Re: SystemTap 3.0 doesn't work on Ubuntu 14.04.4 LTS

[Josh Stone <jistone at redhat dot com>]

On 03/29/2016 06:34 AM, Aleksander Alekseev wrote:
>> Hello
>>
>> Today I decided to try SystemTap 3.0. Here is exactly what I did.
>>
>> For my experiments I created a new KVM virtual machine and installed a
>> clean Ubuntu 14.04.4 system from ISO image named:
>>
>> ubuntu-14.04.4-server-amd64.iso
>>
>> This distribution uses Linux kernel 4.2.0.
>>
>> At first I tried to use default systemtap package:
>>
>> sudo apt-get update
>> sudo apt-get install systemtap gcc
>> sudo apt-get install linux-headers-$(uname -r)
>>
>> Also I downloaded and installed:
>>
>> linux-image-4.2.0-27-generic-dbgsym_4.2.0-27.32_amd64.ddeb
>>
>> ... from here http://ddebs.ubuntu.com/pool/main/l/linux/
>>
>> Unfortunately SystemTap didn't work:
>>
>> http://pastebin.com/raw/GDry4JWJ
>>
>> According to copyright message it looks quite old so I decided to try
>> brand new SystemTap 3.0:
>>
>> ```
>> sudo apt-get remove systemtap
>> sudo apt-get install m4 g++ gettext libz-dev
>> wget
>> https://sourceware.org/systemtap/ftp/releases/systemtap-3.0.tar.gz
>> wget \
>> https://fedorahosted.org/releases/e/l/elfutils/0.159/elfutils-0.159.tar.bz2
>> tar -xvzf systemtap-3.0.tar.gz tar -xvjf elfutils-0.159.tar.bz2
>> cd systemtap-3.0
>> ./configure --with-elfutils=../elfutils-0.159
>> make -j2
>> sudo make install
>> ```
>>
>> As a side node SystemTap 3.0 doesn't compile with newer elfutils
>> 0.165.
>>
>> It turned out that newer SystemTap doesn't work on this system either:
>>
>> http://pastebin.com/raw/HvxaxFYw
>>
>> I found description of these error messages here:
>>
>>
>> """
>> Error -84 is EILSEQ: "illegal byte sequence". The kernel can return
>> this signal, for example if it cannot decode its own binary in the
>> region nearby the requested kprobe, or it finds instruction patterns
>> that its decoder has not been taught to handle. It's not a systemtap
>> bug.
>> """
>>
> 
> Oops, my email client accidentally sent this message before I finished
> it. "Here" supposed to be http://stackoverflow.com/a/22436660/1565238

As noted in that answer, can you provide "objdump -d" around those
addresses?

Are you sure the dbgsym you downloaded is an exact match for your
kernel?  It should have failed earlier if it wasn't, but a mismatch
could lead us to attempt kprobes on weird addresses, like in the middle
of an instruction.

Another thing to try is instead use "nd_syscall.open" etc. which will
probe functions by name, without requiring debuginfo at all.