pstack for T-Kernel

[ 日本語 | English ]

Abstract

A small tool that shows the stacktrace of a running task.

Running environment

T-Kernel/x86 (Port to other architecture requires single function implementation)

License

T-Kernel port of libelf is distributed under GNU LGPL, just like the original.
The other two (pstkdrv, pstack) is distributed under MIT License.

Downloads

• pstack driver (pstkdrv.tar.gz) 4KB
• pstack application (pstack.tar.gz) 8KB
• T-Kernel port of libelf (libelf.tar.gz) 144KB

Compiling pstack

pstkdrv, pstack, and libelf are driver, process, and library, respectively. Thus, you can compile them in driver/, bappl/, and lib/, respectively.

As pstack depends on libelf header files and library, you need to make && make install before compiling pstack application.

Usage

1. First, execute % lodspg pstkdrv.
2. When either the map-file (*.map) or unstripped executable (*.out) is available, transfer that to the target environment.
3. Run % ref tsk command to get the task ID of the target task whose stacktrace you want to view.
4. Type either one of the following commands to execute pstack (assume here that the target task ID is 123):
   • % pstack 123
   • % pstack 123:/path/to/mapfile.map
   • % pstack 123:/path/to/exefile.out
5. Simply read the output
   Example:

   [/SYS]% pstack 47:/SYS/USR/webkit.out
   *** TID = 47:
   EIP = 8000c51e : _end+2116597870
     <-- 80015544 : _end+2116634772
     <-- 80060038 : _end+2116940680
     <-- 800134ca : _end+2116626458
     <-- 8001555d : _end+2116634797
     <-- 0000003b : _usemt_+58
     <-- c062b418 : _end+3196757864
     <-- c061d884 : _end+3196701652
     <-- c061f3e2 : _end+3196708658
     <-- c060c2e6 : _end+3196630582
     <-- 800134ca : _end+2116626458
     <-- 8001555d : _end+2116634797
     <-- 00979073 : b_cact_par+11
     <-- 0010709a : TShellWebKitPanel::onWorkAreaMouseDown()+122
     <-- 004ca049 : TShellWindow::onMouseDown()+129
     <-- 004c952a : TShellApp::dispatch()+142
     <-- 004c9781 : TShellApp::cycle()+49
     <-- 001036d7 : TShellWebKitApp::cycle()+15
     <-- 004c979e : TShellApp::run()+18
     <-- 0010346f : MAIN_sub(message*)+91
     <-- 0010352f : MAIN+27
     <-- 001002ad : _C_startup+105

Of course, you can embed libpstk.c, pstack.h, and demangle.cc into your own applications to do print_stacktrace(...); for debugging purpose. However, if you do not need symbol resolution, it is easier to put tm_command("btr");.

Cautions

Backtraces in kernel mode frames are sometimes incorrect. In the example above, address 0x0006003b is apparently wrong.

As the stacktraces in user mode are considered correct, you should (1) only target at tasks that belongs to a process, and (2) trust only stacktraces before syscalls. (In the above example, below "b_cact_par" can be trusted.)

The heart of the matter

Here's the reasons of the problems described previously. If you have any good ideas that helps to solve them, please tell me.

• It seems that syscall frames (in kernel stacks) do not contain return addresses at [ebp+4], but probably in [ebp+8] or something. Thus, in order to correctly get the return addresses, it is necessary to judge whether the frame is of a system call or a simple function call, which I have no idea to do.
  As a special exception, when stack frame is switched from user stack to kernel stack, I've implemented pstack to categorize the frame as a system call.
• pstack is not implemented only from the information given in T-Kernel/x86 implementation specifications, but also based on my guesses from the memory dumps (caught using T-Monitor). For example , it is theoretically unclear whether user-mode frames can be reached from the kernel-level frames through frame pointers in stack. However, it seems OK for PMC T-Kernel/x86, thus done like this for this implementation.

ChangeLog

• 2011-09-30: Modified pstkdrv to avoid `OS System Down' inside the driver.
  • Modified driver to do ChkSpace to avoid access to invalid pointers when the stack of target task is broken, probably by a buffer-overflow.
  • Use task suspension to avoid target tasks (with higher priority than this driver) terminating or modifying stacks while pstkdrv is checking for their stacks.
• 2010-01-05: Initial release.

[ Back ]

Last modified: Sat Oct 1 13:43:13 2011