x/mobile: gomobile apps crash inside runtime.usleep() on Android O beta

[cjb]

Please answer these questions before submitting your issue. Thanks!

What version of Go are you using (go version)?

go version go1.8.1 linux/amd64

What operating system and processor architecture are you using (go env)?

This is gomobile on Android O -- crashes on both x86 inside the simulator, and on device with arm64 on a Nexus 6P.

What did you do?

If possible, provide a recipe for reproducing the error.
A complete runnable program is good.
A link on play.golang.org is best.

I called runtime.usleep() from Go code. I haven't made a minimal testcase yet, sorry.

What did you expect to see?

A delay.

What did you see instead?

Crashes due to seccomp policy violation. On amd64, in the Android simulator:

05-17 16:43:08.084 18543 18543 F DEBUG   : Build fingerprint: 'Android/sdk_gphone_x86/generic_x86:O/OSR1.170321.002/3834619:userdebug/test-keys'
05-17 16:43:08.084 18543 18543 F DEBUG   : Revision: '0'
05-17 16:43:08.084 18543 18543 F DEBUG   : ABI: 'x86'
05-17 16:43:08.084 18543 18543 F DEBUG   : pid: 18519, tid: 18538, name: ybase.ossifrage  >>> io.keybase.ossifrage <<<
05-17 16:43:08.084 18543 18543 F DEBUG   : signal 31 (SIGSYS), code 1 (SYS_SECCOMP), fault addr --------
05-17 16:43:08.084 18543 18543 F DEBUG   : Cause: seccomp prevented call to disallowed x86 system call 142
05-17 16:43:08.084 18543 18543 F DEBUG   :     eax 0000008e  ebx 00000000  ecx 00000000  edx 00000000
05-17 16:43:08.084 18543 18543 F DEBUG   :     esi 00000000  edi 91e9a77c
05-17 16:43:08.084 18543 18543 F DEBUG   :     xcs 00000073  xds 0000007b  xes 0000007b  xfs 0000003b  xss 0000007b
05-17 16:43:08.084 18543 18543 F DEBUG   :     eip 92342149  ebp 5fa84690  esp 91e9a77c  flags 00000246
05-17 16:43:08.094 18543 18543 F DEBUG   : 
05-17 16:43:08.094 18543 18543 F DEBUG   : backtrace:
05-17 16:43:08.094 18543 18543 F DEBUG   :     #00 pc 002ad149  /data/app/io.keybase.ossifrage-vN7ak8XPsBIXVVyb4sc7EA==/lib/x86/libgojni.so (runtime.usleep+41)
05-17 16:43:08.094 18543 18543 F DEBUG   :     #01 pc 0028ab6b  /data/app/io.keybase.ossifrage-vN7ak8XPsBIXVVyb4sc7EA==/lib/x86/libgojni.so (runtime.runqgrab+155)
05-17 16:43:08.094 18543 18543 F DEBUG   :     #02 pc 0028ad30  /data/app/io.keybase.ossifrage-vN7ak8XPsBIXVVyb4sc7EA==/lib/x86/libgojni.so (runtime.runqsteal+80)
05-17 16:43:08.094 18543 18543 F DEBUG   :     #03 pc 002844ca  /data/app/io.keybase.ossifrage-vN7ak8XPsBIXVVyb4sc7EA==/lib/x86/libgojni.so (runtime.findrunnable+2346)
05-17 16:43:08.094 18543 18543 F DEBUG   :     #04 pc 00284a2d  /data/app/io.keybase.ossifrage-vN7ak8XPsBIXVVyb4sc7EA==/lib/x86/libgojni.so (runtime.schedule+573)
05-17 16:43:08.094 18543 18543 F DEBUG   :     #05 pc 00282027  /data/app/io.keybase.ossifrage-vN7ak8XPsBIXVVyb4sc7EA==/lib/x86/libgojni.so (runtime.mstart1+263)
05-17 16:43:08.094 18543 18543 F DEBUG   :     #06 pc 00281f12  /data/app/io.keybase.ossifrage-vN7ak8XPsBIXVVyb4sc7EA==/lib/x86/libgojni.so (runtime.mstart+82)
05-17 16:43:08.094 18543 18543 F DEBUG   :     #07 pc 010e1db2  /data/app/io.keybase.ossifrage-vN7ak8XPsBIXVVyb4sc7EA==/lib/x86/libgojni.so

On ARM on a Nexus 6P:

05-17 15:27:53.222 15775-15775/? A/DEBUG: Build fingerprint: 'google/angler/angler:O/OPP2.170420.017/3990407:user/release-keys'
05-17 15:27:53.222 15775-15775/? A/DEBUG: Revision: '0'
05-17 15:27:53.222 15775-15775/? A/DEBUG: ABI: 'arm'
05-17 15:27:53.222 15775-15775/? A/DEBUG: pid: 15749, tid: 15769, name: ybase.ossifrage  >>> io.keybase.ossifrage <<<
05-17 15:27:53.222 15775-15775/? A/DEBUG: signal 31 (SIGSYS), code 1 (SYS_SECCOMP), fault addr --------
05-17 15:27:53.222 15775-15775/? A/DEBUG: Cause: seccomp prevented call to disallowed arm system call 142
05-17 15:27:53.223 15775-15775/? A/DEBUG:     r0 00000000  r1 00000000  r2 00000000  r3 00000000
05-17 15:27:53.223 15775-15775/? A/DEBUG:     r4 cea92890  r5 00000000  r6 00000000  r7 0000008e
05-17 15:27:53.223 15775-15775/? A/DEBUG:     r8 00003d85  r9 dfbfeb40  sl 8b0885a0  fp 00002710
05-17 15:27:53.223 15775-15775/? A/DEBUG:     ip ec32f63c  sp cea9288c  lr cee3f8a8  pc cee3f8cc  cpsr 800f0010
05-17 15:27:53.258 15775-15775/? A/DEBUG: backtrace:
05-17 15:27:53.258 15775-15775/? A/DEBUG:     #00 pc 002af8cc  /data/app/io.keybase.ossifrage-ZEUhtPsnVNpH6KCvHYNzEQ==/lib/arm/libgojni.so (runtime.usleep+48)
05-17 15:27:53.258 15775-15775/? A/DEBUG:     #01 pc 00000000  <unknown>

I think system call 142 is sys_newselect, which makes sense -- that's how runtime.usleep() is implemented. But I don't understand why select(2) would be denied by the seccomp policy on Android O. Has anyone else noticed this, any ideas? Thanks!

[cjb]

Ah, I have a theory on what's happening. My theory is:

• the new seccomp filter in Android O limits apps to using system calls that are exposed by Android's bionic libc: https://developer.android.com/preview/behavior-changes.html

• bionic does not use select(2): https://android.googlesource.com/platform/bionic.git/+/master/libc/SYSCALLS.TXT

• It wraps select(2) with pselect6(2) instead: https://android.googlesource.com/platform/bionic.git/+/master/libc/bionic/poll.cpp#78

• because select(2) is not exposed by bionic, it is blocked by seccomp.

• golang uses select(2) to implement runtime.usleep(), which results in the app being killed

So it seems like the potential fixes are:

1. Android adds sys_newselect to the syscall whitelist, even though it is not exposed by bionic.

2. Golang switches runtime.usleep to use pselect6(2) instead of select(2), perhaps only on Android.

(1) seems preferable to me.

[bradfitz]

The Go project can much more easily do (2) than (1).

[cjb]

Yeah, certainly true. (2) is quite a large change -- there's an argument change (struct timespec vs. struct timeval) as well as the syscall number, across every runtime/sys_linux_*.s.

Well, maybe we could limit the change to runtime/sys_linux_{amd64,arm,arm64}.s. I think those are the only platforms that can run Android?

What do you think? Thanks.

[bradfitz]

pselect was added to Linux in kernel 2.6.16 and Go requires 2.6.23 or later, so that seems fine to me at least.

@aclements, @ianlancetaylor?

[aclements]

It makes me sad, but, yes, we could pretty easily switch to pselect. In fact, linux/arm64 already uses pselect. Of course, Go binaries that haven't been recompiled won't work with Android O.

[gopherbot]

CL https://golang.org/cl/43641 mentions this issue.

[eliasnaur]

Could this be included in Go 1.9? Android O will probably be out (much) sooner than Go 1.10.

[aclements]

It will be included in Go 1.9.

A more interesting question is whether we should include this in Go 1.8.3. I'll reopen this on Go 1.8.3 for consideration.