Linux下手动获取当前调用栈

被问到如何手动获取当前的调用栈，之前碰到过一时没记起来，现在回头整理一下。

其原理是：使用backtrace()从栈中获取当前调用各层函数调用的返回地址，backtrace_symbols()将对应地址翻译成对应的符号信息，这两个函数在execinfo.h中声明。详细用法见后面的example。这里强调几处需要注意的地方，在man里头也有说明

1，inline函数无返回地址，因此在结果中不显示

2，需要给linker指定对应的参数，才能保证有对应的符号名称信息，GNU工具链是指定-rdynamic

3，尾调优化会使当前栈帧被新的栈帧覆盖，因此查询的到的信息，会与代码里调用关系不能一一对应

4，static函数由于其符号信息未输出，因此不能获取到具体的名称

example代码，编译指令gcc backtrace.c -o backtrace -g -rdynamic

 #include <execinfo.h>
 #include <stdio.h>
 #include <stdlib.h>

 void bt(void)
 {
     #define MAX_DEPTH (20)
     void *buffer[MAX_DEPTH];
     int nptrs = backtrace(buffer, MAX_DEPTH);
     char **stack = backtrace_symbols(buffer, nptrs);
     int i;

     if (stack)
     {
         for (i = ; i < nptrs; ++i)
         {
             printf("%s\n", stack[i]);
         }

         free(stack);
     }

     return;
 }

 static void func2(void)
 {
     bt();
 }

 inline void func1(void)
 {
     func2();
 }

 void func(void)
 {
     func1();
 }

 int main(int argc, char *argv[])
 {
     func();

     return ;
 }

Linux arch 2.6.30-ARCH #1 SMP PREEMPT Fri Jul 31 18:10:38 UTC 2009 i686 Intel(R) Core(TM) i5-3317U CPU @ 1.70GHz GenuineIntel GNU/Linux

gcc4.4.1 环境之行结果如下

[root@arch code]# make backtrace
gcc backtrace.c -o backtrace -g -rdynamic
[root@arch code]# ./backtrace
./backtrace(bt+0x19) [0x80486ed]
./backtrace [0x804874b]
./backtrace(func1+0xb) [0x8048758]
./backtrace(func+0xb) [0x8048765]
./backtrace(main+0xb) [0x8048772]
/lib/libc.so.6(__libc_start_main+0xe6) [0xb7f8da36]
./backtrace [0x8048641]
[root@arch code]# addr2line -e ./backtrace 0x8048765
/root/code/backtrace.c:40
[root@arch code]# addr2line -e ./backtrace 0x8048758
/root/code/backtrace.c:35
[root@arch code]# addr2line -e ./backtrace 0x804874b
/root/code/backtrace.c:30
[root@arch code]# addr2line -e ./backtrace 0x80486ed
/root/code/backtrace.c:10
[root@arch code]#

从实际验证结果可以看出static函数的确没有解析出对应的符号名，但是inline函数仍然有自己的调用栈，这应该是gcc没有实际将其优化展开，仍然将其当作普通函数所致。

并且根据addre2line的结果，我们可以看出backtrace()调用获取到的其实是各个函数调用的返回地址，可以自己根据行号进行一一比对。这里就不多重复了。

不过在Raspbian环境（Linux raspberrypi 3.10.25+ #622 PREEMPT Fri Jan 3 18:41:00 GMT 2014 armv6l GNU/Linux gcc 4.6.3）里，编译执行均没有问题，但是无任何输出，gdb跟踪的结果是backtrace()调用返回0，很奇怪。stackoverflow上有人说是根据GCC ARM Options documentation需要加上-mapcs-frame参数，以让gcc在ARM平台上产生栈帧，可是编译时加上该参数仍然无效。strace跟踪其执行过程发现其执行过程没有任何backtrace字样，如下

pi@raspberrypi ~/code $ strace ./backtrace
execve("./backtrace", ["./backtrace"], [/* 16 vars */]) =
brk()                                  = 0x1082000
uname({sys="Linux", node="raspberrypi", ...}) =
access("/etc/ld.so.nohwcap", F_OK)      = - ENOENT (No such file or directory)
mmap2(NULL, , PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -, ) = 0xb6f0c000
access("/etc/ld.so.preload", R_OK)      =
open("/etc/ld.so.preload", O_RDONLY)    =
fstat64(, {st_mode=S_IFREG|, st_size=, ...}) =
mmap2(NULL, , PROT_READ|PROT_WRITE, MAP_PRIVATE, , ) = 0xb6f0b000
close()                                =
open("/usr/lib/arm-linux-gnueabihf/libcofi_rpi.so", O_RDONLY) =
read(, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\270\4\0\0004\0\0\0"..., ) =
lseek(, , SEEK_SET)                =
read(, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., ) =
lseek(, , SEEK_SET)                =
read(, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., ) =
fstat64(, {st_mode=S_IFREG|, st_size=, ...}) =
mmap2(NULL, , PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, , ) = 0xb6ee0000
mprotect(0xb6ee2000, , PROT_NONE)  =
mmap2(0xb6ee9000, , PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, , 0x1) = 0xb6ee9000
close()                                =
munmap(0xb6f0b000, )                  =
open("/etc/ld.so.cache", O_RDONLY)      =
fstat64(, {st_mode=S_IFREG|, st_size=, ...}) =
mmap2(NULL, , PROT_READ, MAP_PRIVATE, , ) = 0xb6ed5000
close()                                =
access("/etc/ld.so.nohwcap", F_OK)      = - ENOENT (No such file or directory)
open("/lib/arm-linux-gnueabihf/libc.so.6", O_RDONLY) =
read(, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\214y\1\0004\0\0\0"..., ) =
lseek(, , SEEK_SET)             =
read(, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., ) =
lseek(, , SEEK_SET)             =
read(, "A.\0\0\0aeabi\0\1$\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., ) =
fstat64(, {st_mode=S_IFREG|, st_size=, ...}) =
mmap2(NULL, , PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, , ) = 0xb6da6000
mprotect(0xb6ec8000, , PROT_NONE)  =
mmap2(0xb6ecf000, , PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, , 0x121) = 0xb6ecf000
mmap2(0xb6ed2000, , PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -, ) = 0xb6ed2000
close()                                =
mmap2(NULL, , PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -, ) = 0xb6f0b000
set_tls(0xb6f0b4c0, 0xb6f0bb98, 0xb6f10048, 0xb6f0b4c0, 0xb6f10048) =
mprotect(0xb6ecf000, , PROT_READ)   =
mprotect(0xb6f0f000, , PROT_READ)   =
munmap(0xb6ed5000, )               =
open("/etc/ld.so.cache", O_RDONLY)      =
fstat64(, {st_mode=S_IFREG|, st_size=, ...}) =
mmap2(NULL, , PROT_READ, MAP_PRIVATE, , ) = 0xb6ed5000
close()                                =
access("/etc/ld.so.nohwcap", F_OK)      = - ENOENT (No such file or directory)
open("/lib/arm-linux-gnueabihf/libgcc_s.so.1", O_RDONLY) =
read(, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0`\364\0\0004\0\0\0"..., ) =
lseek(, , SEEK_SET)              =
read(, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., ) =
lseek(, , SEEK_SET)              =
read(, "A2\0\0\0aeabi\0\1(\0\0\0\0056\0\6\6\10\1\t\1\n\2\22\4\24\1\25"..., ) =
brk()                                  = 0x1082000
brk(0x10a3000)                          = 0x10a3000
fstat64(, {st_mode=S_IFREG|, st_size=, ...}) =
mmap2(NULL, , PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, , ) = 0xb6d7e000
mprotect(0xb6d9e000, , PROT_NONE)  =
mmap2(0xb6da5000, , PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, , 0x1f) = 0xb6da5000
close()                                =
munmap(0xb6ed5000, )               =
exit_group()                           = ?
pi@raspberrypi ~/code $

对其原因待有待深究。

===== update 2019/5/5 ====

aarch64 linux 版本的 gcc有 -funwind-tables 编译参数，可以实现 backtrace()/backtrace_symbols 正常功能，需要新的 gcc 版本(>= gcc-4.5) 提供支持。原理是记录每个函数的 入栈指令(一般比APCS的入栈要少的多)到特殊的段.ARM.unwind_idx .ARM.unwind_tab。

详情见 http://www.alivepea.me/prog/how-backtrace-work/