[Bug bpf/28748] New: systemtap bpf unsupported functions and other failures

["raeburn at redhat dot com" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=28748

            Bug ID: 28748
           Summary: systemtap bpf unsupported functions and other failures
           Product: systemtap
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: bpf
          Assignee: systemtap at sourceware dot org
          Reporter: raeburn at redhat dot com
  Target Milestone: ---

Bugzilla only offers me “unspecified” for a version; I’m working with:

  Systemtap translator/driver (version 4.6/0.186, rpm 4.6-4.fc35)
  Copyright (C) 2005-2021 Red Hat, Inc. and others
  This is free software; see the source for copying conditions.
  tested kernel versions: 2.6.32 ... 5.15.0-rc7
  enabled features: AVAHI BOOST_STRING_REF DYNINST BPF JAVA PYTHON3 LIBRPM
LIBSQLITE3 LIBVIRT LIBXML2 NLS NSS READLINE MONITOR_LIBS

on a Fedora 5.15.7-200.fc35.x86_64 kernel.

I was trying a script with kernel-module probes which, first, were failing to
find the variable I wanted to examine at the lines I wanted, right after a
function returns, so I tried probes on the function (saving the pointer passed)
and the corresponding .return probe (fetch the value at the saved location and
print it out), but the .return probe never fired. (I see this issue has come up
on the mailing list around the same time I was running into it

This is an out-of-kernel module, built using standard kernel makefile supplied
options. The function call was between object files but LTO might be enabled.

After a bit of frustration, I decided to try the BPF back end and see if I got
any different results. (For all I know, perhaps the probe point determination
and local variable locating code are common, and the experiment could be a
waste of time. But I don’t know, so I decided to try it out.)

Unfortunately (but perhaps not surprisingly, it still being in early stages of
development), the results were worse:

 * deleting an array isn’t supported
 * kernel_long() and kernel_pointer() aren’t recognized (“unresolved function”)
 * tid() isn’t supported (“bpfinterp.cxx:1127: unknown helper function”)
 * “Error creating probe 0: Invalid or incomplete multibyte or wide character”
though all my own strings seem to be ASCII as far as I can see

This last one is coming from a fairly stripped down input file:

  probe module("uds").function("wait_for_pending_searches")
  {
    printf("%d: wfps\n", tid());
  }

The function being probed is a static function
  static void wait_for_pending_searches(struct page_cache *cache,
                                        unsigned int physical_page) …
which is called from two places in its source file.

If I strip it down further — just a “begin” probe, printing its own thread id —
that’s when I get the “unknown helper function”. Looking at bpfinterp.cxx, it
appears that BPF_FUNC_get_current_pid_tgid is supplied somewhere (hardcoded in
tapset/bpf/context.stp?) but not implemented in the interpreter.

Looking at other “call BPF_FUNC_…” lines in tapset/bpf and comparing against
stapbpf/bpfinterp.cxx, I’d hazard a guess that uses of
BPF_FUNC_get_current_uid_gid, BPF_FUNC_get_smp_processor_id, and
BPF_FUNC_gtod_get_ns might also hit problems. And calls to gid(), uid(), and
cpu() all generate the same error. Calling gettimeofday_ns() seems to be okay
though…

The last point took me a while to figure out, actually, as printf("%d",…) works
just fine normally for “long” values, but in BPF mode I seem to need the %ld
format or the value gets truncated to 32 bits. No warning is given about the
truncation, though all the necessary type info should be available.

So… is there a list somewhere of what is or is not expected to work with the
BPF back end? I see the stapbpf man page and its list of probes and some other
general info, but it’s not very detailed.

-- 
You are receiving this mail because:
You are the assignee for the bug.