buildrun: stop adding our own -Wframe-larger-than=XYZ CFLAGS
linux kbuild has included a CONFIG_FRAME_WARN option for some time,
which adds a -Wframe-larger-than=$(...) CFLAGS. Until this patch,
systemtap used to add one of its own, on the theory that our generated
code really should not have large stack frames. This is partly
assured by use of preallocated per-cpu "struct context" structures, so
our warning was a belt-and-suspenders protection. However, this lower
limit is not sufficient any more.
On rawhide (linux 5.11, gcc 11), KASAN etc. makes the stack-frame of
the unwind_frame() function about 700 bytes, which is easily within
the CONFIG_FRAME_WARN but larger than 512. We now just defer to
kbuild's wisdom.
William Cohen [Mon, 1 Feb 2021 03:16:49 +0000 (22:16 -0500)]
Add CONFIG_COMPAT 32-bit support for aarch64 and powerpc
The aarch64 and powerpc kernels may be built with support for 32-bit
user-space applications. On Fedora 33 the aarch64 kernel is
configured with CONFIG_COMPAT enabled. Needed to provide some support
in _stp_is_compat_task2 for the aarch64. The Fedora 33 ppc64le
kernels by default do not have CONFIG_COMPAT enabled, but included
similar check in there for powerpc in case locally built kernels
enable it.
Frank Ch. Eigler [Fri, 29 Jan 2021 03:12:48 +0000 (22:12 -0500)]
PR27273: port to linux 5.11
Main change is removal/movement of TIF_IA32 in linux commit ff170cd05953
and nearby. Now using single a central wrapper _stp_is_compat_task() and
_stp_is_compat_task2() functions, instead of sprinkling
test_tsk_thread_flag(...) around the code base.
Also, suppressing CONFIG_DEBUG_INFO_BTF_MODULES generation for stap
modules, for diagnostic noise reduction.
Frank Ch. Eigler [Tue, 26 Jan 2021 16:09:53 +0000 (11:09 -0500)]
PR27251: support buildid probing on --x--x--x perm binaries
We need to delegate to executable searches to debuginfod for binaries
that exist on the local system, but are unreadable. Correcting
util.cxx access(3) checks from X_OK -> R_OK to avoid relying on
unreadable links/binaries, which results in stap being unable to probe
them at all. This can come up for probing some setuid programs.
Serhei Makarov [Mon, 25 Jan 2021 18:29:58 +0000 (13:29 -0500)]
bpf-translate.cxx WIP bugfix for PR27030: delay adjusted_toks deallocation
Identified more diagnostic data (adjusted BPF assembler tokens)
that the BPF translator was deallocating prematurely on exception throw.
For now, fix the problem by keeping deallocation disabled
entirely. Only other solution I can think of is to catch and re-throw
any semantic error, copying the adjusted token at that point to
keep it from being deallocated.
Frank Ch. Eigler [Sun, 24 Jan 2021 19:45:54 +0000 (14:45 -0500)]
PR27067: set procfs traceNN files' uid/gid too
commit e3d03db828 neglected to include the proper calls to set the
procfs traceNN files to the correct uid/gid ownership. With those
files left as uid/gid=0/0, stapio running with a user with
stapusr/stapdev privileges couldn't fopenat() those files. Now they
can again. This problem became obvious after commit 4706ab3ca5c0,
which makes STAP_TRANS_PROCFS the default.
bugfix: unwinder: expr: DW_OP_push*: we forgot to push the result to the dwarf stack.
Most of the assembly routines in OpenSSL's libcrypto would produce unwinder failures
and the warning "WARNING: DWARF expression stack underflow in CFI" due to this bug.
Sultan Alsawaf [Fri, 22 Jan 2021 23:19:33 +0000 (15:19 -0800)]
runtime: utilize relay subbufs as much as possible
The relay subbufs used for printing are used very inefficiently, causing
print messages to be frequently dropped. The cause for this inefficiency
is that every time a print flush occurs, the current subbuf is switched
out even if it isn't filled. We can't wait for a subbuf to fill up
before switching it out either, or messages will be delayed.
To remedy this, we instead check to see if there's any data in any
subbuf and use that as an indicator to staprun to tell if there's data
available to read. Then when staprun attempts to read the data out, we
can switch out the current subbuf if it has data in it. This lets us
squeeze out every bit of storage from the subbufs.
Any print drops experienced after this patch should be fixed by
increasing the subbuf count (_stp_nsubbufs).
Sultan Alsawaf [Fri, 22 Jan 2021 18:46:22 +0000 (10:46 -0800)]
runtime: default to using procfs for the transport
Using debugfs for the transport results in a multitude of bugs when
running stap modules in parallel. The bugs include debugfs outright
failing, warnings hit in fs/inode.c, and kernel panics. Since procfs has
been more stable over the years, default to using it for the transport
instead of debugfs. Using procfs resolves the issues faced with debugfs.
Sultan Alsawaf [Wed, 20 Jan 2021 20:55:40 +0000 (12:55 -0800)]
stp_utrace: remove unneeded RCU-freed field from struct utrace
We're only using RCU on struct utrace in order to allow non-blocking
iteration through the hashlists. RCU is not used to manage the lifetime
of utrace structs; once a utrace struct is ready to be freed, nothing
will try to grab it anymore, so we can remove the unneeded utrace->freed
check.
Sultan Alsawaf [Wed, 20 Jan 2021 20:51:19 +0000 (12:51 -0800)]
stp_utrace: remove kmem cache usage
Some kernels appear to have trouble registering the same kmem_cache in
parallel, resulting in the following error as well as some other mayhem,
such as staprun hangs and kernel freezes:
sysfs: cannot create duplicate filename '/kernel/slab/:0000144'
This occurs when stap modules are registered in parallel with one
another.
The justification for using kmem caches in utrace is that the utrace
struct sizes are not powers of 2, and a lot of them can be allocated, so
leaving them to the kernel's default kmem caches can waste quite a bit
of memory. However, this is only a problem for the utrace struct, and
not really the utrace_engine struct, as the utrace_engine struct is 56
bytes on 64-bit, and can be allocated by the kernel's internal 64-byte
kmem cache with only 8 bytes wasted per allocation.
The same cannot be said for the utrace struct, since it's 144 bytes. It
would therefore be allocated from the 256-byte kmem cache, resulting in
112 bytes wasted per allocation. We can remedy this by reusing existing
memory in the struct for the 16-byte RCU callback head, bringing the
overall struct size down to 128 bytes and thus eliminating the need for
a kmem cache. This is safe because the reused struct members are no
longer used once the struct is ready to be freed.
This also eliminates a pesky rcu_barrier() we no longer required.
Martin Cermak [Wed, 20 Jan 2021 21:09:49 +0000 (22:09 +0100)]
systemtap-service onboot: Skip updating the bootloader
It shows up that just modifying the default initrd is good enough,
no need to call kernel-install or new-kernel-pkg. This speeds up
the systemtap-service onboot operation.
Sultan Alsawaf [Tue, 19 Jan 2021 23:36:24 +0000 (15:36 -0800)]
stp_utrace: add missing rcu_read_unlock() in get_utrace_lock() error path
This bug was introduced in 619f6940d ("PR26697: fix NULL pointer deref
in get_utrace_lock()), which was my first stap commit, and subsequently
where this project started going downhill as a result.
Sultan Alsawaf [Tue, 19 Jan 2021 23:00:50 +0000 (15:00 -0800)]
stp_utrace: remove kmem cache usage
Some kernels appear to have trouble registering the same kmem_cache in
parallel, resulting in the following error as well as some other mayhem,
such as staprun hangs and kernel freezes:
sysfs: cannot create duplicate filename '/kernel/slab/:0000144'
This occurs when stap modules are registered in parallel with one
another.
The justification for using kmem caches in utrace is that the utrace
struct sizes are not powers of 2, and a lot of them can be allocated, so
leaving them to the kernel's default kmem caches can waste quite a bit
of memory. However, this is only a problem for the utrace struct, and
not really the utrace_engine struct, as the utrace_engine struct is 56
bytes on 64-bit, and can be allocated by the kernel's internal 64-byte
kmem cache with only 8 bytes wasted per allocation.
The same cannot be said for the utrace struct, since it's 144 bytes. It
would therefore be allocated from the 256-byte kmem cache, resulting in
112 bytes wasted per allocation. We can remedy this by reusing existing
memory in the struct for the 16-byte RCU callback head, bringing the
overall struct size down to 128 bytes and thus eliminating the need for
a kmem cache. This is safe because the reused struct members are no
longer used once the struct is ready to be freed.
This also eliminates a pesky rcu_barrier() we no longer required.
Craig Ringer [Sat, 16 Jan 2021 00:08:55 +0000 (19:08 -0500)]
PR27185: conversions.exp test enhancements
I've adjusted the stress tests referenced in
systemtap.stress/conversions.exp to make them more concise and allow
all the test definitions to be shared across each variant.
In order to avoid a use-after-free bug, we must remove the pde before
doing the path_put(), even though this contradicts what one would
naturally think the ordering should be.
This fixes the following KASAN splat:
BUG: KASAN: use-after-free in proc_remove+0x7b/0x80
Read of size 8 at addr ffff8882dc3b00b8 by task staprun-d/6732
CPU: 7 PID: 6732 Comm: staprun-d Tainted: G OE --------- - - 4.18.0-259.el8.x86_64+debug #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014
Call Trace:
dump_stack+0x8e/0xd0
print_address_description.constprop.3+0x1f/0x300
__kasan_report.cold.7+0x76/0xbf
? proc_remove+0x7b/0x80
kasan_report+0xe/0x20
proc_remove+0x7b/0x80
__stp_procfs_relay_remove_buf_file_callback+0x254/0x346 [orxray_libc_usleep_XX_6587]
? __stp_procfs_relay_remove_buf_file_callback+0x346/0x346 [orxray_libc_usleep_XX_6587]
? __stp_relay_remove_buf_file_callback+0x28/0x29 [orxray_libc_usleep_XX_6587]
? relay_close_buf+0xe0/0x130
? relay_close+0x14f/0x470
? _stp_transport_data_fs_close+0x1b/0x27 [orxray_libc_usleep_XX_6587]
? _stp_procfs_transport_fs_close+0xa/0xb [orxray_libc_usleep_XX_6587]
? _stp_transport_fs_close+0x24/0x26 [orxray_libc_usleep_XX_6587]
? _stp_transport_close+0x1e/0x24 [orxray_libc_usleep_XX_6587]
? cleanup_module+0xa/0xb [orxray_libc_usleep_XX_6587]
? __x64_sys_delete_module+0x2cc/0x4a0
? __ia32_sys_delete_module+0x4a0/0x4a0
? lockdep_hardirqs_on_prepare+0x343/0x4f0
? do_syscall_64+0x22/0x420
? do_syscall_64+0xa5/0x420
? entry_SYSCALL_64_after_hwframe+0x6a/0xdf
Allocated by task 6587:
save_stack+0x19/0x80
__kasan_kmalloc.constprop.10+0xc1/0xd0
kmem_cache_alloc+0xfe/0x350
__proc_create+0x1f6/0x740
proc_create_reg+0x61/0x100
proc_create_data+0x79/0xf0
__stp_procfs_relay_create_buf_file_callback+0xcb/0x43e [orxray_libc_usleep_XX_6587]
Freed by task 6732:
save_stack+0x19/0x80
__kasan_slab_free+0x125/0x170
kmem_cache_free+0xcd/0x360
proc_evict_inode+0x73/0x100
evict+0x29e/0x590
__dentry_kill+0x326/0x5a0
dentry_kill+0x94/0x410
dput+0x3b0/0x4a0
path_put+0x2d/0x60
__stp_procfs_relay_remove_buf_file_callback+0x24c/0x346 [orxray_libc_usleep_XX_6587]
The buggy address belongs to the object at ffff8882dc3b0000
which belongs to the cache proc_dir_entry of size 512
The buggy address is located 184 bytes inside of
512-byte region [ffff8882dc3b0000, ffff8882dc3b0200)
The buggy address belongs to the page:
page:ffffea000b70ec00 refcount:1 mapcount:0 mapping:ffff8881061d4f00 index:0x0 compound_mapcount: 0
flags: 0x17ffffc0008100(slab|head)
raw: 0017ffffc0008100dead000000000100dead000000000200ffff8881061d4f00
raw: 0000000000000000000000008019001900000001ffffffff0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address: ffff8882dc3aff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8882dc3b0000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8882dc3b0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^ ffff8882dc3b0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8882dc3b0180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
stap commit b71d20af819 fixed error messages in bpf assembly
(being broken by implicit deallocation of stack vars on exception throw)
but neglected the fact that visit_embeddedcode can recurse
(via emit_functioncall) such that a single bpf_unparser field for
storing asm_stmts will get overwritten by the recursive call.
Alloc/free a separate statement list per visit_embeddedcode call instead.
William Cohen [Mon, 11 Jan 2021 03:36:21 +0000 (22:36 -0500)]
Update test for bpf raw tracepoints to work with Linux 5.7 kernels
The kernel commit 70ed506c3bbcfa846d4636b23051ca79fa4781f7 in Linux
5.7 and newer replaced the bpf_raw_tracepoint_release function with
bpf_raw_tp_link_release. This change in function names would cause
SystemTap's test for BPF raw tracepoint support to fail. Updated the
check to look for the newer alternative function name.
Sven Wegener [Sat, 9 Jan 2021 21:40:02 +0000 (16:40 -0500)]
Remove non-posix == operators from configure.ac
The configure.ac script contains test commands with the == operator,
which is supported by most shells, but fails if /bin/sh has a test
built-in which is strictly posix-compliant.
Sultan Alsawaf [Fri, 8 Jan 2021 21:09:34 +0000 (13:09 -0800)]
Don't warn about freeing a NULL pointer for functions that tolerate it
Passing a NULL pointer to kfree(), vfree(), and free_percpu() is fine
and supported behavior; these functions will just return early when
given a NULL pointer. However, DEBUG_MEM doesn't know about this, and
warns about it even though it isn't a problem. This mutes the warning
from _stp_mem_debug_free() when these functions receive a NULL pointer.
Signed-off-by: Sultan Alsawaf <sultan@openresty.com>
Stan Cox [Fri, 8 Jan 2021 20:38:42 +0000 (15:38 -0500)]
Add stapdyn VMA-tracking.
To handle VMA-tracking in stapdyn: 1) do not emit pragma:vma so the
kernel VMA-tracker is not enabled 2) add a stapdyn version of
_stp_umodule_relocate which 3) uses dwfl_linux_proc_report to find the
appropriate module start 4) relocate the offset. This makes tls
possible so it is enabled for stapdyn.
Sultan Alsawaf [Wed, 30 Dec 2020 23:47:58 +0000 (15:47 -0800)]
task_finder2: fix task worker race on module unload
Unfortunately, __stp_tf_cancel_all_task_work() does not guarantee that
all of the task finder's task workers will be finished executing when it
returns. In this case, we rely on the stp_task_work API to prevent the
module from being unloaded while there are task workers in-flight, which
works, but the stp_task_work API is notified of a task worker finishing
before it actually finishes. Inside __stp_tf_task_worker_fn(), the
call to the task worker's function (tf_work->func) is where the final
refcount in the stp_task_work API could be put, but there will still be
instructions left in the task worker that will be executing for a short
time after that. In that short time, there can be a race where the
module is unloaded before the task worker finishes executing all of its
instructions, especially if the task worker gets preempted during this
time on a PREEMPT kernel.
To remedy this, we must ensure that the last instruction in
__stp_tf_task_worker_fn() is where the stp_task_work API is notified of
a task worker finishing.
Sultan Alsawaf [Wed, 30 Dec 2020 23:42:11 +0000 (15:42 -0800)]
task_finder2: fix list corruption in __stp_tf_cancel_all_task_work()
The previous commit (b26b4e2c2 "task_finder2: fix panics due to broken
task work cancellation") made it possible for the next node in the task
work list to be free, which would made list_for_each_entry_safe() not so
safe anymore. Using list_for_each_entry_safe() is still the fastest
approach here, so when the next node in the list happens to be freed, we
should just restart iteration on the list.
Sultan Alsawaf [Wed, 30 Dec 2020 22:21:42 +0000 (14:21 -0800)]
task_finder2: fix panics due to broken task work cancellation
The task_work_cancel() API uses function pointers to uniquely identify
task work structs, so there's no guarantee that a specific task work
struct we want to cancel is the one that will actually get canceled.
This issue would cause task work structs to be freed while they were
still queued up on the task's task-worker list.
This is an example of one such panic, where the DEBUG_MEM feature
reported that a __stp_tf_task_work struct (56 bytes) wasn't freed,
because that specific task worker got canceled and instead an active
task worker got freed!
William Cohen [Wed, 23 Dec 2020 21:33:03 +0000 (16:33 -0500)]
Work around kernel claims of a function("input_event").inline probe point
Newer Fedora Linux kernels (F32/F33) are claiming a
function("input_event").inline probe point exists and has no
arguments. The build of the stapgames block and eater fail because
the needed arguments are not found. Examined where the claimed inline
input_events functions are with:
stap -v -L 'kernel.function("input_event").*'
There appears to be a bogus one listed inside the callable input_event
function itself. Worked around this by setting the game.input tapset
probe to function("input_event").call to exclude the bogus inline
version. It was verified that the games got input from the keyboard
with this patch.
William Cohen [Wed, 23 Dec 2020 20:19:42 +0000 (15:19 -0500)]
Adjust enospc.stp example to work with Linux 5.9 kernels
The Linux 5.9 kernels changed the type of the inode agument passed
into the btrfs_check_data_free_space function. Need to check to see
if it is the new struct btrfs_inode being used or the old struct inode
and use a different field to get the s_dev value if required.
William Cohen [Tue, 22 Dec 2020 21:17:02 +0000 (16:17 -0500)]
Allow ioblock.request to work Linux 5.9 and newer kernels
In the Linux 5.9 kernel the generic_make_request function was renamed
to submit_bio_noacct by commit ed00aabd5e. Adjust the ioblock
ioblock.request to use the new name if it is available.
Sultan Alsawaf [Wed, 16 Dec 2020 22:46:36 +0000 (14:46 -0800)]
PR26844: remove trailing space from printed backtraces
When _STP_SYM_POST_SPACE is used, a trailing space is left over in the
log buffer which is then copied to the output for the backtrace print.
This issue was exposed by commit fd93cf71d.
Sultan Alsawaf [Wed, 16 Dec 2020 21:03:47 +0000 (13:03 -0800)]
session.cxx: fix print error dupe-elimination for chained errors
Commit 0e1d5b7eb397 introduced an issue where error messages would be
duplicated, like so:
Before:
--------------------8<--------------------
semantic error: type mismatch (long): identifier 'a' at test.stp:8:5
source: a = 32;
^
semantic error: type was first inferred here (string): identifier 'a' at :4:5
source: a = "stringcheese";
^
The first message would be duplicated because the wrong seen_errors is
checked inside the loop, after that first message would be printed
outside the loop. This fixes the issue by using the same error counter
throughout.
Frank Ch. Eigler [Mon, 14 Dec 2020 02:05:23 +0000 (21:05 -0500)]
PR23512: fix staprun/stapio operation via less-than-root privileges
Commit 7615cae790c899bc8a82841c75c8ea9c6fa54df3 for PR26665 introduced
a regression in handling stapusr/stapdev/stapsys gid invocation of
staprun/stapio. This patch simplifies the relevant code in
staprun/ctl.c, init_ctl_channel(), to rely on openat/etc. to populate
and use the relay_basedir_fd as much as possible. Also, we now avoid
unnecessary use of access(), which was checking against the wrong
(real rather than effective) uid/gid.
Frank Ch. Eigler [Fri, 11 Dec 2020 23:06:36 +0000 (18:06 -0500)]
staprun: handle more and fewer cpus better
NR_CPUS was a hard-coded minimum and maximum on the number of CPUs
worth of trace$N files staprun/stapio would open at startup. While a
constant is useful for array sizing (and so might as well be really
large), the actual iteration should be informed by get_nprocs_conf(3).
This patch replaces NR_CPUS with MAX_NR_CPUS (now 1024, why not), and
limits open/thread iterations to the actual number of processors. It
even prints an error if a behemoth >1K-core machine comes into being.
Frank Ch. Eigler [Fri, 11 Dec 2020 20:39:29 +0000 (15:39 -0500)]
relay transport: comment on STP_BULK message
While we've eliminated any STP_BULKMODE effects from the way relayfs
files are used ("always bulkmode"), staprun/stapio still need to know
whether the user intended "stap -b" or not, so they can save files
stpd_cpu* files separately.
Sultan Alsawaf [Thu, 10 Dec 2020 01:22:20 +0000 (17:22 -0800)]
always use per-cpu bulkmode relayfs files to communicate with userspace
Using a mutex_trylock() in __stp_print_flush() leads to a lot of havoc,
for numerous. Firstly, since __stp_print_flush() can be called from IRQ
context, holding the inode mutex from here would make the mutex owner
become nonsense, since mutex locks can only be held in contexts backed
by the scheduler. Secondly, the mutex_trylock implementation has a
spin_lock() inside of it that leads to two issues: IRQs aren't disabled
when acquiring this spin_lock(), so using it from IRQ context can lead
to a deadlock, and since spin locks can have tracepoints via
lock_acquire(), the spin_lock() can recurse on itself inside a stap
probe and deadlock, like so:
The reason the mutex_trylock() was needed in the first place was because
staprun doesn't properly use the relayfs API when reading buffers in
non-bulk mode. It tries to read all CPUs' buffers from a single thread,
when it should be reading each CPU's buffer from a thread running on
said CPU in order to utilize relayfs' synchronization guarantees, which
are made by disabling IRQs on the local CPU when a buffer is modified.
This change makes staprun always use per-CPU threads to read print
buffers so that we don't need the mutex_trylock() in the print flush
routine, which resolves a wide variety of serious bugs.
We also need to adjust the transport sub-buffer count to accommodate for
frequent print flushing. The sub-buffer size is now reduced to match the
log buffer size, which is 8192 by default, and the number of sub-buffers
is increased to 256. This uses exactly the same amount of memory as
before.
Frank Ch. Eigler [Thu, 10 Dec 2020 03:29:43 +0000 (22:29 -0500)]
PR27044: fix lock loop for conditional probes
Emit a nested block carefully so that the "goto out;" from a failed
stp_lock_probe() call in that spot near the epilogue of a
probe-handler goes downward, not upward.
Sultan Alsawaf [Wed, 9 Dec 2020 20:55:10 +0000 (12:55 -0800)]
PR26844: fix off-by-one error when copying printed backtraces
Since log->buf isn't null-terminated, log->len represents the total
number of bytes present in the log buffer for copying. The use of
strlcpy() here with log->len as its size results in log->len - 1 bytes
being copied, with the log->len'nth byte of the output buffer being set
to zero to terminate the string. Use memcpy() instead to remedy this,
while ensuring that the output buffer has space for null termination,
since the output buffer needs to be terminated.
This test case stresses nesting of heavy duty processing (backtrace
printing) within kernel interrupt processing paths. It seems to
sometimes trigger problems - so let's make the test harder to make
latent problems show up more likely. Instead of quitting after the
first irq_* function hit, stick around for 10 seconds.
Guillaume Morin [Fri, 4 Dec 2020 17:18:44 +0000 (12:18 -0500)]
PR27001: fix runtime/transport/transport.c lockdown build problem
On some kernel/configs, CONFIG_SECURITY_LOCKDOWN_LSM !=
STAPCONF_LOCKDOWN_DEBUGFS, which broke the runtime build.
Using the matching macro as detected by autoconf to fix.
Sultan Alsawaf [Thu, 3 Dec 2020 20:57:34 +0000 (12:57 -0800)]
runtime: fix print races in IRQ context and during print cleanup
Prints can race when there's a print called from IRQ context or a print
called while print cleanup takes place, which can lead to garbled print
messages, out-of-bounds memory accesses, and memory use-after-free. This
is one example of racy modification of the print buffer len in IRQ
context which caused a panic due to an out-of-bounds memory access:
This patch resolves the IRQ print races by disabling IRQs on the local
CPU when accessing said CPU's print buffer, and resolves the cleanup
races with a lock. We also protect against data corruption and panics
from prints inside NMIs now by checking if the current CPU was accessing
the log buffer when an NMI fired; in this case, the NMI's prints will be
dropped, as there is no way to safely service them without creating a
dedicated log buffer for them. This is achieved by forbidding reentrancy
with respect to _stp_print_trylock_irqsave() when the runtime context
isn't held. Reentrancy is otherwise allowed when the runtime context is
held because the runtime context provides reentrancy protection.
Note the deadlock due to _stp_transport_trylock_relay_inode recursing
onto itself via mutex_trylock.
This is a temporary fix for the issue until a proper patch is made to
remove the mutex_trylock from __stp_print_flush. This should be reverted
when that patch lands (it will have something to do with bulkmode).
Sultan Alsawaf [Wed, 2 Dec 2020 19:27:47 +0000 (11:27 -0800)]
task_finder_vma: add kfree_rcu() compat for old kernels
Newer RHEL 6 kernels have kfree_rcu(), but older ones do not. Using
kfree_rcu() is beneficial because it lets the RCU subsystem know that
the queued RCU callback is low-priority, and can be deferred, hence why
we don't replace kfree_rcu() with call_rcu() outright. Luckily,
kfree_rcu() is a macro so we can just #ifdef with it.
Alice Zhang [Fri, 27 Nov 2020 18:45:41 +0000 (13:45 -0500)]
Conscious language initiatives: replaced whitelist->passlist, blacklist->blocklist, master->main/primary. Some occurences of master and slave may not be able to be replaced at this point, eg. name of a terminology or usage of other programs interface.
Sultan Alsawaf [Wed, 2 Dec 2020 02:47:04 +0000 (18:47 -0800)]
runtime_context: replace _stp_context_lock with an atomic variable
We can't use any lock primitives here, such as spin locks or rw locks,
because lock_acquire() has tracepoints inside of it. This can cause a
deadlock, so we have to roll our own synchronization mechanism using an
atomic variable.
Sultan Alsawaf [Tue, 1 Dec 2020 17:54:07 +0000 (09:54 -0800)]
runtime_context: synchronize _stp_context_stop more strictly
We're only reading _stp_context_stop while the read lock is held, so we
can move the modification of it to inside the write lock to ensure
strict memory ordering. As such, it no longer needs to be an atomic_t
variable.
We also don't need to disable IRQs when holding the write lock because
only read_trylock is used from IRQ context, not read_lock, so there's no
possibility of a deadlock occurring.
Sultan Alsawaf [Tue, 24 Nov 2020 18:50:10 +0000 (10:50 -0800)]
runtime_context: factor out RCU usage using a rw lock
We can factor out the RCU insanity in here by just adding in a rw lock
and using that to synchronize _stp_runtime_contexts_free() with any code
that has the runtime context held.
Frank Ch. Eigler [Tue, 17 Nov 2020 21:34:59 +0000 (16:34 -0500)]
PR26665 detect rhel8 (4.18) era kernel_is_locked_down() as procfs trigger
A different older kernel API needs to be probed for rhel8 era detection
of lockdown in effect. Added an (undocumented) $SYSTEMTAP_NOSIGN env
var to override automatic --use-server on lockdown, so that one can
inspect runtime/autoconf* operation locally, without stap-server.
Sultan Alsawaf [Tue, 17 Nov 2020 19:03:53 +0000 (11:03 -0800)]
task_finder: call _stp_vma_done() upon error to fix memory leak
The memory allocated inside stap_initialize_vma_map() is not freed upon
error when the task finder is started because a call to _stp_vma_done()
in the error path is missing. Add it to fix the leak.
Jamie Bainbridge [Tue, 17 Nov 2020 17:50:04 +0000 (12:50 -0500)]
examples: add timestamp to dropwatch.stp
When using dropwatch.stp to troubleshoot packet drops, it is often done
with additional troubleshooting such as packet captures and collections
of other commands like "ethtool -S" or "netstat -s".
To correspond traffic loss events across the various output, these
should all have timestamps.
Add ctime timestamp to dropwatch to enable this. Update documentation to
show example timestamp collection.
Frank Ch. Eigler [Mon, 16 Nov 2020 23:54:11 +0000 (18:54 -0500)]
PR26665: mokutil output parsing tweaks
We encountered secureboot keys in the wild that didn't live up
to the expectations of the current little state machine. Tweaked
regexps to accept Issuer: O= as well as Issuer: CN= lines. With
more verbosity, produces output on parsing process.
Alice Zhang [Tue, 10 Nov 2020 18:11:13 +0000 (13:11 -0500)]
PR13838: Add float32 support and corresponding test cases
runtime/softfloat.* & runtime/softfloat/: add f32 support and f32 to f64
conversion
tapset/floatingpoint.stp: fixed some documentation typos & add f32_tp_f64
tapset function
testsuite/buildok/floatingpoint.stp: add f32 related test cases
main.cxx: add float parameter to sdt_benchmark_thread function for test purpose
runtime/softfloat.c & tapset/floatingpoint.stp : delete unnecessary functions
to keep the code concise
In utrace_report_syscall_entry and _exit, there is a possibility of
dereferencing a NULL pointer, in case __stp_utrace_alloc_task_work
exhausts UTRACE_TASK_WORK_POOL_SIZE live elements. While OOM is
still a possibility, this patch handles it more gracefully.
Frank Ch. Eigler [Tue, 10 Nov 2020 00:18:19 +0000 (19:18 -0500)]
PR26665: relayfs-on-procfs megapatch
On platforms/configurations where debugfs is inaccessible (I'm
side-eyeing at you, secureboot + kernel_lockdown), the stap runtime
needs another way to hook up the relayfs / .cmd files to talk to
staprun/stapio in userspace. kernel relayfs users all rely on
debugfs (tied closely to struct dentry*), and filesystems where
dentry*'s are not immediately available are SOL.
Until now. This gigapatch forks pieces of runtime/transport/transport.c
into debugfs and procfs alternatives. The debugfs fork is just like
before. The procfs fork is new, and uses a proc_dir_entry <-> struct
path look-up table to map between procfs objects and the dentry*'s
that relayfs so loves.
The debugfs alternative is default, except when lockdown mode is
detected; then the runtime chooses procfs_p at the strategic moment.
stap -DSTAP_TRANS_PROCFS or -DSTAP_TRANS_DEBUGFS lets the user
override this heuristic. (Going to a procfs default is worth
considering at some point.)
The staprun/stapio userspace is updated to search both
/sys/kernel/debug/systemtap and /proc/systemtap for the relay/.cmd
file endpoints.
Most of this gigapatch is moving code around in runtime/transport/ so
relay_v2 is agnostic to its enclosing filesystem, going through hooks
in transport.c to either procfs.c or debugfs.c. The old
runtime/procfs.c file is stripped down to move common bits around a
little.
William Cohen [Mon, 9 Nov 2020 18:01:06 +0000 (13:01 -0500)]
Initialize variable in runtime/softfloat.c to avoid RHEL8 -Werror issue
Make sure that the variable is initialized to something to avoid the
following error when running the testsuite on RHEL8:
attempting command stap -p4 floatingpoint.stp -c "stap --benchmark-sdt"
OUT In file included from /tmp/stapBRN9va/stap_825f154f474bfd5b2080a28426f65178_4743_src.c:37:
/usr/share/systemtap/runtime/softfloat.c: In function 'softfloat_shiftRightJamM':
/usr/share/systemtap/runtime/softfloat.c:132:34: error: 'ptr' may be used uninitialized in this function [-Werror=maybe-uninitialized]
uint32_t wordJam, wordDist, *ptr;
^~~
cc1: all warnings being treated as errors
make[3]: *** [scripts/Makefile.build:315: /tmp/stapBRN9va/stap_825f154f474bfd5b2080a28426f65178_4743_src.o] Error 1
make[2]: *** [Makefile:1544: _module_/tmp/stapBRN9va] Error 2
WARNING: kbuild exited with status: 2
Pass 4: compilation failed. [man error::pass4]
child process exited abnormally
RC 1
FAIL: systemtap.examples/general/floatingpoint build
Sultan Alsawaf [Thu, 5 Nov 2020 21:39:30 +0000 (13:39 -0800)]
PR26144: task_finder2: execute task workers in order
The task finder's task workers need to be executed in the order that
they are added, but the kernel's task_work API doesn't make any ordering
guarantees, so task workers end up getting executed out of order. This
becomes a problem when the mmap callback worker runs after the other two
workers the task finder uses, even though it gets queued beforehand.
We can make the task finder's task workers run in order by wrapping the
task worker API with our own routines to dequeue task workers from a
global list and run them in the correct order. A lot of the scaffolding
needed to achieve this is already present, so this change is not too
invasive.