xref: /openbmc/linux/arch/s390/kernel/crash_dump.c (revision 930beb5a)
1 /*
2  * S390 kdump implementation
3  *
4  * Copyright IBM Corp. 2011
5  * Author(s): Michael Holzheu <holzheu@linux.vnet.ibm.com>
6  */
7 
8 #include <linux/crash_dump.h>
9 #include <asm/lowcore.h>
10 #include <linux/kernel.h>
11 #include <linux/module.h>
12 #include <linux/gfp.h>
13 #include <linux/slab.h>
14 #include <linux/bootmem.h>
15 #include <linux/elf.h>
16 #include <asm/os_info.h>
17 #include <asm/elf.h>
18 #include <asm/ipl.h>
19 #include <asm/sclp.h>
20 
21 #define PTR_ADD(x, y) (((char *) (x)) + ((unsigned long) (y)))
22 #define PTR_SUB(x, y) (((char *) (x)) - ((unsigned long) (y)))
23 #define PTR_DIFF(x, y) ((unsigned long)(((char *) (x)) - ((unsigned long) (y))))
24 
25 struct dump_save_areas dump_save_areas;
26 
27 /*
28  * Allocate and add a save area for a CPU
29  */
30 struct save_area *dump_save_area_create(int cpu)
31 {
32 	struct save_area **save_areas, *save_area;
33 
34 	save_area = kmalloc(sizeof(*save_area), GFP_KERNEL);
35 	if (!save_area)
36 		return NULL;
37 	if (cpu + 1 > dump_save_areas.count) {
38 		dump_save_areas.count = cpu + 1;
39 		save_areas = krealloc(dump_save_areas.areas,
40 				      dump_save_areas.count * sizeof(void *),
41 				      GFP_KERNEL | __GFP_ZERO);
42 		if (!save_areas) {
43 			kfree(save_area);
44 			return NULL;
45 		}
46 		dump_save_areas.areas = save_areas;
47 	}
48 	dump_save_areas.areas[cpu] = save_area;
49 	return save_area;
50 }
51 
52 /*
53  * Return physical address for virtual address
54  */
55 static inline void *load_real_addr(void *addr)
56 {
57 	unsigned long real_addr;
58 
59 	asm volatile(
60 		   "	lra     %0,0(%1)\n"
61 		   "	jz	0f\n"
62 		   "	la	%0,0\n"
63 		   "0:"
64 		   : "=a" (real_addr) : "a" (addr) : "cc");
65 	return (void *)real_addr;
66 }
67 
68 /*
69  * Copy real to virtual or real memory
70  */
71 static int copy_from_realmem(void *dest, void *src, size_t count)
72 {
73 	unsigned long size;
74 
75 	if (!count)
76 		return 0;
77 	if (!is_vmalloc_or_module_addr(dest))
78 		return memcpy_real(dest, src, count);
79 	do {
80 		size = min(count, PAGE_SIZE - (__pa(dest) & ~PAGE_MASK));
81 		if (memcpy_real(load_real_addr(dest), src, size))
82 			return -EFAULT;
83 		count -= size;
84 		dest += size;
85 		src += size;
86 	} while (count);
87 	return 0;
88 }
89 
90 /*
91  * Pointer to ELF header in new kernel
92  */
93 static void *elfcorehdr_newmem;
94 
95 /*
96  * Copy one page from zfcpdump "oldmem"
97  *
98  * For pages below HSA size memory from the HSA is copied. Otherwise
99  * real memory copy is used.
100  */
101 static ssize_t copy_oldmem_page_zfcpdump(char *buf, size_t csize,
102 					 unsigned long src, int userbuf)
103 {
104 	int rc;
105 
106 	if (src < sclp_get_hsa_size()) {
107 		rc = memcpy_hsa(buf, src, csize, userbuf);
108 	} else {
109 		if (userbuf)
110 			rc = copy_to_user_real((void __force __user *) buf,
111 					       (void *) src, csize);
112 		else
113 			rc = memcpy_real(buf, (void *) src, csize);
114 	}
115 	return rc ? rc : csize;
116 }
117 
118 /*
119  * Copy one page from kdump "oldmem"
120  *
121  * For the kdump reserved memory this functions performs a swap operation:
122  *  - [OLDMEM_BASE - OLDMEM_BASE + OLDMEM_SIZE] is mapped to [0 - OLDMEM_SIZE].
123  *  - [0 - OLDMEM_SIZE] is mapped to [OLDMEM_BASE - OLDMEM_BASE + OLDMEM_SIZE]
124  */
125 static ssize_t copy_oldmem_page_kdump(char *buf, size_t csize,
126 				      unsigned long src, int userbuf)
127 
128 {
129 	int rc;
130 
131 	if (src < OLDMEM_SIZE)
132 		src += OLDMEM_BASE;
133 	else if (src > OLDMEM_BASE &&
134 		 src < OLDMEM_BASE + OLDMEM_SIZE)
135 		src -= OLDMEM_BASE;
136 	if (userbuf)
137 		rc = copy_to_user_real((void __force __user *) buf,
138 				       (void *) src, csize);
139 	else
140 		rc = copy_from_realmem(buf, (void *) src, csize);
141 	return (rc == 0) ? rc : csize;
142 }
143 
144 /*
145  * Copy one page from "oldmem"
146  */
147 ssize_t copy_oldmem_page(unsigned long pfn, char *buf, size_t csize,
148 			 unsigned long offset, int userbuf)
149 {
150 	unsigned long src;
151 
152 	if (!csize)
153 		return 0;
154 	src = (pfn << PAGE_SHIFT) + offset;
155 	if (OLDMEM_BASE)
156 		return copy_oldmem_page_kdump(buf, csize, src, userbuf);
157 	else
158 		return copy_oldmem_page_zfcpdump(buf, csize, src, userbuf);
159 }
160 
161 /*
162  * Remap "oldmem" for kdump
163  *
164  * For the kdump reserved memory this functions performs a swap operation:
165  * [0 - OLDMEM_SIZE] is mapped to [OLDMEM_BASE - OLDMEM_BASE + OLDMEM_SIZE]
166  */
167 static int remap_oldmem_pfn_range_kdump(struct vm_area_struct *vma,
168 					unsigned long from, unsigned long pfn,
169 					unsigned long size, pgprot_t prot)
170 {
171 	unsigned long size_old;
172 	int rc;
173 
174 	if (pfn < OLDMEM_SIZE >> PAGE_SHIFT) {
175 		size_old = min(size, OLDMEM_SIZE - (pfn << PAGE_SHIFT));
176 		rc = remap_pfn_range(vma, from,
177 				     pfn + (OLDMEM_BASE >> PAGE_SHIFT),
178 				     size_old, prot);
179 		if (rc || size == size_old)
180 			return rc;
181 		size -= size_old;
182 		from += size_old;
183 		pfn += size_old >> PAGE_SHIFT;
184 	}
185 	return remap_pfn_range(vma, from, pfn, size, prot);
186 }
187 
188 /*
189  * Remap "oldmem" for zfcpdump
190  *
191  * We only map available memory above HSA size. Memory below HSA size
192  * is read on demand using the copy_oldmem_page() function.
193  */
194 static int remap_oldmem_pfn_range_zfcpdump(struct vm_area_struct *vma,
195 					   unsigned long from,
196 					   unsigned long pfn,
197 					   unsigned long size, pgprot_t prot)
198 {
199 	unsigned long hsa_end = sclp_get_hsa_size();
200 	unsigned long size_hsa;
201 
202 	if (pfn < hsa_end >> PAGE_SHIFT) {
203 		size_hsa = min(size, hsa_end - (pfn << PAGE_SHIFT));
204 		if (size == size_hsa)
205 			return 0;
206 		size -= size_hsa;
207 		from += size_hsa;
208 		pfn += size_hsa >> PAGE_SHIFT;
209 	}
210 	return remap_pfn_range(vma, from, pfn, size, prot);
211 }
212 
213 /*
214  * Remap "oldmem" for kdump or zfcpdump
215  */
216 int remap_oldmem_pfn_range(struct vm_area_struct *vma, unsigned long from,
217 			   unsigned long pfn, unsigned long size, pgprot_t prot)
218 {
219 	if (OLDMEM_BASE)
220 		return remap_oldmem_pfn_range_kdump(vma, from, pfn, size, prot);
221 	else
222 		return remap_oldmem_pfn_range_zfcpdump(vma, from, pfn, size,
223 						       prot);
224 }
225 
226 /*
227  * Copy memory from old kernel
228  */
229 int copy_from_oldmem(void *dest, void *src, size_t count)
230 {
231 	unsigned long copied = 0;
232 	int rc;
233 
234 	if (OLDMEM_BASE) {
235 		if ((unsigned long) src < OLDMEM_SIZE) {
236 			copied = min(count, OLDMEM_SIZE - (unsigned long) src);
237 			rc = copy_from_realmem(dest, src + OLDMEM_BASE, copied);
238 			if (rc)
239 				return rc;
240 		}
241 	} else {
242 		unsigned long hsa_end = sclp_get_hsa_size();
243 		if ((unsigned long) src < hsa_end) {
244 			copied = min(count, hsa_end - (unsigned long) src);
245 			rc = memcpy_hsa(dest, (unsigned long) src, copied, 0);
246 			if (rc)
247 				return rc;
248 		}
249 	}
250 	return copy_from_realmem(dest + copied, src + copied, count - copied);
251 }
252 
253 /*
254  * Alloc memory and panic in case of ENOMEM
255  */
256 static void *kzalloc_panic(int len)
257 {
258 	void *rc;
259 
260 	rc = kzalloc(len, GFP_KERNEL);
261 	if (!rc)
262 		panic("s390 kdump kzalloc (%d) failed", len);
263 	return rc;
264 }
265 
266 /*
267  * Get memory layout and create hole for oldmem
268  */
269 static struct mem_chunk *get_memory_layout(void)
270 {
271 	struct mem_chunk *chunk_array;
272 
273 	chunk_array = kzalloc_panic(MEMORY_CHUNKS * sizeof(struct mem_chunk));
274 	detect_memory_layout(chunk_array, 0);
275 	create_mem_hole(chunk_array, OLDMEM_BASE, OLDMEM_SIZE);
276 	return chunk_array;
277 }
278 
279 /*
280  * Initialize ELF note
281  */
282 static void *nt_init(void *buf, Elf64_Word type, void *desc, int d_len,
283 		     const char *name)
284 {
285 	Elf64_Nhdr *note;
286 	u64 len;
287 
288 	note = (Elf64_Nhdr *)buf;
289 	note->n_namesz = strlen(name) + 1;
290 	note->n_descsz = d_len;
291 	note->n_type = type;
292 	len = sizeof(Elf64_Nhdr);
293 
294 	memcpy(buf + len, name, note->n_namesz);
295 	len = roundup(len + note->n_namesz, 4);
296 
297 	memcpy(buf + len, desc, note->n_descsz);
298 	len = roundup(len + note->n_descsz, 4);
299 
300 	return PTR_ADD(buf, len);
301 }
302 
303 /*
304  * Initialize prstatus note
305  */
306 static void *nt_prstatus(void *ptr, struct save_area *sa)
307 {
308 	struct elf_prstatus nt_prstatus;
309 	static int cpu_nr = 1;
310 
311 	memset(&nt_prstatus, 0, sizeof(nt_prstatus));
312 	memcpy(&nt_prstatus.pr_reg.gprs, sa->gp_regs, sizeof(sa->gp_regs));
313 	memcpy(&nt_prstatus.pr_reg.psw, sa->psw, sizeof(sa->psw));
314 	memcpy(&nt_prstatus.pr_reg.acrs, sa->acc_regs, sizeof(sa->acc_regs));
315 	nt_prstatus.pr_pid = cpu_nr;
316 	cpu_nr++;
317 
318 	return nt_init(ptr, NT_PRSTATUS, &nt_prstatus, sizeof(nt_prstatus),
319 			 "CORE");
320 }
321 
322 /*
323  * Initialize fpregset (floating point) note
324  */
325 static void *nt_fpregset(void *ptr, struct save_area *sa)
326 {
327 	elf_fpregset_t nt_fpregset;
328 
329 	memset(&nt_fpregset, 0, sizeof(nt_fpregset));
330 	memcpy(&nt_fpregset.fpc, &sa->fp_ctrl_reg, sizeof(sa->fp_ctrl_reg));
331 	memcpy(&nt_fpregset.fprs, &sa->fp_regs, sizeof(sa->fp_regs));
332 
333 	return nt_init(ptr, NT_PRFPREG, &nt_fpregset, sizeof(nt_fpregset),
334 		       "CORE");
335 }
336 
337 /*
338  * Initialize timer note
339  */
340 static void *nt_s390_timer(void *ptr, struct save_area *sa)
341 {
342 	return nt_init(ptr, NT_S390_TIMER, &sa->timer, sizeof(sa->timer),
343 			 KEXEC_CORE_NOTE_NAME);
344 }
345 
346 /*
347  * Initialize TOD clock comparator note
348  */
349 static void *nt_s390_tod_cmp(void *ptr, struct save_area *sa)
350 {
351 	return nt_init(ptr, NT_S390_TODCMP, &sa->clk_cmp,
352 		       sizeof(sa->clk_cmp), KEXEC_CORE_NOTE_NAME);
353 }
354 
355 /*
356  * Initialize TOD programmable register note
357  */
358 static void *nt_s390_tod_preg(void *ptr, struct save_area *sa)
359 {
360 	return nt_init(ptr, NT_S390_TODPREG, &sa->tod_reg,
361 		       sizeof(sa->tod_reg), KEXEC_CORE_NOTE_NAME);
362 }
363 
364 /*
365  * Initialize control register note
366  */
367 static void *nt_s390_ctrs(void *ptr, struct save_area *sa)
368 {
369 	return nt_init(ptr, NT_S390_CTRS, &sa->ctrl_regs,
370 		       sizeof(sa->ctrl_regs), KEXEC_CORE_NOTE_NAME);
371 }
372 
373 /*
374  * Initialize prefix register note
375  */
376 static void *nt_s390_prefix(void *ptr, struct save_area *sa)
377 {
378 	return nt_init(ptr, NT_S390_PREFIX, &sa->pref_reg,
379 			 sizeof(sa->pref_reg), KEXEC_CORE_NOTE_NAME);
380 }
381 
382 /*
383  * Fill ELF notes for one CPU with save area registers
384  */
385 void *fill_cpu_elf_notes(void *ptr, struct save_area *sa)
386 {
387 	ptr = nt_prstatus(ptr, sa);
388 	ptr = nt_fpregset(ptr, sa);
389 	ptr = nt_s390_timer(ptr, sa);
390 	ptr = nt_s390_tod_cmp(ptr, sa);
391 	ptr = nt_s390_tod_preg(ptr, sa);
392 	ptr = nt_s390_ctrs(ptr, sa);
393 	ptr = nt_s390_prefix(ptr, sa);
394 	return ptr;
395 }
396 
397 /*
398  * Initialize prpsinfo note (new kernel)
399  */
400 static void *nt_prpsinfo(void *ptr)
401 {
402 	struct elf_prpsinfo prpsinfo;
403 
404 	memset(&prpsinfo, 0, sizeof(prpsinfo));
405 	prpsinfo.pr_sname = 'R';
406 	strcpy(prpsinfo.pr_fname, "vmlinux");
407 	return nt_init(ptr, NT_PRPSINFO, &prpsinfo, sizeof(prpsinfo),
408 		       KEXEC_CORE_NOTE_NAME);
409 }
410 
411 /*
412  * Get vmcoreinfo using lowcore->vmcore_info (new kernel)
413  */
414 static void *get_vmcoreinfo_old(unsigned long *size)
415 {
416 	char nt_name[11], *vmcoreinfo;
417 	Elf64_Nhdr note;
418 	void *addr;
419 
420 	if (copy_from_oldmem(&addr, &S390_lowcore.vmcore_info, sizeof(addr)))
421 		return NULL;
422 	memset(nt_name, 0, sizeof(nt_name));
423 	if (copy_from_oldmem(&note, addr, sizeof(note)))
424 		return NULL;
425 	if (copy_from_oldmem(nt_name, addr + sizeof(note), sizeof(nt_name) - 1))
426 		return NULL;
427 	if (strcmp(nt_name, "VMCOREINFO") != 0)
428 		return NULL;
429 	vmcoreinfo = kzalloc_panic(note.n_descsz);
430 	if (copy_from_oldmem(vmcoreinfo, addr + 24, note.n_descsz))
431 		return NULL;
432 	*size = note.n_descsz;
433 	return vmcoreinfo;
434 }
435 
436 /*
437  * Initialize vmcoreinfo note (new kernel)
438  */
439 static void *nt_vmcoreinfo(void *ptr)
440 {
441 	unsigned long size;
442 	void *vmcoreinfo;
443 
444 	vmcoreinfo = os_info_old_entry(OS_INFO_VMCOREINFO, &size);
445 	if (!vmcoreinfo)
446 		vmcoreinfo = get_vmcoreinfo_old(&size);
447 	if (!vmcoreinfo)
448 		return ptr;
449 	return nt_init(ptr, 0, vmcoreinfo, size, "VMCOREINFO");
450 }
451 
452 /*
453  * Initialize ELF header (new kernel)
454  */
455 static void *ehdr_init(Elf64_Ehdr *ehdr, int mem_chunk_cnt)
456 {
457 	memset(ehdr, 0, sizeof(*ehdr));
458 	memcpy(ehdr->e_ident, ELFMAG, SELFMAG);
459 	ehdr->e_ident[EI_CLASS] = ELFCLASS64;
460 	ehdr->e_ident[EI_DATA] = ELFDATA2MSB;
461 	ehdr->e_ident[EI_VERSION] = EV_CURRENT;
462 	memset(ehdr->e_ident + EI_PAD, 0, EI_NIDENT - EI_PAD);
463 	ehdr->e_type = ET_CORE;
464 	ehdr->e_machine = EM_S390;
465 	ehdr->e_version = EV_CURRENT;
466 	ehdr->e_phoff = sizeof(Elf64_Ehdr);
467 	ehdr->e_ehsize = sizeof(Elf64_Ehdr);
468 	ehdr->e_phentsize = sizeof(Elf64_Phdr);
469 	ehdr->e_phnum = mem_chunk_cnt + 1;
470 	return ehdr + 1;
471 }
472 
473 /*
474  * Return CPU count for ELF header (new kernel)
475  */
476 static int get_cpu_cnt(void)
477 {
478 	int i, cpus = 0;
479 
480 	for (i = 0; i < dump_save_areas.count; i++) {
481 		if (dump_save_areas.areas[i]->pref_reg == 0)
482 			continue;
483 		cpus++;
484 	}
485 	return cpus;
486 }
487 
488 /*
489  * Return memory chunk count for ELF header (new kernel)
490  */
491 static int get_mem_chunk_cnt(void)
492 {
493 	struct mem_chunk *chunk_array, *mem_chunk;
494 	int i, cnt = 0;
495 
496 	chunk_array = get_memory_layout();
497 	for (i = 0; i < MEMORY_CHUNKS; i++) {
498 		mem_chunk = &chunk_array[i];
499 		if (chunk_array[i].type != CHUNK_READ_WRITE &&
500 		    chunk_array[i].type != CHUNK_READ_ONLY)
501 			continue;
502 		if (mem_chunk->size == 0)
503 			continue;
504 		cnt++;
505 	}
506 	kfree(chunk_array);
507 	return cnt;
508 }
509 
510 /*
511  * Initialize ELF loads (new kernel)
512  */
513 static int loads_init(Elf64_Phdr *phdr, u64 loads_offset)
514 {
515 	struct mem_chunk *chunk_array, *mem_chunk;
516 	int i;
517 
518 	chunk_array = get_memory_layout();
519 	for (i = 0; i < MEMORY_CHUNKS; i++) {
520 		mem_chunk = &chunk_array[i];
521 		if (mem_chunk->size == 0)
522 			continue;
523 		if (chunk_array[i].type != CHUNK_READ_WRITE &&
524 		    chunk_array[i].type != CHUNK_READ_ONLY)
525 			continue;
526 		else
527 			phdr->p_filesz = mem_chunk->size;
528 		phdr->p_type = PT_LOAD;
529 		phdr->p_offset = mem_chunk->addr;
530 		phdr->p_vaddr = mem_chunk->addr;
531 		phdr->p_paddr = mem_chunk->addr;
532 		phdr->p_memsz = mem_chunk->size;
533 		phdr->p_flags = PF_R | PF_W | PF_X;
534 		phdr->p_align = PAGE_SIZE;
535 		phdr++;
536 	}
537 	kfree(chunk_array);
538 	return i;
539 }
540 
541 /*
542  * Initialize notes (new kernel)
543  */
544 static void *notes_init(Elf64_Phdr *phdr, void *ptr, u64 notes_offset)
545 {
546 	struct save_area *sa;
547 	void *ptr_start = ptr;
548 	int i;
549 
550 	ptr = nt_prpsinfo(ptr);
551 
552 	for (i = 0; i < dump_save_areas.count; i++) {
553 		sa = dump_save_areas.areas[i];
554 		if (sa->pref_reg == 0)
555 			continue;
556 		ptr = fill_cpu_elf_notes(ptr, sa);
557 	}
558 	ptr = nt_vmcoreinfo(ptr);
559 	memset(phdr, 0, sizeof(*phdr));
560 	phdr->p_type = PT_NOTE;
561 	phdr->p_offset = notes_offset;
562 	phdr->p_filesz = (unsigned long) PTR_SUB(ptr, ptr_start);
563 	phdr->p_memsz = phdr->p_filesz;
564 	return ptr;
565 }
566 
567 /*
568  * Create ELF core header (new kernel)
569  */
570 int elfcorehdr_alloc(unsigned long long *addr, unsigned long long *size)
571 {
572 	Elf64_Phdr *phdr_notes, *phdr_loads;
573 	int mem_chunk_cnt;
574 	void *ptr, *hdr;
575 	u32 alloc_size;
576 	u64 hdr_off;
577 
578 	/* If we are not in kdump or zfcpdump mode return */
579 	if (!OLDMEM_BASE && ipl_info.type != IPL_TYPE_FCP_DUMP)
580 		return 0;
581 	/* If elfcorehdr= has been passed via cmdline, we use that one */
582 	if (elfcorehdr_addr != ELFCORE_ADDR_MAX)
583 		return 0;
584 	/* If we cannot get HSA size for zfcpdump return error */
585 	if (ipl_info.type == IPL_TYPE_FCP_DUMP && !sclp_get_hsa_size())
586 		return -ENODEV;
587 	mem_chunk_cnt = get_mem_chunk_cnt();
588 
589 	alloc_size = 0x1000 + get_cpu_cnt() * 0x300 +
590 		mem_chunk_cnt * sizeof(Elf64_Phdr);
591 	hdr = kzalloc_panic(alloc_size);
592 	/* Init elf header */
593 	ptr = ehdr_init(hdr, mem_chunk_cnt);
594 	/* Init program headers */
595 	phdr_notes = ptr;
596 	ptr = PTR_ADD(ptr, sizeof(Elf64_Phdr));
597 	phdr_loads = ptr;
598 	ptr = PTR_ADD(ptr, sizeof(Elf64_Phdr) * mem_chunk_cnt);
599 	/* Init notes */
600 	hdr_off = PTR_DIFF(ptr, hdr);
601 	ptr = notes_init(phdr_notes, ptr, ((unsigned long) hdr) + hdr_off);
602 	/* Init loads */
603 	hdr_off = PTR_DIFF(ptr, hdr);
604 	loads_init(phdr_loads, hdr_off);
605 	*addr = (unsigned long long) hdr;
606 	elfcorehdr_newmem = hdr;
607 	*size = (unsigned long long) hdr_off;
608 	BUG_ON(elfcorehdr_size > alloc_size);
609 	return 0;
610 }
611 
612 /*
613  * Free ELF core header (new kernel)
614  */
615 void elfcorehdr_free(unsigned long long addr)
616 {
617 	if (!elfcorehdr_newmem)
618 		return;
619 	kfree((void *)(unsigned long)addr);
620 }
621 
622 /*
623  * Read from ELF header
624  */
625 ssize_t elfcorehdr_read(char *buf, size_t count, u64 *ppos)
626 {
627 	void *src = (void *)(unsigned long)*ppos;
628 
629 	src = elfcorehdr_newmem ? src : src - OLDMEM_BASE;
630 	memcpy(buf, src, count);
631 	*ppos += count;
632 	return count;
633 }
634 
635 /*
636  * Read from ELF notes data
637  */
638 ssize_t elfcorehdr_read_notes(char *buf, size_t count, u64 *ppos)
639 {
640 	void *src = (void *)(unsigned long)*ppos;
641 	int rc;
642 
643 	if (elfcorehdr_newmem) {
644 		memcpy(buf, src, count);
645 	} else {
646 		rc = copy_from_oldmem(buf, src, count);
647 		if (rc)
648 			return rc;
649 	}
650 	*ppos += count;
651 	return count;
652 }
653