如何为每个线程确定Linux内核任务的堆栈指针？

Question

I'm working on a tool that sometimes hijacks application execution, including working in a different stack.

I'm trying to get the kernel to always see the application stack when performing certain system calls, so that it will print the [stack] qualifier in the right place in /proc/pid/maps.

However, simply modifying the esp around the system call seems not to be enough. When I use my tool on "cat /proc/self/stat" I'm seeing kstkesp ( entry 29 here ) sometimes has the value I want but sometimes has a different value, corresponding to my alternate stack.

I'm trying to understand:

1. How is the value reflected in /proc/self/stat:29 determined?
2. Can I modify it so that it will reliably have an appropriate value?
3. If 2 is difficult to answer, where would you recommend that I look to understand why the value is intermittently incorrect?

Answer 1

Looks like it's defined eg in line 409 of http://lxr.free-electrons.com/source/fs/proc/array.c?v=3.16 to me.

There is lots of discussion about the related macro KSTK_ESP over the last few years for example: https://github.com/davet321/rpi-linux/commit/32effd19f64908551f8eff87e7975435edd16624

and

http://lists.openwall.net/linux-kernel/2015/01/04/140

From what I gather regarding the intermittent oddness it seems like an NMI or other interrupt hits inside the kernel sometimes and then it doesn't properly walk the stack in that case.