什么是Oops?从语言学的角度说,Oops应该是一个拟声词。当出了点小事故,或者做了比较尴尬的事之后,你可以说"Oops",翻译成中国话就叫做“哎呦”。“哎呦,对不起,对不起,我真不是故意打碎您的杯子的”。看,Oops就是这个意思。
在Linux内核开发中的Oops是什么呢?其实,它和上面的解释也没什么本质的差别,只不过说话的主角变成了Linux。当某些比较致命的问题出现时,我们的Linux内核也会抱歉的对我们说:“哎呦(Oops),对不起,我把事情搞砸了”。Linux内核在发生kernel panic时会打印出Oops信息,把目前的寄存器状态、堆栈内容、以及完整的Call trace都show给我们看,这样就可以帮助我们定位错误。
那么linux内核的call trace是如何实现的呢?
简单的概述,譬如有一个这样的调用关系:A-------->B-------->C,即A调用B,B调用C,而程序就正是在C函数中执行出现了致命错误,则可以通过此时的内核堆栈,通过堆栈的回朔来找出调用C函数的是B函数,而调用B函数的正是A函数。
大致的方法就是:C函数执行出错时的fp寄存器(称为栈帧寄存器),指向当前函数所在的堆栈帧,而该堆栈帧又是有一定的组织格式的(下面会详细描述该结构),所以可以通过该堆栈帧来找到saved 在栈帧中的lr寄存器(即为C函数的调用者,也即C函数在B函数中的返回地址)和saved 在栈帧中的pc寄存器(该pc寄存器通过简单的修正,就可以确定当前出错时,所在的函数的开始地址),再通过saved 在栈帧中的fp寄存器就可以回朔到调用C函数的B函数所在的堆栈帧,从而可以循环这个过程,直到当栈帧中的fp寄存器为0,说明不能继续回朔了。
linux内核中的堆栈回朔,是跟架构相关的,而linux, arm的堆栈回朔函数为:arch/arm/kernel/traps.c
- static void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk)
- {
- unsigned int fp, mode;
- int ok = 1;
-
- printk("Backtrace: ");
-
- if (!tsk)
- tsk = current;
- if (regs) {
- fp = regs->ARM_fp;
- mode = processor_mode(regs);
- } else if (tsk != current) {
- fp = thread_saved_fp(tsk);
- mode = 0x10;
- } else {
- asm("mov %0, fp" : "=r" (fp) : : "cc");
- mode = 0x10;
- }
-
- if (!fp) {
- printk("no frame pointer");
- ok = 0;
- } else if (verify_stack(fp)) {
- printk("invalid frame pointer 0x%08x", fp);
- ok = 0;
- } else if (fp < (unsigned long)end_of_stack(tsk))
- printk("frame pointer underflow");
- printk("\n");
-
- if (ok)
- c_backtrace(fp, mode);
- }
c_backtrace函数在如下文件中:arch/arm/lib/backtrace.S
在详细讲述该函数之前,我需要介绍下,栈帧的组织格式或构成:
如上所述,r0-r3都是可选的,是用于传递函数前面四个参数。
r4-r10也是可选的,是编译器根据具体情况(使用局部变量的数目),来决定使用那个寄存器,就保存那些寄存器的。
上图对应如下的stack frame layout:
/*
* Stack frame layout:(地址从低到高)
* optionally saved caller registers (r4 - r10)
* saved fp
* saved sp
* saved lr
* frame => saved pc
* optionally saved arguments (r0 - r3)
* saved sp => <next word>
*/
所以为了都遵循以上的栈帧结构,每个函数的反汇编代码,都是以如下的样子展开的:
* Functions start with the following code sequence:
* mov ip, sp
* stmfd sp!, {r0 - r3} (optional)
* corrected pc => stmfd sp!, {..., fp, ip, lr, pc}
*/
下面摘一个实际的反汇编的子程序的列子如下(如下高亮部分就是保存栈帧结构,本列中,被未保存r0-r3):
现在开始对c_backtrace函数展开详细的说明
- @ fp is 0 or stack frame
-
- #define frame r4
- #define sv_fp r5
- #define sv_pc r6
- #define mask r7
- #define offset r8
-
- ENTRY(c_backtrace)
-
- #if !defined(CONFIG_FRAME_POINTER) || !defined(CONFIG_PRINTK)
- mov pc, lr
- ENDPROC(c_backtrace)
- #else
- stmfd sp!, {r4 - r8, lr} @ Save an extra register so we have a location...
- movs frame, r0 @ if frame pointer is zero,将异常产生函数的fp寄存器值赋值给frame
- beq no_frame @ we have no stack frames
-
- tst r1, #0x10 @ 26 or 32-bit mode?
- ARM( moveq mask, #0xfc000003 )
- THUMB( moveq mask, #0xfc000000 )
- THUMB( orreq mask, #0x03 )
- movne mask, #0 @ mask for 32-bit
-
- 1: stmfd sp!, {pc} @ calculate offset of PC stored
- ldr r0, [sp], #4 @ by stmfd for this CPU
- adr r1, 1b
- sub offset, r0, r1
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- for_each_frame: tst frame, mask @ Check for address exceptions
- bne no_frame
-
- 1001: ldr sv_pc, [frame, #0] @ get saved pc
- 1002: ldr sv_fp, [frame, #-12] @ get saved fp 该fp值是异常产生时函数的上一级函数(即调用者)的栈帧寄存器。
-
- sub sv_pc, sv_pc, offset @ Correct PC for prefetching
- bic sv_pc, sv_pc, mask @ mask PC/LR for the mode
-
- 1003: ldr r2, [sv_pc, #-4] @ if stmfd sp!, {args} exists,
- ldr r3, .Ldsi+4 @ adjust saved 'pc' back one
- teq r3, r2, lsr #10 @ instruction
- subne r0, sv_pc, #4 @ allow for mov
- subeq r0, sv_pc, #8 @ allow for mov + stmia
-
- ldr r1, [frame, #-4] @ get saved lr
- mov r2, frame
- bic r1, r1, mask @ mask PC/LR for the mode
- @void dump_backtrace_entry(unsigned long where, unsigned long from, unsigned long frame)
- @ ( sv_pc, sv_lr , frame )
- @至此,r1指向本函数的返回地址,即该函数在调用者中的偏移量,r2执行本函数的栈帧
- bl dump_backtrace_entry
- ldr r1, [sv_pc, #-4] @ if stmfd sp!, {args} exists,
- ldr r3, .Ldsi+4
- teq r3, r1, lsr #10
- ldreq r0, [frame, #-8] @ get sp
- subeq r0, r0, #4 @ point at the last arg
- bleq .Ldumpstm @ dump saved registers
-
- 1004: ldr r1, [sv_pc, #0] @ if stmfd sp!, {..., fp, ip, lr, pc}
- ldr r3, .Ldsi @ instruction exists,
- teq r3, r1, lsr #10
- subeq r0, frame, #16
- bleq .Ldumpstm @ dump saved registers
-
- teq sv_fp, #0 @ zero saved fp means ,由于fp已经为0,不能再继续回朔
- beq no_frame @ no further frames
-
- cmp sv_fp, frame @ next frame must be 取上一级函数的栈帧值,做如上的相同处理。
- mov frame, sv_fp @ above the current frame
- bhi for_each_frame
-
- 1006: adr r0, .Lbad
- mov r1, frame
- bl printk
- no_frame: ldmfd sp!, {r4 - r8, pc}
- ENDPROC(c_backtrace)
以上的dump_backtrace_entry函数定义在文件中:arch/arm/kernel/traps.c
参数where即为当前函数的函数指针值,from即为该函数在调用者中的返回值,frame为当前函数的栈帧值
- void dump_backtrace_entry(unsigned long where, unsigned long from, unsigned long frame)
- {
- #ifdef CONFIG_KALLSYMS
- printk("[<%08lx>] (%pS) from [<%08lx>] (%pS)\n", where, (void *)where, from, (void *)from);
- #else
- printk("Function entered at [<%08lx>] from [<%08lx>]\n", where, from);
- #endif
-
- if (in_exception_text(where))
- dump_mem("", "Exception stack", frame + 4, frame + 4 + sizeof(struct pt_regs));
- }
以上函数会打印出类似如下信息:
[ 4175.704664] Backtrace:
0mS[ 4175.707415] [<bf14d314>] (MlmeSetTxRate+0x0/0x3b0 [mt7601Usta]) from [<bf14e3b8>] (MlmeNewTxRate+0x9c/0xb0 [mt7601Usta])
[ 4175.718186] r6:000ab6d8 r5:db2ff000 r4:db45de78
cre[ 4175.723087] [<bf14e31c>] (MlmeNewTxRate+0x0/0xb0 [mt7601Usta]) from [<bf14ffd8>] (MlmeDynamicTxRateSwitching+0x81c/0x106c [mt7601Usta])
[ 4175.735172] r7:db45de78 r6:db2ff000 r5:00000001 r4:db45e488
enO[ 4175.741092] [<bf14f7bc>] (MlmeDynamicTxRateSwitching+0x0/0x106c [mt7601Usta]) from [<bf10e244>] (MlmePeriodicExec+0x42c/0x8a0 [mt7601Usta])
n:f[ 4175.753828] [<bf10de18>] (MlmePeriodicExec+0x0/0x8a0 [mt7601Usta]) from [<bf139e1c>] (RtmpTimerQThread+0x168/0x1dc [mt7601Usta])
[ 4175.765332] r8:db2ff2e8 r7:001803a9 r6:db2ff2e0 r5:db3bafcc r4:db2ff000
al[ 4175.772171] [<bf139cb4>] (RtmpTimerQThread+0x0/0x1dc [mt7601Usta]) from [<c0044e3c>] (kthread+0x98/0x9c)
[ 4175.781641] [<c0044da4>] (kthread+0x0/0x9c) from [<c002be38>] (do_exit+0x0/0x804)
[ 4175.789078] r6:c002be38 r5:c0044da4 r4:ca0f3c60
[ 4175.793676] Code: e1a0c00d e92dd870 e24cb004 e24dd00c (e5d23001)