xref: /linux/arch/powerpc/mm/mem.c (revision f86fd32d)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  *  PowerPC version
4  *    Copyright (C) 1995-1996 Gary Thomas (gdt@linuxppc.org)
5  *
6  *  Modifications by Paul Mackerras (PowerMac) (paulus@cs.anu.edu.au)
7  *  and Cort Dougan (PReP) (cort@cs.nmt.edu)
8  *    Copyright (C) 1996 Paul Mackerras
9  *  PPC44x/36-bit changes by Matt Porter (mporter@mvista.com)
10  *
11  *  Derived from "arch/i386/mm/init.c"
12  *    Copyright (C) 1991, 1992, 1993, 1994  Linus Torvalds
13  */
14 
15 #include <linux/export.h>
16 #include <linux/sched.h>
17 #include <linux/kernel.h>
18 #include <linux/errno.h>
19 #include <linux/string.h>
20 #include <linux/gfp.h>
21 #include <linux/types.h>
22 #include <linux/mm.h>
23 #include <linux/stddef.h>
24 #include <linux/init.h>
25 #include <linux/memblock.h>
26 #include <linux/highmem.h>
27 #include <linux/initrd.h>
28 #include <linux/pagemap.h>
29 #include <linux/suspend.h>
30 #include <linux/hugetlb.h>
31 #include <linux/slab.h>
32 #include <linux/vmalloc.h>
33 #include <linux/memremap.h>
34 #include <linux/dma-direct.h>
35 
36 #include <asm/pgalloc.h>
37 #include <asm/prom.h>
38 #include <asm/io.h>
39 #include <asm/mmu_context.h>
40 #include <asm/pgtable.h>
41 #include <asm/mmu.h>
42 #include <asm/smp.h>
43 #include <asm/machdep.h>
44 #include <asm/btext.h>
45 #include <asm/tlb.h>
46 #include <asm/sections.h>
47 #include <asm/sparsemem.h>
48 #include <asm/vdso.h>
49 #include <asm/fixmap.h>
50 #include <asm/swiotlb.h>
51 #include <asm/rtas.h>
52 #include <asm/kasan.h>
53 
54 #include <mm/mmu_decl.h>
55 
56 #ifndef CPU_FTR_COHERENT_ICACHE
57 #define CPU_FTR_COHERENT_ICACHE	0	/* XXX for now */
58 #define CPU_FTR_NOEXECUTE	0
59 #endif
60 
61 unsigned long long memory_limit;
62 bool init_mem_is_free;
63 
64 #ifdef CONFIG_HIGHMEM
65 pte_t *kmap_pte;
66 EXPORT_SYMBOL(kmap_pte);
67 pgprot_t kmap_prot;
68 EXPORT_SYMBOL(kmap_prot);
69 
70 static inline pte_t *virt_to_kpte(unsigned long vaddr)
71 {
72 	return pte_offset_kernel(pmd_offset(pud_offset(pgd_offset_k(vaddr),
73 			vaddr), vaddr), vaddr);
74 }
75 #endif
76 
77 pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
78 			      unsigned long size, pgprot_t vma_prot)
79 {
80 	if (ppc_md.phys_mem_access_prot)
81 		return ppc_md.phys_mem_access_prot(file, pfn, size, vma_prot);
82 
83 	if (!page_is_ram(pfn))
84 		vma_prot = pgprot_noncached(vma_prot);
85 
86 	return vma_prot;
87 }
88 EXPORT_SYMBOL(phys_mem_access_prot);
89 
90 #ifdef CONFIG_MEMORY_HOTPLUG
91 
92 #ifdef CONFIG_NUMA
93 int memory_add_physaddr_to_nid(u64 start)
94 {
95 	return hot_add_scn_to_nid(start);
96 }
97 #endif
98 
99 int __weak create_section_mapping(unsigned long start, unsigned long end, int nid)
100 {
101 	return -ENODEV;
102 }
103 
104 int __weak remove_section_mapping(unsigned long start, unsigned long end)
105 {
106 	return -ENODEV;
107 }
108 
109 #define FLUSH_CHUNK_SIZE SZ_1G
110 /**
111  * flush_dcache_range_chunked(): Write any modified data cache blocks out to
112  * memory and invalidate them, in chunks of up to FLUSH_CHUNK_SIZE
113  * Does not invalidate the corresponding instruction cache blocks.
114  *
115  * @start: the start address
116  * @stop: the stop address (exclusive)
117  * @chunk: the max size of the chunks
118  */
119 static void flush_dcache_range_chunked(unsigned long start, unsigned long stop,
120 				       unsigned long chunk)
121 {
122 	unsigned long i;
123 
124 	for (i = start; i < stop; i += chunk) {
125 		flush_dcache_range(i, min(stop, i + chunk));
126 		cond_resched();
127 	}
128 }
129 
130 int __ref arch_add_memory(int nid, u64 start, u64 size,
131 			struct mhp_restrictions *restrictions)
132 {
133 	unsigned long start_pfn = start >> PAGE_SHIFT;
134 	unsigned long nr_pages = size >> PAGE_SHIFT;
135 	int rc;
136 
137 	resize_hpt_for_hotplug(memblock_phys_mem_size());
138 
139 	start = (unsigned long)__va(start);
140 	rc = create_section_mapping(start, start + size, nid);
141 	if (rc) {
142 		pr_warn("Unable to create mapping for hot added memory 0x%llx..0x%llx: %d\n",
143 			start, start + size, rc);
144 		return -EFAULT;
145 	}
146 
147 	return __add_pages(nid, start_pfn, nr_pages, restrictions);
148 }
149 
150 void __ref arch_remove_memory(int nid, u64 start, u64 size,
151 			     struct vmem_altmap *altmap)
152 {
153 	unsigned long start_pfn = start >> PAGE_SHIFT;
154 	unsigned long nr_pages = size >> PAGE_SHIFT;
155 	int ret;
156 
157 	__remove_pages(start_pfn, nr_pages, altmap);
158 
159 	/* Remove htab bolted mappings for this section of memory */
160 	start = (unsigned long)__va(start);
161 	flush_dcache_range_chunked(start, start + size, FLUSH_CHUNK_SIZE);
162 
163 	ret = remove_section_mapping(start, start + size);
164 	WARN_ON_ONCE(ret);
165 
166 	/* Ensure all vmalloc mappings are flushed in case they also
167 	 * hit that section of memory
168 	 */
169 	vm_unmap_aliases();
170 
171 	if (resize_hpt_for_hotplug(memblock_phys_mem_size()) == -ENOSPC)
172 		pr_warn("Hash collision while resizing HPT\n");
173 }
174 #endif
175 
176 #ifndef CONFIG_NEED_MULTIPLE_NODES
177 void __init mem_topology_setup(void)
178 {
179 	max_low_pfn = max_pfn = memblock_end_of_DRAM() >> PAGE_SHIFT;
180 	min_low_pfn = MEMORY_START >> PAGE_SHIFT;
181 #ifdef CONFIG_HIGHMEM
182 	max_low_pfn = lowmem_end_addr >> PAGE_SHIFT;
183 #endif
184 
185 	/* Place all memblock_regions in the same node and merge contiguous
186 	 * memblock_regions
187 	 */
188 	memblock_set_node(0, PHYS_ADDR_MAX, &memblock.memory, 0);
189 }
190 
191 void __init initmem_init(void)
192 {
193 	/* XXX need to clip this if using highmem? */
194 	sparse_memory_present_with_active_regions(0);
195 	sparse_init();
196 }
197 
198 /* mark pages that don't exist as nosave */
199 static int __init mark_nonram_nosave(void)
200 {
201 	struct memblock_region *reg, *prev = NULL;
202 
203 	for_each_memblock(memory, reg) {
204 		if (prev &&
205 		    memblock_region_memory_end_pfn(prev) < memblock_region_memory_base_pfn(reg))
206 			register_nosave_region(memblock_region_memory_end_pfn(prev),
207 					       memblock_region_memory_base_pfn(reg));
208 		prev = reg;
209 	}
210 	return 0;
211 }
212 #else /* CONFIG_NEED_MULTIPLE_NODES */
213 static int __init mark_nonram_nosave(void)
214 {
215 	return 0;
216 }
217 #endif
218 
219 /*
220  * Zones usage:
221  *
222  * We setup ZONE_DMA to be 31-bits on all platforms and ZONE_NORMAL to be
223  * everything else. GFP_DMA32 page allocations automatically fall back to
224  * ZONE_DMA.
225  *
226  * By using 31-bit unconditionally, we can exploit zone_dma_bits to inform the
227  * generic DMA mapping code.  32-bit only devices (if not handled by an IOMMU
228  * anyway) will take a first dip into ZONE_NORMAL and get otherwise served by
229  * ZONE_DMA.
230  */
231 static unsigned long max_zone_pfns[MAX_NR_ZONES];
232 
233 /*
234  * paging_init() sets up the page tables - in fact we've already done this.
235  */
236 void __init paging_init(void)
237 {
238 	unsigned long long total_ram = memblock_phys_mem_size();
239 	phys_addr_t top_of_ram = memblock_end_of_DRAM();
240 
241 #ifdef CONFIG_HIGHMEM
242 	unsigned long v = __fix_to_virt(FIX_KMAP_END);
243 	unsigned long end = __fix_to_virt(FIX_KMAP_BEGIN);
244 
245 	for (; v < end; v += PAGE_SIZE)
246 		map_kernel_page(v, 0, __pgprot(0)); /* XXX gross */
247 
248 	map_kernel_page(PKMAP_BASE, 0, __pgprot(0));	/* XXX gross */
249 	pkmap_page_table = virt_to_kpte(PKMAP_BASE);
250 
251 	kmap_pte = virt_to_kpte(__fix_to_virt(FIX_KMAP_BEGIN));
252 	kmap_prot = PAGE_KERNEL;
253 #endif /* CONFIG_HIGHMEM */
254 
255 	printk(KERN_DEBUG "Top of RAM: 0x%llx, Total RAM: 0x%llx\n",
256 	       (unsigned long long)top_of_ram, total_ram);
257 	printk(KERN_DEBUG "Memory hole size: %ldMB\n",
258 	       (long int)((top_of_ram - total_ram) >> 20));
259 
260 	/*
261 	 * Allow 30-bit DMA for very limited Broadcom wifi chips on many
262 	 * powerbooks.
263 	 */
264 	if (IS_ENABLED(CONFIG_PPC32))
265 		zone_dma_bits = 30;
266 	else
267 		zone_dma_bits = 31;
268 
269 #ifdef CONFIG_ZONE_DMA
270 	max_zone_pfns[ZONE_DMA]	= min(max_low_pfn,
271 				      1UL << (zone_dma_bits - PAGE_SHIFT));
272 #endif
273 	max_zone_pfns[ZONE_NORMAL] = max_low_pfn;
274 #ifdef CONFIG_HIGHMEM
275 	max_zone_pfns[ZONE_HIGHMEM] = max_pfn;
276 #endif
277 
278 	free_area_init_nodes(max_zone_pfns);
279 
280 	mark_nonram_nosave();
281 }
282 
283 void __init mem_init(void)
284 {
285 	/*
286 	 * book3s is limited to 16 page sizes due to encoding this in
287 	 * a 4-bit field for slices.
288 	 */
289 	BUILD_BUG_ON(MMU_PAGE_COUNT > 16);
290 
291 #ifdef CONFIG_SWIOTLB
292 	/*
293 	 * Some platforms (e.g. 85xx) limit DMA-able memory way below
294 	 * 4G. We force memblock to bottom-up mode to ensure that the
295 	 * memory allocated in swiotlb_init() is DMA-able.
296 	 * As it's the last memblock allocation, no need to reset it
297 	 * back to to-down.
298 	 */
299 	memblock_set_bottom_up(true);
300 	swiotlb_init(0);
301 #endif
302 
303 	high_memory = (void *) __va(max_low_pfn * PAGE_SIZE);
304 	set_max_mapnr(max_pfn);
305 
306 	kasan_late_init();
307 
308 	memblock_free_all();
309 
310 #ifdef CONFIG_HIGHMEM
311 	{
312 		unsigned long pfn, highmem_mapnr;
313 
314 		highmem_mapnr = lowmem_end_addr >> PAGE_SHIFT;
315 		for (pfn = highmem_mapnr; pfn < max_mapnr; ++pfn) {
316 			phys_addr_t paddr = (phys_addr_t)pfn << PAGE_SHIFT;
317 			struct page *page = pfn_to_page(pfn);
318 			if (!memblock_is_reserved(paddr))
319 				free_highmem_page(page);
320 		}
321 	}
322 #endif /* CONFIG_HIGHMEM */
323 
324 #if defined(CONFIG_PPC_FSL_BOOK3E) && !defined(CONFIG_SMP)
325 	/*
326 	 * If smp is enabled, next_tlbcam_idx is initialized in the cpu up
327 	 * functions.... do it here for the non-smp case.
328 	 */
329 	per_cpu(next_tlbcam_idx, smp_processor_id()) =
330 		(mfspr(SPRN_TLB1CFG) & TLBnCFG_N_ENTRY) - 1;
331 #endif
332 
333 	mem_init_print_info(NULL);
334 #ifdef CONFIG_PPC32
335 	pr_info("Kernel virtual memory layout:\n");
336 #ifdef CONFIG_KASAN
337 	pr_info("  * 0x%08lx..0x%08lx  : kasan shadow mem\n",
338 		KASAN_SHADOW_START, KASAN_SHADOW_END);
339 #endif
340 	pr_info("  * 0x%08lx..0x%08lx  : fixmap\n", FIXADDR_START, FIXADDR_TOP);
341 #ifdef CONFIG_HIGHMEM
342 	pr_info("  * 0x%08lx..0x%08lx  : highmem PTEs\n",
343 		PKMAP_BASE, PKMAP_ADDR(LAST_PKMAP));
344 #endif /* CONFIG_HIGHMEM */
345 	if (ioremap_bot != IOREMAP_TOP)
346 		pr_info("  * 0x%08lx..0x%08lx  : early ioremap\n",
347 			ioremap_bot, IOREMAP_TOP);
348 	pr_info("  * 0x%08lx..0x%08lx  : vmalloc & ioremap\n",
349 		VMALLOC_START, VMALLOC_END);
350 #endif /* CONFIG_PPC32 */
351 }
352 
353 void free_initmem(void)
354 {
355 	ppc_md.progress = ppc_printk_progress;
356 	mark_initmem_nx();
357 	init_mem_is_free = true;
358 	free_initmem_default(POISON_FREE_INITMEM);
359 }
360 
361 /**
362  * flush_coherent_icache() - if a CPU has a coherent icache, flush it
363  * @addr: The base address to use (can be any valid address, the whole cache will be flushed)
364  * Return true if the cache was flushed, false otherwise
365  */
366 static inline bool flush_coherent_icache(unsigned long addr)
367 {
368 	/*
369 	 * For a snooping icache, we still need a dummy icbi to purge all the
370 	 * prefetched instructions from the ifetch buffers. We also need a sync
371 	 * before the icbi to order the the actual stores to memory that might
372 	 * have modified instructions with the icbi.
373 	 */
374 	if (cpu_has_feature(CPU_FTR_COHERENT_ICACHE)) {
375 		mb(); /* sync */
376 		icbi((void *)addr);
377 		mb(); /* sync */
378 		isync();
379 		return true;
380 	}
381 
382 	return false;
383 }
384 
385 /**
386  * invalidate_icache_range() - Flush the icache by issuing icbi across an address range
387  * @start: the start address
388  * @stop: the stop address (exclusive)
389  */
390 static void invalidate_icache_range(unsigned long start, unsigned long stop)
391 {
392 	unsigned long shift = l1_icache_shift();
393 	unsigned long bytes = l1_icache_bytes();
394 	char *addr = (char *)(start & ~(bytes - 1));
395 	unsigned long size = stop - (unsigned long)addr + (bytes - 1);
396 	unsigned long i;
397 
398 	for (i = 0; i < size >> shift; i++, addr += bytes)
399 		icbi(addr);
400 
401 	mb(); /* sync */
402 	isync();
403 }
404 
405 /**
406  * flush_icache_range: Write any modified data cache blocks out to memory
407  * and invalidate the corresponding blocks in the instruction cache
408  *
409  * Generic code will call this after writing memory, before executing from it.
410  *
411  * @start: the start address
412  * @stop: the stop address (exclusive)
413  */
414 void flush_icache_range(unsigned long start, unsigned long stop)
415 {
416 	if (flush_coherent_icache(start))
417 		return;
418 
419 	clean_dcache_range(start, stop);
420 
421 	if (IS_ENABLED(CONFIG_44x)) {
422 		/*
423 		 * Flash invalidate on 44x because we are passed kmapped
424 		 * addresses and this doesn't work for userspace pages due to
425 		 * the virtually tagged icache.
426 		 */
427 		iccci((void *)start);
428 		mb(); /* sync */
429 		isync();
430 	} else
431 		invalidate_icache_range(start, stop);
432 }
433 EXPORT_SYMBOL(flush_icache_range);
434 
435 #if !defined(CONFIG_PPC_8xx) && !defined(CONFIG_PPC64)
436 /**
437  * flush_dcache_icache_phys() - Flush a page by it's physical address
438  * @physaddr: the physical address of the page
439  */
440 static void flush_dcache_icache_phys(unsigned long physaddr)
441 {
442 	unsigned long bytes = l1_dcache_bytes();
443 	unsigned long nb = PAGE_SIZE / bytes;
444 	unsigned long addr = physaddr & PAGE_MASK;
445 	unsigned long msr, msr0;
446 	unsigned long loop1 = addr, loop2 = addr;
447 
448 	msr0 = mfmsr();
449 	msr = msr0 & ~MSR_DR;
450 	/*
451 	 * This must remain as ASM to prevent potential memory accesses
452 	 * while the data MMU is disabled
453 	 */
454 	asm volatile(
455 		"   mtctr %2;\n"
456 		"   mtmsr %3;\n"
457 		"   isync;\n"
458 		"0: dcbst   0, %0;\n"
459 		"   addi    %0, %0, %4;\n"
460 		"   bdnz    0b;\n"
461 		"   sync;\n"
462 		"   mtctr %2;\n"
463 		"1: icbi    0, %1;\n"
464 		"   addi    %1, %1, %4;\n"
465 		"   bdnz    1b;\n"
466 		"   sync;\n"
467 		"   mtmsr %5;\n"
468 		"   isync;\n"
469 		: "+&r" (loop1), "+&r" (loop2)
470 		: "r" (nb), "r" (msr), "i" (bytes), "r" (msr0)
471 		: "ctr", "memory");
472 }
473 #endif // !defined(CONFIG_PPC_8xx) && !defined(CONFIG_PPC64)
474 
475 /*
476  * This is called when a page has been modified by the kernel.
477  * It just marks the page as not i-cache clean.  We do the i-cache
478  * flush later when the page is given to a user process, if necessary.
479  */
480 void flush_dcache_page(struct page *page)
481 {
482 	if (cpu_has_feature(CPU_FTR_COHERENT_ICACHE))
483 		return;
484 	/* avoid an atomic op if possible */
485 	if (test_bit(PG_arch_1, &page->flags))
486 		clear_bit(PG_arch_1, &page->flags);
487 }
488 EXPORT_SYMBOL(flush_dcache_page);
489 
490 void flush_dcache_icache_page(struct page *page)
491 {
492 #ifdef CONFIG_HUGETLB_PAGE
493 	if (PageCompound(page)) {
494 		flush_dcache_icache_hugepage(page);
495 		return;
496 	}
497 #endif
498 #if defined(CONFIG_PPC_8xx) || defined(CONFIG_PPC64)
499 	/* On 8xx there is no need to kmap since highmem is not supported */
500 	__flush_dcache_icache(page_address(page));
501 #else
502 	if (IS_ENABLED(CONFIG_BOOKE) || sizeof(phys_addr_t) > sizeof(void *)) {
503 		void *start = kmap_atomic(page);
504 		__flush_dcache_icache(start);
505 		kunmap_atomic(start);
506 	} else {
507 		unsigned long addr = page_to_pfn(page) << PAGE_SHIFT;
508 
509 		if (flush_coherent_icache(addr))
510 			return;
511 		flush_dcache_icache_phys(addr);
512 	}
513 #endif
514 }
515 EXPORT_SYMBOL(flush_dcache_icache_page);
516 
517 /**
518  * __flush_dcache_icache(): Flush a particular page from the data cache to RAM.
519  * Note: this is necessary because the instruction cache does *not*
520  * snoop from the data cache.
521  *
522  * @page: the address of the page to flush
523  */
524 void __flush_dcache_icache(void *p)
525 {
526 	unsigned long addr = (unsigned long)p;
527 
528 	if (flush_coherent_icache(addr))
529 		return;
530 
531 	clean_dcache_range(addr, addr + PAGE_SIZE);
532 
533 	/*
534 	 * We don't flush the icache on 44x. Those have a virtual icache and we
535 	 * don't have access to the virtual address here (it's not the page
536 	 * vaddr but where it's mapped in user space). The flushing of the
537 	 * icache on these is handled elsewhere, when a change in the address
538 	 * space occurs, before returning to user space.
539 	 */
540 
541 	if (cpu_has_feature(MMU_FTR_TYPE_44x))
542 		return;
543 
544 	invalidate_icache_range(addr, addr + PAGE_SIZE);
545 }
546 
547 void clear_user_page(void *page, unsigned long vaddr, struct page *pg)
548 {
549 	clear_page(page);
550 
551 	/*
552 	 * We shouldn't have to do this, but some versions of glibc
553 	 * require it (ld.so assumes zero filled pages are icache clean)
554 	 * - Anton
555 	 */
556 	flush_dcache_page(pg);
557 }
558 EXPORT_SYMBOL(clear_user_page);
559 
560 void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
561 		    struct page *pg)
562 {
563 	copy_page(vto, vfrom);
564 
565 	/*
566 	 * We should be able to use the following optimisation, however
567 	 * there are two problems.
568 	 * Firstly a bug in some versions of binutils meant PLT sections
569 	 * were not marked executable.
570 	 * Secondly the first word in the GOT section is blrl, used
571 	 * to establish the GOT address. Until recently the GOT was
572 	 * not marked executable.
573 	 * - Anton
574 	 */
575 #if 0
576 	if (!vma->vm_file && ((vma->vm_flags & VM_EXEC) == 0))
577 		return;
578 #endif
579 
580 	flush_dcache_page(pg);
581 }
582 
583 void flush_icache_user_range(struct vm_area_struct *vma, struct page *page,
584 			     unsigned long addr, int len)
585 {
586 	unsigned long maddr;
587 
588 	maddr = (unsigned long) kmap(page) + (addr & ~PAGE_MASK);
589 	flush_icache_range(maddr, maddr + len);
590 	kunmap(page);
591 }
592 EXPORT_SYMBOL(flush_icache_user_range);
593 
594 /*
595  * System memory should not be in /proc/iomem but various tools expect it
596  * (eg kdump).
597  */
598 static int __init add_system_ram_resources(void)
599 {
600 	struct memblock_region *reg;
601 
602 	for_each_memblock(memory, reg) {
603 		struct resource *res;
604 		unsigned long base = reg->base;
605 		unsigned long size = reg->size;
606 
607 		res = kzalloc(sizeof(struct resource), GFP_KERNEL);
608 		WARN_ON(!res);
609 
610 		if (res) {
611 			res->name = "System RAM";
612 			res->start = base;
613 			res->end = base + size - 1;
614 			res->flags = IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY;
615 			WARN_ON(request_resource(&iomem_resource, res) < 0);
616 		}
617 	}
618 
619 	return 0;
620 }
621 subsys_initcall(add_system_ram_resources);
622 
623 #ifdef CONFIG_STRICT_DEVMEM
624 /*
625  * devmem_is_allowed(): check to see if /dev/mem access to a certain address
626  * is valid. The argument is a physical page number.
627  *
628  * Access has to be given to non-kernel-ram areas as well, these contain the
629  * PCI mmio resources as well as potential bios/acpi data regions.
630  */
631 int devmem_is_allowed(unsigned long pfn)
632 {
633 	if (page_is_rtas_user_buf(pfn))
634 		return 1;
635 	if (iomem_is_exclusive(PFN_PHYS(pfn)))
636 		return 0;
637 	if (!page_is_ram(pfn))
638 		return 1;
639 	return 0;
640 }
641 #endif /* CONFIG_STRICT_DEVMEM */
642 
643 /*
644  * This is defined in kernel/resource.c but only powerpc needs to export it, for
645  * the EHEA driver. Drop this when drivers/net/ethernet/ibm/ehea is removed.
646  */
647 EXPORT_SYMBOL_GPL(walk_system_ram_range);
648