-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathNEWS
2546 lines (1966 loc) · 113 KB
/
NEWS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
* What's new in version 4.0
- Runtime/tapsets were ported to include up to kernel version PRERELEASE.
- When a systemtap module is loaded, the name of the original stap script
is now printed to dmesg by the kernel runtime.
- Embedded-C functions marked /* guru */ may now be invoked from other
tapset probes / functions, while still being invalid for normal call
from an unprivileged user script.
- The syscall tapset now includes an automatic fallback alias to the
sys_enter / sys_exit kernel tracepoints, if no other kprobe-based
mechanism is found.
- New script language operators @kderef/@uderef and @kregister/@uregister
were added.
@kderef/@uderef (size,address) can be used to dereference integers and
@kregister/@uregister (dwarf#) can be used to access register values.
- A systemd service file has been added for systemtap.service (which
runs a configurable set of scripts automatically on system
startup). The existing /etc/init.d/systemtap init script has been
moved to a new utility command 'systemtap-service' which preserves
functionality such as configuring onboot systemtap scripts via
dracut. See systemtap-service(8) for details.
- The eBPF backend's string support has been improved. Strings
can now be stored in variables, passed as function arguments,
and stored as array keys and values.
- The 3rd operand of the ternary operator '?:' in the script language
now binds tighter than the binary assignment operators like '=' and
'+=', just like the C language. The original operator precedence can
be restored by the '--compatible 3.3' option.
* What's new in version 3.3, 2018-06-08
- A new "stap --example FOO.stp" mode searches the example scripts
distributed with systemtap for a file named FOO.stp, so its whole
path does not need to be typed in.
- Systemtap's runtime has learned to deal with several of the
collateral damage from kernel hardening after meltdown/spectre,
including more pointer hiding and relocation. The kptr_restrict
procfs flag is forced on if running on a new enough kernel.
- The "stap --sysroot /PATH" option has received a revamp, so it
works much better against cross-compiled environments.
- The eBPF backend has learned to perform loops - at least in the
userspace "begin/end" probe contexts, so one can iterate across BPF
arrays for reporting. (The linux kernel eBPF interpreter precludes
loops and string processing.). It can also handle much larger probe
handler bodies, with a smarter register spiller/allocator.
- The eBPF backend now supports uprobes, perf counter, timer, and
tracepoint probes.
- An rpm macro %_systemtap_tapsetdir is now defined, to make it
easier for third party packages to add .stp files into the standard
tapset.
- Several low level locking-related fixes were added to the runtime
that used uprobes/tracepoint apis, in order to work more reliably on
rt kernels and on high-cpu-count machines.
- Runtime/tapsets were ported to include up to kernel version 4.16.
(The syscall tapsets are broken on kernel 4.17-rc, and will be fixed
in a next release coming soon; PR23160.)
* What's new in version 3.2, 2017-10-18
- SystemTap now includes an extended Berkeley Packet Filter (eBPF)
backend. This experimental backend does not use kernel modules
and instead produces eBPF programs that are verified by the kernel
and executed by an in-kernel virtual machine. Select this backend
with the new stap option '--runtime=bpf'. For example:
stap --runtime=bpf -e \
'probe kernel.function("sys_open") { printf("hi from stapbpf!\n") }'
Please see the stapbpf(8) man page for more information.
- The regular expression engine now supports extraction of the matched
string and subexpressions using the matched() tapset function:
if ("regexculpicator" =~ "reg(ex.*p).*r") log(matched(1))
-> exculp
- The translator produces better diagnostics for common/annoying case
of missing debuginfo that blocks use of context $variables.
- "stap -k" build trees in $TMPDIR now also include a preprocessed .i form
of the generated module .c code, for problem diagnostics purposes.
- Runtime/tapsets were ported to include up to kernel version PRERELEASE.
- The syscall.execve probes now provide a decoded env_str string vector,
just like the argument vector. Because of this, the unused
__count_envp() and __count_compat_evenp() functions have been
deprecated.
- The task_exe_file() Function has been deprecated and replaced by the
current_exe_file() function.
- A new probe alias input.char allows scripts to access input from stdin
during runtime.
* What's new in version 3.1, 2017-02-17
- Systemtap now needs C++11 to build.
- Syscall and nd_syscall tapsets have been merged in a way that either
dwarf-based, or non-dwarf probe gets automatically used based on
debuginfo availability (e.g. probe syscall.open).
To force use the dwarf based probe, a dw_syscall has been introduced
(e.g. probe dw_syscall.open) and the non-dwarf syscall probes were
left untouched (e.g. nd_syscall.open).
- The syscall tapset files have been reorganized in a way that original
big tapset files carrying many syscall probes were split into smaller
'sysc_' prefixed tapset files. This should reduce the syscall tapset
maintenance burden.
- The powerpc variant of syscall.compat_sysctl got deprecated on favor of
syscall.sysctl32. This aligns the syscall to its respective nd_syscall and
to ia64/s390/x86_64 variants too.
- The syscall.compat_pselect7a (this was actually a typo, but still available
for compatibility purposes with --compatible 1.3) has beed deprecated.
- The 'description_auddr' convenience variable of syscall.add_key has been
deprecated.
- Support has been added for probing python 2 and 3 functions using a
custom python helper module. Python function probes can target
function entry, returns, or specific line numbers.
probe python2.module("myscript").function("foo")
{ println($$parms) }
To run with the custom python helper module, you'd use python's '-m'
option like the following:
stap myscript.stp -c "python -m HelperSDT myscript.py"
- Java method probes now convert all types of java parameters to
strings using the java toString() method before passing them to
systemtap probes; new argN variables copy them into string
variables. Previously, only numeric types were passed, and only by
casting to integers. The previous behaviour is available with
--compatible=3.0 .
3.1: probe java(...).class(...).method(...) { printf("%s", arg1) }
3.0: probe java(...).class(...).method(...) { printf("%d", $arg1) }
- An older defensive measure to suppress kernel kprobes optimizations
since the 3.x era has been disabled for recent kernels. This improves
the performance of kernel function probes. In case of related problems,
please report and work around with:
# echo 0 > /proc/sys/debug/kprobes-optimization
- Context variables in .return probes should be accessed with @entry($var)
rather than $var, to make it clear that entry-time snapshots are being
used. The latter construct now generates a warning. Availability testing
with either @defined(@entry($var)) or @defined($var) works.
- Tapsets containing process probes may now be placed in the special
$prefix/share/systemtap/tapset/PATH/ directory to have their process parameter
prefixed with the location of the tapset. For example,
process("foo").function("NAME") expands to process("/usr/bin/foo").function("NAME")
when placed in $prefix/share/systemtap/tapset/PATH/usr/bin/
This is intended to help write more reusable tapsets for userspace binaries.
- The implementation of "var <<< X" for each aggregate variable is now
specially compiled to compute only the script-requested @op(var) values,
not all potential ones. This speeds up the <<< operations.
- Systemtap now warns if script arguments given on the command line are unused,
instead of mentioned by the script with $n/@n.
- Netfilter tapsets now provide variables data_hex and data_str to display packet
contents in hexadecimal and ASCII respectively.
- Translator now accepts new @const() operator for convenient expressing
constants in tapset code, or guru-mode scripts. See stap(1) for details.
- New -T option allows the script to be terminated after a specified number
of seconds. This is a shortcut for adding the probe, timer {exit()}.
- New installcheck-parallel testsuite feature allows running the tests in
parallel in order to save time. See testsuite/README for details.
- New tapset functions set_user_string(), set_user_string_n(), set_user_long()
set_user_int(), set_user_short(), set_user_char() and set_user_pointer() to
write a value of specified type directly to a user space address.
- New tapset functions user_buffer_quoted(), user_buffer_quoted_error(),
kernel_buffer_quoted(), and kernel_buffer_quoted_error() to print a
buffer of an exact length. These functions can handle '\0' characters
as well.
- New statistics @variance() operator using the Welford's online algorithm
for per-cpu computation, and the Total Variance formula authored by
Niranjan Kamat and Arnab Nandi from the Ohio State University for the
cross-cpu aggregation.
- New command within interactive mode, sample. Allows you to search through
all included example scripts to load for further editing or running. Sample
and example scripts have been moved to /usr/share/systemtap/examples. A
symlink in the former location under $docdir links to it.
* What's new in version 3.0, 2016-03-27
- The new experimental "interactive" mode, specified by "stap -i",
drops you into a command-line prompt where you can build up a script,
run it, edit it, run it again, etc. Type "help" for a list of commands.
- New experimental --monitor[=INTERVAL] option similar to unix "top". This
allows users to see statistics about the running module(uptime, module name,
invoker uid, memory sizes, global variables, and the current probe list
along with their statistics).
An interface is also provided to allow control over the running
module(resetting global variables, sorting the list of probes, deactivating
and reactivating probes).
- The performance of associative arrays have been dramatically
improved, especially for densely filled tables and for multiple
indexes. The hash tables behind these arrays is now sized as a
function of the array maximum size with an optional MAPHASHBIAS
space/time tradeoff knob.
- Add macros @prints to print a scalar aggregate variable, @prints[1-9]
to print an array aggregate (of given index-arity), formatted similarly
to the automatic printing of written-only global variables.
global a, b
probe oneshot { a <<< 1; b[tid()] <<< 2 }
probe end { @prints(a); @prints1(b) }
- Functions may now be overloaded during module runtime using the "next"
statement in script functions and STAP_NEXT macro for embedded-C functions.
They may also be overloaded by number of parameters during compile time.
For example,
Runtime overloading:
function f() { if (condition) next; print("first function") }
function f() %{ STAP_NEXT; print("second function") %}
function f() { print("third function") }
For the given functions above, a functioncall f(), will execute the body of the
third function if condition evaluates to true and print "third function".
Note that the second function is unconditionally nexted.
Parameter overloading:
function g() { print("first function") }
function g(x) { print("second function") }
g() -> "first function"
g(1) -> "second function"
Note that runtime overloading does not occur in the above example as the number
of parameters of the functions differ. The use of a next statement inside a function
while no more overloads remain will trigger a runtime exception. The function
candidates are selected at compile time and is determined by the number of arguments
provided for the functioncall.
- Add Czech version of manual pages.
- The stap compile server will log the stap client's options that are passed
to the server. The options that get logged on the server will include the
script name or the -e script, depending on which is used by the client.
- Embedded-C functions and blocks may now access script level global variables
using the STAP_GLOBAL_GET_* and STAP_GLOBAL_SET_* macros.
To read or write the script global var, the /* pragma:read:var */ or
/* pragma:write:var */ marker must be placed in the embedded-C function or block.
The written type must match the type inferred at script level.
Scalars:
STAP_GLOBAL_SET_var(STAP_GLOBAL_GET_var()+1) -> increments script global var by 1
STAP_GLOBAL_SET_var("hello")
Associative arrays:
STAP_GLOBAL_GET_var(index-1, ..., index-n)
STAP_GLOBAL_SET_var(index-1, ..., index-n, new value)
- Probe point brace expansion is now supported to improve brevity in
specifying probe points. For example,
process.{function("a"), function("b").{call,return}}
=> process.function("a"), process.function("b").call, process.function("b").return
process.{function("*").callees,plt}?
=> process.function("*").callees?, process.plt?
{kernel,module("nfs")}.function("nfs*")!
=> kernel.function("nfs*")!, module("nfs").function("nfs*")!
- Profiling timers at arbitrary frequencies are now provided and perf probes
now support a frequency field as an alternative to sampling counts.
probe timer.profile.freq.hz(N)
probe perf.type(N).config(M).hz(X)
The specified frequency is only accurate up to around 100hz. You may
need to provide a higher value to achieve the desired rate.
- Added support for private global variables and private functions. The scope
of these is limited to the tapset file they are defined in (PR19136).
- New tapset function string_quoted() to quote and \-escape general strings.
String $context variables that are pretty-printed are now processed with
such a quotation engine, falling back to a 0x%x (hex pointer) on errors.
- Functions get_mmap_args() and get_32mmap_args() got deprecated.
* What's new in version 2.9, 2015-10-08
- SystemTap now uses symbols from /proc/kallsyms when kernel debuginfo is not
available.
- New --prologue-searching[=WHEN] option has been added to stap with '-P' being
its short counterpart. Using --prologue-searching=never turns prologue
searching deliberately off working around issue of int_arg() returning wrong
value when a 32-bit userspace binary having debug info is being probed with
active prologue searching (PR18649).
- The powerpc variant of nd_syscall.compat_sysctl got deprecated on favor of
nd_syscall.sysctl32. This aligns the nd_syscall to its respective syscall and
to ia64/s390/x86_64 variants too.
- New tapset function assert(expression, msg) has been added.
- Embedded-C functions may now use the new STAP_PRINTF(fmt, ...)
macro for output.
- New tapset functions fullname_struct_path and fullname_struct_nameidata
resolve full path names from internal kernel struct pointers.
- New tapset functions arch_bytes() and uarch_bytes() to obtain address size
for kernel and user space respectively.
- New tapset function switch_file() allows control over rotation
of output files.
- The [nd_]syscall tapset got autodocumented. Related paragraph got added to PDF
and HTML tapset reference. Also a new tapset::syscall 3stap man page got added.
- Embedded-C functions with parameter arity-0 can now be marked with
the /* stable */ /* pure */ pragmas, if (roughly speaking) the
function is side-effect-free and idempotent. The translator may
execute these speculatively and have their results memoized. This
lets probes with multiple calls to such functions run faster.
Context variable ($foo) getter functions (in non-guru mode), and
numerous tapset functions are now marked as /* stable */ /* pure */.
Several example scripts have been modified to eschew explicit
memoization.
- Callee probe points now support '.return' and '.call' suffix.
For example,
process("proc").function("foo").callee("bar").return
will fire upon returning from bar when called by foo.
process("proc").function("foo").callee("bar").call
will only fire for non-inlined callees.
- The following tapset variables and functions are deprecated in
version 2.9:
- The '__int32_compat' library macro got deprecated in favor of
new '__compat_long' library macro.
- The 'uargs' convenience variable of the 'seccomp' syscall probe
got deprecated in favor of new 'uargs_uaddr' variable.
- SystemTap has reduced its memory consumption by using interned_strings (a
wrapper for boost::string_ref) in place of std::string instances. The change
is to reduce the number of duplicate strings created by replacing them with
interned_strings which act like pointers to existing strings.
For the implementation of interned_string, see stringtable.h
* What's new in version 2.8, 2015-06-17
- SystemTap has improved support for probing golang programs. Work has been
done to be able to handle DWARF information, reporting file names, line
numbers, and column numbers, and tolerance of odd characters in symbol names.
- The function::*, probe::* and new macro::* man pages cross-references the
enclosing tapset::* man page. For example:
function::pn(3stap) mentions tapset::pn(3stap) in the SEE ALSO section
- New stapref(1) man page provides a reference for the scripting language. The
stapref page contains an overview of the features available in the language,
such as keywords, data types, operators and more.
- The @task macro performs the very common @cast to a task_struct.
The embedded-C bodies of task_current() and pid2task() are now wrapped
by @task, which gives them a debuginfo type on the return value. With
autocast type propagation, this removes the need for any explicit @cast
in many places.
Other places which take untyped task pointers as parameters, for
instance, now use @task as well to simplify their code.
- New namespace-aware tapset functions [task_]ns_*() and ia new option
--target-namespaces=PID to denote a target set of namespaces corresponding to
the PID's namespaces. The namespace-aware tapsets will return values
relative to the target namespaces if specified, or the stap process' namespaces.
- Netfilter probes now attempt to decode Spanning Tree Protocol packets
into local variables: probe netfilter.bridge.*, br_* variables,
stp_dump.stp sample script.
- Colorization of error string tokens is made more robust, especially
in presence of $N/@N substitution.
- The following tapset variables and functions are deprecated in
version 2.8:
- The 'hostname_uaddr' variable in the syscall.setdomainname and
nd_syscall.setdomainname probe aliases have been deprecated in
favor of the new 'domainname_uaddr' variable.
- The 'fd' and 'fd_str' variables in the syscall.execveat and
nd_syscall.execveat probe aliases have been deprecated in favor of
the new 'dirfd' and 'dirfd_str' variables.
* What's new in version 2.7, 2015-02-18
- Some systemtap sample scripts are now identified with the "_best" keyword,
because they are generally useful or educational. They are now promoted
within the generated index files.
- Passing strings to and from functions has become faster due to optimization
(passing some strings by reference instead of by value/copy). It may
be disabled by using the unoptimize flag (-u).
To make embedded-C functions eligible for the same optimization, use the pragma
/* unmodified-fnargs */ to indicate that the function body will not modify
the function arguments. Remember to use MAXSTRINGLEN for string length,
rather than sizeof(string_arg) (which might now be a pointer).
- SystemTap now allows .function probes to be specified by their full function
name, file, and declaration line number. Use the .statement probe to probe a
specific line number.
- Tracepoint probes can now also be specified by the target subsystem. For
example, the following are all supported:
probe kernel.trace("sched:sched_switch") --> probe sched_switch found in the
sched subsystem
probe kernel.trace("sched:*") --> probe all tracepoints in sched subsystem
As a result, tapset functions such as pn() will now return a different string
than before. To retain the previous behaviour, use '--compatible=2.6'.
- The following functions are deprecated in release 2.7:
- _adjtx_mode_str(), _statfs_f_type_str(), _waitid_opt_str(),
_internal_wait_opt_str(), and _epoll_events_str().
- New tapset functions [u]symfileline(), [u]symfile() and [u]symline() will
return a string containing the specified portion of the filename:linenumber
match from a given address.
Using these functions may result in large generated modules from stored
address->file:line information.
* What's new in version 2.6, 2014-09-05
- SystemTap now supports on-the-fly arming/disarming of certain probe types:
kprobes, uprobes, and timer.*s(NUM) probes. For example, this probe
probe kernel.function("vfs_read") if (i > 4) { ... }
will automatically register/unregister the associated kprobe on vfs_read
whenever the value of the condition changes (as some probe handler
modifies 'i'). This allows us to avoid probe overhead when we're not
interested. If the arming capability is not relevant/useful, nest the
condition in the normal probe handler:
probe kernel.function("vfs_read") { if (i > 4) { ... } }
- statement("*@file:NNN").nearest probes now available to let systemtap
translate probe to nearest probe-able line to one given if necessary
- process("PATH").library("PATH").plt("NAME").return probes are now supported.
- SystemTap now supports SDT probes with operands that refer to symbols.
- While in listing mode (-l/-L), probes printed are now more consistent
and precise.
- Statement probes now support enumerated linenos to probe discontiguous
linenos using the form:
process.statement("[email protected]:3,5-7,9")
- Statement counting is now suppressed in the generated c code for probes that
are non-recursive and loop-free. Statement counting can be turned back on in
unoptimize mode (-u).
- SystemTap now asserts that the PID provided for a process probe corresponds
to a running process.
- DWARF process probes can be bound to a specific process using the form:
process(PID).function("*")
- SystemTap now accepts additional scripts through the new -E SCRIPT option.
There still needs to be a main script specified through -e or file in order
to provide an additional script. This makes it feasible to have scripts in
the $HOME/.systemtap/rc file. For example:
-E 'probe begin, end, error { log("systemtap script " . pn()) }'
-E 'probe timer.s(30) { error ("timeout") }
The -E SCRIPT option can also be used in listing mode (-l/-L), such that
probe points for the additional scripts will not listed, but other parts of
the script are still available, such as macros or aliases.
- SystemTap now supports array slicing within foreach loop conditions, delete
statements and membership tests. Wildcards are represented by "*". Examples
of the expressions are:
foreach ([a,b,c] in val[*,2,*])
delete val[*, 2, *]
[*, 2, *] in val
- Integer expressions which are derived from DWARF values, like context $vars,
@cast, and @var, will now carry that type information into subsequent reads.
Such expressions can now use "->" and "[]" operators, as can local variables
which were assigned such values.
foo = $param->foo; printf("x:%d y:%d\n", foo->x, foo->y)
printf("my value is %d\n", ($type == 42 ? $foo : $bar)->value)
printf("my parent pid is %d\n", task_parent(task_current())->tgid)
* What's new in version 2.5, 2014-04-30
- Systemtap now supports backtracing through its own, invoking module.
- Java probes now support backtracing using the print_java_backtrace()
and sprint_java_backtrace() functions.
- Statement probes (e.g. process.statement) are now faster to resolve,
more precise, and work better with inlined functions.
- New switches have been added to help inspect the contents of installed
library files:
stap --dump-functions --> list all library functions and their args
stap --dump-probe-aliases --> list all library probe aliases
- The heuristic algorithms used to search for function-prologue
endings were improved, to cover more optimization (or
lack-of-optimization, or incorrect-debuginfo) cases. These
heuristics are necessary to find $context parameters for some
function-call/entry probes. We recommend programs be built with
CFLAGS+=-grecord-gcc-switches to feed information to the heuristics.
- The stap --use-server option now more correctly supports address:port
type parametrization, for manual use in the absence of avahi.
- A new probe alias "oneshot" allows a single quick script fragment to run,
then exit.
- The argv tapset now merges translate-time and run-time positional
arguments, so all of these work:
stap -e 'probe oneshot {println(argv[1]," ",argv[2])}' hello world
stap -e 'probe oneshot {println(argv[1]," ",argv[2])}' \
-G argv_1=hello -G argv_2=world
staprun hello.ko argv_1=hello argv_2=world
- SystemTap now falls back on the symbol table for probing
functions in processes if the debuginfo is not available.
- SystemTap now supports a %( guru_mode == 0 /* or 1 */ %)
conditional for making dual-use scripts.
- SystemTap now supports UEFI/SecureBoot systems, via
machine-owner-keys maintained by a trusted stap-server on the
network. (Key enrollment requires a one-time reboot and BIOS
conversation.)
https://sourceware.org/systemtap/wiki/SecureBoot
- SystemTap now reports more accurate and succinct errors on type
mismatches.
- Embedded-C functions may use STAP_RETURN(value) instead of the
more wordy STAP_RETVALUE assignment followed by a "goto out".
The macro supports numeric or string values as appropriate.
STAP_ERROR(...) is available to return with a (catchable) error.
- Some struct-sockaddr fields are now individually decoded for
socket-related syscalls:
probe syscall.connect { println (uaddr_af, ":", uaddr_ip) }
- The documentation for the SystemTap initscript service and the
SystemTap compile-server service have been completely converted from
README files to man pages (see systemtap(8) and stap-server(8)).
- SystemTap is now capable of inserting modules early during the boot
process on dracut-based systems. See the 'onboot' command in
systemtap(8) for more information.
- DWARF probes can now use the '.callee[s]' variants, which allow more
precise function probing. For example, the probe point
process("myproc").function("foo").callee("bar")
will fire upon entering bar() from foo(). A '.callees' probe will
instead place probes on all callees of foo().
Note that this also means that probe point wildcards should be used
with more care. For example, use signal.*.return rather than
signal.*.*, which would also match '.callees'. See stapprobes(3stap)
for more info. This feature requires at least GCC 4.7.
- A few new functions in the task_time tapsets, as well as a new tapset
function task_ancestry(), which prints out the parentage of a process.
- The kprocess.exec probe has been updated to use syscall.execve, which
allows access to the new process' arguments (through the new 'argstr'
or 'args' variables) as well as giving better support across kernel
versions. Note also that the 'filename' variable now holds the
filename (quoted), or the address (unquoted) if it couldn't be
retrieved.
- The [s]println() function can now be called without any arguments to
simply print a newline.
- Suggestions are now provided when markers could not be resolved. For
example, process("stap").mark("benchmart") will suggest 'benchmark'.
- SystemTap colors can now be turned off by simply setting
SYSTEMTAP_COLORS to be empty, rather than having to make it invalid.
- There is a new context tapset function, pnlabel(), which returns the
name of the label which fired.
- The following tapset variables and functions are deprecated in
release 2.5:
- The 'clone_flags', 'stack_start', 'stack_size',
'parent_tid_uaddr', and 'child_tid_uaddr' variables in the
'syscall.fork' and 'nd_syscall.fork' probe aliases.
- The '_sendflags_str()' and '_recvflags_str()' functions have been
deprecated in favor of the new '_msg_flags_str()' function.
- The 'flags' and 'flags_str' variables in the 'syscall.accept' and
'nd_syscall.accept' probe alias.
- The 'first', 'second', and 'uptr_uaddr' variables in the
'syscall.compat_sys_shmctl', and 'nd_syscall.compat_sys_shmctl'
probe aliases have been deprecated in favor of the new 'shmid',
'cmd', and 'buf_uaddr' variables.
* What's new in version 2.4, 2013-11-06
- Better suggestions are given in many of the semantic errors in which
alternatives are provided. Additionally, suggestions are now provided
when plt and trace probes could not be resolved. For example,
kernel.trace("sched_siwtch") will suggest 'sched_switch'.
- SystemTap is now smarter about error reporting. Errors from the same
source are considered duplicates and suppressed. A message is
displayed on exit if any errors/warnings were suppressed.
- Statistics aggregate typed objects are now implemented locklessly,
if the translator finds that they are only ever read (using the
foreach / @count / etc. constructs) in a probe-begin/end/error.
- SystemTap now supports probing inside virtual machines using the
libvirt and unix schemes, e.g.
stap -ve 'probe timer.s(1) { printf("hello!\n") }' \
--remote=libvirt://MyVirtualMachine
Virtual machines managed by libvirt can be prepared using stapvirt.
See stapvirt(1) and the --remote option in stap(1) for more details.
- Systemtap now checks for and uses (when available) the .gnu_debugdata
section which contains a subset of debuginfo, useful for backtraces
and function probing
- SystemTap map variables are now allocated with vmalloc() instead of
with kmalloc(), which should cause memory to be less fragmented.
- Although SystemTap itself requires elfutils 0.148+, staprun only
requires elfutils 0.142+, which could be useful with the
'--disable-translator' configure switch.
- Under FIPS mode (/proc/sys/crypto/fips_enabled=1), staprun will
refuse to load systemtap modules (since these are not normally
signed with the kernel's build-time keys). This protection may
be suppressed with the $STAP_FIPS_OVERRIDE environment variable.
- The stap-server client & server code now enable all SSL/TLS
ciphers rather than just the "export" subset.
- For systems with in-kernel utrace, 'process.end' and 'thread.end'
probes will hit before the target's parent process is notified of
the target's death. This matches the behavior of newer kernels
without in-kernel utrace.
* What's new in version 2.3, 2013-07-25
- More context-accessing functions throw systemtap exceptions upon a
failure, whereas in previous versions they might return non-error
sentinel values like "" or "<unknown>". Use try { } / catch { }
around these, or new wrapper functions such as user_string_{n_}quoted()
that internally absorb exceptions.
- java("org.my.MyApp") probes are now restricted to pre-existing jvm pid's with
a listing in jps -l output to avoid recursive calls
- The tapset [nd_]syscall.semop parameter tsops_uaddr is renamed sops_uaddr for
consistency with [nd_]syscall.semtimedop.
- The udp.stp tapset adds some ip-address/port variables.
- A new guru-mode-only tapset function raise() is available to send signals
to the current task.
- Support for the standard Posix ERE named character classes has been
added to the regexp engine, e.g. [:digit:], [:alpha:], ...
- A substantial internal overhaul of the regexp engine has resulted in
correct behaviour on further obscure edge cases. The regexp engine
now implements the ERE standard and correctly passes the testsuite
for the glibc regexp engine (minus portions corresponding to
unimplemented features -- i.e. subexpression capture and reuse).
- Alternative functions are now suggested when function probes could not be
resolved. For example, kernel.function("vfs_reads") will suggest vfs_read.
Other probes for which suggestions are made are module.function,
process.function, and process.library.function.
- Has life been a bit bland lately? Want to spice things up? Why not write a
few faulty probes and feast your eyes upon the myriad of colours adorning
your terminal as SystemTap softly whispers in your ear... 'parse error'.
Search for '--color' in 'man stap' for more info.
- The following tapset functions are deprecated in release 2.3:
'stap_NFS_CLIENT', '__getfh_inode', '_success_check',
'_sock_prot_num', '_sock_fam_num', '_sock_state_num',
'_sock_type_num', and '_sock_flags_num'.
* What's new in version 2.2.1, 2013-05-16
* What's new in version 2.2, 2013-05-14
- Experimental support has been added for probing Java methods using
Byteman 2.0 as a backend. Java method probes can target method entries,
returns, or specific statements in the method as specified by line number.
probe java("org.my.MyApp").class("^java.lang.Object").method("foo(int)")
{ println($$parms) }
See java/README for information on how to set up Java/Byteman
functionality. Set env STAPBM_VERBOSE=yes for more tracing.
- The stap -l output and pn() tapset function's return value may be slightly
different for complicated web of wildcarded/aliased probes.
- The dyninst backend has improved in several aspects:
- Setting custom values for global variables is now supported, both
with -G when compiling a script, and from the stapdyn command line
when loading a precompiled module.
- A high-performance shared-memory-based transport is used for
trace data.
- A systemd service file and tmpfile have been added to allow
systemtap-server to be managed natively by systemd.
- Due to the removal of register_timer_hook in recent kernels, the
behaviour of timer.profile has been changed slightly. This probe is
now an alias which uses the old mechanism where possible, but falls
back to perf.sw.cpu_clock or another mechanism when the kernel timer
hook is not available.
To require the kernel timer hook mechanism in your script, use
timer.profile.tick instead of timer.profile.
- The following tapset variables are deprecated in release 2.2:
- The 'origin' variables in the 'generic.fop.llseek',
'generic.fop.llseek.return', and 'nfs.fop.llseek' probes. The
'origin' variable has been replaced by the 'whence' variable.
- The 'page_index' variable in the 'vfs.block_sync_page' and
'vfs.buffer_migrate_page' probe aliases.
- The 'write_from' and 'write_upto' variables in the
'_vfs.block_prepare_write' and '_vfs.block_prepare_write.return'
probe aliases.
- The 'regs' variable in the 'syscall.sigaltstack',
'nd_syscall.sigaltstack', 'syscall.fork', and 'nd_syscall.fork'
probe aliases.
- The 'first', 'second', 'third', and 'uptr_uaddr' variables in the
'syscall.compat_sys_shmat' and 'nd_syscall.compat_sys_shmat' probe
aliases.
- The following tapset functions are deprecated in release 2.2:
'ppos_pos', '_dev_minor', and '_dev_major'
- The folowing tapset functions used to return error strings instead
of raising an error. The original behavior is deprecated in release
2.2.
'ctime', 'probemod', 'modname'
* What's new in version 2.1, 2013-02-13
- EMACS and VIM editor modes for systemtap source files are included / updated.
- The translator now eliminates duplicate tapset files between its
preferred directory (as configured during the build with --prefix=/
or specified with the -I /path option), and files it may find under
$XDG_DATA_DIRS. This should eliminate a class of conflicts between
parallel system- and hand-built systemtap installations.
- The translator accepts a --suppress-time-limits option, which defeats
time-related constraints, to allows probe handlers to run for indefinite
periods. It requires the guru mode (-g) flag to work. Add the earlier
--suppress-handler-errors flag for a gung-ho "just-keep-going" attitude.
- Perf event probes may now be read on demand. The counter probe is
defined using the counter-name part:
probe perf.type(0).config(0).counter("NAME"). The counter is
read in a user space probe using @perf("NAME"), e.g.
process("PROCESS").statement("func@file") {stat <<< @perf("NAME")}
- Perf event probes may now be bound to a specific task using the
process-name part: probe perf.type(0).config(0).process("NAME") { }
If the probed process name is not specified, then it is inferred
from the -c CMD argument.
- Some error messages and warnings now refer to additional information
that is found in man pages. These are generally named
error::FOO or warning::BAR (in the 7stap man page section)
and may be read via
% man error::FOO
% man warning::BAR
- The dyninst backend has improved in several aspects:
- The runtime now allows much more concurrency when probing multithreaded
processes, and will also follow probes across forks.
- Several new probe types are now supported, including timers, function
return, and process.begin/end and process.thread.begin/end.
- Semaphores for SDT probes are now set properly.
- Attaching to existing processes with -x PID now works.
- The foreach looping construct can now sort aggregate arrays by the user's
choice of aggregating function. Previously, @count was implied. e.g.:
foreach ([x,y] in array @sum +) { println(@sum(array[x,y])) }
- Proof of concept support for regular expression matching has been added:
if ("aqqqqqb" =~ "q*b") { ... }
if ("abc" !~ "q*b") { ... }
The eventual aim is to support roughly the same functionality as
the POSIX Extended Regular Expressions implemented by glibc.
Currently missing features include extraction of the matched string
and subexpressions, and named character classes ([:alpha:], [:digit:], &c).
Special thanks go to the re2c project, whose public domain code this
functionality has been based on. For more info on re2c, see:
http://sourceforge.net/projects/re2c/
- The folowing tapset variables are deprecated in release 2.1 and will
be removed in release 2.2:
- The 'send2queue' variable in the 'signal.send' probe.
- The 'oldset_addr' and 'regs' variables in the 'signal.handle' probe.
- The following tapset probes are deprecated in release 2.1 and will
be removed in release 2.2:
- signal.send.return
- signal.handle.return
* What's new in version 2.0, 2012-10-09
- Systemtap includes a new prototype backend, which uses Dyninst to instrument
a user's own processes at runtime. This backend does not use kernel modules,
and does not require root privileges, but is restricted with respect to the
kinds of probes and other constructs that a script may use.
Users from source should configure --with-dyninst and install a
fresh dyninst snapshot such as that in Fedora rawhide. It may be
necessary to disable conflicting selinux checks; systemtap will advise.
Select this new backend with the new stap option --runtime=dyninst
and a -c target process, along with normal options. (-x target
processes are not supported in this prototype version.) For example:
stap --runtime=dyninst -c 'stap -l begin' \
-e 'probe process.function("main") { println("hi from dyninst!") }'
- To aid diagnosis, when a kernel panic occurs systemtap now uses
the panic_notifier_list facility to dump a summary of its trace
buffers to the serial console.
- The systemtap preprocessor now has a simple macro facility as follows:
@define add(a,b) %( ((@a)+(@b)) %)
@define probegin(x) %(
probe begin {
@x
}
%)
@probegin( foo = @add(40, 2); print(foo) )
Macros defined in the user script and regular tapset .stp files are
local to the file. To get around this, the tapset library can define
globally visible 'library macros' inside .stpm files. (A .stpm file
must contain a series of @define directives and nothing else.)
The status of the feature is experimental; semantics of macroexpansion
may change (unlikely) or expand in the future.
- Systemtap probe aliases may be used with additional suffixes
attached. The suffixes are passed on to the underlying probe
point(s) as shown below:
probe foo = bar, baz { }
probe foo.subfoo.option("gronk") { }
// expands to: bar.subfoo.option("gronk"), baz.subfoo.option("gronk")
In practical terms, this allows us to specify additional options to
certain tapset probe aliases, by writing e.g.
probe syscall.open.return.maxactive(5) { ... }
- To support the possibility of separate kernel and dyninst backends,
the tapsets have been reorganized into separate folders according to
backend. Thus kernel-specific tapsets are located under linux/, the
dyninst-specific ones under dyninst/
- The backtrace/unwind tapsets have been expanded to allow random
access to individual elements of the backtrace. (A caching mechanism
ensures that the backtrace computation run at most once for each
time a probe fires, regardless of how many times or what order the
query functions are called in.) New tapset functions are:
stack/ustack - return n'th element of backtrace
callers/ucallers - return first n elements of backtrace
print_syms/print_usyms - print full information on a list of symbols
sprint_syms/sprint_usyms - as above, but return info as a string
The following existing functions have been superseded by print_syms()
et al.; new scripts are recommended to avoid using them:
print_stack()
print_ustack()
sprint_stack()
sprint_ustack()
- The probefunc() tapset function is now myproc-unprivileged, and can
now be used in unprivileged scripts for such things as profiling in
userspace programs. For instance, try running
systemtap.examples/general/para-callgraph.stp in unprivileged mode
with a stapusr-permitted probe. The previous implementation of
probefunc() is available with "stap --compatible=1.8".
- Preprocessor conditional to vary code based on script privilege level:
unprivileged -- %( systemtap_privilege == "stapusr" %? ... %)
privileged -- %( systemtap_privilege != "stapusr" %? ... %)
or, alternately %( systemtap_privilege == "stapsys"
|| systemtap_privilege == "stapdev" %? ... %)
- To ease migration to the embedded-C locals syntax introduced in 1.8
(namely, STAP_ARG_* and STAP_RETVALUE), the old syntax can now be
re-enabled on a per-function basis using the /* unmangled */ pragma:
function add_foo:long(a:long, b:long) %{ /* unmangled */
THIS->__retvalue = THIS->a + STAP_ARG_b;
%}
Note that both the old and the new syntax may be used in an
/* unmangled */ function. Functions not marked /* unmangled */
can only use the new syntax.
- Adjacent string literals are now glued together irrespective of
intervening whitespace or comments:
"foo " "bar" --> "foo bar"
"foo " /* comment */ "bar" --> "foo bar"
Previously, the first pair of literals would be glued correctly,
while the second would cause a syntax error.
* What's new in version 1.8, 2012-06-17
- staprun accepts a -T timeout option to allow less frequent wake-ups
to poll for low-throughput output from scripts.
- When invoked by systemtap, the kbuild $PATH environment is sanitized
(prefixed with /usr/bin:/bin:) in an attempt to exclude compilers