Software debugging technology (2) -- How to Implement coredump

Software debugging technology (2) -- How to Implement coredump
Recently, I learned that when the application software crashes, it can be set to generate a stored file. This function is coredump. Whether the application crashes or the kernel crashes and stores data, it is a very practical technology. This article aims to understand the implementation methods of these two technologies from the perspective of implementation principles. First, analyze the implementation of the application coredump.

What conditions trigger the transfer
This transfer occurs when the application receives a fatal signal. When processing this signal, it executes the transfer of the application and then exits. Note that if the user installs a Custom handler for these fatal signal, the transfer will not happen. OK. Here we will summarize two points:
1. The critical signal will start to be stored, and the signal includes the following content.

1. 398 # define SIG_KERNEL_COREDUMP_MASK (\
   
2. 399 rt_sigmask (SIGQUIT) | rt_sigmask (SIGILL) | \
   
3. 400 rt_sigmask (SIGTRAP) | rt_sigmask (SIGABRT) | \
   
4. 401 rt_sigmask (SIGFPE) | rt_sigmask (SIGSEGV) | \
   
5. 402 rt_sigmask (SIGBUS) | rt_sigmask (SIGSYS) | \
   
6. 403 rt_sigmask (SIGXCPU) | rt_sigmask (SIGXFSZ) | \
   
7. 404 SIGEMT_MASK

2. If the above fatal signal is installed with a user-defined processing function, coredump will not happen.

1. 2366if (ka-> sa. sa_handler! = SIG_DFL ){
   
2. 2265/* Run the handler .*/
   
3. 2266 ksig-> ka = * ka;
   
4. 2267
   
5. 2268if (ka-> sa. sa_flags & SA_ONESHOT)
   
6. 2269 ka-> sa. sa_handler = SIG_DFL;
   
7. 2270
   
8. 2271 break;/* will return non-zero "signr" value */
   
9. 2272}

When the kernel searches for the signal to be processed, it first determines whether the signal is the default processing method. If it is the default processing method, it will continue to be executed to the coredump branch; otherwise, it will jump out of the search link, execute the User-Defined processing method.

Branch that triggers coredump execution

1. 2335if (sig_kernel_coredump (signr )){
   
2. 2336if (print_fatal_signals)
   
3. 2337 print_fatal_signal (ksig-> info. si_signo );
   
4. 2338 proc_coredump_connector (current );
   
5. 2339 /*
   
6. 2340 * Ifit was abletodump core, this kills all
   
7. 2341 * other threadsinthe groupandsynchronizes
   
8. 2342 * their demise. Ifwe lost the race with another
   
9. 2343 * thread getting here, itsetgroup_exit_code
   
10. 2344 * firstandour do_group_exitcallbelow will use
    
11. 2345 * that valueandignore the one we pass it.
    
12. 2346 */
    
13. 2347 do_coredump (& ksig-> info );
    
14. 2348}
15. 
    

Print the fatal signal to the Tips on the console
If you enable option in the following proc directory, the function of printing the fatal signal to the console is enabled.
/Proc/sys/kernel/print-fatal-signals

Coredump steps
In fact, the process of writing this application to a disk must be very responsible. I will not deduct details here. Some detailed principles may be pushed to the following sections for further details and analysis. However, here we need to understand the following key processes for coredump.
1. check whether all threads in the thread group are in sleep state. We need coredump to ensure that some threads in the process are still running and rewrite the memory space when we copy the memory space of the process.
2. There is nothing special about directly transferring the process memory to a file, that is, opening a file and writing it.
3. When a user space script is created and some compression operations are performed, a user-state process is started and an pipeline is established between the kernel and the user-state process,
Kernel ============================== user-mode process (Compressed) ----------- write --------> File

For the first step of processing, the kernel wants all threads in the Process Group to send the kill signal, and then waits until all processes are not in the running state.
For the second step, the processing is relatively simple, but if you are interested, you can further study the format of the coredump file.
The third step is relatively complicated. The clever part is that a pipeline is established in the kernel. The kernel processes the signal part and writes the coredump to the pipeline, the other end of the pipeline in the newly created process is set to the standard input.

How to compress the process
We can build a shell execution File
#! /Bin/sh
Execgzip->/root/unzip 1.core.w.2.gz
Then write data in/proc/sys/kernel/core_pattern.
|/Usr/sbin/core_helper % e % p