ARM + jprobes/kretprobes SEGV/hangs/OOPS in 2.6.29 kernel

[Ananth N Mavinakayanahalli]

On Tue, Aug 25, 2009 at 04:19:22PM +0530, venki kaps wrote:
> Hi,
> 
> I have been tracing kernel system call information using
> the Kprobes/jprobes/kretprobes implementation in the 2.6.29 kernel on
> ARM architecture.
> Although the mainline kprobe/jprobe/kretprobe examples are working
> fine (do_fork),
> I have been facing some issues while running my own jprobe/kretprobe tests.
> 
> For instance, when I am planting jprobe at
> do_execve/sys_open/sys_close/sys_read/sys_write/,
> after registration of probe, segmentation fault is getting generated.
> The following is my code snapshot-
> 
> static int
> jdo_execve(char * filename,
> Â  Â  Â  Â  Â  Â  Â  Â char __user *__user *argv,
> Â  Â  Â  Â  Â  Â  Â  Â char __user *__user *envp,
> Â  Â  Â  Â  Â  Â  Â  Â struct pt_regs * regs)
> 
> {
> Â  Â  Â  Â  Â  Â  Â  Â jprobe_return();
> Â  Â  Â  Â  Â  Â  Â  Â return 0;
> }
> 
> static struct jprobe my_jprobe = {
>        .entry                          = jdo_execve,
> Â  Â  Â  Â  Â  Â  Â  Â .kp = {
>                         .symbol_name    = "do_execve",
> Â  Â  Â  Â  Â  Â  Â  },
> 
> };
> 
> static int __init jprobe_init(void) {
> 
> Â  Â  Â  Â if ((register_jprobe(&my_jprobe)) < 0) {
> Â  Â  Â  Â  Â  Â  Â  Â printk("%s %d,register_jprobe failed, returned\n",
> __FILE__, __LINE__);
> Â  Â  Â  Â  Â  Â  Â  Â return -1;
> Â  Â  Â  Â }
> Â  Â  Â  Â printk("%s %d,Planted jprobe at %p, handler addr %p\n",
> __FILE__, __LINE__,
> Â  Â  Â  Â  Â  Â  Â  Â  my_jprobe.kp.addr, my_jprobe.entry);
> 
> Â  Â  Â  Â return 0;
> }
> 
> static void __exit jprobe_exit(void) {
> Â  Â  Â  Â unregister_jprobe(&my_jprobe);
> Â  Â  Â  Â printk("%s %d,jprobe unregistered\n", __FILE__, __LINE__);
> }
> 
> And also system hangs for sys_open/sys_close/sys_read/sys_write with
> jprobes/kretprobes
> but there are no issues with kprobes.

I don't see much wrong with your module.

> Query:
> =====
> Â  Â  Â  Â - Are there any limitations for jptobes/kretporbes in mainline
> kernel for ARM?

Jprobes in general have quite a bit of architecture specific artefacts.
I wouldn't be surprised if ARM mainline does have a bug.

> Â  Â  Â  Â - Why it works for only do_fork and why not for others
> (do_execve/sys_open/sys_close/sys_read/sys_write)?
> Â  Â  Â  Â - Is it required any additional setup to achieve this?

No. I think you are better off bringing this up on the ARM kernel
mailing lists. Someone with a good knowledge of ARM architecture should
be able to help you out.

Ananth