Thanks to all for replying with helpful links.<br>read a few of them ...<br><br>.. in order to apply that to practical use.. asking a ques ..please see<br><br><u><b>Thats output of bt -f for a process </b></u><br><br>deactivate_super is where i am concentrating for example/discussion sake <br>
<br><span style="background-color:rgb(255,255,0)">#11 [ffff88062b7bbe90] deactivate_super at ffffffff811798a0<br> ffff88062b7bbe98: 0000000000000000 ffff8817de24e480 <br> ffff88062b7bbea8: ffff88062b7bbed8 ffffffff8119581f </span><br>
#12 [ffff88062b7bbeb0] mntput_no_expire at ffffffff8119581f<br> ffff88062b7bbeb8: 0000000000000000 0000000000000000 <br> ffff88062b7bbec8: ffff8817de24e480 0000000000000000 <br> ffff88062b7bbed8: ffff88062b7bbf78 ffffffff811962bb <br>
#13 [ffff88062b7bbee0] sys_umount at ffffffff811962bb<br> ffff88062b7bbee8: ffff88062b7bbf78 ffff88062b7bbf18 <br> ffff88062b7bbef8: ffff88062b7bbf78 ffffffff810d46e2 <br> ffff88062b7bbf08: ffff8817de24e4b0 000000001b9f3800 <br>
ffff88062b7bbf18: ffff88062b7bbf18 ffff88062b7bbf18 <br> ffff88062b7bbf28: ffff88062b7bbf28 ffff88062b7bbf28 <br> ffff88062b7bbf38: ffff8817de24e480 ffff88012c523200 <br> ffff88062b7bbf48: 00007ffff7b6be60 00007ff689b9dab0 <br>
ffff88062b7bbf58: 00007ff689b9db10 0000000000000000 <br> ffff88062b7bbf68: 0000000000000000 0000000000000000 <br> ffff88062b7bbf78: 00007ff689b9da90 ffffffff8100b0f2 <br>#14 [ffff88062b7bbf80] system_call_fastpath at ffffffff8100b0f2<br>
<span style="background-color:rgb(255,255,102)">RIP: 00007ff687cd9987 RSP: 00007ffff7b6b7b0 RFLAGS: 00010293<br> RAX: 00000000000000a6 RBX: ffffffff8100b0f2 RCX: 0000000000000005<br> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ff689b9dab0<br>
RBP: 00007ff689b9da90 R8: 00007ff689b9dad0 R9: 0000000000000000<br> R10: 00007ffff7b6bfb0 R11: 0000000000000246 R12: 0000000000000000<br> R13: 0000000000000000 R14: 0000000000000000 R15: 00007ff689b9db10<br>
ORIG_RAX: 00000000000000a6 CS: 0033 SS: 002b<br></span><br><u><b>this is disassembly of that function</b></u><br><br>crash> dis ffffffff811798a0<br>0xffffffff811798a0 <deactivate_super+112>: mov %r12,%rdi<br>
crash> dis deactivate_super<br>0xffffffff81179830 <deactivate_super>: push %rbp<br>0xffffffff81179831 <deactivate_super+1>: mov %rsp,%rbp<br>0xffffffff81179834 <deactivate_super+4>: push %r12<br>
0xffffffff81179836 <deactivate_super+6>: push %rbx<br>0xffffffff81179837 <deactivate_super+7>: nopl 0x0(%rax,%rax,1)<br>0xffffffff8117983c <deactivate_super+12>: mov 0x30(%rdi),%r12<br>
0xffffffff81179840 <deactivate_super+16>: mov $0xffffffff81fc0a00,%rsi<br>0xffffffff81179847 <deactivate_super+23>: mov %rdi,%rbx<br>0xffffffff8117984a <deactivate_super+26>: lea 0xb8(%rdi),%rdi<br>
0xffffffff81179851 <deactivate_super+33>: callq 0xffffffff8126a820 <_atomic_dec_and_lock><br>0xffffffff81179856 <deactivate_super+38>: test %eax,%eax<br>0xffffffff81179858 <deactivate_super+40>: je 0xffffffff811798b0 <deactivate_super+128><br>
0xffffffff8117985a <deactivate_super+42>: subl $0x3fffffff,0xb0(%rbx)<br>0xffffffff81179864 <deactivate_super+52>: mov $0xffffffff81fc0a00,%rax<br>0xffffffff8117986b <deactivate_super+59>: incw (%rax)<br>
0xffffffff8117986e <deactivate_super+62>: data32 xchg %ax,%ax<br>0xffffffff81179871 <deactivate_super+65>: mov 0x48(%rbx),%rax<br>0xffffffff81179875 <deactivate_super+69>: test %rax,%rax<br>
0xffffffff81179878 <deactivate_super+72>: je 0xffffffff8117988f <deactivate_super+95><br>0xffffffff8117987a <deactivate_super+74>: mov 0x8(%rax),%rax<br>0xffffffff8117987e <deactivate_super+78>: test %rax,%rax<br>
0xffffffff81179881 <deactivate_super+81>: je 0xffffffff8117988f <deactivate_super+95><br>0xffffffff81179883 <deactivate_super+83>: xor %edx,%edx<br>0xffffffff81179885 <deactivate_super+85>: mov $0xffffffff,%esi<br>
0xffffffff8117988a <deactivate_super+90>: mov %rbx,%rdi<br>0xffffffff8117988d <deactivate_super+93>: callq *%rax<br>0xffffffff8117988f <deactivate_super+95>: lea 0x70(%rbx),%rdi<br>
0xffffffff81179893 <deactivate_super+99>: callq 0xffffffff814ee5c0 <down_write><br>0xffffffff81179898 <deactivate_super+104>: mov %rbx,%rdi<br>0xffffffff8117989b <deactivate_super+107>: callq *0x18(%r12)<br>
0xffffffff811798a0 <deactivate_super+112>: mov %r12,%rdi<br>0xffffffff811798a3 <deactivate_super+115>: callq 0xffffffff81193c20 <put_filesystem><br><br><br><u><b>This is code for this function</b></u><br>
<br>/**<br> * deactivate_super - drop an active reference to superblock<br> * @s: superblock to deactivate<br> *<br> * Drops an active reference to superblock, acquiring a temprory one if<br> * there is no active references left. In that case we lock superblock,<br>
* tell fs driver to shut it down and drop the temporary reference we<br> * had just acquired.<br> */<br>void deactivate_super(struct super_block *s)<br>{<br> struct file_system_type *fs = s->s_type;<br>
if (atomic_dec_and_test(&s->s_active)) {<br> vfs_dq_off(s, 0);<br> down_write(&s->s_umount);<br> fs->kill_sb(s);<br> put_filesystem(fs);<br>
put_super(s);<br> }<br>}<br><br>EXPORT_SYMBOL(deactivate_super);<br><br><u><b>now i want to get superblock dump from the stack frame of deactivate_super obtained from bt -f.</b></u><br><br><br>How do i proceed...<br>
<br><u><b>Questions:-</b></u><br>1)Which memory address in stack contains struct super_block *s<br>2)how does disassembly helps in knowing which register contain the struct super_block *s<br>3)bt -f gives highlighted above, register dump at the end, does that help in finding this information ???<br>
<br>If any other command can help in knowing thsi from crash dump ,,please let me know <br><br>Thanks a lot for the helpful links given in replies ...<br><br><br>Thanks<br>Nidhi <br><br><br><br><br><br><div class="gmail_quote">
On Sat, Aug 10, 2013 at 3:10 AM, neha naik <span dir="ltr"><<a href="mailto:nehanaik27@gmail.com" target="_blank">nehanaik27@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi,<br> Pick up a global variable eg : In case of filesystem stack the vfs structure available through built in gdb command or in case of<br> device driver the gendisk structure.<br> Then try to find this in the stack. When you get it, look at the register where it was showed and try to follow this with assembly code and the <br>
source code. <br> If you do this exercise you will start understanding assembly code better.<br> Sometimes the global variable itself can point you to other structures which you can find in your stack. And from that you can get a better<br>
idea about what is happening.<br><br> I personally feel analysing dumps is more about practice.<br>Regards,<br>Neha<br><br><div class="gmail_quote"><div><div class="h5">On Fri, Aug 9, 2013 at 1:19 PM, Tayade, Nilesh <span dir="ltr"><<a href="mailto:Nilesh.Tayade@netscout.com" target="_blank">Nilesh.Tayade@netscout.com</a>></span> wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5"><div>> -----Original Message-----<br>
> From: <a href="mailto:kernelnewbies-bounces@kernelnewbies.org" target="_blank">kernelnewbies-bounces@kernelnewbies.org</a> [mailto:<a href="mailto:kernelnewbies-" target="_blank">kernelnewbies-</a><br>
> <a href="mailto:bounces@kernelnewbies.org" target="_blank">bounces@kernelnewbies.org</a>] On Behalf Of Matthias Brugger<br>
> Sent: Tuesday, August 06, 2013 7:14 PM<br>
> To: nidhi mittal hada<br>
> Cc: <a href="mailto:kernelnewbies@kernelnewbies.org" target="_blank">kernelnewbies@kernelnewbies.org</a><br>
> Subject: Re: Understanding disassembly x86 + understanding function call +<br>
> parameter pass and stack frame<br>
><br>
</div><div>> 2013/8/6 nidhi mittal hada <<a href="mailto:nidhimittal19@gmail.com" target="_blank">nidhimittal19@gmail.com</a>>:<br>
</div>[...]<br>
<div>> > Hi All,<br>
> ><br>
> > I am using crash tool to analyze core dump obtained from red hat linux<br>
> > on<br>
> > x86_64 platform.<br>
</div>[...]<br>
<div>> ><br>
> > Putting some of the doubts..<br>
> ><br>
> > a)like which sequence the parameters, return address, etc are pushed<br>
> > on stack?<br>
</div>May be you would like to take a look at below link:<br>
<a href="http://www.cs.virginia.edu/~evans/cs216/guides/x86.html" target="_blank">http://www.cs.virginia.edu/~evans/cs216/guides/x86.html</a> [Section: Calling Convention] has the exact answer to your question.<br>
<div><br>
> > b)Which registers are used, if some registers play some spl. role ?<br>
</div>You also might want to read the tutorials:<br>
<a href="http://cocoafactory.com/blog/2012/11/23/x86-64-assembly-language-tutorial-part-1" target="_blank">http://cocoafactory.com/blog/2012/11/23/x86-64-assembly-language-tutorial-part-1</a><br>
This tutorial is in four parts. Part-2 has information on all the registers and their roles.<br>
<div><br>
> > c)lets say for a program a.c i use gcc -S a.c ...do we have some other<br>
> > command to generate somewhat more clear assembly code, may be with<br>
</div>> > some comments in English<br>
Take a look at information on objdump command. You can compile the debug binary of the code and use objdump with certain options on that binary- this will dump the assembly code along with inline C code.<br>
<br>
[...]<br>
<div>><br>
> ><br>
> > Any kind of help in understanding this will be appreciated ..<br>
> ><br>
> > Thanks<br>
> > Nidhi<br>
<br>
</div>Hope it helps.<br>
<br>
--<br>
Thanks,<br>
Nilesh<br>
</div></div><div><div><br>
<br>
<br><div class="im">
_______________________________________________<br>
Kernelnewbies mailing list<br>
<a href="mailto:Kernelnewbies@kernelnewbies.org" target="_blank">Kernelnewbies@kernelnewbies.org</a><br>
<a href="http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies" target="_blank">http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies</a><br>
</div></div></div></blockquote></div><br>
</blockquote></div><br><br clear="all"><br>-- <br>Thanks & Regards <br>Nidhi Mittal Hada<br><br><a href="http://nidhi-searchingmyself.blogspot.com/" target="_blank">http://nidhi-searchingmyself.blogspot.com/</a><br><br>