* [PATCH V4 00/20] The Runtime Verification (RV) interface
@ 2022-06-16 8:44 Daniel Bristot de Oliveira
2022-06-16 8:44 ` [PATCH V4 01/20] rv: Add " Daniel Bristot de Oliveira
` (21 more replies)
0 siblings, 22 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-16 8:44 UTC (permalink / raw)
To: Steven Rostedt
Cc: Daniel Bristot de Oliveira, Wim Van Sebroeck, Guenter Roeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel
Over the last years, I've been exploring the possibility of
verifying the Linux kernel behavior using Runtime Verification.
Runtime Verification (RV) is a lightweight (yet rigorous) method that
complements classical exhaustive verification techniques (such as model
checking and theorem proving) with a more practical approach for complex
systems.
Instead of relying on a fine-grained model of a system (e.g., a
re-implementation a instruction level), RV works by analyzing the trace of the
system's actual execution, comparing it against a formal specification of
the system behavior.
The usage of deterministic automaton for RV is a well-established
approach. In the specific case of the Linux kernel, you can check how
to model complex behavior of the Linux kernel with this paper:
DE OLIVEIRA, Daniel Bristot; CUCINOTTA, Tommaso; DE OLIVEIRA, Romulo Silva.
*Efficient formal verification for the Linux kernel.* In: International
Conference on Software Engineering and Formal Methods. Springer, Cham, 2019.
p. 315-332.
And how efficient is this approach here:
DE OLIVEIRA, Daniel B.; DE OLIVEIRA, Romulo S.; CUCINOTTA, Tommaso. *A thread
synchronization model for the PREEMPT_RT Linux kernel.* Journal of Systems
Architecture, 2020, 107: 101729.
tlrd: it is possible to model complex behaviors in a modular way, with
an acceptable overhead (even for production systems). See this
presentation at 2019's ELCE: https://www.youtube.com/watch?v=BfTuEHafNgg
Here I am proposing a more practical approach for the usage of deterministic
automata for runtime verification, and it includes:
- An interface for controlling the verification;
- A tool and set of headers that enables the automatic code
generation of the RV monitor (Monitor Synthesis);
- Sample monitors to evaluate the interface;
- A sample monitor developed in the context of the Elisa Project
demonstrating how to use RV in the context of safety-critical
systems.
Given that RV is a tracing consumer, the code is being placed inside the
tracing subsystem (Steven and I have been talking about it for a while).
Changes from v3:
- Rebased on 5.19
(rostedt's request were made on 1x1 meetings)
- Moved monitors to monitors/$name/ (Rostedt)
- Consolidate the tracepoints into a single include file in the default
directory (trave/events/rv.h) (Rostedt)
- The tracepoints now record the entire string to the buffer.
- Change the enable_monitors to disable monitors with ! (instead of -).
(Rostedt)
- Add a suffix to the state/events enums, to avoid conflict in the
vmlinux.h used by eBPF.
- The models are now placed in the $name.h (it used to store the
tracepoints, but they are now consolidated in a single file)
- dot2c and dot2k updated to the changes
- models re-generated with these new standards.
- user-space tools moved to an directory outside of tools/tracing as
other methods of verification/log sources are planned.
Changes from v2:
- Tons of checkpatch and kernel test robot
- Moved files to better places
- Adjusted watchdog tracepoints patch (Guenter Roeck)
- Added pretimeout watchdog events (Peter Enderborg)
- Used task struct to store per-task monitors (Peter Zijlstra)
- Changed the instrumentation to use internal definition of tracepoint
and check the callback signature (Steven Rostedt)
- Used printk_deferred() and removed the comment about deadlocks
(Shuah Khan/John Ogness)
- Some simplifications:
- Removed the safe watchdog nowayout for now (myself)
- Removed export symbols for now (myself)
Changes from V1:
- rebased to the latest kernel;
- code cleanup;
- the watchdog dev monitor;
- safety app;
Things kept for a second moment (after this patchset):
- Add a reactor tha enables the visualization of the visited
states via KCOV (Marco Elver & Dmitry Vyukov)
- Add a CRC method to check from user-space if the values
exported by the monitor were not corrupted by any other
kernel task (Gabriele Paoloni)
- Export symbols for external modules
- dot2bpf
Daniel Bristot de Oliveira (20):
rv: Add Runtime Verification (RV) interface
rv: Add runtime reactors interface
rv/include: Add helper functions for deterministic automata
rv/include: Add deterministic automata monitor definition via C macros
rv/include: Add instrumentation helper functions
tools/rv: Add dot2c
tools/rv: Add dot2k
rv/monitor: Add the wip monitor skeleton created by dot2k
rv/monitor: wip instrumentation and Makefile/Kconfig entries
rv/monitor: Add the wwnr monitor skeleton created by dot2k
rv/monitor: wwnr instrumentation and Makefile/Kconfig entries
rv/reactor: Add the printk reactor
rv/reactor: Add the panic reactor
Documentation/rv: Add a basic documentation
Documentation/rv: Add deterministic automata monitor synthesis
documentation
Documentation/rv: Add deterministic automata instrumentation
documentation
watchdog/dev: Add tracepoints
rv/monitor: Add safe watchdog monitor
rv/safety_app: Add a safety_app sample
Documentation/rv: Add watchdog-monitor documentation
Documentation/trace/index.rst | 1 +
.../trace/rv/da_monitor_instrumentation.rst | 223 ++++++
.../trace/rv/da_monitor_synthesis.rst | 284 +++++++
Documentation/trace/rv/index.rst | 9 +
.../trace/rv/runtime-verification.rst | 233 ++++++
Documentation/trace/rv/watchdog-monitor.rst | 250 ++++++
drivers/watchdog/watchdog_dev.c | 43 +-
drivers/watchdog/watchdog_pretimeout.c | 2 +
include/linux/rv.h | 38 +
include/linux/sched.h | 11 +
include/linux/watchdog.h | 7 +-
include/rv/automata.h | 49 ++
include/rv/da_monitor.h | 419 ++++++++++
include/rv/instrumentation.h | 23 +
include/rv/rv.h | 32 +
include/trace/events/rv.h | 153 ++++
include/trace/events/watchdog.h | 101 +++
kernel/fork.c | 14 +
kernel/trace/Kconfig | 2 +
kernel/trace/Makefile | 2 +
kernel/trace/rv/Kconfig | 84 ++
kernel/trace/rv/Makefile | 9 +
kernel/trace/rv/monitors/safe_wtd/safe_wtd.c | 300 +++++++
kernel/trace/rv/monitors/safe_wtd/safe_wtd.h | 84 ++
kernel/trace/rv/monitors/wip/wip.c | 110 +++
kernel/trace/rv/monitors/wip/wip.h | 38 +
kernel/trace/rv/monitors/wwnr/wwnr.c | 109 +++
kernel/trace/rv/monitors/wwnr/wwnr.h | 38 +
kernel/trace/rv/reactor_panic.c | 44 +
kernel/trace/rv/reactor_printk.c | 43 +
kernel/trace/rv/rv.c | 757 ++++++++++++++++++
kernel/trace/rv/rv.h | 54 ++
kernel/trace/rv/rv_reactors.c | 476 +++++++++++
kernel/trace/trace.c | 4 +
kernel/trace/trace.h | 2 +
tools/verification/dot2/Makefile | 26 +
tools/verification/dot2/automata.py | 179 +++++
tools/verification/dot2/dot2c | 30 +
tools/verification/dot2/dot2c.py | 244 ++++++
tools/verification/dot2/dot2k | 50 ++
tools/verification/dot2/dot2k.py | 177 ++++
.../dot2/dot2k_templates/main_global.c | 94 +++
.../dot2/dot2k_templates/main_per_cpu.c | 94 +++
.../dot2/dot2k_templates/main_per_task.c | 94 +++
tools/verification/safety_app/Makefile | 51 ++
tools/verification/safety_app/safety_app.c | 614 ++++++++++++++
46 files changed, 5691 insertions(+), 10 deletions(-)
create mode 100644 Documentation/trace/rv/da_monitor_instrumentation.rst
create mode 100644 Documentation/trace/rv/da_monitor_synthesis.rst
create mode 100644 Documentation/trace/rv/index.rst
create mode 100644 Documentation/trace/rv/runtime-verification.rst
create mode 100644 Documentation/trace/rv/watchdog-monitor.rst
create mode 100644 include/linux/rv.h
create mode 100644 include/rv/automata.h
create mode 100644 include/rv/da_monitor.h
create mode 100644 include/rv/instrumentation.h
create mode 100644 include/rv/rv.h
create mode 100644 include/trace/events/rv.h
create mode 100644 include/trace/events/watchdog.h
create mode 100644 kernel/trace/rv/Kconfig
create mode 100644 kernel/trace/rv/Makefile
create mode 100644 kernel/trace/rv/monitors/safe_wtd/safe_wtd.c
create mode 100644 kernel/trace/rv/monitors/safe_wtd/safe_wtd.h
create mode 100644 kernel/trace/rv/monitors/wip/wip.c
create mode 100644 kernel/trace/rv/monitors/wip/wip.h
create mode 100644 kernel/trace/rv/monitors/wwnr/wwnr.c
create mode 100644 kernel/trace/rv/monitors/wwnr/wwnr.h
create mode 100644 kernel/trace/rv/reactor_panic.c
create mode 100644 kernel/trace/rv/reactor_printk.c
create mode 100644 kernel/trace/rv/rv.c
create mode 100644 kernel/trace/rv/rv.h
create mode 100644 kernel/trace/rv/rv_reactors.c
create mode 100644 tools/verification/dot2/Makefile
create mode 100644 tools/verification/dot2/automata.py
create mode 100644 tools/verification/dot2/dot2c
create mode 100644 tools/verification/dot2/dot2c.py
create mode 100644 tools/verification/dot2/dot2k
create mode 100644 tools/verification/dot2/dot2k.py
create mode 100644 tools/verification/dot2/dot2k_templates/main_global.c
create mode 100644 tools/verification/dot2/dot2k_templates/main_per_cpu.c
create mode 100644 tools/verification/dot2/dot2k_templates/main_per_task.c
create mode 100644 tools/verification/safety_app/Makefile
create mode 100644 tools/verification/safety_app/safety_app.c
--
2.35.1
^ permalink raw reply [flat|nested] 82+ messages in thread
* [PATCH V4 01/20] rv: Add Runtime Verification (RV) interface
2022-06-16 8:44 [PATCH V4 00/20] The Runtime Verification (RV) interface Daniel Bristot de Oliveira
@ 2022-06-16 8:44 ` Daniel Bristot de Oliveira
2022-06-23 17:21 ` Punit Agrawal
` (2 more replies)
2022-06-16 8:44 ` [PATCH V4 02/20] rv: Add runtime reactors interface Daniel Bristot de Oliveira
` (20 subsequent siblings)
21 siblings, 3 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-16 8:44 UTC (permalink / raw)
To: Steven Rostedt
Cc: Daniel Bristot de Oliveira, Wim Van Sebroeck, Guenter Roeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel
RV is a lightweight (yet rigorous) method that complements classical
exhaustive verification techniques (such as model checking and
theorem proving) with a more practical approach to complex systems.
RV works by analyzing the trace of the system's actual execution,
comparing it against a formal specification of the system behavior.
RV can give precise information on the runtime behavior of the
monitored system while enabling the reaction for unexpected
events, avoiding, for example, the propagation of a failure on
safety-critical systems.
The development of this interface roots in the development of the
paper:
DE OLIVEIRA, Daniel Bristot; CUCINOTTA, Tommaso; DE OLIVEIRA, Romulo
Silva. Efficient formal verification for the Linux kernel. In:
International Conference on Software Engineering and Formal Methods.
Springer, Cham, 2019. p. 315-332.
And:
DE OLIVEIRA, Daniel Bristot, et al. Automata-based formal analysis
and verification of the real-time Linux kernel. PhD Thesis, 2020.
The RV interface resembles the tracing/ interface on purpose. The current
path for the RV interface is /sys/kernel/tracing/rv/.
It presents these files:
"available_monitors"
- List the available monitors, one per line.
For example:
[root@f32 rv]# cat available_monitors
wip
wwnr
"enabled_monitors"
- Lists the enabled monitors, one per line;
- Writing to it enables a given monitor;
- Writing a monitor name with a '-' prefix disables it;
- Truncating the file disables all enabled monitors.
For example:
[root@f32 rv]# cat enabled_monitors
[root@f32 rv]# echo wip > enabled_monitors
[root@f32 rv]# echo wwnr >> enabled_monitors
[root@f32 rv]# cat enabled_monitors
wip
wwnr
[root@f32 rv]# echo !wip >> enabled_monitors
[root@f32 rv]# cat enabled_monitors
wwnr
[root@f32 rv]# echo > enabled_monitors
[root@f32 rv]# cat enabled_monitors
[root@f32 rv]#
Note that more than one monitor can be enabled concurrently.
"monitoring_on"
- It is an on/off general switcher for monitoring. Note
that it does not disable enabled monitors, but stop the per-entity
monitors of monitoring the events received from the system.
It resambles the "tracing_on" switcher.
"monitors/"
Each monitor will have its one directory inside "monitors/". There
the monitor specific files will be presented.
The "monitors/" directory resambles the "events" directory on
tracefs.
For example:
[root@f32 rv]# cd monitors/wip/
[root@f32 wip]# ls
desc enable
[root@f32 wip]# cat desc
auto-generated wakeup in preemptive monitor.
[root@f32 wip]# cat enable
0
For further information, see the comments in the header of
kernel/trace/rv/rv.c from this patch.
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Gabriele Paoloni <gpaoloni@redhat.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Clark Williams <williams@redhat.com>
Cc: linux-doc@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-trace-devel@vger.kernel.org
Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
---
include/linux/rv.h | 23 ++
include/linux/sched.h | 11 +
include/rv/rv.h | 23 ++
kernel/fork.c | 14 +
kernel/trace/Kconfig | 2 +
kernel/trace/Makefile | 2 +
kernel/trace/rv/Kconfig | 12 +
kernel/trace/rv/Makefile | 3 +
kernel/trace/rv/rv.c | 738 +++++++++++++++++++++++++++++++++++++++
kernel/trace/rv/rv.h | 34 ++
kernel/trace/trace.c | 4 +
kernel/trace/trace.h | 2 +
12 files changed, 868 insertions(+)
create mode 100644 include/linux/rv.h
create mode 100644 include/rv/rv.h
create mode 100644 kernel/trace/rv/Kconfig
create mode 100644 kernel/trace/rv/Makefile
create mode 100644 kernel/trace/rv/rv.c
create mode 100644 kernel/trace/rv/rv.h
diff --git a/include/linux/rv.h b/include/linux/rv.h
new file mode 100644
index 000000000000..205e65f57637
--- /dev/null
+++ b/include/linux/rv.h
@@ -0,0 +1,23 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Runtime Verification.
+ *
+ * For futher information, see: kernel/trace/rv/rv.c.
+ *
+ * Copyright (C) 2019-2022 Daniel Bristot de Oliveira <bristot@kernel.org>
+ */
+#ifndef _LINUX_RV_H
+#define _LINUX_RV_H
+struct rv_monitor {
+ const char *name;
+ const char *description;
+ bool enabled;
+ int (*start)(void);
+ void (*stop)(void);
+ void (*reset)(void);
+};
+
+extern bool monitoring_on;
+int rv_unregister_monitor(struct rv_monitor *monitor);
+int rv_register_monitor(struct rv_monitor *monitor);
+#endif /* _LINUX_RV_H */
diff --git a/include/linux/sched.h b/include/linux/sched.h
index c46f3a63b758..b037f364efdc 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -35,6 +35,7 @@
#include <linux/seqlock.h>
#include <linux/kcsan.h>
#include <asm/kmap_size.h>
+#include <rv/rv.h>
/* task_struct member predeclarations (sorted alphabetically): */
struct audit_context;
@@ -1500,6 +1501,16 @@ struct task_struct {
struct callback_head l1d_flush_kill;
#endif
+#ifdef CONFIG_RV
+ /*
+ * Per-task RV monitor. Nowadays fixed in RV_PER_TASK_MONITORS.
+ * If we find justification for more monitors, we can think
+ * about adding more or developing a dynamic method. So far,
+ * none of these are justified.
+ */
+ union rv_task_monitor rv[RV_PER_TASK_MONITORS];
+#endif
+
/*
* New fields for task_struct should be added above here, so that
* they are included in the randomized portion of task_struct.
diff --git a/include/rv/rv.h b/include/rv/rv.h
new file mode 100644
index 000000000000..27a108881d35
--- /dev/null
+++ b/include/rv/rv.h
@@ -0,0 +1,23 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+
+#ifndef _RV_RV_H
+#define _RV_RV_H
+
+/*
+ * Per-task RV monitors count. Nowadays fixed in RV_PER_TASK_MONITORS.
+ * If we find justification for more monitors, we can think about
+ * adding more or developing a dynamic method. So far, none of
+ * these are justified.
+ */
+#define RV_PER_TASK_MONITORS 1
+#define RV_PER_TASK_MONITOR_INIT (RV_PER_TASK_MONITORS)
+
+/*
+ * Futher monitor types are expected, so make this a union.
+ */
+union rv_task_monitor {
+};
+
+int get_task_monitor_slot(void);
+void put_task_monitor_slot(int slot);
+#endif /* _RV_RV_H */
diff --git a/kernel/fork.c b/kernel/fork.c
index 9d44f2d46c69..5e40e58ef83d 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1964,6 +1964,18 @@ static void copy_oom_score_adj(u64 clone_flags, struct task_struct *tsk)
mutex_unlock(&oom_adj_mutex);
}
+#ifdef CONFIG_RV
+static void rv_task_fork(struct task_struct *p)
+{
+ int i;
+
+ for (i = 0; i < RV_PER_TASK_MONITORS; i++)
+ ;
+}
+#else
+#define rv_task_fork(p) do {} while (0)
+#endif
+
/*
* This creates a new process as a copy of the old one,
* but does not actually start it yet.
@@ -2399,6 +2411,8 @@ static __latent_entropy struct task_struct *copy_process(
*/
copy_seccomp(p);
+ rv_task_fork(p);
+
rseq_fork(p, clone_flags);
/* Don't start children in a dying pid namespace */
diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
index debbbb083286..b415690748bf 100644
--- a/kernel/trace/Kconfig
+++ b/kernel/trace/Kconfig
@@ -1105,4 +1105,6 @@ config HIST_TRIGGERS_DEBUG
If unsure, say N.
+source "kernel/trace/rv/Kconfig"
+
endif # FTRACE
diff --git a/kernel/trace/Makefile b/kernel/trace/Makefile
index 0d261774d6f3..b2670fff6e94 100644
--- a/kernel/trace/Makefile
+++ b/kernel/trace/Makefile
@@ -108,3 +108,5 @@ obj-$(CONFIG_RETHOOK) += rethook.o
obj-$(CONFIG_TRACEPOINT_BENCHMARK) += trace_benchmark.o
libftrace-y := ftrace.o
+
+obj-$(CONFIG_RV) += rv/
diff --git a/kernel/trace/rv/Kconfig b/kernel/trace/rv/Kconfig
new file mode 100644
index 000000000000..6d127cdb00dd
--- /dev/null
+++ b/kernel/trace/rv/Kconfig
@@ -0,0 +1,12 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+menuconfig RV
+ bool "Runtime Verification"
+ depends on TRACING
+ help
+ Enable the kernel runtime verification infrastructure. RV is a
+ lightweight (yet rigorous) method that complements classical
+ exhaustive verification techniques (such as model checking and
+ theorem proving). RV works by analyzing the trace of the system's
+ actual execution, comparing it against a formal specification of
+ the system behavior.
diff --git a/kernel/trace/rv/Makefile b/kernel/trace/rv/Makefile
new file mode 100644
index 000000000000..fd995379df67
--- /dev/null
+++ b/kernel/trace/rv/Makefile
@@ -0,0 +1,3 @@
+# SPDX-License-Identifier: GPL-2.0
+
+obj-$(CONFIG_RV) += rv.o
diff --git a/kernel/trace/rv/rv.c b/kernel/trace/rv/rv.c
new file mode 100644
index 000000000000..43af7b13187e
--- /dev/null
+++ b/kernel/trace/rv/rv.c
@@ -0,0 +1,738 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * This is the online Runtime Verification (RV) interface.
+ *
+ * RV is a lightweight (yet rigorous) method that complements classical
+ * exhaustive verification techniques (such as model checking and
+ * theorem proving) with a more practical approach to complex systems.
+ *
+ * RV works by analyzing the trace of the system's actual execution,
+ * comparing it against a formal specification of the system behavior.
+ * RV can give precise information on the runtime behavior of the
+ * monitored system while enabling the reaction for unexpected
+ * events, avoiding, for example, the propagation of a failure on
+ * safety-critical systems.
+ *
+ * The development of this interface roots in the development of the
+ * paper:
+ *
+ * DE OLIVEIRA, Daniel Bristot; CUCINOTTA, Tommaso; DE OLIVEIRA, Romulo
+ * Silva. Efficient formal verification for the Linux kernel. In:
+ * International Conference on Software Engineering and Formal Methods.
+ * Springer, Cham, 2019. p. 315-332.
+ *
+ * And:
+ *
+ * DE OLIVEIRA, Daniel Bristot, et al. Automata-based formal analysis
+ * and verification of the real-time Linux kernel. PhD Thesis, 2020.
+ *
+ * == Runtime monitor interface ==
+ *
+ * A monitor is the central part of the runtime verification of a system.
+ *
+ * The monitor stands in between the formal specification of the desired
+ * (or undesired) behavior, and the trace of the actual system.
+ *
+ * In Linux terms, the runtime verification monitors are encapsulated
+ * inside the "RV monitor" abstraction. A RV monitor includes a reference
+ * model of the system, a set of instances of the monitor (per-cpu monitor,
+ * per-task monitor, and so on), and the helper functions that glue the
+ * monitor to the system via trace. Generally, a monitor includes some form
+ * of trace output as a reaction for event parsing and exceptions,
+ * as depicted bellow:
+ *
+ * Linux +----- RV Monitor ----------------------------------+ Formal
+ * Realm | | Realm
+ * +-------------------+ +----------------+ +-----------------+
+ * | Linux kernel | | Monitor | | Reference |
+ * | Tracing | -> | Instance(s) | <- | Model |
+ * | (instrumentation) | | (verification) | | (specification) |
+ * +-------------------+ +----------------+ +-----------------+
+ * | | |
+ * | V |
+ * | +----------+ |
+ * | | Reaction | |
+ * | +--+--+--+-+ |
+ * | | | | |
+ * | | | +-> trace output ? |
+ * +------------------------|--|----------------------+
+ * | +----> panic ?
+ * +-------> <user-specified>
+ *
+ * This file implements the interface for loading RV monitors, and
+ * to control the verification session.
+ *
+ * == Registering monitors ==
+ *
+ * The struct rv_monitor defines a set of callback functions to control
+ * a verification session. For instance, when a given monitor is enabled,
+ * the "start" callback function is called to hook the instrumentation
+ * functions to the kernel trace events. The "stop" function is called
+ * when disabling the verification session.
+ *
+ * A RV monitor is registered via:
+ * int rv_register_monitor(struct rv_monitor *monitor);
+ * And unregistered via:
+ * int rv_unregister_monitor(struct rv_monitor *monitor);
+ *
+ * These functions are exported to modules, enabling verification monitors
+ * to be dynamically loaded.
+ *
+ * == User interface ==
+ *
+ * The user interface resembles kernel tracing interface. It presents
+ * these files:
+ *
+ * "available_monitors"
+ * - List the available monitors, one per line.
+ *
+ * For example:
+ * [root@f32 rv]# cat available_monitors
+ * wip
+ * wwnr
+ *
+ * "enabled_monitors"
+ * - Lists the enabled monitors, one per line;
+ * - Writing to it enables a given monitor;
+ * - Writing a monitor name with a '-' prefix disables it;
+ * - Truncating the file disables all enabled monitors.
+ *
+ * For example:
+ * [root@f32 rv]# cat enabled_monitors
+ * [root@f32 rv]# echo wip > enabled_monitors
+ * [root@f32 rv]# echo wwnr >> enabled_monitors
+ * [root@f32 rv]# cat enabled_monitors
+ * wip
+ * wwnr
+ * [root@f32 rv]# echo !wip >> enabled_monitors
+ * [root@f32 rv]# cat enabled_monitors
+ * wwnr
+ * [root@f32 rv]# echo > enabled_monitors
+ * [root@f32 rv]# cat enabled_monitors
+ * [root@f32 rv]#
+ *
+ * Note that more than one monitor can be enabled concurrently.
+ *
+ * "monitoring_on"
+ * - It is an on/off general switcher for monitoring. Note
+ * that it does not disable enabled monitors, but stop the per-entity
+ * monitors of monitoring the events received from the system.
+ * It resambles the "tracing_on" switcher.
+ *
+ * "monitors/"
+ * Each monitor will have its one directory inside "monitors/". There
+ * the monitor specific files will be presented.
+ * The "monitors/" directory resambles the "events" directory on
+ * tracefs.
+ *
+ * For example:
+ * [root@f32 rv]# cd monitors/wip/
+ * [root@f32 wip]# ls
+ * desc enable
+ * [root@f32 wip]# cat desc
+ * auto-generated wakeup in preemptive monitor.
+ * [root@f32 wip]# cat enable
+ * 0
+ *
+ * Copyright (C) 2019-2022 Daniel Bristot de Oliveira <bristot@kernel.org>
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <rv/rv.h>
+
+#include "rv.h"
+
+DEFINE_MUTEX(rv_interface_lock);
+struct rv_interface rv_root;
+
+struct dentry *get_monitors_root(void)
+{
+ return rv_root.monitors_dir;
+}
+
+/*
+ * Monitoring on global switcher!
+ */
+bool __read_mostly monitoring_on;
+
+/*
+ * Interface for the monitor register.
+ */
+LIST_HEAD(rv_monitors_list);
+
+static int task_monitor_count;
+static bool task_monitor_slots[RV_PER_TASK_MONITORS];
+
+int get_task_monitor_slot(void)
+{
+ int i;
+
+ lockdep_assert_held(&rv_interface_lock);
+
+ if (task_monitor_count == RV_PER_TASK_MONITORS)
+ return -EBUSY;
+
+ task_monitor_count++;
+
+ for (i = 0; i < RV_PER_TASK_MONITORS; i++) {
+ if (task_monitor_slots[i] == false) {
+ task_monitor_slots[i] = true;
+ return i;
+ }
+ }
+
+ WARN_ONCE(1, "RV task_monitor_cout and slots are out of sync\n");
+
+ return -EINVAL;
+}
+
+void put_task_monitor_slot(int slot)
+{
+ lockdep_assert_held(&rv_interface_lock);
+
+ if (slot < 0 || slot > RV_PER_TASK_MONITORS) {
+ WARN_ONCE(1, "RV releasing an invlid slot!: %d\n", slot);
+ return;
+ }
+
+ WARN_ONCE(!task_monitor_slots[slot], "RV releasing unsused task_monitor_slots: %d\n",
+ slot);
+
+ task_monitor_count--;
+ task_monitor_slots[slot] = false;
+}
+
+/*
+ * This section collects the monitor/ files and folders.
+ */
+static ssize_t monitor_enable_read_data(struct file *filp,
+ char __user *user_buf,
+ size_t count, loff_t *ppos)
+{
+ struct rv_monitor_def *mdef = filp->private_data;
+ char buff[4];
+
+ memset(buff, 0, sizeof(buff));
+
+ mutex_lock(&rv_interface_lock);
+ sprintf(buff, "%x\n", mdef->monitor->enabled);
+ mutex_unlock(&rv_interface_lock);
+
+ return simple_read_from_buffer(user_buf, count, ppos,
+ buff, strlen(buff)+1);
+}
+
+/*
+ * Disable a given runtime monitor.
+ */
+static int disable_monitor(struct rv_monitor_def *mdef)
+{
+ if (mdef->monitor->enabled) {
+ mdef->monitor->enabled = 0;
+ mdef->monitor->stop();
+ }
+
+ mdef->enabled = 0;
+ return 0;
+}
+
+/*
+ * Enable a given monitor.
+ */
+static int enable_monitor(struct rv_monitor_def *mdef)
+{
+ int retval;
+
+ /*
+ * Reset all internal monitors before starting.
+ */
+ mdef->monitor->reset();
+ if (!mdef->monitor->enabled) {
+ retval = mdef->monitor->start();
+ if (retval)
+ return retval;
+ }
+
+ mdef->monitor->enabled = 1;
+ mdef->enabled = 1;
+
+ return 0;
+}
+
+/*
+ * interface for enabling/disabling a monitor.
+ */
+static ssize_t monitor_enable_write_data(struct file *filp,
+ const char __user *user_buf,
+ size_t count, loff_t *ppos)
+{
+ struct rv_monitor_def *mdef = filp->private_data;
+ int retval;
+ u64 val;
+
+ retval = kstrtoull_from_user(user_buf, count, 10, &val);
+ if (retval)
+ return retval;
+
+ retval = count;
+
+ mutex_lock(&rv_interface_lock);
+
+ switch (val) {
+ case 0:
+ retval = disable_monitor(mdef);
+ break;
+ case 1:
+ retval = enable_monitor(mdef);
+ break;
+ default:
+ retval = -EINVAL;
+ }
+
+ mutex_unlock(&rv_interface_lock);
+
+ return retval;
+}
+
+static const struct file_operations interface_enable_fops = {
+ .open = simple_open,
+ .llseek = no_llseek,
+ .write = monitor_enable_write_data,
+ .read = monitor_enable_read_data,
+};
+
+/*
+ * Interface to read the enable/disable status of a monitor.
+ */
+static ssize_t
+monitor_desc_read_data(struct file *filp, char __user *user_buf,
+ size_t count, loff_t *ppos)
+{
+ struct rv_monitor_def *mdef = filp->private_data;
+ char buf[MAX_RV_MONITOR_NAME_SIZE];
+
+ memset(buf, 0, sizeof(buf));
+
+ mutex_lock(&rv_interface_lock);
+ sprintf(buf, "%s\n", mdef->monitor->description);
+ mutex_unlock(&rv_interface_lock);
+
+ return simple_read_from_buffer(user_buf, count, ppos,
+ buf, strlen(buf)+1);
+}
+
+static const struct file_operations interface_desc_fops = {
+ .open = simple_open,
+ .llseek = no_llseek,
+ .read = monitor_desc_read_data,
+};
+
+/*
+ * During the registration of a monitor, this function creates
+ * the monitor dir, where the specific options of the monitor
+ * is exposed.
+ */
+static int create_monitor_dir(struct rv_monitor_def *mdef)
+{
+ struct dentry *root = get_monitors_root();
+ struct dentry *tmp;
+ const char *name = mdef->monitor->name;
+ int retval = 0;
+
+ mdef->root_d = rv_create_dir(name, root);
+
+ if (!mdef->root_d)
+ return -ENOMEM;
+
+ tmp = rv_create_file("enable", 0600,
+ mdef->root_d, mdef,
+ &interface_enable_fops);
+ if (!tmp) {
+ retval = -ENOMEM;
+ goto out_remove_root;
+ }
+
+ tmp = rv_create_file("desc", 0400,
+ mdef->root_d, mdef,
+ &interface_desc_fops);
+ if (!tmp) {
+ retval = -ENOMEM;
+ goto out_remove_root;
+ }
+
+ return retval;
+
+out_remove_root:
+ rv_remove(mdef->root_d);
+ return retval;
+}
+
+/*
+ * Available/Enable monitor shared seq functions.
+ */
+static int monitors_show(struct seq_file *m, void *p)
+{
+ struct rv_monitor_def *mon_def = p;
+
+ seq_printf(m, "%s\n", mon_def->monitor->name);
+ return 0;
+}
+
+/*
+ * Used by the seq file operations at the end of a read
+ * operation.
+ */
+static void monitors_stop(struct seq_file *m, void *p)
+{
+ mutex_unlock(&rv_interface_lock);
+}
+
+/*
+ * Available monitor seq functions:
+ */
+static void *available_monitors_start(struct seq_file *m, loff_t *pos)
+{
+ mutex_lock(&rv_interface_lock);
+ return seq_list_start(&rv_monitors_list, *pos);
+}
+
+static void *available_monitors_next(struct seq_file *m, void *p, loff_t *pos)
+{
+ return seq_list_next(p, &rv_monitors_list, pos);
+}
+
+/*
+ * Enable monitor seq functions:
+ */
+
+static void *enabled_monitors_next(struct seq_file *m, void *p, loff_t *pos)
+{
+ struct rv_monitor_def *m_def = p;
+
+ (*pos)++;
+
+ list_for_each_entry_continue(m_def, &rv_monitors_list, list) {
+ if (m_def->monitor->enabled)
+ return m_def;
+ }
+
+ return NULL;
+}
+
+static void *enabled_monitors_start(struct seq_file *m, loff_t *pos)
+{
+ struct rv_monitor_def *m_def;
+ loff_t l;
+
+ mutex_lock(&rv_interface_lock);
+ m_def = list_entry(&rv_monitors_list, struct rv_monitor_def, list);
+
+ for (l = 0; l <= *pos; ) {
+ m_def = enabled_monitors_next(m, m_def, &l);
+ if (!m_def)
+ break;
+ }
+
+ return m_def;
+}
+
+/*
+ * available/enabled monitors seq definition.
+ */
+static const struct seq_operations available_monitors_seq_ops = {
+ .start = available_monitors_start,
+ .next = available_monitors_next,
+ .stop = monitors_stop,
+ .show = monitors_show
+};
+
+static const struct seq_operations enabled_monitors_seq_ops = {
+ .start = enabled_monitors_start,
+ .next = enabled_monitors_next,
+ .stop = monitors_stop,
+ .show = monitors_show
+};
+
+/*
+ * available_monitors interface.
+ */
+static int available_monitors_open(struct inode *inode, struct file *file)
+{
+ return seq_open(file, &available_monitors_seq_ops);
+};
+
+static const struct file_operations available_monitors_ops = {
+ .open = available_monitors_open,
+ .read = seq_read,
+ .llseek = seq_lseek,
+ .release = seq_release
+};
+
+/*
+ * enabled_monitors interface
+ */
+static void disable_all_monitors(void)
+{
+ struct rv_monitor_def *mdef;
+
+ list_for_each_entry(mdef, &rv_monitors_list, list)
+ disable_monitor(mdef);
+}
+
+static int enabled_monitors_open(struct inode *inode, struct file *file)
+{
+ if ((file->f_mode & FMODE_WRITE) && (file->f_flags & O_TRUNC))
+ disable_all_monitors();
+
+ return seq_open(file, &enabled_monitors_seq_ops);
+};
+
+static ssize_t
+enabled_monitors_write(struct file *filp, const char __user *user_buf,
+ size_t count, loff_t *ppos)
+{
+ char buff[MAX_RV_MONITOR_NAME_SIZE+1];
+ struct rv_monitor_def *mdef;
+ int retval = -EINVAL;
+ bool enable = true;
+ char *ptr = buff;
+ int len;
+
+ if (count < 1 || count > MAX_RV_MONITOR_NAME_SIZE+1)
+ return -EINVAL;
+
+ memset(buff, 0, sizeof(buff));
+
+ retval = simple_write_to_buffer(buff, sizeof(buff)-1, ppos, user_buf,
+ count);
+ if (!retval)
+ return -EFAULT;
+
+ if (buff[0] == '!') {
+ enable = false;
+ ptr++;
+ }
+
+ len = strlen(ptr);
+ if (!len)
+ return count;
+ /*
+ * remove \n
+ */
+ ptr[len-1] = '\0';
+
+ mutex_lock(&rv_interface_lock);
+
+ retval = -EINVAL;
+
+ list_for_each_entry(mdef, &rv_monitors_list, list) {
+ if (strcmp(ptr, mdef->monitor->name) == 0) {
+ /*
+ * Monitor found!
+ */
+ if (enable)
+ retval = enable_monitor(mdef);
+ else
+ retval = disable_monitor(mdef);
+
+ if (retval)
+ goto out;
+
+ /*
+ * Success!
+ */
+ retval = count;
+ break;
+ }
+ }
+
+out:
+ mutex_unlock(&rv_interface_lock);
+ return retval;
+}
+
+static const struct file_operations enabled_monitors_ops = {
+ .open = enabled_monitors_open,
+ .read = seq_read,
+ .write = enabled_monitors_write,
+ .llseek = seq_lseek,
+ .release = seq_release,
+};
+
+/*
+ * monitoring_on general switcher
+ */
+static ssize_t monitoring_on_read_data(struct file *filp,
+ char __user *user_buf,
+ size_t count, loff_t *ppos)
+{
+ char buff[4];
+
+ memset(buff, 0, sizeof(buff));
+
+ mutex_lock(&rv_interface_lock);
+ sprintf(buff, "%d\n", monitoring_on);
+ mutex_unlock(&rv_interface_lock);
+
+ return simple_read_from_buffer(user_buf, count, ppos,
+ buff, strlen(buff)+1);
+}
+
+static void turn_monitoring_off(void)
+{
+ monitoring_on = false;
+}
+
+static void turn_monitoring_on(void)
+{
+ reset_all_monitors();
+ monitoring_on = true;
+}
+
+static ssize_t monitoring_on_write_data(struct file *filp,
+ const char __user *user_buf,
+ size_t count, loff_t *ppos)
+{
+ int retval;
+ u64 val;
+
+ retval = kstrtoull_from_user(user_buf, count, 10, &val);
+ if (retval)
+ return retval;
+
+ retval = count;
+
+ mutex_lock(&rv_interface_lock);
+
+ switch (val) {
+ case 0:
+ turn_monitoring_off();
+ break;
+ case 1:
+ turn_monitoring_on();
+ break;
+ default:
+ retval = -EINVAL;
+ }
+
+ mutex_unlock(&rv_interface_lock);
+
+ return retval;
+}
+
+static const struct file_operations monitoring_on_fops = {
+ .open = simple_open,
+ .llseek = no_llseek,
+ .write = monitoring_on_write_data,
+ .read = monitoring_on_read_data,
+};
+
+/*
+ * Monitor API.
+ */
+static void destroy_monitor_dir(struct rv_monitor_def *mdef)
+{
+ rv_remove(mdef->root_d);
+}
+
+/**
+ * rv_register_monitor - register a rv monitor.
+ * @monitor: The rv_monitor to be registered.
+ *
+ * Returns 0 if successful, error otherwise.
+ */
+int rv_register_monitor(struct rv_monitor *monitor)
+{
+ struct rv_monitor_def *r;
+ int retval = 0;
+
+ if (strlen(monitor->name) >= MAX_RV_MONITOR_NAME_SIZE) {
+ pr_info("Monitor %s has a name longer than %d\n",
+ monitor->name, MAX_RV_MONITOR_NAME_SIZE);
+ return -1;
+ }
+
+ mutex_lock(&rv_interface_lock);
+
+ list_for_each_entry(r, &rv_monitors_list, list) {
+ if (strcmp(monitor->name, r->monitor->name) == 0) {
+ pr_info("Monitor %s is already registered\n",
+ monitor->name);
+ retval = -1;
+ goto out_unlock;
+ }
+ }
+
+ r = kzalloc(sizeof(struct rv_monitor_def), GFP_KERNEL);
+ if (!r) {
+ retval = -ENOMEM;
+ goto out_unlock;
+ }
+
+ r->monitor = monitor;
+
+ create_monitor_dir(r);
+
+ list_add_tail(&r->list, &rv_monitors_list);
+
+out_unlock:
+ mutex_unlock(&rv_interface_lock);
+ return retval;
+}
+
+/**
+ * rv_unregister_monitor - unregister a rv monitor.
+ * @monitor: The rv_monitor to be unregistered.
+ *
+ * Returns 0 if successful, error otherwise.
+ */
+int rv_unregister_monitor(struct rv_monitor *monitor)
+{
+ struct rv_monitor_def *ptr, *next;
+
+ mutex_lock(&rv_interface_lock);
+
+ list_for_each_entry_safe(ptr, next, &rv_monitors_list, list) {
+ if (strcmp(monitor->name, ptr->monitor->name) == 0) {
+ list_del(&ptr->list);
+ destroy_monitor_dir(ptr);
+ }
+ }
+
+ mutex_unlock(&rv_interface_lock);
+ return 0;
+}
+
+void reset_all_monitors(void)
+{
+ struct rv_monitor_def *mdef;
+
+ /*
+ * Reset all monitors before re-enabling monitoring.
+ */
+ list_for_each_entry(mdef, &rv_monitors_list, list) {
+ if (mdef->monitor->enabled)
+ mdef->monitor->reset();
+ }
+
+}
+
+int __init rv_init_interface(void)
+{
+ rv_root.root_dir = rv_create_dir("rv", NULL);
+ rv_root.monitors_dir = rv_create_dir("monitors", rv_root.root_dir);
+
+ rv_create_file("available_monitors", 0400, rv_root.root_dir, NULL,
+ &available_monitors_ops);
+ rv_create_file("enabled_monitors", 0600, rv_root.root_dir, NULL,
+ &enabled_monitors_ops);
+ rv_create_file("monitoring_on", 0600, rv_root.root_dir, NULL,
+ &monitoring_on_fops);
+
+ monitoring_on = true;
+
+ return 0;
+}
diff --git a/kernel/trace/rv/rv.h b/kernel/trace/rv/rv.h
new file mode 100644
index 000000000000..0796867a7b1e
--- /dev/null
+++ b/kernel/trace/rv/rv.h
@@ -0,0 +1,34 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#include <linux/mutex.h>
+
+struct rv_interface {
+ struct dentry *root_dir;
+ struct dentry *monitors_dir;
+};
+
+#include "../trace.h"
+#include <linux/tracefs.h>
+#include <linux/rv.h>
+
+#define rv_create_dir tracefs_create_dir
+#define rv_create_file tracefs_create_file
+#define rv_remove tracefs_remove
+
+#define MAX_RV_MONITOR_NAME_SIZE 32
+
+extern struct mutex rv_interface_lock;
+
+struct rv_monitor_def {
+ struct list_head list;
+ struct rv_monitor *monitor;
+ struct dentry *root_d;
+ bool enabled;
+ bool task_monitor;
+};
+
+extern bool monitoring_on;
+struct dentry *get_monitors_root(void);
+void reset_all_monitors(void);
+int init_rv_monitors(struct dentry *root_dir);
+int get_task_monitor_slot(void);
+void put_task_monitor_slot(int slot);
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 2c95992e2c71..60e357c3120b 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -9774,6 +9774,10 @@ static __init int tracer_init_tracefs(void)
tracer_init_tracefs_work_func(NULL);
}
+#ifdef CONFIG_RV
+ rv_init_interface();
+#endif
+
return 0;
}
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index ff816fb41e48..becc03c0a45e 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -2005,4 +2005,6 @@ struct trace_min_max_param {
extern const struct file_operations trace_min_max_fops;
+extern int rv_init_interface(void);
+
#endif /* _LINUX_KERNEL_TRACE_H */
--
2.35.1
^ permalink raw reply related [flat|nested] 82+ messages in thread
* [PATCH V4 02/20] rv: Add runtime reactors interface
2022-06-16 8:44 [PATCH V4 00/20] The Runtime Verification (RV) interface Daniel Bristot de Oliveira
2022-06-16 8:44 ` [PATCH V4 01/20] rv: Add " Daniel Bristot de Oliveira
@ 2022-06-16 8:44 ` Daniel Bristot de Oliveira
2022-06-23 20:40 ` Steven Rostedt
2022-06-16 8:44 ` [PATCH V4 03/20] rv/include: Add helper functions for deterministic automata Daniel Bristot de Oliveira
` (19 subsequent siblings)
21 siblings, 1 reply; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-16 8:44 UTC (permalink / raw)
To: Steven Rostedt
Cc: Daniel Bristot de Oliveira, Wim Van Sebroeck, Guenter Roeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel
A runtime monitor can cause a reaction to the detection of an
exception on the model's execution. By default, the monitors have
tracing reactions, printing the monitor output via tracepoints.
But other reactions can be added (on-demand) via this interface.
The user interface resembles the kernel tracing interface and
presents these files:
"available_reactors"
- Reading shows the available reactors, one per line.
For example:
[root@f32 rv]# cat available_reactors
nop
panic
printk
"reacting_on"
- It is an on/off general switch for reactors, disabling
all reactions.
"monitors/MONITOR/reactors"
- List available reactors, with the select reaction for the given
MONITOR inside []. The default one is the nop (no operation)
reactor.
- Writing the name of a reactor enables it to the given
MONITOR.
For example:
[root@f32 rv]# cat monitors/wip/reactors
[nop]
panic
printk
[root@f32 rv]# echo panic > monitors/wip/reactors
[root@f32 rv]# cat monitors/wip/reactors
nop
[panic]
printk
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Gabriele Paoloni <gpaoloni@redhat.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Clark Williams <williams@redhat.com>
Cc: linux-doc@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-trace-devel@vger.kernel.org
Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
---
include/linux/rv.h | 13 +
kernel/trace/rv/Kconfig | 14 +
kernel/trace/rv/Makefile | 1 +
kernel/trace/rv/rv.c | 18 +-
kernel/trace/rv/rv.h | 20 ++
kernel/trace/rv/rv_reactors.c | 476 ++++++++++++++++++++++++++++++++++
6 files changed, 540 insertions(+), 2 deletions(-)
create mode 100644 kernel/trace/rv/rv_reactors.c
diff --git a/include/linux/rv.h b/include/linux/rv.h
index 205e65f57637..1e48c6bb74bf 100644
--- a/include/linux/rv.h
+++ b/include/linux/rv.h
@@ -8,6 +8,13 @@
*/
#ifndef _LINUX_RV_H
#define _LINUX_RV_H
+
+struct rv_reactor {
+ char *name;
+ char *description;
+ void (*react)(char *msg);
+};
+
struct rv_monitor {
const char *name;
const char *description;
@@ -15,9 +22,15 @@ struct rv_monitor {
int (*start)(void);
void (*stop)(void);
void (*reset)(void);
+ void (*react)(char *msg);
+
};
extern bool monitoring_on;
int rv_unregister_monitor(struct rv_monitor *monitor);
int rv_register_monitor(struct rv_monitor *monitor);
+
+extern bool reacting_on;
+int rv_unregister_reactor(struct rv_reactor *reactor);
+int rv_register_reactor(struct rv_reactor *reactor);
#endif /* _LINUX_RV_H */
diff --git a/kernel/trace/rv/Kconfig b/kernel/trace/rv/Kconfig
index 6d127cdb00dd..560408fec0c8 100644
--- a/kernel/trace/rv/Kconfig
+++ b/kernel/trace/rv/Kconfig
@@ -10,3 +10,17 @@ menuconfig RV
theorem proving). RV works by analyzing the trace of the system's
actual execution, comparing it against a formal specification of
the system behavior.
+
+if RV
+
+config RV_REACTORS
+ bool "Runtime verification reactors"
+ default y if RV
+ help
+ Enables the online runtime verification reactors. A runtime
+ monitor can cause a reaction to the detection of an exception
+ on the model's execution. By default, the monitors have
+ tracing reactions, printing the monitor output via tracepoints,
+ but other reactions can be added (on-demand) via this interface.
+
+endif # RV
diff --git a/kernel/trace/rv/Makefile b/kernel/trace/rv/Makefile
index fd995379df67..8944274d9b41 100644
--- a/kernel/trace/rv/Makefile
+++ b/kernel/trace/rv/Makefile
@@ -1,3 +1,4 @@
# SPDX-License-Identifier: GPL-2.0
obj-$(CONFIG_RV) += rv.o
+obj-$(CONFIG_RV_REACTORS) += rv_reactors.o
diff --git a/kernel/trace/rv/rv.c b/kernel/trace/rv/rv.c
index 43af7b13187e..7576d492a974 100644
--- a/kernel/trace/rv/rv.c
+++ b/kernel/trace/rv/rv.c
@@ -362,8 +362,13 @@ static int create_monitor_dir(struct rv_monitor_def *mdef)
retval = -ENOMEM;
goto out_remove_root;
}
+#ifdef CONFIG_RV_REACTORS
+ retval = reactor_create_monitor_files(mdef);
+ if (retval)
+ goto out_remove_root;
+#endif
- return retval;
+ return 0;
out_remove_root:
rv_remove(mdef->root_d);
@@ -674,7 +679,11 @@ int rv_register_monitor(struct rv_monitor *monitor)
r->monitor = monitor;
- create_monitor_dir(r);
+ retval = create_monitor_dir(r);
+ if (retval) {
+ kfree(r);
+ goto out_unlock;
+ }
list_add_tail(&r->list, &rv_monitors_list);
@@ -732,6 +741,11 @@ int __init rv_init_interface(void)
rv_create_file("monitoring_on", 0600, rv_root.root_dir, NULL,
&monitoring_on_fops);
+#ifdef CONFIG_RV_REACTORS
+ init_rv_reactors(rv_root.root_dir);
+ reacting_on = true;
+#endif
+
monitoring_on = true;
return 0;
diff --git a/kernel/trace/rv/rv.h b/kernel/trace/rv/rv.h
index 0796867a7b1e..6d43f52d72a9 100644
--- a/kernel/trace/rv/rv.h
+++ b/kernel/trace/rv/rv.h
@@ -15,14 +15,28 @@ struct rv_interface {
#define rv_remove tracefs_remove
#define MAX_RV_MONITOR_NAME_SIZE 32
+#define MAX_RV_REACTOR_NAME_SIZE 32
extern struct mutex rv_interface_lock;
+#ifdef CONFIG_RV_REACTORS
+struct rv_reactor_def {
+ struct list_head list;
+ struct rv_reactor *reactor;
+ /* protected by the monitor interface lock */
+ int counter;
+};
+#endif
+
struct rv_monitor_def {
struct list_head list;
struct rv_monitor *monitor;
+#ifdef CONFIG_RV_REACTORS
+ struct rv_reactor_def *rdef;
+#endif
struct dentry *root_d;
bool enabled;
+ bool reacting;
bool task_monitor;
};
@@ -32,3 +46,9 @@ void reset_all_monitors(void);
int init_rv_monitors(struct dentry *root_dir);
int get_task_monitor_slot(void);
void put_task_monitor_slot(int slot);
+
+#ifdef CONFIG_RV_REACTORS
+extern bool reacting_on;
+int reactor_create_monitor_files(struct rv_monitor_def *mdef);
+int init_rv_reactors(struct dentry *root_dir);
+#endif
diff --git a/kernel/trace/rv/rv_reactors.c b/kernel/trace/rv/rv_reactors.c
new file mode 100644
index 000000000000..bfe54d6996cc
--- /dev/null
+++ b/kernel/trace/rv/rv_reactors.c
@@ -0,0 +1,476 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Runtime reactor interface.
+ *
+ * A runtime monitor can cause a reaction to the detection of an
+ * exception on the model's execution. By default, the monitors have
+ * tracing reactions, printing the monitor output via tracepoints.
+ * But other reactions can be added (on-demand) via this interface.
+ *
+ * == Registering reactors ==
+ *
+ * The struct rv_reactor defines a callback function to be executed
+ * in case of a model exception happens. The callback function
+ * receives a message to be (optionally) printed before executing
+ * the reaction.
+ *
+ * A RV reactor is registered via:
+ * int rv_register_reactor(struct rv_reactor *reactor)
+ * And unregistered via:
+ * int rv_unregister_reactor(struct rv_reactor *reactor)
+ *
+ * These functions are exported to modules, enabling reactors to be
+ * dynamically loaded.
+ *
+ * == User interface ==
+ *
+ * The user interface resembles the kernel tracing interface and
+ * presents these files:
+ *
+ * "available_reactors"
+ * - List the available reactors, one per line.
+ *
+ * For example:
+ * [root@f32 rv]# cat available_reactors
+ * nop
+ * panic
+ * printk
+ *
+ * "reacting_on"
+ * - It is an on/off general switch for reactors, disabling
+ * all reactions.
+ *
+ * "monitors/MONITOR/reactors"
+ * - List available reactors, with the select reaction for the given
+ * MONITOR inside []. The defaul one is the nop (no operation)
+ * reactor.
+ * - Writing the name of an reactor enables it to the given
+ * MONITOR.
+ *
+ * For example:
+ * [root@f32 rv]# cat monitors/wip/reactors
+ * [nop]
+ * panic
+ * printk
+ * [root@f32 rv]# echo panic > monitors/wip/reactors
+ * [root@f32 rv]# cat monitors/wip/reactors
+ * nop
+ * [panic]
+ * printk
+ *
+ * Copyright (C) 2019-2022 Daniel Bristot de Oliveira <bristot@kernel.org>
+ */
+
+#include <linux/slab.h>
+
+#include "rv.h"
+
+bool __read_mostly reacting_on;
+
+/*
+ * Interface for the reactor register.
+ */
+LIST_HEAD(rv_reactors_list);
+
+static struct rv_reactor_def *get_reactor_rdef_by_name(char *name)
+{
+ struct rv_reactor_def *r;
+
+ list_for_each_entry(r, &rv_reactors_list, list) {
+ if (strcmp(name, r->reactor->name) == 0)
+ return r;
+ }
+ return NULL;
+}
+
+/*
+ * Available reactors seq functions.
+ */
+static int reactors_show(struct seq_file *m, void *p)
+{
+ struct rv_reactor_def *rea_def = p;
+
+ seq_printf(m, "%s\n", rea_def->reactor->name);
+ return 0;
+}
+
+static void reactors_stop(struct seq_file *m, void *p)
+{
+ mutex_unlock(&rv_interface_lock);
+}
+
+static void *reactors_start(struct seq_file *m, loff_t *pos)
+{
+ mutex_lock(&rv_interface_lock);
+ return seq_list_start(&rv_reactors_list, *pos);
+}
+
+static void *reactors_next(struct seq_file *m, void *p, loff_t *pos)
+{
+ return seq_list_next(p, &rv_reactors_list, pos);
+}
+
+/*
+ * available reactors seq definition.
+ */
+static const struct seq_operations available_reactors_seq_ops = {
+ .start = reactors_start,
+ .next = reactors_next,
+ .stop = reactors_stop,
+ .show = reactors_show
+};
+
+/*
+ * available_reactors interface.
+ */
+static int available_reactors_open(struct inode *inode, struct file *file)
+{
+ return seq_open(file, &available_reactors_seq_ops);
+};
+
+static const struct file_operations available_reactors_ops = {
+ .open = available_reactors_open,
+ .read = seq_read,
+ .llseek = seq_lseek,
+ .release = seq_release
+};
+
+/*
+ * Monitor reactor file.
+ */
+static int monitor_reactor_show(struct seq_file *m, void *p)
+{
+ struct rv_monitor_def *mdef = m->private;
+ struct rv_reactor_def *rdef = p;
+
+ if (mdef->rdef == rdef)
+ seq_printf(m, "[%s]\n", rdef->reactor->name);
+ else
+ seq_printf(m, "%s\n", rdef->reactor->name);
+ return 0;
+}
+
+/*
+ * available reactors seq definition.
+ */
+static const struct seq_operations monitor_reactors_seq_ops = {
+ .start = reactors_start,
+ .next = reactors_next,
+ .stop = reactors_stop,
+ .show = monitor_reactor_show
+};
+
+static ssize_t
+monitor_reactors_write(struct file *file, const char __user *user_buf,
+ size_t count, loff_t *ppos)
+{
+ char buff[MAX_RV_REACTOR_NAME_SIZE+1];
+ struct rv_monitor_def *mdef;
+ struct rv_reactor_def *rdef;
+ struct seq_file *seq_f;
+ int retval = -EINVAL;
+ char *ptr = buff;
+ int len;
+
+ if (count < 1 || count > MAX_RV_REACTOR_NAME_SIZE+1)
+ return -EINVAL;
+
+ memset(buff, 0, sizeof(buff));
+
+ retval = simple_write_to_buffer(buff, sizeof(buff)-1, ppos, user_buf,
+ count);
+ if (!retval)
+ return -EFAULT;
+
+ len = strlen(ptr);
+ if (!len)
+ return count;
+ /*
+ * remove the \n
+ */
+ ptr[len-1] = '\0';
+
+ /*
+ * See monitor_reactors_open()
+ */
+ seq_f = file->private_data;
+ mdef = seq_f->private;
+
+ mutex_lock(&rv_interface_lock);
+
+ retval = -EINVAL;
+
+ /*
+ * nop special case: disable reacting.
+ */
+ if (strcmp(ptr, "nop") == 0) {
+
+ if (mdef->monitor->enabled)
+ mdef->monitor->stop();
+
+ mdef->rdef = get_reactor_rdef_by_name("nop");
+ mdef->reacting = false;
+ mdef->monitor->react = NULL;
+
+ if (mdef->monitor->enabled)
+ mdef->monitor->start();
+
+ retval = count;
+ goto unlock;
+ }
+
+ list_for_each_entry(rdef, &rv_reactors_list, list) {
+ if (strcmp(ptr, rdef->reactor->name) == 0) {
+ /*
+ * found!
+ */
+ if (mdef->monitor->enabled)
+ mdef->monitor->stop();
+
+ mdef->rdef = rdef;
+ mdef->reacting = true;
+ mdef->monitor->react = rdef->reactor->react;
+
+ if (mdef->monitor->enabled)
+ mdef->monitor->start();
+
+ retval = count;
+ break;
+ }
+ }
+
+unlock:
+ mutex_unlock(&rv_interface_lock);
+
+ return retval;
+}
+
+/*
+ * available_reactors interface.
+ */
+static int monitor_reactors_open(struct inode *inode, struct file *file)
+{
+ /*
+ * create file "private" info is stored in the inode->i_private
+ */
+ struct rv_monitor_def *mdef = inode->i_private;
+ struct seq_file *seq_f;
+ int ret;
+
+
+ ret = seq_open(file, &monitor_reactors_seq_ops);
+ if (ret < 0)
+ return ret;
+
+ /*
+ * seq_open stores the seq_file on the file->private data.
+ */
+ seq_f = file->private_data;
+ /*
+ * Copy the create file "private" data to the seq_file
+ * private data.
+ */
+ seq_f->private = mdef;
+
+ return 0;
+};
+
+static const struct file_operations monitor_reactors_ops = {
+ .open = monitor_reactors_open,
+ .read = seq_read,
+ .llseek = seq_lseek,
+ .release = seq_release,
+ .write = monitor_reactors_write
+};
+
+static int __rv_register_reactor(struct rv_reactor *reactor)
+{
+ struct rv_reactor_def *r;
+
+ list_for_each_entry(r, &rv_reactors_list, list) {
+ if (strcmp(reactor->name, r->reactor->name) == 0) {
+ pr_info("Reactor %s is already registered\n",
+ reactor->name);
+ return -EINVAL;
+ }
+ }
+
+ r = kzalloc(sizeof(struct rv_reactor_def), GFP_KERNEL);
+ if (!r)
+ return -ENOMEM;
+
+ r->reactor = reactor;
+ r->counter = 0;
+
+ list_add_tail(&r->list, &rv_reactors_list);
+
+ return 0;
+}
+
+/**
+ * rv_register_reactor - register a rv reactor.
+ * @reactor: The rv_reactor to be registered.
+ *
+ * Returns 0 if successful, error otherwise.
+ */
+int rv_register_reactor(struct rv_reactor *reactor)
+{
+ int retval = 0;
+
+ if (strlen(reactor->name) >= MAX_RV_REACTOR_NAME_SIZE) {
+ pr_info("Reactor %s has a name longer than %d\n",
+ reactor->name, MAX_RV_MONITOR_NAME_SIZE);
+ return -EINVAL;
+ }
+
+ mutex_lock(&rv_interface_lock);
+ retval = __rv_register_reactor(reactor);
+ mutex_unlock(&rv_interface_lock);
+ return retval;
+}
+
+/**
+ * rv_unregister_reactor - unregister a rv reactor.
+ * @reactor: The rv_reactor to be unregistered.
+ *
+ * Returns 0 if successful, error otherwise.
+ */
+int rv_unregister_reactor(struct rv_reactor *reactor)
+{
+ struct rv_reactor_def *ptr, *next;
+
+ mutex_lock(&rv_interface_lock);
+
+ list_for_each_entry_safe(ptr, next, &rv_reactors_list, list) {
+ if (strcmp(reactor->name, ptr->reactor->name) == 0) {
+
+ if (!ptr->counter) {
+ list_del(&ptr->list);
+ } else {
+ printk(KERN_WARNING
+ "rv: the rv_reactor %s is in use by %d monitor(s)\n",
+ ptr->reactor->name, ptr->counter);
+ printk(KERN_WARNING "rv: the rv_reactor %s cannot be removed\n",
+ ptr->reactor->name);
+ return -EBUSY;
+ }
+
+ }
+ }
+
+ mutex_unlock(&rv_interface_lock);
+ return 0;
+}
+
+/*
+ * reacting_on interface.
+ */
+static ssize_t reacting_on_read_data(struct file *filp,
+ char __user *user_buf,
+ size_t count, loff_t *ppos)
+{
+ char buff[4];
+
+ memset(buff, 0, sizeof(buff));
+
+ mutex_lock(&rv_interface_lock);
+ sprintf(buff, "%d\n", reacting_on);
+ mutex_unlock(&rv_interface_lock);
+
+ return simple_read_from_buffer(user_buf, count, ppos,
+ buff, strlen(buff)+1);
+}
+
+static void turn_reacting_off(void)
+{
+ reacting_on = false;
+}
+
+static void turn_reacting_on(void)
+{
+ reacting_on = true;
+}
+
+static ssize_t
+reacting_on_write_data(struct file *filp, const char __user *user_buf,
+ size_t count, loff_t *ppos)
+{
+ int retval;
+ u64 val;
+
+ retval = kstrtoull_from_user(user_buf, count, 10, &val);
+ if (retval)
+ return retval;
+
+ retval = count;
+
+ mutex_lock(&rv_interface_lock);
+
+ switch (val) {
+ case 0:
+ turn_reacting_off();
+ break;
+ case 1:
+ turn_reacting_on();
+ break;
+ default:
+ retval = -EINVAL;
+ }
+
+ mutex_unlock(&rv_interface_lock);
+
+ return retval;
+}
+
+static const struct file_operations reacting_on_fops = {
+ .open = simple_open,
+ .llseek = no_llseek,
+ .write = reacting_on_write_data,
+ .read = reacting_on_read_data,
+};
+
+
+int reactor_create_monitor_files(struct rv_monitor_def *mdef)
+{
+ struct dentry *tmp;
+
+ tmp = rv_create_file("reactors", 0400, mdef->root_d, mdef,
+ &monitor_reactors_ops);
+ if (!tmp)
+ return -ENOMEM;
+
+ /*
+ * Configure as the rv_nop reactor.
+ */
+ mdef->rdef = get_reactor_rdef_by_name("nop");
+ mdef->reacting = false;
+
+ return 0;
+}
+
+/*
+ * None reactor register
+ */
+static void rv_nop_reaction(char *msg)
+{
+}
+
+struct rv_reactor rv_nop = {
+ .name = "nop",
+ .description = "no-operation reactor: do nothing.",
+ .react = rv_nop_reaction
+};
+
+/*
+ * This section collects the rv/ root dir files and folders.
+ */
+int init_rv_reactors(struct dentry *root_dir)
+{
+ rv_create_file("available_reactors", 0400, root_dir, NULL,
+ &available_reactors_ops);
+ rv_create_file("reacting_on", 0600, root_dir, NULL, &reacting_on_fops);
+
+ __rv_register_reactor(&rv_nop);
+
+ return 0;
+}
--
2.35.1
^ permalink raw reply related [flat|nested] 82+ messages in thread
* [PATCH V4 03/20] rv/include: Add helper functions for deterministic automata
2022-06-16 8:44 [PATCH V4 00/20] The Runtime Verification (RV) interface Daniel Bristot de Oliveira
2022-06-16 8:44 ` [PATCH V4 01/20] rv: Add " Daniel Bristot de Oliveira
2022-06-16 8:44 ` [PATCH V4 02/20] rv: Add runtime reactors interface Daniel Bristot de Oliveira
@ 2022-06-16 8:44 ` Daniel Bristot de Oliveira
2022-06-28 17:48 ` Steven Rostedt
2022-07-06 18:35 ` Tao Zhou
2022-06-16 8:44 ` [PATCH V4 04/20] rv/include: Add deterministic automata monitor definition via C macros Daniel Bristot de Oliveira
` (18 subsequent siblings)
21 siblings, 2 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-16 8:44 UTC (permalink / raw)
To: Steven Rostedt
Cc: Daniel Bristot de Oliveira, Wim Van Sebroeck, Guenter Roeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel
Formally, a deterministic automaton, denoted by G, is defined as a
quintuple:
G = { X, E, f, x_0, X_m }
where:
- X is the set of states;
- E is the finite set of events;
- x_0 is the initial state;
- X_m (subset of X) is the set of marked states.
- f : X x E -> X $ is the transition function. It defines the
state transition in the occurrence of a event from E in
the state X. In the special case of deterministic automata,
the occurrence of the event in E in a state in X has a
deterministic next state from X.
An automaton can also be represented using a graphical format of
vertices (nodes) and edges. The open-source tool Graphviz can produce
this graphic format using the (textual) DOT language as the source code.
The dot2c tool presented in this paper:
DE OLIVEIRA, Daniel Bristot; CUCINOTTA, Tommaso; DE OLIVEIRA, Romulo
Silva. Efficient formal verification for the Linux kernel. In:
International Conference on Software Engineering and Formal Methods.
Springer, Cham, 2019. p. 315-332.
Translates a deterministic automaton in the DOT format into a C
source code representation that to be used for monitoring.
This header file implements helper functions to facilitate the usage
of the C output from dot2c for monitoring.
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Gabriele Paoloni <gpaoloni@redhat.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Clark Williams <williams@redhat.com>
Cc: linux-doc@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-trace-devel@vger.kernel.org
Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
---
include/rv/automata.h | 49 +++++++++++++++++++++++++++++++++++++++++++
1 file changed, 49 insertions(+)
create mode 100644 include/rv/automata.h
diff --git a/include/rv/automata.h b/include/rv/automata.h
new file mode 100644
index 000000000000..0c0aa54bd820
--- /dev/null
+++ b/include/rv/automata.h
@@ -0,0 +1,49 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Deterministic automata helper functions, to be used with the automata
+ * models in C generated by the dot2k tool.
+ *
+ * Copyright (C) 2019-2022 Daniel Bristot de Oliveira <bristot@kernel.org>
+ */
+
+#define DECLARE_AUTOMATA_HELPERS(name, type) \
+ \
+static inline void *model_get_model_##name(void) \
+{ \
+ return (void *) &automaton_##name; \
+} \
+ \
+static char *model_get_state_name_##name(enum states_##name state) \
+{ \
+ return automaton_##name.state_names[state]; \
+} \
+ \
+static char *model_get_event_name_##name(enum events_##name event) \
+{ \
+ return automaton_##name.event_names[event]; \
+} \
+ \
+static inline type model_get_init_state_##name(void) \
+{ \
+ return automaton_##name.initial_state; \
+} \
+ \
+static inline type model_get_next_state_##name(enum states_##name curr_state, \
+ enum events_##name event) \
+{ \
+ if ((curr_state < 0) || (curr_state > state_max_##name)) \
+ return -1; \
+ \
+ if ((event < 0) || (event > event_max_##name)) \
+ return -1; \
+ \
+ return automaton_##name.function[curr_state][event]; \
+} \
+ \
+static inline bool model_is_final_state_##name(enum states_##name state) \
+{ \
+ if ((state < 0) || (state > state_max_##name)) \
+ return 0; \
+ \
+ return !!automaton_##name.final_states[state]; \
+}
--
2.35.1
^ permalink raw reply related [flat|nested] 82+ messages in thread
* [PATCH V4 04/20] rv/include: Add deterministic automata monitor definition via C macros
2022-06-16 8:44 [PATCH V4 00/20] The Runtime Verification (RV) interface Daniel Bristot de Oliveira
` (2 preceding siblings ...)
2022-06-16 8:44 ` [PATCH V4 03/20] rv/include: Add helper functions for deterministic automata Daniel Bristot de Oliveira
@ 2022-06-16 8:44 ` Daniel Bristot de Oliveira
2022-07-06 18:56 ` Tao Zhou
2022-06-16 8:44 ` [PATCH V4 05/20] rv/include: Add instrumentation helper functions Daniel Bristot de Oliveira
` (17 subsequent siblings)
21 siblings, 1 reply; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-16 8:44 UTC (permalink / raw)
To: Steven Rostedt
Cc: Daniel Bristot de Oliveira, Wim Van Sebroeck, Guenter Roeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel
In Linux terms, the runtime verification monitors are encapsulated
inside the "RV monitor" abstraction. The "RV monitor" includes a set
of instances of the monitor (per-cpu monitor, per-task monitor, and
so on), the helper functions that glue the monitor to the system
reference model, and the trace output as a reaction for event parsing
and exceptions, as depicted below:
Linux +----- RV Monitor ----------------------------------+ Formal
Realm | | Realm
+-------------------+ +----------------+ +-----------------+
| Linux kernel | | Monitor | | Reference |
| Tracing | -> | Instance(s) | <- | Model |
| (instrumentation) | | (verification) | | (specification) |
+-------------------+ +----------------+ +-----------------+
| | |
| V |
| +----------+ |
| | Reaction | |
| +--+--+--+-+ |
| | | | |
| | | +-> trace output ? |
+------------------------|--|----------------------+
| +----> panic ?
+-------> <user-specified>
The dot2c tool presented in this paper:
DE OLIVEIRA, Daniel Bristot; CUCINOTTA, Tommaso; DE OLIVEIRA, Romulo
Silva. Efficient formal verification for the Linux kernel. In:
International Conference on Software Engineering and Formal Methods.
Springer, Cham, 2019. p. 315-332.
Translates a deterministic automaton in the DOT format into a C
source code representation that to be used for monitoring connecting
the Formal Reaml to Linux-like code.
This header file goes beyond, extending the code generation to the
verification stage, generating the code to the Monitor Instance(s)
level using C macros. The trace event code inspires this approach.
The benefits of the usage of macro for monitor synthesis is 3-fold:
- Reduces the code duplication;
- Facilitates the bug fix/improvement;
(but mainly:)
- Avoids the case of developers changing the core of the monitor
code to manipulate the model in a (let's say) non-standard
way.
This initial implementation presents three different types of monitor
instances:
- #define DECLARE_DA_MON_GLOBAL(name, type)
- #define DECLARE_DA_MON_PER_CPU(name, type)
- #define DECLARE_DA_MON_PER_TASK(name, type)
The first declares the functions for a global deterministic automata
monitor, the second with per-cpu instances, and the third with
per-task instances.
In all cases, the name is a string that identifies the monitor,
and the type is the data type used by dot2c/k on the representation
of the model.
For example, the model "wip" below:
preempt_disable sched_waking
+############+ >------------------> +################+ >------------+
-># preemptive # # non-preemptive # |
+############+ <-----------------< +################+ <------------+
preempt_enable
with two states and three events can be stored in a 'char' type.
Considering that the preemption control is a per-cpu behavior, the
monitor declaration will be:
DECLARE_DA_MON_PER_CPU(wip, char);
The monitor is executed by sending events to be processed via the
functions presented below:
da_handle_event_$(MONITOR_NAME)($(event from event enum));
da_handle_init_event_$(MONITOR_NAME)($(event from event enum));
The function da_handle_event_$(MONITOR_NAME) is the regular case,
while the function da_handle_init_event_$(MONITOR_NAME)() is a
special case used to synchronize the system with the model.
When a monitor is enabled, it is placed in the initial state of the
automata. However, the monitor does not know if the system is in
the initial state. Hence, the monitor ignores events sent by
sent by da_handle_event_$(MONITOR_NAME) until the function
da_handle_init_event_$(MONITOR_NAME)() is called.
The function da_handle_init_event_$(MONITOR_NAME)() should be used for
the case in which the system generates the event is the one that returns
the automata to the initial state.
After receiving a da_handle_init_event_$(MONITOR_NAME)() event, the
monitor will know that it is in sync with the system and hence will
start processing the next events.
Using the wip model as example, the events "preempt_disable" and
"sched_waking" should be sent to monitor, respectively, via:
da_handle_event_wip(preempt_disable);
da_handle_event_wip(sched_waking);
While the event "preempt_enabled" will use:
da_handle_init_event_wip(preempt_enable);
To notify the monitor that the system will be returning to the initial
state, so the system and the monitor should be in sync.
With the monitor synthesis in place, using these headers and dot2k,
the developer's work should be limited to the instrumentation of
the system, increasing the confidence in the overall approach.
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Gabriele Paoloni <gpaoloni@redhat.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Clark Williams <williams@redhat.com>
Cc: linux-doc@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-trace-devel@vger.kernel.org
Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
---
include/linux/rv.h | 2 +
include/rv/da_monitor.h | 419 ++++++++++++++++++++++++++++++++++++++
include/rv/rv.h | 9 +
include/trace/events/rv.h | 120 +++++++++++
kernel/fork.c | 2 +-
kernel/trace/rv/Kconfig | 14 ++
kernel/trace/rv/rv.c | 5 +
7 files changed, 570 insertions(+), 1 deletion(-)
create mode 100644 include/rv/da_monitor.h
create mode 100644 include/trace/events/rv.h
diff --git a/include/linux/rv.h b/include/linux/rv.h
index 1e48c6bb74bf..af2081671219 100644
--- a/include/linux/rv.h
+++ b/include/linux/rv.h
@@ -9,6 +9,8 @@
#ifndef _LINUX_RV_H
#define _LINUX_RV_H
+#define MAX_DA_NAME_LEN 24
+
struct rv_reactor {
char *name;
char *description;
diff --git a/include/rv/da_monitor.h b/include/rv/da_monitor.h
new file mode 100644
index 000000000000..043660429659
--- /dev/null
+++ b/include/rv/da_monitor.h
@@ -0,0 +1,419 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Deterministic automata (DA) monitor functions, to be used togheter
+ * with automata models in C generated by the dot2k tool.
+ *
+ * The dot2k tool is available at tools/tracing/rv/
+ *
+ * Copyright (C) 2019-2022 Daniel Bristot de Oliveira <bristot@kernel.org>
+ */
+
+#include <rv/automata.h>
+#include <linux/rv.h>
+
+/*
+ * Generic helpers for all types of deterministic automata monitors.
+ */
+#define DECLARE_DA_MON_GENERIC_HELPERS(name, type) \
+static char REACT_MSG[1024]; \
+ \
+static inline char \
+*format_react_msg(type curr_state, type event) \
+{ \
+ snprintf(REACT_MSG, 1024, \
+ "rv: monitor %s does not allow event %s on state %s\n", \
+ MODULE_NAME, \
+ model_get_event_name_##name(event), \
+ model_get_state_name_##name(curr_state)); \
+ return REACT_MSG; \
+} \
+ \
+static void cond_react(char *msg) \
+{ \
+ if (rv_##name.react) \
+ rv_##name.react(msg); \
+} \
+ \
+static inline void da_monitor_reset_##name(struct da_monitor *da_mon) \
+{ \
+ da_mon->monitoring = 0; \
+ da_mon->curr_state = model_get_init_state_##name(); \
+} \
+ \
+static inline type da_monitor_curr_state_##name(struct da_monitor *da_mon) \
+{ \
+ return da_mon->curr_state; \
+} \
+ \
+static inline void \
+da_monitor_set_state_##name(struct da_monitor *da_mon, enum states_##name state)\
+{ \
+ da_mon->curr_state = state; \
+} \
+static inline void da_monitor_start_##name(struct da_monitor *da_mon) \
+{ \
+ da_mon->monitoring = 1; \
+} \
+ \
+static inline bool da_monitoring_##name(struct da_monitor *da_mon) \
+{ \
+ return da_mon->monitoring; \
+}
+
+
+/*
+ * Event handler for implict monitors. Implicity monitor is the one which the
+ * handler does not need to specify which da_monitor to manilupulate. Examples
+ * of implicit monitor are the per_cpu or the global ones.
+ */
+#define DECLARE_DA_MON_MODEL_HANDLER_IMPLICIT(name, type) \
+static inline bool \
+da_event_##name(struct da_monitor *da_mon, enum events_##name event) \
+{ \
+ type curr_state = da_monitor_curr_state_##name(da_mon); \
+ type next_state = model_get_next_state_##name(curr_state, event); \
+ \
+ if (next_state >= 0) { \
+ da_monitor_set_state_##name(da_mon, next_state); \
+ \
+ trace_event_##name(model_get_state_name_##name(curr_state), \
+ model_get_event_name_##name(event), \
+ model_get_state_name_##name(next_state), \
+ model_is_final_state_##name(next_state)); \
+ \
+ return true; \
+ } \
+ \
+ if (reacting_on) \
+ cond_react(format_react_msg(curr_state, event)); \
+ \
+ trace_error_##name(model_get_state_name_##name(curr_state), \
+ model_get_event_name_##name(event)); \
+ \
+ return false; \
+} \
+
+/*
+ * Event handler for per_task monitors.
+ */
+#define DECLARE_DA_MON_MODEL_HANDLER_PER_TASK(name, type) \
+static inline type \
+da_event_##name(struct da_monitor *da_mon, struct task_struct *tsk, \
+ enum events_##name event) \
+{ \
+ type curr_state = da_monitor_curr_state_##name(da_mon); \
+ type next_state = model_get_next_state_##name(curr_state, event); \
+ \
+ if (next_state >= 0) { \
+ da_monitor_set_state_##name(da_mon, next_state); \
+ \
+ trace_event_##name(tsk->pid, \
+ model_get_state_name_##name(curr_state), \
+ model_get_event_name_##name(event), \
+ model_get_state_name_##name(next_state), \
+ model_is_final_state_##name(next_state)); \
+ \
+ return true; \
+ } \
+ \
+ if (reacting_on) \
+ cond_react(format_react_msg(curr_state, event)); \
+ \
+ trace_error_##name(tsk->pid, \
+ model_get_state_name_##name(curr_state), \
+ model_get_event_name_##name(event)); \
+ \
+ return false; \
+}
+
+/*
+ * Functions to define, init and get a global monitor.
+ */
+#define DECLARE_DA_MON_INIT_GLOBAL(name, type) \
+ \
+static struct da_monitor da_mon_##name; \
+ \
+static struct da_monitor *da_get_monitor_##name(void) \
+{ \
+ return &da_mon_##name; \
+} \
+ \
+static void da_monitor_reset_all_##name(void) \
+{ \
+ da_monitor_reset_##name(da_mon_##name); \
+} \
+ \
+static inline int da_monitor_init_##name(void) \
+{ \
+ struct da_monitor *da_mon = &da_mon_##name \
+ da_mon->curr_state = model_get_init_state_##name(); \
+ da_mon->monitoring = 0; \
+ return 0; \
+} \
+ \
+static inline void da_monitor_destroy_##name(void) \
+{ \
+ return; \
+}
+
+/*
+ * Functions to define, init and get a per-cpu monitor.
+ */
+#define DECLARE_DA_MON_INIT_PER_CPU(name, type) \
+ \
+DEFINE_PER_CPU(struct da_monitor, da_mon_##name); \
+ \
+static struct da_monitor *da_get_monitor_##name(void) \
+{ \
+ return this_cpu_ptr(&da_mon_##name); \
+} \
+ \
+static void da_monitor_reset_all_##name(void) \
+{ \
+ struct da_monitor *da_mon; \
+ int cpu; \
+ for_each_cpu(cpu, cpu_online_mask) { \
+ da_mon = per_cpu_ptr(&da_mon_##name, cpu); \
+ da_monitor_reset_##name(da_mon); \
+ } \
+} \
+ \
+static inline int da_monitor_init_##name(void) \
+{ \
+ struct da_monitor *da_mon; \
+ int cpu; \
+ for_each_cpu(cpu, cpu_online_mask) { \
+ da_mon = per_cpu_ptr(&da_mon_##name, cpu); \
+ da_mon->curr_state = model_get_init_state_##name(); \
+ da_mon->monitoring = 0; \
+ } \
+ return 0; \
+} \
+ \
+static inline void da_monitor_destroy_##name(void) \
+{ \
+ return; \
+}
+
+/*
+ * Functions to define, init and get a per-task monitor.
+ */
+#define DECLARE_DA_MON_INIT_PER_TASK(name, type) \
+ \
+static int task_mon_slot_##name = RV_PER_TASK_MONITOR_INIT; \
+ \
+static inline struct da_monitor *da_get_monitor_##name(struct task_struct *tsk) \
+{ \
+ return &tsk->rv[task_mon_slot_##name].da_mon; \
+} \
+ \
+static void da_monitor_reset_all_##name(void) \
+{ \
+ struct task_struct *g, *p; \
+ \
+ read_lock(&tasklist_lock); \
+ for_each_process_thread(g, p) \
+ da_monitor_reset_##name(da_get_monitor_##name(p)); \
+ read_unlock(&tasklist_lock); \
+} \
+ \
+static int da_monitor_init_##name(void) \
+{ \
+ struct da_monitor *da_mon; \
+ struct task_struct *g, *p; \
+ int retval; \
+ \
+ retval = get_task_monitor_slot(); \
+ if (retval < 0) \
+ return retval; \
+ \
+ task_mon_slot_##name = retval; \
+ \
+ read_lock(&tasklist_lock); \
+ for_each_process_thread(g, p) { \
+ da_mon = da_get_monitor_##name(p); \
+ da_mon->curr_state = model_get_init_state_##name(); \
+ da_mon->monitoring = 0; \
+ } \
+ read_unlock(&tasklist_lock); \
+ \
+ return 0; \
+} \
+ \
+static inline void da_monitor_destroy_##name(void) \
+{ \
+ if (task_mon_slot_##name == RV_PER_TASK_MONITOR_INIT) { \
+ WARN_ONCE(1, "Disabling a disabled monitor: " #name); \
+ return; \
+ } \
+ put_task_monitor_slot(task_mon_slot_##name); \
+ return; \
+}
+
+/*
+ * Handle event for implicit monitor: da_get_monitor_##name() will figure out
+ * the monitor.
+ */
+#define DECLARE_DA_MON_MONITOR_HANDLER_IMPLICIT(name, type) \
+ \
+static inline void __da_handle_event_##name(struct da_monitor *da_mon, \
+ enum events_##name event) \
+{ \
+ int retval; \
+ \
+ if (unlikely(!monitoring_on)) \
+ return; \
+ \
+ if (unlikely(!rv_##name.enabled)) \
+ return; \
+ \
+ if (unlikely(!da_monitoring_##name(da_mon))) \
+ return; \
+ \
+ retval = da_event_##name(da_mon, event); \
+ \
+ if (!retval) \
+ da_monitor_reset_##name(da_mon); \
+} \
+ \
+static inline void da_handle_event_##name(enum events_##name event) \
+{ \
+ struct da_monitor *da_mon = da_get_monitor_##name(); \
+ __da_handle_event_##name(da_mon, event); \
+} \
+ \
+static inline bool da_handle_init_event_##name(enum events_##name event) \
+{ \
+ struct da_monitor *da_mon; \
+ \
+ if (unlikely(!rv_##name.enabled)) \
+ return false; \
+ \
+ da_mon = da_get_monitor_##name(); \
+ \
+ if (unlikely(!da_monitoring_##name(da_mon))) { \
+ da_monitor_start_##name(da_mon); \
+ return false; \
+ } \
+ \
+ __da_handle_event_##name(da_mon, event); \
+ \
+ return true; \
+} \
+ \
+static inline bool da_handle_init_run_event_##name(enum events_##name event) \
+{ \
+ struct da_monitor *da_mon; \
+ \
+ if (unlikely(!rv_##name.enabled)) \
+ return false; \
+ \
+ da_mon = da_get_monitor_##name(); \
+ \
+ if (unlikely(!da_monitoring_##name(da_mon))) \
+ da_monitor_start_##name(da_mon); \
+ \
+ __da_handle_event_##name(da_mon, event); \
+ \
+ return true; \
+}
+
+/*
+ * Handle event for per task.
+ */
+#define DECLARE_DA_MON_MONITOR_HANDLER_PER_TASK(name, type) \
+ \
+static inline void \
+__da_handle_event_##name(struct da_monitor *da_mon, struct task_struct *tsk, \
+ enum events_##name event) \
+{ \
+ int retval; \
+ \
+ if (unlikely(!monitoring_on)) \
+ return; \
+ \
+ if (unlikely(!rv_##name.enabled)) \
+ return; \
+ \
+ if (unlikely(!da_monitoring_##name(da_mon))) \
+ return; \
+ \
+ retval = da_event_##name(da_mon, tsk, event); \
+ \
+ if (!retval) \
+ da_monitor_reset_##name(da_mon); \
+} \
+ \
+static inline void \
+da_handle_event_##name(struct task_struct *tsk, enum events_##name event) \
+{ \
+ struct da_monitor *da_mon = da_get_monitor_##name(tsk); \
+ __da_handle_event_##name(da_mon, tsk, event); \
+} \
+ \
+static inline bool \
+da_handle_init_event_##name(struct task_struct *tsk, enum events_##name event) \
+{ \
+ struct da_monitor *da_mon; \
+ \
+ if (unlikely(!rv_##name.enabled)) \
+ return false; \
+ \
+ da_mon = da_get_monitor_##name(tsk); \
+ \
+ if (unlikely(!da_monitoring_##name(da_mon))) { \
+ da_monitor_start_##name(da_mon); \
+ return false; \
+ } \
+ \
+ __da_handle_event_##name(da_mon, tsk, event); \
+ \
+ return true; \
+}
+
+/*
+ * Entry point for the global monitor.
+ */
+#define DECLARE_DA_MON_GLOBAL(name, type) \
+ \
+DECLARE_AUTOMATA_HELPERS(name, type); \
+ \
+DECLARE_DA_MON_GENERIC_HELPERS(name, type); \
+ \
+DECLARE_DA_MON_MODEL_HANDLER_IMPLICIT(name, type); \
+ \
+DECLARE_DA_MON_INIT_PER_CPU(name, type); \
+ \
+DECLARE_DA_MON_MONITOR_HANDLER_IMPLICIT(name, type);
+
+
+/*
+ * Entry point for the per-cpu monitor.
+ */
+#define DECLARE_DA_MON_PER_CPU(name, type) \
+ \
+DECLARE_AUTOMATA_HELPERS(name, type); \
+ \
+DECLARE_DA_MON_GENERIC_HELPERS(name, type); \
+ \
+DECLARE_DA_MON_MODEL_HANDLER_IMPLICIT(name, type); \
+ \
+DECLARE_DA_MON_INIT_PER_CPU(name, type); \
+ \
+DECLARE_DA_MON_MONITOR_HANDLER_IMPLICIT(name, type);
+
+
+/*
+ * Entry point for the per-task monitor.
+ */
+#define DECLARE_DA_MON_PER_TASK(name, type) \
+ \
+DECLARE_AUTOMATA_HELPERS(name, type); \
+ \
+DECLARE_DA_MON_GENERIC_HELPERS(name, type); \
+ \
+DECLARE_DA_MON_MODEL_HANDLER_PER_TASK(name, type); \
+ \
+DECLARE_DA_MON_INIT_PER_TASK(name, type); \
+ \
+DECLARE_DA_MON_MONITOR_HANDLER_PER_TASK(name, type);
diff --git a/include/rv/rv.h b/include/rv/rv.h
index 27a108881d35..b0658cdc53d9 100644
--- a/include/rv/rv.h
+++ b/include/rv/rv.h
@@ -3,6 +3,14 @@
#ifndef _RV_RV_H
#define _RV_RV_H
+/*
+ * Deterministic automaton per-object variables.
+ */
+struct da_monitor {
+ bool monitoring;
+ int curr_state;
+};
+
/*
* Per-task RV monitors count. Nowadays fixed in RV_PER_TASK_MONITORS.
* If we find justification for more monitors, we can think about
@@ -16,6 +24,7 @@
* Futher monitor types are expected, so make this a union.
*/
union rv_task_monitor {
+ struct da_monitor da_mon;
};
int get_task_monitor_slot(void);
diff --git a/include/trace/events/rv.h b/include/trace/events/rv.h
new file mode 100644
index 000000000000..9f40f2a49f84
--- /dev/null
+++ b/include/trace/events/rv.h
@@ -0,0 +1,120 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM rv
+
+#if !defined(_TRACE_RV_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_RV_H
+
+#include <linux/rv.h>
+#include <linux/tracepoint.h>
+
+#ifdef CONFIG_DA_MON_EVENTS_IMPLICIT
+DECLARE_EVENT_CLASS(event_da_monitor,
+
+ TP_PROTO(char *state, char *event, char *next_state, bool safe),
+
+ TP_ARGS(state, event, next_state, safe),
+
+ TP_STRUCT__entry(
+ __array( char, state, MAX_DA_NAME_LEN )
+ __array( char, event, MAX_DA_NAME_LEN )
+ __array( char, next_state, MAX_DA_NAME_LEN )
+ __field( bool, safe )
+ ),
+
+ TP_fast_assign(
+ memcpy(__entry->state, state, MAX_DA_NAME_LEN);
+ memcpy(__entry->event, event, MAX_DA_NAME_LEN);
+ memcpy(__entry->next_state, next_state, MAX_DA_NAME_LEN);
+ __entry->safe = safe;
+ ),
+
+ TP_printk("%s x %s -> %s %s",
+ __entry->state,
+ __entry->event,
+ __entry->next_state,
+ __entry->safe ? "(safe)" : "")
+);
+
+DECLARE_EVENT_CLASS(error_da_monitor,
+
+ TP_PROTO(char *state, char *event),
+
+ TP_ARGS(state, event),
+
+ TP_STRUCT__entry(
+ __array( char, state, MAX_DA_NAME_LEN )
+ __array( char, event, MAX_DA_NAME_LEN )
+ ),
+
+ TP_fast_assign(
+ memcpy(__entry->state, state, MAX_DA_NAME_LEN);
+ memcpy(__entry->event, event, MAX_DA_NAME_LEN);
+ ),
+
+ TP_printk("event %s not expected in the state %s",
+ __entry->event,
+ __entry->state)
+);
+#endif /* CONFIG_DA_MON_EVENTS_IMPLICIT */
+
+#ifdef CONFIG_DA_MON_EVENTS_ID
+DECLARE_EVENT_CLASS(event_da_monitor_id,
+
+ TP_PROTO(int id, char *state, char *event, char *next_state, bool safe),
+
+ TP_ARGS(id, state, event, next_state, safe),
+
+ TP_STRUCT__entry(
+ __field( int, id )
+ __array( char, state, MAX_DA_NAME_LEN )
+ __array( char, event, MAX_DA_NAME_LEN )
+ __array( char, next_state, MAX_DA_NAME_LEN )
+ __field( bool, safe )
+ ),
+
+ TP_fast_assign(
+ memcpy(__entry->state, state, MAX_DA_NAME_LEN);
+ memcpy(__entry->event, event, MAX_DA_NAME_LEN);
+ memcpy(__entry->next_state, next_state, MAX_DA_NAME_LEN);
+ __entry->id = id;
+ __entry->safe = safe;
+ ),
+
+ TP_printk("%d: %s x %s -> %s %s",
+ __entry->id,
+ __entry->state,
+ __entry->event,
+ __entry->next_state,
+ __entry->safe ? "(safe)" : "")
+);
+
+DECLARE_EVENT_CLASS(error_da_monitor_id,
+
+ TP_PROTO(int id, char *state, char *event),
+
+ TP_ARGS(id, state, event),
+
+ TP_STRUCT__entry(
+ __field( int, id )
+ __array( char, state, MAX_DA_NAME_LEN )
+ __array( char, event, MAX_DA_NAME_LEN )
+ ),
+
+ TP_fast_assign(
+ memcpy(__entry->state, state, MAX_DA_NAME_LEN);
+ memcpy(__entry->event, event, MAX_DA_NAME_LEN);
+ __entry->id = id;
+ ),
+
+ TP_printk("%d: event %s not expected in the state %s",
+ __entry->id,
+ __entry->event,
+ __entry->state)
+);
+#endif /* CONFIG_DA_MON_EVENTS_ID */
+#endif /* _TRACE_RV_H */
+
+/* This part ust be outside protection */
+#undef TRACE_INCLUDE_PATH
+#include <trace/define_trace.h>
diff --git a/kernel/fork.c b/kernel/fork.c
index 5e40e58ef83d..6f1f82ccd5f2 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1970,7 +1970,7 @@ static void rv_task_fork(struct task_struct *p)
int i;
for (i = 0; i < RV_PER_TASK_MONITORS; i++)
- ;
+ p->rv[i].da_mon.monitoring = false;
}
#else
#define rv_task_fork(p) do {} while (0)
diff --git a/kernel/trace/rv/Kconfig b/kernel/trace/rv/Kconfig
index 560408fec0c8..1eafb5adcfcb 100644
--- a/kernel/trace/rv/Kconfig
+++ b/kernel/trace/rv/Kconfig
@@ -1,5 +1,19 @@
# SPDX-License-Identifier: GPL-2.0-only
#
+config DA_MON_EVENTS
+ default n
+ bool
+
+config DA_MON_EVENTS_IMPLICIT
+ select DA_MON_EVENTS
+ default n
+ bool
+
+config DA_MON_EVENTS_ID
+ select DA_MON_EVENTS
+ default n
+ bool
+
menuconfig RV
bool "Runtime Verification"
depends on TRACING
diff --git a/kernel/trace/rv/rv.c b/kernel/trace/rv/rv.c
index 7576d492a974..51a610227341 100644
--- a/kernel/trace/rv/rv.c
+++ b/kernel/trace/rv/rv.c
@@ -143,6 +143,11 @@
#include <linux/slab.h>
#include <rv/rv.h>
+#ifdef CONFIG_DA_MON_EVENTS
+#define CREATE_TRACE_POINTS
+#include <trace/events/rv.h>
+#endif
+
#include "rv.h"
DEFINE_MUTEX(rv_interface_lock);
--
2.35.1
^ permalink raw reply related [flat|nested] 82+ messages in thread
* [PATCH V4 05/20] rv/include: Add instrumentation helper functions
2022-06-16 8:44 [PATCH V4 00/20] The Runtime Verification (RV) interface Daniel Bristot de Oliveira
` (3 preceding siblings ...)
2022-06-16 8:44 ` [PATCH V4 04/20] rv/include: Add deterministic automata monitor definition via C macros Daniel Bristot de Oliveira
@ 2022-06-16 8:44 ` Daniel Bristot de Oliveira
2022-06-16 8:44 ` [PATCH V4 06/20] tools/rv: Add dot2c Daniel Bristot de Oliveira
` (16 subsequent siblings)
21 siblings, 0 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-16 8:44 UTC (permalink / raw)
To: Steven Rostedt
Cc: Daniel Bristot de Oliveira, Wim Van Sebroeck, Guenter Roeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel
Instrumentation helper functions to facilitate the instrumentation of
auto-generated RV monitors create by dot2k.
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Gabriele Paoloni <gpaoloni@redhat.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Clark Williams <williams@redhat.com>
Cc: linux-doc@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-trace-devel@vger.kernel.org
Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
---
include/rv/instrumentation.h | 23 +++++++++++++++++++++++
1 file changed, 23 insertions(+)
create mode 100644 include/rv/instrumentation.h
diff --git a/include/rv/instrumentation.h b/include/rv/instrumentation.h
new file mode 100644
index 000000000000..88dd33f10827
--- /dev/null
+++ b/include/rv/instrumentation.h
@@ -0,0 +1,23 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Helper functions to facilitate the instrumentation of auto-generated
+ * RV monitors create by dot2k.
+ *
+ * The dot2k tool is available at tools/tracing/rv/dot2/
+ *
+ * Copyright (C) 2019-2022 Daniel Bristot de Oliveira <bristot@kernel.org>
+ */
+
+#include <linux/ftrace.h>
+
+#define rv_attach_trace_probe(monitor, tp, rv_handler) \
+ do { \
+ check_trace_callback_type_##tp(rv_handler); \
+ WARN_ONCE(register_trace_##tp(rv_handler, NULL), \
+ "fail attaching " #monitor " " #tp "handler"); \
+ } while (0)
+
+#define rv_detach_trace_probe(monitor, tp, rv_handler) \
+ do { \
+ unregister_trace_##tp(rv_handler, NULL); \
+ } while (0)
--
2.35.1
^ permalink raw reply related [flat|nested] 82+ messages in thread
* [PATCH V4 06/20] tools/rv: Add dot2c
2022-06-16 8:44 [PATCH V4 00/20] The Runtime Verification (RV) interface Daniel Bristot de Oliveira
` (4 preceding siblings ...)
2022-06-16 8:44 ` [PATCH V4 05/20] rv/include: Add instrumentation helper functions Daniel Bristot de Oliveira
@ 2022-06-16 8:44 ` Daniel Bristot de Oliveira
2022-06-28 18:10 ` Steven Rostedt
2022-06-28 18:16 ` Steven Rostedt
2022-06-16 8:44 ` [PATCH V4 07/20] tools/rv: Add dot2k Daniel Bristot de Oliveira
` (15 subsequent siblings)
21 siblings, 2 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-16 8:44 UTC (permalink / raw)
To: Steven Rostedt
Cc: Daniel Bristot de Oliveira, Wim Van Sebroeck, Guenter Roeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel
dot2c is a tool that transforms an automata in the graphiviz .dot file
into an C representation of the automata.
usage: dot2c [-h] dot_file
dot2c: converts a .dot file into a C structure
positional arguments:
dot_file The dot file to be converted
optional arguments:
-h, --help show this help message and exit
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Gabriele Paoloni <gpaoloni@redhat.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Clark Williams <williams@redhat.com>
Cc: linux-doc@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-trace-devel@vger.kernel.org
Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
---
tools/verification/dot2/Makefile | 21 +++
tools/verification/dot2/automata.py | 179 ++++++++++++++++++++
tools/verification/dot2/dot2c | 30 ++++
tools/verification/dot2/dot2c.py | 244 ++++++++++++++++++++++++++++
4 files changed, 474 insertions(+)
create mode 100644 tools/verification/dot2/Makefile
create mode 100644 tools/verification/dot2/automata.py
create mode 100644 tools/verification/dot2/dot2c
create mode 100644 tools/verification/dot2/dot2c.py
diff --git a/tools/verification/dot2/Makefile b/tools/verification/dot2/Makefile
new file mode 100644
index 000000000000..235d182f6b2c
--- /dev/null
+++ b/tools/verification/dot2/Makefile
@@ -0,0 +1,21 @@
+INSTALL=install
+
+prefix ?= /usr
+bindir ?= $(prefix)/bin
+mandir ?= $(prefix)/share/man
+miscdir ?= $(prefix)/share/dot2
+srcdir ?= $(prefix)/src
+
+PYLIB ?= $(shell python3 -c 'import sysconfig; print (sysconfig.get_path("purelib"))')
+
+.PHONY: all
+all:
+
+.PHONY: clean
+clean:
+
+.PHONY: install
+install:
+ $(INSTALL) automata.py -D -m 644 $(DESTDIR)$(PYLIB)/dot2/automata.py
+ $(INSTALL) dot2c.py -D -m 644 $(DESTDIR)$(PYLIB)/dot2/dot2c.py
+ $(INSTALL) dot2c -D -m 755 $(DESTDIR)$(bindir)/
diff --git a/tools/verification/dot2/automata.py b/tools/verification/dot2/automata.py
new file mode 100644
index 000000000000..171ad4497983
--- /dev/null
+++ b/tools/verification/dot2/automata.py
@@ -0,0 +1,179 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# automata object: parse a dot file into a python object
+# For more information, see:
+# https://bristot.me/efficient-formal-verification-for-the-linux-kernel/
+#
+# This program was written in the development of this paper:
+# de Oliveira, D. B. and Cucinotta, T. and de Oliveira, R. S.
+# "Efficient Formal Verification for the Linux Kernel." International
+# Conference on Software Engineering and Formal Methods. Springer, Cham, 2019.
+#
+# Copyright 2018-2020 Red Hat, Inc.
+#
+# Author:
+# Daniel Bristot de Oliveira <bristot@kernel.org>
+
+import ntpath
+
+class Automata:
+ """Automata class: Reads a dot file and part it as an automata.
+
+ Attributes:
+ dot_file: A dot file with an state_automaton definition.
+ """
+
+ def __init__(self, file_path):
+ self.__dot_path=file_path
+ self.name=self.__get_model_name()
+ self.__dot_lines = self.__open_dot()
+ self.states, self.initial_state, self.final_states = self.__get_state_variables()
+ self.events = self.__get_event_variables()
+ self.function = self.__create_matrix()
+
+ def __get_model_name(self):
+ basename=ntpath.basename(self.__dot_path)
+ if basename.endswith(".dot") == False:
+ print("not a dot file")
+ raise Exception("not a dot file: %s" % self.__dot_path)
+
+ model_name=basename[0:-4]
+ if model_name.__len__() == 0:
+ raise Exception("not a dot file: %s" % self.__dot_path)
+
+ return model_name
+
+ def __open_dot(self):
+ cursor = 0
+ dot_lines = []
+ try:
+ dot_file = open(self.__dot_path)
+ except:
+ raise Exception("Cannot open the file: %s" % self.__dot_path)
+
+ dot_lines = dot_file.read().splitlines()
+ dot_file.close()
+
+ # checking the first line:
+ line = dot_lines[cursor].split()
+
+ if (line[0] != "digraph") and (line[1] != "state_automaton"):
+ raise Exception("Not a valid .dot format: %s" % self.__dot_path)
+ else:
+ cursor = cursor + 1
+ return dot_lines
+
+ def __get_cursor_begin_states(self):
+ cursor = 0
+ while self.__dot_lines[cursor].split()[0] != "{node":
+ cursor += 1
+ return cursor
+
+ def __get_cursor_begin_events(self):
+ cursor = 0
+ while self.__dot_lines[cursor].split()[0] != "{node":
+ cursor += 1
+ while self.__dot_lines[cursor].split()[0] == "{node":
+ cursor += 1
+ # skip initial state transition
+ cursor += 1
+ return cursor
+
+ def __get_state_variables(self):
+ # wait for node declaration
+ states = []
+ final_states=[]
+
+ has_final_states = False
+ cursor = self.__get_cursor_begin_states()
+
+ # process nodes
+ while self.__dot_lines[cursor].split()[0] == "{node":
+ line = self.__dot_lines[cursor].split()
+ raw_state = line[-1]
+
+ # "enabled_fired"}; -> enabled_fired
+ state = raw_state.replace('"', '').replace('};', '').replace(',','_')
+ if state[0:7] == "__init_":
+ initial_state = state[7:]
+ else:
+ states.append(state)
+ if self.__dot_lines[cursor].__contains__("doublecircle") == True:
+ final_states.append(state)
+ has_final_states = True
+
+ if self.__dot_lines[cursor].__contains__("ellipse") == True:
+ final_states.append(state)
+ has_final_states = True
+
+ cursor = cursor + 1
+
+ states = sorted(set(states))
+ states.remove(initial_state)
+
+ # Insert the initial state at the bein og the states
+ states.insert(0, initial_state)
+
+ if has_final_states == False:
+ final_states.append(initial_state)
+
+ return states, initial_state, final_states
+
+ def __get_event_variables(self):
+ # here we are at the begin of transitions, take a note, we will return later.
+ cursor = self.__get_cursor_begin_events()
+
+ events = []
+ while self.__dot_lines[cursor][1] == '"':
+ # transitions have the format:
+ # "all_fired" -> "both_fired" [ label = "disable_irq" ];
+ # ------------ event is here ------------^^^^^
+ if self.__dot_lines[cursor].split()[1] == "->":
+ line = self.__dot_lines[cursor].split()
+ event = line[-2].replace('"','')
+
+ # when a transition has more than one lables, they are like this
+ # "local_irq_enable\nhw_local_irq_enable_n"
+ # so split them.
+
+ event = event.replace("\\n", " ")
+ for i in event.split():
+ events.append(i)
+ cursor = cursor + 1
+
+ return sorted(set(events))
+
+ def __create_matrix(self):
+ # transform the array into a dictionary
+ events = self.events
+ states = self.states
+ events_dict = {}
+ states_dict = {}
+ nr_event = 0
+ for event in events:
+ events_dict[event] = nr_event
+ nr_event += 1
+
+ nr_state = 0
+ for state in states:
+ states_dict[state] = nr_state
+ nr_state = nr_state + 1
+
+ # declare the matrix....
+ matrix = [['-1' for x in range(nr_event)] for y in range(nr_state)]
+
+ # and we are back! Let's fill the matrix
+ cursor = self.__get_cursor_begin_events()
+
+ while self.__dot_lines[cursor][1] == '"':
+ if self.__dot_lines[cursor].split()[1] == "->":
+ line = self.__dot_lines[cursor].split()
+ origin_state = line[0].replace('"','').replace(',','_')
+ dest_state = line[2].replace('"','').replace(',','_')
+ possible_events = line[-2].replace('"','').replace("\\n", " ")
+ for event in possible_events.split():
+ matrix[states_dict[origin_state]][events_dict[event]] = dest_state
+ cursor = cursor + 1
+
+ return matrix
diff --git a/tools/verification/dot2/dot2c b/tools/verification/dot2/dot2c
new file mode 100644
index 000000000000..0165f203dedc
--- /dev/null
+++ b/tools/verification/dot2/dot2c
@@ -0,0 +1,30 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# dot2m: transform dot files into C structures.
+# For more information, see:
+# https://bristot.me/efficient-formal-verification-for-the-linux-kernel/
+#
+# This program was written in the development of this paper:
+# de Oliveira, D. B. and Cucinotta, T. and de Oliveira, R. S.
+# "Efficient Formal Verification for the Linux Kernel." International
+# Conference on Software Engineering and Formal Methods. Springer, Cham, 2019.
+#
+# Copyright 2018-2020 Red Hat, Inc.
+#
+# Author:
+# Daniel Bristot de Oliveira <bristot@kernel.org>
+
+if __name__ == '__main__':
+ from dot2 import dot2c
+ import argparse
+ import ntpath
+ import sys
+
+ parser = argparse.ArgumentParser(description='dot2c: converts a .dot file into a C structure')
+ parser.add_argument('dot_file', help='The dot file to be converted')
+
+
+ args = parser.parse_args()
+ d=dot2c.Dot2c(args.dot_file)
+ d.print_model_classic()
diff --git a/tools/verification/dot2/dot2c.py b/tools/verification/dot2/dot2c.py
new file mode 100644
index 000000000000..07f040ebf882
--- /dev/null
+++ b/tools/verification/dot2/dot2c.py
@@ -0,0 +1,244 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# dot2c: transform dot files into C structures.
+# For more information, see:
+# https://bristot.me/efficient-formal-verification-for-the-linux-kernel/
+#
+# This program was written in the development of this paper:
+# de Oliveira, D. B. and Cucinotta, T. and de Oliveira, R. S.
+# "Efficient Formal Verification for the Linux Kernel." International
+# Conference on Software Engineering and Formal Methods. Springer, Cham, 2019.
+#
+# Copyright 2018-2022 Red Hat, Inc.
+#
+# Author:
+# Daniel Bristot de Oliveira <bristot@kernel.org>
+
+from dot2.automata import Automata
+
+class Dot2c(Automata):
+ enum_suffix=""
+ enum_states_def="states"
+ enum_events_def="events"
+ struct_automaton_def="automaton"
+ var_automaton_def="aut"
+
+ def __init__(self, file_path):
+ super().__init__(file_path)
+ self.line_length=80
+
+ def __buff_to_string(self, buff):
+ string=""
+
+ for line in buff:
+ string=string + line + "\n"
+
+ # cut off the last \n
+ return string[:-1]
+
+ def __get_enum_states_content(self):
+ buff=[]
+ buff.append("\t%s%s = 0," % (self.initial_state, self.enum_suffix))
+ for state in self.states:
+ if state != self.initial_state:
+ buff.append("\t%s%s," % (state, self.enum_suffix))
+ buff.append("\tstate_max%s" % (self.enum_suffix))
+
+ return buff
+
+ def get_enum_states_string(self):
+ buff=self.__get_enum_states_content()
+ return self.__buff_to_string(buff)
+
+ def format_states_enum(self):
+ buff=[]
+ buff.append("enum %s {" % self.enum_states_def)
+ buff.append(self.get_enum_states_string())
+ buff.append("};\n")
+
+ return buff
+
+ def __get_enum_events_content(self):
+ buff=[]
+ first=True
+ for event in self.events:
+ if first:
+ buff.append("\t%s%s = 0," % (event, self.enum_suffix))
+ first=False
+ else:
+ buff.append("\t%s%s," % (event, self.enum_suffix))
+ buff.append("\tevent_max%s" % self.enum_suffix)
+
+ return buff
+
+ def get_enum_events_string(self):
+ buff=self.__get_enum_events_content()
+ return self.__buff_to_string(buff)
+
+ def format_events_enum(self):
+ buff=[]
+ buff.append("enum %s {" % self.enum_events_def)
+ buff.append(self.get_enum_events_string())
+ buff.append("};\n")
+
+ return buff
+
+ def get_minimun_type(self):
+ min_type="char"
+
+ if self.states.__len__() > 255:
+ min_type="short"
+
+ if self.states.__len__() > 65535:
+ min_type="int"
+
+ return min_type
+
+ def format_automaton_definition(self):
+ min_type = self.get_minimun_type()
+ buff=[]
+ buff.append("struct %s {" % self.struct_automaton_def)
+ buff.append("\tchar *state_names[state_max%s];" % (self.enum_suffix))
+ buff.append("\tchar *event_names[event_max%s];" % (self.enum_suffix))
+ buff.append("\t%s function[state_max%s][event_max%s];" % (min_type, self.enum_suffix, self.enum_suffix))
+ buff.append("\t%s initial_state;" % min_type)
+ buff.append("\tchar final_states[state_max%s];" % (self.enum_suffix))
+ buff.append("};\n")
+ return buff
+
+ def format_aut_init_header(self):
+ buff=[]
+ buff.append("struct %s %s = {" % (self.struct_automaton_def, self.var_automaton_def))
+ return buff
+
+ def __get_string_vector_per_line_content(self, buff):
+ first=True
+ string=""
+ for entry in buff:
+ if first:
+ string = string + "\t\t\"" + entry
+ first=False;
+ else:
+ string = string + "\",\n\t\t\"" + entry
+ string = string + "\""
+
+ return string
+
+ def get_aut_init_events_string(self):
+ return self.__get_string_vector_per_line_content(self.events)
+
+ def get_aut_init_states_string(self):
+ return self.__get_string_vector_per_line_content(self.states)
+
+ def format_aut_init_events_string(self):
+ buff=[]
+ buff.append("\t.event_names = {")
+ buff.append(self.get_aut_init_events_string())
+ buff.append("\t},")
+ return buff
+
+ def format_aut_init_states_string(self):
+ buff=[]
+ buff.append("\t.state_names = {")
+ buff.append(self.get_aut_init_states_string())
+ buff.append("\t},")
+
+ return buff
+
+ def __get_max_strlen_of_states(self):
+ return max(self.states, key=len).__len__()
+
+ def __get_state_string_length(self):
+ maxlen = self.__get_max_strlen_of_states() + self.enum_suffix.__len__()
+ return "%" + str(maxlen) + "s"
+
+ def get_aut_init_function(self):
+ nr_states=self.states.__len__()
+ nr_events=self.events.__len__()
+ buff=[]
+
+ strformat = self.__get_state_string_length()
+
+ for x in range(nr_states):
+ line="\t\t{ "
+ for y in range(nr_events):
+ next_state = self.function[x][y]
+ if next_state != '-1':
+ next_state = self.function[x][y] + self.enum_suffix
+
+ if y != nr_events-1:
+ line = line + strformat % next_state + ", "
+ else:
+ line = line + strformat % next_state + " },"
+ buff.append(line)
+
+ return self.__buff_to_string(buff)
+
+ def format_aut_init_function(self):
+ buff=[]
+ buff.append("\t.function = {")
+ buff.append(self.get_aut_init_function())
+ buff.append("\t},")
+
+ return buff
+
+ def get_aut_init_initial_state(self):
+ return self.initial_state
+
+ def format_aut_init_initial_state(self):
+ buff=[]
+ initial_state=self.get_aut_init_initial_state()
+ buff.append("\t.initial_state = " + initial_state + self.enum_suffix + ",")
+
+ return buff
+
+ def get_aut_init_final_states(self):
+ line=""
+ first=True
+ for state in self.states:
+ if first == False:
+ line = line + ', '
+ else:
+ first = False
+
+ if self.final_states.__contains__(state):
+ line = line + '1'
+ else:
+ line = line + '0'
+ return line
+
+ def format_aut_init_final_states(self):
+ buff=[]
+ buff.append("\t.final_states = { %s }," % self.get_aut_init_final_states())
+
+ return buff
+
+ def __get_automaton_initialization_footer_string(self):
+ footer="};\n"
+ return footer
+
+ def format_aut_init_footer(self):
+ buff=[]
+ buff.append(self.__get_automaton_initialization_footer_string())
+
+ return buff
+
+ def format_model(self):
+ buff=[]
+ buff += self.format_states_enum()
+ buff += self.format_events_enum()
+ buff += self.format_automaton_definition()
+ buff += self.format_aut_init_header()
+ buff += self.format_aut_init_states_string()
+ buff += self.format_aut_init_events_string()
+ buff += self.format_aut_init_function()
+ buff += self.format_aut_init_initial_state()
+ buff += self.format_aut_init_final_states()
+ buff += self.format_aut_init_footer()
+
+ return buff
+
+ def print_model_classic(self):
+ buff=self.format_model()
+ print(self.__buff_to_string(buff))
--
2.35.1
^ permalink raw reply related [flat|nested] 82+ messages in thread
* [PATCH V4 07/20] tools/rv: Add dot2k
2022-06-16 8:44 [PATCH V4 00/20] The Runtime Verification (RV) interface Daniel Bristot de Oliveira
` (5 preceding siblings ...)
2022-06-16 8:44 ` [PATCH V4 06/20] tools/rv: Add dot2c Daniel Bristot de Oliveira
@ 2022-06-16 8:44 ` Daniel Bristot de Oliveira
2022-06-16 8:44 ` [PATCH V4 08/20] rv/monitor: Add the wip monitor skeleton created by dot2k Daniel Bristot de Oliveira
` (14 subsequent siblings)
21 siblings, 0 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-16 8:44 UTC (permalink / raw)
To: Steven Rostedt
Cc: Daniel Bristot de Oliveira, Wim Van Sebroeck, Guenter Roeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel
transform .dot file into kernel rv monitor
usage: dot2k [-h] -d DOT_FILE -t MONITOR_TYPE [-n MODEL_NAME] [-D DESCRIPTION]
optional arguments:
-h, --help show this help message and exit
-d DOT_FILE, --dot DOT_FILE
-t MONITOR_TYPE, --monitor_type MONITOR_TYPE
-n MODEL_NAME, --model_name MODEL_NAME
-D DESCRIPTION, --description DESCRIPTION
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Gabriele Paoloni <gpaoloni@redhat.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Clark Williams <williams@redhat.com>
Cc: linux-doc@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-trace-devel@vger.kernel.org
Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
---
tools/verification/dot2/Makefile | 5 +
tools/verification/dot2/dot2k | 50 +++++
tools/verification/dot2/dot2k.py | 177 ++++++++++++++++++
.../dot2/dot2k_templates/main_global.c | 94 ++++++++++
.../dot2/dot2k_templates/main_per_cpu.c | 94 ++++++++++
.../dot2/dot2k_templates/main_per_task.c | 94 ++++++++++
6 files changed, 514 insertions(+)
create mode 100644 tools/verification/dot2/dot2k
create mode 100644 tools/verification/dot2/dot2k.py
create mode 100644 tools/verification/dot2/dot2k_templates/main_global.c
create mode 100644 tools/verification/dot2/dot2k_templates/main_per_cpu.c
create mode 100644 tools/verification/dot2/dot2k_templates/main_per_task.c
diff --git a/tools/verification/dot2/Makefile b/tools/verification/dot2/Makefile
index 235d182f6b2c..021beb07a521 100644
--- a/tools/verification/dot2/Makefile
+++ b/tools/verification/dot2/Makefile
@@ -19,3 +19,8 @@ install:
$(INSTALL) automata.py -D -m 644 $(DESTDIR)$(PYLIB)/dot2/automata.py
$(INSTALL) dot2c.py -D -m 644 $(DESTDIR)$(PYLIB)/dot2/dot2c.py
$(INSTALL) dot2c -D -m 755 $(DESTDIR)$(bindir)/
+ $(INSTALL) dot2k.py -D -m 644 $(DESTDIR)$(PYLIB)/dot2/dot2k.py
+ $(INSTALL) dot2k -D -m 755 $(DESTDIR)$(bindir)/
+
+ mkdir -p ${miscdir}/
+ cp -rp dot2k_templates $(DESTDIR)$(miscdir)/
diff --git a/tools/verification/dot2/dot2k b/tools/verification/dot2/dot2k
new file mode 100644
index 000000000000..6a35297e812e
--- /dev/null
+++ b/tools/verification/dot2/dot2k
@@ -0,0 +1,50 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# dot2k: transform dot files into a monitor for the Linux kernel.
+#
+# For more information, see:
+# https://bristot.me/efficient-formal-verification-for-the-linux-kernel/
+#
+# Copyright 2018-2020 Red Hat, Inc.
+#
+# Author:
+# Daniel Bristot de Oliveira <bristot@kernel.org>
+
+if __name__ == '__main__':
+ from dot2.dot2k import dot2k
+ import argparse
+ import ntpath
+ import os
+ import platform
+ import sys
+ import sys
+ import argparse
+
+ parser = argparse.ArgumentParser(description='transform .dot file into kernel rv monitor')
+ parser.add_argument('-d', "--dot", dest="dot_file", required=True)
+ parser.add_argument('-t', "--monitor_type", dest="monitor_type", required=True)
+ parser.add_argument('-n', "--model_name", dest="model_name", required=False)
+ parser.add_argument("-D", "--description", dest="description", required=False)
+ params = parser.parse_args()
+
+ print("Opening and parsing the dot file %s" % params.dot_file)
+ try:
+ monitor=dot2k(params.dot_file, params.monitor_type)
+ except Exception as e:
+ print('Error: '+ str(e))
+ print("Sorry : :-(")
+ sys.exit(1)
+
+ # easier than using argparse action.
+ if params.model_name != None:
+ print(params.model_name)
+
+ print("Writing the monitor into the directory %s" % monitor.name)
+ monitor.print_files()
+ print("Almost done, checklist")
+ print(" - Edit the %s/%s.c to add the instrumentation" % (monitor.name, monitor.name))
+ print(" - Edit include/trace/events/rv.h to add the tracepoint entry")
+ print(" - Move it to the kernel's monitor directory")
+ print(" - Edit kernel/trace/rv/Makefile")
+ print(" - Edit kernel/trace/rv/Kconfig")
diff --git a/tools/verification/dot2/dot2k.py b/tools/verification/dot2/dot2k.py
new file mode 100644
index 000000000000..230ad530b50c
--- /dev/null
+++ b/tools/verification/dot2/dot2k.py
@@ -0,0 +1,177 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# dot2k: transform dot files into a monitor for the Linux kernel.
+#
+# For more information, see:
+# https://bristot.me/efficient-formal-verification-for-the-linux-kernel/
+#
+# Copyright 2018-2020 Red Hat, Inc.
+#
+# Author:
+# Daniel Bristot de Oliveira <bristot@kernel.org>
+
+from dot2.dot2c import Dot2c
+import platform
+import os
+
+class dot2k(Dot2c):
+ monitor_types={ "global" : 1, "per_cpu" : 2, "per_task" : 3 }
+ monitor_templates_dir="dot2k/rv_templates/"
+ monitor_type="per_cpu"
+
+ def __init__(self, file_path, MonitorType):
+ super().__init__(file_path)
+
+ self.monitor_type=self.monitor_types.get(MonitorType)
+ if self.monitor_type == None:
+ raise Exception("Unknown monitor type: %s" % MonitorType)
+
+ self.monitor_type=MonitorType
+ self.__fill_rv_templates_dir()
+ self.main_c = self.__open_file(self.monitor_templates_dir + "main_" + MonitorType + ".c")
+ self.enum_suffix = "_%s" % self.name
+
+ def __fill_rv_templates_dir(self):
+
+ if os.path.exists(self.monitor_templates_dir) == True:
+ return
+
+ if platform.system() != "Linux":
+ raise Exception("I can only run on Linux.")
+
+ kernel_path="/lib/modules/%s/build/tools/rv/%s" % (platform.release(), self.monitor_templates_dir)
+
+ if os.path.exists(kernel_path) == True:
+ self.monitor_templates_dir=kernel_path
+ return
+
+ if os.path.exists("/usr/share/dot2/dot2k_templates/") == True:
+ self.monitor_templates_dir="/usr/share/dot2/dot2k_templates/"
+ return
+
+ raise Exception("Could not find the template directory, do you have the kernel source installed?")
+
+
+ def __open_file(self, path):
+ try:
+ fd = open(path)
+ except OSError:
+ raise Exception("Cannot open the file: %s" % path)
+
+ content = fd.read()
+
+ return content
+
+ def __buff_to_string(self, buff):
+ string=""
+
+ for line in buff:
+ string=string + line + "\n"
+
+ # cut off the last \n
+ return string[:-1]
+
+ def fill_monitor_h(self):
+ monitor_h = self.monitor_h
+
+ min_type=self.get_minimun_type()
+
+ monitor_h = monitor_h.replace("MIN_TYPE", min_type)
+
+ return monitor_h
+
+ def fill_tracepoint_handlers_skel(self):
+ buff=[]
+ for event in self.events:
+ buff.append("static void handle_%s(void *data, /* XXX: fill header */)" % event)
+ buff.append("{")
+ if self.monitor_type == "per_task":
+ buff.append("\tstruct task_struct *p = /* XXX: how do I get p? */;");
+ buff.append("\tda_handle_event_%s(p, %s%s);" % (self.name, event, self.enum_suffix));
+ else:
+ buff.append("\tda_handle_event_%s(%s%s);" % (self.name, event, self.enum_suffix));
+ buff.append("}")
+ buff.append("")
+ return self.__buff_to_string(buff)
+
+ def fill_tracepoint_attach_probe(self):
+ buff=[]
+ for event in self.events:
+ buff.append("\trv_attach_trace_probe(\"%s\", /* XXX: tracepoint */, handle_%s);" % (self.name, event))
+ return self.__buff_to_string(buff)
+
+ def fill_tracepoint_detach_helper(self):
+ buff=[]
+ for event in self.events:
+ buff.append("\trv_detach_trace_probe(\"%s\", /* XXX: tracepoint */, handle_%s);" % (self.name, event))
+ return self.__buff_to_string(buff)
+
+ def fill_main_c(self):
+ main_c = self.main_c
+ min_type=self.get_minimun_type()
+ nr_events=self.events.__len__()
+ tracepoint_handlers=self.fill_tracepoint_handlers_skel()
+ tracepoint_attach=self.fill_tracepoint_attach_probe()
+ tracepoint_detach=self.fill_tracepoint_detach_helper()
+
+ main_c = main_c.replace("MIN_TYPE", min_type)
+ main_c = main_c.replace("MODEL_NAME", self.name)
+ main_c = main_c.replace("NR_EVENTS", str(nr_events))
+ main_c = main_c.replace("TRACEPOINT_HANDLERS_SKEL", tracepoint_handlers)
+ main_c = main_c.replace("TRACEPOINT_ATTACH", tracepoint_attach)
+ main_c = main_c.replace("TRACEPOINT_DETACH", tracepoint_detach)
+
+ return main_c
+
+ def fill_model_h(self):
+ #
+ # Adjust the definition names
+ #
+ self.enum_states_def="states_%s" % self.name
+ self.enum_events_def="events_%s" % self.name
+ self.struct_automaton_def="automaton_%s" % self.name
+ self.var_automaton_def="automaton_%s" % self.name
+
+ buff=self.format_model()
+
+ return self.__buff_to_string(buff)
+
+ def __create_directory(self):
+ try:
+ os.mkdir(self.name)
+ except FileExistsError:
+ return
+ except:
+ print("Fail creating the output dir: %s" % self.name)
+
+ def __create_file(self, file_name, content):
+ path="%s/%s" % (self.name, file_name)
+ try:
+ file = open(path, 'w')
+ except FileExistsError:
+ return
+ except:
+ print("Fail creating file: %s" % path)
+
+ file.write(content)
+
+ file.close()
+
+ def __get_main_name(self):
+ path="%s/%s" % (self.name, "main.c")
+ if os.path.exists(path) == False:
+ return "main.c"
+ return "__main.c"
+
+ def print_files(self):
+ main_c=self.fill_main_c()
+ model_h=self.fill_model_h()
+
+ self.__create_directory()
+
+ path="%s.c" % self.name
+ self.__create_file(path, main_c)
+
+ path="%s.h" % self.name
+ self.__create_file(path, model_h)
diff --git a/tools/verification/dot2/dot2k_templates/main_global.c b/tools/verification/dot2/dot2k_templates/main_global.c
new file mode 100644
index 000000000000..913dc68d782d
--- /dev/null
+++ b/tools/verification/dot2/dot2k_templates/main_global.c
@@ -0,0 +1,94 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/ftrace.h>
+#include <linux/tracepoint.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/rv.h>
+#include <rv/instrumentation.h>
+#include <rv/da_monitor.h>
+
+#define MODULE_NAME "MODEL_NAME"
+
+/*
+ * XXX: include required tracepoint headers, e.g.,
+ * #include <trace/events/sched.h>
+ */
+#include <trace/events/rv.h>
+
+/*
+ * This is the self-generated part of the monitor. Generally, there is no need
+ * to touch this section.
+ */
+#include "MODEL_NAME.h"
+
+/*
+ * Declare the deterministic automata monitor.
+ *
+ * The rv monitor reference is needed for the monitor declaration.
+ */
+struct rv_monitor rv_MODEL_NAME;
+DECLARE_DA_MON_GLOBAL(MODEL_NAME, MIN_TYPE);
+
+/*
+ * This is the instrumentation part of the monitor.
+ *
+ * This is the section where manual work is required. Here the kernel events
+ * are translated into model's event.
+ *
+ */
+TRACEPOINT_HANDLERS_SKEL
+static int start_MODEL_NAME(void)
+{
+ int retval;
+
+ retval = da_monitor_init_MODEL_NAME();
+ if (retval)
+ return retval;
+
+TRACEPOINT_ATTACH
+
+ return 0;
+}
+
+static void stop_MODEL_NAME(void)
+{
+ rv_MODEL_NAME.enabled = 0;
+
+TRACEPOINT_DETACH
+
+ da_monitor_destroy_MODEL_NAME();
+}
+
+/*
+ * This is the monitor register section.
+ */
+struct rv_monitor rv_MODEL_NAME = {
+ .name = "MODEL_NAME",
+ .description = "auto-generated MODEL_NAME",
+ .start = start_MODEL_NAME,
+ .stop = stop_MODEL_NAME,
+ .reset = da_monitor_reset_all_MODEL_NAME,
+ .enabled = 0,
+};
+
+int register_MODEL_NAME(void)
+{
+ rv_register_monitor(&rv_MODEL_NAME);
+ return 0;
+}
+
+void unregister_MODEL_NAME(void)
+{
+ if (rv_MODEL_NAME.enabled)
+ stop_MODEL_NAME();
+
+ rv_unregister_monitor(&rv_MODEL_NAME);
+}
+
+module_init(register_MODEL_NAME);
+module_exit(unregister_MODEL_NAME);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("dot2k: auto-generated");
+MODULE_DESCRIPTION("MODEL_NAME");
diff --git a/tools/verification/dot2/dot2k_templates/main_per_cpu.c b/tools/verification/dot2/dot2k_templates/main_per_cpu.c
new file mode 100644
index 000000000000..95eac96d8951
--- /dev/null
+++ b/tools/verification/dot2/dot2k_templates/main_per_cpu.c
@@ -0,0 +1,94 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/ftrace.h>
+#include <linux/tracepoint.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/rv.h>
+#include <rv/instrumentation.h>
+#include <rv/da_monitor.h>
+
+#define MODULE_NAME "MODEL_NAME"
+
+/*
+ * XXX: include required tracepoint headers, e.g.,
+ * #include <linux/trace/events/sched.h>
+ */
+#include <trace/events/rv.h>
+
+/*
+ * This is the self-generated part of the monitor. Generally, there is no need
+ * to touch this section.
+ */
+#include "MODEL_NAME.h"
+
+/*
+ * Declare the deterministic automata monitor.
+ *
+ * The rv monitor reference is needed for the monitor declaration.
+ */
+struct rv_monitor rv_MODEL_NAME;
+DECLARE_DA_MON_PER_CPU(MODEL_NAME, MIN_TYPE);
+
+/*
+ * This is the instrumentation part of the monitor.
+ *
+ * This is the section where manual work is required. Here the kernel events
+ * are translated into model's event.
+ *
+ */
+TRACEPOINT_HANDLERS_SKEL
+static int start_MODEL_NAME(void)
+{
+ int retval;
+
+ retval = da_monitor_init_MODEL_NAME();
+ if (retval)
+ return retval;
+
+TRACEPOINT_ATTACH
+
+ return 0;
+}
+
+static void stop_MODEL_NAME(void)
+{
+ rv_MODEL_NAME.enabled = 0;
+
+TRACEPOINT_DETACH
+
+ da_monitor_destroy_MODEL_NAME();
+}
+
+/*
+ * This is the monitor register section.
+ */
+struct rv_monitor rv_MODEL_NAME = {
+ .name = "MODEL_NAME",
+ .description = "auto-generated MODEL_NAME",
+ .start = start_MODEL_NAME,
+ .stop = stop_MODEL_NAME,
+ .reset = da_monitor_reset_all_MODEL_NAME,
+ .enabled = 0,
+};
+
+int register_MODEL_NAME(void)
+{
+ rv_register_monitor(&rv_MODEL_NAME);
+ return 0;
+}
+
+void unregister_MODEL_NAME(void)
+{
+ if (rv_MODEL_NAME.enabled)
+ stop_MODEL_NAME();
+
+ rv_unregister_monitor(&rv_MODEL_NAME);
+}
+
+module_init(register_MODEL_NAME);
+module_exit(unregister_MODEL_NAME);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("dot2k: auto-generated");
+MODULE_DESCRIPTION("MODEL_NAME");
diff --git a/tools/verification/dot2/dot2k_templates/main_per_task.c b/tools/verification/dot2/dot2k_templates/main_per_task.c
new file mode 100644
index 000000000000..8bafb8c8a0a4
--- /dev/null
+++ b/tools/verification/dot2/dot2k_templates/main_per_task.c
@@ -0,0 +1,94 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/ftrace.h>
+#include <linux/tracepoint.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/rv.h>
+#include <rv/instrumentation.h>
+#include <rv/da_monitor.h>
+
+#define MODULE_NAME "MODEL_NAME"
+
+/*
+ * XXX: include required tracepoint headers, e.g.,
+ * #include <linux/trace/events/sched.h>
+ */
+#include <trace/events/rv.h>
+
+/*
+ * This is the self-generated part of the monitor. Generally, there is no need
+ * to touch this section.
+ */
+#include "MODEL_NAME.h"
+
+/*
+ * Declare the deterministic automata monitor.
+ *
+ * The rv monitor reference is needed for the monitor declaration.
+ */
+struct rv_monitor rv_MODEL_NAME;
+DECLARE_DA_MON_PER_TASK(MODEL_NAME, MIN_TYPE);
+
+/*
+ * This is the instrumentation part of the monitor.
+ *
+ * This is the section where manual work is required. Here the kernel events
+ * are translated into model's event.
+ *
+ */
+TRACEPOINT_HANDLERS_SKEL
+static int start_MODEL_NAME(void)
+{
+ int retval;
+
+ retval = da_monitor_init_MODEL_NAME();
+ if (retval)
+ return retval;
+
+TRACEPOINT_ATTACH
+
+ return 0;
+}
+
+static void stop_MODEL_NAME(void)
+{
+ rv_MODEL_NAME.enabled = 0;
+
+TRACEPOINT_DETACH
+
+ da_monitor_destroy_MODEL_NAME();
+}
+
+/*
+ * This is the monitor register section.
+ */
+struct rv_monitor rv_MODEL_NAME = {
+ .name = "MODEL_NAME",
+ .description = "auto-generated MODEL_NAME",
+ .start = start_MODEL_NAME,
+ .stop = stop_MODEL_NAME,
+ .reset = da_monitor_reset_all_MODEL_NAME,
+ .enabled = 0,
+};
+
+int register_MODEL_NAME(void)
+{
+ rv_register_monitor(&rv_MODEL_NAME);
+ return 0;
+}
+
+void unregister_MODEL_NAME(void)
+{
+ if (rv_MODEL_NAME.enabled)
+ stop_MODEL_NAME();
+
+ rv_unregister_monitor(&rv_MODEL_NAME);
+}
+
+module_init(register_MODEL_NAME);
+module_exit(unregister_MODEL_NAME);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("dot2k: auto-generated");
+MODULE_DESCRIPTION("MODEL_NAME");
--
2.35.1
^ permalink raw reply related [flat|nested] 82+ messages in thread
* [PATCH V4 08/20] rv/monitor: Add the wip monitor skeleton created by dot2k
2022-06-16 8:44 [PATCH V4 00/20] The Runtime Verification (RV) interface Daniel Bristot de Oliveira
` (6 preceding siblings ...)
2022-06-16 8:44 ` [PATCH V4 07/20] tools/rv: Add dot2k Daniel Bristot de Oliveira
@ 2022-06-16 8:44 ` Daniel Bristot de Oliveira
2022-06-28 19:02 ` Steven Rostedt
2022-06-16 8:44 ` [PATCH V4 09/20] rv/monitor: wip instrumentation and Makefile/Kconfig entries Daniel Bristot de Oliveira
` (13 subsequent siblings)
21 siblings, 1 reply; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-16 8:44 UTC (permalink / raw)
To: Steven Rostedt
Cc: Daniel Bristot de Oliveira, Wim Van Sebroeck, Guenter Roeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel
This is the direct output this command line:
$ dot2k -d ~/wip.dot -t per_cpu
with wip.dot as:
----- %< -----
digraph state_automaton {
center = true;
size = "7,11";
rankdir = LR;
{node [shape = circle] "non_preemptive"};
{node [shape = plaintext, style=invis, label=""] "__init_preemptive"};
{node [shape = doublecircle] "preemptive"};
{node [shape = circle] "preemptive"};
"__init_preemptive" -> "preemptive";
"non_preemptive" [label = "non_preemptive"];
"non_preemptive" -> "non_preemptive" [ label = "sched_waking" ];
"non_preemptive" -> "preemptive" [ label = "preempt_enable" ];
"preemptive" [label = "preemptive"];
"preemptive" -> "non_preemptive" [ label = "preempt_disable" ];
{ rank = min ;
"__init_preemptive";
"preemptive";
}
}
----- >% -----
This model is broken because preempt_disable_notrace(). It is broken on
purpose to test the reactors.
It does not compile because it lacks the instrumentation, which will be
add next.
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Gabriele Paoloni <gpaoloni@redhat.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Clark Williams <williams@redhat.com>
Cc: linux-doc@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-trace-devel@vger.kernel.org
Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
---
kernel/trace/rv/monitors/wip/wip.c | 112 +++++++++++++++++++++++++++++
kernel/trace/rv/monitors/wip/wip.h | 38 ++++++++++
2 files changed, 150 insertions(+)
create mode 100644 kernel/trace/rv/monitors/wip/wip.c
create mode 100644 kernel/trace/rv/monitors/wip/wip.h
diff --git a/kernel/trace/rv/monitors/wip/wip.c b/kernel/trace/rv/monitors/wip/wip.c
new file mode 100644
index 000000000000..08950e09b823
--- /dev/null
+++ b/kernel/trace/rv/monitors/wip/wip.c
@@ -0,0 +1,112 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/ftrace.h>
+#include <linux/tracepoint.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/rv.h>
+#include <rv/instrumentation.h>
+#include <rv/da_monitor.h>
+
+#define MODULE_NAME "wip"
+
+/*
+ * XXX: include required tracepoint headers, e.g.,
+ * #include <linux/trace/events/sched.h>
+ */
+#include <trace/events/rv.h>
+
+/*
+ * This is the self-generated part of the monitor. Generally, there is no need
+ * to touch this section.
+ */
+#include "wip.h"
+
+/*
+ * Declare the deterministic automata monitor.
+ *
+ * The rv monitor reference is needed for the monitor declaration.
+ */
+struct rv_monitor rv_wip;
+DECLARE_DA_MON_PER_CPU(wip, char);
+
+/*
+ * This is the instrumentation part of the monitor.
+ *
+ * This is the section where manual work is required. Here the kernel events
+ * are translated into model's event.
+ *
+ */
+static void handle_preempt_disable(void *data, /* XXX: fill header */)
+{
+ da_handle_event_wip(preempt_disable_wip);
+}
+
+static void handle_preempt_enable(void *data, /* XXX: fill header */)
+{
+ da_handle_event_wip(preempt_enable_wip);
+}
+
+static void handle_sched_waking(void *data, /* XXX: fill header */)
+{
+ da_handle_event_wip(sched_waking_wip);
+}
+
+static int start_wip(void)
+{
+ int retval;
+
+ retval = da_monitor_init_wip();
+ if (retval)
+ return retval;
+
+ rv_attach_trace_probe("wip", /* XXX: tracepoint */, handle_preempt_disable);
+ rv_attach_trace_probe("wip", /* XXX: tracepoint */, handle_preempt_enable);
+ rv_attach_trace_probe("wip", /* XXX: tracepoint */, handle_sched_waking);
+
+ return 0;
+}
+
+static void stop_wip(void)
+{
+ rv_wip.enabled = 0;
+
+ rv_detach_trace_probe("wip", /* XXX: tracepoint */, handle_preempt_disable);
+ rv_detach_trace_probe("wip", /* XXX: tracepoint */, handle_preempt_enable);
+ rv_detach_trace_probe("wip", /* XXX: tracepoint */, handle_sched_waking);
+
+ da_monitor_destroy_wip();
+}
+
+/*
+ * This is the monitor register section.
+ */
+struct rv_monitor rv_wip = {
+ .name = "wip",
+ .description = "auto-generated wip",
+ .start = start_wip,
+ .stop = stop_wip,
+ .reset = da_monitor_reset_all_wip,
+ .enabled = 0,
+};
+
+int register_wip(void)
+{
+ rv_register_monitor(&rv_wip);
+ return 0;
+}
+
+void unregister_wip(void)
+{
+ if (rv_wip.enabled)
+ stop_wip();
+
+ rv_unregister_monitor(&rv_wip);
+}
+
+module_init(register_wip);
+module_exit(unregister_wip);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("dot2k: auto-generated");
+MODULE_DESCRIPTION("wip");
diff --git a/kernel/trace/rv/monitors/wip/wip.h b/kernel/trace/rv/monitors/wip/wip.h
new file mode 100644
index 000000000000..3055ea331706
--- /dev/null
+++ b/kernel/trace/rv/monitors/wip/wip.h
@@ -0,0 +1,38 @@
+enum states_wip {
+ preemptive_wip = 0,
+ non_preemptive_wip,
+ state_max_wip
+};
+
+enum events_wip {
+ preempt_disable_wip = 0,
+ preempt_enable_wip,
+ sched_waking_wip,
+ event_max_wip
+};
+
+struct automaton_wip {
+ char *state_names[state_max_wip];
+ char *event_names[event_max_wip];
+ char function[state_max_wip][event_max_wip];
+ char initial_state;
+ char final_states[state_max_wip];
+};
+
+struct automaton_wip automaton_wip = {
+ .state_names = {
+ "preemptive",
+ "non_preemptive"
+ },
+ .event_names = {
+ "preempt_disable",
+ "preempt_enable",
+ "sched_waking"
+ },
+ .function = {
+ { non_preemptive_wip, -1, -1 },
+ { -1, preemptive_wip, non_preemptive_wip },
+ },
+ .initial_state = preemptive_wip,
+ .final_states = { 1, 0 },
+};
--
2.35.1
^ permalink raw reply related [flat|nested] 82+ messages in thread
* [PATCH V4 09/20] rv/monitor: wip instrumentation and Makefile/Kconfig entries
2022-06-16 8:44 [PATCH V4 00/20] The Runtime Verification (RV) interface Daniel Bristot de Oliveira
` (7 preceding siblings ...)
2022-06-16 8:44 ` [PATCH V4 08/20] rv/monitor: Add the wip monitor skeleton created by dot2k Daniel Bristot de Oliveira
@ 2022-06-16 8:44 ` Daniel Bristot de Oliveira
2022-06-16 11:21 ` kernel test robot
2022-06-16 21:00 ` Randy Dunlap
2022-06-16 8:44 ` [PATCH V4 10/20] rv/monitor: Add the wwnr monitor skeleton created by dot2k Daniel Bristot de Oliveira
` (12 subsequent siblings)
21 siblings, 2 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-16 8:44 UTC (permalink / raw)
To: Steven Rostedt
Cc: Daniel Bristot de Oliveira, Wim Van Sebroeck, Guenter Roeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel
Adds the instrumentation to the previously created wip monitor, as an
example of the developer work. It also adds a Makefile, Kconfig and
tracepoint entries.
This is a good example of the manual work that is left for the
developer to do.
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Gabriele Paoloni <gpaoloni@redhat.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Clark Williams <williams@redhat.com>
Cc: linux-doc@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-trace-devel@vger.kernel.org
Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
---
include/trace/events/rv.h | 10 ++++++++++
kernel/trace/rv/Kconfig | 7 +++++++
kernel/trace/rv/Makefile | 1 +
kernel/trace/rv/monitors/wip/wip.c | 30 ++++++++++++++----------------
4 files changed, 32 insertions(+), 16 deletions(-)
diff --git a/include/trace/events/rv.h b/include/trace/events/rv.h
index 9f40f2a49f84..4e0dabffcf29 100644
--- a/include/trace/events/rv.h
+++ b/include/trace/events/rv.h
@@ -56,6 +56,16 @@ DECLARE_EVENT_CLASS(error_da_monitor,
__entry->event,
__entry->state)
);
+
+#ifdef CONFIG_RV_MON_WIP
+DEFINE_EVENT(event_da_monitor, event_wip,
+ TP_PROTO(char *state, char *event, char *next_state, bool safe),
+ TP_ARGS(state, event, next_state, safe));
+
+DEFINE_EVENT(error_da_monitor, error_wip,
+ TP_PROTO(char *state, char *event),
+ TP_ARGS(state, event));
+#endif /* CONFIG_RV_MON_WIP */
#endif /* CONFIG_DA_MON_EVENTS_IMPLICIT */
#ifdef CONFIG_DA_MON_EVENTS_ID
diff --git a/kernel/trace/rv/Kconfig b/kernel/trace/rv/Kconfig
index 1eafb5adcfcb..e9246b0bec9d 100644
--- a/kernel/trace/rv/Kconfig
+++ b/kernel/trace/rv/Kconfig
@@ -26,6 +26,13 @@ menuconfig RV
the system behavior.
if RV
+config RV_MON_WIP
+ depends on PREEMPTIRQ_TRACEPOINTS
+ select DA_MON_EVENTS_IMPLICIT
+ bool "WIP monitor"
+ help
+ Enable WIP sample monitor, this is a sample monitor that
+ illustrates the usage of per-cpu monitors.
config RV_REACTORS
bool "Runtime verification reactors"
diff --git a/kernel/trace/rv/Makefile b/kernel/trace/rv/Makefile
index 8944274d9b41..b41109d2750a 100644
--- a/kernel/trace/rv/Makefile
+++ b/kernel/trace/rv/Makefile
@@ -2,3 +2,4 @@
obj-$(CONFIG_RV) += rv.o
obj-$(CONFIG_RV_REACTORS) += rv_reactors.o
+obj-$(CONFIG_RV_MON_WIP) += monitors/wip/wip.o
diff --git a/kernel/trace/rv/monitors/wip/wip.c b/kernel/trace/rv/monitors/wip/wip.c
index 08950e09b823..123827db0a03 100644
--- a/kernel/trace/rv/monitors/wip/wip.c
+++ b/kernel/trace/rv/monitors/wip/wip.c
@@ -10,11 +10,9 @@
#define MODULE_NAME "wip"
-/*
- * XXX: include required tracepoint headers, e.g.,
- * #include <linux/trace/events/sched.h>
- */
#include <trace/events/rv.h>
+#include <trace/events/sched.h>
+#include <trace/events/preemptirq.h>
/*
* This is the self-generated part of the monitor. Generally, there is no need
@@ -37,17 +35,17 @@ DECLARE_DA_MON_PER_CPU(wip, char);
* are translated into model's event.
*
*/
-static void handle_preempt_disable(void *data, /* XXX: fill header */)
+static void handle_preempt_disable(void *data, unsigned long ip, unsigned long parent_ip)
{
da_handle_event_wip(preempt_disable_wip);
}
-static void handle_preempt_enable(void *data, /* XXX: fill header */)
+static void handle_preempt_enable(void *data, unsigned long ip, unsigned long parent_ip)
{
- da_handle_event_wip(preempt_enable_wip);
+ da_handle_init_event_wip(preempt_enable_wip);
}
-static void handle_sched_waking(void *data, /* XXX: fill header */)
+static void handle_sched_waking(void *data, struct task_struct *task)
{
da_handle_event_wip(sched_waking_wip);
}
@@ -60,9 +58,9 @@ static int start_wip(void)
if (retval)
return retval;
- rv_attach_trace_probe("wip", /* XXX: tracepoint */, handle_preempt_disable);
- rv_attach_trace_probe("wip", /* XXX: tracepoint */, handle_preempt_enable);
- rv_attach_trace_probe("wip", /* XXX: tracepoint */, handle_sched_waking);
+ rv_attach_trace_probe("wip", preempt_disable, handle_preempt_disable);
+ rv_attach_trace_probe("wip", preempt_enable, handle_preempt_enable);
+ rv_attach_trace_probe("wip", sched_waking, handle_sched_waking);
return 0;
}
@@ -71,9 +69,9 @@ static void stop_wip(void)
{
rv_wip.enabled = 0;
- rv_detach_trace_probe("wip", /* XXX: tracepoint */, handle_preempt_disable);
- rv_detach_trace_probe("wip", /* XXX: tracepoint */, handle_preempt_enable);
- rv_detach_trace_probe("wip", /* XXX: tracepoint */, handle_sched_waking);
+ rv_detach_trace_probe("wip", preempt_disable, handle_preempt_disable);
+ rv_detach_trace_probe("wip", preempt_enable, handle_preempt_enable);
+ rv_detach_trace_probe("wip", sched_waking, handle_sched_waking);
da_monitor_destroy_wip();
}
@@ -108,5 +106,5 @@ module_init(register_wip);
module_exit(unregister_wip);
MODULE_LICENSE("GPL");
-MODULE_AUTHOR("dot2k: auto-generated");
-MODULE_DESCRIPTION("wip");
+MODULE_AUTHOR("Daniel Bristot de Oliveira <bristot@kernel.org>");
+MODULE_DESCRIPTION("wip: wakeup in preemptive - per-cpu sample monitor.");
--
2.35.1
^ permalink raw reply related [flat|nested] 82+ messages in thread
* [PATCH V4 10/20] rv/monitor: Add the wwnr monitor skeleton created by dot2k
2022-06-16 8:44 [PATCH V4 00/20] The Runtime Verification (RV) interface Daniel Bristot de Oliveira
` (8 preceding siblings ...)
2022-06-16 8:44 ` [PATCH V4 09/20] rv/monitor: wip instrumentation and Makefile/Kconfig entries Daniel Bristot de Oliveira
@ 2022-06-16 8:44 ` Daniel Bristot de Oliveira
2022-07-06 20:08 ` Tao Zhou
2022-06-16 8:44 ` [PATCH V4 11/20] rv/monitor: wwnr instrumentation and Makefile/Kconfig entries Daniel Bristot de Oliveira
` (11 subsequent siblings)
21 siblings, 1 reply; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-16 8:44 UTC (permalink / raw)
To: Steven Rostedt
Cc: Daniel Bristot de Oliveira, Wim Van Sebroeck, Guenter Roeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel
Per task wakeup while not running (wwnr) monitor, generated by dot2k
with this command line:
$ dot2k -d wwnr.dot -t per_task
The model is:
----- %< -----
digraph state_automaton {
center = true;
size = "7,11";
{node [shape = plaintext, style=invis, label=""] "__init_not_running"};
{node [shape = ellipse] "not_running"};
{node [shape = plaintext] "not_running"};
{node [shape = plaintext] "running"};
"__init_not_running" -> "not_running";
"not_running" [label = "not_running", color = green3];
"not_running" -> "not_running" [ label = "wakeup" ];
"not_running" -> "running" [ label = "switch_in" ];
"running" [label = "running"];
"running" -> "not_running" [ label = "switch_out" ];
{ rank = min ;
"__init_not_running";
"not_running";
}
}
----- >% -----
This model is broken, the reason is that a task can be running in the
processor without being set as RUNNABLE. Think about a task about to
sleep:
1: set_current_state(TASK_UNINTERRUPTIBLE);
2: schedule();
And then imagine an IRQ happening in between the lines one and two,
waking the task up. BOOM, the wakeup will happen while the task is
running.
Q: Why do we need this model, so?
A: To test the reactors.
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Gabriele Paoloni <gpaoloni@redhat.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Clark Williams <williams@redhat.com>
Cc: linux-doc@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-trace-devel@vger.kernel.org
Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
---
kernel/trace/rv/monitors/wwnr/wwnr.c | 115 +++++++++++++++++++++++++++
kernel/trace/rv/monitors/wwnr/wwnr.h | 38 +++++++++
2 files changed, 153 insertions(+)
create mode 100644 kernel/trace/rv/monitors/wwnr/wwnr.c
create mode 100644 kernel/trace/rv/monitors/wwnr/wwnr.h
diff --git a/kernel/trace/rv/monitors/wwnr/wwnr.c b/kernel/trace/rv/monitors/wwnr/wwnr.c
new file mode 100644
index 000000000000..8ba01f0f0df8
--- /dev/null
+++ b/kernel/trace/rv/monitors/wwnr/wwnr.c
@@ -0,0 +1,115 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/ftrace.h>
+#include <linux/tracepoint.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/rv.h>
+#include <rv/instrumentation.h>
+#include <rv/da_monitor.h>
+
+#define MODULE_NAME "wwnr"
+
+/*
+ * XXX: include required tracepoint headers, e.g.,
+ * #include <linux/trace/events/sched.h>
+ */
+#include <trace/events/rv.h>
+
+/*
+ * This is the self-generated part of the monitor. Generally, there is no need
+ * to touch this section.
+ */
+#include "wwnr.h"
+
+/*
+ * Declare the deterministic automata monitor.
+ *
+ * The rv monitor reference is needed for the monitor declaration.
+ */
+struct rv_monitor rv_wwnr;
+DECLARE_DA_MON_PER_TASK(wwnr, char);
+
+/*
+ * This is the instrumentation part of the monitor.
+ *
+ * This is the section where manual work is required. Here the kernel events
+ * are translated into model's event.
+ *
+ */
+static void handle_switch_in(void *data, /* XXX: fill header */)
+{
+ struct task_struct *p = /* XXX: how do I get p? */;
+ da_handle_event_wwnr(p, switch_in_wwnr);
+}
+
+static void handle_switch_out(void *data, /* XXX: fill header */)
+{
+ struct task_struct *p = /* XXX: how do I get p? */;
+ da_handle_event_wwnr(p, switch_out_wwnr);
+}
+
+static void handle_wakeup(void *data, /* XXX: fill header */)
+{
+ struct task_struct *p = /* XXX: how do I get p? */;
+ da_handle_event_wwnr(p, wakeup_wwnr);
+}
+
+static int start_wwnr(void)
+{
+ int retval;
+
+ retval = da_monitor_init_wwnr();
+ if (retval)
+ return retval;
+
+ rv_attach_trace_probe("wwnr", /* XXX: tracepoint */, handle_switch_in);
+ rv_attach_trace_probe("wwnr", /* XXX: tracepoint */, handle_switch_out);
+ rv_attach_trace_probe("wwnr", /* XXX: tracepoint */, handle_wakeup);
+
+ return 0;
+}
+
+static void stop_wwnr(void)
+{
+ rv_wwnr.enabled = 0;
+
+ rv_detach_trace_probe("wwnr", /* XXX: tracepoint */, handle_switch_in);
+ rv_detach_trace_probe("wwnr", /* XXX: tracepoint */, handle_switch_out);
+ rv_detach_trace_probe("wwnr", /* XXX: tracepoint */, handle_wakeup);
+
+ da_monitor_destroy_wwnr();
+}
+
+/*
+ * This is the monitor register section.
+ */
+struct rv_monitor rv_wwnr = {
+ .name = "wwnr",
+ .description = "auto-generated wwnr",
+ .start = start_wwnr,
+ .stop = stop_wwnr,
+ .reset = da_monitor_reset_all_wwnr,
+ .enabled = 0,
+};
+
+int register_wwnr(void)
+{
+ rv_register_monitor(&rv_wwnr);
+ return 0;
+}
+
+void unregister_wwnr(void)
+{
+ if (rv_wwnr.enabled)
+ stop_wwnr();
+
+ rv_unregister_monitor(&rv_wwnr);
+}
+
+module_init(register_wwnr);
+module_exit(unregister_wwnr);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("dot2k: auto-generated");
+MODULE_DESCRIPTION("wwnr");
diff --git a/kernel/trace/rv/monitors/wwnr/wwnr.h b/kernel/trace/rv/monitors/wwnr/wwnr.h
new file mode 100644
index 000000000000..f3dc160642bf
--- /dev/null
+++ b/kernel/trace/rv/monitors/wwnr/wwnr.h
@@ -0,0 +1,38 @@
+enum states_wwnr {
+ not_running_wwnr = 0,
+ running_wwnr,
+ state_max_wwnr
+};
+
+enum events_wwnr {
+ switch_in_wwnr = 0,
+ switch_out_wwnr,
+ wakeup_wwnr,
+ event_max_wwnr
+};
+
+struct automaton_wwnr {
+ char *state_names[state_max_wwnr];
+ char *event_names[event_max_wwnr];
+ char function[state_max_wwnr][event_max_wwnr];
+ char initial_state;
+ char final_states[state_max_wwnr];
+};
+
+struct automaton_wwnr automaton_wwnr = {
+ .state_names = {
+ "not_running",
+ "running"
+ },
+ .event_names = {
+ "switch_in",
+ "switch_out",
+ "wakeup"
+ },
+ .function = {
+ { running_wwnr, -1, not_running_wwnr },
+ { -1, not_running_wwnr, -1 },
+ },
+ .initial_state = not_running_wwnr,
+ .final_states = { 1, 0 },
+};
--
2.35.1
^ permalink raw reply related [flat|nested] 82+ messages in thread
* [PATCH V4 11/20] rv/monitor: wwnr instrumentation and Makefile/Kconfig entries
2022-06-16 8:44 [PATCH V4 00/20] The Runtime Verification (RV) interface Daniel Bristot de Oliveira
` (9 preceding siblings ...)
2022-06-16 8:44 ` [PATCH V4 10/20] rv/monitor: Add the wwnr monitor skeleton created by dot2k Daniel Bristot de Oliveira
@ 2022-06-16 8:44 ` Daniel Bristot de Oliveira
2022-06-16 13:47 ` kernel test robot
2022-06-28 19:05 ` Steven Rostedt
2022-06-16 8:44 ` [PATCH V4 12/20] rv/reactor: Add the printk reactor Daniel Bristot de Oliveira
` (10 subsequent siblings)
21 siblings, 2 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-16 8:44 UTC (permalink / raw)
To: Steven Rostedt
Cc: Daniel Bristot de Oliveira, Wim Van Sebroeck, Guenter Roeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel
Adds the instrumentation to the previously created wwnr monitor, as an
example of the developer work. It also adds a Makefile, Kconfig and
tracepoint entries.
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Gabriele Paoloni <gpaoloni@redhat.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Clark Williams <williams@redhat.com>
Cc: linux-doc@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-trace-devel@vger.kernel.org
Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
---
include/trace/events/rv.h | 12 +++++++++
kernel/trace/rv/Kconfig | 8 ++++++
kernel/trace/rv/Makefile | 1 +
kernel/trace/rv/monitors/wwnr/wwnr.c | 38 ++++++++++++----------------
4 files changed, 37 insertions(+), 22 deletions(-)
diff --git a/include/trace/events/rv.h b/include/trace/events/rv.h
index 4e0dabffcf29..00f11a8dac3b 100644
--- a/include/trace/events/rv.h
+++ b/include/trace/events/rv.h
@@ -122,6 +122,18 @@ DECLARE_EVENT_CLASS(error_da_monitor_id,
__entry->event,
__entry->state)
);
+
+#ifdef CONFIG_RV_MON_WWNR
+/* id is the pid of the task */
+DEFINE_EVENT(event_da_monitor_id, event_wwnr,
+ TP_PROTO(int id, char *state, char *event, char *next_state, bool safe),
+ TP_ARGS(id, state, event, next_state, safe));
+
+DEFINE_EVENT(error_da_monitor_id, error_wwnr,
+ TP_PROTO(int id, char *state, char *event),
+ TP_ARGS(id, state, event));
+#endif /* CONFIG_RV_MON_WWNR */
+
#endif /* CONFIG_DA_MON_EVENTS_ID */
#endif /* _TRACE_RV_H */
diff --git a/kernel/trace/rv/Kconfig b/kernel/trace/rv/Kconfig
index e9246b0bec9d..fba2ace2a22b 100644
--- a/kernel/trace/rv/Kconfig
+++ b/kernel/trace/rv/Kconfig
@@ -34,6 +34,14 @@ config RV_MON_WIP
Enable WIP sample monitor, this is a sample monitor that
illustrates the usage of per-cpu monitors.
+config RV_MON_WWNR
+ select DA_MON_EVENTS_ID
+ bool "WWNR monitor"
+ help
+ Enable WWNR sample monitor, this is a sample monitor that
+ illustrates the usage of per-task monitor. The model is
+ broken on purpose: it serves to test reactors.
+
config RV_REACTORS
bool "Runtime verification reactors"
default y if RV
diff --git a/kernel/trace/rv/Makefile b/kernel/trace/rv/Makefile
index b41109d2750a..af0ff9a46418 100644
--- a/kernel/trace/rv/Makefile
+++ b/kernel/trace/rv/Makefile
@@ -3,3 +3,4 @@
obj-$(CONFIG_RV) += rv.o
obj-$(CONFIG_RV_REACTORS) += rv_reactors.o
obj-$(CONFIG_RV_MON_WIP) += monitors/wip/wip.o
+obj-$(CONFIG_RV_MON_WWNR) += monitors/wwnr/wwnr.o
diff --git a/kernel/trace/rv/monitors/wwnr/wwnr.c b/kernel/trace/rv/monitors/wwnr/wwnr.c
index 8ba01f0f0df8..3fe1ad9125d3 100644
--- a/kernel/trace/rv/monitors/wwnr/wwnr.c
+++ b/kernel/trace/rv/monitors/wwnr/wwnr.c
@@ -10,11 +10,8 @@
#define MODULE_NAME "wwnr"
-/*
- * XXX: include required tracepoint headers, e.g.,
- * #include <linux/trace/events/sched.h>
- */
#include <trace/events/rv.h>
+#include <trace/events/sched.h>
/*
* This is the self-generated part of the monitor. Generally, there is no need
@@ -37,21 +34,20 @@ DECLARE_DA_MON_PER_TASK(wwnr, char);
* are translated into model's event.
*
*/
-static void handle_switch_in(void *data, /* XXX: fill header */)
+static void handle_switch(void *data, bool preempt, struct task_struct *p,
+ struct task_struct *n, unsigned int prev_state)
{
- struct task_struct *p = /* XXX: how do I get p? */;
- da_handle_event_wwnr(p, switch_in_wwnr);
-}
+ /* start monitoring only after the first suspension */
+ if (prev_state == TASK_INTERRUPTIBLE)
+ da_handle_init_event_wwnr(p, switch_out_wwnr);
+ else
+ da_handle_event_wwnr(p, switch_out_wwnr);
-static void handle_switch_out(void *data, /* XXX: fill header */)
-{
- struct task_struct *p = /* XXX: how do I get p? */;
- da_handle_event_wwnr(p, switch_out_wwnr);
+ da_handle_event_wwnr(n, switch_in_wwnr);
}
-static void handle_wakeup(void *data, /* XXX: fill header */)
+static void handle_wakeup(void *data, struct task_struct *p)
{
- struct task_struct *p = /* XXX: how do I get p? */;
da_handle_event_wwnr(p, wakeup_wwnr);
}
@@ -63,9 +59,8 @@ static int start_wwnr(void)
if (retval)
return retval;
- rv_attach_trace_probe("wwnr", /* XXX: tracepoint */, handle_switch_in);
- rv_attach_trace_probe("wwnr", /* XXX: tracepoint */, handle_switch_out);
- rv_attach_trace_probe("wwnr", /* XXX: tracepoint */, handle_wakeup);
+ rv_attach_trace_probe("wwnr", sched_switch, handle_switch);
+ rv_attach_trace_probe("wwnr", sched_wakeup, handle_wakeup);
return 0;
}
@@ -74,9 +69,8 @@ static void stop_wwnr(void)
{
rv_wwnr.enabled = 0;
- rv_detach_trace_probe("wwnr", /* XXX: tracepoint */, handle_switch_in);
- rv_detach_trace_probe("wwnr", /* XXX: tracepoint */, handle_switch_out);
- rv_detach_trace_probe("wwnr", /* XXX: tracepoint */, handle_wakeup);
+ rv_detach_trace_probe("wwnr", sched_switch, handle_switch);
+ rv_detach_trace_probe("wwnr", sched_wakeup, handle_wakeup);
da_monitor_destroy_wwnr();
}
@@ -111,5 +105,5 @@ module_init(register_wwnr);
module_exit(unregister_wwnr);
MODULE_LICENSE("GPL");
-MODULE_AUTHOR("dot2k: auto-generated");
-MODULE_DESCRIPTION("wwnr");
+MODULE_AUTHOR("Daniel Bristot de Oliveira <bristot@kernel.org>");
+MODULE_DESCRIPTION("wwnr: wakeup while not running monitor.");
--
2.35.1
^ permalink raw reply related [flat|nested] 82+ messages in thread
* [PATCH V4 12/20] rv/reactor: Add the printk reactor
2022-06-16 8:44 [PATCH V4 00/20] The Runtime Verification (RV) interface Daniel Bristot de Oliveira
` (10 preceding siblings ...)
2022-06-16 8:44 ` [PATCH V4 11/20] rv/monitor: wwnr instrumentation and Makefile/Kconfig entries Daniel Bristot de Oliveira
@ 2022-06-16 8:44 ` Daniel Bristot de Oliveira
2022-06-16 8:44 ` [PATCH V4 13/20] rv/reactor: Add the panic reactor Daniel Bristot de Oliveira
` (9 subsequent siblings)
21 siblings, 0 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-16 8:44 UTC (permalink / raw)
To: Steven Rostedt
Cc: Daniel Bristot de Oliveira, Wim Van Sebroeck, Guenter Roeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel
Sample reactor that printks the reaction message.
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Gabriele Paoloni <gpaoloni@redhat.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Clark Williams <williams@redhat.com>
Cc: linux-doc@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-trace-devel@vger.kernel.org
Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
---
kernel/trace/rv/Kconfig | 8 ++++++
kernel/trace/rv/Makefile | 3 ++-
kernel/trace/rv/reactor_printk.c | 43 ++++++++++++++++++++++++++++++++
3 files changed, 53 insertions(+), 1 deletion(-)
create mode 100644 kernel/trace/rv/reactor_printk.c
diff --git a/kernel/trace/rv/Kconfig b/kernel/trace/rv/Kconfig
index fba2ace2a22b..be8e3dab0a52 100644
--- a/kernel/trace/rv/Kconfig
+++ b/kernel/trace/rv/Kconfig
@@ -52,4 +52,12 @@ config RV_REACTORS
tracing reactions, printing the monitor output via tracepoints,
but other reactions can be added (on-demand) via this interface.
+config RV_REACT_PRINTK
+ bool "Printk reactor"
+ depends on RV_REACTORS
+ default y if RV_REACTORS
+ help
+ Enables the printk reactor. The printk reactor emmits a printk()
+ message if an exception is found.
+
endif # RV
diff --git a/kernel/trace/rv/Makefile b/kernel/trace/rv/Makefile
index af0ff9a46418..a13c750a35c1 100644
--- a/kernel/trace/rv/Makefile
+++ b/kernel/trace/rv/Makefile
@@ -1,6 +1,7 @@
# SPDX-License-Identifier: GPL-2.0
obj-$(CONFIG_RV) += rv.o
-obj-$(CONFIG_RV_REACTORS) += rv_reactors.o
obj-$(CONFIG_RV_MON_WIP) += monitors/wip/wip.o
obj-$(CONFIG_RV_MON_WWNR) += monitors/wwnr/wwnr.o
+obj-$(CONFIG_RV_REACTORS) += rv_reactors.o
+obj-$(CONFIG_RV_REACT_PRINTK) += reactor_printk.o
diff --git a/kernel/trace/rv/reactor_printk.c b/kernel/trace/rv/reactor_printk.c
new file mode 100644
index 000000000000..6a7bbf3fc03f
--- /dev/null
+++ b/kernel/trace/rv/reactor_printk.c
@@ -0,0 +1,43 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Printk RV reactor:
+ * Prints the exception msg to the kernel message log.
+ *
+ * Copyright (C) 2019-2022 Daniel Bristot de Oliveira <bristot@kernel.org>
+ *
+ */
+#include <linux/ftrace.h>
+#include <linux/tracepoint.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/rv.h>
+
+static void rv_printk_reaction(char *msg)
+{
+ printk_deferred(msg);
+}
+
+struct rv_reactor rv_printk = {
+ .name = "printk",
+ .description = "prints the exception msg to the kernel message log",
+ .react = rv_printk_reaction
+};
+
+int register_react_printk(void)
+{
+ rv_register_reactor(&rv_printk);
+ return 0;
+}
+
+void unregister_react_printk(void)
+{
+ rv_unregister_reactor(&rv_printk);
+}
+
+module_init(register_react_printk);
+module_exit(unregister_react_printk);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Daniel Bristot de Oliveira");
+MODULE_DESCRIPTION("printk rv reactor: printk if an exception is hit");
--
2.35.1
^ permalink raw reply related [flat|nested] 82+ messages in thread
* [PATCH V4 13/20] rv/reactor: Add the panic reactor
2022-06-16 8:44 [PATCH V4 00/20] The Runtime Verification (RV) interface Daniel Bristot de Oliveira
` (11 preceding siblings ...)
2022-06-16 8:44 ` [PATCH V4 12/20] rv/reactor: Add the printk reactor Daniel Bristot de Oliveira
@ 2022-06-16 8:44 ` Daniel Bristot de Oliveira
2022-06-16 15:20 ` kernel test robot
` (2 more replies)
2022-06-16 8:44 ` [PATCH V4 14/20] Documentation/rv: Add a basic documentation Daniel Bristot de Oliveira
` (8 subsequent siblings)
21 siblings, 3 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-16 8:44 UTC (permalink / raw)
To: Steven Rostedt
Cc: Daniel Bristot de Oliveira, Wim Van Sebroeck, Guenter Roeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel
Sample reactor that panics the system when an exception is found. This
is useful both to capture a vmcore, or to fail-safe a critical system.
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Gabriele Paoloni <gpaoloni@redhat.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Clark Williams <williams@redhat.com>
Cc: linux-doc@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-trace-devel@vger.kernel.org
Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
---
kernel/trace/rv/Kconfig | 8 ++++++
kernel/trace/rv/Makefile | 1 +
kernel/trace/rv/reactor_panic.c | 44 +++++++++++++++++++++++++++++++++
3 files changed, 53 insertions(+)
create mode 100644 kernel/trace/rv/reactor_panic.c
diff --git a/kernel/trace/rv/Kconfig b/kernel/trace/rv/Kconfig
index be8e3dab0a52..91a17b13a080 100644
--- a/kernel/trace/rv/Kconfig
+++ b/kernel/trace/rv/Kconfig
@@ -60,4 +60,12 @@ config RV_REACT_PRINTK
Enables the printk reactor. The printk reactor emmits a printk()
message if an exception is found.
+config RV_REACT_PANIC
+ bool "Panic reactor"
+ depends on RV_REACTORS
+ default y if RV_REACTORS
+ help
+ Enables the panic reactor. The panic reactor emmits a printk()
+ message if an exception is found and panic()s the system.
+
endif # RV
diff --git a/kernel/trace/rv/Makefile b/kernel/trace/rv/Makefile
index a13c750a35c1..963d14875b45 100644
--- a/kernel/trace/rv/Makefile
+++ b/kernel/trace/rv/Makefile
@@ -5,3 +5,4 @@ obj-$(CONFIG_RV_MON_WIP) += monitors/wip/wip.o
obj-$(CONFIG_RV_MON_WWNR) += monitors/wwnr/wwnr.o
obj-$(CONFIG_RV_REACTORS) += rv_reactors.o
obj-$(CONFIG_RV_REACT_PRINTK) += reactor_printk.o
+obj-$(CONFIG_RV_REACT_PANIC) += reactor_panic.o
diff --git a/kernel/trace/rv/reactor_panic.c b/kernel/trace/rv/reactor_panic.c
new file mode 100644
index 000000000000..9d8d78a337a3
--- /dev/null
+++ b/kernel/trace/rv/reactor_panic.c
@@ -0,0 +1,44 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Panic RV reactor:
+ * Prints the exception msg to the kernel message log and panic().
+ *
+ * Copyright (C) 2019-2022 Daniel Bristot de Oliveira <bristot@kernel.org>
+ *
+ */
+
+#include <linux/ftrace.h>
+#include <linux/tracepoint.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/rv.h>
+
+static void rv_panic_reaction(char *msg)
+{
+ panic(msg);
+}
+
+struct rv_reactor rv_panic = {
+ .name = "panic",
+ .description = "panic the system if an exception is found.",
+ .react = rv_panic_reaction
+};
+
+int register_react_panic(void)
+{
+ rv_register_reactor(&rv_panic);
+ return 0;
+}
+
+void unregister_react_panic(void)
+{
+ rv_unregister_reactor(&rv_panic);
+}
+
+module_init(register_react_panic);
+module_exit(unregister_react_panic);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Daniel Bristot de Oliveira");
+MODULE_DESCRIPTION("panic rv reactor: panic if an exception is found");
--
2.35.1
^ permalink raw reply related [flat|nested] 82+ messages in thread
* [PATCH V4 14/20] Documentation/rv: Add a basic documentation
2022-06-16 8:44 [PATCH V4 00/20] The Runtime Verification (RV) interface Daniel Bristot de Oliveira
` (12 preceding siblings ...)
2022-06-16 8:44 ` [PATCH V4 13/20] rv/reactor: Add the panic reactor Daniel Bristot de Oliveira
@ 2022-06-16 8:44 ` Daniel Bristot de Oliveira
2022-06-29 3:35 ` Bagas Sanjaya
2022-06-16 8:44 ` [PATCH V4 15/20] Documentation/rv: Add deterministic automata monitor synthesis documentation Daniel Bristot de Oliveira
` (7 subsequent siblings)
21 siblings, 1 reply; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-16 8:44 UTC (permalink / raw)
To: Steven Rostedt
Cc: Daniel Bristot de Oliveira, Wim Van Sebroeck, Guenter Roeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel
Add the runtime-verification.rst document, explaining the basics of RV
and how to use the interface.
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Gabriele Paoloni <gpaoloni@redhat.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Clark Williams <williams@redhat.com>
Cc: linux-doc@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-trace-devel@vger.kernel.org
Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
---
Documentation/trace/index.rst | 1 +
Documentation/trace/rv/index.rst | 9 +
.../trace/rv/runtime-verification.rst | 233 ++++++++++++++++++
kernel/trace/rv/Kconfig | 3 +
4 files changed, 246 insertions(+)
create mode 100644 Documentation/trace/rv/index.rst
create mode 100644 Documentation/trace/rv/runtime-verification.rst
diff --git a/Documentation/trace/index.rst b/Documentation/trace/index.rst
index f9b7bcb5a630..2d73e8697523 100644
--- a/Documentation/trace/index.rst
+++ b/Documentation/trace/index.rst
@@ -32,3 +32,4 @@ Linux Tracing Technologies
sys-t
coresight/index
user_events
+ rv/index
diff --git a/Documentation/trace/rv/index.rst b/Documentation/trace/rv/index.rst
new file mode 100644
index 000000000000..92338dceffab
--- /dev/null
+++ b/Documentation/trace/rv/index.rst
@@ -0,0 +1,9 @@
+===================================
+RV - Runtime Verification Interface
+===================================
+
+.. toctree::
+ :maxdepth: 2
+ :glob:
+
+ *
diff --git a/Documentation/trace/rv/runtime-verification.rst b/Documentation/trace/rv/runtime-verification.rst
new file mode 100644
index 000000000000..f51cf69b10d3
--- /dev/null
+++ b/Documentation/trace/rv/runtime-verification.rst
@@ -0,0 +1,233 @@
+====================
+Runtime Verification
+====================
+
+Runtime Verification (RV) is a lightweight (yet rigorous) method that
+complements classical exhaustive verification techniques (such as *model
+checking* and *theorem proving*) with a more practical approach for complex
+systems.
+
+
+Instead of relying on a fine-grained model of a system (e.g., a
+re-implementation a instruction level), RV works by analyzing the trace of the
+system's actual execution, comparing it against a formal specification of
+the system behavior.
+
+The main advantage is that RV can give precise information on the runtime
+behavior of the monitored system, without the pitfalls of developing models
+that require a re-implementation of the entire system in a modeling language.
+Moreover, given an efficient monitoring method, it is possible execute an
+*online* verification of a system, enabling the *reaction* for unexpected
+events, avoiding, for example, the propagation of a failure on safety-critical
+systems.
+
+Runtime Monitors and Reactors
+=============================
+
+A monitor is the central part of the runtime verification of a system. The
+monitor stands in between the formal specification of the desired (or
+undesired) behavior, and the trace of the actual system.
+
+In Linux terms, the runtime verification monitors are encapsulated inside the
+*RV monitor* abstraction. A *RV monitor* includes a reference model of the
+system, a set of instances of the monitor (per-cpu monitor, per-task monitor,
+and so on), and the helper functions that glue the monitor to the system via
+trace, as depicted bellow::
+
+ Linux +---- RV Monitor ----------------------------------+ Formal
+ Realm | | Realm
+ +-------------------+ +----------------+ +-----------------+
+ | Linux kernel | | Monitor | | Reference |
+ | Tracing | -> | Instance(s) | <- | Model |
+ | (instrumentation) | | (verification) | | (specification) |
+ +-------------------+ +----------------+ +-----------------+
+ | | |
+ | V |
+ | +----------+ |
+ | | Reaction | |
+ | +--+--+--+-+ |
+ | | | | |
+ | | | +-> trace output ? |
+ +------------------------|--|----------------------+
+ | +----> panic ?
+ +-------> <user-specified>
+
+In addition to the verification and monitoring of the system, a monitor can
+react to an unexpected event. The forms of reaction can vary from logging the
+event occurrence to the enforcement of the correct behavior to the extreme
+action of taking a system down to avoid the propagation of a failure.
+
+In Linux terms, a *reactor* is an reaction method available for *RV monitors*.
+By default, all monitors should provide a trace output of their actions,
+which is already a reaction. In addition, other reactions will be available
+so the user can enable them as needed.
+
+For further information about the principles of runtime verification and
+RV applied to Linux:
+
+ BARTOCCI, Ezio, et al. *Introduction to runtime verification.* In: Lectures on
+ Runtime Verification. Springer, Cham, 2018. p. 1-33.
+
+ FALCONE, Ylies, et al. *A taxonomy for classifying runtime verification tools.*
+ In: International Conference on Runtime Verification. Springer, Cham, 2018. p.
+ 241-262.
+
+ DE OLIVEIRA, Daniel Bristot, et al. *Automata-based formal analysis and
+ verification of the real-time Linux kernel.* Ph.D. Thesis, 2020.
+
+Online RV monitors
+==================
+
+Monitors can be classified as *offline* and *online* monitors. *Offline*
+monitor process the traces generated by a system after the events, generally by
+reading the trace execution from a permanent storage system. *Online* monitors
+process the trace during the execution of the system. Online monitors are said
+to be *synchronous* if the processing of an event is attached to the system
+execution, blocking the system during the event monitoring. On the other hand,
+an *asynchronous* monitor has its execution detached from the system. Each type
+of monitor has a set of advantages. For example, *offline* monitors can be
+executed on different machines but require operations to save the log to a
+file. In contrast, *synchronous online* method can react at the exact moment
+a violation occurs.
+
+Another important aspect regarding monitors is the overhead associated with the
+event analysis. If the system generates events at a frequency higher than the
+monitor's ability to process them in the same system, only the *offline*
+methods are viable. On the other hand, if the tracing of the events incurs
+on higher overhead than the simple handling of an event by a monitor, then a
+*synchronous online* monitors will incur on lower overhead.
+
+Indeed, the research presented in:
+
+ DE OLIVEIRA, Daniel Bristot; CUCINOTTA, Tommaso; DE OLIVEIRA, Romulo Silva.
+ *Efficient formal verification for the Linux kernel.* In: International
+ Conference on Software Engineering and Formal Methods. Springer, Cham, 2019.
+ p. 315-332.
+
+Shows that for Deterministic Automata models, the synchronous processing of
+events in-kernel causes lower overhead than saving the same events to the trace
+buffer, not even considering collecting the trace for user-space analysis.
+This motivated the development of an in-kernel interface for online monitors.
+
+For further information about modeling of Linux kernel behavior using automata,
+please read:
+
+ DE OLIVEIRA, Daniel B.; DE OLIVEIRA, Romulo S.; CUCINOTTA, Tommaso. *A thread
+ synchronization model for the PREEMPT_RT Linux kernel.* Journal of Systems
+ Architecture, 2020, 107: 101729.
+
+The user interface
+==================
+
+The user interface resembles the tracing interface (on purpose). It is
+currently at "/sys/kernel/tracing/rv/".
+
+The following files/folders are currently available:
+
+**available_monitors**
+
+- Reading list the available monitors, one per line
+
+For example::
+
+ [root@f32 rv]# cat available_monitors
+ wip
+ wwnr
+
+**available_reactors**
+
+- Reading shows the available reactors, one per line.
+
+For example::
+
+ [root@f32 rv]# cat available_reactors
+ nop
+ panic
+ printk
+
+**enabled_monitors**:
+
+- Reading lists the enabled monitors, one per line
+- Writing to it enables a given monitor
+- Writing a monitor name with a '-' prefix disables it
+- Truncating the file disables all enabled monitors
+
+For example::
+
+ [root@f32 rv]# cat enabled_monitors
+ [root@f32 rv]# echo wip > enabled_monitors
+ [root@f32 rv]# echo wwnr >> enabled_monitors
+ [root@f32 rv]# cat enabled_monitors
+ wip
+ wwnr
+ [root@f32 rv]# echo '!wip' >> enabled_monitors
+ [root@f32 rv]# cat enabled_monitors
+ wwnr
+ [root@f32 rv]# echo > enabled_monitors
+ [root@f32 rv]# cat enabled_monitors
+ [root@f32 rv]#
+
+Note that it is possible to enable more than one monitor concurrently.
+
+
+**monitoring_on**
+
+This is an on/off general switcher for monitoring. It resembles the
+"tracing_on" switcher in the trace interface.
+
+- Writing "0" stops the monitoring
+- Writing "1" continues the monitoring
+- Reading returns the current status of the monitoring
+
+Note that it does not disable enabled monitors but stop the per-entity
+monitors monitoring the events received from the system.
+
+**reacting_on**
+
+- Writing "0" prevents reactions for happening
+- Writing "1" enable reactions
+- Reading returns the current status of the monitoring
+
+**monitors/**
+
+Each monitor will have its own directory inside "monitors/". There the
+monitor-specific files will be presented. The "monitors/" directory resembles
+the "events" directory on tracefs.
+
+For example::
+
+ [root@f32 rv]# cd monitors/wip/
+ [root@f32 wip]# ls
+ desc enable
+ [root@f32 wip]# cat desc
+ auto-generated wakeup in preemptive monitor.
+ [root@f32 wip]# cat enable
+ 0
+
+**monitors/$MONITOR/desc**
+
+- Reading shows a description of the monitor *$MONITOR*
+
+**monitors/$MONITOR/enable**
+
+- Writing "0" disables the *$MONITOR*
+- Writing "1" enables the *$MONITOR*
+- Reading return the current status of the *$MONITOR*
+
+**monitors/$MONITOR/reactors**
+
+- List available reactors, with the select reaction for the given *MONITOR*
+ inside "[]". The default one is the nop (no operation) reactor.
+- Writing the name of a reactor enables it to the given MONITOR.
+
+For example::
+
+ [root@f32 rv]# cat monitors/wip/reactors
+ [nop]
+ panic
+ printk
+ [root@f32 rv]# echo panic > monitors/wip/reactors
+ [root@f32 rv]# cat monitors/wip/reactors
+ nop
+ [panic]
+ printk
diff --git a/kernel/trace/rv/Kconfig b/kernel/trace/rv/Kconfig
index 91a17b13a080..21f03fb3101a 100644
--- a/kernel/trace/rv/Kconfig
+++ b/kernel/trace/rv/Kconfig
@@ -25,6 +25,9 @@ menuconfig RV
actual execution, comparing it against a formal specification of
the system behavior.
+ For further information, see:
+ Documentation/trace/rv/runtime-verification.rst
+
if RV
config RV_MON_WIP
depends on PREEMPTIRQ_TRACEPOINTS
--
2.35.1
^ permalink raw reply related [flat|nested] 82+ messages in thread
* [PATCH V4 15/20] Documentation/rv: Add deterministic automata monitor synthesis documentation
2022-06-16 8:44 [PATCH V4 00/20] The Runtime Verification (RV) interface Daniel Bristot de Oliveira
` (13 preceding siblings ...)
2022-06-16 8:44 ` [PATCH V4 14/20] Documentation/rv: Add a basic documentation Daniel Bristot de Oliveira
@ 2022-06-16 8:44 ` Daniel Bristot de Oliveira
2022-06-28 19:09 ` Steven Rostedt
2022-06-16 8:44 ` [PATCH V4 16/20] Documentation/rv: Add deterministic automata instrumentation documentation Daniel Bristot de Oliveira
` (6 subsequent siblings)
21 siblings, 1 reply; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-16 8:44 UTC (permalink / raw)
To: Steven Rostedt
Cc: Daniel Bristot de Oliveira, Wim Van Sebroeck, Guenter Roeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel
Add the da_monitor_synthesis.rst introduces some concepts behind the
Deterministic Automata (DA) monitor synthesis and interface.
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Gabriele Paoloni <gpaoloni@redhat.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Clark Williams <williams@redhat.com>
Cc: linux-doc@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-trace-devel@vger.kernel.org
Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
---
.../trace/rv/da_monitor_synthesis.rst | 284 ++++++++++++++++++
1 file changed, 284 insertions(+)
create mode 100644 Documentation/trace/rv/da_monitor_synthesis.rst
diff --git a/Documentation/trace/rv/da_monitor_synthesis.rst b/Documentation/trace/rv/da_monitor_synthesis.rst
new file mode 100644
index 000000000000..1e1c857d7bbd
--- /dev/null
+++ b/Documentation/trace/rv/da_monitor_synthesis.rst
@@ -0,0 +1,284 @@
+Deterministic Automata Monitor Synthesis
+========================================
+
+The starting point for the application of runtime verification (RV) technics is
+the *specification* or *modeling* of the desired (or undesired) behavior of the
+system under scrutiny.
+
+The formal representation needs to be then *synthesized* into a *monitor* that
+can then be used in the analysis of the trace of the system. The *monitor*
+conects to the system via an *instrumentation* layer, that converts the events
+from the *system* to the events of the *specification*.
+
+This document introduces some concepts behind the **Deterministic Automata
+(DA)** monitor synthesis.
+
+DA monitor synthesis in a nutshell
+------------------------------------------------------
+
+The synthesis of automata-based models into the Linux *RV monitor* abstraction
+is automated by a tool named "dot2k", and the "rv/da_monitor.h" provided
+by the RV interface.
+
+Given a file "wip.dot", representing a per-cpu monitor, with this content::
+
+ digraph state_automaton {
+ center = true;
+ size = "7,11";
+ rankdir = LR;
+ {node [shape = circle] "non_preemptive"};
+ {node [shape = plaintext, style=invis, label=""] "__init_preemptive"};
+ {node [shape = doublecircle] "preemptive"};
+ {node [shape = circle] "preemptive"};
+ "__init_preemptive" -> "preemptive";
+ "non_preemptive" [label = "non_preemptive"];
+ "non_preemptive" -> "non_preemptive" [ label = "sched_waking" ];
+ "non_preemptive" -> "preemptive" [ label = "preempt_enable" ];
+ "preemptive" [label = "preemptive"];
+ "preemptive" -> "non_preemptive" [ label = "preempt_disable" ];
+ { rank = min ;
+ "__init_preemptive";
+ "preemptive";
+ }
+ }
+
+Run the dot2k tool with the model, specifying that it is a "per-cpu"
+model::
+
+ $ dot2k -d ~/wip.dot -t per_cpu
+
+This will create a directory named "wip/" with the following files:
+
+- wip.h: the wip in C
+- wip.c: the RV monitor
+
+The following line in the "wip.c" file is responsible for the monitor
+synthesis::
+
+ DECLARE_DA_MON_PER_CPU(wip, char);
+
+With that in place, the work left to be done is the *instrumentation* of
+the monitor, which is already initialized by dot2k.
+
+DA: Introduction and representation formats
+---------------------------------------------------------------
+
+Formally, a deterministic automaton, denoted by G, is defined as a quintuple:
+
+ *G* = { *X*, *E*, *f*, x\ :subscript:`0`, X\ :subscript:`m` }
+
+where:
+
+- *X* is the set of states;
+- *E* is the finite set of events;
+- x\ :subscript:`0` is the initial state;
+- X\ :subscript:`m` (subset of *X*) is the set of marked states.
+- *f* : *X* x *E* -> *X* $ is the transition function. It defines the state
+ transition in the occurrence of an event from *E* in the state *X*. In the
+ special case of deterministic automata, the occurrence of the event in *E*
+ in a state in *X* has a deterministic next state from *X*.
+
+One of the most evident benefits for the practical application of the automata
+formalism is its *graphic representation*, represented using vertices (nodes)
+and edges, which is very intuitive for *operating system* practitioners.
+
+For example, given an automata wip, with a regular representation of:
+
+- *X* = { ``preemptive``, ``non_preemptive``}
+- *E* = { ``preempt_enable``, ``preempt_disable``, ``sched_waking``}
+- x\ :subscript:`0` = ``preemptive``
+- X\ :subscript:`m` = {``preemptive``}
+- *f* =
+ - *f*\ (``preemptive``, ``preempt_disable``) = ``non_preemptive``
+ - *f*\ (``non_preemptive``, ``sched_waking``) = ``non_preemptive``
+ - *f*\ (``non_preemptive``, ``preempt_enable``) = ``preemptive``
+
+
+It can also be represented in a graphic format, without any loss, using this
+format::
+
+ preempt_enable
+ +---------------------------------+
+ v |
+ #============# preempt_disable +------------------+
+ --> H preemptive H -----------------> | non_preemptive |
+ #============# +------------------+
+ ^ sched_waking |
+ +--------------+
+
+The Graphviz open-source tool can produce this graphic format using the
+(textual) DOT language as the source code. The DOT format is widely
+used and can be converted to many other formats, including the ASCII art above.
+
+The dot2c tool presented in:
+
+ DE OLIVEIRA, Daniel Bristot; CUCINOTTA, Tommaso; DE OLIVEIRA, Romulo
+ Silva. Efficient formal verification for the Linux kernel. In:
+ International Conference on Software Engineering and Formal Methods.
+ Springer, Cham, 2019. p. 315-332.
+
+Translates a deterministic automaton in the DOT format into a C source
+code. For instance, using the wip model as input for dot2c results in
+the following C representation::
+
+ enum states_wip {
+ preemptive_wip = 0,
+ non_preemptive_wip,
+ state_max_wip
+ };
+
+ enum events_wip {
+ preempt_disable_wip = 0,
+ preempt_enable_wip,
+ sched_waking_wip,
+ event_max_wip
+ };
+
+ struct automaton_wip {
+ char *state_names[state_max_wip];
+ char *event_names[event_max_wip];
+ char function[state_max_wip][event_max_wip];
+ char initial_state;
+ char final_states[state_max_wip];
+ };
+
+ struct automaton_wip automaton_wip = {
+ .state_names = {
+ "preemptive",
+ "non_preemptive"
+ },
+ .event_names = {
+ "preempt_disable",
+ "preempt_enable",
+ "sched_waking"
+ },
+ .function = {
+ { non_preemptive_wip, -1, -1 },
+ { -1, preemptive_wip, non_preemptive_wip },
+ },
+ .initial_state = preemptive_wip,
+ .final_states = { 1, 0 },
+ };
+
+DA monitor synthesis for Linux
+------------------------------
+
+In Linux terms, the runtime verification monitors are encapsulated
+inside the "RV monitor" abstraction. The "RV monitor" includes a set
+of instances of the monitor (per-cpu monitor, per-task monitor, and
+so on), the helper functions that glue the monitor to the system
+reference model, and the trace output as a reaction for event parsing
+and exceptions, as depicted below::
+
+ Linux +----- RV Monitor ----------------------------------+ Formal
+ Realm | | Realm
+ +-------------------+ +----------------+ +-----------------+
+ | Linux kernel | | Monitor | | Reference |
+ | Tracing | -> | Instance(s) | <- | Model |
+ | (instrumentation) | | (verification) | | (specification) |
+ +-------------------+ +----------------+ +-----------------+
+ | | |
+ | V |
+ | +----------+ |
+ | | Reaction | |
+ | +--+--+--+-+ |
+ | | | | |
+ | | | +-> trace output ? |
+ +------------------------|--|----------------------+
+ | +----> panic ?
+ +-------> <user-specified>
+
+
+The dot2c tool works connecting the *Reference Model* to the *RV Monitor*
+abstraction by translating the *formal notation* into *code*.
+
+The "rv/da_monitor.h" header goes beyond dot2c, extending the code
+generation to the verification stage, generating the code to the *Monitor
+Instance(s)* level using C macros. The trace event code inspires this
+approach.
+
+The benefits of the usage of macro for monitor synthesis is 3-fold:
+
+- Reduces the code duplication;
+- Facilitates the bug fix/improvement;
+- Avoids the case of developers changing the core of the monitor code
+ to manipulate the model in a (let's say) non-standard way.
+
+This initial implementation presents two different types of monitor instances:
+
+- ``#define DECLARE_DA_MON_PER_CPU(name, type)``
+- ``#define DECLARE_DA_MON_PER_TASK(name, type)``
+
+The first declares the functions for deterministic automata monitor with
+per-cpu instances, and the second with per-task instances.
+
+In both cases, the name is a string that identifies the monitor, and the type
+is the data type used by dot2c/k on the representation of the model.
+
+For example, the "wip" model with two states and three events can be
+stored in a "char" type. Considering that the preemption control is a
+per-cpu behavior, the monitor declaration will be::
+
+ DECLARE_DA_MON_PER_CPU(wip, char);
+
+The monitor is executed by sending events to be processed via the functions
+presented below::
+
+ da_handle_event_$(MONITOR_NAME)($(event from event enum));
+ da_handle_init_event_$(MONITOR_NAME)($(event from event enum));
+
+The function ``da_handle_event_$(MONITOR_NAME)()`` is the regular case,
+while the function ``da_handle_init_event_$(MONITOR_NAME)()`` is a special
+case used to synchronize the system with the model.
+
+When a monitor is enabled, it is placed in the initial state of the automata.
+However, the monitor does not know if the system is in the *initial state*.
+Hence, the monitor ignores events sent by sent by
+``da_handle_event_$(MONITOR_NAME)()`` until the function
+``da_handle_init_event_$(MONITOR_NAME)()`` is called.
+
+The function ``da_handle_init_event_$(MONITOR_NAME)()`` should be used for
+the case in which the system generates the event is the one that returns
+the automata to the initial state.
+
+After receiving a ``da_handle_init_event_$(MONITOR_NAME)()`` event, the
+monitor will know that it is in sync with the system and hence will
+start processing the next events.
+
+Using the wip model as example, the events "preempt_disable" and
+"sched_waking" should be sent to monitor, respectively, via::
+
+ da_handle_event_wip(preempt_disable);
+ da_handle_event_wip(sched_waking);
+
+While the event "preempt_enabled" will use::
+
+ da_handle_init_event_wip(preempt_enable);
+
+To notify the monitor that the system will be returning to the initial state,
+so the system and the monitor should be in sync.
+
+rv/da_monitor.h
+-------------------------------------------
+
+The "rv/da_monitor.h" is, mostly, a set of C macros that create function
+definitions based on the paremeters passed via ``DECLARE_DA_MON_*``.
+
+In fewer words, the declaration of a monitor generates:
+
+- Helper functions for getting information from the automata model generated
+ by dot2k.
+- Helper functions for the analysis of a deterministic automata model
+- Functions for the initialization of the monitor instances
+- The definition of the structure to store the monitor instances' data
+
+One important aspect is that the monitor does not call external functions
+for the handling of the events sent by the instrumentation, except for
+generating *tracing events* or *reactions*.
+
+Final remarks
+-------------
+
+With the monitor synthesis in place using, the "rv/da_monitor.h" and
+dot2k, the developer's work should be limited to the instrumentation
+of the system, increasing the confidence in the overall approach.
--
2.35.1
^ permalink raw reply related [flat|nested] 82+ messages in thread
* [PATCH V4 16/20] Documentation/rv: Add deterministic automata instrumentation documentation
2022-06-16 8:44 [PATCH V4 00/20] The Runtime Verification (RV) interface Daniel Bristot de Oliveira
` (14 preceding siblings ...)
2022-06-16 8:44 ` [PATCH V4 15/20] Documentation/rv: Add deterministic automata monitor synthesis documentation Daniel Bristot de Oliveira
@ 2022-06-16 8:44 ` Daniel Bristot de Oliveira
2022-06-16 8:44 ` [PATCH V4 17/20] watchdog/dev: Add tracepoints Daniel Bristot de Oliveira
` (5 subsequent siblings)
21 siblings, 0 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-16 8:44 UTC (permalink / raw)
To: Steven Rostedt
Cc: Daniel Bristot de Oliveira, Wim Van Sebroeck, Guenter Roeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel
Add the da_monitor_instrumentation.rst. It describes the basics
of RV monitor instrumentation.
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Gabriele Paoloni <gpaoloni@redhat.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Clark Williams <williams@redhat.com>
Cc: linux-doc@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-trace-devel@vger.kernel.org
Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
---
.../trace/rv/da_monitor_instrumentation.rst | 223 ++++++++++++++++++
1 file changed, 223 insertions(+)
create mode 100644 Documentation/trace/rv/da_monitor_instrumentation.rst
diff --git a/Documentation/trace/rv/da_monitor_instrumentation.rst b/Documentation/trace/rv/da_monitor_instrumentation.rst
new file mode 100644
index 000000000000..994110050d93
--- /dev/null
+++ b/Documentation/trace/rv/da_monitor_instrumentation.rst
@@ -0,0 +1,223 @@
+Deterministic Automata Instrumentation
+========================================
+
+This document introduces some concepts behind the **Deterministic Automata
+(DA)** monitor instrumentation.
+
+The synthesis of automata-based models into the Linux *RV monitor* abstraction
+is automated by a tool named dot2k, and the "rv/da_monitor.h" provided
+by the RV interface.
+
+For example, given a file "wip.dot", representing a per-cpu monitor, with
+this content::
+
+ digraph state_automaton {
+ center = true;
+ size = "7,11";
+ rankdir = LR;
+ {node [shape = circle] "non_preemptive"};
+ {node [shape = plaintext, style=invis, label=""] "__init_preemptive"};
+ {node [shape = doublecircle] "preemptive"};
+ {node [shape = circle] "preemptive"};
+ "__init_preemptive" -> "preemptive";
+ "non_preemptive" [label = "non_preemptive"];
+ "non_preemptive" -> "non_preemptive" [ label = "sched_waking" ];
+ "non_preemptive" -> "preemptive" [ label = "preempt_enable" ];
+ "preemptive" [label = "preemptive"];
+ "preemptive" -> "non_preemptive" [ label = "preempt_disable" ];
+ { rank = min ;
+ "__init_preemptive";
+ "preemptive";
+ }
+ }
+
+That is the "DOT" representation of this automata model::
+
+ preempt_enable
+ +---------------------------------+
+ v |
+ #============# preempt_disable +------------------+
+ --> H preemptive H -----------------> | non_preemptive |
+ #============# +------------------+
+ ^ sched_waking |
+ +--------------+
+
+
+Run the dot2k tool with the model, specifying that it is a "per-cpu"
+model::
+
+ $ dot2k -d ~/wip.dot -t per_cpu
+
+This will create a directory named "wip/" with the following files:
+
+- model.h: the wip in C
+- wip.h: tracepoints that report the execution of the events by the
+ monitor
+- wip.c: the RV monitor
+
+The monitor instrumentation should be done entirely in the RV monitor,
+in the example above, in the wip.c file.
+
+The RV monitor instrumentation section
+--------------------------------------
+
+The RV monitor file created by dot2k, with the name "$MODEL_NAME.c"
+will include a section dedicated to instrumentation.
+
+In the example of the wip.dot above, it will look like::
+
+ /*
+ * This is the instrumentation part of the monitor.
+ *
+ * This is the section where manual work is required. Here the kernel events
+ * are translated into model's event.
+ *
+ */
+ static void handle_preempt_disable(void *data, /* XXX: fill header */)
+ {
+ da_handle_event_wip(preempt_disable_wip);
+ }
+
+ static void handle_preempt_enable(void *data, /* XXX: fill header */)
+ {
+ da_handle_event_wip(preempt_enable_wip);
+ }
+
+ static void handle_sched_waking(void *data, /* XXX: fill header */)
+ {
+ da_handle_event_wip(sched_waking_wip);
+ }
+
+ static int start_wip(void)
+ {
+ int retval;
+
+ retval = da_monitor_init_wip();
+ if (retval)
+ return retval;
+
+ rv_attach_trace_probe("wip", /* XXX: tracepoint */, handle_preempt_disable);
+ rv_attach_trace_probe("wip", /* XXX: tracepoint */, handle_preempt_enable);
+ rv_attach_trace_probe("wip", /* XXX: tracepoint */, handle_sched_waking);
+
+ return 0;
+ }
+
+The comment at the top of the section explains the general idea: the
+instrumentation section translates *kernel events* into the *events
+accepted by the model*.
+
+Tracing callback functions
+-----------------------------
+
+The first three functions are skeletons for callback *handler functions* for
+each of the three events from the wip model. The developer does not
+necessarily need to use them: they are just starting points.
+
+Using the example of::
+
+ void handle_preempt_disable(void *data, /* XXX: fill header */)
+ {
+ da_handle_event_wip(preempt_disable_wip);
+ }
+
+The "preempt_disable" event from the model conects directly to the
+"preemptirq:preempt_disable". The "preemptirq:preempt_disable" event
+has the following signature, from "include/trace/events/preemptirq.h"::
+
+ TP_PROTO(unsigned long ip, unsigned long parent_ip)
+
+Hence, the "handle_preempt_disable()" function will look like::
+
+ void handle_preempt_disable(void *data, unsigned long ip, unsigned long parent_ip)
+
+In this case, the kernel even translates one to one with the automata event,
+and indeed, no other change is needed for this function.
+
+The next handler function, "handle_preempt_enable()" has the same argument
+list from the "handle_preempt_disable()". The difference is that the
+"preempt_enable" event will be used to synchronize the system to the model.
+
+Initially, the *model* is placed in the initial state. However, the *system*
+might, or might not be in the initial state. The monitor cannot start
+processing events until it knows that the system reached the initial state.
+Otherwise the monitor and the system could be out-of-sync.
+
+Looking at the automata definition, it is possible to see that the system
+and the model are expected to return to the initial state after the
+"preempt_enable" execution. Hence, it can be used to synchronize the
+system and the model at the initialization of the monitoring section.
+
+The initialization is informed via an special handle function, the
+"da_handle_init_event_$(MONITOR)(event)", in this case::
+
+ da_handle_event_wip(preempt_disable_wip);
+
+So, the callback function will look like::
+
+ void handle_preempt_enable(void *data, unsigned long ip, unsigned long parent_ip)
+ {
+ da_handle_init_event_wip(preempt_enable_wip);
+ }
+
+Finally, the "handle_sched_waking()" will look like::
+
+ void handle_sched_waking(void *data, struct task_struct *task)
+ {
+ da_handle_event_wip(sched_waking_wip);
+ }
+
+And the explanation is left for the reader as an exercise.
+
+Start and Stop functions
+------------------------
+
+dot2k automatically creates two special functions::
+
+ start_$MODELNAME()
+ stop_$MODELNAME()
+
+These functions are called when the monitor is enabled and disabled,
+respectivelly.
+
+They should be used to *attach* and *detach* the instrumentation to the running
+system. The developer must add to the relative function all that is needed to
+*attach* and *detach* its monitor to the system.
+
+For the wip case, these functions were named::
+
+ start_wip()
+ stop_wip()
+
+But no change was required because: by default, these functions *attach* and
+*detach* the tracepoints_to_attach, which was enough for this case.
+
+Instrumentation helpers
+--------------------------
+
+To complete the instrumentation, the *handler functions* need to be attached to a
+kernel event, at the monitoring start phase.
+
+The RV interface also facilitates this step. For example, the macro "rv_attach_trace_probe()"
+is used to connect the wip model events to the relative kernel event. dot2k automatically
+adds "rv_attach_trace_probe()" function call for each model event in the start phase, as
+a suggestion.
+
+For example, from the wip sample model::
+
+ static int start_wip(void)
+ {
+ int retval;
+
+ retval = da_monitor_init_wip();
+ if (retval)
+ return retval;
+
+ rv_attach_trace_probe("wip", /* XXX: tracepoint */, handle_preempt_disable);
+ rv_attach_trace_probe("wip", /* XXX: tracepoint */, handle_preempt_enable);
+ rv_attach_trace_probe("wip", /* XXX: tracepoint */, handle_sched_waking);
+
+ return 0;
+ }
+
+The probes then need to be detached at the stop phase.
--
2.35.1
^ permalink raw reply related [flat|nested] 82+ messages in thread
* [PATCH V4 17/20] watchdog/dev: Add tracepoints
2022-06-16 8:44 [PATCH V4 00/20] The Runtime Verification (RV) interface Daniel Bristot de Oliveira
` (15 preceding siblings ...)
2022-06-16 8:44 ` [PATCH V4 16/20] Documentation/rv: Add deterministic automata instrumentation documentation Daniel Bristot de Oliveira
@ 2022-06-16 8:44 ` Daniel Bristot de Oliveira
2022-06-16 13:44 ` Guenter Roeck
2022-06-16 8:45 ` [PATCH V4 18/20] rv/monitor: Add safe watchdog monitor Daniel Bristot de Oliveira
` (4 subsequent siblings)
21 siblings, 1 reply; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-16 8:44 UTC (permalink / raw)
To: Steven Rostedt
Cc: Daniel Bristot de Oliveira, Wim Van Sebroeck, Guenter Roeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel
Add a set of tracepoints, enabling the observability of the watchdog
device interactions with user-space.
The events are:
watchdog:watchdog_open
watchdog:watchdog_close
watchdog:watchdog_start
watchdog:watchdog_stop
watchdog:watchdog_set_timeout
watchdog:watchdog_ping
watchdog:watchdog_nowayout
watchdog:watchdog_set_keep_alive
watchdog:watchdog_keep_alive
watchdog:watchdog_set_pretimeout
watchdog:watchdog_pretimeout
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Gabriele Paoloni <gpaoloni@redhat.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Clark Williams <williams@redhat.com>
Cc: linux-doc@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-trace-devel@vger.kernel.org
Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
---
drivers/watchdog/watchdog_dev.c | 43 ++++++++++-
drivers/watchdog/watchdog_pretimeout.c | 2 +
include/linux/watchdog.h | 7 +-
include/trace/events/watchdog.h | 101 +++++++++++++++++++++++++
4 files changed, 143 insertions(+), 10 deletions(-)
create mode 100644 include/trace/events/watchdog.h
diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
index 54903f3c851e..2f28dc5ab763 100644
--- a/drivers/watchdog/watchdog_dev.c
+++ b/drivers/watchdog/watchdog_dev.c
@@ -44,6 +44,9 @@
#include <linux/watchdog.h> /* For watchdog specific items */
#include <linux/uaccess.h> /* For copy_to_user/put_user/... */
+#define CREATE_TRACE_POINTS
+#include <trace/events/watchdog.h>
+
#include "watchdog_core.h"
#include "watchdog_pretimeout.h"
@@ -130,9 +133,11 @@ static inline void watchdog_update_worker(struct watchdog_device *wdd)
if (watchdog_need_worker(wdd)) {
ktime_t t = watchdog_next_keepalive(wdd);
- if (t > 0)
+ if (t > 0) {
hrtimer_start(&wd_data->timer, t,
HRTIMER_MODE_REL_HARD);
+ trace_watchdog_set_keep_alive(wdd, ktime_to_ms(t));
+ }
} else {
hrtimer_cancel(&wd_data->timer);
}
@@ -141,7 +146,7 @@ static inline void watchdog_update_worker(struct watchdog_device *wdd)
static int __watchdog_ping(struct watchdog_device *wdd)
{
struct watchdog_core_data *wd_data = wdd->wd_data;
- ktime_t earliest_keepalive, now;
+ ktime_t earliest_keepalive, now, next_keepalive;
int err;
earliest_keepalive = ktime_add(wd_data->last_hw_keepalive,
@@ -149,14 +154,16 @@ static int __watchdog_ping(struct watchdog_device *wdd)
now = ktime_get();
if (ktime_after(earliest_keepalive, now)) {
- hrtimer_start(&wd_data->timer,
- ktime_sub(earliest_keepalive, now),
+ next_keepalive = ktime_sub(earliest_keepalive, now);
+ hrtimer_start(&wd_data->timer, next_keepalive,
HRTIMER_MODE_REL_HARD);
+ trace_watchdog_set_keep_alive(wdd, ktime_to_ms(next_keepalive));
return 0;
}
wd_data->last_hw_keepalive = now;
+ trace_watchdog_ping(wdd);
if (wdd->ops->ping)
err = wdd->ops->ping(wdd); /* ping the watchdog */
else
@@ -215,6 +222,7 @@ static void watchdog_ping_work(struct kthread_work *work)
wd_data = container_of(work, struct watchdog_core_data, work);
mutex_lock(&wd_data->lock);
+ trace_watchdog_keep_alive(wd_data->wdd);
if (watchdog_worker_should_ping(wd_data))
__watchdog_ping(wd_data->wdd);
mutex_unlock(&wd_data->lock);
@@ -250,6 +258,8 @@ static int watchdog_start(struct watchdog_device *wdd)
set_bit(_WDOG_KEEPALIVE, &wd_data->status);
+ trace_watchdog_start(wdd);
+
started_at = ktime_get();
if (watchdog_hw_running(wdd) && wdd->ops->ping) {
err = __watchdog_ping(wdd);
@@ -294,6 +304,7 @@ static int watchdog_stop(struct watchdog_device *wdd)
return -EBUSY;
}
+ trace_watchdog_stop(wdd);
if (wdd->ops->stop) {
clear_bit(WDOG_HW_RUNNING, &wdd->status);
err = wdd->ops->stop(wdd);
@@ -367,6 +378,7 @@ static int watchdog_set_timeout(struct watchdog_device *wdd,
if (watchdog_timeout_invalid(wdd, timeout))
return -EINVAL;
+ trace_watchdog_set_timeout(wdd, timeout);
if (wdd->ops->set_timeout) {
err = wdd->ops->set_timeout(wdd, timeout);
} else {
@@ -399,6 +411,8 @@ static int watchdog_set_pretimeout(struct watchdog_device *wdd,
if (watchdog_pretimeout_invalid(wdd, timeout))
return -EINVAL;
+ trace_watchdog_set_pretimeout(wdd, timeout);
+
if (wdd->ops->set_pretimeout && (wdd->info->options & WDIOF_PRETIMEOUT))
err = wdd->ops->set_pretimeout(wdd, timeout);
else
@@ -430,6 +444,23 @@ static int watchdog_get_timeleft(struct watchdog_device *wdd,
return 0;
}
+/**
+ * watchdog_set_nowayout - set nowaout bit
+ * @wdd: The watchdog device to set nowayoutbit
+ * @nowayout A boolean on/off switcher
+ *
+ * If nowayout boolean is true, the nowayout option is set. No action is
+ * taken if nowayout is false.
+ */
+void watchdog_set_nowayout(struct watchdog_device *wdd, bool nowayout)
+{
+ if (nowayout) {
+ set_bit(WDOG_NO_WAY_OUT, &wdd->status);
+ trace_watchdog_nowayout(wdd);
+ }
+}
+EXPORT_SYMBOL(watchdog_set_nowayout);
+
#ifdef CONFIG_WATCHDOG_SYSFS
static ssize_t nowayout_show(struct device *dev, struct device_attribute *attr,
char *buf)
@@ -861,6 +892,8 @@ static int watchdog_open(struct inode *inode, struct file *file)
goto out_clear;
}
+ trace_watchdog_open(wdd);
+
err = watchdog_start(wdd);
if (err < 0)
goto out_mod;
@@ -883,6 +916,7 @@ static int watchdog_open(struct inode *inode, struct file *file)
return stream_open(inode, file);
out_mod:
+ trace_watchdog_close(wdd);
module_put(wd_data->wdd->ops->owner);
out_clear:
clear_bit(_WDOG_DEV_OPEN, &wd_data->status);
@@ -944,6 +978,7 @@ static int watchdog_release(struct inode *inode, struct file *file)
/* make sure that /dev/watchdog can be re-opened */
clear_bit(_WDOG_DEV_OPEN, &wd_data->status);
+ trace_watchdog_close(wdd);
done:
running = wdd && watchdog_hw_running(wdd);
mutex_unlock(&wd_data->lock);
diff --git a/drivers/watchdog/watchdog_pretimeout.c b/drivers/watchdog/watchdog_pretimeout.c
index 376a495ab80c..58c391ed2205 100644
--- a/drivers/watchdog/watchdog_pretimeout.c
+++ b/drivers/watchdog/watchdog_pretimeout.c
@@ -8,6 +8,7 @@
#include <linux/spinlock.h>
#include <linux/string.h>
#include <linux/watchdog.h>
+#include <trace/events/watchdog.h>
#include "watchdog_core.h"
#include "watchdog_pretimeout.h"
@@ -107,6 +108,7 @@ void watchdog_notify_pretimeout(struct watchdog_device *wdd)
return;
}
+ trace_watchdog_pretimeout(wdd);
wdd->gov->pretimeout(wdd);
spin_unlock_irqrestore(&pretimeout_lock, flags);
}
diff --git a/include/linux/watchdog.h b/include/linux/watchdog.h
index 99660197a36c..11d93407e492 100644
--- a/include/linux/watchdog.h
+++ b/include/linux/watchdog.h
@@ -139,12 +139,7 @@ static inline bool watchdog_hw_running(struct watchdog_device *wdd)
return test_bit(WDOG_HW_RUNNING, &wdd->status);
}
-/* Use the following function to set the nowayout feature */
-static inline void watchdog_set_nowayout(struct watchdog_device *wdd, bool nowayout)
-{
- if (nowayout)
- set_bit(WDOG_NO_WAY_OUT, &wdd->status);
-}
+void watchdog_set_nowayout(struct watchdog_device *wdd, bool nowayout);
/* Use the following function to stop the watchdog on reboot */
static inline void watchdog_stop_on_reboot(struct watchdog_device *wdd)
diff --git a/include/trace/events/watchdog.h b/include/trace/events/watchdog.h
new file mode 100644
index 000000000000..145cd6cfaa02
--- /dev/null
+++ b/include/trace/events/watchdog.h
@@ -0,0 +1,101 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM watchdog
+
+#if !defined(_TRACE_WATCHDOG_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_WATCHDOG_H
+
+#include <linux/tracepoint.h>
+
+/*
+ * These are all events whose sole argument is the watchdog id.
+ */
+DECLARE_EVENT_CLASS(dev_operations_template,
+
+ TP_PROTO(struct watchdog_device *wdd),
+
+ TP_ARGS(wdd),
+
+ TP_STRUCT__entry(
+ __field(__u32, id)
+ ),
+
+ TP_fast_assign(
+ __entry->id = wdd->id;
+ ),
+
+ TP_printk("id=%d",
+ __entry->id)
+);
+
+DEFINE_EVENT(dev_operations_template, watchdog_open,
+ TP_PROTO(struct watchdog_device *wdd),
+ TP_ARGS(wdd));
+
+DEFINE_EVENT(dev_operations_template, watchdog_close,
+ TP_PROTO(struct watchdog_device *wdd),
+ TP_ARGS(wdd));
+
+DEFINE_EVENT(dev_operations_template, watchdog_start,
+ TP_PROTO(struct watchdog_device *wdd),
+ TP_ARGS(wdd));
+
+DEFINE_EVENT(dev_operations_template, watchdog_stop,
+ TP_PROTO(struct watchdog_device *wdd),
+ TP_ARGS(wdd));
+
+DEFINE_EVENT(dev_operations_template, watchdog_ping,
+ TP_PROTO(struct watchdog_device *wdd),
+ TP_ARGS(wdd));
+
+DEFINE_EVENT(dev_operations_template, watchdog_nowayout,
+ TP_PROTO(struct watchdog_device *wdd),
+ TP_ARGS(wdd));
+
+DEFINE_EVENT(dev_operations_template, watchdog_keep_alive,
+ TP_PROTO(struct watchdog_device *wdd),
+ TP_ARGS(wdd));
+
+DEFINE_EVENT(dev_operations_template, watchdog_pretimeout,
+ TP_PROTO(struct watchdog_device *wdd),
+ TP_ARGS(wdd));
+
+/*
+ * These are all events with a device ID and a given timeout.
+ */
+DECLARE_EVENT_CLASS(watchdog_timeout_template,
+
+ TP_PROTO(struct watchdog_device *wdd, u64 timeout),
+
+ TP_ARGS(wdd, timeout),
+
+ TP_STRUCT__entry(
+ __field(__u32, id)
+ __field(__u64, timeout)
+ ),
+
+ TP_fast_assign(
+ __entry->id = wdd->id;
+ __entry->timeout = timeout;
+ ),
+
+ TP_printk("id=%d timeout=%llus",
+ __entry->id, __entry->timeout)
+);
+
+DEFINE_EVENT(watchdog_timeout_template, watchdog_set_timeout,
+ TP_PROTO(struct watchdog_device *wdd, u64 timeout),
+ TP_ARGS(wdd, timeout));
+
+DEFINE_EVENT(watchdog_timeout_template, watchdog_set_pretimeout,
+ TP_PROTO(struct watchdog_device *wdd, u64 timeout),
+ TP_ARGS(wdd, timeout));
+
+DEFINE_EVENT(watchdog_timeout_template, watchdog_set_keep_alive,
+ TP_PROTO(struct watchdog_device *wdd, u64 timeout),
+ TP_ARGS(wdd, timeout));
+
+#endif /* _TRACE_WATCHDOG_H */
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>
--
2.35.1
^ permalink raw reply related [flat|nested] 82+ messages in thread
* [PATCH V4 18/20] rv/monitor: Add safe watchdog monitor
2022-06-16 8:44 [PATCH V4 00/20] The Runtime Verification (RV) interface Daniel Bristot de Oliveira
` (16 preceding siblings ...)
2022-06-16 8:44 ` [PATCH V4 17/20] watchdog/dev: Add tracepoints Daniel Bristot de Oliveira
@ 2022-06-16 8:45 ` Daniel Bristot de Oliveira
2022-06-16 13:36 ` Guenter Roeck
` (2 more replies)
2022-06-16 8:45 ` [PATCH V4 19/20] rv/safety_app: Add a safety_app sample Daniel Bristot de Oliveira
` (3 subsequent siblings)
21 siblings, 3 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-16 8:45 UTC (permalink / raw)
To: Steven Rostedt
Cc: Daniel Bristot de Oliveira, Wim Van Sebroeck, Guenter Roeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel
The watchdog is an essential building block for the usage of Linux in
safety-critical systems because it allows the system to be monitored from
an external element - the watchdog hardware, acting as a safety-monitor.
A user-space application controls the watchdog device via the watchdog
interface. This application, hereafter safety_app, enables the watchdog
and periodically pets the watchdog upon correct completion of the safety
related processing.
If the safety_app, for any reason, stops pinging the watchdog,
the watchdog hardware can set the system in a fail-safe state. For
example, shutting the system down.
Given the importance of the safety_app / watchdog hardware couple,
the interaction between these software pieces also needs some
sort of monitoring. In other words, "who monitors the monitor?"
The safe watchdog (safe_wtd) RV monitor monitors the interaction between
the safety_app and the watchdog device, enforcing the correct sequence of
events that leads the system to a safe state.
Furthermore, the safety_app can monitor the RV monitor by collecting the
events generated by the RV monitor itself via tracing interface. In this way,
closing the monitoring loop with the safety_app.
To reach a safe state, the safe_wtd RV monitor requires the
safety_app to:
- Open the watchdog device
- Start the watchdog
- Set a timeout
- ping at least once
The RV monitor also avoids some undesired actions. For example, to have
other threads to touch the watchdog.
The monitor also has a set of options, enabled via kernel command
line/module options. They are:
- watchdog_id: the device id to monitor (default 0).
- dont_stop: once enabled, do not allow the RV monitor to be stopped
(default off);
- safe_timeout: define a maximum safe value that an user-space
application can set as the watchdog timeout
(default unlimited).
- check_timeout: After every ping, check if the time left in the
watchdog is less than or equal to the last timeout set
for the watchdog. It only works for watchdog devices that
provide the get_timeleft() function (default off).
For further information, please refer to:
Documentation/trace/rv/watchdog-monitor.rst
The monitor specification was developed together with Gabriele Paoloni,
in the context of the Linux Foundation Elisa Project.
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Gabriele Paoloni <gpaoloni@redhat.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Clark Williams <williams@redhat.com>
Cc: linux-doc@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-trace-devel@vger.kernel.org
Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
---
include/trace/events/rv.h | 11 +
kernel/trace/rv/Kconfig | 10 +
kernel/trace/rv/Makefile | 1 +
kernel/trace/rv/monitors/safe_wtd/safe_wtd.c | 300 +++++++++++++++++++
kernel/trace/rv/monitors/safe_wtd/safe_wtd.h | 84 ++++++
5 files changed, 406 insertions(+)
create mode 100644 kernel/trace/rv/monitors/safe_wtd/safe_wtd.c
create mode 100644 kernel/trace/rv/monitors/safe_wtd/safe_wtd.h
diff --git a/include/trace/events/rv.h b/include/trace/events/rv.h
index 00f11a8dac3b..895eb3435ed7 100644
--- a/include/trace/events/rv.h
+++ b/include/trace/events/rv.h
@@ -66,6 +66,17 @@ DEFINE_EVENT(error_da_monitor, error_wip,
TP_PROTO(char *state, char *event),
TP_ARGS(state, event));
#endif /* CONFIG_RV_MON_WIP */
+
+#ifdef CONFIG_RV_MON_SAFE_WTD
+DEFINE_EVENT(event_da_monitor, event_safe_wtd,
+ TP_PROTO(char *state, char *event, char *next_state, bool safe),
+ TP_ARGS(state, event, next_state, safe));
+
+DEFINE_EVENT(error_da_monitor, error_safe_wtd,
+ TP_PROTO(char *state, char *event),
+ TP_ARGS(state, event));
+#endif /* CONFIG_RV_MON_SAFE_WTD */
+
#endif /* CONFIG_DA_MON_EVENTS_IMPLICIT */
#ifdef CONFIG_DA_MON_EVENTS_ID
diff --git a/kernel/trace/rv/Kconfig b/kernel/trace/rv/Kconfig
index 21f03fb3101a..b14ae63e792b 100644
--- a/kernel/trace/rv/Kconfig
+++ b/kernel/trace/rv/Kconfig
@@ -45,6 +45,16 @@ config RV_MON_WWNR
illustrates the usage of per-task monitor. The model is
broken on purpose: it serves to test reactors.
+config RV_MON_SAFE_WTD
+ select DA_MON_EVENTS_IMPLICIT
+ bool "Safety watchdog"
+ help
+ Enable safe_wtd, this monitor observes the interaction
+ between a user-space safety monitor and a watchdog device.
+
+ For futher information see:
+ Documentation/trace/rv/safety-monitor.rst
+
config RV_REACTORS
bool "Runtime verification reactors"
default y if RV
diff --git a/kernel/trace/rv/Makefile b/kernel/trace/rv/Makefile
index 963d14875b45..904db96c7eae 100644
--- a/kernel/trace/rv/Makefile
+++ b/kernel/trace/rv/Makefile
@@ -3,6 +3,7 @@
obj-$(CONFIG_RV) += rv.o
obj-$(CONFIG_RV_MON_WIP) += monitors/wip/wip.o
obj-$(CONFIG_RV_MON_WWNR) += monitors/wwnr/wwnr.o
+obj-$(CONFIG_RV_MON_SAFE_WTD) += monitors/safe_wtd/safe_wtd.o
obj-$(CONFIG_RV_REACTORS) += rv_reactors.o
obj-$(CONFIG_RV_REACT_PRINTK) += reactor_printk.o
obj-$(CONFIG_RV_REACT_PANIC) += reactor_panic.o
diff --git a/kernel/trace/rv/monitors/safe_wtd/safe_wtd.c b/kernel/trace/rv/monitors/safe_wtd/safe_wtd.c
new file mode 100644
index 000000000000..9856e0770d0d
--- /dev/null
+++ b/kernel/trace/rv/monitors/safe_wtd/safe_wtd.c
@@ -0,0 +1,300 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/ftrace.h>
+#include <linux/tracepoint.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/rv.h>
+#include <rv/instrumentation.h>
+#include <rv/da_monitor.h>
+
+#include <linux/watchdog.h>
+#include <linux/moduleparam.h>
+
+#include <trace/events/rv.h>
+#include <trace/events/watchdog.h>
+
+#define MODULE_NAME "safe_wtd"
+
+/*
+ * This is the self-generated part of the monitor. Generally, there is no need
+ * to touch this section.
+ */
+#include "safe_wtd.h"
+
+/*
+ * Declare the deterministic automata monitor.
+ *
+ * The rv monitor reference is needed for the monitor declaration.
+ */
+struct rv_monitor rv_safe_wtd;
+DECLARE_DA_MON_GLOBAL(safe_wtd, char);
+
+/*
+ * custom: safe_timeout is the maximum value a watchdog monitor
+ * can set. This value is registered here to duplicate the information.
+ * In this way, a miss-behaving monitor can be detected.
+ */
+static int safe_timeout = ~0;
+module_param(safe_timeout, int, 0444);
+
+/*
+ * custom: if check_timeout is set, the monitor will check if the time left
+ * in the watchdog is less than or equals to the last safe timeout set by
+ * user-space. This check is done after each ping. In this way, if any
+ * code by-passed the watchdog dev interface setting a higher (so unsafe)
+ * timeout, this monitor will catch the side effect and react.
+ */
+static int last_timeout_set = 0;
+static int check_timeout = 0;
+module_param(check_timeout, int, 0444);
+
+/*
+ * custom: if dont_stop is set the monitor will react if stopped.
+ */
+static int dont_stop = 0;
+module_param(dont_stop, int, 0444);
+
+/*
+ * custom: there are some states that are kept after the watchdog is closed.
+ * For example, the nowayout state.
+ *
+ * Thus, the RV monitor needs to keep track of these states after a start/stop
+ * of the RV monitor itself, and should not reset after each restart - keeping the
+ * know state until the system shutdown.
+ *
+ * If for an unknown reason an RV monitor would like to reset the RV monitor at each
+ * RV monitor start, set it to one.
+ */
+static int reset_on_restart = 0;
+module_param(reset_on_restart, int, 0444);
+
+/*
+ * open_pid takes note of the first thread that opened the watchdog.
+ *
+ * Any other thread that generates an event will cause an "other_threads"
+ * event in the monitor.
+ */
+static int open_pid = 0;
+
+/*
+ * watchdog_id: the watchdog to monitor
+ */
+static int watchdog_id = 0;
+module_param(watchdog_id, int, 0444);
+
+static void handle_nowayout(void *data, struct watchdog_device *wdd)
+{
+ if (wdd->id != watchdog_id)
+ return;
+
+ da_handle_init_run_event_safe_wtd(nowayout_safe_wtd);
+}
+
+static void handle_close(void *data, struct watchdog_device *wdd)
+{
+ if (wdd->id != watchdog_id)
+ return;
+
+ if (open_pid && current->pid != open_pid) {
+ da_handle_init_run_event_safe_wtd(other_threads_safe_wtd);
+ } else {
+ da_handle_event_safe_wtd(close_safe_wtd);
+ open_pid = 0;
+ }
+}
+
+static void handle_open(void *data, struct watchdog_device *wdd)
+{
+ if (wdd->id != watchdog_id)
+ return;
+
+ if (open_pid && current->pid != open_pid) {
+ da_handle_init_run_event_safe_wtd(other_threads_safe_wtd);
+ } else {
+ da_handle_init_run_event_safe_wtd(open_safe_wtd);
+ open_pid = current->pid;
+ }
+}
+
+static void blocked_events(void *data, struct watchdog_device *wdd)
+{
+ if (wdd->id != watchdog_id)
+ return;
+
+ if (open_pid && current->pid != open_pid) {
+ da_handle_init_run_event_safe_wtd(other_threads_safe_wtd);
+ return;
+ }
+ da_handle_event_safe_wtd(other_threads_safe_wtd);
+}
+
+static void blocked_events_timeout(void *data, struct watchdog_device *wdd, u64 timeout)
+{
+ blocked_events(data, wdd);
+}
+
+static void handle_ping(void *data, struct watchdog_device *wdd)
+{
+ char msg[128];
+ unsigned int timeout;
+
+ if (wdd->id != watchdog_id)
+ return;
+
+ if (open_pid && current->pid != open_pid) {
+ da_handle_init_run_event_safe_wtd(other_threads_safe_wtd);
+ return;
+ }
+
+ da_handle_event_safe_wtd(ping_safe_wtd);
+
+ if (!check_timeout)
+ return;
+
+ if (wdd->ops->get_timeleft) {
+ timeout = wdd->ops->get_timeleft(wdd);
+ if (timeout > last_timeout_set) {
+ snprintf(msg, 128,
+ "watchdog timeout is %u > than previously set (%d)\n",
+ timeout, last_timeout_set);
+ cond_react(msg);
+ }
+ } else {
+ snprintf(msg, 128, "error getting timeout: option not supported\n");
+ cond_react(msg);
+ }
+}
+
+static void handle_set_safe_timeout(void *data, struct watchdog_device *wdd, u64 timeout)
+{
+ char msg[128];
+
+ if (wdd->id != watchdog_id)
+ return;
+
+ if (open_pid && current->pid != open_pid) {
+ da_handle_init_run_event_safe_wtd(other_threads_safe_wtd);
+ return;
+ }
+
+ da_handle_event_safe_wtd(set_safe_timeout_safe_wtd);
+
+ if (timeout > safe_timeout) {
+ snprintf(msg, 128, "set safety timeout is too high: %d", (int) timeout);
+ cond_react(msg);
+ }
+
+ if (check_timeout)
+ last_timeout_set = timeout;
+}
+
+static void handle_start(void *data, struct watchdog_device *wdd)
+{
+ if (wdd->id != watchdog_id)
+ return;
+
+ if (open_pid && current->pid != open_pid) {
+ da_handle_init_run_event_safe_wtd(other_threads_safe_wtd);
+ return;
+ }
+
+ da_handle_event_safe_wtd(start_safe_wtd);
+}
+
+static void handle_stop(void *data, struct watchdog_device *wdd)
+{
+ if (wdd->id != watchdog_id)
+ return;
+
+ if (open_pid && current->pid != open_pid) {
+ da_handle_init_run_event_safe_wtd(other_threads_safe_wtd);
+ return;
+ }
+
+ da_handle_event_safe_wtd(stop_safe_wtd);
+}
+
+static int mon_started = 0;
+
+static int start_safe_wtd_monitor(void)
+{
+ int retval;
+
+ if (!mon_started || reset_on_restart) {
+ retval = da_monitor_init_safe_wtd();
+ if (retval)
+ return retval;
+
+ mon_started = 1;
+ }
+
+ rv_attach_trace_probe("safe_wtd", watchdog_close, handle_close);
+ rv_attach_trace_probe("safe_wtd", watchdog_nowayout, handle_nowayout);
+ rv_attach_trace_probe("safe_wtd", watchdog_open, handle_open);
+ rv_attach_trace_probe("safe_wtd", watchdog_ping, handle_ping);
+ rv_attach_trace_probe("safe_wtd", watchdog_set_timeout, handle_set_safe_timeout);
+ rv_attach_trace_probe("safe_wtd", watchdog_start, handle_start);
+ rv_attach_trace_probe("safe_wtd", watchdog_stop, handle_stop);
+ rv_attach_trace_probe("safe_wtd", watchdog_set_keep_alive, blocked_events_timeout);
+ rv_attach_trace_probe("safe_wtd", watchdog_keep_alive, blocked_events);
+ rv_attach_trace_probe("safe_wtd", watchdog_set_pretimeout, blocked_events_timeout);
+ rv_attach_trace_probe("safe_wtd", watchdog_pretimeout, blocked_events);
+
+ return 0;
+}
+
+static void stop_safe_wtd_monitor(void)
+{
+ if (dont_stop)
+ cond_react("dont_stop safe_wtd is set.");
+
+ rv_safe_wtd.enabled = 0;
+
+ rv_detach_trace_probe("safe_wtd", watchdog_close, handle_close);
+ rv_detach_trace_probe("safe_wtd", watchdog_nowayout, handle_nowayout);
+ rv_detach_trace_probe("safe_wtd", watchdog_open, handle_open);
+ rv_detach_trace_probe("safe_wtd", watchdog_ping, handle_ping);
+ rv_detach_trace_probe("safe_wtd", watchdog_set_timeout, handle_set_safe_timeout);
+ rv_detach_trace_probe("safe_wtd", watchdog_start, handle_start);
+ rv_detach_trace_probe("safe_wtd", watchdog_stop, handle_stop);
+ rv_detach_trace_probe("safe_wtd", watchdog_set_keep_alive, blocked_events_timeout);
+ rv_detach_trace_probe("safe_wtd", watchdog_keep_alive, blocked_events);
+ rv_detach_trace_probe("safe_wtd", watchdog_set_pretimeout, blocked_events_timeout);
+ rv_detach_trace_probe("safe_wtd", watchdog_pretimeout, blocked_events);
+
+ da_monitor_destroy_safe_wtd();
+}
+
+/*
+ * This is the monitor register section.
+ */
+struct rv_monitor rv_safe_wtd = {
+ .name = "safe_wtd",
+ .description = "A watchdog monitor guarding a safety monitor actions",
+ .start = start_safe_wtd_monitor,
+ .stop = stop_safe_wtd_monitor,
+ .reset = da_monitor_reset_all_safe_wtd,
+ .enabled = 0,
+};
+
+int register_safe_wtd(void)
+{
+ rv_register_monitor(&rv_safe_wtd);
+ return 0;
+}
+
+void unregister_safe_wtd(void)
+{
+ if (rv_safe_wtd.enabled)
+ stop_safe_wtd_monitor();
+
+ rv_unregister_monitor(&rv_safe_wtd);
+}
+
+module_init(register_safe_wtd);
+module_exit(unregister_safe_wtd);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Daniel Bristot de Oliveira <bristot@kernel.org>");
+MODULE_DESCRIPTION("Safe watchdog RV monitor");
diff --git a/kernel/trace/rv/monitors/safe_wtd/safe_wtd.h b/kernel/trace/rv/monitors/safe_wtd/safe_wtd.h
new file mode 100644
index 000000000000..835c9d0979f6
--- /dev/null
+++ b/kernel/trace/rv/monitors/safe_wtd/safe_wtd.h
@@ -0,0 +1,84 @@
+enum states_safe_wtd {
+ init_safe_wtd = 0,
+ closed_running_safe_wtd,
+ closed_running_nwo_safe_wtd,
+ nwo_safe_wtd,
+ opened_safe_wtd,
+ opened_nwo_safe_wtd,
+ reopened_safe_wtd,
+ safe_safe_wtd,
+ safe_nwo_safe_wtd,
+ set_safe_wtd,
+ set_nwo_safe_wtd,
+ started_safe_wtd,
+ started_nwo_safe_wtd,
+ stoped_safe_wtd,
+ state_max_safe_wtd
+};
+
+enum events_safe_wtd {
+ close_safe_wtd = 0,
+ nowayout_safe_wtd,
+ open_safe_wtd,
+ other_threads_safe_wtd,
+ ping_safe_wtd,
+ set_safe_timeout_safe_wtd,
+ start_safe_wtd,
+ stop_safe_wtd,
+ event_max_safe_wtd
+};
+
+struct automaton_safe_wtd {
+ char *state_names[state_max_safe_wtd];
+ char *event_names[event_max_safe_wtd];
+ char function[state_max_safe_wtd][event_max_safe_wtd];
+ char initial_state;
+ char final_states[state_max_safe_wtd];
+};
+
+struct automaton_safe_wtd automaton_safe_wtd = {
+ .state_names = {
+ "init",
+ "closed_running",
+ "closed_running_nwo",
+ "nwo",
+ "opened",
+ "opened_nwo",
+ "reopened",
+ "safe",
+ "safe_nwo",
+ "set",
+ "set_nwo",
+ "started",
+ "started_nwo",
+ "stoped"
+ },
+ .event_names = {
+ "close",
+ "nowayout",
+ "open",
+ "other_threads",
+ "ping",
+ "set_safe_timeout",
+ "start",
+ "stop"
+ },
+ .function = {
+ { -1, nwo_safe_wtd, opened_safe_wtd, init_safe_wtd, -1, -1, -1, -1 },
+ { -1, closed_running_nwo_safe_wtd, reopened_safe_wtd, closed_running_safe_wtd, -1, -1, -1, -1 },
+ { -1, closed_running_nwo_safe_wtd, started_nwo_safe_wtd, closed_running_nwo_safe_wtd, -1, -1, -1, -1 },
+ { -1, nwo_safe_wtd, opened_nwo_safe_wtd, nwo_safe_wtd, -1, -1, -1, -1 },
+ { init_safe_wtd, -1, -1, -1, -1, -1, started_safe_wtd, -1 },
+ { nwo_safe_wtd, -1, -1, -1, -1, -1, started_nwo_safe_wtd, -1 },
+ { closed_running_safe_wtd, -1, -1, -1, -1, set_safe_wtd, -1, opened_safe_wtd },
+ { closed_running_safe_wtd, -1, -1, -1, safe_safe_wtd, -1, -1, stoped_safe_wtd },
+ { closed_running_nwo_safe_wtd, -1, -1, -1, safe_nwo_safe_wtd, -1, -1, -1 },
+ { -1, -1, -1, -1, safe_safe_wtd, -1, -1, -1 },
+ { -1, -1, -1, -1, safe_nwo_safe_wtd, -1, -1, -1 },
+ { closed_running_safe_wtd, -1, -1, -1, -1, set_safe_wtd, -1, stoped_safe_wtd },
+ { closed_running_nwo_safe_wtd, -1, -1, -1, -1, set_nwo_safe_wtd, -1, -1 },
+ { init_safe_wtd, -1, -1, -1, -1, -1, -1, -1 },
+ },
+ .initial_state = init_safe_wtd,
+ .final_states = { 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
+};
--
2.35.1
^ permalink raw reply related [flat|nested] 82+ messages in thread
* [PATCH V4 19/20] rv/safety_app: Add a safety_app sample
2022-06-16 8:44 [PATCH V4 00/20] The Runtime Verification (RV) interface Daniel Bristot de Oliveira
` (17 preceding siblings ...)
2022-06-16 8:45 ` [PATCH V4 18/20] rv/monitor: Add safe watchdog monitor Daniel Bristot de Oliveira
@ 2022-06-16 8:45 ` Daniel Bristot de Oliveira
2022-06-16 8:45 ` [PATCH V4 20/20] Documentation/rv: Add watchdog-monitor documentation Daniel Bristot de Oliveira
` (2 subsequent siblings)
21 siblings, 0 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-16 8:45 UTC (permalink / raw)
To: Steven Rostedt
Cc: Daniel Bristot de Oliveira, Wim Van Sebroeck, Guenter Roeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel
This is the sample code of a safety application that uses the
watchdog as a safety monitor and the RV monitors to monitor
this interaction/get feedback from kernel about the watchdog states.
This tool first creates a trace instance to follow the RV events
and then enables RV monitor. After that, the tool configures
the watchdog and starts running the main loop.
The main loop runs a use-case-specific function, like checking
the system. If the system is running as expected, it pings the
watchdog. After pinging the watchdog, the tool then collects
trace information to see if the RV monitor received the expected
events and is in a safe/safe_nwo state.
For further information, run safety_app --help
The safety-app specification was developed together with Gabriele Paoloni,
in the context of the Linux Foundation Elisa Project.
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Gabriele Paoloni <gpaoloni@redhat.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Clark Williams <williams@redhat.com>
Cc: linux-doc@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-trace-devel@vger.kernel.org
Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
---
tools/verification/safety_app/Makefile | 51 ++
tools/verification/safety_app/safety_app.c | 614 +++++++++++++++++++++
2 files changed, 665 insertions(+)
create mode 100644 tools/verification/safety_app/Makefile
create mode 100644 tools/verification/safety_app/safety_app.c
diff --git a/tools/verification/safety_app/Makefile b/tools/verification/safety_app/Makefile
new file mode 100644
index 000000000000..002531022e45
--- /dev/null
+++ b/tools/verification/safety_app/Makefile
@@ -0,0 +1,51 @@
+NAME := safety_app
+VERSION := 0.1
+
+# From libtracefs:
+# Makefiles suck: This macro sets a default value of $(2) for the
+# variable named by $(1), unless the variable has been set by
+# environment or command line. This is necessary for CC and AR
+# because make sets default values, so the simpler ?= approach
+# won't work as expected.
+define allow-override
+ $(if $(or $(findstring environment,$(origin $(1))),\
+ $(findstring command line,$(origin $(1)))),,\
+ $(eval $(1) = $(2)))
+endef
+
+# Allow setting CC and AR, or setting CROSS_COMPILE as a prefix.
+$(call allow-override,CC,$(CROSS_COMPILE)gcc)
+$(call allow-override,AR,$(CROSS_COMPILE)ar)
+$(call allow-override,STRIP,$(CROSS_COMPILE)strip)
+$(call allow-override,PKG_CONFIG,pkg-config)
+$(call allow-override,LD_SO_CONF_PATH,/etc/ld.so.conf.d/)
+$(call allow-override,LDCONFIG,ldconfig)
+
+INSTALL = install
+FOPTS := -flto=auto -ffat-lto-objects -fexceptions -fstack-protector-strong \
+ -fasynchronous-unwind-tables -fstack-clash-protection
+WOPTS := -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -Wno-maybe-uninitialized
+
+TRACEFS_HEADERS := $$($(PKG_CONFIG) --cflags libtracefs)
+
+CFLAGS := -O -g -DVERSION=\"$(VERSION)\" $(FOPTS) $(WOPTS) $(TRACEFS_HEADERS)
+LDFLAGS := -ggdb
+LIBS := $$($(PKG_CONFIG) --libs libtracefs)
+FILES := Makefile
+BINDIR := /usr/bin
+
+OBJ := $(NAME).o
+
+.PHONY: all
+all: $(OBJ)
+ $(CC) -o $(NAME) $(LDFLAGS) $(OBJ) $(LIBS)
+
+.PHONY: install
+install:
+ $(INSTALL) -d -m 755 $(DESTDIR)$(BINDIR)
+ $(INSTALL) $(NAME) -m 755 $(DESTDIR)$(BINDIR)
+ $(STRIP) $(DESTDIR)$(BINDIR)/$(NAME)
+
+.PHONY: clean
+clean:
+ @rm -rf *~ $(OBJ) $(NAME)
diff --git a/tools/verification/safety_app/safety_app.c b/tools/verification/safety_app/safety_app.c
new file mode 100644
index 000000000000..143ebe17dfc9
--- /dev/null
+++ b/tools/verification/safety_app/safety_app.c
@@ -0,0 +1,614 @@
+// SPDX-License-Identifier: LGPL-2.1
+/*
+ * This is the starting point for a safety monitor.
+ *
+ * The safety_check() function is where you need to add your own code.
+ *
+ * Copyright: Red Hat, Inc. Daniel Bristot de Oliveira <bristot@kernel.org>
+ */
+#define _GNU_SOURCE
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <getopt.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/ioctl.h>
+#include <linux/watchdog.h>
+#include <tracefs/tracefs.h>
+
+#define MAX_PATH 1024
+
+static int config_watchdog_id;
+static char config_watchdog_path[MAX_PATH];
+static int config_nowayout;
+static char config_nowayout_path[MAX_PATH];
+static long long config_timeout = 10;
+static long config_cycles;
+static long config_monitor_period = 1;
+static char *config_rv_monitor = "safe_wtd";
+static char *config_rv_reactor = "panic";
+static int config_stop_monitor = 0;
+static int config_restart_monitor = 0;
+
+/*
+ * print_msg - print a message to stdout
+ */
+void print_msg(const char *fmt, ...)
+{
+ char message[1024];
+ va_list ap;
+
+ va_start(ap, fmt);
+ vsnprintf(message, sizeof(message), fmt, ap);
+ va_end(ap);
+
+ fprintf(stdout, "%s", message);
+ fflush(NULL);
+}
+
+/*
+ * ==================================================================
+ * The code section bellow is responsible for enabling the RV monitor.
+ * ==================================================================
+ */
+
+/*
+ * __disable_rv_monitor - disables the RV monitor
+ *
+ * Unconditionally disables the RV monitor and set the reactor to nop.
+ */
+static void __disable_rv_monitor(char *monitor)
+{
+ char path[MAX_PATH];
+ int retval;
+
+ snprintf(path, MAX_PATH, "rv/monitors/%s/enable", monitor);
+ retval = tracefs_instance_file_write(NULL, path, "0\n");
+ if (retval < 0) {
+ perror("Error disabling the RV monitor");
+ return;
+ }
+
+ snprintf(path, MAX_PATH, "rv/monitors/%s/reactors", monitor);
+ retval = tracefs_instance_file_write(NULL, path, "nop\n");
+ if (retval < 0) {
+ perror("Error disabling the RV reactor");
+ return;
+ }
+}
+
+/*
+ * disable_rv_monitor - conditionally disables the RV monitor
+ */
+static void disable_rv_monitor(char *monitor)
+{
+ if (!config_stop_monitor)
+ return;
+
+ __disable_rv_monitor(monitor);
+}
+
+/*
+ * enable_rv_monitor - sets the 'reactor' and enable RV 'monitor'
+ */
+static int enable_rv_monitor(char *monitor, char *reactor)
+{
+ char buffer[MAX_PATH];
+ char path[MAX_PATH];
+ int size = 2;
+ int retval;
+ char *on;
+
+ snprintf(path, MAX_PATH, "rv/monitors/%s/enable", monitor);
+ on = tracefs_instance_file_read(NULL, path, &size);
+ if (on && on[0] == '1') {
+ if (!config_restart_monitor)
+ return 0;
+ __disable_rv_monitor(monitor);
+ }
+
+ snprintf(path, MAX_PATH, "rv/monitors/%s/reactors", monitor);
+ snprintf(buffer, MAX_PATH, "%s\n", reactor);
+ retval = tracefs_instance_file_write(NULL, path, buffer);
+ if (retval < 0) {
+ perror("Error enabling the RV reactor");
+ return -1;
+ }
+
+ snprintf(path, MAX_PATH, "rv/monitors/%s/enable", monitor);
+ retval = tracefs_instance_file_write(NULL, path, "1\n");
+ if (retval < 0) {
+ perror("Error enabling the RV monitor");
+ return -1;
+ }
+
+ return 0;
+}
+
+/*
+ * ==================================================================
+ * The code section bellow is responsible for parsing the RV monitor output.
+ * ==================================================================
+ */
+struct trace_instance {
+ struct tracefs_instance *inst;
+ struct tep_handle *tep;
+ struct trace_seq *seq;
+};
+
+int ping_counter = 0;
+int last_state_running = 0;
+
+/*
+ * handle_safe_wtd_rv_event - parse events from the safe_wtd RV monitor
+ */
+static int
+handle_safe_wtd_rv_event(struct trace_seq *s, struct tep_record *record,
+ struct tep_event *event, void *context)
+{
+ char *event_name;
+ char *state;
+ int len;
+
+ event_name = tep_get_field_raw(s, event, "event", record, &len, 1);
+ if (event_name && !strcmp(event_name, "ping"))
+ ping_counter++;
+
+ state = tep_get_field_raw(s, event, "next_state", record, &len, 0);
+ if (state && !strncmp(state, "safe", 4))
+ last_state_running = 1;
+ else
+ last_state_running = 0;
+
+ return 0;
+}
+
+/*
+ * collect_registered_events - call the existing callback function for the event
+ *
+ * If an event has a registered callback function, call it.
+ * Otherwise, ignore the event.
+ */
+static int
+collect_registered_events(struct tep_event *event, struct tep_record *record,
+ int cpu, void *context)
+{
+ struct trace_instance *trace = context;
+ struct trace_seq *s = trace->seq;
+
+ if (!event->handler)
+ return 0;
+
+ event->handler(s, record, event, context);
+
+ return 0;
+}
+
+/*
+ * check_rv_events - parse trace events and check for the desired states
+ *
+ * Return 0 if success, 1 otherwise.
+ */
+static int check_rv_events(struct trace_instance *trace)
+{
+ int prev_ping_counter = ping_counter;
+ int retval;
+ int pings;
+
+ retval = tracefs_iterate_raw_events(trace->tep, trace->inst, NULL, 0,
+ collect_registered_events, trace);
+ if (retval < 0) {
+ print_msg("Error iterating on events\n");
+ return 1;
+ }
+
+ pings = ping_counter - prev_ping_counter;
+ print_msg("RV read %d ping(s) and is %s the watchdog\n", pings,
+ last_state_running ? "running" : "not running");
+
+ /*
+ * If there is exactly one ping and the last state is running,
+ * it is safe.
+ */
+ if (pings == 1 && last_state_running) {
+ /* reset the variable */
+ last_state_running = 0;
+ return 0;
+ } else {
+ return 1;
+ }
+}
+
+/*
+ * trace_instance_destroy - destroy and free a trace instance
+ */
+static void trace_instance_destroy(struct trace_instance *trace)
+{
+ if (!trace)
+ return;
+
+ if (trace->inst) {
+ tracefs_instance_destroy(trace->inst);
+ tracefs_instance_free(trace->inst);
+ }
+
+ if (trace->seq)
+ free(trace->seq);
+
+ if (trace->tep)
+ tep_free(trace->tep);
+
+ free(trace);
+}
+
+/*
+ * trace_instance_init - create a trace instance to read monitor's event
+ *
+ * It is more than the tracefs instance, as it contains other
+ * things required for the tracing, such as the local events and
+ * a seq file.
+ */
+static struct trace_instance *trace_instance_init(void)
+{
+ struct trace_instance *trace;
+
+ trace = calloc(1, sizeof(*trace));
+ if (!trace)
+ return NULL;
+
+ trace->seq = calloc(1, sizeof(*trace->seq));
+ if (!trace->seq)
+ goto destroy_instance;
+
+ trace_seq_init(trace->seq);
+
+ trace->inst = tracefs_instance_create("safety_app");
+ if (!trace->inst)
+ goto destroy_instance;
+
+ trace->tep = tracefs_local_events(NULL);
+ if (!trace->tep)
+ goto destroy_instance;
+
+ /*
+ * register for both monitors, it is free.
+ */
+ tep_register_event_handler(trace->tep, -1, "rv", "event_safe_wtd",
+ handle_safe_wtd_rv_event, trace);
+ tracefs_event_enable(trace->inst, "rv", "event_safe_wtd");
+
+ return trace;
+
+destroy_instance:
+ trace_instance_destroy(trace);
+ return NULL;
+}
+
+/*
+ * ==================================================================
+ * The code section bellow are helper functions to use a watchdog device.
+ * ==================================================================
+ */
+
+/*
+ * set_nowayout - set the watchdog's nowayout option
+ */
+static int set_nowayout(char *nowayout_path)
+{
+ int nowayout_fd;
+ int retval;
+
+ print_msg("nowayout\n");
+
+ nowayout_fd = open(nowayout_path, O_WRONLY);
+ if (nowayout_path < 0) {
+ perror("Error opening nowayout fd");
+ return -1;
+ }
+
+ retval = write(nowayout_fd, "1", 1);
+ if (retval != 1) {
+ perror("Error setting nowayout");
+ close(nowayout_fd);
+ return -1;
+ }
+
+ close(nowayout_fd);
+ return 0;
+}
+
+/*
+ * open_watchdog - open watchdog at the watchdog_path
+ */
+static int open_watchdog(char *watchdog_path)
+{
+ int watchdog_fd;
+
+ print_msg("open %s\n", watchdog_path);
+
+ watchdog_fd = open(watchdog_path, O_WRONLY);
+ if (watchdog_fd < 0) {
+ perror("Error opening watchdog");
+ return -1;
+ }
+
+ return watchdog_fd;
+}
+
+/*
+ * set_timeout - set the timeout in seconds for the previously opened watchdog_fd
+ */
+static int set_timeout(int watchdog_fd, int timeout)
+{
+ int retval;
+
+ print_msg("set_timeout %d\n", timeout);
+
+ retval = ioctl(watchdog_fd, WDIOC_SETTIMEOUT, &timeout);
+ if (retval) {
+ perror("Error set_timeout");
+ return -1;
+ }
+
+ return 0;
+}
+
+/*
+ * ping - ping (or pet) the watchdog
+ */
+static int ping(int watchdog_fd)
+{
+ int retval;
+
+ print_msg("ping\n");
+
+ retval = write(watchdog_fd, "1", 1);
+ if (retval != 1) {
+ perror("Error resseting watchdog");
+ return -1;
+ }
+
+ return 0;
+}
+
+/*
+ * stop - try to the watchdog
+ *
+ * Writing "V" to the watchdog is a special case. Unless nowayout is set,
+ * it will stop the watchdog device.
+ */
+static void stop(int watchdog_fd)
+{
+ int retval;
+
+ print_msg("stop\n");
+
+ retval = write(watchdog_fd, "V", 1);
+ if (retval != 1)
+ perror("Error disabling the watchdog");
+}
+
+/*
+ * usage - print usage message
+ */
+static void usage(char *usage, int exitval)
+{
+ int i;
+
+ static const char * const msg[] = {
+ " usage: safety_app [-i id] [-t timeout in seconds ] [-n nowayout_path] \\",
+ " [-c cycles] [-p period] [-N] \\",
+ " [-N] [-r reactor] [-s] [-R] \\",
+ " [-h] \\",
+ "",
+ "Watchdog options",
+ " -i/--id: watchdog id",
+ " -t/--timeout: watchdog timeout",
+ " -n/--nowayout: set nowayout",
+ "",
+ "Safety monitor options",
+ " -c/--cycles: run cycle nr ping, 0 means forever (default)",
+ " -p/--period: monitor loop period",
+ "",
+ "RV monitor options",
+ " -r/--reactor set the reactor (panic is automatically set if no other reactor is passed)",
+ " -s/--stop-mon stop the rv monitor at the end of the execution",
+ " -R/--restart-mon restart the monitor if already started",
+ "",
+ "Generic options",
+ " -h/--help: print help message",
+ NULL,
+ };
+
+ if (usage)
+ fprintf(stderr, "%s\n", usage);
+
+ fprintf(stderr, "sample safety monitor (version %s)\n", VERSION);
+
+ for (i = 0; msg[i]; i++)
+ fprintf(stderr, "%s\n", msg[i]);
+ exit(exitval);
+}
+
+static long long get_long_from_str(char *start)
+{
+ long value;
+ char *end;
+
+ errno = 0;
+ value = strtoll(start, &end, 10);
+ if (errno || start == end) {
+ fprintf(stderr, "Invalid value '%s'", start);
+ return -1;
+ }
+
+ return value;
+}
+
+static int parse_args(int argc, char **argv)
+{
+ int c;
+
+ while (1) {
+ static struct option long_options[] = {
+ {"help", no_argument, 0, 'h'},
+ {"id", required_argument, 0, 'i'},
+ {"timeout", required_argument, 0, 't'},
+ {"nowayout", optional_argument, 0, 'n'},
+ {"cycles", required_argument, 0, 'c'},
+ {"period", required_argument, 0, 'p'},
+ {"reactor", required_argument, 0, 'r'},
+ {"stop-mon", no_argument, 0, 's'},
+ {"restart-mon", no_argument, 0, 'R'},
+ {0, 0, 0, 0}
+ };
+
+ /* getopt_long stores the option index here. */
+ int option_index = 0;
+
+ c = getopt_long(argc, argv, "hi:t:n::c:p:r:sR",
+ long_options, &option_index);
+
+ /* Detect the end of the options. */
+ if (c == -1)
+ break;
+
+ switch (c) {
+ case 'i':
+ config_watchdog_id = get_long_from_str(optarg);
+ break;
+ case 't':
+ config_timeout = get_long_from_str(optarg);
+ break;
+ case 'n':
+ config_nowayout = 1;
+ if (optarg)
+ strncpy(config_nowayout_path, optarg, MAX_PATH);
+ break;
+ case 'c':
+ config_cycles = get_long_from_str(optarg);
+ break;
+ case 'p':
+ config_monitor_period = get_long_from_str(optarg);
+ break;
+ case 'r':
+ config_rv_reactor = optarg;
+ break;
+ case 's':
+ config_stop_monitor = 1;
+ break;
+ case 'R':
+ config_restart_monitor = 1;
+ break;
+ case 'h':
+ usage("Help message", 0);
+ break;
+ default:
+ usage("Invalid option", 1);
+ }
+ }
+
+ if (!strlen(config_nowayout_path)) {
+ snprintf(config_nowayout_path, MAX_PATH,
+ "/sys/devices/virtual/watchdog/watchdog%i/nowayout",
+ config_watchdog_id);
+ }
+
+ if (config_monitor_period > config_timeout)
+ usage("Monitor period higher than the watchdog timeout.\n", 1);
+
+ snprintf(config_watchdog_path, MAX_PATH, "/dev/watchdog%d", config_watchdog_id);
+
+ return 0;
+}
+
+/*
+ * safety_check - check if the system is working properly
+ *
+ * This is the function where the system check will be actually done.
+ * It will be periodically called by the safety_app. If it returns
+ * true, the watchdog will be pinged and the system will continue running.
+ * If this function returns false, the safety_app will not ping the
+ * watchdog and will exit with an error.
+ */
+static int safety_check(void)
+{
+ /*
+ * Add your code here.
+ *
+ * Return 0 to make the safety monitor to skip the watchdog ping and
+ * exit with error, or just kill the system yourself.
+ */
+ return 1;
+}
+
+int main(int argc, char *argv[])
+{
+ struct trace_instance *trace;
+ int exit_val = 1;
+ int watchdog_fd;
+ long cycles = 0;
+ int retval;
+
+ parse_args(argc, argv);
+
+ trace = trace_instance_init();
+
+ retval = enable_rv_monitor(config_rv_monitor, config_rv_reactor);
+ if (retval) {
+ perror("Cannot proceed without the RV monitor");
+ goto out_destroy_trace;
+ }
+
+ if (config_nowayout)
+ set_nowayout(config_nowayout_path);
+
+ watchdog_fd = open_watchdog(config_watchdog_path);
+ if (watchdog_fd < 0) {
+ perror("Error opening watchdog");
+ exit(1);
+ }
+
+ if (config_timeout) {
+ retval = set_timeout(watchdog_fd, config_timeout);
+ if (retval)
+ goto out_close_watchdog;
+ }
+
+ retval = check_rv_events(trace);
+ if (retval) {
+ print_msg("RV monitor returned a failure, it is not safe to continue\n");
+ goto out_close_watchdog;
+ }
+
+ do {
+ retval = safety_check();
+ if (!retval)
+ goto out_close_watchdog;
+
+ retval = ping(watchdog_fd);
+ if (retval)
+ goto out_close_watchdog;
+
+ retval = check_rv_events(trace);
+ if (retval) {
+ print_msg("RV monitor returned a failure, it is not safe to continue\n");
+ goto out_close_watchdog;
+ }
+
+ sleep(config_monitor_period);
+ } while (!config_cycles || ++cycles < config_cycles);
+
+ stop(watchdog_fd);
+
+ exit_val = 0;
+
+out_close_watchdog:
+ close(watchdog_fd);
+ disable_rv_monitor(config_rv_monitor);
+out_destroy_trace:
+ trace_instance_destroy(trace);
+ return exit_val;
+}
--
2.35.1
^ permalink raw reply related [flat|nested] 82+ messages in thread
* [PATCH V4 20/20] Documentation/rv: Add watchdog-monitor documentation
2022-06-16 8:44 [PATCH V4 00/20] The Runtime Verification (RV) interface Daniel Bristot de Oliveira
` (18 preceding siblings ...)
2022-06-16 8:45 ` [PATCH V4 19/20] rv/safety_app: Add a safety_app sample Daniel Bristot de Oliveira
@ 2022-06-16 8:45 ` Daniel Bristot de Oliveira
2022-07-07 12:41 ` Tao Zhou
2022-06-22 7:24 ` [PATCH V4 00/20] The Runtime Verification (RV) interface Song Liu
2022-07-06 16:18 ` Tao Zhou
21 siblings, 1 reply; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-16 8:45 UTC (permalink / raw)
To: Steven Rostedt
Cc: Daniel Bristot de Oliveira, Wim Van Sebroeck, Guenter Roeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel
Adds documentation about the safe_wtd and safe_wtd_nwo RV monitors,
and their usage via a safety application.
Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Marco Elver <elver@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Cc: Gabriele Paoloni <gpaoloni@redhat.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Clark Williams <williams@redhat.com>
Cc: linux-doc@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-trace-devel@vger.kernel.org
Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
---
Documentation/trace/rv/watchdog-monitor.rst | 250 ++++++++++++++++++++
1 file changed, 250 insertions(+)
create mode 100644 Documentation/trace/rv/watchdog-monitor.rst
diff --git a/Documentation/trace/rv/watchdog-monitor.rst b/Documentation/trace/rv/watchdog-monitor.rst
new file mode 100644
index 000000000000..2b142fb31572
--- /dev/null
+++ b/Documentation/trace/rv/watchdog-monitor.rst
@@ -0,0 +1,250 @@
+Watchdog monitor
+----------------
+
+The watchdog is an essential building block for the usage of Linux in
+safety-critical systems because it allows the system to be monitored from
+an external element - the watchdog hardware, acting as a safety-monitor.
+
+A user-space application controls the watchdog device via the watchdog
+interface. This application, hereafter safety_app, enables the watchdog
+and periodically pets the watchdog upon correct completion of the safety
+related processing.
+
+If the safety_app, for any reason, stops pinging the watchdog,
+the watchdog hardware can set the system in a fail-safe state. For
+example, shutting the system down.
+
+Given the importance of the safety_app / watchdog hardware couple,
+the interaction between these software pieces also needs some
+sort of monitoring. In other words, "who monitors the monitor?"
+
+The safe watchdog (safe_wtd) RV monitor monitors the interaction between
+the safety_app and the watchdog device, enforcing the correct sequence of
+events that leads the system to a safe state.
+
+Furthermore, the safety_app can monitor the RV monitor by collecting the
+events generated by the RV monitor itself via tracing interface. In this way,
+closing the monitoring loop with the safety_app.
+
+A diagram of the components and their interactions is::
+
+ user-space:
+ +--------------------------------+
+ | safety_app |-----------+
+ +--------------------------------+ |
+ | ^ |
+ | Configure | Enable and |
+ | | check data |
+ ===================+====================+=============== |
+ kernel-space: | | |
+ v v |
+ +----------+ instr. +-------------+ |
+ | watchdog | ----------->| RV Monitor |----+ |
+ | device | +-------------+ | |
+ +----------+ | |
+ | | |
+ | | |
+ ================+====================================== | |
+ hardware: | | |
+ v | +-> Bring the system
+ +--------------------+ +----> to a safe state,
+ | watchdog hardware |---------------------------> e.g., halt.
+ +--------------------+
+
+Sample safety_app
+-----------------
+
+The user-space safety_app sample code in ``tools/verification/safety_app/``
+serves to illustrate the usage of the RV monitors for this use-case, as
+well as the starting point to the development of a user-specific safety_app.
+
+Watchdog events
+---------------
+
+The RV monitor observes the watchdog by using instrumentation to
+process the events generated by the interaction between the
+safety_app and the watchdog device layer in kernel.
+
+The monitored events are:
+
+ - watchdog:watchdog_open: open the watchdog device;
+ - watchdog:watchdog_close: close the watchdog device;
+ - watchdog:watchdog_start: start the watchdog;
+ - watchdog:watchdog_stop: stop the watchdog;
+ - watchdog:watchdog_set_timeout: set the watchdog timeout;
+ - watchdog:watchdog_ping: reprogram the watchdog with the previously set
+ timeout;
+ - watchdog:watchdog_nowayout: prevents the watchdog from stopping;
+ - watchdog:watchdog_set_keep_alive: set an intermediary ping to overcome
+ the limitation of a hardware watchdog maximum timeout being shorter than
+ the timeout set by the user-space tool;
+ - watchdog:watchdog_keep_alive: the execution of the function that runs the
+ intermediary keep alive ping;
+
+RV monitor events
+-----------------
+
+The RV monitor monitors the relevant events as an outside observer,
+interpreting all the components (the hardware; the watchdog device
+interface; and the safety monitor) as an integrated component.
+
+The events selected for the monitor are:
+
+ - other_threads: an event generated by any thread other than the
+ one that set nowayout or open the watchdog the last time.
+ - open: a thread opens the watchdog to manipulate it;
+ - close: a thread closes the watchdog;
+ - start: starts the watchdog countdown;
+ - stop: stops the watchdog;
+ - set_safe_timeout: configures the watchdog with a given timeout;
+ - ping: resets the watchdog countdown with the previously configured timeout;
+ - nowayout: prevents the watchdog to be stopped until the system's shutdown;
+ - sched_keep_alive: schedules a kernel worker to ping the watchdog if the
+ timeout is longer than the watchdog hardware can handle.
+ - keep_alive: executes the previously scheduled watchdog ping;
+
+Noting that the events that does not appear in the automata models are
+considered blocked events, and their execution will always cause the
+RV monitor to react to an unexpected event.
+
+RV monitor specification
+------------------------
+
+The monitor's goal is to assess a set of specifications that conducts the
+system to a safe state.
+
+These specifications are:
+
+ - 1: Once open, only one process manipulates the watchdog;
+ - 2: Following 1, the keep-alive mechanisms will not be used;
+ - 3: If required, nowayout will be set before opening the watchdog;
+ - 4: A safe timeout must be set;
+ - 5: At least one ping must be made before entering the safe/safe_nwo states
+ - 6: The RV monitor does not react if the watchdog is closed without stopping.
+ But the hardware watchdog is expected to react.
+
+Deterministic automata monitors
+-------------------------------
+
+Following the specifications, a deterministic automata monitor
+was developed. The monitor is modeled as Deterministic Automata model.
+
+The deterministic automata model for safe_wtd is::
+
+ #==================================# other_threads
+ H H ----------------+
+ -----------> H init H |
+ H H <---------------+
+ #==================================#
+ | | ^
+ | | | close
+ | | +----------------------------------------------------+
+ | | |
+ | | open |
+ | +------------------------------------------------------+ |
+ | | |
+ | nowayout | |
+ v | |
+ nowayout +-------------------+ | |
+ other_threads | | nowayout | |
+ +---------------- | nwo |<-------------------------------------+ | |
+ | | | | | |
+ +---------------> | | <+ | | |
+ +-------------------+ | | | |
+ | | | | |
+ | open | close | | |
+ v | | | |
+ +-------------------+ | | | |
+ | opened_nwo | -+ | | |
+ +-------------------+ | | |
+ | | | |
+ | start | | |
+ v | | |
+ +-------------------+ | | |
+ +---------------> | started_nwo | -+ | | |
+ | +-------------------+ | | | |
+ | | | | | |
+ | open | set_safe_timeout | | | |
+ | v | | | |
+ | +-------------------+ | | | |
+ | | set_nwo | | | | |
+ | +-------------------+ | | | |
+ | | | | | |
+ | +-------------+ | ping | | | |
+ | | | | | | | |
+ | | ping v v | | | |
+ | | +-------------------+ | | | |
+ | +-----------| safe_nwo | | | | |
+ | +-------------------+ | | | |
+ | | | | | |
+ | | close | close | | |
+ | v v | | |
+ | +----------------------------------+ nowayout | | |
+ | | | other_threads | | |
+ | | closed_running_nwo | ----------------+ | | |
+ | | | | | | |
+ +---------------- | | <---------------+ | | |
+ +----------------------------------+ | | |
+ | nowayout ^ | | |
+ +-----------------------------+ | | |
+ | | |
+ | | |
+ +-------------------+ +--------+ | | |
+ | | | |------+---+ |
+ | started | start | opened | | |
+ +---------------- | | <-------- | |>-----+-------+
+ | +-------------------+ +--------+ | ^
+ | | | |
+ | | set_safe_timeout +-------------+-------+
+ | v | |
+ | +-------------------+ | |
+ | | | | |
+ | | set | | |
+ +----------+---------------> | | | |
+ | | +-------------------+ | |
+ | | | | |
+ | | | ping | |
+ | | v | |
+ | | +-------------------+ ping | |
+ | | | | -------+ | |
+ | | +---- | safe | | | |
+ | | | | | <------+ | |
+ | | | +-------------------+ | |
+ | | | | | |
+ | | stop | | stop | |
+ | | | v | |
+ | | | +-------------------+ close | |
+ | +-----------+---> | stopped |-------------+ |
+ | | +-------------------+ |
+ | +---+ |
+ | | close |
+ | v |
+ | other_threads +----------------------------------------+ |
+ | +--------------> | | |
+ | | | closed_running | |
+ | +--------------- | |--------------+
+ | +----------------------------------------+
+ | | ^
+ | open | | close
+ | v |
+ | set_safe_timeout +-------------------+
+ +-------------------------> | reopened |
+ +-------------------+
+
+It is important to note that the events sched_keep_alive and keep_alive
+are not allowed in the monitor (they are said to be blocked events).
+The execution of any blocked events leads the RV monitor to react.
+
+Additional options
+------------------
+
+The RV monitor also has a set of options enabled via kernel command
+line/module options. They are:
+
+ - watchdog_id: the device id to monitor (default 0);
+ - dont_stop: once enabled, do not allow the RV monitor to be stopped (default off);
+ - safe_timeout: define a maximum safe value that a user-space application can
+ set as the watchdog timeout (default unlimited);
+ - check_timeout: After every ping, check if the time left in the watchdog is less
+ than or equal to the last timeout set for the watchdog. It only works for watchdog
+ devices that provide the get_timeleft() function (default off);
--
2.35.1
^ permalink raw reply related [flat|nested] 82+ messages in thread
* Re: [PATCH V4 09/20] rv/monitor: wip instrumentation and Makefile/Kconfig entries
2022-06-16 8:44 ` [PATCH V4 09/20] rv/monitor: wip instrumentation and Makefile/Kconfig entries Daniel Bristot de Oliveira
@ 2022-06-16 11:21 ` kernel test robot
2022-06-16 21:00 ` Randy Dunlap
1 sibling, 0 replies; 82+ messages in thread
From: kernel test robot @ 2022-06-16 11:21 UTC (permalink / raw)
To: Daniel Bristot de Oliveira, Steven Rostedt
Cc: kbuild-all, Daniel Bristot de Oliveira, Wim Van Sebroeck,
Guenter Roeck, Jonathan Corbet, Ingo Molnar, Thomas Gleixner,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel
Hi Daniel,
I love your patch! Perhaps something to improve:
[auto build test WARNING on rostedt-trace/for-next]
[also build test WARNING on tip/sched/core]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]
url: https://github.com/intel-lab-lkp/linux/commits/Daniel-Bristot-de-Oliveira/The-Runtime-Verification-RV-interface/20220616-164837
base: https://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace.git for-next
config: riscv-randconfig-r004-20220616 (https://download.01.org/0day-ci/archive/20220616/202206161937.RukeWKWk-lkp@intel.com/config)
compiler: riscv64-linux-gcc (GCC) 11.3.0
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/intel-lab-lkp/linux/commit/a76032130de277ff6f39fc08277a70823fd85bf3
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review Daniel-Bristot-de-Oliveira/The-Runtime-Verification-RV-interface/20220616-164837
git checkout a76032130de277ff6f39fc08277a70823fd85bf3
# save the config file
mkdir build_dir && cp config build_dir/.config
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.3.0 make.cross W=1 O=build_dir ARCH=riscv SHELL=/bin/bash kernel/trace/rv/
If you fix the issue, kindly add following tag where applicable
Reported-by: kernel test robot <lkp@intel.com>
All warnings (new ones prefixed by >>):
In file included from kernel/trace/rv/monitors/wip/wip.c:8:
kernel/trace/rv/monitors/wip/wip.c: In function 'start_wip':
include/rv/instrumentation.h:15:17: error: implicit declaration of function 'check_trace_callback_type_preempt_disable'; did you mean 'check_trace_callback_type_irq_disable'? [-Werror=implicit-function-declaration]
15 | check_trace_callback_type_##tp(rv_handler); \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
kernel/trace/rv/monitors/wip/wip.c:61:9: note: in expansion of macro 'rv_attach_trace_probe'
61 | rv_attach_trace_probe("wip", preempt_disable, handle_preempt_disable);
| ^~~~~~~~~~~~~~~~~~~~~
In file included from include/linux/printk.h:11,
from include/linux/kernel.h:29,
from include/linux/interrupt.h:6,
from include/linux/trace_recursion.h:5,
from include/linux/ftrace.h:10,
from kernel/trace/rv/monitors/wip/wip.c:2:
include/rv/instrumentation.h:16:27: error: implicit declaration of function 'register_trace_preempt_disable'; did you mean 'register_trace_prio_irq_disable'? [-Werror=implicit-function-declaration]
16 | WARN_ONCE(register_trace_##tp(rv_handler, NULL), \
| ^~~~~~~~~~~~~~~
include/linux/once_lite.h:15:41: note: in definition of macro 'DO_ONCE_LITE_IF'
15 | bool __ret_do_once = !!(condition); \
| ^~~~~~~~~
include/rv/instrumentation.h:16:17: note: in expansion of macro 'WARN_ONCE'
16 | WARN_ONCE(register_trace_##tp(rv_handler, NULL), \
| ^~~~~~~~~
kernel/trace/rv/monitors/wip/wip.c:61:9: note: in expansion of macro 'rv_attach_trace_probe'
61 | rv_attach_trace_probe("wip", preempt_disable, handle_preempt_disable);
| ^~~~~~~~~~~~~~~~~~~~~
In file included from kernel/trace/rv/monitors/wip/wip.c:8:
include/rv/instrumentation.h:15:17: error: implicit declaration of function 'check_trace_callback_type_preempt_enable'; did you mean 'check_trace_callback_type_irq_enable'? [-Werror=implicit-function-declaration]
15 | check_trace_callback_type_##tp(rv_handler); \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
kernel/trace/rv/monitors/wip/wip.c:62:9: note: in expansion of macro 'rv_attach_trace_probe'
62 | rv_attach_trace_probe("wip", preempt_enable, handle_preempt_enable);
| ^~~~~~~~~~~~~~~~~~~~~
In file included from include/linux/printk.h:11,
from include/linux/kernel.h:29,
from include/linux/interrupt.h:6,
from include/linux/trace_recursion.h:5,
from include/linux/ftrace.h:10,
from kernel/trace/rv/monitors/wip/wip.c:2:
include/rv/instrumentation.h:16:27: error: implicit declaration of function 'register_trace_preempt_enable'; did you mean 'register_trace_prio_irq_enable'? [-Werror=implicit-function-declaration]
16 | WARN_ONCE(register_trace_##tp(rv_handler, NULL), \
| ^~~~~~~~~~~~~~~
include/linux/once_lite.h:15:41: note: in definition of macro 'DO_ONCE_LITE_IF'
15 | bool __ret_do_once = !!(condition); \
| ^~~~~~~~~
include/rv/instrumentation.h:16:17: note: in expansion of macro 'WARN_ONCE'
16 | WARN_ONCE(register_trace_##tp(rv_handler, NULL), \
| ^~~~~~~~~
kernel/trace/rv/monitors/wip/wip.c:62:9: note: in expansion of macro 'rv_attach_trace_probe'
62 | rv_attach_trace_probe("wip", preempt_enable, handle_preempt_enable);
| ^~~~~~~~~~~~~~~~~~~~~
In file included from kernel/trace/rv/monitors/wip/wip.c:8:
kernel/trace/rv/monitors/wip/wip.c: In function 'stop_wip':
include/rv/instrumentation.h:22:17: error: implicit declaration of function 'unregister_trace_preempt_disable'; did you mean 'unregister_trace_irq_disable'? [-Werror=implicit-function-declaration]
22 | unregister_trace_##tp(rv_handler, NULL); \
| ^~~~~~~~~~~~~~~~~
kernel/trace/rv/monitors/wip/wip.c:72:9: note: in expansion of macro 'rv_detach_trace_probe'
72 | rv_detach_trace_probe("wip", preempt_disable, handle_preempt_disable);
| ^~~~~~~~~~~~~~~~~~~~~
include/rv/instrumentation.h:22:17: error: implicit declaration of function 'unregister_trace_preempt_enable'; did you mean 'unregister_trace_irq_enable'? [-Werror=implicit-function-declaration]
22 | unregister_trace_##tp(rv_handler, NULL); \
| ^~~~~~~~~~~~~~~~~
kernel/trace/rv/monitors/wip/wip.c:73:9: note: in expansion of macro 'rv_detach_trace_probe'
73 | rv_detach_trace_probe("wip", preempt_enable, handle_preempt_enable);
| ^~~~~~~~~~~~~~~~~~~~~
kernel/trace/rv/monitors/wip/wip.c: At top level:
>> kernel/trace/rv/monitors/wip/wip.c:91:5: warning: no previous prototype for 'register_wip' [-Wmissing-prototypes]
91 | int register_wip(void)
| ^~~~~~~~~~~~
>> kernel/trace/rv/monitors/wip/wip.c:97:6: warning: no previous prototype for 'unregister_wip' [-Wmissing-prototypes]
97 | void unregister_wip(void)
| ^~~~~~~~~~~~~~
cc1: some warnings being treated as errors
vim +/register_wip +91 kernel/trace/rv/monitors/wip/wip.c
15679ffb99664f Daniel Bristot de Oliveira 2022-06-16 90
15679ffb99664f Daniel Bristot de Oliveira 2022-06-16 @91 int register_wip(void)
15679ffb99664f Daniel Bristot de Oliveira 2022-06-16 92 {
15679ffb99664f Daniel Bristot de Oliveira 2022-06-16 93 rv_register_monitor(&rv_wip);
15679ffb99664f Daniel Bristot de Oliveira 2022-06-16 94 return 0;
15679ffb99664f Daniel Bristot de Oliveira 2022-06-16 95 }
15679ffb99664f Daniel Bristot de Oliveira 2022-06-16 96
15679ffb99664f Daniel Bristot de Oliveira 2022-06-16 @97 void unregister_wip(void)
15679ffb99664f Daniel Bristot de Oliveira 2022-06-16 98 {
15679ffb99664f Daniel Bristot de Oliveira 2022-06-16 99 if (rv_wip.enabled)
15679ffb99664f Daniel Bristot de Oliveira 2022-06-16 100 stop_wip();
15679ffb99664f Daniel Bristot de Oliveira 2022-06-16 101
15679ffb99664f Daniel Bristot de Oliveira 2022-06-16 102 rv_unregister_monitor(&rv_wip);
15679ffb99664f Daniel Bristot de Oliveira 2022-06-16 103 }
15679ffb99664f Daniel Bristot de Oliveira 2022-06-16 104
--
0-DAY CI Kernel Test Service
https://01.org/lkp
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 18/20] rv/monitor: Add safe watchdog monitor
2022-06-16 8:45 ` [PATCH V4 18/20] rv/monitor: Add safe watchdog monitor Daniel Bristot de Oliveira
@ 2022-06-16 13:36 ` Guenter Roeck
2022-06-16 15:29 ` Daniel Bristot de Oliveira
2022-06-16 20:57 ` Randy Dunlap
2022-07-13 19:13 ` Daniel Bristot de Oliveira
2 siblings, 1 reply; 82+ messages in thread
From: Guenter Roeck @ 2022-06-16 13:36 UTC (permalink / raw)
To: Daniel Bristot de Oliveira, Steven Rostedt
Cc: Wim Van Sebroeck, Jonathan Corbet, Ingo Molnar, Thomas Gleixner,
Peter Zijlstra, Will Deacon, Catalin Marinas, Marco Elver,
Dmitry Vyukov, Paul E. McKenney, Shuah Khan, Gabriele Paoloni,
Juri Lelli, Clark Williams, linux-doc, linux-kernel,
linux-trace-devel
On 6/16/22 01:45, Daniel Bristot de Oliveira wrote:
> The watchdog is an essential building block for the usage of Linux in
> safety-critical systems because it allows the system to be monitored from
> an external element - the watchdog hardware, acting as a safety-monitor.
>
> A user-space application controls the watchdog device via the watchdog
> interface. This application, hereafter safety_app, enables the watchdog
> and periodically pets the watchdog upon correct completion of the safety
> related processing.
>
> If the safety_app, for any reason, stops pinging the watchdog,
> the watchdog hardware can set the system in a fail-safe state. For
> example, shutting the system down.
>
> Given the importance of the safety_app / watchdog hardware couple,
> the interaction between these software pieces also needs some
> sort of monitoring. In other words, "who monitors the monitor?"
>
> The safe watchdog (safe_wtd) RV monitor monitors the interaction between
> the safety_app and the watchdog device, enforcing the correct sequence of
> events that leads the system to a safe state.
>
> Furthermore, the safety_app can monitor the RV monitor by collecting the
> events generated by the RV monitor itself via tracing interface. In this way,
> closing the monitoring loop with the safety_app.
>
> To reach a safe state, the safe_wtd RV monitor requires the
> safety_app to:
>
> - Open the watchdog device
> - Start the watchdog
> - Set a timeout
> - ping at least once
>
> The RV monitor also avoids some undesired actions. For example, to have
> other threads to touch the watchdog.
>
> The monitor also has a set of options, enabled via kernel command
> line/module options. They are:
>
> - watchdog_id: the device id to monitor (default 0).
> - dont_stop: once enabled, do not allow the RV monitor to be stopped
> (default off);
> - safe_timeout: define a maximum safe value that an user-space
> application can set as the watchdog timeout
> (default unlimited).
> - check_timeout: After every ping, check if the time left in the
> watchdog is less than or equal to the last timeout set
> for the watchdog. It only works for watchdog devices that
> provide the get_timeleft() function (default off).
>
> For further information, please refer to:
> Documentation/trace/rv/watchdog-monitor.rst
>
> The monitor specification was developed together with Gabriele Paoloni,
> in the context of the Linux Foundation Elisa Project.
>
> Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
> Cc: Guenter Roeck <linux@roeck-us.net>
> Cc: Jonathan Corbet <corbet@lwn.net>
> Cc: Steven Rostedt <rostedt@goodmis.org>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Peter Zijlstra <peterz@infradead.org>
> Cc: Will Deacon <will@kernel.org>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: Marco Elver <elver@google.com>
> Cc: Dmitry Vyukov <dvyukov@google.com>
> Cc: "Paul E. McKenney" <paulmck@kernel.org>
> Cc: Shuah Khan <skhan@linuxfoundation.org>
> Cc: Gabriele Paoloni <gpaoloni@redhat.com>
> Cc: Juri Lelli <juri.lelli@redhat.com>
> Cc: Clark Williams <williams@redhat.com>
> Cc: linux-doc@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> Cc: linux-trace-devel@vger.kernel.org
> Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
> ---
> include/trace/events/rv.h | 11 +
> kernel/trace/rv/Kconfig | 10 +
> kernel/trace/rv/Makefile | 1 +
> kernel/trace/rv/monitors/safe_wtd/safe_wtd.c | 300 +++++++++++++++++++
> kernel/trace/rv/monitors/safe_wtd/safe_wtd.h | 84 ++++++
> 5 files changed, 406 insertions(+)
> create mode 100644 kernel/trace/rv/monitors/safe_wtd/safe_wtd.c
> create mode 100644 kernel/trace/rv/monitors/safe_wtd/safe_wtd.h
>
> diff --git a/include/trace/events/rv.h b/include/trace/events/rv.h
> index 00f11a8dac3b..895eb3435ed7 100644
> --- a/include/trace/events/rv.h
> +++ b/include/trace/events/rv.h
> @@ -66,6 +66,17 @@ DEFINE_EVENT(error_da_monitor, error_wip,
> TP_PROTO(char *state, char *event),
> TP_ARGS(state, event));
> #endif /* CONFIG_RV_MON_WIP */
> +
> +#ifdef CONFIG_RV_MON_SAFE_WTD
> +DEFINE_EVENT(event_da_monitor, event_safe_wtd,
> + TP_PROTO(char *state, char *event, char *next_state, bool safe),
> + TP_ARGS(state, event, next_state, safe));
> +
> +DEFINE_EVENT(error_da_monitor, error_safe_wtd,
> + TP_PROTO(char *state, char *event),
> + TP_ARGS(state, event));
> +#endif /* CONFIG_RV_MON_SAFE_WTD */
> +
> #endif /* CONFIG_DA_MON_EVENTS_IMPLICIT */
>
> #ifdef CONFIG_DA_MON_EVENTS_ID
> diff --git a/kernel/trace/rv/Kconfig b/kernel/trace/rv/Kconfig
> index 21f03fb3101a..b14ae63e792b 100644
> --- a/kernel/trace/rv/Kconfig
> +++ b/kernel/trace/rv/Kconfig
> @@ -45,6 +45,16 @@ config RV_MON_WWNR
> illustrates the usage of per-task monitor. The model is
> broken on purpose: it serves to test reactors.
>
> +config RV_MON_SAFE_WTD
> + select DA_MON_EVENTS_IMPLICIT
> + bool "Safety watchdog"
> + help
> + Enable safe_wtd, this monitor observes the interaction
> + between a user-space safety monitor and a watchdog device.
> +
> + For futher information see:
> + Documentation/trace/rv/safety-monitor.rst
> +
> config RV_REACTORS
> bool "Runtime verification reactors"
> default y if RV
> diff --git a/kernel/trace/rv/Makefile b/kernel/trace/rv/Makefile
> index 963d14875b45..904db96c7eae 100644
> --- a/kernel/trace/rv/Makefile
> +++ b/kernel/trace/rv/Makefile
> @@ -3,6 +3,7 @@
> obj-$(CONFIG_RV) += rv.o
> obj-$(CONFIG_RV_MON_WIP) += monitors/wip/wip.o
> obj-$(CONFIG_RV_MON_WWNR) += monitors/wwnr/wwnr.o
> +obj-$(CONFIG_RV_MON_SAFE_WTD) += monitors/safe_wtd/safe_wtd.o
> obj-$(CONFIG_RV_REACTORS) += rv_reactors.o
> obj-$(CONFIG_RV_REACT_PRINTK) += reactor_printk.o
> obj-$(CONFIG_RV_REACT_PANIC) += reactor_panic.o
> diff --git a/kernel/trace/rv/monitors/safe_wtd/safe_wtd.c b/kernel/trace/rv/monitors/safe_wtd/safe_wtd.c
> new file mode 100644
> index 000000000000..9856e0770d0d
> --- /dev/null
> +++ b/kernel/trace/rv/monitors/safe_wtd/safe_wtd.c
> @@ -0,0 +1,300 @@
> +// SPDX-License-Identifier: GPL-2.0
> +#include <linux/ftrace.h>
> +#include <linux/tracepoint.h>
> +#include <linux/kernel.h>
> +#include <linux/module.h>
> +#include <linux/init.h>
> +#include <linux/rv.h>
> +#include <rv/instrumentation.h>
> +#include <rv/da_monitor.h>
> +
> +#include <linux/watchdog.h>
> +#include <linux/moduleparam.h>
> +
> +#include <trace/events/rv.h>
> +#include <trace/events/watchdog.h>
> +
> +#define MODULE_NAME "safe_wtd"
> +
> +/*
> + * This is the self-generated part of the monitor. Generally, there is no need
> + * to touch this section.
> + */
> +#include "safe_wtd.h"
> +
> +/*
> + * Declare the deterministic automata monitor.
> + *
> + * The rv monitor reference is needed for the monitor declaration.
> + */
> +struct rv_monitor rv_safe_wtd;
> +DECLARE_DA_MON_GLOBAL(safe_wtd, char);
> +
> +/*
> + * custom: safe_timeout is the maximum value a watchdog monitor
> + * can set. This value is registered here to duplicate the information.
> + * In this way, a miss-behaving monitor can be detected.
> + */
> +static int safe_timeout = ~0;
> +module_param(safe_timeout, int, 0444);
> +
> +/*
> + * custom: if check_timeout is set, the monitor will check if the time left
> + * in the watchdog is less than or equals to the last safe timeout set by
> + * user-space. This check is done after each ping. In this way, if any
> + * code by-passed the watchdog dev interface setting a higher (so unsafe)
> + * timeout, this monitor will catch the side effect and react.
> + */
> +static int last_timeout_set = 0;
> +static int check_timeout = 0;
> +module_param(check_timeout, int, 0444);
> +
> +/*
> + * custom: if dont_stop is set the monitor will react if stopped.
> + */
> +static int dont_stop = 0;
> +module_param(dont_stop, int, 0444);
> +
> +/*
> + * custom: there are some states that are kept after the watchdog is closed.
> + * For example, the nowayout state.
> + *
> + * Thus, the RV monitor needs to keep track of these states after a start/stop
> + * of the RV monitor itself, and should not reset after each restart - keeping the
> + * know state until the system shutdown.
> + *
> + * If for an unknown reason an RV monitor would like to reset the RV monitor at each
> + * RV monitor start, set it to one.
> + */
> +static int reset_on_restart = 0;
> +module_param(reset_on_restart, int, 0444);
> +
> +/*
> + * open_pid takes note of the first thread that opened the watchdog.
> + *
> + * Any other thread that generates an event will cause an "other_threads"
> + * event in the monitor.
> + */
> +static int open_pid = 0;
Userspace could open a watchdog, create a child process, and handle it
from the child. That is perfectly valid.
> +
> +/*
> + * watchdog_id: the watchdog to monitor
> + */
> +static int watchdog_id = 0;
> +module_param(watchdog_id, int, 0444);
Limiting the watcher to a single watchdog sounds less than perfect.
What if the system supports more than one, more than one is enabled,
and the non-monitored watchdog misbehaves ?
> +
> +static void handle_nowayout(void *data, struct watchdog_device *wdd)
> +{
> + if (wdd->id != watchdog_id)
> + return;
> +
> + da_handle_init_run_event_safe_wtd(nowayout_safe_wtd);
> +}
> +
> +static void handle_close(void *data, struct watchdog_device *wdd)
> +{
> + if (wdd->id != watchdog_id)
> + return;
> +
> + if (open_pid && current->pid != open_pid) {
> + da_handle_init_run_event_safe_wtd(other_threads_safe_wtd);
> + } else {
> + da_handle_event_safe_wtd(close_safe_wtd);
> + open_pid = 0;
> + }
> +}
> +
> +static void handle_open(void *data, struct watchdog_device *wdd)
> +{
> + if (wdd->id != watchdog_id)
> + return;
> +
> + if (open_pid && current->pid != open_pid) {
> + da_handle_init_run_event_safe_wtd(other_threads_safe_wtd);
> + } else {
> + da_handle_init_run_event_safe_wtd(open_safe_wtd);
> + open_pid = current->pid;
> + }
> +}
> +
> +static void blocked_events(void *data, struct watchdog_device *wdd)
> +{
> + if (wdd->id != watchdog_id)
> + return;
> +
> + if (open_pid && current->pid != open_pid) {
> + da_handle_init_run_event_safe_wtd(other_threads_safe_wtd);
> + return;
> + }
> + da_handle_event_safe_wtd(other_threads_safe_wtd);
> +}
> +
> +static void blocked_events_timeout(void *data, struct watchdog_device *wdd, u64 timeout)
> +{
> + blocked_events(data, wdd);
> +}
> +
> +static void handle_ping(void *data, struct watchdog_device *wdd)
> +{
> + char msg[128];
> + unsigned int timeout;
> +
> + if (wdd->id != watchdog_id)
> + return;
> +
> + if (open_pid && current->pid != open_pid) {
> + da_handle_init_run_event_safe_wtd(other_threads_safe_wtd);
> + return;
> + }
> +
> + da_handle_event_safe_wtd(ping_safe_wtd);
> +
> + if (!check_timeout)
> + return;
> +
> + if (wdd->ops->get_timeleft) {
> + timeout = wdd->ops->get_timeleft(wdd);
> + if (timeout > last_timeout_set) {
> + snprintf(msg, 128,
> + "watchdog timeout is %u > than previously set (%d)\n",
> + timeout, last_timeout_set);
> + cond_react(msg);
> + }
> + } else {
> + snprintf(msg, 128, "error getting timeout: option not supported\n");
This is not an error. The get_timeleft callback is optional.
> + cond_react(msg);
> + }
> +}
> +
> +static void handle_set_safe_timeout(void *data, struct watchdog_device *wdd, u64 timeout)
> +{
> + char msg[128];
> +
> + if (wdd->id != watchdog_id)
> + return;
> +
> + if (open_pid && current->pid != open_pid) {
> + da_handle_init_run_event_safe_wtd(other_threads_safe_wtd);
> + return;
> + }
> +
> + da_handle_event_safe_wtd(set_safe_timeout_safe_wtd);
> +
> + if (timeout > safe_timeout) {
> + snprintf(msg, 128, "set safety timeout is too high: %d", (int) timeout);
> + cond_react(msg);
> + }
> +
> + if (check_timeout)
> + last_timeout_set = timeout;
> +}
> +
> +static void handle_start(void *data, struct watchdog_device *wdd)
> +{
> + if (wdd->id != watchdog_id)
> + return;
> +
> + if (open_pid && current->pid != open_pid) {
> + da_handle_init_run_event_safe_wtd(other_threads_safe_wtd);
> + return;
> + }
> +
> + da_handle_event_safe_wtd(start_safe_wtd);
> +}
> +
> +static void handle_stop(void *data, struct watchdog_device *wdd)
> +{
> + if (wdd->id != watchdog_id)
> + return;
> +
> + if (open_pid && current->pid != open_pid) {
> + da_handle_init_run_event_safe_wtd(other_threads_safe_wtd);
> + return;
> + }
> +
> + da_handle_event_safe_wtd(stop_safe_wtd);
> +}
> +
> +static int mon_started = 0;
> +
> +static int start_safe_wtd_monitor(void)
> +{
> + int retval;
> +
> + if (!mon_started || reset_on_restart) {
> + retval = da_monitor_init_safe_wtd();
> + if (retval)
> + return retval;
> +
> + mon_started = 1;
> + }
> +
> + rv_attach_trace_probe("safe_wtd", watchdog_close, handle_close);
> + rv_attach_trace_probe("safe_wtd", watchdog_nowayout, handle_nowayout);
> + rv_attach_trace_probe("safe_wtd", watchdog_open, handle_open);
> + rv_attach_trace_probe("safe_wtd", watchdog_ping, handle_ping);
> + rv_attach_trace_probe("safe_wtd", watchdog_set_timeout, handle_set_safe_timeout);
> + rv_attach_trace_probe("safe_wtd", watchdog_start, handle_start);
> + rv_attach_trace_probe("safe_wtd", watchdog_stop, handle_stop);
> + rv_attach_trace_probe("safe_wtd", watchdog_set_keep_alive, blocked_events_timeout);
> + rv_attach_trace_probe("safe_wtd", watchdog_keep_alive, blocked_events);
> + rv_attach_trace_probe("safe_wtd", watchdog_set_pretimeout, blocked_events_timeout);
> + rv_attach_trace_probe("safe_wtd", watchdog_pretimeout, blocked_events);
> +
> + return 0;
> +}
> +
> +static void stop_safe_wtd_monitor(void)
> +{
> + if (dont_stop)
> + cond_react("dont_stop safe_wtd is set.");
> +
> + rv_safe_wtd.enabled = 0;
> +
> + rv_detach_trace_probe("safe_wtd", watchdog_close, handle_close);
> + rv_detach_trace_probe("safe_wtd", watchdog_nowayout, handle_nowayout);
> + rv_detach_trace_probe("safe_wtd", watchdog_open, handle_open);
> + rv_detach_trace_probe("safe_wtd", watchdog_ping, handle_ping);
> + rv_detach_trace_probe("safe_wtd", watchdog_set_timeout, handle_set_safe_timeout);
> + rv_detach_trace_probe("safe_wtd", watchdog_start, handle_start);
> + rv_detach_trace_probe("safe_wtd", watchdog_stop, handle_stop);
> + rv_detach_trace_probe("safe_wtd", watchdog_set_keep_alive, blocked_events_timeout);
> + rv_detach_trace_probe("safe_wtd", watchdog_keep_alive, blocked_events);
> + rv_detach_trace_probe("safe_wtd", watchdog_set_pretimeout, blocked_events_timeout);
> + rv_detach_trace_probe("safe_wtd", watchdog_pretimeout, blocked_events);
> +
> + da_monitor_destroy_safe_wtd();
> +}
> +
> +/*
> + * This is the monitor register section.
> + */
> +struct rv_monitor rv_safe_wtd = {
> + .name = "safe_wtd",
> + .description = "A watchdog monitor guarding a safety monitor actions",
> + .start = start_safe_wtd_monitor,
> + .stop = stop_safe_wtd_monitor,
> + .reset = da_monitor_reset_all_safe_wtd,
> + .enabled = 0,
> +};
> +
> +int register_safe_wtd(void)
> +{
> + rv_register_monitor(&rv_safe_wtd);
> + return 0;
> +}
> +
> +void unregister_safe_wtd(void)
> +{
> + if (rv_safe_wtd.enabled)
> + stop_safe_wtd_monitor();
> +
> + rv_unregister_monitor(&rv_safe_wtd);
> +}
> +
> +module_init(register_safe_wtd);
> +module_exit(unregister_safe_wtd);
> +
> +MODULE_LICENSE("GPL");
> +MODULE_AUTHOR("Daniel Bristot de Oliveira <bristot@kernel.org>");
> +MODULE_DESCRIPTION("Safe watchdog RV monitor");
> diff --git a/kernel/trace/rv/monitors/safe_wtd/safe_wtd.h b/kernel/trace/rv/monitors/safe_wtd/safe_wtd.h
> new file mode 100644
> index 000000000000..835c9d0979f6
> --- /dev/null
> +++ b/kernel/trace/rv/monitors/safe_wtd/safe_wtd.h
> @@ -0,0 +1,84 @@
> +enum states_safe_wtd {
> + init_safe_wtd = 0,
> + closed_running_safe_wtd,
> + closed_running_nwo_safe_wtd,
> + nwo_safe_wtd,
> + opened_safe_wtd,
> + opened_nwo_safe_wtd,
> + reopened_safe_wtd,
> + safe_safe_wtd,
> + safe_nwo_safe_wtd,
> + set_safe_wtd,
> + set_nwo_safe_wtd,
> + started_safe_wtd,
> + started_nwo_safe_wtd,
> + stoped_safe_wtd,
> + state_max_safe_wtd
> +};
> +
> +enum events_safe_wtd {
> + close_safe_wtd = 0,
> + nowayout_safe_wtd,
> + open_safe_wtd,
> + other_threads_safe_wtd,
> + ping_safe_wtd,
> + set_safe_timeout_safe_wtd,
> + start_safe_wtd,
> + stop_safe_wtd,
> + event_max_safe_wtd
> +};
> +
> +struct automaton_safe_wtd {
> + char *state_names[state_max_safe_wtd];
> + char *event_names[event_max_safe_wtd];
> + char function[state_max_safe_wtd][event_max_safe_wtd];
> + char initial_state;
> + char final_states[state_max_safe_wtd];
> +};
> +
> +struct automaton_safe_wtd automaton_safe_wtd = {
> + .state_names = {
> + "init",
> + "closed_running",
> + "closed_running_nwo",
> + "nwo",
> + "opened",
> + "opened_nwo",
> + "reopened",
> + "safe",
> + "safe_nwo",
> + "set",
> + "set_nwo",
> + "started",
> + "started_nwo",
> + "stoped"
> + },
> + .event_names = {
> + "close",
> + "nowayout",
> + "open",
> + "other_threads",
> + "ping",
> + "set_safe_timeout",
> + "start",
> + "stop"
> + },
> + .function = {
> + { -1, nwo_safe_wtd, opened_safe_wtd, init_safe_wtd, -1, -1, -1, -1 },
> + { -1, closed_running_nwo_safe_wtd, reopened_safe_wtd, closed_running_safe_wtd, -1, -1, -1, -1 },
> + { -1, closed_running_nwo_safe_wtd, started_nwo_safe_wtd, closed_running_nwo_safe_wtd, -1, -1, -1, -1 },
> + { -1, nwo_safe_wtd, opened_nwo_safe_wtd, nwo_safe_wtd, -1, -1, -1, -1 },
> + { init_safe_wtd, -1, -1, -1, -1, -1, started_safe_wtd, -1 },
> + { nwo_safe_wtd, -1, -1, -1, -1, -1, started_nwo_safe_wtd, -1 },
> + { closed_running_safe_wtd, -1, -1, -1, -1, set_safe_wtd, -1, opened_safe_wtd },
> + { closed_running_safe_wtd, -1, -1, -1, safe_safe_wtd, -1, -1, stoped_safe_wtd },
> + { closed_running_nwo_safe_wtd, -1, -1, -1, safe_nwo_safe_wtd, -1, -1, -1 },
> + { -1, -1, -1, -1, safe_safe_wtd, -1, -1, -1 },
> + { -1, -1, -1, -1, safe_nwo_safe_wtd, -1, -1, -1 },
> + { closed_running_safe_wtd, -1, -1, -1, -1, set_safe_wtd, -1, stoped_safe_wtd },
> + { closed_running_nwo_safe_wtd, -1, -1, -1, -1, set_nwo_safe_wtd, -1, -1 },
> + { init_safe_wtd, -1, -1, -1, -1, -1, -1, -1 },
> + },
> + .initial_state = init_safe_wtd,
> + .final_states = { 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
I find this event table all but impossible to verify.
> +};
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 17/20] watchdog/dev: Add tracepoints
2022-06-16 8:44 ` [PATCH V4 17/20] watchdog/dev: Add tracepoints Daniel Bristot de Oliveira
@ 2022-06-16 13:44 ` Guenter Roeck
2022-06-16 15:47 ` Daniel Bristot de Oliveira
0 siblings, 1 reply; 82+ messages in thread
From: Guenter Roeck @ 2022-06-16 13:44 UTC (permalink / raw)
To: Daniel Bristot de Oliveira, Steven Rostedt
Cc: Wim Van Sebroeck, Jonathan Corbet, Ingo Molnar, Thomas Gleixner,
Peter Zijlstra, Will Deacon, Catalin Marinas, Marco Elver,
Dmitry Vyukov, Paul E. McKenney, Shuah Khan, Gabriele Paoloni,
Juri Lelli, Clark Williams, linux-doc, linux-kernel,
linux-trace-devel
On 6/16/22 01:44, Daniel Bristot de Oliveira wrote:
> Add a set of tracepoints, enabling the observability of the watchdog
> device interactions with user-space.
>
> The events are:
> watchdog:watchdog_open
> watchdog:watchdog_close
> watchdog:watchdog_start
> watchdog:watchdog_stop
> watchdog:watchdog_set_timeout
> watchdog:watchdog_ping
> watchdog:watchdog_nowayout
> watchdog:watchdog_set_keep_alive
> watchdog:watchdog_keep_alive
> watchdog:watchdog_set_pretimeout
> watchdog:watchdog_pretimeout
>
> Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
> Cc: Guenter Roeck <linux@roeck-us.net>
> Cc: Jonathan Corbet <corbet@lwn.net>
> Cc: Steven Rostedt <rostedt@goodmis.org>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Peter Zijlstra <peterz@infradead.org>
> Cc: Will Deacon <will@kernel.org>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: Marco Elver <elver@google.com>
> Cc: Dmitry Vyukov <dvyukov@google.com>
> Cc: "Paul E. McKenney" <paulmck@kernel.org>
> Cc: Shuah Khan <skhan@linuxfoundation.org>
> Cc: Gabriele Paoloni <gpaoloni@redhat.com>
> Cc: Juri Lelli <juri.lelli@redhat.com>
> Cc: Clark Williams <williams@redhat.com>
> Cc: linux-doc@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> Cc: linux-trace-devel@vger.kernel.org
> Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
> ---
> drivers/watchdog/watchdog_dev.c | 43 ++++++++++-
> drivers/watchdog/watchdog_pretimeout.c | 2 +
> include/linux/watchdog.h | 7 +-
> include/trace/events/watchdog.h | 101 +++++++++++++++++++++++++
> 4 files changed, 143 insertions(+), 10 deletions(-)
> create mode 100644 include/trace/events/watchdog.h
>
> diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
> index 54903f3c851e..2f28dc5ab763 100644
> --- a/drivers/watchdog/watchdog_dev.c
> +++ b/drivers/watchdog/watchdog_dev.c
> @@ -44,6 +44,9 @@
> #include <linux/watchdog.h> /* For watchdog specific items */
> #include <linux/uaccess.h> /* For copy_to_user/put_user/... */
>
> +#define CREATE_TRACE_POINTS
> +#include <trace/events/watchdog.h>
> +
> #include "watchdog_core.h"
> #include "watchdog_pretimeout.h"
>
> @@ -130,9 +133,11 @@ static inline void watchdog_update_worker(struct watchdog_device *wdd)
> if (watchdog_need_worker(wdd)) {
> ktime_t t = watchdog_next_keepalive(wdd);
>
> - if (t > 0)
> + if (t > 0) {
> hrtimer_start(&wd_data->timer, t,
> HRTIMER_MODE_REL_HARD);
> + trace_watchdog_set_keep_alive(wdd, ktime_to_ms(t));
> + }
> } else {
> hrtimer_cancel(&wd_data->timer);
> }
> @@ -141,7 +146,7 @@ static inline void watchdog_update_worker(struct watchdog_device *wdd)
> static int __watchdog_ping(struct watchdog_device *wdd)
> {
> struct watchdog_core_data *wd_data = wdd->wd_data;
> - ktime_t earliest_keepalive, now;
> + ktime_t earliest_keepalive, now, next_keepalive;
> int err;
>
> earliest_keepalive = ktime_add(wd_data->last_hw_keepalive,
> @@ -149,14 +154,16 @@ static int __watchdog_ping(struct watchdog_device *wdd)
> now = ktime_get();
>
> if (ktime_after(earliest_keepalive, now)) {
> - hrtimer_start(&wd_data->timer,
> - ktime_sub(earliest_keepalive, now),
> + next_keepalive = ktime_sub(earliest_keepalive, now);
> + hrtimer_start(&wd_data->timer, next_keepalive,
> HRTIMER_MODE_REL_HARD);
> + trace_watchdog_set_keep_alive(wdd, ktime_to_ms(next_keepalive));
> return 0;
> }
>
> wd_data->last_hw_keepalive = now;
>
> + trace_watchdog_ping(wdd);
> if (wdd->ops->ping)
> err = wdd->ops->ping(wdd); /* ping the watchdog */
> else
> @@ -215,6 +222,7 @@ static void watchdog_ping_work(struct kthread_work *work)
> wd_data = container_of(work, struct watchdog_core_data, work);
>
> mutex_lock(&wd_data->lock);
> + trace_watchdog_keep_alive(wd_data->wdd);
> if (watchdog_worker_should_ping(wd_data))
> __watchdog_ping(wd_data->wdd);
> mutex_unlock(&wd_data->lock);
> @@ -250,6 +258,8 @@ static int watchdog_start(struct watchdog_device *wdd)
>
> set_bit(_WDOG_KEEPALIVE, &wd_data->status);
>
> + trace_watchdog_start(wdd);
> +
> started_at = ktime_get();
> if (watchdog_hw_running(wdd) && wdd->ops->ping) {
> err = __watchdog_ping(wdd);
> @@ -294,6 +304,7 @@ static int watchdog_stop(struct watchdog_device *wdd)
> return -EBUSY;
> }
>
> + trace_watchdog_stop(wdd);
> if (wdd->ops->stop) {
> clear_bit(WDOG_HW_RUNNING, &wdd->status);
> err = wdd->ops->stop(wdd);
> @@ -367,6 +378,7 @@ static int watchdog_set_timeout(struct watchdog_device *wdd,
> if (watchdog_timeout_invalid(wdd, timeout))
> return -EINVAL;
>
> + trace_watchdog_set_timeout(wdd, timeout);
The driver has no obligation to set the timeout to the
requested value. It might be more valuable to report both
the requested and the actual values.
> if (wdd->ops->set_timeout) {
> err = wdd->ops->set_timeout(wdd, timeout);
> } else {
> @@ -399,6 +411,8 @@ static int watchdog_set_pretimeout(struct watchdog_device *wdd,
> if (watchdog_pretimeout_invalid(wdd, timeout))
> return -EINVAL;
>
> + trace_watchdog_set_pretimeout(wdd, timeout);
> +
Again, the driver has no obligation to set the timeout to the
requested value.
> if (wdd->ops->set_pretimeout && (wdd->info->options & WDIOF_PRETIMEOUT))
> err = wdd->ops->set_pretimeout(wdd, timeout);
> else
> @@ -430,6 +444,23 @@ static int watchdog_get_timeleft(struct watchdog_device *wdd,
> return 0;
> }
>
> +/**
> + * watchdog_set_nowayout - set nowaout bit
> + * @wdd: The watchdog device to set nowayoutbit
> + * @nowayout A boolean on/off switcher
> + *
> + * If nowayout boolean is true, the nowayout option is set. No action is
> + * taken if nowayout is false.
> + */
> +void watchdog_set_nowayout(struct watchdog_device *wdd, bool nowayout)
> +{
> + if (nowayout) {
> + set_bit(WDOG_NO_WAY_OUT, &wdd->status);
> + trace_watchdog_nowayout(wdd);
> + }
> +}
> +EXPORT_SYMBOL(watchdog_set_nowayout);
> +
> #ifdef CONFIG_WATCHDOG_SYSFS
> static ssize_t nowayout_show(struct device *dev, struct device_attribute *attr,
> char *buf)
> @@ -861,6 +892,8 @@ static int watchdog_open(struct inode *inode, struct file *file)
> goto out_clear;
> }
>
> + trace_watchdog_open(wdd);
> +
> err = watchdog_start(wdd);
> if (err < 0)
> goto out_mod;
> @@ -883,6 +916,7 @@ static int watchdog_open(struct inode *inode, struct file *file)
> return stream_open(inode, file);
>
> out_mod:
> + trace_watchdog_close(wdd);
> module_put(wd_data->wdd->ops->owner);
> out_clear:
> clear_bit(_WDOG_DEV_OPEN, &wd_data->status);
> @@ -944,6 +978,7 @@ static int watchdog_release(struct inode *inode, struct file *file)
> /* make sure that /dev/watchdog can be re-opened */
> clear_bit(_WDOG_DEV_OPEN, &wd_data->status);
>
> + trace_watchdog_close(wdd);
> done:
> running = wdd && watchdog_hw_running(wdd);
> mutex_unlock(&wd_data->lock);
> diff --git a/drivers/watchdog/watchdog_pretimeout.c b/drivers/watchdog/watchdog_pretimeout.c
> index 376a495ab80c..58c391ed2205 100644
> --- a/drivers/watchdog/watchdog_pretimeout.c
> +++ b/drivers/watchdog/watchdog_pretimeout.c
> @@ -8,6 +8,7 @@
> #include <linux/spinlock.h>
> #include <linux/string.h>
> #include <linux/watchdog.h>
> +#include <trace/events/watchdog.h>
>
> #include "watchdog_core.h"
> #include "watchdog_pretimeout.h"
> @@ -107,6 +108,7 @@ void watchdog_notify_pretimeout(struct watchdog_device *wdd)
> return;
> }
>
> + trace_watchdog_pretimeout(wdd);
> wdd->gov->pretimeout(wdd);
> spin_unlock_irqrestore(&pretimeout_lock, flags);
> }
> diff --git a/include/linux/watchdog.h b/include/linux/watchdog.h
> index 99660197a36c..11d93407e492 100644
> --- a/include/linux/watchdog.h
> +++ b/include/linux/watchdog.h
> @@ -139,12 +139,7 @@ static inline bool watchdog_hw_running(struct watchdog_device *wdd)
> return test_bit(WDOG_HW_RUNNING, &wdd->status);
> }
>
> -/* Use the following function to set the nowayout feature */
> -static inline void watchdog_set_nowayout(struct watchdog_device *wdd, bool nowayout)
> -{
> - if (nowayout)
> - set_bit(WDOG_NO_WAY_OUT, &wdd->status);
> -}
> +void watchdog_set_nowayout(struct watchdog_device *wdd, bool nowayout);
>
> /* Use the following function to stop the watchdog on reboot */
> static inline void watchdog_stop_on_reboot(struct watchdog_device *wdd)
> diff --git a/include/trace/events/watchdog.h b/include/trace/events/watchdog.h
> new file mode 100644
> index 000000000000..145cd6cfaa02
> --- /dev/null
> +++ b/include/trace/events/watchdog.h
> @@ -0,0 +1,101 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +#undef TRACE_SYSTEM
> +#define TRACE_SYSTEM watchdog
> +
> +#if !defined(_TRACE_WATCHDOG_H) || defined(TRACE_HEADER_MULTI_READ)
> +#define _TRACE_WATCHDOG_H
> +
> +#include <linux/tracepoint.h>
> +
> +/*
> + * These are all events whose sole argument is the watchdog id.
> + */
> +DECLARE_EVENT_CLASS(dev_operations_template,
> +
> + TP_PROTO(struct watchdog_device *wdd),
> +
> + TP_ARGS(wdd),
> +
> + TP_STRUCT__entry(
> + __field(__u32, id)
> + ),
> +
> + TP_fast_assign(
> + __entry->id = wdd->id;
> + ),
> +
> + TP_printk("id=%d",
> + __entry->id)
> +);
> +
> +DEFINE_EVENT(dev_operations_template, watchdog_open,
> + TP_PROTO(struct watchdog_device *wdd),
> + TP_ARGS(wdd));
> +
> +DEFINE_EVENT(dev_operations_template, watchdog_close,
> + TP_PROTO(struct watchdog_device *wdd),
> + TP_ARGS(wdd));
> +
> +DEFINE_EVENT(dev_operations_template, watchdog_start,
> + TP_PROTO(struct watchdog_device *wdd),
> + TP_ARGS(wdd));
> +
> +DEFINE_EVENT(dev_operations_template, watchdog_stop,
> + TP_PROTO(struct watchdog_device *wdd),
> + TP_ARGS(wdd));
> +
> +DEFINE_EVENT(dev_operations_template, watchdog_ping,
> + TP_PROTO(struct watchdog_device *wdd),
> + TP_ARGS(wdd));
> +
> +DEFINE_EVENT(dev_operations_template, watchdog_nowayout,
> + TP_PROTO(struct watchdog_device *wdd),
> + TP_ARGS(wdd));
> +
> +DEFINE_EVENT(dev_operations_template, watchdog_keep_alive,
> + TP_PROTO(struct watchdog_device *wdd),
> + TP_ARGS(wdd));
> +
> +DEFINE_EVENT(dev_operations_template, watchdog_pretimeout,
> + TP_PROTO(struct watchdog_device *wdd),
> + TP_ARGS(wdd));
> +
> +/*
> + * These are all events with a device ID and a given timeout.
> + */
> +DECLARE_EVENT_CLASS(watchdog_timeout_template,
> +
> + TP_PROTO(struct watchdog_device *wdd, u64 timeout),
> +
> + TP_ARGS(wdd, timeout),
> +
> + TP_STRUCT__entry(
> + __field(__u32, id)
> + __field(__u64, timeout)
Why u64 ? timeout is unsigned long.
> + ),
> +
> + TP_fast_assign(
> + __entry->id = wdd->id;
> + __entry->timeout = timeout;
> + ),
> +
> + TP_printk("id=%d timeout=%llus",
> + __entry->id, __entry->timeout)
> +);
> +
> +DEFINE_EVENT(watchdog_timeout_template, watchdog_set_timeout,
> + TP_PROTO(struct watchdog_device *wdd, u64 timeout),
> + TP_ARGS(wdd, timeout));
> +
> +DEFINE_EVENT(watchdog_timeout_template, watchdog_set_pretimeout,
> + TP_PROTO(struct watchdog_device *wdd, u64 timeout),
> + TP_ARGS(wdd, timeout));
> +
> +DEFINE_EVENT(watchdog_timeout_template, watchdog_set_keep_alive,
> + TP_PROTO(struct watchdog_device *wdd, u64 timeout),
> + TP_ARGS(wdd, timeout));
> +
> +#endif /* _TRACE_WATCHDOG_H */
> +
> +/* This part must be outside protection */
> +#include <trace/define_trace.h>
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 11/20] rv/monitor: wwnr instrumentation and Makefile/Kconfig entries
2022-06-16 8:44 ` [PATCH V4 11/20] rv/monitor: wwnr instrumentation and Makefile/Kconfig entries Daniel Bristot de Oliveira
@ 2022-06-16 13:47 ` kernel test robot
2022-06-28 19:05 ` Steven Rostedt
1 sibling, 0 replies; 82+ messages in thread
From: kernel test robot @ 2022-06-16 13:47 UTC (permalink / raw)
To: Daniel Bristot de Oliveira, Steven Rostedt
Cc: kbuild-all, Daniel Bristot de Oliveira, Wim Van Sebroeck,
Guenter Roeck, Jonathan Corbet, Ingo Molnar, Thomas Gleixner,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel
Hi Daniel,
I love your patch! Perhaps something to improve:
[auto build test WARNING on rostedt-trace/for-next]
[also build test WARNING on tip/sched/core]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]
url: https://github.com/intel-lab-lkp/linux/commits/Daniel-Bristot-de-Oliveira/The-Runtime-Verification-RV-interface/20220616-164837
base: https://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace.git for-next
config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20220616/202206162130.0xtEgymS-lkp@intel.com/config)
compiler: gcc-11 (Debian 11.3.0-3) 11.3.0
reproduce (this is a W=1 build):
# https://github.com/intel-lab-lkp/linux/commit/31dad6685057c10f6301fbc4018b6586fce0757e
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review Daniel-Bristot-de-Oliveira/The-Runtime-Verification-RV-interface/20220616-164837
git checkout 31dad6685057c10f6301fbc4018b6586fce0757e
# save the config file
mkdir build_dir && cp config build_dir/.config
make W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash kernel/trace/rv/
If you fix the issue, kindly add following tag where applicable
Reported-by: kernel test robot <lkp@intel.com>
All warnings (new ones prefixed by >>):
In file included from kernel/trace/rv/monitors/wwnr/wwnr.c:8:
kernel/trace/rv/monitors/wwnr/wwnr.c: In function 'start_wwnr':
kernel/trace/rv/monitors/wwnr/wwnr.c:62:53: error: passing argument 1 of 'check_trace_callback_type_sched_switch' from incompatible pointer type [-Werror=incompatible-pointer-types]
62 | rv_attach_trace_probe("wwnr", sched_switch, handle_switch);
| ^~~~~~~~~~~~~
| |
| void (*)(void *, bool, struct task_struct *, struct task_struct *, unsigned int) {aka void (*)(void *, _Bool, struct task_struct *, struct task_struct *, unsigned int)}
include/rv/instrumentation.h:15:48: note: in definition of macro 'rv_attach_trace_probe'
15 | check_trace_callback_type_##tp(rv_handler); \
| ^~~~~~~~~~
In file included from kernel/trace/rv/monitors/wwnr/wwnr.c:3:
include/linux/tracepoint.h:279:49: note: expected 'void (*)(void *, bool, unsigned int, struct task_struct *, struct task_struct *)' {aka 'void (*)(void *, _Bool, unsigned int, struct task_struct *, struct task_struct *)'} but argument is of type 'void (*)(void *, bool, struct task_struct *, struct task_struct *, unsigned int)' {aka 'void (*)(void *, _Bool, struct task_struct *, struct task_struct *, unsigned int)'}
279 | check_trace_callback_type_##name(void (*cb)(data_proto)) \
| ~~~~~~~^~~~~~~~~~~~~~~
include/linux/tracepoint.h:419:9: note: in expansion of macro '__DECLARE_TRACE'
419 | __DECLARE_TRACE(name, PARAMS(proto), PARAMS(args), \
| ^~~~~~~~~~~~~~~
include/linux/tracepoint.h:553:9: note: in expansion of macro 'DECLARE_TRACE'
553 | DECLARE_TRACE(name, PARAMS(proto), PARAMS(args))
| ^~~~~~~~~~~~~
include/trace/events/sched.h:222:1: note: in expansion of macro 'TRACE_EVENT'
222 | TRACE_EVENT(sched_switch,
| ^~~~~~~~~~~
In file included from include/linux/printk.h:11,
from include/linux/kernel.h:29,
from include/linux/interrupt.h:6,
from include/linux/trace_recursion.h:5,
from include/linux/ftrace.h:10,
from kernel/trace/rv/monitors/wwnr/wwnr.c:2:
kernel/trace/rv/monitors/wwnr/wwnr.c:62:53: error: passing argument 1 of 'register_trace_sched_switch' from incompatible pointer type [-Werror=incompatible-pointer-types]
62 | rv_attach_trace_probe("wwnr", sched_switch, handle_switch);
| ^~~~~~~~~~~~~
| |
| void (*)(void *, bool, struct task_struct *, struct task_struct *, unsigned int) {aka void (*)(void *, _Bool, struct task_struct *, struct task_struct *, unsigned int)}
include/linux/once_lite.h:15:41: note: in definition of macro 'DO_ONCE_LITE_IF'
15 | bool __ret_do_once = !!(condition); \
| ^~~~~~~~~
include/rv/instrumentation.h:16:17: note: in expansion of macro 'WARN_ONCE'
16 | WARN_ONCE(register_trace_##tp(rv_handler, NULL), \
| ^~~~~~~~~
kernel/trace/rv/monitors/wwnr/wwnr.c:62:9: note: in expansion of macro 'rv_attach_trace_probe'
62 | rv_attach_trace_probe("wwnr", sched_switch, handle_switch);
| ^~~~~~~~~~~~~~~~~~~~~
In file included from kernel/trace/rv/monitors/wwnr/wwnr.c:3:
include/linux/tracepoint.h:260:38: note: expected 'void (*)(void *, bool, unsigned int, struct task_struct *, struct task_struct *)' {aka 'void (*)(void *, _Bool, unsigned int, struct task_struct *, struct task_struct *)'} but argument is of type 'void (*)(void *, bool, struct task_struct *, struct task_struct *, unsigned int)' {aka 'void (*)(void *, _Bool, struct task_struct *, struct task_struct *, unsigned int)'}
260 | register_trace_##name(void (*probe)(data_proto), void *data) \
| ~~~~~~~^~~~~~~~~~~~~~~~~~
include/linux/tracepoint.h:419:9: note: in expansion of macro '__DECLARE_TRACE'
419 | __DECLARE_TRACE(name, PARAMS(proto), PARAMS(args), \
| ^~~~~~~~~~~~~~~
include/linux/tracepoint.h:553:9: note: in expansion of macro 'DECLARE_TRACE'
553 | DECLARE_TRACE(name, PARAMS(proto), PARAMS(args))
| ^~~~~~~~~~~~~
include/trace/events/sched.h:222:1: note: in expansion of macro 'TRACE_EVENT'
222 | TRACE_EVENT(sched_switch,
| ^~~~~~~~~~~
In file included from kernel/trace/rv/monitors/wwnr/wwnr.c:8:
kernel/trace/rv/monitors/wwnr/wwnr.c: In function 'stop_wwnr':
kernel/trace/rv/monitors/wwnr/wwnr.c:72:53: error: passing argument 1 of 'unregister_trace_sched_switch' from incompatible pointer type [-Werror=incompatible-pointer-types]
72 | rv_detach_trace_probe("wwnr", sched_switch, handle_switch);
| ^~~~~~~~~~~~~
| |
| void (*)(void *, bool, struct task_struct *, struct task_struct *, unsigned int) {aka void (*)(void *, _Bool, struct task_struct *, struct task_struct *, unsigned int)}
include/rv/instrumentation.h:22:39: note: in definition of macro 'rv_detach_trace_probe'
22 | unregister_trace_##tp(rv_handler, NULL); \
| ^~~~~~~~~~
In file included from kernel/trace/rv/monitors/wwnr/wwnr.c:3:
include/linux/tracepoint.h:273:40: note: expected 'void (*)(void *, bool, unsigned int, struct task_struct *, struct task_struct *)' {aka 'void (*)(void *, _Bool, unsigned int, struct task_struct *, struct task_struct *)'} but argument is of type 'void (*)(void *, bool, struct task_struct *, struct task_struct *, unsigned int)' {aka 'void (*)(void *, _Bool, struct task_struct *, struct task_struct *, unsigned int)'}
273 | unregister_trace_##name(void (*probe)(data_proto), void *data) \
| ~~~~~~~^~~~~~~~~~~~~~~~~~
include/linux/tracepoint.h:419:9: note: in expansion of macro '__DECLARE_TRACE'
419 | __DECLARE_TRACE(name, PARAMS(proto), PARAMS(args), \
| ^~~~~~~~~~~~~~~
include/linux/tracepoint.h:553:9: note: in expansion of macro 'DECLARE_TRACE'
553 | DECLARE_TRACE(name, PARAMS(proto), PARAMS(args))
| ^~~~~~~~~~~~~
include/trace/events/sched.h:222:1: note: in expansion of macro 'TRACE_EVENT'
222 | TRACE_EVENT(sched_switch,
| ^~~~~~~~~~~
kernel/trace/rv/monitors/wwnr/wwnr.c: At top level:
>> kernel/trace/rv/monitors/wwnr/wwnr.c:90:5: warning: no previous prototype for 'register_wwnr' [-Wmissing-prototypes]
90 | int register_wwnr(void)
| ^~~~~~~~~~~~~
>> kernel/trace/rv/monitors/wwnr/wwnr.c:96:6: warning: no previous prototype for 'unregister_wwnr' [-Wmissing-prototypes]
96 | void unregister_wwnr(void)
| ^~~~~~~~~~~~~~~
cc1: some warnings being treated as errors
vim +/register_wwnr +90 kernel/trace/rv/monitors/wwnr/wwnr.c
13d11b21732323 Daniel Bristot de Oliveira 2022-06-16 89
13d11b21732323 Daniel Bristot de Oliveira 2022-06-16 @90 int register_wwnr(void)
13d11b21732323 Daniel Bristot de Oliveira 2022-06-16 91 {
13d11b21732323 Daniel Bristot de Oliveira 2022-06-16 92 rv_register_monitor(&rv_wwnr);
13d11b21732323 Daniel Bristot de Oliveira 2022-06-16 93 return 0;
13d11b21732323 Daniel Bristot de Oliveira 2022-06-16 94 }
13d11b21732323 Daniel Bristot de Oliveira 2022-06-16 95
13d11b21732323 Daniel Bristot de Oliveira 2022-06-16 @96 void unregister_wwnr(void)
13d11b21732323 Daniel Bristot de Oliveira 2022-06-16 97 {
13d11b21732323 Daniel Bristot de Oliveira 2022-06-16 98 if (rv_wwnr.enabled)
13d11b21732323 Daniel Bristot de Oliveira 2022-06-16 99 stop_wwnr();
13d11b21732323 Daniel Bristot de Oliveira 2022-06-16 100
13d11b21732323 Daniel Bristot de Oliveira 2022-06-16 101 rv_unregister_monitor(&rv_wwnr);
13d11b21732323 Daniel Bristot de Oliveira 2022-06-16 102 }
13d11b21732323 Daniel Bristot de Oliveira 2022-06-16 103
--
0-DAY CI Kernel Test Service
https://01.org/lkp
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 13/20] rv/reactor: Add the panic reactor
2022-06-16 8:44 ` [PATCH V4 13/20] rv/reactor: Add the panic reactor Daniel Bristot de Oliveira
@ 2022-06-16 15:20 ` kernel test robot
2022-06-16 21:03 ` Randy Dunlap
2022-06-28 19:06 ` Steven Rostedt
2 siblings, 0 replies; 82+ messages in thread
From: kernel test robot @ 2022-06-16 15:20 UTC (permalink / raw)
To: Daniel Bristot de Oliveira, Steven Rostedt
Cc: kbuild-all, Daniel Bristot de Oliveira, Wim Van Sebroeck,
Guenter Roeck, Jonathan Corbet, Ingo Molnar, Thomas Gleixner,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel
Hi Daniel,
I love your patch! Perhaps something to improve:
[auto build test WARNING on rostedt-trace/for-next]
[also build test WARNING on tip/sched/core]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]
url: https://github.com/intel-lab-lkp/linux/commits/Daniel-Bristot-de-Oliveira/The-Runtime-Verification-RV-interface/20220616-164837
base: https://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace.git for-next
config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20220616/202206162325.aggB6gj9-lkp@intel.com/config)
compiler: gcc-11 (Debian 11.3.0-3) 11.3.0
reproduce (this is a W=1 build):
# https://github.com/intel-lab-lkp/linux/commit/c32f84c1978c0e0b8526da45a2ab87e191246f68
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review Daniel-Bristot-de-Oliveira/The-Runtime-Verification-RV-interface/20220616-164837
git checkout c32f84c1978c0e0b8526da45a2ab87e191246f68
# save the config file
mkdir build_dir && cp config build_dir/.config
make W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash kernel/trace/rv/
If you fix the issue, kindly add following tag where applicable
Reported-by: kernel test robot <lkp@intel.com>
All warnings (new ones prefixed by >>):
>> kernel/trace/rv/reactor_panic.c:28:5: warning: no previous prototype for 'register_react_panic' [-Wmissing-prototypes]
28 | int register_react_panic(void)
| ^~~~~~~~~~~~~~~~~~~~
>> kernel/trace/rv/reactor_panic.c:34:6: warning: no previous prototype for 'unregister_react_panic' [-Wmissing-prototypes]
34 | void unregister_react_panic(void)
| ^~~~~~~~~~~~~~~~~~~~~~
vim +/register_react_panic +28 kernel/trace/rv/reactor_panic.c
27
> 28 int register_react_panic(void)
29 {
30 rv_register_reactor(&rv_panic);
31 return 0;
32 }
33
> 34 void unregister_react_panic(void)
35 {
36 rv_unregister_reactor(&rv_panic);
37 }
38
--
0-DAY CI Kernel Test Service
https://01.org/lkp
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 18/20] rv/monitor: Add safe watchdog monitor
2022-06-16 13:36 ` Guenter Roeck
@ 2022-06-16 15:29 ` Daniel Bristot de Oliveira
[not found] ` <CA+wEVJbvcMZbCroO2_rdVxLvYkUo-ePxCwsp5vbDpoqys4HGWQ@mail.gmail.com>
0 siblings, 1 reply; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-16 15:29 UTC (permalink / raw)
To: Guenter Roeck, Steven Rostedt
Cc: Wim Van Sebroeck, Jonathan Corbet, Ingo Molnar, Thomas Gleixner,
Peter Zijlstra, Will Deacon, Catalin Marinas, Marco Elver,
Dmitry Vyukov, Paul E. McKenney, Shuah Khan, Gabriele Paoloni,
Juri Lelli, Clark Williams, linux-doc, linux-kernel,
linux-trace-devel
Hi Guenter,
On 6/16/22 15:36, Guenter Roeck wrote:
> On 6/16/22 01:45, Daniel Bristot de Oliveira wrote:
>> The watchdog is an essential building block for the usage of Linux in
>> safety-critical systems because it allows the system to be monitored from
>> an external element - the watchdog hardware, acting as a safety-monitor.
>>
>> A user-space application controls the watchdog device via the watchdog
>> interface. This application, hereafter safety_app, enables the watchdog
>> and periodically pets the watchdog upon correct completion of the safety
>> related processing.
>>
>> If the safety_app, for any reason, stops pinging the watchdog,
>> the watchdog hardware can set the system in a fail-safe state. For
>> example, shutting the system down.
>>
>> Given the importance of the safety_app / watchdog hardware couple,
>> the interaction between these software pieces also needs some
>> sort of monitoring. In other words, "who monitors the monitor?"
>>
>> The safe watchdog (safe_wtd) RV monitor monitors the interaction between
>> the safety_app and the watchdog device, enforcing the correct sequence of
>> events that leads the system to a safe state.
>>
>> Furthermore, the safety_app can monitor the RV monitor by collecting the
>> events generated by the RV monitor itself via tracing interface. In this way,
>> closing the monitoring loop with the safety_app.
>>
>> To reach a safe state, the safe_wtd RV monitor requires the
>> safety_app to:
>>
>> - Open the watchdog device
>> - Start the watchdog
>> - Set a timeout
>> - ping at least once
>>
>> The RV monitor also avoids some undesired actions. For example, to have
>> other threads to touch the watchdog.
>>
>> The monitor also has a set of options, enabled via kernel command
>> line/module options. They are:
>>
>> - watchdog_id: the device id to monitor (default 0).
>> - dont_stop: once enabled, do not allow the RV monitor to be stopped
>> (default off);
>> - safe_timeout: define a maximum safe value that an user-space
>> application can set as the watchdog timeout
>> (default unlimited).
>> - check_timeout: After every ping, check if the time left in the
>> watchdog is less than or equal to the last timeout set
>> for the watchdog. It only works for watchdog devices that
>> provide the get_timeleft() function (default off).
>>
>> For further information, please refer to:
>> Documentation/trace/rv/watchdog-monitor.rst
>>
>> The monitor specification was developed together with Gabriele Paoloni,
>> in the context of the Linux Foundation Elisa Project.
>>
>> Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
>> Cc: Guenter Roeck <linux@roeck-us.net>
>> Cc: Jonathan Corbet <corbet@lwn.net>
>> Cc: Steven Rostedt <rostedt@goodmis.org>
>> Cc: Ingo Molnar <mingo@redhat.com>
>> Cc: Thomas Gleixner <tglx@linutronix.de>
>> Cc: Peter Zijlstra <peterz@infradead.org>
>> Cc: Will Deacon <will@kernel.org>
>> Cc: Catalin Marinas <catalin.marinas@arm.com>
>> Cc: Marco Elver <elver@google.com>
>> Cc: Dmitry Vyukov <dvyukov@google.com>
>> Cc: "Paul E. McKenney" <paulmck@kernel.org>
>> Cc: Shuah Khan <skhan@linuxfoundation.org>
>> Cc: Gabriele Paoloni <gpaoloni@redhat.com>
>> Cc: Juri Lelli <juri.lelli@redhat.com>
>> Cc: Clark Williams <williams@redhat.com>
>> Cc: linux-doc@vger.kernel.org
>> Cc: linux-kernel@vger.kernel.org
>> Cc: linux-trace-devel@vger.kernel.org
>> Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
>> ---
>> include/trace/events/rv.h | 11 +
>> kernel/trace/rv/Kconfig | 10 +
>> kernel/trace/rv/Makefile | 1 +
>> kernel/trace/rv/monitors/safe_wtd/safe_wtd.c | 300 +++++++++++++++++++
>> kernel/trace/rv/monitors/safe_wtd/safe_wtd.h | 84 ++++++
>> 5 files changed, 406 insertions(+)
>> create mode 100644 kernel/trace/rv/monitors/safe_wtd/safe_wtd.c
>> create mode 100644 kernel/trace/rv/monitors/safe_wtd/safe_wtd.h
>>
>> diff --git a/include/trace/events/rv.h b/include/trace/events/rv.h
>> index 00f11a8dac3b..895eb3435ed7 100644
>> --- a/include/trace/events/rv.h
>> +++ b/include/trace/events/rv.h
>> @@ -66,6 +66,17 @@ DEFINE_EVENT(error_da_monitor, error_wip,
>> TP_PROTO(char *state, char *event),
>> TP_ARGS(state, event));
>> #endif /* CONFIG_RV_MON_WIP */
>> +
>> +#ifdef CONFIG_RV_MON_SAFE_WTD
>> +DEFINE_EVENT(event_da_monitor, event_safe_wtd,
>> + TP_PROTO(char *state, char *event, char *next_state, bool safe),
>> + TP_ARGS(state, event, next_state, safe));
>> +
>> +DEFINE_EVENT(error_da_monitor, error_safe_wtd,
>> + TP_PROTO(char *state, char *event),
>> + TP_ARGS(state, event));
>> +#endif /* CONFIG_RV_MON_SAFE_WTD */
>> +
>> #endif /* CONFIG_DA_MON_EVENTS_IMPLICIT */
>> #ifdef CONFIG_DA_MON_EVENTS_ID
>> diff --git a/kernel/trace/rv/Kconfig b/kernel/trace/rv/Kconfig
>> index 21f03fb3101a..b14ae63e792b 100644
>> --- a/kernel/trace/rv/Kconfig
>> +++ b/kernel/trace/rv/Kconfig
>> @@ -45,6 +45,16 @@ config RV_MON_WWNR
>> illustrates the usage of per-task monitor. The model is
>> broken on purpose: it serves to test reactors.
>> +config RV_MON_SAFE_WTD
>> + select DA_MON_EVENTS_IMPLICIT
>> + bool "Safety watchdog"
>> + help
>> + Enable safe_wtd, this monitor observes the interaction
>> + between a user-space safety monitor and a watchdog device.
>> +
>> + For futher information see:
>> + Documentation/trace/rv/safety-monitor.rst
>> +
>> config RV_REACTORS
>> bool "Runtime verification reactors"
>> default y if RV
>> diff --git a/kernel/trace/rv/Makefile b/kernel/trace/rv/Makefile
>> index 963d14875b45..904db96c7eae 100644
>> --- a/kernel/trace/rv/Makefile
>> +++ b/kernel/trace/rv/Makefile
>> @@ -3,6 +3,7 @@
>> obj-$(CONFIG_RV) += rv.o
>> obj-$(CONFIG_RV_MON_WIP) += monitors/wip/wip.o
>> obj-$(CONFIG_RV_MON_WWNR) += monitors/wwnr/wwnr.o
>> +obj-$(CONFIG_RV_MON_SAFE_WTD) += monitors/safe_wtd/safe_wtd.o
>> obj-$(CONFIG_RV_REACTORS) += rv_reactors.o
>> obj-$(CONFIG_RV_REACT_PRINTK) += reactor_printk.o
>> obj-$(CONFIG_RV_REACT_PANIC) += reactor_panic.o
>> diff --git a/kernel/trace/rv/monitors/safe_wtd/safe_wtd.c
>> b/kernel/trace/rv/monitors/safe_wtd/safe_wtd.c
>> new file mode 100644
>> index 000000000000..9856e0770d0d
>> --- /dev/null
>> +++ b/kernel/trace/rv/monitors/safe_wtd/safe_wtd.c
>> @@ -0,0 +1,300 @@
>> +// SPDX-License-Identifier: GPL-2.0
>> +#include <linux/ftrace.h>
>> +#include <linux/tracepoint.h>
>> +#include <linux/kernel.h>
>> +#include <linux/module.h>
>> +#include <linux/init.h>
>> +#include <linux/rv.h>
>> +#include <rv/instrumentation.h>
>> +#include <rv/da_monitor.h>
>> +
>> +#include <linux/watchdog.h>
>> +#include <linux/moduleparam.h>
>> +
>> +#include <trace/events/rv.h>
>> +#include <trace/events/watchdog.h>
>> +
>> +#define MODULE_NAME "safe_wtd"
>> +
>> +/*
>> + * This is the self-generated part of the monitor. Generally, there is no need
>> + * to touch this section.
>> + */
>> +#include "safe_wtd.h"
>> +
>> +/*
>> + * Declare the deterministic automata monitor.
>> + *
>> + * The rv monitor reference is needed for the monitor declaration.
>> + */
>> +struct rv_monitor rv_safe_wtd;
>> +DECLARE_DA_MON_GLOBAL(safe_wtd, char);
>> +
>> +/*
>> + * custom: safe_timeout is the maximum value a watchdog monitor
>> + * can set. This value is registered here to duplicate the information.
>> + * In this way, a miss-behaving monitor can be detected.
>> + */
>> +static int safe_timeout = ~0;
>> +module_param(safe_timeout, int, 0444);
>> +
>> +/*
>> + * custom: if check_timeout is set, the monitor will check if the time left
>> + * in the watchdog is less than or equals to the last safe timeout set by
>> + * user-space. This check is done after each ping. In this way, if any
>> + * code by-passed the watchdog dev interface setting a higher (so unsafe)
>> + * timeout, this monitor will catch the side effect and react.
>> + */
>> +static int last_timeout_set = 0;
>> +static int check_timeout = 0;
>> +module_param(check_timeout, int, 0444);
>> +
>> +/*
>> + * custom: if dont_stop is set the monitor will react if stopped.
>> + */
>> +static int dont_stop = 0;
>> +module_param(dont_stop, int, 0444);
>> +
>> +/*
>> + * custom: there are some states that are kept after the watchdog is closed.
>> + * For example, the nowayout state.
>> + *
>> + * Thus, the RV monitor needs to keep track of these states after a start/stop
>> + * of the RV monitor itself, and should not reset after each restart -
>> keeping the
>> + * know state until the system shutdown.
>> + *
>> + * If for an unknown reason an RV monitor would like to reset the RV monitor
>> at each
>> + * RV monitor start, set it to one.
>> + */
>> +static int reset_on_restart = 0;
>> +module_param(reset_on_restart, int, 0444);
>> +
>> +/*
>> + * open_pid takes note of the first thread that opened the watchdog.
>> + *
>> + * Any other thread that generates an event will cause an "other_threads"
>> + * event in the monitor.
>> + */
>> +static int open_pid = 0;
>
> Userspace could open a watchdog, create a child process, and handle it
> from the child. That is perfectly valid.
Right! It is a correct usage of the watchdog subsystem.
However, the idea here is to allow a "restricted" set of operations based on the
safety analysis made by people in the LF Elisa Workgroup (Gabriele Paoloni in Cc:).
One of the specifications says that: only one process should touch the watchdog.
There are details about it in the "watchdog-monitor.rst," section "RV monitor
specification."
There could be another monitor, a less resticted one, in which the operation you
mention would be allowed.
I will complement this commit log in the next version of the patch set,
clarifying that it is not a "full representation of the watchdog operations" but
a restricted set of operations specified by...
>> +
>> +/*
>> + * watchdog_id: the watchdog to monitor
>> + */
>> +static int watchdog_id = 0;
>> +module_param(watchdog_id, int, 0444);
>
> Limiting the watcher to a single watchdog sounds less than perfect.
> What if the system supports more than one, more than one is enabled,
> and the non-monitored watchdog misbehaves ?
I can add one monitor per watchdog dev. The easiest way would be adding a
"struct da_monitor" variable in the watchdog_device structure, e.g.,
struct watchdog_device {
...
#ifdef CONFIG_RV_MON_SAFE_WTD
struct da_monitor da_mon;
#endif
...
}
A simplified version of the the "per task" monitor, in the patch 01, changes in
include/linux/sched.h.
>> +
>> +static void handle_nowayout(void *data, struct watchdog_device *wdd)
>> +{
>> + if (wdd->id != watchdog_id)
>> + return;
>> +
>> + da_handle_init_run_event_safe_wtd(nowayout_safe_wtd);
>> +}
>> +
>> +static void handle_close(void *data, struct watchdog_device *wdd)
>> +{
>> + if (wdd->id != watchdog_id)
>> + return;
>> +
>> + if (open_pid && current->pid != open_pid) {
>> + da_handle_init_run_event_safe_wtd(other_threads_safe_wtd);
>> + } else {
>> + da_handle_event_safe_wtd(close_safe_wtd);
>> + open_pid = 0;
>> + }
>> +}
>> +
>> +static void handle_open(void *data, struct watchdog_device *wdd)
>> +{
>> + if (wdd->id != watchdog_id)
>> + return;
>> +
>> + if (open_pid && current->pid != open_pid) {
>> + da_handle_init_run_event_safe_wtd(other_threads_safe_wtd);
>> + } else {
>> + da_handle_init_run_event_safe_wtd(open_safe_wtd);
>> + open_pid = current->pid;
>> + }
>> +}
>> +
>> +static void blocked_events(void *data, struct watchdog_device *wdd)
>> +{
>> + if (wdd->id != watchdog_id)
>> + return;
>> +
>> + if (open_pid && current->pid != open_pid) {
>> + da_handle_init_run_event_safe_wtd(other_threads_safe_wtd);
>> + return;
>> + }
>> + da_handle_event_safe_wtd(other_threads_safe_wtd);
>> +}
>> +
>> +static void blocked_events_timeout(void *data, struct watchdog_device *wdd,
>> u64 timeout)
>> +{
>> + blocked_events(data, wdd);
>> +}
>> +
>> +static void handle_ping(void *data, struct watchdog_device *wdd)
>> +{
>> + char msg[128];
>> + unsigned int timeout;
>> +
>> + if (wdd->id != watchdog_id)
>> + return;
>> +
>> + if (open_pid && current->pid != open_pid) {
>> + da_handle_init_run_event_safe_wtd(other_threads_safe_wtd);
>> + return;
>> + }
>> +
>> + da_handle_event_safe_wtd(ping_safe_wtd);
>> +
>> + if (!check_timeout)
>> + return;
>> +
>> + if (wdd->ops->get_timeleft) {
>> + timeout = wdd->ops->get_timeleft(wdd);
>> + if (timeout > last_timeout_set) {
>> + snprintf(msg, 128,
>> + "watchdog timeout is %u > than previously set (%d)\n",
>> + timeout, last_timeout_set);
>> + cond_react(msg);
>> + }
>> + } else {
>> + snprintf(msg, 128, "error getting timeout: option not supported\n");
>
> This is not an error. The get_timeleft callback is optional.
Right... but this part of the code is only reachable if the user explicitly
asked to check the timeout (if (!check_timeout)...return before this code).
So, if the user only considers the system safe if the monitor also checks the
written timeout, but the watchdog is one of those that do not have the callback
implemented (which is ok for a Linux watchdog), the monitor captures this
"undesired" behavior.
This monitor is not checking if the watchdog subsystem is correct at its
plenitude, it is checking if the watchdog usage is following a set of
specifications (raised by people in the LF Elisa workgroup).
>> + cond_react(msg);
>> + }
>> +}
>> +
[...]
>> +
>> +struct automaton_safe_wtd automaton_safe_wtd = {
>> + .state_names = {
>> + "init",
>> + "closed_running",
>> + "closed_running_nwo",
>> + "nwo",
>> + "opened",
>> + "opened_nwo",
>> + "reopened",
>> + "safe",
>> + "safe_nwo",
>> + "set",
>> + "set_nwo",
>> + "started",
>> + "started_nwo",
>> + "stoped"
>> + },
>> + .event_names = {
>> + "close",
>> + "nowayout",
>> + "open",
>> + "other_threads",
>> + "ping",
>> + "set_safe_timeout",
>> + "start",
>> + "stop"
>> + },
>> + .function = {
>> + { -1, nwo_safe_wtd, opened_safe_wtd, init_safe_wtd, -1, -1, -1, -1 },
>> + { -1, closed_running_nwo_safe_wtd, reopened_safe_wtd, closed_running_safe_wtd, -1, -1, -1, -1 },
>> + { -1, closed_running_nwo_safe_wtd, started_nwo_safe_wtd, closed_running_nwo_safe_wtd, -1, -1, -1, -1 },
>> + { -1, nwo_safe_wtd, opened_nwo_safe_wtd, nwo_safe_wtd, -1, -1, -1, -1 },
>> + { init_safe_wtd, -1, -1, -1, -1, -1, started_safe_wtd, -1 },
>> + { nwo_safe_wtd, -1, -1, -1, -1, -1, started_nwo_safe_wtd, -1 },
>> + { closed_running_safe_wtd, -1, -1, -1, -1, set_safe_wtd, 1, opened_safe_wtd },
>> + { closed_running_safe_wtd, -1, -1, -1, safe_safe_wtd, -1, 1, stoped_safe_wtd },
>> + { closed_running_nwo_safe_wtd, -1, -1, -1, safe_nwo_safe_wtd, -1, -1, -1 },
>> + { -1, -1, -1, -1, safe_safe_wtd, -1, -1, -1 },
>> + { -1, -1, -1, -1, safe_nwo_safe_wtd, -1, -1, -1 },
>> + { closed_running_safe_wtd, -1, -1, -1, -1, set_safe_wtd, -1, stoped_safe_wtd },
>> + { closed_running_nwo_safe_wtd, -1, -1, -1, -1, set_nwo_safe_wtd, -1, -1 },
>> + { init_safe_wtd, -1, -1, -1, -1, -1, -1, -1 },
>> + },
>> + .initial_state = init_safe_wtd,
>> + .final_states = { 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
>
> I find this event table all but impossible to verify.
It is a matrix. Lines are states, and columns are events.
On a given state/line, receiving a given event/column, the data is the next
state/row.
For instance, let's say "init" (row 0), event "nwo" (column 1), and the next
state is the "nwo" (row 3).
-1 means invalid/blocked state (yeah, maybe it is better to have an #define
INVALID_STATE -1).
This is the C representation of an automaton, following the formal definition of
a deterministic automaton. I've added an explanation of this representation in
the documentation (patch 15, file da_monitor_synthesis.rst).
A deeper look into this subject is here (peer-reviewed conference paper at
Software Engineer and Formal Methods 2019):
https://bristot.me/wp-content/uploads/2019/09/paper.pdf
One could translate it back to the automaton's graphical format... to a format
of by a tool used to analyze automaton properties... that is the good point of
using a well-established formalism. (The bad part is that they are often
boring... c'est la vie :-)).
-- Daniel
>
>> +};
>
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 17/20] watchdog/dev: Add tracepoints
2022-06-16 13:44 ` Guenter Roeck
@ 2022-06-16 15:47 ` Daniel Bristot de Oliveira
2022-06-16 23:55 ` Guenter Roeck
0 siblings, 1 reply; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-16 15:47 UTC (permalink / raw)
To: Guenter Roeck, Steven Rostedt
Cc: Wim Van Sebroeck, Jonathan Corbet, Ingo Molnar, Thomas Gleixner,
Peter Zijlstra, Will Deacon, Catalin Marinas, Marco Elver,
Dmitry Vyukov, Paul E. McKenney, Shuah Khan, Gabriele Paoloni,
Juri Lelli, Clark Williams, linux-doc, linux-kernel,
linux-trace-devel
On 6/16/22 15:44, Guenter Roeck wrote:
> On 6/16/22 01:44, Daniel Bristot de Oliveira wrote:
>> Add a set of tracepoints, enabling the observability of the watchdog
>> device interactions with user-space.
>>
>> The events are:
>> watchdog:watchdog_open
>> watchdog:watchdog_close
>> watchdog:watchdog_start
>> watchdog:watchdog_stop
>> watchdog:watchdog_set_timeout
>> watchdog:watchdog_ping
>> watchdog:watchdog_nowayout
>> watchdog:watchdog_set_keep_alive
>> watchdog:watchdog_keep_alive
>> watchdog:watchdog_set_pretimeout
>> watchdog:watchdog_pretimeout
>>
>> Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
>> Cc: Guenter Roeck <linux@roeck-us.net>
>> Cc: Jonathan Corbet <corbet@lwn.net>
>> Cc: Steven Rostedt <rostedt@goodmis.org>
>> Cc: Ingo Molnar <mingo@redhat.com>
>> Cc: Thomas Gleixner <tglx@linutronix.de>
>> Cc: Peter Zijlstra <peterz@infradead.org>
>> Cc: Will Deacon <will@kernel.org>
>> Cc: Catalin Marinas <catalin.marinas@arm.com>
>> Cc: Marco Elver <elver@google.com>
>> Cc: Dmitry Vyukov <dvyukov@google.com>
>> Cc: "Paul E. McKenney" <paulmck@kernel.org>
>> Cc: Shuah Khan <skhan@linuxfoundation.org>
>> Cc: Gabriele Paoloni <gpaoloni@redhat.com>
>> Cc: Juri Lelli <juri.lelli@redhat.com>
>> Cc: Clark Williams <williams@redhat.com>
>> Cc: linux-doc@vger.kernel.org
>> Cc: linux-kernel@vger.kernel.org
>> Cc: linux-trace-devel@vger.kernel.org
>> Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
>> ---
>> drivers/watchdog/watchdog_dev.c | 43 ++++++++++-
>> drivers/watchdog/watchdog_pretimeout.c | 2 +
>> include/linux/watchdog.h | 7 +-
>> include/trace/events/watchdog.h | 101 +++++++++++++++++++++++++
>> 4 files changed, 143 insertions(+), 10 deletions(-)
>> create mode 100644 include/trace/events/watchdog.h
>>
>> diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
>> index 54903f3c851e..2f28dc5ab763 100644
>> --- a/drivers/watchdog/watchdog_dev.c
>> +++ b/drivers/watchdog/watchdog_dev.c
>> @@ -44,6 +44,9 @@
>> #include <linux/watchdog.h> /* For watchdog specific items */
>> #include <linux/uaccess.h> /* For copy_to_user/put_user/... */
>> +#define CREATE_TRACE_POINTS
>> +#include <trace/events/watchdog.h>
>> +
>> #include "watchdog_core.h"
>> #include "watchdog_pretimeout.h"
>> @@ -130,9 +133,11 @@ static inline void watchdog_update_worker(struct
>> watchdog_device *wdd)
>> if (watchdog_need_worker(wdd)) {
>> ktime_t t = watchdog_next_keepalive(wdd);
>> - if (t > 0)
>> + if (t > 0) {
>> hrtimer_start(&wd_data->timer, t,
>> HRTIMER_MODE_REL_HARD);
>> + trace_watchdog_set_keep_alive(wdd, ktime_to_ms(t));
>> + }
>> } else {
>> hrtimer_cancel(&wd_data->timer);
>> }
>> @@ -141,7 +146,7 @@ static inline void watchdog_update_worker(struct
>> watchdog_device *wdd)
>> static int __watchdog_ping(struct watchdog_device *wdd)
>> {
>> struct watchdog_core_data *wd_data = wdd->wd_data;
>> - ktime_t earliest_keepalive, now;
>> + ktime_t earliest_keepalive, now, next_keepalive;
>> int err;
>> earliest_keepalive = ktime_add(wd_data->last_hw_keepalive,
>> @@ -149,14 +154,16 @@ static int __watchdog_ping(struct watchdog_device *wdd)
>> now = ktime_get();
>> if (ktime_after(earliest_keepalive, now)) {
>> - hrtimer_start(&wd_data->timer,
>> - ktime_sub(earliest_keepalive, now),
>> + next_keepalive = ktime_sub(earliest_keepalive, now);
>> + hrtimer_start(&wd_data->timer, next_keepalive,
>> HRTIMER_MODE_REL_HARD);
>> + trace_watchdog_set_keep_alive(wdd, ktime_to_ms(next_keepalive));
>> return 0;
>> }
>> wd_data->last_hw_keepalive = now;
>> + trace_watchdog_ping(wdd);
>> if (wdd->ops->ping)
>> err = wdd->ops->ping(wdd); /* ping the watchdog */
>> else
>> @@ -215,6 +222,7 @@ static void watchdog_ping_work(struct kthread_work *work)
>> wd_data = container_of(work, struct watchdog_core_data, work);
>> mutex_lock(&wd_data->lock);
>> + trace_watchdog_keep_alive(wd_data->wdd);
>> if (watchdog_worker_should_ping(wd_data))
>> __watchdog_ping(wd_data->wdd);
>> mutex_unlock(&wd_data->lock);
>> @@ -250,6 +258,8 @@ static int watchdog_start(struct watchdog_device *wdd)
>> set_bit(_WDOG_KEEPALIVE, &wd_data->status);
>> + trace_watchdog_start(wdd);
>> +
>> started_at = ktime_get();
>> if (watchdog_hw_running(wdd) && wdd->ops->ping) {
>> err = __watchdog_ping(wdd);
>> @@ -294,6 +304,7 @@ static int watchdog_stop(struct watchdog_device *wdd)
>> return -EBUSY;
>> }
>> + trace_watchdog_stop(wdd);
>> if (wdd->ops->stop) {
>> clear_bit(WDOG_HW_RUNNING, &wdd->status);
>> err = wdd->ops->stop(wdd);
>> @@ -367,6 +378,7 @@ static int watchdog_set_timeout(struct watchdog_device *wdd,
>> if (watchdog_timeout_invalid(wdd, timeout))
>> return -EINVAL;
>> + trace_watchdog_set_timeout(wdd, timeout);
>
> The driver has no obligation to set the timeout to the
> requested value. It might be more valuable to report both
> the requested and the actual values.
>
>
Ack! how do I get the actual value?
>> if (wdd->ops->set_timeout) {
>> err = wdd->ops->set_timeout(wdd, timeout);
>> } else {
>> @@ -399,6 +411,8 @@ static int watchdog_set_pretimeout(struct watchdog_device
>> *wdd,
>> if (watchdog_pretimeout_invalid(wdd, timeout))
>> return -EINVAL;
>> + trace_watchdog_set_pretimeout(wdd, timeout);
>> +
>
> Again, the driver has no obligation to set the timeout to the
> requested value.
/me takes note.
>
>> if (wdd->ops->set_pretimeout && (wdd->info->options & WDIOF_PRETIMEOUT))
>> err = wdd->ops->set_pretimeout(wdd, timeout);
>> else
>> @@ -430,6 +444,23 @@ static int watchdog_get_timeleft(struct watchdog_device
>> *wdd,
>> return 0;
>> }
>> +/**
>> + * watchdog_set_nowayout - set nowaout bit
>> + * @wdd: The watchdog device to set nowayoutbit
>> + * @nowayout A boolean on/off switcher
>> + *
>> + * If nowayout boolean is true, the nowayout option is set. No action is
>> + * taken if nowayout is false.
>> + */
>> +void watchdog_set_nowayout(struct watchdog_device *wdd, bool nowayout)
>> +{
>> + if (nowayout) {
>> + set_bit(WDOG_NO_WAY_OUT, &wdd->status);
>> + trace_watchdog_nowayout(wdd);
>> + }
>> +}
>> +EXPORT_SYMBOL(watchdog_set_nowayout);
>> +
>> #ifdef CONFIG_WATCHDOG_SYSFS
>> static ssize_t nowayout_show(struct device *dev, struct device_attribute *attr,
>> char *buf)
>> @@ -861,6 +892,8 @@ static int watchdog_open(struct inode *inode, struct file
>> *file)
>> goto out_clear;
>> }
>> + trace_watchdog_open(wdd);
>> +
>> err = watchdog_start(wdd);
>> if (err < 0)
>> goto out_mod;
>> @@ -883,6 +916,7 @@ static int watchdog_open(struct inode *inode, struct file
>> *file)
>> return stream_open(inode, file);
>> out_mod:
>> + trace_watchdog_close(wdd);
>> module_put(wd_data->wdd->ops->owner);
>> out_clear:
>> clear_bit(_WDOG_DEV_OPEN, &wd_data->status);
>> @@ -944,6 +978,7 @@ static int watchdog_release(struct inode *inode, struct
>> file *file)
>> /* make sure that /dev/watchdog can be re-opened */
>> clear_bit(_WDOG_DEV_OPEN, &wd_data->status);
>> + trace_watchdog_close(wdd);
>> done:
>> running = wdd && watchdog_hw_running(wdd);
>> mutex_unlock(&wd_data->lock);
>> diff --git a/drivers/watchdog/watchdog_pretimeout.c
>> b/drivers/watchdog/watchdog_pretimeout.c
>> index 376a495ab80c..58c391ed2205 100644
>> --- a/drivers/watchdog/watchdog_pretimeout.c
>> +++ b/drivers/watchdog/watchdog_pretimeout.c
>> @@ -8,6 +8,7 @@
>> #include <linux/spinlock.h>
>> #include <linux/string.h>
>> #include <linux/watchdog.h>
>> +#include <trace/events/watchdog.h>
>> #include "watchdog_core.h"
>> #include "watchdog_pretimeout.h"
>> @@ -107,6 +108,7 @@ void watchdog_notify_pretimeout(struct watchdog_device *wdd)
>> return;
>> }
>> + trace_watchdog_pretimeout(wdd);
>> wdd->gov->pretimeout(wdd);
>> spin_unlock_irqrestore(&pretimeout_lock, flags);
>> }
>> diff --git a/include/linux/watchdog.h b/include/linux/watchdog.h
>> index 99660197a36c..11d93407e492 100644
>> --- a/include/linux/watchdog.h
>> +++ b/include/linux/watchdog.h
>> @@ -139,12 +139,7 @@ static inline bool watchdog_hw_running(struct
>> watchdog_device *wdd)
>> return test_bit(WDOG_HW_RUNNING, &wdd->status);
>> }
>> -/* Use the following function to set the nowayout feature */
>> -static inline void watchdog_set_nowayout(struct watchdog_device *wdd, bool
>> nowayout)
>> -{
>> - if (nowayout)
>> - set_bit(WDOG_NO_WAY_OUT, &wdd->status);
>> -}
>> +void watchdog_set_nowayout(struct watchdog_device *wdd, bool nowayout);
>> /* Use the following function to stop the watchdog on reboot */
>> static inline void watchdog_stop_on_reboot(struct watchdog_device *wdd)
>> diff --git a/include/trace/events/watchdog.h b/include/trace/events/watchdog.h
>> new file mode 100644
>> index 000000000000..145cd6cfaa02
>> --- /dev/null
>> +++ b/include/trace/events/watchdog.h
>> @@ -0,0 +1,101 @@
>> +/* SPDX-License-Identifier: GPL-2.0 */
>> +#undef TRACE_SYSTEM
>> +#define TRACE_SYSTEM watchdog
>> +
>> +#if !defined(_TRACE_WATCHDOG_H) || defined(TRACE_HEADER_MULTI_READ)
>> +#define _TRACE_WATCHDOG_H
>> +
>> +#include <linux/tracepoint.h>
>> +
>> +/*
>> + * These are all events whose sole argument is the watchdog id.
>> + */
>> +DECLARE_EVENT_CLASS(dev_operations_template,
>> +
>> + TP_PROTO(struct watchdog_device *wdd),
>> +
>> + TP_ARGS(wdd),
>> +
>> + TP_STRUCT__entry(
>> + __field(__u32, id)
>> + ),
>> +
>> + TP_fast_assign(
>> + __entry->id = wdd->id;
>> + ),
>> +
>> + TP_printk("id=%d",
>> + __entry->id)
>> +);
>> +
>> +DEFINE_EVENT(dev_operations_template, watchdog_open,
>> + TP_PROTO(struct watchdog_device *wdd),
>> + TP_ARGS(wdd));
>> +
>> +DEFINE_EVENT(dev_operations_template, watchdog_close,
>> + TP_PROTO(struct watchdog_device *wdd),
>> + TP_ARGS(wdd));
>> +
>> +DEFINE_EVENT(dev_operations_template, watchdog_start,
>> + TP_PROTO(struct watchdog_device *wdd),
>> + TP_ARGS(wdd));
>> +
>> +DEFINE_EVENT(dev_operations_template, watchdog_stop,
>> + TP_PROTO(struct watchdog_device *wdd),
>> + TP_ARGS(wdd));
>> +
>> +DEFINE_EVENT(dev_operations_template, watchdog_ping,
>> + TP_PROTO(struct watchdog_device *wdd),
>> + TP_ARGS(wdd));
>> +
>> +DEFINE_EVENT(dev_operations_template, watchdog_nowayout,
>> + TP_PROTO(struct watchdog_device *wdd),
>> + TP_ARGS(wdd));
>> +
>> +DEFINE_EVENT(dev_operations_template, watchdog_keep_alive,
>> + TP_PROTO(struct watchdog_device *wdd),
>> + TP_ARGS(wdd));
>> +
>> +DEFINE_EVENT(dev_operations_template, watchdog_pretimeout,
>> + TP_PROTO(struct watchdog_device *wdd),
>> + TP_ARGS(wdd));
>> +
>> +/*
>> + * These are all events with a device ID and a given timeout.
>> + */
>> +DECLARE_EVENT_CLASS(watchdog_timeout_template,
>> +
>> + TP_PROTO(struct watchdog_device *wdd, u64 timeout),
>> +
>> + TP_ARGS(wdd, timeout),
>> +
>> + TP_STRUCT__entry(
>> + __field(__u32, id)
>> + __field(__u64, timeout)
>
>
> Why u64 ? timeout is unsigned long.
ack! I will change it. (I am seeing unsigned int, am I missing something?).
Thanks!
-- Daniel
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 18/20] rv/monitor: Add safe watchdog monitor
2022-06-16 8:45 ` [PATCH V4 18/20] rv/monitor: Add safe watchdog monitor Daniel Bristot de Oliveira
2022-06-16 13:36 ` Guenter Roeck
@ 2022-06-16 20:57 ` Randy Dunlap
2022-06-17 16:17 ` Daniel Bristot de Oliveira
2022-07-13 19:13 ` Daniel Bristot de Oliveira
2 siblings, 1 reply; 82+ messages in thread
From: Randy Dunlap @ 2022-06-16 20:57 UTC (permalink / raw)
To: Daniel Bristot de Oliveira, Steven Rostedt
Cc: Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet, Ingo Molnar,
Thomas Gleixner, Peter Zijlstra, Will Deacon, Catalin Marinas,
Marco Elver, Dmitry Vyukov, Paul E. McKenney, Shuah Khan,
Gabriele Paoloni, Juri Lelli, Clark Williams, linux-doc,
linux-kernel, linux-trace-devel
Hi--
On 6/16/22 01:45, Daniel Bristot de Oliveira wrote:
> diff --git a/kernel/trace/rv/Kconfig b/kernel/trace/rv/Kconfig
> index 21f03fb3101a..b14ae63e792b 100644
> --- a/kernel/trace/rv/Kconfig
> +++ b/kernel/trace/rv/Kconfig
> @@ -45,6 +45,16 @@ config RV_MON_WWNR
> illustrates the usage of per-task monitor. The model is
> broken on purpose: it serves to test reactors.
>
> +config RV_MON_SAFE_WTD
> + select DA_MON_EVENTS_IMPLICIT
> + bool "Safety watchdog"
> + help
> + Enable safe_wtd, this monitor observes the interaction
> + between a user-space safety monitor and a watchdog device.
> +
> + For futher information see:
> + Documentation/trace/rv/safety-monitor.rst
I'm curious about what "WTD" means.
I see lots of WDT in drivers/watchdog/Kconfig
(where it means WatchDog Timer AFAIK).
thanks.
--
~Randy
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 09/20] rv/monitor: wip instrumentation and Makefile/Kconfig entries
2022-06-16 8:44 ` [PATCH V4 09/20] rv/monitor: wip instrumentation and Makefile/Kconfig entries Daniel Bristot de Oliveira
2022-06-16 11:21 ` kernel test robot
@ 2022-06-16 21:00 ` Randy Dunlap
2022-06-17 16:07 ` Daniel Bristot de Oliveira
2022-06-28 19:02 ` Steven Rostedt
1 sibling, 2 replies; 82+ messages in thread
From: Randy Dunlap @ 2022-06-16 21:00 UTC (permalink / raw)
To: Daniel Bristot de Oliveira, Steven Rostedt
Cc: Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet, Ingo Molnar,
Thomas Gleixner, Peter Zijlstra, Will Deacon, Catalin Marinas,
Marco Elver, Dmitry Vyukov, Paul E. McKenney, Shuah Khan,
Gabriele Paoloni, Juri Lelli, Clark Williams, linux-doc,
linux-kernel, linux-trace-devel
On 6/16/22 01:44, Daniel Bristot de Oliveira wrote:
> diff --git a/kernel/trace/rv/Kconfig b/kernel/trace/rv/Kconfig
> index 1eafb5adcfcb..e9246b0bec9d 100644
> --- a/kernel/trace/rv/Kconfig
> +++ b/kernel/trace/rv/Kconfig
> @@ -26,6 +26,13 @@ menuconfig RV
> the system behavior.
>
> if RV
> +config RV_MON_WIP
> + depends on PREEMPTIRQ_TRACEPOINTS
> + select DA_MON_EVENTS_IMPLICIT
> + bool "WIP monitor"
Does WIP mean work-in-progress? (It does to me.)
If not, please explain what it means in the help text.
> + help
> + Enable WIP sample monitor, this is a sample monitor that
> + illustrates the usage of per-cpu monitors.
thanks.
--
~Randy
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 13/20] rv/reactor: Add the panic reactor
2022-06-16 8:44 ` [PATCH V4 13/20] rv/reactor: Add the panic reactor Daniel Bristot de Oliveira
2022-06-16 15:20 ` kernel test robot
@ 2022-06-16 21:03 ` Randy Dunlap
2022-06-17 16:09 ` Daniel Bristot de Oliveira
2022-07-13 18:47 ` Daniel Bristot de Oliveira
2022-06-28 19:06 ` Steven Rostedt
2 siblings, 2 replies; 82+ messages in thread
From: Randy Dunlap @ 2022-06-16 21:03 UTC (permalink / raw)
To: Daniel Bristot de Oliveira, Steven Rostedt
Cc: Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet, Ingo Molnar,
Thomas Gleixner, Peter Zijlstra, Will Deacon, Catalin Marinas,
Marco Elver, Dmitry Vyukov, Paul E. McKenney, Shuah Khan,
Gabriele Paoloni, Juri Lelli, Clark Williams, linux-doc,
linux-kernel, linux-trace-devel
On 6/16/22 01:44, Daniel Bristot de Oliveira wrote:
> diff --git a/kernel/trace/rv/Kconfig b/kernel/trace/rv/Kconfig
> index be8e3dab0a52..91a17b13a080 100644
> --- a/kernel/trace/rv/Kconfig
> +++ b/kernel/trace/rv/Kconfig
> @@ -60,4 +60,12 @@ config RV_REACT_PRINTK
> Enables the printk reactor. The printk reactor emmits a printk()
emits
> message if an exception is found.
>
> +config RV_REACT_PANIC
> + bool "Panic reactor"
> + depends on RV_REACTORS
> + default y if RV_REACTORS
> + help
> + Enables the panic reactor. The panic reactor emmits a printk()
emits
> + message if an exception is found and panic()s the system.
--
~Randy
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 18/20] rv/monitor: Add safe watchdog monitor
[not found] ` <CA+wEVJbvcMZbCroO2_rdVxLvYkUo-ePxCwsp5vbDpoqys4HGWQ@mail.gmail.com>
@ 2022-06-16 23:53 ` Guenter Roeck
2022-06-17 17:06 ` Daniel Bristot de Oliveira
2022-06-28 19:32 ` Steven Rostedt
0 siblings, 2 replies; 82+ messages in thread
From: Guenter Roeck @ 2022-06-16 23:53 UTC (permalink / raw)
To: Gabriele Paoloni, Daniel Bristot de Oliveira
Cc: Steven Rostedt, Wim Van Sebroeck, Jonathan Corbet, Ingo Molnar,
Thomas Gleixner, Peter Zijlstra, Will Deacon, Catalin Marinas,
Marco Elver, Dmitry Vyukov, Paul E. McKenney, Shuah Khan,
Juri Lelli, Clark Williams, open list:DOCUMENTATION,
Linux Kernel Mailing List, linux-trace-devel
On 6/16/22 08:43, Gabriele Paoloni wrote:
>
>
> On Thu, Jun 16, 2022 at 5:29 PM Daniel Bristot de Oliveira <bristot@kernel.org <mailto:bristot@kernel.org>> wrote:
>
> Hi Guenter,
>
> On 6/16/22 15:36, Guenter Roeck wrote:
> > On 6/16/22 01:45, Daniel Bristot de Oliveira wrote:
> >> The watchdog is an essential building block for the usage of Linux in
> >> safety-critical systems because it allows the system to be monitored from
> >> an external element - the watchdog hardware, acting as a safety-monitor.
> >>
> >> A user-space application controls the watchdog device via the watchdog
> >> interface. This application, hereafter safety_app, enables the watchdog
> >> and periodically pets the watchdog upon correct completion of the safety
> >> related processing.
> >>
> >> If the safety_app, for any reason, stops pinging the watchdog,
> >> the watchdog hardware can set the system in a fail-safe state. For
> >> example, shutting the system down.
> >>
> >> Given the importance of the safety_app / watchdog hardware couple,
> >> the interaction between these software pieces also needs some
> >> sort of monitoring. In other words, "who monitors the monitor?"
> >>
> >> The safe watchdog (safe_wtd) RV monitor monitors the interaction between
> >> the safety_app and the watchdog device, enforcing the correct sequence of
> >> events that leads the system to a safe state.
> >>
> >> Furthermore, the safety_app can monitor the RV monitor by collecting the
> >> events generated by the RV monitor itself via tracing interface. In this way,
> >> closing the monitoring loop with the safety_app.
> >>
> >> To reach a safe state, the safe_wtd RV monitor requires the
> >> safety_app to:
> >>
> >> - Open the watchdog device
> >> - Start the watchdog
> >> - Set a timeout
> >> - ping at least once
> >>
> >> The RV monitor also avoids some undesired actions. For example, to have
> >> other threads to touch the watchdog.
> >>
> >> The monitor also has a set of options, enabled via kernel command
> >> line/module options. They are:
> >>
> >> - watchdog_id: the device id to monitor (default 0).
> >> - dont_stop: once enabled, do not allow the RV monitor to be stopped
> >> (default off);
> >> - safe_timeout: define a maximum safe value that an user-space
> >> application can set as the watchdog timeout
> >> (default unlimited).
> >> - check_timeout: After every ping, check if the time left in the
> >> watchdog is less than or equal to the last timeout set
> >> for the watchdog. It only works for watchdog devices that
> >> provide the get_timeleft() function (default off).
> >>
> >> For further information, please refer to:
> >> Documentation/trace/rv/watchdog-monitor.rst
> >>
> >> The monitor specification was developed together with Gabriele Paoloni,
> >> in the context of the Linux Foundation Elisa Project.
> >>
> >> Cc: Wim Van Sebroeck <wim@linux-watchdog.org <mailto:wim@linux-watchdog.org>>
> >> Cc: Guenter Roeck <linux@roeck-us.net <mailto:linux@roeck-us.net>>
> >> Cc: Jonathan Corbet <corbet@lwn.net <mailto:corbet@lwn.net>>
> >> Cc: Steven Rostedt <rostedt@goodmis.org <mailto:rostedt@goodmis.org>>
> >> Cc: Ingo Molnar <mingo@redhat.com <mailto:mingo@redhat.com>>
> >> Cc: Thomas Gleixner <tglx@linutronix.de <mailto:tglx@linutronix.de>>
> >> Cc: Peter Zijlstra <peterz@infradead.org <mailto:peterz@infradead.org>>
> >> Cc: Will Deacon <will@kernel.org <mailto:will@kernel.org>>
> >> Cc: Catalin Marinas <catalin.marinas@arm.com <mailto:catalin.marinas@arm.com>>
> >> Cc: Marco Elver <elver@google.com <mailto:elver@google.com>>
> >> Cc: Dmitry Vyukov <dvyukov@google.com <mailto:dvyukov@google.com>>
> >> Cc: "Paul E. McKenney" <paulmck@kernel.org <mailto:paulmck@kernel.org>>
> >> Cc: Shuah Khan <skhan@linuxfoundation.org <mailto:skhan@linuxfoundation.org>>
> >> Cc: Gabriele Paoloni <gpaoloni@redhat.com <mailto:gpaoloni@redhat.com>>
> >> Cc: Juri Lelli <juri.lelli@redhat.com <mailto:juri.lelli@redhat.com>>
> >> Cc: Clark Williams <williams@redhat.com <mailto:williams@redhat.com>>
> >> Cc: linux-doc@vger.kernel.org <mailto:linux-doc@vger.kernel.org>
> >> Cc: linux-kernel@vger.kernel.org <mailto:linux-kernel@vger.kernel.org>
> >> Cc: linux-trace-devel@vger.kernel.org <mailto:linux-trace-devel@vger.kernel.org>
> >> Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org <mailto:bristot@kernel.org>>
> >> ---
> >> include/trace/events/rv.h | 11 +
> >> kernel/trace/rv/Kconfig | 10 +
> >> kernel/trace/rv/Makefile | 1 +
> >> kernel/trace/rv/monitors/safe_wtd/safe_wtd.c | 300 +++++++++++++++++++
> >> kernel/trace/rv/monitors/safe_wtd/safe_wtd.h | 84 ++++++
> >> 5 files changed, 406 insertions(+)
> >> create mode 100644 kernel/trace/rv/monitors/safe_wtd/safe_wtd.c
> >> create mode 100644 kernel/trace/rv/monitors/safe_wtd/safe_wtd.h
> >>
> >> diff --git a/include/trace/events/rv.h b/include/trace/events/rv.h
> >> index 00f11a8dac3b..895eb3435ed7 100644
> >> --- a/include/trace/events/rv.h
> >> +++ b/include/trace/events/rv.h
> >> @@ -66,6 +66,17 @@ DEFINE_EVENT(error_da_monitor, error_wip,
> >> TP_PROTO(char *state, char *event),
> >> TP_ARGS(state, event));
> >> #endif /* CONFIG_RV_MON_WIP */
> >> +
> >> +#ifdef CONFIG_RV_MON_SAFE_WTD
> >> +DEFINE_EVENT(event_da_monitor, event_safe_wtd,
> >> + TP_PROTO(char *state, char *event, char *next_state, bool safe),
> >> + TP_ARGS(state, event, next_state, safe));
> >> +
> >> +DEFINE_EVENT(error_da_monitor, error_safe_wtd,
> >> + TP_PROTO(char *state, char *event),
> >> + TP_ARGS(state, event));
> >> +#endif /* CONFIG_RV_MON_SAFE_WTD */
> >> +
> >> #endif /* CONFIG_DA_MON_EVENTS_IMPLICIT */
> >> #ifdef CONFIG_DA_MON_EVENTS_ID
> >> diff --git a/kernel/trace/rv/Kconfig b/kernel/trace/rv/Kconfig
> >> index 21f03fb3101a..b14ae63e792b 100644
> >> --- a/kernel/trace/rv/Kconfig
> >> +++ b/kernel/trace/rv/Kconfig
> >> @@ -45,6 +45,16 @@ config RV_MON_WWNR
> >> illustrates the usage of per-task monitor. The model is
> >> broken on purpose: it serves to test reactors.
> >> +config RV_MON_SAFE_WTD
> >> + select DA_MON_EVENTS_IMPLICIT
> >> + bool "Safety watchdog"
> >> + help
> >> + Enable safe_wtd, this monitor observes the interaction
> >> + between a user-space safety monitor and a watchdog device.
> >> +
> >> + For futher information see:
> >> + Documentation/trace/rv/safety-monitor.rst
> >> +
> >> config RV_REACTORS
> >> bool "Runtime verification reactors"
> >> default y if RV
> >> diff --git a/kernel/trace/rv/Makefile b/kernel/trace/rv/Makefile
> >> index 963d14875b45..904db96c7eae 100644
> >> --- a/kernel/trace/rv/Makefile
> >> +++ b/kernel/trace/rv/Makefile
> >> @@ -3,6 +3,7 @@
> >> obj-$(CONFIG_RV) += rv.o
> >> obj-$(CONFIG_RV_MON_WIP) += monitors/wip/wip.o
> >> obj-$(CONFIG_RV_MON_WWNR) += monitors/wwnr/wwnr.o
> >> +obj-$(CONFIG_RV_MON_SAFE_WTD) += monitors/safe_wtd/safe_wtd.o
> >> obj-$(CONFIG_RV_REACTORS) += rv_reactors.o
> >> obj-$(CONFIG_RV_REACT_PRINTK) += reactor_printk.o
> >> obj-$(CONFIG_RV_REACT_PANIC) += reactor_panic.o
> >> diff --git a/kernel/trace/rv/monitors/safe_wtd/safe_wtd.c
> >> b/kernel/trace/rv/monitors/safe_wtd/safe_wtd.c
> >> new file mode 100644
> >> index 000000000000..9856e0770d0d
> >> --- /dev/null
> >> +++ b/kernel/trace/rv/monitors/safe_wtd/safe_wtd.c
> >> @@ -0,0 +1,300 @@
> >> +// SPDX-License-Identifier: GPL-2.0
> >> +#include <linux/ftrace.h>
> >> +#include <linux/tracepoint.h>
> >> +#include <linux/kernel.h>
> >> +#include <linux/module.h>
> >> +#include <linux/init.h>
> >> +#include <linux/rv.h>
> >> +#include <rv/instrumentation.h>
> >> +#include <rv/da_monitor.h>
> >> +
> >> +#include <linux/watchdog.h>
> >> +#include <linux/moduleparam.h>
> >> +
> >> +#include <trace/events/rv.h>
> >> +#include <trace/events/watchdog.h>
> >> +
> >> +#define MODULE_NAME "safe_wtd"
> >> +
> >> +/*
> >> + * This is the self-generated part of the monitor. Generally, there is no need
> >> + * to touch this section.
> >> + */
> >> +#include "safe_wtd.h"
> >> +
> >> +/*
> >> + * Declare the deterministic automata monitor.
> >> + *
> >> + * The rv monitor reference is needed for the monitor declaration.
> >> + */
> >> +struct rv_monitor rv_safe_wtd;
> >> +DECLARE_DA_MON_GLOBAL(safe_wtd, char);
> >> +
> >> +/*
> >> + * custom: safe_timeout is the maximum value a watchdog monitor
> >> + * can set. This value is registered here to duplicate the information.
> >> + * In this way, a miss-behaving monitor can be detected.
> >> + */
> >> +static int safe_timeout = ~0;
> >> +module_param(safe_timeout, int, 0444);
> >> +
> >> +/*
> >> + * custom: if check_timeout is set, the monitor will check if the time left
> >> + * in the watchdog is less than or equals to the last safe timeout set by
> >> + * user-space. This check is done after each ping. In this way, if any
> >> + * code by-passed the watchdog dev interface setting a higher (so unsafe)
> >> + * timeout, this monitor will catch the side effect and react.
> >> + */
> >> +static int last_timeout_set = 0;
> >> +static int check_timeout = 0;
> >> +module_param(check_timeout, int, 0444);
> >> +
> >> +/*
> >> + * custom: if dont_stop is set the monitor will react if stopped.
> >> + */
> >> +static int dont_stop = 0;
> >> +module_param(dont_stop, int, 0444);
> >> +
> >> +/*
> >> + * custom: there are some states that are kept after the watchdog is closed.
> >> + * For example, the nowayout state.
> >> + *
> >> + * Thus, the RV monitor needs to keep track of these states after a start/stop
> >> + * of the RV monitor itself, and should not reset after each restart -
> >> keeping the
> >> + * know state until the system shutdown.
> >> + *
> >> + * If for an unknown reason an RV monitor would like to reset the RV monitor
> >> at each
> >> + * RV monitor start, set it to one.
> >> + */
> >> +static int reset_on_restart = 0;
> >> +module_param(reset_on_restart, int, 0444);
> >> +
> >> +/*
> >> + * open_pid takes note of the first thread that opened the watchdog.
> >> + *
> >> + * Any other thread that generates an event will cause an "other_threads"
> >> + * event in the monitor.
> >> + */
> >> +static int open_pid = 0;
> >
> > Userspace could open a watchdog, create a child process, and handle it
> > from the child. That is perfectly valid.
>
> Right! It is a correct usage of the watchdog subsystem.
>
> However, the idea here is to allow a "restricted" set of operations based on the
> safety analysis made by people in the LF Elisa Workgroup (Gabriele Paoloni in Cc:).
>
>
> Yes this is correct. This model represents the instance of a specific monitor
> resulting from a specific use case that was analysed in ELISA. From my
> understanding nothing prevents extending the monitor to a more complex
> model in the future that may eventually result in a group of allowed
> processes for the WTD manipulation...
>
> Kind Regards
> Gab
>
>
> One of the specifications says that: only one process should touch the watchdog.
>
> There are details about it in the "watchdog-monitor.rst," section "RV monitor
> specification."
>
> There could be another monitor, a less resticted one, in which the operation you
> mention would be allowed.
>
> I will complement this commit log in the next version of the patch set,
> clarifying that it is not a "full representation of the watchdog operations" but
> a restricted set of operations specified by...
>
> >> +
> >> +/*
> >> + * watchdog_id: the watchdog to monitor
> >> + */
> >> +static int watchdog_id = 0;
> >> +module_param(watchdog_id, int, 0444);
> >
> > Limiting the watcher to a single watchdog sounds less than perfect.
> > What if the system supports more than one, more than one is enabled,
> > and the non-monitored watchdog misbehaves ?
>
> I can add one monitor per watchdog dev. The easiest way would be adding a
> "struct da_monitor" variable in the watchdog_device structure, e.g.,
>
> struct watchdog_device {
> ...
> #ifdef CONFIG_RV_MON_SAFE_WTD
> struct da_monitor da_mon;
> #endif
> ...
> }
>
In my opinion shis should be dynamically allocated and not waste space in driver
code if unused.
> A simplified version of the the "per task" monitor, in the patch 01, changes in
> include/linux/sched.h.
>
> >> +
> >> +static void handle_nowayout(void *data, struct watchdog_device *wdd)
> >> +{
> >> + if (wdd->id != watchdog_id)
> >> + return;
> >> +
> >> + da_handle_init_run_event_safe_wtd(nowayout_safe_wtd);
> >> +}
> >> +
> >> +static void handle_close(void *data, struct watchdog_device *wdd)
> >> +{
> >> + if (wdd->id != watchdog_id)
> >> + return;
> >> +
> >> + if (open_pid && current->pid != open_pid) {
> >> + da_handle_init_run_event_safe_wtd(other_threads_safe_wtd);
> >> + } else {
> >> + da_handle_event_safe_wtd(close_safe_wtd);
> >> + open_pid = 0;
> >> + }
> >> +}
> >> +
> >> +static void handle_open(void *data, struct watchdog_device *wdd)
> >> +{
> >> + if (wdd->id != watchdog_id)
> >> + return;
> >> +
> >> + if (open_pid && current->pid != open_pid) {
> >> + da_handle_init_run_event_safe_wtd(other_threads_safe_wtd);
> >> + } else {
> >> + da_handle_init_run_event_safe_wtd(open_safe_wtd);
> >> + open_pid = current->pid;
> >> + }
> >> +}
> >> +
> >> +static void blocked_events(void *data, struct watchdog_device *wdd)
> >> +{
> >> + if (wdd->id != watchdog_id)
> >> + return;
> >> +
> >> + if (open_pid && current->pid != open_pid) {
> >> + da_handle_init_run_event_safe_wtd(other_threads_safe_wtd);
> >> + return;
> >> + }
> >> + da_handle_event_safe_wtd(other_threads_safe_wtd);
> >> +}
> >> +
> >> +static void blocked_events_timeout(void *data, struct watchdog_device *wdd,
> >> u64 timeout)
> >> +{
> >> + blocked_events(data, wdd);
> >> +}
> >> +
> >> +static void handle_ping(void *data, struct watchdog_device *wdd)
> >> +{
> >> + char msg[128];
> >> + unsigned int timeout;
> >> +
> >> + if (wdd->id != watchdog_id)
> >> + return;
> >> +
> >> + if (open_pid && current->pid != open_pid) {
> >> + da_handle_init_run_event_safe_wtd(other_threads_safe_wtd);
> >> + return;
> >> + }
> >> +
> >> + da_handle_event_safe_wtd(ping_safe_wtd);
> >> +
> >> + if (!check_timeout)
> >> + return;
> >> +
> >> + if (wdd->ops->get_timeleft) {
> >> + timeout = wdd->ops->get_timeleft(wdd);
> >> + if (timeout > last_timeout_set) {
> >> + snprintf(msg, 128,
> >> + "watchdog timeout is %u > than previously set (%d)\n",
> >> + timeout, last_timeout_set);
> >> + cond_react(msg);
> >> + }
> >> + } else {
> >> + snprintf(msg, 128, "error getting timeout: option not supported\n");
> >
> > This is not an error. The get_timeleft callback is optional.
>
> Right... but this part of the code is only reachable if the user explicitly
> asked to check the timeout (if (!check_timeout)...return before this code).
>
> So, if the user only considers the system safe if the monitor also checks the
> written timeout, but the watchdog is one of those that do not have the callback
> implemented (which is ok for a Linux watchdog), the monitor captures this
> "undesired" behavior.
>
> This monitor is not checking if the watchdog subsystem is correct at its
> plenitude, it is checking if the watchdog usage is following a set of
> specifications (raised by people in the LF Elisa workgroup).
>
The kernel is not intended for special use cases. The callback is optional,
period. The test for check_timeout is way too late. A check like this should
be made when the check is requested, not when it is executed - in other words,
when the user requests it. That request should fail.
> >> + cond_react(msg);
> >> + }
> >> +}
> >> +
>
> [...]
>
> >> +
> >> +struct automaton_safe_wtd automaton_safe_wtd = {
> >> + .state_names = {
> >> + "init",
> >> + "closed_running",
> >> + "closed_running_nwo",
> >> + "nwo",
> >> + "opened",
> >> + "opened_nwo",
> >> + "reopened",
> >> + "safe",
> >> + "safe_nwo",
> >> + "set",
> >> + "set_nwo",
> >> + "started",
> >> + "started_nwo",
> >> + "stoped"
> >> + },
> >> + .event_names = {
> >> + "close",
> >> + "nowayout",
> >> + "open",
> >> + "other_threads",
> >> + "ping",
> >> + "set_safe_timeout",
> >> + "start",
> >> + "stop"
> >> + },
> >> + .function = {
> >> + { -1, nwo_safe_wtd, opened_safe_wtd, init_safe_wtd, -1, -1, -1, -1 },
> >> + { -1, closed_running_nwo_safe_wtd, reopened_safe_wtd, closed_running_safe_wtd, -1, -1, -1, -1 },
> >> + { -1, closed_running_nwo_safe_wtd, started_nwo_safe_wtd, closed_running_nwo_safe_wtd, -1, -1, -1, -1 },
> >> + { -1, nwo_safe_wtd, opened_nwo_safe_wtd, nwo_safe_wtd, -1, -1, -1, -1 },
> >> + { init_safe_wtd, -1, -1, -1, -1, -1, started_safe_wtd, -1 },
> >> + { nwo_safe_wtd, -1, -1, -1, -1, -1, started_nwo_safe_wtd, -1 },
> >> + { closed_running_safe_wtd, -1, -1, -1, -1, set_safe_wtd, 1, opened_safe_wtd },
> >> + { closed_running_safe_wtd, -1, -1, -1, safe_safe_wtd, -1, 1, stoped_safe_wtd },
> >> + { closed_running_nwo_safe_wtd, -1, -1, -1, safe_nwo_safe_wtd, -1, -1, -1 },
> >> + { -1, -1, -1, -1, safe_safe_wtd, -1, -1, -1 },
> >> + { -1, -1, -1, -1, safe_nwo_safe_wtd, -1, -1, -1 },
> >> + { closed_running_safe_wtd, -1, -1, -1, -1, set_safe_wtd, -1, stoped_safe_wtd },
> >> + { closed_running_nwo_safe_wtd, -1, -1, -1, -1, set_nwo_safe_wtd, -1, -1 },
> >> + { init_safe_wtd, -1, -1, -1, -1, -1, -1, -1 },
> >> + },
> >> + .initial_state = init_safe_wtd,
> >> + .final_states = { 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
> >
> > I find this event table all but impossible to verify.
>
> It is a matrix. Lines are states, and columns are events.
>
> On a given state/line, receiving a given event/column, the data is the next
> state/row.
>
I am aware of that, and I did program state machines before.
> For instance, let's say "init" (row 0), event "nwo" (column 1), and the next
> state is the "nwo" (row 3).
>
> -1 means invalid/blocked state (yeah, maybe it is better to have an #define
> INVALID_STATE -1).
>
> This is the C representation of an automaton, following the formal definition of
> a deterministic automaton. I've added an explanation of this representation in
> the documentation (patch 15, file da_monitor_synthesis.rst).
>
> A deeper look into this subject is here (peer-reviewed conference paper at
> Software Engineer and Formal Methods 2019):
> https://bristot.me/wp-content/uploads/2019/09/paper.pdf <https://bristot.me/wp-content/uploads/2019/09/paper.pdf>
>
> One could translate it back to the automaton's graphical format... to a format
> of by a tool used to analyze automaton properties... that is the good point of
> using a well-established formalism. (The bad part is that they are often
> boring... c'est la vie :-)).
>
If the above state machine fails, no one but the authors will be able to even
remotely figure out what happened, and if the watchdog driver is at fault or
its monitor. It is a state machine making assumptions about state transitions,
sure, but who knows if those asssumptions are even remotely correct or match
reality. For example, I have no idea if the lack of a 'ping' function is handled
correctly, if the lack of a 'stop' function is handled correctly, or what
happens if any of the driver functions returns an error.
I already found three assumptions which do not or not necessarily match
reality:
- The function to read the remaining timeout is optional and must not be
used unconditionally, and its lack is not an error.
- The requested timeout (and pretimeout) do not have to match the actually
configured timeout, and userspace must not rely on the assumption that
the values match.
- The code assumes that the process opening the watchdog and the process
accessing it are the same. While that is in general the case, it might
well be that some application opens the watchdog and then handles it
from a child process.
And that is just after briefly browsing through the code.
I am open to suggestions from others, but at this point I have serious doubts
that this code is maintainable in the kernel.
Guenter
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 17/20] watchdog/dev: Add tracepoints
2022-06-16 15:47 ` Daniel Bristot de Oliveira
@ 2022-06-16 23:55 ` Guenter Roeck
2022-06-17 16:16 ` Daniel Bristot de Oliveira
2022-07-13 18:49 ` Daniel Bristot de Oliveira
0 siblings, 2 replies; 82+ messages in thread
From: Guenter Roeck @ 2022-06-16 23:55 UTC (permalink / raw)
To: Daniel Bristot de Oliveira, Steven Rostedt
Cc: Wim Van Sebroeck, Jonathan Corbet, Ingo Molnar, Thomas Gleixner,
Peter Zijlstra, Will Deacon, Catalin Marinas, Marco Elver,
Dmitry Vyukov, Paul E. McKenney, Shuah Khan, Gabriele Paoloni,
Juri Lelli, Clark Williams, linux-doc, linux-kernel,
linux-trace-devel
On 6/16/22 08:47, Daniel Bristot de Oliveira wrote:
> On 6/16/22 15:44, Guenter Roeck wrote:
>> On 6/16/22 01:44, Daniel Bristot de Oliveira wrote:
>>> Add a set of tracepoints, enabling the observability of the watchdog
>>> device interactions with user-space.
>>>
>>> The events are:
>>> watchdog:watchdog_open
>>> watchdog:watchdog_close
>>> watchdog:watchdog_start
>>> watchdog:watchdog_stop
>>> watchdog:watchdog_set_timeout
>>> watchdog:watchdog_ping
>>> watchdog:watchdog_nowayout
>>> watchdog:watchdog_set_keep_alive
>>> watchdog:watchdog_keep_alive
>>> watchdog:watchdog_set_pretimeout
>>> watchdog:watchdog_pretimeout
>>>
>>> Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
>>> Cc: Guenter Roeck <linux@roeck-us.net>
>>> Cc: Jonathan Corbet <corbet@lwn.net>
>>> Cc: Steven Rostedt <rostedt@goodmis.org>
>>> Cc: Ingo Molnar <mingo@redhat.com>
>>> Cc: Thomas Gleixner <tglx@linutronix.de>
>>> Cc: Peter Zijlstra <peterz@infradead.org>
>>> Cc: Will Deacon <will@kernel.org>
>>> Cc: Catalin Marinas <catalin.marinas@arm.com>
>>> Cc: Marco Elver <elver@google.com>
>>> Cc: Dmitry Vyukov <dvyukov@google.com>
>>> Cc: "Paul E. McKenney" <paulmck@kernel.org>
>>> Cc: Shuah Khan <skhan@linuxfoundation.org>
>>> Cc: Gabriele Paoloni <gpaoloni@redhat.com>
>>> Cc: Juri Lelli <juri.lelli@redhat.com>
>>> Cc: Clark Williams <williams@redhat.com>
>>> Cc: linux-doc@vger.kernel.org
>>> Cc: linux-kernel@vger.kernel.org
>>> Cc: linux-trace-devel@vger.kernel.org
>>> Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
>>> ---
>>> drivers/watchdog/watchdog_dev.c | 43 ++++++++++-
>>> drivers/watchdog/watchdog_pretimeout.c | 2 +
>>> include/linux/watchdog.h | 7 +-
>>> include/trace/events/watchdog.h | 101 +++++++++++++++++++++++++
>>> 4 files changed, 143 insertions(+), 10 deletions(-)
>>> create mode 100644 include/trace/events/watchdog.h
>>>
>>> diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
>>> index 54903f3c851e..2f28dc5ab763 100644
>>> --- a/drivers/watchdog/watchdog_dev.c
>>> +++ b/drivers/watchdog/watchdog_dev.c
>>> @@ -44,6 +44,9 @@
>>> #include <linux/watchdog.h> /* For watchdog specific items */
>>> #include <linux/uaccess.h> /* For copy_to_user/put_user/... */
>>> +#define CREATE_TRACE_POINTS
>>> +#include <trace/events/watchdog.h>
>>> +
>>> #include "watchdog_core.h"
>>> #include "watchdog_pretimeout.h"
>>> @@ -130,9 +133,11 @@ static inline void watchdog_update_worker(struct
>>> watchdog_device *wdd)
>>> if (watchdog_need_worker(wdd)) {
>>> ktime_t t = watchdog_next_keepalive(wdd);
>>> - if (t > 0)
>>> + if (t > 0) {
>>> hrtimer_start(&wd_data->timer, t,
>>> HRTIMER_MODE_REL_HARD);
>>> + trace_watchdog_set_keep_alive(wdd, ktime_to_ms(t));
>>> + }
>>> } else {
>>> hrtimer_cancel(&wd_data->timer);
>>> }
>>> @@ -141,7 +146,7 @@ static inline void watchdog_update_worker(struct
>>> watchdog_device *wdd)
>>> static int __watchdog_ping(struct watchdog_device *wdd)
>>> {
>>> struct watchdog_core_data *wd_data = wdd->wd_data;
>>> - ktime_t earliest_keepalive, now;
>>> + ktime_t earliest_keepalive, now, next_keepalive;
>>> int err;
>>> earliest_keepalive = ktime_add(wd_data->last_hw_keepalive,
>>> @@ -149,14 +154,16 @@ static int __watchdog_ping(struct watchdog_device *wdd)
>>> now = ktime_get();
>>> if (ktime_after(earliest_keepalive, now)) {
>>> - hrtimer_start(&wd_data->timer,
>>> - ktime_sub(earliest_keepalive, now),
>>> + next_keepalive = ktime_sub(earliest_keepalive, now);
>>> + hrtimer_start(&wd_data->timer, next_keepalive,
>>> HRTIMER_MODE_REL_HARD);
>>> + trace_watchdog_set_keep_alive(wdd, ktime_to_ms(next_keepalive));
>>> return 0;
>>> }
>>> wd_data->last_hw_keepalive = now;
>>> + trace_watchdog_ping(wdd);
>>> if (wdd->ops->ping)
>>> err = wdd->ops->ping(wdd); /* ping the watchdog */
>>> else
>>> @@ -215,6 +222,7 @@ static void watchdog_ping_work(struct kthread_work *work)
>>> wd_data = container_of(work, struct watchdog_core_data, work);
>>> mutex_lock(&wd_data->lock);
>>> + trace_watchdog_keep_alive(wd_data->wdd);
>>> if (watchdog_worker_should_ping(wd_data))
>>> __watchdog_ping(wd_data->wdd);
>>> mutex_unlock(&wd_data->lock);
>>> @@ -250,6 +258,8 @@ static int watchdog_start(struct watchdog_device *wdd)
>>> set_bit(_WDOG_KEEPALIVE, &wd_data->status);
>>> + trace_watchdog_start(wdd);
>>> +
>>> started_at = ktime_get();
>>> if (watchdog_hw_running(wdd) && wdd->ops->ping) {
>>> err = __watchdog_ping(wdd);
>>> @@ -294,6 +304,7 @@ static int watchdog_stop(struct watchdog_device *wdd)
>>> return -EBUSY;
>>> }
>>> + trace_watchdog_stop(wdd);
>>> if (wdd->ops->stop) {
>>> clear_bit(WDOG_HW_RUNNING, &wdd->status);
>>> err = wdd->ops->stop(wdd);
>>> @@ -367,6 +378,7 @@ static int watchdog_set_timeout(struct watchdog_device *wdd,
>>> if (watchdog_timeout_invalid(wdd, timeout))
>>> return -EINVAL;
>>> + trace_watchdog_set_timeout(wdd, timeout);
>>
>> The driver has no obligation to set the timeout to the
>> requested value. It might be more valuable to report both
>> the requested and the actual values.
>>
>>
>
> Ack! how do I get the actual value?
>
Read it from the data structure after the driver function returned.
>>> if (wdd->ops->set_timeout) {
>>> err = wdd->ops->set_timeout(wdd, timeout);
>>> } else {
>>> @@ -399,6 +411,8 @@ static int watchdog_set_pretimeout(struct watchdog_device
>>> *wdd,
>>> if (watchdog_pretimeout_invalid(wdd, timeout))
>>> return -EINVAL;
>>> + trace_watchdog_set_pretimeout(wdd, timeout);
>>> +
>>
>> Again, the driver has no obligation to set the timeout to the
>> requested value.
>
> /me takes note.
>
>>
>>> if (wdd->ops->set_pretimeout && (wdd->info->options & WDIOF_PRETIMEOUT))
>>> err = wdd->ops->set_pretimeout(wdd, timeout);
>>> else
>>> @@ -430,6 +444,23 @@ static int watchdog_get_timeleft(struct watchdog_device
>>> *wdd,
>>> return 0;
>>> }
>>> +/**
>>> + * watchdog_set_nowayout - set nowaout bit
>>> + * @wdd: The watchdog device to set nowayoutbit
>>> + * @nowayout A boolean on/off switcher
>>> + *
>>> + * If nowayout boolean is true, the nowayout option is set. No action is
>>> + * taken if nowayout is false.
>>> + */
>>> +void watchdog_set_nowayout(struct watchdog_device *wdd, bool nowayout)
>>> +{
>>> + if (nowayout) {
>>> + set_bit(WDOG_NO_WAY_OUT, &wdd->status);
>>> + trace_watchdog_nowayout(wdd);
>>> + }
>>> +}
>>> +EXPORT_SYMBOL(watchdog_set_nowayout);
>>> +
>>> #ifdef CONFIG_WATCHDOG_SYSFS
>>> static ssize_t nowayout_show(struct device *dev, struct device_attribute *attr,
>>> char *buf)
>>> @@ -861,6 +892,8 @@ static int watchdog_open(struct inode *inode, struct file
>>> *file)
>>> goto out_clear;
>>> }
>>> + trace_watchdog_open(wdd);
>>> +
>>> err = watchdog_start(wdd);
>>> if (err < 0)
>>> goto out_mod;
>>> @@ -883,6 +916,7 @@ static int watchdog_open(struct inode *inode, struct file
>>> *file)
>>> return stream_open(inode, file);
>>> out_mod:
>>> + trace_watchdog_close(wdd);
>>> module_put(wd_data->wdd->ops->owner);
>>> out_clear:
>>> clear_bit(_WDOG_DEV_OPEN, &wd_data->status);
>>> @@ -944,6 +978,7 @@ static int watchdog_release(struct inode *inode, struct
>>> file *file)
>>> /* make sure that /dev/watchdog can be re-opened */
>>> clear_bit(_WDOG_DEV_OPEN, &wd_data->status);
>>> + trace_watchdog_close(wdd);
>>> done:
>>> running = wdd && watchdog_hw_running(wdd);
>>> mutex_unlock(&wd_data->lock);
>>> diff --git a/drivers/watchdog/watchdog_pretimeout.c
>>> b/drivers/watchdog/watchdog_pretimeout.c
>>> index 376a495ab80c..58c391ed2205 100644
>>> --- a/drivers/watchdog/watchdog_pretimeout.c
>>> +++ b/drivers/watchdog/watchdog_pretimeout.c
>>> @@ -8,6 +8,7 @@
>>> #include <linux/spinlock.h>
>>> #include <linux/string.h>
>>> #include <linux/watchdog.h>
>>> +#include <trace/events/watchdog.h>
>>> #include "watchdog_core.h"
>>> #include "watchdog_pretimeout.h"
>>> @@ -107,6 +108,7 @@ void watchdog_notify_pretimeout(struct watchdog_device *wdd)
>>> return;
>>> }
>>> + trace_watchdog_pretimeout(wdd);
>>> wdd->gov->pretimeout(wdd);
>>> spin_unlock_irqrestore(&pretimeout_lock, flags);
>>> }
>>> diff --git a/include/linux/watchdog.h b/include/linux/watchdog.h
>>> index 99660197a36c..11d93407e492 100644
>>> --- a/include/linux/watchdog.h
>>> +++ b/include/linux/watchdog.h
>>> @@ -139,12 +139,7 @@ static inline bool watchdog_hw_running(struct
>>> watchdog_device *wdd)
>>> return test_bit(WDOG_HW_RUNNING, &wdd->status);
>>> }
>>> -/* Use the following function to set the nowayout feature */
>>> -static inline void watchdog_set_nowayout(struct watchdog_device *wdd, bool
>>> nowayout)
>>> -{
>>> - if (nowayout)
>>> - set_bit(WDOG_NO_WAY_OUT, &wdd->status);
>>> -}
>>> +void watchdog_set_nowayout(struct watchdog_device *wdd, bool nowayout);
>>> /* Use the following function to stop the watchdog on reboot */
>>> static inline void watchdog_stop_on_reboot(struct watchdog_device *wdd)
>>> diff --git a/include/trace/events/watchdog.h b/include/trace/events/watchdog.h
>>> new file mode 100644
>>> index 000000000000..145cd6cfaa02
>>> --- /dev/null
>>> +++ b/include/trace/events/watchdog.h
>>> @@ -0,0 +1,101 @@
>>> +/* SPDX-License-Identifier: GPL-2.0 */
>>> +#undef TRACE_SYSTEM
>>> +#define TRACE_SYSTEM watchdog
>>> +
>>> +#if !defined(_TRACE_WATCHDOG_H) || defined(TRACE_HEADER_MULTI_READ)
>>> +#define _TRACE_WATCHDOG_H
>>> +
>>> +#include <linux/tracepoint.h>
>>> +
>>> +/*
>>> + * These are all events whose sole argument is the watchdog id.
>>> + */
>>> +DECLARE_EVENT_CLASS(dev_operations_template,
>>> +
>>> + TP_PROTO(struct watchdog_device *wdd),
>>> +
>>> + TP_ARGS(wdd),
>>> +
>>> + TP_STRUCT__entry(
>>> + __field(__u32, id)
>>> + ),
>>> +
>>> + TP_fast_assign(
>>> + __entry->id = wdd->id;
>>> + ),
>>> +
>>> + TP_printk("id=%d",
>>> + __entry->id)
>>> +);
>>> +
>>> +DEFINE_EVENT(dev_operations_template, watchdog_open,
>>> + TP_PROTO(struct watchdog_device *wdd),
>>> + TP_ARGS(wdd));
>>> +
>>> +DEFINE_EVENT(dev_operations_template, watchdog_close,
>>> + TP_PROTO(struct watchdog_device *wdd),
>>> + TP_ARGS(wdd));
>>> +
>>> +DEFINE_EVENT(dev_operations_template, watchdog_start,
>>> + TP_PROTO(struct watchdog_device *wdd),
>>> + TP_ARGS(wdd));
>>> +
>>> +DEFINE_EVENT(dev_operations_template, watchdog_stop,
>>> + TP_PROTO(struct watchdog_device *wdd),
>>> + TP_ARGS(wdd));
>>> +
>>> +DEFINE_EVENT(dev_operations_template, watchdog_ping,
>>> + TP_PROTO(struct watchdog_device *wdd),
>>> + TP_ARGS(wdd));
>>> +
>>> +DEFINE_EVENT(dev_operations_template, watchdog_nowayout,
>>> + TP_PROTO(struct watchdog_device *wdd),
>>> + TP_ARGS(wdd));
>>> +
>>> +DEFINE_EVENT(dev_operations_template, watchdog_keep_alive,
>>> + TP_PROTO(struct watchdog_device *wdd),
>>> + TP_ARGS(wdd));
>>> +
>>> +DEFINE_EVENT(dev_operations_template, watchdog_pretimeout,
>>> + TP_PROTO(struct watchdog_device *wdd),
>>> + TP_ARGS(wdd));
>>> +
>>> +/*
>>> + * These are all events with a device ID and a given timeout.
>>> + */
>>> +DECLARE_EVENT_CLASS(watchdog_timeout_template,
>>> +
>>> + TP_PROTO(struct watchdog_device *wdd, u64 timeout),
>>> +
>>> + TP_ARGS(wdd, timeout),
>>> +
>>> + TP_STRUCT__entry(
>>> + __field(__u32, id)
>>> + __field(__u64, timeout)
>>
>>
>> Why u64 ? timeout is unsigned long.
>
> ack! I will change it. (I am seeing unsigned int, am I missing something?).
Yes, you are correct.
Guenter
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 09/20] rv/monitor: wip instrumentation and Makefile/Kconfig entries
2022-06-16 21:00 ` Randy Dunlap
@ 2022-06-17 16:07 ` Daniel Bristot de Oliveira
2022-06-28 19:02 ` Steven Rostedt
1 sibling, 0 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-17 16:07 UTC (permalink / raw)
To: Randy Dunlap, Steven Rostedt
Cc: Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet, Ingo Molnar,
Thomas Gleixner, Peter Zijlstra, Will Deacon, Catalin Marinas,
Marco Elver, Dmitry Vyukov, Paul E. McKenney, Shuah Khan,
Gabriele Paoloni, Juri Lelli, Clark Williams, linux-doc,
linux-kernel, linux-trace-devel
On 6/16/22 23:00, Randy Dunlap wrote:
>
> On 6/16/22 01:44, Daniel Bristot de Oliveira wrote:
>> diff --git a/kernel/trace/rv/Kconfig b/kernel/trace/rv/Kconfig
>> index 1eafb5adcfcb..e9246b0bec9d 100644
>> --- a/kernel/trace/rv/Kconfig
>> +++ b/kernel/trace/rv/Kconfig
>> @@ -26,6 +26,13 @@ menuconfig RV
>> the system behavior.
>>
>> if RV
>> +config RV_MON_WIP
>> + depends on PREEMPTIRQ_TRACEPOINTS
>> + select DA_MON_EVENTS_IMPLICIT
>> + bool "WIP monitor"
> Does WIP mean work-in-progress? (It does to me.)
>
> If not, please explain what it means in the help text.
>
Wakeup in preemptive. I will add it to the description.
Thanks Randy!
-- Daniel
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 13/20] rv/reactor: Add the panic reactor
2022-06-16 21:03 ` Randy Dunlap
@ 2022-06-17 16:09 ` Daniel Bristot de Oliveira
2022-07-13 18:47 ` Daniel Bristot de Oliveira
1 sibling, 0 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-17 16:09 UTC (permalink / raw)
To: Randy Dunlap, Steven Rostedt
Cc: Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet, Ingo Molnar,
Thomas Gleixner, Peter Zijlstra, Will Deacon, Catalin Marinas,
Marco Elver, Dmitry Vyukov, Paul E. McKenney, Shuah Khan,
Gabriele Paoloni, Juri Lelli, Clark Williams, linux-doc,
linux-kernel, linux-trace-devel
On 6/16/22 23:03, Randy Dunlap wrote:
>
>
> On 6/16/22 01:44, Daniel Bristot de Oliveira wrote:
>> diff --git a/kernel/trace/rv/Kconfig b/kernel/trace/rv/Kconfig
>> index be8e3dab0a52..91a17b13a080 100644
>> --- a/kernel/trace/rv/Kconfig
>> +++ b/kernel/trace/rv/Kconfig
>> @@ -60,4 +60,12 @@ config RV_REACT_PRINTK
>> Enables the printk reactor. The printk reactor emmits a printk()
>
> emits
oops!
>> message if an exception is found.
>>
>> +config RV_REACT_PANIC
>> + bool "Panic reactor"
>> + depends on RV_REACTORS
>> + default y if RV_REACTORS
>> + help
>> + Enables the panic reactor. The panic reactor emmits a printk()
>
> emits
and Oops again.
>> + message if an exception is found and panic()s the system.
>
I will fix that, thanks Randy!
-- Daniel
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 17/20] watchdog/dev: Add tracepoints
2022-06-16 23:55 ` Guenter Roeck
@ 2022-06-17 16:16 ` Daniel Bristot de Oliveira
2022-07-13 18:49 ` Daniel Bristot de Oliveira
1 sibling, 0 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-17 16:16 UTC (permalink / raw)
To: Guenter Roeck, Steven Rostedt
Cc: Wim Van Sebroeck, Jonathan Corbet, Ingo Molnar, Thomas Gleixner,
Peter Zijlstra, Will Deacon, Catalin Marinas, Marco Elver,
Dmitry Vyukov, Paul E. McKenney, Shuah Khan, Gabriele Paoloni,
Juri Lelli, Clark Williams, linux-doc, linux-kernel,
linux-trace-devel
On 6/17/22 01:55, Guenter Roeck wrote:
> On 6/16/22 08:47, Daniel Bristot de Oliveira wrote:
>> On 6/16/22 15:44, Guenter Roeck wrote:
>>> On 6/16/22 01:44, Daniel Bristot de Oliveira wrote:
>>>> Add a set of tracepoints, enabling the observability of the watchdog
>>>> device interactions with user-space.
>>>>
>>>> The events are:
>>>> watchdog:watchdog_open
>>>> watchdog:watchdog_close
>>>> watchdog:watchdog_start
>>>> watchdog:watchdog_stop
>>>> watchdog:watchdog_set_timeout
>>>> watchdog:watchdog_ping
>>>> watchdog:watchdog_nowayout
>>>> watchdog:watchdog_set_keep_alive
>>>> watchdog:watchdog_keep_alive
>>>> watchdog:watchdog_set_pretimeout
>>>> watchdog:watchdog_pretimeout
>>>>
>>>> Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
>>>> Cc: Guenter Roeck <linux@roeck-us.net>
>>>> Cc: Jonathan Corbet <corbet@lwn.net>
>>>> Cc: Steven Rostedt <rostedt@goodmis.org>
>>>> Cc: Ingo Molnar <mingo@redhat.com>
>>>> Cc: Thomas Gleixner <tglx@linutronix.de>
>>>> Cc: Peter Zijlstra <peterz@infradead.org>
>>>> Cc: Will Deacon <will@kernel.org>
>>>> Cc: Catalin Marinas <catalin.marinas@arm.com>
>>>> Cc: Marco Elver <elver@google.com>
>>>> Cc: Dmitry Vyukov <dvyukov@google.com>
>>>> Cc: "Paul E. McKenney" <paulmck@kernel.org>
>>>> Cc: Shuah Khan <skhan@linuxfoundation.org>
>>>> Cc: Gabriele Paoloni <gpaoloni@redhat.com>
>>>> Cc: Juri Lelli <juri.lelli@redhat.com>
>>>> Cc: Clark Williams <williams@redhat.com>
>>>> Cc: linux-doc@vger.kernel.org
>>>> Cc: linux-kernel@vger.kernel.org
>>>> Cc: linux-trace-devel@vger.kernel.org
>>>> Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
>>>> ---
>>>> drivers/watchdog/watchdog_dev.c | 43 ++++++++++-
>>>> drivers/watchdog/watchdog_pretimeout.c | 2 +
>>>> include/linux/watchdog.h | 7 +-
>>>> include/trace/events/watchdog.h | 101 +++++++++++++++++++++++++
>>>> 4 files changed, 143 insertions(+), 10 deletions(-)
>>>> create mode 100644 include/trace/events/watchdog.h
>>>>
>>>> diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
>>>> index 54903f3c851e..2f28dc5ab763 100644
>>>> --- a/drivers/watchdog/watchdog_dev.c
>>>> +++ b/drivers/watchdog/watchdog_dev.c
>>>> @@ -44,6 +44,9 @@
>>>> #include <linux/watchdog.h> /* For watchdog specific items */
>>>> #include <linux/uaccess.h> /* For copy_to_user/put_user/... */
>>>> +#define CREATE_TRACE_POINTS
>>>> +#include <trace/events/watchdog.h>
>>>> +
>>>> #include "watchdog_core.h"
>>>> #include "watchdog_pretimeout.h"
>>>> @@ -130,9 +133,11 @@ static inline void watchdog_update_worker(struct
>>>> watchdog_device *wdd)
>>>> if (watchdog_need_worker(wdd)) {
>>>> ktime_t t = watchdog_next_keepalive(wdd);
>>>> - if (t > 0)
>>>> + if (t > 0) {
>>>> hrtimer_start(&wd_data->timer, t,
>>>> HRTIMER_MODE_REL_HARD);
>>>> + trace_watchdog_set_keep_alive(wdd, ktime_to_ms(t));
>>>> + }
>>>> } else {
>>>> hrtimer_cancel(&wd_data->timer);
>>>> }
>>>> @@ -141,7 +146,7 @@ static inline void watchdog_update_worker(struct
>>>> watchdog_device *wdd)
>>>> static int __watchdog_ping(struct watchdog_device *wdd)
>>>> {
>>>> struct watchdog_core_data *wd_data = wdd->wd_data;
>>>> - ktime_t earliest_keepalive, now;
>>>> + ktime_t earliest_keepalive, now, next_keepalive;
>>>> int err;
>>>> earliest_keepalive = ktime_add(wd_data->last_hw_keepalive,
>>>> @@ -149,14 +154,16 @@ static int __watchdog_ping(struct watchdog_device *wdd)
>>>> now = ktime_get();
>>>> if (ktime_after(earliest_keepalive, now)) {
>>>> - hrtimer_start(&wd_data->timer,
>>>> - ktime_sub(earliest_keepalive, now),
>>>> + next_keepalive = ktime_sub(earliest_keepalive, now);
>>>> + hrtimer_start(&wd_data->timer, next_keepalive,
>>>> HRTIMER_MODE_REL_HARD);
>>>> + trace_watchdog_set_keep_alive(wdd, ktime_to_ms(next_keepalive));
>>>> return 0;
>>>> }
>>>> wd_data->last_hw_keepalive = now;
>>>> + trace_watchdog_ping(wdd);
>>>> if (wdd->ops->ping)
>>>> err = wdd->ops->ping(wdd); /* ping the watchdog */
>>>> else
>>>> @@ -215,6 +222,7 @@ static void watchdog_ping_work(struct kthread_work *work)
>>>> wd_data = container_of(work, struct watchdog_core_data, work);
>>>> mutex_lock(&wd_data->lock);
>>>> + trace_watchdog_keep_alive(wd_data->wdd);
>>>> if (watchdog_worker_should_ping(wd_data))
>>>> __watchdog_ping(wd_data->wdd);
>>>> mutex_unlock(&wd_data->lock);
>>>> @@ -250,6 +258,8 @@ static int watchdog_start(struct watchdog_device *wdd)
>>>> set_bit(_WDOG_KEEPALIVE, &wd_data->status);
>>>> + trace_watchdog_start(wdd);
>>>> +
>>>> started_at = ktime_get();
>>>> if (watchdog_hw_running(wdd) && wdd->ops->ping) {
>>>> err = __watchdog_ping(wdd);
>>>> @@ -294,6 +304,7 @@ static int watchdog_stop(struct watchdog_device *wdd)
>>>> return -EBUSY;
>>>> }
>>>> + trace_watchdog_stop(wdd);
>>>> if (wdd->ops->stop) {
>>>> clear_bit(WDOG_HW_RUNNING, &wdd->status);
>>>> err = wdd->ops->stop(wdd);
>>>> @@ -367,6 +378,7 @@ static int watchdog_set_timeout(struct watchdog_device *wdd,
>>>>
>>>> if (watchdog_timeout_invalid(wdd, timeout))
>>>> return -EINVAL;
>>>> + trace_watchdog_set_timeout(wdd, timeout);
>>>
>>> The driver has no obligation to set the timeout to the
>>> requested value. It might be more valuable to report both
>>> the requested and the actual values.
>>>
>>>
>>
>> Ack! how do I get the actual value?
>>
> Read it from the data structure after the driver function returned.
Got it! I will add this field too.
-- Daniel
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 18/20] rv/monitor: Add safe watchdog monitor
2022-06-16 20:57 ` Randy Dunlap
@ 2022-06-17 16:17 ` Daniel Bristot de Oliveira
0 siblings, 0 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-17 16:17 UTC (permalink / raw)
To: Randy Dunlap, Steven Rostedt
Cc: Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet, Ingo Molnar,
Thomas Gleixner, Peter Zijlstra, Will Deacon, Catalin Marinas,
Marco Elver, Dmitry Vyukov, Paul E. McKenney, Shuah Khan,
Gabriele Paoloni, Juri Lelli, Clark Williams, linux-doc,
linux-kernel, linux-trace-devel
On 6/16/22 22:57, Randy Dunlap wrote:
> Hi--
>
> On 6/16/22 01:45, Daniel Bristot de Oliveira wrote:
>> diff --git a/kernel/trace/rv/Kconfig b/kernel/trace/rv/Kconfig
>> index 21f03fb3101a..b14ae63e792b 100644
>> --- a/kernel/trace/rv/Kconfig
>> +++ b/kernel/trace/rv/Kconfig
>> @@ -45,6 +45,16 @@ config RV_MON_WWNR
>> illustrates the usage of per-task monitor. The model is
>> broken on purpose: it serves to test reactors.
>>
>> +config RV_MON_SAFE_WTD
>> + select DA_MON_EVENTS_IMPLICIT
>> + bool "Safety watchdog"
>> + help
>> + Enable safe_wtd, this monitor observes the interaction
>> + between a user-space safety monitor and a watchdog device.
>> +
>> + For futher information see:
>> + Documentation/trace/rv/safety-monitor.rst
> I'm curious about what "WTD" means.
>
> I see lots of WDT in drivers/watchdog/Kconfig
> (where it means WatchDog Timer AFAIK).
Yep, watchdog. I will add the long description right after the first WTD appearance.
-- Daniel
> thanks.
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 18/20] rv/monitor: Add safe watchdog monitor
2022-06-16 23:53 ` Guenter Roeck
@ 2022-06-17 17:06 ` Daniel Bristot de Oliveira
2022-06-28 19:32 ` Steven Rostedt
1 sibling, 0 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-17 17:06 UTC (permalink / raw)
To: Guenter Roeck, Gabriele Paoloni
Cc: Steven Rostedt, Wim Van Sebroeck, Jonathan Corbet, Ingo Molnar,
Thomas Gleixner, Peter Zijlstra, Will Deacon, Catalin Marinas,
Marco Elver, Dmitry Vyukov, Paul E. McKenney, Shuah Khan,
Juri Lelli, Clark Williams, open list:DOCUMENTATION,
Linux Kernel Mailing List, linux-trace-devel
On 6/17/22 01:53, Guenter Roeck wrote:
>>
>> struct watchdog_device {
>> ...
>> #ifdef CONFIG_RV_MON_SAFE_WTD
>> struct da_monitor da_mon;
>> #endif
>> ...
>> }
>>
>
> In my opinion shis should be dynamically allocated and not waste space in driver
> code if unused.
ack
>> A simplified version of the the "per task" monitor, in the patch 01, changes in
>>
>> include/linux/sched.h.
>>
>> >> +
>> >> +static void handle_nowayout(void *data, struct watchdog_device *wdd)
>> >> +{
>> >> + if (wdd->id != watchdog_id)
>> >> + return;
>> >> +
>> >> + da_handle_init_run_event_safe_wtd(nowayout_safe_wtd);
>> >> +}
>> >> +
>> >> +static void handle_close(void *data, struct watchdog_device *wdd)
>> >> +{
>> >> + if (wdd->id != watchdog_id)
>> >> + return;
>> >> +
>> >> + if (open_pid && current->pid != open_pid) {
>> >> + da_handle_init_run_event_safe_wtd(other_threads_safe_wtd);
>> >> + } else {
>> >> + da_handle_event_safe_wtd(close_safe_wtd);
>> >> + open_pid = 0;
>> >> + }
>> >> +}
>> >> +
>> >> +static void handle_open(void *data, struct watchdog_device *wdd)
>> >> +{
>> >> + if (wdd->id != watchdog_id)
>> >> + return;
>> >> +
>> >> + if (open_pid && current->pid != open_pid) {
>> >> + da_handle_init_run_event_safe_wtd(other_threads_safe_wtd);
>> >> + } else {
>> >> + da_handle_init_run_event_safe_wtd(open_safe_wtd);
>> >> + open_pid = current->pid;
>> >> + }
>> >> +}
>> >> +
>> >> +static void blocked_events(void *data, struct watchdog_device *wdd)
>> >> +{
>> >> + if (wdd->id != watchdog_id)
>> >> + return;
>> >> +
>> >> + if (open_pid && current->pid != open_pid) {
>> >> + da_handle_init_run_event_safe_wtd(other_threads_safe_wtd);
>> >> + return;
>> >> + }
>> >> + da_handle_event_safe_wtd(other_threads_safe_wtd);
>> >> +}
>> >> +
>> >> +static void blocked_events_timeout(void *data, struct watchdog_device *wdd,
>>
>> >> u64 timeout)
>> >> +{
>> >> + blocked_events(data, wdd);
>> >> +}
>> >> +
>> >> +static void handle_ping(void *data, struct watchdog_device *wdd)
>> >> +{
>> >> + char msg[128];
>> >> + unsigned int timeout;
>> >> +
>> >> + if (wdd->id != watchdog_id)
>> >> + return;
>> >> +
>> >> + if (open_pid && current->pid != open_pid) {
>> >> + da_handle_init_run_event_safe_wtd(other_threads_safe_wtd);
>> >> + return;
>> >> + }
>> >> +
>> >> + da_handle_event_safe_wtd(ping_safe_wtd);
>> >> +
>> >> + if (!check_timeout)
>> >> + return;
>> >> +
>> >> + if (wdd->ops->get_timeleft) {
>> >> + timeout = wdd->ops->get_timeleft(wdd);
>> >> + if (timeout > last_timeout_set) {
>> >> + snprintf(msg, 128,
>> >> + "watchdog timeout is %u > than previously set (%d)\n",
>> >> + timeout, last_timeout_set);
>> >> + cond_react(msg);
>> >> + }
>> >> + } else {
>> >> + snprintf(msg, 128, "error getting timeout: option not supported\n");
>>
>> >
>> > This is not an error. The get_timeleft callback is optional.
>>
>> Right... but this part of the code is only reachable if the user explicitly
>> asked to check the timeout (if (!check_timeout)...return before this code).
>>
>> So, if the user only considers the system safe if the monitor also checks the
>> written timeout, but the watchdog is one of those that do not have the callback
>>
>> implemented (which is ok for a Linux watchdog), the monitor captures this
>> "undesired" behavior.
>>
>> This monitor is not checking if the watchdog subsystem is correct at its
>> plenitude, it is checking if the watchdog usage is following a set of
>> specifications (raised by people in the LF Elisa workgroup).
>>
>
> The kernel is not intended for special use cases. The callback is optional,
> period. The test for check_timeout is way too late. A check like this should
> be made when the check is requested, not when it is executed - in other words,
> when the user requests it. That request should fail.
>
>> >> + cond_react(msg);
>> >> + }
[...]
>> >
>> > I find this event table all but impossible to verify.
>>
>> It is a matrix. Lines are states, and columns are events.
>>
>> On a given state/line, receiving a given event/column, the data is the next
>> state/row.
>>
>
> I am aware of that, and I did program state machines before.
>
>> For instance, let's say "init" (row 0), event "nwo" (column 1), and the next
>> state is the "nwo" (row 3).
>>
>> -1 means invalid/blocked state (yeah, maybe it is better to have an #define
>> INVALID_STATE -1).
>>
>> This is the C representation of an automaton, following the formal definition of
>>
>> a deterministic automaton. I've added an explanation of this representation in
>>
>> the documentation (patch 15, file da_monitor_synthesis.rst).
>>
>> A deeper look into this subject is here (peer-reviewed conference paper at
>> Software Engineer and Formal Methods 2019):
>> https://bristot.me/wp-content/uploads/2019/09/paper.pdf <https://bristot.me/wp-content/uploads/2019/09/paper.pdf>
>>
>>
>> One could translate it back to the automaton's graphical format... to a format
>>
>> of by a tool used to analyze automaton properties... that is the good point of
>>
>> using a well-established formalism. (The bad part is that they are often
>> boring... c'est la vie :-)).
>>
>
> If the above state machine fails, no one but the authors will be able to even
> remotely figure out what happened, and if the watchdog driver is at fault or
> its monitor.
That is a point we can improve. If we look only for the matrix, yes, it is not
the best way to try to understand what is going on. I agree.
The idea here is that one can describe the expected behavior and check. But we fail
to explain the reasons for these choices...
The patch "20/20 Documentation/rv: Add watchdog-monitor documentation" attempts
to explain the idea behind the monitor, and includes the ASCII representation
of the monitor. But indeed, it fails on explaining why those assumptions were
made, what it is trying to monitor, and what it is not...
It is a state machine making assumptions about state transitions,
> sure, but who knows if those asssumptions are even remotely correct or match
> reality. For example, I have no idea if the lack of a 'ping' function is handled
> correctly, if the lack of a 'stop' function is handled correctly, or what
> happens if any of the driver functions returns an error.
>
> I already found three assumptions which do not or not necessarily match
> reality:
>
> - The function to read the remaining timeout is optional and must not be
> used unconditionally, and its lack is not an error.
Ack, that can be removed.
> - The requested timeout (and pretimeout) do not have to match the actually
> configured timeout, and userspace must not rely on the assumption that
> the values match.
I agree, the model is lacking that, and it needs it.
> - The code assumes that the process opening the watchdog and the process
> accessing it are the same. While that is in general the case, it might
> well be that some application opens the watchdog and then handles it
> from a child process.
What is not clear on our documentation are the reasons behind these choices.
They are based on a hazard analysis made by people safety experts in the
Elisa group, that need to be clarified.
/me looks at people from Elisa...
-- Daniel
> And that is just after briefly browsing through the code> I am open to suggestions from others, but at this point I have serious doubts
> that this code is maintainable in the kernel.
>
> Guenter
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 00/20] The Runtime Verification (RV) interface
2022-06-16 8:44 [PATCH V4 00/20] The Runtime Verification (RV) interface Daniel Bristot de Oliveira
` (19 preceding siblings ...)
2022-06-16 8:45 ` [PATCH V4 20/20] Documentation/rv: Add watchdog-monitor documentation Daniel Bristot de Oliveira
@ 2022-06-22 7:24 ` Song Liu
2022-06-23 16:41 ` Daniel Bristot de Oliveira
2022-07-06 16:18 ` Tao Zhou
21 siblings, 1 reply; 82+ messages in thread
From: Song Liu @ 2022-06-22 7:24 UTC (permalink / raw)
To: Daniel Bristot de Oliveira
Cc: Steven Rostedt, Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet,
Ingo Molnar, Thomas Gleixner, Peter Zijlstra, Will Deacon,
Catalin Marinas, Marco Elver, Dmitry Vyukov, Paul E. McKenney,
Shuah Khan, Gabriele Paoloni, Juri Lelli, Clark Williams,
Linux Doc Mailing List, open list, linux-trace-devel
Hi Daniel,
On Thu, Jun 16, 2022 at 1:45 AM Daniel Bristot de Oliveira
<bristot@kernel.org> wrote:
>
> Over the last years, I've been exploring the possibility of
> verifying the Linux kernel behavior using Runtime Verification.
>
> Runtime Verification (RV) is a lightweight (yet rigorous) method that
> complements classical exhaustive verification techniques (such as model
> checking and theorem proving) with a more practical approach for complex
> systems.
>
> Instead of relying on a fine-grained model of a system (e.g., a
> re-implementation a instruction level), RV works by analyzing the trace of the
> system's actual execution, comparing it against a formal specification of
> the system behavior.
>
> The usage of deterministic automaton for RV is a well-established
> approach. In the specific case of the Linux kernel, you can check how
> to model complex behavior of the Linux kernel with this paper:
>
> DE OLIVEIRA, Daniel Bristot; CUCINOTTA, Tommaso; DE OLIVEIRA, Romulo Silva.
> *Efficient formal verification for the Linux kernel.* In: International
> Conference on Software Engineering and Formal Methods. Springer, Cham, 2019.
> p. 315-332.
>
> And how efficient is this approach here:
>
> DE OLIVEIRA, Daniel B.; DE OLIVEIRA, Romulo S.; CUCINOTTA, Tommaso. *A thread
> synchronization model for the PREEMPT_RT Linux kernel.* Journal of Systems
> Architecture, 2020, 107: 101729.
>
> tlrd: it is possible to model complex behaviors in a modular way, with
> an acceptable overhead (even for production systems). See this
> presentation at 2019's ELCE: https://www.youtube.com/watch?v=BfTuEHafNgg
>
> Here I am proposing a more practical approach for the usage of deterministic
> automata for runtime verification, and it includes:
>
> - An interface for controlling the verification;
> - A tool and set of headers that enables the automatic code
> generation of the RV monitor (Monitor Synthesis);
> - Sample monitors to evaluate the interface;
> - A sample monitor developed in the context of the Elisa Project
> demonstrating how to use RV in the context of safety-critical
> systems.
>
> Given that RV is a tracing consumer, the code is being placed inside the
> tracing subsystem (Steven and I have been talking about it for a while).
This is interesting work!
I applied the series on top of commit 78ca55889a549a9a194c6ec666836329b774ab6d
in upstream. Then, I got some compile/link error for CONFIG_RV_MON_WIP and
CONFIG_RV_MON_SAFE_WTD. I was able to compile the kernel with these two
configs disabled. However, I hit the some issue with monitors/wwnr/enabled :
[root@eth50-1 ~]# cd /sys/kernel/debug/tracing/rv/
[root@eth50-1 rv]# cat available_monitors
wwnr
[root@eth50-1 rv]# echo wwnr > enabled_monitors
[root@eth50-1 rv]# cd monitors/
[root@eth50-1 monitors]# cd wwnr/
[root@eth50-1 wwnr]# ls
desc enable reactors
[root@eth50-1 wwnr]# cat enable
1
[root@eth50-1 wwnr]# echo 0 > enable <<< hangs
The last echo command hangs forever on a qemu vm. I haven't figured out why
this happens though.
I also have a more general question: can we do RV with BPF and simplify the
work? AFAICT, the idea of RV is to maintain a state machine based on events.
If something unexpected happens, call the reactor.
IIUC, BPF has most of these building blocks ready for use. With BPF, we
can ship many RV monitors without much kernel changes.
Here is my toy wwnr in bpftrace. The reactor is "print to console".
It runs on most systems with BPF and tracepoint enabled. I probably
missed some events, as a result, the script triggers the "reactor" a lot.
=============== 8< ======================
[root@ ~]# cat wwnr.bt
/*
* task_state[pid]
* not_running = 1
* running = 2
*/
tracepoint:sched:sched_switch
{
if (args->prev_state == 0x0001 /* TASK_INTERRUPTIBLE */) {
/* after first suspension */
@task_state[args->prev_pid] = 1;
} else {
if (@task_state[args->prev_pid] == 1) {
printf("Something wrong, call reactor\n");
}
@task_state[args->prev_pid] = 1;
}
@task_state[args->next_pid] = 2;
}
tracepoint:sched:sched_wakeup
{
if (@task_state[args->pid] == 2) {
printf("Something wrong, call reactor\n");
}
@task_state[args->pid] = 2;
}
[root@ ~]# bpftrace wwnr.bt
<<<< some print >>>>
=============== 8< ======================
Does this (BPF for RV) make any sense?
Thanks,
Song
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 00/20] The Runtime Verification (RV) interface
2022-06-22 7:24 ` [PATCH V4 00/20] The Runtime Verification (RV) interface Song Liu
@ 2022-06-23 16:41 ` Daniel Bristot de Oliveira
2022-06-23 17:52 ` Song Liu
0 siblings, 1 reply; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-23 16:41 UTC (permalink / raw)
To: Song Liu
Cc: Steven Rostedt, Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet,
Ingo Molnar, Thomas Gleixner, Peter Zijlstra, Will Deacon,
Catalin Marinas, Marco Elver, Dmitry Vyukov, Paul E. McKenney,
Shuah Khan, Gabriele Paoloni, Juri Lelli, Clark Williams,
Linux Doc Mailing List, open list, linux-trace-devel
On 6/22/22 09:24, Song Liu wrote:
> This is interesting work!
>
> I applied the series on top of commit 78ca55889a549a9a194c6ec666836329b774ab6d
> in upstream. Then, I got some compile/link error for CONFIG_RV_MON_WIP and
> CONFIG_RV_MON_SAFE_WTD. I was able to compile the kernel with these two
> configs disabled.
I rebased the code and... it compiled. Maybe it was missing some
config options that I forgot to set as "depends on" in the Kconfig.
Can you check if it was the same problem automatically reported?
Any further information here would help. I will revisit this.
However, I hit the some issue with monitors/wwnr/enabled :
>
> [root@eth50-1 ~]# cd /sys/kernel/debug/tracing/rv/
> [root@eth50-1 rv]# cat available_monitors
> wwnr
> [root@eth50-1 rv]# echo wwnr > enabled_monitors
> [root@eth50-1 rv]# cd monitors/
> [root@eth50-1 monitors]# cd wwnr/
> [root@eth50-1 wwnr]# ls
> desc enable reactors
> [root@eth50-1 wwnr]# cat enable
> 1
> [root@eth50-1 wwnr]# echo 0 > enable <<< hangs
>
> The last echo command hangs forever on a qemu vm. I haven't figured out why
> this happens though.
I could reproduce it. It is an error in the return code of monitor_enable_write_data(),
I fixed it locally (return retval ? retval : count; // needs more test), and
will add it to the next version. Thanks!
> I also have a more general question: can we do RV with BPF and simplify the
> work? AFAICT, the idea of RV is to maintain a state machine based on events.
> If something unexpected happens, call the reactor.
>
> IIUC, BPF has most of these building blocks ready for use. With BPF, we
> can ship many RV monitors without much kernel changes.
I am aware of bpftrace and bpf + libbpf, and I have a PoC tool doing most of the
work I do in C/kernel in C/bpf.
From the cover letter:
"Things kept for a second moment (after this patchset):
[...]
- dot2bpf"
The point is that there are use-cases in which the users need the code in
C. One of those is the work being done in the Linux Foundation Elisa group.
There will be more formalism, like timed automata... which will require
infra-structure that is easily accessible in C... including synchronization,
and reactors that are available only in C on "per use-cases" basis - for
example on embedded devices.
On the other hand, there is ongoing research on asynchronous RV in which
I am only using BPF on the instrumentation side, for more complex formalism
running the processing in user-space (but for a different use-case,
with different timing and logical properties).
I see C and BPF (and rust?...) as complementary tools that I can use, and
we will have them all :-).
In this first series, I am adding the DA monitor in the kernel (motivated
by Elisa), and the basic kernel interface. After that, I will add the dot2bpf
for the cases in which BPF is a viable option... other formalism... other
extensions from Elisa... and so on... collecting these methods in a single
place.
-- Daniel
> Thanks,
> Song
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 01/20] rv: Add Runtime Verification (RV) interface
2022-06-16 8:44 ` [PATCH V4 01/20] rv: Add " Daniel Bristot de Oliveira
@ 2022-06-23 17:21 ` Punit Agrawal
2022-07-01 13:24 ` Daniel Bristot de Oliveira
2022-06-23 20:26 ` Steven Rostedt
2022-07-06 17:49 ` Tao Zhou
2 siblings, 1 reply; 82+ messages in thread
From: Punit Agrawal @ 2022-06-23 17:21 UTC (permalink / raw)
To: Daniel Bristot de Oliveira
Cc: Steven Rostedt, Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet,
Ingo Molnar, Thomas Gleixner, Peter Zijlstra, Will Deacon,
Catalin Marinas, Marco Elver, Dmitry Vyukov, Paul E. McKenney,
Shuah Khan, Gabriele Paoloni, Juri Lelli, Clark Williams,
linux-doc, linux-kernel, linux-trace-devel
Hi Daniel,
A few flyby issues I noticed while going through the patches to
understand what RV offers.
For the typos, I wonder if it isn't better to use a spellcheck - they
unnecessarily detract from the review. Sorry for the annoyance!
Daniel Bristot de Oliveira <bristot@kernel.org> writes:
> RV is a lightweight (yet rigorous) method that complements classical
> exhaustive verification techniques (such as model checking and
> theorem proving) with a more practical approach to complex systems.
>
> RV works by analyzing the trace of the system's actual execution,
> comparing it against a formal specification of the system behavior.
> RV can give precise information on the runtime behavior of the
> monitored system while enabling the reaction for unexpected
> events, avoiding, for example, the propagation of a failure on
> safety-critical systems.
>
> The development of this interface roots in the development of the
> paper:
>
> DE OLIVEIRA, Daniel Bristot; CUCINOTTA, Tommaso; DE OLIVEIRA, Romulo
> Silva. Efficient formal verification for the Linux kernel. In:
> International Conference on Software Engineering and Formal Methods.
> Springer, Cham, 2019. p. 315-332.
>
> And:
>
> DE OLIVEIRA, Daniel Bristot, et al. Automata-based formal analysis
> and verification of the real-time Linux kernel. PhD Thesis, 2020.
>
> The RV interface resembles the tracing/ interface on purpose. The current
> path for the RV interface is /sys/kernel/tracing/rv/.
>
> It presents these files:
>
> "available_monitors"
> - List the available monitors, one per line.
>
> For example:
> [root@f32 rv]# cat available_monitors
> wip
> wwnr
>
> "enabled_monitors"
> - Lists the enabled monitors, one per line;
> - Writing to it enables a given monitor;
> - Writing a monitor name with a '-' prefix disables it;
> - Truncating the file disables all enabled monitors.
>
> For example:
> [root@f32 rv]# cat enabled_monitors
> [root@f32 rv]# echo wip > enabled_monitors
> [root@f32 rv]# echo wwnr >> enabled_monitors
> [root@f32 rv]# cat enabled_monitors
> wip
> wwnr
> [root@f32 rv]# echo !wip >> enabled_monitors
> [root@f32 rv]# cat enabled_monitors
> wwnr
> [root@f32 rv]# echo > enabled_monitors
> [root@f32 rv]# cat enabled_monitors
> [root@f32 rv]#
>
> Note that more than one monitor can be enabled concurrently.
>
> "monitoring_on"
> - It is an on/off general switcher for monitoring. Note
> that it does not disable enabled monitors, but stop the per-entity
> monitors of monitoring the events received from the system.
> It resambles the "tracing_on" switcher.
resembles
>
> "monitors/"
> Each monitor will have its one directory inside "monitors/". There
> the monitor specific files will be presented.
> The "monitors/" directory resambles the "events" directory on
resembles
... and in the rest of the file.
> tracefs.
>
> For example:
> [root@f32 rv]# cd monitors/wip/
> [root@f32 wip]# ls
> desc enable
> [root@f32 wip]# cat desc
> auto-generated wakeup in preemptive monitor.
> [root@f32 wip]# cat enable
> 0
>
> For further information, see the comments in the header of
> kernel/trace/rv/rv.c from this patch.
>
> Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
> Cc: Guenter Roeck <linux@roeck-us.net>
> Cc: Jonathan Corbet <corbet@lwn.net>
> Cc: Steven Rostedt <rostedt@goodmis.org>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Peter Zijlstra <peterz@infradead.org>
> Cc: Will Deacon <will@kernel.org>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: Marco Elver <elver@google.com>
> Cc: Dmitry Vyukov <dvyukov@google.com>
> Cc: "Paul E. McKenney" <paulmck@kernel.org>
> Cc: Shuah Khan <skhan@linuxfoundation.org>
> Cc: Gabriele Paoloni <gpaoloni@redhat.com>
> Cc: Juri Lelli <juri.lelli@redhat.com>
> Cc: Clark Williams <williams@redhat.com>
> Cc: linux-doc@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> Cc: linux-trace-devel@vger.kernel.org
> Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
> ---
> include/linux/rv.h | 23 ++
> include/linux/sched.h | 11 +
> include/rv/rv.h | 23 ++
> kernel/fork.c | 14 +
> kernel/trace/Kconfig | 2 +
> kernel/trace/Makefile | 2 +
> kernel/trace/rv/Kconfig | 12 +
> kernel/trace/rv/Makefile | 3 +
> kernel/trace/rv/rv.c | 738 +++++++++++++++++++++++++++++++++++++++
> kernel/trace/rv/rv.h | 34 ++
> kernel/trace/trace.c | 4 +
> kernel/trace/trace.h | 2 +
> 12 files changed, 868 insertions(+)
> create mode 100644 include/linux/rv.h
> create mode 100644 include/rv/rv.h
> create mode 100644 kernel/trace/rv/Kconfig
> create mode 100644 kernel/trace/rv/Makefile
> create mode 100644 kernel/trace/rv/rv.c
> create mode 100644 kernel/trace/rv/rv.h
[...]
> diff --git a/kernel/trace/rv/rv.c b/kernel/trace/rv/rv.c
> new file mode 100644
> index 000000000000..43af7b13187e
> --- /dev/null
> +++ b/kernel/trace/rv/rv.c
> @@ -0,0 +1,738 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/*
> + * This is the online Runtime Verification (RV) interface.
> + *
> + * RV is a lightweight (yet rigorous) method that complements classical
> + * exhaustive verification techniques (such as model checking and
> + * theorem proving) with a more practical approach to complex systems.
> + *
> + * RV works by analyzing the trace of the system's actual execution,
> + * comparing it against a formal specification of the system behavior.
> + * RV can give precise information on the runtime behavior of the
> + * monitored system while enabling the reaction for unexpected
> + * events, avoiding, for example, the propagation of a failure on
> + * safety-critical systems.
> + *
> + * The development of this interface roots in the development of the
> + * paper:
> + *
> + * DE OLIVEIRA, Daniel Bristot; CUCINOTTA, Tommaso; DE OLIVEIRA, Romulo
> + * Silva. Efficient formal verification for the Linux kernel. In:
> + * International Conference on Software Engineering and Formal Methods.
> + * Springer, Cham, 2019. p. 315-332.
> + *
> + * And:
> + *
> + * DE OLIVEIRA, Daniel Bristot, et al. Automata-based formal analysis
> + * and verification of the real-time Linux kernel. PhD Thesis, 2020.
> + *
> + * == Runtime monitor interface ==
> + *
> + * A monitor is the central part of the runtime verification of a system.
> + *
> + * The monitor stands in between the formal specification of the desired
> + * (or undesired) behavior, and the trace of the actual system.
> + *
> + * In Linux terms, the runtime verification monitors are encapsulated
> + * inside the "RV monitor" abstraction. A RV monitor includes a reference
> + * model of the system, a set of instances of the monitor (per-cpu monitor,
> + * per-task monitor, and so on), and the helper functions that glue the
> + * monitor to the system via trace. Generally, a monitor includes some form
> + * of trace output as a reaction for event parsing and exceptions,
> + * as depicted bellow:
> + *
> + * Linux +----- RV Monitor ----------------------------------+ Formal
> + * Realm | | Realm
> + * +-------------------+ +----------------+ +-----------------+
> + * | Linux kernel | | Monitor | | Reference |
> + * | Tracing | -> | Instance(s) | <- | Model |
> + * | (instrumentation) | | (verification) | | (specification) |
> + * +-------------------+ +----------------+ +-----------------+
> + * | | |
> + * | V |
> + * | +----------+ |
> + * | | Reaction | |
> + * | +--+--+--+-+ |
> + * | | | | |
> + * | | | +-> trace output ? |
> + * +------------------------|--|----------------------+
> + * | +----> panic ?
> + * +-------> <user-specified>
> + *
> + * This file implements the interface for loading RV monitors, and
> + * to control the verification session.
> + *
> + * == Registering monitors ==
> + *
> + * The struct rv_monitor defines a set of callback functions to control
> + * a verification session. For instance, when a given monitor is enabled,
> + * the "start" callback function is called to hook the instrumentation
> + * functions to the kernel trace events. The "stop" function is called
> + * when disabling the verification session.
> + *
> + * A RV monitor is registered via:
> + * int rv_register_monitor(struct rv_monitor *monitor);
> + * And unregistered via:
> + * int rv_unregister_monitor(struct rv_monitor *monitor);
> + *
> + * These functions are exported to modules, enabling verification monitors
> + * to be dynamically loaded.
> + *
> + * == User interface ==
> + *
> + * The user interface resembles kernel tracing interface. It presents
> + * these files:
> + *
> + * "available_monitors"
> + * - List the available monitors, one per line.
> + *
> + * For example:
> + * [root@f32 rv]# cat available_monitors
> + * wip
> + * wwnr
> + *
> + * "enabled_monitors"
> + * - Lists the enabled monitors, one per line;
> + * - Writing to it enables a given monitor;
> + * - Writing a monitor name with a '-' prefix disables it;
> + * - Truncating the file disables all enabled monitors.
> + *
> + * For example:
> + * [root@f32 rv]# cat enabled_monitors
> + * [root@f32 rv]# echo wip > enabled_monitors
> + * [root@f32 rv]# echo wwnr >> enabled_monitors
> + * [root@f32 rv]# cat enabled_monitors
> + * wip
> + * wwnr
> + * [root@f32 rv]# echo !wip >> enabled_monitors
> + * [root@f32 rv]# cat enabled_monitors
> + * wwnr
> + * [root@f32 rv]# echo > enabled_monitors
> + * [root@f32 rv]# cat enabled_monitors
> + * [root@f32 rv]#
> + *
> + * Note that more than one monitor can be enabled concurrently.
> + *
> + * "monitoring_on"
> + * - It is an on/off general switcher for monitoring. Note
> + * that it does not disable enabled monitors, but stop the per-entity
> + * monitors of monitoring the events received from the system.
> + * It resambles the "tracing_on" switcher.
> + *
> + * "monitors/"
> + * Each monitor will have its one directory inside "monitors/". There
> + * the monitor specific files will be presented.
> + * The "monitors/" directory resambles the "events" directory on
> + * tracefs.
> + *
> + * For example:
> + * [root@f32 rv]# cd monitors/wip/
> + * [root@f32 wip]# ls
> + * desc enable
> + * [root@f32 wip]# cat desc
> + * auto-generated wakeup in preemptive monitor.
> + * [root@f32 wip]# cat enable
> + * 0
> + *
> + * Copyright (C) 2019-2022 Daniel Bristot de Oliveira <bristot@kernel.org>
> + */
> +
> +#include <linux/kernel.h>
> +#include <linux/module.h>
> +#include <linux/init.h>
> +#include <linux/slab.h>
> +#include <rv/rv.h>
> +
> +#include "rv.h"
> +
> +DEFINE_MUTEX(rv_interface_lock);
> +struct rv_interface rv_root;
> +
> +struct dentry *get_monitors_root(void)
> +{
> + return rv_root.monitors_dir;
> +}
> +
> +/*
> + * Monitoring on global switcher!
> + */
> +bool __read_mostly monitoring_on;
> +
> +/*
> + * Interface for the monitor register.
> + */
> +LIST_HEAD(rv_monitors_list);
> +
> +static int task_monitor_count;
> +static bool task_monitor_slots[RV_PER_TASK_MONITORS];
> +
> +int get_task_monitor_slot(void)
> +{
> + int i;
> +
> + lockdep_assert_held(&rv_interface_lock);
> +
> + if (task_monitor_count == RV_PER_TASK_MONITORS)
> + return -EBUSY;
> +
> + task_monitor_count++;
> +
> + for (i = 0; i < RV_PER_TASK_MONITORS; i++) {
> + if (task_monitor_slots[i] == false) {
> + task_monitor_slots[i] = true;
> + return i;
> + }
> + }
> +
> + WARN_ONCE(1, "RV task_monitor_cout and slots are out of sync\n");
task_monitor_count
> +
> + return -EINVAL;
> +}
> +
> +void put_task_monitor_slot(int slot)
> +{
> + lockdep_assert_held(&rv_interface_lock);
> +
> + if (slot < 0 || slot > RV_PER_TASK_MONITORS) {
> + WARN_ONCE(1, "RV releasing an invlid slot!: %d\n", slot);
invalid
> + return;
> + }
> +
> + WARN_ONCE(!task_monitor_slots[slot], "RV releasing unsused task_monitor_slots: %d\n",
unused
> + slot);
> +
> + task_monitor_count--;
> + task_monitor_slots[slot] = false;
> +}
> +
> +/*
> + * This section collects the monitor/ files and folders.
> + */
> +static ssize_t monitor_enable_read_data(struct file *filp,
> + char __user *user_buf,
> + size_t count, loff_t *ppos)
> +{
> + struct rv_monitor_def *mdef = filp->private_data;
> + char buff[4];
> +
> + memset(buff, 0, sizeof(buff));
Not sure if the generated code is different, but the memset can be
rolled into buff declaration as -
char buff[4] = { 0 };
> +
> + mutex_lock(&rv_interface_lock);
> + sprintf(buff, "%x\n", mdef->monitor->enabled);
> + mutex_unlock(&rv_interface_lock);
> +
> + return simple_read_from_buffer(user_buf, count, ppos,
> + buff, strlen(buff)+1);
> +}
> +
> +/*
> + * Disable a given runtime monitor.
> + */
> +static int disable_monitor(struct rv_monitor_def *mdef)
> +{
> + if (mdef->monitor->enabled) {
> + mdef->monitor->enabled = 0;
> + mdef->monitor->stop();
> + }
> +
> + mdef->enabled = 0;
> + return 0;
> +}
> +
> +/*
> + * Enable a given monitor.
> + */
> +static int enable_monitor(struct rv_monitor_def *mdef)
> +{
> + int retval;
> +
> + /*
> + * Reset all internal monitors before starting.
> + */
> + mdef->monitor->reset();
> + if (!mdef->monitor->enabled) {
> + retval = mdef->monitor->start();
> + if (retval)
> + return retval;
> + }
> +
> + mdef->monitor->enabled = 1;
> + mdef->enabled = 1;
> +
> + return 0;
> +}
> +
> +/*
> + * interface for enabling/disabling a monitor.
> + */
> +static ssize_t monitor_enable_write_data(struct file *filp,
> + const char __user *user_buf,
> + size_t count, loff_t *ppos)
> +{
> + struct rv_monitor_def *mdef = filp->private_data;
> + int retval;
> + u64 val;
> +
> + retval = kstrtoull_from_user(user_buf, count, 10, &val);
IIUC, kstrtobool_from_user() is better suited here.
Thanks,
Punit
> + if (retval)
> + return retval;
> +
> + retval = count;
> +
> + mutex_lock(&rv_interface_lock);
> +
> + switch (val) {
> + case 0:
> + retval = disable_monitor(mdef);
> + break;
> + case 1:
> + retval = enable_monitor(mdef);
> + break;
> + default:
> + retval = -EINVAL;
> + }
> +
> + mutex_unlock(&rv_interface_lock);
> +
> + return retval;
> +}
> +
[...]
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 00/20] The Runtime Verification (RV) interface
2022-06-23 16:41 ` Daniel Bristot de Oliveira
@ 2022-06-23 17:52 ` Song Liu
2022-06-23 20:29 ` Daniel Bristot de Oliveira
0 siblings, 1 reply; 82+ messages in thread
From: Song Liu @ 2022-06-23 17:52 UTC (permalink / raw)
To: Daniel Bristot de Oliveira
Cc: Steven Rostedt, Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet,
Ingo Molnar, Thomas Gleixner, Peter Zijlstra, Will Deacon,
Catalin Marinas, Marco Elver, Dmitry Vyukov, Paul E. McKenney,
Shuah Khan, Gabriele Paoloni, Juri Lelli, Clark Williams,
Linux Doc Mailing List, open list, linux-trace-devel
[-- Attachment #1: Type: text/plain, Size: 3493 bytes --]
On Thu, Jun 23, 2022 at 9:42 AM Daniel Bristot de Oliveira
<bristot@kernel.org> wrote:
>
> On 6/22/22 09:24, Song Liu wrote:
> > This is interesting work!
> >
> > I applied the series on top of commit 78ca55889a549a9a194c6ec666836329b774ab6d
> > in upstream. Then, I got some compile/link error for CONFIG_RV_MON_WIP and
> > CONFIG_RV_MON_SAFE_WTD. I was able to compile the kernel with these two
> > configs disabled.
>
> I rebased the code and... it compiled. Maybe it was missing some
> config options that I forgot to set as "depends on" in the Kconfig.
>
> Can you check if it was the same problem automatically reported?
>
> Any further information here would help. I will revisit this.
Here are the error messages I got: https://pastebin.com/zJxMA6RK , and
attached is the config file I used.
>
> However, I hit the some issue with monitors/wwnr/enabled :
> >
> > [root@eth50-1 ~]# cd /sys/kernel/debug/tracing/rv/
> > [root@eth50-1 rv]# cat available_monitors
> > wwnr
> > [root@eth50-1 rv]# echo wwnr > enabled_monitors
> > [root@eth50-1 rv]# cd monitors/
> > [root@eth50-1 monitors]# cd wwnr/
> > [root@eth50-1 wwnr]# ls
> > desc enable reactors
> > [root@eth50-1 wwnr]# cat enable
> > 1
> > [root@eth50-1 wwnr]# echo 0 > enable <<< hangs
> >
> > The last echo command hangs forever on a qemu vm. I haven't figured out why
> > this happens though.
>
> I could reproduce it. It is an error in the return code of monitor_enable_write_data(),
> I fixed it locally (return retval ? retval : count; // needs more test), and
> will add it to the next version. Thanks!
>
> > I also have a more general question: can we do RV with BPF and simplify the
> > work? AFAICT, the idea of RV is to maintain a state machine based on events.
> > If something unexpected happens, call the reactor.
> >
> > IIUC, BPF has most of these building blocks ready for use. With BPF, we
> > can ship many RV monitors without much kernel changes.
>
> I am aware of bpftrace and bpf + libbpf, and I have a PoC tool doing most of the
> work I do in C/kernel in C/bpf.
>
> From the cover letter:
>
> "Things kept for a second moment (after this patchset):
> [...]
> - dot2bpf"
>
> The point is that there are use-cases in which the users need the code in
> C. One of those is the work being done in the Linux Foundation Elisa group.
> There will be more formalism, like timed automata... which will require
> infra-structure that is easily accessible in C... including synchronization,
> and reactors that are available only in C on "per use-cases" basis - for
> example on embedded devices.
Where can I find more information about the constraints of these use cases?
I am asking because there are multiple ways to load a BPF program to the
system. If the constraint is that we cannot have bpftrace or bcc in the system,
maybe it is ok to run a standalone binary (written in C, compiled on a different
system). Or maybe we can load BPF programs in a kernel module, or compile
the BPF programs into the kernel? (Yes, we can do it now, check
kernel/bpf/preload). If any of these works, we can benefit from the good
properties of BPF. For example, we can update the RV models without
rebooting the system; and we can reuse various BPF maps, so we don't
need to add union rv_task_monitor to task_struct.
Of course, we are out of luck if these systems cannot enable CONFIG_BPF
at all. But I guess this is not common for modern embedded systems?
Thanks,
Song
[-- Attachment #2: rv.config --]
[-- Type: application/octet-stream, Size: 114828 bytes --]
#
# Automatically generated file; DO NOT EDIT.
# Linux/x86 5.19.0-rc3 Kernel Configuration
#
CONFIG_CC_VERSION_TEXT="gcc (GCC) 8.5.0 20210514 (Red Hat 8.5.0-13)"
CONFIG_CC_IS_GCC=y
CONFIG_GCC_VERSION=80500
CONFIG_CLANG_VERSION=0
CONFIG_AS_IS_GNU=y
CONFIG_AS_VERSION=23000
CONFIG_LD_IS_BFD=y
CONFIG_LD_VERSION=23000
CONFIG_LLD_VERSION=0
CONFIG_CC_CAN_LINK=y
CONFIG_CC_CAN_LINK_STATIC=y
CONFIG_CC_HAS_ASM_GOTO=y
CONFIG_CC_HAS_ASM_INLINE=y
CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y
CONFIG_PAHOLE_VERSION=122
CONFIG_IRQ_WORK=y
CONFIG_BUILDTIME_TABLE_SORT=y
CONFIG_THREAD_INFO_IN_TASK=y
#
# General setup
#
CONFIG_INIT_ENV_ARG_LIMIT=32
# CONFIG_COMPILE_TEST is not set
# CONFIG_WERROR is not set
CONFIG_LOCALVERSION=""
# CONFIG_LOCALVERSION_AUTO is not set
CONFIG_BUILD_SALT=""
CONFIG_HAVE_KERNEL_GZIP=y
CONFIG_HAVE_KERNEL_BZIP2=y
CONFIG_HAVE_KERNEL_LZMA=y
CONFIG_HAVE_KERNEL_XZ=y
CONFIG_HAVE_KERNEL_LZO=y
CONFIG_HAVE_KERNEL_LZ4=y
CONFIG_HAVE_KERNEL_ZSTD=y
CONFIG_KERNEL_GZIP=y
# CONFIG_KERNEL_BZIP2 is not set
# CONFIG_KERNEL_LZMA is not set
# CONFIG_KERNEL_XZ is not set
# CONFIG_KERNEL_LZO is not set
# CONFIG_KERNEL_LZ4 is not set
# CONFIG_KERNEL_ZSTD is not set
CONFIG_DEFAULT_INIT=""
CONFIG_DEFAULT_HOSTNAME="(none)"
CONFIG_SYSVIPC=y
CONFIG_SYSVIPC_SYSCTL=y
CONFIG_SYSVIPC_COMPAT=y
# CONFIG_POSIX_MQUEUE is not set
# CONFIG_WATCH_QUEUE is not set
CONFIG_CROSS_MEMORY_ATTACH=y
CONFIG_USELIB=y
CONFIG_AUDIT=y
CONFIG_HAVE_ARCH_AUDITSYSCALL=y
CONFIG_AUDITSYSCALL=y
#
# IRQ subsystem
#
CONFIG_GENERIC_IRQ_PROBE=y
CONFIG_GENERIC_IRQ_SHOW=y
CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
CONFIG_GENERIC_PENDING_IRQ=y
CONFIG_GENERIC_IRQ_MIGRATION=y
CONFIG_HARDIRQS_SW_RESEND=y
CONFIG_IRQ_DOMAIN=y
CONFIG_IRQ_DOMAIN_HIERARCHY=y
CONFIG_GENERIC_MSI_IRQ=y
CONFIG_GENERIC_MSI_IRQ_DOMAIN=y
CONFIG_GENERIC_IRQ_MATRIX_ALLOCATOR=y
CONFIG_GENERIC_IRQ_RESERVATION_MODE=y
CONFIG_IRQ_FORCED_THREADING=y
CONFIG_SPARSE_IRQ=y
# CONFIG_GENERIC_IRQ_DEBUGFS is not set
# end of IRQ subsystem
CONFIG_CLOCKSOURCE_WATCHDOG=y
CONFIG_ARCH_CLOCKSOURCE_INIT=y
CONFIG_CLOCKSOURCE_VALIDATE_LAST_CYCLE=y
CONFIG_GENERIC_TIME_VSYSCALL=y
CONFIG_GENERIC_CLOCKEVENTS=y
CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST=y
CONFIG_GENERIC_CMOS_UPDATE=y
CONFIG_HAVE_POSIX_CPU_TIMERS_TASK_WORK=y
CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y
# CONFIG_TIME_KUNIT_TEST is not set
#
# Timers subsystem
#
CONFIG_TICK_ONESHOT=y
CONFIG_NO_HZ_COMMON=y
# CONFIG_HZ_PERIODIC is not set
# CONFIG_NO_HZ_IDLE is not set
CONFIG_NO_HZ_FULL=y
CONFIG_CONTEXT_TRACKING=y
# CONFIG_CONTEXT_TRACKING_FORCE is not set
CONFIG_NO_HZ=y
CONFIG_HIGH_RES_TIMERS=y
CONFIG_CLOCKSOURCE_WATCHDOG_MAX_SKEW_US=100
# end of Timers subsystem
CONFIG_BPF=y
CONFIG_HAVE_EBPF_JIT=y
CONFIG_ARCH_WANT_DEFAULT_BPF_JIT=y
#
# BPF subsystem
#
CONFIG_BPF_SYSCALL=y
CONFIG_BPF_JIT=y
CONFIG_BPF_JIT_ALWAYS_ON=y
CONFIG_BPF_JIT_DEFAULT_ON=y
# CONFIG_BPF_UNPRIV_DEFAULT_OFF is not set
CONFIG_USERMODE_DRIVER=y
CONFIG_BPF_PRELOAD=y
CONFIG_BPF_PRELOAD_UMD=m
CONFIG_BPF_LSM=y
# end of BPF subsystem
CONFIG_PREEMPT_BUILD=y
# CONFIG_PREEMPT_NONE is not set
# CONFIG_PREEMPT_VOLUNTARY is not set
CONFIG_PREEMPT=y
CONFIG_PREEMPT_COUNT=y
CONFIG_PREEMPTION=y
CONFIG_PREEMPT_DYNAMIC=y
# CONFIG_SCHED_CORE is not set
#
# CPU/Task time and stats accounting
#
CONFIG_VIRT_CPU_ACCOUNTING=y
CONFIG_VIRT_CPU_ACCOUNTING_GEN=y
# CONFIG_IRQ_TIME_ACCOUNTING is not set
CONFIG_BSD_PROCESS_ACCT=y
CONFIG_BSD_PROCESS_ACCT_V3=y
CONFIG_TASKSTATS=y
CONFIG_TASK_DELAY_ACCT=y
CONFIG_TASK_XACCT=y
CONFIG_TASK_IO_ACCOUNTING=y
# CONFIG_PSI is not set
# end of CPU/Task time and stats accounting
CONFIG_CPU_ISOLATION=y
#
# RCU Subsystem
#
CONFIG_TREE_RCU=y
CONFIG_PREEMPT_RCU=y
# CONFIG_RCU_EXPERT is not set
CONFIG_SRCU=y
CONFIG_TREE_SRCU=y
CONFIG_TASKS_RCU_GENERIC=y
CONFIG_TASKS_RCU=y
CONFIG_TASKS_RUDE_RCU=y
CONFIG_TASKS_TRACE_RCU=y
CONFIG_RCU_STALL_COMMON=y
CONFIG_RCU_NEED_SEGCBLIST=y
CONFIG_RCU_NOCB_CPU=y
# end of RCU Subsystem
CONFIG_IKCONFIG=y
CONFIG_IKCONFIG_PROC=y
CONFIG_IKHEADERS=y
CONFIG_LOG_BUF_SHIFT=24
CONFIG_LOG_CPU_MAX_BUF_SHIFT=12
CONFIG_PRINTK_SAFE_LOG_BUF_SHIFT=13
# CONFIG_PRINTK_INDEX is not set
CONFIG_HAVE_UNSTABLE_SCHED_CLOCK=y
#
# Scheduler features
#
# CONFIG_UCLAMP_TASK is not set
# end of Scheduler features
CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y
CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH=y
CONFIG_CC_HAS_INT128=y
CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
CONFIG_GCC12_NO_ARRAY_BOUNDS=y
CONFIG_ARCH_SUPPORTS_INT128=y
# CONFIG_NUMA_BALANCING is not set
CONFIG_CGROUPS=y
CONFIG_PAGE_COUNTER=y
CONFIG_MEMCG=y
CONFIG_MEMCG_SWAP=y
CONFIG_MEMCG_KMEM=y
CONFIG_BLK_CGROUP=y
CONFIG_CGROUP_WRITEBACK=y
CONFIG_CGROUP_SCHED=y
CONFIG_FAIR_GROUP_SCHED=y
CONFIG_CFS_BANDWIDTH=y
# CONFIG_RT_GROUP_SCHED is not set
# CONFIG_CGROUP_PIDS is not set
# CONFIG_CGROUP_RDMA is not set
CONFIG_CGROUP_FREEZER=y
# CONFIG_CGROUP_HUGETLB is not set
CONFIG_CPUSETS=y
CONFIG_PROC_PID_CPUSET=y
CONFIG_CGROUP_DEVICE=y
CONFIG_CGROUP_CPUACCT=y
CONFIG_CGROUP_PERF=y
CONFIG_CGROUP_BPF=y
# CONFIG_CGROUP_MISC is not set
# CONFIG_CGROUP_DEBUG is not set
CONFIG_SOCK_CGROUP_DATA=y
CONFIG_NAMESPACES=y
CONFIG_UTS_NS=y
CONFIG_TIME_NS=y
CONFIG_IPC_NS=y
# CONFIG_USER_NS is not set
CONFIG_PID_NS=y
CONFIG_NET_NS=y
# CONFIG_CHECKPOINT_RESTORE is not set
CONFIG_SCHED_AUTOGROUP=y
# CONFIG_SYSFS_DEPRECATED is not set
CONFIG_RELAY=y
CONFIG_BLK_DEV_INITRD=y
CONFIG_INITRAMFS_SOURCE=""
CONFIG_RD_GZIP=y
CONFIG_RD_BZIP2=y
CONFIG_RD_LZMA=y
CONFIG_RD_XZ=y
CONFIG_RD_LZO=y
# CONFIG_RD_LZ4 is not set
CONFIG_RD_ZSTD=y
# CONFIG_BOOT_CONFIG is not set
CONFIG_INITRAMFS_PRESERVE_MTIME=y
CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y
# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
CONFIG_LD_ORPHAN_WARN=y
CONFIG_SYSCTL=y
CONFIG_HAVE_UID16=y
CONFIG_SYSCTL_EXCEPTION_TRACE=y
CONFIG_HAVE_PCSPKR_PLATFORM=y
CONFIG_EXPERT=y
CONFIG_UID16=y
CONFIG_MULTIUSER=y
CONFIG_SGETMASK_SYSCALL=y
CONFIG_SYSFS_SYSCALL=y
# CONFIG_FHANDLE is not set
CONFIG_POSIX_TIMERS=y
CONFIG_PRINTK=y
CONFIG_BUG=y
CONFIG_ELF_CORE=y
CONFIG_PCSPKR_PLATFORM=y
CONFIG_BASE_FULL=y
CONFIG_FUTEX=y
CONFIG_FUTEX_PI=y
CONFIG_EPOLL=y
CONFIG_SIGNALFD=y
CONFIG_TIMERFD=y
CONFIG_EVENTFD=y
CONFIG_SHMEM=y
CONFIG_AIO=y
CONFIG_IO_URING=y
CONFIG_ADVISE_SYSCALLS=y
CONFIG_MEMBARRIER=y
CONFIG_KALLSYMS=y
CONFIG_KALLSYMS_ALL=y
CONFIG_KALLSYMS_ABSOLUTE_PERCPU=y
CONFIG_KALLSYMS_BASE_RELATIVE=y
CONFIG_ARCH_HAS_MEMBARRIER_SYNC_CORE=y
CONFIG_KCMP=y
CONFIG_RSEQ=y
# CONFIG_DEBUG_RSEQ is not set
# CONFIG_EMBEDDED is not set
CONFIG_HAVE_PERF_EVENTS=y
# CONFIG_PC104 is not set
#
# Kernel Performance Events And Counters
#
CONFIG_PERF_EVENTS=y
# CONFIG_DEBUG_PERF_USE_VMALLOC is not set
# end of Kernel Performance Events And Counters
CONFIG_PROFILING=y
CONFIG_TRACEPOINTS=y
# end of General setup
CONFIG_64BIT=y
CONFIG_X86_64=y
CONFIG_X86=y
CONFIG_INSTRUCTION_DECODER=y
CONFIG_OUTPUT_FORMAT="elf64-x86-64"
CONFIG_LOCKDEP_SUPPORT=y
CONFIG_STACKTRACE_SUPPORT=y
CONFIG_MMU=y
CONFIG_ARCH_MMAP_RND_BITS_MIN=28
CONFIG_ARCH_MMAP_RND_BITS_MAX=32
CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=8
CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=16
CONFIG_GENERIC_ISA_DMA=y
CONFIG_GENERIC_BUG=y
CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
CONFIG_ARCH_MAY_HAVE_PC_FDC=y
CONFIG_GENERIC_CALIBRATE_DELAY=y
CONFIG_ARCH_HAS_CPU_RELAX=y
CONFIG_ARCH_HIBERNATION_POSSIBLE=y
CONFIG_ARCH_NR_GPIO=1024
CONFIG_ARCH_SUSPEND_POSSIBLE=y
CONFIG_AUDIT_ARCH=y
CONFIG_X86_64_SMP=y
CONFIG_ARCH_SUPPORTS_UPROBES=y
CONFIG_FIX_EARLYCON_MEM=y
CONFIG_PGTABLE_LEVELS=4
CONFIG_CC_HAS_SANE_STACKPROTECTOR=y
#
# Processor type and features
#
CONFIG_SMP=y
CONFIG_X86_FEATURE_NAMES=y
CONFIG_X86_MPPARSE=y
# CONFIG_GOLDFISH is not set
CONFIG_RETPOLINE=y
# CONFIG_X86_CPU_RESCTRL is not set
CONFIG_X86_EXTENDED_PLATFORM=y
# CONFIG_X86_VSMP is not set
# CONFIG_X86_GOLDFISH is not set
# CONFIG_X86_INTEL_LPSS is not set
# CONFIG_X86_AMD_PLATFORM_DEVICE is not set
CONFIG_IOSF_MBI=y
# CONFIG_IOSF_MBI_DEBUG is not set
CONFIG_X86_SUPPORTS_MEMORY_FAILURE=y
CONFIG_SCHED_OMIT_FRAME_POINTER=y
# CONFIG_HYPERVISOR_GUEST is not set
# CONFIG_MK8 is not set
# CONFIG_MPSC is not set
CONFIG_MCORE2=y
# CONFIG_MATOM is not set
# CONFIG_GENERIC_CPU is not set
CONFIG_X86_INTERNODE_CACHE_SHIFT=6
CONFIG_X86_L1_CACHE_SHIFT=6
CONFIG_X86_INTEL_USERCOPY=y
CONFIG_X86_USE_PPRO_CHECKSUM=y
CONFIG_X86_P6_NOP=y
CONFIG_X86_TSC=y
CONFIG_X86_CMPXCHG64=y
CONFIG_X86_CMOV=y
CONFIG_X86_MINIMUM_CPU_FAMILY=64
CONFIG_X86_DEBUGCTLMSR=y
CONFIG_IA32_FEAT_CTL=y
CONFIG_X86_VMX_FEATURE_NAMES=y
CONFIG_PROCESSOR_SELECT=y
CONFIG_CPU_SUP_INTEL=y
CONFIG_CPU_SUP_AMD=y
CONFIG_CPU_SUP_HYGON=y
# CONFIG_CPU_SUP_CENTAUR is not set
CONFIG_CPU_SUP_ZHAOXIN=y
CONFIG_HPET_TIMER=y
CONFIG_HPET_EMULATE_RTC=y
CONFIG_DMI=y
# CONFIG_GART_IOMMU is not set
CONFIG_BOOT_VESA_SUPPORT=y
# CONFIG_MAXSMP is not set
CONFIG_NR_CPUS_RANGE_BEGIN=2
CONFIG_NR_CPUS_RANGE_END=512
CONFIG_NR_CPUS_DEFAULT=64
CONFIG_NR_CPUS=64
CONFIG_SCHED_CLUSTER=y
CONFIG_SCHED_SMT=y
CONFIG_SCHED_MC=y
CONFIG_SCHED_MC_PRIO=y
CONFIG_X86_LOCAL_APIC=y
CONFIG_X86_IO_APIC=y
CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS=y
CONFIG_X86_MCE=y
# CONFIG_X86_MCELOG_LEGACY is not set
CONFIG_X86_MCE_INTEL=y
CONFIG_X86_MCE_AMD=y
CONFIG_X86_MCE_THRESHOLD=y
# CONFIG_X86_MCE_INJECT is not set
#
# Performance monitoring
#
CONFIG_PERF_EVENTS_INTEL_UNCORE=y
CONFIG_PERF_EVENTS_INTEL_RAPL=y
CONFIG_PERF_EVENTS_INTEL_CSTATE=y
# CONFIG_PERF_EVENTS_AMD_POWER is not set
CONFIG_PERF_EVENTS_AMD_UNCORE=y
# CONFIG_PERF_EVENTS_AMD_BRS is not set
# end of Performance monitoring
CONFIG_X86_16BIT=y
CONFIG_X86_ESPFIX64=y
CONFIG_X86_VSYSCALL_EMULATION=y
CONFIG_X86_IOPL_IOPERM=y
# CONFIG_MICROCODE is not set
CONFIG_X86_MSR=y
CONFIG_X86_CPUID=y
# CONFIG_X86_5LEVEL is not set
CONFIG_X86_DIRECT_GBPAGES=y
# CONFIG_X86_CPA_STATISTICS is not set
# CONFIG_AMD_MEM_ENCRYPT is not set
CONFIG_NUMA=y
CONFIG_AMD_NUMA=y
CONFIG_X86_64_ACPI_NUMA=y
CONFIG_NUMA_EMU=y
CONFIG_NODES_SHIFT=6
CONFIG_ARCH_SPARSEMEM_ENABLE=y
CONFIG_ARCH_SPARSEMEM_DEFAULT=y
CONFIG_ARCH_PROC_KCORE_TEXT=y
CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
# CONFIG_X86_PMEM_LEGACY is not set
CONFIG_X86_CHECK_BIOS_CORRUPTION=y
CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK=y
CONFIG_MTRR=y
CONFIG_MTRR_SANITIZER=y
CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT=0
CONFIG_MTRR_SANITIZER_SPARE_REG_NR_DEFAULT=1
CONFIG_X86_PAT=y
CONFIG_ARCH_USES_PG_UNCACHED=y
CONFIG_ARCH_RANDOM=y
CONFIG_X86_UMIP=y
CONFIG_CC_HAS_IBT=y
# CONFIG_X86_KERNEL_IBT is not set
CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS=y
CONFIG_X86_INTEL_TSX_MODE_OFF=y
# CONFIG_X86_INTEL_TSX_MODE_ON is not set
# CONFIG_X86_INTEL_TSX_MODE_AUTO is not set
# CONFIG_X86_SGX is not set
# CONFIG_EFI is not set
CONFIG_HZ_100=y
# CONFIG_HZ_250 is not set
# CONFIG_HZ_300 is not set
# CONFIG_HZ_1000 is not set
CONFIG_HZ=100
CONFIG_SCHED_HRTICK=y
CONFIG_KEXEC=y
# CONFIG_KEXEC_FILE is not set
CONFIG_CRASH_DUMP=y
CONFIG_PHYSICAL_START=0x1000000
CONFIG_RELOCATABLE=y
# CONFIG_RANDOMIZE_BASE is not set
CONFIG_PHYSICAL_ALIGN=0x1000000
CONFIG_HOTPLUG_CPU=y
# CONFIG_BOOTPARAM_HOTPLUG_CPU0 is not set
# CONFIG_DEBUG_HOTPLUG_CPU0 is not set
# CONFIG_COMPAT_VDSO is not set
CONFIG_LEGACY_VSYSCALL_XONLY=y
# CONFIG_LEGACY_VSYSCALL_NONE is not set
# CONFIG_CMDLINE_BOOL is not set
CONFIG_MODIFY_LDT_SYSCALL=y
# CONFIG_STRICT_SIGALTSTACK_SIZE is not set
CONFIG_HAVE_LIVEPATCH=y
CONFIG_LIVEPATCH=y
# end of Processor type and features
CONFIG_ARCH_HAS_ADD_PAGES=y
CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y
#
# Power management and ACPI options
#
# CONFIG_SUSPEND is not set
# CONFIG_HIBERNATION is not set
CONFIG_PM=y
CONFIG_PM_DEBUG=y
# CONFIG_PM_ADVANCED_DEBUG is not set
CONFIG_PM_CLK=y
# CONFIG_WQ_POWER_EFFICIENT_DEFAULT is not set
# CONFIG_ENERGY_MODEL is not set
CONFIG_ARCH_SUPPORTS_ACPI=y
CONFIG_ACPI=y
CONFIG_ACPI_LEGACY_TABLES_LOOKUP=y
CONFIG_ARCH_MIGHT_HAVE_ACPI_PDC=y
CONFIG_ACPI_SYSTEM_POWER_STATES_SUPPORT=y
# CONFIG_ACPI_DEBUGGER is not set
CONFIG_ACPI_SPCR_TABLE=y
# CONFIG_ACPI_FPDT is not set
CONFIG_ACPI_LPIT=y
CONFIG_ACPI_REV_OVERRIDE_POSSIBLE=y
# CONFIG_ACPI_EC_DEBUGFS is not set
# CONFIG_ACPI_AC is not set
# CONFIG_ACPI_BATTERY is not set
CONFIG_ACPI_BUTTON=y
# CONFIG_ACPI_VIDEO is not set
CONFIG_ACPI_FAN=y
# CONFIG_ACPI_DOCK is not set
CONFIG_ACPI_CPU_FREQ_PSS=y
CONFIG_ACPI_PROCESSOR_CSTATE=y
CONFIG_ACPI_PROCESSOR_IDLE=y
CONFIG_ACPI_CPPC_LIB=y
CONFIG_ACPI_PROCESSOR=y
CONFIG_ACPI_HOTPLUG_CPU=y
# CONFIG_ACPI_PROCESSOR_AGGREGATOR is not set
CONFIG_ACPI_THERMAL=y
CONFIG_ARCH_HAS_ACPI_TABLE_UPGRADE=y
CONFIG_ACPI_TABLE_UPGRADE=y
# CONFIG_ACPI_DEBUG is not set
CONFIG_ACPI_PCI_SLOT=y
CONFIG_ACPI_CONTAINER=y
CONFIG_ACPI_HOTPLUG_IOAPIC=y
# CONFIG_ACPI_SBS is not set
# CONFIG_ACPI_HED is not set
# CONFIG_ACPI_CUSTOM_METHOD is not set
# CONFIG_ACPI_REDUCED_HARDWARE_ONLY is not set
# CONFIG_ACPI_NFIT is not set
CONFIG_ACPI_NUMA=y
# CONFIG_ACPI_HMAT is not set
CONFIG_HAVE_ACPI_APEI=y
CONFIG_HAVE_ACPI_APEI_NMI=y
# CONFIG_ACPI_APEI is not set
# CONFIG_ACPI_DPTF is not set
# CONFIG_ACPI_CONFIGFS is not set
# CONFIG_ACPI_PFRUT is not set
CONFIG_ACPI_PCC=y
# CONFIG_PMIC_OPREGION is not set
CONFIG_X86_PM_TIMER=y
#
# CPU Frequency scaling
#
CONFIG_CPU_FREQ=y
CONFIG_CPU_FREQ_GOV_ATTR_SET=y
CONFIG_CPU_FREQ_GOV_COMMON=y
CONFIG_CPU_FREQ_STAT=y
CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
# CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE is not set
# CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set
# CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL is not set
CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
CONFIG_CPU_FREQ_GOV_POWERSAVE=y
CONFIG_CPU_FREQ_GOV_USERSPACE=y
CONFIG_CPU_FREQ_GOV_ONDEMAND=m
CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
#
# CPU frequency scaling drivers
#
CONFIG_X86_INTEL_PSTATE=y
# CONFIG_X86_PCC_CPUFREQ is not set
# CONFIG_X86_AMD_PSTATE is not set
# CONFIG_X86_ACPI_CPUFREQ is not set
# CONFIG_X86_SPEEDSTEP_CENTRINO is not set
# CONFIG_X86_P4_CLOCKMOD is not set
#
# shared options
#
# end of CPU Frequency scaling
#
# CPU Idle
#
CONFIG_CPU_IDLE=y
CONFIG_CPU_IDLE_GOV_LADDER=y
CONFIG_CPU_IDLE_GOV_MENU=y
# CONFIG_CPU_IDLE_GOV_TEO is not set
# end of CPU Idle
CONFIG_INTEL_IDLE=y
# end of Power management and ACPI options
#
# Bus options (PCI etc.)
#
CONFIG_PCI_DIRECT=y
CONFIG_PCI_MMCONFIG=y
CONFIG_MMCONF_FAM10H=y
# CONFIG_PCI_CNB20LE_QUIRK is not set
# CONFIG_ISA_BUS is not set
CONFIG_ISA_DMA_API=y
CONFIG_AMD_NB=y
# end of Bus options (PCI etc.)
#
# Binary Emulations
#
CONFIG_IA32_EMULATION=y
# CONFIG_X86_X32_ABI is not set
CONFIG_COMPAT_32=y
CONFIG_COMPAT=y
CONFIG_COMPAT_FOR_U64_ALIGNMENT=y
# end of Binary Emulations
CONFIG_HAVE_KVM=y
CONFIG_VIRTUALIZATION=y
# CONFIG_KVM is not set
CONFIG_AS_AVX512=y
CONFIG_AS_SHA1_NI=y
CONFIG_AS_SHA256_NI=y
CONFIG_AS_TPAUSE=y
#
# General architecture-dependent options
#
CONFIG_CRASH_CORE=y
CONFIG_KEXEC_CORE=y
CONFIG_HOTPLUG_SMT=y
CONFIG_GENERIC_ENTRY=y
CONFIG_KPROBES=y
CONFIG_JUMP_LABEL=y
# CONFIG_STATIC_KEYS_SELFTEST is not set
# CONFIG_STATIC_CALL_SELFTEST is not set
CONFIG_OPTPROBES=y
CONFIG_KPROBES_ON_FTRACE=y
CONFIG_UPROBES=y
CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y
CONFIG_ARCH_USE_BUILTIN_BSWAP=y
CONFIG_KRETPROBES=y
CONFIG_KRETPROBE_ON_RETHOOK=y
CONFIG_HAVE_IOREMAP_PROT=y
CONFIG_HAVE_KPROBES=y
CONFIG_HAVE_KRETPROBES=y
CONFIG_HAVE_OPTPROBES=y
CONFIG_HAVE_KPROBES_ON_FTRACE=y
CONFIG_ARCH_CORRECT_STACKTRACE_ON_KRETPROBE=y
CONFIG_HAVE_FUNCTION_ERROR_INJECTION=y
CONFIG_HAVE_NMI=y
CONFIG_TRACE_IRQFLAGS_SUPPORT=y
CONFIG_HAVE_ARCH_TRACEHOOK=y
CONFIG_HAVE_DMA_CONTIGUOUS=y
CONFIG_GENERIC_SMP_IDLE_THREAD=y
CONFIG_ARCH_HAS_FORTIFY_SOURCE=y
CONFIG_ARCH_HAS_SET_MEMORY=y
CONFIG_ARCH_HAS_SET_DIRECT_MAP=y
CONFIG_HAVE_ARCH_THREAD_STRUCT_WHITELIST=y
CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT=y
CONFIG_ARCH_WANTS_NO_INSTR=y
CONFIG_HAVE_ASM_MODVERSIONS=y
CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y
CONFIG_HAVE_RSEQ=y
CONFIG_HAVE_FUNCTION_ARG_ACCESS_API=y
CONFIG_HAVE_HW_BREAKPOINT=y
CONFIG_HAVE_MIXED_BREAKPOINTS_REGS=y
CONFIG_HAVE_USER_RETURN_NOTIFIER=y
CONFIG_HAVE_PERF_EVENTS_NMI=y
CONFIG_HAVE_HARDLOCKUP_DETECTOR_PERF=y
CONFIG_HAVE_PERF_REGS=y
CONFIG_HAVE_PERF_USER_STACK_DUMP=y
CONFIG_HAVE_ARCH_JUMP_LABEL=y
CONFIG_HAVE_ARCH_JUMP_LABEL_RELATIVE=y
CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y
CONFIG_HAVE_ALIGNED_STRUCT_PAGE=y
CONFIG_HAVE_CMPXCHG_LOCAL=y
CONFIG_HAVE_CMPXCHG_DOUBLE=y
CONFIG_ARCH_WANT_COMPAT_IPC_PARSE_VERSION=y
CONFIG_ARCH_WANT_OLD_COMPAT_IPC=y
CONFIG_HAVE_ARCH_SECCOMP=y
CONFIG_HAVE_ARCH_SECCOMP_FILTER=y
CONFIG_SECCOMP=y
CONFIG_SECCOMP_FILTER=y
# CONFIG_SECCOMP_CACHE_DEBUG is not set
CONFIG_HAVE_ARCH_STACKLEAK=y
CONFIG_HAVE_STACKPROTECTOR=y
CONFIG_STACKPROTECTOR=y
CONFIG_STACKPROTECTOR_STRONG=y
CONFIG_ARCH_SUPPORTS_LTO_CLANG=y
CONFIG_ARCH_SUPPORTS_LTO_CLANG_THIN=y
CONFIG_LTO_NONE=y
CONFIG_HAVE_ARCH_WITHIN_STACK_FRAMES=y
CONFIG_HAVE_CONTEXT_TRACKING=y
CONFIG_HAVE_CONTEXT_TRACKING_OFFSTACK=y
CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN=y
CONFIG_HAVE_IRQ_TIME_ACCOUNTING=y
CONFIG_HAVE_MOVE_PUD=y
CONFIG_HAVE_MOVE_PMD=y
CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE=y
CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD=y
CONFIG_HAVE_ARCH_HUGE_VMAP=y
CONFIG_HAVE_ARCH_HUGE_VMALLOC=y
CONFIG_ARCH_WANT_HUGE_PMD_SHARE=y
CONFIG_HAVE_ARCH_SOFT_DIRTY=y
CONFIG_HAVE_MOD_ARCH_SPECIFIC=y
CONFIG_MODULES_USE_ELF_RELA=y
CONFIG_HAVE_IRQ_EXIT_ON_IRQ_STACK=y
CONFIG_HAVE_SOFTIRQ_ON_OWN_STACK=y
CONFIG_ARCH_HAS_ELF_RANDOMIZE=y
CONFIG_HAVE_ARCH_MMAP_RND_BITS=y
CONFIG_HAVE_EXIT_THREAD=y
CONFIG_ARCH_MMAP_RND_BITS=28
CONFIG_HAVE_ARCH_MMAP_RND_COMPAT_BITS=y
CONFIG_ARCH_MMAP_RND_COMPAT_BITS=8
CONFIG_HAVE_ARCH_COMPAT_MMAP_BASES=y
CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
CONFIG_HAVE_OBJTOOL=y
CONFIG_HAVE_JUMP_LABEL_HACK=y
CONFIG_HAVE_NOINSTR_HACK=y
CONFIG_HAVE_NOINSTR_VALIDATION=y
CONFIG_HAVE_UACCESS_VALIDATION=y
CONFIG_HAVE_STACK_VALIDATION=y
CONFIG_HAVE_RELIABLE_STACKTRACE=y
CONFIG_OLD_SIGSUSPEND3=y
CONFIG_COMPAT_OLD_SIGACTION=y
CONFIG_COMPAT_32BIT_TIME=y
CONFIG_HAVE_ARCH_VMAP_STACK=y
CONFIG_VMAP_STACK=y
CONFIG_HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET=y
CONFIG_RANDOMIZE_KSTACK_OFFSET=y
# CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT is not set
CONFIG_ARCH_HAS_STRICT_KERNEL_RWX=y
CONFIG_STRICT_KERNEL_RWX=y
CONFIG_ARCH_HAS_STRICT_MODULE_RWX=y
CONFIG_STRICT_MODULE_RWX=y
CONFIG_HAVE_ARCH_PREL32_RELOCATIONS=y
# CONFIG_LOCK_EVENT_COUNTS is not set
CONFIG_ARCH_HAS_MEM_ENCRYPT=y
CONFIG_HAVE_STATIC_CALL=y
CONFIG_HAVE_STATIC_CALL_INLINE=y
CONFIG_HAVE_PREEMPT_DYNAMIC=y
CONFIG_HAVE_PREEMPT_DYNAMIC_CALL=y
CONFIG_ARCH_WANT_LD_ORPHAN_WARN=y
CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y
CONFIG_ARCH_SUPPORTS_PAGE_TABLE_CHECK=y
CONFIG_ARCH_HAS_ELFCORE_COMPAT=y
CONFIG_ARCH_HAS_PARANOID_L1D_FLUSH=y
CONFIG_DYNAMIC_SIGFRAME=y
#
# GCOV-based kernel profiling
#
# CONFIG_GCOV_KERNEL is not set
CONFIG_ARCH_HAS_GCOV_PROFILE_ALL=y
# end of GCOV-based kernel profiling
CONFIG_HAVE_GCC_PLUGINS=y
# end of General architecture-dependent options
CONFIG_RT_MUTEXES=y
CONFIG_BASE_SMALL=0
CONFIG_MODULES=y
# CONFIG_MODULE_FORCE_LOAD is not set
CONFIG_MODULE_UNLOAD=y
# CONFIG_MODULE_FORCE_UNLOAD is not set
# CONFIG_MODULE_UNLOAD_TAINT_TRACKING is not set
CONFIG_MODVERSIONS=y
CONFIG_ASM_MODVERSIONS=y
CONFIG_MODULE_SRCVERSION_ALL=y
# CONFIG_MODULE_SIG is not set
CONFIG_MODULE_COMPRESS_NONE=y
# CONFIG_MODULE_COMPRESS_GZIP is not set
# CONFIG_MODULE_COMPRESS_XZ is not set
# CONFIG_MODULE_COMPRESS_ZSTD is not set
# CONFIG_MODULE_ALLOW_MISSING_NAMESPACE_IMPORTS is not set
CONFIG_MODPROBE_PATH="/sbin/modprobe"
# CONFIG_TRIM_UNUSED_KSYMS is not set
CONFIG_MODULES_TREE_LOOKUP=y
CONFIG_BLOCK=y
CONFIG_BLOCK_LEGACY_AUTOLOAD=y
CONFIG_BLK_RQ_ALLOC_TIME=y
CONFIG_BLK_DEV_BSG_COMMON=y
CONFIG_BLK_DEV_BSGLIB=y
CONFIG_BLK_DEV_INTEGRITY=y
CONFIG_BLK_DEV_INTEGRITY_T10=y
# CONFIG_BLK_DEV_ZONED is not set
# CONFIG_BLK_DEV_THROTTLING is not set
CONFIG_BLK_WBT=y
CONFIG_BLK_WBT_MQ=y
CONFIG_BLK_CGROUP_IOLATENCY=y
CONFIG_BLK_CGROUP_IOCOST=y
# CONFIG_BLK_CGROUP_IOPRIO is not set
CONFIG_BLK_DEBUG_FS=y
# CONFIG_BLK_SED_OPAL is not set
# CONFIG_BLK_INLINE_ENCRYPTION is not set
#
# Partition Types
#
CONFIG_PARTITION_ADVANCED=y
CONFIG_ACORN_PARTITION=y
# CONFIG_ACORN_PARTITION_CUMANA is not set
# CONFIG_ACORN_PARTITION_EESOX is not set
CONFIG_ACORN_PARTITION_ICS=y
# CONFIG_ACORN_PARTITION_ADFS is not set
# CONFIG_ACORN_PARTITION_POWERTEC is not set
CONFIG_ACORN_PARTITION_RISCIX=y
# CONFIG_AIX_PARTITION is not set
CONFIG_OSF_PARTITION=y
CONFIG_AMIGA_PARTITION=y
CONFIG_ATARI_PARTITION=y
CONFIG_MAC_PARTITION=y
CONFIG_MSDOS_PARTITION=y
CONFIG_BSD_DISKLABEL=y
CONFIG_MINIX_SUBPARTITION=y
CONFIG_SOLARIS_X86_PARTITION=y
CONFIG_UNIXWARE_DISKLABEL=y
CONFIG_LDM_PARTITION=y
# CONFIG_LDM_DEBUG is not set
CONFIG_SGI_PARTITION=y
CONFIG_ULTRIX_PARTITION=y
CONFIG_SUN_PARTITION=y
CONFIG_KARMA_PARTITION=y
CONFIG_EFI_PARTITION=y
CONFIG_SYSV68_PARTITION=y
# CONFIG_CMDLINE_PARTITION is not set
# end of Partition Types
CONFIG_BLOCK_COMPAT=y
CONFIG_BLK_MQ_PCI=y
CONFIG_BLK_MQ_VIRTIO=y
CONFIG_BLK_PM=y
CONFIG_BLOCK_HOLDER_DEPRECATED=y
CONFIG_BLK_MQ_STACKING=y
#
# IO Schedulers
#
CONFIG_MQ_IOSCHED_DEADLINE=y
CONFIG_MQ_IOSCHED_KYBER=y
# CONFIG_IOSCHED_BFQ is not set
# end of IO Schedulers
CONFIG_ASN1=m
CONFIG_UNINLINE_SPIN_UNLOCK=y
CONFIG_ARCH_SUPPORTS_ATOMIC_RMW=y
CONFIG_MUTEX_SPIN_ON_OWNER=y
CONFIG_RWSEM_SPIN_ON_OWNER=y
CONFIG_LOCK_SPIN_ON_OWNER=y
CONFIG_ARCH_USE_QUEUED_SPINLOCKS=y
CONFIG_QUEUED_SPINLOCKS=y
CONFIG_ARCH_USE_QUEUED_RWLOCKS=y
CONFIG_QUEUED_RWLOCKS=y
CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE=y
CONFIG_ARCH_HAS_SYNC_CORE_BEFORE_USERMODE=y
CONFIG_ARCH_HAS_SYSCALL_WRAPPER=y
CONFIG_FREEZER=y
#
# Executable file formats
#
CONFIG_BINFMT_ELF=y
# CONFIG_BINFMT_ELF_KUNIT_TEST is not set
CONFIG_COMPAT_BINFMT_ELF=y
CONFIG_ELFCORE=y
# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
CONFIG_BINFMT_SCRIPT=y
CONFIG_BINFMT_MISC=y
CONFIG_COREDUMP=y
# end of Executable file formats
#
# Memory Management options
#
CONFIG_SWAP=y
# CONFIG_ZSWAP is not set
#
# SLAB allocator options
#
# CONFIG_SLAB is not set
CONFIG_SLUB=y
# CONFIG_SLOB is not set
CONFIG_SLAB_MERGE_DEFAULT=y
# CONFIG_SLAB_FREELIST_RANDOM is not set
CONFIG_SLAB_FREELIST_HARDENED=y
CONFIG_SLUB_STATS=y
CONFIG_SLUB_CPU_PARTIAL=y
# end of SLAB allocator options
# CONFIG_SHUFFLE_PAGE_ALLOCATOR is not set
# CONFIG_COMPAT_BRK is not set
CONFIG_SPARSEMEM=y
CONFIG_SPARSEMEM_EXTREME=y
CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
CONFIG_SPARSEMEM_VMEMMAP=y
CONFIG_HAVE_FAST_GUP=y
CONFIG_MEMORY_ISOLATION=y
CONFIG_EXCLUSIVE_SYSTEM_RAM=y
CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
# CONFIG_MEMORY_HOTPLUG is not set
CONFIG_SPLIT_PTLOCK_CPUS=4
CONFIG_ARCH_ENABLE_SPLIT_PMD_PTLOCK=y
CONFIG_COMPACTION=y
# CONFIG_PAGE_REPORTING is not set
CONFIG_MIGRATION=y
CONFIG_ARCH_ENABLE_HUGEPAGE_MIGRATION=y
CONFIG_ARCH_ENABLE_THP_MIGRATION=y
CONFIG_CONTIG_ALLOC=y
CONFIG_PHYS_ADDR_T_64BIT=y
CONFIG_VIRT_TO_BUS=y
CONFIG_KSM=y
CONFIG_DEFAULT_MMAP_MIN_ADDR=65536
CONFIG_ARCH_SUPPORTS_MEMORY_FAILURE=y
CONFIG_MEMORY_FAILURE=y
# CONFIG_HWPOISON_INJECT is not set
CONFIG_ARCH_WANT_GENERAL_HUGETLB=y
CONFIG_ARCH_WANTS_THP_SWAP=y
CONFIG_TRANSPARENT_HUGEPAGE=y
CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS=y
# CONFIG_TRANSPARENT_HUGEPAGE_MADVISE is not set
CONFIG_THP_SWAP=y
# CONFIG_READ_ONLY_THP_FOR_FS is not set
CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y
CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK=y
CONFIG_USE_PERCPU_NUMA_NODE_ID=y
CONFIG_HAVE_SETUP_PER_CPU_AREA=y
# CONFIG_CMA is not set
CONFIG_GENERIC_EARLY_IOREMAP=y
# CONFIG_DEFERRED_STRUCT_PAGE_INIT is not set
# CONFIG_IDLE_PAGE_TRACKING is not set
CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y
CONFIG_ARCH_HAS_CURRENT_STACK_POINTER=y
CONFIG_ARCH_HAS_VM_GET_PAGE_PROT=y
CONFIG_ARCH_HAS_PTE_DEVMAP=y
CONFIG_ARCH_HAS_ZONE_DMA_SET=y
CONFIG_ZONE_DMA=y
CONFIG_ZONE_DMA32=y
CONFIG_ARCH_USES_HIGH_VMA_FLAGS=y
CONFIG_ARCH_HAS_PKEYS=y
CONFIG_VM_EVENT_COUNTERS=y
# CONFIG_PERCPU_STATS is not set
# CONFIG_GUP_TEST is not set
CONFIG_ARCH_HAS_PTE_SPECIAL=y
CONFIG_SECRETMEM=y
# CONFIG_ANON_VMA_NAME is not set
# CONFIG_USERFAULTFD is not set
#
# Data Access Monitoring
#
# CONFIG_DAMON is not set
# end of Data Access Monitoring
# end of Memory Management options
CONFIG_NET=y
CONFIG_NET_INGRESS=y
CONFIG_NET_EGRESS=y
CONFIG_SKB_EXTENSIONS=y
#
# Networking options
#
CONFIG_PACKET=y
# CONFIG_PACKET_DIAG is not set
CONFIG_UNIX=y
CONFIG_UNIX_SCM=y
CONFIG_AF_UNIX_OOB=y
# CONFIG_UNIX_DIAG is not set
# CONFIG_TLS is not set
CONFIG_XFRM=y
CONFIG_XFRM_ALGO=y
CONFIG_XFRM_USER=y
# CONFIG_XFRM_USER_COMPAT is not set
# CONFIG_XFRM_INTERFACE is not set
# CONFIG_XFRM_SUB_POLICY is not set
# CONFIG_XFRM_MIGRATE is not set
# CONFIG_XFRM_STATISTICS is not set
CONFIG_XFRM_AH=m
CONFIG_XFRM_ESP=m
CONFIG_XFRM_IPCOMP=m
CONFIG_NET_KEY=y
# CONFIG_NET_KEY_MIGRATE is not set
# CONFIG_XDP_SOCKETS is not set
CONFIG_INET=y
CONFIG_IP_MULTICAST=y
CONFIG_IP_ADVANCED_ROUTER=y
# CONFIG_IP_FIB_TRIE_STATS is not set
CONFIG_IP_MULTIPLE_TABLES=y
CONFIG_IP_ROUTE_MULTIPATH=y
CONFIG_IP_ROUTE_VERBOSE=y
CONFIG_IP_ROUTE_CLASSID=y
# CONFIG_IP_PNP is not set
CONFIG_NET_IPIP=y
CONFIG_NET_IPGRE_DEMUX=y
CONFIG_NET_IP_TUNNEL=y
CONFIG_NET_IPGRE=m
CONFIG_NET_IPGRE_BROADCAST=y
CONFIG_IP_MROUTE_COMMON=y
CONFIG_IP_MROUTE=y
# CONFIG_IP_MROUTE_MULTIPLE_TABLES is not set
CONFIG_IP_PIMSM_V1=y
CONFIG_IP_PIMSM_V2=y
CONFIG_SYN_COOKIES=y
# CONFIG_NET_IPVTI is not set
# CONFIG_NET_FOU is not set
# CONFIG_NET_FOU_IP_TUNNELS is not set
CONFIG_INET_AH=m
CONFIG_INET_ESP=m
# CONFIG_INET_ESP_OFFLOAD is not set
# CONFIG_INET_ESPINTCP is not set
CONFIG_INET_IPCOMP=m
CONFIG_INET_XFRM_TUNNEL=m
CONFIG_INET_TUNNEL=y
CONFIG_INET_DIAG=y
CONFIG_INET_TCP_DIAG=y
# CONFIG_INET_UDP_DIAG is not set
# CONFIG_INET_RAW_DIAG is not set
# CONFIG_INET_DIAG_DESTROY is not set
CONFIG_TCP_CONG_ADVANCED=y
CONFIG_TCP_CONG_BIC=m
CONFIG_TCP_CONG_CUBIC=y
CONFIG_TCP_CONG_WESTWOOD=m
CONFIG_TCP_CONG_HTCP=m
# CONFIG_TCP_CONG_HSTCP is not set
# CONFIG_TCP_CONG_HYBLA is not set
# CONFIG_TCP_CONG_VEGAS is not set
# CONFIG_TCP_CONG_NV is not set
# CONFIG_TCP_CONG_SCALABLE is not set
# CONFIG_TCP_CONG_LP is not set
# CONFIG_TCP_CONG_VENO is not set
# CONFIG_TCP_CONG_YEAH is not set
# CONFIG_TCP_CONG_ILLINOIS is not set
# CONFIG_TCP_CONG_DCTCP is not set
# CONFIG_TCP_CONG_CDG is not set
# CONFIG_TCP_CONG_BBR is not set
CONFIG_DEFAULT_CUBIC=y
# CONFIG_DEFAULT_RENO is not set
CONFIG_DEFAULT_TCP_CONG="cubic"
# CONFIG_TCP_MD5SIG is not set
CONFIG_IPV6=y
CONFIG_IPV6_ROUTER_PREF=y
CONFIG_IPV6_ROUTE_INFO=y
# CONFIG_IPV6_OPTIMISTIC_DAD is not set
CONFIG_INET6_AH=m
CONFIG_INET6_ESP=m
# CONFIG_INET6_ESP_OFFLOAD is not set
# CONFIG_INET6_ESPINTCP is not set
CONFIG_INET6_IPCOMP=m
# CONFIG_IPV6_MIP6 is not set
# CONFIG_IPV6_ILA is not set
CONFIG_INET6_XFRM_TUNNEL=m
CONFIG_INET6_TUNNEL=m
# CONFIG_IPV6_VTI is not set
CONFIG_IPV6_SIT=m
# CONFIG_IPV6_SIT_6RD is not set
CONFIG_IPV6_NDISC_NODETYPE=y
CONFIG_IPV6_TUNNEL=m
CONFIG_IPV6_GRE=m
CONFIG_IPV6_MULTIPLE_TABLES=y
# CONFIG_IPV6_SUBTREES is not set
CONFIG_IPV6_MROUTE=y
# CONFIG_IPV6_MROUTE_MULTIPLE_TABLES is not set
# CONFIG_IPV6_PIMSM_V2 is not set
# CONFIG_IPV6_SEG6_LWTUNNEL is not set
# CONFIG_IPV6_SEG6_HMAC is not set
# CONFIG_IPV6_RPL_LWTUNNEL is not set
# CONFIG_IPV6_IOAM6_LWTUNNEL is not set
# CONFIG_NETLABEL is not set
# CONFIG_MPTCP is not set
CONFIG_NETWORK_SECMARK=y
CONFIG_NET_PTP_CLASSIFY=y
# CONFIG_NETWORK_PHY_TIMESTAMPING is not set
CONFIG_NETFILTER=y
CONFIG_NETFILTER_ADVANCED=y
#
# Core Netfilter Configuration
#
CONFIG_NETFILTER_INGRESS=y
CONFIG_NETFILTER_EGRESS=y
CONFIG_NETFILTER_SKIP_EGRESS=y
CONFIG_NETFILTER_NETLINK=m
CONFIG_NETFILTER_FAMILY_ARP=y
# CONFIG_NETFILTER_NETLINK_ACCT is not set
CONFIG_NETFILTER_NETLINK_QUEUE=m
CONFIG_NETFILTER_NETLINK_LOG=m
CONFIG_NETFILTER_NETLINK_OSF=m
CONFIG_NF_CONNTRACK=m
# CONFIG_NF_LOG_SYSLOG is not set
CONFIG_NETFILTER_CONNCOUNT=m
CONFIG_NF_CONNTRACK_MARK=y
CONFIG_NF_CONNTRACK_SECMARK=y
CONFIG_NF_CONNTRACK_ZONES=y
CONFIG_NF_CONNTRACK_PROCFS=y
CONFIG_NF_CONNTRACK_EVENTS=y
# CONFIG_NF_CONNTRACK_TIMEOUT is not set
# CONFIG_NF_CONNTRACK_TIMESTAMP is not set
# CONFIG_NF_CONNTRACK_LABELS is not set
# CONFIG_NF_CT_PROTO_DCCP is not set
CONFIG_NF_CT_PROTO_GRE=y
# CONFIG_NF_CT_PROTO_SCTP is not set
CONFIG_NF_CT_PROTO_UDPLITE=y
CONFIG_NF_CONNTRACK_AMANDA=m
CONFIG_NF_CONNTRACK_FTP=m
CONFIG_NF_CONNTRACK_H323=m
CONFIG_NF_CONNTRACK_IRC=m
CONFIG_NF_CONNTRACK_BROADCAST=m
CONFIG_NF_CONNTRACK_NETBIOS_NS=m
# CONFIG_NF_CONNTRACK_SNMP is not set
CONFIG_NF_CONNTRACK_PPTP=m
# CONFIG_NF_CONNTRACK_SANE is not set
CONFIG_NF_CONNTRACK_SIP=m
CONFIG_NF_CONNTRACK_TFTP=m
CONFIG_NF_CT_NETLINK=m
# CONFIG_NETFILTER_NETLINK_GLUE_CT is not set
# CONFIG_NF_NAT is not set
# CONFIG_NF_TABLES is not set
CONFIG_NETFILTER_XTABLES=m
CONFIG_NETFILTER_XTABLES_COMPAT=y
#
# Xtables combined modules
#
CONFIG_NETFILTER_XT_MARK=m
CONFIG_NETFILTER_XT_CONNMARK=m
#
# Xtables targets
#
# CONFIG_NETFILTER_XT_TARGET_AUDIT is not set
CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=m
CONFIG_NETFILTER_XT_TARGET_CT=m
CONFIG_NETFILTER_XT_TARGET_DSCP=m
CONFIG_NETFILTER_XT_TARGET_HL=m
# CONFIG_NETFILTER_XT_TARGET_HMARK is not set
CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m
# CONFIG_NETFILTER_XT_TARGET_LOG is not set
CONFIG_NETFILTER_XT_TARGET_MARK=m
CONFIG_NETFILTER_XT_TARGET_NFLOG=m
CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
# CONFIG_NETFILTER_XT_TARGET_NOTRACK is not set
CONFIG_NETFILTER_XT_TARGET_RATEEST=m
CONFIG_NETFILTER_XT_TARGET_TEE=m
# CONFIG_NETFILTER_XT_TARGET_TPROXY is not set
CONFIG_NETFILTER_XT_TARGET_TRACE=m
CONFIG_NETFILTER_XT_TARGET_SECMARK=m
CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
# CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP is not set
#
# Xtables matches
#
# CONFIG_NETFILTER_XT_MATCH_ADDRTYPE is not set
# CONFIG_NETFILTER_XT_MATCH_BPF is not set
# CONFIG_NETFILTER_XT_MATCH_CGROUP is not set
CONFIG_NETFILTER_XT_MATCH_CLUSTER=m
CONFIG_NETFILTER_XT_MATCH_COMMENT=m
CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
# CONFIG_NETFILTER_XT_MATCH_CONNLABEL is not set
CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m
CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
CONFIG_NETFILTER_XT_MATCH_CPU=m
CONFIG_NETFILTER_XT_MATCH_DCCP=m
# CONFIG_NETFILTER_XT_MATCH_DEVGROUP is not set
CONFIG_NETFILTER_XT_MATCH_DSCP=m
CONFIG_NETFILTER_XT_MATCH_ECN=m
CONFIG_NETFILTER_XT_MATCH_ESP=m
CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
CONFIG_NETFILTER_XT_MATCH_HELPER=m
CONFIG_NETFILTER_XT_MATCH_HL=m
# CONFIG_NETFILTER_XT_MATCH_IPCOMP is not set
CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
CONFIG_NETFILTER_XT_MATCH_IPVS=m
# CONFIG_NETFILTER_XT_MATCH_L2TP is not set
CONFIG_NETFILTER_XT_MATCH_LENGTH=m
CONFIG_NETFILTER_XT_MATCH_LIMIT=m
CONFIG_NETFILTER_XT_MATCH_MAC=m
CONFIG_NETFILTER_XT_MATCH_MARK=m
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
# CONFIG_NETFILTER_XT_MATCH_NFACCT is not set
CONFIG_NETFILTER_XT_MATCH_OSF=m
CONFIG_NETFILTER_XT_MATCH_OWNER=m
CONFIG_NETFILTER_XT_MATCH_POLICY=m
CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
CONFIG_NETFILTER_XT_MATCH_QUOTA=m
CONFIG_NETFILTER_XT_MATCH_RATEEST=m
CONFIG_NETFILTER_XT_MATCH_REALM=m
CONFIG_NETFILTER_XT_MATCH_RECENT=m
# CONFIG_NETFILTER_XT_MATCH_SCTP is not set
# CONFIG_NETFILTER_XT_MATCH_SOCKET is not set
CONFIG_NETFILTER_XT_MATCH_STATE=m
CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
CONFIG_NETFILTER_XT_MATCH_STRING=m
CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
CONFIG_NETFILTER_XT_MATCH_TIME=m
CONFIG_NETFILTER_XT_MATCH_U32=m
# end of Core Netfilter Configuration
# CONFIG_IP_SET is not set
CONFIG_IP_VS=m
CONFIG_IP_VS_IPV6=y
# CONFIG_IP_VS_DEBUG is not set
CONFIG_IP_VS_TAB_BITS=12
#
# IPVS transport protocol load balancing support
#
CONFIG_IP_VS_PROTO_TCP=y
CONFIG_IP_VS_PROTO_UDP=y
CONFIG_IP_VS_PROTO_AH_ESP=y
CONFIG_IP_VS_PROTO_ESP=y
CONFIG_IP_VS_PROTO_AH=y
CONFIG_IP_VS_PROTO_SCTP=y
#
# IPVS scheduler
#
CONFIG_IP_VS_RR=m
CONFIG_IP_VS_WRR=m
CONFIG_IP_VS_LC=m
CONFIG_IP_VS_WLC=m
# CONFIG_IP_VS_FO is not set
# CONFIG_IP_VS_OVF is not set
CONFIG_IP_VS_LBLC=m
CONFIG_IP_VS_LBLCR=m
CONFIG_IP_VS_DH=m
CONFIG_IP_VS_SH=m
# CONFIG_IP_VS_MH is not set
CONFIG_IP_VS_SED=m
CONFIG_IP_VS_NQ=m
# CONFIG_IP_VS_TWOS is not set
#
# IPVS SH scheduler
#
CONFIG_IP_VS_SH_TAB_BITS=8
#
# IPVS MH scheduler
#
CONFIG_IP_VS_MH_TAB_INDEX=12
#
# IPVS application helper
#
CONFIG_IP_VS_NFCT=y
CONFIG_IP_VS_PE_SIP=m
#
# IP: Netfilter Configuration
#
CONFIG_NF_DEFRAG_IPV4=m
# CONFIG_NF_SOCKET_IPV4 is not set
# CONFIG_NF_TPROXY_IPV4 is not set
CONFIG_NF_DUP_IPV4=m
# CONFIG_NF_LOG_ARP is not set
# CONFIG_NF_LOG_IPV4 is not set
CONFIG_NF_REJECT_IPV4=m
CONFIG_IP_NF_IPTABLES=m
CONFIG_IP_NF_MATCH_AH=m
CONFIG_IP_NF_MATCH_ECN=m
# CONFIG_IP_NF_MATCH_RPFILTER is not set
CONFIG_IP_NF_MATCH_TTL=m
CONFIG_IP_NF_FILTER=m
CONFIG_IP_NF_TARGET_REJECT=m
# CONFIG_IP_NF_TARGET_SYNPROXY is not set
# CONFIG_IP_NF_NAT is not set
CONFIG_IP_NF_MANGLE=m
# CONFIG_IP_NF_TARGET_CLUSTERIP is not set
CONFIG_IP_NF_TARGET_ECN=m
CONFIG_IP_NF_TARGET_TTL=m
CONFIG_IP_NF_RAW=m
# CONFIG_IP_NF_SECURITY is not set
CONFIG_IP_NF_ARPTABLES=m
CONFIG_IP_NF_ARPFILTER=m
CONFIG_IP_NF_ARP_MANGLE=m
# end of IP: Netfilter Configuration
#
# IPv6: Netfilter Configuration
#
# CONFIG_NF_SOCKET_IPV6 is not set
# CONFIG_NF_TPROXY_IPV6 is not set
CONFIG_NF_DUP_IPV6=m
CONFIG_NF_REJECT_IPV6=m
# CONFIG_NF_LOG_IPV6 is not set
CONFIG_IP6_NF_IPTABLES=m
CONFIG_IP6_NF_MATCH_AH=m
CONFIG_IP6_NF_MATCH_EUI64=m
CONFIG_IP6_NF_MATCH_FRAG=m
CONFIG_IP6_NF_MATCH_OPTS=m
CONFIG_IP6_NF_MATCH_HL=m
CONFIG_IP6_NF_MATCH_IPV6HEADER=m
CONFIG_IP6_NF_MATCH_MH=m
# CONFIG_IP6_NF_MATCH_RPFILTER is not set
CONFIG_IP6_NF_MATCH_RT=m
# CONFIG_IP6_NF_MATCH_SRH is not set
CONFIG_IP6_NF_TARGET_HL=m
CONFIG_IP6_NF_FILTER=m
CONFIG_IP6_NF_TARGET_REJECT=m
# CONFIG_IP6_NF_TARGET_SYNPROXY is not set
CONFIG_IP6_NF_MANGLE=m
CONFIG_IP6_NF_RAW=m
# CONFIG_IP6_NF_SECURITY is not set
# CONFIG_IP6_NF_NAT is not set
# end of IPv6: Netfilter Configuration
CONFIG_NF_DEFRAG_IPV6=m
# CONFIG_NF_CONNTRACK_BRIDGE is not set
# CONFIG_BPFILTER is not set
# CONFIG_IP_DCCP is not set
# CONFIG_IP_SCTP is not set
# CONFIG_RDS is not set
# CONFIG_TIPC is not set
# CONFIG_ATM is not set
# CONFIG_L2TP is not set
# CONFIG_BRIDGE is not set
# CONFIG_NET_DSA is not set
# CONFIG_VLAN_8021Q is not set
# CONFIG_DECNET is not set
# CONFIG_LLC2 is not set
# CONFIG_ATALK is not set
# CONFIG_X25 is not set
# CONFIG_LAPB is not set
# CONFIG_PHONET is not set
# CONFIG_6LOWPAN is not set
# CONFIG_IEEE802154 is not set
CONFIG_NET_SCHED=y
#
# Queueing/Scheduling
#
CONFIG_NET_SCH_CBQ=m
CONFIG_NET_SCH_HTB=m
CONFIG_NET_SCH_HFSC=m
CONFIG_NET_SCH_PRIO=m
CONFIG_NET_SCH_MULTIQ=m
CONFIG_NET_SCH_RED=m
# CONFIG_NET_SCH_SFB is not set
CONFIG_NET_SCH_SFQ=m
CONFIG_NET_SCH_TEQL=m
CONFIG_NET_SCH_TBF=m
# CONFIG_NET_SCH_CBS is not set
# CONFIG_NET_SCH_ETF is not set
# CONFIG_NET_SCH_TAPRIO is not set
CONFIG_NET_SCH_GRED=m
CONFIG_NET_SCH_DSMARK=m
CONFIG_NET_SCH_NETEM=m
CONFIG_NET_SCH_DRR=m
# CONFIG_NET_SCH_MQPRIO is not set
# CONFIG_NET_SCH_SKBPRIO is not set
# CONFIG_NET_SCH_CHOKE is not set
# CONFIG_NET_SCH_QFQ is not set
# CONFIG_NET_SCH_CODEL is not set
# CONFIG_NET_SCH_FQ_CODEL is not set
# CONFIG_NET_SCH_CAKE is not set
# CONFIG_NET_SCH_FQ is not set
# CONFIG_NET_SCH_HHF is not set
# CONFIG_NET_SCH_PIE is not set
CONFIG_NET_SCH_INGRESS=m
# CONFIG_NET_SCH_PLUG is not set
# CONFIG_NET_SCH_ETS is not set
# CONFIG_NET_SCH_DEFAULT is not set
#
# Classification
#
CONFIG_NET_CLS=y
CONFIG_NET_CLS_BASIC=m
CONFIG_NET_CLS_TCINDEX=m
CONFIG_NET_CLS_ROUTE4=m
CONFIG_NET_CLS_FW=m
CONFIG_NET_CLS_U32=m
# CONFIG_CLS_U32_PERF is not set
CONFIG_CLS_U32_MARK=y
CONFIG_NET_CLS_RSVP=m
CONFIG_NET_CLS_RSVP6=m
CONFIG_NET_CLS_FLOW=m
CONFIG_NET_CLS_CGROUP=y
# CONFIG_NET_CLS_BPF is not set
# CONFIG_NET_CLS_FLOWER is not set
# CONFIG_NET_CLS_MATCHALL is not set
CONFIG_NET_EMATCH=y
CONFIG_NET_EMATCH_STACK=32
CONFIG_NET_EMATCH_CMP=m
CONFIG_NET_EMATCH_NBYTE=m
CONFIG_NET_EMATCH_U32=m
CONFIG_NET_EMATCH_META=m
CONFIG_NET_EMATCH_TEXT=m
# CONFIG_NET_EMATCH_IPT is not set
CONFIG_NET_CLS_ACT=y
CONFIG_NET_ACT_POLICE=m
CONFIG_NET_ACT_GACT=m
CONFIG_GACT_PROB=y
CONFIG_NET_ACT_MIRRED=m
# CONFIG_NET_ACT_SAMPLE is not set
CONFIG_NET_ACT_IPT=m
CONFIG_NET_ACT_NAT=m
CONFIG_NET_ACT_PEDIT=m
CONFIG_NET_ACT_SIMP=m
CONFIG_NET_ACT_SKBEDIT=m
CONFIG_NET_ACT_CSUM=m
# CONFIG_NET_ACT_MPLS is not set
# CONFIG_NET_ACT_VLAN is not set
# CONFIG_NET_ACT_BPF is not set
# CONFIG_NET_ACT_CONNMARK is not set
# CONFIG_NET_ACT_CTINFO is not set
# CONFIG_NET_ACT_SKBMOD is not set
# CONFIG_NET_ACT_IFE is not set
# CONFIG_NET_ACT_TUNNEL_KEY is not set
# CONFIG_NET_ACT_GATE is not set
# CONFIG_NET_TC_SKB_EXT is not set
CONFIG_NET_SCH_FIFO=y
CONFIG_DCB=y
CONFIG_DNS_RESOLVER=y
# CONFIG_BATMAN_ADV is not set
# CONFIG_OPENVSWITCH is not set
# CONFIG_VSOCKETS is not set
# CONFIG_NETLINK_DIAG is not set
# CONFIG_MPLS is not set
# CONFIG_NET_NSH is not set
# CONFIG_HSR is not set
# CONFIG_NET_SWITCHDEV is not set
# CONFIG_NET_L3_MASTER_DEV is not set
# CONFIG_QRTR is not set
# CONFIG_NET_NCSI is not set
CONFIG_PCPU_DEV_REFCNT=y
CONFIG_RPS=y
CONFIG_RFS_ACCEL=y
CONFIG_SOCK_RX_QUEUE_MAPPING=y
CONFIG_XPS=y
# CONFIG_CGROUP_NET_PRIO is not set
CONFIG_CGROUP_NET_CLASSID=y
CONFIG_NET_RX_BUSY_POLL=y
CONFIG_BQL=y
CONFIG_BPF_STREAM_PARSER=y
CONFIG_NET_FLOW_LIMIT=y
#
# Network testing
#
CONFIG_NET_PKTGEN=m
# CONFIG_NET_DROP_MONITOR is not set
# end of Network testing
# end of Networking options
# CONFIG_HAMRADIO is not set
# CONFIG_CAN is not set
# CONFIG_BT is not set
# CONFIG_AF_RXRPC is not set
# CONFIG_AF_KCM is not set
CONFIG_STREAM_PARSER=y
# CONFIG_MCTP is not set
CONFIG_FIB_RULES=y
# CONFIG_WIRELESS is not set
# CONFIG_RFKILL is not set
# CONFIG_NET_9P is not set
# CONFIG_CAIF is not set
# CONFIG_CEPH_LIB is not set
# CONFIG_NFC is not set
# CONFIG_PSAMPLE is not set
# CONFIG_NET_IFE is not set
# CONFIG_LWTUNNEL is not set
CONFIG_DST_CACHE=y
CONFIG_GRO_CELLS=y
CONFIG_NET_SELFTESTS=y
CONFIG_NET_SOCK_MSG=y
CONFIG_NET_DEVLINK=y
CONFIG_PAGE_POOL=y
# CONFIG_PAGE_POOL_STATS is not set
CONFIG_FAILOVER=y
CONFIG_ETHTOOL_NETLINK=y
# CONFIG_NETDEV_ADDR_LIST_TEST is not set
#
# Device Drivers
#
CONFIG_HAVE_EISA=y
# CONFIG_EISA is not set
CONFIG_HAVE_PCI=y
CONFIG_PCI=y
CONFIG_PCI_DOMAINS=y
CONFIG_PCIEPORTBUS=y
CONFIG_HOTPLUG_PCI_PCIE=y
CONFIG_PCIEAER=y
# CONFIG_PCIEAER_INJECT is not set
# CONFIG_PCIE_ECRC is not set
# CONFIG_PCIEASPM is not set
CONFIG_PCIE_PME=y
# CONFIG_PCIE_DPC is not set
# CONFIG_PCIE_PTM is not set
CONFIG_PCI_MSI=y
CONFIG_PCI_MSI_IRQ_DOMAIN=y
CONFIG_PCI_QUIRKS=y
# CONFIG_PCI_DEBUG is not set
# CONFIG_PCI_REALLOC_ENABLE_AUTO is not set
# CONFIG_PCI_STUB is not set
# CONFIG_PCI_PF_STUB is not set
CONFIG_PCI_ATS=y
CONFIG_PCI_LOCKLESS_CONFIG=y
CONFIG_PCI_IOV=y
# CONFIG_PCI_PRI is not set
# CONFIG_PCI_PASID is not set
CONFIG_PCI_LABEL=y
# CONFIG_PCIE_BUS_TUNE_OFF is not set
CONFIG_PCIE_BUS_DEFAULT=y
# CONFIG_PCIE_BUS_SAFE is not set
# CONFIG_PCIE_BUS_PERFORMANCE is not set
# CONFIG_PCIE_BUS_PEER2PEER is not set
CONFIG_VGA_ARB=y
CONFIG_VGA_ARB_MAX_GPUS=16
CONFIG_HOTPLUG_PCI=y
# CONFIG_HOTPLUG_PCI_ACPI is not set
CONFIG_HOTPLUG_PCI_CPCI=y
CONFIG_HOTPLUG_PCI_CPCI_ZT5550=m
CONFIG_HOTPLUG_PCI_CPCI_GENERIC=m
# CONFIG_HOTPLUG_PCI_SHPC is not set
#
# PCI controller drivers
#
# CONFIG_VMD is not set
#
# DesignWare PCI Core Support
#
# CONFIG_PCIE_DW_PLAT_HOST is not set
# CONFIG_PCI_MESON is not set
# end of DesignWare PCI Core Support
#
# Mobiveil PCIe Core Support
#
# end of Mobiveil PCIe Core Support
#
# Cadence PCIe controllers support
#
# end of Cadence PCIe controllers support
# end of PCI controller drivers
#
# PCI Endpoint
#
# CONFIG_PCI_ENDPOINT is not set
# end of PCI Endpoint
#
# PCI switch controller drivers
#
# CONFIG_PCI_SW_SWITCHTEC is not set
# end of PCI switch controller drivers
# CONFIG_CXL_BUS is not set
# CONFIG_PCCARD is not set
# CONFIG_RAPIDIO is not set
#
# Generic Driver Options
#
CONFIG_AUXILIARY_BUS=y
CONFIG_UEVENT_HELPER=y
CONFIG_UEVENT_HELPER_PATH=""
CONFIG_DEVTMPFS=y
CONFIG_DEVTMPFS_MOUNT=y
# CONFIG_DEVTMPFS_SAFE is not set
CONFIG_STANDALONE=y
CONFIG_PREVENT_FIRMWARE_BUILD=y
#
# Firmware loader
#
CONFIG_FW_LOADER=y
CONFIG_EXTRA_FIRMWARE=""
# CONFIG_FW_LOADER_USER_HELPER is not set
# CONFIG_FW_LOADER_COMPRESS is not set
# CONFIG_FW_UPLOAD is not set
# end of Firmware loader
CONFIG_ALLOW_DEV_COREDUMP=y
# CONFIG_DEBUG_DRIVER is not set
# CONFIG_DEBUG_DEVRES is not set
# CONFIG_DEBUG_TEST_DRIVER_REMOVE is not set
# CONFIG_PM_QOS_KUNIT_TEST is not set
# CONFIG_TEST_ASYNC_DRIVER_PROBE is not set
# CONFIG_DRIVER_PE_KUNIT_TEST is not set
CONFIG_GENERIC_CPU_AUTOPROBE=y
CONFIG_GENERIC_CPU_VULNERABILITIES=y
CONFIG_DMA_SHARED_BUFFER=y
# CONFIG_DMA_FENCE_TRACE is not set
# end of Generic Driver Options
#
# Bus devices
#
# CONFIG_MHI_BUS is not set
# CONFIG_MHI_BUS_EP is not set
# end of Bus devices
CONFIG_CONNECTOR=y
CONFIG_PROC_EVENTS=y
#
# Firmware Drivers
#
#
# ARM System Control and Management Interface Protocol
#
# end of ARM System Control and Management Interface Protocol
CONFIG_EDD=y
CONFIG_EDD_OFF=y
CONFIG_FIRMWARE_MEMMAP=y
CONFIG_DMIID=y
# CONFIG_DMI_SYSFS is not set
CONFIG_DMI_SCAN_MACHINE_NON_EFI_FALLBACK=y
# CONFIG_ISCSI_IBFT is not set
# CONFIG_FW_CFG_SYSFS is not set
CONFIG_SYSFB=y
# CONFIG_SYSFB_SIMPLEFB is not set
# CONFIG_GOOGLE_FIRMWARE is not set
#
# Tegra firmware driver
#
# end of Tegra firmware driver
# end of Firmware Drivers
# CONFIG_GNSS is not set
# CONFIG_MTD is not set
# CONFIG_OF is not set
CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
# CONFIG_PARPORT is not set
CONFIG_PNP=y
# CONFIG_PNP_DEBUG_MESSAGES is not set
#
# Protocols
#
CONFIG_PNPACPI=y
CONFIG_BLK_DEV=y
CONFIG_BLK_DEV_NULL_BLK=m
# CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION is not set
# CONFIG_BLK_DEV_FD is not set
CONFIG_CDROM=y
CONFIG_BLK_DEV_PCIESSD_MTIP32XX=y
# CONFIG_ZRAM is not set
CONFIG_BLK_DEV_LOOP=y
CONFIG_BLK_DEV_LOOP_MIN_COUNT=8
# CONFIG_BLK_DEV_DRBD is not set
# CONFIG_BLK_DEV_NBD is not set
# CONFIG_BLK_DEV_SX8 is not set
CONFIG_BLK_DEV_RAM=y
CONFIG_BLK_DEV_RAM_COUNT=16
CONFIG_BLK_DEV_RAM_SIZE=65536
# CONFIG_CDROM_PKTCDVD is not set
# CONFIG_ATA_OVER_ETH is not set
CONFIG_VIRTIO_BLK=y
# CONFIG_BLK_DEV_RBD is not set
#
# NVME Support
#
CONFIG_NVME_CORE=y
CONFIG_BLK_DEV_NVME=y
# CONFIG_NVME_MULTIPATH is not set
# CONFIG_NVME_VERBOSE_ERRORS is not set
# CONFIG_NVME_FC is not set
# CONFIG_NVME_TCP is not set
# CONFIG_NVME_TARGET is not set
# end of NVME Support
#
# Misc devices
#
# CONFIG_AD525X_DPOT is not set
# CONFIG_DUMMY_IRQ is not set
# CONFIG_IBM_ASM is not set
# CONFIG_PHANTOM is not set
# CONFIG_TIFM_CORE is not set
# CONFIG_ICS932S401 is not set
# CONFIG_ENCLOSURE_SERVICES is not set
# CONFIG_HP_ILO is not set
# CONFIG_APDS9802ALS is not set
# CONFIG_ISL29003 is not set
# CONFIG_ISL29020 is not set
# CONFIG_SENSORS_TSL2550 is not set
# CONFIG_SENSORS_BH1770 is not set
# CONFIG_SENSORS_APDS990X is not set
# CONFIG_HMC6352 is not set
# CONFIG_DS1682 is not set
# CONFIG_SRAM is not set
# CONFIG_DW_XDATA_PCIE is not set
# CONFIG_PCI_ENDPOINT_TEST is not set
# CONFIG_XILINX_SDFEC is not set
# CONFIG_C2PORT is not set
#
# EEPROM support
#
# CONFIG_EEPROM_AT24 is not set
# CONFIG_EEPROM_LEGACY is not set
# CONFIG_EEPROM_MAX6875 is not set
# CONFIG_EEPROM_93CX6 is not set
# CONFIG_EEPROM_IDT_89HPESX is not set
# CONFIG_EEPROM_EE1004 is not set
# end of EEPROM support
# CONFIG_CB710_CORE is not set
#
# Texas Instruments shared transport line discipline
#
# CONFIG_TI_ST is not set
# end of Texas Instruments shared transport line discipline
# CONFIG_SENSORS_LIS3_I2C is not set
# CONFIG_ALTERA_STAPL is not set
# CONFIG_INTEL_MEI is not set
# CONFIG_INTEL_MEI_ME is not set
# CONFIG_INTEL_MEI_TXE is not set
# CONFIG_VMWARE_VMCI is not set
# CONFIG_GENWQE is not set
# CONFIG_ECHO is not set
# CONFIG_BCM_VK is not set
# CONFIG_MISC_ALCOR_PCI is not set
# CONFIG_MISC_RTSX_PCI is not set
# CONFIG_HABANA_AI is not set
# CONFIG_PVPANIC is not set
# end of Misc devices
#
# SCSI device support
#
CONFIG_SCSI_MOD=y
CONFIG_RAID_ATTRS=y
CONFIG_SCSI_COMMON=y
CONFIG_SCSI=y
CONFIG_SCSI_DMA=y
CONFIG_SCSI_PROC_FS=y
#
# SCSI support type (disk, tape, CD-ROM)
#
CONFIG_BLK_DEV_SD=y
# CONFIG_CHR_DEV_ST is not set
CONFIG_BLK_DEV_SR=y
CONFIG_CHR_DEV_SG=y
CONFIG_BLK_DEV_BSG=y
# CONFIG_CHR_DEV_SCH is not set
CONFIG_SCSI_CONSTANTS=y
CONFIG_SCSI_LOGGING=y
CONFIG_SCSI_SCAN_ASYNC=y
#
# SCSI Transports
#
CONFIG_SCSI_SPI_ATTRS=y
# CONFIG_SCSI_FC_ATTRS is not set
# CONFIG_SCSI_ISCSI_ATTRS is not set
CONFIG_SCSI_SAS_ATTRS=y
CONFIG_SCSI_SAS_LIBSAS=y
CONFIG_SCSI_SAS_ATA=y
CONFIG_SCSI_SAS_HOST_SMP=y
# CONFIG_SCSI_SRP_ATTRS is not set
# end of SCSI Transports
CONFIG_SCSI_LOWLEVEL=y
# CONFIG_ISCSI_TCP is not set
# CONFIG_ISCSI_BOOT_SYSFS is not set
# CONFIG_SCSI_CXGB3_ISCSI is not set
# CONFIG_SCSI_CXGB4_ISCSI is not set
# CONFIG_SCSI_BNX2_ISCSI is not set
# CONFIG_BE2ISCSI is not set
# CONFIG_BLK_DEV_3W_XXXX_RAID is not set
# CONFIG_SCSI_HPSA is not set
# CONFIG_SCSI_3W_9XXX is not set
# CONFIG_SCSI_3W_SAS is not set
# CONFIG_SCSI_ACARD is not set
# CONFIG_SCSI_AACRAID is not set
# CONFIG_SCSI_AIC7XXX is not set
# CONFIG_SCSI_AIC79XX is not set
# CONFIG_SCSI_AIC94XX is not set
# CONFIG_SCSI_MVSAS is not set
# CONFIG_SCSI_MVUMI is not set
# CONFIG_SCSI_DPT_I2O is not set
# CONFIG_SCSI_ADVANSYS is not set
# CONFIG_SCSI_ARCMSR is not set
# CONFIG_SCSI_ESAS2R is not set
# CONFIG_MEGARAID_NEWGEN is not set
# CONFIG_MEGARAID_LEGACY is not set
# CONFIG_MEGARAID_SAS is not set
# CONFIG_SCSI_MPT3SAS is not set
# CONFIG_SCSI_MPT2SAS is not set
# CONFIG_SCSI_MPI3MR is not set
# CONFIG_SCSI_SMARTPQI is not set
# CONFIG_SCSI_HPTIOP is not set
# CONFIG_SCSI_BUSLOGIC is not set
# CONFIG_SCSI_MYRB is not set
# CONFIG_SCSI_MYRS is not set
# CONFIG_VMWARE_PVSCSI is not set
# CONFIG_SCSI_SNIC is not set
# CONFIG_SCSI_DMX3191D is not set
# CONFIG_SCSI_FDOMAIN_PCI is not set
# CONFIG_SCSI_ISCI is not set
# CONFIG_SCSI_IPS is not set
# CONFIG_SCSI_INITIO is not set
# CONFIG_SCSI_INIA100 is not set
# CONFIG_SCSI_STEX is not set
CONFIG_SCSI_SYM53C8XX_2=y
CONFIG_SCSI_SYM53C8XX_DMA_ADDRESSING_MODE=1
CONFIG_SCSI_SYM53C8XX_DEFAULT_TAGS=16
CONFIG_SCSI_SYM53C8XX_MAX_TAGS=64
CONFIG_SCSI_SYM53C8XX_MMIO=y
CONFIG_SCSI_IPR=y
CONFIG_SCSI_IPR_TRACE=y
CONFIG_SCSI_IPR_DUMP=y
# CONFIG_SCSI_QLOGIC_1280 is not set
# CONFIG_SCSI_QLA_ISCSI is not set
# CONFIG_SCSI_DC395x is not set
# CONFIG_SCSI_AM53C974 is not set
# CONFIG_SCSI_WD719X is not set
# CONFIG_SCSI_DEBUG is not set
CONFIG_SCSI_PMCRAID=y
# CONFIG_SCSI_PM8001 is not set
CONFIG_SCSI_VIRTIO=y
CONFIG_SCSI_DH=y
# CONFIG_SCSI_DH_RDAC is not set
# CONFIG_SCSI_DH_HP_SW is not set
# CONFIG_SCSI_DH_EMC is not set
# CONFIG_SCSI_DH_ALUA is not set
# end of SCSI device support
CONFIG_ATA=y
CONFIG_SATA_HOST=y
CONFIG_PATA_TIMINGS=y
CONFIG_ATA_VERBOSE_ERROR=y
CONFIG_ATA_FORCE=y
CONFIG_ATA_ACPI=y
# CONFIG_SATA_ZPODD is not set
CONFIG_SATA_PMP=y
#
# Controllers with non-SFF native interface
#
CONFIG_SATA_AHCI=y
CONFIG_SATA_MOBILE_LPM_POLICY=0
# CONFIG_SATA_AHCI_PLATFORM is not set
# CONFIG_SATA_INIC162X is not set
# CONFIG_SATA_ACARD_AHCI is not set
CONFIG_SATA_SIL24=m
CONFIG_ATA_SFF=y
#
# SFF controllers with custom DMA interface
#
# CONFIG_PDC_ADMA is not set
# CONFIG_SATA_QSTOR is not set
# CONFIG_SATA_SX4 is not set
CONFIG_ATA_BMDMA=y
#
# SATA SFF controllers with BMDMA
#
CONFIG_ATA_PIIX=y
# CONFIG_SATA_MV is not set
# CONFIG_SATA_NV is not set
# CONFIG_SATA_PROMISE is not set
# CONFIG_SATA_SIL is not set
# CONFIG_SATA_SIS is not set
# CONFIG_SATA_SVW is not set
# CONFIG_SATA_ULI is not set
# CONFIG_SATA_VIA is not set
# CONFIG_SATA_VITESSE is not set
#
# PATA SFF controllers with BMDMA
#
# CONFIG_PATA_ALI is not set
# CONFIG_PATA_AMD is not set
# CONFIG_PATA_ARTOP is not set
# CONFIG_PATA_ATIIXP is not set
# CONFIG_PATA_ATP867X is not set
# CONFIG_PATA_CMD64X is not set
# CONFIG_PATA_CYPRESS is not set
# CONFIG_PATA_EFAR is not set
# CONFIG_PATA_HPT366 is not set
# CONFIG_PATA_HPT37X is not set
# CONFIG_PATA_HPT3X2N is not set
# CONFIG_PATA_HPT3X3 is not set
# CONFIG_PATA_IT8213 is not set
# CONFIG_PATA_IT821X is not set
# CONFIG_PATA_JMICRON is not set
# CONFIG_PATA_MARVELL is not set
# CONFIG_PATA_NETCELL is not set
# CONFIG_PATA_NINJA32 is not set
# CONFIG_PATA_NS87415 is not set
CONFIG_PATA_OLDPIIX=y
# CONFIG_PATA_OPTIDMA is not set
# CONFIG_PATA_PDC2027X is not set
# CONFIG_PATA_PDC_OLD is not set
# CONFIG_PATA_RADISYS is not set
# CONFIG_PATA_RDC is not set
# CONFIG_PATA_SCH is not set
# CONFIG_PATA_SERVERWORKS is not set
# CONFIG_PATA_SIL680 is not set
# CONFIG_PATA_SIS is not set
# CONFIG_PATA_TOSHIBA is not set
# CONFIG_PATA_TRIFLEX is not set
# CONFIG_PATA_VIA is not set
# CONFIG_PATA_WINBOND is not set
#
# PIO-only SFF controllers
#
# CONFIG_PATA_CMD640_PCI is not set
CONFIG_PATA_MPIIX=y
# CONFIG_PATA_NS87410 is not set
# CONFIG_PATA_OPTI is not set
# CONFIG_PATA_PLATFORM is not set
# CONFIG_PATA_RZ1000 is not set
#
# Generic fallback / legacy drivers
#
# CONFIG_PATA_ACPI is not set
# CONFIG_ATA_GENERIC is not set
# CONFIG_PATA_LEGACY is not set
CONFIG_MD=y
CONFIG_BLK_DEV_MD=y
CONFIG_MD_AUTODETECT=y
CONFIG_MD_LINEAR=y
CONFIG_MD_RAID0=y
CONFIG_MD_RAID1=y
CONFIG_MD_RAID10=y
CONFIG_MD_RAID456=y
# CONFIG_MD_MULTIPATH is not set
# CONFIG_MD_FAULTY is not set
CONFIG_BCACHE=y
# CONFIG_BCACHE_DEBUG is not set
# CONFIG_BCACHE_CLOSURES_DEBUG is not set
# CONFIG_BCACHE_ASYNC_REGISTRATION is not set
CONFIG_BLK_DEV_DM_BUILTIN=y
CONFIG_BLK_DEV_DM=y
CONFIG_DM_DEBUG=y
CONFIG_DM_BUFIO=y
CONFIG_DM_DEBUG_BLOCK_MANAGER_LOCKING=y
CONFIG_DM_DEBUG_BLOCK_STACK_TRACING=y
CONFIG_DM_BIO_PRISON=y
CONFIG_DM_PERSISTENT_DATA=y
CONFIG_DM_UNSTRIPED=y
CONFIG_DM_CRYPT=y
CONFIG_DM_SNAPSHOT=y
CONFIG_DM_THIN_PROVISIONING=y
CONFIG_DM_CACHE=y
CONFIG_DM_CACHE_SMQ=y
CONFIG_DM_WRITECACHE=y
# CONFIG_DM_EBS is not set
CONFIG_DM_ERA=y
CONFIG_DM_CLONE=y
CONFIG_DM_MIRROR=y
CONFIG_DM_LOG_USERSPACE=y
CONFIG_DM_RAID=y
CONFIG_DM_ZERO=y
CONFIG_DM_MULTIPATH=y
CONFIG_DM_MULTIPATH_QL=y
CONFIG_DM_MULTIPATH_ST=y
# CONFIG_DM_MULTIPATH_HST is not set
# CONFIG_DM_MULTIPATH_IOA is not set
CONFIG_DM_DELAY=y
# CONFIG_DM_DUST is not set
CONFIG_DM_INIT=y
CONFIG_DM_UEVENT=y
# CONFIG_DM_FLAKEY is not set
# CONFIG_DM_VERITY is not set
# CONFIG_DM_SWITCH is not set
# CONFIG_DM_LOG_WRITES is not set
# CONFIG_DM_INTEGRITY is not set
# CONFIG_DM_AUDIT is not set
CONFIG_TARGET_CORE=y
# CONFIG_TCM_IBLOCK is not set
# CONFIG_TCM_FILEIO is not set
# CONFIG_TCM_PSCSI is not set
# CONFIG_TCM_USER2 is not set
CONFIG_LOOPBACK_TARGET=y
# CONFIG_ISCSI_TARGET is not set
CONFIG_FUSION=y
CONFIG_FUSION_SPI=y
CONFIG_FUSION_SAS=y
CONFIG_FUSION_MAX_SGE=128
# CONFIG_FUSION_CTL is not set
# CONFIG_FUSION_LOGGING is not set
#
# IEEE 1394 (FireWire) support
#
# CONFIG_FIREWIRE is not set
# CONFIG_FIREWIRE_NOSY is not set
# end of IEEE 1394 (FireWire) support
# CONFIG_MACINTOSH_DRIVERS is not set
CONFIG_NETDEVICES=y
CONFIG_NET_CORE=y
# CONFIG_BONDING is not set
# CONFIG_DUMMY is not set
# CONFIG_WIREGUARD is not set
# CONFIG_EQUALIZER is not set
# CONFIG_NET_FC is not set
# CONFIG_IFB is not set
# CONFIG_NET_TEAM is not set
# CONFIG_MACVLAN is not set
# CONFIG_IPVLAN is not set
# CONFIG_VXLAN is not set
# CONFIG_GENEVE is not set
# CONFIG_BAREUDP is not set
# CONFIG_GTP is not set
# CONFIG_AMT is not set
# CONFIG_MACSEC is not set
CONFIG_NETCONSOLE=y
# CONFIG_NETCONSOLE_DYNAMIC is not set
CONFIG_NETPOLL=y
CONFIG_NET_POLL_CONTROLLER=y
CONFIG_TUN=y
# CONFIG_TUN_VNET_CROSS_LE is not set
# CONFIG_VETH is not set
CONFIG_VIRTIO_NET=y
CONFIG_NLMON=y
# CONFIG_ARCNET is not set
CONFIG_ETHERNET=y
CONFIG_MDIO=y
# CONFIG_NET_VENDOR_3COM is not set
# CONFIG_NET_VENDOR_ADAPTEC is not set
# CONFIG_NET_VENDOR_AGERE is not set
CONFIG_NET_VENDOR_ALACRITECH=y
# CONFIG_SLICOSS is not set
# CONFIG_NET_VENDOR_ALTEON is not set
# CONFIG_ALTERA_TSE is not set
CONFIG_NET_VENDOR_AMAZON=y
# CONFIG_ENA_ETHERNET is not set
# CONFIG_NET_VENDOR_AMD is not set
CONFIG_NET_VENDOR_AQUANTIA=y
# CONFIG_AQTION is not set
# CONFIG_NET_VENDOR_ARC is not set
CONFIG_NET_VENDOR_ASIX=y
# CONFIG_NET_VENDOR_ATHEROS is not set
# CONFIG_CX_ECAT is not set
# CONFIG_NET_VENDOR_BROADCOM is not set
CONFIG_NET_VENDOR_CADENCE=y
# CONFIG_MACB is not set
CONFIG_NET_VENDOR_CAVIUM=y
# CONFIG_THUNDER_NIC_PF is not set
# CONFIG_THUNDER_NIC_VF is not set
# CONFIG_THUNDER_NIC_BGX is not set
# CONFIG_THUNDER_NIC_RGX is not set
# CONFIG_CAVIUM_PTP is not set
# CONFIG_LIQUIDIO is not set
# CONFIG_LIQUIDIO_VF is not set
# CONFIG_NET_VENDOR_CHELSIO is not set
# CONFIG_NET_VENDOR_CISCO is not set
CONFIG_NET_VENDOR_CORTINA=y
CONFIG_NET_VENDOR_DAVICOM=y
# CONFIG_DNET is not set
# CONFIG_NET_VENDOR_DEC is not set
# CONFIG_NET_VENDOR_DLINK is not set
# CONFIG_NET_VENDOR_EMULEX is not set
CONFIG_NET_VENDOR_ENGLEDER=y
# CONFIG_TSNEP is not set
CONFIG_NET_VENDOR_EZCHIP=y
CONFIG_NET_VENDOR_FUNGIBLE=y
# CONFIG_FUN_ETH is not set
CONFIG_NET_VENDOR_GOOGLE=y
# CONFIG_GVE is not set
CONFIG_NET_VENDOR_HUAWEI=y
# CONFIG_HINIC is not set
CONFIG_NET_VENDOR_I825XX=y
CONFIG_NET_VENDOR_INTEL=y
# CONFIG_E100 is not set
CONFIG_E1000=y
CONFIG_E1000E=y
CONFIG_E1000E_HWTS=y
CONFIG_IGB=y
CONFIG_IGBVF=y
CONFIG_IXGB=y
CONFIG_IXGBE=y
CONFIG_IXGBE_DCB=y
CONFIG_IXGBEVF=y
CONFIG_I40E=y
# CONFIG_I40E_DCB is not set
CONFIG_IAVF=y
CONFIG_I40EVF=y
# CONFIG_ICE is not set
CONFIG_FM10K=y
# CONFIG_IGC is not set
# CONFIG_JME is not set
CONFIG_NET_VENDOR_LITEX=y
# CONFIG_NET_VENDOR_MARVELL is not set
CONFIG_NET_VENDOR_MELLANOX=y
CONFIG_MLX4_EN=y
CONFIG_MLX4_EN_DCB=y
CONFIG_MLX4_CORE=y
CONFIG_MLX4_DEBUG=y
CONFIG_MLX4_CORE_GEN2=y
# CONFIG_MLX5_CORE is not set
# CONFIG_MLXSW_CORE is not set
# CONFIG_MLXFW is not set
# CONFIG_NET_VENDOR_MICREL is not set
CONFIG_NET_VENDOR_MICROCHIP=y
# CONFIG_LAN743X is not set
CONFIG_NET_VENDOR_MICROSEMI=y
CONFIG_NET_VENDOR_MICROSOFT=y
# CONFIG_NET_VENDOR_MYRI is not set
# CONFIG_FEALNX is not set
CONFIG_NET_VENDOR_NI=y
# CONFIG_NI_XGE_MANAGEMENT_ENET is not set
# CONFIG_NET_VENDOR_NATSEMI is not set
CONFIG_NET_VENDOR_NETERION=y
# CONFIG_S2IO is not set
# CONFIG_VXGE is not set
CONFIG_NET_VENDOR_NETRONOME=y
# CONFIG_NFP is not set
# CONFIG_NET_VENDOR_NVIDIA is not set
# CONFIG_NET_VENDOR_OKI is not set
# CONFIG_ETHOC is not set
CONFIG_NET_VENDOR_PACKET_ENGINES=y
# CONFIG_HAMACHI is not set
# CONFIG_YELLOWFIN is not set
CONFIG_NET_VENDOR_PENSANDO=y
# CONFIG_IONIC is not set
# CONFIG_NET_VENDOR_QLOGIC is not set
# CONFIG_NET_VENDOR_BROCADE is not set
CONFIG_NET_VENDOR_QUALCOMM=y
# CONFIG_QCOM_EMAC is not set
# CONFIG_RMNET is not set
# CONFIG_NET_VENDOR_RDC is not set
# CONFIG_NET_VENDOR_REALTEK is not set
CONFIG_NET_VENDOR_RENESAS=y
CONFIG_NET_VENDOR_ROCKER=y
# CONFIG_NET_VENDOR_SAMSUNG is not set
# CONFIG_NET_VENDOR_SEEQ is not set
# CONFIG_NET_VENDOR_SILAN is not set
# CONFIG_NET_VENDOR_SIS is not set
CONFIG_NET_VENDOR_SOLARFLARE=y
# CONFIG_SFC is not set
# CONFIG_SFC_FALCON is not set
# CONFIG_SFC_SIENA is not set
# CONFIG_NET_VENDOR_SMSC is not set
CONFIG_NET_VENDOR_SOCIONEXT=y
# CONFIG_NET_VENDOR_STMICRO is not set
# CONFIG_NET_VENDOR_SUN is not set
CONFIG_NET_VENDOR_SYNOPSYS=y
# CONFIG_DWC_XLGMAC is not set
# CONFIG_NET_VENDOR_TEHUTI is not set
# CONFIG_NET_VENDOR_TI is not set
CONFIG_NET_VENDOR_VERTEXCOM=y
# CONFIG_NET_VENDOR_VIA is not set
# CONFIG_NET_VENDOR_WIZNET is not set
CONFIG_NET_VENDOR_XILINX=y
# CONFIG_XILINX_EMACLITE is not set
# CONFIG_XILINX_AXI_EMAC is not set
# CONFIG_XILINX_LL_TEMAC is not set
# CONFIG_FDDI is not set
# CONFIG_HIPPI is not set
# CONFIG_NET_SB1000 is not set
CONFIG_PHYLIB=y
CONFIG_SWPHY=y
CONFIG_FIXED_PHY=y
#
# MII PHY device drivers
#
# CONFIG_AMD_PHY is not set
# CONFIG_ADIN_PHY is not set
# CONFIG_ADIN1100_PHY is not set
# CONFIG_AQUANTIA_PHY is not set
# CONFIG_AX88796B_PHY is not set
# CONFIG_BROADCOM_PHY is not set
# CONFIG_BCM54140_PHY is not set
# CONFIG_BCM7XXX_PHY is not set
# CONFIG_BCM84881_PHY is not set
# CONFIG_BCM87XX_PHY is not set
# CONFIG_CICADA_PHY is not set
# CONFIG_CORTINA_PHY is not set
# CONFIG_DAVICOM_PHY is not set
# CONFIG_ICPLUS_PHY is not set
# CONFIG_LXT_PHY is not set
# CONFIG_INTEL_XWAY_PHY is not set
# CONFIG_LSI_ET1011C_PHY is not set
# CONFIG_MARVELL_PHY is not set
# CONFIG_MARVELL_10G_PHY is not set
# CONFIG_MARVELL_88X2222_PHY is not set
# CONFIG_MAXLINEAR_GPHY is not set
# CONFIG_MEDIATEK_GE_PHY is not set
# CONFIG_MICREL_PHY is not set
# CONFIG_MICROCHIP_PHY is not set
# CONFIG_MICROCHIP_T1_PHY is not set
# CONFIG_MICROSEMI_PHY is not set
# CONFIG_MOTORCOMM_PHY is not set
# CONFIG_NATIONAL_PHY is not set
# CONFIG_NXP_C45_TJA11XX_PHY is not set
# CONFIG_QSEMI_PHY is not set
# CONFIG_REALTEK_PHY is not set
# CONFIG_RENESAS_PHY is not set
# CONFIG_ROCKCHIP_PHY is not set
# CONFIG_SMSC_PHY is not set
# CONFIG_STE10XP is not set
# CONFIG_TERANETICS_PHY is not set
# CONFIG_DP83822_PHY is not set
# CONFIG_DP83TC811_PHY is not set
# CONFIG_DP83848_PHY is not set
# CONFIG_DP83867_PHY is not set
# CONFIG_DP83869_PHY is not set
# CONFIG_DP83TD510_PHY is not set
# CONFIG_VITESSE_PHY is not set
# CONFIG_XILINX_GMII2RGMII is not set
CONFIG_MDIO_DEVICE=y
CONFIG_MDIO_BUS=y
CONFIG_FWNODE_MDIO=y
CONFIG_ACPI_MDIO=y
CONFIG_MDIO_DEVRES=y
# CONFIG_MDIO_BITBANG is not set
# CONFIG_MDIO_BCM_UNIMAC is not set
# CONFIG_MDIO_THUNDER is not set
#
# MDIO Multiplexers
#
#
# PCS device drivers
#
# CONFIG_PCS_XPCS is not set
# end of PCS device drivers
# CONFIG_PPP is not set
# CONFIG_SLIP is not set
#
# Host-side USB support is needed for USB Network Adapter support
#
# CONFIG_WLAN is not set
# CONFIG_WAN is not set
#
# Wireless WAN
#
# CONFIG_WWAN is not set
# end of Wireless WAN
# CONFIG_VMXNET3 is not set
# CONFIG_FUJITSU_ES is not set
# CONFIG_NETDEVSIM is not set
CONFIG_NET_FAILOVER=y
# CONFIG_ISDN is not set
#
# Input device support
#
CONFIG_INPUT=y
CONFIG_INPUT_FF_MEMLESS=m
CONFIG_INPUT_SPARSEKMAP=m
CONFIG_INPUT_MATRIXKMAP=m
CONFIG_INPUT_VIVALDIFMAP=y
#
# Userland interfaces
#
CONFIG_INPUT_MOUSEDEV=y
CONFIG_INPUT_MOUSEDEV_PSAUX=y
CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
# CONFIG_INPUT_JOYDEV is not set
CONFIG_INPUT_EVDEV=y
# CONFIG_INPUT_EVBUG is not set
#
# Input Device Drivers
#
CONFIG_INPUT_KEYBOARD=y
CONFIG_KEYBOARD_ADP5588=m
# CONFIG_KEYBOARD_ADP5589 is not set
CONFIG_KEYBOARD_ATKBD=y
# CONFIG_KEYBOARD_QT1050 is not set
# CONFIG_KEYBOARD_QT1070 is not set
# CONFIG_KEYBOARD_QT2160 is not set
# CONFIG_KEYBOARD_DLINK_DIR685 is not set
CONFIG_KEYBOARD_LKKBD=m
CONFIG_KEYBOARD_GPIO=m
CONFIG_KEYBOARD_GPIO_POLLED=m
CONFIG_KEYBOARD_TCA6416=m
# CONFIG_KEYBOARD_TCA8418 is not set
CONFIG_KEYBOARD_MATRIX=m
# CONFIG_KEYBOARD_LM8333 is not set
CONFIG_KEYBOARD_MAX7359=m
CONFIG_KEYBOARD_MCS=m
# CONFIG_KEYBOARD_MPR121 is not set
CONFIG_KEYBOARD_NEWTON=m
CONFIG_KEYBOARD_OPENCORES=m
# CONFIG_KEYBOARD_SAMSUNG is not set
CONFIG_KEYBOARD_STOWAWAY=m
CONFIG_KEYBOARD_SUNKBD=m
CONFIG_KEYBOARD_XTKBD=m
# CONFIG_KEYBOARD_CYPRESS_SF is not set
# CONFIG_INPUT_MOUSE is not set
# CONFIG_INPUT_JOYSTICK is not set
# CONFIG_INPUT_TABLET is not set
# CONFIG_INPUT_TOUCHSCREEN is not set
CONFIG_INPUT_MISC=y
CONFIG_INPUT_AD714X=m
CONFIG_INPUT_AD714X_I2C=m
# CONFIG_INPUT_BMA150 is not set
# CONFIG_INPUT_E3X0_BUTTON is not set
CONFIG_INPUT_PCSPKR=m
# CONFIG_INPUT_MMA8450 is not set
# CONFIG_INPUT_GPIO_BEEPER is not set
# CONFIG_INPUT_GPIO_DECODER is not set
# CONFIG_INPUT_GPIO_VIBRA is not set
CONFIG_INPUT_ATLAS_BTNS=m
# CONFIG_INPUT_KXTJ9 is not set
CONFIG_INPUT_UINPUT=y
# CONFIG_INPUT_PCF8574 is not set
CONFIG_INPUT_GPIO_ROTARY_ENCODER=m
# CONFIG_INPUT_DA7280_HAPTICS is not set
CONFIG_INPUT_ADXL34X=m
CONFIG_INPUT_ADXL34X_I2C=m
# CONFIG_INPUT_IQS269A is not set
# CONFIG_INPUT_IQS626A is not set
# CONFIG_INPUT_IQS7222 is not set
CONFIG_INPUT_CMA3000=m
CONFIG_INPUT_CMA3000_I2C=m
# CONFIG_INPUT_IDEAPAD_SLIDEBAR is not set
# CONFIG_INPUT_SOC_BUTTON_ARRAY is not set
# CONFIG_INPUT_DRV260X_HAPTICS is not set
# CONFIG_INPUT_DRV2665_HAPTICS is not set
# CONFIG_INPUT_DRV2667_HAPTICS is not set
# CONFIG_RMI4_CORE is not set
#
# Hardware I/O ports
#
CONFIG_SERIO=y
CONFIG_ARCH_MIGHT_HAVE_PC_SERIO=y
CONFIG_SERIO_I8042=y
CONFIG_SERIO_SERPORT=m
CONFIG_SERIO_CT82C710=m
CONFIG_SERIO_PCIPS2=m
CONFIG_SERIO_LIBPS2=y
CONFIG_SERIO_RAW=m
CONFIG_SERIO_ALTERA_PS2=m
CONFIG_SERIO_PS2MULT=m
# CONFIG_SERIO_ARC_PS2 is not set
# CONFIG_SERIO_GPIO_PS2 is not set
# CONFIG_USERIO is not set
CONFIG_GAMEPORT=m
CONFIG_GAMEPORT_NS558=m
CONFIG_GAMEPORT_L4=m
CONFIG_GAMEPORT_EMU10K1=m
CONFIG_GAMEPORT_FM801=m
# end of Hardware I/O ports
# end of Input device support
#
# Character devices
#
CONFIG_TTY=y
CONFIG_VT=y
CONFIG_CONSOLE_TRANSLATIONS=y
CONFIG_VT_CONSOLE=y
CONFIG_HW_CONSOLE=y
CONFIG_VT_HW_CONSOLE_BINDING=y
CONFIG_UNIX98_PTYS=y
CONFIG_LEGACY_PTYS=y
CONFIG_LEGACY_PTY_COUNT=0
CONFIG_LDISC_AUTOLOAD=y
#
# Serial drivers
#
CONFIG_SERIAL_EARLYCON=y
CONFIG_SERIAL_8250=y
CONFIG_SERIAL_8250_DEPRECATED_OPTIONS=y
CONFIG_SERIAL_8250_PNP=y
# CONFIG_SERIAL_8250_16550A_VARIANTS is not set
# CONFIG_SERIAL_8250_FINTEK is not set
CONFIG_SERIAL_8250_CONSOLE=y
CONFIG_SERIAL_8250_PCI=y
CONFIG_SERIAL_8250_EXAR=y
CONFIG_SERIAL_8250_NR_UARTS=48
CONFIG_SERIAL_8250_RUNTIME_UARTS=4
# CONFIG_SERIAL_8250_EXTENDED is not set
CONFIG_SERIAL_8250_DWLIB=y
# CONFIG_SERIAL_8250_DW is not set
# CONFIG_SERIAL_8250_RT288X is not set
CONFIG_SERIAL_8250_LPSS=y
# CONFIG_SERIAL_8250_MID is not set
CONFIG_SERIAL_8250_PERICOM=y
#
# Non-8250 serial port support
#
# CONFIG_SERIAL_UARTLITE is not set
CONFIG_SERIAL_CORE=y
CONFIG_SERIAL_CORE_CONSOLE=y
# CONFIG_SERIAL_JSM is not set
# CONFIG_SERIAL_LANTIQ is not set
# CONFIG_SERIAL_SCCNXP is not set
# CONFIG_SERIAL_SC16IS7XX is not set
# CONFIG_SERIAL_ALTERA_JTAGUART is not set
# CONFIG_SERIAL_ALTERA_UART is not set
# CONFIG_SERIAL_ARC is not set
# CONFIG_SERIAL_RP2 is not set
# CONFIG_SERIAL_FSL_LPUART is not set
# CONFIG_SERIAL_FSL_LINFLEXUART is not set
# CONFIG_SERIAL_SPRD is not set
# end of Serial drivers
CONFIG_SERIAL_MCTRL_GPIO=y
# CONFIG_SERIAL_NONSTANDARD is not set
# CONFIG_N_GSM is not set
# CONFIG_NOZOMI is not set
# CONFIG_NULL_TTY is not set
# CONFIG_SERIAL_DEV_BUS is not set
# CONFIG_TTY_PRINTK is not set
# CONFIG_VIRTIO_CONSOLE is not set
# CONFIG_IPMI_HANDLER is not set
# CONFIG_HW_RANDOM is not set
# CONFIG_APPLICOM is not set
# CONFIG_MWAVE is not set
CONFIG_DEVMEM=y
# CONFIG_NVRAM is not set
CONFIG_DEVPORT=y
CONFIG_HPET=y
CONFIG_HPET_MMAP=y
CONFIG_HPET_MMAP_DEFAULT=y
# CONFIG_HANGCHECK_TIMER is not set
CONFIG_TCG_TPM=y
CONFIG_TCG_TIS_CORE=y
CONFIG_TCG_TIS=y
# CONFIG_TCG_TIS_I2C_CR50 is not set
# CONFIG_TCG_TIS_I2C_ATMEL is not set
# CONFIG_TCG_TIS_I2C_INFINEON is not set
# CONFIG_TCG_TIS_I2C_NUVOTON is not set
# CONFIG_TCG_NSC is not set
# CONFIG_TCG_ATMEL is not set
# CONFIG_TCG_INFINEON is not set
CONFIG_TCG_CRB=y
# CONFIG_TCG_VTPM_PROXY is not set
# CONFIG_TCG_TIS_ST33ZP24_I2C is not set
# CONFIG_TELCLOCK is not set
# CONFIG_XILLYBUS is not set
# CONFIG_RANDOM_TRUST_CPU is not set
# CONFIG_RANDOM_TRUST_BOOTLOADER is not set
# end of Character devices
#
# I2C support
#
CONFIG_I2C=y
CONFIG_ACPI_I2C_OPREGION=y
CONFIG_I2C_BOARDINFO=y
# CONFIG_I2C_COMPAT is not set
# CONFIG_I2C_CHARDEV is not set
# CONFIG_I2C_MUX is not set
# CONFIG_I2C_HELPER_AUTO is not set
# CONFIG_I2C_SMBUS is not set
#
# I2C Algorithms
#
CONFIG_I2C_ALGOBIT=y
# CONFIG_I2C_ALGOPCF is not set
# CONFIG_I2C_ALGOPCA is not set
# end of I2C Algorithms
#
# I2C Hardware Bus support
#
#
# PC SMBus host controller drivers
#
# CONFIG_I2C_ALI1535 is not set
# CONFIG_I2C_ALI1563 is not set
# CONFIG_I2C_ALI15X3 is not set
# CONFIG_I2C_AMD756 is not set
# CONFIG_I2C_AMD8111 is not set
# CONFIG_I2C_AMD_MP2 is not set
# CONFIG_I2C_I801 is not set
# CONFIG_I2C_ISCH is not set
# CONFIG_I2C_ISMT is not set
# CONFIG_I2C_PIIX4 is not set
# CONFIG_I2C_NFORCE2 is not set
# CONFIG_I2C_NVIDIA_GPU is not set
# CONFIG_I2C_SIS5595 is not set
# CONFIG_I2C_SIS630 is not set
# CONFIG_I2C_SIS96X is not set
# CONFIG_I2C_VIA is not set
# CONFIG_I2C_VIAPRO is not set
#
# ACPI drivers
#
# CONFIG_I2C_SCMI is not set
#
# I2C system bus drivers (mostly embedded / system-on-chip)
#
# CONFIG_I2C_CBUS_GPIO is not set
# CONFIG_I2C_DESIGNWARE_PLATFORM is not set
# CONFIG_I2C_DESIGNWARE_PCI is not set
# CONFIG_I2C_EMEV2 is not set
# CONFIG_I2C_GPIO is not set
# CONFIG_I2C_OCORES is not set
# CONFIG_I2C_PCA_PLATFORM is not set
# CONFIG_I2C_SIMTEC is not set
# CONFIG_I2C_XILINX is not set
#
# External I2C/SMBus adapter drivers
#
# CONFIG_I2C_TAOS_EVM is not set
#
# Other I2C/SMBus bus drivers
#
# CONFIG_I2C_MLXCPLD is not set
# CONFIG_I2C_VIRTIO is not set
# end of I2C Hardware Bus support
# CONFIG_I2C_STUB is not set
# CONFIG_I2C_SLAVE is not set
# CONFIG_I2C_DEBUG_CORE is not set
# CONFIG_I2C_DEBUG_ALGO is not set
# CONFIG_I2C_DEBUG_BUS is not set
# end of I2C support
# CONFIG_I3C is not set
# CONFIG_SPI is not set
# CONFIG_SPMI is not set
# CONFIG_HSI is not set
CONFIG_PPS=y
# CONFIG_PPS_DEBUG is not set
#
# PPS clients support
#
# CONFIG_PPS_CLIENT_KTIMER is not set
# CONFIG_PPS_CLIENT_LDISC is not set
# CONFIG_PPS_CLIENT_GPIO is not set
#
# PPS generators support
#
#
# PTP clock support
#
CONFIG_PTP_1588_CLOCK=y
CONFIG_PTP_1588_CLOCK_OPTIONAL=y
#
# Enable PHYLIB and NETWORK_PHY_TIMESTAMPING to see the additional clocks.
#
# CONFIG_PTP_1588_CLOCK_IDT82P33 is not set
# CONFIG_PTP_1588_CLOCK_IDTCM is not set
# end of PTP clock support
# CONFIG_PINCTRL is not set
CONFIG_GPIOLIB=y
CONFIG_GPIOLIB_FASTPATH_LIMIT=512
CONFIG_GPIO_ACPI=y
# CONFIG_DEBUG_GPIO is not set
# CONFIG_GPIO_SYSFS is not set
CONFIG_GPIO_CDEV=y
CONFIG_GPIO_CDEV_V1=y
#
# Memory mapped GPIO drivers
#
# CONFIG_GPIO_AMDPT is not set
# CONFIG_GPIO_DWAPB is not set
# CONFIG_GPIO_EXAR is not set
# CONFIG_GPIO_GENERIC_PLATFORM is not set
# CONFIG_GPIO_MB86S7X is not set
# CONFIG_GPIO_VX855 is not set
# CONFIG_GPIO_AMD_FCH is not set
# end of Memory mapped GPIO drivers
#
# Port-mapped I/O GPIO drivers
#
# CONFIG_GPIO_F7188X is not set
# CONFIG_GPIO_IT87 is not set
# CONFIG_GPIO_SCH is not set
# CONFIG_GPIO_SCH311X is not set
# CONFIG_GPIO_WINBOND is not set
# CONFIG_GPIO_WS16C48 is not set
# end of Port-mapped I/O GPIO drivers
#
# I2C GPIO expanders
#
# CONFIG_GPIO_ADP5588 is not set
# CONFIG_GPIO_MAX7300 is not set
# CONFIG_GPIO_MAX732X is not set
# CONFIG_GPIO_PCA953X is not set
# CONFIG_GPIO_PCA9570 is not set
# CONFIG_GPIO_PCF857X is not set
# CONFIG_GPIO_TPIC2810 is not set
# end of I2C GPIO expanders
#
# MFD GPIO expanders
#
# end of MFD GPIO expanders
#
# PCI GPIO expanders
#
# CONFIG_GPIO_AMD8111 is not set
# CONFIG_GPIO_BT8XX is not set
# CONFIG_GPIO_ML_IOH is not set
# CONFIG_GPIO_PCI_IDIO_16 is not set
# CONFIG_GPIO_PCIE_IDIO_24 is not set
# CONFIG_GPIO_RDC321X is not set
# end of PCI GPIO expanders
#
# Virtual GPIO drivers
#
# CONFIG_GPIO_AGGREGATOR is not set
# CONFIG_GPIO_MOCKUP is not set
# CONFIG_GPIO_VIRTIO is not set
# CONFIG_GPIO_SIM is not set
# end of Virtual GPIO drivers
# CONFIG_W1 is not set
# CONFIG_POWER_RESET is not set
CONFIG_POWER_SUPPLY=y
# CONFIG_POWER_SUPPLY_DEBUG is not set
# CONFIG_PDA_POWER is not set
# CONFIG_IP5XXX_POWER is not set
# CONFIG_TEST_POWER is not set
# CONFIG_CHARGER_ADP5061 is not set
# CONFIG_BATTERY_CW2015 is not set
# CONFIG_BATTERY_DS2780 is not set
# CONFIG_BATTERY_DS2781 is not set
# CONFIG_BATTERY_DS2782 is not set
# CONFIG_BATTERY_SAMSUNG_SDI is not set
# CONFIG_BATTERY_SBS is not set
# CONFIG_CHARGER_SBS is not set
# CONFIG_BATTERY_BQ27XXX is not set
# CONFIG_BATTERY_MAX17040 is not set
# CONFIG_BATTERY_MAX17042 is not set
# CONFIG_CHARGER_MAX8903 is not set
# CONFIG_CHARGER_LP8727 is not set
# CONFIG_CHARGER_GPIO is not set
# CONFIG_CHARGER_LT3651 is not set
# CONFIG_CHARGER_LTC4162L is not set
# CONFIG_CHARGER_MAX77976 is not set
# CONFIG_CHARGER_BQ2415X is not set
# CONFIG_CHARGER_BQ24257 is not set
# CONFIG_CHARGER_BQ24735 is not set
# CONFIG_CHARGER_BQ2515X is not set
# CONFIG_CHARGER_BQ25890 is not set
# CONFIG_CHARGER_BQ25980 is not set
# CONFIG_CHARGER_BQ256XX is not set
# CONFIG_BATTERY_GAUGE_LTC2941 is not set
# CONFIG_BATTERY_GOLDFISH is not set
# CONFIG_BATTERY_RT5033 is not set
# CONFIG_CHARGER_RT9455 is not set
# CONFIG_CHARGER_BD99954 is not set
# CONFIG_BATTERY_UG3105 is not set
# CONFIG_HWMON is not set
CONFIG_THERMAL=y
# CONFIG_THERMAL_NETLINK is not set
# CONFIG_THERMAL_STATISTICS is not set
CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0
CONFIG_THERMAL_WRITABLE_TRIPS=y
CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y
# CONFIG_THERMAL_DEFAULT_GOV_FAIR_SHARE is not set
# CONFIG_THERMAL_DEFAULT_GOV_USER_SPACE is not set
# CONFIG_THERMAL_GOV_FAIR_SHARE is not set
CONFIG_THERMAL_GOV_STEP_WISE=y
# CONFIG_THERMAL_GOV_BANG_BANG is not set
CONFIG_THERMAL_GOV_USER_SPACE=y
# CONFIG_THERMAL_EMULATION is not set
#
# Intel thermal drivers
#
# CONFIG_INTEL_POWERCLAMP is not set
CONFIG_X86_THERMAL_VECTOR=y
CONFIG_X86_PKG_TEMP_THERMAL=m
# CONFIG_INTEL_SOC_DTS_THERMAL is not set
#
# ACPI INT340X thermal drivers
#
# CONFIG_INT340X_THERMAL is not set
# end of ACPI INT340X thermal drivers
# CONFIG_INTEL_PCH_THERMAL is not set
# CONFIG_INTEL_TCC_COOLING is not set
# CONFIG_INTEL_MENLOW is not set
# CONFIG_INTEL_HFI_THERMAL is not set
# end of Intel thermal drivers
# CONFIG_WATCHDOG is not set
CONFIG_SSB_POSSIBLE=y
CONFIG_SSB=m
CONFIG_SSB_SPROM=y
CONFIG_SSB_PCIHOST_POSSIBLE=y
CONFIG_SSB_PCIHOST=y
CONFIG_SSB_DRIVER_PCICORE_POSSIBLE=y
# CONFIG_SSB_DRIVER_PCICORE is not set
# CONFIG_SSB_DRIVER_GPIO is not set
CONFIG_BCMA_POSSIBLE=y
# CONFIG_BCMA is not set
#
# Multifunction device drivers
#
CONFIG_MFD_CORE=m
# CONFIG_MFD_AS3711 is not set
# CONFIG_PMIC_ADP5520 is not set
# CONFIG_MFD_AAT2870_CORE is not set
# CONFIG_MFD_BCM590XX is not set
# CONFIG_MFD_BD9571MWV is not set
# CONFIG_MFD_AXP20X_I2C is not set
# CONFIG_MFD_MADERA is not set
# CONFIG_PMIC_DA903X is not set
# CONFIG_MFD_DA9052_I2C is not set
# CONFIG_MFD_DA9055 is not set
# CONFIG_MFD_DA9062 is not set
# CONFIG_MFD_DA9063 is not set
# CONFIG_MFD_DA9150 is not set
# CONFIG_MFD_MC13XXX_I2C is not set
# CONFIG_MFD_MP2629 is not set
# CONFIG_HTC_PASIC3 is not set
# CONFIG_HTC_I2CPLD is not set
# CONFIG_MFD_INTEL_QUARK_I2C_GPIO is not set
# CONFIG_LPC_ICH is not set
CONFIG_LPC_SCH=m
# CONFIG_MFD_INTEL_LPSS_ACPI is not set
# CONFIG_MFD_INTEL_LPSS_PCI is not set
# CONFIG_MFD_IQS62X is not set
# CONFIG_MFD_JANZ_CMODIO is not set
# CONFIG_MFD_KEMPLD is not set
# CONFIG_MFD_88PM800 is not set
# CONFIG_MFD_88PM805 is not set
# CONFIG_MFD_88PM860X is not set
# CONFIG_MFD_MAX14577 is not set
# CONFIG_MFD_MAX77693 is not set
# CONFIG_MFD_MAX77843 is not set
# CONFIG_MFD_MAX8907 is not set
# CONFIG_MFD_MAX8925 is not set
# CONFIG_MFD_MAX8997 is not set
# CONFIG_MFD_MAX8998 is not set
# CONFIG_MFD_MT6360 is not set
# CONFIG_MFD_MT6397 is not set
# CONFIG_MFD_MENF21BMC is not set
# CONFIG_MFD_RETU is not set
# CONFIG_MFD_PCF50633 is not set
CONFIG_MFD_RDC321X=m
# CONFIG_MFD_RT4831 is not set
# CONFIG_MFD_RT5033 is not set
# CONFIG_MFD_RC5T583 is not set
# CONFIG_MFD_SI476X_CORE is not set
# CONFIG_MFD_SIMPLE_MFD_I2C is not set
# CONFIG_MFD_SM501 is not set
# CONFIG_MFD_SKY81452 is not set
# CONFIG_MFD_SYSCON is not set
# CONFIG_MFD_TI_AM335X_TSCADC is not set
# CONFIG_MFD_LP3943 is not set
# CONFIG_MFD_LP8788 is not set
# CONFIG_MFD_TI_LMU is not set
# CONFIG_MFD_PALMAS is not set
# CONFIG_TPS6105X is not set
# CONFIG_TPS65010 is not set
# CONFIG_TPS6507X is not set
# CONFIG_MFD_TPS65086 is not set
# CONFIG_MFD_TPS65090 is not set
# CONFIG_MFD_TI_LP873X is not set
# CONFIG_MFD_TPS6586X is not set
# CONFIG_MFD_TPS65910 is not set
# CONFIG_MFD_TPS65912_I2C is not set
# CONFIG_TWL4030_CORE is not set
# CONFIG_TWL6040_CORE is not set
# CONFIG_MFD_WL1273_CORE is not set
# CONFIG_MFD_LM3533 is not set
# CONFIG_MFD_TQMX86 is not set
CONFIG_MFD_VX855=m
# CONFIG_MFD_ARIZONA_I2C is not set
# CONFIG_MFD_WM8400 is not set
# CONFIG_MFD_WM831X_I2C is not set
# CONFIG_MFD_WM8350_I2C is not set
# CONFIG_MFD_WM8994 is not set
# CONFIG_MFD_ATC260X_I2C is not set
# end of Multifunction device drivers
# CONFIG_REGULATOR is not set
# CONFIG_RC_CORE is not set
#
# CEC support
#
# CONFIG_MEDIA_CEC_SUPPORT is not set
# end of CEC support
# CONFIG_MEDIA_SUPPORT is not set
#
# Graphics support
#
CONFIG_AGP=y
# CONFIG_AGP_AMD64 is not set
CONFIG_AGP_INTEL=y
CONFIG_AGP_SIS=m
CONFIG_AGP_VIA=y
CONFIG_INTEL_GTT=y
CONFIG_VGA_SWITCHEROO=y
CONFIG_DRM=y
# CONFIG_DRM_DEBUG_MM is not set
# CONFIG_DRM_DEBUG_SELFTEST is not set
CONFIG_DRM_DEBUG_MODESET_LOCK=y
# CONFIG_DRM_LOAD_EDID_FIRMWARE is not set
#
# ARM devices
#
# end of ARM devices
# CONFIG_DRM_RADEON is not set
# CONFIG_DRM_AMDGPU is not set
# CONFIG_DRM_NOUVEAU is not set
# CONFIG_DRM_I915 is not set
# CONFIG_DRM_VGEM is not set
# CONFIG_DRM_VKMS is not set
# CONFIG_DRM_VMWGFX is not set
# CONFIG_DRM_GMA500 is not set
# CONFIG_DRM_AST is not set
# CONFIG_DRM_MGAG200 is not set
# CONFIG_DRM_QXL is not set
# CONFIG_DRM_VIRTIO_GPU is not set
CONFIG_DRM_PANEL=y
#
# Display Panels
#
# end of Display Panels
CONFIG_DRM_BRIDGE=y
CONFIG_DRM_PANEL_BRIDGE=y
#
# Display Interface Bridges
#
# CONFIG_DRM_ANALOGIX_ANX78XX is not set
# end of Display Interface Bridges
# CONFIG_DRM_ETNAVIV is not set
# CONFIG_DRM_BOCHS is not set
# CONFIG_DRM_CIRRUS_QEMU is not set
# CONFIG_DRM_SIMPLEDRM is not set
# CONFIG_DRM_VBOXVIDEO is not set
# CONFIG_DRM_SSD130X is not set
# CONFIG_DRM_LEGACY is not set
CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y
CONFIG_DRM_NOMODESET=y
#
# Frame buffer Devices
#
CONFIG_FB_CMDLINE=y
CONFIG_FB_NOTIFY=y
CONFIG_FB=y
CONFIG_FIRMWARE_EDID=y
CONFIG_FB_CFB_FILLRECT=y
CONFIG_FB_CFB_COPYAREA=y
CONFIG_FB_CFB_IMAGEBLIT=y
CONFIG_FB_SYS_FILLRECT=m
CONFIG_FB_SYS_COPYAREA=m
CONFIG_FB_SYS_IMAGEBLIT=m
# CONFIG_FB_FOREIGN_ENDIAN is not set
CONFIG_FB_SYS_FOPS=m
CONFIG_FB_DEFERRED_IO=y
CONFIG_FB_MODE_HELPERS=y
CONFIG_FB_TILEBLITTING=y
#
# Frame buffer hardware drivers
#
# CONFIG_FB_CIRRUS is not set
# CONFIG_FB_PM2 is not set
# CONFIG_FB_CYBER2000 is not set
# CONFIG_FB_ARC is not set
# CONFIG_FB_ASILIANT is not set
# CONFIG_FB_IMSTT is not set
CONFIG_FB_VGA16=y
# CONFIG_FB_UVESA is not set
CONFIG_FB_VESA=y
# CONFIG_FB_N411 is not set
# CONFIG_FB_HGA is not set
# CONFIG_FB_OPENCORES is not set
# CONFIG_FB_S1D13XXX is not set
# CONFIG_FB_NVIDIA is not set
# CONFIG_FB_RIVA is not set
# CONFIG_FB_I740 is not set
# CONFIG_FB_LE80578 is not set
# CONFIG_FB_INTEL is not set
# CONFIG_FB_MATROX is not set
# CONFIG_FB_RADEON is not set
# CONFIG_FB_ATY128 is not set
# CONFIG_FB_ATY is not set
# CONFIG_FB_S3 is not set
# CONFIG_FB_SAVAGE is not set
# CONFIG_FB_SIS is not set
# CONFIG_FB_VIA is not set
# CONFIG_FB_NEOMAGIC is not set
# CONFIG_FB_KYRO is not set
# CONFIG_FB_3DFX is not set
# CONFIG_FB_VOODOO1 is not set
# CONFIG_FB_VT8623 is not set
# CONFIG_FB_TRIDENT is not set
# CONFIG_FB_ARK is not set
# CONFIG_FB_PM3 is not set
# CONFIG_FB_CARMINE is not set
# CONFIG_FB_IBM_GXT4500 is not set
# CONFIG_FB_VIRTUAL is not set
# CONFIG_FB_METRONOME is not set
# CONFIG_FB_MB862XX is not set
# CONFIG_FB_SIMPLE is not set
# CONFIG_FB_SSD1307 is not set
# CONFIG_FB_SM712 is not set
# end of Frame buffer Devices
#
# Backlight & LCD device support
#
CONFIG_LCD_CLASS_DEVICE=m
# CONFIG_LCD_PLATFORM is not set
CONFIG_BACKLIGHT_CLASS_DEVICE=m
# CONFIG_BACKLIGHT_KTD253 is not set
# CONFIG_BACKLIGHT_APPLE is not set
# CONFIG_BACKLIGHT_QCOM_WLED is not set
# CONFIG_BACKLIGHT_SAHARA is not set
# CONFIG_BACKLIGHT_ADP8860 is not set
# CONFIG_BACKLIGHT_ADP8870 is not set
# CONFIG_BACKLIGHT_LM3639 is not set
# CONFIG_BACKLIGHT_GPIO is not set
# CONFIG_BACKLIGHT_LV5207LP is not set
# CONFIG_BACKLIGHT_BD6107 is not set
# CONFIG_BACKLIGHT_ARCXCNN is not set
# end of Backlight & LCD device support
CONFIG_VGASTATE=y
CONFIG_HDMI=y
#
# Console display driver support
#
CONFIG_VGA_CONSOLE=y
CONFIG_DUMMY_CONSOLE=y
CONFIG_DUMMY_CONSOLE_COLUMNS=80
CONFIG_DUMMY_CONSOLE_ROWS=25
CONFIG_FRAMEBUFFER_CONSOLE=y
# CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION is not set
CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y
# CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set
# CONFIG_FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER is not set
# end of Console display driver support
# CONFIG_LOGO is not set
# end of Graphics support
# CONFIG_SOUND is not set
#
# HID support
#
CONFIG_HID=y
# CONFIG_HID_BATTERY_STRENGTH is not set
CONFIG_HIDRAW=y
# CONFIG_UHID is not set
CONFIG_HID_GENERIC=y
#
# Special HID drivers
#
CONFIG_HID_A4TECH=m
CONFIG_HID_ACRUX=m
# CONFIG_HID_ACRUX_FF is not set
# CONFIG_HID_AUREAL is not set
CONFIG_HID_BELKIN=m
CONFIG_HID_CHERRY=m
# CONFIG_HID_COUGAR is not set
# CONFIG_HID_MACALLY is not set
# CONFIG_HID_CMEDIA is not set
CONFIG_HID_CYPRESS=m
CONFIG_HID_DRAGONRISE=m
CONFIG_DRAGONRISE_FF=y
CONFIG_HID_EMS_FF=m
# CONFIG_HID_ELECOM is not set
CONFIG_HID_EZKEY=m
# CONFIG_HID_GEMBIRD is not set
# CONFIG_HID_GFRM is not set
# CONFIG_HID_GLORIOUS is not set
# CONFIG_HID_VIVALDI is not set
# CONFIG_HID_KEYTOUCH is not set
CONFIG_HID_KYE=m
CONFIG_HID_WALTOP=m
# CONFIG_HID_VIEWSONIC is not set
# CONFIG_HID_XIAOMI is not set
CONFIG_HID_GYRATION=m
# CONFIG_HID_ICADE is not set
# CONFIG_HID_ITE is not set
# CONFIG_HID_JABRA is not set
CONFIG_HID_TWINHAN=m
CONFIG_HID_KENSINGTON=m
# CONFIG_HID_LCPOWER is not set
# CONFIG_HID_LENOVO is not set
# CONFIG_HID_MAGICMOUSE is not set
# CONFIG_HID_MALTRON is not set
# CONFIG_HID_MAYFLASH is not set
# CONFIG_HID_REDRAGON is not set
CONFIG_HID_MICROSOFT=m
CONFIG_HID_MONTEREY=m
CONFIG_HID_MULTITOUCH=m
# CONFIG_HID_NTI is not set
CONFIG_HID_ORTEK=m
CONFIG_HID_PANTHERLORD=m
CONFIG_PANTHERLORD_FF=y
CONFIG_HID_PETALYNX=m
CONFIG_HID_PICOLCD=m
CONFIG_HID_PICOLCD_FB=y
# CONFIG_HID_PICOLCD_BACKLIGHT is not set
# CONFIG_HID_PICOLCD_LCD is not set
# CONFIG_HID_PLANTRONICS is not set
# CONFIG_HID_RAZER is not set
# CONFIG_HID_PRIMAX is not set
# CONFIG_HID_SAITEK is not set
# CONFIG_HID_SEMITEK is not set
# CONFIG_HID_SPEEDLINK is not set
# CONFIG_HID_STEAM is not set
# CONFIG_HID_STEELSERIES is not set
CONFIG_HID_SUNPLUS=m
# CONFIG_HID_RMI is not set
CONFIG_HID_GREENASIA=m
CONFIG_GREENASIA_FF=y
CONFIG_HID_SMARTJOYPLUS=m
CONFIG_SMARTJOYPLUS_FF=y
# CONFIG_HID_TIVO is not set
CONFIG_HID_TOPSEED=m
# CONFIG_HID_UDRAW_PS3 is not set
# CONFIG_HID_XINMO is not set
CONFIG_HID_ZEROPLUS=m
CONFIG_ZEROPLUS_FF=y
CONFIG_HID_ZYDACRON=m
# CONFIG_HID_SENSOR_HUB is not set
# CONFIG_HID_ALPS is not set
# end of Special HID drivers
#
# I2C HID support
#
# CONFIG_I2C_HID_ACPI is not set
# end of I2C HID support
#
# Intel ISH HID support
#
# CONFIG_INTEL_ISH_HID is not set
# end of Intel ISH HID support
#
# AMD SFH HID Support
#
# CONFIG_AMD_SFH_HID is not set
# end of AMD SFH HID Support
# end of HID support
CONFIG_USB_OHCI_LITTLE_ENDIAN=y
# CONFIG_USB_SUPPORT is not set
# CONFIG_MMC is not set
# CONFIG_SCSI_UFSHCD is not set
# CONFIG_MEMSTICK is not set
# CONFIG_NEW_LEDS is not set
# CONFIG_ACCESSIBILITY is not set
# CONFIG_INFINIBAND is not set
CONFIG_EDAC_ATOMIC_SCRUB=y
CONFIG_EDAC_SUPPORT=y
# CONFIG_EDAC is not set
CONFIG_RTC_LIB=y
CONFIG_RTC_MC146818_LIB=y
CONFIG_RTC_CLASS=y
CONFIG_RTC_HCTOSYS=y
CONFIG_RTC_HCTOSYS_DEVICE="rtc0"
CONFIG_RTC_SYSTOHC=y
CONFIG_RTC_SYSTOHC_DEVICE="rtc0"
# CONFIG_RTC_DEBUG is not set
# CONFIG_RTC_LIB_KUNIT_TEST is not set
CONFIG_RTC_NVMEM=y
#
# RTC interfaces
#
CONFIG_RTC_INTF_SYSFS=y
CONFIG_RTC_INTF_PROC=y
CONFIG_RTC_INTF_DEV=y
# CONFIG_RTC_INTF_DEV_UIE_EMUL is not set
CONFIG_RTC_DRV_TEST=m
#
# I2C RTC drivers
#
# CONFIG_RTC_DRV_ABB5ZES3 is not set
# CONFIG_RTC_DRV_ABEOZ9 is not set
# CONFIG_RTC_DRV_ABX80X is not set
# CONFIG_RTC_DRV_DS1307 is not set
# CONFIG_RTC_DRV_DS1374 is not set
# CONFIG_RTC_DRV_DS1672 is not set
# CONFIG_RTC_DRV_MAX6900 is not set
# CONFIG_RTC_DRV_RS5C372 is not set
# CONFIG_RTC_DRV_ISL1208 is not set
# CONFIG_RTC_DRV_ISL12022 is not set
# CONFIG_RTC_DRV_X1205 is not set
# CONFIG_RTC_DRV_PCF8523 is not set
# CONFIG_RTC_DRV_PCF85063 is not set
# CONFIG_RTC_DRV_PCF85363 is not set
# CONFIG_RTC_DRV_PCF8563 is not set
# CONFIG_RTC_DRV_PCF8583 is not set
# CONFIG_RTC_DRV_M41T80 is not set
# CONFIG_RTC_DRV_BQ32K is not set
# CONFIG_RTC_DRV_S35390A is not set
# CONFIG_RTC_DRV_FM3130 is not set
# CONFIG_RTC_DRV_RX8010 is not set
# CONFIG_RTC_DRV_RX8581 is not set
# CONFIG_RTC_DRV_RX8025 is not set
# CONFIG_RTC_DRV_EM3027 is not set
# CONFIG_RTC_DRV_RV3028 is not set
# CONFIG_RTC_DRV_RV3032 is not set
# CONFIG_RTC_DRV_RV8803 is not set
# CONFIG_RTC_DRV_SD3078 is not set
#
# SPI RTC drivers
#
CONFIG_RTC_I2C_AND_SPI=y
#
# SPI and I2C RTC drivers
#
# CONFIG_RTC_DRV_DS3232 is not set
# CONFIG_RTC_DRV_PCF2127 is not set
# CONFIG_RTC_DRV_RV3029C2 is not set
# CONFIG_RTC_DRV_RX6110 is not set
#
# Platform RTC drivers
#
CONFIG_RTC_DRV_CMOS=y
# CONFIG_RTC_DRV_DS1286 is not set
# CONFIG_RTC_DRV_DS1511 is not set
# CONFIG_RTC_DRV_DS1553 is not set
# CONFIG_RTC_DRV_DS1685_FAMILY is not set
# CONFIG_RTC_DRV_DS1742 is not set
# CONFIG_RTC_DRV_DS2404 is not set
# CONFIG_RTC_DRV_STK17TA8 is not set
# CONFIG_RTC_DRV_M48T86 is not set
# CONFIG_RTC_DRV_M48T35 is not set
# CONFIG_RTC_DRV_M48T59 is not set
# CONFIG_RTC_DRV_MSM6242 is not set
# CONFIG_RTC_DRV_BQ4802 is not set
# CONFIG_RTC_DRV_RP5C01 is not set
# CONFIG_RTC_DRV_V3020 is not set
#
# on-CPU RTC drivers
#
# CONFIG_RTC_DRV_FTRTC010 is not set
#
# HID Sensor RTC drivers
#
# CONFIG_RTC_DRV_GOLDFISH is not set
# CONFIG_DMADEVICES is not set
#
# DMABUF options
#
CONFIG_SYNC_FILE=y
# CONFIG_SW_SYNC is not set
# CONFIG_UDMABUF is not set
# CONFIG_DMABUF_MOVE_NOTIFY is not set
# CONFIG_DMABUF_DEBUG is not set
# CONFIG_DMABUF_SELFTESTS is not set
# CONFIG_DMABUF_HEAPS is not set
# CONFIG_DMABUF_SYSFS_STATS is not set
# end of DMABUF options
# CONFIG_AUXDISPLAY is not set
CONFIG_UIO=y
# CONFIG_UIO_CIF is not set
# CONFIG_UIO_PDRV_GENIRQ is not set
# CONFIG_UIO_DMEM_GENIRQ is not set
# CONFIG_UIO_AEC is not set
# CONFIG_UIO_SERCOS3 is not set
# CONFIG_UIO_PCI_GENERIC is not set
# CONFIG_UIO_NETX is not set
# CONFIG_UIO_PRUSS is not set
# CONFIG_UIO_MF624 is not set
# CONFIG_VFIO is not set
CONFIG_VIRT_DRIVERS=y
CONFIG_VMGENID=y
# CONFIG_VBOXGUEST is not set
# CONFIG_NITRO_ENCLAVES is not set
CONFIG_VIRTIO=y
CONFIG_VIRTIO_PCI_LIB=y
CONFIG_VIRTIO_PCI_LIB_LEGACY=y
CONFIG_VIRTIO_MENU=y
CONFIG_VIRTIO_PCI=y
CONFIG_VIRTIO_PCI_LEGACY=y
# CONFIG_VIRTIO_BALLOON is not set
# CONFIG_VIRTIO_INPUT is not set
# CONFIG_VIRTIO_MMIO is not set
# CONFIG_VDPA is not set
CONFIG_VHOST_MENU=y
# CONFIG_VHOST_NET is not set
# CONFIG_VHOST_SCSI is not set
# CONFIG_VHOST_CROSS_ENDIAN_LEGACY is not set
#
# Microsoft Hyper-V guest support
#
# end of Microsoft Hyper-V guest support
# CONFIG_GREYBUS is not set
# CONFIG_COMEDI is not set
CONFIG_STAGING=y
# CONFIG_RTS5208 is not set
# CONFIG_FB_SM750 is not set
# CONFIG_STAGING_MEDIA is not set
# CONFIG_FIELDBUS_DEV is not set
# CONFIG_QLGE is not set
#
# VME Device Drivers
#
# CONFIG_X86_PLATFORM_DEVICES is not set
CONFIG_PMC_ATOM=y
# CONFIG_CHROME_PLATFORMS is not set
# CONFIG_MELLANOX_PLATFORM is not set
CONFIG_SURFACE_PLATFORMS=y
# CONFIG_SURFACE_3_POWER_OPREGION is not set
# CONFIG_SURFACE_GPE is not set
# CONFIG_SURFACE_HOTPLUG is not set
# CONFIG_SURFACE_PRO3_BUTTON is not set
CONFIG_HAVE_CLK=y
CONFIG_HAVE_CLK_PREPARE=y
CONFIG_COMMON_CLK=y
# CONFIG_COMMON_CLK_MAX9485 is not set
# CONFIG_COMMON_CLK_SI5341 is not set
# CONFIG_COMMON_CLK_SI5351 is not set
# CONFIG_COMMON_CLK_SI544 is not set
# CONFIG_COMMON_CLK_CDCE706 is not set
# CONFIG_COMMON_CLK_CS2000_CP is not set
# CONFIG_XILINX_VCU is not set
# CONFIG_CLK_KUNIT_TEST is not set
# CONFIG_CLK_GATE_KUNIT_TEST is not set
# CONFIG_HWSPINLOCK is not set
#
# Clock Source drivers
#
CONFIG_CLKEVT_I8253=y
CONFIG_I8253_LOCK=y
CONFIG_CLKBLD_I8253=y
# end of Clock Source drivers
CONFIG_MAILBOX=y
CONFIG_PCC=y
# CONFIG_ALTERA_MBOX is not set
CONFIG_IOMMU_SUPPORT=y
#
# Generic IOMMU Pagetable Support
#
# end of Generic IOMMU Pagetable Support
# CONFIG_IOMMU_DEBUGFS is not set
# CONFIG_AMD_IOMMU is not set
# CONFIG_INTEL_IOMMU is not set
# CONFIG_IRQ_REMAP is not set
# CONFIG_VIRTIO_IOMMU is not set
#
# Remoteproc drivers
#
# CONFIG_REMOTEPROC is not set
# end of Remoteproc drivers
#
# Rpmsg drivers
#
# CONFIG_RPMSG_QCOM_GLINK_RPM is not set
# CONFIG_RPMSG_VIRTIO is not set
# end of Rpmsg drivers
# CONFIG_SOUNDWIRE is not set
#
# SOC (System On Chip) specific Drivers
#
#
# Amlogic SoC drivers
#
# end of Amlogic SoC drivers
#
# Broadcom SoC drivers
#
# end of Broadcom SoC drivers
#
# NXP/Freescale QorIQ SoC drivers
#
# end of NXP/Freescale QorIQ SoC drivers
#
# i.MX SoC drivers
#
# end of i.MX SoC drivers
#
# Enable LiteX SoC Builder specific drivers
#
# end of Enable LiteX SoC Builder specific drivers
#
# Qualcomm SoC drivers
#
# end of Qualcomm SoC drivers
# CONFIG_SOC_TI is not set
#
# Xilinx SoC drivers
#
# end of Xilinx SoC drivers
# end of SOC (System On Chip) specific Drivers
# CONFIG_PM_DEVFREQ is not set
# CONFIG_EXTCON is not set
# CONFIG_MEMORY is not set
# CONFIG_IIO is not set
# CONFIG_NTB is not set
# CONFIG_VME_BUS is not set
# CONFIG_PWM is not set
#
# IRQ chip support
#
# end of IRQ chip support
# CONFIG_IPACK_BUS is not set
# CONFIG_RESET_CONTROLLER is not set
#
# PHY Subsystem
#
# CONFIG_GENERIC_PHY is not set
# CONFIG_PHY_CAN_TRANSCEIVER is not set
#
# PHY drivers for Broadcom platforms
#
# CONFIG_BCM_KONA_USB2_PHY is not set
# end of PHY drivers for Broadcom platforms
# CONFIG_PHY_PXA_28NM_HSIC is not set
# CONFIG_PHY_PXA_28NM_USB2 is not set
# CONFIG_PHY_INTEL_LGM_EMMC is not set
# end of PHY Subsystem
# CONFIG_POWERCAP is not set
# CONFIG_MCB is not set
#
# Performance monitor support
#
# end of Performance monitor support
CONFIG_RAS=y
# CONFIG_RAS_CEC is not set
# CONFIG_USB4 is not set
#
# Android
#
# CONFIG_ANDROID is not set
# end of Android
# CONFIG_LIBNVDIMM is not set
# CONFIG_DAX is not set
CONFIG_NVMEM=y
CONFIG_NVMEM_SYSFS=y
# CONFIG_NVMEM_RMEM is not set
#
# HW tracing support
#
# CONFIG_STM is not set
# CONFIG_INTEL_TH is not set
# end of HW tracing support
# CONFIG_FPGA is not set
# CONFIG_TEE is not set
# CONFIG_SIOX is not set
# CONFIG_SLIMBUS is not set
# CONFIG_INTERCONNECT is not set
# CONFIG_COUNTER is not set
# CONFIG_MOST is not set
# CONFIG_PECI is not set
# CONFIG_HTE is not set
# end of Device Drivers
#
# File systems
#
CONFIG_DCACHE_WORD_ACCESS=y
CONFIG_VALIDATE_FS_PARSER=y
CONFIG_FS_IOMAP=y
CONFIG_EXT2_FS=y
CONFIG_EXT2_FS_XATTR=y
CONFIG_EXT2_FS_POSIX_ACL=y
CONFIG_EXT2_FS_SECURITY=y
CONFIG_EXT3_FS=y
CONFIG_EXT3_FS_POSIX_ACL=y
CONFIG_EXT3_FS_SECURITY=y
CONFIG_EXT4_FS=y
CONFIG_EXT4_FS_POSIX_ACL=y
CONFIG_EXT4_FS_SECURITY=y
# CONFIG_EXT4_DEBUG is not set
# CONFIG_EXT4_KUNIT_TESTS is not set
CONFIG_JBD2=y
# CONFIG_JBD2_DEBUG is not set
CONFIG_FS_MBCACHE=y
# CONFIG_REISERFS_FS is not set
# CONFIG_JFS_FS is not set
CONFIG_XFS_FS=y
CONFIG_XFS_SUPPORT_V4=y
CONFIG_XFS_QUOTA=y
CONFIG_XFS_POSIX_ACL=y
CONFIG_XFS_RT=y
# CONFIG_XFS_ONLINE_SCRUB is not set
# CONFIG_XFS_WARN is not set
# CONFIG_XFS_DEBUG is not set
# CONFIG_GFS2_FS is not set
# CONFIG_OCFS2_FS is not set
CONFIG_BTRFS_FS=y
CONFIG_BTRFS_FS_POSIX_ACL=y
# CONFIG_BTRFS_FS_CHECK_INTEGRITY is not set
# CONFIG_BTRFS_FS_RUN_SANITY_TESTS is not set
CONFIG_BTRFS_DEBUG=y
# CONFIG_BTRFS_ASSERT is not set
# CONFIG_BTRFS_FS_REF_VERIFY is not set
# CONFIG_NILFS2_FS is not set
# CONFIG_F2FS_FS is not set
CONFIG_FS_POSIX_ACL=y
CONFIG_EXPORTFS=y
# CONFIG_EXPORTFS_BLOCK_OPS is not set
CONFIG_FILE_LOCKING=y
# CONFIG_FS_ENCRYPTION is not set
# CONFIG_FS_VERITY is not set
CONFIG_FSNOTIFY=y
CONFIG_DNOTIFY=y
CONFIG_INOTIFY_USER=y
CONFIG_FANOTIFY=y
# CONFIG_FANOTIFY_ACCESS_PERMISSIONS is not set
CONFIG_QUOTA=y
CONFIG_QUOTA_NETLINK_INTERFACE=y
# CONFIG_PRINT_QUOTA_WARNING is not set
# CONFIG_QUOTA_DEBUG is not set
# CONFIG_QFMT_V1 is not set
# CONFIG_QFMT_V2 is not set
CONFIG_QUOTACTL=y
# CONFIG_AUTOFS4_FS is not set
# CONFIG_AUTOFS_FS is not set
CONFIG_FUSE_FS=y
# CONFIG_CUSE is not set
# CONFIG_VIRTIO_FS is not set
# CONFIG_OVERLAY_FS is not set
#
# Caches
#
CONFIG_NETFS_SUPPORT=y
# CONFIG_NETFS_STATS is not set
CONFIG_FSCACHE=y
# CONFIG_FSCACHE_STATS is not set
# CONFIG_FSCACHE_DEBUG is not set
CONFIG_CACHEFILES=y
# CONFIG_CACHEFILES_DEBUG is not set
# CONFIG_CACHEFILES_ERROR_INJECTION is not set
# CONFIG_CACHEFILES_ONDEMAND is not set
# end of Caches
#
# CD-ROM/DVD Filesystems
#
CONFIG_ISO9660_FS=y
CONFIG_JOLIET=y
CONFIG_ZISOFS=y
CONFIG_UDF_FS=y
# end of CD-ROM/DVD Filesystems
#
# DOS/FAT/EXFAT/NT Filesystems
#
CONFIG_FAT_FS=y
CONFIG_MSDOS_FS=y
CONFIG_VFAT_FS=y
CONFIG_FAT_DEFAULT_CODEPAGE=437
CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
# CONFIG_FAT_DEFAULT_UTF8 is not set
# CONFIG_FAT_KUNIT_TEST is not set
# CONFIG_EXFAT_FS is not set
CONFIG_NTFS_FS=y
# CONFIG_NTFS_DEBUG is not set
# CONFIG_NTFS_RW is not set
# CONFIG_NTFS3_FS is not set
# end of DOS/FAT/EXFAT/NT Filesystems
#
# Pseudo filesystems
#
CONFIG_PROC_FS=y
CONFIG_PROC_KCORE=y
CONFIG_PROC_VMCORE=y
# CONFIG_PROC_VMCORE_DEVICE_DUMP is not set
CONFIG_PROC_SYSCTL=y
CONFIG_PROC_PAGE_MONITOR=y
# CONFIG_PROC_CHILDREN is not set
CONFIG_PROC_PID_ARCH_STATUS=y
CONFIG_KERNFS=y
CONFIG_SYSFS=y
CONFIG_TMPFS=y
CONFIG_TMPFS_POSIX_ACL=y
CONFIG_TMPFS_XATTR=y
# CONFIG_TMPFS_INODE64 is not set
CONFIG_HUGETLBFS=y
CONFIG_HUGETLB_PAGE=y
CONFIG_ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y
CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y
# CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON is not set
CONFIG_MEMFD_CREATE=y
CONFIG_ARCH_HAS_GIGANTIC_PAGE=y
CONFIG_CONFIGFS_FS=y
# end of Pseudo filesystems
# CONFIG_MISC_FILESYSTEMS is not set
CONFIG_NETWORK_FILESYSTEMS=y
CONFIG_NFS_FS=y
CONFIG_NFS_V2=y
CONFIG_NFS_V3=y
CONFIG_NFS_V3_ACL=y
CONFIG_NFS_V4=y
# CONFIG_NFS_SWAP is not set
CONFIG_NFS_V4_1=y
CONFIG_NFS_V4_2=y
CONFIG_PNFS_FILE_LAYOUT=y
CONFIG_PNFS_BLOCK=y
CONFIG_PNFS_FLEXFILE_LAYOUT=y
CONFIG_NFS_V4_1_IMPLEMENTATION_ID_DOMAIN="kernel.org"
# CONFIG_NFS_V4_1_MIGRATION is not set
CONFIG_NFS_V4_SECURITY_LABEL=y
CONFIG_NFS_FSCACHE=y
# CONFIG_NFS_USE_LEGACY_DNS is not set
CONFIG_NFS_USE_KERNEL_DNS=y
CONFIG_NFS_DISABLE_UDP_SUPPORT=y
# CONFIG_NFS_V4_2_READ_PLUS is not set
# CONFIG_NFSD is not set
CONFIG_GRACE_PERIOD=y
CONFIG_LOCKD=y
CONFIG_LOCKD_V4=y
CONFIG_NFS_ACL_SUPPORT=y
CONFIG_NFS_COMMON=y
CONFIG_NFS_V4_2_SSC_HELPER=y
CONFIG_SUNRPC=y
CONFIG_SUNRPC_GSS=y
CONFIG_SUNRPC_BACKCHANNEL=y
# CONFIG_RPCSEC_GSS_KRB5 is not set
# CONFIG_SUNRPC_DEBUG is not set
# CONFIG_CEPH_FS is not set
# CONFIG_CIFS is not set
# CONFIG_SMB_SERVER is not set
# CONFIG_CODA_FS is not set
# CONFIG_AFS_FS is not set
CONFIG_NLS=y
CONFIG_NLS_DEFAULT="utf8"
CONFIG_NLS_CODEPAGE_437=m
CONFIG_NLS_CODEPAGE_737=m
CONFIG_NLS_CODEPAGE_775=m
CONFIG_NLS_CODEPAGE_850=m
CONFIG_NLS_CODEPAGE_852=m
CONFIG_NLS_CODEPAGE_855=m
CONFIG_NLS_CODEPAGE_857=m
CONFIG_NLS_CODEPAGE_860=m
CONFIG_NLS_CODEPAGE_861=m
CONFIG_NLS_CODEPAGE_862=m
CONFIG_NLS_CODEPAGE_863=m
CONFIG_NLS_CODEPAGE_864=m
CONFIG_NLS_CODEPAGE_865=m
CONFIG_NLS_CODEPAGE_866=m
CONFIG_NLS_CODEPAGE_869=m
CONFIG_NLS_CODEPAGE_936=m
CONFIG_NLS_CODEPAGE_950=m
CONFIG_NLS_CODEPAGE_932=m
CONFIG_NLS_CODEPAGE_949=m
CONFIG_NLS_CODEPAGE_874=m
CONFIG_NLS_ISO8859_8=m
CONFIG_NLS_CODEPAGE_1250=m
CONFIG_NLS_CODEPAGE_1251=m
CONFIG_NLS_ASCII=m
CONFIG_NLS_ISO8859_1=m
CONFIG_NLS_ISO8859_2=m
CONFIG_NLS_ISO8859_3=m
CONFIG_NLS_ISO8859_4=m
CONFIG_NLS_ISO8859_5=m
CONFIG_NLS_ISO8859_6=m
CONFIG_NLS_ISO8859_7=m
CONFIG_NLS_ISO8859_9=m
CONFIG_NLS_ISO8859_13=m
CONFIG_NLS_ISO8859_14=m
CONFIG_NLS_ISO8859_15=m
CONFIG_NLS_KOI8_R=m
CONFIG_NLS_KOI8_U=m
# CONFIG_NLS_MAC_ROMAN is not set
# CONFIG_NLS_MAC_CELTIC is not set
# CONFIG_NLS_MAC_CENTEURO is not set
# CONFIG_NLS_MAC_CROATIAN is not set
# CONFIG_NLS_MAC_CYRILLIC is not set
# CONFIG_NLS_MAC_GAELIC is not set
# CONFIG_NLS_MAC_GREEK is not set
# CONFIG_NLS_MAC_ICELAND is not set
# CONFIG_NLS_MAC_INUIT is not set
# CONFIG_NLS_MAC_ROMANIAN is not set
# CONFIG_NLS_MAC_TURKISH is not set
CONFIG_NLS_UTF8=m
# CONFIG_DLM is not set
# CONFIG_UNICODE is not set
CONFIG_IO_WQ=y
# end of File systems
#
# Security options
#
CONFIG_KEYS=y
# CONFIG_KEYS_REQUEST_CACHE is not set
# CONFIG_PERSISTENT_KEYRINGS is not set
# CONFIG_TRUSTED_KEYS is not set
# CONFIG_ENCRYPTED_KEYS is not set
# CONFIG_KEY_DH_OPERATIONS is not set
# CONFIG_SECURITY_DMESG_RESTRICT is not set
CONFIG_SECURITY=y
CONFIG_SECURITYFS=y
CONFIG_SECURITY_NETWORK=y
CONFIG_PAGE_TABLE_ISOLATION=y
# CONFIG_SECURITY_NETWORK_XFRM is not set
# CONFIG_SECURITY_PATH is not set
CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR=y
# CONFIG_HARDENED_USERCOPY is not set
# CONFIG_FORTIFY_SOURCE is not set
# CONFIG_STATIC_USERMODEHELPER is not set
# CONFIG_SECURITY_SELINUX is not set
# CONFIG_SECURITY_SMACK is not set
# CONFIG_SECURITY_TOMOYO is not set
# CONFIG_SECURITY_APPARMOR is not set
# CONFIG_SECURITY_LOADPIN is not set
# CONFIG_SECURITY_YAMA is not set
# CONFIG_SECURITY_SAFESETID is not set
# CONFIG_SECURITY_LOCKDOWN_LSM is not set
# CONFIG_SECURITY_LANDLOCK is not set
CONFIG_INTEGRITY=y
# CONFIG_INTEGRITY_SIGNATURE is not set
CONFIG_INTEGRITY_AUDIT=y
CONFIG_IMA=y
CONFIG_IMA_MEASURE_PCR_IDX=10
CONFIG_IMA_NG_TEMPLATE=y
# CONFIG_IMA_SIG_TEMPLATE is not set
CONFIG_IMA_DEFAULT_TEMPLATE="ima-ng"
CONFIG_IMA_DEFAULT_HASH_SHA1=y
# CONFIG_IMA_DEFAULT_HASH_SHA256 is not set
CONFIG_IMA_DEFAULT_HASH="sha1"
# CONFIG_IMA_WRITE_POLICY is not set
# CONFIG_IMA_READ_POLICY is not set
# CONFIG_IMA_APPRAISE is not set
# CONFIG_IMA_DISABLE_HTABLE is not set
# CONFIG_EVM is not set
CONFIG_DEFAULT_SECURITY_DAC=y
CONFIG_LSM="yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,apparmor,bpf"
#
# Kernel hardening options
#
#
# Memory initialization
#
CONFIG_INIT_STACK_NONE=y
# CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set
# CONFIG_INIT_ON_FREE_DEFAULT_ON is not set
# end of Memory initialization
CONFIG_RANDSTRUCT_NONE=y
# end of Kernel hardening options
# end of Security options
CONFIG_XOR_BLOCKS=y
CONFIG_ASYNC_CORE=y
CONFIG_ASYNC_MEMCPY=y
CONFIG_ASYNC_XOR=y
CONFIG_ASYNC_PQ=y
CONFIG_ASYNC_RAID6_RECOV=y
CONFIG_CRYPTO=y
#
# Crypto core or helper
#
CONFIG_CRYPTO_ALGAPI=y
CONFIG_CRYPTO_ALGAPI2=y
CONFIG_CRYPTO_AEAD=y
CONFIG_CRYPTO_AEAD2=y
CONFIG_CRYPTO_SKCIPHER=y
CONFIG_CRYPTO_SKCIPHER2=y
CONFIG_CRYPTO_HASH=y
CONFIG_CRYPTO_HASH2=y
CONFIG_CRYPTO_RNG=m
CONFIG_CRYPTO_RNG2=y
CONFIG_CRYPTO_RNG_DEFAULT=m
CONFIG_CRYPTO_AKCIPHER2=y
CONFIG_CRYPTO_AKCIPHER=m
CONFIG_CRYPTO_KPP2=y
CONFIG_CRYPTO_ACOMP2=y
CONFIG_CRYPTO_MANAGER=y
CONFIG_CRYPTO_MANAGER2=y
# CONFIG_CRYPTO_USER is not set
CONFIG_CRYPTO_MANAGER_DISABLE_TESTS=y
CONFIG_CRYPTO_GF128MUL=m
CONFIG_CRYPTO_NULL=y
CONFIG_CRYPTO_NULL2=y
# CONFIG_CRYPTO_PCRYPT is not set
CONFIG_CRYPTO_CRYPTD=y
CONFIG_CRYPTO_AUTHENC=y
CONFIG_CRYPTO_TEST=m
CONFIG_CRYPTO_SIMD=m
CONFIG_CRYPTO_ENGINE=m
#
# Public-key cryptography
#
CONFIG_CRYPTO_RSA=m
# CONFIG_CRYPTO_DH is not set
# CONFIG_CRYPTO_ECDH is not set
# CONFIG_CRYPTO_ECDSA is not set
# CONFIG_CRYPTO_ECRDSA is not set
# CONFIG_CRYPTO_SM2 is not set
# CONFIG_CRYPTO_CURVE25519 is not set
# CONFIG_CRYPTO_CURVE25519_X86 is not set
#
# Authenticated Encryption with Associated Data
#
CONFIG_CRYPTO_CCM=m
CONFIG_CRYPTO_GCM=m
# CONFIG_CRYPTO_CHACHA20POLY1305 is not set
# CONFIG_CRYPTO_AEGIS128 is not set
# CONFIG_CRYPTO_AEGIS128_AESNI_SSE2 is not set
CONFIG_CRYPTO_SEQIV=m
CONFIG_CRYPTO_ECHAINIV=m
#
# Block modes
#
CONFIG_CRYPTO_CBC=y
# CONFIG_CRYPTO_CFB is not set
CONFIG_CRYPTO_CTR=m
CONFIG_CRYPTO_CTS=m
CONFIG_CRYPTO_ECB=y
CONFIG_CRYPTO_LRW=m
# CONFIG_CRYPTO_OFB is not set
CONFIG_CRYPTO_PCBC=m
CONFIG_CRYPTO_XTS=m
# CONFIG_CRYPTO_KEYWRAP is not set
# CONFIG_CRYPTO_NHPOLY1305_SSE2 is not set
# CONFIG_CRYPTO_NHPOLY1305_AVX2 is not set
# CONFIG_CRYPTO_ADIANTUM is not set
CONFIG_CRYPTO_ESSIV=y
#
# Hash modes
#
# CONFIG_CRYPTO_CMAC is not set
CONFIG_CRYPTO_HMAC=y
# CONFIG_CRYPTO_XCBC is not set
# CONFIG_CRYPTO_VMAC is not set
#
# Digest
#
CONFIG_CRYPTO_CRC32C=y
CONFIG_CRYPTO_CRC32C_INTEL=y
# CONFIG_CRYPTO_CRC32 is not set
# CONFIG_CRYPTO_CRC32_PCLMUL is not set
CONFIG_CRYPTO_XXHASH=y
CONFIG_CRYPTO_BLAKE2B=y
# CONFIG_CRYPTO_BLAKE2S is not set
# CONFIG_CRYPTO_BLAKE2S_X86 is not set
CONFIG_CRYPTO_CRCT10DIF=y
# CONFIG_CRYPTO_CRCT10DIF_PCLMUL is not set
CONFIG_CRYPTO_CRC64_ROCKSOFT=y
CONFIG_CRYPTO_GHASH=m
# CONFIG_CRYPTO_POLY1305 is not set
# CONFIG_CRYPTO_POLY1305_X86_64 is not set
CONFIG_CRYPTO_MD4=m
CONFIG_CRYPTO_MD5=y
CONFIG_CRYPTO_MICHAEL_MIC=m
CONFIG_CRYPTO_RMD160=m
CONFIG_CRYPTO_SHA1=y
# CONFIG_CRYPTO_SHA1_SSSE3 is not set
# CONFIG_CRYPTO_SHA256_SSSE3 is not set
# CONFIG_CRYPTO_SHA512_SSSE3 is not set
CONFIG_CRYPTO_SHA256=y
CONFIG_CRYPTO_SHA512=m
# CONFIG_CRYPTO_SHA3 is not set
# CONFIG_CRYPTO_SM3_GENERIC is not set
# CONFIG_CRYPTO_SM3_AVX_X86_64 is not set
# CONFIG_CRYPTO_STREEBOG is not set
CONFIG_CRYPTO_WP512=m
CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL=m
#
# Ciphers
#
CONFIG_CRYPTO_AES=y
# CONFIG_CRYPTO_AES_TI is not set
CONFIG_CRYPTO_AES_NI_INTEL=m
CONFIG_CRYPTO_ANUBIS=m
CONFIG_CRYPTO_ARC4=y
CONFIG_CRYPTO_BLOWFISH=m
CONFIG_CRYPTO_BLOWFISH_COMMON=m
# CONFIG_CRYPTO_BLOWFISH_X86_64 is not set
CONFIG_CRYPTO_CAMELLIA=m
# CONFIG_CRYPTO_CAMELLIA_X86_64 is not set
# CONFIG_CRYPTO_CAMELLIA_AESNI_AVX_X86_64 is not set
# CONFIG_CRYPTO_CAMELLIA_AESNI_AVX2_X86_64 is not set
CONFIG_CRYPTO_CAST_COMMON=m
CONFIG_CRYPTO_CAST5=m
# CONFIG_CRYPTO_CAST5_AVX_X86_64 is not set
CONFIG_CRYPTO_CAST6=m
# CONFIG_CRYPTO_CAST6_AVX_X86_64 is not set
CONFIG_CRYPTO_DES=m
# CONFIG_CRYPTO_DES3_EDE_X86_64 is not set
CONFIG_CRYPTO_FCRYPT=m
CONFIG_CRYPTO_KHAZAD=m
# CONFIG_CRYPTO_CHACHA20 is not set
# CONFIG_CRYPTO_CHACHA20_X86_64 is not set
CONFIG_CRYPTO_SEED=m
CONFIG_CRYPTO_SERPENT=m
# CONFIG_CRYPTO_SERPENT_SSE2_X86_64 is not set
# CONFIG_CRYPTO_SERPENT_AVX_X86_64 is not set
# CONFIG_CRYPTO_SERPENT_AVX2_X86_64 is not set
# CONFIG_CRYPTO_SM4_GENERIC is not set
# CONFIG_CRYPTO_SM4_AESNI_AVX_X86_64 is not set
# CONFIG_CRYPTO_SM4_AESNI_AVX2_X86_64 is not set
CONFIG_CRYPTO_TEA=m
CONFIG_CRYPTO_TWOFISH=m
CONFIG_CRYPTO_TWOFISH_COMMON=m
CONFIG_CRYPTO_TWOFISH_X86_64=m
# CONFIG_CRYPTO_TWOFISH_X86_64_3WAY is not set
# CONFIG_CRYPTO_TWOFISH_AVX_X86_64 is not set
#
# Compression
#
CONFIG_CRYPTO_DEFLATE=m
CONFIG_CRYPTO_LZO=y
# CONFIG_CRYPTO_842 is not set
# CONFIG_CRYPTO_LZ4 is not set
# CONFIG_CRYPTO_LZ4HC is not set
# CONFIG_CRYPTO_ZSTD is not set
#
# Random Number Generation
#
CONFIG_CRYPTO_ANSI_CPRNG=m
CONFIG_CRYPTO_DRBG_MENU=m
CONFIG_CRYPTO_DRBG_HMAC=y
# CONFIG_CRYPTO_DRBG_HASH is not set
# CONFIG_CRYPTO_DRBG_CTR is not set
CONFIG_CRYPTO_DRBG=m
CONFIG_CRYPTO_JITTERENTROPY=m
CONFIG_CRYPTO_USER_API=m
CONFIG_CRYPTO_USER_API_HASH=m
CONFIG_CRYPTO_USER_API_SKCIPHER=m
# CONFIG_CRYPTO_USER_API_RNG is not set
# CONFIG_CRYPTO_USER_API_AEAD is not set
CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE=y
CONFIG_CRYPTO_HASH_INFO=y
CONFIG_CRYPTO_HW=y
CONFIG_CRYPTO_DEV_PADLOCK=y
CONFIG_CRYPTO_DEV_PADLOCK_AES=m
CONFIG_CRYPTO_DEV_PADLOCK_SHA=m
# CONFIG_CRYPTO_DEV_ATMEL_ECC is not set
# CONFIG_CRYPTO_DEV_ATMEL_SHA204A is not set
# CONFIG_CRYPTO_DEV_CCP is not set
# CONFIG_CRYPTO_DEV_QAT_DH895xCC is not set
# CONFIG_CRYPTO_DEV_QAT_C3XXX is not set
# CONFIG_CRYPTO_DEV_QAT_C62X is not set
# CONFIG_CRYPTO_DEV_QAT_4XXX is not set
# CONFIG_CRYPTO_DEV_QAT_DH895xCCVF is not set
# CONFIG_CRYPTO_DEV_QAT_C3XXXVF is not set
# CONFIG_CRYPTO_DEV_QAT_C62XVF is not set
# CONFIG_CRYPTO_DEV_NITROX_CNN55XX is not set
CONFIG_CRYPTO_DEV_VIRTIO=m
# CONFIG_CRYPTO_DEV_SAFEXCEL is not set
# CONFIG_CRYPTO_DEV_AMLOGIC_GXL is not set
# CONFIG_ASYMMETRIC_KEY_TYPE is not set
#
# Certificates for signature checking
#
# CONFIG_SYSTEM_BLACKLIST_KEYRING is not set
# end of Certificates for signature checking
CONFIG_BINARY_PRINTF=y
#
# Library routines
#
CONFIG_RAID6_PQ=y
CONFIG_RAID6_PQ_BENCHMARK=y
# CONFIG_PACKING is not set
CONFIG_BITREVERSE=y
CONFIG_GENERIC_STRNCPY_FROM_USER=y
CONFIG_GENERIC_STRNLEN_USER=y
CONFIG_GENERIC_NET_UTILS=y
# CONFIG_CORDIC is not set
# CONFIG_PRIME_NUMBERS is not set
CONFIG_RATIONAL=y
CONFIG_GENERIC_PCI_IOMAP=y
CONFIG_GENERIC_IOMAP=y
CONFIG_ARCH_USE_CMPXCHG_LOCKREF=y
CONFIG_ARCH_HAS_FAST_MULTIPLIER=y
CONFIG_ARCH_USE_SYM_ANNOTATIONS=y
#
# Crypto library routines
#
CONFIG_CRYPTO_LIB_AES=y
CONFIG_CRYPTO_LIB_ARC4=y
CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
# CONFIG_CRYPTO_LIB_CHACHA is not set
# CONFIG_CRYPTO_LIB_CURVE25519 is not set
CONFIG_CRYPTO_LIB_DES=m
CONFIG_CRYPTO_LIB_POLY1305_RSIZE=11
# CONFIG_CRYPTO_LIB_POLY1305 is not set
# CONFIG_CRYPTO_LIB_CHACHA20POLY1305 is not set
CONFIG_CRYPTO_LIB_SHA256=y
# end of Crypto library routines
CONFIG_LIB_MEMNEQ=y
CONFIG_CRC_CCITT=y
CONFIG_CRC16=y
CONFIG_CRC_T10DIF=y
CONFIG_CRC64_ROCKSOFT=y
CONFIG_CRC_ITU_T=y
CONFIG_CRC32=y
# CONFIG_CRC32_SELFTEST is not set
CONFIG_CRC32_SLICEBY8=y
# CONFIG_CRC32_SLICEBY4 is not set
# CONFIG_CRC32_SARWATE is not set
# CONFIG_CRC32_BIT is not set
CONFIG_CRC64=y
# CONFIG_CRC4 is not set
CONFIG_CRC7=y
CONFIG_LIBCRC32C=y
# CONFIG_CRC8 is not set
CONFIG_XXHASH=y
# CONFIG_RANDOM32_SELFTEST is not set
CONFIG_ZLIB_INFLATE=y
CONFIG_ZLIB_DEFLATE=y
CONFIG_LZO_COMPRESS=y
CONFIG_LZO_DECOMPRESS=y
CONFIG_ZSTD_COMPRESS=y
CONFIG_ZSTD_DECOMPRESS=y
CONFIG_XZ_DEC=y
CONFIG_XZ_DEC_X86=y
# CONFIG_XZ_DEC_POWERPC is not set
# CONFIG_XZ_DEC_IA64 is not set
# CONFIG_XZ_DEC_ARM is not set
# CONFIG_XZ_DEC_ARMTHUMB is not set
# CONFIG_XZ_DEC_SPARC is not set
# CONFIG_XZ_DEC_MICROLZMA is not set
CONFIG_XZ_DEC_BCJ=y
CONFIG_XZ_DEC_TEST=y
CONFIG_DECOMPRESS_GZIP=y
CONFIG_DECOMPRESS_BZIP2=y
CONFIG_DECOMPRESS_LZMA=y
CONFIG_DECOMPRESS_XZ=y
CONFIG_DECOMPRESS_LZO=y
CONFIG_DECOMPRESS_ZSTD=y
CONFIG_GENERIC_ALLOCATOR=y
CONFIG_TEXTSEARCH=y
CONFIG_TEXTSEARCH_KMP=m
CONFIG_TEXTSEARCH_BM=m
CONFIG_TEXTSEARCH_FSM=m
CONFIG_XARRAY_MULTI=y
CONFIG_ASSOCIATIVE_ARRAY=y
CONFIG_HAS_IOMEM=y
CONFIG_HAS_IOPORT_MAP=y
CONFIG_HAS_DMA=y
CONFIG_NEED_SG_DMA_LENGTH=y
CONFIG_NEED_DMA_MAP_STATE=y
CONFIG_ARCH_DMA_ADDR_T_64BIT=y
CONFIG_SWIOTLB=y
# CONFIG_DMA_API_DEBUG is not set
# CONFIG_DMA_MAP_BENCHMARK is not set
CONFIG_SGL_ALLOC=y
# CONFIG_CPUMASK_OFFSTACK is not set
CONFIG_CPU_RMAP=y
CONFIG_DQL=y
CONFIG_GLOB=y
# CONFIG_GLOB_SELFTEST is not set
CONFIG_NLATTR=y
CONFIG_CLZ_TAB=y
CONFIG_IRQ_POLL=y
CONFIG_MPILIB=m
CONFIG_OID_REGISTRY=y
CONFIG_HAVE_GENERIC_VDSO=y
CONFIG_GENERIC_GETTIMEOFDAY=y
CONFIG_GENERIC_VDSO_TIME_NS=y
CONFIG_FONT_SUPPORT=y
CONFIG_FONTS=y
# CONFIG_FONT_8x8 is not set
CONFIG_FONT_8x16=y
# CONFIG_FONT_6x11 is not set
# CONFIG_FONT_7x14 is not set
# CONFIG_FONT_PEARL_8x8 is not set
# CONFIG_FONT_ACORN_8x8 is not set
# CONFIG_FONT_MINI_4x6 is not set
# CONFIG_FONT_6x10 is not set
CONFIG_FONT_10x18=y
# CONFIG_FONT_SUN8x16 is not set
# CONFIG_FONT_SUN12x22 is not set
# CONFIG_FONT_TER16x32 is not set
# CONFIG_FONT_6x8 is not set
CONFIG_SG_POOL=y
CONFIG_ARCH_HAS_PMEM_API=y
CONFIG_ARCH_HAS_UACCESS_FLUSHCACHE=y
CONFIG_ARCH_HAS_COPY_MC=y
CONFIG_ARCH_STACKWALK=y
CONFIG_STACKDEPOT=y
CONFIG_STACKDEPOT_ALWAYS_INIT=y
CONFIG_STACK_HASH_ORDER=20
CONFIG_SBITMAP=y
# end of Library routines
#
# Kernel hacking
#
#
# printk and dmesg options
#
CONFIG_PRINTK_TIME=y
# CONFIG_PRINTK_CALLER is not set
# CONFIG_STACKTRACE_BUILD_ID is not set
CONFIG_CONSOLE_LOGLEVEL_DEFAULT=7
CONFIG_CONSOLE_LOGLEVEL_QUIET=4
CONFIG_MESSAGE_LOGLEVEL_DEFAULT=4
CONFIG_BOOT_PRINTK_DELAY=y
CONFIG_DYNAMIC_DEBUG=y
CONFIG_DYNAMIC_DEBUG_CORE=y
CONFIG_SYMBOLIC_ERRNAME=y
CONFIG_DEBUG_BUGVERBOSE=y
# end of printk and dmesg options
CONFIG_DEBUG_KERNEL=y
CONFIG_DEBUG_MISC=y
#
# Compile-time checks and compiler options
#
CONFIG_DEBUG_INFO=y
# CONFIG_DEBUG_INFO_NONE is not set
CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
# CONFIG_DEBUG_INFO_DWARF4 is not set
# CONFIG_DEBUG_INFO_DWARF5 is not set
# CONFIG_DEBUG_INFO_REDUCED is not set
# CONFIG_DEBUG_INFO_COMPRESSED is not set
# CONFIG_DEBUG_INFO_SPLIT is not set
CONFIG_DEBUG_INFO_BTF=y
CONFIG_PAHOLE_HAS_SPLIT_BTF=y
CONFIG_DEBUG_INFO_BTF_MODULES=y
# CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set
# CONFIG_GDB_SCRIPTS is not set
CONFIG_FRAME_WARN=1024
# CONFIG_STRIP_ASM_SYMS is not set
# CONFIG_READABLE_ASM is not set
# CONFIG_HEADERS_INSTALL is not set
# CONFIG_DEBUG_SECTION_MISMATCH is not set
CONFIG_SECTION_MISMATCH_WARN_ONLY=y
# CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B is not set
CONFIG_OBJTOOL=y
# CONFIG_VMLINUX_MAP is not set
# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set
# end of Compile-time checks and compiler options
#
# Generic Kernel Debugging Instruments
#
CONFIG_MAGIC_SYSRQ=y
CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0x1
CONFIG_MAGIC_SYSRQ_SERIAL=y
CONFIG_MAGIC_SYSRQ_SERIAL_SEQUENCE=""
CONFIG_DEBUG_FS=y
CONFIG_DEBUG_FS_ALLOW_ALL=y
# CONFIG_DEBUG_FS_DISALLOW_MOUNT is not set
# CONFIG_DEBUG_FS_ALLOW_NONE is not set
CONFIG_HAVE_ARCH_KGDB=y
# CONFIG_KGDB is not set
CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y
# CONFIG_UBSAN is not set
CONFIG_HAVE_ARCH_KCSAN=y
# end of Generic Kernel Debugging Instruments
#
# Networking Debugging
#
# CONFIG_NET_DEV_REFCNT_TRACKER is not set
# CONFIG_NET_NS_REFCNT_TRACKER is not set
# CONFIG_DEBUG_NET is not set
# end of Networking Debugging
#
# Memory Debugging
#
CONFIG_PAGE_EXTENSION=y
CONFIG_DEBUG_PAGEALLOC=y
CONFIG_DEBUG_PAGEALLOC_ENABLE_DEFAULT=y
CONFIG_SLUB_DEBUG=y
CONFIG_SLUB_DEBUG_ON=y
CONFIG_PAGE_OWNER=y
# CONFIG_PAGE_TABLE_CHECK is not set
CONFIG_PAGE_POISONING=y
CONFIG_DEBUG_PAGE_REF=y
CONFIG_DEBUG_RODATA_TEST=y
CONFIG_ARCH_HAS_DEBUG_WX=y
# CONFIG_DEBUG_WX is not set
CONFIG_GENERIC_PTDUMP=y
CONFIG_PTDUMP_CORE=y
CONFIG_PTDUMP_DEBUGFS=y
CONFIG_DEBUG_OBJECTS=y
CONFIG_DEBUG_OBJECTS_SELFTEST=y
CONFIG_DEBUG_OBJECTS_FREE=y
CONFIG_DEBUG_OBJECTS_TIMERS=y
CONFIG_DEBUG_OBJECTS_WORK=y
CONFIG_DEBUG_OBJECTS_RCU_HEAD=y
CONFIG_DEBUG_OBJECTS_PERCPU_COUNTER=y
CONFIG_DEBUG_OBJECTS_ENABLE_DEFAULT=1
CONFIG_HAVE_DEBUG_KMEMLEAK=y
CONFIG_DEBUG_KMEMLEAK=y
CONFIG_DEBUG_KMEMLEAK_MEM_POOL_SIZE=16000
# CONFIG_DEBUG_KMEMLEAK_TEST is not set
CONFIG_DEBUG_KMEMLEAK_DEFAULT_OFF=y
CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN=y
CONFIG_DEBUG_STACK_USAGE=y
CONFIG_SCHED_STACK_END_CHECK=y
CONFIG_ARCH_HAS_DEBUG_VM_PGTABLE=y
CONFIG_DEBUG_VM=y
CONFIG_DEBUG_VM_VMACACHE=y
CONFIG_DEBUG_VM_RB=y
CONFIG_DEBUG_VM_PGFLAGS=y
CONFIG_DEBUG_VM_PGTABLE=y
CONFIG_ARCH_HAS_DEBUG_VIRTUAL=y
CONFIG_DEBUG_VIRTUAL=y
CONFIG_DEBUG_MEMORY_INIT=y
CONFIG_DEBUG_PER_CPU_MAPS=y
CONFIG_ARCH_SUPPORTS_KMAP_LOCAL_FORCE_MAP=y
# CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP is not set
CONFIG_HAVE_ARCH_KASAN=y
CONFIG_HAVE_ARCH_KASAN_VMALLOC=y
CONFIG_CC_HAS_KASAN_GENERIC=y
CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y
# CONFIG_KASAN is not set
CONFIG_HAVE_ARCH_KFENCE=y
# CONFIG_KFENCE is not set
# end of Memory Debugging
CONFIG_DEBUG_SHIRQ=y
#
# Debug Oops, Lockups and Hangs
#
CONFIG_PANIC_ON_OOPS=y
CONFIG_PANIC_ON_OOPS_VALUE=1
CONFIG_PANIC_TIMEOUT=0
CONFIG_LOCKUP_DETECTOR=y
CONFIG_SOFTLOCKUP_DETECTOR=y
CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
CONFIG_HARDLOCKUP_DETECTOR_PERF=y
CONFIG_HARDLOCKUP_CHECK_TIMESTAMP=y
CONFIG_HARDLOCKUP_DETECTOR=y
CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
CONFIG_DETECT_HUNG_TASK=y
CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120
CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
CONFIG_WQ_WATCHDOG=y
# CONFIG_TEST_LOCKUP is not set
# end of Debug Oops, Lockups and Hangs
#
# Scheduler Debugging
#
CONFIG_SCHED_DEBUG=y
CONFIG_SCHED_INFO=y
CONFIG_SCHEDSTATS=y
# end of Scheduler Debugging
CONFIG_DEBUG_TIMEKEEPING=y
CONFIG_DEBUG_PREEMPT=y
#
# Lock Debugging (spinlocks, mutexes, etc...)
#
CONFIG_LOCK_DEBUGGING_SUPPORT=y
CONFIG_PROVE_LOCKING=y
# CONFIG_PROVE_RAW_LOCK_NESTING is not set
CONFIG_LOCK_STAT=y
CONFIG_DEBUG_RT_MUTEXES=y
CONFIG_DEBUG_SPINLOCK=y
CONFIG_DEBUG_MUTEXES=y
CONFIG_DEBUG_WW_MUTEX_SLOWPATH=y
CONFIG_DEBUG_RWSEMS=y
CONFIG_DEBUG_LOCK_ALLOC=y
CONFIG_LOCKDEP=y
CONFIG_LOCKDEP_BITS=15
CONFIG_LOCKDEP_CHAINS_BITS=16
CONFIG_LOCKDEP_STACK_TRACE_BITS=19
CONFIG_LOCKDEP_STACK_TRACE_HASH_BITS=14
CONFIG_LOCKDEP_CIRCULAR_QUEUE_BITS=12
# CONFIG_DEBUG_LOCKDEP is not set
CONFIG_DEBUG_ATOMIC_SLEEP=y
CONFIG_DEBUG_LOCKING_API_SELFTESTS=y
# CONFIG_LOCK_TORTURE_TEST is not set
# CONFIG_WW_MUTEX_SELFTEST is not set
# CONFIG_SCF_TORTURE_TEST is not set
# CONFIG_CSD_LOCK_WAIT_DEBUG is not set
# end of Lock Debugging (spinlocks, mutexes, etc...)
CONFIG_TRACE_IRQFLAGS=y
CONFIG_TRACE_IRQFLAGS_NMI=y
# CONFIG_DEBUG_IRQFLAGS is not set
CONFIG_STACKTRACE=y
# CONFIG_WARN_ALL_UNSEEDED_RANDOM is not set
CONFIG_DEBUG_KOBJECT=y
CONFIG_DEBUG_KOBJECT_RELEASE=y
#
# Debug kernel data structures
#
CONFIG_DEBUG_LIST=y
# CONFIG_DEBUG_PLIST is not set
# CONFIG_DEBUG_SG is not set
# CONFIG_DEBUG_NOTIFIERS is not set
# CONFIG_BUG_ON_DATA_CORRUPTION is not set
# end of Debug kernel data structures
CONFIG_DEBUG_CREDENTIALS=y
#
# RCU Debugging
#
CONFIG_PROVE_RCU=y
# CONFIG_RCU_SCALE_TEST is not set
# CONFIG_RCU_TORTURE_TEST is not set
# CONFIG_RCU_REF_SCALE_TEST is not set
CONFIG_RCU_CPU_STALL_TIMEOUT=60
CONFIG_RCU_EXP_CPU_STALL_TIMEOUT=0
# CONFIG_RCU_TRACE is not set
# CONFIG_RCU_EQS_DEBUG is not set
# end of RCU Debugging
CONFIG_DEBUG_WQ_FORCE_RR_CPU=y
CONFIG_CPU_HOTPLUG_STATE_CONTROL=y
CONFIG_LATENCYTOP=y
CONFIG_USER_STACKTRACE_SUPPORT=y
CONFIG_NOP_TRACER=y
CONFIG_HAVE_RETHOOK=y
CONFIG_RETHOOK=y
CONFIG_HAVE_FUNCTION_TRACER=y
CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
CONFIG_HAVE_DYNAMIC_FTRACE=y
CONFIG_HAVE_DYNAMIC_FTRACE_WITH_REGS=y
CONFIG_HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS=y
CONFIG_HAVE_DYNAMIC_FTRACE_WITH_ARGS=y
CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
CONFIG_HAVE_SYSCALL_TRACEPOINTS=y
CONFIG_HAVE_FENTRY=y
CONFIG_HAVE_OBJTOOL_MCOUNT=y
CONFIG_HAVE_C_RECORDMCOUNT=y
CONFIG_HAVE_BUILDTIME_MCOUNT_SORT=y
CONFIG_BUILDTIME_MCOUNT_SORT=y
CONFIG_TRACER_MAX_TRACE=y
CONFIG_TRACE_CLOCK=y
CONFIG_RING_BUFFER=y
CONFIG_EVENT_TRACING=y
CONFIG_CONTEXT_SWITCH_TRACER=y
CONFIG_PREEMPTIRQ_TRACEPOINTS=y
CONFIG_TRACING=y
CONFIG_GENERIC_TRACER=y
CONFIG_TRACING_SUPPORT=y
CONFIG_FTRACE=y
# CONFIG_BOOTTIME_TRACING is not set
CONFIG_FUNCTION_TRACER=y
CONFIG_FUNCTION_GRAPH_TRACER=y
CONFIG_DYNAMIC_FTRACE=y
CONFIG_DYNAMIC_FTRACE_WITH_REGS=y
CONFIG_DYNAMIC_FTRACE_WITH_DIRECT_CALLS=y
CONFIG_DYNAMIC_FTRACE_WITH_ARGS=y
# CONFIG_FPROBE is not set
CONFIG_FUNCTION_PROFILER=y
CONFIG_STACK_TRACER=y
# CONFIG_IRQSOFF_TRACER is not set
# CONFIG_PREEMPT_TRACER is not set
CONFIG_SCHED_TRACER=y
# CONFIG_HWLAT_TRACER is not set
# CONFIG_OSNOISE_TRACER is not set
# CONFIG_TIMERLAT_TRACER is not set
CONFIG_MMIOTRACE=y
CONFIG_FTRACE_SYSCALLS=y
CONFIG_TRACER_SNAPSHOT=y
# CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP is not set
CONFIG_BRANCH_PROFILE_NONE=y
# CONFIG_PROFILE_ANNOTATED_BRANCHES is not set
# CONFIG_PROFILE_ALL_BRANCHES is not set
CONFIG_BLK_DEV_IO_TRACE=y
CONFIG_KPROBE_EVENTS=y
CONFIG_KPROBE_EVENTS_ON_NOTRACE=y
CONFIG_UPROBE_EVENTS=y
CONFIG_BPF_EVENTS=y
CONFIG_DYNAMIC_EVENTS=y
CONFIG_PROBE_EVENTS=y
# CONFIG_BPF_KPROBE_OVERRIDE is not set
CONFIG_FTRACE_MCOUNT_RECORD=y
CONFIG_FTRACE_MCOUNT_USE_CC=y
# CONFIG_SYNTH_EVENTS is not set
# CONFIG_HIST_TRIGGERS is not set
# CONFIG_TRACE_EVENT_INJECT is not set
# CONFIG_TRACEPOINT_BENCHMARK is not set
# CONFIG_RING_BUFFER_BENCHMARK is not set
# CONFIG_TRACE_EVAL_MAP_FILE is not set
# CONFIG_FTRACE_RECORD_RECURSION is not set
# CONFIG_FTRACE_STARTUP_TEST is not set
# CONFIG_FTRACE_SORT_STARTUP_TEST is not set
# CONFIG_RING_BUFFER_STARTUP_TEST is not set
# CONFIG_RING_BUFFER_VALIDATE_TIME_DELTAS is not set
# CONFIG_MMIOTRACE_TEST is not set
# CONFIG_PREEMPTIRQ_DELAY_TEST is not set
# CONFIG_KPROBE_EVENT_GEN_TEST is not set
CONFIG_DA_MON_EVENTS=y
CONFIG_DA_MON_EVENTS_IMPLICIT=y
CONFIG_DA_MON_EVENTS_ID=y
CONFIG_RV=y
CONFIG_RV_MON_WIP=y
CONFIG_RV_MON_WWNR=y
CONFIG_RV_MON_SAFE_WTD=y
CONFIG_RV_REACTORS=y
CONFIG_RV_REACT_PRINTK=y
CONFIG_RV_REACT_PANIC=y
CONFIG_PROVIDE_OHCI1394_DMA_INIT=y
CONFIG_SAMPLES=y
# CONFIG_SAMPLE_AUXDISPLAY is not set
# CONFIG_SAMPLE_TRACE_EVENTS is not set
# CONFIG_SAMPLE_TRACE_CUSTOM_EVENTS is not set
# CONFIG_SAMPLE_TRACE_PRINTK is not set
# CONFIG_SAMPLE_FTRACE_DIRECT is not set
# CONFIG_SAMPLE_FTRACE_DIRECT_MULTI is not set
# CONFIG_SAMPLE_TRACE_ARRAY is not set
# CONFIG_SAMPLE_KOBJECT is not set
# CONFIG_SAMPLE_KPROBES is not set
# CONFIG_SAMPLE_HW_BREAKPOINT is not set
# CONFIG_SAMPLE_KFIFO is not set
CONFIG_SAMPLE_LIVEPATCH=m
CONFIG_SAMPLE_CONFIGFS=m
# CONFIG_SAMPLE_VFIO_MDEV_MDPY_FB is not set
# CONFIG_SAMPLE_WATCHDOG is not set
CONFIG_HAVE_SAMPLE_FTRACE_DIRECT=y
CONFIG_HAVE_SAMPLE_FTRACE_DIRECT_MULTI=y
CONFIG_ARCH_HAS_DEVMEM_IS_ALLOWED=y
CONFIG_STRICT_DEVMEM=y
CONFIG_IO_STRICT_DEVMEM=y
#
# x86 Debugging
#
CONFIG_TRACE_IRQFLAGS_NMI_SUPPORT=y
# CONFIG_X86_VERBOSE_BOOTUP is not set
CONFIG_EARLY_PRINTK=y
# CONFIG_EARLY_PRINTK_DBGP is not set
# CONFIG_EARLY_PRINTK_USB_XDBC is not set
# CONFIG_DEBUG_TLBFLUSH is not set
CONFIG_HAVE_MMIOTRACE_SUPPORT=y
# CONFIG_X86_DECODER_SELFTEST is not set
# CONFIG_IO_DELAY_0X80 is not set
CONFIG_IO_DELAY_0XED=y
# CONFIG_IO_DELAY_UDELAY is not set
# CONFIG_IO_DELAY_NONE is not set
# CONFIG_DEBUG_BOOT_PARAMS is not set
# CONFIG_CPA_DEBUG is not set
# CONFIG_DEBUG_ENTRY is not set
CONFIG_DEBUG_NMI_SELFTEST=y
CONFIG_X86_DEBUG_FPU=y
# CONFIG_PUNIT_ATOM_DEBUG is not set
CONFIG_UNWINDER_ORC=y
# CONFIG_UNWINDER_FRAME_POINTER is not set
# end of x86 Debugging
#
# Kernel Testing and Coverage
#
CONFIG_KUNIT=y
# CONFIG_KUNIT_DEBUGFS is not set
# CONFIG_KUNIT_TEST is not set
# CONFIG_KUNIT_EXAMPLE_TEST is not set
# CONFIG_KUNIT_ALL_TESTS is not set
CONFIG_NOTIFIER_ERROR_INJECTION=y
CONFIG_PM_NOTIFIER_ERROR_INJECT=y
CONFIG_NETDEV_NOTIFIER_ERROR_INJECT=y
CONFIG_FUNCTION_ERROR_INJECTION=y
CONFIG_FAULT_INJECTION=y
CONFIG_FAILSLAB=y
CONFIG_FAIL_PAGE_ALLOC=y
# CONFIG_FAULT_INJECTION_USERCOPY is not set
CONFIG_FAIL_MAKE_REQUEST=y
CONFIG_FAIL_IO_TIMEOUT=y
CONFIG_FAIL_FUTEX=y
CONFIG_FAULT_INJECTION_DEBUG_FS=y
CONFIG_FAIL_FUNCTION=y
CONFIG_ARCH_HAS_KCOV=y
CONFIG_CC_HAS_SANCOV_TRACE_PC=y
# CONFIG_KCOV is not set
CONFIG_RUNTIME_TESTING_MENU=y
# CONFIG_LKDTM is not set
# CONFIG_TEST_LIST_SORT is not set
# CONFIG_TEST_MIN_HEAP is not set
# CONFIG_TEST_SORT is not set
# CONFIG_TEST_DIV64 is not set
# CONFIG_KPROBES_SANITY_TEST is not set
# CONFIG_BACKTRACE_SELF_TEST is not set
# CONFIG_TEST_REF_TRACKER is not set
# CONFIG_RBTREE_TEST is not set
# CONFIG_REED_SOLOMON_TEST is not set
# CONFIG_INTERVAL_TREE_TEST is not set
# CONFIG_PERCPU_TEST is not set
# CONFIG_ATOMIC64_SELFTEST is not set
# CONFIG_ASYNC_RAID6_TEST is not set
# CONFIG_TEST_HEXDUMP is not set
# CONFIG_STRING_SELFTEST is not set
# CONFIG_TEST_STRING_HELPERS is not set
# CONFIG_TEST_STRSCPY is not set
# CONFIG_TEST_KSTRTOX is not set
# CONFIG_TEST_PRINTF is not set
# CONFIG_TEST_SCANF is not set
# CONFIG_TEST_BITMAP is not set
# CONFIG_TEST_UUID is not set
# CONFIG_TEST_XARRAY is not set
# CONFIG_TEST_RHASHTABLE is not set
# CONFIG_TEST_SIPHASH is not set
# CONFIG_TEST_IDA is not set
# CONFIG_TEST_LKM is not set
# CONFIG_TEST_BITOPS is not set
# CONFIG_TEST_VMALLOC is not set
# CONFIG_TEST_USER_COPY is not set
# CONFIG_TEST_BPF is not set
# CONFIG_TEST_BLACKHOLE_DEV is not set
# CONFIG_FIND_BIT_BENCHMARK is not set
# CONFIG_TEST_FIRMWARE is not set
# CONFIG_TEST_SYSCTL is not set
# CONFIG_BITFIELD_KUNIT is not set
# CONFIG_HASH_KUNIT_TEST is not set
# CONFIG_RESOURCE_KUNIT_TEST is not set
# CONFIG_SYSCTL_KUNIT_TEST is not set
# CONFIG_LIST_KUNIT_TEST is not set
# CONFIG_LINEAR_RANGES_TEST is not set
# CONFIG_CMDLINE_KUNIT_TEST is not set
# CONFIG_BITS_TEST is not set
# CONFIG_SLUB_KUNIT_TEST is not set
# CONFIG_RATIONAL_KUNIT_TEST is not set
# CONFIG_MEMCPY_KUNIT_TEST is not set
# CONFIG_OVERFLOW_KUNIT_TEST is not set
# CONFIG_STACKINIT_KUNIT_TEST is not set
# CONFIG_TEST_UDELAY is not set
# CONFIG_TEST_STATIC_KEYS is not set
# CONFIG_TEST_KMOD is not set
# CONFIG_TEST_DEBUG_VIRTUAL is not set
# CONFIG_TEST_MEMCAT_P is not set
CONFIG_TEST_LIVEPATCH=m
# CONFIG_TEST_MEMINIT is not set
# CONFIG_TEST_FREE_PAGES is not set
# CONFIG_TEST_FPU is not set
# CONFIG_TEST_CLOCKSOURCE_WATCHDOG is not set
CONFIG_ARCH_USE_MEMTEST=y
# CONFIG_MEMTEST is not set
# end of Kernel Testing and Coverage
# end of Kernel hacking
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 01/20] rv: Add Runtime Verification (RV) interface
2022-06-16 8:44 ` [PATCH V4 01/20] rv: Add " Daniel Bristot de Oliveira
2022-06-23 17:21 ` Punit Agrawal
@ 2022-06-23 20:26 ` Steven Rostedt
2022-07-04 19:49 ` Daniel Bristot de Oliveira
2022-07-06 17:49 ` Tao Zhou
2 siblings, 1 reply; 82+ messages in thread
From: Steven Rostedt @ 2022-06-23 20:26 UTC (permalink / raw)
To: Daniel Bristot de Oliveira
Cc: Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet, Ingo Molnar,
Thomas Gleixner, Peter Zijlstra, Will Deacon, Catalin Marinas,
Marco Elver, Dmitry Vyukov, Paul E. McKenney, Shuah Khan,
Gabriele Paoloni, Juri Lelli, Clark Williams, linux-doc,
linux-kernel, linux-trace-devel
On Thu, 16 Jun 2022 10:44:43 +0200
Daniel Bristot de Oliveira <bristot@kernel.org> wrote:
>
> It presents these files:
>
> "available_monitors"
> - List the available monitors, one per line.
>
> For example:
> [root@f32 rv]# cat available_monitors
> wip
> wwnr
>
> "enabled_monitors"
> - Lists the enabled monitors, one per line;
> - Writing to it enables a given monitor;
> - Writing a monitor name with a '-' prefix disables it;
You forgot to update this. You want '!' not '-'.
> - Truncating the file disables all enabled monitors.
>
> For example:
> [root@f32 rv]# cat enabled_monitors
> [root@f32 rv]# echo wip > enabled_monitors
> [root@f32 rv]# echo wwnr >> enabled_monitors
> [root@f32 rv]# cat enabled_monitors
> wip
> wwnr
> [root@f32 rv]# echo !wip >> enabled_monitors
You need to add quotes around the ! because that's a bash special
character.
echo '!wip' >> enabled_monitors
> [root@f32 rv]# cat enabled_monitors
> wwnr
> [root@f32 rv]# echo > enabled_monitors
> [root@f32 rv]# cat enabled_monitors
> [root@f32 rv]#
>
> Note that more than one monitor can be enabled concurrently.
>
> "monitoring_on"
> - It is an on/off general switcher for monitoring. Note
> that it does not disable enabled monitors, but stop the per-entity
> monitors of monitoring the events received from the system.
> It resambles the "tracing_on" switcher.
You mean that the tracepoints are still attached, but the process of
monitoring isn't doing anything?
>
> "monitors/"
> Each monitor will have its one directory inside "monitors/". There
> the monitor specific files will be presented.
> The "monitors/" directory resambles the "events" directory on
> tracefs.
>
> For example:
> [root@f32 rv]# cd monitors/wip/
> [root@f32 wip]# ls
> desc enable
> [root@f32 wip]# cat desc
> auto-generated wakeup in preemptive monitor.
> [root@f32 wip]# cat enable
> 0
>
> For further information, see the comments in the header of
> kernel/trace/rv/rv.c from this patch.
>
> Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
> Cc: Guenter Roeck <linux@roeck-us.net>
> Cc: Jonathan Corbet <corbet@lwn.net>
> Cc: Steven Rostedt <rostedt@goodmis.org>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Peter Zijlstra <peterz@infradead.org>
> Cc: Will Deacon <will@kernel.org>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: Marco Elver <elver@google.com>
> Cc: Dmitry Vyukov <dvyukov@google.com>
> Cc: "Paul E. McKenney" <paulmck@kernel.org>
> Cc: Shuah Khan <skhan@linuxfoundation.org>
> Cc: Gabriele Paoloni <gpaoloni@redhat.com>
> Cc: Juri Lelli <juri.lelli@redhat.com>
> Cc: Clark Williams <williams@redhat.com>
> Cc: linux-doc@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> Cc: linux-trace-devel@vger.kernel.org
> Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
> ---
> include/linux/rv.h | 23 ++
> include/linux/sched.h | 11 +
> include/rv/rv.h | 23 ++
> kernel/fork.c | 14 +
> kernel/trace/Kconfig | 2 +
> kernel/trace/Makefile | 2 +
> kernel/trace/rv/Kconfig | 12 +
> kernel/trace/rv/Makefile | 3 +
> kernel/trace/rv/rv.c | 738 +++++++++++++++++++++++++++++++++++++++
> kernel/trace/rv/rv.h | 34 ++
> kernel/trace/trace.c | 4 +
> kernel/trace/trace.h | 2 +
> 12 files changed, 868 insertions(+)
> create mode 100644 include/linux/rv.h
> create mode 100644 include/rv/rv.h
> create mode 100644 kernel/trace/rv/Kconfig
> create mode 100644 kernel/trace/rv/Makefile
> create mode 100644 kernel/trace/rv/rv.c
> create mode 100644 kernel/trace/rv/rv.h
>
> diff --git a/include/linux/rv.h b/include/linux/rv.h
> new file mode 100644
> index 000000000000..205e65f57637
> --- /dev/null
> +++ b/include/linux/rv.h
> @@ -0,0 +1,23 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +/*
> + * Runtime Verification.
> + *
> + * For futher information, see: kernel/trace/rv/rv.c.
> + *
> + * Copyright (C) 2019-2022 Daniel Bristot de Oliveira <bristot@kernel.org>
> + */
> +#ifndef _LINUX_RV_H
> +#define _LINUX_RV_H
Add a space here.
> +struct rv_monitor {
> + const char *name;
> + const char *description;
> + bool enabled;
> + int (*start)(void);
> + void (*stop)(void);
> + void (*reset)(void);
> +};
> +
> +extern bool monitoring_on;
> +int rv_unregister_monitor(struct rv_monitor *monitor);
> +int rv_register_monitor(struct rv_monitor *monitor);
> +#endif /* _LINUX_RV_H */
> diff --git a/include/linux/sched.h b/include/linux/sched.h
> index c46f3a63b758..b037f364efdc 100644
> --- a/include/linux/sched.h
> +++ b/include/linux/sched.h
> @@ -35,6 +35,7 @@
> #include <linux/seqlock.h>
> #include <linux/kcsan.h>
> #include <asm/kmap_size.h>
> +#include <rv/rv.h>
>
> /* task_struct member predeclarations (sorted alphabetically): */
> struct audit_context;
> @@ -1500,6 +1501,16 @@ struct task_struct {
> struct callback_head l1d_flush_kill;
> #endif
>
> +#ifdef CONFIG_RV
> + /*
> + * Per-task RV monitor. Nowadays fixed in RV_PER_TASK_MONITORS.
> + * If we find justification for more monitors, we can think
> + * about adding more or developing a dynamic method. So far,
> + * none of these are justified.
> + */
> + union rv_task_monitor rv[RV_PER_TASK_MONITORS];
> +#endif
> +
> /*
> * New fields for task_struct should be added above here, so that
> * they are included in the randomized portion of task_struct.
> diff --git a/include/rv/rv.h b/include/rv/rv.h
> new file mode 100644
> index 000000000000..27a108881d35
> --- /dev/null
> +++ b/include/rv/rv.h
> @@ -0,0 +1,23 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +
> +#ifndef _RV_RV_H
> +#define _RV_RV_H
> +
> +/*
> + * Per-task RV monitors count. Nowadays fixed in RV_PER_TASK_MONITORS.
> + * If we find justification for more monitors, we can think about
> + * adding more or developing a dynamic method. So far, none of
> + * these are justified.
> + */
> +#define RV_PER_TASK_MONITORS 1
> +#define RV_PER_TASK_MONITOR_INIT (RV_PER_TASK_MONITORS)
> +
> +/*
> + * Futher monitor types are expected, so make this a union.
> + */
> +union rv_task_monitor {
> +};
> +
> +int get_task_monitor_slot(void);
> +void put_task_monitor_slot(int slot);
> +#endif /* _RV_RV_H */
> diff --git a/kernel/fork.c b/kernel/fork.c
> index 9d44f2d46c69..5e40e58ef83d 100644
> --- a/kernel/fork.c
> +++ b/kernel/fork.c
> @@ -1964,6 +1964,18 @@ static void copy_oom_score_adj(u64 clone_flags, struct task_struct *tsk)
> mutex_unlock(&oom_adj_mutex);
> }
>
> +#ifdef CONFIG_RV
> +static void rv_task_fork(struct task_struct *p)
> +{
> + int i;
> +
> + for (i = 0; i < RV_PER_TASK_MONITORS; i++)
> + ;
> +}
Please move this to the next patch. It's useless for the review process
to see a loop that does nothing.
> +#else
> +#define rv_task_fork(p) do {} while (0)
> +#endif
> +
> /*
> * This creates a new process as a copy of the old one,
> * but does not actually start it yet.
> @@ -2399,6 +2411,8 @@ static __latent_entropy struct task_struct *copy_process(
> */
> copy_seccomp(p);
>
> + rv_task_fork(p);
> +
> rseq_fork(p, clone_flags);
>
> /* Don't start children in a dying pid namespace */
> diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
> index debbbb083286..b415690748bf 100644
> --- a/kernel/trace/Kconfig
> +++ b/kernel/trace/Kconfig
> @@ -1105,4 +1105,6 @@ config HIST_TRIGGERS_DEBUG
>
> If unsure, say N.
>
> +source "kernel/trace/rv/Kconfig"
> +
> endif # FTRACE
> diff --git a/kernel/trace/Makefile b/kernel/trace/Makefile
> index 0d261774d6f3..b2670fff6e94 100644
> --- a/kernel/trace/Makefile
> +++ b/kernel/trace/Makefile
> @@ -108,3 +108,5 @@ obj-$(CONFIG_RETHOOK) += rethook.o
> obj-$(CONFIG_TRACEPOINT_BENCHMARK) += trace_benchmark.o
>
> libftrace-y := ftrace.o
> +
> +obj-$(CONFIG_RV) += rv/
Please move this before the libftrace-y line. The libftrace-y is best
at the end of the file.
---
obj-$(CONFIG_RV) += rv/
libftrace-y := ftrace.o
---
> diff --git a/kernel/trace/rv/Kconfig b/kernel/trace/rv/Kconfig
> new file mode 100644
> index 000000000000..6d127cdb00dd
> --- /dev/null
> +++ b/kernel/trace/rv/Kconfig
> @@ -0,0 +1,12 @@
> +# SPDX-License-Identifier: GPL-2.0-only
> +#
> +menuconfig RV
> + bool "Runtime Verification"
> + depends on TRACING
> + help
> + Enable the kernel runtime verification infrastructure. RV is a
> + lightweight (yet rigorous) method that complements classical
> + exhaustive verification techniques (such as model checking and
> + theorem proving). RV works by analyzing the trace of the system's
> + actual execution, comparing it against a formal specification of
> + the system behavior.
> diff --git a/kernel/trace/rv/Makefile b/kernel/trace/rv/Makefile
> new file mode 100644
> index 000000000000..fd995379df67
> --- /dev/null
> +++ b/kernel/trace/rv/Makefile
> @@ -0,0 +1,3 @@
> +# SPDX-License-Identifier: GPL-2.0
> +
> +obj-$(CONFIG_RV) += rv.o
> diff --git a/kernel/trace/rv/rv.c b/kernel/trace/rv/rv.c
> new file mode 100644
> index 000000000000..43af7b13187e
> --- /dev/null
> +++ b/kernel/trace/rv/rv.c
> @@ -0,0 +1,738 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/*
> + * This is the online Runtime Verification (RV) interface.
> + *
> + * RV is a lightweight (yet rigorous) method that complements classical
> + * exhaustive verification techniques (such as model checking and
> + * theorem proving) with a more practical approach to complex systems.
> + *
> + * RV works by analyzing the trace of the system's actual execution,
> + * comparing it against a formal specification of the system behavior.
> + * RV can give precise information on the runtime behavior of the
> + * monitored system while enabling the reaction for unexpected
> + * events, avoiding, for example, the propagation of a failure on
> + * safety-critical systems.
> + *
> + * The development of this interface roots in the development of the
> + * paper:
> + *
> + * DE OLIVEIRA, Daniel Bristot; CUCINOTTA, Tommaso; DE OLIVEIRA, Romulo
> + * Silva. Efficient formal verification for the Linux kernel. In:
> + * International Conference on Software Engineering and Formal Methods.
> + * Springer, Cham, 2019. p. 315-332.
> + *
> + * And:
> + *
> + * DE OLIVEIRA, Daniel Bristot, et al. Automata-based formal analysis
> + * and verification of the real-time Linux kernel. PhD Thesis, 2020.
> + *
> + * == Runtime monitor interface ==
> + *
> + * A monitor is the central part of the runtime verification of a system.
> + *
> + * The monitor stands in between the formal specification of the desired
> + * (or undesired) behavior, and the trace of the actual system.
> + *
> + * In Linux terms, the runtime verification monitors are encapsulated
> + * inside the "RV monitor" abstraction. A RV monitor includes a reference
> + * model of the system, a set of instances of the monitor (per-cpu monitor,
> + * per-task monitor, and so on), and the helper functions that glue the
> + * monitor to the system via trace. Generally, a monitor includes some form
> + * of trace output as a reaction for event parsing and exceptions,
> + * as depicted bellow:
> + *
> + * Linux +----- RV Monitor ----------------------------------+ Formal
> + * Realm | | Realm
> + * +-------------------+ +----------------+ +-----------------+
> + * | Linux kernel | | Monitor | | Reference |
> + * | Tracing | -> | Instance(s) | <- | Model |
> + * | (instrumentation) | | (verification) | | (specification) |
> + * +-------------------+ +----------------+ +-----------------+
> + * | | |
> + * | V |
> + * | +----------+ |
> + * | | Reaction | |
> + * | +--+--+--+-+ |
> + * | | | | |
> + * | | | +-> trace output ? |
> + * +------------------------|--|----------------------+
> + * | +----> panic ?
> + * +-------> <user-specified>
> + *
> + * This file implements the interface for loading RV monitors, and
> + * to control the verification session.
> + *
> + * == Registering monitors ==
> + *
> + * The struct rv_monitor defines a set of callback functions to control
> + * a verification session. For instance, when a given monitor is enabled,
> + * the "start" callback function is called to hook the instrumentation
> + * functions to the kernel trace events. The "stop" function is called
> + * when disabling the verification session.
> + *
> + * A RV monitor is registered via:
> + * int rv_register_monitor(struct rv_monitor *monitor);
> + * And unregistered via:
> + * int rv_unregister_monitor(struct rv_monitor *monitor);
> + *
> + * These functions are exported to modules, enabling verification monitors
> + * to be dynamically loaded.
> + *
> + * == User interface ==
> + *
> + * The user interface resembles kernel tracing interface. It presents
> + * these files:
> + *
> + * "available_monitors"
> + * - List the available monitors, one per line.
> + *
> + * For example:
> + * [root@f32 rv]# cat available_monitors
> + * wip
> + * wwnr
> + *
> + * "enabled_monitors"
> + * - Lists the enabled monitors, one per line;
> + * - Writing to it enables a given monitor;
> + * - Writing a monitor name with a '-' prefix disables it;
Need to update here too.
> + * - Truncating the file disables all enabled monitors.
> + *
> + * For example:
> + * [root@f32 rv]# cat enabled_monitors
> + * [root@f32 rv]# echo wip > enabled_monitors
> + * [root@f32 rv]# echo wwnr >> enabled_monitors
> + * [root@f32 rv]# cat enabled_monitors
> + * wip
> + * wwnr
> + * [root@f32 rv]# echo !wip >> enabled_monitors
> + * [root@f32 rv]# cat enabled_monitors
> + * wwnr
> + * [root@f32 rv]# echo > enabled_monitors
> + * [root@f32 rv]# cat enabled_monitors
> + * [root@f32 rv]#
> + *
> + * Note that more than one monitor can be enabled concurrently.
> + *
> + * "monitoring_on"
> + * - It is an on/off general switcher for monitoring. Note
> + * that it does not disable enabled monitors, but stop the per-entity
> + * monitors of monitoring the events received from the system.
> + * It resambles the "tracing_on" switcher.
> + *
> + * "monitors/"
> + * Each monitor will have its one directory inside "monitors/". There
> + * the monitor specific files will be presented.
> + * The "monitors/" directory resambles the "events" directory on
> + * tracefs.
> + *
> + * For example:
> + * [root@f32 rv]# cd monitors/wip/
> + * [root@f32 wip]# ls
> + * desc enable
> + * [root@f32 wip]# cat desc
> + * auto-generated wakeup in preemptive monitor.
> + * [root@f32 wip]# cat enable
> + * 0
> + *
> + * Copyright (C) 2019-2022 Daniel Bristot de Oliveira <bristot@kernel.org>
Copyright should be at the beginning of the comment.
> + */
> +
> +#include <linux/kernel.h>
> +#include <linux/module.h>
> +#include <linux/init.h>
> +#include <linux/slab.h>
> +#include <rv/rv.h>
> +
> +#include "rv.h"
> +
> +DEFINE_MUTEX(rv_interface_lock);
> +struct rv_interface rv_root;
> +
> +struct dentry *get_monitors_root(void)
> +{
> + return rv_root.monitors_dir;
> +}
> +
> +/*
> + * Monitoring on global switcher!
> + */
> +bool __read_mostly monitoring_on;
> +
> +/*
> + * Interface for the monitor register.
> + */
> +LIST_HEAD(rv_monitors_list);
> +
> +static int task_monitor_count;
> +static bool task_monitor_slots[RV_PER_TASK_MONITORS];
> +
> +int get_task_monitor_slot(void)
> +{
> + int i;
> +
> + lockdep_assert_held(&rv_interface_lock);
> +
> + if (task_monitor_count == RV_PER_TASK_MONITORS)
> + return -EBUSY;
> +
> + task_monitor_count++;
> +
> + for (i = 0; i < RV_PER_TASK_MONITORS; i++) {
> + if (task_monitor_slots[i] == false) {
> + task_monitor_slots[i] = true;
> + return i;
> + }
> + }
> +
> + WARN_ONCE(1, "RV task_monitor_cout and slots are out of sync\n");
> +
> + return -EINVAL;
> +}
> +
> +void put_task_monitor_slot(int slot)
> +{
> + lockdep_assert_held(&rv_interface_lock);
> +
> + if (slot < 0 || slot > RV_PER_TASK_MONITORS) {
> + WARN_ONCE(1, "RV releasing an invlid slot!: %d\n", slot);
> + return;
> + }
> +
> + WARN_ONCE(!task_monitor_slots[slot], "RV releasing unsused task_monitor_slots: %d\n",
> + slot);
> +
> + task_monitor_count--;
> + task_monitor_slots[slot] = false;
> +}
> +
> +/*
> + * This section collects the monitor/ files and folders.
> + */
> +static ssize_t monitor_enable_read_data(struct file *filp,
> + char __user *user_buf,
> + size_t count, loff_t *ppos)
> +{
> + struct rv_monitor_def *mdef = filp->private_data;
> + char buff[4];
> +
> + memset(buff, 0, sizeof(buff));
> +
> + mutex_lock(&rv_interface_lock);
> + sprintf(buff, "%x\n", mdef->monitor->enabled);
Just make this:
const char *buff;
buff = mdef->monitor->enabled ? "1\n" : "0\n";
> + mutex_unlock(&rv_interface_lock);
> +
> + return simple_read_from_buffer(user_buf, count, ppos,
> + buff, strlen(buff)+1);
> +}
> +
> +/*
> + * Disable a given runtime monitor.
> + */
> +static int disable_monitor(struct rv_monitor_def *mdef)
> +{
> + if (mdef->monitor->enabled) {
> + mdef->monitor->enabled = 0;
> + mdef->monitor->stop();
> + }
> +
> + mdef->enabled = 0;
What's the difference between mdef->enabled and mdef->monitor->enabled?
> + return 0;
> +}
> +
> +/*
> + * Enable a given monitor.
> + */
> +static int enable_monitor(struct rv_monitor_def *mdef)
> +{
> + int retval;
> +
> + /*
> + * Reset all internal monitors before starting.
> + */
> + mdef->monitor->reset();
> + if (!mdef->monitor->enabled) {
> + retval = mdef->monitor->start();
> + if (retval)
> + return retval;
> + }
> +
> + mdef->monitor->enabled = 1;
> + mdef->enabled = 1;
> +
> + return 0;
> +}
> +
> +/*
> + * interface for enabling/disabling a monitor.
> + */
> +static ssize_t monitor_enable_write_data(struct file *filp,
> + const char __user *user_buf,
> + size_t count, loff_t *ppos)
> +{
> + struct rv_monitor_def *mdef = filp->private_data;
> + int retval;
> + u64 val;
> +
> + retval = kstrtoull_from_user(user_buf, count, 10, &val);
> + if (retval)
> + return retval;
> +
> + retval = count;
> +
> + mutex_lock(&rv_interface_lock);
> +
> + switch (val) {
> + case 0:
> + retval = disable_monitor(mdef);
> + break;
> + case 1:
> + retval = enable_monitor(mdef);
> + break;
> + default:
> + retval = -EINVAL;
> + }
> +
> + mutex_unlock(&rv_interface_lock);
> +
> + return retval;
> +}
> +
> +static const struct file_operations interface_enable_fops = {
> + .open = simple_open,
> + .llseek = no_llseek,
> + .write = monitor_enable_write_data,
> + .read = monitor_enable_read_data,
> +};
> +
> +/*
> + * Interface to read the enable/disable status of a monitor.
> + */
> +static ssize_t
> +monitor_desc_read_data(struct file *filp, char __user *user_buf,
> + size_t count, loff_t *ppos)
> +{
> + struct rv_monitor_def *mdef = filp->private_data;
> + char buf[MAX_RV_MONITOR_NAME_SIZE];
I think you want to add +2 here. "\n\0"
> +
> + memset(buf, 0, sizeof(buf));
> +
> + mutex_lock(&rv_interface_lock);
> + sprintf(buf, "%s\n", mdef->monitor->description);
Use snprintf().
> + mutex_unlock(&rv_interface_lock);
> +
> + return simple_read_from_buffer(user_buf, count, ppos,
> + buf, strlen(buf)+1);
> +}
> +
> +static const struct file_operations interface_desc_fops = {
> + .open = simple_open,
> + .llseek = no_llseek,
> + .read = monitor_desc_read_data,
> +};
> +
> +/*
> + * During the registration of a monitor, this function creates
> + * the monitor dir, where the specific options of the monitor
> + * is exposed.
> + */
> +static int create_monitor_dir(struct rv_monitor_def *mdef)
> +{
> + struct dentry *root = get_monitors_root();
> + struct dentry *tmp;
> + const char *name = mdef->monitor->name;
> + int retval = 0;
> +
> + mdef->root_d = rv_create_dir(name, root);
> +
> + if (!mdef->root_d)
> + return -ENOMEM;
> +
> + tmp = rv_create_file("enable", 0600,
I'd recommend make the modes (0600) into macros. I recently changed
these for tracing, and having them hard coded was a pain.
#define RV_FILE_READ 0600
> + mdef->root_d, mdef,
> + &interface_enable_fops);
> + if (!tmp) {
> + retval = -ENOMEM;
> + goto out_remove_root;
> + }
> +
> + tmp = rv_create_file("desc", 0400,
Same here, and in all other cases.
> + mdef->root_d, mdef,
> + &interface_desc_fops);
> + if (!tmp) {
> + retval = -ENOMEM;
> + goto out_remove_root;
> + }
> +
> + return retval;
> +
> +out_remove_root:
> + rv_remove(mdef->root_d);
> + return retval;
> +}
> +
> +/*
> + * Available/Enable monitor shared seq functions.
> + */
> +static int monitors_show(struct seq_file *m, void *p)
> +{
> + struct rv_monitor_def *mon_def = p;
> +
> + seq_printf(m, "%s\n", mon_def->monitor->name);
> + return 0;
> +}
> +
> +/*
> + * Used by the seq file operations at the end of a read
> + * operation.
> + */
> +static void monitors_stop(struct seq_file *m, void *p)
> +{
> + mutex_unlock(&rv_interface_lock);
> +}
> +
> +/*
> + * Available monitor seq functions:
> + */
> +static void *available_monitors_start(struct seq_file *m, loff_t *pos)
> +{
> + mutex_lock(&rv_interface_lock);
> + return seq_list_start(&rv_monitors_list, *pos);
> +}
> +
> +static void *available_monitors_next(struct seq_file *m, void *p, loff_t *pos)
> +{
> + return seq_list_next(p, &rv_monitors_list, pos);
> +}
> +
> +/*
> + * Enable monitor seq functions:
> + */
> +
> +static void *enabled_monitors_next(struct seq_file *m, void *p, loff_t *pos)
> +{
> + struct rv_monitor_def *m_def = p;
> +
> + (*pos)++;
> +
> + list_for_each_entry_continue(m_def, &rv_monitors_list, list) {
> + if (m_def->monitor->enabled)
> + return m_def;
> + }
> +
> + return NULL;
> +}
> +
> +static void *enabled_monitors_start(struct seq_file *m, loff_t *pos)
> +{
> + struct rv_monitor_def *m_def;
> + loff_t l;
> +
> + mutex_lock(&rv_interface_lock);
> + m_def = list_entry(&rv_monitors_list, struct rv_monitor_def, list);
> +
> + for (l = 0; l <= *pos; ) {
> + m_def = enabled_monitors_next(m, m_def, &l);
> + if (!m_def)
> + break;
> + }
> +
> + return m_def;
> +}
> +
> +/*
> + * available/enabled monitors seq definition.
> + */
> +static const struct seq_operations available_monitors_seq_ops = {
> + .start = available_monitors_start,
> + .next = available_monitors_next,
> + .stop = monitors_stop,
> + .show = monitors_show
> +};
> +
> +static const struct seq_operations enabled_monitors_seq_ops = {
> + .start = enabled_monitors_start,
> + .next = enabled_monitors_next,
> + .stop = monitors_stop,
> + .show = monitors_show
> +};
> +
> +/*
> + * available_monitors interface.
> + */
> +static int available_monitors_open(struct inode *inode, struct file *file)
> +{
> + return seq_open(file, &available_monitors_seq_ops);
> +};
> +
> +static const struct file_operations available_monitors_ops = {
> + .open = available_monitors_open,
> + .read = seq_read,
> + .llseek = seq_lseek,
> + .release = seq_release
> +};
> +
> +/*
> + * enabled_monitors interface
> + */
> +static void disable_all_monitors(void)
> +{
> + struct rv_monitor_def *mdef;
> +
> + list_for_each_entry(mdef, &rv_monitors_list, list)
> + disable_monitor(mdef);
> +}
> +
> +static int enabled_monitors_open(struct inode *inode, struct file *file)
> +{
> + if ((file->f_mode & FMODE_WRITE) && (file->f_flags & O_TRUNC))
> + disable_all_monitors();
> +
> + return seq_open(file, &enabled_monitors_seq_ops);
> +};
> +
> +static ssize_t
> +enabled_monitors_write(struct file *filp, const char __user *user_buf,
> + size_t count, loff_t *ppos)
> +{
> + char buff[MAX_RV_MONITOR_NAME_SIZE+1];
> + struct rv_monitor_def *mdef;
> + int retval = -EINVAL;
> + bool enable = true;
> + char *ptr = buff;
> + int len;
> +
> + if (count < 1 || count > MAX_RV_MONITOR_NAME_SIZE+1)
> + return -EINVAL;
> +
> + memset(buff, 0, sizeof(buff));
> +
> + retval = simple_write_to_buffer(buff, sizeof(buff)-1, ppos, user_buf,
> + count);
> + if (!retval)
> + return -EFAULT;
> +
> + if (buff[0] == '!') {
> + enable = false;
> + ptr++;
> + }
> +
> + len = strlen(ptr);
> + if (!len)
> + return count;
> + /*
> + * remove \n
> + */
> + ptr[len-1] = '\0';
Are you sure there's an '\n' here?
One could just do "write(fd, "monitor", 7)"
Perhaps use strim()
> +
> + mutex_lock(&rv_interface_lock);
> +
> + retval = -EINVAL;
> +
> + list_for_each_entry(mdef, &rv_monitors_list, list) {
> + if (strcmp(ptr, mdef->monitor->name) == 0) {
BTW, you could do:
if (strcmp(ptr, mdef->monitor->name) != 0)
continue;
And then get rid of an extra indent below.
> + /*
> + * Monitor found!
> + */
> + if (enable)
> + retval = enable_monitor(mdef);
> + else
> + retval = disable_monitor(mdef);
> +
> + if (retval)
> + goto out;
Why not just break?
In fact, you could just do:
if (!retval)
retval = count;
break;
> +
> + /*
> + * Success!
> + */
> + retval = count;
> + break;
> + }
> + }
> +
> +out:
> + mutex_unlock(&rv_interface_lock);
> + return retval;
> +}
> +
> +static const struct file_operations enabled_monitors_ops = {
> + .open = enabled_monitors_open,
> + .read = seq_read,
> + .write = enabled_monitors_write,
> + .llseek = seq_lseek,
> + .release = seq_release,
> +};
> +
> +/*
> + * monitoring_on general switcher
> + */
> +static ssize_t monitoring_on_read_data(struct file *filp,
> + char __user *user_buf,
> + size_t count, loff_t *ppos)
> +{
> + char buff[4];
> +
> + memset(buff, 0, sizeof(buff));
> +
> + mutex_lock(&rv_interface_lock);
> + sprintf(buff, "%d\n", monitoring_on);
Same here with just hard coding "1\n" : "0\n"
> + mutex_unlock(&rv_interface_lock);
> +
> + return simple_read_from_buffer(user_buf, count, ppos,
> + buff, strlen(buff)+1);
> +}
> +
> +static void turn_monitoring_off(void)
> +{
> + monitoring_on = false;
> +}
> +
> +static void turn_monitoring_on(void)
> +{
> + reset_all_monitors();
> + monitoring_on = true;
> +}
> +
> +static ssize_t monitoring_on_write_data(struct file *filp,
> + const char __user *user_buf,
> + size_t count, loff_t *ppos)
> +{
> + int retval;
> + u64 val;
> +
> + retval = kstrtoull_from_user(user_buf, count, 10, &val);
> + if (retval)
> + return retval;
> +
> + retval = count;
> +
> + mutex_lock(&rv_interface_lock);
> +
> + switch (val) {
> + case 0:
> + turn_monitoring_off();
> + break;
> + case 1:
> + turn_monitoring_on();
> + break;
> + default:
> + retval = -EINVAL;
> + }
> +
> + mutex_unlock(&rv_interface_lock);
> +
> + return retval;
> +}
> +
> +static const struct file_operations monitoring_on_fops = {
> + .open = simple_open,
> + .llseek = no_llseek,
> + .write = monitoring_on_write_data,
> + .read = monitoring_on_read_data,
> +};
> +
> +/*
> + * Monitor API.
> + */
> +static void destroy_monitor_dir(struct rv_monitor_def *mdef)
> +{
> + rv_remove(mdef->root_d);
> +}
> +
> +/**
> + * rv_register_monitor - register a rv monitor.
> + * @monitor: The rv_monitor to be registered.
> + *
> + * Returns 0 if successful, error otherwise.
> + */
> +int rv_register_monitor(struct rv_monitor *monitor)
> +{
> + struct rv_monitor_def *r;
> + int retval = 0;
> +
> + if (strlen(monitor->name) >= MAX_RV_MONITOR_NAME_SIZE) {
> + pr_info("Monitor %s has a name longer than %d\n",
> + monitor->name, MAX_RV_MONITOR_NAME_SIZE);
> + return -1;
> + }
> +
> + mutex_lock(&rv_interface_lock);
> +
> + list_for_each_entry(r, &rv_monitors_list, list) {
> + if (strcmp(monitor->name, r->monitor->name) == 0) {
> + pr_info("Monitor %s is already registered\n",
> + monitor->name);
> + retval = -1;
> + goto out_unlock;
> + }
> + }
> +
> + r = kzalloc(sizeof(struct rv_monitor_def), GFP_KERNEL);
> + if (!r) {
> + retval = -ENOMEM;
> + goto out_unlock;
> + }
> +
> + r->monitor = monitor;
> +
> + create_monitor_dir(r);
Should you check for success in creating the dir?
> +
> + list_add_tail(&r->list, &rv_monitors_list);
> +
> +out_unlock:
> + mutex_unlock(&rv_interface_lock);
> + return retval;
> +}
> +
> +/**
> + * rv_unregister_monitor - unregister a rv monitor.
> + * @monitor: The rv_monitor to be unregistered.
> + *
> + * Returns 0 if successful, error otherwise.
> + */
> +int rv_unregister_monitor(struct rv_monitor *monitor)
> +{
> + struct rv_monitor_def *ptr, *next;
> +
> + mutex_lock(&rv_interface_lock);
> +
> + list_for_each_entry_safe(ptr, next, &rv_monitors_list, list) {
> + if (strcmp(monitor->name, ptr->monitor->name) == 0) {
> + list_del(&ptr->list);
> + destroy_monitor_dir(ptr);
> + }
> + }
> +
> + mutex_unlock(&rv_interface_lock);
> + return 0;
> +}
> +
> +void reset_all_monitors(void)
> +{
> + struct rv_monitor_def *mdef;
> +
> + /*
> + * Reset all monitors before re-enabling monitoring.
> + */
> + list_for_each_entry(mdef, &rv_monitors_list, list) {
> + if (mdef->monitor->enabled)
> + mdef->monitor->reset();
> + }
> +
> +}
> +
> +int __init rv_init_interface(void)
> +{
> + rv_root.root_dir = rv_create_dir("rv", NULL);
> + rv_root.monitors_dir = rv_create_dir("monitors", rv_root.root_dir);
> +
> + rv_create_file("available_monitors", 0400, rv_root.root_dir, NULL,
> + &available_monitors_ops);
> + rv_create_file("enabled_monitors", 0600, rv_root.root_dir, NULL,
> + &enabled_monitors_ops);
> + rv_create_file("monitoring_on", 0600, rv_root.root_dir, NULL,
> + &monitoring_on_fops);
> +
> + monitoring_on = true;
> +
> + return 0;
> +}
> diff --git a/kernel/trace/rv/rv.h b/kernel/trace/rv/rv.h
> new file mode 100644
> index 000000000000..0796867a7b1e
> --- /dev/null
> +++ b/kernel/trace/rv/rv.h
> @@ -0,0 +1,34 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +#include <linux/mutex.h>
> +
> +struct rv_interface {
> + struct dentry *root_dir;
> + struct dentry *monitors_dir;
> +};
> +
> +#include "../trace.h"
> +#include <linux/tracefs.h>
> +#include <linux/rv.h>
> +
> +#define rv_create_dir tracefs_create_dir
> +#define rv_create_file tracefs_create_file
> +#define rv_remove tracefs_remove
> +
> +#define MAX_RV_MONITOR_NAME_SIZE 32
> +
> +extern struct mutex rv_interface_lock;
> +
> +struct rv_monitor_def {
> + struct list_head list;
> + struct rv_monitor *monitor;
> + struct dentry *root_d;
> + bool enabled;
> + bool task_monitor;
Can you tab these to make it easier to read?
struct rv_monitor_def {
struct list_head list;
struct rv_monitor *monitor;
struct dentry *root_d;
bool enabled;
bool task_monitor;
};
-- Steve
> +};
> +
> +extern bool monitoring_on;
> +struct dentry *get_monitors_root(void);
> +void reset_all_monitors(void);
> +int init_rv_monitors(struct dentry *root_dir);
> +int get_task_monitor_slot(void);
> +void put_task_monitor_slot(int slot);
> diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
> index 2c95992e2c71..60e357c3120b 100644
> --- a/kernel/trace/trace.c
> +++ b/kernel/trace/trace.c
> @@ -9774,6 +9774,10 @@ static __init int tracer_init_tracefs(void)
> tracer_init_tracefs_work_func(NULL);
> }
>
> +#ifdef CONFIG_RV
> + rv_init_interface();
> +#endif
> +
> return 0;
> }
>
> diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
> index ff816fb41e48..becc03c0a45e 100644
> --- a/kernel/trace/trace.h
> +++ b/kernel/trace/trace.h
> @@ -2005,4 +2005,6 @@ struct trace_min_max_param {
>
> extern const struct file_operations trace_min_max_fops;
>
> +extern int rv_init_interface(void);
> +
> #endif /* _LINUX_KERNEL_TRACE_H */
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 00/20] The Runtime Verification (RV) interface
2022-06-23 17:52 ` Song Liu
@ 2022-06-23 20:29 ` Daniel Bristot de Oliveira
2022-06-23 21:10 ` Song Liu
0 siblings, 1 reply; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-06-23 20:29 UTC (permalink / raw)
To: Song Liu
Cc: Steven Rostedt, Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet,
Ingo Molnar, Thomas Gleixner, Peter Zijlstra, Will Deacon,
Catalin Marinas, Marco Elver, Dmitry Vyukov, Paul E. McKenney,
Shuah Khan, Gabriele Paoloni, Juri Lelli, Clark Williams,
Linux Doc Mailing List, open list, linux-trace-devel
On 6/23/22 12:52, Song Liu wrote:
> On Thu, Jun 23, 2022 at 9:42 AM Daniel Bristot de Oliveira
> <bristot@kernel.org> wrote:
>>
>> On 6/22/22 09:24, Song Liu wrote:
>>> This is interesting work!
>>>
>>> I applied the series on top of commit 78ca55889a549a9a194c6ec666836329b774ab6d
>>> in upstream. Then, I got some compile/link error for CONFIG_RV_MON_WIP and
>>> CONFIG_RV_MON_SAFE_WTD. I was able to compile the kernel with these two
>>> configs disabled.
>>
>> I rebased the code and... it compiled. Maybe it was missing some
>> config options that I forgot to set as "depends on" in the Kconfig.
>>
>> Can you check if it was the same problem automatically reported?
>>
>> Any further information here would help. I will revisit this.
>
> Here are the error messages I got: https://pastebin.com/zJxMA6RK , and
> attached is the config file I used.
>
>>
>> However, I hit the some issue with monitors/wwnr/enabled :
>>>
>>> [root@eth50-1 ~]# cd /sys/kernel/debug/tracing/rv/
>>> [root@eth50-1 rv]# cat available_monitors
>>> wwnr
>>> [root@eth50-1 rv]# echo wwnr > enabled_monitors
>>> [root@eth50-1 rv]# cd monitors/
>>> [root@eth50-1 monitors]# cd wwnr/
>>> [root@eth50-1 wwnr]# ls
>>> desc enable reactors
>>> [root@eth50-1 wwnr]# cat enable
>>> 1
>>> [root@eth50-1 wwnr]# echo 0 > enable <<< hangs
>>>
>>> The last echo command hangs forever on a qemu vm. I haven't figured out why
>>> this happens though.
>>
>> I could reproduce it. It is an error in the return code of monitor_enable_write_data(),
>> I fixed it locally (return retval ? retval : count; // needs more test), and
>> will add it to the next version. Thanks!
>>
>>> I also have a more general question: can we do RV with BPF and simplify the
>>> work? AFAICT, the idea of RV is to maintain a state machine based on events.
>>> If something unexpected happens, call the reactor.
>>>
>>> IIUC, BPF has most of these building blocks ready for use. With BPF, we
>>> can ship many RV monitors without much kernel changes.
>>
>> I am aware of bpftrace and bpf + libbpf, and I have a PoC tool doing most of the
>> work I do in C/kernel in C/bpf.
>>
>> From the cover letter:
>>
>> "Things kept for a second moment (after this patchset):
>> [...]
>> - dot2bpf"
>>
>> The point is that there are use-cases in which the users need the code in
>> C. One of those is the work being done in the Linux Foundation Elisa group.
>> There will be more formalism, like timed automata... which will require
>> infra-structure that is easily accessible in C... including synchronization,
>> and reactors that are available only in C on "per use-cases" basis - for
>> example on embedded devices.
>
> Where can I find more information about the constraints of these use cases?
Check the LF elisa workgroup.
> I am asking because there are multiple ways to load a BPF program to the
> system. If the constraint is that we cannot have bpftrace or bcc in the system,
> maybe it is ok to run a standalone binary (written in C, compiled on a different
> system).
as I said... *I am aware of that*. I do like BPF! I was already convinced I will having
things in BPF :-)
dot2bpf does stand alone application, C + libbpf (and I did it this way to
have the most of flexibility), it works (for the things that are possible in BPF).
It shares most of the work in C/kernel, I will add it in the second patch series.
Or maybe we can load BPF programs in a kernel module, or compile
> the BPF programs into the kernel? (Yes, we can do it now, check
> kernel/bpf/preload). If any of these works, we can benefit from the good
> properties of BPF.
RV will take all these benefits, it is in the todo list as I said in this thread.
But the in kernel version also has its facilities.
For example, we can update the RV models without
> rebooting the system; and we can reuse various BPF maps, so we don't
> need to add union rv_task_monitor to task_struct.
>
> Of course, we are out of luck if these systems cannot enable CONFIG_BPF
> at all. But I guess this is not common for modern embedded systems?
I understand your motivations, and I agree with the benefits of BPF, but I also
see benefits of having it in kernel as well.
So, RV will go with both, they are not mutually exclusive.
Thanks!
-- Daniel
> Thanks,
> Song
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 02/20] rv: Add runtime reactors interface
2022-06-16 8:44 ` [PATCH V4 02/20] rv: Add runtime reactors interface Daniel Bristot de Oliveira
@ 2022-06-23 20:40 ` Steven Rostedt
0 siblings, 0 replies; 82+ messages in thread
From: Steven Rostedt @ 2022-06-23 20:40 UTC (permalink / raw)
To: Daniel Bristot de Oliveira
Cc: Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet, Ingo Molnar,
Thomas Gleixner, Peter Zijlstra, Will Deacon, Catalin Marinas,
Marco Elver, Dmitry Vyukov, Paul E. McKenney, Shuah Khan,
Gabriele Paoloni, Juri Lelli, Clark Williams, linux-doc,
linux-kernel, linux-trace-devel
On Thu, 16 Jun 2022 10:44:44 +0200
Daniel Bristot de Oliveira <bristot@kernel.org> wrote:
> diff --git a/include/linux/rv.h b/include/linux/rv.h
> index 205e65f57637..1e48c6bb74bf 100644
> --- a/include/linux/rv.h
> +++ b/include/linux/rv.h
> @@ -8,6 +8,13 @@
> */
> #ifndef _LINUX_RV_H
> #define _LINUX_RV_H
> +
> +struct rv_reactor {
> + char *name;
> + char *description;
> + void (*react)(char *msg);
> +};
> +
> struct rv_monitor {
> const char *name;
> const char *description;
> @@ -15,9 +22,15 @@ struct rv_monitor {
> int (*start)(void);
> void (*stop)(void);
> void (*reset)(void);
> + void (*react)(char *msg);
> +
> };
>
> extern bool monitoring_on;
> int rv_unregister_monitor(struct rv_monitor *monitor);
> int rv_register_monitor(struct rv_monitor *monitor);
> +
> +extern bool reacting_on;
> +int rv_unregister_reactor(struct rv_reactor *reactor);
> +int rv_register_reactor(struct rv_reactor *reactor);
> #endif /* _LINUX_RV_H */
> diff --git a/kernel/trace/rv/Kconfig b/kernel/trace/rv/Kconfig
> index 6d127cdb00dd..560408fec0c8 100644
> --- a/kernel/trace/rv/Kconfig
> +++ b/kernel/trace/rv/Kconfig
> @@ -10,3 +10,17 @@ menuconfig RV
> theorem proving). RV works by analyzing the trace of the system's
> actual execution, comparing it against a formal specification of
> the system behavior.
> +
> +if RV
Remove the above.
> +
> +config RV_REACTORS
> + bool "Runtime verification reactors"
> + default y if RV
default y
DEPENDS ON RV
> + help
> + Enables the online runtime verification reactors. A runtime
> + monitor can cause a reaction to the detection of an exception
> + on the model's execution. By default, the monitors have
> + tracing reactions, printing the monitor output via tracepoints,
> + but other reactions can be added (on-demand) via this interface.
> +
> +endif # RV
> diff --git a/kernel/trace/rv/Makefile b/kernel/trace/rv/Makefile
> index fd995379df67..8944274d9b41 100644
> --- a/kernel/trace/rv/Makefile
> +++ b/kernel/trace/rv/Makefile
> @@ -1,3 +1,4 @@
> # SPDX-License-Identifier: GPL-2.0
>
> obj-$(CONFIG_RV) += rv.o
> +obj-$(CONFIG_RV_REACTORS) += rv_reactors.o
> diff --git a/kernel/trace/rv/rv.c b/kernel/trace/rv/rv.c
> index 43af7b13187e..7576d492a974 100644
> --- a/kernel/trace/rv/rv.c
> +++ b/kernel/trace/rv/rv.c
> @@ -362,8 +362,13 @@ static int create_monitor_dir(struct rv_monitor_def *mdef)
> retval = -ENOMEM;
> goto out_remove_root;
> }
> +#ifdef CONFIG_RV_REACTORS
Could you move the ifdefs to a header or above, and then just make
theses functions into nops when not defined. Keeps the actual code
cleaner.
> + retval = reactor_create_monitor_files(mdef);
> + if (retval)
> + goto out_remove_root;
> +#endif
>
> - return retval;
> + return 0;
>
> out_remove_root:
> rv_remove(mdef->root_d);
> @@ -674,7 +679,11 @@ int rv_register_monitor(struct rv_monitor *monitor)
>
> r->monitor = monitor;
>
> - create_monitor_dir(r);
> + retval = create_monitor_dir(r);
> + if (retval) {
> + kfree(r);
> + goto out_unlock;
> + }
>
> list_add_tail(&r->list, &rv_monitors_list);
>
> @@ -732,6 +741,11 @@ int __init rv_init_interface(void)
> rv_create_file("monitoring_on", 0600, rv_root.root_dir, NULL,
> &monitoring_on_fops);
>
> +#ifdef CONFIG_RV_REACTORS
> + init_rv_reactors(rv_root.root_dir);
> + reacting_on = true;
Same here.
Could have init_rv_reactors() return a value and then:
if (init_rv_reactors(...))
reacting_on = true;
> +#endif
> +
> monitoring_on = true;
>
> return 0;
> diff --git a/kernel/trace/rv/rv.h b/kernel/trace/rv/rv.h
> index 0796867a7b1e..6d43f52d72a9 100644
> --- a/kernel/trace/rv/rv.h
> +++ b/kernel/trace/rv/rv.h
> @@ -15,14 +15,28 @@ struct rv_interface {
> #define rv_remove tracefs_remove
>
> #define MAX_RV_MONITOR_NAME_SIZE 32
> +#define MAX_RV_REACTOR_NAME_SIZE 32
>
> extern struct mutex rv_interface_lock;
>
> +#ifdef CONFIG_RV_REACTORS
> +struct rv_reactor_def {
> + struct list_head list;
> + struct rv_reactor *reactor;
> + /* protected by the monitor interface lock */
> + int counter;
> +};
> +#endif
> +
> struct rv_monitor_def {
> struct list_head list;
> struct rv_monitor *monitor;
> +#ifdef CONFIG_RV_REACTORS
> + struct rv_reactor_def *rdef;
> +#endif
> struct dentry *root_d;
> bool enabled;
> + bool reacting;
> bool task_monitor;
> };
>
> @@ -32,3 +46,9 @@ void reset_all_monitors(void);
> int init_rv_monitors(struct dentry *root_dir);
> int get_task_monitor_slot(void);
> void put_task_monitor_slot(int slot);
> +
> +#ifdef CONFIG_RV_REACTORS
> +extern bool reacting_on;
> +int reactor_create_monitor_files(struct rv_monitor_def *mdef);
> +int init_rv_reactors(struct dentry *root_dir);
> +#endif
> diff --git a/kernel/trace/rv/rv_reactors.c b/kernel/trace/rv/rv_reactors.c
> new file mode 100644
> index 000000000000..bfe54d6996cc
> --- /dev/null
> +++ b/kernel/trace/rv/rv_reactors.c
> @@ -0,0 +1,476 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/*
> + * Runtime reactor interface.
> + *
> + * A runtime monitor can cause a reaction to the detection of an
> + * exception on the model's execution. By default, the monitors have
> + * tracing reactions, printing the monitor output via tracepoints.
> + * But other reactions can be added (on-demand) via this interface.
> + *
> + * == Registering reactors ==
> + *
> + * The struct rv_reactor defines a callback function to be executed
> + * in case of a model exception happens. The callback function
> + * receives a message to be (optionally) printed before executing
> + * the reaction.
> + *
> + * A RV reactor is registered via:
> + * int rv_register_reactor(struct rv_reactor *reactor)
> + * And unregistered via:
> + * int rv_unregister_reactor(struct rv_reactor *reactor)
> + *
> + * These functions are exported to modules, enabling reactors to be
> + * dynamically loaded.
> + *
> + * == User interface ==
> + *
> + * The user interface resembles the kernel tracing interface and
> + * presents these files:
> + *
> + * "available_reactors"
> + * - List the available reactors, one per line.
> + *
> + * For example:
> + * [root@f32 rv]# cat available_reactors
> + * nop
> + * panic
> + * printk
> + *
> + * "reacting_on"
> + * - It is an on/off general switch for reactors, disabling
> + * all reactions.
> + *
> + * "monitors/MONITOR/reactors"
> + * - List available reactors, with the select reaction for the given
> + * MONITOR inside []. The defaul one is the nop (no operation)
> + * reactor.
> + * - Writing the name of an reactor enables it to the given
> + * MONITOR.
> + *
> + * For example:
> + * [root@f32 rv]# cat monitors/wip/reactors
> + * [nop]
> + * panic
> + * printk
> + * [root@f32 rv]# echo panic > monitors/wip/reactors
> + * [root@f32 rv]# cat monitors/wip/reactors
> + * nop
> + * [panic]
> + * printk
> + *
> + * Copyright (C) 2019-2022 Daniel Bristot de Oliveira <bristot@kernel.org>
> + */
> +
> +#include <linux/slab.h>
> +
> +#include "rv.h"
> +
> +bool __read_mostly reacting_on;
> +
> +/*
> + * Interface for the reactor register.
> + */
> +LIST_HEAD(rv_reactors_list);
> +
> +static struct rv_reactor_def *get_reactor_rdef_by_name(char *name)
> +{
> + struct rv_reactor_def *r;
> +
> + list_for_each_entry(r, &rv_reactors_list, list) {
> + if (strcmp(name, r->reactor->name) == 0)
> + return r;
> + }
> + return NULL;
> +}
> +
> +/*
> + * Available reactors seq functions.
> + */
> +static int reactors_show(struct seq_file *m, void *p)
> +{
> + struct rv_reactor_def *rea_def = p;
> +
> + seq_printf(m, "%s\n", rea_def->reactor->name);
> + return 0;
> +}
> +
> +static void reactors_stop(struct seq_file *m, void *p)
> +{
> + mutex_unlock(&rv_interface_lock);
> +}
> +
> +static void *reactors_start(struct seq_file *m, loff_t *pos)
> +{
> + mutex_lock(&rv_interface_lock);
> + return seq_list_start(&rv_reactors_list, *pos);
> +}
> +
> +static void *reactors_next(struct seq_file *m, void *p, loff_t *pos)
> +{
> + return seq_list_next(p, &rv_reactors_list, pos);
> +}
> +
> +/*
> + * available reactors seq definition.
> + */
> +static const struct seq_operations available_reactors_seq_ops = {
> + .start = reactors_start,
> + .next = reactors_next,
> + .stop = reactors_stop,
> + .show = reactors_show
> +};
> +
> +/*
> + * available_reactors interface.
> + */
> +static int available_reactors_open(struct inode *inode, struct file *file)
> +{
> + return seq_open(file, &available_reactors_seq_ops);
> +};
> +
> +static const struct file_operations available_reactors_ops = {
> + .open = available_reactors_open,
> + .read = seq_read,
> + .llseek = seq_lseek,
> + .release = seq_release
> +};
> +
> +/*
> + * Monitor reactor file.
> + */
> +static int monitor_reactor_show(struct seq_file *m, void *p)
> +{
> + struct rv_monitor_def *mdef = m->private;
> + struct rv_reactor_def *rdef = p;
> +
> + if (mdef->rdef == rdef)
> + seq_printf(m, "[%s]\n", rdef->reactor->name);
> + else
> + seq_printf(m, "%s\n", rdef->reactor->name);
> + return 0;
> +}
> +
> +/*
> + * available reactors seq definition.
> + */
> +static const struct seq_operations monitor_reactors_seq_ops = {
> + .start = reactors_start,
> + .next = reactors_next,
> + .stop = reactors_stop,
> + .show = monitor_reactor_show
> +};
> +
> +static ssize_t
> +monitor_reactors_write(struct file *file, const char __user *user_buf,
> + size_t count, loff_t *ppos)
> +{
> + char buff[MAX_RV_REACTOR_NAME_SIZE+1];
> + struct rv_monitor_def *mdef;
> + struct rv_reactor_def *rdef;
> + struct seq_file *seq_f;
> + int retval = -EINVAL;
> + char *ptr = buff;
> + int len;
> +
> + if (count < 1 || count > MAX_RV_REACTOR_NAME_SIZE+1)
> + return -EINVAL;
> +
> + memset(buff, 0, sizeof(buff));
> +
> + retval = simple_write_to_buffer(buff, sizeof(buff)-1, ppos, user_buf,
> + count);
> + if (!retval)
> + return -EFAULT;
> +
> + len = strlen(ptr);
> + if (!len)
> + return count;
> + /*
> + * remove the \n
> + */
> + ptr[len-1] = '\0';
Again, use strim().
> +
> + /*
> + * See monitor_reactors_open()
> + */
> + seq_f = file->private_data;
> + mdef = seq_f->private;
> +
> + mutex_lock(&rv_interface_lock);
> +
> + retval = -EINVAL;
> +
> + /*
> + * nop special case: disable reacting.
> + */
> + if (strcmp(ptr, "nop") == 0) {
> +
> + if (mdef->monitor->enabled)
> + mdef->monitor->stop();
> +
> + mdef->rdef = get_reactor_rdef_by_name("nop");
> + mdef->reacting = false;
> + mdef->monitor->react = NULL;
> +
> + if (mdef->monitor->enabled)
> + mdef->monitor->start();
> +
> + retval = count;
> + goto unlock;
> + }
> +
> + list_for_each_entry(rdef, &rv_reactors_list, list) {
> + if (strcmp(ptr, rdef->reactor->name) == 0) {
Again,
if (strcmp(ptr, rdef->reactor->name) != 0)
continue;
Then we can remove the extra indent.
-- Steve
> + /*
> + * found!
> + */
> + if (mdef->monitor->enabled)
> + mdef->monitor->stop();
> +
> + mdef->rdef = rdef;
> + mdef->reacting = true;
> + mdef->monitor->react = rdef->reactor->react;
> +
> + if (mdef->monitor->enabled)
> + mdef->monitor->start();
> +
> + retval = count;
> + break;
> + }
> + }
> +
> +unlock:
> + mutex_unlock(&rv_interface_lock);
> +
> + return retval;
> +}
> +
> +/*
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 00/20] The Runtime Verification (RV) interface
2022-06-23 20:29 ` Daniel Bristot de Oliveira
@ 2022-06-23 21:10 ` Song Liu
0 siblings, 0 replies; 82+ messages in thread
From: Song Liu @ 2022-06-23 21:10 UTC (permalink / raw)
To: Daniel Bristot de Oliveira
Cc: Steven Rostedt, Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet,
Ingo Molnar, Thomas Gleixner, Peter Zijlstra, Will Deacon,
Catalin Marinas, Marco Elver, Dmitry Vyukov, Paul E. McKenney,
Shuah Khan, Gabriele Paoloni, Juri Lelli, Clark Williams,
Linux Doc Mailing List, open list, linux-trace-devel
On Thu, Jun 23, 2022 at 1:29 PM Daniel Bristot de Oliveira
<bristot@kernel.org> wrote:
>
[...]
> >>
> >> The point is that there are use-cases in which the users need the code in
> >> C. One of those is the work being done in the Linux Foundation Elisa group.
> >> There will be more formalism, like timed automata... which will require
> >> infra-structure that is easily accessible in C... including synchronization,
> >> and reactors that are available only in C on "per use-cases" basis - for
> >> example on embedded devices.
> >
> > Where can I find more information about the constraints of these use cases?
>
> Check the LF elisa workgroup.
Thanks for the information. It looks interesting.
>
> > I am asking because there are multiple ways to load a BPF program to the
> > system. If the constraint is that we cannot have bpftrace or bcc in the system,
> > maybe it is ok to run a standalone binary (written in C, compiled on a different
> > system).
>
> as I said... *I am aware of that*. I do like BPF! I was already convinced I will having
> things in BPF :-)
>
> dot2bpf does stand alone application, C + libbpf (and I did it this way to
> have the most of flexibility), it works (for the things that are possible in BPF).
> It shares most of the work in C/kernel, I will add it in the second patch series.
This is great! Looking forward to trying it out. :)
Thanks,
Song
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 03/20] rv/include: Add helper functions for deterministic automata
2022-06-16 8:44 ` [PATCH V4 03/20] rv/include: Add helper functions for deterministic automata Daniel Bristot de Oliveira
@ 2022-06-28 17:48 ` Steven Rostedt
2022-07-06 18:35 ` Tao Zhou
1 sibling, 0 replies; 82+ messages in thread
From: Steven Rostedt @ 2022-06-28 17:48 UTC (permalink / raw)
To: Daniel Bristot de Oliveira
Cc: Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet, Ingo Molnar,
Thomas Gleixner, Peter Zijlstra, Will Deacon, Catalin Marinas,
Marco Elver, Dmitry Vyukov, Paul E. McKenney, Shuah Khan,
Gabriele Paoloni, Juri Lelli, Clark Williams, linux-doc,
linux-kernel, linux-trace-devel
On Thu, 16 Jun 2022 10:44:45 +0200
Daniel Bristot de Oliveira <bristot@kernel.org> wrote:
> Formally, a deterministic automaton, denoted by G, is defined as a
> quintuple:
>
> G = { X, E, f, x_0, X_m }
>
> where:
> - X is the set of states;
> - E is the finite set of events;
> - x_0 is the initial state;
> - X_m (subset of X) is the set of marked states.
> - f : X x E -> X $ is the transition function. It defines the
> state transition in the occurrence of a event from E in
> the state X. In the special case of deterministic automata,
> the occurrence of the event in E in a state in X has a
> deterministic next state from X.
>
> An automaton can also be represented using a graphical format of
> vertices (nodes) and edges. The open-source tool Graphviz can produce
> this graphic format using the (textual) DOT language as the source code.
>
> The dot2c tool presented in this paper:
>
> DE OLIVEIRA, Daniel Bristot; CUCINOTTA, Tommaso; DE OLIVEIRA, Romulo
> Silva. Efficient formal verification for the Linux kernel. In:
> International Conference on Software Engineering and Formal Methods.
> Springer, Cham, 2019. p. 315-332.
>
> Translates a deterministic automaton in the DOT format into a C
> source code representation that to be used for monitoring.
>
> This header file implements helper functions to facilitate the usage
> of the C output from dot2c for monitoring.
>
> Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
> Cc: Guenter Roeck <linux@roeck-us.net>
> Cc: Jonathan Corbet <corbet@lwn.net>
> Cc: Steven Rostedt <rostedt@goodmis.org>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Peter Zijlstra <peterz@infradead.org>
> Cc: Will Deacon <will@kernel.org>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: Marco Elver <elver@google.com>
> Cc: Dmitry Vyukov <dvyukov@google.com>
> Cc: "Paul E. McKenney" <paulmck@kernel.org>
> Cc: Shuah Khan <skhan@linuxfoundation.org>
> Cc: Gabriele Paoloni <gpaoloni@redhat.com>
> Cc: Juri Lelli <juri.lelli@redhat.com>
> Cc: Clark Williams <williams@redhat.com>
> Cc: linux-doc@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> Cc: linux-trace-devel@vger.kernel.org
> Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
> ---
> include/rv/automata.h | 49 +++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 49 insertions(+)
> create mode 100644 include/rv/automata.h
>
> diff --git a/include/rv/automata.h b/include/rv/automata.h
> new file mode 100644
> index 000000000000..0c0aa54bd820
> --- /dev/null
> +++ b/include/rv/automata.h
> @@ -0,0 +1,49 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +/*
> + * Deterministic automata helper functions, to be used with the automata
> + * models in C generated by the dot2k tool.
> + *
> + * Copyright (C) 2019-2022 Daniel Bristot de Oliveira <bristot@kernel.org>
Copyright before the description.
> + */
> +
There should be comments here describing how the helper functions are used.
-- Steve
> +#define DECLARE_AUTOMATA_HELPERS(name, type) \
> + \
> +static inline void *model_get_model_##name(void) \
> +{ \
> + return (void *) &automaton_##name; \
> +} \
> + \
> +static char *model_get_state_name_##name(enum states_##name state) \
> +{ \
> + return automaton_##name.state_names[state]; \
> +} \
> + \
> +static char *model_get_event_name_##name(enum events_##name event) \
> +{ \
> + return automaton_##name.event_names[event]; \
> +} \
> + \
> +static inline type model_get_init_state_##name(void) \
> +{ \
> + return automaton_##name.initial_state; \
> +} \
> + \
> +static inline type model_get_next_state_##name(enum states_##name curr_state, \
> + enum events_##name event) \
> +{ \
> + if ((curr_state < 0) || (curr_state > state_max_##name)) \
> + return -1; \
> + \
> + if ((event < 0) || (event > event_max_##name)) \
> + return -1; \
> + \
> + return automaton_##name.function[curr_state][event]; \
> +} \
> + \
> +static inline bool model_is_final_state_##name(enum states_##name state) \
> +{ \
> + if ((state < 0) || (state > state_max_##name)) \
> + return 0; \
> + \
> + return !!automaton_##name.final_states[state]; \
> +}
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 06/20] tools/rv: Add dot2c
2022-06-16 8:44 ` [PATCH V4 06/20] tools/rv: Add dot2c Daniel Bristot de Oliveira
@ 2022-06-28 18:10 ` Steven Rostedt
2022-06-28 18:16 ` Steven Rostedt
1 sibling, 0 replies; 82+ messages in thread
From: Steven Rostedt @ 2022-06-28 18:10 UTC (permalink / raw)
To: Daniel Bristot de Oliveira
Cc: Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet, Ingo Molnar,
Thomas Gleixner, Peter Zijlstra, Will Deacon, Catalin Marinas,
Marco Elver, Dmitry Vyukov, Paul E. McKenney, Shuah Khan,
Gabriele Paoloni, Juri Lelli, Clark Williams, linux-doc,
linux-kernel, linux-trace-devel
On Thu, 16 Jun 2022 10:44:48 +0200
Daniel Bristot de Oliveira <bristot@kernel.org> wrote:
> + def __create_matrix(self):
> + # transform the array into a dictionary
> + events = self.events
> + states = self.states
> + events_dict = {}
> + states_dict = {}
> + nr_event = 0
> + for event in events:
> + events_dict[event] = nr_event
> + nr_event += 1
> +
> + nr_state = 0
> + for state in states:
> + states_dict[state] = nr_state
> + nr_state = nr_state + 1
> +
Hmm, do you just like inconsistency?
nr_event += 1
nr_state = nr_state + 1
??
-- Steve
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 06/20] tools/rv: Add dot2c
2022-06-16 8:44 ` [PATCH V4 06/20] tools/rv: Add dot2c Daniel Bristot de Oliveira
2022-06-28 18:10 ` Steven Rostedt
@ 2022-06-28 18:16 ` Steven Rostedt
2022-07-13 18:41 ` Daniel Bristot de Oliveira
1 sibling, 1 reply; 82+ messages in thread
From: Steven Rostedt @ 2022-06-28 18:16 UTC (permalink / raw)
To: Daniel Bristot de Oliveira
Cc: Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet, Ingo Molnar,
Thomas Gleixner, Peter Zijlstra, Will Deacon, Catalin Marinas,
Marco Elver, Dmitry Vyukov, Paul E. McKenney, Shuah Khan,
Gabriele Paoloni, Juri Lelli, Clark Williams, linux-doc,
linux-kernel, linux-trace-devel
On Thu, 16 Jun 2022 10:44:48 +0200
Daniel Bristot de Oliveira <bristot@kernel.org> wrote:
> + def get_minimun_type(self):
> + min_type="char"
> +
> + if self.states.__len__() > 255:
> + min_type="short"
> +
> + if self.states.__len__() > 65535:
> + min_type="int"
Should these be "unsigned"? As char goes from -128 <-> 127
and short goes from -32768 <-> 32767
And are you sure you're not going to have more than 2,147,483,647 states ;-)
(or 4,294,967,296 if it's unsigned).
-- Steve
> +
> + return min_type
> +
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 08/20] rv/monitor: Add the wip monitor skeleton created by dot2k
2022-06-16 8:44 ` [PATCH V4 08/20] rv/monitor: Add the wip monitor skeleton created by dot2k Daniel Bristot de Oliveira
@ 2022-06-28 19:02 ` Steven Rostedt
0 siblings, 0 replies; 82+ messages in thread
From: Steven Rostedt @ 2022-06-28 19:02 UTC (permalink / raw)
To: Daniel Bristot de Oliveira
Cc: Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet, Ingo Molnar,
Thomas Gleixner, Peter Zijlstra, Will Deacon, Catalin Marinas,
Marco Elver, Dmitry Vyukov, Paul E. McKenney, Shuah Khan,
Gabriele Paoloni, Juri Lelli, Clark Williams, linux-doc,
linux-kernel, linux-trace-devel
On Thu, 16 Jun 2022 10:44:50 +0200
Daniel Bristot de Oliveira <bristot@kernel.org> wrote:
> This is the direct output this command line:
> $ dot2k -d ~/wip.dot -t per_cpu
>
> with wip.dot as:
So you created the "Work In Progress" monitor?
Is that what wip stands for?
-- Steve
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 09/20] rv/monitor: wip instrumentation and Makefile/Kconfig entries
2022-06-16 21:00 ` Randy Dunlap
2022-06-17 16:07 ` Daniel Bristot de Oliveira
@ 2022-06-28 19:02 ` Steven Rostedt
1 sibling, 0 replies; 82+ messages in thread
From: Steven Rostedt @ 2022-06-28 19:02 UTC (permalink / raw)
To: Randy Dunlap
Cc: Daniel Bristot de Oliveira, Wim Van Sebroeck, Guenter Roeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel
On Thu, 16 Jun 2022 14:00:10 -0700
Randy Dunlap <rdunlap@infradead.org> wrote:
> On 6/16/22 01:44, Daniel Bristot de Oliveira wrote:
> > diff --git a/kernel/trace/rv/Kconfig b/kernel/trace/rv/Kconfig
> > index 1eafb5adcfcb..e9246b0bec9d 100644
> > --- a/kernel/trace/rv/Kconfig
> > +++ b/kernel/trace/rv/Kconfig
> > @@ -26,6 +26,13 @@ menuconfig RV
> > the system behavior.
> >
> > if RV
> > +config RV_MON_WIP
> > + depends on PREEMPTIRQ_TRACEPOINTS
> > + select DA_MON_EVENTS_IMPLICIT
> > + bool "WIP monitor"
>
> Does WIP mean work-in-progress? (It does to me.)
>
> If not, please explain what it means in the help text.
Yeah, that's exactly what I thought too ;-)
-- Steve
>
> > + help
> > + Enable WIP sample monitor, this is a sample monitor that
> > + illustrates the usage of per-cpu monitors.
>
> thanks.
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 11/20] rv/monitor: wwnr instrumentation and Makefile/Kconfig entries
2022-06-16 8:44 ` [PATCH V4 11/20] rv/monitor: wwnr instrumentation and Makefile/Kconfig entries Daniel Bristot de Oliveira
2022-06-16 13:47 ` kernel test robot
@ 2022-06-28 19:05 ` Steven Rostedt
1 sibling, 0 replies; 82+ messages in thread
From: Steven Rostedt @ 2022-06-28 19:05 UTC (permalink / raw)
To: Daniel Bristot de Oliveira
Cc: Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet, Ingo Molnar,
Thomas Gleixner, Peter Zijlstra, Will Deacon, Catalin Marinas,
Marco Elver, Dmitry Vyukov, Paul E. McKenney, Shuah Khan,
Gabriele Paoloni, Juri Lelli, Clark Williams, linux-doc,
linux-kernel, linux-trace-devel
On Thu, 16 Jun 2022 10:44:53 +0200
Daniel Bristot de Oliveira <bristot@kernel.org> wrote:
> diff --git a/kernel/trace/rv/monitors/wwnr/wwnr.c b/kernel/trace/rv/monitors/wwnr/wwnr.c
> index 8ba01f0f0df8..3fe1ad9125d3 100644
> --- a/kernel/trace/rv/monitors/wwnr/wwnr.c
> +++ b/kernel/trace/rv/monitors/wwnr/wwnr.c
> @@ -10,11 +10,8 @@
>
> #define MODULE_NAME "wwnr"
>
> -/*
> - * XXX: include required tracepoint headers, e.g.,
> - * #include <linux/trace/events/sched.h>
> - */
> #include <trace/events/rv.h>
> +#include <trace/events/sched.h>
>
> /*
> * This is the self-generated part of the monitor. Generally, there is no need
> @@ -37,21 +34,20 @@ DECLARE_DA_MON_PER_TASK(wwnr, char);
> * are translated into model's event.
> *
> */
> -static void handle_switch_in(void *data, /* XXX: fill header */)
> +static void handle_switch(void *data, bool preempt, struct task_struct *p,
> + struct task_struct *n, unsigned int prev_state)
> {
Patch 8 was the "educational" patch. There's no reason to split 10 and 11
up too.
-- Steve
> - struct task_struct *p = /* XXX: how do I get p? */;
> - da_handle_event_wwnr(p, switch_in_wwnr);
> -}
> + /* start monitoring only after the first suspension */
> + if (prev_state == TASK_INTERRUPTIBLE)
> + da_handle_init_event_wwnr(p, switch_out_wwnr);
> + else
> + da_handle_event_wwnr(p, switch_out_wwnr);
>
> -static void handle_switch_out(void *data, /* XXX: fill header */)
> -{
> - struct task_struct *p = /* XXX: how do I get p? */;
> - da_handle_event_wwnr(p, switch_out_wwnr);
> + da_handle_event_wwnr(n, switch_in_wwnr);
> }
>
> -static void handle_wakeup(void *data, /* XXX: fill header */)
> +static void handle_wakeup(void *data, struct task_struct *p)
> {
> - struct task_struct *p = /* XXX: how do I get p? */;
> da_handle_event_wwnr(p, wakeup_wwnr);
> }
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 13/20] rv/reactor: Add the panic reactor
2022-06-16 8:44 ` [PATCH V4 13/20] rv/reactor: Add the panic reactor Daniel Bristot de Oliveira
2022-06-16 15:20 ` kernel test robot
2022-06-16 21:03 ` Randy Dunlap
@ 2022-06-28 19:06 ` Steven Rostedt
2 siblings, 0 replies; 82+ messages in thread
From: Steven Rostedt @ 2022-06-28 19:06 UTC (permalink / raw)
To: Daniel Bristot de Oliveira
Cc: Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet, Ingo Molnar,
Thomas Gleixner, Peter Zijlstra, Will Deacon, Catalin Marinas,
Marco Elver, Dmitry Vyukov, Paul E. McKenney, Shuah Khan,
Gabriele Paoloni, Juri Lelli, Clark Williams, linux-doc,
linux-kernel, linux-trace-devel
On Thu, 16 Jun 2022 10:44:55 +0200
Daniel Bristot de Oliveira <bristot@kernel.org> wrote:
> Sample reactor that panics the system when an exception is found. This
> is useful both to capture a vmcore, or to fail-safe a critical system.
>
> Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
> Cc: Guenter Roeck <linux@roeck-us.net>
> Cc: Jonathan Corbet <corbet@lwn.net>
> Cc: Steven Rostedt <rostedt@goodmis.org>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Peter Zijlstra <peterz@infradead.org>
> Cc: Will Deacon <will@kernel.org>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: Marco Elver <elver@google.com>
> Cc: Dmitry Vyukov <dvyukov@google.com>
> Cc: "Paul E. McKenney" <paulmck@kernel.org>
> Cc: Shuah Khan <skhan@linuxfoundation.org>
> Cc: Gabriele Paoloni <gpaoloni@redhat.com>
> Cc: Juri Lelli <juri.lelli@redhat.com>
> Cc: Clark Williams <williams@redhat.com>
> Cc: linux-doc@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> Cc: linux-trace-devel@vger.kernel.org
> Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
> ---
> kernel/trace/rv/Kconfig | 8 ++++++
> kernel/trace/rv/Makefile | 1 +
> kernel/trace/rv/reactor_panic.c | 44 +++++++++++++++++++++++++++++++++
> 3 files changed, 53 insertions(+)
> create mode 100644 kernel/trace/rv/reactor_panic.c
>
> diff --git a/kernel/trace/rv/Kconfig b/kernel/trace/rv/Kconfig
> index be8e3dab0a52..91a17b13a080 100644
> --- a/kernel/trace/rv/Kconfig
> +++ b/kernel/trace/rv/Kconfig
> @@ -60,4 +60,12 @@ config RV_REACT_PRINTK
> Enables the printk reactor. The printk reactor emmits a printk()
> message if an exception is found.
>
> +config RV_REACT_PANIC
> + bool "Panic reactor"
> + depends on RV_REACTORS
> + default y if RV_REACTORS
Just put default y if it already depends on RV_REACTORS.
-- Steve
> + help
> + Enables the panic reactor. The panic reactor emmits a printk()
> + message if an exception is found and panic()s the system.
> +
> endif # RV
> diff --git a/kernel/trace/rv/Makefile b/kernel/trace/rv/Makefile
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 15/20] Documentation/rv: Add deterministic automata monitor synthesis documentation
2022-06-16 8:44 ` [PATCH V4 15/20] Documentation/rv: Add deterministic automata monitor synthesis documentation Daniel Bristot de Oliveira
@ 2022-06-28 19:09 ` Steven Rostedt
0 siblings, 0 replies; 82+ messages in thread
From: Steven Rostedt @ 2022-06-28 19:09 UTC (permalink / raw)
To: Daniel Bristot de Oliveira
Cc: Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet, Ingo Molnar,
Thomas Gleixner, Peter Zijlstra, Will Deacon, Catalin Marinas,
Marco Elver, Dmitry Vyukov, Paul E. McKenney, Shuah Khan,
Gabriele Paoloni, Juri Lelli, Clark Williams, linux-doc,
linux-kernel, linux-trace-devel
On Thu, 16 Jun 2022 10:44:57 +0200
Daniel Bristot de Oliveira <bristot@kernel.org> wrote:
> +DA monitor synthesis in a nutshell
> +------------------------------------------------------
> +
> +The synthesis of automata-based models into the Linux *RV monitor* abstraction
> +is automated by a tool named "dot2k", and the "rv/da_monitor.h" provided
> +by the RV interface.
> +
> +Given a file "wip.dot", representing a per-cpu monitor, with this content::
Specify what "wip" is here too.
-- Steve
> +
> + digraph state_automaton {
> + center = true;
> + size = "7,11";
> + rankdir = LR;
> + {node [shape = circle] "non_preemptive"};
> + {node [shape = plaintext, style=invis, label=""] "__init_preemptive"};
> + {node [shape = doublecircle] "preemptive"};
> + {node [shape = circle] "preemptive"};
> + "__init_preemptive" -> "preemptive";
> + "non_preemptive" [label = "non_preemptive"];
> + "non_preemptive" -> "non_preemptive" [ label = "sched_waking" ];
> + "non_preemptive" -> "preemptive" [ label = "preempt_enable" ];
> + "preemptive" [label = "preemptive"];
> + "preemptive" -> "non_preemptive" [ label = "preempt_disable" ];
> + { rank = min ;
> + "__init_preemptive";
> + "preemptive";
> + }
> + }
> +
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 18/20] rv/monitor: Add safe watchdog monitor
2022-06-16 23:53 ` Guenter Roeck
2022-06-17 17:06 ` Daniel Bristot de Oliveira
@ 2022-06-28 19:32 ` Steven Rostedt
2022-07-01 14:45 ` Guenter Roeck
1 sibling, 1 reply; 82+ messages in thread
From: Steven Rostedt @ 2022-06-28 19:32 UTC (permalink / raw)
To: Guenter Roeck
Cc: Gabriele Paoloni, Daniel Bristot de Oliveira, Wim Van Sebroeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Juri Lelli, Clark Williams,
open list:DOCUMENTATION, Linux Kernel Mailing List,
linux-trace-devel
On Thu, 16 Jun 2022 16:53:54 -0700
Guenter Roeck <linux@roeck-us.net> wrote:
> > >> +
> > >> +struct automaton_safe_wtd automaton_safe_wtd = {
> > >> + .state_names = {
> > >> + "init",
> > >> + "closed_running",
> > >> + "closed_running_nwo",
> > >> + "nwo",
> > >> + "opened",
> > >> + "opened_nwo",
> > >> + "reopened",
> > >> + "safe",
> > >> + "safe_nwo",
> > >> + "set",
> > >> + "set_nwo",
> > >> + "started",
> > >> + "started_nwo",
> > >> + "stoped"
> > >> + },
> > >> + .event_names = {
> > >> + "close",
> > >> + "nowayout",
> > >> + "open",
> > >> + "other_threads",
> > >> + "ping",
> > >> + "set_safe_timeout",
> > >> + "start",
> > >> + "stop"
> > >> + },
> > >> + .function = {
I think it could become much more readable if you added comments here that
show what each column is. That way, we do not need to try to remember it.
And maybe even a diagram in the comments. If we can automate the generating
of an ASCII DFA diagram then that would be awesome too :-)
> > >> + { -1, nwo_safe_wtd, opened_safe_wtd, init_safe_wtd, -1, -1, -1, -1 },
> > >> + { -1, closed_running_nwo_safe_wtd, reopened_safe_wtd, closed_running_safe_wtd, -1, -1, -1, -1 },
> > >> + { -1, closed_running_nwo_safe_wtd, started_nwo_safe_wtd, closed_running_nwo_safe_wtd, -1, -1, -1, -1 },
> > >> + { -1, nwo_safe_wtd, opened_nwo_safe_wtd, nwo_safe_wtd, -1, -1, -1, -1 },
> > >> + { init_safe_wtd, -1, -1, -1, -1, -1, started_safe_wtd, -1 },
> > >> + { nwo_safe_wtd, -1, -1, -1, -1, -1, started_nwo_safe_wtd, -1 },
> > >> + { closed_running_safe_wtd, -1, -1, -1, -1, set_safe_wtd, 1, opened_safe_wtd },
> > >> + { closed_running_safe_wtd, -1, -1, -1, safe_safe_wtd, -1, 1, stoped_safe_wtd },
> > >> + { closed_running_nwo_safe_wtd, -1, -1, -1, safe_nwo_safe_wtd, -1, -1, -1 },
> > >> + { -1, -1, -1, -1, safe_safe_wtd, -1, -1, -1 },
> > >> + { -1, -1, -1, -1, safe_nwo_safe_wtd, -1, -1, -1 },
> > >> + { closed_running_safe_wtd, -1, -1, -1, -1, set_safe_wtd, -1, stoped_safe_wtd },
> > >> + { closed_running_nwo_safe_wtd, -1, -1, -1, -1, set_nwo_safe_wtd, -1, -1 },
> > >> + { init_safe_wtd, -1, -1, -1, -1, -1, -1, -1 },
> > >> + },
> > >> + .initial_state = init_safe_wtd,
> > >> + .final_states = { 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 },
> > >
> > > I find this event table all but impossible to verify.
> >
> > It is a matrix. Lines are states, and columns are events.
> >
> > On a given state/line, receiving a given event/column, the data is the next
> > state/row.
> >
>
> I am aware of that, and I did program state machines before.
>
> > For instance, let's say "init" (row 0), event "nwo" (column 1), and the next
> > state is the "nwo" (row 3).
> >
> > -1 means invalid/blocked state (yeah, maybe it is better to have an #define
> > INVALID_STATE -1).
> >
> > This is the C representation of an automaton, following the formal definition of
> > a deterministic automaton. I've added an explanation of this representation in
> > the documentation (patch 15, file da_monitor_synthesis.rst).
> >
> > A deeper look into this subject is here (peer-reviewed conference paper at
> > Software Engineer and Formal Methods 2019):
> > https://bristot.me/wp-content/uploads/2019/09/paper.pdf <https://bristot.me/wp-content/uploads/2019/09/paper.pdf>
> >
> > One could translate it back to the automaton's graphical format... to a format
> > of by a tool used to analyze automaton properties... that is the good point of
> > using a well-established formalism. (The bad part is that they are often
> > boring... c'est la vie :-)).
> >
>
> If the above state machine fails, no one but the authors will be able to even
> remotely figure out what happened, and if the watchdog driver is at fault or
> its monitor. It is a state machine making assumptions about state transitions,
> sure, but who knows if those asssumptions are even remotely correct or match
> reality. For example, I have no idea if the lack of a 'ping' function is handled
> correctly, if the lack of a 'stop' function is handled correctly, or what
> happens if any of the driver functions returns an error.
>
> I already found three assumptions which do not or not necessarily match
> reality:
>
> - The function to read the remaining timeout is optional and must not be
> used unconditionally, and its lack is not an error.
> - The requested timeout (and pretimeout) do not have to match the actually
> configured timeout, and userspace must not rely on the assumption that
> the values match.
> - The code assumes that the process opening the watchdog and the process
> accessing it are the same. While that is in general the case, it might
> well be that some application opens the watchdog and then handles it
> from a child process.
>
> And that is just after briefly browsing through the code.
>
> I am open to suggestions from others, but at this point I have serious doubts
> that this code is maintainable in the kernel.
>
Let me give some background on this. Various safety critical users
(automotive, power plants, etc) are looking at using Linux in the field.
Obviously, Linux itself is too big to verify properly. In fact, even small
OSs that say they are verifiable seldom are. Part of the solution is to add
a way to check that Linux is running as expected, and be able to detect
when it is not. When that happens, you fall into a "fail-safe" mode (for
example, if you have an autonomous driving vehicle, it could sound an alarm
and inform the driver to go into manual mode, or it is going to simply
"pull over". Note, this is just a hypothetical example, not something I've
seen in reality).
But to implement this, you need to verify the verifier. In this case, the
watchdog timer is what verifies that Linux is running properly. It is
possible to verify parts of the kernel when you limit the inputs of the
kernel. This means we are not trying to verify all use cases of the
watchdog timer. That would be pretty much impossible, or take decades to
complete. We only need to verify the use cases used in safety critical
systems.
Do not confuse this with static analyzers or other general purpose tooling
to find bugs. This is not the purpose of the run time verify. It is just to
prove that certain use cases will perform as expected, given a limited
input.
Years ago there was an interview with Linus where he was asked if he would
trust Linux in real-time safety critical projects. And Linus's response was
something to the effect that he would, as those projects have a very
limited use case, and the code that actually gets run is not as big as you
would think. And that code can be verified.
That's exactly what we are doing here. There are very strict standards on
what is considered safe for safety critical projects and by limiting the
use cases of the code we are verifying, we can achieve those objectives.
But your complaint about not being able to read or understand the table is
legitimate, and that needs to be addressed. And what the limiting input is
must also be commented as well, that way people will not get confused when
they see a legitimate use case not covered by the DFA.
Action Items:
1. Add column title to the matrix.
2. Ideally, also add an ASCII DFA diagram.
3. And finally, comment what the range of inputs are (what use cases are
being covered).
-- Steve
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 14/20] Documentation/rv: Add a basic documentation
2022-06-16 8:44 ` [PATCH V4 14/20] Documentation/rv: Add a basic documentation Daniel Bristot de Oliveira
@ 2022-06-29 3:35 ` Bagas Sanjaya
2022-07-13 19:30 ` Daniel Bristot de Oliveira
0 siblings, 1 reply; 82+ messages in thread
From: Bagas Sanjaya @ 2022-06-29 3:35 UTC (permalink / raw)
To: Daniel Bristot de Oliveira
Cc: Steven Rostedt, Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet,
Ingo Molnar, Thomas Gleixner, Peter Zijlstra, Will Deacon,
Catalin Marinas, Marco Elver, Dmitry Vyukov, Paul E. McKenney,
Shuah Khan, Gabriele Paoloni, Juri Lelli, Clark Williams,
linux-doc, linux-kernel, linux-trace-devel
On Thu, Jun 16, 2022 at 10:44:56AM +0200, Daniel Bristot de Oliveira wrote:
> +For further information about the principles of runtime verification and
> +RV applied to Linux:
> +
> + BARTOCCI, Ezio, et al. *Introduction to runtime verification.* In: Lectures on
> + Runtime Verification. Springer, Cham, 2018. p. 1-33.
> +
> + FALCONE, Ylies, et al. *A taxonomy for classifying runtime verification tools.*
> + In: International Conference on Runtime Verification. Springer, Cham, 2018. p.
> + 241-262.
> +
> + DE OLIVEIRA, Daniel Bristot, et al. *Automata-based formal analysis and
> + verification of the real-time Linux kernel.* Ph.D. Thesis, 2020.
> +
Shouldn't these references be formatted citations reference syntax?
> +For example::
> +
> + [root@f32 rv]# cat available_monitors
> + wip
> + wwnr
> +
I think the prompt should be just `#` (without username and host).
Thanks.
--
An old man doll... just what I always wanted! - Clara
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 01/20] rv: Add Runtime Verification (RV) interface
2022-06-23 17:21 ` Punit Agrawal
@ 2022-07-01 13:24 ` Daniel Bristot de Oliveira
0 siblings, 0 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-07-01 13:24 UTC (permalink / raw)
To: Punit Agrawal
Cc: Steven Rostedt, Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet,
Ingo Molnar, Thomas Gleixner, Peter Zijlstra, Will Deacon,
Catalin Marinas, Marco Elver, Dmitry Vyukov, Paul E. McKenney,
Shuah Khan, Gabriele Paoloni, Juri Lelli, Clark Williams,
linux-doc, linux-kernel, linux-trace-devel
Hi Punit!
On 6/23/22 19:21, Punit Agrawal wrote:
> Hi Daniel,
>
> A few flyby issues I noticed while going through the patches to
> understand what RV offers.
>
> For the typos, I wonder if it isn't better to use a spellcheck - they
> unnecessarily detract from the review. Sorry for the annoyance!
I do appreciate this kind of review. I run a spell checker, but sometimes I
forget a patch here or there. I will add your changes and check the other
patches.
Thanks!
-- Daniel
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 18/20] rv/monitor: Add safe watchdog monitor
2022-06-28 19:32 ` Steven Rostedt
@ 2022-07-01 14:45 ` Guenter Roeck
2022-07-01 15:38 ` Steven Rostedt
0 siblings, 1 reply; 82+ messages in thread
From: Guenter Roeck @ 2022-07-01 14:45 UTC (permalink / raw)
To: Steven Rostedt
Cc: Gabriele Paoloni, Daniel Bristot de Oliveira, Wim Van Sebroeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Juri Lelli, Clark Williams,
open list:DOCUMENTATION, Linux Kernel Mailing List,
linux-trace-devel
On 6/28/22 12:32, Steven Rostedt wrote:
[ ... ]
>> I am open to suggestions from others, but at this point I have serious doubts
>> that this code is maintainable in the kernel.
>>
>
> Let me give some background on this. Various safety critical users
> (automotive, power plants, etc) are looking at using Linux in the field.
> Obviously, Linux itself is too big to verify properly. In fact, even small
> OSs that say they are verifiable seldom are. Part of the solution is to add
> a way to check that Linux is running as expected, and be able to detect
> when it is not. When that happens, you fall into a "fail-safe" mode (for
> example, if you have an autonomous driving vehicle, it could sound an alarm
> and inform the driver to go into manual mode, or it is going to simply
> "pull over". Note, this is just a hypothetical example, not something I've
> seen in reality).
>
> But to implement this, you need to verify the verifier. In this case, the
> watchdog timer is what verifies that Linux is running properly. It is
> possible to verify parts of the kernel when you limit the inputs of the
> kernel. This means we are not trying to verify all use cases of the
> watchdog timer. That would be pretty much impossible, or take decades to
> complete. We only need to verify the use cases used in safety critical
> systems.
>
I understand the context. However, ...
> Do not confuse this with static analyzers or other general purpose tooling
> to find bugs. This is not the purpose of the run time verify. It is just to
> prove that certain use cases will perform as expected, given a limited
> input.
>
... this is, unfortunately, not explained in the patch. I would have much less
of a problem with the series if those details were included.
Not that I would mind such a verifier, if it was possible to define one,
but it would have to be tested with a large number of watchdog drivers
to ensure that it addresses all use cases, or at least with a substantial
percentage of use cases. It would also require that the state machine is
readable to give people a chance to fix it if turns out to be broken.
It would also have to be robust, meaning it would have to reject invalid
(unsupported) settings from the start and not only during runtime.
Thanks,
Guenter
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 18/20] rv/monitor: Add safe watchdog monitor
2022-07-01 14:45 ` Guenter Roeck
@ 2022-07-01 15:38 ` Steven Rostedt
2022-07-04 12:41 ` Daniel Bristot de Oliveira
0 siblings, 1 reply; 82+ messages in thread
From: Steven Rostedt @ 2022-07-01 15:38 UTC (permalink / raw)
To: Guenter Roeck
Cc: Gabriele Paoloni, Daniel Bristot de Oliveira, Wim Van Sebroeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Juri Lelli, Clark Williams,
open list:DOCUMENTATION, Linux Kernel Mailing List,
linux-trace-devel
On Fri, 1 Jul 2022 07:45:50 -0700
Guenter Roeck <linux@roeck-us.net> wrote:
> > Do not confuse this with static analyzers or other general purpose tooling
> > to find bugs. This is not the purpose of the run time verify. It is just to
> > prove that certain use cases will perform as expected, given a limited
> > input.
> >
>
> ... this is, unfortunately, not explained in the patch. I would have much less
> of a problem with the series if those details were included.
It's one of those cases where developers get so involved in their code that
they leave out the things that are so obvious to them, but not obvious to
others ;-)
My new saying is: "We work in a field where the obvious seldom is".
Hmm, I think I'll go tweet that :-)
>
> Not that I would mind such a verifier, if it was possible to define one,
> but it would have to be tested with a large number of watchdog drivers
> to ensure that it addresses all use cases, or at least with a substantial
> percentage of use cases. It would also require that the state machine is
> readable to give people a chance to fix it if turns out to be broken.
> It would also have to be robust, meaning it would have to reject invalid
> (unsupported) settings from the start and not only during runtime.
I would agree than any module would need to state up front exactly what it
is modeling. In safety critical systems, all the components that are used
are defined up front. Not sure if we can have the model not load if the
required drivers to test are not loaded or ones not part of the model are
(Daniel?).
Anyway, thanks for the feedback.
-- Steve
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 18/20] rv/monitor: Add safe watchdog monitor
2022-07-01 15:38 ` Steven Rostedt
@ 2022-07-04 12:41 ` Daniel Bristot de Oliveira
0 siblings, 0 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-07-04 12:41 UTC (permalink / raw)
To: Steven Rostedt, Guenter Roeck
Cc: Gabriele Paoloni, Wim Van Sebroeck, Jonathan Corbet, Ingo Molnar,
Thomas Gleixner, Peter Zijlstra, Will Deacon, Catalin Marinas,
Marco Elver, Dmitry Vyukov, Paul E. McKenney, Shuah Khan,
Juri Lelli, Clark Williams, open list:DOCUMENTATION,
Linux Kernel Mailing List, linux-trace-devel
On 7/1/22 17:38, Steven Rostedt wrote:
> On Fri, 1 Jul 2022 07:45:50 -0700
> Guenter Roeck <linux@roeck-us.net> wrote:
>
>>> Do not confuse this with static analyzers or other general purpose tooling
>>> to find bugs. This is not the purpose of the run time verify. It is just to
>>> prove that certain use cases will perform as expected, given a limited
>>> input.
>>>
>>
>> ... this is, unfortunately, not explained in the patch. I would have much less
>> of a problem with the series if those details were included.
>
> It's one of those cases where developers get so involved in their code that
> they leave out the things that are so obvious to them, but not obvious to
> others ;-)
I agree that the main point here is that the documentation [patch 20/20] needs
to be extended and correctly linked to the code.
The goal of the model is to specify the minimum but obligatory steps to set a
watchdog (start, set a safe timeout, ping...) so it can be used by
"safety/heath" monitors in safety-critical systems.
Another goal is to reduce the amount of code/dependencies that will require
deeper inspections to qualify the subsystem for usage in a given context via
monitoring (as steven mentioned - more about it here [1]), without having to
reduce the generic subsystem.
Although the method allows one to create a complete model of the watchdog device
layer, covering all use cases, that is not the idea of this monitor. Moreover, a
full model would not be the adequate model for this specific (but relevant) case
raised and discussed in the Elisa workgroup [2].
The goal of the monitor (that uses the model) is to verify that the interaction
between the watchdog device layer and the "safety/heath" monitors follows this
established model, at runtime.
> My new saying is: "We work in a field where the obvious seldom is".
>
> Hmm, I think I'll go tweet that :-)
/me liked the tweet... and yep, you clarified well the context in which this is
being applied.
>>
>> Not that I would mind such a verifier, if it was possible to define one,
>> but it would have to be tested with a large number of watchdog drivers
>> to ensure that it addresses all use cases, or at least with a substantial
>> percentage of use cases. It would also require that the state machine is
>> readable to give people a chance to fix it if turns out to be broken.
The patch 20/20 has the automaton in the ASCII art format. Both C and ASCII
models were extracted from the same .dot file. I am not including the .dot file
because there was a previous discussion with the doc people that prefer the
ASCII format in the documentation. But I can add as well, not linked with the
rst file. By reading the model in the ASCII format, it is possible to see that
it is broad enough to cover many watchdogs as it uses simple/generic operations.
The model (the .h) and the instrumentation (the .c) can be updated at any time.
I am adding the tooling to facilitate that, like [patch 06/20].
Patch 19/20 adds a safety application that enables the RV monitor, uses the
watchdog, and collects feedback from the monitor to see if the requested actions
are occurring in the model - and it can be used to test the RV monitor with
any watchdog.
The goal is the one I described above, so an exception generated by this monitor
needs to be read accordingly: it does not imply that a watchdog driver is
broken. It means the interaction between the safety/health monitor and the
watchdog is not following specifications and must be checked at the development
phase, or that something went really wrong at runtime phase.
I will add that to the documentation and emphasize the context of this monitor.
>> It would also have to be robust, meaning it would have to reject invalid
>> (unsupported) settings from the start and not only during runtime.
>
> I would agree than any module would need to state up front exactly what it
> is modeling. In safety critical systems, all the components that are used
> are defined up front. Not sure if we can have the model not load if the
> required drivers to test are not loaded or ones not part of the model are
> (Daniel?).
I can add a check in the time in which the model is being enabled. But for this
specific case, removing that part might be better and adding it later if it
becomes fundamental.
In practice, selecting a watchdog device can assume that the get_timeleft
implementation is a requirement - so that option was just an additional check.
[1] This is one use case for the broader goal of the strategy discussed here:
https://www.youtube.com/watch?v=DkiwkAKOXNs
[2] https://www.youtube.com/watch?v=qFSYlCbHCYk
> Anyway, thanks for the feedback.
>
> -- Steve
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 01/20] rv: Add Runtime Verification (RV) interface
2022-06-23 20:26 ` Steven Rostedt
@ 2022-07-04 19:49 ` Daniel Bristot de Oliveira
0 siblings, 0 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-07-04 19:49 UTC (permalink / raw)
To: Steven Rostedt
Cc: Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet, Ingo Molnar,
Thomas Gleixner, Peter Zijlstra, Will Deacon, Catalin Marinas,
Marco Elver, Dmitry Vyukov, Paul E. McKenney, Shuah Khan,
Gabriele Paoloni, Juri Lelli, Clark Williams, linux-doc,
linux-kernel, linux-trace-devel
On 6/23/22 22:26, Steven Rostedt wrote:
> On Thu, 16 Jun 2022 10:44:43 +0200
> Daniel Bristot de Oliveira <bristot@kernel.org> wrote:
[ removing comments that I agreed and changed the code/log accordingly ]
>>
>> "monitoring_on"
>> - It is an on/off general switcher for monitoring. Note
>> that it does not disable enabled monitors, but stop the per-entity
>> monitors of monitoring the events received from the system.
>> It resambles the "tracing_on" switcher.
>
> You mean that the tracepoints are still attached, but the process of
> monitoring isn't doing anything?
correct, I am now mentioning it in the comment.
[...]
>> +static int disable_monitor(struct rv_monitor_def *mdef)
>> +{
>> + if (mdef->monitor->enabled) {
>> + mdef->monitor->enabled = 0;
>> + mdef->monitor->stop();
>> + }
>> +
>> + mdef->enabled = 0;
>
> What's the difference between mdef->enabled and mdef->monitor->enabled?
Ooops, the mdef->enabled is a leftover... removing mdef->enabled.
>> + return 0;
>> +}
>> +
[...]
>> +static int create_monitor_dir(struct rv_monitor_def *mdef)
>> +{
>> + struct dentry *root = get_monitors_root();
>> + struct dentry *tmp;
>> + const char *name = mdef->monitor->name;
>> + int retval = 0;
>> +
>> + mdef->root_d = rv_create_dir(name, root);
>> +
>> + if (!mdef->root_d)
>> + return -ENOMEM;
>> +
>> + tmp = rv_create_file("enable", 0600,
>
> I'd recommend make the modes (0600) into macros. I recently changed
> these for tracing, and having them hard coded was a pain.
>
> #define RV_FILE_READ 0600
>
Added:
#define RV_MODE_WRITE TRACE_MODE_WRITE
#define RV_MODE_READ TRACE_MODE_READ
>> + mdef->root_d, mdef,
>> + &interface_enable_fops);
>> + if (!tmp) {
>> + retval = -ENOMEM;
>> + goto out_remove_root;
>> + }
>> +
>> + tmp = rv_create_file("desc", 0400,
>
> Same here, and in all other cases.
>
>> + mdef->root_d, mdef,
>> + &interface_desc_fops);
>> + if (!tmp) {
>> + retval = -ENOMEM;
>> + goto out_remove_root;
>> + }
>> +
>> + return retval;
>> +
>> +out_remove_root:
>> + rv_remove(mdef->root_d);
>> + return retval;
>> +}
[...]
>> +static ssize_t
>> +enabled_monitors_write(struct file *filp, const char __user *user_buf,
>> + size_t count, loff_t *ppos)
>> +{
>> + char buff[MAX_RV_MONITOR_NAME_SIZE+1];
>> + struct rv_monitor_def *mdef;
>> + int retval = -EINVAL;
>> + bool enable = true;
>> + char *ptr = buff;
>> + int len;
>> +
>> + if (count < 1 || count > MAX_RV_MONITOR_NAME_SIZE+1)
>> + return -EINVAL;
>> +
>> + memset(buff, 0, sizeof(buff));
>> +
>> + retval = simple_write_to_buffer(buff, sizeof(buff)-1, ppos, user_buf,
>> + count);
>> + if (!retval)
>> + return -EFAULT;
>> +
>> + if (buff[0] == '!') {
>> + enable = false;
>> + ptr++;
>> + }
>> +
>> + len = strlen(ptr);
>> + if (!len)
>> + return count;
>> + /*
>> + * remove \n
>> + */
>> + ptr[len-1] = '\0';
>
> Are you sure there's an '\n' here?
>
> One could just do "write(fd, "monitor", 7)"
>
> Perhaps use strim()
ack.
>
>> +
>> + mutex_lock(&rv_interface_lock);
>> +
>> + retval = -EINVAL;
>> +
>> + list_for_each_entry(mdef, &rv_monitors_list, list) {
>> + if (strcmp(ptr, mdef->monitor->name) == 0) {
>
> BTW, you could do:
>
> if (strcmp(ptr, mdef->monitor->name) != 0)
> continue;
>
> And then get rid of an extra indent below.
>
>> + /*
>> + * Monitor found!
>> + */
>> + if (enable)
>> + retval = enable_monitor(mdef);
>> + else
>> + retval = disable_monitor(mdef);
>> +
>> + if (retval)
>> + goto out;
>
> Why not just break?
>
> In fact, you could just do:
>
> if (!retval)
> retval = count;
> break;
yep, it looks better.
-- Daniel
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 00/20] The Runtime Verification (RV) interface
2022-06-16 8:44 [PATCH V4 00/20] The Runtime Verification (RV) interface Daniel Bristot de Oliveira
` (20 preceding siblings ...)
2022-06-22 7:24 ` [PATCH V4 00/20] The Runtime Verification (RV) interface Song Liu
@ 2022-07-06 16:18 ` Tao Zhou
21 siblings, 0 replies; 82+ messages in thread
From: Tao Zhou @ 2022-07-06 16:18 UTC (permalink / raw)
To: Daniel Bristot de Oliveira
Cc: Steven Rostedt, Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet,
Ingo Molnar, Thomas Gleixner, Peter Zijlstra, Will Deacon,
Catalin Marinas, Marco Elver, Dmitry Vyukov, Paul E. McKenney,
Shuah Khan, Gabriele Paoloni, Juri Lelli, Clark Williams,
linux-doc, linux-kernel, linux-trace-devel, Tao Zhou
Hi Daniel,
After reading things in paper and the previous versions these days slowly
from me, I choose to join the thread this time not because I understand
them clearly. Sorry for not saving your email bandwidth..
On Thu, Jun 16, 2022 at 10:44:42AM +0200, Daniel Bristot de Oliveira wrote:
> Over the last years, I've been exploring the possibility of
> verifying the Linux kernel behavior using Runtime Verification.
>
> Runtime Verification (RV) is a lightweight (yet rigorous) method that
> complements classical exhaustive verification techniques (such as model
> checking and theorem proving) with a more practical approach for complex
> systems.
>
> Instead of relying on a fine-grained model of a system (e.g., a
> re-implementation a instruction level), RV works by analyzing the trace of the
> system's actual execution, comparing it against a formal specification of
> the system behavior.
>
> The usage of deterministic automaton for RV is a well-established
> approach. In the specific case of the Linux kernel, you can check how
> to model complex behavior of the Linux kernel with this paper:
>
> DE OLIVEIRA, Daniel Bristot; CUCINOTTA, Tommaso; DE OLIVEIRA, Romulo Silva.
> *Efficient formal verification for the Linux kernel.* In: International
> Conference on Software Engineering and Formal Methods. Springer, Cham, 2019.
> p. 315-332.
>
> And how efficient is this approach here:
>
> DE OLIVEIRA, Daniel B.; DE OLIVEIRA, Romulo S.; CUCINOTTA, Tommaso. *A thread
> synchronization model for the PREEMPT_RT Linux kernel.* Journal of Systems
> Architecture, 2020, 107: 101729.
>
> tlrd: it is possible to model complex behaviors in a modular way, with
> an acceptable overhead (even for production systems). See this
> presentation at 2019's ELCE: https://www.youtube.com/watch?v=BfTuEHafNgg
>
> Here I am proposing a more practical approach for the usage of deterministic
> automata for runtime verification, and it includes:
>
> - An interface for controlling the verification;
> - A tool and set of headers that enables the automatic code
> generation of the RV monitor (Monitor Synthesis);
> - Sample monitors to evaluate the interface;
> - A sample monitor developed in the context of the Elisa Project
> demonstrating how to use RV in the context of safety-critical
> systems.
>
> Given that RV is a tracing consumer, the code is being placed inside the
> tracing subsystem (Steven and I have been talking about it for a while).
>
> Changes from v3:
> - Rebased on 5.19
> (rostedt's request were made on 1x1 meetings)
> - Moved monitors to monitors/$name/ (Rostedt)
> - Consolidate the tracepoints into a single include file in the default
> directory (trave/events/rv.h) (Rostedt)
s/trave\(\/events\/rv.h\)/trace\1/
> - The tracepoints now record the entire string to the buffer.
> - Change the enable_monitors to disable monitors with ! (instead of -).
> (Rostedt)
> - Add a suffix to the state/events enums, to avoid conflict in the
> vmlinux.h used by eBPF.
> - The models are now placed in the $name.h (it used to store the
> tracepoints, but they are now consolidated in a single file)
> - dot2c and dot2k updated to the changes
> - models re-generated with these new standards.
> - user-space tools moved to an directory outside of tools/tracing as
> other methods of verification/log sources are planned.
> Changes from v2:
> - Tons of checkpatch and kernel test robot
> - Moved files to better places
> - Adjusted watchdog tracepoints patch (Guenter Roeck)
> - Added pretimeout watchdog events (Peter Enderborg)
> - Used task struct to store per-task monitors (Peter Zijlstra)
> - Changed the instrumentation to use internal definition of tracepoint
> and check the callback signature (Steven Rostedt)
> - Used printk_deferred() and removed the comment about deadlocks
> (Shuah Khan/John Ogness)
> - Some simplifications:
> - Removed the safe watchdog nowayout for now (myself)
> - Removed export symbols for now (myself)
> Changes from V1:
> - rebased to the latest kernel;
> - code cleanup;
> - the watchdog dev monitor;
> - safety app;
>
> Things kept for a second moment (after this patchset):
> - Add a reactor tha enables the visualization of the visited
> states via KCOV (Marco Elver & Dmitry Vyukov)
> - Add a CRC method to check from user-space if the values
> exported by the monitor were not corrupted by any other
> kernel task (Gabriele Paoloni)
> - Export symbols for external modules
> - dot2bpf
>
> Daniel Bristot de Oliveira (20):
> rv: Add Runtime Verification (RV) interface
> rv: Add runtime reactors interface
> rv/include: Add helper functions for deterministic automata
> rv/include: Add deterministic automata monitor definition via C macros
> rv/include: Add instrumentation helper functions
> tools/rv: Add dot2c
> tools/rv: Add dot2k
> rv/monitor: Add the wip monitor skeleton created by dot2k
> rv/monitor: wip instrumentation and Makefile/Kconfig entries
> rv/monitor: Add the wwnr monitor skeleton created by dot2k
> rv/monitor: wwnr instrumentation and Makefile/Kconfig entries
> rv/reactor: Add the printk reactor
> rv/reactor: Add the panic reactor
> Documentation/rv: Add a basic documentation
> Documentation/rv: Add deterministic automata monitor synthesis
> documentation
> Documentation/rv: Add deterministic automata instrumentation
> documentation
> watchdog/dev: Add tracepoints
> rv/monitor: Add safe watchdog monitor
> rv/safety_app: Add a safety_app sample
> Documentation/rv: Add watchdog-monitor documentation
>
> Documentation/trace/index.rst | 1 +
> .../trace/rv/da_monitor_instrumentation.rst | 223 ++++++
> .../trace/rv/da_monitor_synthesis.rst | 284 +++++++
> Documentation/trace/rv/index.rst | 9 +
> .../trace/rv/runtime-verification.rst | 233 ++++++
> Documentation/trace/rv/watchdog-monitor.rst | 250 ++++++
> drivers/watchdog/watchdog_dev.c | 43 +-
> drivers/watchdog/watchdog_pretimeout.c | 2 +
> include/linux/rv.h | 38 +
> include/linux/sched.h | 11 +
> include/linux/watchdog.h | 7 +-
> include/rv/automata.h | 49 ++
> include/rv/da_monitor.h | 419 ++++++++++
> include/rv/instrumentation.h | 23 +
> include/rv/rv.h | 32 +
> include/trace/events/rv.h | 153 ++++
> include/trace/events/watchdog.h | 101 +++
> kernel/fork.c | 14 +
> kernel/trace/Kconfig | 2 +
> kernel/trace/Makefile | 2 +
> kernel/trace/rv/Kconfig | 84 ++
> kernel/trace/rv/Makefile | 9 +
> kernel/trace/rv/monitors/safe_wtd/safe_wtd.c | 300 +++++++
> kernel/trace/rv/monitors/safe_wtd/safe_wtd.h | 84 ++
> kernel/trace/rv/monitors/wip/wip.c | 110 +++
> kernel/trace/rv/monitors/wip/wip.h | 38 +
> kernel/trace/rv/monitors/wwnr/wwnr.c | 109 +++
> kernel/trace/rv/monitors/wwnr/wwnr.h | 38 +
> kernel/trace/rv/reactor_panic.c | 44 +
> kernel/trace/rv/reactor_printk.c | 43 +
> kernel/trace/rv/rv.c | 757 ++++++++++++++++++
> kernel/trace/rv/rv.h | 54 ++
> kernel/trace/rv/rv_reactors.c | 476 +++++++++++
> kernel/trace/trace.c | 4 +
> kernel/trace/trace.h | 2 +
> tools/verification/dot2/Makefile | 26 +
> tools/verification/dot2/automata.py | 179 +++++
> tools/verification/dot2/dot2c | 30 +
> tools/verification/dot2/dot2c.py | 244 ++++++
> tools/verification/dot2/dot2k | 50 ++
> tools/verification/dot2/dot2k.py | 177 ++++
> .../dot2/dot2k_templates/main_global.c | 94 +++
> .../dot2/dot2k_templates/main_per_cpu.c | 94 +++
> .../dot2/dot2k_templates/main_per_task.c | 94 +++
> tools/verification/safety_app/Makefile | 51 ++
> tools/verification/safety_app/safety_app.c | 614 ++++++++++++++
> 46 files changed, 5691 insertions(+), 10 deletions(-)
> create mode 100644 Documentation/trace/rv/da_monitor_instrumentation.rst
> create mode 100644 Documentation/trace/rv/da_monitor_synthesis.rst
> create mode 100644 Documentation/trace/rv/index.rst
> create mode 100644 Documentation/trace/rv/runtime-verification.rst
> create mode 100644 Documentation/trace/rv/watchdog-monitor.rst
> create mode 100644 include/linux/rv.h
> create mode 100644 include/rv/automata.h
> create mode 100644 include/rv/da_monitor.h
> create mode 100644 include/rv/instrumentation.h
> create mode 100644 include/rv/rv.h
> create mode 100644 include/trace/events/rv.h
> create mode 100644 include/trace/events/watchdog.h
> create mode 100644 kernel/trace/rv/Kconfig
> create mode 100644 kernel/trace/rv/Makefile
> create mode 100644 kernel/trace/rv/monitors/safe_wtd/safe_wtd.c
> create mode 100644 kernel/trace/rv/monitors/safe_wtd/safe_wtd.h
> create mode 100644 kernel/trace/rv/monitors/wip/wip.c
> create mode 100644 kernel/trace/rv/monitors/wip/wip.h
> create mode 100644 kernel/trace/rv/monitors/wwnr/wwnr.c
> create mode 100644 kernel/trace/rv/monitors/wwnr/wwnr.h
> create mode 100644 kernel/trace/rv/reactor_panic.c
> create mode 100644 kernel/trace/rv/reactor_printk.c
> create mode 100644 kernel/trace/rv/rv.c
> create mode 100644 kernel/trace/rv/rv.h
> create mode 100644 kernel/trace/rv/rv_reactors.c
> create mode 100644 tools/verification/dot2/Makefile
> create mode 100644 tools/verification/dot2/automata.py
> create mode 100644 tools/verification/dot2/dot2c
> create mode 100644 tools/verification/dot2/dot2c.py
> create mode 100644 tools/verification/dot2/dot2k
> create mode 100644 tools/verification/dot2/dot2k.py
> create mode 100644 tools/verification/dot2/dot2k_templates/main_global.c
> create mode 100644 tools/verification/dot2/dot2k_templates/main_per_cpu.c
> create mode 100644 tools/verification/dot2/dot2k_templates/main_per_task.c
> create mode 100644 tools/verification/safety_app/Makefile
> create mode 100644 tools/verification/safety_app/safety_app.c
>
> --
> 2.35.1
>
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 01/20] rv: Add Runtime Verification (RV) interface
2022-06-16 8:44 ` [PATCH V4 01/20] rv: Add " Daniel Bristot de Oliveira
2022-06-23 17:21 ` Punit Agrawal
2022-06-23 20:26 ` Steven Rostedt
@ 2022-07-06 17:49 ` Tao Zhou
2022-07-06 17:53 ` Matthew Wilcox
2022-07-08 14:39 ` Daniel Bristot de Oliveira
2 siblings, 2 replies; 82+ messages in thread
From: Tao Zhou @ 2022-07-06 17:49 UTC (permalink / raw)
To: Daniel Bristot de Oliveira
Cc: Steven Rostedt, Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet,
Ingo Molnar, Thomas Gleixner, Peter Zijlstra, Will Deacon,
Catalin Marinas, Marco Elver, Dmitry Vyukov, Paul E. McKenney,
Shuah Khan, Gabriele Paoloni, Juri Lelli, Clark Williams,
linux-doc, linux-kernel, linux-trace-devel, Tao Zhou
On Thu, Jun 16, 2022 at 10:44:43AM +0200, Daniel Bristot de Oliveira wrote:
> RV is a lightweight (yet rigorous) method that complements classical
> exhaustive verification techniques (such as model checking and
> theorem proving) with a more practical approach to complex systems.
>
> RV works by analyzing the trace of the system's actual execution,
> comparing it against a formal specification of the system behavior.
> RV can give precise information on the runtime behavior of the
> monitored system while enabling the reaction for unexpected
> events, avoiding, for example, the propagation of a failure on
> safety-critical systems.
>
> The development of this interface roots in the development of the
> paper:
>
> DE OLIVEIRA, Daniel Bristot; CUCINOTTA, Tommaso; DE OLIVEIRA, Romulo
> Silva. Efficient formal verification for the Linux kernel. In:
> International Conference on Software Engineering and Formal Methods.
> Springer, Cham, 2019. p. 315-332.
>
> And:
>
> DE OLIVEIRA, Daniel Bristot, et al. Automata-based formal analysis
> and verification of the real-time Linux kernel. PhD Thesis, 2020.
>
> The RV interface resembles the tracing/ interface on purpose. The current
> path for the RV interface is /sys/kernel/tracing/rv/.
>
> It presents these files:
>
> "available_monitors"
> - List the available monitors, one per line.
>
> For example:
> [root@f32 rv]# cat available_monitors
> wip
> wwnr
>
> "enabled_monitors"
> - Lists the enabled monitors, one per line;
> - Writing to it enables a given monitor;
> - Writing a monitor name with a '-' prefix disables it;
> - Truncating the file disables all enabled monitors.
>
> For example:
> [root@f32 rv]# cat enabled_monitors
> [root@f32 rv]# echo wip > enabled_monitors
> [root@f32 rv]# echo wwnr >> enabled_monitors
> [root@f32 rv]# cat enabled_monitors
> wip
> wwnr
> [root@f32 rv]# echo !wip >> enabled_monitors
> [root@f32 rv]# cat enabled_monitors
> wwnr
> [root@f32 rv]# echo > enabled_monitors
> [root@f32 rv]# cat enabled_monitors
> [root@f32 rv]#
>
> Note that more than one monitor can be enabled concurrently.
>
> "monitoring_on"
> - It is an on/off general switcher for monitoring. Note
> that it does not disable enabled monitors, but stop the per-entity
> monitors of monitoring the events received from the system.
> It resambles the "tracing_on" switcher.
>
> "monitors/"
> Each monitor will have its one directory inside "monitors/". There
> the monitor specific files will be presented.
> The "monitors/" directory resambles the "events" directory on
> tracefs.
>
> For example:
> [root@f32 rv]# cd monitors/wip/
> [root@f32 wip]# ls
> desc enable
> [root@f32 wip]# cat desc
> auto-generated wakeup in preemptive monitor.
> [root@f32 wip]# cat enable
> 0
>
> For further information, see the comments in the header of
> kernel/trace/rv/rv.c from this patch.
>
> Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
> Cc: Guenter Roeck <linux@roeck-us.net>
> Cc: Jonathan Corbet <corbet@lwn.net>
> Cc: Steven Rostedt <rostedt@goodmis.org>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Peter Zijlstra <peterz@infradead.org>
> Cc: Will Deacon <will@kernel.org>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: Marco Elver <elver@google.com>
> Cc: Dmitry Vyukov <dvyukov@google.com>
> Cc: "Paul E. McKenney" <paulmck@kernel.org>
> Cc: Shuah Khan <skhan@linuxfoundation.org>
> Cc: Gabriele Paoloni <gpaoloni@redhat.com>
> Cc: Juri Lelli <juri.lelli@redhat.com>
> Cc: Clark Williams <williams@redhat.com>
> Cc: linux-doc@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> Cc: linux-trace-devel@vger.kernel.org
> Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
> ---
> include/linux/rv.h | 23 ++
> include/linux/sched.h | 11 +
> include/rv/rv.h | 23 ++
> kernel/fork.c | 14 +
> kernel/trace/Kconfig | 2 +
> kernel/trace/Makefile | 2 +
> kernel/trace/rv/Kconfig | 12 +
> kernel/trace/rv/Makefile | 3 +
> kernel/trace/rv/rv.c | 738 +++++++++++++++++++++++++++++++++++++++
> kernel/trace/rv/rv.h | 34 ++
> kernel/trace/trace.c | 4 +
> kernel/trace/trace.h | 2 +
> 12 files changed, 868 insertions(+)
> create mode 100644 include/linux/rv.h
> create mode 100644 include/rv/rv.h
> create mode 100644 kernel/trace/rv/Kconfig
> create mode 100644 kernel/trace/rv/Makefile
> create mode 100644 kernel/trace/rv/rv.c
> create mode 100644 kernel/trace/rv/rv.h
>
> diff --git a/include/linux/rv.h b/include/linux/rv.h
> new file mode 100644
> index 000000000000..205e65f57637
> --- /dev/null
> +++ b/include/linux/rv.h
> @@ -0,0 +1,23 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +/*
> + * Runtime Verification.
> + *
> + * For futher information, see: kernel/trace/rv/rv.c.
> + *
> + * Copyright (C) 2019-2022 Daniel Bristot de Oliveira <bristot@kernel.org>
> + */
> +#ifndef _LINUX_RV_H
> +#define _LINUX_RV_H
> +struct rv_monitor {
> + const char *name;
> + const char *description;
> + bool enabled;
Can the 'bool enabled;' be put at the end like the definition of
structure rv_monitor_def. If '8+8+sizeof(bool)+8+8+8' not the same
as '8+8+8+8+8+sizeof(bool)', I mean is it possible that after the
end of stucture there is a int or char not require to align to 8 as
an example from my nonsense.
> + int (*start)(void);
> + void (*stop)(void);
> + void (*reset)(void);
> +};
> +
> +extern bool monitoring_on;
> +int rv_unregister_monitor(struct rv_monitor *monitor);
> +int rv_register_monitor(struct rv_monitor *monitor);
> +#endif /* _LINUX_RV_H */
> diff --git a/include/linux/sched.h b/include/linux/sched.h
> index c46f3a63b758..b037f364efdc 100644
> --- a/include/linux/sched.h
> +++ b/include/linux/sched.h
> @@ -35,6 +35,7 @@
> #include <linux/seqlock.h>
> #include <linux/kcsan.h>
> #include <asm/kmap_size.h>
> +#include <rv/rv.h>
>
> /* task_struct member predeclarations (sorted alphabetically): */
> struct audit_context;
> @@ -1500,6 +1501,16 @@ struct task_struct {
> struct callback_head l1d_flush_kill;
> #endif
>
> +#ifdef CONFIG_RV
> + /*
> + * Per-task RV monitor. Nowadays fixed in RV_PER_TASK_MONITORS.
> + * If we find justification for more monitors, we can think
> + * about adding more or developing a dynamic method. So far,
> + * none of these are justified.
> + */
> + union rv_task_monitor rv[RV_PER_TASK_MONITORS];
> +#endif
> +
> /*
> * New fields for task_struct should be added above here, so that
> * they are included in the randomized portion of task_struct.
> diff --git a/include/rv/rv.h b/include/rv/rv.h
> new file mode 100644
> index 000000000000..27a108881d35
> --- /dev/null
> +++ b/include/rv/rv.h
> @@ -0,0 +1,23 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +
> +#ifndef _RV_RV_H
> +#define _RV_RV_H
> +
> +/*
> + * Per-task RV monitors count. Nowadays fixed in RV_PER_TASK_MONITORS.
> + * If we find justification for more monitors, we can think about
> + * adding more or developing a dynamic method. So far, none of
> + * these are justified.
> + */
> +#define RV_PER_TASK_MONITORS 1
> +#define RV_PER_TASK_MONITOR_INIT (RV_PER_TASK_MONITORS)
> +
> +/*
> + * Futher monitor types are expected, so make this a union.
> + */
> +union rv_task_monitor {
> +};
> +
> +int get_task_monitor_slot(void);
> +void put_task_monitor_slot(int slot);
> +#endif /* _RV_RV_H */
> diff --git a/kernel/fork.c b/kernel/fork.c
> index 9d44f2d46c69..5e40e58ef83d 100644
> --- a/kernel/fork.c
> +++ b/kernel/fork.c
> @@ -1964,6 +1964,18 @@ static void copy_oom_score_adj(u64 clone_flags, struct task_struct *tsk)
> mutex_unlock(&oom_adj_mutex);
> }
>
> +#ifdef CONFIG_RV
> +static void rv_task_fork(struct task_struct *p)
> +{
> + int i;
> +
> + for (i = 0; i < RV_PER_TASK_MONITORS; i++)
> + ;
> +}
> +#else
> +#define rv_task_fork(p) do {} while (0)
> +#endif
> +
> /*
> * This creates a new process as a copy of the old one,
> * but does not actually start it yet.
> @@ -2399,6 +2411,8 @@ static __latent_entropy struct task_struct *copy_process(
> */
> copy_seccomp(p);
>
> + rv_task_fork(p);
> +
> rseq_fork(p, clone_flags);
>
> /* Don't start children in a dying pid namespace */
> diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
> index debbbb083286..b415690748bf 100644
> --- a/kernel/trace/Kconfig
> +++ b/kernel/trace/Kconfig
> @@ -1105,4 +1105,6 @@ config HIST_TRIGGERS_DEBUG
>
> If unsure, say N.
>
> +source "kernel/trace/rv/Kconfig"
> +
> endif # FTRACE
> diff --git a/kernel/trace/Makefile b/kernel/trace/Makefile
> index 0d261774d6f3..b2670fff6e94 100644
> --- a/kernel/trace/Makefile
> +++ b/kernel/trace/Makefile
> @@ -108,3 +108,5 @@ obj-$(CONFIG_RETHOOK) += rethook.o
> obj-$(CONFIG_TRACEPOINT_BENCHMARK) += trace_benchmark.o
>
> libftrace-y := ftrace.o
> +
> +obj-$(CONFIG_RV) += rv/
> diff --git a/kernel/trace/rv/Kconfig b/kernel/trace/rv/Kconfig
> new file mode 100644
> index 000000000000..6d127cdb00dd
> --- /dev/null
> +++ b/kernel/trace/rv/Kconfig
> @@ -0,0 +1,12 @@
> +# SPDX-License-Identifier: GPL-2.0-only
> +#
> +menuconfig RV
> + bool "Runtime Verification"
> + depends on TRACING
> + help
> + Enable the kernel runtime verification infrastructure. RV is a
> + lightweight (yet rigorous) method that complements classical
> + exhaustive verification techniques (such as model checking and
> + theorem proving). RV works by analyzing the trace of the system's
> + actual execution, comparing it against a formal specification of
> + the system behavior.
> diff --git a/kernel/trace/rv/Makefile b/kernel/trace/rv/Makefile
> new file mode 100644
> index 000000000000..fd995379df67
> --- /dev/null
> +++ b/kernel/trace/rv/Makefile
> @@ -0,0 +1,3 @@
> +# SPDX-License-Identifier: GPL-2.0
> +
> +obj-$(CONFIG_RV) += rv.o
> diff --git a/kernel/trace/rv/rv.c b/kernel/trace/rv/rv.c
> new file mode 100644
> index 000000000000..43af7b13187e
> --- /dev/null
> +++ b/kernel/trace/rv/rv.c
> @@ -0,0 +1,738 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/*
> + * This is the online Runtime Verification (RV) interface.
> + *
> + * RV is a lightweight (yet rigorous) method that complements classical
> + * exhaustive verification techniques (such as model checking and
> + * theorem proving) with a more practical approach to complex systems.
> + *
> + * RV works by analyzing the trace of the system's actual execution,
> + * comparing it against a formal specification of the system behavior.
> + * RV can give precise information on the runtime behavior of the
> + * monitored system while enabling the reaction for unexpected
> + * events, avoiding, for example, the propagation of a failure on
> + * safety-critical systems.
> + *
> + * The development of this interface roots in the development of the
> + * paper:
> + *
> + * DE OLIVEIRA, Daniel Bristot; CUCINOTTA, Tommaso; DE OLIVEIRA, Romulo
> + * Silva. Efficient formal verification for the Linux kernel. In:
> + * International Conference on Software Engineering and Formal Methods.
> + * Springer, Cham, 2019. p. 315-332.
> + *
> + * And:
> + *
> + * DE OLIVEIRA, Daniel Bristot, et al. Automata-based formal analysis
> + * and verification of the real-time Linux kernel. PhD Thesis, 2020.
> + *
> + * == Runtime monitor interface ==
> + *
> + * A monitor is the central part of the runtime verification of a system.
> + *
> + * The monitor stands in between the formal specification of the desired
> + * (or undesired) behavior, and the trace of the actual system.
> + *
> + * In Linux terms, the runtime verification monitors are encapsulated
> + * inside the "RV monitor" abstraction. A RV monitor includes a reference
> + * model of the system, a set of instances of the monitor (per-cpu monitor,
> + * per-task monitor, and so on), and the helper functions that glue the
> + * monitor to the system via trace. Generally, a monitor includes some form
> + * of trace output as a reaction for event parsing and exceptions,
> + * as depicted bellow:
> + *
> + * Linux +----- RV Monitor ----------------------------------+ Formal
> + * Realm | | Realm
> + * +-------------------+ +----------------+ +-----------------+
> + * | Linux kernel | | Monitor | | Reference |
> + * | Tracing | -> | Instance(s) | <- | Model |
> + * | (instrumentation) | | (verification) | | (specification) |
> + * +-------------------+ +----------------+ +-----------------+
> + * | | |
> + * | V |
> + * | +----------+ |
> + * | | Reaction | |
> + * | +--+--+--+-+ |
> + * | | | | |
> + * | | | +-> trace output ? |
> + * +------------------------|--|----------------------+
> + * | +----> panic ?
> + * +-------> <user-specified>
> + *
> + * This file implements the interface for loading RV monitors, and
> + * to control the verification session.
> + *
> + * == Registering monitors ==
> + *
> + * The struct rv_monitor defines a set of callback functions to control
> + * a verification session. For instance, when a given monitor is enabled,
> + * the "start" callback function is called to hook the instrumentation
> + * functions to the kernel trace events. The "stop" function is called
> + * when disabling the verification session.
> + *
> + * A RV monitor is registered via:
> + * int rv_register_monitor(struct rv_monitor *monitor);
> + * And unregistered via:
> + * int rv_unregister_monitor(struct rv_monitor *monitor);
> + *
> + * These functions are exported to modules, enabling verification monitors
> + * to be dynamically loaded.
> + *
> + * == User interface ==
> + *
> + * The user interface resembles kernel tracing interface. It presents
> + * these files:
> + *
> + * "available_monitors"
> + * - List the available monitors, one per line.
> + *
> + * For example:
> + * [root@f32 rv]# cat available_monitors
> + * wip
> + * wwnr
> + *
> + * "enabled_monitors"
> + * - Lists the enabled monitors, one per line;
> + * - Writing to it enables a given monitor;
> + * - Writing a monitor name with a '-' prefix disables it;
> + * - Truncating the file disables all enabled monitors.
> + *
> + * For example:
> + * [root@f32 rv]# cat enabled_monitors
> + * [root@f32 rv]# echo wip > enabled_monitors
> + * [root@f32 rv]# echo wwnr >> enabled_monitors
> + * [root@f32 rv]# cat enabled_monitors
> + * wip
> + * wwnr
> + * [root@f32 rv]# echo !wip >> enabled_monitors
> + * [root@f32 rv]# cat enabled_monitors
> + * wwnr
> + * [root@f32 rv]# echo > enabled_monitors
> + * [root@f32 rv]# cat enabled_monitors
> + * [root@f32 rv]#
> + *
> + * Note that more than one monitor can be enabled concurrently.
> + *
> + * "monitoring_on"
> + * - It is an on/off general switcher for monitoring. Note
> + * that it does not disable enabled monitors, but stop the per-entity
> + * monitors of monitoring the events received from the system.
> + * It resambles the "tracing_on" switcher.
> + *
> + * "monitors/"
> + * Each monitor will have its one directory inside "monitors/". There
> + * the monitor specific files will be presented.
> + * The "monitors/" directory resambles the "events" directory on
> + * tracefs.
> + *
> + * For example:
> + * [root@f32 rv]# cd monitors/wip/
> + * [root@f32 wip]# ls
> + * desc enable
> + * [root@f32 wip]# cat desc
> + * auto-generated wakeup in preemptive monitor.
> + * [root@f32 wip]# cat enable
> + * 0
> + *
> + * Copyright (C) 2019-2022 Daniel Bristot de Oliveira <bristot@kernel.org>
> + */
> +
> +#include <linux/kernel.h>
> +#include <linux/module.h>
> +#include <linux/init.h>
> +#include <linux/slab.h>
> +#include <rv/rv.h>
> +
> +#include "rv.h"
> +
> +DEFINE_MUTEX(rv_interface_lock);
> +struct rv_interface rv_root;
> +
> +struct dentry *get_monitors_root(void)
> +{
> + return rv_root.monitors_dir;
> +}
> +
> +/*
> + * Monitoring on global switcher!
> + */
> +bool __read_mostly monitoring_on;
> +
> +/*
> + * Interface for the monitor register.
> + */
> +LIST_HEAD(rv_monitors_list);
> +
> +static int task_monitor_count;
> +static bool task_monitor_slots[RV_PER_TASK_MONITORS];
> +
> +int get_task_monitor_slot(void)
> +{
> + int i;
> +
> + lockdep_assert_held(&rv_interface_lock);
> +
> + if (task_monitor_count == RV_PER_TASK_MONITORS)
> + return -EBUSY;
> +
> + task_monitor_count++;
> +
> + for (i = 0; i < RV_PER_TASK_MONITORS; i++) {
> + if (task_monitor_slots[i] == false) {
> + task_monitor_slots[i] = true;
> + return i;
> + }
> + }
> +
> + WARN_ONCE(1, "RV task_monitor_cout and slots are out of sync\n");
> +
> + return -EINVAL;
> +}
> +
> +void put_task_monitor_slot(int slot)
> +{
> + lockdep_assert_held(&rv_interface_lock);
> +
> + if (slot < 0 || slot > RV_PER_TASK_MONITORS) {
> + WARN_ONCE(1, "RV releasing an invlid slot!: %d\n", slot);
> + return;
> + }
> +
> + WARN_ONCE(!task_monitor_slots[slot], "RV releasing unsused task_monitor_slots: %d\n",
> + slot);
> +
> + task_monitor_count--;
> + task_monitor_slots[slot] = false;
> +}
> +
> +/*
> + * This section collects the monitor/ files and folders.
> + */
> +static ssize_t monitor_enable_read_data(struct file *filp,
> + char __user *user_buf,
> + size_t count, loff_t *ppos)
> +{
> + struct rv_monitor_def *mdef = filp->private_data;
> + char buff[4];
> +
> + memset(buff, 0, sizeof(buff));
> +
> + mutex_lock(&rv_interface_lock);
> + sprintf(buff, "%x\n", mdef->monitor->enabled);
> + mutex_unlock(&rv_interface_lock);
> +
> + return simple_read_from_buffer(user_buf, count, ppos,
> + buff, strlen(buff)+1);
> +}
> +
> +/*
> + * Disable a given runtime monitor.
> + */
> +static int disable_monitor(struct rv_monitor_def *mdef)
> +{
> + if (mdef->monitor->enabled) {
> + mdef->monitor->enabled = 0;
> + mdef->monitor->stop();
> + }
> +
> + mdef->enabled = 0;
> + return 0;
> +}
> +
> +/*
> + * Enable a given monitor.
> + */
> +static int enable_monitor(struct rv_monitor_def *mdef)
> +{
> + int retval;
> +
> + /*
> + * Reset all internal monitors before starting.
> + */
> + mdef->monitor->reset();
> + if (!mdef->monitor->enabled) {
> + retval = mdef->monitor->start();
> + if (retval)
> + return retval;
> + }
> +
> + mdef->monitor->enabled = 1;
> + mdef->enabled = 1;
> +
> + return 0;
> +}
> +
> +/*
> + * interface for enabling/disabling a monitor.
> + */
> +static ssize_t monitor_enable_write_data(struct file *filp,
> + const char __user *user_buf,
> + size_t count, loff_t *ppos)
> +{
> + struct rv_monitor_def *mdef = filp->private_data;
> + int retval;
> + u64 val;
> +
> + retval = kstrtoull_from_user(user_buf, count, 10, &val);
> + if (retval)
> + return retval;
> +
> + retval = count;
> +
> + mutex_lock(&rv_interface_lock);
> +
> + switch (val) {
> + case 0:
> + retval = disable_monitor(mdef);
> + break;
> + case 1:
> + retval = enable_monitor(mdef);
> + break;
> + default:
> + retval = -EINVAL;
> + }
> +
> + mutex_unlock(&rv_interface_lock);
> +
> + return retval;
> +}
> +
> +static const struct file_operations interface_enable_fops = {
> + .open = simple_open,
> + .llseek = no_llseek,
> + .write = monitor_enable_write_data,
> + .read = monitor_enable_read_data,
> +};
> +
> +/*
> + * Interface to read the enable/disable status of a monitor.
> + */
> +static ssize_t
> +monitor_desc_read_data(struct file *filp, char __user *user_buf,
> + size_t count, loff_t *ppos)
> +{
> + struct rv_monitor_def *mdef = filp->private_data;
> + char buf[MAX_RV_MONITOR_NAME_SIZE];
> +
> + memset(buf, 0, sizeof(buf));
> +
> + mutex_lock(&rv_interface_lock);
> + sprintf(buf, "%s\n", mdef->monitor->description);
> + mutex_unlock(&rv_interface_lock);
> +
> + return simple_read_from_buffer(user_buf, count, ppos,
> + buf, strlen(buf)+1);
> +}
> +
> +static const struct file_operations interface_desc_fops = {
> + .open = simple_open,
> + .llseek = no_llseek,
> + .read = monitor_desc_read_data,
> +};
> +
> +/*
> + * During the registration of a monitor, this function creates
> + * the monitor dir, where the specific options of the monitor
> + * is exposed.
> + */
> +static int create_monitor_dir(struct rv_monitor_def *mdef)
> +{
> + struct dentry *root = get_monitors_root();
> + struct dentry *tmp;
> + const char *name = mdef->monitor->name;
> + int retval = 0;
> +
> + mdef->root_d = rv_create_dir(name, root);
> +
> + if (!mdef->root_d)
> + return -ENOMEM;
> +
> + tmp = rv_create_file("enable", 0600,
> + mdef->root_d, mdef,
> + &interface_enable_fops);
> + if (!tmp) {
> + retval = -ENOMEM;
> + goto out_remove_root;
> + }
> +
> + tmp = rv_create_file("desc", 0400,
> + mdef->root_d, mdef,
> + &interface_desc_fops);
> + if (!tmp) {
> + retval = -ENOMEM;
> + goto out_remove_root;
> + }
> +
> + return retval;
> +
> +out_remove_root:
> + rv_remove(mdef->root_d);
> + return retval;
> +}
> +
> +/*
> + * Available/Enable monitor shared seq functions.
> + */
> +static int monitors_show(struct seq_file *m, void *p)
> +{
> + struct rv_monitor_def *mon_def = p;
> +
> + seq_printf(m, "%s\n", mon_def->monitor->name);
> + return 0;
> +}
> +
> +/*
> + * Used by the seq file operations at the end of a read
> + * operation.
> + */
> +static void monitors_stop(struct seq_file *m, void *p)
> +{
> + mutex_unlock(&rv_interface_lock);
> +}
> +
> +/*
> + * Available monitor seq functions:
> + */
> +static void *available_monitors_start(struct seq_file *m, loff_t *pos)
> +{
> + mutex_lock(&rv_interface_lock);
> + return seq_list_start(&rv_monitors_list, *pos);
> +}
> +
> +static void *available_monitors_next(struct seq_file *m, void *p, loff_t *pos)
> +{
> + return seq_list_next(p, &rv_monitors_list, pos);
> +}
> +
> +/*
> + * Enable monitor seq functions:
> + */
> +
> +static void *enabled_monitors_next(struct seq_file *m, void *p, loff_t *pos)
> +{
> + struct rv_monitor_def *m_def = p;
> +
> + (*pos)++;
> +
> + list_for_each_entry_continue(m_def, &rv_monitors_list, list) {
> + if (m_def->monitor->enabled)
> + return m_def;
> + }
> +
> + return NULL;
> +}
> +
> +static void *enabled_monitors_start(struct seq_file *m, loff_t *pos)
> +{
> + struct rv_monitor_def *m_def;
> + loff_t l;
> +
> + mutex_lock(&rv_interface_lock);
> + m_def = list_entry(&rv_monitors_list, struct rv_monitor_def, list);
I realized this m_def is not real but vain. Is it possible the loop is
skiped and just return m_def that is not valid.
> + for (l = 0; l <= *pos; ) {
> + m_def = enabled_monitors_next(m, m_def, &l);
> + if (!m_def)
> + break;
> + }
> +
> + return m_def;
> +}
> +
> +/*
> + * available/enabled monitors seq definition.
> + */
> +static const struct seq_operations available_monitors_seq_ops = {
> + .start = available_monitors_start,
> + .next = available_monitors_next,
> + .stop = monitors_stop,
> + .show = monitors_show
> +};
> +
> +static const struct seq_operations enabled_monitors_seq_ops = {
> + .start = enabled_monitors_start,
> + .next = enabled_monitors_next,
> + .stop = monitors_stop,
> + .show = monitors_show
> +};
> +
> +/*
> + * available_monitors interface.
> + */
> +static int available_monitors_open(struct inode *inode, struct file *file)
> +{
> + return seq_open(file, &available_monitors_seq_ops);
> +};
> +
> +static const struct file_operations available_monitors_ops = {
> + .open = available_monitors_open,
> + .read = seq_read,
> + .llseek = seq_lseek,
> + .release = seq_release
> +};
> +
> +/*
> + * enabled_monitors interface
> + */
> +static void disable_all_monitors(void)
> +{
> + struct rv_monitor_def *mdef;
> +
> + list_for_each_entry(mdef, &rv_monitors_list, list)
> + disable_monitor(mdef);
> +}
> +
> +static int enabled_monitors_open(struct inode *inode, struct file *file)
> +{
> + if ((file->f_mode & FMODE_WRITE) && (file->f_flags & O_TRUNC))
> + disable_all_monitors();
> +
> + return seq_open(file, &enabled_monitors_seq_ops);
> +};
> +
> +static ssize_t
> +enabled_monitors_write(struct file *filp, const char __user *user_buf,
> + size_t count, loff_t *ppos)
> +{
> + char buff[MAX_RV_MONITOR_NAME_SIZE+1];
> + struct rv_monitor_def *mdef;
> + int retval = -EINVAL;
> + bool enable = true;
> + char *ptr = buff;
> + int len;
> +
> + if (count < 1 || count > MAX_RV_MONITOR_NAME_SIZE+1)
> + return -EINVAL;
> +
> + memset(buff, 0, sizeof(buff));
> +
> + retval = simple_write_to_buffer(buff, sizeof(buff)-1, ppos, user_buf,
> + count);
> + if (!retval)
> + return -EFAULT;
> +
> + if (buff[0] == '!') {
> + enable = false;
> + ptr++;
> + }
> +
> + len = strlen(ptr);
> + if (!len)
> + return count;
> + /*
> + * remove \n
> + */
> + ptr[len-1] = '\0';
> +
> + mutex_lock(&rv_interface_lock);
> +
> + retval = -EINVAL;
> +
> + list_for_each_entry(mdef, &rv_monitors_list, list) {
> + if (strcmp(ptr, mdef->monitor->name) == 0) {
> + /*
> + * Monitor found!
> + */
> + if (enable)
> + retval = enable_monitor(mdef);
> + else
> + retval = disable_monitor(mdef);
> +
> + if (retval)
> + goto out;
> +
> + /*
> + * Success!
> + */
> + retval = count;
> + break;
> + }
> + }
> +
> +out:
> + mutex_unlock(&rv_interface_lock);
> + return retval;
> +}
> +
> +static const struct file_operations enabled_monitors_ops = {
> + .open = enabled_monitors_open,
> + .read = seq_read,
> + .write = enabled_monitors_write,
> + .llseek = seq_lseek,
> + .release = seq_release,
> +};
> +
> +/*
> + * monitoring_on general switcher
> + */
> +static ssize_t monitoring_on_read_data(struct file *filp,
> + char __user *user_buf,
> + size_t count, loff_t *ppos)
> +{
> + char buff[4];
> +
> + memset(buff, 0, sizeof(buff));
> +
> + mutex_lock(&rv_interface_lock);
> + sprintf(buff, "%d\n", monitoring_on);
> + mutex_unlock(&rv_interface_lock);
> +
> + return simple_read_from_buffer(user_buf, count, ppos,
> + buff, strlen(buff)+1);
> +}
> +
> +static void turn_monitoring_off(void)
> +{
> + monitoring_on = false;
> +}
> +
> +static void turn_monitoring_on(void)
> +{
> + reset_all_monitors();
> + monitoring_on = true;
> +}
> +
> +static ssize_t monitoring_on_write_data(struct file *filp,
> + const char __user *user_buf,
> + size_t count, loff_t *ppos)
> +{
> + int retval;
> + u64 val;
> +
> + retval = kstrtoull_from_user(user_buf, count, 10, &val);
> + if (retval)
> + return retval;
> +
> + retval = count;
> +
> + mutex_lock(&rv_interface_lock);
> +
> + switch (val) {
> + case 0:
> + turn_monitoring_off();
> + break;
> + case 1:
> + turn_monitoring_on();
> + break;
> + default:
> + retval = -EINVAL;
> + }
> +
> + mutex_unlock(&rv_interface_lock);
> +
> + return retval;
> +}
> +
> +static const struct file_operations monitoring_on_fops = {
> + .open = simple_open,
> + .llseek = no_llseek,
> + .write = monitoring_on_write_data,
> + .read = monitoring_on_read_data,
> +};
> +
> +/*
> + * Monitor API.
> + */
> +static void destroy_monitor_dir(struct rv_monitor_def *mdef)
> +{
> + rv_remove(mdef->root_d);
> +}
> +
> +/**
> + * rv_register_monitor - register a rv monitor.
> + * @monitor: The rv_monitor to be registered.
> + *
> + * Returns 0 if successful, error otherwise.
> + */
> +int rv_register_monitor(struct rv_monitor *monitor)
> +{
> + struct rv_monitor_def *r;
> + int retval = 0;
> +
> + if (strlen(monitor->name) >= MAX_RV_MONITOR_NAME_SIZE) {
> + pr_info("Monitor %s has a name longer than %d\n",
> + monitor->name, MAX_RV_MONITOR_NAME_SIZE);
> + return -1;
> + }
> +
> + mutex_lock(&rv_interface_lock);
> +
> + list_for_each_entry(r, &rv_monitors_list, list) {
> + if (strcmp(monitor->name, r->monitor->name) == 0) {
> + pr_info("Monitor %s is already registered\n",
> + monitor->name);
> + retval = -1;
> + goto out_unlock;
> + }
> + }
> +
> + r = kzalloc(sizeof(struct rv_monitor_def), GFP_KERNEL);
> + if (!r) {
> + retval = -ENOMEM;
> + goto out_unlock;
> + }
> +
> + r->monitor = monitor;
> +
> + create_monitor_dir(r);
> +
> + list_add_tail(&r->list, &rv_monitors_list);
> +
> +out_unlock:
> + mutex_unlock(&rv_interface_lock);
> + return retval;
> +}
> +
> +/**
> + * rv_unregister_monitor - unregister a rv monitor.
> + * @monitor: The rv_monitor to be unregistered.
> + *
> + * Returns 0 if successful, error otherwise.
> + */
> +int rv_unregister_monitor(struct rv_monitor *monitor)
> +{
> + struct rv_monitor_def *ptr, *next;
> +
> + mutex_lock(&rv_interface_lock);
> +
> + list_for_each_entry_safe(ptr, next, &rv_monitors_list, list) {
> + if (strcmp(monitor->name, ptr->monitor->name) == 0) {
> + list_del(&ptr->list);
> + destroy_monitor_dir(ptr);
> + }
> + }
> +
> + mutex_unlock(&rv_interface_lock);
> + return 0;
> +}
> +
> +void reset_all_monitors(void)
> +{
> + struct rv_monitor_def *mdef;
> +
> + /*
> + * Reset all monitors before re-enabling monitoring.
> + */
> + list_for_each_entry(mdef, &rv_monitors_list, list) {
> + if (mdef->monitor->enabled)
> + mdef->monitor->reset();
> + }
> +
> +}
> +
> +int __init rv_init_interface(void)
> +{
> + rv_root.root_dir = rv_create_dir("rv", NULL);
> + rv_root.monitors_dir = rv_create_dir("monitors", rv_root.root_dir);
> +
> + rv_create_file("available_monitors", 0400, rv_root.root_dir, NULL,
> + &available_monitors_ops);
> + rv_create_file("enabled_monitors", 0600, rv_root.root_dir, NULL,
> + &enabled_monitors_ops);
> + rv_create_file("monitoring_on", 0600, rv_root.root_dir, NULL,
> + &monitoring_on_fops);
> +
> + monitoring_on = true;
> +
> + return 0;
> +}
> diff --git a/kernel/trace/rv/rv.h b/kernel/trace/rv/rv.h
> new file mode 100644
> index 000000000000..0796867a7b1e
> --- /dev/null
> +++ b/kernel/trace/rv/rv.h
> @@ -0,0 +1,34 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +#include <linux/mutex.h>
> +
> +struct rv_interface {
> + struct dentry *root_dir;
> + struct dentry *monitors_dir;
> +};
> +
> +#include "../trace.h"
> +#include <linux/tracefs.h>
> +#include <linux/rv.h>
> +
> +#define rv_create_dir tracefs_create_dir
> +#define rv_create_file tracefs_create_file
> +#define rv_remove tracefs_remove
> +
> +#define MAX_RV_MONITOR_NAME_SIZE 32
> +
> +extern struct mutex rv_interface_lock;
> +
> +struct rv_monitor_def {
> + struct list_head list;
> + struct rv_monitor *monitor;
> + struct dentry *root_d;
> + bool enabled;
> + bool task_monitor;
> +};
> +
> +extern bool monitoring_on;
> +struct dentry *get_monitors_root(void);
> +void reset_all_monitors(void);
> +int init_rv_monitors(struct dentry *root_dir);
> +int get_task_monitor_slot(void);
> +void put_task_monitor_slot(int slot);
> diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
> index 2c95992e2c71..60e357c3120b 100644
> --- a/kernel/trace/trace.c
> +++ b/kernel/trace/trace.c
> @@ -9774,6 +9774,10 @@ static __init int tracer_init_tracefs(void)
> tracer_init_tracefs_work_func(NULL);
> }
>
> +#ifdef CONFIG_RV
> + rv_init_interface();
> +#endif
> +
> return 0;
> }
>
> diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
> index ff816fb41e48..becc03c0a45e 100644
> --- a/kernel/trace/trace.h
> +++ b/kernel/trace/trace.h
> @@ -2005,4 +2005,6 @@ struct trace_min_max_param {
>
> extern const struct file_operations trace_min_max_fops;
>
> +extern int rv_init_interface(void);
> +
> #endif /* _LINUX_KERNEL_TRACE_H */
> --
> 2.35.1
>
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 01/20] rv: Add Runtime Verification (RV) interface
2022-07-06 17:49 ` Tao Zhou
@ 2022-07-06 17:53 ` Matthew Wilcox
2022-07-08 15:36 ` Tao Zhou
2022-07-08 14:39 ` Daniel Bristot de Oliveira
1 sibling, 1 reply; 82+ messages in thread
From: Matthew Wilcox @ 2022-07-06 17:53 UTC (permalink / raw)
To: Tao Zhou
Cc: Daniel Bristot de Oliveira, Steven Rostedt, Wim Van Sebroeck,
Guenter Roeck, Jonathan Corbet, Ingo Molnar, Thomas Gleixner,
Peter Zijlstra, Will Deacon, Catalin Marinas, Marco Elver,
Dmitry Vyukov, Paul E. McKenney, Shuah Khan, Gabriele Paoloni,
Juri Lelli, Clark Williams, linux-doc, linux-kernel,
linux-trace-devel
On Thu, Jul 07, 2022 at 01:49:02AM +0800, Tao Zhou wrote:
> > +struct rv_monitor {
> > + const char *name;
> > + const char *description;
> > + bool enabled;
>
> Can the 'bool enabled;' be put at the end like the definition of
> structure rv_monitor_def. If '8+8+sizeof(bool)+8+8+8' not the same
> as '8+8+8+8+8+sizeof(bool)', I mean is it possible that after the
> end of stucture there is a int or char not require to align to 8 as
> an example from my nonsense.
That will make no difference at all. C doesn't allow other variables
to "fill in the hole" at the end of the structure like that. For
example, one could legitimately do 'memset(&rvm, sizeof(rvm))',
and that would wipe out those other variables as well.
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 03/20] rv/include: Add helper functions for deterministic automata
2022-06-16 8:44 ` [PATCH V4 03/20] rv/include: Add helper functions for deterministic automata Daniel Bristot de Oliveira
2022-06-28 17:48 ` Steven Rostedt
@ 2022-07-06 18:35 ` Tao Zhou
2022-07-13 18:38 ` Daniel Bristot de Oliveira
1 sibling, 1 reply; 82+ messages in thread
From: Tao Zhou @ 2022-07-06 18:35 UTC (permalink / raw)
To: Daniel Bristot de Oliveira
Cc: Steven Rostedt, Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet,
Ingo Molnar, Thomas Gleixner, Peter Zijlstra, Will Deacon,
Catalin Marinas, Marco Elver, Dmitry Vyukov, Paul E. McKenney,
Shuah Khan, Gabriele Paoloni, Juri Lelli, Clark Williams,
linux-doc, linux-kernel, linux-trace-devel, Tao Zhou
On Thu, Jun 16, 2022 at 10:44:45AM +0200, Daniel Bristot de Oliveira wrote:
> Formally, a deterministic automaton, denoted by G, is defined as a
> quintuple:
>
> G = { X, E, f, x_0, X_m }
>
> where:
> - X is the set of states;
> - E is the finite set of events;
> - x_0 is the initial state;
> - X_m (subset of X) is the set of marked states.
> - f : X x E -> X $ is the transition function. It defines the
> state transition in the occurrence of a event from E in
> the state X. In the special case of deterministic automata,
> the occurrence of the event in E in a state in X has a
> deterministic next state from X.
>
> An automaton can also be represented using a graphical format of
> vertices (nodes) and edges. The open-source tool Graphviz can produce
> this graphic format using the (textual) DOT language as the source code.
>
> The dot2c tool presented in this paper:
>
> DE OLIVEIRA, Daniel Bristot; CUCINOTTA, Tommaso; DE OLIVEIRA, Romulo
> Silva. Efficient formal verification for the Linux kernel. In:
> International Conference on Software Engineering and Formal Methods.
> Springer, Cham, 2019. p. 315-332.
>
> Translates a deterministic automaton in the DOT format into a C
> surce code representation that to be used for monitoring.
>
> This header file implements helper functions to facilitate the usage
> of the C output from dot2c for monitoring.
>
> Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
> Cc: Guenter Roeck <linux@roeck-us.net>
> Cc: Jonathan Corbet <corbet@lwn.net>
> Cc: Steven Rostedt <rostedt@goodmis.org>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Peter Zijlstra <peterz@infradead.org>
> Cc: Will Deacon <will@kernel.org>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: Marco Elver <elver@google.com>
> Cc: Dmitry Vyukov <dvyukov@google.com>
> Cc: "Paul E. McKenney" <paulmck@kernel.org>
> Cc: Shuah Khan <skhan@linuxfoundation.org>
> Cc: Gabriele Paoloni <gpaoloni@redhat.com>
> Cc: Juri Lelli <juri.lelli@redhat.com>
> Cc: Clark Williams <williams@redhat.com>
> Cc: linux-doc@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> Cc: linux-trace-devel@vger.kernel.org
> Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
> ---
> include/rv/automata.h | 49 +++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 49 insertions(+)
> create mode 100644 include/rv/automata.h
>
> diff --git a/include/rv/automata.h b/include/rv/automata.h
> new file mode 100644
> index 000000000000..0c0aa54bd820
> --- /dev/null
> +++ b/include/rv/automata.h
> @@ -0,0 +1,49 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +/*
> + * Deterministic automata helper functions, to be used with the automata
> + * models in C generated by the dot2k tool.
> + *
> + * Copyright (C) 2019-2022 Daniel Bristot de Oliveira <bristot@kernel.org>
> + */
> +
> +#define DECLARE_AUTOMATA_HELPERS(name, type) \
> + \
> +static inline void *model_get_model_##name(void) \
> +{ \
> + return (void *) &automaton_##name; \
> +} \
> + \
> +static char *model_get_state_name_##name(enum states_##name state) \
> +{ \
> + return automaton_##name.state_names[state]; \
> +} \
> + \
> +static char *model_get_event_name_##name(enum events_##name event) \
> +{ \
> + return automaton_##name.event_names[event]; \
> +} \
> + \
> +static inline type model_get_init_state_##name(void) \
> +{ \
> + return automaton_##name.initial_state; \
> +} \
> + \
> +static inline type model_get_next_state_##name(enum states_##name curr_state, \
> + enum events_##name event) \
> +{ \
> + if ((curr_state < 0) || (curr_state > state_max_##name)) \
> + return -1; \
curr_state can not be state_max_xxx. curr_state must be not bigger
than state_max_xxx. Or am I miss something?
> + if ((event < 0) || (event > event_max_##name)) \
> + return -1; \
> + \
Same here for the event boundary check.
> + return automaton_##name.function[curr_state][event]; \
> +} \
> + \
> +static inline bool model_is_final_state_##name(enum states_##name state) \
> +{ \
> + if ((state < 0) || (state > state_max_##name)) \
> + return 0; \
> + \
Same here.
> + return !!automaton_##name.final_states[state]; \
If the value of .final_states[state] is 0 or 1, can the type of
.final_states[state] be befined to bool. Or not need to use !! to
explicitly transfer the type to bool. I remember that you define
this as char array and the matrix model value of this array is 0 or 1
see from the next patche. 1 delegate the state it is the initial state.
0 for others.
> +}
> --
> 2.35.1
>
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 04/20] rv/include: Add deterministic automata monitor definition via C macros
2022-06-16 8:44 ` [PATCH V4 04/20] rv/include: Add deterministic automata monitor definition via C macros Daniel Bristot de Oliveira
@ 2022-07-06 18:56 ` Tao Zhou
2022-07-13 18:39 ` Daniel Bristot de Oliveira
0 siblings, 1 reply; 82+ messages in thread
From: Tao Zhou @ 2022-07-06 18:56 UTC (permalink / raw)
To: Daniel Bristot de Oliveira
Cc: Steven Rostedt, Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet,
Ingo Molnar, Thomas Gleixner, Peter Zijlstra, Will Deacon,
Catalin Marinas, Marco Elver, Dmitry Vyukov, Paul E. McKenney,
Shuah Khan, Gabriele Paoloni, Juri Lelli, Clark Williams,
linux-doc, linux-kernel, linux-trace-devel, Tao Zhou
On Thu, Jun 16, 2022 at 10:44:46AM +0200, Daniel Bristot de Oliveira wrote:
> In Linux terms, the runtime verification monitors are encapsulated
> inside the "RV monitor" abstraction. The "RV monitor" includes a set
> of instances of the monitor (per-cpu monitor, per-task monitor, and
> so on), the helper functions that glue the monitor to the system
> reference model, and the trace output as a reaction for event parsing
> and exceptions, as depicted below:
>
> Linux +----- RV Monitor ----------------------------------+ Formal
> Realm | | Realm
> +-------------------+ +----------------+ +-----------------+
> | Linux kernel | | Monitor | | Reference |
> | Tracing | -> | Instance(s) | <- | Model |
> | (instrumentation) | | (verification) | | (specification) |
> +-------------------+ +----------------+ +-----------------+
> | | |
> | V |
> | +----------+ |
> | | Reaction | |
> | +--+--+--+-+ |
> | | | | |
> | | | +-> trace output ? |
> +------------------------|--|----------------------+
> | +----> panic ?
> +-------> <user-specified>
>
> The dot2c tool presented in this paper:
>
> DE OLIVEIRA, Daniel Bristot; CUCINOTTA, Tommaso; DE OLIVEIRA, Romulo
> Silva. Efficient formal verification for the Linux kernel. In:
> International Conference on Software Engineering and Formal Methods.
> Springer, Cham, 2019. p. 315-332.
>
> Translates a deterministic automaton in the DOT format into a C
> source code representation that to be used for monitoring connecting
> the Formal Reaml to Linux-like code.
>
> This header file goes beyond, extending the code generation to the
> verification stage, generating the code to the Monitor Instance(s)
> level using C macros. The trace event code inspires this approach.
>
> The benefits of the usage of macro for monitor synthesis is 3-fold:
>
> - Reduces the code duplication;
> - Facilitates the bug fix/improvement;
> (but mainly:)
> - Avoids the case of developers changing the core of the monitor
> code to manipulate the model in a (let's say) non-standard
> way.
>
> This initial implementation presents three different types of monitor
> instances:
>
> - #define DECLARE_DA_MON_GLOBAL(name, type)
> - #define DECLARE_DA_MON_PER_CPU(name, type)
> - #define DECLARE_DA_MON_PER_TASK(name, type)
>
> The first declares the functions for a global deterministic automata
> monitor, the second with per-cpu instances, and the third with
> per-task instances.
>
> In all cases, the name is a string that identifies the monitor,
> and the type is the data type used by dot2c/k on the representation
> of the model.
>
> For example, the model "wip" below:
>
> preempt_disable sched_waking
> +############+ >------------------> +################+ >------------+
> -># preemptive # # non-preemptive # |
> +############+ <-----------------< +################+ <------------+
> preempt_enable
>
> with two states and three events can be stored in a 'char' type.
> Considering that the preemption control is a per-cpu behavior, the
> monitor declaration will be:
>
> DECLARE_DA_MON_PER_CPU(wip, char);
>
> The monitor is executed by sending events to be processed via the
> functions presented below:
>
> da_handle_event_$(MONITOR_NAME)($(event from event enum));
> da_handle_init_event_$(MONITOR_NAME)($(event from event enum));
>
> The function da_handle_event_$(MONITOR_NAME) is the regular case,
> while the function da_handle_init_event_$(MONITOR_NAME)() is a
> special case used to synchronize the system with the model.
>
> When a monitor is enabled, it is placed in the initial state of the
> automata. However, the monitor does not know if the system is in
> the initial state. Hence, the monitor ignores events sent by
> sent by da_handle_event_$(MONITOR_NAME) until the function
> da_handle_init_event_$(MONITOR_NAME)() is called.
>
> The function da_handle_init_event_$(MONITOR_NAME)() should be used for
> the case in which the system generates the event is the one that returns
> the automata to the initial state.
>
> After receiving a da_handle_init_event_$(MONITOR_NAME)() event, the
> monitor will know that it is in sync with the system and hence will
> start processing the next events.
>
> Using the wip model as example, the events "preempt_disable" and
> "sched_waking" should be sent to monitor, respectively, via:
> da_handle_event_wip(preempt_disable);
> da_handle_event_wip(sched_waking);
>
> While the event "preempt_enabled" will use:
> da_handle_init_event_wip(preempt_enable);
>
> To notify the monitor that the system will be returning to the initial
> state, so the system and the monitor should be in sync.
>
> With the monitor synthesis in place, using these headers and dot2k,
> the developer's work should be limited to the instrumentation of
> the system, increasing the confidence in the overall approach.
>
> Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
> Cc: Guenter Roeck <linux@roeck-us.net>
> Cc: Jonathan Corbet <corbet@lwn.net>
> Cc: Steven Rostedt <rostedt@goodmis.org>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Peter Zijlstra <peterz@infradead.org>
> Cc: Will Deacon <will@kernel.org>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: Marco Elver <elver@google.com>
> Cc: Dmitry Vyukov <dvyukov@google.com>
> Cc: "Paul E. McKenney" <paulmck@kernel.org>
> Cc: Shuah Khan <skhan@linuxfoundation.org>
> Cc: Gabriele Paoloni <gpaoloni@redhat.com>
> Cc: Juri Lelli <juri.lelli@redhat.com>
> Cc: Clark Williams <williams@redhat.com>
> Cc: linux-doc@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> Cc: linux-trace-devel@vger.kernel.org
> Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
> ---
> include/linux/rv.h | 2 +
> include/rv/da_monitor.h | 419 ++++++++++++++++++++++++++++++++++++++
> include/rv/rv.h | 9 +
> include/trace/events/rv.h | 120 +++++++++++
> kernel/fork.c | 2 +-
> kernel/trace/rv/Kconfig | 14 ++
> kernel/trace/rv/rv.c | 5 +
> 7 files changed, 570 insertions(+), 1 deletion(-)
> create mode 100644 include/rv/da_monitor.h
> create mode 100644 include/trace/events/rv.h
>
> diff --git a/include/linux/rv.h b/include/linux/rv.h
> index 1e48c6bb74bf..af2081671219 100644
> --- a/include/linux/rv.h
> +++ b/include/linux/rv.h
> @@ -9,6 +9,8 @@
> #ifndef _LINUX_RV_H
> #define _LINUX_RV_H
>
> +#define MAX_DA_NAME_LEN 24
> +
> struct rv_reactor {
> char *name;
> char *description;
> diff --git a/include/rv/da_monitor.h b/include/rv/da_monitor.h
> new file mode 100644
> index 000000000000..043660429659
> --- /dev/null
> +++ b/include/rv/da_monitor.h
> @@ -0,0 +1,419 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +/*
> + * Deterministic automata (DA) monitor functions, to be used togheter
> + * with automata models in C generated by the dot2k tool.
> + *
> + * The dot2k tool is available at tools/tracing/rv/
> + *
> + * Copyright (C) 2019-2022 Daniel Bristot de Oliveira <bristot@kernel.org>
> + */
> +
> +#include <rv/automata.h>
> +#include <linux/rv.h>
> +
> +/*
> + * Generic helpers for all types of deterministic automata monitors.
> + */
> +#define DECLARE_DA_MON_GENERIC_HELPERS(name, type) \
> +static char REACT_MSG[1024]; \
> + \
> +static inline char \
> +*format_react_msg(type curr_state, type event) \
Not seperate char * into tow lines seems to be comfortable to me.
> +{ \
> + snprintf(REACT_MSG, 1024, \
> + "rv: monitor %s does not allow event %s on state %s\n", \
> + MODULE_NAME, \
> + model_get_event_name_##name(event), \
> + model_get_state_name_##name(curr_state)); \
> + return REACT_MSG; \
> +} \
> + \
> +static void cond_react(char *msg) \
> +{ \
> + if (rv_##name.react) \
> + rv_##name.react(msg); \
> +} \
> + \
> +static inline void da_monitor_reset_##name(struct da_monitor *da_mon) \
> +{ \
> + da_mon->monitoring = 0; \
> + da_mon->curr_state = model_get_init_state_##name(); \
> +} \
> + \
> +static inline type da_monitor_curr_state_##name(struct da_monitor *da_mon) \
> +{ \
> + return da_mon->curr_state; \
> +} \
> + \
> +static inline void \
> +da_monitor_set_state_##name(struct da_monitor *da_mon, enum states_##name state)\
> +{ \
> + da_mon->curr_state = state; \
> +} \
> +static inline void da_monitor_start_##name(struct da_monitor *da_mon) \
> +{ \
> + da_mon->monitoring = 1; \
> +} \
> + \
> +static inline bool da_monitoring_##name(struct da_monitor *da_mon) \
> +{ \
> + return da_mon->monitoring; \
> +}
> +
> +
> +/*
> + * Event handler for implict monitors. Implicity monitor is the one which the
> + * handler does not need to specify which da_monitor to manilupulate. Examples
> + * of implicit monitor are the per_cpu or the global ones.
> + */
> +#define DECLARE_DA_MON_MODEL_HANDLER_IMPLICIT(name, type) \
> +static inline bool \
> +da_event_##name(struct da_monitor *da_mon, enum events_##name event) \
> +{ \
> + type curr_state = da_monitor_curr_state_##name(da_mon); \
> + type next_state = model_get_next_state_##name(curr_state, event); \
> + \
> + if (next_state >= 0) { \
> + da_monitor_set_state_##name(da_mon, next_state); \
> + \
> + trace_event_##name(model_get_state_name_##name(curr_state), \
> + model_get_event_name_##name(event), \
> + model_get_state_name_##name(next_state), \
> + model_is_final_state_##name(next_state)); \
> + \
> + return true; \
> + } \
> + \
> + if (reacting_on) \
> + cond_react(format_react_msg(curr_state, event)); \
> + \
> + trace_error_##name(model_get_state_name_##name(curr_state), \
> + model_get_event_name_##name(event)); \
> + \
> + return false; \
> +} \
> +
> +/*
> + * Event handler for per_task monitors.
> + */
> +#define DECLARE_DA_MON_MODEL_HANDLER_PER_TASK(name, type) \
> +static inline type \
> +da_event_##name(struct da_monitor *da_mon, struct task_struct *tsk, \
> + enum events_##name event) \
> +{ \
> + type curr_state = da_monitor_curr_state_##name(da_mon); \
> + type next_state = model_get_next_state_##name(curr_state, event); \
> + \
> + if (next_state >= 0) { \
> + da_monitor_set_state_##name(da_mon, next_state); \
> + \
> + trace_event_##name(tsk->pid, \
> + model_get_state_name_##name(curr_state), \
> + model_get_event_name_##name(event), \
> + model_get_state_name_##name(next_state), \
> + model_is_final_state_##name(next_state)); \
> + \
> + return true; \
> + } \
> + \
> + if (reacting_on) \
> + cond_react(format_react_msg(curr_state, event)); \
> + \
> + trace_error_##name(tsk->pid, \
> + model_get_state_name_##name(curr_state), \
> + model_get_event_name_##name(event)); \
> + \
> + return false; \
> +}
> +
> +/*
> + * Functions to define, init and get a global monitor.
> + */
> +#define DECLARE_DA_MON_INIT_GLOBAL(name, type) \
> + \
> +static struct da_monitor da_mon_##name; \
> + \
> +static struct da_monitor *da_get_monitor_##name(void) \
> +{ \
> + return &da_mon_##name; \
> +} \
> + \
> +static void da_monitor_reset_all_##name(void) \
> +{ \
> + da_monitor_reset_##name(da_mon_##name); \
> +} \
> + \
> +static inline int da_monitor_init_##name(void) \
> +{ \
> + struct da_monitor *da_mon = &da_mon_##name \
> + da_mon->curr_state = model_get_init_state_##name(); \
> + da_mon->monitoring = 0; \
> + return 0; \
> +} \
> + \
> +static inline void da_monitor_destroy_##name(void) \
> +{ \
> + return; \
> +}
> +
> +/*
> + * Functions to define, init and get a per-cpu monitor.
> + */
> +#define DECLARE_DA_MON_INIT_PER_CPU(name, type) \
> + \
> +DEFINE_PER_CPU(struct da_monitor, da_mon_##name); \
> + \
> +static struct da_monitor *da_get_monitor_##name(void) \
> +{ \
> + return this_cpu_ptr(&da_mon_##name); \
> +} \
> + \
> +static void da_monitor_reset_all_##name(void) \
> +{ \
> + struct da_monitor *da_mon; \
> + int cpu; \
> + for_each_cpu(cpu, cpu_online_mask) { \
> + da_mon = per_cpu_ptr(&da_mon_##name, cpu); \
> + da_monitor_reset_##name(da_mon); \
> + } \
> +} \
> + \
> +static inline int da_monitor_init_##name(void) \
> +{ \
> + struct da_monitor *da_mon; \
> + int cpu; \
> + for_each_cpu(cpu, cpu_online_mask) { \
> + da_mon = per_cpu_ptr(&da_mon_##name, cpu); \
> + da_mon->curr_state = model_get_init_state_##name(); \
> + da_mon->monitoring = 0; \
> + } \
> + return 0; \
> +} \
> + \
> +static inline void da_monitor_destroy_##name(void) \
> +{ \
> + return; \
> +}
> +
> +/*
> + * Functions to define, init and get a per-task monitor.
> + */
> +#define DECLARE_DA_MON_INIT_PER_TASK(name, type) \
> + \
> +static int task_mon_slot_##name = RV_PER_TASK_MONITOR_INIT; \
> + \
> +static inline struct da_monitor *da_get_monitor_##name(struct task_struct *tsk) \
> +{ \
> + return &tsk->rv[task_mon_slot_##name].da_mon; \
> +} \
> + \
> +static void da_monitor_reset_all_##name(void) \
> +{ \
> + struct task_struct *g, *p; \
> + \
> + read_lock(&tasklist_lock); \
> + for_each_process_thread(g, p) \
> + da_monitor_reset_##name(da_get_monitor_##name(p)); \
> + read_unlock(&tasklist_lock); \
> +} \
> + \
> +static int da_monitor_init_##name(void) \
> +{ \
> + struct da_monitor *da_mon; \
> + struct task_struct *g, *p; \
> + int retval; \
> + \
> + retval = get_task_monitor_slot(); \
> + if (retval < 0) \
> + return retval; \
> + \
> + task_mon_slot_##name = retval; \
> + \
> + read_lock(&tasklist_lock); \
> + for_each_process_thread(g, p) { \
> + da_mon = da_get_monitor_##name(p); \
> + da_mon->curr_state = model_get_init_state_##name(); \
> + da_mon->monitoring = 0; \
> + } \
> + read_unlock(&tasklist_lock); \
> + \
> + return 0; \
> +} \
> + \
> +static inline void da_monitor_destroy_##name(void) \
> +{ \
> + if (task_mon_slot_##name == RV_PER_TASK_MONITOR_INIT) { \
> + WARN_ONCE(1, "Disabling a disabled monitor: " #name); \
> + return; \
> + } \
> + put_task_monitor_slot(task_mon_slot_##name); \
> + return; \
> +}
> +
> +/*
> + * Handle event for implicit monitor: da_get_monitor_##name() will figure out
> + * the monitor.
> + */
> +#define DECLARE_DA_MON_MONITOR_HANDLER_IMPLICIT(name, type) \
> + \
> +static inline void __da_handle_event_##name(struct da_monitor *da_mon, \
> + enum events_##name event) \
> +{ \
> + int retval; \
> + \
> + if (unlikely(!monitoring_on)) \
> + return; \
> + \
> + if (unlikely(!rv_##name.enabled)) \
> + return; \
> + \
> + if (unlikely(!da_monitoring_##name(da_mon))) \
> + return; \
> + \
> + retval = da_event_##name(da_mon, event); \
> + \
> + if (!retval) \
> + da_monitor_reset_##name(da_mon); \
> +} \
> + \
> +static inline void da_handle_event_##name(enum events_##name event) \
> +{ \
> + struct da_monitor *da_mon = da_get_monitor_##name(); \
> + __da_handle_event_##name(da_mon, event); \
> +} \
> + \
> +static inline bool da_handle_init_event_##name(enum events_##name event) \
> +{ \
> + struct da_monitor *da_mon; \
> + \
> + if (unlikely(!rv_##name.enabled)) \
> + return false; \
> + \
> + da_mon = da_get_monitor_##name(); \
> + \
> + if (unlikely(!da_monitoring_##name(da_mon))) { \
> + da_monitor_start_##name(da_mon); \
> + return false; \
> + } \
> + \
> + __da_handle_event_##name(da_mon, event); \
> + \
> + return true; \
> +} \
> + \
> +static inline bool da_handle_init_run_event_##name(enum events_##name event) \
> +{ \
> + struct da_monitor *da_mon; \
> + \
> + if (unlikely(!rv_##name.enabled)) \
> + return false; \
> + \
> + da_mon = da_get_monitor_##name(); \
> + \
> + if (unlikely(!da_monitoring_##name(da_mon))) \
> + da_monitor_start_##name(da_mon); \
> + \
> + __da_handle_event_##name(da_mon, event); \
> + \
> + return true; \
> +}
> +
> +/*
> + * Handle event for per task.
> + */
> +#define DECLARE_DA_MON_MONITOR_HANDLER_PER_TASK(name, type) \
> + \
> +static inline void \
> +__da_handle_event_##name(struct da_monitor *da_mon, struct task_struct *tsk, \
> + enum events_##name event) \
> +{ \
> + int retval; \
> + \
> + if (unlikely(!monitoring_on)) \
> + return; \
> + \
> + if (unlikely(!rv_##name.enabled)) \
> + return; \
> + \
> + if (unlikely(!da_monitoring_##name(da_mon))) \
> + return; \
> + \
> + retval = da_event_##name(da_mon, tsk, event); \
> + \
> + if (!retval) \
> + da_monitor_reset_##name(da_mon); \
> +} \
> + \
> +static inline void \
> +da_handle_event_##name(struct task_struct *tsk, enum events_##name event) \
> +{ \
> + struct da_monitor *da_mon = da_get_monitor_##name(tsk); \
> + __da_handle_event_##name(da_mon, tsk, event); \
> +} \
> + \
> +static inline bool \
> +da_handle_init_event_##name(struct task_struct *tsk, enum events_##name event) \
> +{ \
> + struct da_monitor *da_mon; \
> + \
> + if (unlikely(!rv_##name.enabled)) \
> + return false; \
> + \
> + da_mon = da_get_monitor_##name(tsk); \
> + \
> + if (unlikely(!da_monitoring_##name(da_mon))) { \
> + da_monitor_start_##name(da_mon); \
> + return false; \
> + } \
> + \
> + __da_handle_event_##name(da_mon, tsk, event); \
> + \
> + return true; \
> +}
> +
> +/*
> + * Entry point for the global monitor.
> + */
> +#define DECLARE_DA_MON_GLOBAL(name, type) \
> + \
> +DECLARE_AUTOMATA_HELPERS(name, type); \
> + \
> +DECLARE_DA_MON_GENERIC_HELPERS(name, type); \
> + \
> +DECLARE_DA_MON_MODEL_HANDLER_IMPLICIT(name, type); \
> + \
> +DECLARE_DA_MON_INIT_PER_CPU(name, type); \
Why the global monitor declaration use the per-cpu monitor macro.
Global monitor has its own DECLARE_DA_MON_INIT_GLOBAL(name, type);
Or am I miss something?
> + \
> +DECLARE_DA_MON_MONITOR_HANDLER_IMPLICIT(name, type);
> +
> +
> +/*
> + * Entry point for the per-cpu monitor.
> + */
> +#define DECLARE_DA_MON_PER_CPU(name, type) \
> + \
> +DECLARE_AUTOMATA_HELPERS(name, type); \
> + \
> +DECLARE_DA_MON_GENERIC_HELPERS(name, type); \
> + \
> +DECLARE_DA_MON_MODEL_HANDLER_IMPLICIT(name, type); \
> + \
> +DECLARE_DA_MON_INIT_PER_CPU(name, type); \
> + \
> +DECLARE_DA_MON_MONITOR_HANDLER_IMPLICIT(name, type);
> +
> +
> +/*
> + * Entry point for the per-task monitor.
> + */
> +#define DECLARE_DA_MON_PER_TASK(name, type) \
> + \
> +DECLARE_AUTOMATA_HELPERS(name, type); \
> + \
> +DECLARE_DA_MON_GENERIC_HELPERS(name, type); \
> + \
> +DECLARE_DA_MON_MODEL_HANDLER_PER_TASK(name, type); \
> + \
> +DECLARE_DA_MON_INIT_PER_TASK(name, type); \
> + \
> +DECLARE_DA_MON_MONITOR_HANDLER_PER_TASK(name, type);
> diff --git a/include/rv/rv.h b/include/rv/rv.h
> index 27a108881d35..b0658cdc53d9 100644
> --- a/include/rv/rv.h
> +++ b/include/rv/rv.h
> @@ -3,6 +3,14 @@
> #ifndef _RV_RV_H
> #define _RV_RV_H
>
> +/*
> + * Deterministic automaton per-object variables.
> + */
> +struct da_monitor {
> + bool monitoring;
> + int curr_state;
> +};
> +
> /*
> * Per-task RV monitors count. Nowadays fixed in RV_PER_TASK_MONITORS.
> * If we find justification for more monitors, we can think about
> @@ -16,6 +24,7 @@
> * Futher monitor types are expected, so make this a union.
> */
> union rv_task_monitor {
> + struct da_monitor da_mon;
> };
>
> int get_task_monitor_slot(void);
> diff --git a/include/trace/events/rv.h b/include/trace/events/rv.h
> new file mode 100644
> index 000000000000..9f40f2a49f84
> --- /dev/null
> +++ b/include/trace/events/rv.h
> @@ -0,0 +1,120 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +#undef TRACE_SYSTEM
> +#define TRACE_SYSTEM rv
> +
> +#if !defined(_TRACE_RV_H) || defined(TRACE_HEADER_MULTI_READ)
> +#define _TRACE_RV_H
> +
> +#include <linux/rv.h>
> +#include <linux/tracepoint.h>
> +
> +#ifdef CONFIG_DA_MON_EVENTS_IMPLICIT
> +DECLARE_EVENT_CLASS(event_da_monitor,
> +
> + TP_PROTO(char *state, char *event, char *next_state, bool safe),
> +
> + TP_ARGS(state, event, next_state, safe),
> +
> + TP_STRUCT__entry(
> + __array( char, state, MAX_DA_NAME_LEN )
> + __array( char, event, MAX_DA_NAME_LEN )
> + __array( char, next_state, MAX_DA_NAME_LEN )
> + __field( bool, safe )
> + ),
> +
> + TP_fast_assign(
> + memcpy(__entry->state, state, MAX_DA_NAME_LEN);
> + memcpy(__entry->event, event, MAX_DA_NAME_LEN);
> + memcpy(__entry->next_state, next_state, MAX_DA_NAME_LEN);
> + __entry->safe = safe;
> + ),
> +
> + TP_printk("%s x %s -> %s %s",
> + __entry->state,
> + __entry->event,
> + __entry->next_state,
> + __entry->safe ? "(safe)" : "")
> +);
> +
> +DECLARE_EVENT_CLASS(error_da_monitor,
> +
> + TP_PROTO(char *state, char *event),
> +
> + TP_ARGS(state, event),
> +
> + TP_STRUCT__entry(
> + __array( char, state, MAX_DA_NAME_LEN )
> + __array( char, event, MAX_DA_NAME_LEN )
> + ),
> +
> + TP_fast_assign(
> + memcpy(__entry->state, state, MAX_DA_NAME_LEN);
> + memcpy(__entry->event, event, MAX_DA_NAME_LEN);
> + ),
> +
> + TP_printk("event %s not expected in the state %s",
> + __entry->event,
> + __entry->state)
> +);
> +#endif /* CONFIG_DA_MON_EVENTS_IMPLICIT */
> +
> +#ifdef CONFIG_DA_MON_EVENTS_ID
> +DECLARE_EVENT_CLASS(event_da_monitor_id,
> +
> + TP_PROTO(int id, char *state, char *event, char *next_state, bool safe),
> +
> + TP_ARGS(id, state, event, next_state, safe),
> +
> + TP_STRUCT__entry(
> + __field( int, id )
> + __array( char, state, MAX_DA_NAME_LEN )
> + __array( char, event, MAX_DA_NAME_LEN )
> + __array( char, next_state, MAX_DA_NAME_LEN )
> + __field( bool, safe )
> + ),
> +
> + TP_fast_assign(
> + memcpy(__entry->state, state, MAX_DA_NAME_LEN);
> + memcpy(__entry->event, event, MAX_DA_NAME_LEN);
> + memcpy(__entry->next_state, next_state, MAX_DA_NAME_LEN);
> + __entry->id = id;
> + __entry->safe = safe;
> + ),
> +
> + TP_printk("%d: %s x %s -> %s %s",
> + __entry->id,
> + __entry->state,
> + __entry->event,
> + __entry->next_state,
> + __entry->safe ? "(safe)" : "")
> +);
> +
> +DECLARE_EVENT_CLASS(error_da_monitor_id,
> +
> + TP_PROTO(int id, char *state, char *event),
> +
> + TP_ARGS(id, state, event),
> +
> + TP_STRUCT__entry(
> + __field( int, id )
> + __array( char, state, MAX_DA_NAME_LEN )
> + __array( char, event, MAX_DA_NAME_LEN )
> + ),
> +
> + TP_fast_assign(
> + memcpy(__entry->state, state, MAX_DA_NAME_LEN);
> + memcpy(__entry->event, event, MAX_DA_NAME_LEN);
> + __entry->id = id;
> + ),
> +
> + TP_printk("%d: event %s not expected in the state %s",
> + __entry->id,
> + __entry->event,
> + __entry->state)
> +);
> +#endif /* CONFIG_DA_MON_EVENTS_ID */
> +#endif /* _TRACE_RV_H */
> +
> +/* This part ust be outside protection */
> +#undef TRACE_INCLUDE_PATH
> +#include <trace/define_trace.h>
> diff --git a/kernel/fork.c b/kernel/fork.c
> index 5e40e58ef83d..6f1f82ccd5f2 100644
> --- a/kernel/fork.c
> +++ b/kernel/fork.c
> @@ -1970,7 +1970,7 @@ static void rv_task_fork(struct task_struct *p)
> int i;
>
> for (i = 0; i < RV_PER_TASK_MONITORS; i++)
> - ;
> + p->rv[i].da_mon.monitoring = false;
> }
> #else
> #define rv_task_fork(p) do {} while (0)
> diff --git a/kernel/trace/rv/Kconfig b/kernel/trace/rv/Kconfig
> index 560408fec0c8..1eafb5adcfcb 100644
> --- a/kernel/trace/rv/Kconfig
> +++ b/kernel/trace/rv/Kconfig
> @@ -1,5 +1,19 @@
> # SPDX-License-Identifier: GPL-2.0-only
> #
> +config DA_MON_EVENTS
> + default n
> + bool
> +
> +config DA_MON_EVENTS_IMPLICIT
> + select DA_MON_EVENTS
> + default n
> + bool
> +
> +config DA_MON_EVENTS_ID
> + select DA_MON_EVENTS
> + default n
> + bool
> +
> menuconfig RV
> bool "Runtime Verification"
> depends on TRACING
> diff --git a/kernel/trace/rv/rv.c b/kernel/trace/rv/rv.c
> index 7576d492a974..51a610227341 100644
> --- a/kernel/trace/rv/rv.c
> +++ b/kernel/trace/rv/rv.c
> @@ -143,6 +143,11 @@
> #include <linux/slab.h>
> #include <rv/rv.h>
>
> +#ifdef CONFIG_DA_MON_EVENTS
> +#define CREATE_TRACE_POINTS
> +#include <trace/events/rv.h>
> +#endif
> +
> #include "rv.h"
>
> DEFINE_MUTEX(rv_interface_lock);
> --
> 2.35.1
>
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 10/20] rv/monitor: Add the wwnr monitor skeleton created by dot2k
2022-06-16 8:44 ` [PATCH V4 10/20] rv/monitor: Add the wwnr monitor skeleton created by dot2k Daniel Bristot de Oliveira
@ 2022-07-06 20:08 ` Tao Zhou
0 siblings, 0 replies; 82+ messages in thread
From: Tao Zhou @ 2022-07-06 20:08 UTC (permalink / raw)
To: Daniel Bristot de Oliveira
Cc: Steven Rostedt, Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet,
Ingo Molnar, Thomas Gleixner, Peter Zijlstra, Will Deacon,
Catalin Marinas, Marco Elver, Dmitry Vyukov, Paul E. McKenney,
Shuah Khan, Gabriele Paoloni, Juri Lelli, Clark Williams,
linux-doc, linux-kernel, linux-trace-devel, Tao Zhou
On Thu, Jun 16, 2022 at 10:44:52AM +0200, Daniel Bristot de Oliveira wrote:
> Per task wakeup while not running (wwnr) monitor, generated by dot2k
> with this command line:
>
> $ dot2k -d wwnr.dot -t per_task
>
> The model is:
> ----- %< -----
> digraph state_automaton {
> center = true;
> size = "7,11";
> {node [shape = plaintext, style=invis, label=""] "__init_not_running"};
> {node [shape = ellipse] "not_running"};
> {node [shape = plaintext] "not_running"};
> {node [shape = plaintext] "running"};
> "__init_not_running" -> "not_running";
> "not_running" [label = "not_running", color = green3];
> "not_running" -> "not_running" [ label = "wakeup" ];
> "not_running" -> "running" [ label = "switch_in" ];
> "running" [label = "running"];
> "running" -> "not_running" [ label = "switch_out" ];
> { rank = min ;
> "__init_not_running";
> "not_running";
> }
> }
> ----- >% -----
>
> This model is broken, the reason is that a task can be running in the
> processor without being set as RUNNABLE. Think about a task about to
> sleep:
>
> 1: set_current_state(TASK_UNINTERRUPTIBLE);
> 2: schedule();
>
> And then imagine an IRQ happening in between the lines one and two,
> waking the task up. BOOM, the wakeup will happen while the task is
> running.
>
> Q: Why do we need this model, so?
> A: To test the reactors.
>
> Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
> Cc: Guenter Roeck <linux@roeck-us.net>
> Cc: Jonathan Corbet <corbet@lwn.net>
> Cc: Steven Rostedt <rostedt@goodmis.org>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Peter Zijlstra <peterz@infradead.org>
> Cc: Will Deacon <will@kernel.org>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: Marco Elver <elver@google.com>
> Cc: Dmitry Vyukov <dvyukov@google.com>
> Cc: "Paul E. McKenney" <paulmck@kernel.org>
> Cc: Shuah Khan <skhan@linuxfoundation.org>
> Cc: Gabriele Paoloni <gpaoloni@redhat.com>
> Cc: Juri Lelli <juri.lelli@redhat.com>
> Cc: Clark Williams <williams@redhat.com>
> Cc: linux-doc@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> Cc: linux-trace-devel@vger.kernel.org
> Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
> ---
> kernel/trace/rv/monitors/wwnr/wwnr.c | 115 +++++++++++++++++++++++++++
> kernel/trace/rv/monitors/wwnr/wwnr.h | 38 +++++++++
> 2 files changed, 153 insertions(+)
> create mode 100644 kernel/trace/rv/monitors/wwnr/wwnr.c
> create mode 100644 kernel/trace/rv/monitors/wwnr/wwnr.h
>
> diff --git a/kernel/trace/rv/monitors/wwnr/wwnr.c b/kernel/trace/rv/monitors/wwnr/wwnr.c
> new file mode 100644
> index 000000000000..8ba01f0f0df8
> --- /dev/null
> +++ b/kernel/trace/rv/monitors/wwnr/wwnr.c
> @@ -0,0 +1,115 @@
> +// SPDX-License-Identifier: GPL-2.0
> +#include <linux/ftrace.h>
> +#include <linux/tracepoint.h>
> +#include <linux/kernel.h>
> +#include <linux/module.h>
> +#include <linux/init.h>
> +#include <linux/rv.h>
> +#include <rv/instrumentation.h>
> +#include <rv/da_monitor.h>
> +
> +#define MODULE_NAME "wwnr"
> +
> +/*
> + * XXX: include required tracepoint headers, e.g.,
> + * #include <linux/trace/events/sched.h>
> + */
> +#include <trace/events/rv.h>
> +
> +/*
> + * This is the self-generated part of the monitor. Generally, there is no need
> + * to touch this section.
> + */
> +#include "wwnr.h"
> +
> +/*
> + * Declare the deterministic automata monitor.
> + *
> + * The rv monitor reference is needed for the monitor declaration.
> + */
> +struct rv_monitor rv_wwnr;
> +DECLARE_DA_MON_PER_TASK(wwnr, char);
> +
> +/*
> + * This is the instrumentation part of the monitor.
> + *
> + * This is the section where manual work is required. Here the kernel events
> + * are translated into model's event.
> + *
> + */
> +static void handle_switch_in(void *data, /* XXX: fill header */)
> +{
> + struct task_struct *p = /* XXX: how do I get p? */;
> + da_handle_event_wwnr(p, switch_in_wwnr);
> +}
> +
> +static void handle_switch_out(void *data, /* XXX: fill header */)
> +{
> + struct task_struct *p = /* XXX: how do I get p? */;
> + da_handle_event_wwnr(p, switch_out_wwnr);
> +}
> +
> +static void handle_wakeup(void *data, /* XXX: fill header */)
> +{
> + struct task_struct *p = /* XXX: how do I get p? */;
> + da_handle_event_wwnr(p, wakeup_wwnr);
> +}
> +
> +static int start_wwnr(void)
> +{
> + int retval;
> +
> + retval = da_monitor_init_wwnr();
> + if (retval)
> + return retval;
> +
> + rv_attach_trace_probe("wwnr", /* XXX: tracepoint */, handle_switch_in);
> + rv_attach_trace_probe("wwnr", /* XXX: tracepoint */, handle_switch_out);
> + rv_attach_trace_probe("wwnr", /* XXX: tracepoint */, handle_wakeup);
> +
> + return 0;
> +}
> +
> +static void stop_wwnr(void)
> +{
> + rv_wwnr.enabled = 0;
> +
> + rv_detach_trace_probe("wwnr", /* XXX: tracepoint */, handle_switch_in);
> + rv_detach_trace_probe("wwnr", /* XXX: tracepoint */, handle_switch_out);
> + rv_detach_trace_probe("wwnr", /* XXX: tracepoint */, handle_wakeup);
> +
> + da_monitor_destroy_wwnr();
> +}
> +
> +/*
> + * This is the monitor register section.
> + */
> +struct rv_monitor rv_wwnr = {
> + .name = "wwnr",
> + .description = "auto-generated wwnr",
> + .start = start_wwnr,
> + .stop = stop_wwnr,
> + .reset = da_monitor_reset_all_wwnr,
> + .enabled = 0,
> +};
> +
> +int register_wwnr(void)
> +{
> + rv_register_monitor(&rv_wwnr);
> + return 0;
> +}
> +
> +void unregister_wwnr(void)
> +{
> + if (rv_wwnr.enabled)
> + stop_wwnr();
> +
> + rv_unregister_monitor(&rv_wwnr);
> +}
> +
> +module_init(register_wwnr);
> +module_exit(unregister_wwnr);
> +
> +MODULE_LICENSE("GPL");
> +MODULE_AUTHOR("dot2k: auto-generated");
> +MODULE_DESCRIPTION("wwnr");
> diff --git a/kernel/trace/rv/monitors/wwnr/wwnr.h b/kernel/trace/rv/monitors/wwnr/wwnr.h
> new file mode 100644
> index 000000000000..f3dc160642bf
> --- /dev/null
> +++ b/kernel/trace/rv/monitors/wwnr/wwnr.h
> @@ -0,0 +1,38 @@
> +enum states_wwnr {
> + not_running_wwnr = 0,
> + running_wwnr,
> + state_max_wwnr
> +};
> +
> +enum events_wwnr {
> + switch_in_wwnr = 0,
> + switch_out_wwnr,
> + wakeup_wwnr,
> + event_max_wwnr
> +};
> +
> +struct automaton_wwnr {
> + char *state_names[state_max_wwnr];
> + char *event_names[event_max_wwnr];
> + char function[state_max_wwnr][event_max_wwnr];
> + char initial_state;
> + char final_states[state_max_wwnr];
> +};
> +
> +struct automaton_wwnr automaton_wwnr = {
> + .state_names = {
> + "not_running",
> + "running"
> + },
> + .event_names = {
> + "switch_in",
> + "switch_out",
> + "wakeup"
> + },
The .state_names and .event_names lack the wwnr postfix.
If they generated aotomatically, something need to fix,
if not, can manually change to the consistent name.
If the state change from running to non-running(initial state),
in the next patch in handle_switch() where there checked
TASK_INTERRUPTABLE to set initial state. Why can not check
TASK_UNINTERURPTABLE to set initial state there, confused.
This model is not completed for me now.
> + .function = {
> + { running_wwnr, -1, not_running_wwnr },
> + { -1, not_running_wwnr, -1 },
> + },
> + .initial_state = not_running_wwnr,
> + .final_states = { 1, 0 },
> +};
> --
> 2.35.1
>
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 20/20] Documentation/rv: Add watchdog-monitor documentation
2022-06-16 8:45 ` [PATCH V4 20/20] Documentation/rv: Add watchdog-monitor documentation Daniel Bristot de Oliveira
@ 2022-07-07 12:41 ` Tao Zhou
2022-07-13 18:51 ` Daniel Bristot de Oliveira
0 siblings, 1 reply; 82+ messages in thread
From: Tao Zhou @ 2022-07-07 12:41 UTC (permalink / raw)
To: Daniel Bristot de Oliveira
Cc: Steven Rostedt, Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet,
Ingo Molnar, Thomas Gleixner, Peter Zijlstra, Will Deacon,
Catalin Marinas, Marco Elver, Dmitry Vyukov, Paul E. McKenney,
Shuah Khan, Gabriele Paoloni, Juri Lelli, Clark Williams,
linux-doc, linux-kernel, linux-trace-devel, Tao Zhou
On Thu, Jun 16, 2022 at 10:45:02AM +0200,
Daniel Bristot de Oliveira wrote:
> Adds documentation about the safe_wtd and safe_wtd_nwo RV monitors,
> and their usage via a safety application.
>
> Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
> Cc: Guenter Roeck <linux@roeck-us.net>
> Cc: Jonathan Corbet <corbet@lwn.net>
> Cc: Steven Rostedt <rostedt@goodmis.org>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Peter Zijlstra <peterz@infradead.org>
> Cc: Will Deacon <will@kernel.org>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: Marco Elver <elver@google.com>
> Cc: Dmitry Vyukov <dvyukov@google.com>
> Cc: "Paul E. McKenney" <paulmck@kernel.org>
> Cc: Shuah Khan <skhan@linuxfoundation.org>
> Cc: Gabriele Paoloni <gpaoloni@redhat.com>
> Cc: Juri Lelli <juri.lelli@redhat.com>
> Cc: Clark Williams <williams@redhat.com>
> Cc: linux-doc@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> Cc: linux-trace-devel@vger.kernel.org
> Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
> ---
> Documentation/trace/rv/watchdog-monitor.rst | 250 ++++++++++++++++++++
> 1 file changed, 250 insertions(+)
> create mode 100644 Documentation/trace/rv/watchdog-monitor.rst
>
> diff --git a/Documentation/trace/rv/watchdog-monitor.rst b/Documentation/trace/rv/watchdog-monitor.rst
> new file mode 100644
> index 000000000000..2b142fb31572
> --- /dev/null
> +++ b/Documentation/trace/rv/watchdog-monitor.rst
> @@ -0,0 +1,250 @@
> +Watchdog monitor
> +----------------
> +
> +The watchdog is an essential building block for the usage of Linux in
> +safety-critical systems because it allows the system to be monitored from
> +an external element - the watchdog hardware, acting as a safety-monitor.
> +
> +A user-space application controls the watchdog device via the watchdog
> +interface. This application, hereafter safety_app, enables the watchdog
> +and periodically pets the watchdog upon correct completion of the safety
> +related processing.
> +
> +If the safety_app, for any reason, stops pinging the watchdog,
> +the watchdog hardware can set the system in a fail-safe state. For
> +example, shutting the system down.
> +
> +Given the importance of the safety_app / watchdog hardware couple,
> +the interaction between these software pieces also needs some
> +sort of monitoring. In other words, "who monitors the monitor?"
> +
> +The safe watchdog (safe_wtd) RV monitor monitors the interaction between
> +the safety_app and the watchdog device, enforcing the correct sequence of
> +events that leads the system to a safe state.
> +
> +Furthermore, the safety_app can monitor the RV monitor by collecting the
> +events generated by the RV monitor itself via tracing interface. In this way,
> +closing the monitoring loop with the safety_app.
> +
> +A diagram of the components and their interactions is::
> +
> + user-space:
> + +--------------------------------+
> + | safety_app |-----------+
> + +--------------------------------+ |
> + | ^ |
> + | Configure | Enable and |
> + | | check data |
> + ===================+====================+=============== |
> + kernel-space: | | |
> + v v |
> + +----------+ instr. +-------------+ |
> + | watchdog | ----------->| RV Monitor |----+ |
> + | device | +-------------+ | |
> + +----------+ | |
> + | | |
> + | | |
> + ================+====================================== | |
> + hardware: | | |
> + v | +-> Bring the system
> + +--------------------+ +----> to a safe state,
> + | watchdog hardware |---------------------------> e.g., halt.
> + +--------------------+
> +
> +Sample safety_app
> +-----------------
> +
> +The user-space safety_app sample code in ``tools/verification/safety_app/``
> +serves to illustrate the usage of the RV monitors for this use-case, as
> +well as the starting point to the development of a user-specific safety_app.
> +
> +Watchdog events
> +---------------
> +
> +The RV monitor observes the watchdog by using instrumentation to
> +process the events generated by the interaction between the
> +safety_app and the watchdog device layer in kernel.
> +
> +The monitored events are:
> +
> + - watchdog:watchdog_open: open the watchdog device;
> + - watchdog:watchdog_close: close the watchdog device;
> + - watchdog:watchdog_start: start the watchdog;
> + - watchdog:watchdog_stop: stop the watchdog;
> + - watchdog:watchdog_set_timeout: set the watchdog timeout;
> + - watchdog:watchdog_ping: reprogram the watchdog with the previously set
> + timeout;
> + - watchdog:watchdog_nowayout: prevents the watchdog from stopping;
> + - watchdog:watchdog_set_keep_alive: set an intermediary ping to overcome
> + the limitation of a hardware watchdog maximum timeout being shorter than
> + the timeout set by the user-space tool;
> + - watchdog:watchdog_keep_alive: the execution of the function that runs the
> + intermediary keep alive ping;
> +
> +RV monitor events
> +-----------------
> +
> +The RV monitor monitors the relevant events as an outside observer,
> +interpreting all the components (the hardware; the watchdog device
> +interface; and the safety monitor) as an integrated component.
> +
> +The events selected for the monitor are:
> +
> + - other_threads: an event generated by any thread other than the
> + one that set nowayout or open the watchdog the last time.
> + - open: a thread opens the watchdog to manipulate it;
> + - close: a thread closes the watchdog;
> + - start: starts the watchdog countdown;
> + - stop: stops the watchdog;
> + - set_safe_timeout: configures the watchdog with a given timeout;
> + - ping: resets the watchdog countdown with the previously configured timeout;
> + - nowayout: prevents the watchdog to be stopped until the system's shutdown;
> + - sched_keep_alive: schedules a kernel worker to ping the watchdog if the
> + timeout is longer than the watchdog hardware can handle.
> + - keep_alive: executes the previously scheduled watchdog ping;
> +
> +Noting that the events that does not appear in the automata models are
> +considered blocked events, and their execution will always cause the
> +RV monitor to react to an unexpected event.
> +
> +RV monitor specification
> +------------------------
> +
> +The monitor's goal is to assess a set of specifications that conducts the
> +system to a safe state.
> +
> +These specifications are:
> +
> + - 1: Once open, only one process manipulates the watchdog;
> + - 2: Following 1, the keep-alive mechanisms will not be used;
> + - 3: If required, nowayout will be set before opening the watchdog;
> + - 4: A safe timeout must be set;
> + - 5: At least one ping must be made before entering the safe/safe_nwo states
> + - 6: The RV monitor does not react if the watchdog is closed without stopping.
> + But the hardware watchdog is expected to react.
> +
> +Deterministic automata monitors
> +-------------------------------
> +
> +Following the specifications, a deterministic automata monitor
> +was developed. The monitor is modeled as Deterministic Automata model.
> +
> +The deterministic automata model for safe_wtd is::
> +
> + #==================================# other_threads
> + H H ----------------+
> + -----------> H init H |
> + H H <---------------+
> + #==================================#
> + | | ^
> + | | | close
> + | | +----------------------------------------------------+
> + | | |
> + | | open |
> + | +------------------------------------------------------+ |
> + | | |
> + | nowayout | |
> + v | |
> + nowayout +-------------------+ | |
> + other_threads | | nowayout | |
> + +---------------- | nwo |<-------------------------------------+ | |
> + | | | | | |
> + +---------------> | | <+ | | |
> + +-------------------+ | | | |
> + | | | | |
> + | open | close | | |
> + v | | | |
> + +-------------------+ | | | |
> + | opened_nwo | -+ | | |
> + +-------------------+ | | |
> + | | | |
> + | start | | |
> + v | | |
> + +-------------------+ | | |
> + +---------------> | started_nwo | -+ | | |
> + | +-------------------+ | | | |
> + | | | | | |
> + | open | set_safe_timeout | | | |
> + | v | | | |
> + | +-------------------+ | | | |
> + | | set_nwo | | | | |
> + | +-------------------+ | | | |
> + | | | | | |
> + | +-------------+ | ping | | | |
> + | | | | | | | |
> + | | ping v v | | | |
> + | | +-------------------+ | | | |
> + | +-----------| safe_nwo | | | | |
> + | +-------------------+ | | | |
> + | | | | | |
> + | | close | close | | |
> + | v v | | |
> + | +----------------------------------+ nowayout | | |
> + | | | other_threads | | |
> + | | closed_running_nwo | ----------------+ | | |
> + | | | | | | |
> + +---------------- | | <---------------+ | | |
> + +----------------------------------+ | | |
> + | nowayout ^ | | |
> + +-----------------------------+ | | |
> + | | |
> + | | |
> + +-------------------+ +--------+ | | |
> + | | | |------+---+ |
> + | started | start | opened | | |
> + +---------------- | | <-------- | |>-----+-------+
> + | +-------------------+ +--------+ | ^
> + | | | |
> + | | set_safe_timeout +-------------+-------+
> + | v | |
> + | +-------------------+ | |
> + | | | | |
> + | | set | | |
> + +----------+---------------> | | | |
> + | | +-------------------+ | |
> + | | | | |
> + | | | ping | |
> + | | v | |
> + | | +-------------------+ ping | |
> + | | | | -------+ | |
> + | | +---- | safe | | | |
> + | | | | | <------+ | |
> + | | | +-------------------+ | |
> + | | | | | |
> + | | stop | | stop | |
> + | | | v | |
> + | | | +-------------------+ close | |
> + | +-----------+---> | stopped |-------------+ |
> + | | +-------------------+ |
> + | +---+ |
> + | | close |
> + | v |
> + | other_threads +----------------------------------------+ |
> + | +--------------> | | |
> + | | | closed_running | |
> + | +--------------- | |--------------+
> + | +----------------------------------------+
> + | | ^
> + | open | | close
> + | v |
> + | set_safe_timeout +-------------------+
> + +-------------------------> | reopened |
> + +-------------------+
So I must check the model matrix in patch18 and the above graph to
check if the matrix have the not right value or something in this
graph go wrong.
open
o init state ------> opened state: there lack a direction arrow.
nwo
o closed_running state -------> closed_running_nwo state: this
is the state trasfer indicated from matrix, but the above
graph is not consistent with it. In graph:
nwo
closed_running state -------> nwo state. I prefer the state
closed_running_nwo.
nwo
other_thread
o closed_running_nwo state ---------------> closed_running_nwo state.
The graph above have a duplicate nwo event leading to state transfer.
open
closed_running_nwo state ---------------> started_nwo state. I think
it should transfer to opened_nwo state.
set_safe_timeout
o reopened state ------------------> set state: the direction is from
reopened state to set state. The graph above have two direction arrow.
stop
reopenped state ------------------> opened state. why stop event trigger
it to opened state not stoped state. I think it should transfer to stoped
state like the started state do.
o started state do not have link to closed_running state by close event in
graph. Like started_nwo state do, it should have a direct close event to
link to closed_running state.
Modified the above graph like this:
+
+ #==================================# other_threads
+ H H ----------------+
+ -----------> H init H |
+ H H <---------------+
+ #==================================#
+ | | ^
+ | | | close
+ | | +----------------------------------------------------+
+ | | |
+ | | open |
+ | +------------------------------------------------------+ |
+ | | |
+ | nowayout | |
+ v | |
+ nowayout +-------------------+ | |
+ other_threads | | | |
+ +---------------- | nwo | | |
+ | | | | |
+ +---------------> | | <+ | |
+ +-------------------+ | | |
+ | | | |
+ | open | close | |
+ v | | |
+ +-------------------+ | | |
+ +---------------> | opened_nwo | -+ | |
+ | +-------------------+ | |
+ | | | |
+ | | start | |
+ | v | |
+ | +-------------------+ | |
+ | | started_nwo | -+ | |
+ | +-------------------+ | | |
+ | | | | |
+ | open | set_safe_timeout | | |
+ | v | | |
+ | +-------------------+ | | |
+ | | set_nwo | | | |
+ | +-------------------+ | | |
+ | | | | |
+ | +-------------+ | ping | | |
+ | | | | | | |
+ | | ping v v | | |
+ | | +-------------------+ | | |
+ | +-----------| safe_nwo | | | |
+ | +-------------------+ | | |
+ | | | | |
+ | | close | close | |
+ | v v | |
+ | +----------------------------------+ nowayout | |
+ | | | other_threads | |
+ | | closed_running_nwo | ----------------+ | |
+ | | | | | |
+ +---------------- | | <---------------+ | |
+ +----------------------------------+ | |
+ ^ | |
+ | nowayout | |
+ +--------------------------------------+ | |
+ | | |
+ +-------------------+ +--------+ | | |
+ | | start | |<----+---+ |
+ | started | <--------- | opened | | |
+ +---------------- | | ---------+ | |>----+-------+
+ | +-------------------+ close | +--------+ | ^
+ | | | | |
+ | | set_safe_timeout | +-----------+-------+
+ | v | | |
+ | +-------------------+ | | |
+ | | | | | |
+ | | set | | | |
+ +----------+---------------> | | | | |
+ | | +-------------------+ | | |
+ | | | | | |
+ | | | ping | | |
+ | | v | | |
+ | | +-------------------+ ping | | |
+ | | | | -------+ | | |
+ | | +---- | safe | | | | |
+ | | | | | <------+ | | |
+ | | | +-------------------+ | | |
+ | | | | | | |
+ | | stop | | stop | | |
+ | | | v | | |
+ | | | +-------------------+ close | | |
+ | +-----------+---> | stopped |----------+----+ |
+ | | +-------------------+ | |
+ | +---+ ^ | |
+ | | close | | |
+ | | +------------------+------+ |
| v v | |
+ | other_threads +----------------------------------------+ | |
+ | +--------------> | | | |
+ | | | closed_running | | |
+ | +--------------- | |----+---------+
+ | +----------------------------------------+ |
+ | | ^ |
+ | open | | close |stop
+ | v | |
+ | set_safe_timeout +-------------------+ |
+ +-------------------------- | reopened |------------------+
+ +-------------------+
Thanks
> +It is important to note that the events sched_keep_alive and keep_alive
> +are not allowed in the monitor (they are said to be blocked events).
> +The execution of any blocked events leads the RV monitor to react.
> +
> +Additional options
> +------------------
> +
> +The RV monitor also has a set of options enabled via kernel command
> +line/module options. They are:
> +
> + - watchdog_id: the device id to monitor (default 0);
> + - dont_stop: once enabled, do not allow the RV monitor to be stopped (default off);
> + - safe_timeout: define a maximum safe value that a user-space application can
> + set as the watchdog timeout (default unlimited);
> + - check_timeout: After every ping, check if the time left in the watchdog is less
> + than or equal to the last timeout set for the watchdog. It only works for watchdog
> + devices that provide the get_timeleft() function (default off);
> --
> 2.35.1
>
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 01/20] rv: Add Runtime Verification (RV) interface
2022-07-06 17:49 ` Tao Zhou
2022-07-06 17:53 ` Matthew Wilcox
@ 2022-07-08 14:39 ` Daniel Bristot de Oliveira
2022-07-10 15:11 ` Tao Zhou
1 sibling, 1 reply; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-07-08 14:39 UTC (permalink / raw)
To: Tao Zhou, Steven Rostedt
Cc: Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet, Ingo Molnar,
Thomas Gleixner, Peter Zijlstra, Will Deacon, Catalin Marinas,
Marco Elver, Dmitry Vyukov, Paul E. McKenney, Shuah Khan,
Gabriele Paoloni, Juri Lelli, Clark Williams, linux-doc,
linux-kernel, linux-trace-devel
Hey Tao!
On 7/6/22 19:49, Tao Zhou wrote:
>> +static void *enabled_monitors_start(struct seq_file *m, loff_t *pos)
>> +{
>> + struct rv_monitor_def *m_def;
>> + loff_t l;
>> +
>> + mutex_lock(&rv_interface_lock);
>> + m_def = list_entry(&rv_monitors_list, struct rv_monitor_def, list);
> I realized this m_def is not real but vain. Is it possible the loop is
> skiped and just return m_def that is not valid.
that is empty... not a problem.
I am not seeing (the possible) problem here. Could you simulate/reproduce the problem?
Btw, this code is "inspired" (iow stolen) from trace_events.c.
Am I missing something? steve?
>> + for (l = 0; l <= *pos; ) {
>> + m_def = enabled_monitors_next(m, m_def, &l);
>> + if (!m_def)
>> + break;
>> + }
>> +
>> + return m_def;
>> +}
-- Daniel
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 01/20] rv: Add Runtime Verification (RV) interface
2022-07-06 17:53 ` Matthew Wilcox
@ 2022-07-08 15:36 ` Tao Zhou
2022-07-08 15:55 ` Matthew Wilcox
0 siblings, 1 reply; 82+ messages in thread
From: Tao Zhou @ 2022-07-08 15:36 UTC (permalink / raw)
To: Matthew Wilcox
Cc: Daniel Bristot de Oliveira, Steven Rostedt, Wim Van Sebroeck,
Guenter Roeck, Jonathan Corbet, Ingo Molnar, Thomas Gleixner,
Peter Zijlstra, Will Deacon, Catalin Marinas, Marco Elver,
Dmitry Vyukov, Paul E. McKenney, Shuah Khan, Gabriele Paoloni,
Juri Lelli, Clark Williams, linux-doc, linux-kernel,
linux-trace-devel, Tao Zhou
On Wed, Jul 06, 2022 at 06:53:21PM +0100, Matthew Wilcox wrote:
> On Thu, Jul 07, 2022 at 01:49:02AM +0800, Tao Zhou wrote:
> > > +struct rv_monitor {
> > > + const char *name;
> > > + const char *description;
> > > + bool enabled;
> >
> > Can the 'bool enabled;' be put at the end like the definition of
> > structure rv_monitor_def. If '8+8+sizeof(bool)+8+8+8' not the same
> > as '8+8+8+8+8+sizeof(bool)', I mean is it possible that after the
> > end of stucture there is a int or char not require to align to 8 as
> > an example from my nonsense.
>
> That will make no difference at all. C doesn't allow other variables
> to "fill in the hole" at the end of the structure like that. For
> example, one could legitimately do 'memset(&rvm, sizeof(rvm))',
> and that would wipe out those other variables as well.
I mean if it is possible that if @enabled placed at the end of the
structure rv_monitor will save some bytes.
If @enabled place in between, the next function pointer which is 8 bytes
will align to be in x8 address and the size of structure rv_monitor is
larger than been placed at the end of the structure.
Or the compiler can do magic that I can not guess.
Sorry for my late reply. I am not sure about this. But your reply is not
about what I mean. You say that the size of structure is the same(I doute about this).
But what my concert is that the other data next to the structure rv_monitor
how to align if placing the @enabled at the end.
Place in between, bytes:
8+8+8(padd)+8+8+8=48
Place at the end, bytes:
8+8+8+8+8+sizeof(bool)=?
? is small than 48 and the data next to the data structure rv_monitor can use
the saved byte which is the result of placing @enabled at the end of structure
to place the data.
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 01/20] rv: Add Runtime Verification (RV) interface
2022-07-08 15:36 ` Tao Zhou
@ 2022-07-08 15:55 ` Matthew Wilcox
0 siblings, 0 replies; 82+ messages in thread
From: Matthew Wilcox @ 2022-07-08 15:55 UTC (permalink / raw)
To: Tao Zhou
Cc: Daniel Bristot de Oliveira, Steven Rostedt, Wim Van Sebroeck,
Guenter Roeck, Jonathan Corbet, Ingo Molnar, Thomas Gleixner,
Peter Zijlstra, Will Deacon, Catalin Marinas, Marco Elver,
Dmitry Vyukov, Paul E. McKenney, Shuah Khan, Gabriele Paoloni,
Juri Lelli, Clark Williams, linux-doc, linux-kernel,
linux-trace-devel
On Fri, Jul 08, 2022 at 11:36:06PM +0800, Tao Zhou wrote:
> On Wed, Jul 06, 2022 at 06:53:21PM +0100, Matthew Wilcox wrote:
>
> > On Thu, Jul 07, 2022 at 01:49:02AM +0800, Tao Zhou wrote:
> > > > +struct rv_monitor {
> > > > + const char *name;
> > > > + const char *description;
> > > > + bool enabled;
> > >
> > > Can the 'bool enabled;' be put at the end like the definition of
> > > structure rv_monitor_def. If '8+8+sizeof(bool)+8+8+8' not the same
> > > as '8+8+8+8+8+sizeof(bool)', I mean is it possible that after the
> > > end of stucture there is a int or char not require to align to 8 as
> > > an example from my nonsense.
> >
> > That will make no difference at all. C doesn't allow other variables
> > to "fill in the hole" at the end of the structure like that. For
> > example, one could legitimately do 'memset(&rvm, sizeof(rvm))',
> > and that would wipe out those other variables as well.
>
> I mean if it is possible that if @enabled placed at the end of the
> structure rv_monitor will save some bytes.
> If @enabled place in between, the next function pointer which is 8 bytes
> will align to be in x8 address and the size of structure rv_monitor is
> larger than been placed at the end of the structure.
> Or the compiler can do magic that I can not guess.
>
> Sorry for my late reply. I am not sure about this. But your reply is not
> about what I mean. You say that the size of structure is the same(I doute about this).
> But what my concert is that the other data next to the structure rv_monitor
> how to align if placing the @enabled at the end.
>
> Place in between, bytes:
> 8+8+8(padd)+8+8+8=48
>
> Place at the end, bytes:
> 8+8+8+8+8+sizeof(bool)=?
>
> ? is small than 48 and the data next to the data structure rv_monitor can use
> the saved byte which is the result of placing @enabled at the end of structure
> to place the data.
You don't need to take my word for it. You can try it yourself.
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 01/20] rv: Add Runtime Verification (RV) interface
2022-07-08 14:39 ` Daniel Bristot de Oliveira
@ 2022-07-10 15:11 ` Tao Zhou
2022-07-10 15:42 ` Steven Rostedt
0 siblings, 1 reply; 82+ messages in thread
From: Tao Zhou @ 2022-07-10 15:11 UTC (permalink / raw)
To: Daniel Bristot de Oliveira
Cc: Steven Rostedt, Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet,
Ingo Molnar, Thomas Gleixner, Peter Zijlstra, Will Deacon,
Catalin Marinas, Marco Elver, Dmitry Vyukov, Paul E. McKenney,
Shuah Khan, Gabriele Paoloni, Juri Lelli, Clark Williams,
linux-doc, linux-kernel, linux-trace-devel, Tao Zhou
On Fri, Jul 08, 2022 at 04:39:47PM +0200,
Daniel Bristot de Oliveira wrote:
> Hey Tao!
>
> On 7/6/22 19:49, Tao Zhou wrote:
> >> +static void *enabled_monitors_start(struct seq_file *m, loff_t *pos)
> >> +{
> >> + struct rv_monitor_def *m_def;
> >> + loff_t l;
> >> +
> >> + mutex_lock(&rv_interface_lock);
> >> + m_def = list_entry(&rv_monitors_list, struct rv_monitor_def, list);
> > I realized this m_def is not real but vain. Is it possible the loop is
> > skiped and just return m_def that is not valid.
>
> that is empty... not a problem.
>
> I am not seeing (the possible) problem here. Could you simulate/reproduce the problem?
The @*pos of enable_monitors_start() can not be -1 or other negative value.
And I checked that the *pos is 0(right?). That is safe. Sorry for not being
that ture and maybe this is a notice here. Because if it is a negative value,
the returned m_def is a point to a data place 16 bytes before &rv_monitors_list.
That is a not ture rv_monitors_list stucture data. But it is not possiable now.
Maybe "inspired" from your question. Look it more, I image this simulation.
If the monitor(and all is enabled) is more enough to let the *pos to increase
to -1. And the returned m_def is last monitor that returned from enable_monitors_start().
The enable_monitors_next() check from the last monitor and return NULL.
Only show the last monitor. This will not really happen I think.
But I am not focus enough to the seq file code or others now, so this may be
more possible to be not right. Late reply continued from me..
Thanks,
Tao
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 01/20] rv: Add Runtime Verification (RV) interface
2022-07-10 15:11 ` Tao Zhou
@ 2022-07-10 15:42 ` Steven Rostedt
2022-07-10 22:28 ` Tao Zhou
0 siblings, 1 reply; 82+ messages in thread
From: Steven Rostedt @ 2022-07-10 15:42 UTC (permalink / raw)
To: Tao Zhou
Cc: Daniel Bristot de Oliveira, Wim Van Sebroeck, Guenter Roeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel
On Sun, 10 Jul 2022 23:11:43 +0800
Tao Zhou <tao.zhou@linux.dev> wrote:
> The @*pos of enable_monitors_start() can not be -1 or other negative value.
> And I checked that the *pos is 0(right?). That is safe. Sorry for not being
> that ture and maybe this is a notice here. Because if it is a negative value,
> the returned m_def is a point to a data place 16 bytes before &rv_monitors_list.
> That is a not ture rv_monitors_list stucture data. But it is not possiable now.
> Maybe "inspired" from your question. Look it more, I image this simulation.
> If the monitor(and all is enabled) is more enough to let the *pos to increase
> to -1. And the returned m_def is last monitor that returned from enable_monitors_start().
> The enable_monitors_next() check from the last monitor and return NULL.
> Only show the last monitor. This will not really happen I think.
> But I am not focus enough to the seq file code or others now, so this may be
> more possible to be not right. Late reply continued from me..
So basically you are saying we should have:
> +static void *enabled_monitors_start(struct seq_file *m, loff_t *pos)
> +{
> + struct rv_monitor_def *m_def;
> + loff_t l;
> +
> + mutex_lock(&rv_interface_lock);
if (list_empty(&rv_monitors_list->list))
return NULL;
?
Probably safer to have that.
-- Steve
> + m_def = list_entry(&rv_monitors_list, struct rv_monitor_def, list);
> +
> + for (l = 0; l <= *pos; ) {
> + m_def = enabled_monitors_next(m, m_def, &l);
> + if (!m_def)
> + break;
> + }
> +
> + return m_def;
> +}
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 01/20] rv: Add Runtime Verification (RV) interface
2022-07-10 15:42 ` Steven Rostedt
@ 2022-07-10 22:28 ` Tao Zhou
0 siblings, 0 replies; 82+ messages in thread
From: Tao Zhou @ 2022-07-10 22:28 UTC (permalink / raw)
To: Steven Rostedt
Cc: Daniel Bristot de Oliveira, Wim Van Sebroeck, Guenter Roeck,
Jonathan Corbet, Ingo Molnar, Thomas Gleixner, Peter Zijlstra,
Will Deacon, Catalin Marinas, Marco Elver, Dmitry Vyukov,
Paul E. McKenney, Shuah Khan, Gabriele Paoloni, Juri Lelli,
Clark Williams, linux-doc, linux-kernel, linux-trace-devel,
Tao Zhou
On Sun, Jul 10, 2022 at 11:42:42AM -0400, Steven Rostedt wrote:
> On Sun, 10 Jul 2022 23:11:43 +0800
> Tao Zhou <tao.zhou@linux.dev> wrote:
>
> > The @*pos of enable_monitors_start() can not be -1 or other negative value.
> > And I checked that the *pos is 0(right?). That is safe. Sorry for not being
> > that ture and maybe this is a notice here. Because if it is a negative value,
> > the returned m_def is a point to a data place 16 bytes before &rv_monitors_list.
> > That is a not ture rv_monitors_list stucture data. But it is not possiable now.
> > Maybe "inspired" from your question. Look it more, I image this simulation.
> > If the monitor(and all is enabled) is more enough to let the *pos to increase
> > to -1. And the returned m_def is last monitor that returned from enable_monitors_start().
> > The enable_monitors_next() check from the last monitor and return NULL.
> > Only show the last monitor. This will not really happen I think.
> > But I am not focus enough to the seq file code or others now, so this may be
> > more possible to be not right. Late reply continued from me..
>
>
> So basically you are saying we should have:
>
> > +static void *enabled_monitors_start(struct seq_file *m, loff_t *pos)
> > +{
> > + struct rv_monitor_def *m_def;
> > + loff_t l;
> > +
> > + mutex_lock(&rv_interface_lock);
>
> if (list_empty(&rv_monitors_list->list))
> return NULL;
> ?
From the function itself, this looks safer. Thanks.
> Probably safer to have that.
>
> -- Steve
>
>
> > + m_def = list_entry(&rv_monitors_list, struct rv_monitor_def, list);
> > +
> > + for (l = 0; l <= *pos; ) {
> > + m_def = enabled_monitors_next(m, m_def, &l);
> > + if (!m_def)
> > + break;
> > + }
> > +
> > + return m_def;
> > +}
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 03/20] rv/include: Add helper functions for deterministic automata
2022-07-06 18:35 ` Tao Zhou
@ 2022-07-13 18:38 ` Daniel Bristot de Oliveira
0 siblings, 0 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-07-13 18:38 UTC (permalink / raw)
To: Tao Zhou
Cc: Steven Rostedt, Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet,
Ingo Molnar, Thomas Gleixner, Peter Zijlstra, Will Deacon,
Catalin Marinas, Marco Elver, Dmitry Vyukov, Paul E. McKenney,
Shuah Khan, Gabriele Paoloni, Juri Lelli, Clark Williams,
linux-doc, linux-kernel, linux-trace-devel
On 7/6/22 20:35, Tao Zhou wrote:
> On Thu, Jun 16, 2022 at 10:44:45AM +0200, Daniel Bristot de Oliveira wrote:
>
>> Formally, a deterministic automaton, denoted by G, is defined as a
>> quintuple:
>>
>> G = { X, E, f, x_0, X_m }
>>
>> where:
>> - X is the set of states;
>> - E is the finite set of events;
>> - x_0 is the initial state;
>> - X_m (subset of X) is the set of marked states.
>> - f : X x E -> X $ is the transition function. It defines the
>> state transition in the occurrence of a event from E in
>> the state X. In the special case of deterministic automata,
>> the occurrence of the event in E in a state in X has a
>> deterministic next state from X.
>>
>> An automaton can also be represented using a graphical format of
>> vertices (nodes) and edges. The open-source tool Graphviz can produce
>> this graphic format using the (textual) DOT language as the source code.
>>
>> The dot2c tool presented in this paper:
>>
>> DE OLIVEIRA, Daniel Bristot; CUCINOTTA, Tommaso; DE OLIVEIRA, Romulo
>> Silva. Efficient formal verification for the Linux kernel. In:
>> International Conference on Software Engineering and Formal Methods.
>> Springer, Cham, 2019. p. 315-332.
>>
>> Translates a deterministic automaton in the DOT format into a C
>> surce code representation that to be used for monitoring.
>>
>> This header file implements helper functions to facilitate the usage
>> of the C output from dot2c for monitoring.
>>
>> Cc: Wim Van Sebroeck <wim@linux-watchdog.org>
>> Cc: Guenter Roeck <linux@roeck-us.net>
>> Cc: Jonathan Corbet <corbet@lwn.net>
>> Cc: Steven Rostedt <rostedt@goodmis.org>
>> Cc: Ingo Molnar <mingo@redhat.com>
>> Cc: Thomas Gleixner <tglx@linutronix.de>
>> Cc: Peter Zijlstra <peterz@infradead.org>
>> Cc: Will Deacon <will@kernel.org>
>> Cc: Catalin Marinas <catalin.marinas@arm.com>
>> Cc: Marco Elver <elver@google.com>
>> Cc: Dmitry Vyukov <dvyukov@google.com>
>> Cc: "Paul E. McKenney" <paulmck@kernel.org>
>> Cc: Shuah Khan <skhan@linuxfoundation.org>
>> Cc: Gabriele Paoloni <gpaoloni@redhat.com>
>> Cc: Juri Lelli <juri.lelli@redhat.com>
>> Cc: Clark Williams <williams@redhat.com>
>> Cc: linux-doc@vger.kernel.org
>> Cc: linux-kernel@vger.kernel.org
>> Cc: linux-trace-devel@vger.kernel.org
>> Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
>> ---
>> include/rv/automata.h | 49 +++++++++++++++++++++++++++++++++++++++++++
>> 1 file changed, 49 insertions(+)
>> create mode 100644 include/rv/automata.h
>>
>> diff --git a/include/rv/automata.h b/include/rv/automata.h
>> new file mode 100644
>> index 000000000000..0c0aa54bd820
>> --- /dev/null
>> +++ b/include/rv/automata.h
>> @@ -0,0 +1,49 @@
>> +/* SPDX-License-Identifier: GPL-2.0 */
>> +/*
>> + * Deterministic automata helper functions, to be used with the automata
>> + * models in C generated by the dot2k tool.
>> + *
>> + * Copyright (C) 2019-2022 Daniel Bristot de Oliveira <bristot@kernel.org>
>> + */
>> +
>> +#define DECLARE_AUTOMATA_HELPERS(name, type) \
>> + \
>> +static inline void *model_get_model_##name(void) \
>> +{ \
>> + return (void *) &automaton_##name; \
>> +} \
>> + \
>> +static char *model_get_state_name_##name(enum states_##name state) \
>> +{ \
>> + return automaton_##name.state_names[state]; \
>> +} \
>> + \
>> +static char *model_get_event_name_##name(enum events_##name event) \
>> +{ \
>> + return automaton_##name.event_names[event]; \
>> +} \
>> + \
>> +static inline type model_get_init_state_##name(void) \
>> +{ \
>> + return automaton_##name.initial_state; \
>> +} \
>> + \
>> +static inline type model_get_next_state_##name(enum states_##name curr_state, \
>> + enum events_##name event) \
>> +{ \
>> + if ((curr_state < 0) || (curr_state > state_max_##name)) \
>> + return -1; \
>
> curr_state can not be state_max_xxx. curr_state must be not bigger
> than state_max_xxx. Or am I miss something?
>
>> + if ((event < 0) || (event > event_max_##name)) \
>> + return -1; \
>> + \
>
> Same here for the event boundary check.
>
>> + return automaton_##name.function[curr_state][event]; \
>> +} \
>> + \
>> +static inline bool model_is_final_state_##name(enum states_##name state) \
>> +{ \
>> + if ((state < 0) || (state > state_max_##name)) \
>> + return 0; \
>> + \
>
> Same here.
>
>> + return !!automaton_##name.final_states[state]; \
>
> If the value of .final_states[state] is 0 or 1, can the type of
> .final_states[state] be befined to bool. Or not need to use !! to
> explicitly transfer the type to bool. I remember that you define
> this as char array and the matrix model value of this array is 0 or 1
> see from the next patche. 1 delegate the state it is the initial state.
> 0 for others.
All points addressed!
-- Daniel
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 04/20] rv/include: Add deterministic automata monitor definition via C macros
2022-07-06 18:56 ` Tao Zhou
@ 2022-07-13 18:39 ` Daniel Bristot de Oliveira
0 siblings, 0 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-07-13 18:39 UTC (permalink / raw)
To: Tao Zhou
Cc: Steven Rostedt, Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet,
Ingo Molnar, Thomas Gleixner, Peter Zijlstra, Will Deacon,
Catalin Marinas, Marco Elver, Dmitry Vyukov, Paul E. McKenney,
Shuah Khan, Gabriele Paoloni, Juri Lelli, Clark Williams,
linux-doc, linux-kernel, linux-trace-devel
On 7/6/22 20:56, Tao Zhou wrote:
>> +/*
>> + * Entry point for the global monitor.
>> + */
>> +#define DECLARE_DA_MON_GLOBAL(name, type) \
>> + \
>> +DECLARE_AUTOMATA_HELPERS(name, type); \
>> + \
>> +DECLARE_DA_MON_GENERIC_HELPERS(name, type); \
>> + \
>> +DECLARE_DA_MON_MODEL_HANDLER_IMPLICIT(name, type); \
>> + \
>> +DECLARE_DA_MON_INIT_PER_CPU(name, type); \
> Why the global monitor declaration use the per-cpu monitor macro.
> Global monitor has its own DECLARE_DA_MON_INIT_GLOBAL(name, type);
> Or am I miss something?
>
Pure miss attention from my side.
Fixed
-- Daniel
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 06/20] tools/rv: Add dot2c
2022-06-28 18:16 ` Steven Rostedt
@ 2022-07-13 18:41 ` Daniel Bristot de Oliveira
0 siblings, 0 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-07-13 18:41 UTC (permalink / raw)
To: Steven Rostedt
Cc: Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet, Ingo Molnar,
Thomas Gleixner, Peter Zijlstra, Will Deacon, Catalin Marinas,
Marco Elver, Dmitry Vyukov, Paul E. McKenney, Shuah Khan,
Gabriele Paoloni, Juri Lelli, Clark Williams, linux-doc,
linux-kernel, linux-trace-devel
On 6/28/22 20:16, Steven Rostedt wrote:
> On Thu, 16 Jun 2022 10:44:48 +0200
> Daniel Bristot de Oliveira <bristot@kernel.org> wrote:
>
>> + def get_minimun_type(self):
>> + min_type="char"
>> +
>> + if self.states.__len__() > 255:
>> + min_type="short"
>> +
>> + if self.states.__len__() > 65535:
>> + min_type="int"
> Should these be "unsigned"? As char goes from -128 <-> 127
> and short goes from -32768 <-> 32767
>
> And are you sure you're not going to have more than 2,147,483,647 states ;-)
> (or 4,294,967,296 if it's unsigned).
Fixed! now I am using the "state_max" as the invalid state, so I can use unsigned.
I also revisited all python code for consistency.
-- Daniel
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 13/20] rv/reactor: Add the panic reactor
2022-06-16 21:03 ` Randy Dunlap
2022-06-17 16:09 ` Daniel Bristot de Oliveira
@ 2022-07-13 18:47 ` Daniel Bristot de Oliveira
1 sibling, 0 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-07-13 18:47 UTC (permalink / raw)
To: Randy Dunlap, Steven Rostedt
Cc: Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet, Ingo Molnar,
Thomas Gleixner, Peter Zijlstra, Will Deacon, Catalin Marinas,
Marco Elver, Dmitry Vyukov, Paul E. McKenney, Shuah Khan,
Gabriele Paoloni, Juri Lelli, Clark Williams, linux-doc,
linux-kernel, linux-trace-devel
On 6/16/22 23:03, Randy Dunlap wrote:
>> Enables the printk reactor. The printk reactor emmits a printk()
> emits
>
Fixed all the cases!
-- Daniel
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 17/20] watchdog/dev: Add tracepoints
2022-06-16 23:55 ` Guenter Roeck
2022-06-17 16:16 ` Daniel Bristot de Oliveira
@ 2022-07-13 18:49 ` Daniel Bristot de Oliveira
1 sibling, 0 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-07-13 18:49 UTC (permalink / raw)
To: Guenter Roeck, Steven Rostedt
Cc: Wim Van Sebroeck, Jonathan Corbet, Ingo Molnar, Thomas Gleixner,
Peter Zijlstra, Will Deacon, Catalin Marinas, Marco Elver,
Dmitry Vyukov, Paul E. McKenney, Shuah Khan, Gabriele Paoloni,
Juri Lelli, Clark Williams, linux-doc, linux-kernel,
linux-trace-devel
On 6/17/22 01:55, Guenter Roeck wrote:
>>
>> ack! I will change it. (I am seeing unsigned int, am I missing something?).
>
> Yes, you are correct.
Fixed!
-- Daniel
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 20/20] Documentation/rv: Add watchdog-monitor documentation
2022-07-07 12:41 ` Tao Zhou
@ 2022-07-13 18:51 ` Daniel Bristot de Oliveira
0 siblings, 0 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-07-13 18:51 UTC (permalink / raw)
To: Tao Zhou
Cc: Steven Rostedt, Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet,
Ingo Molnar, Thomas Gleixner, Peter Zijlstra, Will Deacon,
Catalin Marinas, Marco Elver, Dmitry Vyukov, Paul E. McKenney,
Shuah Khan, Gabriele Paoloni, Juri Lelli, Clark Williams,
linux-doc, linux-kernel, linux-trace-devel
On 7/7/22 14:41, Tao Zhou wrote:
> So I must check the model matrix in patch18 and the above graph to
> check if the matrix have the not right value or something in this
> graph go wrong.
It was my fault, the ASCII art generated by graph-easy was too wide, so I had to manually
change it... and so I broke it.
At least this validates that it is better to have it automatically generated :-)
Thanks for reviewing it Tao, I do appreciate these kind of reviews!!!!
-- Daniel
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 18/20] rv/monitor: Add safe watchdog monitor
2022-06-16 8:45 ` [PATCH V4 18/20] rv/monitor: Add safe watchdog monitor Daniel Bristot de Oliveira
2022-06-16 13:36 ` Guenter Roeck
2022-06-16 20:57 ` Randy Dunlap
@ 2022-07-13 19:13 ` Daniel Bristot de Oliveira
2 siblings, 0 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-07-13 19:13 UTC (permalink / raw)
To: Steven Rostedt, Guenter Roeck
Cc: Wim Van Sebroeck, Jonathan Corbet, Ingo Molnar, Thomas Gleixner,
Peter Zijlstra, Will Deacon, Catalin Marinas, Marco Elver,
Dmitry Vyukov, Paul E. McKenney, Shuah Khan, Gabriele Paoloni,
Juri Lelli, Clark Williams, linux-doc, linux-kernel,
linux-trace-devel
On 6/16/22 10:45, Daniel Bristot de Oliveira wrote:
> The watchdog is an essential building block for the usage of Linux in
> safety-critical systems because it allows the system to be monitored from
> an external element - the watchdog hardware, acting as a safety-monitor.
Guenter and Steven,
I will move the watchdog monitor to a separated thread, as it will require
further discussions specific to it, mainly to get feedback from watchdog
maintainers.
Anyways, I am adding additional information for the sample monitors based on our
discussions here.
They are:
I added documentation about the automata format and the translation between
the formal <-> dot -> C.
I am adding the .dot file to the tools/verification/models/ so that one can get
the .dot file and convert it to other formats, like, a png file. This
will make it easy to read the automata model.
I am adding a .rst documentation for each model, including details about it.
I will send the v5 of RV without the safe_wtd monitor and then start a new
one about the watchdog later, after getting the RV interface series ready.
-- Daniel
^ permalink raw reply [flat|nested] 82+ messages in thread
* Re: [PATCH V4 14/20] Documentation/rv: Add a basic documentation
2022-06-29 3:35 ` Bagas Sanjaya
@ 2022-07-13 19:30 ` Daniel Bristot de Oliveira
0 siblings, 0 replies; 82+ messages in thread
From: Daniel Bristot de Oliveira @ 2022-07-13 19:30 UTC (permalink / raw)
To: Bagas Sanjaya
Cc: Steven Rostedt, Wim Van Sebroeck, Guenter Roeck, Jonathan Corbet,
Ingo Molnar, Thomas Gleixner, Peter Zijlstra, Will Deacon,
Catalin Marinas, Marco Elver, Dmitry Vyukov, Paul E. McKenney,
Shuah Khan, Gabriele Paoloni, Juri Lelli, Clark Williams,
linux-doc, linux-kernel, linux-trace-devel
On 6/29/22 05:35, Bagas Sanjaya wrote:
>> + DE OLIVEIRA, Daniel Bristot, et al. *Automata-based formal analysis and
>> + verification of the real-time Linux kernel.* Ph.D. Thesis, 2020.
>> +
> Shouldn't these references be formatted citations reference syntax?
I improved them, but there is no single syntax. In practice, people find the
BibTeX "citation" from the place where the paper was published and let the
venue template do its work, formatting it properly (don't ask me what people
using word use... I just know that many people have a bad first impression of
papers made on word haha).
>
>> +For example::
>> +
>> + [root@f32 rv]# cat available_monitors
>> + wip
>> + wwnr
>> +
> I think the prompt should be just `#` (without username and host).
Fixed!
Thanks.
-- Daniel
> Thanks.
^ permalink raw reply [flat|nested] 82+ messages in thread
end of thread, other threads:[~2022-07-13 19:30 UTC | newest]
Thread overview: 82+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-06-16 8:44 [PATCH V4 00/20] The Runtime Verification (RV) interface Daniel Bristot de Oliveira
2022-06-16 8:44 ` [PATCH V4 01/20] rv: Add " Daniel Bristot de Oliveira
2022-06-23 17:21 ` Punit Agrawal
2022-07-01 13:24 ` Daniel Bristot de Oliveira
2022-06-23 20:26 ` Steven Rostedt
2022-07-04 19:49 ` Daniel Bristot de Oliveira
2022-07-06 17:49 ` Tao Zhou
2022-07-06 17:53 ` Matthew Wilcox
2022-07-08 15:36 ` Tao Zhou
2022-07-08 15:55 ` Matthew Wilcox
2022-07-08 14:39 ` Daniel Bristot de Oliveira
2022-07-10 15:11 ` Tao Zhou
2022-07-10 15:42 ` Steven Rostedt
2022-07-10 22:28 ` Tao Zhou
2022-06-16 8:44 ` [PATCH V4 02/20] rv: Add runtime reactors interface Daniel Bristot de Oliveira
2022-06-23 20:40 ` Steven Rostedt
2022-06-16 8:44 ` [PATCH V4 03/20] rv/include: Add helper functions for deterministic automata Daniel Bristot de Oliveira
2022-06-28 17:48 ` Steven Rostedt
2022-07-06 18:35 ` Tao Zhou
2022-07-13 18:38 ` Daniel Bristot de Oliveira
2022-06-16 8:44 ` [PATCH V4 04/20] rv/include: Add deterministic automata monitor definition via C macros Daniel Bristot de Oliveira
2022-07-06 18:56 ` Tao Zhou
2022-07-13 18:39 ` Daniel Bristot de Oliveira
2022-06-16 8:44 ` [PATCH V4 05/20] rv/include: Add instrumentation helper functions Daniel Bristot de Oliveira
2022-06-16 8:44 ` [PATCH V4 06/20] tools/rv: Add dot2c Daniel Bristot de Oliveira
2022-06-28 18:10 ` Steven Rostedt
2022-06-28 18:16 ` Steven Rostedt
2022-07-13 18:41 ` Daniel Bristot de Oliveira
2022-06-16 8:44 ` [PATCH V4 07/20] tools/rv: Add dot2k Daniel Bristot de Oliveira
2022-06-16 8:44 ` [PATCH V4 08/20] rv/monitor: Add the wip monitor skeleton created by dot2k Daniel Bristot de Oliveira
2022-06-28 19:02 ` Steven Rostedt
2022-06-16 8:44 ` [PATCH V4 09/20] rv/monitor: wip instrumentation and Makefile/Kconfig entries Daniel Bristot de Oliveira
2022-06-16 11:21 ` kernel test robot
2022-06-16 21:00 ` Randy Dunlap
2022-06-17 16:07 ` Daniel Bristot de Oliveira
2022-06-28 19:02 ` Steven Rostedt
2022-06-16 8:44 ` [PATCH V4 10/20] rv/monitor: Add the wwnr monitor skeleton created by dot2k Daniel Bristot de Oliveira
2022-07-06 20:08 ` Tao Zhou
2022-06-16 8:44 ` [PATCH V4 11/20] rv/monitor: wwnr instrumentation and Makefile/Kconfig entries Daniel Bristot de Oliveira
2022-06-16 13:47 ` kernel test robot
2022-06-28 19:05 ` Steven Rostedt
2022-06-16 8:44 ` [PATCH V4 12/20] rv/reactor: Add the printk reactor Daniel Bristot de Oliveira
2022-06-16 8:44 ` [PATCH V4 13/20] rv/reactor: Add the panic reactor Daniel Bristot de Oliveira
2022-06-16 15:20 ` kernel test robot
2022-06-16 21:03 ` Randy Dunlap
2022-06-17 16:09 ` Daniel Bristot de Oliveira
2022-07-13 18:47 ` Daniel Bristot de Oliveira
2022-06-28 19:06 ` Steven Rostedt
2022-06-16 8:44 ` [PATCH V4 14/20] Documentation/rv: Add a basic documentation Daniel Bristot de Oliveira
2022-06-29 3:35 ` Bagas Sanjaya
2022-07-13 19:30 ` Daniel Bristot de Oliveira
2022-06-16 8:44 ` [PATCH V4 15/20] Documentation/rv: Add deterministic automata monitor synthesis documentation Daniel Bristot de Oliveira
2022-06-28 19:09 ` Steven Rostedt
2022-06-16 8:44 ` [PATCH V4 16/20] Documentation/rv: Add deterministic automata instrumentation documentation Daniel Bristot de Oliveira
2022-06-16 8:44 ` [PATCH V4 17/20] watchdog/dev: Add tracepoints Daniel Bristot de Oliveira
2022-06-16 13:44 ` Guenter Roeck
2022-06-16 15:47 ` Daniel Bristot de Oliveira
2022-06-16 23:55 ` Guenter Roeck
2022-06-17 16:16 ` Daniel Bristot de Oliveira
2022-07-13 18:49 ` Daniel Bristot de Oliveira
2022-06-16 8:45 ` [PATCH V4 18/20] rv/monitor: Add safe watchdog monitor Daniel Bristot de Oliveira
2022-06-16 13:36 ` Guenter Roeck
2022-06-16 15:29 ` Daniel Bristot de Oliveira
[not found] ` <CA+wEVJbvcMZbCroO2_rdVxLvYkUo-ePxCwsp5vbDpoqys4HGWQ@mail.gmail.com>
2022-06-16 23:53 ` Guenter Roeck
2022-06-17 17:06 ` Daniel Bristot de Oliveira
2022-06-28 19:32 ` Steven Rostedt
2022-07-01 14:45 ` Guenter Roeck
2022-07-01 15:38 ` Steven Rostedt
2022-07-04 12:41 ` Daniel Bristot de Oliveira
2022-06-16 20:57 ` Randy Dunlap
2022-06-17 16:17 ` Daniel Bristot de Oliveira
2022-07-13 19:13 ` Daniel Bristot de Oliveira
2022-06-16 8:45 ` [PATCH V4 19/20] rv/safety_app: Add a safety_app sample Daniel Bristot de Oliveira
2022-06-16 8:45 ` [PATCH V4 20/20] Documentation/rv: Add watchdog-monitor documentation Daniel Bristot de Oliveira
2022-07-07 12:41 ` Tao Zhou
2022-07-13 18:51 ` Daniel Bristot de Oliveira
2022-06-22 7:24 ` [PATCH V4 00/20] The Runtime Verification (RV) interface Song Liu
2022-06-23 16:41 ` Daniel Bristot de Oliveira
2022-06-23 17:52 ` Song Liu
2022-06-23 20:29 ` Daniel Bristot de Oliveira
2022-06-23 21:10 ` Song Liu
2022-07-06 16:18 ` Tao Zhou
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).