diff --git a/Makefile b/Makefile
index 5cd5be0..ef49580 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,10 @@
-all:
+all: build
+
+build:
 	latexmk -xelatex -pdf slides.tex
 
 clean:
 	rm -f *aux *bbl *bcf *blg *_latexmk *fls *log *out *.run.xml
+
+upload: build
+	scp slides.pdf www.tobast:~/files/sweden18.pdf
diff --git a/slides.tex b/slides.tex
index e369c38..969e7cb 100644
--- a/slides.tex
+++ b/slides.tex
@@ -42,7 +42,7 @@
 \newcommand{\cmark}{\color{OliveGreen}\ding{52}}
 \newcommand{\xmark}{\color{BrickRed}\ding{56}}
 
-\AtBeginSection[]{
+\AtBeginSection{
     \begin{frame}
         \vfill
         \centering
@@ -86,10 +86,8 @@
 
     \vspace{-2em}
     \begin{center}
-            \todo{}
         \begin{align*}
-            \text{Slides: } &\text{\url{https://tobast.fr/m2/slides.pdf}} \\
-            \text{Report: } &\text{\url{https://tobast.fr/m2/report.pdf}}
+            \text{Slides: } &\text{\url{https://tobast.fr/files/sweden18.pdf}} \\
         \end{align*}
     \end{center}
 \end{frame}
@@ -292,25 +290,28 @@ $1 = 84
     \end{center}
 \end{frame}
 
-\begin{frame}{A debugging hell: Linux kernel}
+\newcommand{\LinusMailOne}{
     ``Sorry, but last time was too f\dots painful. The whole (and
     only) point of unwinders is to make debugging easy
     when a bug occurs. But \alert{the dwarf unwinder had bugs}
     itself, or \alert{our dwarf information had bugs}, and in either
     case it actually turned several trivial bugs into a \alert{total
     undebuggable hell}.''
-
-    \vspace{1em}
-    \only<1>{\hfill ---~Linus Torvalds, Kernel mailing list, 2012}
-    \pause{}
-
+}
+\newcommand{\LinusMailTwo}{
     ``If you can \alert{mathematically prove that the unwinder is
     correct} — even in the presence of bogus and actively
     incorrect unwinding information — and never ever
     follows a bad pointer, \alert{I’ll reconsider}.''
+}
+\newcommand{\LinusSource}{
+    \hfill ---~Linus Torvalds, Kernel mailing list, 2012
+}
+\begin{frame}{A debugging hell: Linux kernel}
+    \LinusMailOne{}
 
     \vspace{1em}
-    \hfill ---~Linus Torvalds, Kernel mailing list, 2012
+    \LinusSource{}
 
     \pause{}\vspace{1em}
     \begin{center}
@@ -552,9 +553,92 @@ $1 = 84
             \begin{itemize}
                 \item[$\leadsto$] only \cfa{} tracking matters (for unwinding)
             \end{itemize}
+        \item We had a working strategy for a \alert{linear execution}
+        \item We still have to handle
+            \begin{itemize}
+                \item \alert{\cfa{} expression}
+                \item \alert{control flow graph}
+            \end{itemize}
     \end{itemize}
 \end{frame}
 
+\begin{frame}{\cfa{} expression}
+    Two possibilities:
+    \begin{itemize}
+        \item Either \reg{rbp} is used as base pointer \pause{}
+        \item Or we must track \cfa{} wrt. \reg{rsp}
+            \begin{itemize}
+                \item And update it after each instruction if needed
+            \end{itemize}
+    \end{itemize}
+\end{frame}
+
+\begin{frame}{Control flow graph}
+    \begin{columns}[c]
+        \column{0.4\textwidth}
+        \lstinputlisting[language=C]{src/cfg/cfg.c}
+
+        \pause{}
+        \column{0.30\textwidth}
+        \begin{figure}
+            \centering
+            \includegraphics[width=\textwidth]{src/cfg/cfg.png}
+        \end{figure}
+    \end{columns}
+
+    \pause{}
+
+    \begin{itemize}
+        \item \alert{Upon split} (eg. \texttt{X})\alert{:} nothing special,
+            propagate end state of X to children nodes A and B
+        \item \alert{Upon join} (eg.\texttt{while\_end})\alert{:} check
+            consistency of both input states
+            \begin{itemize}
+                \item If tricky, \texttt{gcc} will have used \reg{rbp}, even
+                    with \texttt{-fomit-frame-pointer}.
+            \end{itemize}
+    \end{itemize}
+
+\end{frame}
+
+\renewcommand{\tblrowval}[4]{#1 & #2 & #3 & #4 \\}
+\begin{frame}{Trust the compiler to avoid tricky unwinding}
+    \begin{columns}[c]
+        \column{0.55\textwidth}
+        \lstinputlisting[language=C,firstline=3,lastline=7]
+            {src/use_rbp/use_rbp.c}
+
+        \pause{}
+        \begin{itemize}
+            \item At each loop cycle, \alert{\texttt{y} is larger} and
+                \alert{allocated on the stack}
+            \item Thus, \reg{rsp} is \alert{farther from \cfa} at each cycle: no
+                constant rule $\cfa = \reg{rsp} + k$.
+            \item A complex DWARF expression is possible, but
+                \alert{the compiler won't}.
+        \end{itemize}
+
+        \pause{}
+        \column{0.45\textwidth}
+        \lstbash{\$ gcc -O0 -g -c src.c -fomit-frame-pointer}
+
+        \vspace{1em}
+
+        \begin{center}
+            \tt
+            \begin{tabular}{l l l l}
+                \tblrowval{LOC} {CFA}      {rbp}    {ra}
+                \tblrowval{000} {rsp+8}    {u}      {c-8}
+                \tblrowval{001} {rsp+16}   {c-16}   {c-8}
+                \tblrowval{004} {\alert{rbp}+16}   {c-16}   {c-8}
+                \tblrowval{010} {\alert{rbp}+16}   {c-16}   {c-8}
+                \tblrowval{0ce} {rsp+8}    {c-16}   {c-8}
+            \end{tabular}
+        \end{center}
+
+    \end{columns}
+\end{frame}
+
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 \section{Unwinding data compilation}
 
@@ -664,23 +748,6 @@ $1 = 84
 \end{frame}
 
 
-\begin{frame}[t]{A word on formalization}
-    \begin{itemize}
-        \item First task: \alert{writing semantics} for DWARF, written  as
-            mapping to C code.
-        \item DWARF5 specification: \alert{plain English}, no proper semantics
-        \item Compiled code is in substance equivalent to semantics
-        \item What remains to prove is mostly \alert{simple or classic
-            optimisations}
-    \end{itemize}
-
-    \pause{}
-    \vspace{-3cm}
-    \begin{center}
-        \includegraphics[width=0.8\linewidth, angle=10]{img/dw_spec.png}
-    \end{center}
-\end{frame}
-
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 \subsection{Benchmarking}
 
@@ -697,7 +764,7 @@ $1 = 84
 
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 \begin{frame}{perf instrumentation}
-    \textbf{\alert{perf} is the state-of-the-art polling profiler for Linux.}
+    \textbf{\alert{perf} is a state-of-the-art polling profiler for Linux.}
     \begin{itemize}
         \item{} used to get readings of the time spent in each function
         \item{} works by regularly stopping the program, unwinding its stack,
@@ -782,27 +849,28 @@ $1 = 84
 \end{frame}
 
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
-\section*{}
+\section*{Conclusion}
 \setcounter{section}{0}
 
-\begin{frame}{What next?}
-    \begin{itemize}
-        \item Implement a release-ready, packageable, easy to use version of
-            perf with \ehelfs{} and submit it for inclusion
+\begin{frame}{}
+    \LinusMailOne{}
 
-        \item{} Measure \alert{C++ exceptions overhead} precisely in common
-            software
+    \only<1>{\LinusSource{}}
+    \only<2->\vspace{1em}
+    \pause{}
 
-        \item{} Implement \alert{\ehelfs{}} support for \alert{C++ runtime}
-            exception handling, and other systems where unwinding is a
-            performance bottleneck
+    \LinusMailTwo{}
 
-        \medskip
+    \LinusSource{}
 
-        \item \alert{Outlining} was effective for
-            compactness\ldots{} Try outlining DWARF bytecode\@?
+    \pause{}
+    \vspace{1em}
+
+    \begin{center}
+        \bf
+        Give us a few months to make Linus reconsider \texttt{;)}
+    \end{center}
 
-    \end{itemize}
 \end{frame}
 
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
@@ -814,8 +882,7 @@ $1 = 84
     \begin{center}
         \large
         \begin{align*}
-            \textbf{Slides: } &\text{\url{https://tobast.fr/m2/slides.pdf}} \\
-            \textbf{Report: } &\text{\url{https://tobast.fr/m2/report.pdf}}
+            \textbf{Slides: } &\text{\url{https://tobast.fr/files/sweden18.pdf}} \\
         \end{align*}
     \end{center}
 
diff --git a/src/cfg/cfg.c b/src/cfg/cfg.c
new file mode 100644
index 0000000..251f0b0
--- /dev/null
+++ b/src/cfg/cfg.c
@@ -0,0 +1,8 @@
+while(/* ... */) {
+    X;
+    if(/* ... */) {
+        A;
+    } else {
+        B;
+    }
+}
diff --git a/src/cfg/cfg.dot b/src/cfg/cfg.dot
new file mode 100644
index 0000000..70460a6
--- /dev/null
+++ b/src/cfg/cfg.dot
@@ -0,0 +1,8 @@
+digraph {
+    while_beg -> X;
+    X -> A;
+    X -> B;
+    A -> while_end;
+    B -> while_end;
+    while_end -> while_beg;
+}
diff --git a/src/cfg/cfg.png b/src/cfg/cfg.png
new file mode 100644
index 0000000..398b3b3
Binary files /dev/null and b/src/cfg/cfg.png differ
diff --git a/src/use_rbp/use_rbp.c b/src/use_rbp/use_rbp.c
new file mode 100644
index 0000000..fe31512
--- /dev/null
+++ b/src/use_rbp/use_rbp.c
@@ -0,0 +1,8 @@
+#include <stdlib.h>
+int main() {
+int z = rand();
+for(int x=1; x < z; ++x) {
+    int y[x]; // Variable size
+    /* do something */
+}
+}
diff --git a/src/use_rbp/use_rbp.fde b/src/use_rbp/use_rbp.fde
new file mode 100644
index 0000000..9f8a96e
--- /dev/null
+++ b/src/use_rbp/use_rbp.fde
@@ -0,0 +1,8 @@
+\begin{tabular}{l l l l}
+\tblrowval{LOC} {CFA}      {rbp}    {ra}
+\tblrowval{000} {rsp+8}    {u}      {c-8}
+\tblrowval{001} {rsp+16}   {c-16}   {c-8}
+\tblrowval{004} {rbp+16}   {c-16}   {c-8}
+\tblrowval{010} {rbp+16}   {c-16}   {c-8}
+\tblrowval{0ce} {rsp+8}    {c-16}   {c-8}
+\end{tabular}