Kernel State Information Commands

Describes how to use the i command to get detailed information on the current process, thread, user process, user thread, and the state of the kernel.

The output shown below is a typical result of using the i command, and we use this to illustrate how information can be extracted about the:

SCHEDULER @64000348: CurrentThread 640396b0
RescheduleNeeded=00 DfcPending=00 KernCSLocked=00000001
DFCS: next 64000458 prev 64000458
ProcessHandler=f8014904, AddressSpace=64038d5c
SYSLOCK: HoldingThread 00000000 iWaiting 00000000
Extras 0: 64038d5c 1: 64038d5c 2: 64038d5c 3: 00000000
Extras 4: 00000000 5: 00000000 6: 00000000 7: 00000000
Extras 8: 00000000 9: 00000000 A: 00000000 B: 00000000
Extras C: 00000000 D: 00000000 E: 00000000 F: 00000000

TheCurrentThread=64039408
THREAD at 64039408 VPTR=f803423c AccessCount=3 Owner=64038d5c
Full name test2.exe::Main
Thread MState READY
Default priority 16 WaitLink Priority 16
ExitInfo 2,100,USER
Flags 00000004, Handles 640330bc
Supervisor stack base 6571f000 size 1000
User stack base 00402000 size 2000
Id=26, Alctr=00600000, Created alctr=00600000, Frame=00000000
Trap handler=00000000, ActiveScheduler=00000000, Exception handler=00000000
TempObj=00000000 TempAlloc=00000000 IpcCount=00000000
NThread @ 640396b0 Pri 16 NState READY
Next=640396b0 Prev=640396b0 Att=03 iUserContextType=0b
HeldFM=00000000 WaitFM=00000000 AddrSp=64038d5c
Time=17 Timeslice=20 ReqCount=0
SuspendCount=0 CsCount=1 CsFunction=fffffffe
SavedSP=6571ff34 ExtraContext=00000000 ExtraContextSize=0000
DACR 63990000
R13_USR 6571ff88 R14_USR f8025bc0 SPSR_SVC 10000004
 R4 f8033794  R5 64039408  R6 640396b0  R7 f8028518
 R8 640396b0  R9 640396b0 R10 00000000 R11 f80284d8
 PC 00000000

TheCurrentProcess=64038d5c
PROCESS at 64038d5c VPTR=f80342a4 AccessCount=6 Owner=00000000
Full name test2.exe
ExitInfo 3,0,
Flags a0000000, Handles 6403860c, Attributes 60010000
DataBssChunk 64039234, CodeSeg 6403919c
DllLock 64039044, Process Lock 64038eec SID 00000000
TempCodeSeg 00000000 CodeSeg 6403919c Capability 00000000 0003ffff
CodeSegs: Count=0
NumChunks=2
0: Chunk 64039234, run 00400000, access count 1
1: Chunk 6403613c, run 00600000, access count 1
Process shared IO buffers cookie 0000031d
Process has no shared IO buffers
Domain -1, DACR 55555507
TheCurrentAddressSpace=64038d5c
TheCurrentVMProcess=64038d5c
PROCESS at 64038d5c VPTR=f80342a4 AccessCount=6 Owner=00000000
Full name test2.exe
ExitInfo 3,0,
Flags a0000000, Handles 6403860c, Attributes 60010000
DataBssChunk 64039234, CodeSeg 6403919c
DllLock 64039044, Process Lock 64038eec SID 00000000
TempCodeSeg 00000000 CodeSeg 6403919c Capability 00000000 0003ffff
CodeSegs: Count=0
NumChunks=2
0: Chunk 64039234, run 00400000, access count 1
1: Chunk 6403613c, run 00600000, access count 1
Process shared IO buffers cookie 0000031d
Process has no shared IO buffers
Domain -1, DACR 55555507
TheCurrentDataSectionProcess=64038d5c
TheCompleteDataSectionProcess=64038d5c
PROCESS at 64038d5c VPTR=f80342a4 AccessCount=6 Owner=00000000
Full name test2.exe
ExitInfo 3,0,
Flags a0000000, Handles 6403860c, Attributes 60010000
DataBssChunk 64039234, CodeSeg 6403919c
DllLock 64039044, Process Lock 64038eec SID 00000000
TempCodeSeg 00000000 CodeSeg 6403919c Capability 00000000 0003ffff
CodeSegs: Count=0
NumChunks=2
0: Chunk 64039234, run 00400000, access count 1
1: Chunk 6403613c, run 00600000, access count 1
Process shared IO buffers cookie 0000031d
Process has no shared IO buffers
Domain -1, DACR 55555507

Scheduler state

The first three lines and the fifth line of the output show the state of the kernel scheduler. This information is mainly of interest to kernel engineers, although the state of the kernel and the system locks can be useful when debugging device driver crashes.

SCHEDULER @64000348: CurrentThread 640396b0
RescheduleNeeded=00 DfcPending=00 KernCSLocked=00000001
DFCS: next 64000458 prev 64000458
...
SYSLOCK: HoldingThread 00000000 iWaiting 00000000

The values are interpreted as follows:

SCHEDULER @

This is the address of the kernel’s scheduler instance; this is not very useful.

CurrentThread

The address of the kernel object for the current kernel thread.

RescheduleNeeded

This is set to non-zero by the kernel to force a reschedule, for example if a thread has been signalled

DfcPending

This is non-zero when there are DFCs queued.

KernCSLocked

This is incremented each time the kernel is locked by a call to NKern::Lock(), and decremented by calls to NKern::Unlock(). A value of zero means that the kernel is not locked.

DFCS:

The addresses of the next and the previous items on the DFC queue

HoldingThread

The address of the thread holding the system lock mutex. The system lock is set by call to NKern::LockSystem() and unset by call to NKern::UnlockSystem()

iWaiting

Non-zero, if any thread is waiting for the system lock mutex.

Current thread state

The current thread is the thread that was executing when the fault occurred. The 23 lines starting at line 10 of the output gives information relating to the current thread:

TheCurrentThread=64039408
THREAD at 64039408 VPTR=f803423c AccessCount=3 Owner=64038d5c
Full name test2.exe::Main
Thread MState READY
Default priority 16 WaitLink Priority 16
ExitInfo 2,100,USER
Flags 00000004, Handles 640330bc
Supervisor stack base 6571f000 size 1000
User stack base 00402000 size 2000
Id=26, Alctr=00600000, Created alctr=00600000, Frame=00000000
Trap handler=00000000, ActiveScheduler=00000000, Exception handler=00000000
TempObj=00000000 TempAlloc=00000000 IpcCount=00000000
NThread @ 640396b0 Pri 16 NState READY
Next=640396b0 Prev=640396b0 Att=03 iUserContextType=0b
HeldFM=00000000 WaitFM=00000000 AddrSp=64038d5c
Time=17 Timeslice=20 ReqCount=0
SuspendCount=0 CsCount=1 CsFunction=fffffffe
SavedSP=6571ff34 ExtraContext=00000000 ExtraContextSize=0000
DACR 63990000
R13_USR 6571ff88 R14_USR f8025bc0 SPSR_SVC 10000004
 R4 f8033794  R5 64039408  R6 640396b0  R7 f8028518
 R8 640396b0  R9 640396b0 R10 00000000 R11 f80284d8
 PC 00000000

Thread object and access count

THREAD at 64039408 VPTR=f803423c AccessCount=3 Owner=64038d5c

The THread at field contains a pointer to the DThread object representing the thread.

The AccessCount field contains the reference count on the thread object.

The owner field contains a pointer to the object that owns this DThread object.

The thread name

Full name test2.exe::Main

The thread name is the part after the colons. The part before the colons is the process name. This means that the thread is called Main inside the process test2.exe.

The thread state, exit information, priority

Thread MState READY
Default priority 16 WaitLink Priority 16
ExitInfo 2,100,USER

The information that characterises the thread exit is described by ExitInfo; this is shown as exit type, exit reason and exit category. In this example:

  • the thread has panicked, as indicated by: exit type 2; See also TExitType.

  • the panic category was: USER

  • the panic number was:100

  • the thread was running or it was in a ready-to-run state: MState READY

The priority shown is for the underlying thread, see also Process and thread priorities.

Thread flags

Flags 00000004, Handles 640330bc

The Flags field contains information about the state of the thread. The possible values in this field are defined by the KThread... constants in u32std.h. While the symbols are internal to Symbian platform, the following table summarises the values and their meaning.

Symbol

Value

Meaning

KThreadFlagProcessCritical

0x00000001

A thread panic causes the process to panic.

KThreadFlagProcessPermanent

0x00000002

If the thread exits for any reason, then this causes the process to exit.

KThreadFlagSystemCritical

0x00000004

If the thread panics, then this causes the entire system to reboot.

KThreadFlagSystemPermanent

0x00000008

If the thread exits for any reason, then this causes the entire system to reboot.

KThreadFlagOriginal

0x00000010

Reserved for future use.

KThreadFlagLastChance

0x00000020

Set if the thread is currently handling an exception.

Handles

Flags 00000004, Handles 640330bc

The Handles field contains the address of a DObjectIx object that contains the handles owned by the thread.

Kernel & user stack addresses

Supervisor stack base 6571f000 size 1000
User stack base 00402000 size 2000

These fields give the base address and size, in bytes, of the kernel and user stacks respectively.

Thread id, RAllocator instances, trap frame

Id=26, Alctr=00600000, Created alctr=00600000, Frame=00000000

The Id field contains the thread id.

The Alctr field contains a pointer to the current RAllocator instance used for heap allocation.

The Created alctr field contains a pointer to the original RAllocator instance used for heap allocation. This may be different from the current instance if User::SwitchAllocator() has been called.

The Frame field contains a pointer to the current trap frame, an instance of the TTrap class, on the cleanup stack.

Trap handler, active scheduler, user-side exception handler

Trap handler=00000000, ActiveScheduler=00000000, Exception handler=00000000

The Trap handler field contains a pointer to the current trap handler, an instance of TTrapHandler, for the cleanup stack.

The ActiveScheduler field contains a pointer to the current active scheduler.

The Exception handler field contains a pointer to the current user-side exception handler.

Temporary object, temporary allocation, IPC count

TempObj=00000000 TempAlloc=00000000 IpcCount=00000000

The Tempobj field contains a pointer to an instance of a DObject derived class that must be closed when the thread terminates.

The TempAlloc field contains a pointer to a kernel heap cell that must be freed when the thread terminates. Both this and Tempobj are used to avoid leaks if the thread terminates unexpectedly.

The IpcCount field contains the number of messages currently queued to this thread.

Underlying nanokernel thread

NThread @ 640396b0 Pri 16 NState READY
Next=640396b0 Prev=640396b0 Att=03 iUserContextType=0b

The NThread field contains a pointer to the underlying nanokernel thread object, an instance of the NThread class.

The Pri field contains the current priority of the underlying nanokernel thread.

The NState field shows the current state of the underlying nanokernel thread. Note that this state is often referred to as the N-state, as compared to the to M-state, the state of a Symbian platform thread. See the Thread state summary.

The Next field points to the next nanokernel thread object.

The Prev field points to the previous nanokernel thread object.

The Att field contains the nanokernel thread attributes, which is an 8-bit mask that controls how the thread is scheduled in certain cases. Two attributes are defined:

KThreadAttImplicitSystemLock

This attribute signifies that the thread may not be scheduled if another thread currently holds the system lock, unless the the former thread holds another fast mutex. This attribute is used in implementing address space switching in the moving memory model and also in implementing change of user context in order to allow exceptions to be raised on other threads.

KThreadAttAddressSpace

This attribute signifies that the thread may require a change of address space to schedule it. This attribute is used in conjunction with the thread’s iAddressSpace field; if this does not match the scheduler’s iAddressSpace field at the point where the thread is scheduled an address space switch will occur. Note that this is not required if the address space change is limited to the ARM domain permissions since these are saved and restored as part of the thread context.

Fast mutexes

HeldFM=00000000 WaitFM=00000000 AddrSp=64038d5c

The HeldFM field contains a pointer to the fast mutex held by this thread; this is NULL if no fast mutext was held.

The WaitFM field contains a pointer to the fast mutex that this thread was waiting on; this is NULL if this thread was not waiting on a fast mutex.

The AddrSp field is the address space identifier used by the scheduler to determine whether an address space change is required when scheduling in a new thread.

Timing, request semaphore count

Time=17 Timeslice=20 ReqCount=0

The Time field contains the number of nanokernel ticks, usually in milliseconds, to go before the thread is preempted.

The Timeslice field contains the maximum number of ticks for which the thread can run before being preempted.

The ReqCount contains the request semaphore counter. If the value is negative, then the thread is blocked waiting for a request to complete; if it is positive, then one or more requests have completed.

Suspend count, critical section counter, register values

SuspendCount=0 CsCount=1 CsFunction=fffffffe
SavedSP=6571ff34 ExtraContext=00000000 ExtraContextSize=0000
DACR 63990000
R13_USR 6571ff88 R14_USR f8025bc0 SPSR_SVC 10000004
 R4 f8033794  R5 64039408  R6 640396b0  R7 f8028518
 R8 640396b0  R9 640396b0 R10 00000000 R11 f80284d8
 PC 00000000

The SuspendCount field contains the number of times that the thread has been suspended.

The CsCount field critical section counter. When this value is greater than zero, then the thread is in a critical section and cannot be suspended or killed.

The remaining content is a list of register values. Note that they are not the register values when the thread panicked. They are the values in the registers the last time that this thread was pre-empted.

Current process state

The current process is the process in whose address space the current thread was executing when the fault occurred. The 15 lines starting at line 33 of the output gives information relating to the current process. This has some similarities with the current thread information:

TheCurrentProcess=64038d5c
PROCESS at 64038d5c VPTR=f80342a4 AccessCount=6 Owner=00000000
Full name test2.exe
ExitInfo 3,0,
Flags a0000000, Handles 6403860c, Attributes 60010000
DataBssChunk 64039234, CodeSeg 6403919c
DllLock 64039044, Process Lock 64038eec SID 00000000
TempCodeSeg 00000000 CodeSeg 6403919c Capability 00000000 0003ffff
CodeSegs: Count=0
NumChunks=2
0: Chunk 64039234, run 00400000, access count 1
1: Chunk 6403613c, run 00600000, access count 1
Process shared IO buffers cookie 0000031d
Process has no shared IO buffers
Domain -1, DACR 55555507

Process object and access count

PROCESS at 64038d5c VPTR=f80342a4 AccessCount=6 Owner=00000000

The Process at field contains a pointer to the DProcess object representing the process.

The AccessCount field contains the reference count on the process object.

The owner field contains a pointer to the object that owns this DProcess object.

The process name

Full name test2.exe

The Full name field gives the name of the process. In this example, the name of the process is test2.exe.

See the thread name.

Exit information

ExitInfo 3,0,

The ExitInfo field contains the information that characterises the process exit. In this example, the value is 3, meaning that this process has not exited. See also TExitType.

Process flags

Flags a0000000, Handles 6403860c, Attributes 60010000

The Flags field contains information about the state of the process. The possible values in this field are defined by the KProcess... constants in u32std.h. While the symbols are internal to Symbian platform, the following table summarises the values and their meaning.

Symbol

Value

Meaning

KProcessFlagSystemCritical

0x00000004

A process panic causes the entire system to reboot.

KProcessFlagSystemPermanent

0x00000008

If the process exits for any reason, then this causes the entire system to reboot.

KProcessFlagPriorityControl

0x40000000

If set, then other threads are allowed to change this thread’s priority.

KProcessFlagJustInTime

0x80000000

If set, then just-in-time debug is enabled for this thread.

Handles

Flags a0000000, Handles 6403860c, Attributes 60010000

The Handles field contains the address of a DObjectIx object that contains the handles owned by the process.

Attributes

Flags a0000000, Handles 6403860c, Attributes 60010000

The Attributes field contains the attributes of the process. Some are generic, as defined by DProcess::TProcessAttributes, but others depend on the memory model.

Information about memory

DataBssChunk 64039234, CodeSeg 6403919c

The DataBssChunk field contains a pointer to the DChunk object representing the chunk that contains the process data and .bss memory. Be aware that this is not the same as the heap - heaps are allocated to threads, and chunk information is found in the DThread object.

The CodeSeg field contains a pointer to the DCodeSeg object that represents the code segment.

Secure id

DllLock 64039044, Process Lock 64038eec SID 00000000

The SID field contains the secure id of the process.

Capability

TempCodeSeg 00000000 CodeSeg 6403919c Capability 00000000 0003ffff

The second four bytes of the Capability field contains the set of bits that define the capability for this process. This defines what the process can and cannot do.

Code segments

CodeSegs: Count=0

The CodeSegs: Count field contains the number of code segments that have been dynamically loaded into the process. This will be zero if the process is XIP.

Chunks owned by the process

NumChunks=2
0: Chunk 64039234, run 00400000, access count 1
1: Chunk 6403613c, run 00600000, access count 1

The NumChunks field contains the number of chunks owned by the process.

Successive lines contain information about each chunk:

  • the Chunk field contains the address of a kernel DChunk object.

  • the run field contains the virtual address at which the chunk resides when this is the current process.

  • the access count field contains the reference count of the object.

Shared IO buffer information

Process shared IO buffers cookie 0000031d
Process has no shared IO buffers

This is information about shared IO buffers. The cookie is only really of interest to base engineers.

Domain information

Domain -1, DACR 55555507

This is ARM MMU-specific protection information. Processes have domain -1 and DACR 0xFFFFFFFF.

Current data section process

In the moving memory model the current process could be a fixed process, in which case there is also a current moving process. The current data section process is the current moving process.

TheCurrentDataSectionProcess=64038d5c

This field contains a pointer to the DProcess object for the current moving process. This line is followed by detailed information about the process itself; the format is the same as that described for the Current process state.