crash bt command
bt: 功能是Display a kernel stack backtrace
需要使用pid 或者 taskp,指定process,如果不指定，就是当前进程。
NAME
bt - backtrace
SYNOPSIS
bt [-a|-g|-r|-t|-T|-l|-e|-E|-f|-F|-o|-O] [-R ref] [-s [-x|d]] [-I ip] [-S sp]
[pid | task]
DESCRIPTION
Display a kernel stack backtrace. If no arguments are given, the stack
trace of the current context will be displayed.
/*-a : active task on each CPU*/
-a displays the stack traces of the active task on each CPU.
(only applicable to crash dumps)
/*-g: all threads in the thread group of the target task*/
-g displays the stack traces of all threads in the thread group of
the target task; the thread group leader will be displayed first.
/*-r: dump the 2 pages,正好是进程的栈*/
-r display raw stack data, consisting of a memory dump of the two
pages of memory containing the task_union structure.
/*-t/T: 用于当back trace 解析失败的情形*/
-t display all text symbols found from the last known stack location
to the top of the stack. (helpful if the back trace fails)
-T display all text symbols found from just above the task_struct or
thread_info to the top of the stack. (helpful if the back trace
fails or the -t option starts too high in the process stack).
/*-l: 显示文件和行号*/
-l show file and line number of each stack trace text location.
/*-e/E: what is exception frames?中断？*/
-e search the stack for possible kernel and user mode exception frames.
-E search the IRQ stacks (x86, x86_64 and ppc64), and the exception
stacks (x86_64) for possible exception frames; all other arguments
will be ignored since this is not a context-sensitive operation.
/*-f/F:display all stack data contained in a frame*/
-f display all stack data contained in a frame; this option can be
used to determine the arguments passed to each function; on ia64,
the argument register contents are dumped.
-F similar to -f, except that the stack data is displayed symbolically
when appropriate; if the stack data references a slab cache object,
the name of the slab cache will be displayed in brackets; on ia64,
the substitution is done to the argument register contents.
/*-R:?????*/
-R ref display stack trace only if there is a reference to this symbol
or text address.
/*-s/x/d:symbol name plus its offset*/
-s display the symbol name plus its offset.
-x when displaying a symbol offset with the -s option, override the
default output format with hexadecimal format.
-d when displaying a symbol offset with the -s option, override the
default output format with decimal format.
/*-I: ???*/
-I ip use ip as the starting text location.
/*-S sp use sp as the starting stack frame address.*/
-S sp use sp as the starting stack frame address.
/*指定某个process*/
pid displays the stack trace(s) of this pid.
taskp displays the stack trace the the task referenced by this hexadecimal
task_struct pointer.
Multiple pid and taskp arguments may be specified.
crash> bt -e
PID: 286 TASK: c0b3a000 CPU: 0 COMMAND: "in.rlogind"KERNEL-MODE EXCEPTION FRAME AT c0b3bf44:
EAX: 00000000 EBX: c0e68280 ECX: 00000000 EDX: 00000004 EBP: c0b3bfbc
DS: 0018 ESI: 00000004 ES: 0018 EDI: c0e68284
CS: 0010 EIP: c012f803 ERR: ffffff09 EFLAGS: 00000246
USER-MODE EXCEPTION FRAME AT c0b3bfc4:
EAX: 0000008e EBX: 00000004 ECX: bfffc9a0 EDX: 00000000
DS: 002b ESI: bfffc8a0 ES: 002b EDI: 00000000
SS: 002b ESP: bfffc82c EBP: bfffd224
CS: 0023 EIP: 400d032e ERR: 0000008e EFLAGS: 00000246
crash> bt
PID: 1320 TASK: e6915be0 CPU: 0 COMMAND: "sh"#0 [<c01e1a1c>] (sysrq_handle_crash) from [<c01e215c>]
#1 [<c01e20b4>] (__handle_sysrq) from [<c01e2238>]
#2 [<c01e220c>] (write_sysrq_trigger) from [<c00f2a50>]
#3 [<c00f29b8>] (proc_reg_write) from [<c00ad9c4>]
#4 [<c00ad910>] (vfs_write) from [<c00adb14>]
#5 [<c00adad4>] (sys_write) from [<c000df00>]
pc : [<400f9d94>] lr : [<400ad257>] psr: 20000010
sp : beca68e0 ip : 400c2f38 fp : 400c7404
r10: 40a37e94 r9 : 00000000 r8 : 40a36c04
r7 : 00000004 r6 : 00000001 r5 : 00000002 r4 : 00000003
r3 : ffffffff r2 : 00000002 r1 : 40a36c04 r0 : 00000001
Flags: nzCv IRQs on FIQs on Mode USER_32 ISA ARM
crash> bt -r
stack 的低地址是thread_info,栈的大小为8K 从高地址开始存放。
PID: 1320 TASK: e6915be0 CPU: 0 COMMAND: "sh"
e6364000: 00000000 00000000 bf000000 e6915be0e6364010: default_exec_domain 00000000 00000015 c0e4f360
e6364020: e6915be0 e6364000 00000000 e6333be0
e6364030: 00000000 init_task e6365cac e6365c80
e6364040: __schedule+1008 00000000 00000000 00000000
----
crash> bt -S e6365ec8
crash> log | grep -10 "PC is"pll0 clock rate set to 400000000.
CPU1: platform_cpu_die
CPU1: shutdown
SysRq : Trigger a crash
Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = e6398000
[00000000] *pgd=00000000
Internal error: Oops: 805 [#1] SMP ARM
Modules linked in:
CPU: 0 Not tainted (3.4.0-g40efdaf-dirty #5)
PC is at sysrq_handle_crash+0x38/0x48
LR is at l2x0_cache_sync+0x34/0x3c
pc : [<c01e1a50>] lr : [<c0019c74>] psr: 60000093
sp : e6365ec8 ip : e6365eb0 fp : e6365ed4
r10: e6bb4bec r9 : e6364000 r8 : 00000000
r7 : 60000013 r6 : 00000063 r5 : 00000004 r4 : c0701718
r3 : 00000000 r2 : 00000001 r1 : a0000093 r0 : c07220c0
Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user
Control: 10c53c7d Table: a639804a DAC: 00000015
PC: 0xc01e19d0:
crash> bt -S e6365ec8
PID: 1320 TASK: e6915be0 CPU: 0 COMMAND: "sh"
#0 [<c01e1a1c>] (sysrq_handle_crash) from [<c01e215c>]
#1 [<c01e20b4>] (__handle_sysrq) from [<c01e2238>]
#2 [<c01e220c>] (write_sysrq_trigger) from [<c00f2a50>]
#3 [<c00f29b8>] (proc_reg_write) from [<c00ad9c4>]
#4 [<c00ad910>] (vfs_write) from [<c00adb14>]
#5 [<c00adad4>] (sys_write) from [<c000df00>]
pc : [<400f9d94>] lr : [<400ad257>] psr: 20000010
sp : beca68e0 ip : 400c2f38 fp : 400c7404
r10: 40a37e94 r9 : 00000000 r8 : 40a36c04
r7 : 00000004 r6 : 00000001 r5 : 00000002 r4 : 00000003
r3 : ffffffff r2 : 00000002 r1 : 40a36c04 r0 : 00000001
Flags: nzCv IRQs on FIQs on Mode USER_32 ISA ARM
有关bt -f/F的细节
r15PC The Program Counter.
r14LR The Link Register.
r12IP The Intra-Procedure-call scratch register. （可简单的认为暂存SP）
实际上，还有一个r11是optional的，被称为FP，即framepointer。
structstackframe {
unsignedlong fp;
unsignedlong sp;
unsignedlong lr;
unsignedlong pc;
};
一般函数的开头都是：
crash> dis vfp_restore_user_hwstate
0xc0008df0 <vfp_restore_user_hwstate>: mov r12, sp
0xc0008df4 <vfp_restore_user_hwstate+0x4>: push {r3, r4, r5, r6, r11, r12, lr, pc}
以该帧为例说明帧头的意思：
#0 [<c0560fa4>] (__raw_spin_lock_irqsave) from [<c056105c>]
[PC: c0560fa4 LR: c056105c SP: c97e1c78 FP: c97e1c9c SIZE: 24]
c97e1c78: 00000004 0000000c c97e1c9c c97e1c90
c97e1c88: c056105c c0560fac
SP:意思是该函数栈结束的地址【从高地址到低地址存放】，如
[PC: c0560fa4 LR: c056105c SP: c97e1c78
c97e1c78: 00000004 ----
PC:函数的入口地址+4, 如
[PC: c0560fa4 LR: c056105c SP: c97e1c78
crash> dis __raw_spin_lock_irqsave
0xc0560fa0 <__raw_spin_lock_irqsave>: mov r12, sp
0xc0560fa4 <__raw_spin_lock_irqsave+0x4>: push {r4, r5, r11, r12
LR:函数被调用后，返回到哪里，或者说哪里调用了该函数
[PC: c0560fa4 LR: c056105c SP: c97e1c78
crash> dis c056105c -r
0xc0561044 <_raw_spin_lock_irqsave>: mov r12, sp
0xc0561048 <_raw_spin_lock_irqsave+0x4>: push {r11, r12, lr, pc}
0xc056104c <_raw_spin_lock_irqsave+0x8>: sub r11, r12, #4
0xc0561050 <_raw_spin_lock_irqsave+0xc>: stmfd sp!, {lr}
0xc0561054 <_raw_spin_lock_irqsave+0x10>: ldmfd sp!, {lr}
0xc0561058 <_raw_spin_lock_irqsave+0x14>: bl 0xc0560fa0 <__raw_spin_lock_irqsave>
0xc056105c <_raw_spin_lock_irqsave+0x18>: ldm sp, {r11, sp, pc}
FP：
[PC: c0560fa4 LR: c056105c SP: c97e1c78 FP: c97e1c9c SIZE: 24]
crash> rd c97e1c9c【fp的内容是前一帧的PC值(保存在栈里的)】
c97e1c9c: c0561050
保存在栈里的内容：
从高地址开始依次是 PC/LR/SP/FP 4个寄存器
这里PC的内容是当前+8，也就是函数开始+12，LR是函数的返回地址，或者说哪里调用的这个函数
其他的就看什么入栈了。