same kernel working with 1 userspace filesystem and not with another one (Android IceCreamSandwich and JellyBean)

same kernel working with 1 userspace filesystem and not with another one (Android IceCreamSandwich and JellyBean)

[Turgis, Frederic]

Hi,

We are starting an investigation but maybe someone would have an idea.
- kernels (K3.0 and K3.4) have an issue with Android JellyBean OS
   * probing tracepoints works well (we monitor IRQs)
   * probing functions does not work, it seems that nothing happens in that case (we just do a print, we only get tracepoints prints)
   * at test start, we get now "WARNING: build-id address 0 < base 0"

- same kernel with Android ICS OS works OK. Same kernel exactly so same build of script

- staprun/stapio are statically linked so would have in theory no link with userspace. So the difference between the 2 OSes would be insmod but not sure that makes sense. I guess we should try ICS insmod in JB.

Any clue ? How can userspace influence systemtap if tool is statically built ?

Regards
Fred


OMAP Platform Business Unit - System Platform Engineering - Platform & Product Entitlement



Texas Instruments France SA, 821 Avenue Jack Kilby, 06270 Villeneuve Loubet. 036 420 040 R.C.S Antibes. Capital de EUR 12.654.784

Re: same kernel working with 1 userspace filesystem and not with another one (Android IceCreamSandwich and JellyBean)

[Josh Stone]

On 10/05/2012 04:03 PM, Turgis, Frederic wrote:
> Hi,
> 
> We are starting an investigation but maybe someone would have an idea.
> - kernels (K3.0 and K3.4) have an issue with Android JellyBean OS
>    * probing tracepoints works well (we monitor IRQs)
>    * probing functions does not work, it seems that nothing happens in
>      that case (we just do a print, we only get tracepoints prints)
>    * at test start, we get now "WARNING: build-id address 0 < base 0"
> 
> - same kernel with Android ICS OS works OK. Same kernel exactly so
> same build of script
> 
> - staprun/stapio are statically linked so would have in theory no
> link with userspace. So the difference between the 2 OSes would be
> insmod but not sure that makes sense. I guess we should try ICS
> insmod in JB.

It's not insmod - we use init_module() directly.

> Any clue ? How can userspace influence systemtap if tool is
> statically built ?

Perhaps through the many procfs, sysfs, and debugfs controls...

e.g. if you weren't getting stap to work at all, I would suspect debugfs
mounted permissions, as we've see that before.

Since you're getting tracepoints but not kprobes, that seems to indicate
it's really a problem just in kprobes.  I know for instance that on x86
there are issues with enabled ftrace (-mfentry hooks) and kprobes on the
same addresses.  So if any of the JB userspace enables ftrace function
tracing, that may cause your conflict.


Hope that helps,
Josh

Re: same kernel working with 1 userspace filesystem and not with another one (Android IceCreamSandwich and JellyBean)

[Frank Ch. Eigler]

Hi, Frederic -

f-turgis wrote:

> [...]
>    * probing functions does not work, it seems that nothing happens in that case (we just do a print, we only get tracepoints prints)
>    * at test start, we get now "WARNING: build-id address 0 < base 0"
> [...]

This sounds like http://sourceware.org/bugzilla/show_bug.cgi?id=14555

- FChE

RE: same kernel working with 1 userspace filesystem and not with another one (Android IceCreamSandwich and JellyBean)

[Turgis, Frederic]

Well, I remember it was mentioned on IRC or mailing list. I will try on board when back but that makes sense when "googling"

"Jelly Bean also pulled in a couple easy enhancements inherited from the upstream Linux kernel that can prevent information leakage. The dmesg_restrict and kptr_restrict sysctls, originally implemented by Dan Rosenberg, are now available and enabled in 4.1."

Thanks

Regards
Fred

OMAP Platform Business Unit - System Platform Engineering - Platform & Product Entitlement

>
Texas Instruments France SA, 821 Avenue Jack Kilby, 06270 Villeneuve Loubet. 036 420 040 R.C.S Antibes. Capital de EUR 12.654.784

-----Original Message-----
>From: Frank Ch. Eigler [mailto:fche@redhat.com]
>Sent: Saturday, October 06, 2012 4:21 AM
>To: Turgis, Frederic
>Cc: systemtap@sourceware.org
>Subject: Re: same kernel working with 1 userspace filesystem and not with another one (Android
>IceCreamSandwich and JellyBean)
>
>
>Hi, Frederic -
>
>f-turgis wrote:
>
>> [...]
>>    * probing functions does not work, it seems that nothing happens in that case (we just do a
>print, we only get tracepoints prints)
>>    * at test start, we get now "WARNING: build-id address 0 < base 0"
>> [...]
>
>This sounds like http://sourceware.org/bugzilla/show_bug.cgi?id=14555
>
>- FChE

RE: same kernel working with 1 userspace filesystem and not with another one (Android IceCreamSandwich and JellyBean)

[Turgis, Frederic]

Thanks Frank (and Josh), issue was kptr_restrict set to 2 for increased Android JellyBean security.

Regards
Fred

OMAP Platform Business Unit - System Platform Engineering - Platform & Product Entitlement

>
Texas Instruments France SA, 821 Avenue Jack Kilby, 06270 Villeneuve Loubet. 036 420 040 R.C.S Antibes. Capital de EUR 12.654.784

-----Original Message-----
>From: systemtap-owner@sourceware.org [mailto:systemtap-owner@sourceware.org] On Behalf Of Turgis,
>Frederic
>Sent: Saturday, October 06, 2012 1:51 PM
>To: Frank Ch. Eigler
>Cc: systemtap@sourceware.org
>Subject: RE: same kernel working with 1 userspace filesystem and not with another one (Android
>IceCreamSandwich and JellyBean)
>
>Well, I remember it was mentioned on IRC or mailing list. I will try on board when back but that makes
>sense when "googling"
>
>"Jelly Bean also pulled in a couple easy enhancements inherited from the upstream Linux kernel that
>can prevent information leakage. The dmesg_restrict and kptr_restrict sysctls, originally implemented
>by Dan Rosenberg, are now available and enabled in 4.1."
>
>Thanks
>
>Regards
>Fred
>
>OMAP Platform Business Unit - System Platform Engineering - Platform & Product Entitlement
>
>>
>Texas Instruments France SA, 821 Avenue Jack Kilby, 06270 Villeneuve Loubet. 036 420 040 R.C.S
>Antibes. Capital de EUR 12.654.784
>
>-----Original Message-----
>>From: Frank Ch. Eigler [mailto:fche@redhat.com]
>>Sent: Saturday, October 06, 2012 4:21 AM
>>To: Turgis, Frederic
>>Cc: systemtap@sourceware.org
>>Subject: Re: same kernel working with 1 userspace filesystem and not with another one (Android
>>IceCreamSandwich and JellyBean)
>>
>>
>>Hi, Frederic -
>>
>>f-turgis wrote:
>>
>>> [...]
>>>    * probing functions does not work, it seems that nothing happens in that case (we just do a
>>print, we only get tracepoints prints)
>>>    * at test start, we get now "WARNING: build-id address 0 < base 0"
>>> [...]
>>
>>This sounds like http://sourceware.org/bugzilla/show_bug.cgi?id=14555
>>
>>- FChE