Re: ARM + jprobes/kretprobes SEGV/hangs/OOPS in 2.6.29 kernel

[Ananth N Mavinakayanahalli <ananth at in dot ibm dot com>]

On Tue, Aug 25, 2009 at 04:19:22PM +0530, venki kaps wrote:
> Hi,
> 
> I have been tracing kernel system call information using
> the Kprobes/jprobes/kretprobes implementation in the 2.6.29 kernel on
> ARM architecture.
> Although the mainline kprobe/jprobe/kretprobe examples are working
> fine (do_fork),
> I have been facing some issues while running my own jprobe/kretprobe tests.
> 
> For instance, when I am planting jprobe at
> do_execve/sys_open/sys_close/sys_read/sys_write/,
> after registration of probe, segmentation fault is getting generated.
> The following is my code snapshot-
> 
> static int
> jdo_execve(char * filename,
> ? ? ? ? ? ? ? ?char __user *__user *argv,
> ? ? ? ? ? ? ? ?char __user *__user *envp,
> ? ? ? ? ? ? ? ?struct pt_regs * regs)
> 
> {
> ? ? ? ? ? ? ? ?jprobe_return();
> ? ? ? ? ? ? ? ?return 0;
> }
> 
> static struct jprobe my_jprobe = {
> ? ? ? ?.entry ? ? ? ? ? ? ? ? ? ? ? ? ?= jdo_execve,
> ? ? ? ? ? ? ? ?.kp = {
> ? ? ? ? ? ? ? ? ? ? ? ? .symbol_name ? ?= "do_execve",
> ? ? ? ? ? ? ? },
> 
> };
> 
> static int __init jprobe_init(void) {
> 
> ? ? ? ?if ((register_jprobe(&my_jprobe)) < 0) {
> ? ? ? ? ? ? ? ?printk("%s %d,register_jprobe failed, returned\n",
> __FILE__, __LINE__);
> ? ? ? ? ? ? ? ?return -1;
> ? ? ? ?}
> ? ? ? ?printk("%s %d,Planted jprobe at %p, handler addr %p\n",
> __FILE__, __LINE__,
> ? ? ? ? ? ? ? ? my_jprobe.kp.addr, my_jprobe.entry);
> 
> ? ? ? ?return 0;
> }
> 
> static void __exit jprobe_exit(void) {
> ? ? ? ?unregister_jprobe(&my_jprobe);
> ? ? ? ?printk("%s %d,jprobe unregistered\n", __FILE__, __LINE__);
> }
> 
> And also system hangs for sys_open/sys_close/sys_read/sys_write with
> jprobes/kretprobes
> but there are no issues with kprobes.

I don't see much wrong with your module.

> Query:
> =====
> ? ? ? ?- Are there any limitations for jptobes/kretporbes in mainline
> kernel for ARM?

Jprobes in general have quite a bit of architecture specific artefacts.
I wouldn't be surprised if ARM mainline does have a bug.

> ? ? ? ?- Why it works for only do_fork and why not for others
> (do_execve/sys_open/sys_close/sys_read/sys_write)?
> ? ? ? ?- Is it required any additional setup to achieve this?

No. I think you are better off bringing this up on the ARM kernel
mailing lists. Someone with a good knowledge of ARM architecture should
be able to help you out.

Ananth