Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Finding out where syscalls are called from: Stack traces with strace

abstractexpr.com

Post reply on HN
Print view View original

11–17 of 17 posts

Re: Finding out where syscalls are called from: Stack traces with strace

#11

Post by rcxdude »

spcharc wrote: post #6

It can be useful I think. Trying this on my toy project. This is a single thread program so it cannot do syscall from multiple cores. It is not very helpful without debug info: nanosleep({tv_sec=1, tv_nsec=299127292}, NULL) = 0 > /home/spcharc/proj/out() [0x80f1] write(1, "g1() ===== end =====\n", 21g1() ===== end ===== ) = 21 > /home/spcharc/proj/out() [0x80f1] munmap(0x7a267b491000, 66580) = 0 > /home/spcharc/proj/…

Does your main have an assert(false) after the main loop? If so the return address could be set to the assert function as some kind of optimization.

Re: Finding out where syscalls are called from: Stack traces with strace

#12

Post by amelius »

fjfaase wrote: post #5

strace is a rather powerfull tool if you want to find out what a certain executable is doing. Which files it is opening, reading and writing and also which other executables it is executing. I personally have not used the '--stack-trace' option yet. Earlier this year, I have used it to analyze what happens during the initial steps of live-bootstrap [1] and produce a web page with all the information [2]. For this, I…

What flags do you use when you just want to see the files that are being opened? I'm always grepping, but there must be an easier way.

Re: Finding out where syscalls are called from: Stack traces with strace

#13

Post by Amezarak »

amelius wrote: post #12
fjfaase wrote: post #5

strace is a rather powerfull tool if you want to find out what a certain executable is doing. Which files it is opening, reading and writing and also which other executables it is executing. I personally have not used the '--stack-trace' option yet. Earlier this year, I have used it to analyze what happens during the initial steps of live-bootstrap [1] and produce a web page with all the information [2]. For this, I…

What flags do you use when you just want to see the files that are being opened? I'm always grepping, but there must be an easier way.

strace -e trace=open -f -p pid

If you want to see all file-related calls, replace "open" with "file" or you could add the calls one by one: e.g., trace=open,read.

Re: Finding out where syscalls are called from: Stack traces with strace

#15

Post by codetrotter »

thundergolfer wrote: post #4
aheck wrote: post #2

One of the great strengths of strace as a debugging tool is that it shows you what a program is doing regardless of whether it was compiled with debug info or not. The downside of this is that you only see the program’s syscall. You can use this information to deduce what is happening in the program but you don’t see from where in the program those syscalls originate...

Why did you just quote the start of the article?

He's the person that submitted the post. I assume he added it for context.

Re: Finding out where syscalls are called from: Stack traces with strace

#16

Post by spcharc »

rcxdude wrote: post #11
spcharc wrote: post #6

It can be useful I think. Trying this on my toy project. This is a single thread program so it cannot do syscall from multiple cores. It is not very helpful without debug info: nanosleep({tv_sec=1, tv_nsec=299127292}, NULL) = 0 > /home/spcharc/proj/out() [0x80f1] write(1, "g1() ===== end =====\n", 21g1() ===== end ===== ) = 21 > /home/spcharc/proj/out() [0x80f1] munmap(0x7a267b491000, 66580) = 0 > /home/spcharc/proj/…

Does your main have an assert(false) after the main loop? If so the return address could be set to the assert function as some kind of optimization.

I do have a couple of asserts in my code, but that does not explain why every stack trace begins and ends with "assert()"

Actually I call syscalls from assembly, and my _start() is also an assembly function. That is why this happens I guess. strace somehow doesn't play well with code written in .s file?

Re: Finding out where syscalls are called from: Stack traces with strace

#17

Post by rcxdude »

spcharc wrote: post #16
rcxdude wrote: post #11

Earlier quoted context omitted.

Does your main have an assert(false) after the main loop? If so the return address could be set to the assert function as some kind of optimization.

I do have a couple of asserts in my code, but that does not explain why every stack trace begins and ends with "assert()" Actually I call syscalls from assembly, and my _start() is also an assembly function. That is why this happens I guess. strace somehow doesn't play well with code written in .s file?

The backtrace code probably won't, as it'll be depending on the C calling convention to generate it. It's also possible assert() is just the function at the start or end of your text section, so any address that falls outside the range in that direction gets attributed to it, including values the stack walker incorrectly thinks are addresses.
Post reply on HN