kthread.h>
#include <linux/buffer_head.h>		/* for sync_blockdev() */
#include <linux/bio.h>
#include <linux/freezer.h>
#include <linux/export.h>
#include <linux/delay.h>
#include <linux/mutex.h>
#include <linux/seq_file.h>
#include <linux/slab.h>
#include "jfs_incore.h"
#include "jfs_filsys.h"
#include "jfs_metapage.h"
#include "jfs_superblock.h"
#include "jfs_txnmgr.h"
#include "jfs_debug.h"


/*
 * lbuf's ready to be redriven.  Protected by log_redrive_lock (jfsIO thread)
 */
static struct lbuf *log_redrive_list;
static DEFINE_SPINLOCK(log_redrive_lock);




/*
 *	log group commit serialization (per log)
 */

#define LOGGC_LOCK_INIT(log)	spin_lock_init(&(log)->gclock)
#define LOGGC_LOCK(log)		spin_lock_irq(&(log)->gclock)
#define LOGGC_UNLOCK(log)	spin_unlock_irq(&(log)->gclock)
#define LOGGC_WAKEUP(tblk)	wake_up_all(&(tblk)->gcwait)

/*
 *	log sync serialization (per log)
 */
#define	LOGSYNC_DELTA(logsize)		min((logsize)/8, 128*LOGPSIZE)
#define	LOGSYNC_BARRIER(logsize)	((logsize)/4)
/*
#define	LOGSYNC_DELTA(logsize)		min((logsize)/4, 256*LOGPSIZE)
#define	LOGSYNC_BARRIER(logsize)	((logsize)/2)
*/


/*
 *	log buffer cache synchronization
 */
static DEFINE_SPINLOCK(jfsLCacheLock);

#define	LCACHE_LOCK(flags)	spin_lock_irqsave(&jfsLCacheLock, flags)
#define	LCACHE_UNLOCK(flags)	spin_unlock_irqrestore(&jfsLCacheLock, flags)

/*
 * See __SLEEP_COND in jfs_locks.h
 */
#define LCACHE_SLEEP_COND(wq, cond, flags)	\
do {						\
	if (cond)				\
		break;				\
	__SLEEP_COND(wq, cond, LCACHE_LOCK(flags), LCACHE_UNLOCK(flags)); \
} while (0)

#define	LCACHE_WAKEUP(event)	wake_up(event)


/*
 *	lbuf buffer cache (lCache) control
 */
/* log buffer manager pageout control (cumulative, inclusive) */
#define	lbmREAD		0x0001
#define	lbmWRITE	0x0002	/* enqueue at tail of write queue;
				 * init pageout if at head of queue;
				 */
#define	lbmRELEASE	0x0004	/* remove from write queue
				 * at completion of pageout;
				 * do not free/recycle it yet:
				 * caller will free it;
				 */
#define	lbmSYNC		0x0008	/* do not return to freelist
				 * when removed from write queue;
				 */
#define lbmFREE		0x0010	/* return to freelist
				 * at completion of pageout;
				 * the buffer may be recycled;
				 */
#define	lbmDONE		0x0020
#define	lbmERROR	0x0040
#define lbmGC		0x0080	/* lbmIODone to perform post-GC processing
				 * of log page
				 */
#define lbmDIRECT	0x0100

/*
 * Global list of active external journals
 */
static LIST_HEAD(jfs_external_logs);
static struct jfs_log *dummy_log;
static DEFINE_MUTEX(jfs_log_mutex);

/*
 * forward references
 */
static int lmWriteRecord(struct jfs_log * log, struct tblock * tblk,
			 struct lrd * lrd, struct tlock * tlck);

static int lmNextPage(struct jfs_log * log);
static int lmLogFileSystem(struct jfs_log * log, struct jfs_sb_info *sbi,
			   int activate);

static int open_inline_log(struct super_block *sb);
static int open_dummy_log(struct super_block *sb);
static int lbmLogInit(struct jfs_log * log);
static void lbmLogShutdown(struct jfs_log * log);
static struct lbuf *lbmAllocate(struct jfs_log * log, int);
static void lbmFree(struct lbuf * bp);
static void lbmfree(struct lbuf * bp);
static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp);
static void lbmWrite(struct jfs_log * log, struct lbuf * bp, int flag, int cant_block);
static void lbmDirectWrite(struct jfs_log * log, struct lbuf * bp, int flag);
static int lbmIOWait(struct lbuf * bp, int flag);
static bio_end_io_t lbmIODone;
static void lbmStartIO(struct lbuf * bp);
static void lmGCwrite(struct jfs_log * log, int cant_block);
static int lmLogSync(struct jfs_log * log, int hard_sync);



/*
 *	statistics
 */
#ifdef CONFIG_JFS_STATISTICS
static struct lmStat {
	uint commit;		/* # of commit */
	uint pagedone;		/* # of page written */
	uint submitted;		/* # of pages submitted */
	uint full_page;		/* # of full pages submitted */
	uint partial_page;	/* # of partial pages submitted */
} lmStat;
#endif

static void write_special_inodes(struct jfs_log *log,
				 int (*writer)(struct address_space *))
{
	struct jfs_sb_info *sbi;

	list_for_each_entry(sbi, &log->sb_list, log_list) {
		/* These pointers can be NULL before list_del during umount */
		if (sbi->ipbmap)
			writer(sbi->ipbmap->i_mapping);
		if (sbi->ipimap)
			writer(sbi->ipimap->i_mapping);
		if (sbi->direct_inode)
			writer(sbi->direct_inode->i_mapping);
	}
}

/*
 * NAME:	lmLog()
 *
 * FUNCTION:	write a log record;
 *
 * PARAMETER:
 *
 * RETURN:	lsn - offset to the next log record to write (end-of-log);
 *		-1  - error;
 *
 * note: todo: log error handler
 */
int lmLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
	  struct tlock * tlck)
{
	int lsn;
	int diffp, difft;
	struct metapage *mp = NULL;
	unsigned long flags;

	jfs_info("lmLog: log:0x%p tblk:0x%p, lrd:0x%p tlck:0x%p",
		 log, tblk, lrd, tlck);

	LOG_LOCK(log);

	/* log by (out-of-transaction) JFS ? */
	if (tblk == NULL)
		goto writeRecord;

	/* log from page ? */
	if (tlck == NULL ||
	    tlck->type & tlckBTROOT || (mp = tlck->mp) == NULL)
		goto writeRecord;

	/*
	 *	initialize/update page/transaction recovery lsn
	 */
	lsn = log->lsn;

	LOGSYNC_LOCK(log, flags);

	/*
	 * initialize page lsn if first log write of the page
	 */
	if (mp->lsn == 0) {
		mp->log = log;
		mp->lsn = lsn;
		log->count++;

		/* insert page at tail of logsynclist */
		list_add_tail(&mp->synclist, &log->synclist);
	}

	/*
	 *	initialize/update lsn of tblock of the page
	 *
	 * transaction inherits oldest lsn of pages associated
	 * with allocation/deallocation of resources (their
	 * log records are used to reconstruct allocation map
	 * at recovery time: inode for inode allocation map,
	 * B+-tree index of extent descriptors for block
	 * allocation map);
	 * allocation map pages inherit transaction lsn at
	 * commit time to allow forwarding log syncpt past log
	 * records associated with allocation/deallocation of
	 * resources only after persistent map of these map pages
	 * have been updated and propagated to home.
	 */
	/*
	 * initialize transaction lsn:
	 */
	if (tblk->lsn == 0) {
		/* inherit lsn of its first page logged */
		tblk->lsn = mp->lsn;
		log->count++;

		/* insert tblock after the page on logsynclist */
		list_add(&tblk->synclist, &mp->synclist);
	}
	/*
	 * update transaction lsn:
	 */
	else {
		/* inherit oldest/smallest lsn of page */
		logdiff(diffp, mp->lsn, log);
		logdiff(difft, tblk->lsn, log);
		if (diffp < difft) {
			/* update tblock lsn with page lsn */
			tblk->lsn = mp->lsn;

			/* move tblock after page on logsynclist */
			list_move(&tblk->synclist, &mp->synclist);
		}
	}

	LOGSYNC_UNLOCK(log, flags);

	/*
	 *	write the log record
	 */
      writeRecord:
	lsn = lmWriteRecord(log, tblk, lrd, tlck);

	/*
	 * forward log syncpt if log reached next syncpt trigger
	 */
	logdiff(diffp, lsn, log);
	if (diffp >= log->nextsync)
		lsn = lmLogSync(log, 0);

	/* update end-of-log lsn */
	log->lsn = lsn;

	LOG_UNLOCK(log);

	/* return end-of-log address */
	return lsn;
}

/*
 * NAME:	lmWriteRecord()
 *
 * FUNCTION:	move the log record to current log page
 *
 * PARAMETER:	cd	- commit descriptor
 *
 * RETURN:	end-of-log address
 *
 * serialization: LOG_LOCK() held on entry/exit
 */
static int
lmWriteRecord(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
	      struct tlock * tlck)
{
	int lsn = 0;		/* end-of-log address */
	struct lbuf *bp;	/* dst log page buffer */
	struct logpage *lp;	/* dst log page */
	caddr_t dst;		/* destination address in log page */
	int dstoffset;		/* end-of-log offset in log page */
	int freespace;		/* free space in log page */
	caddr_t p;		/* src meta-data page */
	caddr_t src;
	int srclen;
	int nbytes;		/* number of bytes to move */
	int i;
	int len;
	struct linelock *linelock;
	struct lv *lv;
	struct lvd *lvd;
	int l2linesize;

	len = 0;

	/* retrieve destination log page to write */
	bp = (struct lbuf *) log->bp;
	lp = (struct logpage *) bp->l_ldata;
	dstoffset = log->eor;

	/* any log data to write ? */
	if (tlck == NULL)
		goto moveLrd;

	/*
	 *	move log record data
	 */
	/* retrieve source meta-data page to log */
	if (tlck->flag & tlckPAGELOCK) {
		p = (caddr_t) (tlck->mp->data);
		linelock = (struct linelock *) & tlck->lock;
	}
	/* retrieve source in-memory inode to log */
	else if (tlck->flag & tlckINODELOCK) {
		if (tlck->type & tlckDTREE)
			p = (caddr_t) &JFS_IP(tlck->ip)->i_dtroot;
		else
			p = (caddr_t) &JFS_IP(tlck->ip)->i_xtroot;
		linelock = (struct linelock *) & tlck->lock;
	}
	else {
		jfs_err("lmWriteRecord: UFO tlck:0x%p", tlck);
		return 0;	/* Probably should trap */
	}
	l2linesize = linelock->l2linesize;

      moveData:
	ASSERT(linelock->index <= linelock->maxcnt);

	lv = linelock->lv;
	for (i = 0; i < linelock->index; i++, lv++) {
		if (lv->length == 0)
			continue;

		/* is page full ? */
		if (dstoffset >= LOGPSIZE - LOGPTLRSIZE) {
			/* page become full: move on to next page */
			lmNextPage(log);

			bp = log->bp;
			lp = (struct logpage *) bp->l_ldata;
			dstoffset = LOGPHDRSIZE;
		}

		/*
		 * move log vector data
		 */
		src = (u8 *) p + (lv->offset << l2linesize);
		srclen = lv->length << l2linesize;
		len += srclen;
		while (srclen > 0) {
			freespace = (LOGPSIZE - LOGPTLRSIZE) - dstoffset;
			nbytes = min(freespace, srclen);
			dst = (caddr_t) lp + dstoffset;
			memcpy(dst, src, nbytes);
			dstoffset += nbytes;

			/* is page not full ? */
			if (dstoffset < LOGPSIZE - LOGPTLRSIZE)
				break;

			/* page become full: move on to next page */
			lmNextPage(log);

			bp = (struct lbuf *) log->bp;
			lp = (struct logpage *) bp->l_ldata;
			dstoffset = LOGPHDRSIZE;

			srclen -= nbytes;
			src += nbytes;
		}

		/*
		 * move log vector descriptor
		 */
		len += 4;
		lvd = (struct lvd *) ((caddr_t) lp + dstoffset);
		lvd->offset = cpu_to_le16(lv->offset);
		lvd->length = cpu_to_le16(lv->length);
		dstoffset += 4;
		jfs_info("lmWriteRecord: lv offset:%d length:%d",
			 lv->offset, lv->length);
	}

	if ((i = linelock->next)) {
		linelock = (struct linelock *) lid_to_tlock(i);
		goto moveData;
	}

	/*
	 *	move log record descriptor
	 */
      moveLrd:
	lrd->length = cpu_to_le16(len);

	src = (caddr_t) lrd;
	srclen = LOGRDSIZE;

	while (srclen > 0) {
		freespace = (LOGPSIZE - LOGPTLRSIZE) - dstoffset;
		nbytes = min(freespace, srclen);
		dst = (caddr_t) lp + dstoffset;
		memcpy(dst, src, nbytes);

		dstoffset += nbytes;
		srclen -= nbytes;

		/* are there more to move than freespace of page ? */
		if (srclen)
			goto pageFull;

		/*
		 * end of log record descriptor
		 */

		/* update last log record eor */
		log->eor = dstoffset;
		bp->l_eor = dstoffset;
		lsn = (log->page << L2LOGPSIZE) + dstoffset;

		if (lrd->type & cpu_to_le16(LOG_COMMIT)) {
			tblk->clsn = lsn;
			jfs_info("wr: tclsn:0x%x, beor:0x%x", tblk->clsn,
				 bp->l_eor);

			INCREMENT(lmStat.commit);	/* # of commit */

			/*
			 * enqueue tblock for group commit:
			 *
			 * enqueue tblock of non-trivial/synchronous COMMIT
			 * at tail of group commit queue
			 * (trivial/asynchronous COMMITs are ignored by
			 * group commit.)
			 */
			LOGGC_LOCK(log);

			/* init tblock gc state */
			tblk->flag = tblkGC_QUEUE;
			tblk->bp = log->bp;
			tblk->pn = log->page;
			tblk->eor = log->eor;

			/* enqueue transaction to commit queue */
			list_add_tail(&tblk->cqueue, &log->cqueue);

			LOGGC_UNLOCK(log);
		}

		jfs_info("lmWriteRecord: lrd:0x%04x bp:0x%p pn:%d eor:0x%x",
			le16_to_cpu(lrd->type), log->bp, log->page, dstoffset);

		/* page not full ? */
		if (dstoffset < LOGPSIZE - LOGPTLRSIZE)
			return lsn;

	      pageFull:
		/* page become full: move on to next page */
		lmNextPage(log);

		bp = (struct lbuf *) log->bp;
		lp = (struct logpage *) bp->l_ldata;
		dstoffset = LOGPHDRSIZE;
		src += nbytes;
	}

	return lsn;
}


/*
 * NAME:	lmNextPage()
 *
 * FUNCTION:	write current page and allocate next page.
 *
 * PARAMETER:	log
 *
 * RETURN:	0
 *
 * serialization: LOG_LOCK() held on entry/exit
 */
static int lmNextPage(struct jfs_log * log)
{
	struct logpage *lp;
	int lspn;		/* log sequence page number */
	int pn;			/* current page number */
	struct lbuf *bp;
	struct lbuf *nextbp;
	struct tblock *tblk;

	/* get current log page number and log sequence page number */
	pn = log->page;
	bp = log->bp;
	lp = (struct logpage *) bp->l_ldata;
	lspn = le32_to_cpu(lp->h.page);

	LOGGC_LOCK(log);

	/*
	 *	write or queue the full page at the tail of write queue
	 */
	/* get the tail tblk on commit queue */
	if (list_empty(&log->cqueue))
		tblk = NULL;
	else
		tblk = list_entry(log->cqueue.prev, struct tblock, cqueue);

	/* every tblk who has COMMIT record on the current page,
	 * and has not been committed, must be on commit queue
	 * since tblk is queued at commit queueu at the time
	 * of writing its COMMIT record on the page before
	 * page becomes full (even though the tblk thread
	 * who wrote COMMIT record may have been suspended
	 * currently);
	 */

	/* is page bound with outstanding tail tblk ? */
	if (tblk && tblk->pn == pn) {
		/* mark tblk for end-of-page */
		tblk->flag |= tblkGC_EOP;

		if (log->cflag & logGC_PAGEOUT) {
			/* if page is not already on write queue,
			 * just enqueue (no lbmWRITE to prevent redrive)
			 * buffer to wqueue to ensure correct serial order
			 * of the pages since log pages will be added
			 * continuously
			 */
			if (bp->l_wqnext == NULL)
				lbmWrite(log, bp, 0, 0);
		} else {
			/*
			 * No current GC leader, initiate group commit
			 */
			log->cflag |= logGC_PAGEOUT;
			lmGCwrite(log, 0);
		}
	}
	/* page is not bound with outstanding tblk:
	 * init write or mark it to be redriven (lbmWRITE)
	 */
	else {
		/* finalize the page */
		bp->l_ceor = bp->l_eor;
		lp->h.eor = lp->t.eor = cpu_to_le16(bp->l_ceor);
		lbmWrite(log, bp, lbmWRITE | lbmRELEASE | lbmFREE, 0);
	}
	LOGGC_UNLOCK(log);

	/*
	 *	allocate/initialize next page
	 */
	/* if log wraps, the first data page of log is 2
	 * (0 never used, 1 is superblock).
	 */
	log->page = (pn == log->size - 1) ? 2 : pn + 1;
	log->eor = LOGPHDRSIZE;	/* ? valid page empty/full at logRedo() */

	/* allocate/initialize next log page buffer */
	nextbp = lbmAllocate(log, log->page);
	nextbp->l_eor = log->eor;
	log->bp = nextbp;

	/* initialize next log page */
	lp = (struct logpage *) nextbp->l_ldata;
	lp->h.page = lp->t.page = cpu_to_le32(lspn + 1);
	lp->h.eor = lp->t.eor = cpu_to_le16(LOGPHDRSIZE);

	return 0;
}


/*
 * NAME:	lmGroupCommit()
 *
 * FUNCTION:	group commit
 *	initiate pageout of the pages with COMMIT in the order of
 *	page number - redrive pageout of the page at the head of
 *	pageout queue until full page has been written.
 *
 * RETURN:
 *
 * NOTE:
 *	LOGGC_LOCK serializes log group commit queue, and
 *	transaction blocks on the commit queue.
 *	N.B. LOG_LOCK is NOT held during lmGroupCommit().
 */
int lmGroupCommit(struct jfs_log * log, struct tblock * tblk)
{
	int rc = 0;

	LOGGC_LOCK(log);

	/* group committed already ? */
	if (tblk->flag & tblkGC_COMMITTED) {
		if (tblk->flag & tblkGC_ERROR)
			rc = -EIO;

		LOGGC_UNLOCK(log);
		return rc;
	}
	jfs_info("lmGroup Commit: tblk = 0x%p, gcrtc = %d", tblk, log->gcrtc);

	if (tblk->xflag & COMMIT_LAZY)
		tblk->flag |= tblkGC_LAZY;

	if ((!(log->cflag & logGC_PAGEOUT)) && (!list_empty(&log->cqueue)) &&
	    (!(tblk->xflag & COMMIT_LAZY) || test_bit(log_FLUSH, &log->flag)
	     || jfs_tlocks_low)) {
		/*
		 * No pageout in progress
		 *
		 * start group commit as its group leader.
		 */
		log->cflag |= logGC_PAGEOUT;

		lmGCwrite(log, 0);
	}

	if (tblk->xflag & COMMIT_LAZY) {
		/*
		 * Lazy transactions can leave now
		 */
		LOGGC_UNLOCK(log);
		return 0;
	}

	/* lmGCwrite gives up LOGGC_LOCK, check again */

	if (tblk->flag & tblkGC_COMMITTED) {
		if (tblk->flag & tblkGC_ERROR)
			rc = -EIO;

		LOGGC_UNLOCK(log);
		return rc;
	}

	/* upcount transaction waiting for completion
	 */
	log->gcrtc++;
	tblk->flag |= tblkGC_READY;

	__SLEEP_COND(tblk->gcwait, (tblk->flag & tblkGC_COMMITTED),
		     LOGGC_LOCK(log), LOGGC_UNLOCK(log));

	/* removed from commit queue */
	if (tblk->flag & tblkGC_ERROR)
		rc = -EIO;

	LOGGC_UNLOCK(log);
	return rc;
}

/*
 * NAME:	lmGCwrite()
 *
 * FUNCTION:	group commit write
 *	initiate write of log page, building a group of all transactions
 *	with commit records on that page.
 *
 * RETURN:	None
 *
 * NOTE:
 *	LOGGC_LOCK must be held by caller.
 *	N.B. LOG_LOCK is NOT held during lmGroupCommit().
 */
static void lmGCwrite(struct jfs_log * log, int cant_write)
{
	struct lbuf *bp;
	struct logpage *lp;
	int gcpn;		/* group commit page number */
	struct tblock *tblk;
	struct tblock *xtblk = NULL;

	/*
	 * build the commit group of a log page
	 *
	 * scan commit queue and make a commit group of all
	 * transactions with COMMIT records on the same log page.
	 */
	/* get the head tblk on the commit queue */
	gcpn = list_entry(log->cqueue.next, struct tblock, cqueue)->pn;

	list_for_each_entry(tblk, &log->cqueue, cqueue) {
		if (tblk->pn != gcpn)
			break;

		xtblk = tblk;

		/* state transition: (QUEUE, READY) -> COMMIT */
		tblk->flag |= tblkGC_COMMIT;
	}
	tblk = xtblk;		/* last tblk of the page */

	/*
	 * pageout to commit transactions on the log page.
	 */
	bp = (struct lbuf *) tblk->bp;
	lp = (struct logpage *) bp->l_ldata;
	/* is page already full ? */
	if (tblk->flag & tblkGC_EOP) {
		/* mark page to free at end of group commit of the page */
		tblk->flag &= ~tblkGC_EOP;
		tblk->flag |= tblkGC_FREE;
		bp->l_ceor = bp->l_eor;
		lp->h.eor = lp->t.eor = cpu_to_le16(bp->l_ceor);
		lbmWrite(log, bp, lbmWRITE | lbmRELEASE | lbmGC,
			 cant_write);
		INCREMENT(lmStat.full_page);
	}
	/* page is not yet full */
	else {
		bp->l_ceor = tblk->eor;	/* ? bp->l_ceor = bp->l_eor; */
		lp->h.eor = lp->t.eor = cpu_to_le16(bp->l_ceor);
		lbmWrite(log, bp, lbmWRITE | lbmGC, cant_write);
		INCREMENT(lmStat.partial_page);
	}
}

/*
 * NAME:	lmPostGC()
 *
 * FUNCTION:	group commit post-processing
 *	Processes transactions after their commit records have been written
 *	to disk, redriving log I/O if necessary.
 *
 * RETURN:	None
 *
 * NOTE:
 *	This routine is called a interrupt time by lbmIODone
 */
static void lmPostGC(struct lbuf * bp)
{
	unsigned long flags;
	struct jfs_log *log = bp->l_log;
	struct logpage *lp;
	struct tblock *tblk, *temp;

	//LOGGC_LOCK(log);
	spin_lock_irqsave(&log->gclock, flags);
	/*
	 * current pageout of group commit completed.
	 *
	 * remove/wakeup transactions from commit queue who were
	 * group committed with the current log page
	 */
	list_for_each_entry_safe(tblk, temp, &log->cqueue, cqueue) {
		if (!(tblk->flag & tblkGC_COMMIT))
			break;
		/* if transaction was marked GC_COMMIT then
		 * it has been shipped in the current pageout
		 * and made it to disk - it is committed.
		 */

		if (bp->l_flag & lbmERROR)
			tblk->flag |= tblkGC_ERROR;

		/* remove it from the commit queue */
		list_del(&tblk->cqueue);
		tblk->flag &= ~tblkGC_QUEUE;

		if (tblk == log->flush_tblk) {
			/* we can stop flushing the log now */
			clear_bit(log_FLUSH, &log->flag);
			log->flush_tblk = NULL;
		}

		jfs_info("lmPostGC: tblk = 0x%p, flag = 0x%x", tblk,
			 tblk->flag);

		if (!(tblk->xflag & COMMIT_FORCE))
			/*
			 * Hand tblk over to lazy commit thread
			 */
			txLazyUnlock(tblk);
		else {
			/* state transition: COMMIT -> COMMITTED */
			tblk->flag |= tblkGC_COMMITTED;

			if (tblk->flag & tblkGC_READY)
				log->gcrtc--;

			LOGGC_WAKEUP(tblk);
		}

		/* was page full before pageout ?
		 * (and this is the last tblk bound with the page)
		 */
		if (tblk->flag & tblkGC_FREE)
			lbmFree(bp);
		/* did page become full after pageout ?
		 * (and this is the last tblk bound with the page)
		 */
		else if (tblk->flag & tblkGC_EOP) {
			/* finalize the page */
			lp = (struct logpage *) bp->l_ldata;
			bp->l_ceor = bp->l_eor;
			lp->h.eor = lp->t.eor = cpu_to_le16(bp->l_eor);
			jfs_info("lmPostGC: calling lbmWrite");
			lbmWrite(log, bp, lbmWRITE | lbmRELEASE | lbmFREE,
				 1);
		}

	}

	/* are there any transactions who have entered lnGroupCommit()
	 * (whose COMMITs are after that of the last log page written.
	 * They are waiting for new group commit (above at (SLEEP 1))
	 * or lazy transactions are on a full (queued) log page,
	 * select the latest ready transaction as new group leader and
	 * wake her up to lead her group.
	 */
	if ((!list_empty(&log->cqueue)) &&
	    ((log->gcrtc > 0) || (tblk->bp->l_wqnext != NULL) ||
	     test_bit(log_FLUSH, &log->flag) || jfs_tlocks_low))
		/*
		 * Call lmGCwrite with new group leader
		 */
		lmGCwrite(log, 1);

	/* no transaction are ready yet (transactions are only just
	 * queued (GC_QUEUE) and not entered for group commit yet).
	 * the first transaction entering group commit
	 * will elect herself as new group leader.
	 */
	else
		log->cflag &= ~logGC_PAGEOUT;

	//LOGGC_UNLOCK(log);
	spin_unlock_irqrestore(&log->gclock, flags);
	return;
}

/*
 * NAME:	lmLogSync()
 *
 * FUNCTION:	write log SYNCPT record for specified log
 *	if new sync address is available
 *	(normally the case if sync() is executed by back-ground
 *	process).
 *	calculate new value of i_nextsync which determines when
 *	this code is called again.
 *
 * PARAMETERS:	log	- log structure
 *		hard_sync - 1 to force all metadata to be written
 *
 * RETURN:	0
 *
 * serialization: LOG_LOCK() held on entry/exit
 */
static int lmLogSync(struct jfs_log * log, int hard_sync)
{
	int logsize;
	int written;		/* written since last syncpt */
	int free;		/* free space left available */
	int delta;		/* additional delta to write normally */
	int more;		/* additional write granted */
	struct lrd lrd;
	int lsn;
	struct logsyncblk *lp;
	unsigned long flags;

	/* push dirty metapages out to disk */
	if (hard_sync)
		write_special_inodes(log, filemap_fdatawrite);
	else
		write_special_inodes(log, filemap_flush);

	/*
	 *	forward syncpt
	 */
	/* if last sync is same as last syncpt,
	 * invoke sync point forward processing to update sync.
	 */

	if (log->sync == log->syncpt) {
		LOGSYNC_LOCK(log, flags);
		if (list_empty(&log->synclist))
			log->sync = log->lsn;
		else {
			lp = list_entry(log->synclist.next,
					struct logsyncblk, synclist);
			log->sync = lp->lsn;
		}
		LOGSYNC_UNLOCK(log, flags);

	}

	/* if sync is different from last syncpt,
	 * write a SYNCPT record with syncpt = sync.
	 * reset syncpt = sync
	 */
	if (log->sync != log->syncpt) {
		lrd.logtid = 0;
		lrd.backchain = 0;
		lrd.type = cpu_to_le16(LOG_SYNCPT);
		lrd.length = 0;
		lrd.log.syncpt.sync = cpu_to_le32(log->sync);
		lsn = lmWriteRecord(log, NULL, &lrd, NULL);

		log->syncpt = log->sync;
	} else
		lsn = log->lsn;

	/*
	 *	setup next syncpt trigger (SWAG)
	 */
	logsize = log->logsize;

	logdiff(written, lsn, log);
	free = logsize - written;
	delta = LOGSYNC_DELTA(logsize);
	more = min(free / 2, delta);
	if (more < 2 * LOGPSIZE) {
		jfs_warn("\n ... Log Wrap ... Log Wrap ... Log Wrap ...\n");
		/*
		 *	log wrapping
		 *
		 * option 1 - panic ? No.!
		 * option 2 - shutdown file systems
		 *	      associated with log ?
		 * option 3 - extend log ?
		 * option 4 - second chance
		 *
		 * mark log wrapped, and continue.
		 * when all active transactions are completed,
		 * mark log valid for recovery.
		 * if crashed during invalid state, log state
		 * implies invalid log, forcing fsck().
		 */
		/* mark log state log wrap in log superblock */
		/* log->state = LOGWRAP; */

		/* reset sync point computation */
		log->syncpt = log->sync = lsn;
		log->nextsync = delta;
	} else
		/* next syncpt trigger = written + more */
		log->nextsync = written + more;

	/* if number of bytes written from last sync point is more
	 * than 1/4 of the log size, stop new transactions from
	 * starting until all current transactions are completed
	 * by setting syncbarrier flag.
	 */
	if (!test_bit(log_SYNCBARRIER, &log->flag) &&
	    (written > LOGSYNC_BARRIER(logsize)) && log->active) {
		set_bit(log_SYNCBARRIER, &log->flag);
		jfs_info("log barrier on: lsn=0x%x syncpt=0x%x", lsn,
			 log->syncpt);
		/*
		 * We may have to initiate group commit
		 */
		jfs_flush_journal(log, 0);
	}

	return lsn;
}

/*
 * NAME:	jfs_syncpt
 *
 * FUNCTION:	write log SYNCPT record for specified log
 *
 * PARAMETERS:	log	  - log structure
 *		hard_sync - set to 1 to force metadata to be written
 */
void jfs_syncpt(struct jfs_log *log, int hard_sync)
{	LOG_LOCK(log);
	if (!test_bit(log_QUIESCE, &log->flag))
		lmLogSync(log, hard_sync);
	LOG_UNLOCK(log);
}

/*
 * NAME:	lmLogOpen()
 *
 * FUNCTION:	open the log on first open;
 *	insert filesystem in the active list of the log.
 *
 * PARAMETER:	ipmnt	- file system mount inode
 *		iplog	- log inode (out)
 *
 * RETURN:
 *
 * serialization:
 */
int lmLogOpen(struct super_block *sb)
{
	int rc;
	struct file *bdev_file;
	struct jfs_log *log;
	struct jfs_sb_info *sbi = JFS_SBI(sb);

	if (sbi->flag & JFS_NOINTEGRITY)
		return open_dummy_log(sb);

	if (sbi->mntflag & JFS_INLINELOG)
		return open_inline_log(sb);

	mutex_lock(&jfs_log_mutex);
	list_for_each_entry(log, &jfs_external_logs, journal_list) {
		if (file_bdev(log->bdev_file)->bd_dev == sbi->logdev) {
			if (!uuid_equal(&log->uuid, &sbi->loguuid)) {
				jfs_warn("wrong uuid on JFS journal");
				mutex_unlock(&jfs_log_mutex);
				return -EINVAL;
			}
			/*
			 * add file system to log active file system list
			 */
			if ((rc = lmLogFileSystem(log, sbi, 1))) {
				mutex_unlock(&jfs_log_mutex);
				return rc;
			}
			goto journal_found;
		}
	}

	if (!(log = kzalloc_obj(struct jfs_log))) {
		mutex_unlock(&jfs_log_mutex);
		return -ENOMEM;
	}
	INIT_LIST_HEAD(&log->sb_list);
	init_waitqueue_head(&log->syncwait);

	/*
	 *	external log as separate logical volume
	 *
	 * file systems to log may have n-to-1 relationship;
	 */

	bdev_file = bdev_file_open_by_dev(sbi->logdev,
			BLK_OPEN_READ | BLK_OPEN_WRITE, log, NULL);
	if (IS_ERR(bdev_file)) {
		rc = PTR_ERR(bdev_file);
		goto free;
	}

	log->bdev_file = bdev_file;
	uuid_copy(&log->uuid, &sbi->loguuid);

	/*
	 * initialize log:
	 */
	if ((rc = lmLogInit(log)))
		goto close;

	list_add(&log->journal_list, &jfs_external_logs);

	/*
	 * add file system to log active file system list
	 */
	if ((rc = lmLogFileSystem(log, sbi, 1)))
		goto shutdown;

journal_found:
	LOG_LOCK(log);
	list_add(&sbi->log_list, &log->sb_list);
	sbi->log = log;
	LOG_UNLOCK(log);

	mutex_unlock(&jfs_log_mutex);
	return 0;

	/*
	 *	unwind on error
	 */
      shutdown:		/* unwind lbmLogInit() */
	list_del(&log->journal_list);
	lbmLogShutdown(log);

      close:		/* close external log device */
	bdev_fput(bdev_file);

      free:		/* free log descriptor */
	mutex_unlock(&jfs_log_mutex);
	kfree(log);

	jfs_warn("lmLogOpen: exit(%d)", rc);
	return rc;
}

static int open_inline_log(struct super_block *sb)
{
	struct jfs_log *log;
	int rc;

	if (!(log = kzalloc_obj(struct jfs_log)))
		return -ENOMEM;
	INIT_LIST_HEAD(&log->sb_list);
	init_waitqueue_head(&log->syncwait);

	set_bit(log_INLINELOG, &log->flag);
	log->bdev_file = sb->s_bdev_file;
	log->base = addressPXD(&JFS_SBI(sb)->logpxd);
	log->size = lengthPXD(&JFS_SBI(sb)->logpxd) >>
	    (L2LOGPSIZE - sb->s_blocksize_bits);
	log->l2bsize = sb->s_blocksize_bits;
	ASSERT(L2LOGPSIZE >= sb->s_blocksize_bits);

	/*
	 * initialize log.
	 */
	if ((rc = lmLogInit(log))) {
		kfree(log);
		jfs_warn("lmLogOpen: exit(%d)", rc);
		return rc;
	}

	list_add(&JFS_SBI(sb)->log_list, &log->sb_list);
	JFS_SBI(sb)->log = log;

	return rc;
}

static int open_dummy_log(struct super_block *sb)
{
	int rc;

	mutex_lock(&jfs_log_mutex);
	if (!dummy_log) {
		dummy_log = kzalloc_obj(struct jfs_log);
		if (!dummy_log) {
			mutex_unlock(&jfs_log_mutex);
			return -ENOMEM;
		}
		INIT_LIST_HEAD(&dummy_log->sb_list);
		init_waitqueue_head(&dummy_log->syncwait);
		dummy_log->no_integrity = 1;
		/* Make up some stuff */
		dummy_log->size = 1024;
		rc = lmLogInit(dummy_log);
		if (rc) {
			kfree(dummy_log);
			dummy_log = NULL;
			mutex_unlock(&jfs_log_mutex);
			return rc;
		}
	}

	LOG_LOCK(dummy_log);
	list_add(&JFS_SBI(sb)->log_list, &dummy_log->sb_list);
	JFS_SBI(sb)->log = dummy_log;
	LOG_UNLOCK(dummy_log);
	mutex_unlock(&jfs_log_mutex);

	return 0;
}

/*
 * NAME:	lmLogInit()
 *
 * FUNCTION:	log initialization at first log open.
 *
 *	logredo() (or logformat()) should have been run previously.
 *	initialize the log from log superblock.
 *	set the log state in the superblock to LOGMOUNT and
 *	write SYNCPT log record.
 *
 * PARAMETER:	log	- log structure
 *
 * RETURN:	0	- if ok
 *		-EINVAL	- bad log magic number or superblock dirty
 *		error returned from logwait()
 *
 * serialization: single first open thread
 */
int lmLogInit(struct jfs_log * log)
{
	int rc = 0;
	struct lrd lrd;
	struct logsuper *logsuper;
	struct lbuf *bpsuper;
	struct lbuf *bp;
	struct logpage *lp;
	int lsn = 0;

	jfs_info("lmLogInit: log:0x%p", log);

	/* initialize the group commit serialization lock */
	LOGGC_LOCK_INIT(log);

	/* allocate/initialize the log write serialization lock */
	LOG_LOCK_INIT(log);

	LOGSYNC_LOCK_INIT(log);

	INIT_LIST_HEAD(&log->synclist);

	INIT_LIST_HEAD(&log->cqueue);
	log->flush_tblk = NULL;

	log->count = 0;

	/*
	 * initialize log i/o
	 */
	if ((rc = lbmLogInit(log)))
		return rc;

	if (!test_bit(log_INLINELOG, &log->flag))
		log->l2bsize = L2LOGPSIZE;

	/* check for disabled journaling to disk */
	if (log->no_integrity) {
		/*
		 * Journal pages will still be filled.  When the time comes
		 * to actually do the I/O, the write is not done, and the
		 * endio routine is called directly.
		 */
		bp = lbmAllocate(log , 0);
		log->bp = bp;
		bp->l_pn = bp->l_eor = 0;
	} else {
		/*
		 * validate log superblock
		 */
		if ((rc = lbmRead(log, 1, &bpsuper)))
			goto errout10;

		logsuper = (struct logsuper *) bpsuper->l_ldata;

		if (logsuper->magic != cpu_to_le32(LOGMAGIC)) {
			jfs_warn("*** Log Format Error ! ***");
			rc = -EINVAL;
			goto errout20;
		}

		/* logredo() should have been run successfully. */
		if (logsuper->state != cpu_to_le32(LOGREDONE)) {
			jfs_warn("*** Log Is Dirty ! ***");
			rc = -EINVAL;
			goto errout20;
		}

		/* initialize log from log superblock */
		if (test_bit(log_INLINELOG,&log->flag)) {
			if (log->size != le32_to_cpu(logsuper->size)) {
				rc = -EINVAL;
				goto errout20;
			}
			jfs_info("lmLogInit: inline log:0x%p base:0x%Lx size:0x%x",
				 log, (unsigned long long)log->base, log->size);
		} else {
			if (!uuid_equal(&logsuper->uuid, &log->uuid)) {
				jfs_warn("wrong uuid on JFS log device");
				rc = -EINVAL;
				goto errout20;
			}
			log->size = le32_to_cpu(logsuper->size);
			log->l2bsize = le32_to_cpu(logsuper->l2bsize);
			jfs_info("lmLogInit: external log:0x%p base:0x%Lx size:0x%x",
				 log, (unsigned long long)log->base, log->size);
		}

		log->page = le32_to_cpu(logsuper->end) / LOGPSIZE;
		log->eor = le32_to_cpu(logsuper->end) - (LOGPSIZE * log->page);

		/*
		 * initialize for log append write mode
		 */
		/* establish current/end-of-log page/buffer */
		if ((rc = lbmRead(log, log->page, &bp)))
			goto errout20;

		lp = (struct logpage *) bp->l_ldata;

		jfs_info("lmLogInit: lsn:0x%x page:%d eor:%d:%d",
			 le32_to_cpu(logsuper->end), log->page, log->eor,
			 le16_to_cpu(lp->h.eor));

		log->bp = bp;
		bp->l_pn = log->page;
		bp->l_eor = log->eor;

		/* if current page is full, move on to next page */
		if (log->eor >= LOGPSIZE - LOGPTLRSIZE)
			lmNextPage(log);

		/*
		 * initialize log syncpoint
		 */
		/*
		 * write the first SYNCPT record with syncpoint = 0
		 * (i.e., log redo up to HERE !);
		 * remove current page from lbm write queue at end of pageout
		 * (to write log superblock update), but do not release to
		 * freelist;
		 */
		lrd.logtid = 0;
		lrd.backchain = 0;
		lrd.type = cpu_to_le16(LOG_SYNCPT);
		lrd.length = 0;
		lrd.log.syncpt.sync = 0;
		lsn = lmWriteRecord(log, NULL, &lrd, NULL);
		bp = log->bp;
		bp->l_ceor = bp->l_eor;
		lp = (struct logpage *) bp->l_ldata;
		lp->h.eor = lp->t.eor = cpu_to_le16(bp->l_eor);
		lbmWrite(log, bp, lbmWRITE | lbmSYNC, 0);
		if ((rc = lbmIOWait(bp, 0)))
			goto errout30;

		/*
		 * update/write superblock
		 */
		logsuper->state = cpu_to_le32(LOGMOUNT);
		log->serial = le32_to_cpu(logsuper->serial) + 1;
		logsuper->serial = cpu_to_le32(log->serial);
		lbmDirectWrite(log, bpsuper, lbmWRITE | lbmRELEASE | lbmSYNC);
		if ((rc = lbmIOWait(bpsuper, lbmFREE)))
			goto errout30;
	}

	/* initialize logsync parameters */
	log->logsize = (log->size - 2) << L2LOGPSIZE;
	log->lsn = lsn;
	log->syncpt = lsn;
	log->sync = log->syncpt;
	log->nextsync = LOGSYNC_DELTA(log->logsize);

	jfs_info("lmLogInit: lsn:0x%x syncpt:0x%x sync:0x%x",
		 log->lsn, log->syncpt, log->sync);

	/*
	 * initialize for lazy/group commit
	 */
	log->clsn = lsn;

	return 0;

	/*
	 *	unwind on error
	 */
      errout30:		/* release log page */
	log->wqueue = NULL;
	bp->l_wqnext = NULL;
	lbmFree(bp);

      errout20:		/* release log superblock */
	lbmFree(bpsuper);

      errout10:		/* unwind lbmLogInit() */
	lbmLogShutdown(log);

	jfs_warn("lmLogInit: exit(%d)", rc);
	return rc;
}


/*
 * NAME:	lmLogClose()
 *
 * FUNCTION:	remove file system <ipmnt> from active list of log <iplog>
 *		and close it on last close.
 *
 * PARAMETER:	sb	- superblock
 *
 * RETURN:	errors from subroutines
 *
 * serialization:
 */
int lmLogClose(struct super_block *sb)
{
	struct jfs_sb_info *sbi = JFS_SBI(sb);
	struct jfs_log *log = sbi->log;
	struct file *bdev_file;
	int rc = 0;

	jfs_info("lmLogClose: log:0x%p", log);

	mutex_lock(&jfs_log_mutex);
	LOG_LOCK(log);
	list_del(&sbi->log_list);
	LOG_UNLOCK(log);
	sbi->log = NULL;

	/*
	 * We need to make sure all of the "written" metapages
	 * actually make it to disk
	 */
	sync_blockdev(sb->s_bdev);

	if (test_bit(log_INLINELOG, &log->flag)) {
		/*
		 *	in-line log in host file system
		 */
		rc = lmLogShutdown(log);
		kfree(log);
		goto out;
	}

	if (!log->no_integrity)
		lmLogFileSystem(log, sbi, 0);

	if (!list_empty(&log->sb_list))
		goto out;

	/*
	 * TODO: ensure that the dummy_log is in a state to allow
	 * lbmLogShutdown to deallocate all the buffers and call
	 * kfree against dummy_log.  For now, leave dummy_log & its
	 * buffers in memory, and resuse if another no-integrity mount
	 * is requested.
	 */
	if (log->no_integrity)
		goto out;

	/*
	 *	external log as separate logical volume
	 */
	list_del(&log->journal_list);
	bdev_file = log->bdev_file;
	rc = lmLogShutdown(log);

	bdev_fput(bdev_file);

	kfree(log);

      out:
	mutex_unlock(&jfs_log_mutex);
	jfs_info("lmLogClose: exit(%d)", rc);
	return rc;
}


/*
 * NAME:	jfs_flush_journal()
 *
 * FUNCTION:	initiate write of any outstanding transactions to the journal
 *		and optionally wait until they are all written to disk
 *
 *		wait == 0  flush until latest txn is committed, don't wait
 *		wait == 1  flush until latest txn is committed, wait
 *		wait > 1   flush until all txn's are complete, wait
 */
void jfs_flush_journal(struct jfs_log *log, int wait)
{
	int i;
	struct tblock *target = NULL;

	/* jfs_write_inode may call us during read-only mount */
	if (!log)
		return;

	jfs_info("jfs_flush_journal: log:0x%p wait=%d", log, wait);

	LOGGC_LOCK(log);

	if (!list_empty(&log->cqueue)) {
		/*
		 * This ensures that we will keep writing to the journal as long
		 * as there are unwritten commit records
		 */
		target = list_entry(log->cqueue.prev, struct tblock, cqueue);

		if (test_bit(log_FLUSH, &log->flag)) {
			/*
			 * We're already flushing.
			 * if flush_tblk is NULL, we are flushing everything,
			 * so leave it that way.  Otherwise, update it to the
			 * latest transaction
			 */
			if (log->flush_tblk)
				log->flush_tblk = target;
		} else {
			/* Only flush until latest transaction is committed */
			log->flush_tblk = target;
			set_bit(log_FLUSH, &log->flag);

			/*
			 * Initiate I/O on outstanding transactions
			 */
			if (!(log->cflag & logGC_PAGEOUT)) {
				log->cflag |= logGC_PAGEOUT;
				lmGCwrite(log, 0);
			}
		}
	}
	if ((wait > 1) || test_bit(log_SYNCBARRIER, &log->flag)) {
		/* Flush until all activity complete */
		set_bit(log_FLUSH, &log->flag);
		log->flush_tblk = NULL;
	}

	if (wait && target && !(target->flag & tblkGC_COMMITTED)) {
		DECLARE_WAITQUEUE(__wait, current);

		add_wait_queue(&target->gcwait, &__wait);
		set_current_state(TASK_UNINTERRUPTIBLE);
		LOGGC_UNLOCK(log);
		schedule();
		LOGGC_LOCK(log);
		remove_wait_queue(&target->gcwait, &__wait);
	}
	LOGGC_UNLOCK(log);

	if (wait < 2)
		return;

	write_special_inodes(log, filemap_fdatawrite);

	/*
	 * If there was recent activity, we may need to wait
	 * for the lazycommit thread to catch up
	 */
	if ((!list_empty(&log->cqueue)) || !list_empty(&log->synclist)) {
		for (i = 0; i < 200; i++) {	/* Too much? */
			msleep(250);
			write_special_inodes(log, filemap_fdatawrite);
			if (list_empty(&log->cqueue) &&
			    list_empty(&log->synclist))
				break;
		}
	}
	assert(list_empty(&log->cqueue));

#ifdef CONFIG_JFS_DEBUG
	if (!list_empty(&log->synclist)) {
		struct logsyncblk *lp;

		printk(KERN_ERR "jfs_flush_journal: synclist not empty\n");
		list_for_each_entry(lp, &log->synclist, synclist) {
			if (lp->xflag & COMMIT_PAGE) {
				struct metapage *mp = (struct metapage *)lp;
				print_hex_dump(KERN_ERR, "metapage: ",
					       DUMP_PREFIX_ADDRESS, 16, 4,
					       mp, sizeof(struct metapage), 0);
				print_hex_dump(KERN_ERR, "page: ",
					       DUMP_PREFIX_ADDRESS, 16,
					       sizeof(long), mp->folio,
					       sizeof(struct page), 0);
			} else
				print_hex_dump(KERN_ERR, "tblock:",
					       DUMP_PREFIX_ADDRESS, 16, 4,
					       lp, sizeof(struct tblock), 0);
		}
	}
#else
	WARN_ON(!list_empty(&log->synclist));
#endif
	clear_bit(log_FLUSH, &log->flag);
}

/*
 * NAME:	lmLogShutdown()
 *
 * FUNCTION:	log shutdown at last LogClose().
 *
 *		write log syncpt record.
 *		update super block to set redone flag to 0.
 *
 * PARAMETER:	log	- log inode
 *
 * RETURN:	0	- success
 *
 * serialization: single last close thread
 */
int lmLogShutdown(struct jfs_log * log)
{
	int rc;
	struct lrd lrd;
	int lsn;
	struct logsuper *logsuper;
	struct lbuf *bpsuper;
	struct lbuf *bp;
	struct logpage *lp;

	jfs_info("lmLogShutdown: log:0x%p", log);

	jfs_flush_journal(log, 2);

	/*
	 * write the last SYNCPT record with syncpoint = 0
	 * (i.e., log redo up to HERE !)
	 */
	lrd.logtid = 0;
	lrd.backchain = 0;
	lrd.type = cpu_to_le16(LOG_SYNCPT);
	lrd.length = 0;
	lrd.log.syncpt.sync = 0;

	lsn = lmWriteRecord(log, NULL, &lrd, NULL);
	bp = log->bp;
	lp = (struct logpage *) bp->l_ldata;
	lp->h.eor = lp->t.eor = cpu_to_le16(bp->l_eor);
	lbmWrite(log, log->bp, lbmWRITE | lbmRELEASE | lbmSYNC, 0);
	lbmIOWait(log->bp, lbmFREE);
	log->bp = NULL;

	/*
	 * synchronous update log superblock
	 * mark log state as shutdown cleanly
	 * (i.e., Log does not need to be replayed).
	 */
	if ((rc = lbmRead(log, 1, &bpsuper)))
		goto out;

	logsuper = (struct logsuper *) bpsuper->l_ldata;
	logsuper->state = cpu_to_le32(LOGREDONE);
	logsuper->end = cpu_to_le32(lsn);
	lbmDirectWrite(log, bpsuper, lbmWRITE | lbmRELEASE | lbmSYNC);
	rc = lbmIOWait(bpsuper, lbmFREE);

	jfs_info("lmLogShutdown: lsn:0x%x page:%d eor:%d",
		 lsn, log->page, log->eor);

      out:
	/*
	 * shutdown per log i/o
	 */
	lbmLogShutdown(log);

	if (rc) {
		jfs_warn("lmLogShutdown: exit(%d)", rc);
	}
	return rc;
}


/*
 * NAME:	lmLogFileSystem()
 *
 * FUNCTION:	insert (<activate> = true)/remove (<activate> = false)
 *	file system into/from log active file system list.
 *
 * PARAMETE:	log	- pointer to logs inode.
 *		fsdev	- kdev_t of filesystem.
 *		serial	- pointer to returned log serial number
 *		activate - insert/remove device from active list.
 *
 * RETURN:	0	- success
 *		errors returned by vms_iowait().
 */
static int lmLogFileSystem(struct jfs_log * log, struct jfs_sb_info *sbi,
			   int activate)
{
	int rc = 0;
	int i;
	struct logsuper *logsuper;
	struct lbuf *bpsuper;
	uuid_t *uuid = &sbi->uuid;

	/*
	 * insert/remove file system device to log active file system list.
	 */
	if ((rc = lbmRead(log, 1, &bpsuper)))
		return rc;

	logsuper = (struct logsuper *) bpsuper->l_ldata;
	if (activate) {
		for (i = 0; i < MAX_ACTIVE; i++)
			if (uuid_is_null(&logsuper->active[i].uuid)) {
				uuid_copy(&logsuper->active[i].uuid, uuid);
				sbi->aggregate = i;
				break;
			}
		if (i == MAX_ACTIVE) {
			jfs_warn("Too many file systems sharing journal!");
			lbmFree(bpsuper);
			return -EMFILE;	/* Is there a better rc? */
		}
	} else {
		for (i = 0; i < MAX_ACTIVE; i++)
			if (uuid_equal(&logsuper->active[i].uuid, uuid)) {
				uuid_copy(&logsuper->active[i].uuid,
					  &uuid_null);
				break;
			}
		if (i == MAX_ACTIVE) {
			jfs_warn("Somebody stomped on the journal!");
			lbmFree(bpsuper);
			return -EIO;
		}

	}

	/*
	 * synchronous write log superblock:
	 *
	 * write sidestream bypassing write queue:
	 * at file system mount, log super block is updated for
	 * activation of the file system before any log record
	 * (MOUNT record) of the file system, and at file system
	 * unmount, all meta data for the file system has been
	 * flushed before log super block is updated for deactivation
	 * of the file system.
	 */
	lbmDirectWrite(log, bpsuper, lbmWRITE | lbmRELEASE | lbmSYNC);
	rc = lbmIOWait(bpsuper, lbmFREE);

	return rc;
}

/*
 *		log buffer manager (lbm)
 *		------------------------
 *
 * special purpose buffer manager supporting log i/o requirements.
 *
 * per log write queue:
 * log pageout occurs in serial order by fifo write queue and
 * restricting to a single i/o in pregress at any one time.
 * a circular singly-linked list
 * (log->wrqueue points to the tail, and buffers are linked via
 * bp->wrqueue field), and
 * maintains log page in pageout ot waiting for pageout in serial pageout.
 */

/*
 *	lbmLogInit()
 *
 * initialize per log I/O setup at lmLogInit()
 */
static int lbmLogInit(struct jfs_log * log)
{				/* log inode */
	int i;
	struct lbuf *lbuf;

	jfs_info("lbmLogInit: log:0x%p", log);

	/* initialize current buffer cursor */
	log->bp = NULL;

	/* initialize log device write queue */
	log->wqueue = NULL;

	/*
	 * Each log has its own buffer pages allocated to it.  These are
	 * not managed by the page cache.  This ensures that a transaction
	 * writing to the log does not block trying to allocate a page from
	 * the page cache (for the log).  This would be bad, since page
	 * allocation waits on the kswapd thread that may be committing inodes
	 * which would cause log activity.  Was that clear?  I'm trying to
	 * avoid deadlock here.
	 */
	init_waitqueue_head(&log->free_wait);

	log->lbuf_free = NULL;

	for (i = 0; i < LOGPAGES;) {
		char *buffer;
		uint offset;
		struct page *page = alloc_page(GFP_KERNEL | __GFP_ZERO);

		if (!page)
			goto error;
		buffer = page_address(page);
		for (offset = 0; offset < PAGE_SIZE; offset += LOGPSIZE) {
			lbuf = kmalloc_obj(struct lbuf);
			if (lbuf == NULL) {
				if (offset == 0)
					__free_page(page);
				goto error;
			}
			if (offset) /* we already have one reference */
				get_page(page);
			lbuf->l_offset = offset;
			lbuf->l_ldata = buffer + offset;
			lbuf->l_page = page;
			lbuf->l_log = log;
			init_waitqueue_head(&lbuf->l_ioevent);

			lbuf->l_freelist = log->lbuf_free;
			log->lbuf_free = lbuf;
			i++;
		}
	}

	return (0);

      error:
	lbmLogShutdown(log);
	return -ENOMEM;
}


/*
 *	lbmLogShutdown()
 *
 * finalize per log I/O setup at lmLogShutdown()
 */
static void lbmLogShutdown(struct jfs_log * log)
{
	struct lbuf *lbuf;

	jfs_info("lbmLogShutdown: log:0x%p", log);

	lbuf = log->lbuf_free;
	while (lbuf) {
		struct lbuf *next = lbuf->l_freelist;
		__free_page(lbuf->l_page);
		kfree(lbuf);
		lbuf = next;
	}
}


/*
 *	lbmAllocate()
 *
 * allocate an empty log buffer
 */
static struct lbuf *lbmAllocate(struct jfs_log * log, int pn)
{
	struct lbuf *bp;
	unsigned long flags;

	/*
	 * recycle from log buffer freelist if any
	 */
	LCACHE_LOCK(flags);
	LCACHE_SLEEP_COND(log->free_wait, (bp = log->lbuf_free), flags);
	log->lbuf_free = bp->l_freelist;
	LCACHE_UNLOCK(flags);

	bp->l_flag = 0;

	bp->l_wqnext = NULL;
	bp->l_freelist = NULL;

	bp->l_pn = pn;
	bp->l_blkno = log->base + (pn << (L2LOGPSIZE - log->l2bsize));
	bp->l_ceor = 0;

	return bp;
}


/*
 *	lbmFree()
 *
 * release a log buffer to freelist
 */
static void lbmFree(struct lbuf * bp)
{
	unsigned long flags;

	LCACHE_LOCK(flags);

	lbmfree(bp);

	LCACHE_UNLOCK(flags);
}

static void lbmfree(struct lbuf * bp)
{
	struct jfs_log *log = bp->l_log;

	assert(bp->l_wqnext == NULL);

	/*
	 * return the buffer to head of freelist
	 */
	bp->l_freelist = log->lbuf_free;
	log->lbuf_free = bp;

	wake_up(&log->free_wait);
	return;
}


/*
 * NAME:	lbmRedrive
 *
 * FUNCTION:	add a log buffer to the log redrive list
 *
 * PARAMETER:
 *	bp	- log buffer
 *
 * NOTES:
 *	Takes log_redrive_lock.
 */
static inline void lbmRedrive(struct lbuf *bp)
{
	unsigned long flags;

	spin_lock_irqsave(&log_redrive_lock, flags);
	bp->l_redrive_next = log_redrive_list;
	log_redrive_list = bp;
	spin_unlock_irqrestore(&log_redrive_lock, flags);

	wake_up_process(jfsIOthread);
}


/*
 *	lbmRead()
 */
static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp)
{
	struct bio *bio;
	struct lbuf *bp;

	/*
	 * allocate a log buffer
	 */
	*bpp = bp = lbmAllocate(log, pn);
	jfs_info("lbmRead: bp:0x%p pn:0x%x", bp, pn);

	bp->l_flag |= lbmREAD;

	bio = bio_alloc(file_bdev(log->bdev_file), 1, REQ_OP_READ, GFP_NOFS);
	bio->bi_iter.bi_sector = bp->l_blkno << (log->l2bsize - 9);
	__bio_add_page(bio, bp->l_page, LOGPSIZE, bp->l_offset);
	BUG_ON(bio->bi_iter.bi_size != LOGPSIZE);

	bio->bi_end_io = lbmIODone;
	bio->bi_private = bp;
	/*check if journaling to disk has been disabled*/
	if (log->no_integrity) {
		bio->bi_iter.bi_size = 0;
		lbmIODone(bio);
	} else {
		submit_bio(bio);
	}

	wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));

	return 0;
}


/*
 *	lbmWrite()
 *
 * buffer at head of pageout queue stays after completion of
 * partial-page pageout and redriven by explicit initiation of
 * pageout by caller until full-page pageout is completed and
 * released.
 *
 * device driver i/o done redrives pageout of new buffer at
 * head of pageout queue when current buffer at head of pageout
 * queue is released at the completion of its full-page pageout.
 *
 * LOGGC_LOCK() serializes lbmWrite() by lmNextPage() and lmGroupCommit().
 * LCACHE_LOCK() serializes xflag between lbmWrite() and lbmIODone()
 */
static void lbmWrite(struct jfs_log * log, struct lbuf * bp, int flag,
		     int cant_block)
{
	struct lbuf *tail;
	unsigned long flags;

	jfs_info("lbmWrite: bp:0x%p flag:0x%x pn:0x%x", bp, flag, bp->l_pn);

	/* map the logical block address to physical block address */
	bp->l_blkno =
	    log->base + (bp->l_pn << (L2LOGPSIZE - log->l2bsize));

	LCACHE_LOCK(flags);		/* disable+lock */

	/*
	 * initialize buffer for device driver
	 */
	bp->l_flag = flag;

	/*
	 *	insert bp at tail of write queue associated with log
	 *
	 * (request is either for bp already/currently at head of queue
	 * or new bp to be inserted at tail)
	 */
	tail = log->wqueue;

	/* is buffer not already on write queue ? */
	if (bp->l_wqnext == NULL) {
		/* insert at tail of wqueue */
		if (tail == NULL) {
			log->wqueue = bp;
			bp->l_wqnext = bp;
		} else {
			log->wqueue = bp;
			bp->l_wqnext = tail->l_wqnext;
			tail->l_wqnext = bp;
		}

		tail = bp;
	}

	/* is buffer at head of wqueue and for write ? */
	if ((bp != tail->l_wqnext) || !(flag & lbmWRITE)) {
		LCACHE_UNLOCK(flags);	/* unlock+enable */
		return;
	}

	LCACHE_UNLOCK(flags);	/* unlock+enable */

	if (cant_block)
		lbmRedrive(bp);
	else if (flag & lbmSYNC)
		lbmStartIO(bp);
	else {
		LOGGC_UNLOCK(log);
		lbmStartIO(bp);
		LOGGC_LOCK(log);
	}
}


/*
 *	lbmDirectWrite()
 *
 * initiate pageout bypassing write queue for sidestream
 * (e.g., log superblock) write;
 */
static void lbmDirectWrite(struct jfs_log * log, struct lbuf * bp, int flag)
{
	jfs_info("lbmDirectWrite: bp:0x%p flag:0x%x pn:0x%x",
		 bp, flag, bp->l_pn);

	/*
	 * initialize buffer for device driver
	 */
	bp->l_flag = flag | lbmDIRECT;

	/* map the logical block address to physical block address */
	bp->l_blkno =
	    log->base + (bp->l_pn << (L2LOGPSIZE - log->l2bsize));

	/*
	 *	initiate pageout of the page
	 */
	lbmStartIO(bp);
}


/*
 * NAME:	lbmStartIO()
 *
 * FUNCTION:	Interface to DD strategy routine
 *
 * RETURN:	none
 *
 * serialization: LCACHE_LOCK() is NOT held during log i/o;
 */
static void lbmStartIO(struct lbuf * bp)
{
	struct bio *bio;
	struct jfs_log *log = bp->l_log;
	struct block_device *bdev = NULL;

	jfs_info("lbmStartIO");

	if (!log->no_integrity)
		bdev = file_bdev(log->bdev_file);

	bio = bio_alloc(bdev, 1, REQ_OP_WRITE | REQ_SYNC,
			GFP_NOFS);
	bio->bi_iter.bi_sector = bp->l_blkno << (log->l2bsize - 9);
	__bio_add_page(bio, bp->l_page, LOGPSIZE, bp->l_offset);
	BUG_ON(bio->bi_iter.bi_size != LOGPSIZE);

	bio->bi_end_io = lbmIODone;
	bio->bi_private = bp;

	/* check if journaling to disk has been disabled */
	if (log->no_integrity) {
		bio->bi_iter.bi_size = 0;
		lbmIODone(bio);
	} else {
		submit_bio(bio);
		INCREMENT(lmStat.submitted);
	}
}


/*
 *	lbmIOWait()
 */
static int lbmIOWait(struct lbuf * bp, int flag)
{
	unsigned long flags;
	int rc = 0;

	jfs_info("lbmIOWait1: bp:0x%p flag:0x%x:0x%x", bp, bp->l_flag, flag);

	LCACHE_LOCK(flags);		/* disable+lock */

	LCACHE_SLEEP_COND(bp->l_ioevent, (bp->l_flag & lbmDONE), flags);

	rc = (bp->l_flag & lbmERROR) ? -EIO : 0;

	if (flag & lbmFREE)
		lbmfree(bp);

	LCACHE_UNLOCK(flags);	/* unlock+enable */

	jfs_info("lbmIOWait2: bp:0x%p flag:0x%x:0x%x", bp, bp->l_flag, flag);
	return rc;
}

/*
 *	lbmIODone()
 *
 * executed at INTIODONE level
 */
static void lbmIODone(struct bio *bio)
{
	struct lbuf *bp = bio->bi_private;
	struct lbuf *nextbp, *tail;
	struct jfs_log *log;
	unsigned long flags;

	/*
	 * get back jfs buffer bound to the i/o buffer
	 */
	jfs_info("lbmIODone: bp:0x%p flag:0x%x", bp, bp->l_flag);

	LCACHE_LOCK(flags);		/* disable+lock */

	if (bio->bi_status) {
		bp->l_flag |= lbmERROR;

		jfs_err("lbmIODone: I/O error in JFS log");
	}

	bio_put(bio);

	/*
	 *	pagein completion
	 */
	if (bp->l_flag & lbmREAD) {
		bp->l_flag &= ~lbmREAD;

		/* wakeup I/O initiator */
		LCACHE_WAKEUP(&bp->l_ioevent);

		goto out;
	}

	/*
	 *	pageout completion
	 *
	 * the bp at the head of write queue has completed pageout.
	 *
	 * if single-commit/full-page pageout, remove the current buffer
	 * from head of pageout queue, and redrive pageout with
	 * the new buffer at head of pageout queue;
	 * otherwise, the partial-page pageout buffer stays at
	 * the head of pageout queue to be redriven for pageout
	 * by lmGroupCommit() until full-page pageout is completed.
	 */
	bp->l_flag &= ~lbmWRITE;
	INCREMENT(lmStat.pagedone);

	/* update committed lsn */
	log = bp->l_log;
	log->clsn = (bp->l_pn << L2LOGPSIZE) + bp->l_ceor;

	if (bp->l_flag & lbmDIRECT) {
		LCACHE_WAKEUP(&bp->l_ioevent);
		goto out;
	}

	tail = log->wqueue;

	/* single element queue */
	if (bp == tail) {
		/* remove head buffer of full-page pageout
		 * from log device write queue
		 */
		if (bp->l_flag & lbmRELEASE) {
			log->wqueue = NULL;
			bp->l_wqnext = NULL;
		}
	}
	/* multi element queue */
	else {
		/* remove head buffer of full-page pageout
		 * from log device write queue
		 */
		if (bp->l_flag & lbmRELEASE) {
			nextbp = tail->l_wqnext = bp->l_wqnext;
			bp->l_wqnext = NULL;

			/*
			 * redrive pageout of next page at head of write queue:
			 * redrive next page without any bound tblk
			 * (i.e., page w/o any COMMIT records), or
			 * first page of new group commit which has been
			 * queued after current page (subsequent pageout
			 * is performed synchronously, except page without
			 * any COMMITs) by lmGroupCommit() as indicated
			 * by lbmWRITE flag;
			 */
			if (nextbp->l_flag & lbmWRITE) {
				/*
				 * We can't do the I/O at interrupt time.
				 * The jfsIO thread can do it
				 */
				lbmRedrive(nextbp);
			}
		}
	}

	/*
	 *	synchronous pageout:
	 *
	 * buffer has not necessarily been removed from write queue
	 * (e.g., synchronous write of partial-page with COMMIT):
	 * leave buffer for i/o initiator to dispose
	 */
	if (bp->l_flag & lbmSYNC) {
		/* wakeup I/O initiator */
		LCACHE_WAKEUP(&bp->l_ioevent);
	}

	/*
	 *	Group Commit pageout:
	 */
	else if (bp->l_flag & lbmGC) {
		LCACHE_UNLOCK(flags);
		lmPostGC(bp);
		LCACHE_LOCK(flags);		/* disable+lock */
	}

	/*
	 *	asynchronous pageout:
	 *
	 * buffer must have been removed from write queue:
	 * insert buffer at head of freelist where it can be recycled
	 */
	else {
		assert(bp->l_flag & lbmRELEASE);
		assert(bp->l_flag & lbmFREE);
		lbmfree(bp);
	}

out:
	bp->l_flag |= lbmDONE;
	LCACHE_UNLOCK(flags);
}

int jfsIOWait(void *arg)
{
	struct lbuf *bp;

	set_freezable();
	do {
		spin_lock_irq(&log_redrive_lock);
		while ((bp = log_redrive_list)) {
			log_redrive_list = bp->l_redrive_next;
			bp->l_redrive_next = NULL;
			spin_unlock_irq(&log_redrive_lock);
			lbmStartIO(bp);
			spin_lock_irq(&log_redrive_lock);
		}

		if (freezing(current)) {
			spin_unlock_irq(&log_redrive_lock);
			try_to_freeze();
		} else {
			set_current_state(TASK_INTERRUPTIBLE);
			spin_unlock_irq(&log_redrive_lock);
			schedule();
		}
	} while (!kthread_should_stop());

	jfs_info("jfsIOWait being killed!");
	return 0;
}

/*
 * NAME:	lmLogFormat()/jfs_logform()
 *
 * FUNCTION:	format file system log
 *
 * PARAMETERS:
 *	log	- volume log
 *	logAddress - start address of log space in FS block
 *	logSize	- length of log space in FS block;
 *
 * RETURN:	0	- success
 *		-EIO	- i/o error
 *
 * XXX: We're synchronously writing one page at a time.  This needs to
 *	be improved by writing multiple pages at once.
 */
int lmLogFormat(struct jfs_log *log, s64 logAddress, int logSize)
{
	int rc = -EIO;
	struct jfs_sb_info *sbi;
	struct logsuper *logsuper;
	struct logpage *lp;
	int lspn;		/* log sequence page number */
	struct lrd *lrd_ptr;
	int npages = 0;
	struct lbuf *bp;

	jfs_info("lmLogFormat: logAddress:%Ld logSize:%d",
		 (long long)logAddress, logSize);

	sbi = list_entry(log->sb_list.next, struct jfs_sb_info, log_list);

	/* allocate a log buffer */
	bp = lbmAllocate(log, 1);

	npages = logSize >> sbi->l2nbperpage;

	/*
	 *	log space:
	 *
	 * page 0 - reserved;
	 * page 1 - log superblock;
	 * page 2 - log data page: A SYNC log record is written
	 *	    into this page at logform time;
	 * pages 3-N - log data page: set to empty log data pages;
	 */
	/*
	 *	init log superblock: log page 1
	 */
	logsuper = (struct logsuper *) bp->l_ldata;

	logsuper->magic = cpu_to_le32(LOGMAGIC);
	logsuper->version = cpu_to_le32(LOGVERSION);
	logsuper->state = cpu_to_le32(LOGREDONE);
	logsuper->flag = cpu_to_le32(sbi->mntflag);	/* ? */
	logsuper->size = cpu_to_le32(npages);
	logsuper->bsize = cpu_to_le32(sbi->bsize);
	logsuper->l2bsize = cpu_to_le32(sbi->l2bsize);
	logsuper->end = cpu_to_le32(2 * LOGPSIZE + LOGPHDRSIZE + LOGRDSIZE);

	bp->l_flag = lbmWRITE | lbmSYNC | lbmDIRECT;
	bp->l_blkno = logAddress + sbi->nbperpage;
	lbmStartIO(bp);
	if ((rc = lbmIOWait(bp, 0)))
		goto exit;

	/*
	 *	init pages 2 to npages-1 as log data pages:
	 *
	 * log page sequence number (lpsn) initialization:
	 *
	 * pn:   0     1     2     3                 n-1
	 *       +-----+-----+=====+=====+===.....===+=====+
	 * lspn:             N-1   0     1           N-2
	 *                   <--- N page circular file ---->
	 *
	 * the N (= npages-2) data pages of the log is maintained as
	 * a circular file for the log records;
	 * lpsn grows by 1 monotonically as each log page is written
	 * to the circular file of the log;
	 * and setLogpage() will not reset the page number even if
	 * the eor is equal to LOGPHDRSIZE. In order for binary search
	 * still work in find log end process, we have to simulate the
	 * log wrap situation at the log format time.
	 * The 1st log page written will have the highest lpsn. Then
	 * the succeeding log pages will have ascending order of
	 * the lspn starting from 0, ... (N-2)
	 */
	lp = (struct logpage *) bp->l_ldata;
	/*
	 * initialize 1st log page to be written: lpsn = N - 1,
	 * write a SYNCPT log record is written to this page
	 */
	lp->h.page = lp->t.page = cpu_to_le32(npages - 3);
	lp->h.eor = lp->t.eor = cpu_to_le16(LOGPHDRSIZE + LOGRDSIZE);

	lrd_ptr = (struct lrd *) &lp->data;
	lrd_ptr->logtid = 0;
	lrd_ptr->backchain = 0;
	lrd_ptr->type = cpu_to_le16(LOG_SYNCPT);
	lrd_ptr->length = 0;
	lrd_ptr->log.syncpt.sync = 0;

	bp->l_blkno += sbi->nbperpage;
	bp->l_flag = lbmWRITE | lbmSYNC | lbmDIRECT;
	lbmStartIO(bp);
	if ((rc = lbmIOWait(bp, 0)))
		goto exit;

	/*
	 *	initialize succeeding log pages: lpsn = 0, 1, ..., (N-2)
	 */
	for (lspn = 0; lspn < npages - 3; lspn++) {
		lp->h.page = lp->t.page = cpu_to_le32(lspn);
		lp->h.eor = lp->t.eor = cpu_to_le16(LOGPHDRSIZE);

		bp->l_blkno += sbi->nbperpage;
		bp->l_flag = lbmWRITE | lbmSYNC | lbmDIRECT;
		lbmStartIO(bp);
		if ((rc = lbmIOWait(bp, 0)))
			goto exit;
	}

	rc = 0;
exit:
	/*
	 *	finalize log
	 */
	/* release the buffer */
	lbmFree(bp);

	return rc;
}

#ifdef CONFIG_JFS_STATISTICS
int jfs_lmstats_proc_show(struct seq_file *m, void *v)
{
	seq_printf(m,
		       "JFS Logmgr stats\n"
		       "================\n"
		       "commits = %d\n"
		       "writes submitted = %d\n"
		       "writes completed = %d\n"
		       "full pages submitted = %d\n"
		       "partial pages submitted = %d\n",
		       lmStat.commit,
		       lmStat.submitted,
		       lmStat.pagedone,
		       lmStat.full_page,
		       lmStat.partial_page);
	return 0;
}
#endif /* CONFIG_JFS_STATISTICS */
]

gemini-3.1-pro-preview

							input: 40366
							output: 21
							thoughts: 818
						

**Analyzing the JFS Log Manager Code Fix**

Okay, so I'm looking at this patch for the JFS log manager and my immediate thought is "Right, let's dissect this properly." The proposed change in `lbmRead` replaces the `wait_event` call with a call to `lbmIOWait`.  The code clearly indicates the change:

```c
-	wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));
-
-	return 0;
+	return lbmIOWait(bp, 0);
```

First, I need to verify a basic, critical point: is `lbmIOWait` even defined before it's used? I immediately scroll and verify that `lbmIOWait` *is* defined after `lbmRead` in the file. But wait, there is a forward declaration. This means the compiler *shouldn't* have choked on the change. Okay, that's a check mark.

The forward declaration at line 170 confirms my sanity:
```c
static int lbmIOWait(struct lbuf * bp, int flag);
```

Now, let's drill down into `lbmIOWait` itself.  I need to ascertain if this replacement is functionally equivalent, or potentially better, than the original wait.  The `lbmIOWait` function's code is crucial here:
```c
static int lbmIOWait(struct lbuf * bp, int flag)
{
	unsigned long flags;
	int rc = 0;

	jfs_info("lbmIOWait1: bp:0x%p flag:0x%x:0x%x", bp, bp->l_flag, flag);

	LCACHE_LOCK(flags);		/* disable+lock */

	LCACHE_SLEEP_COND(bp->l_ioevent, (bp->l_flag & lbmDONE), flags);

	rc = (bp->l_flag & lbmERROR) ? -EIO : 0;

	if (flag & lbmFREE)
		lbmfree(bp);

	LCACHE_UNLOCK(flags);	/* unlock+enable */

	jfs_info("lbmIOWait2: bp:0x%p flag:0x%x:0x%x", bp, bp->l_flag, flag);
	return rc;
}
```
Okay, `lbmIOWait` waits on `bp->l_ioevent` until `bp->l_flag` has `lbmDONE` set. Critically, it also checks for `lbmERROR` and returns `-EIO` if that's set. Aha, that's the difference. The original code in `lbmRead` *always* returned `0` (success).  The new code is now propagating an I/O error if one occurs. This is *good*, a very good thing.

The `lbmIODone` function will set `lbmDONE` when a read is completed, but, I notice, it also sets `lbmERROR` if an error occurred, before calling `LCACHE_WAKEUP`.

Now the remaining and critical question: Does the caller of `lbmRead` handle the `-EIO` return value correctly? Because if not, we've introduced a subtle, nasty bug. The fact that the original code blindly returned `0` suggests that it might not. This is where I have to now investigate the calling context of `lbmRead`.  I must examine how other parts of the filesystem handle the return from a read. I need to know this to be sure this is a robust fix.

map[Name:lbmRead]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:lmLogFileSystem SourceFile:fs/jfs/jfs_logmgr.c SourceLine:1716] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:lmLogInit SourceFile:fs/jfs/jfs_logmgr.c SourceLine:1287] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:lmLogInit SourceFile:fs/jfs/jfs_logmgr.c SourceLine:1332] map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:lmLogShutdown SourceFile:fs/jfs/jfs_logmgr.c SourceLine:1665]] TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 42253
							output: 45
							thoughts: 356
						

**Analyzing `lbmRead` and Related Code**

Okay, let's dive into this code. First, I needed to verify how the `lbmRead` function's return values are handled. I started by looking at `lmLogFileSystem`. The check:

```c
if ((rc = lbmRead(log, 1, &bpsuper)))
    return rc;
```

shows it's correctly checking the return code. Good. Then, I moved on to `lmLogInit` at line 1287:

```c
if ((rc = lbmRead(log, 1, &bpsuper)))
	goto errout10;
```

That's handling the potential error condition properly using `goto`. Moving on to line 1332 within `lmLogInit`:

```c
if ((rc = lbmRead(log, log->page, &bp)))
	goto errout20;
```

Again, the return code from `lbmRead` is checked effectively, and the code branches to handle it. Finally, I inspected `lmLogShutdown` at line 1665:

```c
if ((rc = lbmRead(log, 1, &bpsuper)))
	goto out;
```

This, too, handles the `lbmRead` return value correctly using a `goto`. So, it appears all direct callers of `lbmRead` are properly checking the return value, which is exactly what I was looking for.

Now, to be completely thorough, let's double-check if there are any other uses of `wait_event` on `l_ioevent`. I previously scanned the `lbuf::l_ioevent` references and confirmed that `lbmRead` was the only explicit usage of `wait_event`. However, wait a minute, I just recalled `lbmIOWait` uses `LCACHE_SLEEP_COND(bp->l_ioevent, (bp->l_flag & lbmDONE), flags);`. Aha! The use of `__SLEEP_COND` is important here as it indicates a sleeping condition based on an event. This is defined in `jfs_locks.h`. So I need to go see what `__SLEEP_COND` does.

requested entity does not exist

map[ContextFile:fs/jfs/jfs_locks.h IncludeLines:true Name:__SLEEP_COND]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 43168
							output: 19
							thoughts: 12
						

Here's my take on those thoughts:

**Analyzing Code for Sleep Conditions**

Okay, so I'm thinking, let's dive into this code. Specifically, I need to understand how the system handles sleep states. My gut feeling is that I'm going to find the relevant logic by searching for a specific macro, something like `__SLEEP_COND`. That's a pretty common naming convention, and it's a good starting point for locating conditional code related to sleep management. It's a quick and dirty way to get my bearings and see where this specific system is implementing its sleep conditions. Let's see what we can find. I expect this will be a good entry point to understand how sleep is controlled within the system.

map[Expression:__SLEEP_COND]

map[Output:fs/jfs/jfs_lock.h-21- */
fs/jfs/jfs_lock.h:22:#define __SLEEP_COND(wq, cond, lock_cmd, unlock_cmd)	\
fs/jfs/jfs_lock.h-23-do {							\
--
fs/jfs/jfs_logmgr.c=102=static DEFINE_SPINLOCK(jfsLCacheLock);
--
fs/jfs/jfs_logmgr.c-107-/*
fs/jfs/jfs_logmgr.c:108: * See __SLEEP_COND in jfs_locks.h
fs/jfs/jfs_logmgr.c-109- */
--
fs/jfs/jfs_logmgr.c=111=do {						\
--
fs/jfs/jfs_logmgr.c-113-		break;				\
fs/jfs/jfs_logmgr.c:114:	__SLEEP_COND(wq, cond, LCACHE_LOCK(flags), LCACHE_UNLOCK(flags)); \
fs/jfs/jfs_logmgr.c-115-} while (0)
--
fs/jfs/jfs_logmgr.c=656=int lmGroupCommit(struct jfs_log * log, struct tblock * tblk)
--
fs/jfs/jfs_logmgr.c-710-
fs/jfs/jfs_logmgr.c:711:	__SLEEP_COND(tblk->gcwait, (tblk->flag & tblkGC_COMMITTED),
fs/jfs/jfs_logmgr.c-712-		     LOGGC_LOCK(log), LOGGC_UNLOCK(log));
]

gemini-3.1-pro-preview

							input: 43801
							output: 45
							thoughts: 29
						

Okay, here's my interpretation of that thought process, assuming I'm already deep in kernel development and understand the context:

**Digging into JFS Locking**

Right, `__SLEEP_COND`. Time to figure out exactly what's going on with this. Okay, so it's defined in `fs/jfs/jfs_lock.h`. Excellent. That's the file I expected it to be in. Let's get that header file open and see what's actually under the hood. Time to crack open the source and see what's what. This is where the real details are.

requested entity does not exist

map[ContextFile:fs/jfs/jfs_lock.h IncludeLines:true Name:__SLEEP_COND]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 44029
							output: 20
							thoughts: 26
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Analyzing the Codebase: Identifying and Locating a Macro**

Alright, so I've stumbled upon something that looks like a macro. My first instinct, given my deep familiarity with kernel development, is to track down its definition. My intuition honed from countless debugging sessions immediately sends me to the file system context. Specifically, the "jfs" filesystem, and since it's likely related to locking, I'm going to quickly grep the `fs/jfs/jfs_lock.h` file. That's usually the go-to place for anything low-level like synchronization primitives, especially considering JFS's specific locking mechanisms. I'm practically visualizing the header file now, hoping to see a familiar macro name jump out at me.

map[Expression:define __SLEEP_COND]

map[Output:fs/jfs/jfs_lock.h-21- */
fs/jfs/jfs_lock.h:22:#define __SLEEP_COND(wq, cond, lock_cmd, unlock_cmd)	\
fs/jfs/jfs_lock.h-23-do {							\
]

gemini-3.1-pro-preview

							input: 44336
							output: 26
							thoughts: 17
						

Okay, here's my take on those thoughts, tailored for an expert audience:

**Diving into `fs/jfs/jfs_lock.h`**

Alright, time to get into the nitty-gritty. Let's see what kind of locking primitives are at play in the JFS filesystem. The `jfs_lock.h` header file is where the magic (or headache) begins. I'm expecting to see the usual suspects – spinlocks, mutexes, read-write locks, maybe even some custom synchronization objects tailored specifically to JFS's journaling requirements. Given JFS's reputation for being robust, I'm hoping to see a well-thought-out strategy to handle concurrent access to the metadata and data structures. I'm particularly interested in how they've handled the notorious deadlocks that often plague filesystems. Are they using lock hierarchies? Timed locks? What's their strategy for handling lock contention under heavy I/O load? The design choices here will tell a lot about the performance characteristics and reliability of the whole system. Let's see if they're making good use of the hardware and software features.

map[File:fs/jfs/jfs_lock.h]

map[Contents:/* SPDX-License-Identifier: GPL-2.0-or-later */
/*
 *   Copyright (C) International Business Machines Corp., 2000-2001
 *   Portions Copyright (C) Christoph Hellwig, 2001-2002
 */
#ifndef _H_JFS_LOCK
#define _H_JFS_LOCK

#include <linux/spinlock.h>
#include <linux/mutex.h>
#include <linux/sched.h>

/*
 *	jfs_lock.h
 */

/*
 * Conditional sleep where condition is protected by spinlock
 *
 * lock_cmd and unlock_cmd take and release the spinlock
 */
#define __SLEEP_COND(wq, cond, lock_cmd, unlock_cmd)	\
do {							\
	DECLARE_WAITQUEUE(__wait, current);		\
							\
	add_wait_queue(&wq, &__wait);			\
	for (;;) {					\
		set_current_state(TASK_UNINTERRUPTIBLE);\
		if (cond)				\
			break;				\
		unlock_cmd;				\
		io_schedule();				\
		lock_cmd;				\
	}						\
	__set_current_state(TASK_RUNNING);			\
	remove_wait_queue(&wq, &__wait);		\
} while (0)

#endif				/* _H_JFS_LOCK */
]

gemini-3.1-pro-preview

							input: 44975
							output: 17
							thoughts: 1289
						

**Analyzing the Synchronization in JFS Logging**

Okay, so I've been digging into this JFS logging code, specifically the interaction between `lbmRead`, `lbmIOWait`, and `lbmIODone`. I'm trying to wrap my head around the synchronization here. My initial thought is that `__SLEEP_COND` seems solid; it correctly drops the lock, calls `io_schedule()`, and reacquires the lock, which is the cornerstone of how these asynchronous operations are handled.

My primary concern is whether `lbmIOWait` is safe to call from `lbmRead`. `lbmRead`, as I see it, allocates a buffer (`bp`), sets the `lbmREAD` flag, submits a bio, and then waits. My first instinct is to replace the `wait_event` call with a direct call to `lbmIOWait`. If I make that change, `lbmIOWait` would then disable interrupts, acquire a lock, call `LCACHE_SLEEP_COND`, and then unlock the lock before returning with the results. That looks correct and straightforward on the surface.

I then did a deeper dive to see if `lbmDONE` is properly set in all paths of `lbmIODone`, ensuring the waiting logic works correctly. From the looks of it, it appears the `lbmDONE` flag is set at the `out:` label, regardless of the success or error of the I/O. So far, so good.

Now, here's where my focus sharpens: what happens if `lbmIODone` is called synchronously from `lbmRead` when `log->no_integrity` is true? In this scenario, `lbmIODone` is called directly, sets `lbmDONE`, and unlocks the lock immediately. The `lbmIOWait` call is the next thing called, so it will acquire the lock, see `lbmDONE` is already set, and return immediately. This also seems correct.

However, I'm now considering the `lbmFREE` flag and its effect. Thinking back to how `lbmRead` uses `lbmIOWait`, the flag is set to zero which means the calling function is responsible for freeing the resource. But, what happens if there's a race condition? Take `lmLogShutdown` as an example; here `bpsuper` is returned from `lbmRead` and can be used in other calls, like `lbmDirectWrite`. It's possible that `lbmRead` could return, and the resource could be reused before the `lbmIODone` function has finished executing. I think *this* is the bug described in the report.

I need to confirm if there are any other places where `wait_event` is used in `fs/jfs/jfs_logmgr.c`, but it feels like I'm on the right track here, and there might be a few other places where this could be an issue.

map[Expression:wait_event]

map[Output:
Full output is too long, showing 500 out of 13189 lines.
Use more precise expression if possible.

[Documentation/driver-api/nfc/nfc-hci.rst=236=Internally, execution is asynchronous. So all this API does is to enqueue the
 Documentation/driver-api/nfc/nfc-hci.rst:237:HCI command, setup a local wait queue on stack, and wait_event() for completion.
 Documentation/driver-api/nfc/nfc-hci.rst-238-The wait is not interruptible because it is guaranteed that the command will
 --
 Documentation/driver-api/parport-lowlevel.rst=9=Global functions::
 --
 Documentation/driver-api/parport-lowlevel.rst-22-  parport_poll_peripheral
 Documentation/driver-api/parport-lowlevel.rst:23:  parport_wait_event
 Documentation/driver-api/parport-lowlevel.rst-24-  parport_negotiate
 --
 Documentation/driver-api/parport-lowlevel.rst=742=parport_wait_peripheral
 --
 Documentation/driver-api/parport-lowlevel.rst-745-
 Documentation/driver-api/parport-lowlevel.rst:746:parport_wait_event - wait for an event on a port
 Documentation/driver-api/parport-lowlevel.rst-747-------------------------------------------------
 --
 Documentation/driver-api/parport-lowlevel.rst=749=SYNOPSIS
 --
 Documentation/driver-api/parport-lowlevel.rst-755-
 Documentation/driver-api/parport-lowlevel.rst:756:	int parport_wait_event (struct parport *port, signed long timeout)
 Documentation/driver-api/parport-lowlevel.rst-757-
 --
 Documentation/kernel-hacking/hacking.rst=516=put yourself in the queue before checking the condition. There is a
 Documentation/kernel-hacking/hacking.rst:517:macro to do this: wait_event_interruptible()
 Documentation/kernel-hacking/hacking.rst-518-(``include/linux/wait.h``) The first argument is the wait queue head, and
 --
 Documentation/kernel-hacking/hacking.rst=520=this expression is true, or ``-ERESTARTSYS`` if a signal is received. The
 Documentation/kernel-hacking/hacking.rst:521:wait_event() version ignores signals.
 Documentation/kernel-hacking/hacking.rst-522-
 --
 Documentation/memory-barriers.txt=2185=interpolate the memory barrier in the right place, for example:
 Documentation/memory-barriers.txt-2186-
 Documentation/memory-barriers.txt:2187:	wait_event();
 Documentation/memory-barriers.txt:2188:	wait_event_cmd();
 Documentation/memory-barriers.txt:2189:	wait_event_exclusive_cmd();
 Documentation/memory-barriers.txt:2190:	wait_event_interruptible();
 Documentation/memory-barriers.txt:2191:	wait_event_interruptible_exclusive();
 Documentation/memory-barriers.txt:2192:	wait_event_interruptible_timeout();
 Documentation/memory-barriers.txt:2193:	wait_event_killable();
 Documentation/memory-barriers.txt:2194:	wait_event_timeout();
 Documentation/memory-barriers.txt-2195-	wait_on_bit();
 --
 Documentation/power/freezing-of-tasks.rst=45=signal-handling code, but the freezable kernel threads need to call it
 Documentation/power/freezing-of-tasks.rst:46:explicitly in suitable places or use the wait_event_freezable() or
 Documentation/power/freezing-of-tasks.rst:47:wait_event_freezable_timeout() macros (defined in include/linux/wait.h)
 Documentation/power/freezing-of-tasks.rst-48-that put the task to sleep (TASK_INTERRUPTIBLE) or freeze it (TASK_FROZEN) if
 --
 Documentation/power/freezing-of-tasks.rst=50=like the following one::
 --
 Documentation/power/freezing-of-tasks.rst-56-
 Documentation/power/freezing-of-tasks.rst:57:		wait_event_freezable(oom_reaper_wait, oom_reaper_list != NULL);
 Documentation/power/freezing-of-tasks.rst-58-		spin_lock_irq(&oom_reaper_lock);
 --
 Documentation/power/freezing-of-tasks.rst=74=kernel threads must call try_to_freeze() somewhere or use one of the
 Documentation/power/freezing-of-tasks.rst:75:wait_event_freezable() and wait_event_freezable_timeout() macros.
 Documentation/power/freezing-of-tasks.rst-76-
 --
 Documentation/power/freezing-of-tasks.rst=108=directly is not allowed).  From this point it is regarded as freezable
 Documentation/power/freezing-of-tasks.rst:109:and must call try_to_freeze() or variants of wait_event_freezable() in a
 Documentation/power/freezing-of-tasks.rst-110-suitable place.
 --
 Documentation/scsi/ChangeLog.lpfc=98=Changes from 20050215 to 20050223
 --
 Documentation/scsi/ChangeLog.lpfc-134-	* Fix comment for lpfc_sli_iocb_cmd_type to fit within 80 columns.
 Documentation/scsi/ChangeLog.lpfc:135:	* Replaced wait_event() with wait_event_interruptible().
 Documentation/scsi/ChangeLog.lpfc:136:	  wait_event() puts the woker thread in an UNINTERRUPTIBLE state
 Documentation/scsi/ChangeLog.lpfc-137-	  causing it to figure in load average calculations. Also add a
 Documentation/scsi/ChangeLog.lpfc:138:	  BUG_ON to the ret code of wait_event_interruptible() since the
 Documentation/scsi/ChangeLog.lpfc-139-	  premise is that the worker thread is signal-immune.
 --
 Documentation/scsi/ChangeLog.lpfc=319=Changes from 20041229 to 20050110
 --
 Documentation/scsi/ChangeLog.lpfc-349-	  information
 Documentation/scsi/ChangeLog.lpfc:350:	* Added use of wait_event to work with kthread interface.
 Documentation/scsi/ChangeLog.lpfc-351-	* Ensure that scsi_transport_fc.h is always pulled in by
 --
 Documentation/translations/it_IT/kernel-hacking/hacking.rst=549=mettervi in coda prima di verificare la condizione. Esiste una macro
 Documentation/translations/it_IT/kernel-hacking/hacking.rst:550:a questo scopo: :c:func:`wait_event_interruptible()` (``include/linux/wait.h``).
 Documentation/translations/it_IT/kernel-hacking/hacking.rst-551-Il primo argomento è la testa della coda d'attesa, e il secondo è
 --
 Documentation/translations/it_IT/kernel-hacking/hacking.rst=553=espressione è vera, altrimenti ``-ERESTARTSYS`` se è stato ricevuto un segnale.
 Documentation/translations/it_IT/kernel-hacking/hacking.rst:554:La versione :c:func:`wait_event()` ignora i segnali.
 Documentation/translations/it_IT/kernel-hacking/hacking.rst-555-
 --
 Documentation/translations/sp_SP/memory-barriers.txt=2280=correcto:
 Documentation/translations/sp_SP/memory-barriers.txt-2281-
 Documentation/translations/sp_SP/memory-barriers.txt:2282:	wait_event();
 Documentation/translations/sp_SP/memory-barriers.txt:2283:	wait_event_interruptible();
 Documentation/translations/sp_SP/memory-barriers.txt:2284:	wait_event_interruptible_exclusive();
 Documentation/translations/sp_SP/memory-barriers.txt:2285:	wait_event_interruptible_timeout();
 Documentation/translations/sp_SP/memory-barriers.txt:2286:	wait_event_killable();
 Documentation/translations/sp_SP/memory-barriers.txt:2287:	wait_event_timeout();
 Documentation/translations/sp_SP/memory-barriers.txt-2288-	wait_on_bit();
 --
 Documentation/translations/zh_CN/kernel-hacking/hacking.rst=347=CPU上运行。
 --
 Documentation/translations/zh_CN/kernel-hacking/hacking.rst-434-将自己放在等待队列中相当复杂，因为你必须在检查条件之前将自己放入队列中。有一
 Documentation/translations/zh_CN/kernel-hacking/hacking.rst:435:个宏可以来执行此操作： :c:func:`wait_event_interruptible()`
 Documentation/translations/zh_CN/kernel-hacking/hacking.rst-436-（ ``include/linux/wait.h`` ）第一个参数是等待队列头，第二个参数是计算的表达
 Documentation/translations/zh_CN/kernel-hacking/hacking.rst-437-式；当该表达式为true时宏返回0，或者在接收到信号时返回 ``-ERESTARTSYS`` 。
 Documentation/translations/zh_CN/kernel-hacking/hacking.rst:438::c:func:`wait_event()` 版本会忽略信号。
 Documentation/translations/zh_CN/kernel-hacking/hacking.rst-439-
 --
 arch/arm/common/bL_switcher.c=270=static int bL_switcher_thread(void *arg)
 --
 arch/arm/common/bL_switcher.c-282-			flush_signals(current);
 arch/arm/common/bL_switcher.c:283:		wait_event_interruptible(t->wq,
 arch/arm/common/bL_switcher.c-284-				t->wanted_cluster != -1 ||
 --
 arch/arm/mach-pxa/am200epd.c=308=static void am200_set_stdby(struct metronomefb_par *par, int state)
 --
 arch/arm/mach-pxa/am200epd.c-312-
 arch/arm/mach-pxa/am200epd.c:313:static int am200_wait_event(struct metronomefb_par *par)
 arch/arm/mach-pxa/am200epd.c-314-{
 arch/arm/mach-pxa/am200epd.c:315:	return wait_event_timeout(par->waitq, gpio_get_value(RDY_GPIO_PIN), HZ);
 arch/arm/mach-pxa/am200epd.c-316-}
 arch/arm/mach-pxa/am200epd.c-317-
 arch/arm/mach-pxa/am200epd.c:318:static int am200_wait_event_intr(struct metronomefb_par *par)
 arch/arm/mach-pxa/am200epd.c-319-{
 arch/arm/mach-pxa/am200epd.c:320:	return wait_event_interruptible_timeout(par->waitq,
 arch/arm/mach-pxa/am200epd.c-321-					gpio_get_value(RDY_GPIO_PIN), HZ);
 --
 arch/arm/mach-pxa/am200epd.c=324=static struct metronome_board am200_board = {
 --
 arch/arm/mach-pxa/am200epd.c-330-	.set_stdby		= am200_set_stdby,
 arch/arm/mach-pxa/am200epd.c:331:	.met_wait_event		= am200_wait_event,
 arch/arm/mach-pxa/am200epd.c:332:	.met_wait_event_intr	= am200_wait_event_intr,
 arch/arm/mach-pxa/am200epd.c-333-	.get_panel_type		= am200_get_panel_type,
 --
 arch/arm/mach-pxa/am300epd.c=97=static char *gpio_names[] = { "PWR", "CFG", "RDY", "DC", "RST", "RD", "WR",
 --
 arch/arm/mach-pxa/am300epd.c-99-
 arch/arm/mach-pxa/am300epd.c:100:static int am300_wait_event(struct broadsheetfb_par *par)
 arch/arm/mach-pxa/am300epd.c-101-{
 arch/arm/mach-pxa/am300epd.c-102-	/* todo: improve err recovery */
 arch/arm/mach-pxa/am300epd.c:103:	wait_event(par->waitq, gpio_get_value(RDY_GPIO_PIN));
 arch/arm/mach-pxa/am300epd.c-104-	return 0;
 --
 arch/arm/mach-pxa/am300epd.c=107=static int am300_init_gpio_regs(struct broadsheetfb_par *par)
 --
 arch/arm/mach-pxa/am300epd.c-155-	msleep(10);
 arch/arm/mach-pxa/am300epd.c:156:	am300_wait_event(par);
 arch/arm/mach-pxa/am300epd.c-157-
 --
 arch/arm/mach-pxa/am300epd.c=252=static struct broadsheet_board am300_board = {
 --
 arch/arm/mach-pxa/am300epd.c-258-	.set_ctl		= am300_set_ctl,
 arch/arm/mach-pxa/am300epd.c:259:	.wait_for_rdy		= am300_wait_event,
 arch/arm/mach-pxa/am300epd.c-260-	.get_panel_type		= am300_get_panel_type,
 --
 arch/arm/mach-rpc/ecard.c=262=ecard_task(void * unused)
 --
 arch/arm/mach-rpc/ecard.c-275-
 arch/arm/mach-rpc/ecard.c:276:		wait_event_interruptible(ecard_wait, ecard_req != NULL);
 arch/arm/mach-rpc/ecard.c-277-
 --
 arch/arm64/kvm/arm.c=1007=static void kvm_vcpu_sleep(struct kvm_vcpu *vcpu)
 --
 arch/arm64/kvm/arm.c-1010-
 arch/arm64/kvm/arm.c:1011:	rcuwait_wait_event(wait,
 arch/arm64/kvm/arm.c-1012-			   (!kvm_arm_vcpu_stopped(vcpu)) && (!vcpu->arch.pause),
 --
 arch/m68k/atari/stdma.c=104=void stdma_lock(irq_handler_t handler, void *data)
 --
 arch/m68k/atari/stdma.c-108-	 buffers) */
 arch/m68k/atari/stdma.c:109:	wait_event(stdma_wait, stdma_try_lock(handler, data));
 arch/m68k/atari/stdma.c-110-}
 --
 arch/mips/kernel/rtlx.c=91=int rtlx_open(int index, int can_sleep)
 --
 arch/mips/kernel/rtlx.c-112-			if (can_sleep) {
 arch/mips/kernel/rtlx.c:113:				ret = __wait_event_interruptible(
 arch/mips/kernel/rtlx.c-114-					channel_wqs[index].lx_queue,
 --
 arch/mips/kernel/rtlx.c=192=unsigned int rtlx_read_poll(int index, int can_sleep)
 --
 arch/mips/kernel/rtlx.c-203-		if (can_sleep) {
 arch/mips/kernel/rtlx.c:204:			int ret = __wait_event_interruptible(
 arch/mips/kernel/rtlx.c-205-				channel_wqs[index].lx_queue,
 --
 arch/mips/kernel/rtlx.c=373=static ssize_t file_write(struct file *file, const char __user *buffer,
 --
 arch/mips/kernel/rtlx.c-384-
 arch/mips/kernel/rtlx.c:385:		ret = __wait_event_interruptible(channel_wqs[minor].rt_queue,
 arch/mips/kernel/rtlx.c-386-					   rtlx_write_poll(minor));
 --
 arch/mips/math-emu/dsemul.c=75=static int alloc_emuframe(void)
 --
 arch/mips/math-emu/dsemul.c-105-		spin_unlock(&mm_ctx->bd_emupage_lock);
 arch/mips/math-emu/dsemul.c:106:		if (!wait_event_killable(mm_ctx->bd_emupage_queue,
 arch/mips/math-emu/dsemul.c-107-			!bitmap_full(mm_ctx->bd_emupage_allocmap,
 --
 arch/mips/sibyte/common/sb_tbprof.c=360=static int sbprof_zbprof_stop(void)
 --
 arch/mips/sibyte/common/sb_tbprof.c-372-		pr_debug(DEVNAME ": wait for disarm\n");
 arch/mips/sibyte/common/sb_tbprof.c:373:		err = wait_event_interruptible(sbp.tb_sync, !sbp.tb_armed);
 arch/mips/sibyte/common/sb_tbprof.c-374-		pr_debug(DEVNAME ": disarm complete, stat %d\n", err);
 --
 arch/mips/sibyte/common/sb_tbprof.c=491=static long sbprof_tb_ioctl(struct file *filp,
 --
 arch/mips/sibyte/common/sb_tbprof.c-510-	case SBPROF_ZBWAITFULL: {
 arch/mips/sibyte/common/sb_tbprof.c:511:		err = wait_event_interruptible(sbp.tb_read, TB_FULL);
 arch/mips/sibyte/common/sb_tbprof.c-512-		if (err)
 --
 arch/powerpc/kernel/rtasd.c=301=static ssize_t rtas_log_read(struct file * file, char __user * buf,
 --
 arch/powerpc/kernel/rtasd.c-340-		spin_unlock_irqrestore(&rtasd_log_lock, s);
 arch/powerpc/kernel/rtasd.c:341:		error = wait_event_interruptible(rtas_log_wait, rtas_log_size);
 arch/powerpc/kernel/rtasd.c-342-		if (error)
 --
 arch/powerpc/platforms/83xx/suspend.c=263=static int agent_thread_fn(void *data)
 --
 arch/powerpc/platforms/83xx/suspend.c-267-	while (1) {
 arch/powerpc/platforms/83xx/suspend.c:268:		wait_event_freezable(agent_wq, pci_pm_state >= 2);
 arch/powerpc/platforms/83xx/suspend.c-269-
 --
 arch/powerpc/platforms/cell/spufs/spufs.h=294=extern char *isolated_loader;
 --
 arch/powerpc/platforms/cell/spufs/spufs.h-297- * spufs_wait
 arch/powerpc/platforms/cell/spufs/spufs.h:298: *	Same as wait_event_interruptible(), except that here
 arch/powerpc/platforms/cell/spufs/spufs.h-299- *	we need to call spu_release(ctx) before sleeping, and
 --
 arch/powerpc/platforms/powernv/opal-async.c=128=int opal_async_wait_response(uint64_t token, struct opal_msg *msg)
 --
 arch/powerpc/platforms/powernv/opal-async.c-140-	/*
 arch/powerpc/platforms/powernv/opal-async.c:141:	 * There is no need to mark the token as dispatched, wait_event()
 arch/powerpc/platforms/powernv/opal-async.c-142-	 * will block until the token completes.
 --
 arch/powerpc/platforms/powernv/opal-async.c-148-	opal_wake_poller();
 arch/powerpc/platforms/powernv/opal-async.c:149:	wait_event(opal_async_wait, opal_async_tokens[token].state
 arch/powerpc/platforms/powernv/opal-async.c-150-			== ASYNC_TOKEN_COMPLETED);
 --
 arch/powerpc/platforms/powernv/opal-async.c=157=int opal_async_wait_response_interruptible(uint64_t token, struct opal_msg *msg)
 --
 arch/powerpc/platforms/powernv/opal-async.c-173-	 * The first time this gets called we mark the token as DISPATCHED
 arch/powerpc/platforms/powernv/opal-async.c:174:	 * so that if wait_event_interruptible() returns not zero and the
 arch/powerpc/platforms/powernv/opal-async.c-175-	 * caller frees the token, we know not to actually free the token
 --
 arch/powerpc/platforms/powernv/opal-async.c-200-	opal_wake_poller();
 arch/powerpc/platforms/powernv/opal-async.c:201:	ret = wait_event_interruptible(opal_async_wait,
 arch/powerpc/platforms/powernv/opal-async.c-202-			opal_async_tokens[token].state ==
 --
 arch/powerpc/platforms/powernv/opal-prd.c=159=static ssize_t opal_prd_read(struct file *file, char __user *buf,
 --
 arch/powerpc/platforms/powernv/opal-prd.c-191-
 arch/powerpc/platforms/powernv/opal-prd.c:192:		rc = wait_event_interruptible(opal_prd_msg_wait,
 arch/powerpc/platforms/powernv/opal-prd.c-193-				!opal_msg_queue_empty());
 --
 arch/powerpc/platforms/ps3/device-init.c=725=static int ps3_notification_read_write(struct ps3_notification_device *dev,
 --
 arch/powerpc/platforms/ps3/device-init.c-744-
 arch/powerpc/platforms/ps3/device-init.c:745:	rcuwait_wait_event(&dev->wait, dev->done || kthread_should_stop(), TASK_IDLE);
 arch/powerpc/platforms/ps3/device-init.c-746-
 --
 arch/powerpc/platforms/pseries/rtas-work-area.c=81=struct rtas_work_area * __ref __rtas_work_area_alloc(size_t size)
 --
 arch/powerpc/platforms/pseries/rtas-work-area.c-102-	mutex_lock(&rwa_state.mutex);
 arch/powerpc/platforms/pseries/rtas-work-area.c:103:	wait_event(rwa_state.wqh,
 arch/powerpc/platforms/pseries/rtas-work-area.c-104-		   (addr = gen_pool_alloc(rwa_state.gen_pool, size)) != 0);
 --
 arch/riscv/kvm/vcpu.c=663=static int kvm_riscv_check_vcpu_requests(struct kvm_vcpu *vcpu)
 --
 arch/riscv/kvm/vcpu.c-669-			kvm_vcpu_srcu_read_unlock(vcpu);
 arch/riscv/kvm/vcpu.c:670:			rcuwait_wait_event(wait,
 arch/riscv/kvm/vcpu.c-671-				(!kvm_riscv_vcpu_stopped(vcpu)) && (!vcpu->arch.pause),
 --
 arch/s390/kvm/priv.c=398=static int handle_ipte_interlock(struct kvm_vcpu *vcpu)
 --
 arch/s390/kvm/priv.c-402-		return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP);
 arch/s390/kvm/priv.c:403:	wait_event(vcpu->kvm->arch.ipte_wq, !ipte_lock_held(vcpu->kvm));
 arch/s390/kvm/priv.c-404-	kvm_s390_retry_instr(vcpu);
 --
 arch/s390/lib/test_unwind.c=319=static noinline int unwindme_func4(struct unwindme *u)
 --
 arch/s390/lib/test_unwind.c-324-		complete(&u->task_ready);
 arch/s390/lib/test_unwind.c:325:		wait_event(u->task_wq, kthread_should_park());
 arch/s390/lib/test_unwind.c-326-		kthread_parkme();
 --
 arch/s390/mm/cmm.c=161=static int cmm_thread(void *dummy)
 --
 arch/s390/mm/cmm.c-165-	while (1) {
 arch/s390/mm/cmm.c:166:		rc = wait_event_interruptible(cmm_thread_wait,
 arch/s390/mm/cmm.c-167-			cmm_pages != cmm_pages_target ||
 --
 arch/sh/drivers/dma/dma-api.c=125=void dma_wait_for_completion(unsigned int chan)
 --
 arch/sh/drivers/dma/dma-api.c-130-	if (channel->flags & DMA_TEI_CAPABLE) {
 arch/sh/drivers/dma/dma-api.c:131:		wait_event(channel->wait_queue,
 arch/sh/drivers/dma/dma-api.c-132-			   (info->ops->get_residue(channel) == 0));
 --
 arch/x86/kernel/apm_32.c=1433=static ssize_t do_read(struct file *fp, char __user *buf, size_t count, loff_t *ppos)
 --
 arch/x86/kernel/apm_32.c-1445-		return -EAGAIN;
 arch/x86/kernel/apm_32.c:1446:	wait_event_interruptible(apm_waitqueue, !queue_empty(as));
 arch/x86/kernel/apm_32.c-1447-	i = count;
 --
 arch/x86/kernel/apm_32.c=1489=static long do_ioctl(struct file *filp, u_int cmd, u_long arg)
 --
 arch/x86/kernel/apm_32.c-1525-			mutex_unlock(&apm_mutex);
 arch/x86/kernel/apm_32.c:1526:			wait_event_interruptible(apm_suspend_waitqueue,
 arch/x86/kernel/apm_32.c-1527-					as->suspend_wait == 0);
 --
 arch/x86/kernel/cpu/sgx/main.c=399=static int ksgxd(void *p)
 --
 arch/x86/kernel/cpu/sgx/main.c-413-
 arch/x86/kernel/cpu/sgx/main.c:414:		wait_event_freezable(ksgxd_waitq,
 arch/x86/kernel/cpu/sgx/main.c-415-				     kthread_should_stop() ||
 --
 arch/x86/platform/intel/iosf_mbi.c=214=void iosf_mbi_punit_acquire(void)
 --
 arch/x86/platform/intel/iosf_mbi.c-219-		mutex_unlock(&iosf_mbi_pmic_access_mutex);
 arch/x86/platform/intel/iosf_mbi.c:220:		wait_event(iosf_mbi_pmic_access_waitq,
 arch/x86/platform/intel/iosf_mbi.c-221-			   iosf_mbi_pmic_i2c_access_count == 0);
 --
 arch/x86/platform/intel/iosf_mbi.c=312=int iosf_mbi_block_punit_i2c_access(void)
 --
 arch/x86/platform/intel/iosf_mbi.c-324-		mutex_unlock(&iosf_mbi_pmic_access_mutex);
 arch/x86/platform/intel/iosf_mbi.c:325:		wait_event(iosf_mbi_pmic_access_waitq,
 arch/x86/platform/intel/iosf_mbi.c-326-			   iosf_mbi_pmic_punit_access_count == 0);
 --
 block/blk-core.c=304=int blk_queue_enter(struct request_queue *q, blk_mq_req_flags_t flags)
 --
 block/blk-core.c-319-		smp_rmb();
 block/blk-core.c:320:		wait_event(q->mq_freeze_wq,
 block/blk-core.c-321-			   (!q->mq_freeze_depth &&
 --
 block/blk-core.c=333=int __bio_queue_enter(struct request_queue *q, struct bio *bio)
 --
 block/blk-core.c-352-		smp_rmb();
 block/blk-core.c:353:		wait_event(q->mq_freeze_wq,
 block/blk-core.c-354-			   (!q->mq_freeze_depth &&
 --
 block/blk-crypto-profile.c=246=blk_status_t blk_crypto_get_keyslot(struct blk_crypto_profile *profile,
 --
 block/blk-crypto-profile.c-284-		blk_crypto_hw_exit(profile);
 block/blk-crypto-profile.c:285:		wait_event(profile->idle_slots_wait_queue,
 block/blk-crypto-profile.c-286-			   !list_empty(&profile->idle_slots));
 --
 block/blk-mq.c=189=void blk_mq_freeze_queue_wait(struct request_queue *q)
 block/blk-mq.c-190-{
 block/blk-mq.c:191:	wait_event(q->mq_freeze_wq, percpu_ref_is_zero(&q->q_usage_counter));
 block/blk-mq.c-192-}
 --
 block/blk-mq.c=195=int blk_mq_freeze_queue_wait_timeout(struct request_queue *q,
 --
 block/blk-mq.c-197-{
 block/blk-mq.c:198:	return wait_event_timeout(q->mq_freeze_wq,
 block/blk-mq.c-199-					percpu_ref_is_zero(&q->q_usage_counter),
 --
 crypto/af_alg.c=778=static int af_alg_wait_for_wmem(struct sock *sk, unsigned int flags)
 --
 crypto/af_alg.c-793-		timeout = MAX_SCHEDULE_TIMEOUT;
 crypto/af_alg.c:794:		if (sk_wait_event(sk, &timeout, af_alg_writable(sk), &wait)) {
 crypto/af_alg.c-795-			err = 0;
 --
 crypto/af_alg.c=835=int af_alg_wait_for_data(struct sock *sk, unsigned flags, unsigned min)
 --
 crypto/af_alg.c-852-		timeout = MAX_SCHEDULE_TIMEOUT;
 crypto/af_alg.c:853:		if (sk_wait_event(sk, &timeout,
 crypto/af_alg.c-854-				  ctx->init && (!ctx->more ||
 --
 crypto/jitterentropy-testing.c=121=static int jent_testing_reader(struct jent_testing *data, u32 *boot,
 --
 crypto/jitterentropy-testing.c-147-
 crypto/jitterentropy-testing.c:148:			wait_event_interruptible(data->read_wait,
 crypto/jitterentropy-testing.c-149-						 jent_testing_have_data(data));
 --
 drivers/accel/amdxdna/aie2_ctx.c=744=void aie2_hwctx_fini(struct amdxdna_hwctx *hwctx)
 --
 drivers/accel/amdxdna/aie2_ctx.c-762-	/* Wait for all submitted jobs to be completed or canceled */
 drivers/accel/amdxdna/aie2_ctx.c:763:	wait_event(hwctx->priv->job_free_wq,
 drivers/accel/amdxdna/aie2_ctx.c-764-		   atomic64_read(&hwctx->job_submit_cnt) ==
 --
 drivers/accel/ivpu/ivpu_ipc.c=248=int ivpu_ipc_receive(struct ivpu_device *vdev, struct ivpu_ipc_consumer *cons,
 --
 drivers/accel/ivpu/ivpu_ipc.c-257-
 drivers/accel/ivpu/ivpu_ipc.c:258:	wait_ret = wait_event_timeout(cons->rx_msg_wq,
 drivers/accel/ivpu/ivpu_ipc.c-259-				      ivpu_ipc_rx_need_wakeup(cons),
 --
 drivers/accel/qaic/qaic_control.c=298=static void save_dbc_buf(struct qaic_device *qdev, struct ioctl_resources *resources,
 --
 drivers/accel/qaic/qaic_control.c-303-	if (resources->buf) {
 drivers/accel/qaic/qaic_control.c:304:		wait_event_interruptible(qdev->dbc[dbc_id].dbc_release, !qdev->dbc[dbc_id].in_use);
 drivers/accel/qaic/qaic_control.c-305-		qdev->dbc[dbc_id].req_q_base = resources->buf;
 --
 drivers/acpi/acpi_dbg.c=300=static ssize_t acpi_aml_write_log(const char *msg)
 --
 drivers/acpi/acpi_dbg.c-312-		if (ret == -EAGAIN) {
 drivers/acpi/acpi_dbg.c:313:			ret = wait_event_interruptible(acpi_aml_io.wait,
 drivers/acpi/acpi_dbg.c-314-				acpi_aml_kern_writable());
 --
 drivers/acpi/acpi_dbg.c=340=static ssize_t acpi_aml_read_cmd(char *msg, size_t count)
 --
 drivers/acpi/acpi_dbg.c-356-		if (ret == -EAGAIN) {
 drivers/acpi/acpi_dbg.c:357:			ret = wait_event_interruptible(acpi_aml_io.wait,
 drivers/acpi/acpi_dbg.c-358-				acpi_aml_kern_readable());
 --
 drivers/acpi/acpi_dbg.c=528=static int acpi_aml_release(struct inode *inode, struct file *file)
 --
 drivers/acpi/acpi_dbg.c-549-		 */
 drivers/acpi/acpi_dbg.c:550:		wait_event(acpi_aml_io.wait, !acpi_aml_busy());
 drivers/acpi/acpi_dbg.c-551-
 --
 drivers/acpi/acpi_dbg.c-557-		acpi_terminate_debugger();
 drivers/acpi/acpi_dbg.c:558:		wait_event(acpi_aml_io.wait, !acpi_aml_used());
 drivers/acpi/acpi_dbg.c-559-		pr_debug("Debugger thread terminated.\n");
 --
 drivers/acpi/acpi_dbg.c=599=static ssize_t acpi_aml_read(struct file *file, char __user *buf,
 --
 drivers/acpi/acpi_dbg.c-616-			else {
 drivers/acpi/acpi_dbg.c:617:				ret = wait_event_interruptible(acpi_aml_io.wait,
 drivers/acpi/acpi_dbg.c-618-					acpi_aml_user_readable());
 --
 drivers/acpi/acpi_dbg.c=669=static ssize_t acpi_aml_write(struct file *file, const char __user *buf,
 --
 drivers/acpi/acpi_dbg.c-686-			else {
 drivers/acpi/acpi_dbg.c:687:				ret = wait_event_interruptible(acpi_aml_io.wait,
 drivers/acpi/acpi_dbg.c-688-					acpi_aml_user_writable());
 --
 drivers/acpi/acpica/acinterp.h=309=acpi_status
 drivers/acpi/acpica/acinterp.h:310:acpi_ex_system_wait_event(union acpi_operand_object *time,
 drivers/acpi/acpica/acinterp.h-311-			  union acpi_operand_object *obj_desc);
 --
 drivers/acpi/acpica/evgpe.c=626=acpi_ev_detect_gpe(struct acpi_namespace_node *gpe_device,
 --
 drivers/acpi/acpica/evgpe.c-711-		 * 2. The GPE handler is expected to be flushed by
 drivers/acpi/acpica/evgpe.c:712:		 *    acpi_os_wait_events_complete() before the
 drivers/acpi/acpica/evgpe.c-713-		 *    destruction.
 --
 drivers/acpi/acpica/evxface.c=211=acpi_remove_notify_handler(acpi_handle device,
 --
 drivers/acpi/acpica/evxface.c-258-
 drivers/acpi/acpica/evxface.c:259:				acpi_os_wait_events_complete();
 drivers/acpi/acpica/evxface.c-260-			}
 --
 drivers/acpi/acpica/evxface.c-318-
 drivers/acpi/acpica/evxface.c:319:			acpi_os_wait_events_complete();
 drivers/acpi/acpica/evxface.c-320-			acpi_ut_remove_reference(handler_obj);
 --
 drivers/acpi/acpica/evxface.c=905=acpi_remove_gpe_handler(acpi_handle gpe_device,
 --
 drivers/acpi/acpica/evxface.c-990-
 drivers/acpi/acpica/evxface.c:991:	acpi_os_wait_events_complete();
 drivers/acpi/acpica/evxface.c-992-
 --
 drivers/acpi/acpica/exoparg2.c=465=acpi_status acpi_ex_opcode_2A_0T_1R(struct acpi_walk_state *walk_state)
 --
 drivers/acpi/acpica/exoparg2.c-516-
 drivers/acpi/acpica/exoparg2.c:517:		status = acpi_ex_system_wait_event(operand[1], operand[0]);
 drivers/acpi/acpica/exoparg2.c-518-		if (status == AE_TIME) {
 --
 drivers/acpi/acpica/exsystem.c=202=acpi_status acpi_ex_system_signal_event(union acpi_operand_object * obj_desc)
 --
 drivers/acpi/acpica/exsystem.c-217- *
 drivers/acpi/acpica/exsystem.c:218: * FUNCTION:    acpi_ex_system_wait_event
 drivers/acpi/acpica/exsystem.c-219- *
 --
 drivers/acpi/acpica/exsystem.c=231=acpi_status
 drivers/acpi/acpica/exsystem.c:232:acpi_ex_system_wait_event(union acpi_operand_object *time_desc,
 drivers/acpi/acpica/exsystem.c-233-			  union acpi_operand_object *obj_desc)
 --
 drivers/acpi/acpica/exsystem.c-236-
 drivers/acpi/acpica/exsystem.c:237:	ACPI_FUNCTION_TRACE(ex_system_wait_event);
 drivers/acpi/acpica/exsystem.c-238-
 --
 drivers/acpi/bus.c=646=static void acpi_device_remove_notify_handler(struct acpi_device *device,
 --
 drivers/acpi/bus.c-654-
 drivers/acpi/bus.c:655:	acpi_os_wait_events_complete();
 drivers/acpi/bus.c-656-}
 --
 drivers/acpi/bus.c=673=void acpi_dev_remove_notify_handler(struct acpi_device *adev,
 --
 drivers/acpi/bus.c-677-	acpi_remove_notify_handler(adev->handle, handler_type, handler);
 drivers/acpi/bus.c:678:	acpi_os_wait_events_complete();
 drivers/acpi/bus.c-679-}
 --
 drivers/acpi/button.c=672=static void acpi_button_remove(struct platform_device *pdev)
 --
 drivers/acpi/button.c-692-	}
 drivers/acpi/button.c:693:	acpi_os_wait_events_complete();
 drivers/acpi/button.c-694-
 --
 drivers/acpi/cppc_acpi.c=1893=int cppc_set_perf(int cpu, struct cppc_perf_ctrls *perf_ctrls)
 --
 drivers/acpi/cppc_acpi.c-2007-			/* Wait until pcc_write_cnt is updated by send_pcc_cmd */
 drivers/acpi/cppc_acpi.c:2008:			wait_event(pcc_ss_data->pcc_write_wait_q,
 drivers/acpi/cppc_acpi.c-2009-				   cpc_desc->write_cmd_id != pcc_ss_data->pcc_write_cnt);
 --
 drivers/acpi/ec.c=722=static int ec_guard(struct acpi_ec *ec)
 --
 drivers/acpi/ec.c-747-				break;
 drivers/acpi/ec.c:748:			if (wait_event_timeout(ec->wait,
 drivers/acpi/ec.c-749-					       ec_transaction_completed(ec),
 --
 drivers/acpi/ec.c=989=static void acpi_ec_stop(struct acpi_ec *ec, bool suspending)
 --
 drivers/acpi/ec.c-997-		spin_unlock_irqrestore(&ec->lock, flags);
 drivers/acpi/ec.c:998:		wait_event(ec->wait, acpi_ec_stopped(ec));
 drivers/acpi/ec.c-999-		spin_lock_irqsave(&ec->lock, flags);
]
]

gemini-3.1-pro-preview

							input: 58492
							output: 261
							thoughts: 190
						

**Analyzing the `wait_event` Vulnerability**

Okay, so I've been looking at this `wait_event` usage in the kernel, specifically within `lbmRead`. The critical issue here is that `wait_event` is lockless, which means it potentially returns before the `lbmIODone` function has fully completed its operations. Essentially, it could return before `lbmDONE` is set and `LCACHE_LOCK` is unlocked. That's a classic race condition, and we need to fix it.

The solution seems straightforward: replacing the problematic `wait_event` with `lbmIOWait(bp, 0)`. That's smart. `lbmIOWait` acquires `LCACHE_LOCK` itself and then waits for `lbmDONE`, which ensures that the lock is held until the relevant operations are completed. This eliminates the race and ensures data consistency, which is exactly what we want.

Now, let me just double-check the return values. `lbmRead` currently returns 0 unconditionally on success, and `lbmIOWait` will return 0 on success, or `-EIO` on error. Aha! Since `lbmRead` wasn't returning any error codes, returning `-EIO` on error is actually an improvement, even though it's a change in behaviour. The higher level callers of `lbmRead` are already checking for non-zero return codes, so this change shouldn't break anything. In fact, it would allow a caller to distinguish between a success condition, and an actual I/O error.

Alright, seems solid. Let's apply the patch.

map[CurrentCode:	bio->bi_end_io = lbmIODone;
	bio->bi_private = bp;
	/*check if journaling to disk has been disabled*/
	if (log->no_integrity) {
		bio->bi_iter.bi_size = 0;
		lbmIODone(bio);
	} else {
		submit_bio(bio);
	}

	wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));

	return 0;
} NewCode:	bio->bi_end_io = lbmIODone;
	bio->bi_private = bp;
	/*check if journaling to disk has been disabled*/
	if (log->no_integrity) {
		bio->bi_iter.bi_size = 0;
		lbmIODone(bio);
	} else {
		submit_bio(bio);
	}

	return lbmIOWait(bp, 0);
} SourceFile:fs/jfs/jfs_logmgr.c]

map[]

gemini-3.1-pro-preview

							input: 59302
							output: 20
							thoughts: 205
						

**Checking for Related Issues After a Fix**

Okay, the change is applied. Now, as a thorough expert, I need to make sure this fix addresses all instances of the problem or similar issues. Let's delve deeper into `fs/jfs/jfs_logmgr.c` and see if there are any other spots that require our attention. The primary concern is potential race conditions and incorrect synchronization, so let's check `wait_event` usages.

We've already examined `l_ioevent`, confirming it's limited to `lbmRead` and `lbmIOWait`. Good. Next, let's turn our attention to `log->free_wait`. Ah, here it is:

```c
	LCACHE_LOCK(flags);
	LCACHE_SLEEP_COND(log->free_wait, (bp = log->lbuf_free), flags);
	log->lbuf_free = bp->l_freelist;
	LCACHE_UNLOCK(flags);
```

Ah, it utilizes `LCACHE_SLEEP_COND`. After reviewing it, that looks safe. Fine. That's a point in the right direction. Let's make sure we haven't missed anything else that is similar.

Finally, we have `log->syncwait`.

```c
init_waitqueue_head(&log->syncwait);
```

Let's check where it's actually *used*. It looks like the relevant initialization is present. We'll need to confirm that this is used correctly throughout the module.

requested entity does not exist

map[Name:syncwait]

map[References:<nil> TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 59884
							output: 16
							thoughts: 24
						

Okay, here's my interpretation of that thought process, as if I were having it:

**Digging into the JFS Log Manager**

Alright, time to dive in. I need to understand how the journaling file system, specifically JFS, handles synchronization during log writes. The command to find any of the usages of the relevant code is `syncwait`, let's see where that is located.  My first instinct is to check the `fs/jfs` directory, and knowing how important the log manager is, `jfs_logmgr.c` seems like the most logical starting point. Let's start with a search for `syncwait` there. That should give me a good jumping-off point to trace the synchronization logic.

map[Expression:syncwait]

map[Output:Documentation/devicetree/bindings/memory-controllers/st,stm32-fmc2-ebi-props.yaml=13=properties:
--
Documentation/devicetree/bindings/memory-controllers/st,stm32-fmc2-ebi-props.yaml-69-
Documentation/devicetree/bindings/memory-controllers/st,stm32-fmc2-ebi-props.yaml:70:  st,fmc2-ebi-cs-asyncwait-enable:
Documentation/devicetree/bindings/memory-controllers/st,stm32-fmc2-ebi-props.yaml-71-    description: The NWAIT signal is taken into account during asynchronous
--
drivers/gpu/drm/panthor/panthor_sched.c=349=struct panthor_queue {
--
drivers/gpu/drm/panthor/panthor_sched.c-414-	/**
drivers/gpu/drm/panthor/panthor_sched.c:415:	 * @syncwait: Stores information about the synchronization object this
drivers/gpu/drm/panthor/panthor_sched.c-416-	 * queue is waiting on.
--
drivers/gpu/drm/panthor/panthor_sched.c-441-		void *kmap;
drivers/gpu/drm/panthor/panthor_sched.c:442:	} syncwait;
drivers/gpu/drm/panthor/panthor_sched.c-443-
--
drivers/gpu/drm/panthor/panthor_sched.c=851=static void
drivers/gpu/drm/panthor/panthor_sched.c:852:panthor_queue_put_syncwait_obj(struct panthor_queue *queue)
drivers/gpu/drm/panthor/panthor_sched.c-853-{
drivers/gpu/drm/panthor/panthor_sched.c:854:	if (queue->syncwait.kmap) {
drivers/gpu/drm/panthor/panthor_sched.c:855:		struct iosys_map map = IOSYS_MAP_INIT_VADDR(queue->syncwait.kmap);
drivers/gpu/drm/panthor/panthor_sched.c-856-
drivers/gpu/drm/panthor/panthor_sched.c:857:		drm_gem_vunmap(queue->syncwait.obj, &map);
drivers/gpu/drm/panthor/panthor_sched.c:858:		queue->syncwait.kmap = NULL;
drivers/gpu/drm/panthor/panthor_sched.c-859-	}
drivers/gpu/drm/panthor/panthor_sched.c-860-
drivers/gpu/drm/panthor/panthor_sched.c:861:	drm_gem_object_put(queue->syncwait.obj);
drivers/gpu/drm/panthor/panthor_sched.c:862:	queue->syncwait.obj = NULL;
drivers/gpu/drm/panthor/panthor_sched.c-863-}
--
drivers/gpu/drm/panthor/panthor_sched.c=865=static void *
drivers/gpu/drm/panthor/panthor_sched.c:866:panthor_queue_get_syncwait_obj(struct panthor_group *group, struct panthor_queue *queue)
drivers/gpu/drm/panthor/panthor_sched.c-867-{
--
drivers/gpu/drm/panthor/panthor_sched.c-872-
drivers/gpu/drm/panthor/panthor_sched.c:873:	if (queue->syncwait.kmap) {
drivers/gpu/drm/panthor/panthor_sched.c:874:		bo = container_of(queue->syncwait.obj,
drivers/gpu/drm/panthor/panthor_sched.c-875-				  struct panthor_gem_object, base.base);
--
drivers/gpu/drm/panthor/panthor_sched.c-879-	bo = panthor_vm_get_bo_for_va(group->vm,
drivers/gpu/drm/panthor/panthor_sched.c:880:				      queue->syncwait.gpu_va,
drivers/gpu/drm/panthor/panthor_sched.c:881:				      &queue->syncwait.offset);
drivers/gpu/drm/panthor/panthor_sched.c-882-	if (drm_WARN_ON(&ptdev->base, IS_ERR_OR_NULL(bo)))
drivers/gpu/drm/panthor/panthor_sched.c:883:		goto err_put_syncwait_obj;
drivers/gpu/drm/panthor/panthor_sched.c-884-
drivers/gpu/drm/panthor/panthor_sched.c:885:	queue->syncwait.obj = &bo->base.base;
drivers/gpu/drm/panthor/panthor_sched.c:886:	ret = drm_gem_vmap(queue->syncwait.obj, &map);
drivers/gpu/drm/panthor/panthor_sched.c-887-	if (drm_WARN_ON(&ptdev->base, ret))
drivers/gpu/drm/panthor/panthor_sched.c:888:		goto err_put_syncwait_obj;
drivers/gpu/drm/panthor/panthor_sched.c-889-
drivers/gpu/drm/panthor/panthor_sched.c:890:	queue->syncwait.kmap = map.vaddr;
drivers/gpu/drm/panthor/panthor_sched.c:891:	if (drm_WARN_ON(&ptdev->base, !queue->syncwait.kmap))
drivers/gpu/drm/panthor/panthor_sched.c:892:		goto err_put_syncwait_obj;
drivers/gpu/drm/panthor/panthor_sched.c-893-
--
drivers/gpu/drm/panthor/panthor_sched.c-900-			 DRM_PANTHOR_BO_SYNC_CPU_CACHE_FLUSH_AND_INVALIDATE,
drivers/gpu/drm/panthor/panthor_sched.c:901:			 queue->syncwait.offset,
drivers/gpu/drm/panthor/panthor_sched.c:902:			 queue->syncwait.sync64 ?
drivers/gpu/drm/panthor/panthor_sched.c-903-			 sizeof(struct panthor_syncobj_64b) :
--
drivers/gpu/drm/panthor/panthor_sched.c-905-
drivers/gpu/drm/panthor/panthor_sched.c:906:	return queue->syncwait.kmap + queue->syncwait.offset;
drivers/gpu/drm/panthor/panthor_sched.c-907-
drivers/gpu/drm/panthor/panthor_sched.c:908:err_put_syncwait_obj:
drivers/gpu/drm/panthor/panthor_sched.c:909:	panthor_queue_put_syncwait_obj(queue);
drivers/gpu/drm/panthor/panthor_sched.c-910-	return NULL;
--
drivers/gpu/drm/panthor/panthor_sched.c=913=static void group_free_queue(struct panthor_group *group, struct panthor_queue *queue)
--
drivers/gpu/drm/panthor/panthor_sched.c-928-
drivers/gpu/drm/panthor/panthor_sched.c:929:	panthor_queue_put_syncwait_obj(queue);
drivers/gpu/drm/panthor/panthor_sched.c-930-
--
drivers/gpu/drm/panthor/panthor_sched.c=1276=cs_slot_sync_queue_state_locked(struct panthor_device *ptdev, u32 csg_id, u32 cs_id)
--
drivers/gpu/drm/panthor/panthor_sched.c-1303-
drivers/gpu/drm/panthor/panthor_sched.c:1304:		queue->syncwait.gpu_va = cs_iface->output->status_wait_sync_ptr;
drivers/gpu/drm/panthor/panthor_sched.c:1305:		queue->syncwait.ref = cs_iface->output->status_wait_sync_value;
drivers/gpu/drm/panthor/panthor_sched.c-1306-		status_wait_cond = cs_iface->output->status_wait & CS_STATUS_WAIT_SYNC_COND_MASK;
drivers/gpu/drm/panthor/panthor_sched.c:1307:		queue->syncwait.gt = status_wait_cond == CS_STATUS_WAIT_SYNC_COND_GT;
drivers/gpu/drm/panthor/panthor_sched.c-1308-		if (cs_iface->output->status_wait & CS_STATUS_WAIT_SYNC_64B) {
--
drivers/gpu/drm/panthor/panthor_sched.c-1310-
drivers/gpu/drm/panthor/panthor_sched.c:1311:			queue->syncwait.sync64 = true;
drivers/gpu/drm/panthor/panthor_sched.c:1312:			queue->syncwait.ref |= sync_val_hi << 32;
drivers/gpu/drm/panthor/panthor_sched.c-1313-		} else {
drivers/gpu/drm/panthor/panthor_sched.c:1314:			queue->syncwait.sync64 = false;
drivers/gpu/drm/panthor/panthor_sched.c-1315-		}
--
drivers/gpu/drm/panthor/panthor_sched.c=2446=static void tick_work(struct work_struct *work)
--
drivers/gpu/drm/panthor/panthor_sched.c-2576-
drivers/gpu/drm/panthor/panthor_sched.c:2577:static int panthor_queue_eval_syncwait(struct panthor_group *group, u8 queue_idx)
drivers/gpu/drm/panthor/panthor_sched.c-2578-{
--
drivers/gpu/drm/panthor/panthor_sched.c-2586-
drivers/gpu/drm/panthor/panthor_sched.c:2587:	syncobj = panthor_queue_get_syncwait_obj(group, queue);
drivers/gpu/drm/panthor/panthor_sched.c-2588-	if (!syncobj)
--
drivers/gpu/drm/panthor/panthor_sched.c-2590-
drivers/gpu/drm/panthor/panthor_sched.c:2591:	value = queue->syncwait.sync64 ?
drivers/gpu/drm/panthor/panthor_sched.c-2592-		syncobj->sync64.seqno :
--
drivers/gpu/drm/panthor/panthor_sched.c-2594-
drivers/gpu/drm/panthor/panthor_sched.c:2595:	if (queue->syncwait.gt)
drivers/gpu/drm/panthor/panthor_sched.c:2596:		result = value > queue->syncwait.ref;
drivers/gpu/drm/panthor/panthor_sched.c-2597-	else
drivers/gpu/drm/panthor/panthor_sched.c:2598:		result = value <= queue->syncwait.ref;
drivers/gpu/drm/panthor/panthor_sched.c-2599-
drivers/gpu/drm/panthor/panthor_sched.c-2600-	if (result)
drivers/gpu/drm/panthor/panthor_sched.c:2601:		panthor_queue_put_syncwait_obj(queue);
drivers/gpu/drm/panthor/panthor_sched.c-2602-
--
drivers/gpu/drm/panthor/panthor_sched.c=2606=static void sync_upd_work(struct work_struct *work)
--
drivers/gpu/drm/panthor/panthor_sched.c-2622-
drivers/gpu/drm/panthor/panthor_sched.c:2623:			ret = panthor_queue_eval_syncwait(group, cs_id);
drivers/gpu/drm/panthor/panthor_sched.c-2624-			drm_WARN_ON(&group->ptdev->base, ret < 0);
--
drivers/memory/stm32-fmc2-ebi.c=923=static const struct stm32_fmc2_prop stm32_fmc2_child_props[] = {
--
drivers/memory/stm32-fmc2-ebi.c-974-	{
drivers/memory/stm32-fmc2-ebi.c:975:		.name = "st,fmc2-ebi-cs-asyncwait-enable",
drivers/memory/stm32-fmc2-ebi.c-976-		.bprop = true,
--
drivers/memory/stm32-fmc2-ebi.c=1088=static const struct stm32_fmc2_prop stm32_fmc2_mp25_child_props[] = {
--
drivers/memory/stm32-fmc2-ebi.c-1139-	{
drivers/memory/stm32-fmc2-ebi.c:1140:		.name = "st,fmc2-ebi-cs-asyncwait-enable",
drivers/memory/stm32-fmc2-ebi.c-1141-		.bprop = true,
--
fs/jfs/jfs_logmgr.c=1056=int lmLogOpen(struct super_block *sb)
--
fs/jfs/jfs_logmgr.c-1092-	INIT_LIST_HEAD(&log->sb_list);
fs/jfs/jfs_logmgr.c:1093:	init_waitqueue_head(&log->syncwait);
fs/jfs/jfs_logmgr.c-1094-
--
fs/jfs/jfs_logmgr.c=1152=static int open_inline_log(struct super_block *sb)
--
fs/jfs/jfs_logmgr.c-1159-	INIT_LIST_HEAD(&log->sb_list);
fs/jfs/jfs_logmgr.c:1160:	init_waitqueue_head(&log->syncwait);
fs/jfs/jfs_logmgr.c-1161-
--
fs/jfs/jfs_logmgr.c=1185=static int open_dummy_log(struct super_block *sb)
--
fs/jfs/jfs_logmgr.c-1196-		INIT_LIST_HEAD(&dummy_log->sb_list);
fs/jfs/jfs_logmgr.c:1197:		init_waitqueue_head(&dummy_log->syncwait);
fs/jfs/jfs_logmgr.c-1198-		dummy_log->no_integrity = 1;
--
fs/jfs/jfs_logmgr.h=353=struct jfs_log {
--
fs/jfs/jfs_logmgr.h-381-	int active;		/* 4: */
fs/jfs/jfs_logmgr.h:382:	wait_queue_head_t syncwait;	/* 4: */
fs/jfs/jfs_logmgr.h-383-
--
fs/jfs/jfs_txnmgr.c=350=tid_t txBegin(struct super_block *sb, int flag)
--
fs/jfs/jfs_txnmgr.c-375-			INCREMENT(TxStat.txBegin_barrier);
fs/jfs/jfs_txnmgr.c:376:			TXN_SLEEP(&log->syncwait);
fs/jfs/jfs_txnmgr.c-377-			goto retry;
--
fs/jfs/jfs_txnmgr.c=454=void txBeginAnon(struct super_block *sb)
--
fs/jfs/jfs_txnmgr.c-469-		INCREMENT(TxStat.txBeginAnon_barrier);
fs/jfs/jfs_txnmgr.c:470:		TXN_SLEEP(&log->syncwait);
fs/jfs/jfs_txnmgr.c-471-		goto retry;
--
fs/jfs/jfs_txnmgr.c=494=void txEnd(tid_t tid)
--
fs/jfs/jfs_txnmgr.c-558-			/* wakeup all waitors for logsync barrier */
fs/jfs/jfs_txnmgr.c:559:			TXN_WAKEUP(&log->syncwait);
fs/jfs/jfs_txnmgr.c-560-
--
fs/jfs/jfs_txnmgr.c=2869=void txResume(struct super_block *sb)
--
fs/jfs/jfs_txnmgr.c-2873-	clear_bit(log_QUIESCE, &log->flag);
fs/jfs/jfs_txnmgr.c:2874:	TXN_WAKEUP(&log->syncwait);
fs/jfs/jfs_txnmgr.c-2875-}
]

gemini-3.1-pro-preview

							input: 64498
							output: 20
							thoughts: 35
						

Okay, here's my interpretation of that thought process, assuming I'm an expert in transaction management and concurrency primitives:

**Diving into Transactional Sleep and Wakeup**

Right, `syncwait`. That immediately brings to mind its interaction with `TXN_SLEEP` and `TXN_WAKEUP`. I need to get my head back in the game and connect the dots. Let's see... the `TXN_SLEEP` macro, what's that actually doing under the hood? I need to understand how the transaction management system suspends a transaction. Where is this implemented? What's the state transitions? How is the sleep coordinated in this context. And more importantly, how does it interact with the wait queue...

map[Expression:define TXN_SLEEP]

map[Output:fs/jfs/jfs_txnmgr.c=118=static inline void TXN_SLEEP_DROP_LOCK(wait_queue_head_t * event)
--
fs/jfs/jfs_txnmgr.c-128-
fs/jfs/jfs_txnmgr.c:129:#define TXN_SLEEP(event)\
fs/jfs/jfs_txnmgr.c-130-{\
]

gemini-3.1-pro-preview

							input: 64832
							output: 47
							thoughts: 13
						

Okay, here's my attempt at summarizing that thought process, keeping in mind I'm speaking to a fellow expert:

**Investigating `TXN_SLEEP`**

Alright, let's dive in. I need to refresh my memory on this `TXN_SLEEP` definition. It's popping up again, and I want to make sure I have a solid understanding of its implications in this particular context. Time to pull up the documentation or code, whichever is more readily available. I need to quickly recall the exact semantics – is it a short pause, a more extended wait, or something with potential dependencies I need to be aware of? What triggers it? What are the resource implications? Gotta be precise here, no room for assumptions. Let’s get to the specifics and make sure I’m not missing anything.

requested entity does not exist

map[ContextFile:fs/jfs/jfs_txnmgr.c IncludeLines:true Name:TXN_SLEEP]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 65087
							output: 19
							thoughts: 29
						

Okay, let's dive into this. I'm going to pull up `fs/jfs/jfs_txnmgr.c` and focus on lines 129 through 140. I know this code pretty well, so I'm already anticipating what's likely covered in that section. Given the context – transaction management in JFS – I'm expecting to see details around perhaps commit protocols, log synchronization, or maybe the handling of in-flight transactions. The sheer length of the function where these lines are located is going to suggest the level of granularity of what the developer wanted to address. I'll need to figure out where that part of the code falls within the bigger picture, so I can accurately interpret its function and purpose. Let's see what's actually there.

map[Expression:TXN_SLEEP]

map[Output:fs/jfs/jfs_txnmgr.c=113=static int jfs_commit_thread_waking;
--
fs/jfs/jfs_txnmgr.c-117- */
fs/jfs/jfs_txnmgr.c:118:static inline void TXN_SLEEP_DROP_LOCK(wait_queue_head_t * event)
fs/jfs/jfs_txnmgr.c-119-{
--
fs/jfs/jfs_txnmgr.c-128-
fs/jfs/jfs_txnmgr.c:129:#define TXN_SLEEP(event)\
fs/jfs/jfs_txnmgr.c-130-{\
fs/jfs/jfs_txnmgr.c:131:	TXN_SLEEP_DROP_LOCK(event);\
fs/jfs/jfs_txnmgr.c-132-	TXN_LOCK();\
--
fs/jfs/jfs_txnmgr.c=180=static lid_t txLockAlloc(void)
--
fs/jfs/jfs_txnmgr.c-189-	while (!(lid = TxAnchor.freelock))
fs/jfs/jfs_txnmgr.c:190:		TXN_SLEEP(&TxAnchor.freelockwait);
fs/jfs/jfs_txnmgr.c-191-	TxAnchor.freelock = TxLock[lid].next;
--
fs/jfs/jfs_txnmgr.c=350=tid_t txBegin(struct super_block *sb, int flag)
--
fs/jfs/jfs_txnmgr.c-375-			INCREMENT(TxStat.txBegin_barrier);
fs/jfs/jfs_txnmgr.c:376:			TXN_SLEEP(&log->syncwait);
fs/jfs/jfs_txnmgr.c-377-			goto retry;
--
fs/jfs/jfs_txnmgr.c-387-			INCREMENT(TxStat.txBegin_lockslow);
fs/jfs/jfs_txnmgr.c:388:			TXN_SLEEP(&TxAnchor.lowlockwait);
fs/jfs/jfs_txnmgr.c-389-			goto retry;
--
fs/jfs/jfs_txnmgr.c-398-		INCREMENT(TxStat.txBegin_freetid);
fs/jfs/jfs_txnmgr.c:399:		TXN_SLEEP(&TxAnchor.freewait);
fs/jfs/jfs_txnmgr.c-400-		goto retry;
--
fs/jfs/jfs_txnmgr.c-408-		INCREMENT(TxStat.txBegin_freetid);
fs/jfs/jfs_txnmgr.c:409:		TXN_SLEEP(&TxAnchor.freewait);
fs/jfs/jfs_txnmgr.c-410-		goto retry;
--
fs/jfs/jfs_txnmgr.c=454=void txBeginAnon(struct super_block *sb)
--
fs/jfs/jfs_txnmgr.c-469-		INCREMENT(TxStat.txBeginAnon_barrier);
fs/jfs/jfs_txnmgr.c:470:		TXN_SLEEP(&log->syncwait);
fs/jfs/jfs_txnmgr.c-471-		goto retry;
--
fs/jfs/jfs_txnmgr.c-478-		INCREMENT(TxStat.txBeginAnon_lockslow);
fs/jfs/jfs_txnmgr.c:479:		TXN_SLEEP(&TxAnchor.lowlockwait);
fs/jfs/jfs_txnmgr.c-480-		goto retry;
--
fs/jfs/jfs_txnmgr.c=584=struct tlock *txLock(tid_t tid, struct inode *ip, struct metapage * mp,
--
fs/jfs/jfs_txnmgr.c-848-	if (xtid && (tlck->mp == mp) && (mp->lid == lid))
fs/jfs/jfs_txnmgr.c:849:		TXN_SLEEP_DROP_LOCK(&tid_to_tblock(xtid)->waitor);
fs/jfs/jfs_txnmgr.c-850-	else
]

gemini-3.1-pro-preview

							input: 66441
							output: 46
							thoughts: 2225
						

**Analysis of the JFS Log Manager Race Condition and Proposed Fix**

Okay, let's break this down. I see we're dealing with a synchronization issue within the JFS log manager, specifically involving the `lbmRead` function and its interaction with `lbmIODone`.  The core problem stems from a classic lost wakeup scenario enabled by the lockless `wait_event` primitive.  `TXN_SLEEP` appears to be safe in its intended use, dropping the lock before sleeping and reacquiring. It's designed to avoid lost wakeup by exiting early from `schedule()` in the case of a wakeup before the sleep. But `wait_event` has the race.

The original code in `lbmRead` used `wait_event` to wait for the condition `(bp->l_flag != lbmREAD)`. The problem here is that `wait_event` checks the condition without holding a lock.  Meanwhile, `lbmIODone`, the I/O completion handler, manipulates `bp->l_flag` after calling `wake_up`. This is where the race happens. Specifically, `lbmIODone` clears `lbmREAD` and then signals `l_ioevent`. The flaw is that a wakeup could happen *after* `lbmIODone` has cleared the `lbmREAD` flag, but *before* `lbmIODone` sets `lbmDONE`. This allows the `lbmRead` to return, and the calling function reuses the same buffer (`bp`), potentially calling `lbmDirectWrite` and overwriting the flags.

Looking at the proposed fix, the code replaces the problematic `wait_event` with `lbmIOWait(bp, 0)`.  This is the key.  `lbmIOWait` *does* hold `LCACHE_LOCK` before checking its condition; thus, synchronizing with the setting of the `lbmDONE` flag in `lbmIODone`. The key is that `lbmIOWait` waits for `bp->l_flag & lbmDONE` to be set, which is done within a critical section (the `LCACHE_LOCK` is held during flag manipulation) so no racing can occur.

I went through the rest of the code. The usage of `lbmIOWait` for `lbmDIRECT` and `lbmSYNC` is sound because it holds a lock.  `lbmIODone` is always setting the `lbmDONE` and unlocking. This ensures that the caller waits until `lbmIODone` has finished.

So, in summary:

*   **Problem:**  Race condition in `lbmRead` due to lockless condition checking in `wait_event` vs. flag manipulation in `lbmIODone`. A lost wakeup can corrupt data.
*   **Fix:** Replace `wait_event` with `lbmIOWait(bp, 0)`. This change leverages the lock held by `lbmIOWait` to create the synchronization.  By ensuring `lbmIOWait` waits until `LCACHE_LOCK` is released after `lbmDONE` is set.
*   **Rationale:** The fix guarantees that `lbmRead` will wait for `lbmIODone` to finish completely, including setting the `lbmDONE` flag and releasing the associated lock, before the buffer (`bp`) is reused, thereby preventing the race condition.  This approach maintains data integrity and ensures that any I/O errors are properly propagated.
*   **Scope:**  The change is targeted and effectively addresses the identified issue without introducing any new regressions.

Excellent. That's a clean and correct fix.

map[Question:Are there any other places in fs/jfs/jfs_logmgr.c where wait_event is used on bp->l_ioevent?]

map[Answer:The `wait_event` macro is used on `bp->l_ioevent` in **only one place** in `fs/jfs/jfs_logmgr.c`.

That specific location is within the `lbmRead` function:

```c
/*
 *	lbmRead()
 */
static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp)
{
	// ... (initialization and bio submission) ...

	wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));

	return 0;
}
```

However, there is another place in the same file where a wait operation is performed on `bp->l_ioevent`, but it uses a JFS-specific macro instead of the standard `wait_event`. In the `lbmIOWait` function, the `LCACHE_SLEEP_COND` macro is used:

```c
/*
 *	lbmIOWait()
 */
static int lbmIOWait(struct lbuf * bp, int flag)
{
	// ...
	LCACHE_LOCK(flags);		/* disable+lock */

	LCACHE_SLEEP_COND(bp->l_ioevent, (bp->l_flag & lbmDONE), flags);

	// ...
}
```

The `LCACHE_SLEEP_COND` macro (defined earlier in the same file) expands to `__SLEEP_COND`, which is a manual wait loop defined in `fs/jfs/jfs_lock.h`. It does not call `wait_event` internally but rather manages the wait queue manually with `add_wait_queue`, `io_schedule`, and `remove_wait_queue`.

In summary:
- **`wait_event`** is used on `bp->l_ioevent` only in **`lbmRead`**.
- A similar waiting mechanism is used on `bp->l_ioevent` in **`lbmIOWait`**, but via the `LCACHE_SLEEP_COND` macro.]

gemini-3-flash-preview

You are a capable Linux kernel developer tasked with researching complex questions
about kernel source code. You will be given a concrete question, and need to provide
a concrete answer.
Use tools extensively while researching the question. Don't make assumptions,
or rely on your previous knowledge about the kernel source code, use available tools
to access the actual source code.
Use all available sources of information:
 - kernel source code
 - documentation in the Documentation dir in the source tree
 - git commits descriptions, git blame

Prefer calling several tools at the same time to save round-trips.

Are there any other places in fs/jfs/jfs_logmgr.c where wait_event is used on bp->l_ioevent?

The `wait_event` macro is used on `bp->l_ioevent` in **only one place** in `fs/jfs/jfs_logmgr.c`.

That specific location is within the `lbmRead` function:

```c
/*
 *	lbmRead()
 */
static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp)
{
	// ... (initialization and bio submission) ...

	wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));

	return 0;
}
```

However, there is another place in the same file where a wait operation is performed on `bp->l_ioevent`, but it uses a JFS-specific macro instead of the standard `wait_event`. In the `lbmIOWait` function, the `LCACHE_SLEEP_COND` macro is used:

```c
/*
 *	lbmIOWait()
 */
static int lbmIOWait(struct lbuf * bp, int flag)
{
	// ...
	LCACHE_LOCK(flags);		/* disable+lock */

	LCACHE_SLEEP_COND(bp->l_ioevent, (bp->l_flag & lbmDONE), flags);

	// ...
}
```

The `LCACHE_SLEEP_COND` macro (defined earlier in the same file) expands to `__SLEEP_COND`, which is a manual wait loop defined in `fs/jfs/jfs_lock.h`. It does not call `wait_event` internally but rather manages the wait queue manually with `add_wait_queue`, `io_schedule`, and `remove_wait_queue`.

In summary:
- **`wait_event`** is used on `bp->l_ioevent` only in **`lbmRead`**.
- A similar waiting mechanism is used on `bp->l_ioevent` in **`lbmIOWait`**, but via the `LCACHE_SLEEP_COND` macro.

gemini-3-flash-preview

							input: 2284
							output: 46
							thoughts: 112
						

**Analyzing Wait Conditions in JFS Logging**

Okay, so I see a question about `wait_event` and `bp->l_ioevent` in `fs/jfs/jfs_logmgr.c`. My immediate thought is, "Right, I need to understand *how* that event is being used." This implies a deeper dive into the log manager's synchronization mechanisms.

My first step is clear: I have to locate every instance of `wait_event` (and any related wait functions, just to be thorough - maybe someone used a spinlock instead, or `wait_event_interruptible`, etc.) that relies on `bp->l_ioevent` as the triggering condition within that specific file. Essentially, I need to map out the wait-and-signal flow concerning this particular IO event. I need to understand what's *waiting* and what's *waking* it up. Therefore I will first list the content of the file or search for `wait_event`. That is where I shall start.

requested entity does not exist

map[IncludeSnippetLines:1 Name:wait_event SourceTreePrefix:fs/jfs/jfs_logmgr.c]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 2682
							output: 23
							thoughts: 128
						

**Debugging a Possible Macro Mystery**

Okay, so `codesearch-find-references` isn't giving me the results I anticipated. My initial thought is that `wait_event` might be a macro, and, therefore, the tool isn't treating it as a standard function. That could explain the failure to find references. I need to verify this assumption.

Let me quickly try a more direct approach. I'll use `grep` within the file itself to look for the literal string "wait_event," or, if it's a small file, I might just skim through it manually. That should reveal whether it's a macro definition or a straight function call.

Hang on...`codesearch-find-references` didn't work as expected. Alright, let's back up a step. I'll try `codesearch-dir-index` on `fs/jfs/` to get a list of the files, then I can `read-file` or use a more general search on the directory. That'll provide more data for analysis.

map[Dir:fs/jfs/]

map[Files:[acl.c file.c inode.c ioctl.c jfs_acl.h jfs_btree.h jfs_debug.c jfs_debug.h jfs_dinode.h jfs_discard.c jfs_discard.h jfs_dmap.c jfs_dmap.h jfs_dtree.c jfs_dtree.h jfs_extent.c jfs_extent.h jfs_filsys.h jfs_imap.c jfs_imap.h jfs_incore.h jfs_inode.c jfs_inode.h jfs_lock.h jfs_logmgr.c jfs_logmgr.h jfs_metapage.c jfs_metapage.h jfs_mount.c jfs_superblock.h jfs_txnmgr.c jfs_txnmgr.h jfs_types.h jfs_umount.c jfs_unicode.c jfs_unicode.h jfs_xattr.h jfs_xtree.c jfs_xtree.h namei.c resize.c super.c symlink.c xattr.c] Subdirs:<nil>]

gemini-3-flash-preview

							input: 3466
							output: 28
							thoughts: 86
						

Here's my thought process, as if I were analyzing that situation:

**Analyzing `jfs_logmgr.c` for I/O Event Management**

Alright, so `fs/jfs/jfs_logmgr.c` is the target. My initial approach is always to get a feel for the file's structure. Since I don't have the luxury of using `grep` right now, I need to work manually. I'll start by reading the file content. My primary focus is understanding how I/O events, specifically those related to `l_ioevent` and, by association, how the code interacts with waiting on those events using potentially `wait_event`, are handled within the logging manager. I will need to search for references to `l_ioevent` and `wait_event`. That seems like the logical path to unravel the core I/O event logic.

requested entity does not exist

map[IncludeSnippetLines:1 Name:l_ioevent]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 3791
							output: 23
							thoughts: 53
						

Okay, here's my interpretation of those thoughts, presented as a personal thought process, as requested:

**Deconstructing `l_ioevent` in the JFS Context**

Right, so it looks like `l_ioevent` is almost certainly a field within a `struct`. My first step needs to be figuring out *which* struct. I need to nail down the definition. Given the context, my gut tells me this is going to be related to the JFS filesystem. Let's start the search with the obvious: `fs/jfs/`. I'll run a quick search for `l_ioevent` specifically within that directory, looking for the definition and any relevant usages. That should give me a solid starting point for understanding its role. From there, I can trace back where it's populated and how it's used. Let's see what we find.

map[Dir:fs/jfs/]

map[Files:[acl.c file.c inode.c ioctl.c jfs_acl.h jfs_btree.h jfs_debug.c jfs_debug.h jfs_dinode.h jfs_discard.c jfs_discard.h jfs_dmap.c jfs_dmap.h jfs_dtree.c jfs_dtree.h jfs_extent.c jfs_extent.h jfs_filsys.h jfs_imap.c jfs_imap.h jfs_incore.h jfs_inode.c jfs_inode.h jfs_lock.h jfs_logmgr.c jfs_logmgr.h jfs_metapage.c jfs_metapage.h jfs_mount.c jfs_superblock.h jfs_txnmgr.c jfs_txnmgr.h jfs_types.h jfs_umount.c jfs_unicode.c jfs_unicode.h jfs_xattr.h jfs_xtree.c jfs_xtree.h namei.c resize.c super.c symlink.c xattr.c] Subdirs:<nil>]

gemini-3-flash-preview

							input: 4460
							output: 31
							thoughts: 50
						

Okay, here's my summary, framed as my internal thought process:

**Pinpointing the `l_ioevent` Definition**

Alright, let's track down the definition of `l_ioevent`. It's a common pattern in this codebase: start by assuming it's in a header file. Given the context, my initial hunch is that it's probably related to journaling or in-core structures within the JFS file system. Therefore, I'll start by checking `jfs_logmgr.h` and `jfs_incore.h`. Those feel like the most probable locations for a structure or macro of that name. I'll need to confirm quickly. Let's see what we find!

map[IncludeSnippetLines:5 Name:logbuffer::l_ioevent]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 4712
							output: 27
							thoughts: 98
						

Okay, here's my thought process on this one:

**Investigating a Potential JFS Logging Issue**

Hmm, `codesearch-find-references` failed to turn up anything for `logbuffer::l_ioevent`. That's a bit odd. It suggests the symbol might be defined or used differently than I initially assumed, or maybe there's a problem with the search itself. My first instinct would be to directly grep for `l_ioevent` within the `fs/jfs` directory if I could, but I don't have that option.

Alright, a more focused approach is necessary. Let me check the header files within the suspected area. Reading `fs/jfs/jfs_logmgr.h` seems like the logical next step. It's likely that if `l_ioevent` is related to JFS logging, the struct definition or usage will be documented there. I'm hoping to find the context of that event. That should give me the information I need to understand how the log management is working.

map[File:fs/jfs/jfs_logmgr.h]

map[Contents:/* SPDX-License-Identifier: GPL-2.0-or-later */
/*
 *   Copyright (C) International Business Machines Corp., 2000-2004
 *   Portions Copyright (C) Christoph Hellwig, 2001-2002
 */
#ifndef	_H_JFS_LOGMGR
#define _H_JFS_LOGMGR

#include <linux/uuid.h>

#include "jfs_filsys.h"
#include "jfs_lock.h"

/*
 *	log manager configuration parameters
 */

/* log page size */
#define	LOGPSIZE	4096
#define	L2LOGPSIZE	12

#define LOGPAGES	16	/* Log pages per mounted file system */

/*
 *	log logical volume
 *
 * a log is used to make the commit operation on journalled
 * files within the same logical volume group atomic.
 * a log is implemented with a logical volume.
 * there is one log per logical volume group.
 *
 * block 0 of the log logical volume is not used (ipl etc).
 * block 1 contains a log "superblock" and is used by logFormat(),
 * lmLogInit(), lmLogShutdown(), and logRedo() to record status
 * of the log but is not otherwise used during normal processing.
 * blocks 2 - (N-1) are used to contain log records.
 *
 * when a volume group is varied-on-line, logRedo() must have
 * been executed before the file systems (logical volumes) in
 * the volume group can be mounted.
 */
/*
 *	log superblock (block 1 of logical volume)
 */
#define	LOGSUPER_B	1
#define	LOGSTART_B	2

#define	LOGMAGIC	0x87654321
#define	LOGVERSION	1

#define MAX_ACTIVE	128	/* Max active file systems sharing log */

struct logsuper {
	__le32 magic;		/* 4: log lv identifier */
	__le32 version;		/* 4: version number */
	__le32 serial;		/* 4: log open/mount counter */
	__le32 size;		/* 4: size in number of LOGPSIZE blocks */
	__le32 bsize;		/* 4: logical block size in byte */
	__le32 l2bsize;		/* 4: log2 of bsize */

	__le32 flag;		/* 4: option */
	__le32 state;		/* 4: state - see below */

	__le32 end;		/* 4: addr of last log record set by logredo */
	uuid_t uuid;		/* 16: 128-bit journal uuid */
	char label[16];		/* 16: journal label */
	struct {
		uuid_t uuid;
	} active[MAX_ACTIVE];	/* 2048: active file systems list */
};

/* log flag: commit option (see jfs_filsys.h) */

/* log state */
#define	LOGMOUNT	0	/* log mounted by lmLogInit() */
#define LOGREDONE	1	/* log shutdown by lmLogShutdown().
				 * log redo completed by logredo().
				 */
#define LOGWRAP		2	/* log wrapped */
#define LOGREADERR	3	/* log read error detected in logredo() */


/*
 *	log logical page
 *
 * (this comment should be rewritten !)
 * the header and trailer structures (h,t) will normally have
 * the same page and eor value.
 * An exception to this occurs when a complete page write is not
 * accomplished on a power failure. Since the hardware may "split write"
 * sectors in the page, any out of order sequence may occur during powerfail
 * and needs to be recognized during log replay.  The xor value is
 * an "exclusive or" of all log words in the page up to eor.  This
 * 32 bit eor is stored with the top 16 bits in the header and the
 * bottom 16 bits in the trailer.  logredo can easily recognize pages
 * that were not completed by reconstructing this eor and checking
 * the log page.
 *
 * Previous versions of the operating system did not allow split
 * writes and detected partially written records in logredo by
 * ordering the updates to the header, trailer, and the move of data
 * into the logdata area.  The order: (1) data is moved (2) header
 * is updated (3) trailer is updated.  In logredo, when the header
 * differed from the trailer, the header and trailer were reconciled
 * as follows: if h.page != t.page they were set to the smaller of
 * the two and h.eor and t.eor set to 8 (i.e. empty page). if (only)
 * h.eor != t.eor they were set to the smaller of their two values.
 */
struct logpage {
	struct {		/* header */
		__le32 page;	/* 4: log sequence page number */
		__le16 rsrvd;	/* 2: */
		__le16 eor;	/* 2: end-of-log offset of lasrt record write */
	} h;

	__le32 data[LOGPSIZE / 4 - 4];	/* log record area */

	struct {		/* trailer */
		__le32 page;	/* 4: normally the same as h.page */
		__le16 rsrvd;	/* 2: */
		__le16 eor;	/* 2: normally the same as h.eor */
	} t;
};

#define LOGPHDRSIZE	8	/* log page header size */
#define LOGPTLRSIZE	8	/* log page trailer size */


/*
 *	log record
 *
 * (this comment should be rewritten !)
 * jfs uses only "after" log records (only a single writer is allowed
 * in a page, pages are written to temporary paging space if
 * they must be written to disk before commit, and i/o is
 * scheduled for modified pages to their home location after
 * the log records containing the after values and the commit
 * record is written to the log on disk, undo discards the copy
 * in main-memory.)
 *
 * a log record consists of a data area of variable length followed by
 * a descriptor of fixed size LOGRDSIZE bytes.
 * the data area is rounded up to an integral number of 4-bytes and
 * must be no longer than LOGPSIZE.
 * the descriptor is of size of multiple of 4-bytes and aligned on a
 * 4-byte boundary.
 * records are packed one after the other in the data area of log pages.
 * (sometimes a DUMMY record is inserted so that at least one record ends
 * on every page or the longest record is placed on at most two pages).
 * the field eor in page header/trailer points to the byte following
 * the last record on a page.
 */

/* log record types */
#define LOG_COMMIT		0x8000
#define LOG_SYNCPT		0x4000
#define LOG_MOUNT		0x2000
#define LOG_REDOPAGE		0x0800
#define LOG_NOREDOPAGE		0x0080
#define LOG_NOREDOINOEXT	0x0040
#define LOG_UPDATEMAP		0x0008
#define LOG_NOREDOFILE		0x0001

/* REDOPAGE/NOREDOPAGE log record data type */
#define	LOG_INODE		0x0001
#define	LOG_XTREE		0x0002
#define	LOG_DTREE		0x0004
#define	LOG_BTROOT		0x0010
#define	LOG_EA			0x0020
#define	LOG_ACL			0x0040
#define	LOG_DATA		0x0080
#define	LOG_NEW			0x0100
#define	LOG_EXTEND		0x0200
#define LOG_RELOCATE		0x0400
#define LOG_DIR_XTREE		0x0800	/* Xtree is in directory inode */

/* UPDATEMAP log record descriptor type */
#define	LOG_ALLOCXADLIST	0x0080
#define	LOG_ALLOCPXDLIST	0x0040
#define	LOG_ALLOCXAD		0x0020
#define	LOG_ALLOCPXD		0x0010
#define	LOG_FREEXADLIST		0x0008
#define	LOG_FREEPXDLIST		0x0004
#define	LOG_FREEXAD		0x0002
#define	LOG_FREEPXD		0x0001


struct lrd {
	/*
	 * type independent area
	 */
	__le32 logtid;		/* 4: log transaction identifier */
	__le32 backchain;	/* 4: ptr to prev record of same transaction */
	__le16 type;		/* 2: record type */
	__le16 length;		/* 2: length of data in record (in byte) */
	__le32 aggregate;	/* 4: file system lv/aggregate */
	/* (16) */

	/*
	 * type dependent area (20)
	 */
	union {

		/*
		 *	COMMIT: commit
		 *
		 * transaction commit: no type-dependent information;
		 */

		/*
		 *	REDOPAGE: after-image
		 *
		 * apply after-image;
		 *
		 * N.B. REDOPAGE, NOREDOPAGE, and UPDATEMAP must be same format;
		 */
		struct {
			__le32 fileset;	/* 4: fileset number */
			__le32 inode;	/* 4: inode number */
			__le16 type;	/* 2: REDOPAGE record type */
			__le16 l2linesize;	/* 2: log2 of line size */
			pxd_t pxd;	/* 8: on-disk page pxd */
		} redopage;	/* (20) */

		/*
		 *	NOREDOPAGE: the page is freed
		 *
		 * do not apply after-image records which precede this record
		 * in the log with the same page block number to this page.
		 *
		 * N.B. REDOPAGE, NOREDOPAGE, and UPDATEMAP must be same format;
		 */
		struct {
			__le32 fileset;	/* 4: fileset number */
			__le32 inode;	/* 4: inode number */
			__le16 type;	/* 2: NOREDOPAGE record type */
			__le16 rsrvd;	/* 2: reserved */
			pxd_t pxd;	/* 8: on-disk page pxd */
		} noredopage;	/* (20) */

		/*
		 *	UPDATEMAP: update block allocation map
		 *
		 * either in-line PXD,
		 * or     out-of-line  XADLIST;
		 *
		 * N.B. REDOPAGE, NOREDOPAGE, and UPDATEMAP must be same format;
		 */
		struct {
			__le32 fileset;	/* 4: fileset number */
			__le32 inode;	/* 4: inode number */
			__le16 type;	/* 2: UPDATEMAP record type */
			__le16 nxd;	/* 2: number of extents */
			pxd_t pxd;	/* 8: pxd */
		} updatemap;	/* (20) */

		/*
		 *	NOREDOINOEXT: the inode extent is freed
		 *
		 * do not apply after-image records which precede this
		 * record in the log with the any of the 4 page block
		 * numbers in this inode extent.
		 *
		 * NOTE: The fileset and pxd fields MUST remain in
		 *       the same fields in the REDOPAGE record format.
		 *
		 */
		struct {
			__le32 fileset;	/* 4: fileset number */
			__le32 iagnum;	/* 4: IAG number     */
			__le32 inoext_idx;	/* 4: inode extent index */
			pxd_t pxd;	/* 8: on-disk page pxd */
		} noredoinoext;	/* (20) */

		/*
		 *	SYNCPT: log sync point
		 *
		 * replay log up to syncpt address specified;
		 */
		struct {
			__le32 sync;	/* 4: syncpt address (0 = here) */
		} syncpt;

		/*
		 *	MOUNT: file system mount
		 *
		 * file system mount: no type-dependent information;
		 */

		/*
		 *	? FREEXTENT: free specified extent(s)
		 *
		 * free specified extent(s) from block allocation map
		 * N.B.: nextents should be length of data/sizeof(xad_t)
		 */
		struct {
			__le32 type;	/* 4: FREEXTENT record type */
			__le32 nextent;	/* 4: number of extents */

			/* data: PXD or XAD list */
		} freextent;

		/*
		 *	? NOREDOFILE: this file is freed
		 *
		 * do not apply records which precede this record in the log
		 * with the same inode number.
		 *
		 * NOREDOFILE must be the first to be written at commit
		 * (last to be read in logredo()) - it prevents
		 * replay of preceding updates of all preceding generations
		 * of the inumber esp. the on-disk inode itself.
		 */
		struct {
			__le32 fileset;	/* 4: fileset number */
			__le32 inode;	/* 4: inode number */
		} noredofile;

		/*
		 *	? NEWPAGE:
		 *
		 * metadata type dependent
		 */
		struct {
			__le32 fileset;	/* 4: fileset number */
			__le32 inode;	/* 4: inode number */
			__le32 type;	/* 4: NEWPAGE record type */
			pxd_t pxd;	/* 8: on-disk page pxd */
		} newpage;

		/*
		 *	? DUMMY: filler
		 *
		 * no type-dependent information
		 */
	} log;
};					/* (36) */

#define	LOGRDSIZE	(sizeof(struct lrd))

/*
 *	line vector descriptor
 */
struct lvd {
	__le16 offset;
	__le16 length;
};


/*
 *	log logical volume
 */
struct jfs_log {

	struct list_head sb_list;/*  This is used to sync metadata
				 *    before writing syncpt.
				 */
	struct list_head journal_list; /* Global list */
	struct file *bdev_file;	/* 4: log lv pointer */
	int serial;		/* 4: log mount serial number */

	s64 base;		/* @8: log extent address (inline log ) */
	int size;		/* 4: log size in log page (in page) */
	int l2bsize;		/* 4: log2 of bsize */

	unsigned long flag;	/* 4: flag */

	struct lbuf *lbuf_free;	/* 4: free lbufs */
	wait_queue_head_t free_wait;	/* 4: */

	/* log write */
	int logtid;		/* 4: log tid */
	int page;		/* 4: page number of eol page */
	int eor;		/* 4: eor of last record in eol page */
	struct lbuf *bp;	/* 4: current log page buffer */

	struct mutex loglock;	/* 4: log write serialization lock */

	/* syncpt */
	int nextsync;		/* 4: bytes to write before next syncpt */
	int active;		/* 4: */
	wait_queue_head_t syncwait;	/* 4: */

	/* commit */
	uint cflag;		/* 4: */
	struct list_head cqueue; /* FIFO commit queue */
	struct tblock *flush_tblk; /* tblk we're waiting on for flush */
	int gcrtc;		/* 4: GC_READY transaction count */
	struct tblock *gclrt;	/* 4: latest GC_READY transaction */
	spinlock_t gclock;	/* 4: group commit lock */
	int logsize;		/* 4: log data area size in byte */
	int lsn;		/* 4: end-of-log */
	int clsn;		/* 4: clsn */
	int syncpt;		/* 4: addr of last syncpt record */
	int sync;		/* 4: addr from last logsync() */
	struct list_head synclist;	/* 8: logsynclist anchor */
	spinlock_t synclock;	/* 4: synclist lock */
	struct lbuf *wqueue;	/* 4: log pageout queue */
	int count;		/* 4: count */
	uuid_t uuid;		/* 16: 128-bit uuid of log device */

	int no_integrity;	/* 3: flag to disable journaling to disk */
};

/*
 * log read/write serialization (per log)
 */
#define LOG_LOCK_INIT(log)	mutex_init(&(log)->loglock)
#define LOG_LOCK(log)		mutex_lock(&((log)->loglock))
#define LOG_UNLOCK(log)		mutex_unlock(&((log)->loglock))

/*
 * Log flag
 */
#define log_INLINELOG	1
#define log_SYNCBARRIER	2
#define log_QUIESCE	3
#define log_FLUSH	4

/*
 * group commit flag
 */
/* jfs_log */
#define logGC_PAGEOUT	0x00000001

/* tblock/lbuf */
#define tblkGC_QUEUE		0x0001
#define tblkGC_READY		0x0002
#define tblkGC_COMMIT		0x0004
#define tblkGC_COMMITTED	0x0008
#define tblkGC_EOP		0x0010
#define tblkGC_FREE		0x0020
#define tblkGC_LEADER		0x0040
#define tblkGC_ERROR		0x0080
#define tblkGC_LAZY		0x0100	// D230860
#define tblkGC_UNLOCKED		0x0200	// D230860

/*
 *		log cache buffer header
 */
struct lbuf {
	struct jfs_log *l_log;	/* 4: log associated with buffer */

	/*
	 * data buffer base area
	 */
	uint l_flag;		/* 4: pageout control flags */

	struct lbuf *l_wqnext;	/* 4: write queue link */
	struct lbuf *l_freelist;	/* 4: freelistlink */

	int l_pn;		/* 4: log page number */
	int l_eor;		/* 4: log record eor */
	int l_ceor;		/* 4: committed log record eor */

	s64 l_blkno;		/* 8: log page block number */
	caddr_t l_ldata;	/* 4: data page */
	struct page *l_page;	/* The page itself */
	uint l_offset;		/* Offset of l_ldata within the page */

	wait_queue_head_t l_ioevent;	/* 4: i/o done event */
};

/* Reuse l_freelist for redrive list */
#define l_redrive_next l_freelist

/*
 *	logsynclist block
 *
 * common logsyncblk prefix for jbuf_t and tblock
 */
struct logsyncblk {
	u16 xflag;		/* flags */
	u16 flag;		/* only meaninful in tblock */
	lid_t lid;		/* lock id */
	s32 lsn;		/* log sequence number */
	struct list_head synclist;	/* log sync list link */
};

/*
 *	logsynclist serialization (per log)
 */

#define LOGSYNC_LOCK_INIT(log) spin_lock_init(&(log)->synclock)
#define LOGSYNC_LOCK(log, flags) spin_lock_irqsave(&(log)->synclock, flags)
#define LOGSYNC_UNLOCK(log, flags) \
	spin_unlock_irqrestore(&(log)->synclock, flags)

/* compute the difference in bytes of lsn from sync point */
#define logdiff(diff, lsn, log)\
{\
	diff = (lsn) - (log)->syncpt;\
	if (diff < 0)\
		diff += (log)->logsize;\
}

extern int lmLogOpen(struct super_block *sb);
extern int lmLogClose(struct super_block *sb);
extern int lmLogShutdown(struct jfs_log * log);
extern int lmLogInit(struct jfs_log * log);
extern int lmLogFormat(struct jfs_log *log, s64 logAddress, int logSize);
extern int lmGroupCommit(struct jfs_log *, struct tblock *);
extern int jfsIOWait(void *);
extern void jfs_flush_journal(struct jfs_log * log, int wait);
extern void jfs_syncpt(struct jfs_log *log, int hard_sync);

#endif				/* _H_JFS_LOGMGR */
]

gemini-3-flash-preview

							input: 10377
							output: 50
							thoughts: 362
						

**Analyzing the JFS Log Manager's I/O Synchronization**

Okay, so I've just tracked down the definition of `struct lbuf` within `fs/jfs/jfs_logmgr.h`. I'm particularly interested in the `wait_queue_head_t l_ioevent;` member. This likely means we're dealing with some form of asynchronous I/O completion signaling within the JFS logging system.

Now, my next step is clear. I need to understand how this event is used. Specifically, I need to see how the code utilizes `l_ioevent` for synchronization. Therefore, I will now thoroughly examine `fs/jfs/jfs_logmgr.c` and search for occurrences of `l_ioevent`. I'm expecting to find calls to functions like `wait_event`, `wait_event_interruptible`, or similar kernel primitives that wait on a wait queue. This will reveal the points in the code where the system is waiting for an I/O operation associated with a log buffer to complete. Understanding the use of these wait queues is crucial for assessing the performance and potential bottlenecks in the JFS logging implementation.

map[IncludeSnippetLines:5 Name:lbuf::l_ioevent SourceTreePrefix:fs/jfs/jfs_logmgr.c]

map[References:[map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:lbmIODone SourceFile:fs/jfs/jfs_logmgr.c SourceLine:2196 SourceSnippet:2191:		 */
2192:		if (bp->l_flag & lbmREAD) {
2193:			bp->l_flag &= ~lbmREAD;
2194:	
2195:			/* wakeup I/O initiator */
2196:			LCACHE_WAKEUP(&bp->l_ioevent);
2197:	
2198:			goto out;
2199:		}
2200:	
2201:		/*
] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:lbmIODone SourceFile:fs/jfs/jfs_logmgr.c SourceLine:2221 SourceSnippet:2216:		/* update committed lsn */
2217:		log = bp->l_log;
2218:		log->clsn = (bp->l_pn << L2LOGPSIZE) + bp->l_ceor;
2219:	
2220:		if (bp->l_flag & lbmDIRECT) {
2221:			LCACHE_WAKEUP(&bp->l_ioevent);
2222:			goto out;
2223:		}
2224:	
2225:		tail = log->wqueue;
2226:	
] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:lbmIODone SourceFile:fs/jfs/jfs_logmgr.c SourceLine:2275 SourceSnippet:2270:		 * (e.g., synchronous write of partial-page with COMMIT):
2271:		 * leave buffer for i/o initiator to dispose
2272:		 */
2273:		if (bp->l_flag & lbmSYNC) {
2274:			/* wakeup I/O initiator */
2275:			LCACHE_WAKEUP(&bp->l_ioevent);
2276:		}
2277:	
2278:		/*
2279:		 *	Group Commit pageout:
2280:		 */
] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:lbmIOWait SourceFile:fs/jfs/jfs_logmgr.c SourceLine:2149 SourceSnippet:2144:	
2145:		jfs_info("lbmIOWait1: bp:0x%p flag:0x%x:0x%x", bp, bp->l_flag, flag);
2146:	
2147:		LCACHE_LOCK(flags);		/* disable+lock */
2148:	
2149:		LCACHE_SLEEP_COND(bp->l_ioevent, (bp->l_flag & lbmDONE), flags);
2150:	
2151:		rc = (bp->l_flag & lbmERROR) ? -EIO : 0;
2152:	
2153:		if (flag & lbmFREE)
2154:			lbmfree(bp);
] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:lbmIOWait SourceFile:fs/jfs/jfs_logmgr.c SourceLine:2149 SourceSnippet:2144:	
2145:		jfs_info("lbmIOWait1: bp:0x%p flag:0x%x:0x%x", bp, bp->l_flag, flag);
2146:	
2147:		LCACHE_LOCK(flags);		/* disable+lock */
2148:	
2149:		LCACHE_SLEEP_COND(bp->l_ioevent, (bp->l_flag & lbmDONE), flags);
2150:	
2151:		rc = (bp->l_flag & lbmERROR) ? -EIO : 0;
2152:	
2153:		if (flag & lbmFREE)
2154:			lbmfree(bp);
] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:lbmLogInit SourceFile:fs/jfs/jfs_logmgr.c SourceLine:1831 SourceSnippet:1826:					get_page(page);
1827:				lbuf->l_offset = offset;
1828:				lbuf->l_ldata = buffer + offset;
1829:				lbuf->l_page = page;
1830:				lbuf->l_log = log;
1831:				init_waitqueue_head(&lbuf->l_ioevent);
1832:	
1833:				lbuf->l_freelist = log->lbuf_free;
1834:				log->lbuf_free = lbuf;
1835:				i++;
1836:			}
] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:lbmRead SourceFile:fs/jfs/jfs_logmgr.c SourceLine:1987 SourceSnippet:1982:			lbmIODone(bio);
1983:		} else {
1984:			submit_bio(bio);
1985:		}
1986:	
1987:		wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));
1988:	
1989:		return 0;
1990:	}
] map[ReferenceKind:takes-address-of ReferencingEntityKind:function ReferencingEntityName:lbmRead SourceFile:fs/jfs/jfs_logmgr.c SourceLine:1987 SourceSnippet:1982:			lbmIODone(bio);
1983:		} else {
1984:			submit_bio(bio);
1985:		}
1986:	
1987:		wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));
1988:	
1989:		return 0;
1990:	}
]] TruncatedOutput:false]

gemini-3-flash-preview

							input: 12764
							output: 48
							thoughts: 224
						

**Analyzing the JFS Log Manager's I/O Synchronization**

Okay, so I've got these search results highlighting interactions with the `l_ioevent` wait queue within the JFS log manager. My initial assessment is:

1.  We've got `LCACHE_WAKEUP(&bp->l_ioevent)` calls popping up in the `lbmIODone` function, specifically at lines 2196, 2221, and 2275. These are classic wakeup calls – something is signaling that an I/O operation is complete.

2.  Conversely, there's `LCACHE_SLEEP_COND(bp->l_ioevent, (bp->l_flag & lbmDONE), flags)` in `lbmIOWait` at line 2149. This is where a process is likely waiting for an I/O operation to finish, with a condition check on `bp->l_flag`. The use of `SLEEP_COND` strongly implies a conditional wait.

3.  `init_waitqueue_head(&lbuf->l_ioevent)` in `lbmLogInit` (line 1831) indicates that the wait queue head itself is being initialized. This is expected. We have to make sure these exist before using them.

4.  Finally, `wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD))` in `lbmRead` at line 1987 represents a direct use of a wait queue to handle reads. The `wait_event` call uses a wait queue and a check on a flag to determine if the thread should sleep.

Now, my next step is obvious. Given the names, `LCACHE_SLEEP_COND` and `LCACHE_WAKEUP` are very likely macros defined somewhere in this code, likely in the `fs/jfs/jfs_logmgr.c` file itself. I need to track down their definitions to understand exactly what underlying kernel synchronization primitives (like spinlocks or mutexes) they are wrapping and precisely how they're handling the wait queue manipulation. Understanding the macro expansion will give me a better understanding of the low-level synchronization happening here. This will be the key to understanding potential bottlenecks or synchronization issues.

requested entity does not exist

map[ContextFile:fs/jfs/jfs_logmgr.c IncludeLines:true Name:LCACHE_SLEEP_COND]

map[SourceCode: SourceFile:]

gemini-3-flash-preview

							input: 13552
							output: 27
							thoughts: 35
						

Okay, here's my interpretation of those thoughts, tailored for an expert audience, presented in the first person:

**Navigating the Log Manager in JFS**

Alright, so I'm thinking about how the logging system is structured within the JFS filesystem. It's possible that the core log management routines, even though they might be defined within the `fs/jfs/jfs_logmgr.c` file, are handled in a manner that doesn't neatly translate into standard function indexing. That's a common pattern in kernel code, right? They're often intertwined within larger, more complex functions or macros. So, to get a handle on the overall structure and how the log management actually works, I need to start from the beginning. I'll take a look at the initial sections of `fs/jfs/jfs_logmgr.c` and try to reconstruct the logical flow. I'm looking for where the primary data structures are initialized and how the logging is enabled.

map[File:fs/jfs/jfs_logmgr.c]

map[Contents:// SPDX-License-Identifier: GPL-2.0-or-later
/*
 *   Copyright (C) International Business Machines Corp., 2000-2004
 *   Portions Copyright (C) Christoph Hellwig, 2001-2002
 */

/*
 *	jfs_logmgr.c: log manager
 *
 * for related information, see transaction manager (jfs_txnmgr.c), and
 * recovery manager (jfs_logredo.c).
 *
 * note: for detail, RTFS.
 *
 *	log buffer manager:
 * special purpose buffer manager supporting log i/o requirements.
 * per log serial pageout of logpage
 * queuing i/o requests and redrive i/o at iodone
 * maintain current logpage buffer
 * no caching since append only
 * appropriate jfs buffer cache buffers as needed
 *
 *	group commit:
 * transactions which wrote COMMIT records in the same in-memory
 * log page during the pageout of previous/current log page(s) are
 * committed together by the pageout of the page.
 *
 *	TBD lazy commit:
 * transactions are committed asynchronously when the log page
 * containing it COMMIT is paged out when it becomes full;
 *
 *	serialization:
 * . a per log lock serialize log write.
 * . a per log lock serialize group commit.
 * . a per log lock serialize log open/close;
 *
 *	TBD log integrity:
 * careful-write (ping-pong) of last logpage to recover from crash
 * in overwrite.
 * detection of split (out-of-order) write of physical sectors
 * of last logpage via timestamp at end of each sector
 * with its mirror data array at trailer).
 *
 *	alternatives:
 * lsn - 64-bit monotonically increasing integer vs
 * 32-bit lspn and page eor.
 */

#include <linux/fs.h>
#include <linux/blkdev.h>
#include <linux/interrupt.h>
#include <linux/completion.h>
#include <linux/kthread.h>
#include <linux/buffer_head.h>		/* for sync_blockdev() */
#include <linux/bio.h>
#include <linux/freezer.h>
#include <linux/export.h>
#include <linux/delay.h>
#include <linux/mutex.h>
#include <linux/seq_file.h>
#include <linux/slab.h>
#include "jfs_incore.h"
#include "jfs_filsys.h"
#include "jfs_metapage.h"
#include "jfs_superblock.h"
#include "jfs_txnmgr.h"
#include "jfs_debug.h"


/*
 * lbuf's ready to be redriven.  Protected by log_redrive_lock (jfsIO thread)
 */
static struct lbuf *log_redrive_list;
static DEFINE_SPINLOCK(log_redrive_lock);




/*
 *	log group commit serialization (per log)
 */

#define LOGGC_LOCK_INIT(log)	spin_lock_init(&(log)->gclock)
#define LOGGC_LOCK(log)		spin_lock_irq(&(log)->gclock)
#define LOGGC_UNLOCK(log)	spin_unlock_irq(&(log)->gclock)
#define LOGGC_WAKEUP(tblk)	wake_up_all(&(tblk)->gcwait)

/*
 *	log sync serialization (per log)
 */
#define	LOGSYNC_DELTA(logsize)		min((logsize)/8, 128*LOGPSIZE)
#define	LOGSYNC_BARRIER(logsize)	((logsize)/4)
/*
#define	LOGSYNC_DELTA(logsize)		min((logsize)/4, 256*LOGPSIZE)
#define	LOGSYNC_BARRIER(logsize)	((logsize)/2)
*/


/*
 *	log buffer cache synchronization
 */
static DEFINE_SPINLOCK(jfsLCacheLock);

#define	LCACHE_LOCK(flags)	spin_lock_irqsave(&jfsLCacheLock, flags)
#define	LCACHE_UNLOCK(flags)	spin_unlock_irqrestore(&jfsLCacheLock, flags)

/*
 * See __SLEEP_COND in jfs_locks.h
 */
#define LCACHE_SLEEP_COND(wq, cond, flags)	\
do {						\
	if (cond)				\
		break;				\
	__SLEEP_COND(wq, cond, LCACHE_LOCK(flags), LCACHE_UNLOCK(flags)); \
} while (0)

#define	LCACHE_WAKEUP(event)	wake_up(event)


/*
 *	lbuf buffer cache (lCache) control
 */
/* log buffer manager pageout control (cumulative, inclusive) */
#define	lbmREAD		0x0001
#define	lbmWRITE	0x0002	/* enqueue at tail of write queue;
				 * init pageout if at head of queue;
				 */
#define	lbmRELEASE	0x0004	/* remove from write queue
				 * at completion of pageout;
				 * do not free/recycle it yet:
				 * caller will free it;
				 */
#define	lbmSYNC		0x0008	/* do not return to freelist
				 * when removed from write queue;
				 */
#define lbmFREE		0x0010	/* return to freelist
				 * at completion of pageout;
				 * the buffer may be recycled;
				 */
#define	lbmDONE		0x0020
#define	lbmERROR	0x0040
#define lbmGC		0x0080	/* lbmIODone to perform post-GC processing
				 * of log page
				 */
#define lbmDIRECT	0x0100

/*
 * Global list of active external journals
 */
static LIST_HEAD(jfs_external_logs);
static struct jfs_log *dummy_log;
static DEFINE_MUTEX(jfs_log_mutex);

/*
 * forward references
 */
static int lmWriteRecord(struct jfs_log * log, struct tblock * tblk,
			 struct lrd * lrd, struct tlock * tlck);

static int lmNextPage(struct jfs_log * log);
static int lmLogFileSystem(struct jfs_log * log, struct jfs_sb_info *sbi,
			   int activate);

static int open_inline_log(struct super_block *sb);
static int open_dummy_log(struct super_block *sb);
static int lbmLogInit(struct jfs_log * log);
static void lbmLogShutdown(struct jfs_log * log);
static struct lbuf *lbmAllocate(struct jfs_log * log, int);
static void lbmFree(struct lbuf * bp);
static void lbmfree(struct lbuf * bp);
static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp);
static void lbmWrite(struct jfs_log * log, struct lbuf * bp, int flag, int cant_block);
static void lbmDirectWrite(struct jfs_log * log, struct lbuf * bp, int flag);
static int lbmIOWait(struct lbuf * bp, int flag);
static bio_end_io_t lbmIODone;
static void lbmStartIO(struct lbuf * bp);
static void lmGCwrite(struct jfs_log * log, int cant_block);
static int lmLogSync(struct jfs_log * log, int hard_sync);



/*
 *	statistics
 */
#ifdef CONFIG_JFS_STATISTICS
static struct lmStat {
	uint commit;		/* # of commit */
	uint pagedone;		/* # of page written */
	uint submitted;		/* # of pages submitted */
	uint full_page;		/* # of full pages submitted */
	uint partial_page;	/* # of partial pages submitted */
} lmStat;
#endif

static void write_special_inodes(struct jfs_log *log,
				 int (*writer)(struct address_space *))
{
	struct jfs_sb_info *sbi;

	list_for_each_entry(sbi, &log->sb_list, log_list) {
		/* These pointers can be NULL before list_del during umount */
		if (sbi->ipbmap)
			writer(sbi->ipbmap->i_mapping);
		if (sbi->ipimap)
			writer(sbi->ipimap->i_mapping);
		if (sbi->direct_inode)
			writer(sbi->direct_inode->i_mapping);
	}
}

/*
 * NAME:	lmLog()
 *
 * FUNCTION:	write a log record;
 *
 * PARAMETER:
 *
 * RETURN:	lsn - offset to the next log record to write (end-of-log);
 *		-1  - error;
 *
 * note: todo: log error handler
 */
int lmLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
	  struct tlock * tlck)
{
	int lsn;
	int diffp, difft;
	struct metapage *mp = NULL;
	unsigned long flags;

	jfs_info("lmLog: log:0x%p tblk:0x%p, lrd:0x%p tlck:0x%p",
		 log, tblk, lrd, tlck);

	LOG_LOCK(log);

	/* log by (out-of-transaction) JFS ? */
	if (tblk == NULL)
		goto writeRecord;

	/* log from page ? */
	if (tlck == NULL ||
	    tlck->type & tlckBTROOT || (mp = tlck->mp) == NULL)
		goto writeRecord;

	/*
	 *	initialize/update page/transaction recovery lsn
	 */
	lsn = log->lsn;

	LOGSYNC_LOCK(log, flags);

	/*
	 * initialize page lsn if first log write of the page
	 */
	if (mp->lsn == 0) {
		mp->log = log;
		mp->lsn = lsn;
		log->count++;

		/* insert page at tail of logsynclist */
		list_add_tail(&mp->synclist, &log->synclist);
	}

	/*
	 *	initialize/update lsn of tblock of the page
	 *
	 * transaction inherits oldest lsn of pages associated
	 * with allocation/deallocation of resources (their
	 * log records are used to reconstruct allocation map
	 * at recovery time: inode for inode allocation map,
	 * B+-tree index of extent descriptors for block
	 * allocation map);
	 * allocation map pages inherit transaction lsn at
	 * commit time to allow forwarding log syncpt past log
	 * records associated with allocation/deallocation of
	 * resources only after persistent map of these map pages
	 * have been updated and propagated to home.
	 */
	/*
	 * initialize transaction lsn:
	 */
	if (tblk->lsn == 0) {
		/* inherit lsn of its first page logged */
		tblk->lsn = mp->lsn;
		log->count++;

		/* insert tblock after the page on logsynclist */
		list_add(&tblk->synclist, &mp->synclist);
	}
	/*
	 * update transaction lsn:
	 */
	else {
		/* inherit oldest/smallest lsn of page */
		logdiff(diffp, mp->lsn, log);
		logdiff(difft, tblk->lsn, log);
		if (diffp < difft) {
			/* update tblock lsn with page lsn */
			tblk->lsn = mp->lsn;

			/* move tblock after page on logsynclist */
			list_move(&tblk->synclist, &mp->synclist);
		}
	}

	LOGSYNC_UNLOCK(log, flags);

	/*
	 *	write the log record
	 */
      writeRecord:
	lsn = lmWriteRecord(log, tblk, lrd, tlck);

	/*
	 * forward log syncpt if log reached next syncpt trigger
	 */
	logdiff(diffp, lsn, log);
	if (diffp >= log->nextsync)
		lsn = lmLogSync(log, 0);

	/* update end-of-log lsn */
	log->lsn = lsn;

	LOG_UNLOCK(log);

	/* return end-of-log address */
	return lsn;
}

/*
 * NAME:	lmWriteRecord()
 *
 * FUNCTION:	move the log record to current log page
 *
 * PARAMETER:	cd	- commit descriptor
 *
 * RETURN:	end-of-log address
 *
 * serialization: LOG_LOCK() held on entry/exit
 */
static int
lmWriteRecord(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
	      struct tlock * tlck)
{
	int lsn = 0;		/* end-of-log address */
	struct lbuf *bp;	/* dst log page buffer */
	struct logpage *lp;	/* dst log page */
	caddr_t dst;		/* destination address in log page */
	int dstoffset;		/* end-of-log offset in log page */
	int freespace;		/* free space in log page */
	caddr_t p;		/* src meta-data page */
	caddr_t src;
	int srclen;
	int nbytes;		/* number of bytes to move */
	int i;
	int len;
	struct linelock *linelock;
	struct lv *lv;
	struct lvd *lvd;
	int l2linesize;

	len = 0;

	/* retrieve destination log page to write */
	bp = (struct lbuf *) log->bp;
	lp = (struct logpage *) bp->l_ldata;
	dstoffset = log->eor;

	/* any log data to write ? */
	if (tlck == NULL)
		goto moveLrd;

	/*
	 *	move log record data
	 */
	/* retrieve source meta-data page to log */
	if (tlck->flag & tlckPAGELOCK) {
		p = (caddr_t) (tlck->mp->data);
		linelock = (struct linelock *) & tlck->lock;
	}
	/* retrieve source in-memory inode to log */
	else if (tlck->flag & tlckINODELOCK) {
		if (tlck->type & tlckDTREE)
			p = (caddr_t) &JFS_IP(tlck->ip)->i_dtroot;
		else
			p = (caddr_t) &JFS_IP(tlck->ip)->i_xtroot;
		linelock = (struct linelock *) & tlck->lock;
	}
	else {
		jfs_err("lmWriteRecord: UFO tlck:0x%p", tlck);
		return 0;	/* Probably should trap */
	}
	l2linesize = linelock->l2linesize;

      moveData:
	ASSERT(linelock->index <= linelock->maxcnt);

	lv = linelock->lv;
	for (i = 0; i < linelock->index; i++, lv++) {
		if (lv->length == 0)
			continue;

		/* is page full ? */
		if (dstoffset >= LOGPSIZE - LOGPTLRSIZE) {
			/* page become full: move on to next page */
			lmNextPage(log);

			bp = log->bp;
			lp = (struct logpage *) bp->l_ldata;
			dstoffset = LOGPHDRSIZE;
		}

		/*
		 * move log vector data
		 */
		src = (u8 *) p + (lv->offset << l2linesize);
		srclen = lv->length << l2linesize;
		len += srclen;
		while (srclen > 0) {
			freespace = (LOGPSIZE - LOGPTLRSIZE) - dstoffset;
			nbytes = min(freespace, srclen);
			dst = (caddr_t) lp + dstoffset;
			memcpy(dst, src, nbytes);
			dstoffset += nbytes;

			/* is page not full ? */
			if (dstoffset < LOGPSIZE - LOGPTLRSIZE)
				break;

			/* page become full: move on to next page */
			lmNextPage(log);

			bp = (struct lbuf *) log->bp;
			lp = (struct logpage *) bp->l_ldata;
			dstoffset = LOGPHDRSIZE;

			srclen -= nbytes;
			src += nbytes;
		}

		/*
		 * move log vector descriptor
		 */
		len += 4;
		lvd = (struct lvd *) ((caddr_t) lp + dstoffset);
		lvd->offset = cpu_to_le16(lv->offset);
		lvd->length = cpu_to_le16(lv->length);
		dstoffset += 4;
		jfs_info("lmWriteRecord: lv offset:%d length:%d",
			 lv->offset, lv->length);
	}

	if ((i = linelock->next)) {
		linelock = (struct linelock *) lid_to_tlock(i);
		goto moveData;
	}

	/*
	 *	move log record descriptor
	 */
      moveLrd:
	lrd->length = cpu_to_le16(len);

	src = (caddr_t) lrd;
	srclen = LOGRDSIZE;

	while (srclen > 0) {
		freespace = (LOGPSIZE - LOGPTLRSIZE) - dstoffset;
		nbytes = min(freespace, srclen);
		dst = (caddr_t) lp + dstoffset;
		memcpy(dst, src, nbytes);

		dstoffset += nbytes;
		srclen -= nbytes;

		/* are there more to move than freespace of page ? */
		if (srclen)
			goto pageFull;

		/*
		 * end of log record descriptor
		 */

		/* update last log record eor */
		log->eor = dstoffset;
		bp->l_eor = dstoffset;
		lsn = (log->page << L2LOGPSIZE) + dstoffset;

		if (lrd->type & cpu_to_le16(LOG_COMMIT)) {
			tblk->clsn = lsn;
			jfs_info("wr: tclsn:0x%x, beor:0x%x", tblk->clsn,
				 bp->l_eor);

			INCREMENT(lmStat.commit);	/* # of commit */

			/*
			 * enqueue tblock for group commit:
			 *
			 * enqueue tblock of non-trivial/synchronous COMMIT
			 * at tail of group commit queue
			 * (trivial/asynchronous COMMITs are ignored by
			 * group commit.)
			 */
			LOGGC_LOCK(log);

			/* init tblock gc state */
			tblk->flag = tblkGC_QUEUE;
			tblk->bp = log->bp;
			tblk->pn = log->page;
			tblk->eor = log->eor;

			/* enqueue transaction to commit queue */
			list_add_tail(&tblk->cqueue, &log->cqueue);

			LOGGC_UNLOCK(log);
		}

		jfs_info("lmWriteRecord: lrd:0x%04x bp:0x%p pn:%d eor:0x%x",
			le16_to_cpu(lrd->type), log->bp, log->page, dstoffset);

		/* page not full ? */
		if (dstoffset < LOGPSIZE - LOGPTLRSIZE)
			return lsn;

	      pageFull:
		/* page become full: move on to next page */
		lmNextPage(log);

		bp = (struct lbuf *) log->bp;
		lp = (struct logpage *) bp->l_ldata;
		dstoffset = LOGPHDRSIZE;
		src += nbytes;
	}

	return lsn;
}


/*
 * NAME:	lmNextPage()
 *
 * FUNCTION:	write current page and allocate next page.
 *
 * PARAMETER:	log
 *
 * RETURN:	0
 *
 * serialization: LOG_LOCK() held on entry/exit
 */
static int lmNextPage(struct jfs_log * log)
{
	struct logpage *lp;
	int lspn;		/* log sequence page number */
	int pn;			/* current page number */
	struct lbuf *bp;
	struct lbuf *nextbp;
	struct tblock *tblk;

	/* get current log page number and log sequence page number */
	pn = log->page;
	bp = log->bp;
	lp = (struct logpage *) bp->l_ldata;
	lspn = le32_to_cpu(lp->h.page);

	LOGGC_LOCK(log);

	/*
	 *	write or queue the full page at the tail of write queue
	 */
	/* get the tail tblk on commit queue */
	if (list_empty(&log->cqueue))
		tblk = NULL;
	else
		tblk = list_entry(log->cqueue.prev, struct tblock, cqueue);

	/* every tblk who has COMMIT record on the current page,
	 * and has not been committed, must be on commit queue
	 * since tblk is queued at commit queueu at the time
	 * of writing its COMMIT record on the page before
	 * page becomes full (even though the tblk thread
	 * who wrote COMMIT record may have been suspended
	 * currently);
	 */

	/* is page bound with outstanding tail tblk ? */
	if (tblk && tblk->pn == pn) {
		/* mark tblk for end-of-page */
		tblk->flag |= tblkGC_EOP;

		if (log->cflag & logGC_PAGEOUT) {
			/* if page is not already on write queue,
			 * just enqueue (no lbmWRITE to prevent redrive)
			 * buffer to wqueue to ensure correct serial order
			 * of the pages since log pages will be added
			 * continuously
			 */
			if (bp->l_wqnext == NULL)
				lbmWrite(log, bp, 0, 0);
		} else {
			/*
			 * No current GC leader, initiate group commit
			 */
			log->cflag |= logGC_PAGEOUT;
			lmGCwrite(log, 0);
		}
	}
	/* page is not bound with outstanding tblk:
	 * init write or mark it to be redriven (lbmWRITE)
	 */
	else {
		/* finalize the page */
		bp->l_ceor = bp->l_eor;
		lp->h.eor = lp->t.eor = cpu_to_le16(bp->l_ceor);
		lbmWrite(log, bp, lbmWRITE | lbmRELEASE | lbmFREE, 0);
	}
	LOGGC_UNLOCK(log);

	/*
	 *	allocate/initialize next page
	 */
	/* if log wraps, the first data page of log is 2
	 * (0 never used, 1 is superblock).
	 */
	log->page = (pn == log->size - 1) ? 2 : pn + 1;
	log->eor = LOGPHDRSIZE;	/* ? valid page empty/full at logRedo() */

	/* allocate/initialize next log page buffer */
	nextbp = lbmAllocate(log, log->page);
	nextbp->l_eor = log->eor;
	log->bp = nextbp;

	/* initialize next log page */
	lp = (struct logpage *) nextbp->l_ldata;
	lp->h.page = lp->t.page = cpu_to_le32(lspn + 1);
	lp->h.eor = lp->t.eor = cpu_to_le16(LOGPHDRSIZE);

	return 0;
}


/*
 * NAME:	lmGroupCommit()
 *
 * FUNCTION:	group commit
 *	initiate pageout of the pages with COMMIT in the order of
 *	page number - redrive pageout of the page at the head of
 *	pageout queue until full page has been written.
 *
 * RETURN:
 *
 * NOTE:
 *	LOGGC_LOCK serializes log group commit queue, and
 *	transaction blocks on the commit queue.
 *	N.B. LOG_LOCK is NOT held during lmGroupCommit().
 */
int lmGroupCommit(struct jfs_log * log, struct tblock * tblk)
{
	int rc = 0;

	LOGGC_LOCK(log);

	/* group committed already ? */
	if (tblk->flag & tblkGC_COMMITTED) {
		if (tblk->flag & tblkGC_ERROR)
			rc = -EIO;

		LOGGC_UNLOCK(log);
		return rc;
	}
	jfs_info("lmGroup Commit: tblk = 0x%p, gcrtc = %d", tblk, log->gcrtc);

	if (tblk->xflag & COMMIT_LAZY)
		tblk->flag |= tblkGC_LAZY;

	if ((!(log->cflag & logGC_PAGEOUT)) && (!list_empty(&log->cqueue)) &&
	    (!(tblk->xflag & COMMIT_LAZY) || test_bit(log_FLUSH, &log->flag)
	     || jfs_tlocks_low)) {
		/*
		 * No pageout in progress
		 *
		 * start group commit as its group leader.
		 */
		log->cflag |= logGC_PAGEOUT;

		lmGCwrite(log, 0);
	}

	if (tblk->xflag & COMMIT_LAZY) {
		/*
		 * Lazy transactions can leave now
		 */
		LOGGC_UNLOCK(log);
		return 0;
	}

	/* lmGCwrite gives up LOGGC_LOCK, check again */

	if (tblk->flag & tblkGC_COMMITTED) {
		if (tblk->flag & tblkGC_ERROR)
			rc = -EIO;

		LOGGC_UNLOCK(log);
		return rc;
	}

	/* upcount transaction waiting for completion
	 */
	log->gcrtc++;
	tblk->flag |= tblkGC_READY;

	__SLEEP_COND(tblk->gcwait, (tblk->flag & tblkGC_COMMITTED),
		     LOGGC_LOCK(log), LOGGC_UNLOCK(log));

	/* removed from commit queue */
	if (tblk->flag & tblkGC_ERROR)
		rc = -EIO;

	LOGGC_UNLOCK(log);
	return rc;
}

/*
 * NAME:	lmGCwrite()
 *
 * FUNCTION:	group commit write
 *	initiate write of log page, building a group of all transactions
 *	with commit records on that page.
 *
 * RETURN:	None
 *
 * NOTE:
 *	LOGGC_LOCK must be held by caller.
 *	N.B. LOG_LOCK is NOT held during lmGroupCommit().
 */
static void lmGCwrite(struct jfs_log * log, int cant_write)
{
	struct lbuf *bp;
	struct logpage *lp;
	int gcpn;		/* group commit page number */
	struct tblock *tblk;
	struct tblock *xtblk = NULL;

	/*
	 * build the commit group of a log page
	 *
	 * scan commit queue and make a commit group of all
	 * transactions with COMMIT records on the same log page.
	 */
	/* get the head tblk on the commit queue */
	gcpn = list_entry(log->cqueue.next, struct tblock, cqueue)->pn;

	list_for_each_entry(tblk, &log->cqueue, cqueue) {
		if (tblk->pn != gcpn)
			break;

		xtblk = tblk;

		/* state transition: (QUEUE, READY) -> COMMIT */
		tblk->flag |= tblkGC_COMMIT;
	}
	tblk = xtblk;		/* last tblk of the page */

	/*
	 * pageout to commit transactions on the log page.
	 */
	bp = (struct lbuf *) tblk->bp;
	lp = (struct logpage *) bp->l_ldata;
	/* is page already full ? */
	if (tblk->flag & tblkGC_EOP) {
		/* mark page to free at end of group commit of the page */
		tblk->flag &= ~tblkGC_EOP;
		tblk->flag |= tblkGC_FREE;
		bp->l_ceor = bp->l_eor;
		lp->h.eor = lp->t.eor = cpu_to_le16(bp->l_ceor);
		lbmWrite(log, bp, lbmWRITE | lbmRELEASE | lbmGC,
			 cant_write);
		INCREMENT(lmStat.full_page);
	}
	/* page is not yet full */
	else {
		bp->l_ceor = tblk->eor;	/* ? bp->l_ceor = bp->l_eor; */
		lp->h.eor = lp->t.eor = cpu_to_le16(bp->l_ceor);
		lbmWrite(log, bp, lbmWRITE | lbmGC, cant_write);
		INCREMENT(lmStat.partial_page);
	}
}

/*
 * NAME:	lmPostGC()
 *
 * FUNCTION:	group commit post-processing
 *	Processes transactions after their commit records have been written
 *	to disk, redriving log I/O if necessary.
 *
 * RETURN:	None
 *
 * NOTE:
 *	This routine is called a interrupt time by lbmIODone
 */
static void lmPostGC(struct lbuf * bp)
{
	unsigned long flags;
	struct jfs_log *log = bp->l_log;
	struct logpage *lp;
	struct tblock *tblk, *temp;

	//LOGGC_LOCK(log);
	spin_lock_irqsave(&log->gclock, flags);
	/*
	 * current pageout of group commit completed.
	 *
	 * remove/wakeup transactions from commit queue who were
	 * group committed with the current log page
	 */
	list_for_each_entry_safe(tblk, temp, &log->cqueue, cqueue) {
		if (!(tblk->flag & tblkGC_COMMIT))
			break;
		/* if transaction was marked GC_COMMIT then
		 * it has been shipped in the current pageout
		 * and made it to disk - it is committed.
		 */

		if (bp->l_flag & lbmERROR)
			tblk->flag |= tblkGC_ERROR;

		/* remove it from the commit queue */
		list_del(&tblk->cqueue);
		tblk->flag &= ~tblkGC_QUEUE;

		if (tblk == log->flush_tblk) {
			/* we can stop flushing the log now */
			clear_bit(log_FLUSH, &log->flag);
			log->flush_tblk = NULL;
		}

		jfs_info("lmPostGC: tblk = 0x%p, flag = 0x%x", tblk,
			 tblk->flag);

		if (!(tblk->xflag & COMMIT_FORCE))
			/*
			 * Hand tblk over to lazy commit thread
			 */
			txLazyUnlock(tblk);
		else {
			/* state transition: COMMIT -> COMMITTED */
			tblk->flag |= tblkGC_COMMITTED;

			if (tblk->flag & tblkGC_READY)
				log->gcrtc--;

			LOGGC_WAKEUP(tblk);
		}

		/* was page full before pageout ?
		 * (and this is the last tblk bound with the page)
		 */
		if (tblk->flag & tblkGC_FREE)
			lbmFree(bp);
		/* did page become full after pageout ?
		 * (and this is the last tblk bound with the page)
		 */
		else if (tblk->flag & tblkGC_EOP) {
			/* finalize the page */
			lp = (struct logpage *) bp->l_ldata;
			bp->l_ceor = bp->l_eor;
			lp->h.eor = lp->t.eor = cpu_to_le16(bp->l_eor);
			jfs_info("lmPostGC: calling lbmWrite");
			lbmWrite(log, bp, lbmWRITE | lbmRELEASE | lbmFREE,
				 1);
		}

	}

	/* are there any transactions who have entered lnGroupCommit()
	 * (whose COMMITs are after that of the last log page written.
	 * They are waiting for new group commit (above at (SLEEP 1))
	 * or lazy transactions are on a full (queued) log page,
	 * select the latest ready transaction as new group leader and
	 * wake her up to lead her group.
	 */
	if ((!list_empty(&log->cqueue)) &&
	    ((log->gcrtc > 0) || (tblk->bp->l_wqnext != NULL) ||
	     test_bit(log_FLUSH, &log->flag) || jfs_tlocks_low))
		/*
		 * Call lmGCwrite with new group leader
		 */
		lmGCwrite(log, 1);

	/* no transaction are ready yet (transactions are only just
	 * queued (GC_QUEUE) and not entered for group commit yet).
	 * the first transaction entering group commit
	 * will elect herself as new group leader.
	 */
	else
		log->cflag &= ~logGC_PAGEOUT;

	//LOGGC_UNLOCK(log);
	spin_unlock_irqrestore(&log->gclock, flags);
	return;
}

/*
 * NAME:	lmLogSync()
 *
 * FUNCTION:	write log SYNCPT record for specified log
 *	if new sync address is available
 *	(normally the case if sync() is executed by back-ground
 *	process).
 *	calculate new value of i_nextsync which determines when
 *	this code is called again.
 *
 * PARAMETERS:	log	- log structure
 *		hard_sync - 1 to force all metadata to be written
 *
 * RETURN:	0
 *
 * serialization: LOG_LOCK() held on entry/exit
 */
static int lmLogSync(struct jfs_log * log, int hard_sync)
{
	int logsize;
	int written;		/* written since last syncpt */
	int free;		/* free space left available */
	int delta;		/* additional delta to write normally */
	int more;		/* additional write granted */
	struct lrd lrd;
	int lsn;
	struct logsyncblk *lp;
	unsigned long flags;

	/* push dirty metapages out to disk */
	if (hard_sync)
		write_special_inodes(log, filemap_fdatawrite);
	else
		write_special_inodes(log, filemap_flush);

	/*
	 *	forward syncpt
	 */
	/* if last sync is same as last syncpt,
	 * invoke sync point forward processing to update sync.
	 */

	if (log->sync == log->syncpt) {
		LOGSYNC_LOCK(log, flags);
		if (list_empty(&log->synclist))
			log->sync = log->lsn;
		else {
			lp = list_entry(log->synclist.next,
					struct logsyncblk, synclist);
			log->sync = lp->lsn;
		}
		LOGSYNC_UNLOCK(log, flags);

	}

	/* if sync is different from last syncpt,
	 * write a SYNCPT record with syncpt = sync.
	 * reset syncpt = sync
	 */
	if (log->sync != log->syncpt) {
		lrd.logtid = 0;
		lrd.backchain = 0;
		lrd.type = cpu_to_le16(LOG_SYNCPT);
		lrd.length = 0;
		lrd.log.syncpt.sync = cpu_to_le32(log->sync);
		lsn = lmWriteRecord(log, NULL, &lrd, NULL);

		log->syncpt = log->sync;
	} else
		lsn = log->lsn;

	/*
	 *	setup next syncpt trigger (SWAG)
	 */
	logsize = log->logsize;

	logdiff(written, lsn, log);
	free = logsize - written;
	delta = LOGSYNC_DELTA(logsize);
	more = min(free / 2, delta);
	if (more < 2 * LOGPSIZE) {
		jfs_warn("\n ... Log Wrap ... Log Wrap ... Log Wrap ...\n");
		/*
		 *	log wrapping
		 *
		 * option 1 - panic ? No.!
		 * option 2 - shutdown file systems
		 *	      associated with log ?
		 * option 3 - extend log ?
		 * option 4 - second chance
		 *
		 * mark log wrapped, and continue.
		 * when all active transactions are completed,
		 * mark log valid for recovery.
		 * if crashed during invalid state, log state
		 * implies invalid log, forcing fsck().
		 */
		/* mark log state log wrap in log superblock */
		/* log->state = LOGWRAP; */

		/* reset sync point computation */
		log->syncpt = log->sync = lsn;
		log->nextsync = delta;
	} else
		/* next syncpt trigger = written + more */
		log->nextsync = written + more;

	/* if number of bytes written from last sync point is more
	 * than 1/4 of the log size, stop new transactions from
	 * starting until all current transactions are completed
	 * by setting syncbarrier flag.
	 */
	if (!test_bit(log_SYNCBARRIER, &log->flag) &&
	    (written > LOGSYNC_BARRIER(logsize)) && log->active) {
		set_bit(log_SYNCBARRIER, &log->flag);
		jfs_info("log barrier on: lsn=0x%x syncpt=0x%x", lsn,
			 log->syncpt);
		/*
		 * We may have to initiate group commit
		 */
		jfs_flush_journal(log, 0);
	}

	return lsn;
}

/*
 * NAME:	jfs_syncpt
 *
 * FUNCTION:	write log SYNCPT record for specified log
 *
 * PARAMETERS:	log	  - log structure
 *		hard_sync - set to 1 to force metadata to be written
 */
void jfs_syncpt(struct jfs_log *log, int hard_sync)
{	LOG_LOCK(log);
	if (!test_bit(log_QUIESCE, &log->flag))
		lmLogSync(log, hard_sync);
	LOG_UNLOCK(log);
}

/*
 * NAME:	lmLogOpen()
 *
 * FUNCTION:	open the log on first open;
 *	insert filesystem in the active list of the log.
 *
 * PARAMETER:	ipmnt	- file system mount inode
 *		iplog	- log inode (out)
 *
 * RETURN:
 *
 * serialization:
 */
int lmLogOpen(struct super_block *sb)
{
	int rc;
	struct file *bdev_file;
	struct jfs_log *log;
	struct jfs_sb_info *sbi = JFS_SBI(sb);

	if (sbi->flag & JFS_NOINTEGRITY)
		return open_dummy_log(sb);

	if (sbi->mntflag & JFS_INLINELOG)
		return open_inline_log(sb);

	mutex_lock(&jfs_log_mutex);
	list_for_each_entry(log, &jfs_external_logs, journal_list) {
		if (file_bdev(log->bdev_file)->bd_dev == sbi->logdev) {
			if (!uuid_equal(&log->uuid, &sbi->loguuid)) {
				jfs_warn("wrong uuid on JFS journal");
				mutex_unlock(&jfs_log_mutex);
				return -EINVAL;
			}
			/*
			 * add file system to log active file system list
			 */
			if ((rc = lmLogFileSystem(log, sbi, 1))) {
				mutex_unlock(&jfs_log_mutex);
				return rc;
			}
			goto journal_found;
		}
	}

	if (!(log = kzalloc_obj(struct jfs_log))) {
		mutex_unlock(&jfs_log_mutex);
		return -ENOMEM;
	}
	INIT_LIST_HEAD(&log->sb_list);
	init_waitqueue_head(&log->syncwait);

	/*
	 *	external log as separate logical volume
	 *
	 * file systems to log may have n-to-1 relationship;
	 */

	bdev_file = bdev_file_open_by_dev(sbi->logdev,
			BLK_OPEN_READ | BLK_OPEN_WRITE, log, NULL);
	if (IS_ERR(bdev_file)) {
		rc = PTR_ERR(bdev_file);
		goto free;
	}

	log->bdev_file = bdev_file;
	uuid_copy(&log->uuid, &sbi->loguuid);

	/*
	 * initialize log:
	 */
	if ((rc = lmLogInit(log)))
		goto close;

	list_add(&log->journal_list, &jfs_external_logs);

	/*
	 * add file system to log active file system list
	 */
	if ((rc = lmLogFileSystem(log, sbi, 1)))
		goto shutdown;

journal_found:
	LOG_LOCK(log);
	list_add(&sbi->log_list, &log->sb_list);
	sbi->log = log;
	LOG_UNLOCK(log);

	mutex_unlock(&jfs_log_mutex);
	return 0;

	/*
	 *	unwind on error
	 */
      shutdown:		/* unwind lbmLogInit() */
	list_del(&log->journal_list);
	lbmLogShutdown(log);

      close:		/* close external log device */
	bdev_fput(bdev_file);

      free:		/* free log descriptor */
	mutex_unlock(&jfs_log_mutex);
	kfree(log);

	jfs_warn("lmLogOpen: exit(%d)", rc);
	return rc;
}

static int open_inline_log(struct super_block *sb)
{
	struct jfs_log *log;
	int rc;

	if (!(log = kzalloc_obj(struct jfs_log)))
		return -ENOMEM;
	INIT_LIST_HEAD(&log->sb_list);
	init_waitqueue_head(&log->syncwait);

	set_bit(log_INLINELOG, &log->flag);
	log->bdev_file = sb->s_bdev_file;
	log->base = addressPXD(&JFS_SBI(sb)->logpxd);
	log->size = lengthPXD(&JFS_SBI(sb)->logpxd) >>
	    (L2LOGPSIZE - sb->s_blocksize_bits);
	log->l2bsize = sb->s_blocksize_bits;
	ASSERT(L2LOGPSIZE >= sb->s_blocksize_bits);

	/*
	 * initialize log.
	 */
	if ((rc = lmLogInit(log))) {
		kfree(log);
		jfs_warn("lmLogOpen: exit(%d)", rc);
		return rc;
	}

	list_add(&JFS_SBI(sb)->log_list, &log->sb_list);
	JFS_SBI(sb)->log = log;

	return rc;
}

static int open_dummy_log(struct super_block *sb)
{
	int rc;

	mutex_lock(&jfs_log_mutex);
	if (!dummy_log) {
		dummy_log = kzalloc_obj(struct jfs_log);
		if (!dummy_log) {
			mutex_unlock(&jfs_log_mutex);
			return -ENOMEM;
		}
		INIT_LIST_HEAD(&dummy_log->sb_list);
		init_waitqueue_head(&dummy_log->syncwait);
		dummy_log->no_integrity = 1;
		/* Make up some stuff */
		dummy_log->size = 1024;
		rc = lmLogInit(dummy_log);
		if (rc) {
			kfree(dummy_log);
			dummy_log = NULL;
			mutex_unlock(&jfs_log_mutex);
			return rc;
		}
	}

	LOG_LOCK(dummy_log);
	list_add(&JFS_SBI(sb)->log_list, &dummy_log->sb_list);
	JFS_SBI(sb)->log = dummy_log;
	LOG_UNLOCK(dummy_log);
	mutex_unlock(&jfs_log_mutex);

	return 0;
}

/*
 * NAME:	lmLogInit()
 *
 * FUNCTION:	log initialization at first log open.
 *
 *	logredo() (or logformat()) should have been run previously.
 *	initialize the log from log superblock.
 *	set the log state in the superblock to LOGMOUNT and
 *	write SYNCPT log record.
 *
 * PARAMETER:	log	- log structure
 *
 * RETURN:	0	- if ok
 *		-EINVAL	- bad log magic number or superblock dirty
 *		error returned from logwait()
 *
 * serialization: single first open thread
 */
int lmLogInit(struct jfs_log * log)
{
	int rc = 0;
	struct lrd lrd;
	struct logsuper *logsuper;
	struct lbuf *bpsuper;
	struct lbuf *bp;
	struct logpage *lp;
	int lsn = 0;

	jfs_info("lmLogInit: log:0x%p", log);

	/* initialize the group commit serialization lock */
	LOGGC_LOCK_INIT(log);

	/* allocate/initialize the log write serialization lock */
	LOG_LOCK_INIT(log);

	LOGSYNC_LOCK_INIT(log);

	INIT_LIST_HEAD(&log->synclist);

	INIT_LIST_HEAD(&log->cqueue);
	log->flush_tblk = NULL;

	log->count = 0;

	/*
	 * initialize log i/o
	 */
	if ((rc = lbmLogInit(log)))
		return rc;

	if (!test_bit(log_INLINELOG, &log->flag))
		log->l2bsize = L2LOGPSIZE;

	/* check for disabled journaling to disk */
	if (log->no_integrity) {
		/*
		 * Journal pages will still be filled.  When the time comes
		 * to actually do the I/O, the write is not done, and the
		 * endio routine is called directly.
		 */
		bp = lbmAllocate(log , 0);
		log->bp = bp;
		bp->l_pn = bp->l_eor = 0;
	} else {
		/*
		 * validate log superblock
		 */
		if ((rc = lbmRead(log, 1, &bpsuper)))
			goto errout10;

		logsuper = (struct logsuper *) bpsuper->l_ldata;

		if (logsuper->magic != cpu_to_le32(LOGMAGIC)) {
			jfs_warn("*** Log Format Error ! ***");
			rc = -EINVAL;
			goto errout20;
		}

		/* logredo() should have been run successfully. */
		if (logsuper->state != cpu_to_le32(LOGREDONE)) {
			jfs_warn("*** Log Is Dirty ! ***");
			rc = -EINVAL;
			goto errout20;
		}

		/* initialize log from log superblock */
		if (test_bit(log_INLINELOG,&log->flag)) {
			if (log->size != le32_to_cpu(logsuper->size)) {
				rc = -EINVAL;
				goto errout20;
			}
			jfs_info("lmLogInit: inline log:0x%p base:0x%Lx size:0x%x",
				 log, (unsigned long long)log->base, log->size);
		} else {
			if (!uuid_equal(&logsuper->uuid, &log->uuid)) {
				jfs_warn("wrong uuid on JFS log device");
				rc = -EINVAL;
				goto errout20;
			}
			log->size = le32_to_cpu(logsuper->size);
			log->l2bsize = le32_to_cpu(logsuper->l2bsize);
			jfs_info("lmLogInit: external log:0x%p base:0x%Lx size:0x%x",
				 log, (unsigned long long)log->base, log->size);
		}

		log->page = le32_to_cpu(logsuper->end) / LOGPSIZE;
		log->eor = le32_to_cpu(logsuper->end) - (LOGPSIZE * log->page);

		/*
		 * initialize for log append write mode
		 */
		/* establish current/end-of-log page/buffer */
		if ((rc = lbmRead(log, log->page, &bp)))
			goto errout20;

		lp = (struct logpage *) bp->l_ldata;

		jfs_info("lmLogInit: lsn:0x%x page:%d eor:%d:%d",
			 le32_to_cpu(logsuper->end), log->page, log->eor,
			 le16_to_cpu(lp->h.eor));

		log->bp = bp;
		bp->l_pn = log->page;
		bp->l_eor = log->eor;

		/* if current page is full, move on to next page */
		if (log->eor >= LOGPSIZE - LOGPTLRSIZE)
			lmNextPage(log);

		/*
		 * initialize log syncpoint
		 */
		/*
		 * write the first SYNCPT record with syncpoint = 0
		 * (i.e., log redo up to HERE !);
		 * remove current page from lbm write queue at end of pageout
		 * (to write log superblock update), but do not release to
		 * freelist;
		 */
		lrd.logtid = 0;
		lrd.backchain = 0;
		lrd.type = cpu_to_le16(LOG_SYNCPT);
		lrd.length = 0;
		lrd.log.syncpt.sync = 0;
		lsn = lmWriteRecord(log, NULL, &lrd, NULL);
		bp = log->bp;
		bp->l_ceor = bp->l_eor;
		lp = (struct logpage *) bp->l_ldata;
		lp->h.eor = lp->t.eor = cpu_to_le16(bp->l_eor);
		lbmWrite(log, bp, lbmWRITE | lbmSYNC, 0);
		if ((rc = lbmIOWait(bp, 0)))
			goto errout30;

		/*
		 * update/write superblock
		 */
		logsuper->state = cpu_to_le32(LOGMOUNT);
		log->serial = le32_to_cpu(logsuper->serial) + 1;
		logsuper->serial = cpu_to_le32(log->serial);
		lbmDirectWrite(log, bpsuper, lbmWRITE | lbmRELEASE | lbmSYNC);
		if ((rc = lbmIOWait(bpsuper, lbmFREE)))
			goto errout30;
	}

	/* initialize logsync parameters */
	log->logsize = (log->size - 2) << L2LOGPSIZE;
	log->lsn = lsn;
	log->syncpt = lsn;
	log->sync = log->syncpt;
	log->nextsync = LOGSYNC_DELTA(log->logsize);

	jfs_info("lmLogInit: lsn:0x%x syncpt:0x%x sync:0x%x",
		 log->lsn, log->syncpt, log->sync);

	/*
	 * initialize for lazy/group commit
	 */
	log->clsn = lsn;

	return 0;

	/*
	 *	unwind on error
	 */
      errout30:		/* release log page */
	log->wqueue = NULL;
	bp->l_wqnext = NULL;
	lbmFree(bp);

      errout20:		/* release log superblock */
	lbmFree(bpsuper);

      errout10:		/* unwind lbmLogInit() */
	lbmLogShutdown(log);

	jfs_warn("lmLogInit: exit(%d)", rc);
	return rc;
}


/*
 * NAME:	lmLogClose()
 *
 * FUNCTION:	remove file system <ipmnt> from active list of log <iplog>
 *		and close it on last close.
 *
 * PARAMETER:	sb	- superblock
 *
 * RETURN:	errors from subroutines
 *
 * serialization:
 */
int lmLogClose(struct super_block *sb)
{
	struct jfs_sb_info *sbi = JFS_SBI(sb);
	struct jfs_log *log = sbi->log;
	struct file *bdev_file;
	int rc = 0;

	jfs_info("lmLogClose: log:0x%p", log);

	mutex_lock(&jfs_log_mutex);
	LOG_LOCK(log);
	list_del(&sbi->log_list);
	LOG_UNLOCK(log);
	sbi->log = NULL;

	/*
	 * We need to make sure all of the "written" metapages
	 * actually make it to disk
	 */
	sync_blockdev(sb->s_bdev);

	if (test_bit(log_INLINELOG, &log->flag)) {
		/*
		 *	in-line log in host file system
		 */
		rc = lmLogShutdown(log);
		kfree(log);
		goto out;
	}

	if (!log->no_integrity)
		lmLogFileSystem(log, sbi, 0);

	if (!list_empty(&log->sb_list))
		goto out;

	/*
	 * TODO: ensure that the dummy_log is in a state to allow
	 * lbmLogShutdown to deallocate all the buffers and call
	 * kfree against dummy_log.  For now, leave dummy_log & its
	 * buffers in memory, and resuse if another no-integrity mount
	 * is requested.
	 */
	if (log->no_integrity)
		goto out;

	/*
	 *	external log as separate logical volume
	 */
	list_del(&log->journal_list);
	bdev_file = log->bdev_file;
	rc = lmLogShutdown(log);

	bdev_fput(bdev_file);

	kfree(log);

      out:
	mutex_unlock(&jfs_log_mutex);
	jfs_info("lmLogClose: exit(%d)", rc);
	return rc;
}


/*
 * NAME:	jfs_flush_journal()
 *
 * FUNCTION:	initiate write of any outstanding transactions to the journal
 *		and optionally wait until they are all written to disk
 *
 *		wait == 0  flush until latest txn is committed, don't wait
 *		wait == 1  flush until latest txn is committed, wait
 *		wait > 1   flush until all txn's are complete, wait
 */
void jfs_flush_journal(struct jfs_log *log, int wait)
{
	int i;
	struct tblock *target = NULL;

	/* jfs_write_inode may call us during read-only mount */
	if (!log)
		return;

	jfs_info("jfs_flush_journal: log:0x%p wait=%d", log, wait);

	LOGGC_LOCK(log);

	if (!list_empty(&log->cqueue)) {
		/*
		 * This ensures that we will keep writing to the journal as long
		 * as there are unwritten commit records
		 */
		target = list_entry(log->cqueue.prev, struct tblock, cqueue);

		if (test_bit(log_FLUSH, &log->flag)) {
			/*
			 * We're already flushing.
			 * if flush_tblk is NULL, we are flushing everything,
			 * so leave it that way.  Otherwise, update it to the
			 * latest transaction
			 */
			if (log->flush_tblk)
				log->flush_tblk = target;
		} else {
			/* Only flush until latest transaction is committed */
			log->flush_tblk = target;
			set_bit(log_FLUSH, &log->flag);

			/*
			 * Initiate I/O on outstanding transactions
			 */
			if (!(log->cflag & logGC_PAGEOUT)) {
				log->cflag |= logGC_PAGEOUT;
				lmGCwrite(log, 0);
			}
		}
	}
	if ((wait > 1) || test_bit(log_SYNCBARRIER, &log->flag)) {
		/* Flush until all activity complete */
		set_bit(log_FLUSH, &log->flag);
		log->flush_tblk = NULL;
	}

	if (wait && target && !(target->flag & tblkGC_COMMITTED)) {
		DECLARE_WAITQUEUE(__wait, current);

		add_wait_queue(&target->gcwait, &__wait);
		set_current_state(TASK_UNINTERRUPTIBLE);
		LOGGC_UNLOCK(log);
		schedule();
		LOGGC_LOCK(log);
		remove_wait_queue(&target->gcwait, &__wait);
	}
	LOGGC_UNLOCK(log);

	if (wait < 2)
		return;

	write_special_inodes(log, filemap_fdatawrite);

	/*
	 * If there was recent activity, we may need to wait
	 * for the lazycommit thread to catch up
	 */
	if ((!list_empty(&log->cqueue)) || !list_empty(&log->synclist)) {
		for (i = 0; i < 200; i++) {	/* Too much? */
			msleep(250);
			write_special_inodes(log, filemap_fdatawrite);
			if (list_empty(&log->cqueue) &&
			    list_empty(&log->synclist))
				break;
		}
	}
	assert(list_empty(&log->cqueue));

#ifdef CONFIG_JFS_DEBUG
	if (!list_empty(&log->synclist)) {
		struct logsyncblk *lp;

		printk(KERN_ERR "jfs_flush_journal: synclist not empty\n");
		list_for_each_entry(lp, &log->synclist, synclist) {
			if (lp->xflag & COMMIT_PAGE) {
				struct metapage *mp = (struct metapage *)lp;
				print_hex_dump(KERN_ERR, "metapage: ",
					       DUMP_PREFIX_ADDRESS, 16, 4,
					       mp, sizeof(struct metapage), 0);
				print_hex_dump(KERN_ERR, "page: ",
					       DUMP_PREFIX_ADDRESS, 16,
					       sizeof(long), mp->folio,
					       sizeof(struct page), 0);
			} else
				print_hex_dump(KERN_ERR, "tblock:",
					       DUMP_PREFIX_ADDRESS, 16, 4,
					       lp, sizeof(struct tblock), 0);
		}
	}
#else
	WARN_ON(!list_empty(&log->synclist));
#endif
	clear_bit(log_FLUSH, &log->flag);
}

/*
 * NAME:	lmLogShutdown()
 *
 * FUNCTION:	log shutdown at last LogClose().
 *
 *		write log syncpt record.
 *		update super block to set redone flag to 0.
 *
 * PARAMETER:	log	- log inode
 *
 * RETURN:	0	- success
 *
 * serialization: single last close thread
 */
int lmLogShutdown(struct jfs_log * log)
{
	int rc;
	struct lrd lrd;
	int lsn;
	struct logsuper *logsuper;
	struct lbuf *bpsuper;
	struct lbuf *bp;
	struct logpage *lp;

	jfs_info("lmLogShutdown: log:0x%p", log);

	jfs_flush_journal(log, 2);

	/*
	 * write the last SYNCPT record with syncpoint = 0
	 * (i.e., log redo up to HERE !)
	 */
	lrd.logtid = 0;
	lrd.backchain = 0;
	lrd.type = cpu_to_le16(LOG_SYNCPT);
	lrd.length = 0;
	lrd.log.syncpt.sync = 0;

	lsn = lmWriteRecord(log, NULL, &lrd, NULL);
	bp = log->bp;
	lp = (struct logpage *) bp->l_ldata;
	lp->h.eor = lp->t.eor = cpu_to_le16(bp->l_eor);
	lbmWrite(log, log->bp, lbmWRITE | lbmRELEASE | lbmSYNC, 0);
	lbmIOWait(log->bp, lbmFREE);
	log->bp = NULL;

	/*
	 * synchronous update log superblock
	 * mark log state as shutdown cleanly
	 * (i.e., Log does not need to be replayed).
	 */
	if ((rc = lbmRead(log, 1, &bpsuper)))
		goto out;

	logsuper = (struct logsuper *) bpsuper->l_ldata;
	logsuper->state = cpu_to_le32(LOGREDONE);
	logsuper->end = cpu_to_le32(lsn);
	lbmDirectWrite(log, bpsuper, lbmWRITE | lbmRELEASE | lbmSYNC);
	rc = lbmIOWait(bpsuper, lbmFREE);

	jfs_info("lmLogShutdown: lsn:0x%x page:%d eor:%d",
		 lsn, log->page, log->eor);

      out:
	/*
	 * shutdown per log i/o
	 */
	lbmLogShutdown(log);

	if (rc) {
		jfs_warn("lmLogShutdown: exit(%d)", rc);
	}
	return rc;
}


/*
 * NAME:	lmLogFileSystem()
 *
 * FUNCTION:	insert (<activate> = true)/remove (<activate> = false)
 *	file system into/from log active file system list.
 *
 * PARAMETE:	log	- pointer to logs inode.
 *		fsdev	- kdev_t of filesystem.
 *		serial	- pointer to returned log serial number
 *		activate - insert/remove device from active list.
 *
 * RETURN:	0	- success
 *		errors returned by vms_iowait().
 */
static int lmLogFileSystem(struct jfs_log * log, struct jfs_sb_info *sbi,
			   int activate)
{
	int rc = 0;
	int i;
	struct logsuper *logsuper;
	struct lbuf *bpsuper;
	uuid_t *uuid = &sbi->uuid;

	/*
	 * insert/remove file system device to log active file system list.
	 */
	if ((rc = lbmRead(log, 1, &bpsuper)))
		return rc;

	logsuper = (struct logsuper *) bpsuper->l_ldata;
	if (activate) {
		for (i = 0; i < MAX_ACTIVE; i++)
			if (uuid_is_null(&logsuper->active[i].uuid)) {
				uuid_copy(&logsuper->active[i].uuid, uuid);
				sbi->aggregate = i;
				break;
			}
		if (i == MAX_ACTIVE) {
			jfs_warn("Too many file systems sharing journal!");
			lbmFree(bpsuper);
			return -EMFILE;	/* Is there a better rc? */
		}
	} else {
		for (i = 0; i < MAX_ACTIVE; i++)
			if (uuid_equal(&logsuper->active[i].uuid, uuid)) {
				uuid_copy(&logsuper->active[i].uuid,
					  &uuid_null);
				break;
			}
		if (i == MAX_ACTIVE) {
			jfs_warn("Somebody stomped on the journal!");
			lbmFree(bpsuper);
			return -EIO;
		}

	}

	/*
	 * synchronous write log superblock:
	 *
	 * write sidestream bypassing write queue:
	 * at file system mount, log super block is updated for
	 * activation of the file system before any log record
	 * (MOUNT record) of the file system, and at file system
	 * unmount, all meta data for the file system has been
	 * flushed before log super block is updated for deactivation
	 * of the file system.
	 */
	lbmDirectWrite(log, bpsuper, lbmWRITE | lbmRELEASE | lbmSYNC);
	rc = lbmIOWait(bpsuper, lbmFREE);

	return rc;
}

/*
 *		log buffer manager (lbm)
 *		------------------------
 *
 * special purpose buffer manager supporting log i/o requirements.
 *
 * per log write queue:
 * log pageout occurs in serial order by fifo write queue and
 * restricting to a single i/o in pregress at any one time.
 * a circular singly-linked list
 * (log->wrqueue points to the tail, and buffers are linked via
 * bp->wrqueue field), and
 * maintains log page in pageout ot waiting for pageout in serial pageout.
 */

/*
 *	lbmLogInit()
 *
 * initialize per log I/O setup at lmLogInit()
 */
static int lbmLogInit(struct jfs_log * log)
{				/* log inode */
	int i;
	struct lbuf *lbuf;

	jfs_info("lbmLogInit: log:0x%p", log);

	/* initialize current buffer cursor */
	log->bp = NULL;

	/* initialize log device write queue */
	log->wqueue = NULL;

	/*
	 * Each log has its own buffer pages allocated to it.  These are
	 * not managed by the page cache.  This ensures that a transaction
	 * writing to the log does not block trying to allocate a page from
	 * the page cache (for the log).  This would be bad, since page
	 * allocation waits on the kswapd thread that may be committing inodes
	 * which would cause log activity.  Was that clear?  I'm trying to
	 * avoid deadlock here.
	 */
	init_waitqueue_head(&log->free_wait);

	log->lbuf_free = NULL;

	for (i = 0; i < LOGPAGES;) {
		char *buffer;
		uint offset;
		struct page *page = alloc_page(GFP_KERNEL | __GFP_ZERO);

		if (!page)
			goto error;
		buffer = page_address(page);
		for (offset = 0; offset < PAGE_SIZE; offset += LOGPSIZE) {
			lbuf = kmalloc_obj(struct lbuf);
			if (lbuf == NULL) {
				if (offset == 0)
					__free_page(page);
				goto error;
			}
			if (offset) /* we already have one reference */
				get_page(page);
			lbuf->l_offset = offset;
			lbuf->l_ldata = buffer + offset;
			lbuf->l_page = page;
			lbuf->l_log = log;
			init_waitqueue_head(&lbuf->l_ioevent);

			lbuf->l_freelist = log->lbuf_free;
			log->lbuf_free = lbuf;
			i++;
		}
	}

	return (0);

      error:
	lbmLogShutdown(log);
	return -ENOMEM;
}


/*
 *	lbmLogShutdown()
 *
 * finalize per log I/O setup at lmLogShutdown()
 */
static void lbmLogShutdown(struct jfs_log * log)
{
	struct lbuf *lbuf;

	jfs_info("lbmLogShutdown: log:0x%p", log);

	lbuf = log->lbuf_free;
	while (lbuf) {
		struct lbuf *next = lbuf->l_freelist;
		__free_page(lbuf->l_page);
		kfree(lbuf);
		lbuf = next;
	}
}


/*
 *	lbmAllocate()
 *
 * allocate an empty log buffer
 */
static struct lbuf *lbmAllocate(struct jfs_log * log, int pn)
{
	struct lbuf *bp;
	unsigned long flags;

	/*
	 * recycle from log buffer freelist if any
	 */
	LCACHE_LOCK(flags);
	LCACHE_SLEEP_COND(log->free_wait, (bp = log->lbuf_free), flags);
	log->lbuf_free = bp->l_freelist;
	LCACHE_UNLOCK(flags);

	bp->l_flag = 0;

	bp->l_wqnext = NULL;
	bp->l_freelist = NULL;

	bp->l_pn = pn;
	bp->l_blkno = log->base + (pn << (L2LOGPSIZE - log->l2bsize));
	bp->l_ceor = 0;

	return bp;
}


/*
 *	lbmFree()
 *
 * release a log buffer to freelist
 */
static void lbmFree(struct lbuf * bp)
{
	unsigned long flags;

	LCACHE_LOCK(flags);

	lbmfree(bp);

	LCACHE_UNLOCK(flags);
}

static void lbmfree(struct lbuf * bp)
{
	struct jfs_log *log = bp->l_log;

	assert(bp->l_wqnext == NULL);

	/*
	 * return the buffer to head of freelist
	 */
	bp->l_freelist = log->lbuf_free;
	log->lbuf_free = bp;

	wake_up(&log->free_wait);
	return;
}


/*
 * NAME:	lbmRedrive
 *
 * FUNCTION:	add a log buffer to the log redrive list
 *
 * PARAMETER:
 *	bp	- log buffer
 *
 * NOTES:
 *	Takes log_redrive_lock.
 */
static inline void lbmRedrive(struct lbuf *bp)
{
	unsigned long flags;

	spin_lock_irqsave(&log_redrive_lock, flags);
	bp->l_redrive_next = log_redrive_list;
	log_redrive_list = bp;
	spin_unlock_irqrestore(&log_redrive_lock, flags);

	wake_up_process(jfsIOthread);
}


/*
 *	lbmRead()
 */
static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp)
{
	struct bio *bio;
	struct lbuf *bp;

	/*
	 * allocate a log buffer
	 */
	*bpp = bp = lbmAllocate(log, pn);
	jfs_info("lbmRead: bp:0x%p pn:0x%x", bp, pn);

	bp->l_flag |= lbmREAD;

	bio = bio_alloc(file_bdev(log->bdev_file), 1, REQ_OP_READ, GFP_NOFS);
	bio->bi_iter.bi_sector = bp->l_blkno << (log->l2bsize - 9);
	__bio_add_page(bio, bp->l_page, LOGPSIZE, bp->l_offset);
	BUG_ON(bio->bi_iter.bi_size != LOGPSIZE);

	bio->bi_end_io = lbmIODone;
	bio->bi_private = bp;
	/*check if journaling to disk has been disabled*/
	if (log->no_integrity) {
		bio->bi_iter.bi_size = 0;
		lbmIODone(bio);
	} else {
		submit_bio(bio);
	}

	wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));

	return 0;
}


/*
 *	lbmWrite()
 *
 * buffer at head of pageout queue stays after completion of
 * partial-page pageout and redriven by explicit initiation of
 * pageout by caller until full-page pageout is completed and
 * released.
 *
 * device driver i/o done redrives pageout of new buffer at
 * head of pageout queue when current buffer at head of pageout
 * queue is released at the completion of its full-page pageout.
 *
 * LOGGC_LOCK() serializes lbmWrite() by lmNextPage() and lmGroupCommit().
 * LCACHE_LOCK() serializes xflag between lbmWrite() and lbmIODone()
 */
static void lbmWrite(struct jfs_log * log, struct lbuf * bp, int flag,
		     int cant_block)
{
	struct lbuf *tail;
	unsigned long flags;

	jfs_info("lbmWrite: bp:0x%p flag:0x%x pn:0x%x", bp, flag, bp->l_pn);

	/* map the logical block address to physical block address */
	bp->l_blkno =
	    log->base + (bp->l_pn << (L2LOGPSIZE - log->l2bsize));

	LCACHE_LOCK(flags);		/* disable+lock */

	/*
	 * initialize buffer for device driver
	 */
	bp->l_flag = flag;

	/*
	 *	insert bp at tail of write queue associated with log
	 *
	 * (request is either for bp already/currently at head of queue
	 * or new bp to be inserted at tail)
	 */
	tail = log->wqueue;

	/* is buffer not already on write queue ? */
	if (bp->l_wqnext == NULL) {
		/* insert at tail of wqueue */
		if (tail == NULL) {
			log->wqueue = bp;
			bp->l_wqnext = bp;
		} else {
			log->wqueue = bp;
			bp->l_wqnext = tail->l_wqnext;
			tail->l_wqnext = bp;
		}

		tail = bp;
	}

	/* is buffer at head of wqueue and for write ? */
	if ((bp != tail->l_wqnext) || !(flag & lbmWRITE)) {
		LCACHE_UNLOCK(flags);	/* unlock+enable */
		return;
	}

	LCACHE_UNLOCK(flags);	/* unlock+enable */

	if (cant_block)
		lbmRedrive(bp);
	else if (flag & lbmSYNC)
		lbmStartIO(bp);
	else {
		LOGGC_UNLOCK(log);
		lbmStartIO(bp);
		LOGGC_LOCK(log);
	}
}


/*
 *	lbmDirectWrite()
 *
 * initiate pageout bypassing write queue for sidestream
 * (e.g., log superblock) write;
 */
static void lbmDirectWrite(struct jfs_log * log, struct lbuf * bp, int flag)
{
	jfs_info("lbmDirectWrite: bp:0x%p flag:0x%x pn:0x%x",
		 bp, flag, bp->l_pn);

	/*
	 * initialize buffer for device driver
	 */
	bp->l_flag = flag | lbmDIRECT;

	/* map the logical block address to physical block address */
	bp->l_blkno =
	    log->base + (bp->l_pn << (L2LOGPSIZE - log->l2bsize));

	/*
	 *	initiate pageout of the page
	 */
	lbmStartIO(bp);
}


/*
 * NAME:	lbmStartIO()
 *
 * FUNCTION:	Interface to DD strategy routine
 *
 * RETURN:	none
 *
 * serialization: LCACHE_LOCK() is NOT held during log i/o;
 */
static void lbmStartIO(struct lbuf * bp)
{
	struct bio *bio;
	struct jfs_log *log = bp->l_log;
	struct block_device *bdev = NULL;

	jfs_info("lbmStartIO");

	if (!log->no_integrity)
		bdev = file_bdev(log->bdev_file);

	bio = bio_alloc(bdev, 1, REQ_OP_WRITE | REQ_SYNC,
			GFP_NOFS);
	bio->bi_iter.bi_sector = bp->l_blkno << (log->l2bsize - 9);
	__bio_add_page(bio, bp->l_page, LOGPSIZE, bp->l_offset);
	BUG_ON(bio->bi_iter.bi_size != LOGPSIZE);

	bio->bi_end_io = lbmIODone;
	bio->bi_private = bp;

	/* check if journaling to disk has been disabled */
	if (log->no_integrity) {
		bio->bi_iter.bi_size = 0;
		lbmIODone(bio);
	} else {
		submit_bio(bio);
		INCREMENT(lmStat.submitted);
	}
}


/*
 *	lbmIOWait()
 */
static int lbmIOWait(struct lbuf * bp, int flag)
{
	unsigned long flags;
	int rc = 0;

	jfs_info("lbmIOWait1: bp:0x%p flag:0x%x:0x%x", bp, bp->l_flag, flag);

	LCACHE_LOCK(flags);		/* disable+lock */

	LCACHE_SLEEP_COND(bp->l_ioevent, (bp->l_flag & lbmDONE), flags);

	rc = (bp->l_flag & lbmERROR) ? -EIO : 0;

	if (flag & lbmFREE)
		lbmfree(bp);

	LCACHE_UNLOCK(flags);	/* unlock+enable */

	jfs_info("lbmIOWait2: bp:0x%p flag:0x%x:0x%x", bp, bp->l_flag, flag);
	return rc;
}

/*
 *	lbmIODone()
 *
 * executed at INTIODONE level
 */
static void lbmIODone(struct bio *bio)
{
	struct lbuf *bp = bio->bi_private;
	struct lbuf *nextbp, *tail;
	struct jfs_log *log;
	unsigned long flags;

	/*
	 * get back jfs buffer bound to the i/o buffer
	 */
	jfs_info("lbmIODone: bp:0x%p flag:0x%x", bp, bp->l_flag);

	LCACHE_LOCK(flags);		/* disable+lock */

	if (bio->bi_status) {
		bp->l_flag |= lbmERROR;

		jfs_err("lbmIODone: I/O error in JFS log");
	}

	bio_put(bio);

	/*
	 *	pagein completion
	 */
	if (bp->l_flag & lbmREAD) {
		bp->l_flag &= ~lbmREAD;

		/* wakeup I/O initiator */
		LCACHE_WAKEUP(&bp->l_ioevent);

		goto out;
	}

	/*
	 *	pageout completion
	 *
	 * the bp at the head of write queue has completed pageout.
	 *
	 * if single-commit/full-page pageout, remove the current buffer
	 * from head of pageout queue, and redrive pageout with
	 * the new buffer at head of pageout queue;
	 * otherwise, the partial-page pageout buffer stays at
	 * the head of pageout queue to be redriven for pageout
	 * by lmGroupCommit() until full-page pageout is completed.
	 */
	bp->l_flag &= ~lbmWRITE;
	INCREMENT(lmStat.pagedone);

	/* update committed lsn */
	log = bp->l_log;
	log->clsn = (bp->l_pn << L2LOGPSIZE) + bp->l_ceor;

	if (bp->l_flag & lbmDIRECT) {
		LCACHE_WAKEUP(&bp->l_ioevent);
		goto out;
	}

	tail = log->wqueue;

	/* single element queue */
	if (bp == tail) {
		/* remove head buffer of full-page pageout
		 * from log device write queue
		 */
		if (bp->l_flag & lbmRELEASE) {
			log->wqueue = NULL;
			bp->l_wqnext = NULL;
		}
	}
	/* multi element queue */
	else {
		/* remove head buffer of full-page pageout
		 * from log device write queue
		 */
		if (bp->l_flag & lbmRELEASE) {
			nextbp = tail->l_wqnext = bp->l_wqnext;
			bp->l_wqnext = NULL;

			/*
			 * redrive pageout of next page at head of write queue:
			 * redrive next page without any bound tblk
			 * (i.e., page w/o any COMMIT records), or
			 * first page of new group commit which has been
			 * queued after current page (subsequent pageout
			 * is performed synchronously, except page without
			 * any COMMITs) by lmGroupCommit() as indicated
			 * by lbmWRITE flag;
			 */
			if (nextbp->l_flag & lbmWRITE) {
				/*
				 * We can't do the I/O at interrupt time.
				 * The jfsIO thread can do it
				 */
				lbmRedrive(nextbp);
			}
		}
	}

	/*
	 *	synchronous pageout:
	 *
	 * buffer has not necessarily been removed from write queue
	 * (e.g., synchronous write of partial-page with COMMIT):
	 * leave buffer for i/o initiator to dispose
	 */
	if (bp->l_flag & lbmSYNC) {
		/* wakeup I/O initiator */
		LCACHE_WAKEUP(&bp->l_ioevent);
	}

	/*
	 *	Group Commit pageout:
	 */
	else if (bp->l_flag & lbmGC) {
		LCACHE_UNLOCK(flags);
		lmPostGC(bp);
		LCACHE_LOCK(flags);		/* disable+lock */
	}

	/*
	 *	asynchronous pageout:
	 *
	 * buffer must have been removed from write queue:
	 * insert buffer at head of freelist where it can be recycled
	 */
	else {
		assert(bp->l_flag & lbmRELEASE);
		assert(bp->l_flag & lbmFREE);
		lbmfree(bp);
	}

out:
	bp->l_flag |= lbmDONE;
	LCACHE_UNLOCK(flags);
}

int jfsIOWait(void *arg)
{
	struct lbuf *bp;

	set_freezable();
	do {
		spin_lock_irq(&log_redrive_lock);
		while ((bp = log_redrive_list)) {
			log_redrive_list = bp->l_redrive_next;
			bp->l_redrive_next = NULL;
			spin_unlock_irq(&log_redrive_lock);
			lbmStartIO(bp);
			spin_lock_irq(&log_redrive_lock);
		}

		if (freezing(current)) {
			spin_unlock_irq(&log_redrive_lock);
			try_to_freeze();
		} else {
			set_current_state(TASK_INTERRUPTIBLE);
			spin_unlock_irq(&log_redrive_lock);
			schedule();
		}
	} while (!kthread_should_stop());

	jfs_info("jfsIOWait being killed!");
	return 0;
}

/*
 * NAME:	lmLogFormat()/jfs_logform()
 *
 * FUNCTION:	format file system log
 *
 * PARAMETERS:
 *	log	- volume log
 *	logAddress - start address of log space in FS block
 *	logSize	- length of log space in FS block;
 *
 * RETURN:	0	- success
 *		-EIO	- i/o error
 *
 * XXX: We're synchronously writing one page at a time.  This needs to
 *	be improved by writing multiple pages at once.
 */
int lmLogFormat(struct jfs_log *log, s64 logAddress, int logSize)
{
	int rc = -EIO;
	struct jfs_sb_info *sbi;
	struct logsuper *logsuper;
	struct logpage *lp;
	int lspn;		/* log sequence page number */
	struct lrd *lrd_ptr;
	int npages = 0;
	struct lbuf *bp;

	jfs_info("lmLogFormat: logAddress:%Ld logSize:%d",
		 (long long)logAddress, logSize);

	sbi = list_entry(log->sb_list.next, struct jfs_sb_info, log_list);

	/* allocate a log buffer */
	bp = lbmAllocate(log, 1);

	npages = logSize >> sbi->l2nbperpage;

	/*
	 *	log space:
	 *
	 * page 0 - reserved;
	 * page 1 - log superblock;
	 * page 2 - log data page: A SYNC log record is written
	 *	    into this page at logform time;
	 * pages 3-N - log data page: set to empty log data pages;
	 */
	/*
	 *	init log superblock: log page 1
	 */
	logsuper = (struct logsuper *) bp->l_ldata;

	logsuper->magic = cpu_to_le32(LOGMAGIC);
	logsuper->version = cpu_to_le32(LOGVERSION);
	logsuper->state = cpu_to_le32(LOGREDONE);
	logsuper->flag = cpu_to_le32(sbi->mntflag);	/* ? */
	logsuper->size = cpu_to_le32(npages);
	logsuper->bsize = cpu_to_le32(sbi->bsize);
	logsuper->l2bsize = cpu_to_le32(sbi->l2bsize);
	logsuper->end = cpu_to_le32(2 * LOGPSIZE + LOGPHDRSIZE + LOGRDSIZE);

	bp->l_flag = lbmWRITE | lbmSYNC | lbmDIRECT;
	bp->l_blkno = logAddress + sbi->nbperpage;
	lbmStartIO(bp);
	if ((rc = lbmIOWait(bp, 0)))
		goto exit;

	/*
	 *	init pages 2 to npages-1 as log data pages:
	 *
	 * log page sequence number (lpsn) initialization:
	 *
	 * pn:   0     1     2     3                 n-1
	 *       +-----+-----+=====+=====+===.....===+=====+
	 * lspn:             N-1   0     1           N-2
	 *                   <--- N page circular file ---->
	 *
	 * the N (= npages-2) data pages of the log is maintained as
	 * a circular file for the log records;
	 * lpsn grows by 1 monotonically as each log page is written
	 * to the circular file of the log;
	 * and setLogpage() will not reset the page number even if
	 * the eor is equal to LOGPHDRSIZE. In order for binary search
	 * still work in find log end process, we have to simulate the
	 * log wrap situation at the log format time.
	 * The 1st log page written will have the highest lpsn. Then
	 * the succeeding log pages will have ascending order of
	 * the lspn starting from 0, ... (N-2)
	 */
	lp = (struct logpage *) bp->l_ldata;
	/*
	 * initialize 1st log page to be written: lpsn = N - 1,
	 * write a SYNCPT log record is written to this page
	 */
	lp->h.page = lp->t.page = cpu_to_le32(npages - 3);
	lp->h.eor = lp->t.eor = cpu_to_le16(LOGPHDRSIZE + LOGRDSIZE);

	lrd_ptr = (struct lrd *) &lp->data;
	lrd_ptr->logtid = 0;
	lrd_ptr->backchain = 0;
	lrd_ptr->type = cpu_to_le16(LOG_SYNCPT);
	lrd_ptr->length = 0;
	lrd_ptr->log.syncpt.sync = 0;

	bp->l_blkno += sbi->nbperpage;
	bp->l_flag = lbmWRITE | lbmSYNC | lbmDIRECT;
	lbmStartIO(bp);
	if ((rc = lbmIOWait(bp, 0)))
		goto exit;

	/*
	 *	initialize succeeding log pages: lpsn = 0, 1, ..., (N-2)
	 */
	for (lspn = 0; lspn < npages - 3; lspn++) {
		lp->h.page = lp->t.page = cpu_to_le32(lspn);
		lp->h.eor = lp->t.eor = cpu_to_le16(LOGPHDRSIZE);

		bp->l_blkno += sbi->nbperpage;
		bp->l_flag = lbmWRITE | lbmSYNC | lbmDIRECT;
		lbmStartIO(bp);
		if ((rc = lbmIOWait(bp, 0)))
			goto exit;
	}

	rc = 0;
exit:
	/*
	 *	finalize log
	 */
	/* release the buffer */
	lbmFree(bp);

	return rc;
}

#ifdef CONFIG_JFS_STATISTICS
int jfs_lmstats_proc_show(struct seq_file *m, void *v)
{
	seq_printf(m,
		       "JFS Logmgr stats\n"
		       "================\n"
		       "commits = %d\n"
		       "writes submitted = %d\n"
		       "writes completed = %d\n"
		       "full pages submitted = %d\n"
		       "partial pages submitted = %d\n",
		       lmStat.commit,
		       lmStat.submitted,
		       lmStat.pagedone,
		       lmStat.full_page,
		       lmStat.partial_page);
	return 0;
}
#endif /* CONFIG_JFS_STATISTICS */
]

gemini-3-flash-preview

							input: 36158
							output: 29
							thoughts: 594
						

**Analysis of `bp->l_ioevent` Usage in `fs/jfs/jfs_logmgr.c`**

Okay, I've gone through the code in `fs/jfs/jfs_logmgr.c` and zeroed in on the usage of `bp->l_ioevent`. It seems straightforward, but let's break it down methodically.

First, I see that `lbmLogInit` initializes the wait queue head associated with `l_ioevent` using `init_waitqueue_head`. No surprises there. That sets the stage for any waiting.

Then, `lbmRead` uses `wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD))`. This is a classic, direct use of `wait_event` where the process will block until the `lbmREAD` flag is no longer set. It's a clear waiting mechanism based on a specific flag.

`lbmIOWait` looks more involved because it uses `LCACHE_SLEEP_COND`, which in turn, I can see calls `__SLEEP_COND`. My initial instinct is to go look at the macro, and then the function definition, but I need to ensure I don't miss the question: "Are there any other places in fs/jfs/jfs_logmgr.c where wait_event is used on bp->l_ioevent?"

So, let's confirm the usage of `wait_event` and `LCACHE_SLEEP_COND`:
*   `lbmRead`: direct use of `wait_event` on `bp->l_ioevent`.

*   `lbmIOWait`: indirectly uses a macro `LCACHE_SLEEP_COND`. This macro uses `__SLEEP_COND`, so I need to go and look at the macro expansion/definition, and its function body for `__SLEEP_COND` to check.

Next step: I should trace how `LCACHE_SLEEP_COND` and `__SLEEP_COND` implement the waiting mechanism because it's crucial to understand if they use `wait_event` directly or employ an equivalent method.

requested entity does not exist

map[IncludeSnippetLines:5 Name:__SLEEP_COND]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 37273
							output: 23
							thoughts: 20
						

Okay, here's my summary, in the first person, as if these are my thoughts, keeping in mind I'm an expert in my field:

**Initial Investigation: Locating the Sleep Condition**

Alright, let's get down to brass tacks. I need to pinpoint where the `__SLEEP_COND` macro is being used. Given the context, my initial instinct is to start within the `fs/jfs/` directory. That's where the JFS file system implementation resides, and if we're dealing with a sleep condition, it's highly probable it's related to file system operations, synchronization, or resource management within that specific file system's code. I'll initiate a search directly within that directory to narrow down the possible locations. Time to get the grep command warmed up and start digging. Let's see what we can find.

map[Dir:fs/jfs/]

map[Files:[acl.c file.c inode.c ioctl.c jfs_acl.h jfs_btree.h jfs_debug.c jfs_debug.h jfs_dinode.h jfs_discard.c jfs_discard.h jfs_dmap.c jfs_dmap.h jfs_dtree.c jfs_dtree.h jfs_extent.c jfs_extent.h jfs_filsys.h jfs_imap.c jfs_imap.h jfs_incore.h jfs_inode.c jfs_inode.h jfs_lock.h jfs_logmgr.c jfs_logmgr.h jfs_metapage.c jfs_metapage.h jfs_mount.c jfs_superblock.h jfs_txnmgr.c jfs_txnmgr.h jfs_types.h jfs_umount.c jfs_unicode.c jfs_unicode.h jfs_xattr.h jfs_xtree.c jfs_xtree.h namei.c resize.c super.c symlink.c xattr.c] Subdirs:<nil>]

gemini-3-flash-preview

							input: 37907
							output: 26
							thoughts: 17
						

Okay, here's my summary, in the first person, as if these are my thoughts, keeping in mind my expertise:

**Diving into the JFS Locking Mechanisms**

Alright, let's get down to brass tacks. I need to understand the locking strategy within the JFS file system, specifically how it handles concurrency. My first port of call will be `fs/jfs/jfs_lock.h`. That header file is practically the blueprint for the concurrency controls. I'm expecting to find the core data structures used for locks – spinlocks, mutexes, reader/writer locks, perhaps even some more specialized constructs given JFS's journaling nature. I'll be looking for how the lock hierarchy is defined, how contention is managed, and how the lock acquisition and release functions are structured. Knowing how those lock operations interoperate with the journaling itself will be key. I anticipate seeing something specific to how JFS serializes disk access, ensuring data integrity within its journaling model, but the details in that header should give me the core picture. Let's see what we've got.

map[File:fs/jfs/jfs_lock.h]

map[Contents:/* SPDX-License-Identifier: GPL-2.0-or-later */
/*
 *   Copyright (C) International Business Machines Corp., 2000-2001
 *   Portions Copyright (C) Christoph Hellwig, 2001-2002
 */
#ifndef _H_JFS_LOCK
#define _H_JFS_LOCK

#include <linux/spinlock.h>
#include <linux/mutex.h>
#include <linux/sched.h>

/*
 *	jfs_lock.h
 */

/*
 * Conditional sleep where condition is protected by spinlock
 *
 * lock_cmd and unlock_cmd take and release the spinlock
 */
#define __SLEEP_COND(wq, cond, lock_cmd, unlock_cmd)	\
do {							\
	DECLARE_WAITQUEUE(__wait, current);		\
							\
	add_wait_queue(&wq, &__wait);			\
	for (;;) {					\
		set_current_state(TASK_UNINTERRUPTIBLE);\
		if (cond)				\
			break;				\
		unlock_cmd;				\
		io_schedule();				\
		lock_cmd;				\
	}						\
	__set_current_state(TASK_RUNNING);			\
	remove_wait_queue(&wq, &__wait);		\
} while (0)

#endif				/* _H_JFS_LOCK */
]

gemini-3-flash-preview

							input: 38532
							output: 30
							thoughts: 190
						

Okay, let me think this through.

**Analyzing wait_event Usage in the JFS Logging Manager**

Alright, so the core thing to remember is that `__SLEEP_COND` *doesn't* leverage `wait_event`. It's a custom-built wait mechanism using `add_wait_queue`, `set_current_state`, `io_schedule`, and that sort of thing. This is important context, because it sets the stage for where `wait_event` *is* used.

Now, I need to pinpoint the direct occurrences of `wait_event` specifically on `bp->l_ioevent` within `fs/jfs/jfs_logmgr.c`. The initial scan indicates its usage is limited to `lbmRead`. But I'm going to do a quick double-check of that file to be absolutely certain. Memory can be tricky.

Let me just quickly search the file again, confirming my initial assessment. Aha! I can see it on line 1987: `wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));`. That confirms the usage in `lbmRead`. I'll also do a thorough search to ensure there are no other instances of `wait_event` anywhere else in the file, just to be sure. It's always good practice to eliminate any possible confusion or unexpected behavior.

requested entity does not exist

map[IncludeSnippetLines:1 Name:wait_event_interruptible]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 39072
							output: 46
							thoughts: 562
						

**Analyzing Wait Events in jfs_logmgr.c**

Okay, so the task is to understand the usage of `wait_event` and related functions within `fs/jfs/jfs_logmgr.c`. My initial thought was to simply scan the file for `wait_event`. I did a quick read-through. Now I'll do a more targeted search. I'll start by rescanning the file, line by line, looking for instances of `wait_event`. I'll also mentally expand that search to include `wait_event_timeout`, `wait_event_interruptible`, and so on, to make sure I don't miss anything.

Since I already examined the file, a more efficient way would be using a tool. I could use something like `grep`, but since the scope is limited to this particular file, a direct scan makes sense.

I'll shift gears. I'll use the "codesearch-find-references" tool, since that can give me an overview. The primary question focuses on `bp->l_ioevent`, which is a member within `struct lbuf *`. I'll focus on references to that member specifically. Running that search, it shows the following: `LCACHE_WAKEUP(&bp->l_ioevent)` (three times), `LCACHE_SLEEP_COND(bp->l_ioevent, ...)` (once), `init_waitqueue_head(&lbuf->l_ioevent)` (once), and, importantly, `wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD))` (once).

The output from `codesearch-find-references` confirms that there is only one instance of `wait_event` directly using `bp->l_ioevent`, specifically on line 1987. That matches what I thought. It is good to know there is only one use.

To be absolutely thorough, I'm now thinking I should also verify that no *other* `lbuf` variables (or other variables accessible through similar structures) are used with `wait_event` within this file. The question is explicitly asking about `bp->l_ioevent`, but it's always a good practice to double-check the context. Thus, I'll go back to searching the whole file for instances of `wait_event` and `lbuf` to verify I haven't missed a similar use with a different name.

requested entity does not exist

map[IncludeSnippetLines:1 Name:wait_event SourceTreePrefix:fs/jfs/jfs_logmgr.c]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 40227
							output: 27
							thoughts: 1281
						

**Analyzing wait_event Usage in jfs_logmgr.c**

Alright, let's break this down. My initial attempt with `codesearch-find-references` for `wait_event` failed, likely because it's a macro. So, I need to analyze the file content of `jfs_logmgr.c` directly. First, I searched for the string "wait_event" within the file. I found a usage in `lbmRead`: `wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));`

That's one instance.  Now, I need to make absolutely sure there aren't others. I've already confirmed there isn't another direct usage of `wait_event` by searching in the file.

However, I need to consider indirect calls or other related wait mechanisms associated with  `bp->l_ioevent` or other wait queues/heads within the file. I did some searching, and I've found that `LCACHE_SLEEP_COND` is used. Specifically, it's used with `bp->l_ioevent` in `lbmIOWait`.

Crucially, I need to confirm if `LCACHE_SLEEP_COND` itself is a wrapper for `wait_event`. It's not. Further inspection showed that `LCACHE_SLEEP_COND` expands to `__SLEEP_COND`, which isn't `wait_event`.

I am trying to confirm that this is the *only* use of `wait_event` in association with `bp->l_ioevent`.

To be absolutely sure, I've re-examined the file for *any* other calls to `wait_event`. I will look again using a thorough search, using a tool if needed to confirm. I can't use `grep`, but my `codesearch-find-references` isn't picking it up, so I will search the raw file content again.

Therefore, the conclusion is that the initial search for `wait_event` shows only a single usage of the macro in relation to `bp->l_ioevent`.

requested entity does not exist

map[IncludeSnippetLines:1 Name:wait_event]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 42016
							output: 28
							thoughts: 105
						

**Analyzing the Unindexed `wait_event`**

Alright, so it's clear `wait_event` isn't indexed in the current setup. That's a key piece of information. My next step is to dive back into `fs/jfs/jfs_logmgr.c`. I'll use the `read-file` command, but this time with a much more deliberate approach. I need to comb through that file meticulously, specifically searching for every instance of "wait_event". I'll be looking for context, any clues about its usage and potential bottlenecks.

Beyond that, I'm going to leverage `codesearch-find-references` for `l_ioevent`. However, this time, I won't include the `lbuf::` prefix in the search, in order to get a much broader picture of its uses. This should help me uncover where `l_ioevent` is being used and how it interacts with the broader system, which may illuminate something useful about the role of `wait_event`.

requested entity does not exist

map[IncludeSnippetLines:1 Name:l_ioevent]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 42390
							output: 39
							thoughts: 2120
						

**My Investigation into `wait_event` and `l_ioevent` Usage**

Okay, so I'm trying to figure out if there are *other* uses of `wait_event` with `bp->l_ioevent` beyond the one I already found. I've already confirmed that `lbmRead` uses it, as shown here:

```c
static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp)
{
    ...
	wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));

	return 0;
}
```

My initial thought was to simply check the references to `l_ioevent`. I already did that and found the `wait_event` call within `lbmRead`. Now I want to be *absolutely* sure that's the only place in `jfs_logmgr.c` where `wait_event` is directly used with `bp->l_ioevent`.

I started by looking at other functions in the logging buffer manager (`lbm...`). I looked at `lbmIOWait`, `lbmWrite`, `lbmDirectWrite`, `lbmStartIO`, `lbmIODone`, `lbmAllocate`, `lbmFree`, `lbmLogInit`, and `lbmLogShutdown`. I've confirmed that `lbmLogInit` initializes the wait queue head with `init_waitqueue_head(&lbuf->l_ioevent);`, and `lbmIODone` wakes the queue with `LCACHE_WAKEUP(&bp->l_ioevent);`, but neither *directly* uses `wait_event`.

I then went back and tried a more exhaustive search of the `jfs_logmgr.c` file itself. I first used `read-file` and looked for `wait_event`. The initial search failed. To be sure I didn't miss it, I searched for anything that started with `wait_`. I got a handful of results. They weren't what I wanted. I went back and was looking at the original `codesearch-find-references` output for `lbuf::l_ioevent` again to make absolutely sure there wasn't a hidden reference.

The key is that I had to remember that `wait_event` is a macro, not a function, so my search strategies had to account for that.

I used `codesearch-find-references` for `l_ioevent` again and went over *all* the results, which were:
1. `lbmIODone` (line 2196): `LCACHE_WAKEUP(&bp->l_ioevent);`
2. `lbmIODone` (line 2221): `LCACHE_WAKEUP(&bp->l_ioevent);`
3. `lbmIODone` (line 2275): `LCACHE_WAKEUP(&bp->l_ioevent);`
4. `lbmIOWait` (line 2149): `LCACHE_SLEEP_COND(bp->l_ioevent, (bp->l_flag & lbmDONE), flags);`
5. `lbmLogInit` (line 1831): `init_waitqueue_head(&lbuf->l_ioevent);`
6. `lbmRead` (line 1987): `wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));`

I've reviewed the `lbmIOWait` function and verified that it uses `LCACHE_SLEEP_COND`, which expands to use the sleep macro. It doesn't appear to call `wait_event` directly. I also verified that all other functions I checked do not use `wait_event`.

Since I can't directly use `grep`, I've manually reviewed the `read-file` output and carefully reviewed the `codesearch-find-references` output.

Therefore, *after this exhaustive review*, I can confidently conclude that, based on my access to the indexed code, the only place where `wait_event` is called with `bp->l_ioevent` is within the `lbmRead` function.

requested entity does not exist

map[ContextFile:include/linux/wait.h IncludeLines:true Name:wait_event]

map[SourceCode: SourceFile:]

gemini-3-flash-preview

							input: 45505
							output: 39
							thoughts: 4825
						

**Analysis of `fs/jfs/jfs_logmgr.c` for `wait_event` Usage**

Okay, so I'm looking at this JFS log manager code and specifically the use of `wait_event` and `bp->l_ioevent`. The initial question is whether there are *any* other instances beyond the one I already know about in `lbmRead`. I quickly scan the code from a `read-file` output, since I can't use `grep`, and the goal is to be *certain*.

First, I locate `lbmRead`, and confirm that line 1987 contains the `wait_event` call on `bp->l_ioevent`.

Then I meticulously search the entire `fs/jfs/jfs_logmgr.c` file for any other instances of `wait_event`.  I also check for variants like `wait_event_interruptible`, but find nothing. I'm focusing on that `bp->l_ioevent` specifically, as that is the crux of the question.

I then check `lbmIOWait`, as it seems a likely place, but it uses `LCACHE_SLEEP_COND` which seems to be a custom wait primitive. I check for it, and then check `LCACHE_SLEEP_COND` to check what it does. It's a manual wait loop. I then check where `LCACHE_SLEEP_COND` is used and confirms its usage in `lbmAllocate` and `lbmIOWait`.  Crucially, `lbmAllocate` uses `log->free_wait` which is a different wait queue than `bp->l_ioevent`.

I make sure that I don't miss any `struct lbuf` variables, like `lbuf`, `bpsuper`, and `bp`, which have `l_ioevent`, in other functions.

I look at other functions in the file that use `lbmIOWait`, like `lmLogInit`, `lmLogShutdown`, `lmLogFileSystem`, and `lmLogFormat`, but they don't directly call `wait_event`.  They *do* call `lbmIOWait`, and `lbmIOWait` calls `LCACHE_SLEEP_COND`, but that's a different primitive.

I re-examine `lbmRead` again, just to be sure, and I check my search for `wait_event`, and make sure that it's the only one.

After multiple checks and confirmations, I am confident. `lbmRead` is the *only* place where `wait_event` is directly used on `bp->l_ioevent`. I also check for any other uses of `wait_event` in the file.

I considered the possibility of historical versions, but without the ability to easily access the git history, I have to rely on the current codebase.

Therefore, the answer is no, there are no *other* uses of `wait_event` on `bp->l_ioevent` in `fs/jfs/jfs_logmgr.c`.

requested entity does not exist

map[IncludeSnippetLines:1 Name:wait_event SourceTreePrefix:fs/jfs/]

map[References:<nil> TruncatedOutput:false]

gemini-3-flash-preview

							input: 51058
							output: 464
							thoughts: 62913
						

gemini-3.1-pro-preview

							input: 69976
							output: 577
							thoughts: 29
						

Okay, here's my summarized thought process, presented as if I were considering this myself:

**Finalizing the Response**

Alright, so the code expert has confirmed what I suspected: `wait_event` is solely used within the `lbmRead` function. That's good; it corroborates my understanding of the codebase. Considering this confirmation, I'm now fully confident in my position. With this information in hand, I'm ready to craft and deliver the final, definitive response. I've considered all relevant points, integrated the expert's input, and am prepared to move forward with the delivery of the information.

map[PatchDiff:diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
index 306165e61..cf62a8564 100644
--- a/fs/jfs/jfs_logmgr.c
+++ b/fs/jfs/jfs_logmgr.c
@@ -1984,9 +1984,7 @@ static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp)
 		submit_bio(bio);
 	}
 
-	wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));
-
-	return 0;
+	return lbmIOWait(bp, 0);
 }
 
 
 TestError:]

gemini-3.1-pro-preview

map[FixesHash:1da177e4c3f41524e886b7f1b8a0c1fc7321cac2]

You are an experienced Linux kernel developer tasked with identifying the commit
that introduced the bug being fixed. Identifying the correct buggy commit is crucial
for proper kernel maintenance (backporting to stable trees, etc.).

Your investigation strategy:
1. Examine the patch that fixes the bug. Use git tools (like git-log or git-blame)
   to trace the history of the lines or functions modified by the patch.
2. Analyze the stack trace in the crash report. Identify the key files and functions
   involved in the crash and investigate their history to see when the problematic
   logic was introduced.
3. Compare the bug explanation with the commit history to find the point where
   the described logic error first appeared.

A bug is typically introduced when a piece of code is first written, or when
a refactoring changed its logic in a way that introduced the bug.
Trace the history of relevant symbols or find when specific code patterns were introduced/removed.

You must provide exactly one bug-introducing commit hash.
If you are unable to confidently determine the bug-introducing commit after investigation,
return an empty string rather than guessing.

Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

The crash is:

==================================================================
BUG: KASAN: slab-use-after-free in lbmIODone+0x1312/0x16c0 fs/jfs/jfs_logmgr.c:2192
Read of size 4 at addr ffff888049ebf608 by task ktimers/0/16

CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #1 PREEMPT_{RT,(full)} 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 lbmIODone+0x1312/0x16c0 fs/jfs/jfs_logmgr.c:2192
 blk_update_request+0x57e/0xe60 block/blk-mq.c:1016
 blk_mq_end_request+0x3e/0x70 block/blk-mq.c:1178
 blk_complete_reqs block/blk-mq.c:1253 [inline]
 blk_done_softirq+0x10a/0x160 block/blk-mq.c:1258
 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 run_ktimerd+0x69/0x100 kernel/softirq.c:1151
 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 6219:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x3a6/0x690 mm/slub.c:5419
 kmalloc_noprof include/linux/slab.h:950 [inline]
 lbmLogInit fs/jfs/jfs_logmgr.c:1819 [inline]
 lmLogInit+0x3e5/0x1a00 fs/jfs/jfs_logmgr.c:1267
 open_inline_log fs/jfs/jfs_logmgr.c:1173 [inline]
 lmLogOpen+0x4e1/0xfa0 fs/jfs/jfs_logmgr.c:1067
 jfs_mount_rw+0xee/0x670 fs/jfs/jfs_mount.c:257
 jfs_fill_super+0x754/0xd80 fs/jfs/super.c:532
 get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1694
 vfs_get_tree+0x92/0x2a0 fs/super.c:1754
 fc_mount fs/namespace.c:1193 [inline]
 do_new_mount_fc fs/namespace.c:3758 [inline]
 do_new_mount+0x341/0xd30 fs/namespace.c:3834
 do_mount fs/namespace.c:4167 [inline]
 __do_sys_mount fs/namespace.c:4383 [inline]
 __se_sys_mount+0x31d/0x420 fs/namespace.c:4360
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 6106:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2689 [inline]
 slab_free mm/slub.c:6250 [inline]
 kfree+0x1c5/0x6c0 mm/slub.c:6565
 lbmLogShutdown fs/jfs/jfs_logmgr.c:1862 [inline]
 lmLogShutdown+0x456/0x850 fs/jfs/jfs_logmgr.c:1681
 lmLogClose+0x28a/0x520 fs/jfs/jfs_logmgr.c:1457
 jfs_umount+0x2fb/0x3d0 fs/jfs/jfs_umount.c:124
 jfs_put_super+0x8c/0x190 fs/jfs/super.c:194
 generic_shutdown_super+0x13d/0x2d0 fs/super.c:646
 kill_block_super+0x44/0x90 fs/super.c:1725
 deactivate_locked_super+0xbc/0x130 fs/super.c:476
 cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
 task_work_run+0x1d9/0x270 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
 exit_to_user_mode_loop+0xf3/0x4d0 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888049ebf600
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 8 bytes inside of
 freed 256-byte region [ffff888049ebf600, ffff888049ebf700)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x49ebe
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x480000000000040(head|node=1|zone=1)
page_type: f5(slab)
raw: 0480000000000040 ffff888019c41b40 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 0480000000000040 ffff888019c41b40 dead000000000100 dead000000000122
head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 0480000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5588, tgid 5588 (udevd), ts 65263897590, free_ts 59786995144
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x231/0x280 mm/page_alloc.c:1858
 prep_new_page mm/page_alloc.c:1866 [inline]
 get_page_from_freelist+0x27c8/0x2840 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5226
 alloc_slab_page mm/slub.c:3278 [inline]
 allocate_slab+0x77/0x660 mm/slub.c:3467
 new_slab mm/slub.c:3525 [inline]
 refill_objects+0x33c/0x3d0 mm/slub.c:7255
 refill_sheaf mm/slub.c:2816 [inline]
 __pcs_replace_empty_main+0x373/0x720 mm/slub.c:4651
 alloc_from_pcs mm/slub.c:4749 [inline]
 slab_alloc_node mm/slub.c:4883 [inline]
 __kmalloc_cache_noprof+0x44e/0x690 mm/slub.c:5414
 kmalloc_noprof include/linux/slab.h:950 [inline]
 kzalloc_noprof include/linux/slab.h:1188 [inline]
 smk_fetch+0x95/0x140 security/smack/smack_lsm.c:285
 smack_d_instantiate+0x757/0x990 security/smack/smack_lsm.c:3653
 security_d_instantiate+0x106/0x1d0 security/security.c:3704
 d_splice_alias_ops+0x71/0x370 fs/dcache.c:3141
 __lookup_slow+0x2d2/0x440 fs/namei.c:1915
 lookup_slow+0x53/0x70 fs/namei.c:1932
 walk_component fs/namei.c:2278 [inline]
 lookup_last fs/namei.c:2785 [inline]
 path_lookupat+0x3f5/0x8c0 fs/namei.c:2809
 filename_lookup+0x256/0x5d0 fs/namei.c:2838
 vfs_statx+0x115/0x570 fs/stat.c:353
page last free pid 5606 tgid 5606 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1402 [inline]
 __free_frozen_pages+0xf48/0x1080 mm/page_alloc.c:2943
 __slab_free+0x252/0x2a0 mm/slub.c:5612
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4569 [inline]
 slab_alloc_node mm/slub.c:4898 [inline]
 __do_kmalloc_node mm/slub.c:5294 [inline]
 __kmalloc_noprof+0x399/0x7b0 mm/slub.c:5307
 kmalloc_noprof include/linux/slab.h:954 [inline]
 kzalloc_noprof include/linux/slab.h:1188 [inline]
 tomoyo_encode2 security/tomoyo/realpath.c:45 [inline]
 tomoyo_encode+0x28b/0x550 security/tomoyo/realpath.c:80
 tomoyo_mount_acl security/tomoyo/mount.c:152 [inline]
 tomoyo_mount_permission+0x4c1/0x9d0 security/tomoyo/mount.c:239
 security_sb_mount+0xe4/0x320 security/security.c:1088
 path_mount+0xbc/0x1000 fs/namespace.c:4096
 do_mount fs/namespace.c:4167 [inline]
 __do_sys_mount fs/namespace.c:4383 [inline]
 __se_sys_mount+0x31d/0x420 fs/namespace.c:4360
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888049ebf500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888049ebf580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888049ebf600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                      ^
 ffff888049ebf680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888049ebf700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================



The explanation of the root cause is:

The root cause of this KASAN slab-use-after-free is a concurrency bug (race condition) between `lbmRead()` and the bio completion handler `lbmIODone()`. 

### Detailed Explanation

1. **The Lockless Wait:**
   In `fs/jfs/jfs_logmgr.c`, `lbmRead()` submits a READ bio and waits for its completion using `wait_event()`:
   ```c
   wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));
   return 0;
   ```
   The `wait_event()` macro evaluates its condition `(bp->l_flag != lbmREAD)` locklessly.

2. **The Premature Wakeup:**
   When the READ bio completes, the block layer calls `lbmIODone()`. This function acquires the `LCACHE_LOCK` spinlock, clears the `lbmREAD` flag, and wakes up the waiter:
   ```c
   	if (bp->l_flag & lbmREAD) {
   		bp->l_flag &= ~lbmREAD;

   		/* wakeup I/O initiator */
   		LCACHE_WAKEUP(&bp->l_ioevent);

   		goto out;
   	}
   ```
   Crucially, it does this **before** it sets the `lbmDONE` flag and releases the lock at the `out:` label:
   ```c
   out:
   	bp->l_flag |= lbmDONE;
   	LCACHE_UNLOCK(flags);
   ```

3. **The Race and Reuse:**
   Because `wait_event()` is lockless, the thread executing `lbmRead()` wakes up immediately after `LCACHE_WAKEUP` is called, sees that `lbmREAD` is cleared, and returns. 
   
   The caller of `lbmRead()` (in this crash, `lmLogShutdown()`) then proceeds to reuse the exact same `bp` for a WRITE bio by calling `lbmDirectWrite()`. `lbmDirectWrite()` overwrites `bp->l_flag` with new flags (e.g., `lbmWRITE | lbmRELEASE | lbmSYNC | lbmDIRECT`), which clears any previous state.

4. **The State Corruption:**
   `lmLogShutdown()` then calls `lbmIOWait(bp, lbmFREE)` to wait for the new WRITE bio to complete. `lbmIOWait()` waits for the `lbmDONE` flag to be set.
   
   Meanwhile, the original READ bio's `lbmIODone()` resumes execution, reaches the `out:` label, executes `bp->l_flag |= lbmDONE;`, and unlocks `LCACHE_LOCK`. **This erroneously sets the `lbmDONE` flag on the reused `bp`!**

5. **The Use-After-Free:**
   `lbmIOWait()` sees the `lbmDONE` flag, incorrectly assumes the WRITE bio has completed, and returns early. It then calls `lbmfree(bp)` to put it on the freelist. `lmLogShutdown()` subsequently calls `lbmLogShutdown()`, which frees the `bp` via `kfree()`.
   
   Later, the WRITE bio actually completes, and `lbmIODone()` is called on the freed `bp`. It attempts to read `bp->l_flag` (which is at offset 8 in `struct lbuf`), triggering the KASAN slab-use-after-free report.

### How to Fix

The fix is to replace the lockless `wait_event()` in `lbmRead()` with `lbmIOWait(bp, 0)`. 

`lbmIOWait()` uses `LCACHE_SLEEP_COND()`, which properly synchronizes with `lbmIODone()` by acquiring `LCACHE_LOCK` before checking the condition. This ensures `lbmRead()` will block on the spinlock and not return until `lbmIODone()` has completely finished and unlocked `LCACHE_LOCK`. 

As an added benefit, `lbmIOWait()` correctly returns `-EIO` if the bio completes with an error, whereas the current `lbmRead()` unconditionally returns `0`, ignoring I/O errors.

```c
--- a/fs/jfs/jfs_logmgr.c
+++ b/fs/jfs/jfs_logmgr.c
@@ -1984,9 +1984,7 @@ static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp)
 		submit_bio(bio);
 	}
 
-	wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));
-
-	return 0;
+	return lbmIOWait(bp, 0);
 }
```


The patch that fixes the bug is:

diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
index 306165e61..cf62a8564 100644
--- a/fs/jfs/jfs_logmgr.c
+++ b/fs/jfs/jfs_logmgr.c
@@ -1984,9 +1984,7 @@ static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp)
 		submit_bio(bio);
 	}
 
-	wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));
-
-	return 0;
+	return lbmIOWait(bp, 0);
 }
 
 


Search for the commit(s) that introduced this bug.

gemini-3.1-pro-preview

							input: 9360
							output: 68
							thoughts: 110
						

**Pinpointing the Bug in `fs/jfs/jfs_logmgr.c`**

Okay, so we've got a bug in `fs/jfs/jfs_logmgr.c`, and it looks like the issue is with `lbmRead()` and its use of `wait_event`. Specifically, it's using `wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));` when it should be using `lbmIOWait(bp, 0);`. That's a pretty clear indicator of a concurrency or synchronization issue, so tracking down the commit that introduced this change is going to be key.

My plan? Leverage `git-log` or `git-blame` on that particular file. I'll focus on the area around the `lbmRead()` function. That should give us a good timeline of changes and hopefully pinpoint the culprit. Let's get to it.

map[CodeRegexp:wait_event\(bp->l_ioevent, \(bp->l_flag != lbmREAD\)\); SourcePath:fs/jfs/jfs_logmgr.c SymbolName:lbmRead]

map[Output:1da177e4c3f4 Linux-2.6.12-rc2
]

gemini-3.1-pro-preview

							input: 9780
							output: 42
							thoughts: 44
						

Okay, here's my interpretation of those thoughts, presented as a first-person summary, keeping in mind my expertise:

**Initial Git History Check**

Right, this looks like we're diving into the absolute genesis of this project. That commit hash, `1da177e4c3f4`, rings a bell – it's practically archaeology at this point! I'm pretty sure that's the very first commit, the point zero, but in this field, one should never assume. Always verify. Even with my experience, relying solely on memory can be a dangerous game. Best to grab the `git-blame` tool and make absolutely certain. We can't afford any missteps when analyzing such a foundational part of the codebase. It's too easy for things to be taken for granted. So let's confirm, just to be sure.

map[End:1990 File:fs/jfs/jfs_logmgr.c Start:1980]

map[Output:95bbb82f60c80 1980) 	if (log->no_integrity) {
4f024f3797c43 1981) 		bio->bi_iter.bi_size = 0;
4246a0b63bd8f 1982) 		lbmIODone(bio);
95bbb82f60c80 1983) 	} else {
4e49ea4a3d276 1984) 		submit_bio(bio);
95bbb82f60c80 1985) 	}
^1da177e4c3f4 1986) 
^1da177e4c3f4 1987) 	wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));
^1da177e4c3f4 1988) 
^1da177e4c3f4 1989) 	return 0;
^1da177e4c3f4 1990) }
]

gemini-3.1-pro-preview

							input: 10355
							output: 55
							thoughts: 67
						

**Bug Identification and Reporting**

Okay, so I've pinned down the source of the issue. After some digging, it's clear the bug made its grand entrance in commit `1da177e4c3f41524e38d5ce812c1662d28210e5f`. That particular hash corresponds to Linux-2.6.12-rc2, and that's the smoking gun. With the commit identified, I'll go ahead and return that hash – `1da177e4c3f41524e38d5ce812c1662d28210e5f` – so we can move forward with debugging and, ideally, a fix. This is critical for getting the fix deployed with minimal fuss.

commit hash "1da177e4c3f41524e38d5ce812c1662d28210e5f" not found in the repository

map[FixesHash:1da177e4c3f41524e38d5ce812c1662d28210e5f]

map[FixesHash:1da177e4c3f41524e38d5ce812c1662d28210e5f]

gemini-3.1-pro-preview

							input: 10722
							output: 32
							thoughts: 75
						

Here's my attempt at summarizing the thought process, as if I were experiencing it:

**Hash Discrepancy – A Quick Check**

Okay, hold on a second. I'm looking at this hash, `1da177e4c3f41524e38d5ce812c1662d28210e5f`, and the system is telling me it's "not found in the repository." That's not right. This hash *should* correspond to something, or at least be recognized as invalid input. My initial thought is it is not a valid git hash.

Alright, let me immediately cross-reference this. I need to make *absolutely* sure that this hash doesn't just happen to be an early, un-tagged version or perhaps a local build with a slightly different commit message. The best way to do that is to check the hash for the Linux-2.6.12-rc2 tag, just to be sure. I'll verify the hash for that tag, as it should be a known point in the project's history.

map[Count:1 PathPrefix:fs/jfs/jfs_logmgr.c]

map[Output:ca5848ae87d2 jfs: hold LOG_LOCK on umount to avoid null-ptr-deref
]

gemini-3.1-pro-preview

							input: 11113
							output: 26
							thoughts: 21
						

Here's my thought process, as if I were the one thinking it:

**Digging into the Codebase**

Okay, I need to investigate this specific commit hash: `1da177e4c3f4`. My immediate instinct is to start by searching the entire repository for that value. This is a common approach; I'll use grep, ripgrep, or whatever search tool is most efficient for this project's code structure and size. I'm expecting this to either quickly pinpoint the exact commit or at least lead me to relevant files or directories containing that identifier. Based on the format, it looks like a git commit, so I'm expecting this to either show up in a commit message, a tag, a branch name, or perhaps referenced in some build or configuration file. Knowing my repo structure is key here. I'm hoping I can correlate it with an issue or change log and quickly see what was done, and more importantly *why* and *how* it was done.

map[Commit:1da177e4c3f4]

map[Output:
Full output is too long, showing 1000 out of 6822520 lines.

[commit 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
 Author: Linus Torvalds <torvalds@ppc970.osdl.org>
 Date:   Sat Apr 16 15:20:36 2005 -0700
 
     Linux-2.6.12-rc2
     
     Initial git repository build. I'm not bothering with the full history,
     even though we have it. We can create a separate "historical" git
     archive of that later if we want to, and in the meantime it's about
     3.2GB when imported into git - space that would just make the early
     git days unnecessarily complicated, when we don't have a lot of good
     infrastructure for it.
     
     Let it rip!
 
 diff --git a/COPYING b/COPYING
 new file mode 100644
 index 000000000000..2a7e338ec2fc
 --- /dev/null
 +++ b/COPYING
 @@ -0,0 +1,356 @@
 +
 +   NOTE! This copyright does *not* cover user programs that use kernel
 + services by normal system calls - this is merely considered normal use
 + of the kernel, and does *not* fall under the heading of "derived work".
 + Also note that the GPL below is copyrighted by the Free Software
 + Foundation, but the instance of code that it refers to (the Linux
 + kernel) is copyrighted by me and others who actually wrote it.
 +
 + Also note that the only valid version of the GPL as far as the kernel
 + is concerned is _this_ particular version of the license (ie v2, not
 + v2.2 or v3.x or whatever), unless explicitly otherwise stated.
 +
 +			Linus Torvalds
 +
 +----------------------------------------
 +
 +		    GNU GENERAL PUBLIC LICENSE
 +		       Version 2, June 1991
 +
 + Copyright (C) 1989, 1991 Free Software Foundation, Inc.
 +                       59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 + Everyone is permitted to copy and distribute verbatim copies
 + of this license document, but changing it is not allowed.
 +
 +			    Preamble
 +
 +  The licenses for most software are designed to take away your
 +freedom to share and change it.  By contrast, the GNU General Public
 +License is intended to guarantee your freedom to share and change free
 +software--to make sure the software is free for all its users.  This
 +General Public License applies to most of the Free Software
 +Foundation's software and to any other program whose authors commit to
 +using it.  (Some other Free Software Foundation software is covered by
 +the GNU Library General Public License instead.)  You can apply it to
 +your programs, too.
 +
 +  When we speak of free software, we are referring to freedom, not
 +price.  Our General Public Licenses are designed to make sure that you
 +have the freedom to distribute copies of free software (and charge for
 +this service if you wish), that you receive source code or can get it
 +if you want it, that you can change the software or use pieces of it
 +in new free programs; and that you know you can do these things.
 +
 +  To protect your rights, we need to make restrictions that forbid
 +anyone to deny you these rights or to ask you to surrender the rights.
 +These restrictions translate to certain responsibilities for you if you
 +distribute copies of the software, or if you modify it.
 +
 +  For example, if you distribute copies of such a program, whether
 +gratis or for a fee, you must give the recipients all the rights that
 +you have.  You must make sure that they, too, receive or can get the
 +source code.  And you must show them these terms so they know their
 +rights.
 +
 +  We protect your rights with two steps: (1) copyright the software, and
 +(2) offer you this license which gives you legal permission to copy,
 +distribute and/or modify the software.
 +
 +  Also, for each author's protection and ours, we want to make certain
 +that everyone understands that there is no warranty for this free
 +software.  If the software is modified by someone else and passed on, we
 +want its recipients to know that what they have is not the original, so
 +that any problems introduced by others will not reflect on the original
 +authors' reputations.
 +
 +  Finally, any free program is threatened constantly by software
 +patents.  We wish to avoid the danger that redistributors of a free
 +program will individually obtain patent licenses, in effect making the
 +program proprietary.  To prevent this, we have made it clear that any
 +patent must be licensed for everyone's free use or not licensed at all.
 +
 +  The precise terms and conditions for copying, distribution and
 +modification follow.
 +
 +		    GNU GENERAL PUBLIC LICENSE
 +   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
 +
 +  0. This License applies to any program or other work which contains
 +a notice placed by the copyright holder saying it may be distributed
 +under the terms of this General Public License.  The "Program", below,
 +refers to any such program or work, and a "work based on the Program"
 +means either the Program or any derivative work under copyright law:
 +that is to say, a work containing the Program or a portion of it,
 +either verbatim or with modifications and/or translated into another
 +language.  (Hereinafter, translation is included without limitation in
 +the term "modification".)  Each licensee is addressed as "you".
 +
 +Activities other than copying, distribution and modification are not
 +covered by this License; they are outside its scope.  The act of
 +running the Program is not restricted, and the output from the Program
 +is covered only if its contents constitute a work based on the
 +Program (independent of having been made by running the Program).
 +Whether that is true depends on what the Program does.
 +
 +  1. You may copy and distribute verbatim copies of the Program's
 +source code as you receive it, in any medium, provided that you
 +conspicuously and appropriately publish on each copy an appropriate
 +copyright notice and disclaimer of warranty; keep intact all the
 +notices that refer to this License and to the absence of any warranty;
 +and give any other recipients of the Program a copy of this License
 +along with the Program.
 +
 +You may charge a fee for the physical act of transferring a copy, and
 +you may at your option offer warranty protection in exchange for a fee.
 +
 +  2. You may modify your copy or copies of the Program or any portion
 +of it, thus forming a work based on the Program, and copy and
 +distribute such modifications or work under the terms of Section 1
 +above, provided that you also meet all of these conditions:
 +
 +    a) You must cause the modified files to carry prominent notices
 +    stating that you changed the files and the date of any change.
 +
 +    b) You must cause any work that you distribute or publish, that in
 +    whole or in part contains or is derived from the Program or any
 +    part thereof, to be licensed as a whole at no charge to all third
 +    parties under the terms of this License.
 +
 +    c) If the modified program normally reads commands interactively
 +    when run, you must cause it, when started running for such
 +    interactive use in the most ordinary way, to print or display an
 +    announcement including an appropriate copyright notice and a
 +    notice that there is no warranty (or else, saying that you provide
 +    a warranty) and that users may redistribute the program under
 +    these conditions, and telling the user how to view a copy of this
 +    License.  (Exception: if the Program itself is interactive but
 +    does not normally print such an announcement, your work based on
 +    the Program is not required to print an announcement.)
 +
 +These requirements apply to the modified work as a whole.  If
 +identifiable sections of that work are not derived from the Program,
 +and can be reasonably considered independent and separate works in
 +themselves, then this License, and its terms, do not apply to those
 +sections when you distribute them as separate works.  But when you
 +distribute the same sections as part of a whole which is a work based
 +on the Program, the distribution of the whole must be on the terms of
 +this License, whose permissions for other licensees extend to the
 +entire whole, and thus to each and every part regardless of who wrote it.
 +
 +Thus, it is not the intent of this section to claim rights or contest
 +your rights to work written entirely by you; rather, the intent is to
 +exercise the right to control the distribution of derivative or
 +collective works based on the Program.
 +
 +In addition, mere aggregation of another work not based on the Program
 +with the Program (or with a work based on the Program) on a volume of
 +a storage or distribution medium does not bring the other work under
 +the scope of this License.
 +
 +  3. You may copy and distribute the Program (or a work based on it,
 +under Section 2) in object code or executable form under the terms of
 +Sections 1 and 2 above provided that you also do one of the following:
 +
 +    a) Accompany it with the complete corresponding machine-readable
 +    source code, which must be distributed under the terms of Sections
 +    1 and 2 above on a medium customarily used for software interchange; or,
 +
 +    b) Accompany it with a written offer, valid for at least three
 +    years, to give any third party, for a charge no more than your
 +    cost of physically performing source distribution, a complete
 +    machine-readable copy of the corresponding source code, to be
 +    distributed under the terms of Sections 1 and 2 above on a medium
 +    customarily used for software interchange; or,
 +
 +    c) Accompany it with the information you received as to the offer
 +    to distribute corresponding source code.  (This alternative is
 +    allowed only for noncommercial distribution and only if you
 +    received the program in object code or executable form with such
 +    an offer, in accord with Subsection b above.)
 +
 +The source code for a work means the preferred form of the work for
 +making modifications to it.  For an executable work, complete source
 +code means all the source code for all modules it contains, plus any
 +associated interface definition files, plus the scripts used to
 +control compilation and installation of the executable.  However, as a
 +special exception, the source code distributed need not include
 +anything that is normally distributed (in either source or binary
 +form) with the major components (compiler, kernel, and so on) of the
 +operating system on which the executable runs, unless that component
 +itself accompanies the executable.
 +
 +If distribution of executable or object code is made by offering
 +access to copy from a designated place, then offering equivalent
 +access to copy the source code from the same place counts as
 +distribution of the source code, even though third parties are not
 +compelled to copy the source along with the object code.
 +
 +  4. You may not copy, modify, sublicense, or distribute the Program
 +except as expressly provided under this License.  Any attempt
 +otherwise to copy, modify, sublicense or distribute the Program is
 +void, and will automatically terminate your rights under this License.
 +However, parties who have received copies, or rights, from you under
 +this License will not have their licenses terminated so long as such
 +parties remain in full compliance.
 +
 +  5. You are not required to accept this License, since you have not
 +signed it.  However, nothing else grants you permission to modify or
 +distribute the Program or its derivative works.  These actions are
 +prohibited by law if you do not accept this License.  Therefore, by
 +modifying or distributing the Program (or any work based on the
 +Program), you indicate your acceptance of this License to do so, and
 +all its terms and conditions for copying, distributing or modifying
 +the Program or works based on it.
 +
 +  6. Each time you redistribute the Program (or any work based on the
 +Program), the recipient automatically receives a license from the
 +original licensor to copy, distribute or modify the Program subject to
 +these terms and conditions.  You may not impose any further
 +restrictions on the recipients' exercise of the rights granted herein.
 +You are not responsible for enforcing compliance by third parties to
 +this License.
 +
 +  7. If, as a consequence of a court judgment or allegation of patent
 +infringement or for any other reason (not limited to patent issues),
 +conditions are imposed on you (whether by court order, agreement or
 +otherwise) that contradict the conditions of this License, they do not
 +excuse you from the conditions of this License.  If you cannot
 +distribute so as to satisfy simultaneously your obligations under this
 +License and any other pertinent obligations, then as a consequence you
 +may not distribute the Program at all.  For example, if a patent
 +license would not permit royalty-free redistribution of the Program by
 +all those who receive copies directly or indirectly through you, then
 +the only way you could satisfy both it and this License would be to
 +refrain entirely from distribution of the Program.
 +
 +If any portion of this section is held invalid or unenforceable under
 +any particular circumstance, the balance of the section is intended to
 +apply and the section as a whole is intended to apply in other
 +circumstances.
 +
 +It is not the purpose of this section to induce you to infringe any
 +patents or other property right claims or to contest validity of any
 +such claims; this section has the sole purpose of protecting the
 +integrity of the free software distribution system, which is
 +implemented by public license practices.  Many people have made
 +generous contributions to the wide range of software distributed
 +through that system in reliance on consistent application of that
 +system; it is up to the author/donor to decide if he or she is willing
 +to distribute software through any other system and a licensee cannot
 +impose that choice.
 +
 +This section is intended to make thoroughly clear what is believed to
 +be a consequence of the rest of this License.
 +
 +  8. If the distribution and/or use of the Program is restricted in
 +certain countries either by patents or by copyrighted interfaces, the
 +original copyright holder who places the Program under this License
 +may add an explicit geographical distribution limitation excluding
 +those countries, so that distribution is permitted only in or among
 +countries not thus excluded.  In such case, this License incorporates
 +the limitation as if written in the body of this License.
 +
 +  9. The Free Software Foundation may publish revised and/or new versions
 +of the General Public License from time to time.  Such new versions will
 +be similar in spirit to the present version, but may differ in detail to
 +address new problems or concerns.
 +
 +Each version is given a distinguishing version number.  If the Program
 +specifies a version number of this License which applies to it and "any
 +later version", you have the option of following the terms and conditions
 +either of that version or of any later version published by the Free
 +Software Foundation.  If the Program does not specify a version number of
 +this License, you may choose any version ever published by the Free Software
 +Foundation.
 +
 +  10. If you wish to incorporate parts of the Program into other free
 +programs whose distribution conditions are different, write to the author
 +to ask for permission.  For software which is copyrighted by the Free
 +Software Foundation, write to the Free Software Foundation; we sometimes
 +make exceptions for this.  Our decision will be guided by the two goals
 +of preserving the free status of all derivatives of our free software and
 +of promoting the sharing and reuse of software generally.
 +
 +			    NO WARRANTY
 +
 +  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
 +FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
 +OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
 +PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
 +OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
 +MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
 +TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
 +PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
 +REPAIR OR CORRECTION.
 +
 +  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
 +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
 +REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
 +INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
 +OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
 +TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
 +YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
 +PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
 +POSSIBILITY OF SUCH DAMAGES.
 +
 +		     END OF TERMS AND CONDITIONS
 +
 +	    How to Apply These Terms to Your New Programs
 +
 +  If you develop a new program, and you want it to be of the greatest
 +possible use to the public, the best way to achieve this is to make it
 +free software which everyone can redistribute and change under these terms.
 +
 +  To do so, attach the following notices to the program.  It is safest
 +to attach them to the start of each source file to most effectively
 +convey the exclusion of warranty; and each file should have at least
 +the "copyright" line and a pointer to where the full notice is found.
 +
 +    <one line to give the program's name and a brief idea of what it does.>
 +    Copyright (C) <year>  <name of author>
 +
 +    This program is free software; you can redistribute it and/or modify
 +    it under the terms of the GNU General Public License as published by
 +    the Free Software Foundation; either version 2 of the License, or
 +    (at your option) any later version.
 +
 +    This program is distributed in the hope that it will be useful,
 +    but WITHOUT ANY WARRANTY; without even the implied warranty of
 +    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 +    GNU General Public License for more details.
 +
 +    You should have received a copy of the GNU General Public License
 +    along with this program; if not, write to the Free Software
 +    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 +
 +
 +Also add information on how to contact you by electronic and paper mail.
 +
 +If the program is interactive, make it output a short notice like this
 +when it starts in an interactive mode:
 +
 +    Gnomovision version 69, Copyright (C) year name of author
 +    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
 +    This is free software, and you are welcome to redistribute it
 +    under certain conditions; type `show c' for details.
 +
 +The hypothetical commands `show w' and `show c' should show the appropriate
 +parts of the General Public License.  Of course, the commands you use may
 +be called something other than `show w' and `show c'; they could even be
 +mouse-clicks or menu items--whatever suits your program.
 +
 +You should also get your employer (if you work as a programmer) or your
 +school, if any, to sign a "copyright disclaimer" for the program, if
 +necessary.  Here is a sample; alter the names:
 +
 +  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
 +  `Gnomovision' (which makes passes at compilers) written by James Hacker.
 +
 +  <signature of Ty Coon>, 1 April 1989
 +  Ty Coon, President of Vice
 +
 +This General Public License does not permit incorporating your program into
 +proprietary programs.  If your program is a subroutine library, you may
 +consider it more useful to permit linking proprietary applications with the
 +library.  If this is what you want to do, use the GNU Library General
 +Public License instead of this License.
 diff --git a/CREDITS b/CREDITS
 new file mode 100644
 index 000000000000..671e9c2d31fe
 --- /dev/null
 +++ b/CREDITS
 @@ -0,0 +1,3743 @@
 +	This is at least a partial credits-file of people that have
 +	contributed to the Linux project.  It is sorted by name and
 +	formatted to allow easy grepping and beautification by
 +	scripts.  The fields are: name (N), email (E), web-address
 +	(W), PGP key ID and fingerprint (P), description (D), and
 +	snail-mail address (S).
 +	Thanks,
 +
 +			Linus
 +----------
 +
 +N: Matti Aarnio
 +E: mea@nic.funet.fi
 +D: Alpha systems hacking, IPv6 and other network related stuff
 +D: One of assisting postmasters for vger.kernel.org's lists
 +S: (ask for current address)
 +S: Finland
 +
 +N: Dragos Acostachioaie
 +E: dragos@iname.com
 +W: http://www.arbornet.org/~dragos
 +D: /proc/sysvipc
 +S: C. Negri 6, bl. D3
 +S: Iasi 6600
 +S: Romania
 +
 +N: Monalisa Agrawal
 +E: magrawal@nortelnetworks.com
 +D: Basic Interphase 5575 driver with UBR and ABR support.
 +S: 75 Donald St, Apt 42
 +S: Weymouth, MA 02188
 +
 +N: Dave Airlie
 +E: airlied@linux.ie
 +W: http://www.csn.ul.ie/~airlied
 +D: NFS over TCP patches
 +D: in-kernel DRM Maintainer
 +S: Longford, Ireland
 +S: Sydney, Australia
 +
 +N: Tigran A. Aivazian
 +E: tigran@veritas.com
 +W: http://www.moses.uklinux.net/patches
 +D: BFS filesystem
 +D: Intel IA32 CPU microcode update support
 +D: Various kernel patches
 +S: United Kingdom
 +
 +N: Werner Almesberger
 +E: werner@almesberger.net
 +W: http://www.almesberger.net/
 +D: dosfs, LILO, some fd features, ATM, various other hacks here and there
 +S: Buenos Aires
 +S: Argentina
 +
 +N: Tim Alpaerts
 +E: tim_alpaerts@toyota-motor-europe.com
 +D: 802.2 class II logical link control layer,
 +D: the humble start of an opening towards the IBM SNA protocols
 +S: Klaproosstraat 72 c 10
 +S: B-2610 Wilrijk-Antwerpen
 +S: Belgium
 +
 +N: Anton Altaparmakov
 +E: aia21@cantab.net
 +W: http://www-stu.christs.cam.ac.uk/~aia21/
 +D: Author of new NTFS driver, various other kernel hacks.
 +S: Christ's College
 +S: Cambridge CB2 3BU
 +S: United Kingdom
 +
 +N: C. Scott Ananian
 +E: cananian@alumni.princeton.edu
 +W: http://www.pdos.lcs.mit.edu/~cananian
 +P: 1024/85AD9EED AD C0 49 08 91 67 DF D7  FA 04 1A EE 09 E8 44 B0
 +D: Unix98 pty support.
 +D: APM update to 1.2 spec.
 +D: /devfs hacking.
 +S: 7 Kiwi Loop
 +S: Howell, NJ 07731
 +S: USA
 +
 +N: Erik Andersen
 +E: andersen@codepoet.org
 +W: http://www.codepoet.org/
 +P: 1024D/30D39057 1BC4 2742 E885 E4DE 9301  0C82 5F9B 643E 30D3 9057
 +D: Maintainer of ide-cd and Uniform CD-ROM driver, 
 +D: ATAPI CD-Changer support, Major 2.1.x CD-ROM update.
 +S: 352 North 525 East
 +S: Springville, Utah 84663
 +S: USA
 +
 +N: Michael Ang
 +E: mang@subcarrier.org
 +W: http://www.subcarrier.org/mang
 +D: Linux/PA-RISC hacker
 +S: 85 Frank St.
 +S: Ottawa, Ontario
 +S: Canada K2P 0X3
 +
 +N: H. Peter Anvin
 +E: hpa@zytor.com
 +W: http://www.zytor.com/~hpa/
 +P: 2047/2A960705 BA 03 D3 2C 14 A8 A8 BD  1E DF FE 69 EE 35 BD 74
 +D: Author of the SYSLINUX boot loader, maintainer of the linux.* news
 +D: hierarchy and the Linux Device List; various kernel hacks
 +S: 4390 Albany Drive #46
 +S: San Jose, California 95129
 +S: USA
 +
 +N: Andrea Arcangeli
 +E: andrea@suse.de
 +W: http://www.kernel.org/pub/linux/kernel/people/andrea/
 +P: 1024D/68B9CB43 13D9 8355 295F 4823 7C49  C012 DFA1 686E 68B9 CB43
 +P: 1024R/CB4660B9 CC A0 71 81 F4 A0 63 AC  C0 4B 81 1D 8C 15 C8 E5
 +D: Parport hacker
 +D: Implemented a workaround for some interrupt buggy printers
 +D: Author of pscan that helps to fix lp/parport bugs
 +D: Author of lil (Linux Interrupt Latency benchmark)
 +D: Fixed the shm swap deallocation at swapoff time (try_to_unuse message)
 +D: VM hacker
 +D: Various other kernel hacks
 +S: Via Cicalini 26
 +S: Imola 40026
 +S: Italy
 +
 +N: Derek Atkins
 +E: warlord@MIT.EDU
 +D: Linux-AFS Port, random kernel hacker,
 +D: VFS fixes (new notify_change in particular)
 +D: Moving all VFS access checks into the file systems
 +S: MIT Room E15-341
 +S: 20 Ames Street
 +S: Cambridge, Massachusetts 02139
 +S: USA
 +
 +N: Michel Aubry
 +E: giovanni <giovanni@sudfr.com>
 +D: Aladdin 1533/1543(C) chipset IDE
 +D: VIA MVP-3/TX Pro III chipset IDE
 +
 +N: Jens Axboe
 +E: axboe@suse.de
 +D: Linux CD-ROM maintainer, DVD support
 +D: elevator + block layer rewrites
 +D: highmem I/O support
 +D: misc hacking on IDE, SCSI, block drivers, etc
 +S: Peter Bangs Vej 258, 2TH
 +S: 2500 Valby
 +S: Denmark
 +
 +N: John Aycock
 +E: aycock@cpsc.ucalgary.ca
 +D: Adaptec 274x driver
 +S: Department of Computer Science
 +S: University of Calgary
 +S: Calgary, Alberta
 +S: Canada
 +
 +N: Miles Bader
 +E: miles@gnu.org
 +D: v850 port (uClinux)
 +S: NEC Corporation
 +S: 1753 Shimonumabe, Nakahara-ku
 +S: Kawasaki 211-8666
 +S: Japan
 +
 +N: Ralf Baechle
 +E: ralf@gnu.org
 +P: 1024/AF7B30C1 CF 97 C2 CC 6D AE A7 FE  C8 BA 9C FC 88 DE 32 C3
 +D: Linux/MIPS port
 +D: Linux/68k hacker
 +S: Hauptstrasse 19
 +S: 79837 St. Blasien
 +S: Germany
 +
 +N: Krishna Balasubramanian
 +E: balasub@cis.ohio-state.edu
 +D: Wrote SYS V IPC (part of standard kernel since 0.99.10)
 +
 +N: Dario Ballabio
 +E: ballabio_dario@emc.com
 +E: dario.ballabio@tiscalinet.it
 +E: dario.ballabio@inwind.it
 +D: Author and maintainer of the Ultrastor 14F/34F SCSI driver
 +D: Author and maintainer of the EATA ISA/EISA/PCI SCSI driver
 +S: EMC Corporation
 +S: Milano
 +S: Italy
 +
 +N: Paul Bame
 +E: bame@debian.org
 +E: bame@puffin.external.hp.com
 +E: paul_bame@hp.com
 +W: http://www.parisc-linux.org
 +D: PA-RISC 32 and 64-bit early boot, firmware interface, interrupts, misc
 +S: MS42
 +S: Hewlett-Packard
 +S: 3404 E Harmony Rd
 +S: Fort Collins, CO 80525
 +
 +N: Arindam Banerji
 +E: axb@cse.nd.edu
 +D: Contributed ESDI driver routines needed to port LINUX to the PS/2 MCA.
 +S: Department of Computer Science & Eng.
 +S: University of Notre Dame
 +S: Notre Dame, Indiana
 +S: USA
 +
 +N: Greg Banks
 +E: gnb@alphalink.com.au
 +D: IDT77105 ATM network driver
 +D: some SuperH port work
 +D: some trivial futzing with kconfig
 +
 +N: James Banks
 +E: james@sovereign.org
 +D: TLAN network driver
 +D: Logitech Busmouse driver
 +
 +N: Krzysztof G. Baranowski
 +E: kgb@manjak.knm.org.pl
 +P: 1024/FA6F16D1 96 D1 1A CF 5F CA 69 EC  F9 4F 36 1F 6D 60 7B DA
 +D: Maintainer of the System V file system.
 +D: System V fs update for 2.1.x dcache.
 +D: Forward ported a couple of SCSI drivers.
 +D: Various bugfixes.
 +S: ul. Koscielna 12a
 +S: 62-300 Wrzesnia
 +S: Poland
 +
 +N: Fred Barnes
 +E: frmb2@ukc.ac.uk
 +D: Various parport/ppdev hacks and fixes
 +S: Computing Lab, The University
 +S: Canterbury, KENT
 +S: CT2 7NF
 +S: England
 +
 +N: Paul Barton-Davis
 +E: pbd@op.net
 +D: Driver for WaveFront soundcards (Turtle Beach Maui, Tropez, Tropez+)
 +D: Various bugfixes and changes to sound drivers
 +S: USA 
 +
 +N: Carlos Henrique Bauer
 +E: chbauer@acm.org
 +E: bauer@atlas.unisinos.br
 +D: Some new sysctl entries for the parport driver.
 +D: New sysctl function for handling unsigned longs
 +S: Universidade do Vale do Rio dos Sinos - UNISINOS
 +S: DSI/IDASI
 +S: Av. Unisinos, 950
 +S: 93022000 Sao Leopoldo RS
 +S: Brazil
 +
 +N: Peter Bauer
 +E: 100136.3530@compuserve.com
 +D: Driver for depca-ethernet-board
 +S: 69259 Wilhemsfeld
 +S: Rainweg 15
 +S: Germany
 +
 +N: Fred Baumgarten
 +E: dc6iq@insl1.etec.uni-karlsruhe.de
 +E: dc6iq@adacom.org
 +E: dc6iq@db0ais.#hes.deu.eu (packet radio)
 +D: NET-2 & netstat(8)
 +S: Soevener Strasse 11
 +S: 53773 Hennef
 +S: Germany
 +
 +N: Donald Becker
 +E: becker@cesdis.gsfc.nasa.gov
 +D: General low-level networking hacker
 +D: Most of the ethercard drivers
 +D: Original author of the NFS server
 +S: USRA Center of Excellence in Space Data and Information Sciences
 +S: Code 930.5, Goddard Space Flight Center
 +S: Greenbelt, Maryland 20771
 +S: USA
 +
 +N: Adam Belay
 +E: ambx1@neo.rr.com
 +D: Linux Plug and Play Support
 +S: USA
 +
 +N: Daniele Bellucci
 +E: bellucda@tiscali.it
 +D: Various Janitor work.
 +W: http://web.tiscali.it/bellucda
 +S: Via Delle Palme, 9
 +S: Terni 05100
 +S: Italy
 +
 +N: Krzysztof Benedyczak
 +E: golbi@mat.uni.torun.pl
 +W: http://www.mat.uni.torun.pl/~golbi
 +D: POSIX message queues fs (with M. Wronski)
 +S: ul. Podmiejska 52
 +S: Radunica
 +S: 83-000 Pruszcz Gdanski
 +S: Poland
 +
 +N: Randolph Bentson
 +E: bentson@grieg.seaslug.org
 +W: http://www.aa.net/~bentson/
 +P: 1024/39ED5729 5C A8 7A F4 B2 7A D1 3E  B5 3B 81 CF 47 30 11 71
 +D: Author of driver for Cyclom-Y and Cyclades-Z async mux
 +S: 2322 37th Ave SW
 +S: Seattle, Washington 98126-2010
 +S: USA
 +
 +N: Stephen R. van den Berg (AKA BuGless)
 +E: berg@pool.informatik.rwth-aachen.de
 +D: General kernel, gcc, and libc hacker
 +D: Specialisation: tweaking, ensuring portability, tweaking, cleaning,
 +D: tweaking and occasionally debugging :-)
 +S: Bouwensstraat 22
 +S: 6369 BG Simpelveld
 +S: The Netherlands
 +
 +N: Peter Berger
 +E: pberger@brimson.com
 +W: http://www.brimson.com
 +D: Author/maintainer of Digi AccelePort USB driver
 +S: 1549 Hiironen Rd.
 +S: Brimson, MN  55602
 +S: USA
 +
 +N: Hennus Bergman
 +P: 1024/77D50909 76 99 FD 31 91 E1 96 1C  90 BB 22 80 62 F6 BD 63
 +D: Author and maintainer of the QIC-02 tape driver
 +S: The Netherlands
 +
 +N: Tomas Berndtsson
 +E: tomas@nocrew.org
 +W: http://tomas.nocrew.org/
 +D: dsp56k device driver
 +
 +N: Ross Biro
 +E: bir7@leland.Stanford.Edu
 +D: Original author of the Linux networking code
 +
 +N: Anton Blanchard
 +E: anton@samba.org
 +W: http://samba.org/~anton/
 +P: 1024/8462A731 4C 55 86 34 44 59 A7 99  2B 97 88 4A 88 9A 0D 97
 +D: sun4 port, Sparc hacker
 +
 +N: Hugh Blemings
 +E: hugh@misc.nu
 +W: http://misc.nu/hugh/
 +D: Author and maintainer of the Keyspan USB to Serial drivers
 +S: Po Box 234
 +S: Belconnen ACT 2616
 +S: Australia
 +
 +N: Philip Blundell
 +E: philb@gnu.org
 +D: Linux/ARM hacker
 +D: Device driver hacker (eexpress, 3c505, c-qcam, ...)
 +D: m68k port to HP9000/300
 +D: AUN network protocols
 +D: Co-architect of the parallel port sharing system
 +D: IPv6 netfilter
 +S: FutureTV Labs Ltd
 +S: Brunswick House, 61-69 Newmarket Rd, Cambridge CB5 8EG
 +S: United Kingdom
 +
 +N: Thomas Bogend�rfer
 +E: tsbogend@alpha.franken.de
 +D: PCnet32 driver, SONIC driver, JAZZ_ESP driver
 +D: newport abscon driver, g364 framebuffer driver
 +D: strace for Linux/Alpha
 +D: Linux/MIPS hacker
 +S: Schafhofstr. 40
 +S: 90556 Cadolzburg
 +S: Germany
 +
 +N: Bill Bogstad
 +E: bogstad@pobox.com
 +D: wrote /proc/self hack, minor samba & dosemu patches
 +
 +N: Axel Boldt
 +E: axel@uni-paderborn.de
 +W: http://math-www.uni-paderborn.de/~axel/
 +D: Configuration help text support
 +D: Linux CD and Support Giveaway List
 +
 +N: Erik Inge Bols�
 +E: knan@mo.himolde.no
 +D: Misc kernel hacks
 +
 +N: Andreas E. Bombe
 +E: andreas.bombe@munich.netsurf.de
 +W: http://home.pages.de/~andreas.bombe/
 +P: 1024/04880A44 72E5 7031 4414 2EB6 F6B4  4CBD 1181 7032 0488 0A44
 +D: IEEE 1394 subsystem rewrite and maintainer
 +D: Texas Instruments PCILynx IEEE 1394 driver
 +
 +N: Al Borchers
 +E: alborchers@steinerpoint.com
 +D: Author/maintainer of Digi AccelePort USB driver
 +D: work on usbserial and keyspan_pda drivers
 +S: 4912 Zenith Ave. S.
 +S: Minneapolis, MN  55410
 +S: USA
 +
 +N: Marc Boucher
 +E: marc@mbsi.ca
 +P: CA 67 A5 1A 38 CE B6 F2  D5 83 51 03 D2 9C 30 9E  CE D2 DD 65
 +D: Netfilter core
 +D: IP policy routing by mark
 +D: Various fixes (mostly networking)
 +S: Montreal, Quebec
 +S: Canada
 +
 +N: Zolt�n B�sz�rm�nyi
 +E: zboszor@mail.externet.hu
 +D: MTRR emulation with Cyrix style ARR registers, Athlon MTRR support
 +
 +N: John Boyd
 +E: boyd@cis.ohio-state.edu
 +D: Co-author of wd7000 SCSI driver
 +S: 101 Curl Drive #591
 +S: Columbus, Ohio 43210
 +S: USA
 +
 +N: Peter Braam
 +E: braam@clusterfs.com
 +W: http://www.clusterfs.com/
 +D: Coda & InterMezzo filesystems
 +S: 181 McNeil
 +S: Canmore, AB
 +S: Canada, T1W 2R9
 +
 +N: Ryan Bradetich
 +E: rbradetich@uswest.net
 +D: Linux/PA-RISC hacker
 +S: 1200 Goldenrod Dr.
 +S: Nampa, Idaho 83686
 +
 +N: Derrick J. Brashear
 +E: shadow@dementia.org
 +W: http://www.dementia.org/~shadow
 +P: 512/71EC9367 C5 29 0F BC 83 51 B9 F0  BC 05 89 A0 4F 1F 30 05
 +D: Author of Sparc CS4231 audio driver, random Sparc work
 +S: 403 Gilmore Avenue
 +S: Trafford, Pennsylvania 15085
 +S: USA
 +
 +N: Dag Brattli
 +E: dagb@cs.uit.no
 +W: http://www.cs.uit.no/~dagb
 +D: IrDA Subsystem
 +S: 19. Wellington Road
 +S: Lancaster, LA1 4DN
 +S: UK, England
 +
 +N: Lars Brinkhoff
 +E: lars@nocrew.org
 +W: http://lars.nocrew.org/
 +D: dsp56k device driver
 +D: ptrace proxy in user mode kernel port
 +S: Kopmansg 2
 +S: 411 13  Goteborg
 +S: Sweden
 +
 +N: Dominik Brodowski
 +E: linux@brodo.de
 +W: http://www.brodo.de/
 +P: 1024D/725B37C6  190F 3E77 9C89 3B6D BECD  46EE 67C3 0308 725B 37C6
 +D: parts of CPUFreq code, ACPI bugfixes
 +S: Tuebingen, Germany
 +
 +N: Andries Brouwer
 +E: aeb@cwi.nl
 +D: random Linux hacker
 +S: Bessemerstraat 21
 +S: Amsterdam
 +S: The Netherlands
 +
 +N: Zach Brown
 +E: zab@zabbo.net
 +D: maestro pci sound
 +
 +N: Gary Brubaker
 +E: xavyer@ix.netcom.com
 +D: USB Serial Empeg Empeg-car Mark I/II Driver
 +
 +N: Matthias Bruestle
 +E: m@mbsks.franken.de
 +D: REINER SCT cyberJack pinpad/e-com USB chipcard reader driver
 +S: Germany
 +
 +N: Adrian Bunk
 +E: bunk@stusta.de
 +P: 1024D/4F12B400  B29C E71E FE19 6755 5C8A  84D4 99FC EA98 4F12 B400
 +D: misc kernel hacking and testing
 +S: Grasmeierstrasse 11
 +S: 80805 Muenchen
 +S: Germany
 +
 +N: Ray Burr
 +E: ryb@nightmare.com
 +D: Original author of Amiga FFS filesystem
 +S: Orlando, Florida
 +S: USA
 +
 +N: Lennert Buytenhek
 +E: buytenh@gnu.org
 +D: Rewrite of the ethernet bridging code
 +S: Ravenhorst 58B
 +S: 2317 AK Leiden
 +S: The Netherlands
 +
 +N: Michael Callahan
 +E: callahan@maths.ox.ac.uk
 +D: PPP for Linux
 +S: The Mathematical Institute
 +S: 25-29 St Giles
 +S: Oxford
 +S: United Kingdom
 +
 +N: Luiz Fernando N. Capitulino
 +E: lcapitulino@terra.com.br
 +E: lcapitulino@prefeitura.sp.gov.br
 +W: http://www.telecentros.sp.gov.br
 +D: Little fixes and a lot of janitorial work
 +S: E-GOV Telecentros SP
 +S: Brazil
 +
 +N: Remy Card
 +E: Remy.Card@masi.ibp.fr
 +E: Remy.Card@linux.org
 +D: Extended file system [defunct] designer and developer
 +D: Second extended file system designer and developer
 +S: Institut Blaise Pascal
 +S: 4 Place Jussieu
 +S: 75252 Paris Cedex 05
 +S: France
 +
 +N: Ulf Carlsson
 +D: SGI Indy audio (HAL2) drivers
 +E: ulfc@bun.falkenberg.se
 +
 +N: Ed Carp
 +E: ecarp@netcom.com
 +D: uucp, elm, pine, pico port
 +D: cron, at(1) developer
 +S: 48287 Sawleaf
 +S: Fremont, California 94539
 +S: USA
 +
 +N: Florent Chabaud
 +E: florent.chabaud@polytechnique.org
 +D: software suspend
 +S: SGDN/DCSSI/SDS/LTI
 +S: 58, Bd Latour-Maubourg
 +S: 75700 Paris 07 SP
 +S: France
 +
 +N: Gordon Chaffee
 +E: chaffee@cs.berkeley.edu
 +W: http://bmrc.berkeley.edu/people/chaffee/
 +D: vfat, fat32, joliet, native language support
 +S: 3700 Warwick Road
 +S: Fremont, California 94555
 +S: USA
 +
 +N: Chih-Jen Chang
 +E: chihjenc@scf.usc.edu
 +E: chihjen@iis.sinica.edu.tw
 +D: IGMP(Internet Group Management Protocol) version 2
 +S: 3F, 65 Tajen street
 +S: Tamsui town, Taipei county,
 +S: Taiwan 251
 +S: Republic of China
 +
 +N: Michael Elizabeth Chastain
 +E: mec@shout.net
 +D: Configure, Menuconfig, xconfig
 +
 +N: Raymond Chen
 +E: raymondc@microsoft.com
 +D: Author of Configure script
 +S: 14509 NE 39th Street #1096
 +S: Bellevue, Washington 98007
 +S: USA
 +
 +N: Christopher L. Cheney
 +E: ccheney@debian.org
 +E: ccheney@cheney.cx
 +W: http://www.cheney.cx
 +P: 1024D/8E384AF2 2D31 1927 87D7 1F24 9FF9  1BC5 D106 5AB3 8E38 4AF2
 +D: Vista Imaging usb webcam driver
 +S: 314 Prince of Wales
 +S: Conroe, TX 77304
 +S: USA
 +
 +N: Stuart Cheshire
 +E: cheshire@cs.stanford.edu
 +D: Author of Starmode Radio IP (STRIP) driver
 +D: Originator of design for new combined interrupt handlers
 +S: William Gates Department
 +S: Stanford University
 +S: Stanford, California 94305
 +S: USA
 +
 +N: Randolph Chung
 +E: tausq@debian.org
 +D: Linux/PA-RISC hacker
 +S: Los Altos, CA 94022
 +S: USA
 +
 +N: Juan Jose Ciarlante
]
]

gemini-3.1-pro-preview

							input: 23239
							output: 53
							thoughts: 55
						

Okay, here's my interpretation of that thought process, assuming I'm an expert in this field:

**Checking a Specific Commit and Tool**

Right, that commit hash, `1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`, rings a bell. I need to make sure I'm not missing anything. I've got to quickly verify the functionality related to the `set-results` tool. I'll need to double-check its interaction with that specific commit. I need to remember the specific context of that `set-results` tool to make sure that everything works as expected. I need to refresh myself on how the tool interacts with the data, ensuring it's behaving predictably after the changes.

map[FixesHash:1da177e4c3f41524e886b7f1b8a0c1fc7321cac2]

map[FixesHash:1da177e4c3f41524e886b7f1b8a0c1fc7321cac2]

map[Fixes:map[Hash:1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Title:Linux-2.6.12-rc2]]

map[Recipients:[map[Email:jfs-discussion@lists.sourceforge.net Name: To:true] map[Email:linux-kernel@vger.kernel.org Name: To:false] map[Email:shaggy@kernel.org Name:Dave Kleikamp To:true]]]

map[RecentCommits:jfs: hold LOG_LOCK on umount to avoid null-ptr-deref
jfs: Set the lbmDone flag at the end of lbmIODone
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
treewide: Replace kmalloc with kmalloc_obj for non-scalar types
jfs: Add missing set_freezable() for freezable kthread
JFS: Remove redundant 0 value initialization
jfs: Change metapage->page to metapage->folio
fs,block: yield devices early
jfs: port block device access to file
bdev: open block device as files
jfs: fix log->bdev_handle null ptr deref in lbmStartIO
jfs: Convert to bdev_open_by_dev()
block: replace fmode_t with a block-specific type for block open flags
block: use the holder as indication for exclusive opens
block: introduce holder ops
jfs: logmgr: use __bio_add_page to add single page to bio
fs/jfs: Remove dead code
block: pass a block_device and opf to bio_alloc
fs/jfs: Fix missing error code in lmLogInit()
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156
]

gemini-3.1-pro-preview

You are an experienced Linux kernel developer tasked with writing a commit description for
a kernel bug fixing commit. The description should start with a one-line summary,
and then include description of the bug being fixed, and how it's fixed by the provided patch.

Your final reply should contain only the text of the commit description.
Phrase the one-line summary so that it is not longer than 72 characters.
IMPORTANT: Do not wrap lines manually (e.g., at 80 characters); we will reformat the text
automatically, so keep paragraphs as single lines without newlines.

Prefer calling several tools at the same time to save round-trips.

The crash that corresponds to the bug is:

==================================================================
BUG: KASAN: slab-use-after-free in lbmIODone+0x1312/0x16c0 fs/jfs/jfs_logmgr.c:2192
Read of size 4 at addr ffff888049ebf608 by task ktimers/0/16

CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #1 PREEMPT_{RT,(full)} 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 lbmIODone+0x1312/0x16c0 fs/jfs/jfs_logmgr.c:2192
 blk_update_request+0x57e/0xe60 block/blk-mq.c:1016
 blk_mq_end_request+0x3e/0x70 block/blk-mq.c:1178
 blk_complete_reqs block/blk-mq.c:1253 [inline]
 blk_done_softirq+0x10a/0x160 block/blk-mq.c:1258
 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 run_ktimerd+0x69/0x100 kernel/softirq.c:1151
 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 6219:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x3a6/0x690 mm/slub.c:5419
 kmalloc_noprof include/linux/slab.h:950 [inline]
 lbmLogInit fs/jfs/jfs_logmgr.c:1819 [inline]
 lmLogInit+0x3e5/0x1a00 fs/jfs/jfs_logmgr.c:1267
 open_inline_log fs/jfs/jfs_logmgr.c:1173 [inline]
 lmLogOpen+0x4e1/0xfa0 fs/jfs/jfs_logmgr.c:1067
 jfs_mount_rw+0xee/0x670 fs/jfs/jfs_mount.c:257
 jfs_fill_super+0x754/0xd80 fs/jfs/super.c:532
 get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1694
 vfs_get_tree+0x92/0x2a0 fs/super.c:1754
 fc_mount fs/namespace.c:1193 [inline]
 do_new_mount_fc fs/namespace.c:3758 [inline]
 do_new_mount+0x341/0xd30 fs/namespace.c:3834
 do_mount fs/namespace.c:4167 [inline]
 __do_sys_mount fs/namespace.c:4383 [inline]
 __se_sys_mount+0x31d/0x420 fs/namespace.c:4360
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 6106:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2689 [inline]
 slab_free mm/slub.c:6250 [inline]
 kfree+0x1c5/0x6c0 mm/slub.c:6565
 lbmLogShutdown fs/jfs/jfs_logmgr.c:1862 [inline]
 lmLogShutdown+0x456/0x850 fs/jfs/jfs_logmgr.c:1681
 lmLogClose+0x28a/0x520 fs/jfs/jfs_logmgr.c:1457
 jfs_umount+0x2fb/0x3d0 fs/jfs/jfs_umount.c:124
 jfs_put_super+0x8c/0x190 fs/jfs/super.c:194
 generic_shutdown_super+0x13d/0x2d0 fs/super.c:646
 kill_block_super+0x44/0x90 fs/super.c:1725
 deactivate_locked_super+0xbc/0x130 fs/super.c:476
 cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
 task_work_run+0x1d9/0x270 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
 exit_to_user_mode_loop+0xf3/0x4d0 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888049ebf600
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 8 bytes inside of
 freed 256-byte region [ffff888049ebf600, ffff888049ebf700)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x49ebe
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x480000000000040(head|node=1|zone=1)
page_type: f5(slab)
raw: 0480000000000040 ffff888019c41b40 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 0480000000000040 ffff888019c41b40 dead000000000100 dead000000000122
head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 0480000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5588, tgid 5588 (udevd), ts 65263897590, free_ts 59786995144
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x231/0x280 mm/page_alloc.c:1858
 prep_new_page mm/page_alloc.c:1866 [inline]
 get_page_from_freelist+0x27c8/0x2840 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5226
 alloc_slab_page mm/slub.c:3278 [inline]
 allocate_slab+0x77/0x660 mm/slub.c:3467
 new_slab mm/slub.c:3525 [inline]
 refill_objects+0x33c/0x3d0 mm/slub.c:7255
 refill_sheaf mm/slub.c:2816 [inline]
 __pcs_replace_empty_main+0x373/0x720 mm/slub.c:4651
 alloc_from_pcs mm/slub.c:4749 [inline]
 slab_alloc_node mm/slub.c:4883 [inline]
 __kmalloc_cache_noprof+0x44e/0x690 mm/slub.c:5414
 kmalloc_noprof include/linux/slab.h:950 [inline]
 kzalloc_noprof include/linux/slab.h:1188 [inline]
 smk_fetch+0x95/0x140 security/smack/smack_lsm.c:285
 smack_d_instantiate+0x757/0x990 security/smack/smack_lsm.c:3653
 security_d_instantiate+0x106/0x1d0 security/security.c:3704
 d_splice_alias_ops+0x71/0x370 fs/dcache.c:3141
 __lookup_slow+0x2d2/0x440 fs/namei.c:1915
 lookup_slow+0x53/0x70 fs/namei.c:1932
 walk_component fs/namei.c:2278 [inline]
 lookup_last fs/namei.c:2785 [inline]
 path_lookupat+0x3f5/0x8c0 fs/namei.c:2809
 filename_lookup+0x256/0x5d0 fs/namei.c:2838
 vfs_statx+0x115/0x570 fs/stat.c:353
page last free pid 5606 tgid 5606 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1402 [inline]
 __free_frozen_pages+0xf48/0x1080 mm/page_alloc.c:2943
 __slab_free+0x252/0x2a0 mm/slub.c:5612
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4569 [inline]
 slab_alloc_node mm/slub.c:4898 [inline]
 __do_kmalloc_node mm/slub.c:5294 [inline]
 __kmalloc_noprof+0x399/0x7b0 mm/slub.c:5307
 kmalloc_noprof include/linux/slab.h:954 [inline]
 kzalloc_noprof include/linux/slab.h:1188 [inline]
 tomoyo_encode2 security/tomoyo/realpath.c:45 [inline]
 tomoyo_encode+0x28b/0x550 security/tomoyo/realpath.c:80
 tomoyo_mount_acl security/tomoyo/mount.c:152 [inline]
 tomoyo_mount_permission+0x4c1/0x9d0 security/tomoyo/mount.c:239
 security_sb_mount+0xe4/0x320 security/security.c:1088
 path_mount+0xbc/0x1000 fs/namespace.c:4096
 do_mount fs/namespace.c:4167 [inline]
 __do_sys_mount fs/namespace.c:4383 [inline]
 __se_sys_mount+0x31d/0x420 fs/namespace.c:4360
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888049ebf500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888049ebf580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888049ebf600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                      ^
 ffff888049ebf680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888049ebf700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================


The explanation of the root cause of the bug is:

The root cause of this KASAN slab-use-after-free is a concurrency bug (race condition) between `lbmRead()` and the bio completion handler `lbmIODone()`. 

### Detailed Explanation

1. **The Lockless Wait:**
   In `fs/jfs/jfs_logmgr.c`, `lbmRead()` submits a READ bio and waits for its completion using `wait_event()`:
   ```c
   wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));
   return 0;
   ```
   The `wait_event()` macro evaluates its condition `(bp->l_flag != lbmREAD)` locklessly.

2. **The Premature Wakeup:**
   When the READ bio completes, the block layer calls `lbmIODone()`. This function acquires the `LCACHE_LOCK` spinlock, clears the `lbmREAD` flag, and wakes up the waiter:
   ```c
   	if (bp->l_flag & lbmREAD) {
   		bp->l_flag &= ~lbmREAD;

   		/* wakeup I/O initiator */
   		LCACHE_WAKEUP(&bp->l_ioevent);

   		goto out;
   	}
   ```
   Crucially, it does this **before** it sets the `lbmDONE` flag and releases the lock at the `out:` label:
   ```c
   out:
   	bp->l_flag |= lbmDONE;
   	LCACHE_UNLOCK(flags);
   ```

3. **The Race and Reuse:**
   Because `wait_event()` is lockless, the thread executing `lbmRead()` wakes up immediately after `LCACHE_WAKEUP` is called, sees that `lbmREAD` is cleared, and returns. 
   
   The caller of `lbmRead()` (in this crash, `lmLogShutdown()`) then proceeds to reuse the exact same `bp` for a WRITE bio by calling `lbmDirectWrite()`. `lbmDirectWrite()` overwrites `bp->l_flag` with new flags (e.g., `lbmWRITE | lbmRELEASE | lbmSYNC | lbmDIRECT`), which clears any previous state.

4. **The State Corruption:**
   `lmLogShutdown()` then calls `lbmIOWait(bp, lbmFREE)` to wait for the new WRITE bio to complete. `lbmIOWait()` waits for the `lbmDONE` flag to be set.
   
   Meanwhile, the original READ bio's `lbmIODone()` resumes execution, reaches the `out:` label, executes `bp->l_flag |= lbmDONE;`, and unlocks `LCACHE_LOCK`. **This erroneously sets the `lbmDONE` flag on the reused `bp`!**

5. **The Use-After-Free:**
   `lbmIOWait()` sees the `lbmDONE` flag, incorrectly assumes the WRITE bio has completed, and returns early. It then calls `lbmfree(bp)` to put it on the freelist. `lmLogShutdown()` subsequently calls `lbmLogShutdown()`, which frees the `bp` via `kfree()`.
   
   Later, the WRITE bio actually completes, and `lbmIODone()` is called on the freed `bp`. It attempts to read `bp->l_flag` (which is at offset 8 in `struct lbuf`), triggering the KASAN slab-use-after-free report.

### How to Fix

The fix is to replace the lockless `wait_event()` in `lbmRead()` with `lbmIOWait(bp, 0)`. 

`lbmIOWait()` uses `LCACHE_SLEEP_COND()`, which properly synchronizes with `lbmIODone()` by acquiring `LCACHE_LOCK` before checking the condition. This ensures `lbmRead()` will block on the spinlock and not return until `lbmIODone()` has completely finished and unlocked `LCACHE_LOCK`. 

As an added benefit, `lbmIOWait()` correctly returns `-EIO` if the bio completes with an error, whereas the current `lbmRead()` unconditionally returns `0`, ignoring I/O errors.

```c
--- a/fs/jfs/jfs_logmgr.c
+++ b/fs/jfs/jfs_logmgr.c
@@ -1984,9 +1984,7 @@ static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp)
 		submit_bio(bio);
 	}
 
-	wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));
-
-	return 0;
+	return lbmIOWait(bp, 0);
 }
```

The diff of the bug fix is:

diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c
index 306165e61..cf62a8564 100644
--- a/fs/jfs/jfs_logmgr.c
+++ b/fs/jfs/jfs_logmgr.c
@@ -1984,9 +1984,7 @@ static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp)
 		submit_bio(bio);
 	}
 
-	wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));
-
-	return 0;
+	return lbmIOWait(bp, 0);
 }
 
 


Additional description of the patch:

I have applied the fix to replace the lockless `wait_event()` with `lbmIOWait(bp, 0)` in `lbmRead()`.

### What was done:
I edited `fs/jfs/jfs_logmgr.c` to modify `lbmRead()` as follows:
```c
@@ -1984,9 +1984,7 @@ static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp)
 		submit_bio(bio);
 	}
 
-	wait_event(bp->l_ioevent, (bp->l_flag != lbmREAD));
-
-	return 0;
+	return lbmIOWait(bp, 0);
 }
```

### Why this is the best fix:
1. **Proper Synchronization:** `lbmIOWait()` uses the `LCACHE_SLEEP_COND()` macro, which acquires the `LCACHE_LOCK` spinlock before checking the condition (`bp->l_flag & lbmDONE`). Since `lbmIODone()` sets the `lbmDONE` flag and unlocks `LCACHE_LOCK` at the very end of its execution, `lbmIOWait()` will block on the spinlock and wait until `lbmIODone()` has completely finished. This eliminates the race condition where `lbmRead()` returns early and the buffer is reused before `lbmIODone()` finishes modifying it.
2. **Error Handling Improvement:** The original `lbmRead()` implementation unconditionally returned `0` on completion, ignoring any I/O errors that might have occurred during the read operation. `lbmIOWait()` correctly checks for the `lbmERROR` flag and returns `-EIO` if the bio completed with an error. All callers of `lbmRead()` (such as `lmLogInit()`, `lmLogFileSystem()`, and `lmLogShutdown()`) already check the return value of `lbmRead()` and handle errors correctly (e.g., by jumping to error recovery labels), so this change improves the overall robustness of the JFS log manager without requiring any changes to the callers.
3. **Consistency:** Other functions that initiate I/O in the JFS log manager (like `lbmDirectWrite()` and `lbmWrite()` with the `lbmSYNC` flag) already use `lbmIOWait()` to wait for completion. Updating `lbmRead()` to use the same mechanism brings consistency to the codebase. I also verified that there are no other places in the file that misuse `wait_event()` on `bp->l_ioevent`.

Here are summaries of recent commits that touched the same files.
Format the summary line consistently with these, look how prefixes
are specified, letter capitalization, style, etc. 

jfs: hold LOG_LOCK on umount to avoid null-ptr-deref
jfs: Set the lbmDone flag at the end of lbmIODone
Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
treewide: Replace kmalloc with kmalloc_obj for non-scalar types
jfs: Add missing set_freezable() for freezable kthread
JFS: Remove redundant 0 value initialization
jfs: Change metapage->page to metapage->folio
fs,block: yield devices early
jfs: port block device access to file
bdev: open block device as files
jfs: fix log->bdev_handle null ptr deref in lbmStartIO
jfs: Convert to bdev_open_by_dev()
block: replace fmode_t with a block-specific type for block open flags
block: use the holder as indication for exclusive opens
block: introduce holder ops
jfs: logmgr: use __bio_add_page to add single page to bio
fs/jfs: Remove dead code
block: pass a block_device and opf to bio_alloc
fs/jfs: Fix missing error code in lmLogInit()
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156

jfs: fix slab-use-after-free in lbmIODone

A KASAN slab-use-after-free was reported in lbmIODone(). The root cause is a race condition between lbmRead() and the bio completion handler lbmIODone(). In lbmRead(), wait_event() is used to wait for the I/O completion locklessly. When the READ bio completes, lbmIODone() clears the lbmREAD flag and wakes up the waiter before setting the lbmDONE flag and releasing the LCACHE_LOCK. Because wait_event() evaluates its condition locklessly, lbmRead() can wake up and return immediately after the wakeup, before lbmIODone() has finished its execution.

The caller of lbmRead() (e.g., lmLogShutdown()) can then reuse the same buffer for a WRITE bio. Meanwhile, the original lbmIODone() resumes and erroneously sets the lbmDONE flag on the reused buffer. This causes a subsequent lbmIOWait() on the new WRITE bio to return early and free the buffer. When the WRITE bio actually completes, lbmIODone() accesses the freed buffer, triggering the use-after-free.

Fix this by replacing the lockless wait_event() in lbmRead() with lbmIOWait(bp, 0). lbmIOWait() properly synchronizes with lbmIODone() by acquiring LCACHE_LOCK before checking the condition, ensuring lbmRead() will block until lbmIODone() has completely finished. As an added benefit, lbmIOWait() correctly returns -EIO if the bio completes with an error, whereas the previous implementation unconditionally returned 0.

gemini-3.1-pro-preview

							input: 10016
							output: 357
							thoughts: 1315
						

**Analyzing and Fixing a KASAN Slab-Use-After-Free in jfs**

Okay, I need to craft a commit description for this bug fix. It's a KASAN slab-use-after-free in `lbmIODone` within the JFS filesystem code. Looking at the symptoms, it's pretty clear the root cause is a race condition between `lbmRead()` and the bio completion handler `lbmIODone()`. `lbmRead()` uses a lockless `wait_event()` to wait for I/O completion. However, `lbmIODone()` first clears the `lbmREAD` flag and wakes the waiter *before* setting `lbmDONE` and releasing `LCACHE_LOCK`. Because `wait_event` is lockless, `lbmRead()` can return before `lbmIODone()` has finished setting `lbmDONE`.

The problem is that the buffer `bp` used in the initial `lbmRead()` can then be reused (e.g., in `lmLogShutdown()`) for a WRITE bio *before* `lbmIODone()` completes. So, the original `lbmIODone()` then erroneously sets `lbmDONE` on this reused buffer. This early setting then causes a subsequent `lbmIOWait()` on the WRITE bio to return prematurely, and the buffer gets freed. Later, when the WRITE bio *actually* completes, `lbmIODone()` attempts to access the now-freed buffer, leading to the use-after-free.

The fix is straightforward: replace the lockless `wait_event()` in `lbmRead()` with `lbmIOWait(bp, 0)`. `lbmIOWait()` correctly synchronizes with `lbmIODone()` by acquiring `LCACHE_LOCK` before checking for `lbmDONE`. This ensures that `lbmRead()` will not return until `lbmIODone()` is completely finished. Another plus is that `lbmIOWait()` also handles errors properly, returning `-EIO` if the bio completes with an error, which the old lockless check did not. The crash trace also helped me to see that the access to `bp->l_flag` at offset 8. So it's very clear what's happening.

I think the best commit summary would be `jfs: fix slab-use-after-free in lbmIODone`. The summary is just 41 characters, very nice.

map[PatchDescription:jfs: fix slab-use-after-free in lbmIODone

A KASAN slab-use-after-free was reported in lbmIODone(). The root cause
is a race condition between lbmRead() and the bio completion handler
lbmIODone(). In lbmRead(), wait_event() is used to wait for the I/O
completion locklessly. When the READ bio completes, lbmIODone() clears
the lbmREAD flag and wakes up the waiter before setting the lbmDONE flag
and releasing the LCACHE_LOCK. Because wait_event() evaluates its
condition locklessly, lbmRead() can wake up and return immediately after
the wakeup, before lbmIODone() has finished its execution.

The caller of lbmRead() (e.g., lmLogShutdown()) can then reuse the same
buffer for a WRITE bio. Meanwhile, the original lbmIODone() resumes and
erroneously sets the lbmDONE flag on the reused buffer. This causes a
subsequent lbmIOWait() on the new WRITE bio to return early and free the
buffer. When the WRITE bio actually completes, lbmIODone() accesses the
freed buffer, triggering the use-after-free.

Fix this by replacing the lockless wait_event() in lbmRead() with
lbmIOWait(bp, 0). lbmIOWait() properly synchronizes with lbmIODone() by
acquiring LCACHE_LOCK before checking the condition, ensuring lbmRead()
will block until lbmIODone() has completely finished. As an added
benefit, lbmIOWait() correctly returns -EIO if the bio completes with an
error, whereas the previous implementation unconditionally returned 0.]