Lecture notes for CS 438, Operating Systems Concepts

Lecture Notes for CS 438, Operating Systems Concepts

25 November 2003, A Case Study in OS Overhead

Disaster Strikes

A student deleted a file accidently.
- He intended to delete the backup, so oops.
- The file was less than one day old.
  - Not covered by the nightly backups.
- This is on Linux, no undelete by default.
Maybe the version of rm used does allow for undelete.
- The one I use does.
- The man page didn't say.

System Calls to the Rescue

What to do? Was the student hosed?
Many operating systems can trace system calls.
- truss on Solaris; strace on Linux; ktrace on FreeBSD.
Run rm under strace and see what it does.
- Maybe it copied the file somewhere, rather than deleting it.
Maybe try some i-node surgery too, but
- I don't know how to do that.
- If I did, I wouldn't have permission to do it.
- It was probably too late for that anyway, specially on rockhopper.

A Simple `rm`

$ strace rm junk.cc
execve("/bin/rm", ["rm", "junk.cc"], [/* 51 vars */]) = 0
uname({sys="Linux", node="rockhopper", ...}) = 0
brk(0)                                  = 0x804f808
open("/etc/ld.so.preload", O_RDONLY)    = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY)      = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=94669, ...}) = 0
old_mmap(NULL, 94669, PROT_READ, MAP_PRIVATE, 3, 0) = 0x40016000
close(3)                                = 0
open("/lib/tls/libc.so.6", O_RDONLY)    = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\360W\1"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=1539996, ...}) = 0
old_mmap(0x42000000, 1267276, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) 
  = 0x42000000
old_mmap(0x42130000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 
  0x130000) = 0x42130000
old_mmap(0x42133000, 9804, PROT_READ|PROT_WRITE, 
  MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x42133000
close(3)                                = 0
old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
  = 0x4002e000
set_thread_area({entry_number:-1 -> 6, base_addr:0x4002e4e0, limit:1048575, 
  seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, 
  seg_not_present:0, useable:1}) = 0
munmap(0x40016000, 94669)               = 0
brk(0)                                  = 0x804f808
brk(0x8050808)                          = 0x8050808
brk(0)                                  = 0x8050808
brk(0x8051000)                          = 0x8051000
open("/usr/lib/locale/locale-archive", O_RDONLY|O_LARGEFILE) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=31215088, ...}) = 0
mmap2(NULL, 2097152, PROT_READ, MAP_PRIVATE, 3, 0) = 0x4002f000
mmap2(NULL, 204800, PROT_READ, MAP_PRIVATE, 3, 0xa26) = 0x4022f000
mmap2(NULL, 4096, PROT_READ, MAP_PRIVATE, 3, 0xa5a) = 0x40016000
close(3)                                = 0
ioctl(0, SNDCTL_TMR_TIMEBASE, {B38400 opost isig icanon echo ...}) = 0
brk(0)                                  = 0x8051000
brk(0x8052000)                          = 0x8052000
brk(0)                                  = 0x8052000
brk(0x8053000)                          = 0x8053000
brk(0)                                  = 0x8053000
brk(0x8054000)                          = 0x8054000

lstat64("junk.cc", {st_mode=S_IFREG|0600, st_size=0, ...}) = 0
access("junk.cc", W_OK)                 = 0
unlink("junk.cc")                       = 0
exit_group(0)                           = ?

The Actual `rm`

$strace rm junk.cc

[...]

lstat64("junk.cc", {mode, size, ...}) = 0
access("junk.cc", W_OK)               = 0
unlink("junk.cc")                     = 0
exit_group(0)                         = ?

$

lstat64(), return general file information.
access(), return user-specific file information.
unlink(), delete the file.
exit_group(), that's all, folks.
Yup, the student's hosed; the file is gone.
And that's an impressive amount of overhead for a simple command.

Executing The Command

execve("/bin/rm", ["rm", "junk.cc"], [/* 51 vars */]) = 0
uname({sys="Linux", node="rockhopper", ...}) = 0
brk(0)                                  = 0x804f808

open("/etc/ld.so.preload", O_RDONLY)    = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY)      = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=94669, ...}) = 0
old_mmap(NULL, 94669, PROT_READ, MAP_PRIVATE, 3, 0) = 0x40016000
close(3)                                = 0
open("/lib/tls/libc.so.6", O_RDONLY)    = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\360W\1"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=1539996, ...}) = 0
old_mmap(0x42000000, 1267276, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) 
  = 0x42000000
old_mmap(0x42130000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 
  0x130000) = 0x42130000
old_mmap(0x42133000, 9804, PROT_READ|PROT_WRITE, 
  MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x42133000
close(3)                                = 0
old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
  = 0x4002e000
set_thread_area({entry_number:-1 -> 6, base_addr:0x4002e4e0, limit:1048575, 
  seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, 
  seg_not_present:0, useable:1}) = 0
munmap(0x40016000, 94669)               = 0
brk(0)                                  = 0x804f808
brk(0x8050808)                          = 0x8050808
brk(0)                                  = 0x8050808
brk(0x8051000)                          = 0x8051000
open("/usr/lib/locale/locale-archive", O_RDONLY|O_LARGEFILE) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=31215088, ...}) = 0
mmap2(NULL, 2097152, PROT_READ, MAP_PRIVATE, 3, 0) = 0x4002f000
mmap2(NULL, 204800, PROT_READ, MAP_PRIVATE, 3, 0xa26) = 0x4022f000
mmap2(NULL, 4096, PROT_READ, MAP_PRIVATE, 3, 0xa5a) = 0x40016000
close(3)                                = 0
ioctl(0, SNDCTL_TMR_TIMEBASE, {B38400 opost isig icanon echo ...}) = 0
brk(0)                                  = 0x8051000
brk(0x8052000)                          = 0x8052000
brk(0)                                  = 0x8052000
brk(0x8053000)                          = 0x8053000
brk(0)                                  = 0x8053000
brk(0x8054000)                          = 0x8054000
lstat64("junk.cc", {st_mode=S_IFREG|0600, st_size=0, ...}) = 0
access("junk.cc", W_OK)                 = 0
unlink("junk.cc")                       = 0
exit_group(0)                           = ?

Executing System Commands

execve("/bin/rm", ["rm", "junk.cc"], []) = 0

uname(sys="Linux", node="rockhopper", ) = 0

brk(0) = 0x804f808

execve() runs the command.
uname() returns information about the system.
brk() returns the process-memory size.

Dynamic Loading

execve("/bin/rm", ["rm", "junk.cc"], [/* 51 vars */]) = 0
uname({sys="Linux", node="rockhopper", ...}) = 0
brk(0)                                  = 0x804f808

open("/etc/ld.so.preload", O_RDONLY)    = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY)      = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=94669, ...}) = 0
old_mmap(NULL, 94669, PROT_READ, MAP_PRIVATE, 3, 0) = 0x40016000
close(3)                                = 0
open("/lib/tls/libc.so.6", O_RDONLY)    = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\360W\1"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=1539996, ...}) = 0
old_mmap(0x42000000, 1267276, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) 
  = 0x42000000
old_mmap(0x42130000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 
  0x130000) = 0x42130000
old_mmap(0x42133000, 9804, PROT_READ|PROT_WRITE, 
  MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x42133000
close(3)                                = 0

old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
  = 0x4002e000
set_thread_area({entry_number:-1 -> 6, base_addr:0x4002e4e0, limit:1048575, 
  seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, 
  seg_not_present:0, useable:1}) = 0
munmap(0x40016000, 94669)               = 0
brk(0)                                  = 0x804f808
brk(0x8050808)                          = 0x8050808
brk(0)                                  = 0x8050808
brk(0x8051000)                          = 0x8051000

open("/usr/lib/locale/locale-archive", O_RDONLY|O_LARGEFILE) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=31215088, ...}) = 0
mmap2(NULL, 2097152, PROT_READ, MAP_PRIVATE, 3, 0) = 0x4002f000
mmap2(NULL, 204800, PROT_READ, MAP_PRIVATE, 3, 0xa26) = 0x4022f000
mmap2(NULL, 4096, PROT_READ, MAP_PRIVATE, 3, 0xa5a) = 0x40016000
close(3)                                = 0

ioctl(0, SNDCTL_TMR_TIMEBASE, {B38400 opost isig icanon echo ...}) = 0
brk(0)                                  = 0x8051000
brk(0x8052000)                          = 0x8052000
brk(0)                                  = 0x8052000
brk(0x8053000)                          = 0x8053000
brk(0)                                  = 0x8053000
brk(0x8054000)                          = 0x8054000
lstat64("junk.cc", {st_mode=S_IFREG|0600, st_size=0, ...}) = 0
access("junk.cc", W_OK)                 = 0
unlink("junk.cc")                       = 0
exit_group(0)                           = ?

Dynamic Loading System Calls

open("/lib/tls/libc.so.6", O_RDONLY) = 3
read(3, buffer, 512) = 512
fstat64(3, {mode, size, ...}) = 0
old_mmap(0x42000000, 1267276, 
         PROT_READ|PROT_EXEC, MAP_PRIVATE, 
         3, 0) = 0x42000000
old_mmap(0x42130000, 12288, 
         PROT_READ|PROT_WRITE, MAP_PRIVATE,
	  3, 0x130000) = 0x42130000
old_mmap(0x42133000, 9804, 
         PROT_READ|PROT_WRITE, MAP_PRIVATE, 
         -1, 0) = 0x42133000
close(3) = 0

mmap(addr, len, prot, flags, file, off)

Memory Management

execve("/bin/rm", ["rm", "junk.cc"], [/* 51 vars */]) = 0
uname({sys="Linux", node="rockhopper", ...}) = 0
brk(0)                                  = 0x804f808
open("/etc/ld.so.preload", O_RDONLY)    = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY)      = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=94669, ...}) = 0
old_mmap(NULL, 94669, PROT_READ, MAP_PRIVATE, 3, 0) = 0x40016000
close(3)                                = 0
open("/lib/tls/libc.so.6", O_RDONLY)    = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\360W\1"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=1539996, ...}) = 0
old_mmap(0x42000000, 1267276, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) 
  = 0x42000000
old_mmap(0x42130000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 
  0x130000) = 0x42130000
old_mmap(0x42133000, 9804, PROT_READ|PROT_WRITE, 
  MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x42133000
close(3)                                = 0
old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
  = 0x4002e000
set_thread_area({entry_number:-1 -> 6, base_addr:0x4002e4e0, limit:1048575, 
  seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, 
  seg_not_present:0, useable:1}) = 0
munmap(0x40016000, 94669)               = 0

brk(0)                                  = 0x804f808
brk(0x8050808)                          = 0x8050808
brk(0)                                  = 0x8050808
brk(0x8051000)                          = 0x8051000

open("/usr/lib/locale/locale-archive", O_RDONLY|O_LARGEFILE) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=31215088, ...}) = 0
mmap2(NULL, 2097152, PROT_READ, MAP_PRIVATE, 3, 0) = 0x4002f000
mmap2(NULL, 204800, PROT_READ, MAP_PRIVATE, 3, 0xa26) = 0x4022f000
mmap2(NULL, 4096, PROT_READ, MAP_PRIVATE, 3, 0xa5a) = 0x40016000
close(3)                                = 0
ioctl(0, SNDCTL_TMR_TIMEBASE, {B38400 opost isig icanon echo ...}) = 0

brk(0)                                  = 0x8051000
brk(0x8052000)                          = 0x8052000
brk(0)                                  = 0x8052000
brk(0x8053000)                          = 0x8053000
brk(0)                                  = 0x8053000
brk(0x8054000)                          = 0x8054000

lstat64("junk.cc", {st_mode=S_IFREG|0600, st_size=0, ...}) = 0
access("junk.cc", W_OK)                 = 0
unlink("junk.cc")                       = 0
exit_group(0)                           = ?

Memory Management System Calls

brk(0)                      = 0x8051000
brk(0x8052000)              = 0x8052000
brk(0)                      = 0x8052000
brk(0x8053000)              = 0x8053000
brk(0)                      = 0x8053000
brk(0x8054000)              = 0x8054000

brk(), increase process-space to the given amount.
- Returns the new maximum process-space address.

Points To Remember

There's a lot going on behind even simple commands.
- Probably too much.
Most operating systems let you trace system calls.
- Some will let you do even more than that.
Backup early, backup often.
- Render the rm * monster harmless.

This page last modified on 25 November 2003.