The stack is often the key to a debug session. It is the stack, of course, that holds the current execution context of the process or thread – where it is now – which allows us to infer what it's doing. More importantly, being able to see and interpret the thread's call stack (or call chain/backtrace) crucially allows us to understand how exactly we got here. All this precious information resides in the stack. But wait, there are two stacks for every thread – the user space and the kernel space stack. How do we view them?
Here, we shall show two broad ways of viewing the kernel and user-mode stacks of a given process or thread, firstly via the 'traditional' approach, and then a more recent modern approach (via [e]BPF). Do read on.
