]> sourceware.org Git - systemtap.git/blob - NEWS
PR18876: modify existing tapset and testcases to use assert()
[systemtap.git] / NEWS
1 * What's new in version 2.9
2
3 - New tapset function assert(expression, msg) has been added.
4
5 - Embedded-C functions may now use the new STAP_PRINTF(fmt, ...)
6 macro for output.
7
8 - New tapset functions fullname_struct_path and fullname_struct_nameidata
9 resolve full path names from internal kernel struct pointers.
10
11 - New tapset functions arch_bytes() and uarch_bytes() to obtain address size
12 for kernel and user space respectively.
13
14 - New tapset function switch_file() allows control over rotation
15 of output files.
16
17 - The [nd_]syscall tapset got autodocumented. Related paragraph got added to PDF
18 and HTML tapset reference. Also a new tapset::syscall 3stap man page got added.
19
20 - Embedded-C functions with parameter arity-0 can now be marked with
21 the /* stable */ /* pure */ pragmas, if (roughly speaking) the
22 function is side-effect-free and idempotent. The translator may
23 execute these speculatively and have their results memoized. This
24 lets probes with multiple calls to such functions run faster.
25
26 Context variable ($foo) getter functions (in non-guru mode), and
27 numerous tapset functions are now marked as /* stable */ /* pure */.
28 Several example scripts have been modified to eschew explicit
29 memoization.
30
31 - Callee probe points now support '.return' and '.call' suffix.
32 For example,
33
34 process("proc").function("foo").callee("bar").return
35
36 will fire upon returning from bar when called by foo.
37
38 process("proc").function("foo").callee("bar").call
39
40 will only fire for non-inlined callees.
41
42 - The following tapset variables and functions are deprecated in
43 version 2.9:
44 - The '__int32_compat' library macro got deprecated in favor of
45 new '__compat_long' library macro.
46 - The 'uargs' convenience variable of the 'seccomp' syscall probe
47 got deprecated in favor of new 'uargs_uaddr' variable.
48
49 - SystemTap has reduced its memory consumption by using interned_strings (a
50 wrapper for boost::string_ref) in place of std::string instances. The change
51 is to reduce the number of duplicate strings created by replacing them with
52 interned_strings which act like pointers to existing strings.
53
54 For the implementation of interned_string, see stringtable.h
55
56 * What's new in version 2.8, 2015-06-17
57
58 - SystemTap has improved support for probing golang programs. Work has been
59 done to be able to handle DWARF information, reporting file names, line
60 numbers, and column numbers, and tolerance of odd characters in symbol names.
61
62 - The function::*, probe::* and new macro::* man pages cross-references the
63 enclosing tapset::* man page. For example:
64
65 function::pn(3stap) mentions tapset::pn(3stap) in the SEE ALSO section
66
67 - New stapref(1) man page provides a reference for the scripting language. The
68 stapref page contains an overview of the features available in the language,
69 such as keywords, data types, operators and more.
70
71 - The @task macro performs the very common @cast to a task_struct.
72
73 The embedded-C bodies of task_current() and pid2task() are now wrapped
74 by @task, which gives them a debuginfo type on the return value. With
75 autocast type propagation, this removes the need for any explicit @cast
76 in many places.
77
78 Other places which take untyped task pointers as parameters, for
79 instance, now use @task as well to simplify their code.
80
81 - New namespace-aware tapset functions [task_]ns_*() and ia new option
82 --target-namespaces=PID to denote a target set of namespaces corresponding to
83 the PID's namespaces. The namespace-aware tapsets will return values
84 relative to the target namespaces if specified, or the stap process' namespaces.
85
86 - Netfilter probes now attempt to decode Spanning Tree Protocol packets
87 into local variables: probe netfilter.bridge.*, br_* variables,
88 stp_dump.stp sample script.
89
90 - Colorization of error string tokens is made more robust, especially
91 in presence of $N/@N substitution.
92
93 - The following tapset variables and functions are deprecated in
94 version 2.8:
95 - The 'hostname_uaddr' variable in the syscall.setdomainname and
96 nd_syscall.setdomainname probe aliases have been deprecated in
97 favor of the new 'domainname_uaddr' variable.
98 - The 'fd' and 'fd_str' variables in the syscall.execveat and
99 nd_syscall.execveat probe aliases have been deprecated in favor of
100 the new 'dirfd' and 'dirfd_str' variables.
101
102 * What's new in version 2.7, 2015-02-18
103
104 - Some systemtap sample scripts are now identified with the "_best" keyword,
105 because they are generally useful or educational. They are now promoted
106 within the generated index files.
107
108 - Passing strings to and from functions has become faster due to optimization
109 (passing some strings by reference instead of by value/copy). It may
110 be disabled by using the unoptimize flag (-u).
111
112 To make embedded-C functions eligible for the same optimization, use the pragma
113 /* unmodified-fnargs */ to indicate that the function body will not modify
114 the function arguments. Remember to use MAXSTRINGLEN for string length,
115 rather than sizeof(string_arg) (which might now be a pointer).
116
117 - SystemTap now allows .function probes to be specified by their full function
118 name, file, and declaration line number. Use the .statement probe to probe a
119 specific line number.
120
121 - Tracepoint probes can now also be specified by the target subsystem. For
122 example, the following are all supported:
123
124 probe kernel.trace("sched:sched_switch") --> probe sched_switch found in the
125 sched subsystem
126 probe kernel.trace("sched:*") --> probe all tracepoints in sched subsystem
127
128 As a result, tapset functions such as pn() will now return a different string
129 than before. To retain the previous behaviour, use '--compatible=2.6'.
130
131 - The following functions are deprecated in release 2.7:
132 - _adjtx_mode_str(), _statfs_f_type_str(), _waitid_opt_str(),
133 _internal_wait_opt_str(), and _epoll_events_str().
134
135 - New tapset functions [u]symfileline(), [u]symfile() and [u]symline() will
136 return a string containing the specified portion of the filename:linenumber
137 match from a given address.
138
139 Using these functions may result in large generated modules from stored
140 address->file:line information.
141
142 * What's new in version 2.6, 2014-09-05
143
144 - SystemTap now supports on-the-fly arming/disarming of certain probe types:
145 kprobes, uprobes, and timer.*s(NUM) probes. For example, this probe
146
147 probe kernel.function("vfs_read") if (i > 4) { ... }
148
149 will automatically register/unregister the associated kprobe on vfs_read
150 whenever the value of the condition changes (as some probe handler
151 modifies 'i'). This allows us to avoid probe overhead when we're not
152 interested. If the arming capability is not relevant/useful, nest the
153 condition in the normal probe handler:
154
155 probe kernel.function("vfs_read") { if (i > 4) { ... } }
156
157 - statement("*@file:NNN").nearest probes now available to let systemtap
158 translate probe to nearest probe-able line to one given if necessary
159
160 - process("PATH").library("PATH").plt("NAME").return probes are now supported.
161
162 - SystemTap now supports SDT probes with operands that refer to symbols.
163
164 - While in listing mode (-l/-L), probes printed are now more consistent
165 and precise.
166
167 - Statement probes now support enumerated linenos to probe discontiguous
168 linenos using the form:
169
170 process.statement("foo@file.c:3,5-7,9")
171
172 - Statement counting is now suppressed in the generated c code for probes that
173 are non-recursive and loop-free. Statement counting can be turned back on in
174 unoptimize mode (-u).
175
176 - SystemTap now asserts that the PID provided for a process probe corresponds
177 to a running process.
178
179 - DWARF process probes can be bound to a specific process using the form:
180
181 process(PID).function("*")
182
183 - SystemTap now accepts additional scripts through the new -E SCRIPT option.
184 There still needs to be a main script specified through -e or file in order
185 to provide an additional script. This makes it feasible to have scripts in
186 the $HOME/.systemtap/rc file. For example:
187
188 -E 'probe begin, end, error { log("systemtap script " . pn()) }'
189 -E 'probe timer.s(30) { error ("timeout") }
190
191 The -E SCRIPT option can also be used in listing mode (-l/-L), such that
192 probe points for the additional scripts will not listed, but other parts of
193 the script are still available, such as macros or aliases.
194
195 - SystemTap now supports array slicing within foreach loop conditions, delete
196 statements and membership tests. Wildcards are represented by "*". Examples
197 of the expressions are:
198
199 foreach ([a,b,c] in val[*,2,*])
200 delete val[*, 2, *]
201 [*, 2, *] in val
202
203 - Integer expressions which are derived from DWARF values, like context $vars,
204 @cast, and @var, will now carry that type information into subsequent reads.
205 Such expressions can now use "->" and "[]" operators, as can local variables
206 which were assigned such values.
207
208 foo = $param->foo; printf("x:%d y:%d\n", foo->x, foo->y)
209 printf("my value is %d\n", ($type == 42 ? $foo : $bar)->value)
210 printf("my parent pid is %d\n", task_parent(task_current())->tgid)
211
212 * What's new in version 2.5, 2014-04-30
213
214 - Systemtap now supports backtracing through its own, invoking module.
215
216 - Java probes now support backtracing using the print_java_backtrace()
217 and sprint_java_backtrace() functions.
218
219 - Statement probes (e.g. process.statement) are now faster to resolve,
220 more precise, and work better with inlined functions.
221
222 - New switches have been added to help inspect the contents of installed
223 library files:
224
225 stap --dump-functions --> list all library functions and their args
226 stap --dump-probe-aliases --> list all library probe aliases
227
228 - The heuristic algorithms used to search for function-prologue
229 endings were improved, to cover more optimization (or
230 lack-of-optimization, or incorrect-debuginfo) cases. These
231 heuristics are necessary to find $context parameters for some
232 function-call/entry probes. We recommend programs be built with
233 CFLAGS+=-grecord-gcc-switches to feed information to the heuristics.
234
235 - The stap --use-server option now more correctly supports address:port
236 type parametrization, for manual use in the absence of avahi.
237
238 - A new probe alias "oneshot" allows a single quick script fragment to run,
239 then exit.
240
241 - The argv tapset now merges translate-time and run-time positional
242 arguments, so all of these work:
243
244 stap -e 'probe oneshot {println(argv[1]," ",argv[2])}' hello world
245
246 stap -e 'probe oneshot {println(argv[1]," ",argv[2])}' \
247 -G argv_1=hello -G argv_2=world
248
249 staprun hello.ko argv_1=hello argv_2=world
250
251 - SystemTap now falls back on the symbol table for probing
252 functions in processes if the debuginfo is not available.
253
254 - SystemTap now supports a %( guru_mode == 0 /* or 1 */ %)
255 conditional for making dual-use scripts.
256
257 - SystemTap now supports UEFI/SecureBoot systems, via
258 machine-owner-keys maintained by a trusted stap-server on the
259 network. (Key enrollment requires a one-time reboot and BIOS
260 conversation.)
261 https://sourceware.org/systemtap/wiki/SecureBoot
262
263 - SystemTap now reports more accurate and succinct errors on type
264 mismatches.
265
266 - Embedded-C functions may use STAP_RETURN(value) instead of the
267 more wordy STAP_RETVALUE assignment followed by a "goto out".
268 The macro supports numeric or string values as appropriate.
269 STAP_ERROR(...) is available to return with a (catchable) error.
270
271 - Some struct-sockaddr fields are now individually decoded for
272 socket-related syscalls:
273 probe syscall.connect { println (uaddr_af, ":", uaddr_ip) }
274
275 - The documentation for the SystemTap initscript service and the
276 SystemTap compile-server service have been completely converted from
277 README files to man pages (see systemtap(8) and stap-server(8)).
278
279 - SystemTap is now capable of inserting modules early during the boot
280 process on dracut-based systems. See the 'onboot' command in
281 systemtap(8) for more information.
282
283 - DWARF probes can now use the '.callee[s]' variants, which allow more
284 precise function probing. For example, the probe point
285
286 process("myproc").function("foo").callee("bar")
287
288 will fire upon entering bar() from foo(). A '.callees' probe will
289 instead place probes on all callees of foo().
290 Note that this also means that probe point wildcards should be used
291 with more care. For example, use signal.*.return rather than
292 signal.*.*, which would also match '.callees'. See stapprobes(3stap)
293 for more info. This feature requires at least GCC 4.7.
294
295 - A few new functions in the task_time tapsets, as well as a new tapset
296 function task_ancestry(), which prints out the parentage of a process.
297
298 - The kprocess.exec probe has been updated to use syscall.execve, which
299 allows access to the new process' arguments (through the new 'argstr'
300 or 'args' variables) as well as giving better support across kernel
301 versions. Note also that the 'filename' variable now holds the
302 filename (quoted), or the address (unquoted) if it couldn't be
303 retrieved.
304
305 - The [s]println() function can now be called without any arguments to
306 simply print a newline.
307
308 - Suggestions are now provided when markers could not be resolved. For
309 example, process("stap").mark("benchmart") will suggest 'benchmark'.
310
311 - SystemTap colors can now be turned off by simply setting
312 SYSTEMTAP_COLORS to be empty, rather than having to make it invalid.
313
314 - There is a new context tapset function, pnlabel(), which returns the
315 name of the label which fired.
316
317 - The following tapset variables and functions are deprecated in
318 release 2.5:
319 - The 'clone_flags', 'stack_start', 'stack_size',
320 'parent_tid_uaddr', and 'child_tid_uaddr' variables in the
321 'syscall.fork' and 'nd_syscall.fork' probe aliases.
322 - The '_sendflags_str()' and '_recvflags_str()' functions have been
323 deprecated in favor of the new '_msg_flags_str()' function.
324 - The 'flags' and 'flags_str' variables in the 'syscall.accept' and
325 'nd_syscall.accept' probe alias.
326 - The 'first', 'second', and 'uptr_uaddr' variables in the
327 'syscall.compat_sys_shmctl', and 'nd_syscall.compat_sys_shmctl'
328 probe aliases have been deprecated in favor of the new 'shmid',
329 'cmd', and 'buf_uaddr' variables.
330
331 * What's new in version 2.4, 2013-11-06
332
333 - Better suggestions are given in many of the semantic errors in which
334 alternatives are provided. Additionally, suggestions are now provided
335 when plt and trace probes could not be resolved. For example,
336 kernel.trace("sched_siwtch") will suggest 'sched_switch'.
337
338 - SystemTap is now smarter about error reporting. Errors from the same
339 source are considered duplicates and suppressed. A message is
340 displayed on exit if any errors/warnings were suppressed.
341
342 - Statistics aggregate typed objects are now implemented locklessly,
343 if the translator finds that they are only ever read (using the
344 foreach / @count / etc. constructs) in a probe-begin/end/error.
345
346 - SystemTap now supports probing inside virtual machines using the
347 libvirt and unix schemes, e.g.
348
349 stap -ve 'probe timer.s(1) { printf("hello!\n") }' \
350 --remote=libvirt://MyVirtualMachine
351
352 Virtual machines managed by libvirt can be prepared using stapvirt.
353 See stapvirt(1) and the --remote option in stap(1) for more details.
354
355 - Systemtap now checks for and uses (when available) the .gnu_debugdata
356 section which contains a subset of debuginfo, useful for backtraces
357 and function probing
358
359 - SystemTap map variables are now allocated with vmalloc() instead of
360 with kmalloc(), which should cause memory to be less fragmented.
361
362 - Although SystemTap itself requires elfutils 0.148+, staprun only
363 requires elfutils 0.142+, which could be useful with the
364 '--disable-translator' configure switch.
365
366 - Under FIPS mode (/proc/sys/crypto/fips_enabled=1), staprun will
367 refuse to load systemtap modules (since these are not normally
368 signed with the kernel's build-time keys). This protection may
369 be suppressed with the $STAP_FIPS_OVERRIDE environment variable.
370
371 - The stap-server client & server code now enable all SSL/TLS
372 ciphers rather than just the "export" subset.
373
374 - For systems with in-kernel utrace, 'process.end' and 'thread.end'
375 probes will hit before the target's parent process is notified of
376 the target's death. This matches the behavior of newer kernels
377 without in-kernel utrace.
378
379 * What's new in version 2.3, 2013-07-25
380
381 - More context-accessing functions throw systemtap exceptions upon a
382 failure, whereas in previous versions they might return non-error
383 sentinel values like "" or "<unknown>". Use try { } / catch { }
384 around these, or new wrapper functions such as user_string_{n_}quoted()
385 that internally absorb exceptions.
386
387 - java("org.my.MyApp") probes are now restricted to pre-existing jvm pid's with
388 a listing in jps -l output to avoid recursive calls
389
390 - The tapset [nd_]syscall.semop parameter tsops_uaddr is renamed sops_uaddr for
391 consistency with [nd_]syscall.semtimedop.
392
393 - The udp.stp tapset adds some ip-address/port variables.
394
395 - A new guru-mode-only tapset function raise() is available to send signals
396 to the current task.
397
398 - Support for the standard Posix ERE named character classes has been
399 added to the regexp engine, e.g. [:digit:], [:alpha:], ...
400
401 - A substantial internal overhaul of the regexp engine has resulted in
402 correct behaviour on further obscure edge cases. The regexp engine
403 now implements the ERE standard and correctly passes the testsuite
404 for the glibc regexp engine (minus portions corresponding to
405 unimplemented features -- i.e. subexpression capture and reuse).
406
407 - Alternative functions are now suggested when function probes could not be
408 resolved. For example, kernel.function("vfs_reads") will suggest vfs_read.
409 Other probes for which suggestions are made are module.function,
410 process.function, and process.library.function.
411
412 - Has life been a bit bland lately? Want to spice things up? Why not write a
413 few faulty probes and feast your eyes upon the myriad of colours adorning
414 your terminal as SystemTap softly whispers in your ear... 'parse error'.
415 Search for '--color' in 'man stap' for more info.
416
417 - The following tapset functions are deprecated in release 2.3:
418 'stap_NFS_CLIENT', '__getfh_inode', '_success_check',
419 '_sock_prot_num', '_sock_fam_num', '_sock_state_num',
420 '_sock_type_num', and '_sock_flags_num'.
421
422 * What's new in version 2.2.1, 2013-05-16
423 * What's new in version 2.2, 2013-05-14
424
425 - Experimental support has been added for probing Java methods using
426 Byteman 2.0 as a backend. Java method probes can target method entries,
427 returns, or specific statements in the method as specified by line number.
428
429 probe java("org.my.MyApp").class("^java.lang.Object").method("foo(int)")
430 { println($$parms) }
431
432 See java/README for information on how to set up Java/Byteman
433 functionality. Set env STAPBM_VERBOSE=yes for more tracing.
434
435 - The stap -l output and pn() tapset function's return value may be slightly
436 different for complicated web of wildcarded/aliased probes.
437
438 - The dyninst backend has improved in several aspects:
439
440 - Setting custom values for global variables is now supported, both
441 with -G when compiling a script, and from the stapdyn command line
442 when loading a precompiled module.
443
444 - A high-performance shared-memory-based transport is used for
445 trace data.
446
447 - A systemd service file and tmpfile have been added to allow
448 systemtap-server to be managed natively by systemd.
449
450 - Due to the removal of register_timer_hook in recent kernels, the
451 behaviour of timer.profile has been changed slightly. This probe is
452 now an alias which uses the old mechanism where possible, but falls
453 back to perf.sw.cpu_clock or another mechanism when the kernel timer
454 hook is not available.
455
456 To require the kernel timer hook mechanism in your script, use
457 timer.profile.tick instead of timer.profile.
458
459 - The following tapset variables are deprecated in release 2.2:
460 - The 'origin' variables in the 'generic.fop.llseek',
461 'generic.fop.llseek.return', and 'nfs.fop.llseek' probes. The
462 'origin' variable has been replaced by the 'whence' variable.
463 - The 'page_index' variable in the 'vfs.block_sync_page' and
464 'vfs.buffer_migrate_page' probe aliases.
465 - The 'write_from' and 'write_upto' variables in the
466 '_vfs.block_prepare_write' and '_vfs.block_prepare_write.return'
467 probe aliases.
468 - The 'regs' variable in the 'syscall.sigaltstack',
469 'nd_syscall.sigaltstack', 'syscall.fork', and 'nd_syscall.fork'
470 probe aliases.
471 - The 'first', 'second', 'third', and 'uptr_uaddr' variables in the
472 'syscall.compat_sys_shmat' and 'nd_syscall.compat_sys_shmat' probe
473 aliases.
474
475 - The following tapset functions are deprecated in release 2.2:
476 'ppos_pos', '_dev_minor', and '_dev_major'
477
478 - The folowing tapset functions used to return error strings instead
479 of raising an error. The original behavior is deprecated in release
480 2.2.
481
482 'ctime', 'probemod', 'modname'
483
484 * What's new in version 2.1, 2013-02-13
485
486 - EMACS and VIM editor modes for systemtap source files are included / updated.
487
488 - The translator now eliminates duplicate tapset files between its
489 preferred directory (as configured during the build with --prefix=/
490 or specified with the -I /path option), and files it may find under
491 $XDG_DATA_DIRS. This should eliminate a class of conflicts between
492 parallel system- and hand-built systemtap installations.
493
494 - The translator accepts a --suppress-time-limits option, which defeats
495 time-related constraints, to allows probe handlers to run for indefinite
496 periods. It requires the guru mode (-g) flag to work. Add the earlier
497 --suppress-handler-errors flag for a gung-ho "just-keep-going" attitude.
498
499 - Perf event probes may now be read on demand. The counter probe is
500 defined using the counter-name part:
501 probe perf.type(0).config(0).counter("NAME"). The counter is
502 read in a user space probe using @perf("NAME"), e.g.
503 process("PROCESS").statement("func@file") {stat <<< @perf("NAME")}
504
505 - Perf event probes may now be bound to a specific task using the
506 process-name part: probe perf.type(0).config(0).process("NAME") { }
507 If the probed process name is not specified, then it is inferred
508 from the -c CMD argument.
509
510 - Some error messages and warnings now refer to additional information
511 that is found in man pages. These are generally named
512 error::FOO or warning::BAR (in the 7stap man page section)
513 and may be read via
514 % man error::FOO
515 % man warning::BAR
516
517 - The dyninst backend has improved in several aspects:
518 - The runtime now allows much more concurrency when probing multithreaded
519 processes, and will also follow probes across forks.
520 - Several new probe types are now supported, including timers, function
521 return, and process.begin/end and process.thread.begin/end.
522 - Semaphores for SDT probes are now set properly.
523 - Attaching to existing processes with -x PID now works.
524
525 - The foreach looping construct can now sort aggregate arrays by the user's
526 choice of aggregating function. Previously, @count was implied. e.g.:
527 foreach ([x,y] in array @sum +) { println(@sum(array[x,y])) }
528
529 - Proof of concept support for regular expression matching has been added:
530 if ("aqqqqqb" =~ "q*b") { ... }
531 if ("abc" !~ "q*b") { ... }
532
533 The eventual aim is to support roughly the same functionality as
534 the POSIX Extended Regular Expressions implemented by glibc.
535 Currently missing features include extraction of the matched string
536 and subexpressions, and named character classes ([:alpha:], [:digit:], &c).
537
538 Special thanks go to the re2c project, whose public domain code this
539 functionality has been based on. For more info on re2c, see:
540 http://sourceforge.net/projects/re2c/
541
542 - The folowing tapset variables are deprecated in release 2.1 and will
543 be removed in release 2.2:
544 - The 'send2queue' variable in the 'signal.send' probe.
545 - The 'oldset_addr' and 'regs' variables in the 'signal.handle' probe.
546
547 - The following tapset probes are deprecated in release 2.1 and will
548 be removed in release 2.2:
549 - signal.send.return
550 - signal.handle.return
551
552 * What's new in version 2.0, 2012-10-09
553
554 - Systemtap includes a new prototype backend, which uses Dyninst to instrument
555 a user's own processes at runtime. This backend does not use kernel modules,
556 and does not require root privileges, but is restricted with respect to the
557 kinds of probes and other constructs that a script may use.
558
559 Users from source should configure --with-dyninst and install a
560 fresh dyninst snapshot such as that in Fedora rawhide. It may be
561 necessary to disable conflicting selinux checks; systemtap will advise.
562
563 Select this new backend with the new stap option --runtime=dyninst
564 and a -c target process, along with normal options. (-x target
565 processes are not supported in this prototype version.) For example:
566
567 stap --runtime=dyninst -c 'stap -l begin' \
568 -e 'probe process.function("main") { println("hi from dyninst!") }'
569
570 - To aid diagnosis, when a kernel panic occurs systemtap now uses
571 the panic_notifier_list facility to dump a summary of its trace
572 buffers to the serial console.
573
574 - The systemtap preprocessor now has a simple macro facility as follows:
575
576 @define add(a,b) %( ((@a)+(@b)) %)
577 @define probegin(x) %(
578 probe begin {
579 @x
580 }
581 %)
582
583 @probegin( foo = @add(40, 2); print(foo) )
584
585 Macros defined in the user script and regular tapset .stp files are
586 local to the file. To get around this, the tapset library can define
587 globally visible 'library macros' inside .stpm files. (A .stpm file
588 must contain a series of @define directives and nothing else.)
589
590 The status of the feature is experimental; semantics of macroexpansion
591 may change (unlikely) or expand in the future.
592
593 - Systemtap probe aliases may be used with additional suffixes
594 attached. The suffixes are passed on to the underlying probe
595 point(s) as shown below:
596
597 probe foo = bar, baz { }
598 probe foo.subfoo.option("gronk") { }
599 // expands to: bar.subfoo.option("gronk"), baz.subfoo.option("gronk")
600
601 In practical terms, this allows us to specify additional options to
602 certain tapset probe aliases, by writing e.g.
603 probe syscall.open.return.maxactive(5) { ... }
604
605 - To support the possibility of separate kernel and dyninst backends,
606 the tapsets have been reorganized into separate folders according to
607 backend. Thus kernel-specific tapsets are located under linux/, the
608 dyninst-specific ones under dyninst/
609
610 - The backtrace/unwind tapsets have been expanded to allow random
611 access to individual elements of the backtrace. (A caching mechanism
612 ensures that the backtrace computation run at most once for each
613 time a probe fires, regardless of how many times or what order the
614 query functions are called in.) New tapset functions are:
615 stack/ustack - return n'th element of backtrace
616 callers/ucallers - return first n elements of backtrace
617 print_syms/print_usyms - print full information on a list of symbols
618 sprint_syms/sprint_usyms - as above, but return info as a string
619
620 The following existing functions have been superseded by print_syms()
621 et al.; new scripts are recommended to avoid using them:
622 print_stack()
623 print_ustack()
624 sprint_stack()
625 sprint_ustack()
626
627 - The probefunc() tapset function is now myproc-unprivileged, and can
628 now be used in unprivileged scripts for such things as profiling in
629 userspace programs. For instance, try running
630 systemtap.examples/general/para-callgraph.stp in unprivileged mode
631 with a stapusr-permitted probe. The previous implementation of
632 probefunc() is available with "stap --compatible=1.8".
633
634 - Preprocessor conditional to vary code based on script privilege level:
635 unprivileged -- %( systemtap_privilege == "stapusr" %? ... %)
636 privileged -- %( systemtap_privilege != "stapusr" %? ... %)
637 or, alternately %( systemtap_privilege == "stapsys"
638 || systemtap_privilege == "stapdev" %? ... %)
639
640 - To ease migration to the embedded-C locals syntax introduced in 1.8
641 (namely, STAP_ARG_* and STAP_RETVALUE), the old syntax can now be
642 re-enabled on a per-function basis using the /* unmangled */ pragma:
643
644 function add_foo:long(a:long, b:long) %{ /* unmangled */
645 THIS->__retvalue = THIS->a + STAP_ARG_b;
646 %}
647
648 Note that both the old and the new syntax may be used in an
649 /* unmangled */ function. Functions not marked /* unmangled */
650 can only use the new syntax.
651
652 - Adjacent string literals are now glued together irrespective of
653 intervening whitespace or comments:
654 "foo " "bar" --> "foo bar"
655 "foo " /* comment */ "bar" --> "foo bar"
656 Previously, the first pair of literals would be glued correctly,
657 while the second would cause a syntax error.
658
659 * What's new in version 1.8, 2012-06-17
660
661 - staprun accepts a -T timeout option to allow less frequent wake-ups
662 to poll for low-throughput output from scripts.
663
664 - When invoked by systemtap, the kbuild $PATH environment is sanitized
665 (prefixed with /usr/bin:/bin:) in an attempt to exclude compilers
666 other than the one the kernel was presumed built with.
667
668 - Printf formats can now use "%#c" to escape non-printing characters.
669
670 - Pretty-printed bitfields use integers and chars use escaped formatting
671 for printing.
672
673 - The systemtap compile-server and client now support IPv6 networks.
674 - IPv6 addresses may now be specified on the --use-server option and will
675 be displayed by --list-servers, if the avahi-daemon service is running and
676 has IPv6 enabled.
677 - Automatic server selection will automatically choose IPv4 or IPv6 servers
678 according to the normal server selection criteria when avahi-daemon is
679 running. One is not preferred over the other.
680 - The compile-server will automatically listen on IPv6 addresses, if
681 available.
682 - To enable IPv6 in avahi-daemon, ensure that /etc/avahi/avahi-daemon.conf
683 contains an active "use-ipv6=yes" line. After adding this line run
684 "service avahi-daemon restart" to activate IPv6 support.
685 - See man stap(1) for details on how to use IPv6 addresses with the
686 --use-server option.
687
688 - Support for DWARF4 .debug_types sections (for executables and shared
689 libraries compiled with recent GCC's -gdwarf-4 / -fdebug-types-section).
690 PR12997. SystemTap now requires elfutils 0.148+, full .debug_types support
691 depends on elfutils 0.154+.
692
693 - Systemtap modules are somewhat smaller & faster to compile. Their
694 debuginfo is now suppressed by default; use -B CONFIG_DEBUG_INFO=y to
695 re-enable.
696
697 - @var now an alternative language syntax for accessing DWARF variables
698 in uprobe and kprobe handlers (process, kernel, module). @var("somevar")
699 can be used where $somevar can be used. The @var syntax also makes it
700 possible to access non-local, global compile unit (CU) variables by
701 specifying the CU source file as follows @var("somevar@some/src/file.c").
702 This will provide the target variable value of global "somevar" as defined
703 in the source file "some/src/file.c". The @var syntax combines with all
704 normal features of DWARF target variables like @defined(), @entry(),
705 [N] array indexing, field access through ->, taking the address with
706 the & prefix and shallow or deep pretty printing with a $ or $$ suffix.
707
708 - Stap now has resource limit options:
709 --rlimit-as=NUM
710 --rlimit-cpu=NUM
711 --rlimit-nproc=NUM
712 --rlimit-stack=NUM
713 --rlimit-fsize=NUM
714 All resource limiting has been moved from the compile server to stap
715 itself. When running the server as "stap-server", default resource
716 limit values are specified in ~stap-server/.systemtap/rc.
717
718 - Bug CVE-2012-0875 (kernel panic when processing malformed DWARF unwind data)
719 is fixed.
720
721 - The systemtap compile-server now supports multiple concurrent connections.
722 Specify the desired maximum number of concurrent connections with
723 the new stap-server/stap-serverd --max-threads option. Specify a
724 value of '0' to tell the server not to spawn any new threads (handle
725 all connections serially in the main thread). The default value is
726 the number of processor cores on the host.
727
728 - The following tapset functions are deprecated in release 1.8 and will be
729 removed in release 1.9:
730 daddr_to_string()
731
732 - SystemTap now mangles local variables to avoid collisions with C
733 headers included by tapsets. This required a change in how
734 embedded-C functions access local parameters and the return value slot.
735
736 Instead of THIS->foo in an embedded-C function, please use the newly
737 defined macro STAP_ARG_foo (substitute the actual name of the
738 argument for 'foo'); instead of THIS->__retvalue, use the newly
739 defined STAP_RETVALUE. All of the tapsets and test cases have been
740 adapted to use this new notation.
741
742 If you need to run code which uses the old THIS-> notation, run stap
743 with the --compatible=1.7 option.
744
745 - There is updated support for user-space probing against kernels >=
746 3.5, which have no utrace but do have the newer inode-uprobes work
747 by Srikar Dronamraju and colleagues. For kernels < 3.5, the
748 following 3 sets of kernel patches would need to be backported to
749 your kernel to use this preliminary user-space probing support:
750
751 - inode-uprobes patches:
752 - 2b144498350860b6ee9dc57ff27a93ad488de5dc
753 - 7b2d81d48a2d8e37efb6ce7b4d5ef58822b30d89
754 - a5f4374a9610fd7286c2164d4e680436727eff71
755 - 04a3d984d32e47983770d314cdb4e4d8f38fccb7
756 - 96379f60075c75b261328aa7830ef8aa158247ac
757 - 3ff54efdfaace9e9b2b7c1959a865be6b91de96c
758 - 35aa621b5ab9d08767f7bc8d209b696df281d715
759 - 900771a483ef28915a48066d7895d8252315607a
760 - e3343e6a2819ff5d0dfc4bb5c9fb7f9a4d04da73
761 - exec tracepoint kernel patch:
762 - 4ff16c25e2cc48cbe6956e356c38a25ac063a64d
763 - task_work_add kernel patches:
764 - e73f8959af0439d114847eab5a8a5ce48f1217c4
765 - 4d1d61a6b203d957777d73fcebf19d90b038b5b2
766 - 413cd3d9abeaef590e5ce00564f7a443165db238
767 - dea649b8ac1861107c5d91e1a71121434fc64193
768 - f23ca335462e3c84f13270b9e65f83936068ec2c
769
770 * What's new in version 1.7, 2012-02-01
771
772 - Map inserting and deleting is now significantly faster due to
773 improved hashing and larger hash tables. The hashes are also
774 now randomized to provide better protection against deliberate
775 collision attacks.
776
777 - Formatted printing is faster by compiling the formatting directives
778 to C code rather than interpreting at run time.
779
780 - Systemtap loads extra command line options from $SYSTEMTAP_DIR/rc
781 ($HOME/.systemtap/rc by default) before the normal argc/argv. This
782 may be useful to activate site options such as --use-server or
783 --download-debuginfo or --modinfo.
784
785 - The stap-server has seen many improvements, and is no longer considered
786 experimental.
787
788 - The stap-server service (initscript) now supports four new options:
789 -D MACRO[=VALUE]
790 --log LOGFILE
791 --port PORT-NUMBER
792 --SSL CERT-DATABASE
793 These allow the specification of macro definitions to be passed to stap
794 by the server, the location of the log file, network port number and
795 NSS certificate database location respectively. These options are also
796 supported within individual server configuration files. See stap-server
797 and initscript/README.stap-server for details. The stap-server is no
798 longer activated by default.
799
800 - process("PATH").[library("PATH")].function("NAME").exported probes are now
801 supported to filter function() to only exported instances.
802
803 - The translator supports a new --suppress-handler-errors option, which
804 causes most runtime errors to be turned into quiet skipped probes. This
805 also disables the MAXERRORS and MAXSKIPPED limits.
806
807 - Translator warnings have been standardized and controlled by the -w / -W
808 flags.
809
810 - The translator supports a new --modinfo NAME=VALUE option to emit additional
811 MODULE_INFO(n,v) macros into the generated code.
812
813 - There is no more fixed maximum number of VMA pages that will be tracked
814 at runtime. This reduces memory use for those scripts that don't need any,
815 or only limited target process VMA tracking and allows easier system
816 wide probes inspecting shared library variables and/or user backtraces.
817 stap will now silently ignore -DTASK_FINDER_VMA_ENTRY_ITEMS.
818
819 - The tapset functions remote_id() and remote_uri() identify the member of a
820 swarm of "stap --remote FOO --remote BAR baz.stp" concurrent executions.
821
822 - Systemtap now supports a new privilege level and group, "stapsys", which
823 is equivalent to the privilege afforded by membership in the group "stapdev",
824 except that guru mode (-g) functionality may not be used. To support this, a
825 new option, --privilege=[stapusr|stapsys|stapdev] has been added.
826 --privilege=stapusr is equivalent to specifying the existing --unprivileged
827 option. --privilege=stapdev is the default. See man stap(1) for details.
828
829 - Scripts that use kernel.trace("...") probes compile much faster.
830
831 - The systemtap module cache is cleaned less frequently, governed by the
832 number of seconds in the $SYSTEMTAP_DIR/cache/cache_clean_interval_s file.
833
834 - SDT can now define up to 12 arguments in a probe point.
835
836 - Parse errors no longer generate a cascade of false errors. Instead, a
837 parse error skips the rest of the current probe or function, and resumes
838 at the next one. This should generate fewer and better messages.
839
840 - Global array wrapping is now supported for both associative and statistics typed
841 arrays using the '%' character to signify a wrapped array. For example,
842 'global foo%[100]' would allow the array 'foo' to be wrapped if more than 100
843 elements are inserted.
844
845 - process("PATH").library("PATH").plt("NAME") probes are now supported.
846 Wildcards are supported in the plt-name part, to refer to any function in the
847 program linkage table which matches the glob pattern and the rest of the
848 probe point.
849
850 - A new option, --dump-probe-types, will dump a list of supported probe types.
851 If --unprivileged is also specified, the list will be limited to probe types
852 which are available to unprivileged users.
853
854 - Systemtap can now automatically download the required debuginfo
855 using abrt. The --download-debuginfo[=OPTION] can be used to
856 control this feature. Possible values are: 'yes', 'no', 'ask',
857 and a positive number representing the timeout desired. The
858 default behavior is to not automatically download the debuginfo.
859
860 - The translator has better support for probing C++ applications by
861 better undertanding of compilation units, nested types, templates,
862 as used in probe point and @cast constructs.
863
864 - On 2.6.29+ kernels, systemtap can now probe kernel modules that
865 arrive and/or depart during the run-time of a session. This allows
866 probing of device driver initialization functions, which had formerly been
867 blacklisted.
868
869 - New tapset functions for cpu_clock and local_clock access were added.
870
871 - There is some limited preliminary support for user-space probing
872 against kernels such as linux-next, which have no utrace but do have
873 the newer inode-uprobes work by Srikar Dronamraju and colleagues.
874
875 - The following probe types are deprecated in release 1.7 and will be
876 removed in release 1.8:
877 kernel.function(number).inline
878 module(string).function(number).inline
879 process.function(number).inline
880 process.library(string).function(number).inline
881 process(string).function(number).inline
882 process(string).library(string).function(number).inline
883
884 - The systemtap-grapher is deprecated in release 1.7 and will be removed in
885 release 1.8.
886
887 - The task_backtrace() tapset function was deprecated in 1.6 and has been
888 removed in 1.7.
889
890 - MAXBACKTRACE did work in earlier releases, but has now been documented
891 in the stap 1 manual page.
892
893 - New tapset function probe_type(). Returns a short string describing
894 the low level probe handler type for the current probe point.
895
896 - Both unwind and symbol data is now only collected and emitted for
897 scripts actually using backtracing or function/data symbols.
898 Tapset functions are marked with /* pragma:symbols */ or
899 /* pragma:unwind */ to indicate they need the specific data.
900
901 - Kernel backtraces can now be generated for non-pt_regs probe context
902 if the kernel support dump_trace(). This enables backtraces from
903 certain timer probes and tracepoints.
904
905 - ubacktrace() should now also work for some kernel probes on x86 which can
906 use the dwarf unwinder to recover the user registers to provide
907 more accurate user backtraces.
908
909 - For s390x the systemtap runtime now properly splits kernel and user
910 addresses (which are in separate address spaces on that architecture)
911 which enable user space introspection.
912
913 - ppc and s390x now supports user backtraces through the DWARF unwinder.
914
915 - ppc now handles function descriptors as symbol names correctly.
916
917 - arm support kernel backtraces through the DWARF unwinder.
918
919 - arm now have a uprobes port which enables user probes. This still
920 requires some kernel patches (user_regsets and tracehook support for
921 arm).
922
923 - Starting in release 1.7, these old variables will be deprecated:
924 - The 'pid' variable in the 'kprocess.release' probe has been
925 deprecated in favor of the new 'released_pid' variable.
926 - The 'args' variable in the
927 '_sunrpc.clnt.create_client.rpc_new_client_inline' probe has been
928 deprecated in favor of the new internal-only '__args' variable.
929
930 - Experimental support for recent kernels without utrace has been
931 added for the following probe types:
932
933 process(PID).begin
934 process("PATH").begin
935 process.begin
936 process(PID).thread.begin
937 process("PATH").thread.begin
938 process.thread.begin
939 process(PID).end
940 process("PATH").end
941 process.end
942 process(PID).thread.end
943 process("PATH").thread.end
944 process.thread.end
945 process(PID).syscall
946 process("PATH").syscall
947 process.syscall
948 process(PID).syscall.return
949 process("PATH").syscall.return
950 process.syscall.return
951
952 - staprun disables kprobe-optimizations in recent kernels, as problems
953 were found. (PR13193)
954
955 * What's new in version 1.6, 2011-07-25
956
957 - Security fixes for CVE-2011-2503: read instead of mmap to load modules,
958 CVE-2011-2502: Don't allow path-based auth for uprobes
959
960 - The systemtap compile-server no longer uses the -k option when calling the
961 translator (stap). As a result, the server will now take advantage of the
962 module cache when compiling the same script more than once. You may observe
963 an improvement in the performance of the server in this situation.
964
965 - The systemtap compile-server and client now each check the version of the
966 other, allowing both to adapt when communicating with a down-level
967 counterpart. As a result, all version of the client can communicate
968 with all versions of the server and vice-versa. Client will prefer newer
969 servers when selecting a server automatically.
970
971 - SystemTap has improved support for the ARM architecture. The
972 kread() and kwrite() operations for ARM were corrected allowing many
973 of the tapsets probes and function to work properly on the ARM
974 architecture.
975
976 - Staprun can now rename the module to a unique name with the '-R' option before
977 inserting it. Systemtap itself will also call staprun with '-R' by default.
978 This allows the same module to be inserted more than once, without conflicting
979 duplicate names.
980
981 - Systemtap error messages now provide feedback when staprun or any other
982 process fails to launch. This also specifically covers when the user
983 doesn't have the proper permissions to launch staprun.
984
985 - Systemtap will now map - to _ in module names. Previously,
986 stap -L 'module("i2c-core").function("*")' would be empty. It now returns
987 a list had stap -L 'module("i2c_core").function("*") been specified.
988
989 - Systemtap now fills in missing process names to probe points, to
990 avoid having to name them twice twice:
991 % stap -e 'probe process("a.out").function("*") {}' -c 'a.out ...'
992 Now the probed process name is inferred from the -c CMD argument.
993 % stap -e 'probe process.function("*") {}' -c 'a.out ...'
994
995 - stap -L 'process("PATH").syscall' will now list context variables
996
997 - Depends on elfutils 0.142+.
998
999 - Deprecated task_backtrace:string (task:long). This function will go
1000 away after 1.6. Please run your scripts with stap --check-version.
1001
1002 * What's new in version 1.5, 2011-05-23
1003
1004 - Security fixes for CVE-2011-1781, CVE-2011-1769: correct DW_OP_{mod,div}
1005 division-by-zero bug
1006
1007 - The compile server and its related tools (stap-gen-ert, stap-authorize-cert,
1008 stap-sign-module) have been re-implemented in C++. Previously, these
1009 components were a mix of bash scripts and C code. These changes should be
1010 transparent to the end user with the exception of NSS certificate database
1011 password prompting (see below). The old implementation would prompt more
1012 than once for the same password in some situations.
1013
1014 - eventcount.stp now allows for event counting in the format of
1015 'stap eventcount.stp process.end syscall.* ...', and also reports
1016 corresponding event tid's.
1017
1018 - Systemtap checks that the build-id of the module being probed matches the
1019 build-id saved in the systemtap module. Invoking systemtap with
1020 -DSTP_NO_BUILDID_CHECK will bypass this build-id runtime verification. See
1021 man ld(1) for info on --build-id.
1022
1023 - stapio will now report if a child process has an abnormal exit along with
1024 the associated status or signal.
1025
1026 - Compiler optimization may sometimes result in systemtap not being able to
1027 access a user-space probe argument. Compiling the application with
1028 -DSTAP_SDT_ARG_CONSTRAINT=nr will force the argument to be an immediate or
1029 register value which should enable systemtap to access the argument.
1030
1031 - GNU Gettext has now been intergrated with systemtap. Our translation
1032 page can be found at http://www.transifex.net/projects/p/systemtap/ .
1033 "make update-po" will generate the necessary files to use translated
1034 messages. Please refer to the po/README file for more info and
1035 please consider contributing to this I18N effort!
1036
1037 - The new addr() function returns the probe's instruction pointer.
1038
1039 - process("...").library("...") probes are now supported. Wildcards
1040 are supported in the library-name part, to refer to any shared
1041 library that is required by process-name, which matches the glob
1042 pattern and the rest of the probe point.
1043
1044 - The "--remote USER@HOST" functionality can now be specified multiple times
1045 to fan out on multiple targets. If the targets have distinct kernel and
1046 architecture configurations, stap will automatically build the script
1047 appropriately for each one. This option is also no longer considered
1048 experimental.
1049
1050 - The NSS certificate database generated for use by the compile server is now
1051 generated with no password. Previously, a random password was generated and
1052 used to access the database. This change should be transparent to most users.
1053 However, if you are prompted for a password when using systemtap, then
1054 running $libexecdir/stap-gen-cert should correct the problem.
1055
1056 - The timestamp tapset includes jiffies() and HZ() for lightweight approximate
1057 timekeeping.
1058
1059 - A powerful new command line option --version has been added.
1060
1061 - process.mark now supports $$parms for reading probe parameters.
1062
1063 - A new command line option, --use-server-on-error[=yes|no] is available
1064 for stap. It instructs stap to retry compilation of a script using a
1065 compile server if it fails on the local host. The default setting
1066 is 'no'.
1067
1068 - The following deprecated tools have been removed:
1069 stap-client
1070 stap-authorize-server-cert
1071 stap-authorize-signing-cert
1072 stap-find-or-start-server
1073 stap-find-servers
1074 Use the --use-server, --trust-server and --list-servers options of stap
1075 instead.
1076
1077 * What's new in version 1.4, 2011-01-17
1078
1079 - Security fixes for CVE-2010-4170, CVE-2010-4171: staprun module
1080 loading/unloading
1081
1082 - A new /* myproc-unprivileged */ marker is now available for embedded C
1083 code and and expressions. Like the /* unprivileged */ marker, it makes
1084 the code or expression available for use in unprivileged mode (see
1085 --unprivileged). However, it also automatically adds a call to
1086 assert_is_myproc() to the code or expression, thus, making it available
1087 to the unprivileged user only if the target of the current probe is within
1088 the user's own process.
1089
1090 - The experimental "--remote USER@HOST" option will run pass 5 on a given
1091 ssh host, after building locally (or with --use-server) for that target.
1092
1093 - Warning messages from the script may now be suppressed with the stap
1094 and/or staprun -w option. By default, duplicate warning messages are
1095 suppressed (up to a certain limit). With stap --vp 00002 and above,
1096 the duplicate elimination is defeated.
1097
1098 - The print_ubacktrace and usym* functions attempt to print the full
1099 path of the user-space binaries' paths, instead of just the basename.
1100 The maximum saved path length is set by -DTASK_FINDER_VMA_ENTRY_PATHLEN,
1101 default 64. Warning messages are produced if unwinding fails due to
1102 a missing 'stap -d MODULE' option, providing preloaded unwind data.
1103
1104 - The new tz_ctime() tapset function prints times in the local time zone.
1105
1106 - More kernel tracepoints are accessible to the kernel.trace("...") mechanism,
1107 if kernel source trees or debuginfo are available. These formerly "hidden"
1108 tracepoints are those that are declared somewhere other than the usual
1109 include/linux/trace/ headers, such as xfs and kvm.
1110
1111 - debuginfo-based process("...").function/.statement/.mark probes support
1112 wildcards in the process-name part, to refer to any executable files that
1113 match the glob pattern and the rest of the probe point.
1114
1115 - The -t option now displays information per probe-point rather than a summary
1116 for each probe. It also now shows the derivation chain for each probe-point.
1117
1118 - A rewrite of the sys/sdt.h header file provides zero-cost startup (few or
1119 no ELF relocations) for the debuginfo-less near-zero-cost runtime probes.
1120 Binaries compiled with earlier sdt.h versions remain supported. The
1121 stap -L (listing) option now lists parameters for sys/sdt.h markers.
1122
1123 - The implementation of the integrated compile-server client has been
1124 extended.
1125 o --use-server now accepts an argument representing a particular server and
1126 may be specified more than once.
1127 o --list-servers now accepts an expanded range of arguments.
1128 o a new --trust-servers option has been added to stap to replace several
1129 old certificate-management scripts.
1130 o The following tools are now deprecated and will be removed in release 1.5:
1131 stap-client
1132 stap-authorize-server-cert
1133 stap-authorize-signing-cert
1134 stap-find-or-start-server
1135 stap-find-servers
1136 See man stap(1) for complete details.
1137
1138 - The compile-server now returns the uprobes.ko to the client when it is
1139 required by the script being compiled. The integrated compile-server client
1140 now makes it available to be loaded by staprun. The old (deprecated)
1141 stap-client does not do this.
1142
1143 - process probes with scripts as the target are recognized by stap and the
1144 interpreter would be selected for probing.
1145
1146 - Starting in release 1.5, these old variables/functions will be deprecated
1147 and will only be available when the '--compatible=1.4' flag is used:
1148
1149 - In the 'syscall.add_key' probe, the 'description_auddr' variable
1150 has been deprecated in favor of the new 'description_uaddr'
1151 variable.
1152 - In the 'syscall.fgetxattr', 'syscall.fsetxattr',
1153 'syscall.getxattr', 'syscall.lgetxattr', and
1154 'syscall.lremovexattr' probes, the 'name2' variable has been
1155 deprecated in favor of the new 'name_str' variable.
1156 - In the 'nd_syscall.accept' probe the 'flag_str' variable
1157 has been deprecated in favor of the new 'flags_str' variable.
1158 - In the 'nd_syscall.dup' probe the 'old_fd' variable has been
1159 deprecated in favor of the new 'oldfd' variable.
1160 - In the 'nd_syscall.fgetxattr', 'nd_syscall.fremovexattr',
1161 'nd_syscall.fsetxattr', 'nd_syscall.getxattr', and
1162 'nd_syscall.lremovexattr' probes, the 'name2' variable has been
1163 deprecated in favor of the new 'name_str' variable.
1164 - The tapset alias 'nd_syscall.compat_pselect7a' was misnamed. It should
1165 have been 'nd_syscall.compat_pselect7' (without the trailing 'a').
1166 - The tapset function 'cpuid' is deprecated in favor of the better known
1167 'cpu'.
1168 - In the i386 'syscall.sigaltstack' probe, the 'ussp' variable has
1169 been deprecated in favor of the new 'uss_uaddr' variable.
1170 - In the ia64 'syscall.sigaltstack' probe, the 'ss_uaddr' and
1171 'oss_uaddr' variables have been deprecated in favor of the new
1172 'uss_uaddr' and 'uoss_uaddr' variables.
1173 - The powerpc tapset alias 'syscall.compat_sysctl' was deprecated
1174 and renamed 'syscall.sysctl32'.
1175 - In the x86_64 'syscall.sigaltstack' probe, the 'regs_uaddr'
1176 variable has been deprecated in favor of the new 'regs' variable.
1177
1178 * What's new in version 1.3, 2010-07-21
1179
1180 - The uprobes kernel module now has about half the overhead when probing
1181 NOPs, which is particularly relevant for sdt.h markers.
1182
1183 - New stap option -G VAR=VALUE allows overriding global variables
1184 by passing the settings to staprun as module options.
1185
1186 - The tapset alias 'syscall.compat_pselect7a' was misnamed. It should
1187 have been 'syscall.compat_pselect7' (without the trailing 'a').
1188 Starting in release 1.4, the old name will be deprecated and
1189 will only be available when the '--compatible=1.3' flag is used.
1190
1191 - A new procfs parameter .umask(UMASK) which provides modification of
1192 file permissions using the proper umask value. Default file
1193 permissions for a read probe are 0400, 0200 for a write probe, and
1194 0600 for a file with a read and write probe.
1195
1196 - It is now possible in some situations to use print_ubacktrace() to
1197 get a user space stack trace from a kernel probe point. e.g. for
1198 user backtraces when there is a pagefault:
1199 $ stap -d /bin/sort --ldd -e 'probe vm.pagefault {
1200 if (pid() == target()) {
1201 printf("pagefault @0x%x\n", address); print_ubacktrace();
1202 } }' -c /bin/sort
1203 [...]
1204 pagefault @0x7fea0595fa70
1205 0x000000384f07f958 : __GI_strcmp+0x12b8/0x1440 [libc-2.12.so]
1206 0x000000384f02824e : __gconv_lookup_cache+0xee/0x5a0 [libc-2.12.so]
1207 0x000000384f021092 : __gconv_find_transform+0x92/0x2cf [libc-2.12.so]
1208 0x000000384f094896 : __wcsmbs_load_conv+0x106/0x2b0 [libc-2.12.so]
1209 0x000000384f08bd90 : mbrtowc+0x1b0/0x1c0 [libc-2.12.so]
1210 0x0000000000404199 : ismbblank+0x39/0x90 [sort]
1211 0x0000000000404a4f : inittables_mb+0xef/0x290 [sort]
1212 0x0000000000406934 : main+0x174/0x2510 [sort]
1213 0x000000384f01ec5d : __libc_start_main+0xfd/0x1d0 [libc-2.12.so]
1214 0x0000000000402509 : _start+0x29/0x2c [sort]
1215 [...]
1216
1217 - New tapset functions to get a string representation of a stack trace:
1218 sprint_[u]backtrace() and sprint_[u]stack().
1219
1220 - New tapset function to get the module (shared library) name for a
1221 user space address umodname:string(long). The module name will now
1222 also be in the output of usymdata() and in backtrace addresses even
1223 when they were not given with -d at the command line.
1224
1225 - Kernel backtraces are now much faster (replaced a linear search
1226 with a binary search).
1227
1228 - A new integrated compile-server client is now available as part of stap.
1229
1230 o 'stap --use-server ...' is equivalent to 'stap-client ...'
1231 o 'stap --list-servers' is equivalent to 'stap-find-servers'
1232 o 'stap --list-servers=online' is equivalent to 'stap-find-servers --all'
1233 o stap-client and its related tools will soon be deprecated.
1234 o the nss-devel and avahi-devel packages are required for building stap with
1235 the integrated client (checked during configuration).
1236 o nss and avahi are required to run the integrated client.
1237
1238 - A new operator @entry is available for automatically saving an expression
1239 at entry time for use in a .return probe.
1240 probe foo.return { println(get_cycles() - @entry(get_cycles())) }
1241
1242 - Probe $target variables and @cast() can now use a suffix to print complex
1243 data types as strings. Use a single '$' for a shallow view, or '$$' for a
1244 deeper view that includes nested types. For example, with fs_struct:
1245 $fs$ : "{.users=%i, .lock={...}, .umask=%i,
1246 .in_exec=%i, .root={...}, .pwd={...}}"
1247 $fs$$ : "{.users=%i, .lock={.raw_lock={.lock=%u}}, .umask=%i, .in_exec=%i,
1248 .root={.mnt=%p, .dentry=%p}, .pwd={.mnt=%p, .dentry=%p}}"
1249
1250 - The <sys/sdt.h> user-space markers no longer default to an implicit
1251 MARKER_NAME_ENABLED() semaphore check for each marker. To check for
1252 enabled markers use a .d declaration file, then:
1253 if (MARKER_NAME_ENABLED()) MARKER_NAME()
1254
1255 - Hyphenated <sys/sdt.h> marker names such as process(...).mark("foo-bar")
1256 are now accepted in scripts. They are mapped to the double-underscore
1257 form ("foo__bar").
1258
1259 - More robust <sys/sdt.h> user-space markers support is included. For
1260 some platforms (x86*, ppc*), this can let systemtap probe the markers
1261 without debuginfo. This implementation also supports preserving
1262 the "provider" name associated with a marker:
1263 probe process("foo").provider("bar").mark("baz") to match
1264 STAP_PROBE<n>(bar, baz <...>)
1265 (Compile with -DSTAP_SDT_V1 to revert to the previous implementation.
1266 Systemtap supports pre-existing or new binaries using them.)
1267
1268 - Embedded-C may be used within expressions as values, when in guru mode:
1269 num = %{ LINUX_VERSION_CODE %} // int64_t
1270 name = %{ /* string */ THIS_MODULE->name %} // const char*
1271 printf ("%s %x\n", name, num)
1272 The usual /* pure */, /* unprivileged */, and /* guru */ markers may be used
1273 as with embedded-C functions.
1274
1275 - By default the systemtap-runtime RPM builds now include a shared
1276 library, staplog.so, that allows crash to extract systemtap data from
1277 a vmcore image.
1278
1279 - Iterating with "foreach" can now explicitly save the value for the loop.
1280 foreach(v = [i,j] in array)
1281 printf("array[%d,%s] = %d\n", i, j, v /* array[i,j] */)
1282
1283 - The new "--ldd" option automatically adds any additional shared
1284 libraries needed by probed or -d-listed userspace binaries to the -d
1285 list, to enable symbolic backtracing through them. Similarly, the
1286 new "--all-modules" option automatically adds any currently loaded
1287 kernel modules (listed in /proc/modules) to the -d list.
1288
1289 - A new family of set_kernel_* functions make it easier for gurus to write
1290 new values at arbitrary memory addresses.
1291
1292 - Probe wildcards can now use '**' to cross the '.' separator.
1293 $ stap -l 'sys**open'
1294 syscall.mq_open
1295 syscall.open
1296
1297 - Backward compatibility flags (--compatible=VERSION, and matching
1298 script preprocessing predicate %( systemtap_v CMP "version" %)
1299 and a deprecation policy are being introduced, in case future
1300 tapset/language changes break valid scripts.
1301
1302 * What's new in version 1.2, 2010-03-22
1303
1304 - Prototype support for "perf events", where the kernel supports the
1305 2.6.33 in-kernel API. Probe points may refer to low-level
1306 perf_event_attr type/config numbers, or to a number of aliases
1307 defined in the new perf.stp tapset:
1308 probe perf.sw.cpu_clock, perf.type(0).config(4) { }
1309
1310 - Type-casting can now use multiple headers to resolve codependencies.
1311 @cast(task, "task_struct",
1312 "kernel<linux/sched.h><linux/fs_struct.h>")->fs->umask
1313
1314 - Tapset-related man pages have been renamed. 'man -k 3stap' should show
1315 the installed list, which due to prefixing should no longer collide over
1316 ordinary system functions.
1317
1318 - User space marker arguments no longer use volatile if the version of gcc,
1319 which must be at least 4.5.0, supports richer DWARF debuginfo. Use cflags
1320 -DSTAP_SDT_VOLATILE=volatile or -DSTAP_SDT_VOLATILE= when building
1321 the sys/sdt.h application to override this one way or another.
1322
1323 - A new construct for error handling is available. It is similar to c++
1324 exception catching, using try and catch as new keywords. Within a handler
1325 or function, the following is valid and may be nested:
1326 try { /* arbitrary statements */ }
1327 catch (er) { /* e.g. println("caught error ", er) */ }
1328
1329 - A new command line flag '-W' forces systemtap to abort translation of
1330 a script if any warnings are produced. It is similar to gcc's -Werror.
1331 (If '-w' is also supplied to suppress warnings, it wins.)
1332
1333 - A new predicate @defined is available for testing whether a
1334 particular $variable/expression is resolvable at translate time:
1335 probe foo { if (@defined($bar)) log ("$bar is available here") }
1336
1337 - Adjacent string literals are glued together, making this
1338 construct valid:
1339 probe process("/usr" @1 "/bin").function("*") { ... }
1340
1341 - In order to limit potential impact from future security problems,
1342 the stap-server process does not permit its being launched as root.
1343
1344 - On recent kernels, for some architectures/configurations, hardware
1345 breakpoint probes are supported. The probe point syntax is:
1346
1347 probe kernel.data(ADDRESS).write
1348 probe kernel.data(ADDRESS).length(LEN).write
1349 probe kernel.data("SYMBOL_NAME").write
1350
1351 * What's new in version 1.1, 2010-01-15
1352
1353 - New tracepoint based tapset for memory subsystem.
1354
1355 - The loading of signed modules by staprun is no longer allowed for
1356 ordinary, unprivileged users. This means that only root, members of
1357 the group 'stapdev' and members of the group 'stapusr' can load
1358 systemtap modules using staprun, stap or stap-client. The minimum
1359 privilege required to run arbitrary --unprivileged scripts is now
1360 'stapusr' membership.
1361
1362 - The stap-server initscript is available. This initscript allows you
1363 to start systemtap compile servers as a system service and to manage
1364 these servers as a group or individually. The stap-server initscript
1365 is installed by the systemtap-server rpm. The build directory for
1366 the uprobes module (/usr/share/systemtap/runtime/uprobes) is made
1367 writable by the 'stap-server' group. All of the files generated when
1368 building the uprobes module, including the digital signature, are
1369 also writable by members of stap-server.
1370
1371 See initscript/README.stap-server for details.
1372
1373 - Some of the compile server client, server and certificate management
1374 tools have been moved from $bindir to $libexecdir/systemtap.
1375 You should use the new stap-server script or the stap-server initscript
1376 for server management where possible. The stap-server script provides the same
1377 functionality as the stap-server initscript except that the servers are
1378 run by the invoking user by default as opposed to servers started by the
1379 stap-server initscript which are run by the user stap-server
1380 by default. See stap-server(8) for more information.
1381
1382 You may continue to use these tools by adding $libexecdir/systemtap to
1383 your path. You would need to do this, for example, if you are not root,
1384 you want to start a compile server and you are not running systemtap from a
1385 private installation. In this case you still need to use stap-start-server.
1386
1387 - Any diagnostic output line that starts with "ERROR", as in
1388 error("foo"), will promote a "Pass 5: run failed", and the return
1389 code is 1.
1390
1391 - Systemtap now warns about global variables being referenced from other
1392 script files. This aims to protect against unintended local-vs-global
1393 namespace collisions such as:
1394
1395 % cat some_tapset.stp
1396 probe baz.one = bar { foo = $foo; bar = $bar }
1397 % cat end_user_script.stp
1398 global foo # intended to be private variable
1399 probe timer.s(1) { foo ++ }
1400 probe baz.* { println(foo, pp()) }
1401 % stap end_user_script.stp
1402 WARNING: cross-file global variable reference to foo from some_tapset.stp
1403
1404 - Preprocessor conditional for kernel configuration testing:
1405 %( CONFIG_foo == "y" %? ... %)
1406
1407 - ftrace(msg:string) tapset function to send strings to the system-wide
1408 ftrace ring-buffer (if any).
1409
1410 - Better support for richer DWARF debuginfo output from GCC 4.5
1411 (variable tracking assignments). Kernel modules are now always resolved
1412 against all their dependencies to find any info referring to missing
1413 symbols. DW_AT_const_value is now supported when no DW_AT_location
1414 is available.
1415
1416 * What's new in verson 1.0, 2009-09-22
1417
1418 - process().mark() probes now use an enabling semaphore to reduce the
1419 computation overhead of dormant probes.
1420
1421 - The function spec for dwarf probes now supports C++ scopes, so you can
1422 limit the probes to specific namespaces or classes. Multiple scopes
1423 can be specified, and they will be matched progressively outward.
1424 probe process("foo").function("std::vector<*>::*") { }
1425 probe process("foo").function("::global_function") { }
1426
1427 - It is now possible to cross-compile systemtap scripts for foreign
1428 architectures, using the new '-a ARCH' and '-B OPT=VALUE' flags.
1429 For example, put arm-linux-gcc etc. into your $PATH, and point
1430 systemtap at the target kernel build tree with:
1431 stap -a arm -B CROSS_COMPILE=arm-linux- -r /build/tree [...]
1432 The -B option is passed to kbuild make. -r identifies the already
1433 configured/built kernel tree and -a its architecture (kbuild ARCH=...).
1434 Systemtap will infer -p4.
1435
1436 - Cross compilation using the systemtap client and server
1437 - stap-start-server now accepts the -r, -R, -I, -B and -a options in
1438 order to start a cross compiling server. The server will correctly
1439 advertise itself with respect to the kernel release and architecture
1440 that it compiles for.
1441 - When specified on stap-client, the -r and -a options will be
1442 considered when searching for a suitable server.
1443
1444 - When using the systemtap client and server udp port 5353 must be open
1445 in your firewall in order for the client to find servers using
1446 avahi-browse. Also the systemtap server will choose a random port in
1447 the range 1024-63999 for accepting ssl connections.
1448
1449 - Support for unprivileged users:
1450 ***********************************************************************
1451 * WARNING!!!!!!!!!! *
1452 * This feature is EXPERIMENTAL at this time and should be used with *
1453 * care. This feature allows systemtap kernel modules to be loaded by *
1454 * unprivileged users. The user interface and restrictions will change *
1455 * as this feature evolves. *
1456 ***********************************************************************
1457 - Systemtap modules generated from scripts which use a restricted
1458 subset of the features available may be loaded by staprun for
1459 unprivileged users. Previously, staprun would load modules only for
1460 root or for members of the groups stapdev and stapusr.
1461 - Using the --unprivileged option on stap enables translation-time
1462 checking for use by unprivileged users (see restrictions below).
1463 - All modules deemed suitable for use by unprivileged users will be
1464 signed by the systemtap server when --unprivileged is specified on
1465 stap-client. See module signing in release 0.9.8 and stap-server in
1466 release 0.9 below.
1467 - Modules signed by trusted signers (servers) and verified by staprun
1468 will be loaded by staprun regardless of the user's privilege level.
1469 - The system administrator asserts the trustworthiness of a signer
1470 (server) by running stap-authorize-signing-cert <cert-file> as root,
1471 where the <cert-file> can be found in
1472 ~<user>/.systemtap/ssl/server/stap.cert for servers started by
1473 ordinary users and in $sysconfdir/systemtap/ssl/server/stap.cert for
1474 servers started by root.
1475 - Restrictions are intentionally strict at this time and may be
1476 relaxed in the future:
1477 - probe points are restricted to:
1478 begin, begin(n), end, end(n), error, error(n), never,
1479 timer.{jiffies,s,sec,ms,msec,us,usec,ns,nsec}(n)*, timer.hz(n),
1480 process.* (for processes owned by the user).
1481 - use of embedded C code is not allowed.
1482 - use of tapset functions is restricted.
1483 - some tapset functions may not be used at all. A message will be
1484 generated at module compilation time.
1485 - some actions by allowed tapset functions may only be performed
1486 in the context of the user's own process. A runtime fault will
1487 occur in these situations, for example, direct memory access.
1488 - The is_myproc() tapset function has been provided so that
1489 tapset writers for unprivileged users can check that the
1490 context is of the users own process before attempting these
1491 actions.
1492 - accessing the kernel memory space is not allowed.
1493 - The following command line options may not be used by stap-client
1494 -g, -I, -D, -R, -B
1495 - The following environment variables are ignored by stap-client:
1496 SYSTEMTAP_RUNTIME, SYSTEMTAP_TAPSET, SYSTEMTAP_DEBUGINFO_PATH
1497 - nss and nss-tools are required to use this feature.
1498
1499 - Support output file switching by SIGUSR2. Users can command running
1500 stapio to switch output file by sending SIGUSR2.
1501
1502 - Memory consumption for scripts involving many uprobes has been
1503 dramatically reduced.
1504
1505 - The preprocessor now supports || and && in the conditions.
1506 e.g. %( arch == "x86_64" || arch == "ia64" %: ... %)
1507
1508 - The systemtap notion of "architecture" now matches the kernel's, rather
1509 than that of "uname -m". This means that 32-bit i386 family are all
1510 known as "i386" rather than "i386" or "i686"; "ppc64" as "powerpc";
1511 "s390x" as "s390", and so on. This is consistent between the new
1512 "-a ARCH" flag and the script-level %( arch ... %) conditional.
1513
1514 - It is now possible to define multiple probe aliases with the same name.
1515 A probe will expand to all matching aliases.
1516 probe foo = bar { }
1517 probe foo = baz { }
1518 probe foo { } # expands twice, once to bar and once to baz
1519
1520 - A new experimental transport mechanism, using ftrace's ring_buffer,
1521 has been added. This may become the default transport mechanism in
1522 future versions of systemtap. To test this new transport mechanism,
1523 define 'STP_USE_RING_BUFFER'.
1524
1525 - Support for recognizing DW_OP_{stack,implicit}_value DWARF expressions
1526 as emitted by GCC 4.5.
1527
1528 * What's new in version 0.9.9, 2009-08-04
1529
1530 - Systemwide kernel .function.return (kretprobe) maxactive defaults may
1531 be overridden with the -DKRETACTIVE=nnn parameter.
1532
1533 - Translation pass 2 is significantly faster by avoiding unnecessary
1534 searching through a kernel build/module directory tree.
1535
1536 - When compiled against elfutils 0.142 systemtap now handles the new
1537 DW_OP_call_frame_CFA generated by by GCC.
1538
1539 - uprobes and ustack() are more robust when used on applications that
1540 depend on prelinked/separate debuginfo shared libraries.
1541
1542 - User space PROBE marks are not always found with or without separate
1543 debuginfo. The .probes section itself is now always put in the main
1544 elf file and marked as allocated. When building pic code the section
1545 is marked writable. The selinux memory check problems seen with
1546 programs using STAP_PROBES is fixed.
1547
1548 - statement() probes can now override "address not at start of statement"
1549 errors in guru mode. They also provide alternative addresses to use
1550 in non-guru mode.
1551
1552 - The stapgraph application can generate graphs of data and events
1553 emitted by systemtap scripts in real time. Run "stapgraph
1554 testsuite/systemtap.examples/general/grapher.stp" for an example of
1555 graphing the system load average and keyboard events.
1556
1557 - Dwarf probes now show parameters and local variables in the verbose
1558 listing mode (-L).
1559
1560 - Symbol aliases are now resolved to their canonical dwarf names. For
1561 example, probing "malloc" in libc resolves to "__libc_malloc".
1562
1563 - The syntax for dereferencing $target variables and @cast() gained new
1564 capabilities:
1565 - Array indexes can now be arbitrary numeric expressions.
1566 - Array subscripts are now supported on pointer types.
1567 - An '&' operator before a @cast or $target returns the address of the
1568 final component, especially useful for nested structures.
1569
1570 - For reading all probe variables, kernel.mark now supports $$vars and
1571 $$parms, and process.syscall now supports $$vars.
1572
1573 - The SNMP tapset provides probes and functions for many network
1574 statistics. See stapprobes.snmp(3stap) for more details.
1575
1576 - The dentry tapset provides functions to map kernel VFS directory entries
1577 to file or full path names: d_path(), d_name() and reverse_path_walk().
1578
1579 - SystemTap now has userspace markers in its own binaries, and the stap
1580 tapset provides the available probepoints and local variables.
1581
1582 - Miscellaneous new tapset functions:
1583 - pgrp() returns the process group ID of the current process
1584 - str_replace() performs string replacement
1585
1586 * What's new in version 0.9.8, 2009-06-11
1587
1588 - Miscellaneous new tapset functions:
1589 - sid() returns the session ID of the current process
1590 - stringat() indexes a single character from a string.
1591
1592 - Using %M in print formats for hex dumps can now print entire buffers,
1593 instead of just small numbers.
1594
1595 - Dwarfless syscalls: The nd_syscalls tapset is now available to probe
1596 system calls without requiring kernel debugging information. All of
1597 the same probepoints in the normal syscalls tapset are available with
1598 an "nd_" prefix, e.g. syscall.open becomes nd_syscall.open. Most
1599 syscall arguments are also available by name in nd_syscalls.
1600
1601 - Module signing: If the appropriate nss libraries are available on your
1602 system, stap-server will sign each compiled module using a self-generated
1603 certificate. This is the first step toward extending authority to
1604 load certain modules to unprivileged users. For now, if the system
1605 administrator adds a certificate to a database of trusted signers
1606 (stap-authorize-signing-cert), modules signed using that certificate
1607 will be verified by staprun against tampering. Otherwise, you should
1608 notice no difference in the operation of stap or staprun.
1609
1610 * What's new in version 0.9.7, 2009-04-23
1611
1612 - @cast can now determine its type information using an explicit header
1613 specification. For example:
1614 @cast(tv, "timeval", "<sys/time.h>")->tv_sec
1615 @cast(task, "task_struct", "kernel<linux/sched.h>")->tgid
1616
1617 - The overlapping process.* tapsets are now separated. Those probe points
1618 documented in stapprobes(3stap) remain the same. Those that were formerly
1619 in stapprobes.process(3stap) have been renamed to kprocess, to reflect
1620 their kernel perspective on processes.
1621
1622 - The --skip-badvars option now also suppresses run-time error
1623 messages that would otherwise result from erroneous memory accesses.
1624 Such accesses can originate from $context expressions fueled by
1625 erroneous debug data, or by kernel_{long,string,...}() tapset calls.
1626
1627 - New probes kprobe.function(FUNCTION) and kprobe.function(FUNCTION).return
1628 for dwarfless probing. These postpone function address resolution to
1629 run-time and use the kprobe symbol-resolution mechanism.
1630 Probing of absolute statements can be done using the
1631 kprobe.statement(ADDRESS).absolute construct.
1632
1633 - EXPERIMENTAL support for user process unwinding. A new collection of
1634 tapset functions have been added to handle user space backtraces from
1635 probe points that support them (currently process and timer probes -
1636 for timer probes test whether or not in user space first with the
1637 already existing user_mode() function). The new tapset functions are:
1638 uaddr - User space address of current running task.
1639 usymname - Return the symbol of an address in the current task.
1640 usymdata - Return the symbol and module offset of an address.
1641 print_ustack - Print out stack for the current task from string.
1642 print_ubacktrace - Print stack back trace for current task.
1643 ubacktrace - Hex backtrace of current task stack.
1644 Please read http://sourceware.org/ml/systemtap/2009-q2/msg00364.html
1645 on the current restrictions and possible changes in the future and
1646 give feedback if you want to influence future developments.
1647
1648 * What's new in version 0.9.5, 2009-03-27
1649
1650 - New probes process().insn and process().insn.block that allows
1651 inspection of the process after each instruction or block of
1652 instructions executed. So to count the total number of instructions
1653 a process executes during a run do something like:
1654 $ stap -e 'global steps; probe process("/bin/ls").insn {steps++}
1655 probe end {printf("Total instructions: %d\n", steps);}' \
1656 -c /bin/ls
1657 This feature can slow down execution of a process somewhat.
1658
1659 - Systemtap probes and function man pages extracted from the tapsets
1660 are now available under 3stap. To show the page for probe vm.pagefault
1661 or the stap function pexecname do:
1662 $ man 3stap vm.pagefault
1663 $ man 3stap pexecname
1664
1665 - Kernel tracepoints are now supported for probing predefined kernel
1666 events without any debuginfo. Tracepoints incur less overhead than
1667 kprobes, and context parameters are available with full type
1668 information. Any kernel 2.6.28 and later should have defined
1669 tracepoints. Try the following to see what's available:
1670 $ stap -L 'kernel.trace("*")'
1671
1672 - Typecasting with @cast now supports modules search paths, which is
1673 useful in case there are multiple places where the type definition
1674 may be found. For example:
1675 @cast(sdev, "scsi_device", "kernel:scsi_mod")->sdev_state
1676
1677 - On-file flight recorder is supported. It allows stap to record huge
1678 trace log on the disk and to run in background.
1679 Passing -F option with -o option runs stap in background mode. In this
1680 mode, staprun is detached from console, and stap itself shows staprun's
1681 pid and exits.
1682 Specifying the max size and the max number of log files are also available
1683 by passing -S option. This option has one or two arguments seperated by
1684 a comma. The first argument is the max size of a log file in MB. If the
1685 size of a log file exceeds it, stap switches to the next log file
1686 automatically. The second is how many files are kept on the disk. If the
1687 number of log files exceeds it, the oldest log file is removed
1688 automatically. The second argument can be omitted.
1689
1690 For example, this will record output on log files each of them is smaller
1691 than 1024MB and keep last 3 logs, in background.
1692 % stap -F -o /tmp/staplog -S 1024,3 script.stp
1693
1694 - In guru mode (-g), the kernel probing blacklist is disabled, leaving
1695 only a subset - the kernel's own internal kprobe blacklist - to attempt
1696 to filter out areas unsafe to probe. The differences may be enough to
1697 probe more interrupt handlers.
1698
1699 - Variables unavailable in current context may be skipped by setting a
1700 session level flag with command line option --skip-badvars now available.
1701 This replaces any dwarf $variable expressions that could not be resolved
1702 with literal numeric zeros, along with a warning message.
1703
1704 - Both kernel markers and kernel tracepoint support argument listing
1705 through stap -L 'kernel.mark("*")' or stap -L 'kernel.trace("*")'
1706
1707 - Users can use -DINTERRUPTIBLE=0 to prevent interrupt reentrancy in
1708 their script, at the cost of a bit more overhead to toggle the
1709 interrupt mask.
1710
1711 - Added reentrancy debugging. If stap is run with the arguments
1712 "-t -DDEBUG_REENTRANCY", additional warnings will be printed for
1713 every reentrancy event, including the probe points of the
1714 resident and interloper probes.
1715
1716 - Default to --disable-pie for configure.
1717 Use --enable-pie to turn it back on.
1718
1719 - Improved sdt.h compatibility and test suite for static dtrace
1720 compatible user space markers.
1721
1722 - Some architectures now use syscall wrappers (HAVE_SYSCALL_WRAPPERS).
1723 The syscall tapset has been enhanced to take care of the syscall
1724 wrappers in this release.
1725
1726 - Security fix for CVE-2009-0784: stapusr module-path checking race.
1727
1728 * What's new in version 0.9, 2009-02-19
1729
1730 - Typecasting is now supported using the @cast operator. A script can
1731 define a pointer type for a "long" value, and then access type members
1732 using the same syntax as with $target variables. For example, this will
1733 retrieve the parent pid from a kernel task_struct:
1734 @cast(pointer, "task_struct", "kernel")->parent->pid
1735
1736 - process().mark() probes are now possible to trace static user space
1737 markers put in programs with the STAP_PROBE macro using the new
1738 sys/sdt.h include file. This also provides dtrace compatible markers
1739 through DTRACE_PROBE and an associated python 'dtrace' script that
1740 can be used in builds based on dtrace that need dtrace -h or -G
1741 functionality.
1742
1743 - For those that really want to run stap from the build tree there is
1744 now the 'run-stap' script in the top-level build directory that sets
1745 up the SYSTEMTAP_TAPSET, SYSTEMTAP_RUNTIME, SYSTEMTAP_STAPRUN, and
1746 SYSTEMTAP_STAPIO environment variables (installing systemtap, in a
1747 local prefix, is still recommended for common use).
1748
1749 - Systemtap now comes with a new Beginners Guide that walks the user
1750 through their first steps setting up stap, understanding how it all
1751 works, introduces some useful scripts and describes some common
1752 pitfalls. It isn't created by default since it needs a Publican
1753 setup, but full build instructions can be found in the wiki:
1754 http://sourceware.org/systemtap/wiki/PublicanQuikHowto
1755 An online version can be found at:
1756 http://sourceware.org/systemtap/SystemTap_Beginners_Guide.pdf
1757
1758 - Standard tapsets included with Systemtap were modified to include
1759 extractable documentation information based on the kernel-doc
1760 infrastructure. When configured --enabled-docs a HTML and PDF
1761 version of the Tapset Reference Manual is produced explaining probes
1762 defined in each tapset.
1763
1764 - The systemtap client and compile server are now available.
1765 These allow you to compile a systemtap module on a host other than
1766 the one which it will be run, providing the client and server
1767 are compatible. Other than using a server for passes 1 through
1768 4, the client behaves like the 'stap' front end itself. This
1769 means, among other things, that the client will automatically
1770 load the resulting module on the local host unless -p[1234]
1771 was specified. See stap-server(8) for more details.
1772 The client/server now use SSL for network connection security and
1773 for signing.
1774
1775 The systemtap client and server are prototypes only. Interfaces, options
1776 and usage may change at any time.
1777
1778 - function("func").label("label") probes are now supported to allow matching
1779 the label of a function.
1780
1781 - Systemtap initscript is available. This initscript allows you to run
1782 systemtap scripts as system services (in flight recorder mode) and
1783 control those scripts individually.
1784 See README.systemtap for details.
1785
1786 - The stap "-r DIR" option may be used to identify a hand-made kernel
1787 build directory. The tool determines the appropriate release string
1788 automatically from the directory.
1789
1790 - Serious problems associated with user-space probing in shared libraries
1791 were corrected, making it now possible to experiment with probe shared
1792 libraries. Assuming dwarf debugging information is installed, use this
1793 twist on the normal syntax:
1794
1795 probe process("/lib64/libc-2.8.so").function("....") { ... }
1796
1797 This would probe all threads that call into that library. Running
1798 "stap -c CMD" or "stap -x PID" naturally restricts this to the target
1799 command+descendants only. $$vars etc. may be used.
1800
1801 - For scripts that sometimes terminate with excessive "skipped" probes,
1802 rerunning the script with "-t" (timing) will print more details about
1803 the skippage reasons.
1804
1805 - Symbol tables and unwind (backtracing) data support were formerly
1806 compiled in for all probed modules as identified by the script
1807 (kernel; module("name"); process("file")) plus those listed by the
1808 stap "-d BINARY" option. Now, this data is included only if the systemtap
1809 script uses tapset functions like probefunc() or backtrace() that require
1810 such information. This shrinks the probe modules considerably for the rest.
1811
1812 - Per-pass verbosity control is available with the new "--vp {N}+" option.
1813 "stap --vp 040" adds 4 units of -v verbosity only to pass 2. This is useful
1814 for diagnosing errors from one pass without excessive verbosity from others.
1815
1816 - Most probe handlers now run with interrupts enabled, for improved
1817 system responsiveness and less probing overhead. This may result
1818 in more skipped probes, for example if a reentrant probe handler
1819 is attempted from within an interrupt handler. It may also make the
1820 systemtap overload detection facility more likely to be triggered, as
1821 interrupt handlers' run time would be included in the self-assessed
1822 overhead of running probe handlers.
1823
1824 * What's new in version 0.8, 2008-11-13
1825
1826 - Cache limiting is now available. If the compiled module cache size is
1827 over a limit specified in the $SYSTEMTAP_DIR/cache/cache_mb_limit file,
1828 some old cache entries will be unlinked. See man stap(1) for more.
1829
1830 - Error and warning messages are now followed by source context displaying
1831 the erroneous line/s and a handy '^' in the following line pointing to the
1832 appropriate column.
1833
1834 - A bug reporting tool "stap-report" is now available which will quickly
1835 retrieve much of the information requested here:
1836 http://sourceware.org/systemtap/wiki/HowToReportBugs
1837
1838 - The translator can resolve members of anonymous structs / unions:
1839 given struct { int foo; struct { int bar; }; } *p;
1840 this now works: $p->bar
1841
1842 - The stap "-F" flag activates "flight recorder" mode, which consists of
1843 translating the given script as usual, but implicitly launching it into
1844 the background with staprun's existing "-L" (launch) option. A user
1845 can later reattach to the module with "staprun -A MODULENAME".
1846
1847 - Additional context variables are available on user-space syscall probes.
1848 - $argN ($arg1, $arg2, ... $arg6) in process(PATH_OR_PID).syscall
1849 gives you the argument of the system call.
1850 - $return in process(PATH_OR_PID).syscall.return gives you the return
1851 value of the system call.
1852
1853 - Target process mode (stap -c CMD or -x PID) now implicitly restricts all
1854 "process.*" probes to the given child process. (It does not affect
1855 kernel.* or other probe types.) The CMD string is normally run directly,
1856 rather than via a /bin/sh -c subshell, since then utrace/uprobe probes
1857 receive a fairly "clean" event stream. If metacharacters like
1858 redirection operators were present in CMD, then "sh -c CMD" is still
1859 used, and utrace/uprobe probes will receive events from the shell.
1860
1861 % stap -e 'probe process.syscall, process.end {
1862 printf("%s %d %s\n", execname(), pid(), pp())}'\
1863 -c ls
1864 ls 2323 process.syscall
1865 ls 2323 process.syscall
1866 ls 2323 process.end
1867
1868 - Probe listing mode is improved: "-L" lists available script-level variables
1869
1870 % stap -L 'syscall.*open*'
1871 syscall.mq_open name:string name_uaddr:long filename:string mode:long u_attr_uaddr:long oflag:long argstr:string
1872 syscall.open name:string filename:string flags:long mode:long argstr:string
1873 syscall.openat name:string filename:string flags:long mode:long argstr:string
1874
1875 - All user-space-related probes support $PATH-resolved executable
1876 names, so
1877
1878 probe process("ls").syscall {}
1879 probe process("./a.out").syscall {}
1880
1881 work now, instead of just
1882
1883 probe process("/bin/ls").syscall {}
1884 probe process("/my/directory/a.out").syscall {}
1885
1886 - Prototype symbolic user-space probing support:
1887
1888 # stap -e 'probe process("ls").function("*").call {
1889 log (probefunc()." ".$$parms)
1890 }' \
1891 -c 'ls -l'
1892
1893 This requires:
1894 - debugging information for the named program
1895 - a version of utrace in the kernel that is compatible with the "uprobes"
1896 kernel module prototype. This includes RHEL5 and older Fedora, but not
1897 yet current lkml-track utrace; a "pass 4a"-time build failure means
1898 your system cannot use this yet.
1899
1900 - Global variables which are written to but never read are now
1901 automatically displayed when the session does a shutdown. For example:
1902
1903 global running_tasks
1904 probe timer.profile {running_tasks[pid(),tid()] = execname()}
1905 probe timer.ms(8000) {exit()}
1906
1907 - A formatted string representation of the variables, parameters, or local
1908 variables at a probe point is now supported via the special $$vars,
1909 $$parms, and $$locals context variables, which expand to a string
1910 containing a list "var1=0xdead var2=0xbeef var3=?". (Here, var3 exists
1911 but is for some reason unavailable.) In return probes only, $$return
1912 expands to an empty string for a void function, or "return=0xf00".
1913
1914
1915 * What's new in version 0.7, 2008-07-15
1916
1917 - .statement("func@file:*") and .statement("func@file:M-N") probes are now
1918 supported to allow matching a range of lines in a function. This allows
1919 tracing the execution of a function.
1920
1921 - Scripts relying on probe point wildcards like "syscall.*" that expand
1922 to distinct kprobes are processed significantly faster than before.
1923
1924 - The vector of script command line arguments is available in a
1925 tapset-provided global array argv[]. It is indexed 1 ... argc,
1926 another global. This can substitute for of preprocessor
1927 directives @NNN that fail at parse time if there are not
1928 enough arguments.
1929
1930 printf("argv: %s %s %s", argv[1], argv[2], argv[3])
1931
1932 - .statement("func@file+line") probes are now supported to allow a
1933 match relative to the entry of the function incremented by line
1934 number. This allows using the same systemtap script if the rest
1935 of the file.c source only changes slightly.
1936
1937 - A probe listing mode is available.
1938 % stap -l vm.*
1939 vm.brk
1940 vm.mmap
1941 vm.munmap
1942 vm.oom_kill
1943 vm.pagefault
1944 vm.write_shared
1945
1946 - More user-space probe types are added:
1947
1948 probe process(PID).begin { }
1949 probe process("PATH").begin { }
1950 probe process(PID).thread.begin { }
1951 probe process("PATH").thread.begin { }
1952 probe process(PID).end { }
1953 probe process("PATH").end { }
1954 probe process(PID).thread.end { }
1955 probe process("PATH").thread.end { }
1956 probe process(PID).syscall { }
1957 probe process("PATH").syscall { }
1958 probe process(PID).syscall.return { }
1959 probe process("PATH").syscall.return { }
1960
1961 - Globals now accept ; terminators
1962
1963 global odds, evens;
1964 global little[10], big[5];
1965
1966 * What's new in version 0.6, 2007-12-15
1967
1968 - A copy of the systemtap tutorial and language reference guide
1969 are now included.
1970
1971 - There is a new format specifier, %m, for the printf family of
1972 functions. It functions like %s, except that it does not stop when
1973 a nul ('\0') byte is encountered. The number of bytes output is
1974 determined by the precision specifier. The default precision is 1.
1975 For example:
1976
1977 printf ("%m", "My String") // prints one character: M
1978 printf ("%.5", myString) // prints 5 bytes beginning at the start
1979 // of myString
1980
1981 - The %b format specifier for the printf family of functions has been enhanced
1982 as follows:
1983
1984 1) When the width and precision are both unspecified, the default is %8.8b.
1985 2) When only one of the width or precision is specified, the other defaults
1986 to the same value. For example, %4b == %.4b == %4.4b
1987 3) Nul ('\0') bytes are used for field width padding. For example,
1988
1989 printf ("%b", 0x1111deadbeef2222) // prints all eight bytes
1990 printf ("%4.2b", 0xdeadbeef) // prints \0\0\xbe\xef
1991
1992 - Dynamic width and precision are now supported for all printf family format
1993 specifiers. For example:
1994
1995 four = 4
1996 two = 2
1997 printf ("%*.*b", four, two, 0xdeadbbeef) // prints \0\0\xbe\xef
1998 printf ("%*d", four, two) // prints <space><space><space>2
1999
2000 - Preprocessor conditional expressions can now include wildcard style
2001 matches on kernel versions.
2002 %( kernel_vr != "*xen" %? foo %: bar %)
2003
2004 - Prototype support for user-space probing is showing some progress.
2005 No symbolic notations are supported yet (so no probing by function names,
2006 file names, process names, and no access to $context variables), but at
2007 least it's something:
2008
2009 probe process(PID).statement(ADDRESS).absolute { }
2010
2011 This will set a uprobe on the given process-id and given virtual address.
2012 The proble handler runs in kernel-space as usual, and can generally use
2013 existing tapset functions.
2014
2015 - Crash utility can retrieve systemtap's relay buffer from a kernel dump
2016 image by using staplog which is a crash extension module. To use this
2017 feature, type commands as below from crash(8)'s command line:
2018
2019 crash> extend staplog.so
2020 crash> help systemtaplog
2021
2022 Then, you can see more precise help message.
2023
2024 - You can share a relay buffer amoung several scripts and merge outputs from
2025 several scripts by using "-DRELAY_HOST" and "-DRELAY_GUEST" options.
2026 For example:
2027
2028 # run a host script
2029 % stap -ve 'probe begin{}' -o merged.out -DRELAY_HOST &
2030 # wait until starting the host.
2031 % stap -ve 'probe begin{print("hello ");exit()}' -DRELAY_GUEST
2032 % stap -ve 'probe begin{print("world\n");exit()}' -DRELAY_GUEST
2033
2034 Then, you'll see "hello world" in merged.out.
2035
2036 - You can add a conditional statement for each probe point or aliase, which
2037 is evaluated when the probe point is hit. If the condition is false, the
2038 whole probe body(including aliases) is skipped. For example:
2039
2040 global switch = 0;
2041 probe syscall.* if (switch) { ... }
2042 probe procfs.write {switch = strtol($value,10)} /* enable/disable ctrl */
2043
2044 - Systemtap will warn you if your script contains unused variables or
2045 functions. This is helpful in case of misspelled variables. If it
2046 doth protest too much, turn it off with "stap -w ...".
2047
2048 - You can add error-handling probes to a script, which are run if a
2049 script was stopped due to errors. In such a case, "end" probes are
2050 not run, but "error" ones are.
2051
2052 probe error { println ("oops, errors encountered; here's a report anyway")
2053 foreach (coin in mint) { println (coin) } }
2054
2055 - In a related twist, one may list probe points in order of preference,
2056 and mark any of them as "sufficient" beyond just "optional". Probe
2057 point sequence expansion stops if a sufficient-marked probe point has a hit.
2058 This is useful for probes on functions that may be in a module (CONFIG_FOO=m)
2059 or may have been compiled into the kernel (CONFIG_FOO=y), but we don't know
2060 which. Instead of
2061
2062 probe module("sd").function("sd_init_command") ? ,
2063 kernel.function("sd_init_command") ? { ... }
2064
2065 which might match neither, now one can write this:
2066
2067 probe module("sd").function("sd_init_command") ! , /* <-- note excl. mark */
2068 kernel.function("sd_init_command") { ... }
2069
2070 - New security model. To install a systemtap kernel module, a user
2071 must be one of the following: the root user; a member of the
2072 'stapdev' group; or a member of the 'stapusr' group. Members of the
2073 stapusr group can only use modules located in the
2074 /lib/modules/VERSION/systemtap directory (where VERSION is the
2075 output of "uname -r").
2076
2077 - .statement("...@file:line") probes now apply heuristics to allow an
2078 approximate match for the line number. This works similarly to gdb,
2079 where a breakpoint placed on an empty source line is automatically
2080 moved to the next statement. A silly bug that made many $target
2081 variables inaccessible to .statement() probes was also fixed.
2082
2083 - LKET has been retired. Please let us know on <systemtap@sourceware.org>
2084 if you have been a user of the tapset/tools, so we can help you find
2085 another way.
2086
2087 - New families of printing functions println() and printd() have been added.
2088 println() is like print() but adds a newline at the end;
2089 printd() is like a sequence of print()s, with a specified field delimiter.
2090
2091 * What's new since version 0.5.14?, 2007-07-03
2092
2093 - The way in which command line arguments for scripts are substituted has
2094 changed. Previously, $1 etc. would interpret the corresponding command
2095 line argument as an numeric literal, and @1 as a string literal. Now,
2096 the command line arguments are pasted uninterpreted wherever $1 etc.
2097 appears at the beginning of a token. @1 is similar, but is quoted as
2098 a string. This change does not modify old scripts, but has the effect
2099 of permitting substitution of arbitrary token sequences.
2100
2101 # This worked before, and still does:
2102 % stap -e 'probe timer.s($1) {}' 5
2103 # Now this also works:
2104 % stap -e 'probe syscall.$1 {log(@1)}' open
2105 # This won't crash, just signal a recursion error:
2106 % stap -e '$1' '$1'
2107 # As before, $1... is recognized only at the beginning of a token
2108 % stap -e 'probe begin {foo$1=5}'
2109
2110 * What's new since version 0.5.13?, 2007-03-26
2111
2112 - The way in which systemtap resolves function/inline probes has changed:
2113 .function(...) - now refers to all functions, inlined or not
2114 .inline(...) - is deprecated, use instead:
2115 .function(...).inline - filters function() to only inlined instances
2116 .function(...).call - filters function() to only non-inlined instances
2117 .function(...).return - as before, but now pairs best with .function().call
2118 .statement() is unchanged.
2119
2120 * What's new since version 0.5.12?, 2007-01-01
2121
2122 - When running in -p4 (compile-only) mode, the compiled .ko file name
2123 is printed on standard output.
2124
2125 - An array element with a null value such as zero or an empty string
2126 is now preserved, and will show up in a "foreach" loop or "in" test.
2127 To delete such an element, the scripts needs to use an explicit
2128 "delete array[idx]" statement rather than something like "array[idx]=0".
2129
2130 - The new "-P" option controls whether prologue searching heuristics
2131 will be activated for function probes. This was needed to get correct
2132 debugging information (dwarf location list) data for $target variables.
2133 Modern compilers (gcc 4.1+) tend not to need this heuristic, so it is
2134 no longer default. A new configure flag (--enable-prologues) restores
2135 it as a default setting, and is appropriate for older compilers (gcc 3.*).
2136
2137 - Each systemtap module prints a one-line message to the kernel informational
2138 log when it starts. This line identifies the translator version, base
2139 address of the probe module, a broken-down memory consumption estimate, and
2140 the total number of probes. This is meant as a debugging / auditing aid.
2141
2142 - Begin/end probes are run with interrupts enabled (but with
2143 preemption disabled). This will allow begin/end probes to be
2144 longer, to support generating longer reports.
2145
2146 - The numeric forms of kernel.statement() and kernel.function() probe points
2147 are now interpreted as relocatable values - treated as relative to the
2148 _stext symbol in that kernel binary. Since some modern kernel images
2149 are relocated to a different virtual address at startup, such addresses
2150 may shift up or down when actually inserted into a running kernel.
2151
2152 kernel.statement(0xdeadbeef): validated, interpreted relative to _stext,
2153 may map to 0xceadbeef at run time.
2154
2155 In order to specify unrelocated addresses, use the new ".absolute"
2156 probe point suffix for such numeric addresses. These are only
2157 allowed in guru mode, and provide access to no $target variables.
2158 They don't use debugging information at all, actually.
2159
2160 kernel.statement(0xfeedface).absolute: raw, unvalidated, guru mode only
2161
2162 * What's new since version 0.5.10?, 2006-10-19
2163
2164 - Offline processing of debugging information, enabling general
2165 cross-compilation of probe scripts to remote hosts, without
2166 requiring identical module/memory layout. This slows down
2167 compilation/translation somewhat.
2168
2169 - Kernel symbol table data is loaded by staprun at startup time
2170 rather than compiled into the module.
2171
2172 - Support the "limit" keyword for foreach iterations:
2173 foreach ([x,y] in ary limit 5) { ... }
2174 This implicitly exits after the fifth iteration. It also enables
2175 more efficient key/value sorting.
2176
2177 - Support the "maxactive" keyword for return probes:
2178 probe kernel.function("sdfsdf").maxactive(848) { ... }
2179 This allows up to 848 concurrently outstanding entries to
2180 the sdfsdf function before one returns. The default maxactive
2181 number is smaller, and can result in missed return probes.
2182
2183 - Support accessing of saved function arguments from within
2184 return probes. These values are saved by a synthesized
2185 function-entry probe.
2186
2187 - Add substantial version/architecture checking in compiled probes to
2188 assert correct installation of debugging information and correct
2189 execution on a compatible kernel.
2190
2191 - Add probe-time checking for sufficient free stack space when probe
2192 handlers are invoked, as a safety improvement.
2193
2194 - Add an optional numeric parameter for begin/end probe specifications,
2195 to order their execution.
2196 probe begin(10) { } /* comes after */ probe begin(-10) {}
2197
2198 - Add an optional array size declaration, which is handy for very small
2199 or very large ones.
2200 global little[5], big[20000]
2201
2202 - Include some example scripts along with the documentation.
2203
2204 - Change the start-time allocation of probe memory to avoid causing OOM
2205 situations, and to abort cleanly if free kernel memory is short.
2206
2207 - Automatically use the kernel DWARF unwinder, if present, for stack
2208 tracebacks.
2209
2210 - Many minor bug fixes, performance, tapset, and error message
2211 improvements.
This page took 0.491421 seconds and 6 git commands to generate.