Method, apparatus and device for determining thread calling information

Abstract

Provided in the present disclosure are a method, apparatus and device for determining thread calling information. The method comprises: determining a thread state of a target thread, wherein the thread state may be a kernel mode or a user state; determining a target central processing unit (CPU) core corresponding to the target thread, wherein the target CPU core is used for executing the target thread; and determining calling information of the target thread on the basis of the thread state and the target CPU core, wherein the calling information comprises function identifiers of multi-layer functions called by the target thread, and a calling sequence of the multi-layer functions. The flexibility of determination of thread calling information is improved.

Description

Method, device and equipment for determining thread call information

[0001] This disclosure claims priority to a Chinese patent application filed with the Patent Office of China on September 8, 2023, with application number 202311156517.5 and application name “Method, device and apparatus for determining thread call information,” the entire contents of which are incorporated by reference into this disclosure. Technical Field

[0002] The present disclosure relates to the field of computers, and in particular to a method, apparatus, and device for determining thread call information. Background Art

[0003] In a computer, an application can be executed through multiple threads. When an exception occurs in any thread, the thread call information of the thread can be obtained to find the cause of the exception.

[0004] In related art, when a thread exception occurs, the thread is typically interrupted and pre-set code is executed to obtain the thread's call information. However, in this approach, the pre-set code is typically written during the application development phase. If an unexpected exception occurs in a thread, the pre-set code cannot be executed to obtain the thread's call information, resulting in limited flexibility in determining the thread call information.

[0005] Summary of the Invention

[0006] Various aspects of the present disclosure provide a method, apparatus, and device for determining thread call information, so as to improve the flexibility of determining thread call information.

[0007] In a first aspect, an embodiment of the present disclosure provides a method for determining thread call information, comprising:

[0008] Determine the thread state of the target thread, wherein the thread state includes kernel state and user state;

[0009] Determine a target processor CPU core corresponding to a target thread, wherein the target CPU core is used to execute the target thread;

[0010] The calling information of the target thread is determined according to the thread state and the target CPU core, where the calling information includes function identifiers of multi-layer functions called by the target thread and a calling sequence between the multi-layer functions.

[0011] In a possible embodiment, determining the call information of the target thread according to the thread state and the target CPU core includes:

[0012] If the thread state is the user state, obtaining values ​​of multiple MSR registers of specific models corresponding to the target CPU core, and determining the call information according to the values ​​of the multiple MSR registers;

[0013] If the thread state is the kernel state, the values ​​of multiple general registers of the target thread in the user state are obtained, and the call information is determined according to the values ​​of the multiple general registers of the target thread in the user state.

[0014] In a possible embodiment, obtaining values ​​of multiple MSR registers corresponding to the target CPU core includes:

[0015] Determine an index register corresponding to the target CPU core, and determine at least one address register, wherein the index register and the address register are MSR registers respectively;

[0016] Obtaining a value of the index register and a value of the at least one address register;

[0017] Determining the values ​​of the plurality of MSR registers includes the value of the index register and the value of the at least one address register.

[0018] In one possible embodiment, determining at least one address register includes:

[0019] determining a target register location in the index register;

[0020] Determining, according to the target register position, a first target register among a plurality of address registers corresponding to the target CPU core, where the first target register is an address register used by the target CPU core to record a function call relationship for the last time;

[0021] Determine M second target registers from a plurality of address registers used by the target CPU core, wherein the values ​​in the second target registers are non-zero values;

[0022] It is determined that the at least one address register includes the first target register and the M second target registers.

[0023] In a possible embodiment, determining the call information according to the values ​​of the multiple MSR registers includes:

[0024] determining a source address of the multi-layer function according to the value of the first target register and the values ​​of the M second target registers;

[0025] Determining a function identifier of the multi-layer function according to a source address of the multi-layer function;

[0026] determining a calling order of the multi-layer function according to an arrangement order of the first target register and the M second target registers;

[0027] The calling information includes the function identifier of the multi-layer function and the calling order of the multi-layer function.

[0028] In a possible embodiment, before obtaining the values ​​of multiple MSR registers of specific models corresponding to the target CPU core, the method further includes:

[0029] After the target thread is started, the function call recording function of the target CPU core is enabled;

[0030] When the target CPU core executes the first-layer function call instruction, the source address of the first-layer function is stored in the address register with a register sequence number K, and the value in the index register is updated to K, where K is an integer greater than or equal to 0, and the address register with a register sequence number K is the first address register used by the target CPU core in the current function call recording process;

[0031] When the target CPU core executes the i+1th layer function call instruction, the source address of the i+1th layer function is stored in the address register with register number K+1, and the value in the index register is updated to K+1;

[0032] Here, the value of i is 1, 2, ... in sequence until the function call recording function of the target CPU core is turned off.

[0033] In a possible embodiment, enabling the function call recording function of the target CPU core includes:

[0034] Setting the value in the flag register corresponding to the target CPU core to a first preset value to enable the function call recording function of the target CPU core, the flag register being an MSR register;

[0035] Disable the function call recording function of the target CPU core, including:

[0036] The value in the flag MSR register is set to a second preset value to disable the function call recording function of the target CPU core.

[0037] In a possible embodiment, for any one MRS register among the index register and the at least one address register, obtaining a value of the MSR register includes:

[0038] Obtain a first system file of the target CPU core, where the first system file includes a method for reading and writing the multiple MSR registers in user mode;

[0039] According to the first system file and the identifier of the MSR register, the value of the MSR register is obtained.

[0040] In a possible embodiment, obtaining the values ​​of multiple general registers of the target thread in user mode includes:

[0041] Determine the kernel stack corresponding to the target thread;

[0042] The values ​​of a plurality of general registers of the target thread in the user state are obtained in the kernel stack.

[0043] In a possible embodiment, obtaining values ​​of multiple general registers of the target thread in user mode in the kernel stack includes:

[0044] Get the symbol table description file of the operating system kernel;

[0045] Determine an address calculation formula corresponding to the operating system kernel, where the address calculation formula is used to calculate the kernel stack address of the target thread;

[0046] According to the symbol table description file and the address calculation formula, values ​​of multiple general registers of the target thread in the user state are obtained in the kernel stack.

[0047] In a possible embodiment, obtaining the values ​​of multiple general registers of the target thread in user mode in the kernel stack according to the symbol table description file and the address calculation formula includes:

[0048] Calculate the target memory address according to the symbol table description file and the address calculation formula;

[0049] According to the target memory address, a target memory is determined in the kernel stack, and values ​​of a plurality of general registers of the target thread in the user state are stored in the target memory.

[0050] In a possible embodiment, determining the call information according to the values ​​of a plurality of general registers of the target thread in user mode includes:

[0051] Determine the user stack corresponding to the target thread;

[0052] Determining a function address of a latest function according to values ​​of a plurality of general registers of the target thread in user mode;

[0053] Determining a starting position in the user stack according to a function address of the latest function;

[0054] Starting from the starting position, obtaining the return address of the multi-layer function in the user stack in order of stack addresses from low to high;

[0055] The calling information is determined according to the function address of the latest function and the return address of the multi-layer function.

[0056] In a second aspect, an embodiment of the present disclosure provides a thread call information determination device, comprising: a first determination module, a second determination module, and a third determination module, wherein:

[0057] The first determining module is used to determine the thread state of the target thread, where the thread state includes kernel state and user state;

[0058] The second determining module is used to determine a target processor CPU core corresponding to the target thread, and the target CPU core is used to execute the target thread;

[0059] The third determining module is used to determine the calling information of the target thread according to the thread state and the target CPU core, where the calling information includes function identifiers of multi-layer functions called by the target thread and a calling order between the multi-layer functions.

[0060] In a possible embodiment, the third determining module is specifically configured to:

[0061] If the thread state is the user state, obtaining values ​​of multiple MSR registers of specific models corresponding to the target CPU core, and determining the call information according to the values ​​of the multiple MSR registers;

[0062] If the thread state is the kernel state, the values ​​of multiple general registers of the target thread in the user state are obtained, and the call information is determined according to the values ​​of the multiple general registers of the target thread in the user state.

[0063] In a possible embodiment, the third determining module is specifically configured to:

[0064] Determine an index register corresponding to the target CPU core, and determine at least one address register, wherein the index register and the address register are MSR registers respectively;

[0065] Obtaining a value of the index register and a value of the at least one address register;

[0066] Determining the values ​​of the plurality of MSR registers includes the value of the index register and the value of the at least one address register.

[0067] In a possible embodiment, the third determining module is specifically configured to:

[0068] determining a target register location in the index register;

[0069] Determining, according to the target register position, a first target register among a plurality of address registers corresponding to the target CPU core, where the first target register is an address register used by the target CPU core to record a function call relationship for the last time;

[0070] Determine M second target registers from a plurality of address registers used by the target CPU core, wherein the values ​​in the second target registers are non-zero values;

[0071] It is determined that the at least one address register includes the first target register and the M second target registers.

[0072] In a possible embodiment, the third determining module is specifically configured to:

[0073] determining a source address of the multi-layer function according to the value of the first target register and the values ​​of the M second target registers;

[0074] Determining a function identifier of the multi-layer function according to a source address of the multi-layer function;

[0075] determining a calling order of the multi-layer function according to an arrangement order of the first target register and the M second target registers;

[0076] The calling information includes the function identifier of the multi-layer function and the calling order of the multi-layer function.

[0077] In a possible embodiment, the device further includes a setting module and a storage module, wherein:

[0078] The setting module is used to enable the function call recording function of the target CPU core after the target thread is started;

[0079] The storage module is configured to, when the target CPU core executes the first-layer function call instruction, store the source address of the first-layer function in the address register with a register sequence number K, and update the value in the index register to K, where K is an integer greater than or equal to 0, and the address register with a register sequence number K is the first address register used by the target CPU core in the current function call recording process;

[0080] The storage module is used to, when the target CPU core executes the i+1th layer function call instruction, store the source address of the i+1th layer function in the address register with register sequence number K+1, and update the value in the index register to K+1;

[0081] Here, the value of i is 1, 2, ... in sequence until the function call recording function of the target CPU core is turned off.

[0082] In a possible embodiment, the setting module is specifically configured to:

[0083] Setting the value in the flag register corresponding to the target CPU core to a first preset value to enable the function call recording function of the target CPU core, the flag register being an MSR register;

[0084] Disable the function call recording function of the target CPU core, and the setting module is specifically used to:

[0085] The value in the flag MSR register is set to a second preset value to disable the function call recording function of the target CPU core.

[0086] In a possible embodiment, for any one MRS register among the index register and the at least one address register, the third determining module is specifically configured to:

[0087] Obtain a first system file of the target CPU core, where the first system file includes a method for reading and writing the multiple MSR registers in user mode;

[0088] According to the first system file and the identifier of the MSR register, the value of the MSR register is obtained.

[0089] In a possible embodiment, the third determining module is specifically configured to:

[0090] Determine the kernel stack corresponding to the target thread;

[0091] The values ​​of a plurality of general registers of the target thread in the user state are obtained in the kernel stack.

[0092] In a possible embodiment, the third determining module is specifically configured to:

[0093] Get the symbol table description file of the operating system kernel;

[0094] Determine an address calculation formula corresponding to the operating system kernel, where the address calculation formula is used to calculate the kernel stack address of the target thread;

[0095] According to the symbol table description file and the address calculation formula, values ​​of multiple general registers of the target thread in the user state are obtained in the kernel stack.

[0096] In a possible embodiment, the third determining module is specifically configured to:

[0097] Calculate the target memory address according to the symbol table description file and the address calculation formula;

[0098] According to the target memory address, a target memory is determined in the kernel stack, and values ​​of a plurality of general registers of the target thread in the user state are stored in the target memory.

[0099] In a possible embodiment, the third determining module is specifically configured to:

[0100] Determine the user stack corresponding to the target thread;

[0101] Determining a function address of a latest function according to values ​​of a plurality of general registers of the target thread in user mode;

[0102] Determining a starting position in the user stack according to a function address of the latest function;

[0103] Starting from the starting position, obtaining the return address of the multi-layer function in the user stack in order of stack addresses from low to high;

[0104] The calling information is determined according to the function address of the latest function and the return address of the multi-layer function.

[0105] In a third aspect, an embodiment of the present disclosure provides an electronic device, including: a memory and a processor;

[0106] The memory stores computer-executable instructions;

[0107] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the method for determining thread call information according to any one of the first aspects.

[0108] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer execution instructions, which, when executed by a processor, are used to implement the method for determining thread call information described in any one of the first aspects.

[0109] In a fifth aspect, an embodiment of the present disclosure provides a computer program product, including a computer program, which, when executed by a processor, implements the method for determining thread call information shown in any one of the first aspects.

[0110] The disclosed embodiments provide a method, apparatus, and device for determining thread call information. The electronic device can determine the thread state of the target thread and the target CPU core corresponding to the target thread, and then determine the call information of the target thread based on the thread state and the target CPU core. Since the call information of the target thread can be determined in the event of any abnormality in the target thread, it is not limited to the preset code; and the stack backtrace can be performed using hardware characteristics or kernel design without interrupting the execution of the target thread, which comprehensively improves the flexibility of determining the thread call information; and achieves high-frequency and efficient tracking of the execution process of the target thread, determines the call information of the target thread, and archives it. After an abnormal scenario occurs, the call information of the target thread during the abnormal period can be used to assist in finding the cause of the fault and eliminate security risks in the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0111] The drawings described herein are used to provide a further understanding of the present disclosure and constitute a part of the present disclosure. The exemplary embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation of the present disclosure. In the drawings:

[0112] FIG1 is a schematic diagram of a scenario provided by an exemplary embodiment of the present disclosure;

[0113] FIG2 is a flow chart of a method for determining thread call information provided by an exemplary embodiment of the present disclosure;

[0114] FIG3 is a schematic diagram of the structure of a user stack provided by an exemplary embodiment of the present disclosure;

[0115] FIG4 is a flow chart of another method for determining thread call information provided by an exemplary embodiment of the present disclosure;

[0116] FIG5 is a process diagram of a method for determining thread call information provided by an exemplary embodiment of the present disclosure;

[0117] FIG6 is a flow chart of another method for determining thread call information provided by an exemplary embodiment of the present disclosure;

[0118] FIG7 is a process diagram of another method for determining thread call information provided by an exemplary embodiment of the present disclosure;

[0119] FIG8 is a schematic structural diagram of a device for determining thread call information provided by an exemplary embodiment of the present disclosure;

[0120] FIG9 is a schematic structural diagram of an electronic device provided by an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0121] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0122] To make the objectives, technical solutions, and advantages of the present disclosure more clear, the technical solutions of the present disclosure will be clearly and completely described below in conjunction with the specific embodiments of the present disclosure and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present disclosure.

[0123] FIG1 is a schematic diagram of a scenario provided by an exemplary embodiment of the present disclosure. Referring to FIG1 , a processor (Central Processing Unit, CPU) may include multiple CPU cores. For example, the multiple CPU cores may be CPU core 1, CPU core 2, ..., CPU core n, (n is an integer greater than or equal to 1).

[0124] Different CPU cores can execute different threads. For example, CPU core 1 can execute thread 1, and CPU core 2 can execute thread 2.

[0125] Threads can have corresponding thread states, including user state and kernel state. User state is a lower-privilege running state; kernel state is a higher-privilege running state. For example, thread 1 can be in kernel state, while thread 2 can be in user state.

[0126] When it is necessary to obtain the call information of the target thread, the thread state of the target thread and the target CPU core executing the target thread can be determined. Then, the call information of the target thread can be determined based on the thread state of the target thread and the target CPU core. For example, if the target thread is thread 1, if the thread state of thread 1 is determined to be kernel state, and if the target CPU core executing thread 1 is CPU core 1, the call information of thread 1 can be determined by accessing the kernel state memory.

[0127] In related art, when a thread exception occurs, the thread is typically interrupted and pre-set code is executed to obtain the thread's call information. However, in this approach, the pre-set code is typically written during the application development phase. If an unexpected exception occurs in a thread, the pre-set code cannot be executed to obtain the thread's call information, resulting in limited flexibility in determining the thread call information.

[0128] In the disclosed embodiments, the target thread's thread state and the target CPU core corresponding to the target thread can be determined, and the target thread's call information can be determined based on the thread state and the target CPU core. Since the target thread's call information can be determined even if any exception occurs in the target thread, without being restricted by a preset code, the flexibility of determining thread call information is increased.

[0129] The technical solutions shown in the present disclosure are described in detail below through specific embodiments. It should be noted that the following embodiments can exist independently or in combination with each other, and the same or similar contents will not be repeated in different embodiments.

[0130] FIG2 is a flow chart of a method for determining thread call information provided by an exemplary embodiment of the present disclosure. Referring to FIG2 , the method may include:

[0131] S201: Determine the thread state of the target thread.

[0132] The execution subject of the embodiments of the present disclosure may be an electronic device, or a device for determining thread call information provided in the electronic device. The device for determining thread call information may be implemented through software, or through a combination of software and hardware. The device for determining thread call information may be a processor in the electronic device. For ease of understanding, the following description will be based on an example in which the execution subject is an electronic device.

[0133] It should be noted that the technical solution in the present disclosure may also be executed by a monitoring thread in the process where the target thread is located.

[0134] A process can include multiple threads. A thread is the smallest unit of execution for an application. For example, a process can include 10 threads: thread 1, thread 2, ..., thread 10. Thread 10 can be a monitoring thread, which can execute the technical solutions of this disclosure on any other threads in the process.

[0135] Optionally, the thread state may include kernel state and user state.

[0136] Kernel state refers to the state in which a thread is in after entering kernel state to perform specific operations or being scheduled by the operating system, and has a higher level of privileges; user state refers to the state in which a thread is in when executing in user state, and has a lower level of privileges.

[0137] Optionally, if the thread is executed in user state, the thread state of the thread can be determined to be user state; if the thread is executed in kernel state or is scheduled by the operating system to enter a dormant state, the thread state of the thread can be determined to be kernel state.

[0138] For example, if thread 1 is executed in user mode, the thread state of thread 1 is user mode; if thread 2 is executed in kernel mode, the thread state of thread 2 is kernel mode.

[0139] For any thread, the thread can have a corresponding user stack or kernel stack.

[0140] The user stack is described below with reference to FIG3 .

[0141] Figure 3 is a schematic diagram of the structure of a user stack provided by an exemplary embodiment of the present disclosure. Referring to Figure 3 , a user stack may include stack frames corresponding to multiple layers of functions. For example, if thread 1 calls three layers of functions, namely function 1, function 2, and function 3, the user stack corresponding to thread 1 may include stack frames corresponding to function 1, function 2, and function 3, respectively.

[0142] The stack is the memory space allocated in user mode during a function call. It can be divided into multiple stack frames according to the calling relationship. Each stack frame contains the address returned to the previous stack frame and local variables. For example, the stack frame corresponding to function 2 can store the address returned to function 1 and the local variables of function 2.

[0143] The user stack grows from the bottom to the top, with the bottom stack address being the highest address and the top stack address being the lowest address. For example, if the target thread has the following call relationship: function 1 calls function 2, and function 2 calls function 3, then function 3 is the top of the user stack corresponding to the target thread.

[0144] It should be noted that the structure of the kernel stack is similar to that of the user stack.

[0145] S202: Determine the target processor CPU core corresponding to the target thread.

[0146] The target CPU core refers to the CPU core used to execute the target thread.

[0147] In an optional embodiment, the target CPU core corresponding to the target thread may be determined in the following manner: obtaining a target thread state description file corresponding to the target thread; and determining the target CPU core corresponding to the target thread according to the target thread state description file.

[0148] The target thread state description file may include the target thread's running information, such as the target thread's running time, the CPU core that executes the target thread, and the like.

[0149] For example, if the thread identification (Identity document, ID) of the target thread is t, the corresponding target thread status description file is / proc / t / stat file under Linux. If the target thread is running on CPU core 1, the target thread status description file can be read and parsed, and the target CPU core corresponding to thread t can be determined as CPU core 1 in the target thread status description file.

[0150] S203: Determine the call information of the target thread according to the thread state and the target CPU core.

[0151] The target thread can call multiple layers of functions. For example, the target thread can call function main, function main calls function A, and function A calls function B.

[0152] The call information may include the function identifiers of the multi-layer functions called by the target thread, as well as the calling order between the multi-layer functions. For example, the call information may include the identifiers of the layer 1 function, the layer 2 function, and the layer 3 function, and the calling relationship may be: the layer 1 function calls the layer 2 function, and the layer 2 function calls the layer 3 function.

[0153] Optionally, the calling information of the target thread is determined based on the thread state and the target CPU core, which may include the following two cases:

[0154] Case 1: The thread state is user mode.

[0155] In this case, values ​​of multiple model specific registers (MSR) corresponding to the target CPU core may be obtained, and call information may be determined based on the values ​​of the multiple MSR registers.

[0156] The MSR register refers to a register in the x86 architecture processor that is used to control CPU operation, function switches, debugging, tracking program execution, and monitoring CPU performance.

[0157] For any CPU core, multiple MSR registers can be configured in the CPU core. For example, CPU core 1 can be configured with 64 MSR registers.

[0158] For example, if the target thread is thread t, the state of thread t is user state, and the target CPU core is CPU core 1, the values ​​of multiple MSR registers corresponding to CPU core 1 can be determined, and the call information of thread t can be determined based on the values ​​of the multiple MSR registers.

[0159] Case 2: The thread state is kernel state.

[0160] In this case, the values ​​of multiple general registers of the target thread in the user state may be obtained, and the call information may be determined according to the values ​​of the multiple general registers of the target thread in the user state.

[0161] For example, if the target thread is thread t and the state of thread t is kernel state, the values ​​of multiple general registers of thread t in user state can be obtained, and the call information of thread t can be determined based on the values ​​of multiple general registers of thread t in user state.

[0162] For any thread, the technical solution disclosed in this disclosure can be used to track the execution process of the thread with high frequency and high efficiency, determine the thread's call information and archive it. After an abnormal scenario occurs, the thread's call information during the abnormal period can be used to assist in finding the cause of the fault and eliminating system security risks.

[0163] In an embodiment of the present disclosure, an electronic device can determine the thread state of a target thread and the target CPU core corresponding to the target thread, and then determine the call information of the target thread based on the thread state and the target CPU core. Since the call information of the target thread can be determined even if any exception occurs in the target thread, it is not limited to a preset code, thereby increasing the flexibility of determining the thread call information.

[0164] Below, based on the embodiment shown in Figure 2, in combination with Figure 4, a method for determining the call information of a thread when the thread state of the thread is in user mode is described in detail; in combination with Figure 6, a method for determining the call information of a thread when the thread state of the thread is in kernel mode is described in detail.

[0165] FIG4 is a flow chart of another method for determining thread call information provided by an exemplary embodiment of the present disclosure. Referring to FIG4 , the method includes:

[0166] S401: Determine the thread state of the target thread.

[0167] S402: Determine the target processor CPU core corresponding to the target thread.

[0168] It should be noted that the execution process of steps S401 to S402 can refer to the execution process of steps S201 to S202, and will not be repeated here.

[0169] S403: After the target thread is started, the function call recording function of the target CPU core is enabled.

[0170] In an optional embodiment, the value in the flag register of the target CPU core may be set to a first preset value to enable the function call recording function of the target CPU core.

[0171] Optionally, the flag register can be an MSR register. For example, the flag register can be the IA32_DEBUGCTL register.

[0172] Optionally, the first preset value can be 1, which is used to indicate enabling the function call recording function.

[0173] In an optional embodiment, the identification of the flag register can be obtained from the CPU hardware manual, and according to the identification of the flag register, the way to read and write the flag register in the user state can be determined in the first system file of the target CPU core. Furthermore, the value of the flag register can be set to the first preset value according to the way of reading and writing the flag register.

[0174] The CPU hardware manual can include the identifications of multiple MSR registers. For example, if there are 64 MSR registers, the CPU hardware manual can include the identifications of these 64 MSR registers.

[0175] The first system file can be a file for operating multiple MSR registers in the user state. The first system file can include the ways to read and write multiple MSR registers in the user state. For example, the first system file can be the / dev / cpu / <CPU core> / msr file.

[0176] For example, if the flag register is the IA32_DEBUGCTL register, assuming that the register identification of IA32_DEBUGCTL obtained from the CPU hardware manual is 01D9H, if the target CPU core is CPU core 1, then in the first system file 1 of CPU core 1, a 64-bit integer 1 can be written with 01D9H as the offset of the written file, that is, the value of the IA32_DEBUGCTL register is set to 1 to enable the function call recording function of CPU core 1.

[0177] S404. When the target CPU core executes the first-layer function call instruction, store the source address of the first-layer function into the address register with register number K, and update the value in the index register to K.

[0178] Optionally, the multiple MSR registers can include an index register and multiple address registers.

[0179] The index register can be the MSR_LBR_TOS register, which can be used to save the target register position. The target register position can be the cursor position P. For example, if the target register position in the index register is 4, it means that the currently latest used address register is address register 4.

[0180] The address register may be the MSR_LASTBRANCH_X_FROM_IP register, where X represents the register number. The numbers of multiple address registers may start from 0. For example, the multiple address registers may be the MSR_LASTBRANCH_0_FROM_IP register, the MSR_LASTBRANCH_1_FROM_IP register, and so on, the MSR_LASTBRANCH_X_FROM_IP register.

[0181] The address register with register serial number K may be the first address register used by the target CPU core during the current function call recording process, and K may be an integer greater than or equal to 0. For example, if the first address register used by the target CPU core during the current function call recording process is the MSR_LASTBRANCH_2_FROM_IP register, then K is 2.

[0182] When using multiple address registers, they can be used in order, starting with the first address register used by the target CPU during the current function call recording. For example, if the first address register used by the target CPU core during the current function call recording is the MSR_LASTBRANCH_2_FROM_IP register, and the target register position stored in the index register is 4, then the most recently used address register is the MSR_LASTBRANCH_4_FROM_IP register. Since the first address register is the MSR_LASTBRANCH_2_FROM_IP register, this means that the MSR_LASTBRANCH_2_FROM_IP register, the MSR_LASTBRANCH_3_FROM_IP register, and the MSR_LASTBRANCH_4_FROM_IP register have all been used.

[0183] The address registers can be used to store the source address of a multi-layer function call by the target thread. For example, if the target thread calls a layer-3 function, the MSR_LASTBRANCH_1_FROM_IP register can be used to store the source address of the layer-1 function, the MSR_LASTBRANCH_2_FROM_IP register can be used to store the source address of the layer-2 function, and the MSR_LASTBRANCH_3_FROM_IP register can be used to store the source address of the layer-3 function.

[0184] For example, if the target thread is thread t, and thread t is a 3-level function call, if the first address register used in the function call recording process is the MSR_LASTBRANCH_2_FROM_IP register, that is, K is 2, then when the target CPU core executes the 1-level function call instruction, it can store the source address of the 1-level function to the address register with register number 2, that is, the MSR_LASTBRANCH_2_FROM_IP register, and update the value in the index register to 2.

[0185] S405. When the target CPU core executes the i+1th layer function call instruction, the source address of the i+1th layer function is stored in the address register with register sequence number K+1, and the value in the index register is updated to the K+1.

[0186] Optionally, i can be 1, 2, ... in sequence until the function call recording function of the target CPU core is disabled.

[0187] For example, if the target thread is thread t, and thread t is a 3-level function call, when the target CPU core executes the 1-level function, the source address of the 1-level function is stored in the MSR_LASTBRANCH_2_FROM_IP register, and K is 2. If i is 1, then i+1 is 2. When the target CPU core executes the 2-level function call instruction, it can store the source address of the 2-level function in the address register with register number 3, that is, the MSR_LASTBRANCH_3_FROM_IP register, and update the value in the index register to 3; if i is 2, then i+1 is 3. When the target CPU core executes the 3-level function call instruction, it can store the source address of the 3-level function in the address register with register number 4, that is, the MSR_LASTBRANCH_4_FROM_IP register, and update the value in the index register to 4.

[0188] S406: After the target thread ends, disable the function call recording function of the target CPU core.

[0189] Optionally, the value in the flag register of the target CPU core may be set to a second preset value to disable the function call recording function of the target CPU core.

[0190] Optionally, the second preset value may be 0, which is used to instruct the target CPU core to disable the function call recording function.

[0191] For example, if the flag register is the IA32_DEBUGCTL register, assuming that the register identifier of IA32_DEBUGCTL obtained in the CPU hardware manual is 01D9H, if the target CPU core is CPU core 1, then after the target thread ends, you can write 01D9H as the offset of the write file in the first system file 1 of CPU core 1, and write a 64-bit integer 0, that is, set the value of the IA32_DEBUGCTL register to 0, so as to turn off the function call recording function of CPU core 1.

[0192] S407 : Determine an index register corresponding to the target CPU core, and determine at least one address register.

[0193] Optionally, the target CPU core may correspond to multiple MSR registers. The multiple MSR registers may include an index register and at least one address register. For example, if the target CPU core corresponds to 64 MSR registers, the 64 MSR registers may include 1 index register and 32 address registers.

[0194] In an optional embodiment, at least one address register may be determined in the following manner: determining a target register position in an index MSR register; determining a first target register from a plurality of address registers corresponding to a target CPU core based on the target register position; determining M second target registers from a plurality of address registers used by the target CPU core; and determining that at least one address register includes the first target register and the M second target registers.

[0195] The first target register may be the address register used by the target CPU core to record the function call relationship for the last time. For example, if the first target register is the MSR_LASTBRANCH_4_FROM_IP register, it indicates that the address register used by the target CPU core to record the function call relationship for the last time during the current function call process is the MSR_LASTBRANCH_4_FROM_IP register.

[0196] The serial number of the second target register is located before the serial number of the first target register. The value in the second target register can be a non-zero value.

[0197] For example, if the first target register is the MSR_LASTBRANCH_4_FROM_IP register, the second target register may be the MSR_LASTBRANCH_2_FROM_IP register and the MSR_LASTBRANCH_3_FROM_IP register whose sequence numbers are located before the first target register, and the values ​​in these two registers are non-zero values.

[0198] For example, if the target register position in the index MSR register is 4, then the first target register can be determined as the MSR_LASTBRANCH_4_FROM_IP register in the multiple address registers corresponding to the target CPU core based on the target register position 4. Since the MSR_LASTBRANCH_0_FROM_IP register, the MSR_LASTBRANCH_1_FROM_IP register, the MSR_LASTBRANCH_2_FROM_IP register, and the MSR_LASTBRANCH_3_FROM_IP register exist before the MSR_LASTBRANCH_4_FROM_IP register, if the values ​​of the MSR_LASTBRANCH_2_FROM_IP register and the MSR_LASTBRANCH_3_FROM_IP register are non-zero, then two second target registers, namely the MSR_LASTBRANCH_2_FROM_IP register and the MSR_LASTBRANCH_3_FROM_IP register, can be determined in the multiple address registers used by the target CPU core. It may be determined that the at least one address register includes an MSR_LASTBRANCH_2_FROM_IP register, an MSR_LASTBRANCH_2_FROM_IP register, and an MSR_LASTBRANCH_3_FROM_IP register.

[0199] S408 , obtaining a value of an index register and a value of at least one address register, and determining that the values ​​of the multiple MRS registers include the value of the index register and the value of the at least one address register.

[0200] Since the index register and at least one address register are all MSR registers, for any MSR register, the value of the MSR register can be obtained in the following way: obtain the first system file of the target CPU core; and obtain the value of the MSR register based on the first system file and the identifier of the MSR register.

[0201] Optionally, for any MSR register, the identifier of the MSR register may be obtained from the CPU hardware manual.

[0202] Optionally, a first system file of the target CPU core can be obtained. The identifier of the index register can be determined in the CPU hardware manual, and the path for reading and writing the index register in user mode can be determined in the first system file based on the identifier of the index register. Then, the value of the index register can be obtained based on the path for reading and writing the index register in user mode. The identifier of the address register can be determined in the CPU hardware manual, and the path for reading and writing the address register in user mode can be determined in the first system file based on the identifier of the address register. Then, the value of the address register can be obtained based on the path for reading and writing the address register in user mode.

[0203] For example, if the target CPU core is CPU core 1, the first system file / dev / cpu / 1 / msr of CPU core 1 can be obtained. If the index register identifier is determined to be 0x4FD in the CPU hardware manual, the way to read and write the index register in user mode can be determined in the first system file / dev / cpu / 1 / msr according to 0x4FD, and then the value of the index register can be obtained according to the way to read and write the index register in user mode; if the address register 1 identifier is determined to be 0x29A in the CPU hardware manual, the way to read and write address register 1 in user mode can be determined in the first system file / dev / cpu / 1 / msr according to 0x29A, and then the value of address register 1 can be obtained according to the way to read and write address register 1 in user mode.

[0204] The values ​​of the multiple MRS registers may include a value of an index register and a value of at least one address register.

[0205] For example, the values ​​of the multiple MRS registers may include the value of the index register and the values ​​of three address registers.

[0206] S409: Determine calling information according to the values ​​of the multiple MSR registers.

[0207] Optionally, the call information includes the function identifiers of the multi-layer functions called by the target thread and the calling order between the multi-layer functions. For example, the call information may include the function identifiers of three-layer functions and the calling order of the three-layer functions.

[0208] In an optional embodiment, the calling information can be determined according to the values ​​of multiple MSR registers in the following manner: the source address of the multi-layer function is determined according to the value of the first target register and the values ​​of the M second target registers; the function identifier of the multi-layer function is determined according to the source address of the multi-layer function; and the calling order of the multi-layer function is determined according to the arrangement order of the first target register and the M second target registers.

[0209] Since the first target register and the M second target registers are both address registers, the address registers are used to store the source address of the target thread calling the multi-layer function. Therefore, the value of the first target register and the values ​​of the M second target registers are both the source addresses of the function. The source address of the M+1 layer function can be determined based on the value of the first target register and the values ​​of the M second target registers.

[0210] Optionally, the source address of the M+1 layer function is processed by a preset instruction to determine the function identifier of the M+1 layer function, and the calling order of the M+1 layer function is determined according to the arrangement order of the first target register and the M second target registers.

[0211] For example, if the target thread is thread t, thread t calls a level 3 function, the first target register is the MSR_LASTBRANCH_4_FROM_IP register, and the two second target registers are the MSR_LASTBRANCH_2_FROM_IP register and the MSR_LASTBRANCH_3_FROM_IP register. The source address 3 of the level 3 function can be determined based on the value of the MSR_LASTBRANCH_4_FROM_IP register; the source address 2 of the level 2 function can be determined based on the value of the MSR_LASTBRANCH_3_FROM_IP register; and the source address 1 of the level 1 function can be determined based on the value of the MSR_LASTBRANCH_2_FROM_IP register. Then, by processing source address 1 using a preset instruction, the function identifier of the level 1 function can be determined to be main; by processing source address 2 using a preset instruction, the function identifier of the level 2 function can be determined to be A; and by processing source address 3 using a preset instruction, the function identifier of the level 3 function can be determined to be B. If the three registers are arranged in the following order: MSR_LASTBRANCH_2_FROM_IP register, MSR_LASTBRANCH_3_FROM_IP register, and MSR_LASTBRANCH_4_FROM_IP register, the calling order among the three layers of functions can be determined as follows: the first layer function calls the second layer function, and the second layer function calls the third layer function. Since the first layer function is identified as main, the second layer function is identified as A, and the third layer function is identified as B, the calling information can be determined as follows: function main calls function A, and function A calls function B.

[0212] It should be noted that the various processing steps (S401 to S409) shown in the embodiment of FIG4 do not constitute a specific limitation on the process of determining thread call information. In other embodiments of the present disclosure, the process of determining thread call information may include more or fewer steps than the embodiment of FIG4. For example, the process of determining thread call information may include some of the steps in the embodiment of FIG4, or some steps in the embodiment of FIG4 may be replaced by steps with the same functions, or some steps in the embodiment of FIG4 may be split into multiple steps, etc.

[0213] In an embodiment of the present disclosure, an electronic device can determine the thread state of a target thread and determine the target CPU core corresponding to the target thread. After the target thread is started, the function call recording function of the target CPU core can be enabled. When the target CPU core executes a layer 1 function call instruction, the source address of the layer 1 function is stored in an address register with a register sequence number of K, and the value in the index register is updated to K, where K is an integer greater than or equal to 0, and the address register with a register sequence number of K is the first address register used by the target CPU core during this function call recording process. When the target CPU core executes a layer i+1 function call instruction, the source address of the layer i+1 function is stored in an address register with a register sequence number of K+1, and the value in the index register is updated to K+1. After the target thread ends, the function call recording function of the target CPU core is disabled. The electronic device can determine the index register corresponding to the target CPU core, determine at least one address register, obtain the value of the index register and the value of the at least one address register, and determine the values ​​of multiple MRS registers, including the value of the index register and the value of the at least one address register. The electronic device can determine call information based on the values ​​of the multiple MSR registers. Since the call information of the target thread can be determined in the event of any exception in the target thread without being restricted by preset codes; and since the call information of the target thread can be determined by utilizing hardware characteristics without interrupting the execution of the target thread, the flexibility of determining the thread call information is comprehensively improved.

[0214] FIG5 is a process diagram of a method for determining thread call information provided by an exemplary embodiment of the present disclosure. Referring to FIG5 , the method includes steps ① ② ③ ④ ⑤.

[0215] The electronic device may determine the thread state of the target thread. For example, if the target thread is thread 1 and the thread is executed in user mode, then the thread state may be determined to be user mode.

[0216] For any thread, there may be a corresponding thread state description file. Since the thread state description file includes the thread's running information, in step ①, the target CPU core for executing the thread can be determined based on the thread state description file. For example, if thread 1 has a corresponding thread state description file 1, and if thread state description file 1 includes CPU core 1, then based on thread state description file 1, the target CPU core for thread 1 can be determined to be CPU core 1.

[0217] Optionally, the target CPU core is provided with a plurality of MSR registers, including an index register, 32 address registers, and a flag MSR register, wherein a value in the flag register is 0, indicating that the function call recording function of CPU core 1 is not enabled.

[0218] In step ②, the value in the flag register may be set to a first preset value 1 to enable the function call recording function of CPU core 1 .

[0219] In step ③, when the target CPU core executes the i+1th layer function call instruction, the source address of the i+1th layer function is stored in the address register with register number K+1, and the value in the index register is updated to K+1. i can be 1, 2,... in sequence until the function call recording function of the target CPU core is turned off.

[0220] For example, if the target thread is thread 1, and thread 1 is a 3-level function call, if K is 2, it means that the first address register used in this function call recording process is address register 2. When the target CPU core executes the 1-level function call instruction, it can store the source address of the 1-level function to address register 2, and update the value in the index register to 2, that is, K is 2; when i is equal to 1, then i+1 is 2, when the target CPU core executes the 2-level function call instruction, it can store the source address of the 2-level function to address register 3, and update the value in the index register to 3; when i is equal to 2, then i+1 is 3, when the target CPU core executes the 3-level function call instruction, it can store the source address of the 3-level function to address register 4, and update the value in the index register to 4.

[0221] In step ④, after the target thread finishes running, the value in the flag register of the target CPU core can be set to a second preset value 0 to disable the function call recording function of the target CPU core.

[0222] In step ⑤, the values ​​of multiple MSR registers are obtained, and the calling information is determined according to the values ​​of the multiple MSR registers.

[0223] Alternatively, the target register position may be obtained from the index register, a first target register may be determined based on the target register position, and M second target registers may be determined, thereby determining the value of the first target register and the values ​​of the M second target registers. The values ​​of the multiple MSR registers may include the value of the first target register and the values ​​of the M second target registers.

[0224] For example, if CPU core 1 includes 32 address registers, and if the target register position obtained in the index register is 4, then the first target register is determined to be address register 4 based on the target register position. Furthermore, the four address registers preceding address register 4 can be determined, and among these four address registers, the two address registers storing non-zero values ​​can be determined as the second target registers, namely, address register 2 and address register 3. Furthermore, the values ​​in address register 4, address register 3, and address register 2 can be determined. For example, the values ​​in address register 4, address register 3, and address register 2 can be source address 3, source address 2, and source address 1, respectively.

[0225] Optionally, source address 1 can be processed by a preset instruction to determine that the function identifier of the first-layer function is main; source address 2 can be processed by a preset instruction to determine that the function identifier of the second-layer function is A; source address 3 can be processed by a preset instruction to determine that the function identifier of the third-layer function is B. If the arrangement order of the three registers is: address register 2, address register 3, address register 4, then the calling order between the three-layer functions can be determined as the first-layer function calls the second-layer function, and the second-layer function calls the third-layer function. Since the identifier of the first-layer function is main, the identifier of the second-layer function is A, and the identifier of the third-layer function is B, the calling information can be determined as: function main calls function A, and function A calls function B.

[0226] In an embodiment of the present disclosure, an electronic device can determine the thread state of a target thread and determine the target CPU core corresponding to the target thread. After the target thread is started, the function call recording function of the target CPU core can be turned on. When the target CPU core executes a first-layer function call instruction, the source address of the first-layer function can be stored in an address register with a register number of K, and the value in the index register is updated to K; when the target CPU core executes an i+1th-layer function call instruction, the source address of the i+1th-layer function can be stored in an address register with a register number of K+1, and the value in the index register is updated to K+1. After the target thread ends, the function call recording function of the target CPU core can be turned off. The electronic device can determine the index register corresponding to the target CPU core, and determine at least one address register, and obtain the value of the index register and the value of at least one address register, and determine the values ​​of multiple MRS registers including the value of the index register and the value of at least one address register. The electronic device can determine the call information based on the values ​​of multiple MSR registers. Since the call information of the target thread can be determined in the event of any exception in the target thread without being restricted by preset codes; and since the call information of the target thread can be determined by utilizing hardware characteristics without interrupting the execution of the target thread, the flexibility of determining the thread call information is comprehensively improved.

[0227] FIG6 is a flow chart of another method for determining thread call information provided by an exemplary embodiment of the present disclosure. Referring to FIG6 , the method includes:

[0228] S601: Determine the thread state of the target thread.

[0229] S602: Determine the target processor CPU core corresponding to the target thread.

[0230] It should be noted that the execution process of steps S601 to S602 can refer to the execution process of steps S201 to S202, and will not be repeated here.

[0231] S603: Determine the kernel stack corresponding to the target thread.

[0232] For any thread, when the thread is executed in kernel state, the thread can have a corresponding kernel stack.

[0233] For example, if the target thread is thread 1, kernel stack 1 corresponding to thread 1 may be determined.

[0234] S604: Obtain a symbol table description file of the operating system kernel.

[0235] The symbol table description file can be a file such as / boot / System.map-* or / proc / kallsyms. The symbol table description file can include fixed kernel symbols. For example, if the symbol table description file is / proc / kallsyms, then / proc / kallsyms can include multiple fixed kernel symbols, such as kernel symbol 1, kernel symbol 2, and so on.

[0236] The electronic device may be provided with a symbol table description file. Since different operating system kernels correspond to different symbol table description files, the symbol table description file of the operating system kernel may be obtained.

[0237] S605: Determine the address calculation formula corresponding to the operating system kernel.

[0238] The address calculation formula can be used to calculate the kernel stack address of the target thread.

[0239] Optionally, an address calculation formula corresponding to the operating system kernel may be constructed based on the specific data organization mode of the operating system kernel in combination with a symbol table description file.

[0240] For example, if the operating system installed in the electronic device is the 2012 version of System W, the specific data organization method of the 2012 version of System W can be obtained, and combined with the symbol table description file, the address calculation formula corresponding to the 2012 version of System W can be constructed.

[0241] S606: Obtain values ​​of multiple general registers of the target thread in user mode in the kernel stack according to the symbol table description file and the address calculation formula.

[0242] When the target thread is executing in user state, the function instructions, function parameters, and other values ​​of the most recent function called by the target thread in user state can be saved in multiple general-purpose registers. When the target thread's thread state switches from user state to kernel state, in order to prevent the values ​​of the multiple general-purpose registers in user state from contaminating kernel state, the values ​​of the multiple general-purpose registers can be copied and saved in the kernel stack corresponding to the target thread, and then the values ​​in the multiple general-purpose registers can be cleared, making the multiple general-purpose registers available for use by the target thread in kernel state. Therefore, when the target thread switches from user state to kernel state, the kernel stack corresponding to the target thread saves the values ​​of the multiple general-purpose registers of the target thread in user state, and the values ​​of the multiple general-purpose registers of the target thread in user state can be obtained from the kernel stack.

[0243] The latest function is the function currently being called by the target thread. For example, if the target thread is currently calling a layer 3 function, then the layer 3 function is the latest function called by the target thread.

[0244] The function information may include at least one of a function pointer and a function parameter. For example, the function information may include an instruction pointer (RIP), a function parameter 1, and the like.

[0245] The rip pointer can be used to indicate the address of the code in the function of the top stack frame in the user state before entering the kernel state, that is, the function address of the latest function.

[0246] In an optional embodiment, the values ​​of multiple general registers of the target thread in user state can be obtained in the kernel stack according to the symbol table description file and the address calculation formula in the following manner: the target memory address is calculated according to the symbol table description file and the address calculation formula; the target memory is determined in the kernel stack according to the target memory address, and the values ​​of multiple general registers of the target thread in user state are obtained in the target memory.

[0247] Optionally, a plurality of target kernel symbols may be determined in the symbol table description file, and the target memory address may be obtained by calculating the plurality of target kernel symbols using an address calculation formula.

[0248] For example, if the symbol table description file is the / proc / kallsyms file, the target kernel symbols are kernel symbol 1 and kernel symbol 2, and if the address calculation formula is calculation formula 1, kernel symbol 1 and kernel symbol 2 can be calculated using calculation formula 1 to obtain the target memory address. Assume that the obtained target memory address is 0X80000038.

[0249] Optionally, the target memory may be determined in the kernel stack according to the target memory address, and values ​​of multiple general registers of the target thread in the user state may be stored in the target memory.

[0250] For example, if the target thread is thread 1 and the target memory address is 0X80000038, the target memory can be determined in the kernel stack based on 0X80000038. The values ​​of multiple general-purpose registers of thread 1 in user mode can be obtained from the target memory. Assume that the values ​​of multiple general-purpose registers of thread 1 in user mode include rip pointer 1 and function parameter 1. If the latest function is a layer 3 function, rip pointer 1 can be used to indicate the function address of the layer 3 function.

[0251] S607: Determine the user stack corresponding to the target thread.

[0252] For any thread, there is a corresponding user stack, which can be used to store data such as the function address and function variables of the functions called by the thread.

[0253] For example, if the target thread is thread 1, user stack 1 corresponding to thread 1 may be determined.

[0254] S608: Determine the function address of the latest function according to the values ​​of multiple general registers of the target thread in the user state.

[0255] Optionally, the values ​​of multiple general registers of the target thread in user mode may be parsed using code in the Libunwind code library to determine the function address of the latest function.

[0256] For example, if the latest function is a layer 3 function, and its function information includes rip pointer 1 and function parameter 2, the Libunwind code library can be used to determine the function address 3 of the layer 3 function based on the rip pointer 1 in the function information. Assume that the function address 3 of the layer 3 function can be 0X1008.

[0257] S609: Determine the starting position in the user stack according to the function address of the latest function.

[0258] Since the user stack includes multiple memory segments, the position corresponding to the function address of the latest function in the user stack can be determined as the starting position.

[0259] For example, if the latest function is a layer 3 function, function address 3 is 0X1008, and if the target thread is thread 1, corresponding to user stack 1, the position corresponding to function address 0X1008 in user stack 1 can be determined as the starting position based on function address 0X1008.

[0260] S610 , starting from the starting position, obtaining the return address of the multi-layer function in the user stack in order of stack addresses from low to high.

[0261] Optionally, the callback function can be executed through the Libunwind code to obtain the function address of the multi-layer function in the user stack.

[0262] Optionally, starting from the starting position, in order of stack addresses from low to high, with the assistance of other register values ​​and in combination with the debugging symbol information of the program, the return addresses of multiple layers of functions are obtained layer by layer in the user stack.

[0263] For example, if the user stack is as shown in Figure 3, the callback function can be executed through the Libunwind code, starting from the starting position corresponding to function address 3 in the user stack, with the assistance of other register values, combined with the debugging symbol information of the program, the return address 2 is obtained as the "return address of function 2" in the stack frame corresponding to the third-layer function, that is, function 3, and the return address 1 is obtained as the "return address of function 1" in the stack frame corresponding to the second-layer function, that is, function 2.

[0264] It should be noted that when the callback function is executed according to the Libunwind code to obtain the function address, the data in the user stack corresponding to the target thread may change as the target thread executes. Therefore, memory validity protection is required when executing the callback function to prevent the application from accessing illegal memory and causing a segmentation fault.

[0265] S611. Determine call information based on the function address of the latest function and the return address of the multi-layer function.

[0266] The calling information may include function identifiers of multi-layer functions and the calling sequence between multi-layer functions.

[0267] Optionally, multiple function addresses are processed by preset instructions to determine function identifiers of multi-layer functions.

[0268] For example, if the function address 3 of function 3 is 0X1008, "0X1008" can be processed through the preset instruction to obtain the function identifier of function 3 as B; similarly, the return address 2 can be processed through the preset instruction to obtain the function identifier of function 2 as A; the return address 1 can be processed through the preset instruction to obtain the function identifier of function 1 as main.

[0269] Since the stack addresses in the user stack are generated from high to low, after obtaining the function address and multiple return addresses of the latest function, the multiple function addresses can be sorted in order from high to low to obtain the calling order between multiple layers of functions.

[0270] For example, if there are three layers of function addresses, namely function address 3, return address 2, and return address 1, function address 3 is the function address of the latest function 3, return address 2 is the "return address of function 2", and return address 1 is the "return address of function 1", then the three function addresses can be sorted in descending order. Assuming the sorting result is return address 1, return address 2, function address 3, it can be determined that the calling order between the three layers of functions is the first layer function calling the second layer function, and the second layer function calling the third layer function, that is, function 1 calls function 2, and function 2 calls function 3.

[0271] Optionally, the call information may include the function identifiers of the multi-layer functions and the calling order between the multi-layer functions. For example, if the target thread is thread 1, thread 1 calls a 3-layer function, the function identifier of the 1st layer function is main, the function identifier of the 2nd layer function is A, and the function identifier of the 3rd layer function is B, and the calling order between the 3-layer functions is: the 1st layer function calls the 2nd layer function, and the 2nd layer function calls the 3rd layer function, then the call information can be determined as: function main calls function A, and function A calls function B.

[0272] It should be noted that the various processing steps (S601 to S611) shown in the embodiment of FIG6 do not constitute a specific limitation on the process of determining thread call information. In other embodiments of the present disclosure, the process of determining thread call information may include more or fewer steps than the embodiment of FIG6. For example, the process of determining thread call information may include some of the steps in the embodiment of FIG6, or some steps in the embodiment of FIG6 may be replaced by steps with the same functions, or some steps in the embodiment of FIG6 may be split into multiple steps, etc.

[0273] In an embodiment of the present disclosure, an electronic device can determine the thread state of a target thread and the target processor CPU core corresponding to the target thread. The electronic device can also determine the kernel stack corresponding to the target thread. The electronic device can obtain a symbol table description file for the operating system kernel and determine an address calculation formula corresponding to the operating system kernel. The electronic device can then obtain the values ​​of multiple general-purpose registers of the target thread in user state from the kernel stack based on the symbol table description file and the address calculation formula. The electronic device can determine the user stack corresponding to the target thread and, based on the values ​​of the multiple general-purpose registers of the target thread in user state, determine the function address of the latest function. Based on the function address of the latest function, the electronic device can then determine the starting position in the user stack. Starting from the starting position, the electronic device can retrieve the return addresses of multiple functions in the user stack in ascending order of stack addresses. Call information can then be determined based on the return addresses of the multiple functions. Because the call information of the target thread can be determined regardless of any exception in the target thread, without being restricted by pre-set code, and because the call information of the target thread can be determined by leveraging kernel design without interrupting the execution of the target thread, the flexibility of determining thread call information is improved.

[0274] FIG7 is a process diagram of another method for determining thread call information provided by an exemplary embodiment of the present disclosure. Referring to FIG7 , the method includes steps ① ② ③ ④ ⑤.

[0275] When the target thread is in user mode, the target thread can enter kernel mode through a system call interface to switch from user mode to kernel mode. The electronic device can determine the thread state of the target thread. For example, if the target thread is thread 1 and the thread is executing in kernel mode, the thread state can be determined to be kernel mode.

[0276] Each thread can have a corresponding thread state description file. Because the thread state description file includes the thread's running information, the target CPU core for executing the thread can be determined based on the thread state description file. For example, if thread 1 has a corresponding thread state description file 1, and if thread state description file 1 includes CPU core 1, then thread state description file 1 can be used to determine that the target CPU core for thread 1 is CPU core 1.

[0277] In step ①, the kernel stack corresponding to the target thread can be determined. For example, if the target thread is thread 1, the kernel stack corresponding to thread 1 can be used.

[0278] When the target thread executes in user state, it can store function information and other values ​​for the most recent function called by the target thread in multiple general-purpose registers. When the target thread enters kernel state, it can copy the values ​​of these general-purpose registers from user state and store them in the kernel stack's target memory. Therefore, the kernel stack's target memory stores the values ​​of the target thread's general-purpose registers in user state. Therefore, in step 2, the target memory address can be obtained, and based on the target memory address, the values ​​of the target thread's general-purpose registers in user state can be retrieved from the kernel stack.

[0279] Optionally, the target memory address may be calculated based on the symbol table description file and an address calculation formula.

[0280] For example, if the symbol table description file is the / proc / kallsyms file, the target kernel symbols are kernel symbol 1 and kernel symbol 2, and if the address calculation formula is calculation formula 1, kernel symbol 1 and kernel symbol 2 can be calculated using calculation formula 1 to obtain the target memory address. Assume that the obtained target memory address is 0X80000038.

[0281] Alternatively, the target memory can be determined in the kernel stack based on the target memory address, and the values ​​of multiple general registers of the target thread in user state can be obtained in the target memory. For example, if the target thread is thread 1 and the target memory address is 0X80000038, the corresponding target memory can be determined based on 0X80000038, and the values ​​of multiple general registers of thread 1 in user state can be obtained in the target memory, assuming that the values ​​of the multiple general registers of thread 1 in user state include rip pointer 1 and function parameter 2.

[0282] Optionally, the values ​​of multiple general registers of the target thread in user mode may be parsed using code in the Libunwind code library to determine the function address of the latest function.

[0283] For example, if the latest function is a layer 3 function, and its function information includes rip pointer 1 and function parameter 2, the Libunwind code library can be used to determine the function address 3 of the layer 3 function based on the rip pointer 1 in the function information. Assume that the function address 3 of the layer 3 function can be 0X1008.

[0284] In step ③, the user stack corresponding to the target thread can be determined. For example, if the target thread is thread 1, the user stack 1 corresponding to thread 1 can be determined.

[0285] In step ④, the starting position in the user stack can be determined based on the function address of the latest function. For example, if function address 3 is 0X1008, the address corresponding to function address 0X1008 in user stack 1 can be determined as the starting position based on function address 0X1008.

[0286] In step ⑤, the return address of the multi-layer function can be obtained in the user stack from the starting position in the order of stack addresses from low to high. Optionally, the callback function can be executed through the Libunwind code to obtain the function address of the multi-layer function in the user stack from the starting position. For example, the callback function can be executed through the Libunwind code to obtain the return address 2 as the "return address of function 2" in the stack frame corresponding to the third-layer function, i.e., function 3, in the user stack, and obtain the return address 1 as the "return address of function 1" in the stack frame corresponding to the second-layer function, i.e., function 2.

[0287] After obtaining the return address, the multiple return addresses are processed using a preset instruction to determine the function identifier of the multi-layer function. The multiple function addresses can then be sorted in descending order of stack address to determine the calling sequence between the multi-layer functions, thereby determining the calling information. The multiple function addresses may include the function address of the most recent function and the return address of the multi-layer function.

[0288] For example, if the target thread is thread 1, and thread 1 is a three-level function call, if there are three function addresses, namely function address 3, return address 2, and return address 1, then function address 3 can be processed through a preset instruction to obtain the function identifier of function 3 as B; return address 2 can be processed through a preset instruction to obtain the function identifier of function 2 as A; and return address 1 can be processed through a preset instruction to obtain the function identifier of function 1 as main. If the order of the three function addresses is return address 1, return address 2, and function address 3, then the calling order between the three layers of functions can be determined as function 1 calling function 2, function 2 calling function 3, and the calling information can be determined as: function main calls function A, function A calls function B.

[0289] In an embodiment of the present disclosure, an electronic device can determine the thread state of a target thread and the target processor CPU core corresponding to the target thread. The electronic device can also determine the kernel stack corresponding to the target thread. The electronic device can obtain a symbol table description file for the operating system kernel and determine an address calculation formula corresponding to the operating system kernel. The electronic device can then obtain the values ​​of multiple general-purpose registers of the target thread in user state from the kernel stack based on the symbol table description file and the address calculation formula. The electronic device can determine the user stack corresponding to the target thread and, based on the values ​​of the multiple general-purpose registers of the target thread in user state, determine the function address of the latest function. Based on the function address of the latest function, the electronic device can then determine the starting position in the user stack. Starting from the starting position, the electronic device can retrieve the return addresses of multiple functions in the user stack in ascending order of stack addresses. Call information can then be determined based on the return addresses of the multiple functions. Because the call information of the target thread can be determined regardless of any exception in the target thread, without being restricted by pre-set code, and because the call information of the target thread can be determined by leveraging kernel design without interrupting the execution of the target thread, the flexibility of determining thread call information is improved.

[0290] FIG8 is a schematic diagram of a structure of a device for determining thread call information provided by an exemplary embodiment of the present disclosure. Referring to FIG8 , the device 10 for determining thread call information includes: a first determining module 11, a second determining module 12, and a third determining module 13, wherein:

[0291] The first determining module 11 is used to determine the thread state of the target thread, where the thread state includes kernel state and user state;

[0292] The second determining module 12 is used to determine a target processor CPU core corresponding to a target thread, and the target CPU core is used to execute the target thread;

[0293] The third determining module 13 is configured to determine the calling information of the target thread according to the thread state and the target CPU core, wherein the calling information includes function identifiers of multi-layer functions called by the target thread and a calling sequence between the multi-layer functions.

[0294] The apparatus for determining thread call information provided by the embodiment of the present disclosure can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be described in detail here.

[0295] In a possible embodiment, the third determining module 13 is specifically configured to:

[0296] If the thread state is the user state, obtaining values ​​of multiple MSR registers of specific models corresponding to the target CPU core, and determining the call information according to the values ​​of the multiple MSR registers;

[0297] If the thread state is the kernel state, the values ​​of multiple general registers of the target thread in the user state are obtained, and the call information is determined according to the values ​​of the multiple general registers of the target thread in the user state.

[0298] In a possible embodiment, the third determining module 13 is specifically configured to:

[0299] Determine an index register corresponding to the target CPU core, and determine at least one address register, wherein the index register and the address register are MSR registers respectively;

[0300] Obtaining a value of the index register and a value of the at least one address register;

[0301] Determining the values ​​of the plurality of MSR registers includes the value of the index register and the value of the at least one address register.

[0302] In a possible embodiment, the third determining module 13 is specifically configured to:

[0303] determining a target register location in the index register;

[0304] Determining, according to the target register position, a first target register among a plurality of address registers corresponding to the target CPU core, where the first target register is an address register used by the target CPU core to record a function call relationship for the last time;

[0305] Determine M second target registers from a plurality of address registers used by the target CPU core, wherein the values ​​in the second target registers are non-zero values;

[0306] It is determined that the at least one address register includes the first target register and the M second target registers.

[0307] In a possible embodiment, the third determining module 13 is specifically configured to:

[0308] determining a source address of the multi-layer function according to the value of the first target register and the values ​​of the M second target registers;

[0309] Determining a function identifier of the multi-layer function according to a source address of the multi-layer function;

[0310] determining a calling order of the multi-layer function according to an arrangement order of the first target register and the M second target registers;

[0311] The calling information includes the function identifier of the multi-layer function and the calling order of the multi-layer function.

[0312] In a possible embodiment, the device further includes a setting module 14 and a storage module 15, wherein:

[0313] The setting module 14 is used to enable the function call recording function of the target CPU core after the target thread is started;

[0314] The storage module 15 is configured to, when the target CPU core executes the first-layer function call instruction, store the source address of the first-layer function in the address register with a register sequence number K, and update the value in the index register to K, where K is an integer greater than or equal to 0, and the address register with a register sequence number K is the first address register used by the target CPU core in the current function call recording process;

[0315] The storage module 15 is used to store the source address of the i+1th layer function in the address register with register number K+1 when the target CPU core executes the i+1th layer function call instruction, and update the value in the index register to K+1;

[0316] Here, the value of i is 1, 2, ... in sequence until the function call recording function of the target CPU core is turned off.

[0317] In a possible embodiment, the setting module 14 is specifically configured to:

[0318] Setting the value in the flag register corresponding to the target CPU core to a first preset value to enable the function call recording function of the target CPU core, the flag register being an MSR register;

[0319] To disable the function call recording function of the target CPU core, the setting module 14 is specifically configured to:

[0320] The value in the flag MSR register is set to a second preset value to disable the function call recording function of the target CPU core.

[0321] In a possible embodiment, for any one MRS register among the index register and the at least one address register, the third determining module 13 is specifically configured to:

[0322] Obtain a first system file of the target CPU core, where the first system file includes a method for reading and writing the multiple MSR registers in user mode;

[0323] According to the first system file and the identifier of the MSR register, the value of the MSR register is obtained.

[0324] In a possible embodiment, the third determining module 13 is specifically configured to:

[0325] Determine the kernel stack corresponding to the target thread;

[0326] The values ​​of a plurality of general registers of the target thread in the user state are obtained in the kernel stack.

[0327] In a possible embodiment, the third determining module 13 is specifically configured to:

[0328] Get the symbol table description file of the operating system kernel;

[0329] Determine an address calculation formula corresponding to the operating system kernel, where the address calculation formula is used to calculate the kernel stack address of the target thread;

[0330] According to the symbol table description file and the address calculation formula, values ​​of multiple general registers of the target thread in the user state are obtained in the kernel stack.

[0331] In a possible embodiment, the third determining module 13 is specifically configured to:

[0332] Calculate the target memory address according to the symbol table description file and the address calculation formula;

[0333] According to the target memory address, a target memory is determined in the kernel stack, and values ​​of a plurality of general registers of the target thread in the user state are stored in the target memory.

[0334] In a possible embodiment, the third determining module 13 is specifically configured to:

[0335] Determine the user stack corresponding to the target thread;

[0336] Determining a function address of a latest function according to values ​​of a plurality of general registers of the target thread in user mode;

[0337] Determining a starting position in the user stack according to a function address of the latest function;

[0338] Starting from the starting position, obtaining the return address of the multi-layer function in the user stack in order of stack addresses from low to high;

[0339] The calling information is determined according to the function address of the latest function and the return address of the multi-layer function.

[0340] The apparatus for determining thread call information provided by the embodiment of the present disclosure can execute the technical solution shown in the above method embodiment, and its implementation principle and beneficial effects are similar, which will not be described in detail here.

[0341] An exemplary embodiment of the present disclosure provides a schematic structural diagram of an electronic device, as shown in Figure 9 . The electronic device 20 may include a processor 21 and a memory 22. For example, the processor 21 and the memory 22 are interconnected via a bus 23.

[0342] The memory 22 stores computer-executable instructions;

[0343] The processor 21 executes the computer-executable instructions stored in the memory 22 , so that the processor 21 performs the method shown in the above method embodiment.

[0344] Accordingly, an embodiment of the present disclosure provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the method described in any of the above method embodiments.

[0345] Accordingly, an embodiment of the present disclosure may further provide a computer program product, including a computer program. When the computer program is executed by a processor, the method shown in any of the above method embodiments can be implemented.

[0346] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0347] The present invention is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0348] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0349] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0350] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0351] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0352] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0353] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0354] The foregoing is merely an embodiment of the present disclosure and is not intended to limit the present disclosure. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present disclosure are intended to be included within the scope of the claims of the present disclosure.

Claims

1. A method for determining thread call information, wherein: include: Determine the thread state of the target thread, wherein the thread state includes a kernel state and a user state; Determine a target processor CPU core corresponding to a target thread, wherein the target CPU core is used to execute the target thread; The calling information of the target thread is determined according to the thread state and the target CPU core, wherein the calling information includes function identifiers of the multi-layer functions called by the target thread and a calling sequence between the multi-layer functions.

2. The method according to claim 1, wherein: Determining the call information of the target thread according to the thread state and the target CPU core includes: If the thread state is the user state, obtaining values ​​of multiple MSR registers of specific models corresponding to the target CPU core, and determining the call information according to the values ​​of the multiple MSR registers; If the thread state is the kernel state, the values ​​of multiple general registers of the target thread in the user state are obtained, and the call information is determined according to the values ​​of the multiple general registers of the target thread in the user state.

3. The method according to claim 2, wherein: Obtain the values ​​of multiple MSR registers corresponding to the target CPU core, including: Determine an index register corresponding to the target CPU core, and determine at least one address register, wherein the index register and the address register are MSR registers respectively; Obtaining a value of the index register and a value of the at least one address register; Determining the values ​​of the plurality of MSR registers includes the value of the index register and the value of the at least one address register.

4. The method according to claim 3, wherein: Determining at least one address register, comprising: determining a target register location in the index register; According to the target register position, determining a first target register from a plurality of address registers corresponding to the target CPU core, wherein the first target register is an address register used by the target CPU core to record a function call relationship for the last time; Determine M second target registers from a plurality of address registers used by the target CPU core, wherein the values ​​in the second target registers are non-zero values; It is determined that the at least one address register includes the first target register and the M second target registers.

5. The method according to any one of claims 2 to 4, wherein: Determining the call information according to the values ​​of the multiple MSR registers includes: Determine a source address of the multi-layer function according to the value of the first target register and the values ​​of the M second target registers; Determine a function identifier of the multi-layer function according to the source address of the multi-layer function; Determining a calling order of the multi-layer function according to an arrangement order of the first target register and the M second target registers; The calling information includes the function identifier of the multi-layer function and the calling order of the multi-layer function.

6. The method according to any one of claims 3 to 5, wherein: Before obtaining the values ​​of multiple specific model MSR registers corresponding to the target CPU core, the method further includes: After the target thread is started, a function call recording function of the target CPU core is enabled; When the target CPU core executes the first-layer function call instruction, the source address of the first-layer function is stored in the address register with a register number of K, and the value in the index register is updated to K, where K is an integer greater than or equal to 0, and the address register with a register number of K is the first address register used by the target CPU core in the current function call recording process; When the target CPU core executes the i+1th layer function call instruction, the source address of the i+1th layer function is stored in the address register with register number K+1, and the value in the index register is updated to K+1; Here, the value of i is 1, 2, ... in sequence until the function call recording function of the target CPU core is turned off.

7. The method according to claim 6, wherein: Enable the function call recording function of the target CPU core, including: Setting the value in the flag register corresponding to the target CPU core to a first preset value to enable the function call recording function of the target CPU core, the flag register being an MSR register; Disabling the function call recording function of the target CPU core includes: The value in the flag MSR register is set to a second preset value to disable the function call recording function of the target CPU core.

8. The method according to any one of claims 2 to 7, wherein: for any one MRS register among the index register and the at least one address register; Get the value of the MSR register, including: Obtain a first system file of the target CPU core, wherein the first system file includes a method for reading and writing the multiple MSR registers in user mode; According to the first system file and the identifier of the MSR register, the value of the MSR register is obtained.

9. The method according to claim 2, wherein: Obtaining values ​​of multiple general registers of the target thread in user mode, including: Determine the kernel stack corresponding to the target thread; The values ​​of a plurality of general registers of the target thread in the user state are obtained in the kernel stack.

10. The method according to claim 9, wherein: Obtaining values ​​of a plurality of general registers of the target thread in the user state in the kernel stack includes: Get the symbol table description file of the operating system kernel; Determine an address calculation formula corresponding to the operating system kernel, where the address calculation formula is used to calculate the kernel stack address of the target thread; According to the symbol table description file and the address calculation formula, the values ​​of multiple general registers of the target thread in the user state are obtained in the kernel stack.

11. The method according to claim 10, wherein: According to the symbol table description file and the address calculation formula, obtaining values ​​of multiple general registers of the target thread in the user state in the kernel stack includes: Calculate the target memory address according to the symbol table description file and the address calculation formula; According to the target memory address, a target memory is determined in the kernel stack, and values ​​of a plurality of general registers of the target thread in user mode are stored in the target memory.

12. The method according to any one of claims 2, 9 to 11, wherein: Determining the call information according to the values ​​of a plurality of general registers of the target thread in the user state includes: Determine a user stack corresponding to the target thread; Determining a function address of a latest function according to values ​​of a plurality of general registers of the target thread in user mode; Determining a starting position in the user stack according to a function address of the latest function; From the starting position, in the order of stack addresses from low to high, obtaining the return address of the multi-layer function in the user stack; The calling information is determined according to the function address of the latest function and the return address of the multi-layer function.

13. An electronic device, wherein: include: at least one processor; as well as a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the electronic device to perform the method described in any one of claims 1 to 12.

14. A computer-readable storage medium, wherein: The computer-readable storage medium stores computer-executable instructions, and when the processor executes the computer-executable instructions, the method according to any one of claims 1 to 12 is implemented.

15. A computer program product comprising a computer program, wherein: When the computer program is executed by a processor, the method according to any one of claims 1 to 12 is implemented.

Images