debug.c

/*
 * Process debugging functions.
 *
 * Copyright 2000-2019 Willy Tarreau <willy@haproxy.org>.
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version
 * 2 of the License, or (at your option) any later version.
 *
 */


#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <time.h>
#include <stdio.h>
#include <stdlib.h>
#include <syslog.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/utsname.h>
#include <sys/wait.h>
#include <unistd.h>
#ifdef USE_EPOLL
#include <sys/epoll.h>
#endif

#include <haproxy/api.h>
#include <haproxy/applet.h>
#include <haproxy/buf.h>
#include <haproxy/cli.h>
#include <haproxy/clock.h>
#include <haproxy/debug.h>
#include <haproxy/fd.h>
#include <haproxy/global.h>
#include <haproxy/hlua.h>
#include <haproxy/http_ana.h>
#include <haproxy/log.h>
#include <haproxy/net_helper.h>
#include <haproxy/sc_strm.h>
#include <haproxy/stconn.h>
#include <haproxy/task.h>
#include <haproxy/thread.h>
#include <haproxy/time.h>
#include <haproxy/tools.h>
#include <haproxy/trace.h>
#include <import/ist.h>


/* The dump state is made of:
 *   - num_thread on the lowest 15 bits
 *   - a SYNC flag on bit 15 (waiting for sync start)
 *   - number of participating threads on bits 16-30
 * Initiating a dump consists in setting it to SYNC and incrementing the
 * num_thread part when entering the function. The first thread periodically
 * recounts active threads and compares it to the ready ones, and clears SYNC
 * and sets the number of participants to the value found, which serves as a
 * start signal. A thread finished dumping looks up the TID of the next active
 * thread after it and writes it in the lowest part. If there's none, it sets
 * the thread counter to the number of participants and resets that part,
 * which serves as an end-of-dump signal. All threads decrement the num_thread
 * part. Then all threads wait for the value to reach zero. Only used when
 * USE_THREAD_DUMP is set.
 */
#define THREAD_DUMP_TMASK     0x00007FFFU
#define THREAD_DUMP_FSYNC     0x00008000U
#define THREAD_DUMP_PMASK     0x7FFF0000U

/* Description of a component with name, version, path, build options etc. E.g.
 * one of them is haproxy. Others might be some clearly identified shared libs.
 * They're intentionally self-contained and to be placed into an array to make
 * it easier to find them in a core. The important fields (name and version)
 * are locally allocated, other ones are dynamic.
 */
struct post_mortem_component {
	char name[32];           // symbolic short name
	char version[32];        // exact version
	char *toolchain;         // compiler and version (e.g. gcc-11.4.0)
	char *toolchain_opts;    // optims, arch-specific options (e.g. CFLAGS)
	char *build_settings;    // build options (e.g. USE_*, TARGET, etc)
	char *path;              // path if known.
};

/* This is a collection of information that are centralized to help with core
 * dump analysis. It must be used with a public variable and gather elements
 * as much as possible without dereferences so that even when identified in a
 * core dump it's possible to get the most out of it even if the core file is
 * not much exploitable. It's aligned to 256 so that it's easy to spot, given
 * that being that large it will not change its size much.
 */
struct post_mortem {
	/* platform-specific information */
	struct {
		struct utsname utsname; // OS name+ver+arch+hostname
		char hw_vendor[64];     // hardware/hypervisor vendor when known
		char hw_family[64];     // hardware/hypervisor product family when known
		char hw_model[64];      // hardware/hypervisor product/model when known
		char brd_vendor[64];    // mainboard vendor when known
		char brd_model[64];     // mainboard model when known
		char soc_vendor[64];    // SoC/CPU vendor from cpuinfo
		char soc_model[64];     // SoC model when known and relevant
		char cpu_model[64];     // CPU model when different from SoC
		char virt_techno[16];   // when provided by cpuid
		char cont_techno[16];   // empty, "no", "yes", "docker" or others
	} platform;

	/* process-specific information */
	struct {
		pid_t pid;
		uid_t boot_uid;
		gid_t boot_gid;
		struct rlimit limit_fd;  // RLIMIT_NOFILE
		struct rlimit limit_ram; // RLIMIT_DATA

#if defined(USE_THREAD)
		struct {
			ullong pth_id;   // pthread_t cast to a ullong
			void *stack_top; // top of the stack
		} thread_info[MAX_THREADS];
#endif
	} process;

#if defined(HA_HAVE_DUMP_LIBS)
	/* information about dynamic shared libraries involved */
	char *libs;                      // dump of one addr / path per line, or NULL
#endif

	/* info about identified distinct components (executable, shared libs, etc).
	 * These can be all listed at once in gdb using:
	 *    p *post_mortem.components@post_mortem.nb_components
	 */
	uint nb_components;              // # of components below
	struct post_mortem_component *components; // NULL or array
} post_mortem ALIGNED(256) = { };

/* Points to a copy of the buffer where the dump functions should write, when
 * non-null. It's only used by debuggers for core dump analysis.
 */
struct buffer *thread_dump_buffer = NULL;
unsigned int debug_commands_issued = 0;

/* dumps a backtrace of the current thread that is appended to buffer <buf>.
 * Lines are prefixed with the string <prefix> which may be empty (used for
 * indenting). It is recommended to use this at a function's tail so that
 * the function does not appear in the call stack. The <dump> argument
 * indicates what dump state to start from, and should usually be zero. It
 * may be among the following values:
 *   - 0: search usual callers before step 1, or directly jump to 2
 *   - 1: skip usual callers before step 2
 *   - 2: dump until polling loop, scheduler, or main() (excluded)
 *   - 3: end
 *   - 4-7: like 0 but stops *after* main.
 */
void ha_dump_backtrace(struct buffer *buf, const char *prefix, int dump)
{
	struct buffer bak;
	char pfx2[100];
	void *callers[100];
	int j, nptrs;
	const void *addr;

	nptrs = my_backtrace(callers, sizeof(callers)/sizeof(*callers));
	if (!nptrs)
		return;

	if (snprintf(pfx2, sizeof(pfx2), "%s| ", prefix) > sizeof(pfx2))
		pfx2[0] = 0;

	/* The call backtrace_symbols_fd(callers, nptrs, STDOUT_FILENO would
	 * produce similar output to the following:
	 */
	chunk_appendf(buf, "%scall trace(%d):\n", prefix, nptrs);
	for (j = 0; (j < nptrs || (dump & 3) < 2); j++) {
		if (j == nptrs && !(dump & 3)) {
			/* we failed to spot the starting point of the
			 * dump, let's start over dumping everything we
			 * have.
			 */
			dump += 2;
			j = 0;
		}
		bak = *buf;
		dump_addr_and_bytes(buf, pfx2, callers[j], 8);
		addr = resolve_sym_name(buf, ": ", callers[j]);
		if ((dump & 3) == 0) {
			/* dump not started, will start *after* ha_thread_dump_one(),
			 * ha_panic and ha_backtrace_to_stderr
			 */
			if (addr == ha_panic ||
			    addr == ha_backtrace_to_stderr || addr == ha_thread_dump_one)
				dump++;
			*buf = bak;
			continue;
		}

		if ((dump & 3) == 1) {
			/* starting */
			if (addr == ha_panic ||
			    addr == ha_backtrace_to_stderr || addr == ha_thread_dump_one) {
				*buf = bak;
				continue;
			}
			dump++;
		}

		if ((dump & 3) == 2) {
			/* still dumping */
			if (dump == 6) {
				/* we only stop *after* main and we must send the LF */
				if (addr == main) {
					j = nptrs;
					dump++;
				}
			}
			else if (addr == run_poll_loop || addr == main || addr == run_tasks_from_lists) {
				dump++;
				*buf = bak;
				break;
			}
		}
		/* OK, line dumped */
		chunk_appendf(buf, "\n");
	}
}

/* dump a backtrace of current thread's stack to stderr. */
void ha_backtrace_to_stderr(void)
{
	char area[2048];
	struct buffer b = b_make(area, sizeof(area), 0, 0);

	ha_dump_backtrace(&b, "  ", 4);
	if (b.data)
		DISGUISE(write(2, b.area, b.data));
}

/* Dumps to the thread's buffer some known information for the desired thread,
 * and optionally extra info when it's safe to do so (current thread or
 * isolated). The dump will be appended to the buffer, so the caller is
 * responsible for preliminary initializing it. The <from_signal> argument will
 * indicate if the function is called from the debug signal handler, indicating
 * the thread was dumped upon request from another one, otherwise if the thread
 * it the current one, a star ('*') will be displayed in front of the thread to
 * indicate the requesting one. Any stuck thread is also prefixed with a '>'.
 * The caller is responsible for atomically setting up the thread's dump buffer
 * to point to a valid buffer with enough room. Output will be truncated if it
 * does not fit. When the dump is complete, the dump buffer will be switched to
 * (void*)0x1 that the caller must turn to 0x0 once the contents are collected.
 */
void ha_thread_dump_one(int thr, int from_signal)
{
	struct buffer *buf = HA_ATOMIC_LOAD(&ha_thread_ctx[thr].thread_dump_buffer);
	unsigned long __maybe_unused thr_bit = ha_thread_info[thr].ltid_bit;
	int __maybe_unused tgrp  = ha_thread_info[thr].tgid;
	unsigned long long p = ha_thread_ctx[thr].prev_cpu_time;
	unsigned long long n = now_cpu_time_thread(thr);
	int stuck = !!(ha_thread_ctx[thr].flags & TH_FL_STUCK);

	chunk_appendf(buf,
	              "%c%cThread %-2u: id=0x%llx act=%d glob=%d wq=%d rq=%d tl=%d tlsz=%d rqsz=%d\n"
	              "     %2u/%-2u   stuck=%d prof=%d",
	              (thr == tid && !from_signal) ? '*' : ' ', stuck ? '>' : ' ', thr + 1,
		      ha_get_pthread_id(thr),
		      thread_has_tasks(),
	              !eb_is_empty(&ha_thread_ctx[thr].rqueue_shared),
	              !eb_is_empty(&ha_thread_ctx[thr].timers),
	              !eb_is_empty(&ha_thread_ctx[thr].rqueue),
	              !(LIST_ISEMPTY(&ha_thread_ctx[thr].tasklets[TL_URGENT]) &&
			LIST_ISEMPTY(&ha_thread_ctx[thr].tasklets[TL_NORMAL]) &&
			LIST_ISEMPTY(&ha_thread_ctx[thr].tasklets[TL_BULK]) &&
			MT_LIST_ISEMPTY(&ha_thread_ctx[thr].shared_tasklet_list)),
	              ha_thread_ctx[thr].tasks_in_list,
	              ha_thread_ctx[thr].rq_total,
		      ha_thread_info[thr].tgid, ha_thread_info[thr].ltid + 1,
	              stuck,
	              !!(ha_thread_ctx[thr].flags & TH_FL_TASK_PROFILING));

#if defined(USE_THREAD)
	chunk_appendf(buf,
	              " harmless=%d isolated=%d",
	              !!(_HA_ATOMIC_LOAD(&ha_tgroup_ctx[tgrp-1].threads_harmless) & thr_bit),
		      isolated_thread == thr);
#endif

	chunk_appendf(buf, "\n");
	chunk_appendf(buf, "             cpu_ns: poll=%llu now=%llu diff=%llu\n", p, n, n-p);

	/* this is the end of what we can dump from outside the current thread */

	if (thr != tid && !thread_isolated())
		goto leave;

	chunk_appendf(buf, "             curr_task=");
	ha_task_dump(buf, th_ctx->current, "             ");

	if (stuck && thr == tid) {
#ifdef USE_LUA
		if (th_ctx->current &&
		    th_ctx->current->process == process_stream && th_ctx->current->context) {
			const struct stream *s = (const struct stream *)th_ctx->current->context;
			struct hlua *hlua = NULL;

			if (s) {
				if (s->hlua[0] && HLUA_IS_BUSY(s->hlua[0]))
					hlua = s->hlua[0];
				else if (s->hlua[1] && HLUA_IS_BUSY(s->hlua[1]))
					hlua = s->hlua[1];
			}
			if (hlua) {
				mark_tainted(TAINTED_LUA_STUCK);
				if (hlua->state_id == 0)
					mark_tainted(TAINTED_LUA_STUCK_SHARED);
			}
		}
#endif

		if (HA_ATOMIC_LOAD(&pool_trim_in_progress))
			mark_tainted(TAINTED_MEM_TRIMMING_STUCK);

		/* We only emit the backtrace for stuck threads in order not to
		 * waste precious output buffer space with non-interesting data.
		 * Please leave this as the last instruction in this function
		 * so that the compiler uses tail merging and the current
		 * function does not appear in the stack.
		 */
		ha_dump_backtrace(buf, "             ", 0);
	}
 leave:
	/* end of dump, setting the buffer to 0x1 will tell the caller we're done */
	HA_ATOMIC_STORE(&ha_thread_ctx[thr].thread_dump_buffer, (void*)0x1UL);
}

/* Triggers a thread dump from thread <thr>, either directly if it's the
 * current thread or if thread dump signals are not implemented, or by sending
 * a signal if it's a remote one and the feature is supported. The buffer <buf>
 * will get the dump appended, and the caller is responsible for making sure
 * there is enough room otherwise some contents will be truncated.
 */
void ha_thread_dump(struct buffer *buf, int thr)
{
	struct buffer *old = NULL;

	/* try to impose our dump buffer and to reserve the target thread's
	 * next dump for us.
	 */
	do {
		if (old)
			ha_thread_relax();
		old = NULL;
	} while (!HA_ATOMIC_CAS(&ha_thread_ctx[thr].thread_dump_buffer, &old, buf));

#ifdef USE_THREAD_DUMP
	/* asking the remote thread to dump itself allows to get more details
	 * including a backtrace.
	 */
	if (thr != tid)
		ha_tkill(thr, DEBUGSIG);
	else
#endif
		ha_thread_dump_one(thr, thr != tid);

	/* now wait for the dump to be done, and release it */
	do {
		if (old)
			ha_thread_relax();
		old = (void*)0x01;
	} while (!HA_ATOMIC_CAS(&ha_thread_ctx[thr].thread_dump_buffer, &old, 0));
}

/* dumps into the buffer some information related to task <task> (which may
 * either be a task or a tasklet, and prepend each line except the first one
 * with <pfx>. The buffer is only appended and the first output starts by the
 * pointer itself. The caller is responsible for making sure the task is not
 * going to vanish during the dump.
 */
void ha_task_dump(struct buffer *buf, const struct task *task, const char *pfx)
{
	const struct stream *s = NULL;
	const struct appctx __maybe_unused *appctx = NULL;
	struct hlua __maybe_unused *hlua = NULL;
	const struct stconn *sc;

	if (!task) {
		chunk_appendf(buf, "0\n");
		return;
	}

	if (TASK_IS_TASKLET(task))
		chunk_appendf(buf,
		              "%p (tasklet) calls=%u\n",
		              task,
		              task->calls);
	else
		chunk_appendf(buf,
		              "%p (task) calls=%u last=%llu%s\n",
		              task,
		              task->calls,
		              task->wake_date ? (unsigned long long)(now_mono_time() - task->wake_date) : 0,
		              task->wake_date ? " ns ago" : "");

	chunk_appendf(buf, "%s  fct=%p(", pfx, task->process);
	resolve_sym_name(buf, NULL, task->process);
	chunk_appendf(buf,") ctx=%p", task->context);

	if (task->process == task_run_applet && (appctx = task->context))
		chunk_appendf(buf, "(%s)\n", appctx->applet->name);
	else
		chunk_appendf(buf, "\n");

	if (task->process == process_stream && task->context)
		s = (struct stream *)task->context;
	else if (task->process == task_run_applet && task->context && (sc = appctx_sc((struct appctx *)task->context)))
		s = sc_strm(sc);
	else if (task->process == sc_conn_io_cb && task->context)
		s = sc_strm(((struct stconn *)task->context));

	if (s) {
		chunk_appendf(buf, "%sstream=", pfx);
		strm_dump_to_buffer(buf, s, pfx, HA_ATOMIC_LOAD(&global.anon_key));
	}

#ifdef USE_LUA
	hlua = NULL;
	if (s && ((s->hlua[0] && HLUA_IS_BUSY(s->hlua[0])) ||
	    (s->hlua[1] && HLUA_IS_BUSY(s->hlua[1])))) {
		hlua = (s->hlua[0] && HLUA_IS_BUSY(s->hlua[0])) ? s->hlua[0] : s->hlua[1];
		chunk_appendf(buf, "%sCurrent executing Lua from a stream analyser -- ", pfx);
	}
	else if (task->process == hlua_process_task && (hlua = task->context)) {
		chunk_appendf(buf, "%sCurrent executing a Lua task -- ", pfx);
	}
	else if (task->process == task_run_applet && (appctx = task->context) &&
		 (appctx->applet->fct == hlua_applet_tcp_fct)) {
		chunk_appendf(buf, "%sCurrent executing a Lua TCP service -- ", pfx);
	}
	else if (task->process == task_run_applet && (appctx = task->context) &&
		 (appctx->applet->fct == hlua_applet_http_fct)) {
		chunk_appendf(buf, "%sCurrent executing a Lua HTTP service -- ", pfx);
	}

	if (hlua && hlua->T) {
		chunk_appendf(buf, "stack traceback:\n    ");
		append_prefixed_str(buf, hlua_traceback(hlua->T, "\n    "), pfx, '\n', 0);
	}

	/* we may need to terminate the current line */
	if (*b_peek(buf, b_data(buf)-1) != '\n')
		b_putchr(buf, '\n');
#endif
}

/* This function dumps all profiling settings. It returns 0 if the output
 * buffer is full and it needs to be called again, otherwise non-zero.
 */
static int cli_io_handler_show_threads(struct appctx *appctx)
{
	int thr;

	if (appctx->st0)
		thr = appctx->st1;
	else
		thr = 0;

	do {
		chunk_reset(&trash);
		ha_thread_dump(&trash, thr);

		if (applet_putchk(appctx, &trash) == -1) {
			/* failed, try again */
			appctx->st1 = thr;
			return 0;
		}
		thr++;
	} while (thr < global.nbthread);

	return 1;
}

#if defined(HA_HAVE_DUMP_LIBS)
/* parse a "show libs" command. It returns 1 if it emits anything otherwise zero. */
static int debug_parse_cli_show_libs(char **args, char *payload, struct appctx *appctx, void *private)
{
	if (!cli_has_level(appctx, ACCESS_LVL_OPER))
		return 1;

	chunk_reset(&trash);
	if (dump_libs(&trash, 1))
		return cli_msg(appctx, LOG_INFO, trash.area);
	else
		return 0;
}
#endif

/* parse a "show dev" command. It returns 1 if it emits anything otherwise zero. */
static int debug_parse_cli_show_dev(char **args, char *payload, struct appctx *appctx, void *private)
{
	const char **build_opt;

	if (*args[2])
		return cli_err(appctx, "This command takes no argument.\n");

	chunk_reset(&trash);

	chunk_appendf(&trash, "Features\n  %s\n", build_features);

	chunk_appendf(&trash, "Build options\n");
	for (build_opt = NULL; (build_opt = hap_get_next_build_opt(build_opt)); )
		if (append_prefixed_str(&trash, *build_opt, "  ", '\n', 0) == 0)
			chunk_strcat(&trash, "\n");

	chunk_appendf(&trash, "Platform info\n");
	if (*post_mortem.platform.hw_vendor)
		chunk_appendf(&trash, "  machine vendor: %s\n", post_mortem.platform.hw_vendor);
	if (*post_mortem.platform.hw_family)
		chunk_appendf(&trash, "  machine family: %s\n", post_mortem.platform.hw_family);
	if (*post_mortem.platform.hw_model)
		chunk_appendf(&trash, "  machine model: %s\n", post_mortem.platform.hw_model);
	if (*post_mortem.platform.brd_vendor)
		chunk_appendf(&trash, "  board vendor: %s\n", post_mortem.platform.brd_vendor);
	if (*post_mortem.platform.brd_model)
		chunk_appendf(&trash, "  board model: %s\n", post_mortem.platform.brd_model);
	if (*post_mortem.platform.soc_vendor)
		chunk_appendf(&trash, "  soc vendor: %s\n", post_mortem.platform.soc_vendor);
	if (*post_mortem.platform.soc_model)
		chunk_appendf(&trash, "  soc model: %s\n", post_mortem.platform.soc_model);
	if (*post_mortem.platform.cpu_model)
		chunk_appendf(&trash, "  cpu model: %s\n", post_mortem.platform.cpu_model);
	if (*post_mortem.platform.virt_techno)
		chunk_appendf(&trash, "  virtual machine: %s\n", post_mortem.platform.virt_techno);
	if (*post_mortem.platform.cont_techno)
		chunk_appendf(&trash, "  container: %s\n", post_mortem.platform.cont_techno);
	if (*post_mortem.platform.utsname.sysname)
		chunk_appendf(&trash, "  OS name: %s\n", post_mortem.platform.utsname.sysname);
	if (*post_mortem.platform.utsname.release)
		chunk_appendf(&trash, "  OS release: %s\n", post_mortem.platform.utsname.release);
	if (*post_mortem.platform.utsname.version)
		chunk_appendf(&trash, "  OS version: %s\n", post_mortem.platform.utsname.version);
	if (*post_mortem.platform.utsname.machine)
		chunk_appendf(&trash, "  OS architecture: %s\n", post_mortem.platform.utsname.machine);
	if (*post_mortem.platform.utsname.nodename)
		chunk_appendf(&trash, "  node name: %s\n", HA_ANON_CLI(post_mortem.platform.utsname.nodename));

	chunk_appendf(&trash, "Process info\n");
	chunk_appendf(&trash, "  pid: %d\n", post_mortem.process.pid);
	chunk_appendf(&trash, "  boot uid: %d\n", post_mortem.process.boot_uid);
	chunk_appendf(&trash, "  boot gid: %d\n", post_mortem.process.boot_gid);

	if ((ulong)post_mortem.process.limit_fd.rlim_cur != RLIM_INFINITY)
		chunk_appendf(&trash, "  fd limit (soft): %lu\n", (ulong)post_mortem.process.limit_fd.rlim_cur);
	if ((ulong)post_mortem.process.limit_fd.rlim_max != RLIM_INFINITY)
		chunk_appendf(&trash, "  fd limit (hard): %lu\n", (ulong)post_mortem.process.limit_fd.rlim_max);
	if ((ulong)post_mortem.process.limit_ram.rlim_cur != RLIM_INFINITY)
		chunk_appendf(&trash, "  ram limit (soft): %lu\n", (ulong)post_mortem.process.limit_ram.rlim_cur);
	if ((ulong)post_mortem.process.limit_ram.rlim_max != RLIM_INFINITY)
		chunk_appendf(&trash, "  ram limit (hard): %lu\n", (ulong)post_mortem.process.limit_ram.rlim_max);

	return cli_msg(appctx, LOG_INFO, trash.area);
}

/* Dumps a state of all threads into the trash and on fd #2, then aborts.
 * A copy will be put into a trash chunk that's assigned to thread_dump_buffer
 * so that the debugger can easily find it. This buffer might be truncated if
 * too many threads are being dumped, but at least we'll dump them all on stderr.
 * If thread_dump_buffer is set, it means that a panic has already begun.
 */
void ha_panic()
{
	struct buffer *old;
	unsigned int thr;

	mark_tainted(TAINTED_PANIC);

	old = NULL;
	if (!HA_ATOMIC_CAS(&thread_dump_buffer, &old, get_trash_chunk())) {
		/* a panic dump is already in progress, let's not disturb it,
		 * we'll be called via signal DEBUGSIG. By returning we may be
		 * able to leave a current signal handler (e.g. WDT) so that
		 * this will ensure more reliable signal delivery.
		 */
		return;
	}

	chunk_reset(&trash);
	chunk_appendf(&trash, "Thread %u is about to kill the process.\n", tid + 1);

	for (thr = 0; thr < global.nbthread; thr++) {
		ha_thread_dump(&trash, thr);
		DISGUISE(write(2, trash.area, trash.data));
		b_force_xfer(thread_dump_buffer, &trash, b_room(thread_dump_buffer));
		chunk_reset(&trash);
	}

#ifdef USE_LUA
	if (get_tainted() & TAINTED_LUA_STUCK_SHARED && global.nbthread > 1) {
		chunk_printf(&trash,
			     "### Note: at least one thread was stuck in a Lua context loaded using the\n"
			     "          'lua-load' directive, which is known for causing heavy contention\n"
			     "          when used with threads. Please consider using 'lua-load-per-thread'\n"
			     "          instead if your code is safe to run in parallel on multiple threads.\n");
		DISGUISE(write(2, trash.area, trash.data));
	}
	else if (get_tainted() & TAINTED_LUA_STUCK) {
		chunk_printf(&trash,
			     "### Note: at least one thread was stuck in a Lua context in a way that suggests\n"
			     "          heavy processing inside a dependency or a long loop that can't yield.\n"
			     "          Please make sure any external code you may rely on is safe for use in\n"
			     "          an event-driven engine.\n");
		DISGUISE(write(2, trash.area, trash.data));
	}
#endif
	if (get_tainted() & TAINTED_MEM_TRIMMING_STUCK) {
		chunk_printf(&trash,
			     "### Note: one thread was found stuck under malloc_trim(), which can run for a\n"
			     "          very long time on large memory systems. You way want to disable this\n"
			     "          memory reclaiming feature by setting 'no-memory-trimming' in the\n"
			     "          'global' section of your configuration to avoid this in the future.\n");
		DISGUISE(write(2, trash.area, trash.data));
	}

	for (;;)
		abort();
}

/* Complain with message <msg> on stderr. If <counter> is not NULL, it is
 * atomically incremented, and the message is only printed when the counter
 * was zero, so that the message is only printed once. <taint> is only checked
 * on bit 1, and will taint the process either for a bug (2) or warn (0).
 */
void complain(int *counter, const char *msg, int taint)
{
	if (counter && _HA_ATOMIC_FETCH_ADD(counter, 1))
		return;
	DISGUISE(write(2, msg, strlen(msg)));
	if (taint & 2)
		mark_tainted(TAINTED_BUG);
	else
		mark_tainted(TAINTED_WARN);
}

/* parse a "debug dev exit" command. It always returns 1, though it should never return. */
static int debug_parse_cli_exit(char **args, char *payload, struct appctx *appctx, void *private)
{
	int code = atoi(args[3]);

	if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
		return 1;

	_HA_ATOMIC_INC(&debug_commands_issued);
	exit(code);
	return 1;
}

/* parse a "debug dev bug" command. It always returns 1, though it should never return.
 * Note: we make sure not to make the function static so that it appears in the trace.
 */
int debug_parse_cli_bug(char **args, char *payload, struct appctx *appctx, void *private)
{
	if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
		return 1;

	_HA_ATOMIC_INC(&debug_commands_issued);
	BUG_ON(one > zero, "This was triggered on purpose from the CLI 'debug dev bug' command.");
	return 1;
}

/* parse a "debug dev warn" command. It always returns 1.
 * Note: we make sure not to make the function static so that it appears in the trace.
 */
int debug_parse_cli_warn(char **args, char *payload, struct appctx *appctx, void *private)
{
	if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
		return 1;

	_HA_ATOMIC_INC(&debug_commands_issued);
	WARN_ON(one > zero, "This was triggered on purpose from the CLI 'debug dev warn' command.");
	return 1;
}

/* parse a "debug dev check" command. It always returns 1.
 * Note: we make sure not to make the function static so that it appears in the trace.
 */
int debug_parse_cli_check(char **args, char *payload, struct appctx *appctx, void *private)
{
	if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
		return 1;

	_HA_ATOMIC_INC(&debug_commands_issued);
	CHECK_IF(one > zero, "This was triggered on purpose from the CLI 'debug dev check' command.");
	return 1;
}

/* parse a "debug dev close" command. It always returns 1. */
static int debug_parse_cli_close(char **args, char *payload, struct appctx *appctx, void *private)
{
	int fd;

	if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
		return 1;

	if (!*args[3])
		return cli_err(appctx, "Missing file descriptor number.\n");

	fd = atoi(args[3]);
	if (fd < 0 || fd >= global.maxsock)
		return cli_err(appctx, "File descriptor out of range.\n");

	if (!fdtab[fd].owner)
		return cli_msg(appctx, LOG_INFO, "File descriptor was already closed.\n");

	_HA_ATOMIC_INC(&debug_commands_issued);
	fd_delete(fd);
	return 1;
}

/* this is meant to cause a deadlock when more than one task is running it or when run twice */
static struct task *debug_run_cli_deadlock(struct task *task, void *ctx, unsigned int state)
{
	static HA_SPINLOCK_T lock __maybe_unused;

	HA_SPIN_LOCK(OTHER_LOCK, &lock);
	return NULL;
}

/* parse a "debug dev deadlock" command. It always returns 1. */
static int debug_parse_cli_deadlock(char **args, char *payload, struct appctx *appctx, void *private)
{
	int tasks;

	if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
		return 1;

	_HA_ATOMIC_INC(&debug_commands_issued);
	for (tasks = atoi(args[3]); tasks > 0; tasks--) {
		struct task *t = task_new_on(tasks % global.nbthread);
		if (!t)
			continue;
		t->process = debug_run_cli_deadlock;
		t->context = NULL;
		task_wakeup(t, TASK_WOKEN_INIT);
	}

	return 1;
}

/* parse a "debug dev delay" command. It always returns 1. */
static int debug_parse_cli_delay(char **args, char *payload, struct appctx *appctx, void *private)
{
	int delay = atoi(args[3]);

	if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
		return 1;

	_HA_ATOMIC_INC(&debug_commands_issued);
	usleep((long)delay * 1000);
	return 1;
}

/* parse a "debug dev log" command. It always returns 1. */
static int debug_parse_cli_log(char **args, char *payload, struct appctx *appctx, void *private)
{
	int arg;

	if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
		return 1;

	_HA_ATOMIC_INC(&debug_commands_issued);
	chunk_reset(&trash);
	for (arg = 3; *args[arg]; arg++) {
		if (arg > 3)
			chunk_strcat(&trash, " ");
		chunk_strcat(&trash, args[arg]);
	}

	send_log(NULL, LOG_INFO, "%s\n", trash.area);
	return 1;
}

/* parse a "debug dev loop" command. It always returns 1. */
static int debug_parse_cli_loop(char **args, char *payload, struct appctx *appctx, void *private)
{
	struct timeval deadline, curr;
	int loop = atoi(args[3]);
	int isolate;

	if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
		return 1;

	isolate = strcmp(args[4], "isolated") == 0;

	_HA_ATOMIC_INC(&debug_commands_issued);
	gettimeofday(&curr, NULL);
	tv_ms_add(&deadline, &curr, loop);

	if (isolate)
		thread_isolate();

	while (tv_ms_cmp(&curr, &deadline) < 0)
		gettimeofday(&curr, NULL);

	if (isolate)
		thread_release();

	return 1;
}

/* parse a "debug dev panic" command. It always returns 1, though it should never return. */
static int debug_parse_cli_panic(char **args, char *payload, struct appctx *appctx, void *private)
{
	if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
		return 1;

	_HA_ATOMIC_INC(&debug_commands_issued);
	ha_panic();
	return 1;
}

/* parse a "debug dev exec" command. It always returns 1. */
#if defined(DEBUG_DEV)
static int debug_parse_cli_exec(char **args, char *payload, struct appctx *appctx, void *private)
{
	int pipefd[2];
	int arg;
	int pid;

	if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
		return 1;

	_HA_ATOMIC_INC(&debug_commands_issued);
	chunk_reset(&trash);
	for (arg = 3; *args[arg]; arg++) {
		if (arg > 3)
			chunk_strcat(&trash, " ");
		chunk_strcat(&trash, args[arg]);
	}

	thread_isolate();
	if (pipe(pipefd) < 0)
		goto fail_pipe;

	if (fd_set_cloexec(pipefd[0]) == -1)
		goto fail_fcntl;

	if (fd_set_cloexec(pipefd[1]) == -1)
		goto fail_fcntl;

	pid = fork();

	if (pid < 0)
		goto fail_fork;
	else if (pid == 0) {
		/* child */
		char *cmd[4] = { "/bin/sh", "-c", 0, 0 };

		close(0);
		dup2(pipefd[1], 1);
		dup2(pipefd[1], 2);

		cmd[2] = trash.area;
		execvp(cmd[0], cmd);
		printf("execvp() failed\n");
		exit(1);
	}

	/* parent */
	thread_release();
	close(pipefd[1]);
	chunk_reset(&trash);
	while (1) {
		size_t ret = read(pipefd[0], trash.area + trash.data, trash.size - 20 - trash.data);
		if (ret <= 0)
			break;
		trash.data += ret;
		if (trash.data + 20 == trash.size) {
			chunk_strcat(&trash, "\n[[[TRUNCATED]]]\n");
			break;
		}
	}
	close(pipefd[0]);
	waitpid(pid, NULL, WNOHANG);
	trash.area[trash.data] = 0;
	return cli_msg(appctx, LOG_INFO, trash.area);

 fail_fork:
 fail_fcntl:
	close(pipefd[0]);
	close(pipefd[1]);
 fail_pipe:
	thread_release();
	return cli_err(appctx, "Failed to execute command.\n");
}

/* handles SIGRTMAX to inject random delays on the receiving thread in order
 * to try to increase the likelihood to reproduce inter-thread races. The
 * signal is periodically sent by a task initiated by "debug dev delay-inj".
 */
void debug_delay_inj_sighandler(int sig, siginfo_t *si, void *arg)
{
	volatile int i = statistical_prng_range(10000);

	while (i--)
		__ha_cpu_relax();
}
#endif

/* parse a "debug dev hex" command. It always returns 1. */
static int debug_parse_cli_hex(char **args, char *payload, struct appctx *appctx, void *private)
{
	unsigned long start, len;

	if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
		return 1;

	if (!*args[3])
		return cli_err(appctx, "Missing memory address to dump from.\n");

	start = strtoul(args[3], NULL, 0);
	if (!start)
		return cli_err(appctx, "Will not dump from NULL address.\n");

	_HA_ATOMIC_INC(&debug_commands_issued);

	/* by default, dump ~128 till next block of 16 */
	len = strtoul(args[4], NULL, 0);
	if (!len)
		len = ((start + 128) & -16) - start;

	chunk_reset(&trash);
	dump_hex(&trash, "  ", (const void *)start, len, 1);
	trash.area[trash.data] = 0;
	return cli_msg(appctx, LOG_INFO, trash.area);
}

/* parse a "debug dev sym <addr>" command. It always returns 1. */
static int debug_parse_cli_sym(char **args, char *payload, struct appctx *appctx, void *private)
{
	unsigned long addr;

	if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
		return 1;

	if (!*args[3])
		return cli_err(appctx, "Missing memory address to be resolved.\n");

	_HA_ATOMIC_INC(&debug_commands_issued);

	addr = strtoul(args[3], NULL, 0);
	chunk_printf(&trash, "%#lx resolves to ", addr);
	resolve_sym_name(&trash, NULL, (const void *)addr);
	chunk_appendf(&trash, "\n");

	return cli_msg(appctx, LOG_INFO, trash.area);
}

/* parse a "debug dev tkill" command. It always returns 1. */
static int debug_parse_cli_tkill(char **args, char *payload, struct appctx *appctx, void *private)
{
	int thr = 0;
	int sig = SIGABRT;

	if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
		return 1;

	if (*args[3])
		thr = atoi(args[3]);

	if (thr < 0 || thr > global.nbthread)
		return cli_err(appctx, "Thread number out of range (use 0 for current).\n");

	if (*args[4])
		sig = atoi(args[4]);

	_HA_ATOMIC_INC(&debug_commands_issued);
	if (thr)
		ha_tkill(thr - 1, sig);
	else
		raise(sig);
	return 1;
}

/* hashes 'word' in "debug dev hash 'word' ". */
static int debug_parse_cli_hash(char **args, char *payload, struct appctx *appctx, void *private)
{
	char *msg = NULL;

	cli_dynmsg(appctx, LOG_INFO, memprintf(&msg, "%s\n", HA_ANON_CLI(args[3])));
	return 1;
}

/* parse a "debug dev write" command. It always returns 1. */
static int debug_parse_cli_write(char **args, char *payload, struct appctx *appctx, void *private)
{
	unsigned long len;

	if (!*args[3])
		return cli_err(appctx, "Missing output size.\n");

	len = strtoul(args[3], NULL, 0);