OLD | NEW |
(Empty) | |
| 1 # Introduction |
| 2 |
| 3 Linux implements its userland-to-kernel transition using a special library |
| 4 called linux-gate.so that is mapped by the kernel into every process. For more |
| 5 information, see |
| 6 |
| 7 http://www.trilithium.com/johan/2005/08/linux-gate/ |
| 8 |
| 9 In a nutshell, the problem is that the system call gate function, |
| 10 kernel\_vsyscall does not use EBP to point to the frame pointer. |
| 11 |
| 12 However, the Breakpad processor supports special frames like this via STACK |
| 13 lines in the symbol file. If you look in src/client/linux/data you will see |
| 14 symbol files for linux-gate.so for both Intel & AMD(the implementation of |
| 15 kernel\_vsyscall changes depending on the CPU manufacturer). When processing |
| 16 minidumps from Linux 2.6, having these symbol files is necessary for walking the |
| 17 stack for crashes that happen while a thread is in a system call. |
| 18 |
| 19 If you're just interested in processing minidumps, those two symbol files should |
| 20 be all you need! |
| 21 |
| 22 # Details |
| 23 |
| 24 The particular details of understanding the linux-gate.so symbol files can be |
| 25 found by reading about STACK lines inside |
| 26 src/common/windows/pdb\_source\_line\_writer.cc, and the above link. To |
| 27 summarize briefly, we just have to inform the processor how to get to the |
| 28 previous frame when the EIP is inside kernel\_vsyscall, and we do that by |
| 29 telling the processor how many bytes kernel\_vsyscall has pushed onto the stack |
| 30 in it's prologue. For example, one of the symbol files looks somewhat like the |
| 31 following: |
| 32 |
| 33 MODULE Linux x86 random\_debug\_id linux-gate.so PUBLIC 400 0 kernel\_vsyscall |
| 34 STACK WIN 4 100 1 1 0 0 0 0 0 1 |
| 35 |
| 36 The PUBLIC line indicates that kernel\_vsyscall is at offset 400 (in bytes) from |
| 37 the beginning of linux-gate.so. The STACK line indicates the size of the |
| 38 function(100), how many bytes it pushes(1), and how many bytes it pops(1). The |
| 39 last 1 indicates that EBP is pushed onto the stack before being used by the |
| 40 function. |
| 41 |
| 42 # Warnings |
| 43 |
| 44 These functions might change significantly depending on kernel version. In my |
| 45 opinion, the actual function stack information is unlikely to change frequently, |
| 46 but the Linux kernel might change the address of kernel\_vsyscall w.r.t the |
| 47 beginning of linux-gate.so, which would cause these symbol files to be invalid. |
OLD | NEW |