]> sourceware.org Git - systemtap.git/blob - NEWS
tapset: add fullpath_struct_{nameidata,path}() and probe vfs.open*
[systemtap.git] / NEWS
1 * What's new in version 2.9
2
3 - Embedded-C functions may now use the new STAP_PRINTF(fmt, ...)
4 macro for output.
5
6 - New tapset functions fullname_struct_path and fullname_struct_nameidata
7 resolve full path names from internal kernel struct pointers.
8
9 - New tapset functions arch_bytes() and uarch_bytes() to obtain address size
10 for kernel and user space respectively.
11
12 - New tapset function switch_file() allows control over rotation
13 of output files.
14
15 - The [nd_]syscall tapset got autodocumented. Related paragraph got added to PDF
16 and HTML tapset reference. Also a new tapset::syscall 3stap man page got added.
17
18 - Embedded-C functions with parameter arity-0 can now be marked with
19 the /* stable */ /* pure */ pragmas, if (roughly speaking) the
20 function is side-effect-free and idempotent. The translator may
21 execute these speculatively and have their results memoized. This
22 lets probes with multiple calls to such functions run faster.
23
24 Context variable ($foo) getter functions (in non-guru mode), and
25 numerous tapset functions are now marked as /* stable */ /* pure */.
26 Several example scripts have been modified to eschew explicit
27 memoization.
28
29 - Callee probe points now support '.return' and '.call' suffix.
30 For example,
31
32 process("proc").function("foo").callee("bar").return
33
34 will fire upon returning from bar when called by foo.
35
36 process("proc").function("foo").callee("bar").call
37
38 will only fire for non-inlined callees.
39
40 - The following tapset variables and functions are deprecated in
41 version 2.9:
42 - The '__int32_compat' library macro got deprecated in favor of
43 new '__compat_long' library macro.
44 - The 'uargs' convenience variable of the 'seccomp' syscall probe
45 got deprecated in favor of new 'uargs_uaddr' variable.
46
47 - SystemTap has reduced its memory consumption by using interned_strings (a
48 wrapper for boost::string_ref) in place of std::string instances. The change
49 is to reduce the number of duplicate strings created by replacing them with
50 interned_strings which act like pointers to existing strings.
51
52 For the implementation of interned_string, see stringtable.h
53
54 * What's new in version 2.8, 2015-06-17
55
56 - SystemTap has improved support for probing golang programs. Work has been
57 done to be able to handle DWARF information, reporting file names, line
58 numbers, and column numbers, and tolerance of odd characters in symbol names.
59
60 - The function::*, probe::* and new macro::* man pages cross-references the
61 enclosing tapset::* man page. For example:
62
63 function::pn(3stap) mentions tapset::pn(3stap) in the SEE ALSO section
64
65 - New stapref(1) man page provides a reference for the scripting language. The
66 stapref page contains an overview of the features available in the language,
67 such as keywords, data types, operators and more.
68
69 - The @task macro performs the very common @cast to a task_struct.
70
71 The embedded-C bodies of task_current() and pid2task() are now wrapped
72 by @task, which gives them a debuginfo type on the return value. With
73 autocast type propagation, this removes the need for any explicit @cast
74 in many places.
75
76 Other places which take untyped task pointers as parameters, for
77 instance, now use @task as well to simplify their code.
78
79 - New namespace-aware tapset functions [task_]ns_*() and ia new option
80 --target-namespaces=PID to denote a target set of namespaces corresponding to
81 the PID's namespaces. The namespace-aware tapsets will return values
82 relative to the target namespaces if specified, or the stap process' namespaces.
83
84 - Netfilter probes now attempt to decode Spanning Tree Protocol packets
85 into local variables: probe netfilter.bridge.*, br_* variables,
86 stp_dump.stp sample script.
87
88 - Colorization of error string tokens is made more robust, especially
89 in presence of $N/@N substitution.
90
91 - The following tapset variables and functions are deprecated in
92 version 2.8:
93 - The 'hostname_uaddr' variable in the syscall.setdomainname and
94 nd_syscall.setdomainname probe aliases have been deprecated in
95 favor of the new 'domainname_uaddr' variable.
96 - The 'fd' and 'fd_str' variables in the syscall.execveat and
97 nd_syscall.execveat probe aliases have been deprecated in favor of
98 the new 'dirfd' and 'dirfd_str' variables.
99
100 * What's new in version 2.7, 2015-02-18
101
102 - Some systemtap sample scripts are now identified with the "_best" keyword,
103 because they are generally useful or educational. They are now promoted
104 within the generated index files.
105
106 - Passing strings to and from functions has become faster due to optimization
107 (passing some strings by reference instead of by value/copy). It may
108 be disabled by using the unoptimize flag (-u).
109
110 To make embedded-C functions eligible for the same optimization, use the pragma
111 /* unmodified-fnargs */ to indicate that the function body will not modify
112 the function arguments. Remember to use MAXSTRINGLEN for string length,
113 rather than sizeof(string_arg) (which might now be a pointer).
114
115 - SystemTap now allows .function probes to be specified by their full function
116 name, file, and declaration line number. Use the .statement probe to probe a
117 specific line number.
118
119 - Tracepoint probes can now also be specified by the target subsystem. For
120 example, the following are all supported:
121
122 probe kernel.trace("sched:sched_switch") --> probe sched_switch found in the
123 sched subsystem
124 probe kernel.trace("sched:*") --> probe all tracepoints in sched subsystem
125
126 As a result, tapset functions such as pn() will now return a different string
127 than before. To retain the previous behaviour, use '--compatible=2.6'.
128
129 - The following functions are deprecated in release 2.7:
130 - _adjtx_mode_str(), _statfs_f_type_str(), _waitid_opt_str(),
131 _internal_wait_opt_str(), and _epoll_events_str().
132
133 - New tapset functions [u]symfileline(), [u]symfile() and [u]symline() will
134 return a string containing the specified portion of the filename:linenumber
135 match from a given address.
136
137 Using these functions may result in large generated modules from stored
138 address->file:line information.
139
140 * What's new in version 2.6, 2014-09-05
141
142 - SystemTap now supports on-the-fly arming/disarming of certain probe types:
143 kprobes, uprobes, and timer.*s(NUM) probes. For example, this probe
144
145 probe kernel.function("vfs_read") if (i > 4) { ... }
146
147 will automatically register/unregister the associated kprobe on vfs_read
148 whenever the value of the condition changes (as some probe handler
149 modifies 'i'). This allows us to avoid probe overhead when we're not
150 interested. If the arming capability is not relevant/useful, nest the
151 condition in the normal probe handler:
152
153 probe kernel.function("vfs_read") { if (i > 4) { ... } }
154
155 - statement("*@file:NNN").nearest probes now available to let systemtap
156 translate probe to nearest probe-able line to one given if necessary
157
158 - process("PATH").library("PATH").plt("NAME").return probes are now supported.
159
160 - SystemTap now supports SDT probes with operands that refer to symbols.
161
162 - While in listing mode (-l/-L), probes printed are now more consistent
163 and precise.
164
165 - Statement probes now support enumerated linenos to probe discontiguous
166 linenos using the form:
167
168 process.statement("foo@file.c:3,5-7,9")
169
170 - Statement counting is now suppressed in the generated c code for probes that
171 are non-recursive and loop-free. Statement counting can be turned back on in
172 unoptimize mode (-u).
173
174 - SystemTap now asserts that the PID provided for a process probe corresponds
175 to a running process.
176
177 - DWARF process probes can be bound to a specific process using the form:
178
179 process(PID).function("*")
180
181 - SystemTap now accepts additional scripts through the new -E SCRIPT option.
182 There still needs to be a main script specified through -e or file in order
183 to provide an additional script. This makes it feasible to have scripts in
184 the $HOME/.systemtap/rc file. For example:
185
186 -E 'probe begin, end, error { log("systemtap script " . pn()) }'
187 -E 'probe timer.s(30) { error ("timeout") }
188
189 The -E SCRIPT option can also be used in listing mode (-l/-L), such that
190 probe points for the additional scripts will not listed, but other parts of
191 the script are still available, such as macros or aliases.
192
193 - SystemTap now supports array slicing within foreach loop conditions, delete
194 statements and membership tests. Wildcards are represented by "*". Examples
195 of the expressions are:
196
197 foreach ([a,b,c] in val[*,2,*])
198 delete val[*, 2, *]
199 [*, 2, *] in val
200
201 - Integer expressions which are derived from DWARF values, like context $vars,
202 @cast, and @var, will now carry that type information into subsequent reads.
203 Such expressions can now use "->" and "[]" operators, as can local variables
204 which were assigned such values.
205
206 foo = $param->foo; printf("x:%d y:%d\n", foo->x, foo->y)
207 printf("my value is %d\n", ($type == 42 ? $foo : $bar)->value)
208 printf("my parent pid is %d\n", task_parent(task_current())->tgid)
209
210 * What's new in version 2.5, 2014-04-30
211
212 - Systemtap now supports backtracing through its own, invoking module.
213
214 - Java probes now support backtracing using the print_java_backtrace()
215 and sprint_java_backtrace() functions.
216
217 - Statement probes (e.g. process.statement) are now faster to resolve,
218 more precise, and work better with inlined functions.
219
220 - New switches have been added to help inspect the contents of installed
221 library files:
222
223 stap --dump-functions --> list all library functions and their args
224 stap --dump-probe-aliases --> list all library probe aliases
225
226 - The heuristic algorithms used to search for function-prologue
227 endings were improved, to cover more optimization (or
228 lack-of-optimization, or incorrect-debuginfo) cases. These
229 heuristics are necessary to find $context parameters for some
230 function-call/entry probes. We recommend programs be built with
231 CFLAGS+=-grecord-gcc-switches to feed information to the heuristics.
232
233 - The stap --use-server option now more correctly supports address:port
234 type parametrization, for manual use in the absence of avahi.
235
236 - A new probe alias "oneshot" allows a single quick script fragment to run,
237 then exit.
238
239 - The argv tapset now merges translate-time and run-time positional
240 arguments, so all of these work:
241
242 stap -e 'probe oneshot {println(argv[1]," ",argv[2])}' hello world
243
244 stap -e 'probe oneshot {println(argv[1]," ",argv[2])}' \
245 -G argv_1=hello -G argv_2=world
246
247 staprun hello.ko argv_1=hello argv_2=world
248
249 - SystemTap now falls back on the symbol table for probing
250 functions in processes if the debuginfo is not available.
251
252 - SystemTap now supports a %( guru_mode == 0 /* or 1 */ %)
253 conditional for making dual-use scripts.
254
255 - SystemTap now supports UEFI/SecureBoot systems, via
256 machine-owner-keys maintained by a trusted stap-server on the
257 network. (Key enrollment requires a one-time reboot and BIOS
258 conversation.)
259 https://sourceware.org/systemtap/wiki/SecureBoot
260
261 - SystemTap now reports more accurate and succinct errors on type
262 mismatches.
263
264 - Embedded-C functions may use STAP_RETURN(value) instead of the
265 more wordy STAP_RETVALUE assignment followed by a "goto out".
266 The macro supports numeric or string values as appropriate.
267 STAP_ERROR(...) is available to return with a (catchable) error.
268
269 - Some struct-sockaddr fields are now individually decoded for
270 socket-related syscalls:
271 probe syscall.connect { println (uaddr_af, ":", uaddr_ip) }
272
273 - The documentation for the SystemTap initscript service and the
274 SystemTap compile-server service have been completely converted from
275 README files to man pages (see systemtap(8) and stap-server(8)).
276
277 - SystemTap is now capable of inserting modules early during the boot
278 process on dracut-based systems. See the 'onboot' command in
279 systemtap(8) for more information.
280
281 - DWARF probes can now use the '.callee[s]' variants, which allow more
282 precise function probing. For example, the probe point
283
284 process("myproc").function("foo").callee("bar")
285
286 will fire upon entering bar() from foo(). A '.callees' probe will
287 instead place probes on all callees of foo().
288 Note that this also means that probe point wildcards should be used
289 with more care. For example, use signal.*.return rather than
290 signal.*.*, which would also match '.callees'. See stapprobes(3stap)
291 for more info. This feature requires at least GCC 4.7.
292
293 - A few new functions in the task_time tapsets, as well as a new tapset
294 function task_ancestry(), which prints out the parentage of a process.
295
296 - The kprocess.exec probe has been updated to use syscall.execve, which
297 allows access to the new process' arguments (through the new 'argstr'
298 or 'args' variables) as well as giving better support across kernel
299 versions. Note also that the 'filename' variable now holds the
300 filename (quoted), or the address (unquoted) if it couldn't be
301 retrieved.
302
303 - The [s]println() function can now be called without any arguments to
304 simply print a newline.
305
306 - Suggestions are now provided when markers could not be resolved. For
307 example, process("stap").mark("benchmart") will suggest 'benchmark'.
308
309 - SystemTap colors can now be turned off by simply setting
310 SYSTEMTAP_COLORS to be empty, rather than having to make it invalid.
311
312 - There is a new context tapset function, pnlabel(), which returns the
313 name of the label which fired.
314
315 - The following tapset variables and functions are deprecated in
316 release 2.5:
317 - The 'clone_flags', 'stack_start', 'stack_size',
318 'parent_tid_uaddr', and 'child_tid_uaddr' variables in the
319 'syscall.fork' and 'nd_syscall.fork' probe aliases.
320 - The '_sendflags_str()' and '_recvflags_str()' functions have been
321 deprecated in favor of the new '_msg_flags_str()' function.
322 - The 'flags' and 'flags_str' variables in the 'syscall.accept' and
323 'nd_syscall.accept' probe alias.
324 - The 'first', 'second', and 'uptr_uaddr' variables in the
325 'syscall.compat_sys_shmctl', and 'nd_syscall.compat_sys_shmctl'
326 probe aliases have been deprecated in favor of the new 'shmid',
327 'cmd', and 'buf_uaddr' variables.
328
329 * What's new in version 2.4, 2013-11-06
330
331 - Better suggestions are given in many of the semantic errors in which
332 alternatives are provided. Additionally, suggestions are now provided
333 when plt and trace probes could not be resolved. For example,
334 kernel.trace("sched_siwtch") will suggest 'sched_switch'.
335
336 - SystemTap is now smarter about error reporting. Errors from the same
337 source are considered duplicates and suppressed. A message is
338 displayed on exit if any errors/warnings were suppressed.
339
340 - Statistics aggregate typed objects are now implemented locklessly,
341 if the translator finds that they are only ever read (using the
342 foreach / @count / etc. constructs) in a probe-begin/end/error.
343
344 - SystemTap now supports probing inside virtual machines using the
345 libvirt and unix schemes, e.g.
346
347 stap -ve 'probe timer.s(1) { printf("hello!\n") }' \
348 --remote=libvirt://MyVirtualMachine
349
350 Virtual machines managed by libvirt can be prepared using stapvirt.
351 See stapvirt(1) and the --remote option in stap(1) for more details.
352
353 - Systemtap now checks for and uses (when available) the .gnu_debugdata
354 section which contains a subset of debuginfo, useful for backtraces
355 and function probing
356
357 - SystemTap map variables are now allocated with vmalloc() instead of
358 with kmalloc(), which should cause memory to be less fragmented.
359
360 - Although SystemTap itself requires elfutils 0.148+, staprun only
361 requires elfutils 0.142+, which could be useful with the
362 '--disable-translator' configure switch.
363
364 - Under FIPS mode (/proc/sys/crypto/fips_enabled=1), staprun will
365 refuse to load systemtap modules (since these are not normally
366 signed with the kernel's build-time keys). This protection may
367 be suppressed with the $STAP_FIPS_OVERRIDE environment variable.
368
369 - The stap-server client & server code now enable all SSL/TLS
370 ciphers rather than just the "export" subset.
371
372 - For systems with in-kernel utrace, 'process.end' and 'thread.end'
373 probes will hit before the target's parent process is notified of
374 the target's death. This matches the behavior of newer kernels
375 without in-kernel utrace.
376
377 * What's new in version 2.3, 2013-07-25
378
379 - More context-accessing functions throw systemtap exceptions upon a
380 failure, whereas in previous versions they might return non-error
381 sentinel values like "" or "<unknown>". Use try { } / catch { }
382 around these, or new wrapper functions such as user_string_{n_}quoted()
383 that internally absorb exceptions.
384
385 - java("org.my.MyApp") probes are now restricted to pre-existing jvm pid's with
386 a listing in jps -l output to avoid recursive calls
387
388 - The tapset [nd_]syscall.semop parameter tsops_uaddr is renamed sops_uaddr for
389 consistency with [nd_]syscall.semtimedop.
390
391 - The udp.stp tapset adds some ip-address/port variables.
392
393 - A new guru-mode-only tapset function raise() is available to send signals
394 to the current task.
395
396 - Support for the standard Posix ERE named character classes has been
397 added to the regexp engine, e.g. [:digit:], [:alpha:], ...
398
399 - A substantial internal overhaul of the regexp engine has resulted in
400 correct behaviour on further obscure edge cases. The regexp engine
401 now implements the ERE standard and correctly passes the testsuite
402 for the glibc regexp engine (minus portions corresponding to
403 unimplemented features -- i.e. subexpression capture and reuse).
404
405 - Alternative functions are now suggested when function probes could not be
406 resolved. For example, kernel.function("vfs_reads") will suggest vfs_read.
407 Other probes for which suggestions are made are module.function,
408 process.function, and process.library.function.
409
410 - Has life been a bit bland lately? Want to spice things up? Why not write a
411 few faulty probes and feast your eyes upon the myriad of colours adorning
412 your terminal as SystemTap softly whispers in your ear... 'parse error'.
413 Search for '--color' in 'man stap' for more info.
414
415 - The following tapset functions are deprecated in release 2.3:
416 'stap_NFS_CLIENT', '__getfh_inode', '_success_check',
417 '_sock_prot_num', '_sock_fam_num', '_sock_state_num',
418 '_sock_type_num', and '_sock_flags_num'.
419
420 * What's new in version 2.2.1, 2013-05-16
421 * What's new in version 2.2, 2013-05-14
422
423 - Experimental support has been added for probing Java methods using
424 Byteman 2.0 as a backend. Java method probes can target method entries,
425 returns, or specific statements in the method as specified by line number.
426
427 probe java("org.my.MyApp").class("^java.lang.Object").method("foo(int)")
428 { println($$parms) }
429
430 See java/README for information on how to set up Java/Byteman
431 functionality. Set env STAPBM_VERBOSE=yes for more tracing.
432
433 - The stap -l output and pn() tapset function's return value may be slightly
434 different for complicated web of wildcarded/aliased probes.
435
436 - The dyninst backend has improved in several aspects:
437
438 - Setting custom values for global variables is now supported, both
439 with -G when compiling a script, and from the stapdyn command line
440 when loading a precompiled module.
441
442 - A high-performance shared-memory-based transport is used for
443 trace data.
444
445 - A systemd service file and tmpfile have been added to allow
446 systemtap-server to be managed natively by systemd.
447
448 - Due to the removal of register_timer_hook in recent kernels, the
449 behaviour of timer.profile has been changed slightly. This probe is
450 now an alias which uses the old mechanism where possible, but falls
451 back to perf.sw.cpu_clock or another mechanism when the kernel timer
452 hook is not available.
453
454 To require the kernel timer hook mechanism in your script, use
455 timer.profile.tick instead of timer.profile.
456
457 - The following tapset variables are deprecated in release 2.2:
458 - The 'origin' variables in the 'generic.fop.llseek',
459 'generic.fop.llseek.return', and 'nfs.fop.llseek' probes. The
460 'origin' variable has been replaced by the 'whence' variable.
461 - The 'page_index' variable in the 'vfs.block_sync_page' and
462 'vfs.buffer_migrate_page' probe aliases.
463 - The 'write_from' and 'write_upto' variables in the
464 '_vfs.block_prepare_write' and '_vfs.block_prepare_write.return'
465 probe aliases.
466 - The 'regs' variable in the 'syscall.sigaltstack',
467 'nd_syscall.sigaltstack', 'syscall.fork', and 'nd_syscall.fork'
468 probe aliases.
469 - The 'first', 'second', 'third', and 'uptr_uaddr' variables in the
470 'syscall.compat_sys_shmat' and 'nd_syscall.compat_sys_shmat' probe
471 aliases.
472
473 - The following tapset functions are deprecated in release 2.2:
474 'ppos_pos', '_dev_minor', and '_dev_major'
475
476 - The folowing tapset functions used to return error strings instead
477 of raising an error. The original behavior is deprecated in release
478 2.2.
479
480 'ctime', 'probemod', 'modname'
481
482 * What's new in version 2.1, 2013-02-13
483
484 - EMACS and VIM editor modes for systemtap source files are included / updated.
485
486 - The translator now eliminates duplicate tapset files between its
487 preferred directory (as configured during the build with --prefix=/
488 or specified with the -I /path option), and files it may find under
489 $XDG_DATA_DIRS. This should eliminate a class of conflicts between
490 parallel system- and hand-built systemtap installations.
491
492 - The translator accepts a --suppress-time-limits option, which defeats
493 time-related constraints, to allows probe handlers to run for indefinite
494 periods. It requires the guru mode (-g) flag to work. Add the earlier
495 --suppress-handler-errors flag for a gung-ho "just-keep-going" attitude.
496
497 - Perf event probes may now be read on demand. The counter probe is
498 defined using the counter-name part:
499 probe perf.type(0).config(0).counter("NAME"). The counter is
500 read in a user space probe using @perf("NAME"), e.g.
501 process("PROCESS").statement("func@file") {stat <<< @perf("NAME")}
502
503 - Perf event probes may now be bound to a specific task using the
504 process-name part: probe perf.type(0).config(0).process("NAME") { }
505 If the probed process name is not specified, then it is inferred
506 from the -c CMD argument.
507
508 - Some error messages and warnings now refer to additional information
509 that is found in man pages. These are generally named
510 error::FOO or warning::BAR (in the 7stap man page section)
511 and may be read via
512 % man error::FOO
513 % man warning::BAR
514
515 - The dyninst backend has improved in several aspects:
516 - The runtime now allows much more concurrency when probing multithreaded
517 processes, and will also follow probes across forks.
518 - Several new probe types are now supported, including timers, function
519 return, and process.begin/end and process.thread.begin/end.
520 - Semaphores for SDT probes are now set properly.
521 - Attaching to existing processes with -x PID now works.
522
523 - The foreach looping construct can now sort aggregate arrays by the user's
524 choice of aggregating function. Previously, @count was implied. e.g.:
525 foreach ([x,y] in array @sum +) { println(@sum(array[x,y])) }
526
527 - Proof of concept support for regular expression matching has been added:
528 if ("aqqqqqb" =~ "q*b") { ... }
529 if ("abc" !~ "q*b") { ... }
530
531 The eventual aim is to support roughly the same functionality as
532 the POSIX Extended Regular Expressions implemented by glibc.
533 Currently missing features include extraction of the matched string
534 and subexpressions, and named character classes ([:alpha:], [:digit:], &c).
535
536 Special thanks go to the re2c project, whose public domain code this
537 functionality has been based on. For more info on re2c, see:
538 http://sourceforge.net/projects/re2c/
539
540 - The folowing tapset variables are deprecated in release 2.1 and will
541 be removed in release 2.2:
542 - The 'send2queue' variable in the 'signal.send' probe.
543 - The 'oldset_addr' and 'regs' variables in the 'signal.handle' probe.
544
545 - The following tapset probes are deprecated in release 2.1 and will
546 be removed in release 2.2:
547 - signal.send.return
548 - signal.handle.return
549
550 * What's new in version 2.0, 2012-10-09
551
552 - Systemtap includes a new prototype backend, which uses Dyninst to instrument
553 a user's own processes at runtime. This backend does not use kernel modules,
554 and does not require root privileges, but is restricted with respect to the
555 kinds of probes and other constructs that a script may use.
556
557 Users from source should configure --with-dyninst and install a
558 fresh dyninst snapshot such as that in Fedora rawhide. It may be
559 necessary to disable conflicting selinux checks; systemtap will advise.
560
561 Select this new backend with the new stap option --runtime=dyninst
562 and a -c target process, along with normal options. (-x target
563 processes are not supported in this prototype version.) For example:
564
565 stap --runtime=dyninst -c 'stap -l begin' \
566 -e 'probe process.function("main") { println("hi from dyninst!") }'
567
568 - To aid diagnosis, when a kernel panic occurs systemtap now uses
569 the panic_notifier_list facility to dump a summary of its trace
570 buffers to the serial console.
571
572 - The systemtap preprocessor now has a simple macro facility as follows:
573
574 @define add(a,b) %( ((@a)+(@b)) %)
575 @define probegin(x) %(
576 probe begin {
577 @x
578 }
579 %)
580
581 @probegin( foo = @add(40, 2); print(foo) )
582
583 Macros defined in the user script and regular tapset .stp files are
584 local to the file. To get around this, the tapset library can define
585 globally visible 'library macros' inside .stpm files. (A .stpm file
586 must contain a series of @define directives and nothing else.)
587
588 The status of the feature is experimental; semantics of macroexpansion
589 may change (unlikely) or expand in the future.
590
591 - Systemtap probe aliases may be used with additional suffixes
592 attached. The suffixes are passed on to the underlying probe
593 point(s) as shown below:
594
595 probe foo = bar, baz { }
596 probe foo.subfoo.option("gronk") { }
597 // expands to: bar.subfoo.option("gronk"), baz.subfoo.option("gronk")
598
599 In practical terms, this allows us to specify additional options to
600 certain tapset probe aliases, by writing e.g.
601 probe syscall.open.return.maxactive(5) { ... }
602
603 - To support the possibility of separate kernel and dyninst backends,
604 the tapsets have been reorganized into separate folders according to
605 backend. Thus kernel-specific tapsets are located under linux/, the
606 dyninst-specific ones under dyninst/
607
608 - The backtrace/unwind tapsets have been expanded to allow random
609 access to individual elements of the backtrace. (A caching mechanism
610 ensures that the backtrace computation run at most once for each
611 time a probe fires, regardless of how many times or what order the
612 query functions are called in.) New tapset functions are:
613 stack/ustack - return n'th element of backtrace
614 callers/ucallers - return first n elements of backtrace
615 print_syms/print_usyms - print full information on a list of symbols
616 sprint_syms/sprint_usyms - as above, but return info as a string
617
618 The following existing functions have been superseded by print_syms()
619 et al.; new scripts are recommended to avoid using them:
620 print_stack()
621 print_ustack()
622 sprint_stack()
623 sprint_ustack()
624
625 - The probefunc() tapset function is now myproc-unprivileged, and can
626 now be used in unprivileged scripts for such things as profiling in
627 userspace programs. For instance, try running
628 systemtap.examples/general/para-callgraph.stp in unprivileged mode
629 with a stapusr-permitted probe. The previous implementation of
630 probefunc() is available with "stap --compatible=1.8".
631
632 - Preprocessor conditional to vary code based on script privilege level:
633 unprivileged -- %( systemtap_privilege == "stapusr" %? ... %)
634 privileged -- %( systemtap_privilege != "stapusr" %? ... %)
635 or, alternately %( systemtap_privilege == "stapsys"
636 || systemtap_privilege == "stapdev" %? ... %)
637
638 - To ease migration to the embedded-C locals syntax introduced in 1.8
639 (namely, STAP_ARG_* and STAP_RETVALUE), the old syntax can now be
640 re-enabled on a per-function basis using the /* unmangled */ pragma:
641
642 function add_foo:long(a:long, b:long) %{ /* unmangled */
643 THIS->__retvalue = THIS->a + STAP_ARG_b;
644 %}
645
646 Note that both the old and the new syntax may be used in an
647 /* unmangled */ function. Functions not marked /* unmangled */
648 can only use the new syntax.
649
650 - Adjacent string literals are now glued together irrespective of
651 intervening whitespace or comments:
652 "foo " "bar" --> "foo bar"
653 "foo " /* comment */ "bar" --> "foo bar"
654 Previously, the first pair of literals would be glued correctly,
655 while the second would cause a syntax error.
656
657 * What's new in version 1.8, 2012-06-17
658
659 - staprun accepts a -T timeout option to allow less frequent wake-ups
660 to poll for low-throughput output from scripts.
661
662 - When invoked by systemtap, the kbuild $PATH environment is sanitized
663 (prefixed with /usr/bin:/bin:) in an attempt to exclude compilers
664 other than the one the kernel was presumed built with.
665
666 - Printf formats can now use "%#c" to escape non-printing characters.
667
668 - Pretty-printed bitfields use integers and chars use escaped formatting
669 for printing.
670
671 - The systemtap compile-server and client now support IPv6 networks.
672 - IPv6 addresses may now be specified on the --use-server option and will
673 be displayed by --list-servers, if the avahi-daemon service is running and
674 has IPv6 enabled.
675 - Automatic server selection will automatically choose IPv4 or IPv6 servers
676 according to the normal server selection criteria when avahi-daemon is
677 running. One is not preferred over the other.
678 - The compile-server will automatically listen on IPv6 addresses, if
679 available.
680 - To enable IPv6 in avahi-daemon, ensure that /etc/avahi/avahi-daemon.conf
681 contains an active "use-ipv6=yes" line. After adding this line run
682 "service avahi-daemon restart" to activate IPv6 support.
683 - See man stap(1) for details on how to use IPv6 addresses with the
684 --use-server option.
685
686 - Support for DWARF4 .debug_types sections (for executables and shared
687 libraries compiled with recent GCC's -gdwarf-4 / -fdebug-types-section).
688 PR12997. SystemTap now requires elfutils 0.148+, full .debug_types support
689 depends on elfutils 0.154+.
690
691 - Systemtap modules are somewhat smaller & faster to compile. Their
692 debuginfo is now suppressed by default; use -B CONFIG_DEBUG_INFO=y to
693 re-enable.
694
695 - @var now an alternative language syntax for accessing DWARF variables
696 in uprobe and kprobe handlers (process, kernel, module). @var("somevar")
697 can be used where $somevar can be used. The @var syntax also makes it
698 possible to access non-local, global compile unit (CU) variables by
699 specifying the CU source file as follows @var("somevar@some/src/file.c").
700 This will provide the target variable value of global "somevar" as defined
701 in the source file "some/src/file.c". The @var syntax combines with all
702 normal features of DWARF target variables like @defined(), @entry(),
703 [N] array indexing, field access through ->, taking the address with
704 the & prefix and shallow or deep pretty printing with a $ or $$ suffix.
705
706 - Stap now has resource limit options:
707 --rlimit-as=NUM
708 --rlimit-cpu=NUM
709 --rlimit-nproc=NUM
710 --rlimit-stack=NUM
711 --rlimit-fsize=NUM
712 All resource limiting has been moved from the compile server to stap
713 itself. When running the server as "stap-server", default resource
714 limit values are specified in ~stap-server/.systemtap/rc.
715
716 - Bug CVE-2012-0875 (kernel panic when processing malformed DWARF unwind data)
717 is fixed.
718
719 - The systemtap compile-server now supports multiple concurrent connections.
720 Specify the desired maximum number of concurrent connections with
721 the new stap-server/stap-serverd --max-threads option. Specify a
722 value of '0' to tell the server not to spawn any new threads (handle
723 all connections serially in the main thread). The default value is
724 the number of processor cores on the host.
725
726 - The following tapset functions are deprecated in release 1.8 and will be
727 removed in release 1.9:
728 daddr_to_string()
729
730 - SystemTap now mangles local variables to avoid collisions with C
731 headers included by tapsets. This required a change in how
732 embedded-C functions access local parameters and the return value slot.
733
734 Instead of THIS->foo in an embedded-C function, please use the newly
735 defined macro STAP_ARG_foo (substitute the actual name of the
736 argument for 'foo'); instead of THIS->__retvalue, use the newly
737 defined STAP_RETVALUE. All of the tapsets and test cases have been
738 adapted to use this new notation.
739
740 If you need to run code which uses the old THIS-> notation, run stap
741 with the --compatible=1.7 option.
742
743 - There is updated support for user-space probing against kernels >=
744 3.5, which have no utrace but do have the newer inode-uprobes work
745 by Srikar Dronamraju and colleagues. For kernels < 3.5, the
746 following 3 sets of kernel patches would need to be backported to
747 your kernel to use this preliminary user-space probing support:
748
749 - inode-uprobes patches:
750 - 2b144498350860b6ee9dc57ff27a93ad488de5dc
751 - 7b2d81d48a2d8e37efb6ce7b4d5ef58822b30d89
752 - a5f4374a9610fd7286c2164d4e680436727eff71
753 - 04a3d984d32e47983770d314cdb4e4d8f38fccb7
754 - 96379f60075c75b261328aa7830ef8aa158247ac
755 - 3ff54efdfaace9e9b2b7c1959a865be6b91de96c
756 - 35aa621b5ab9d08767f7bc8d209b696df281d715
757 - 900771a483ef28915a48066d7895d8252315607a
758 - e3343e6a2819ff5d0dfc4bb5c9fb7f9a4d04da73
759 - exec tracepoint kernel patch:
760 - 4ff16c25e2cc48cbe6956e356c38a25ac063a64d
761 - task_work_add kernel patches:
762 - e73f8959af0439d114847eab5a8a5ce48f1217c4
763 - 4d1d61a6b203d957777d73fcebf19d90b038b5b2
764 - 413cd3d9abeaef590e5ce00564f7a443165db238
765 - dea649b8ac1861107c5d91e1a71121434fc64193
766 - f23ca335462e3c84f13270b9e65f83936068ec2c
767
768 * What's new in version 1.7, 2012-02-01
769
770 - Map inserting and deleting is now significantly faster due to
771 improved hashing and larger hash tables. The hashes are also
772 now randomized to provide better protection against deliberate
773 collision attacks.
774
775 - Formatted printing is faster by compiling the formatting directives
776 to C code rather than interpreting at run time.
777
778 - Systemtap loads extra command line options from $SYSTEMTAP_DIR/rc
779 ($HOME/.systemtap/rc by default) before the normal argc/argv. This
780 may be useful to activate site options such as --use-server or
781 --download-debuginfo or --modinfo.
782
783 - The stap-server has seen many improvements, and is no longer considered
784 experimental.
785
786 - The stap-server service (initscript) now supports four new options:
787 -D MACRO[=VALUE]
788 --log LOGFILE
789 --port PORT-NUMBER
790 --SSL CERT-DATABASE
791 These allow the specification of macro definitions to be passed to stap
792 by the server, the location of the log file, network port number and
793 NSS certificate database location respectively. These options are also
794 supported within individual server configuration files. See stap-server
795 and initscript/README.stap-server for details. The stap-server is no
796 longer activated by default.
797
798 - process("PATH").[library("PATH")].function("NAME").exported probes are now
799 supported to filter function() to only exported instances.
800
801 - The translator supports a new --suppress-handler-errors option, which
802 causes most runtime errors to be turned into quiet skipped probes. This
803 also disables the MAXERRORS and MAXSKIPPED limits.
804
805 - Translator warnings have been standardized and controlled by the -w / -W
806 flags.
807
808 - The translator supports a new --modinfo NAME=VALUE option to emit additional
809 MODULE_INFO(n,v) macros into the generated code.
810
811 - There is no more fixed maximum number of VMA pages that will be tracked
812 at runtime. This reduces memory use for those scripts that don't need any,
813 or only limited target process VMA tracking and allows easier system
814 wide probes inspecting shared library variables and/or user backtraces.
815 stap will now silently ignore -DTASK_FINDER_VMA_ENTRY_ITEMS.
816
817 - The tapset functions remote_id() and remote_uri() identify the member of a
818 swarm of "stap --remote FOO --remote BAR baz.stp" concurrent executions.
819
820 - Systemtap now supports a new privilege level and group, "stapsys", which
821 is equivalent to the privilege afforded by membership in the group "stapdev",
822 except that guru mode (-g) functionality may not be used. To support this, a
823 new option, --privilege=[stapusr|stapsys|stapdev] has been added.
824 --privilege=stapusr is equivalent to specifying the existing --unprivileged
825 option. --privilege=stapdev is the default. See man stap(1) for details.
826
827 - Scripts that use kernel.trace("...") probes compile much faster.
828
829 - The systemtap module cache is cleaned less frequently, governed by the
830 number of seconds in the $SYSTEMTAP_DIR/cache/cache_clean_interval_s file.
831
832 - SDT can now define up to 12 arguments in a probe point.
833
834 - Parse errors no longer generate a cascade of false errors. Instead, a
835 parse error skips the rest of the current probe or function, and resumes
836 at the next one. This should generate fewer and better messages.
837
838 - Global array wrapping is now supported for both associative and statistics typed
839 arrays using the '%' character to signify a wrapped array. For example,
840 'global foo%[100]' would allow the array 'foo' to be wrapped if more than 100
841 elements are inserted.
842
843 - process("PATH").library("PATH").plt("NAME") probes are now supported.
844 Wildcards are supported in the plt-name part, to refer to any function in the
845 program linkage table which matches the glob pattern and the rest of the
846 probe point.
847
848 - A new option, --dump-probe-types, will dump a list of supported probe types.
849 If --unprivileged is also specified, the list will be limited to probe types
850 which are available to unprivileged users.
851
852 - Systemtap can now automatically download the required debuginfo
853 using abrt. The --download-debuginfo[=OPTION] can be used to
854 control this feature. Possible values are: 'yes', 'no', 'ask',
855 and a positive number representing the timeout desired. The
856 default behavior is to not automatically download the debuginfo.
857
858 - The translator has better support for probing C++ applications by
859 better undertanding of compilation units, nested types, templates,
860 as used in probe point and @cast constructs.
861
862 - On 2.6.29+ kernels, systemtap can now probe kernel modules that
863 arrive and/or depart during the run-time of a session. This allows
864 probing of device driver initialization functions, which had formerly been
865 blacklisted.
866
867 - New tapset functions for cpu_clock and local_clock access were added.
868
869 - There is some limited preliminary support for user-space probing
870 against kernels such as linux-next, which have no utrace but do have
871 the newer inode-uprobes work by Srikar Dronamraju and colleagues.
872
873 - The following probe types are deprecated in release 1.7 and will be
874 removed in release 1.8:
875 kernel.function(number).inline
876 module(string).function(number).inline
877 process.function(number).inline
878 process.library(string).function(number).inline
879 process(string).function(number).inline
880 process(string).library(string).function(number).inline
881
882 - The systemtap-grapher is deprecated in release 1.7 and will be removed in
883 release 1.8.
884
885 - The task_backtrace() tapset function was deprecated in 1.6 and has been
886 removed in 1.7.
887
888 - MAXBACKTRACE did work in earlier releases, but has now been documented
889 in the stap 1 manual page.
890
891 - New tapset function probe_type(). Returns a short string describing
892 the low level probe handler type for the current probe point.
893
894 - Both unwind and symbol data is now only collected and emitted for
895 scripts actually using backtracing or function/data symbols.
896 Tapset functions are marked with /* pragma:symbols */ or
897 /* pragma:unwind */ to indicate they need the specific data.
898
899 - Kernel backtraces can now be generated for non-pt_regs probe context
900 if the kernel support dump_trace(). This enables backtraces from
901 certain timer probes and tracepoints.
902
903 - ubacktrace() should now also work for some kernel probes on x86 which can
904 use the dwarf unwinder to recover the user registers to provide
905 more accurate user backtraces.
906
907 - For s390x the systemtap runtime now properly splits kernel and user
908 addresses (which are in separate address spaces on that architecture)
909 which enable user space introspection.
910
911 - ppc and s390x now supports user backtraces through the DWARF unwinder.
912
913 - ppc now handles function descriptors as symbol names correctly.
914
915 - arm support kernel backtraces through the DWARF unwinder.
916
917 - arm now have a uprobes port which enables user probes. This still
918 requires some kernel patches (user_regsets and tracehook support for
919 arm).
920
921 - Starting in release 1.7, these old variables will be deprecated:
922 - The 'pid' variable in the 'kprocess.release' probe has been
923 deprecated in favor of the new 'released_pid' variable.
924 - The 'args' variable in the
925 '_sunrpc.clnt.create_client.rpc_new_client_inline' probe has been
926 deprecated in favor of the new internal-only '__args' variable.
927
928 - Experimental support for recent kernels without utrace has been
929 added for the following probe types:
930
931 process(PID).begin
932 process("PATH").begin
933 process.begin
934 process(PID).thread.begin
935 process("PATH").thread.begin
936 process.thread.begin
937 process(PID).end
938 process("PATH").end
939 process.end
940 process(PID).thread.end
941 process("PATH").thread.end
942 process.thread.end
943 process(PID).syscall
944 process("PATH").syscall
945 process.syscall
946 process(PID).syscall.return
947 process("PATH").syscall.return
948 process.syscall.return
949
950 - staprun disables kprobe-optimizations in recent kernels, as problems
951 were found. (PR13193)
952
953 * What's new in version 1.6, 2011-07-25
954
955 - Security fixes for CVE-2011-2503: read instead of mmap to load modules,
956 CVE-2011-2502: Don't allow path-based auth for uprobes
957
958 - The systemtap compile-server no longer uses the -k option when calling the
959 translator (stap). As a result, the server will now take advantage of the
960 module cache when compiling the same script more than once. You may observe
961 an improvement in the performance of the server in this situation.
962
963 - The systemtap compile-server and client now each check the version of the
964 other, allowing both to adapt when communicating with a down-level
965 counterpart. As a result, all version of the client can communicate
966 with all versions of the server and vice-versa. Client will prefer newer
967 servers when selecting a server automatically.
968
969 - SystemTap has improved support for the ARM architecture. The
970 kread() and kwrite() operations for ARM were corrected allowing many
971 of the tapsets probes and function to work properly on the ARM
972 architecture.
973
974 - Staprun can now rename the module to a unique name with the '-R' option before
975 inserting it. Systemtap itself will also call staprun with '-R' by default.
976 This allows the same module to be inserted more than once, without conflicting
977 duplicate names.
978
979 - Systemtap error messages now provide feedback when staprun or any other
980 process fails to launch. This also specifically covers when the user
981 doesn't have the proper permissions to launch staprun.
982
983 - Systemtap will now map - to _ in module names. Previously,
984 stap -L 'module("i2c-core").function("*")' would be empty. It now returns
985 a list had stap -L 'module("i2c_core").function("*") been specified.
986
987 - Systemtap now fills in missing process names to probe points, to
988 avoid having to name them twice twice:
989 % stap -e 'probe process("a.out").function("*") {}' -c 'a.out ...'
990 Now the probed process name is inferred from the -c CMD argument.
991 % stap -e 'probe process.function("*") {}' -c 'a.out ...'
992
993 - stap -L 'process("PATH").syscall' will now list context variables
994
995 - Depends on elfutils 0.142+.
996
997 - Deprecated task_backtrace:string (task:long). This function will go
998 away after 1.6. Please run your scripts with stap --check-version.
999
1000 * What's new in version 1.5, 2011-05-23
1001
1002 - Security fixes for CVE-2011-1781, CVE-2011-1769: correct DW_OP_{mod,div}
1003 division-by-zero bug
1004
1005 - The compile server and its related tools (stap-gen-ert, stap-authorize-cert,
1006 stap-sign-module) have been re-implemented in C++. Previously, these
1007 components were a mix of bash scripts and C code. These changes should be
1008 transparent to the end user with the exception of NSS certificate database
1009 password prompting (see below). The old implementation would prompt more
1010 than once for the same password in some situations.
1011
1012 - eventcount.stp now allows for event counting in the format of
1013 'stap eventcount.stp process.end syscall.* ...', and also reports
1014 corresponding event tid's.
1015
1016 - Systemtap checks that the build-id of the module being probed matches the
1017 build-id saved in the systemtap module. Invoking systemtap with
1018 -DSTP_NO_BUILDID_CHECK will bypass this build-id runtime verification. See
1019 man ld(1) for info on --build-id.
1020
1021 - stapio will now report if a child process has an abnormal exit along with
1022 the associated status or signal.
1023
1024 - Compiler optimization may sometimes result in systemtap not being able to
1025 access a user-space probe argument. Compiling the application with
1026 -DSTAP_SDT_ARG_CONSTRAINT=nr will force the argument to be an immediate or
1027 register value which should enable systemtap to access the argument.
1028
1029 - GNU Gettext has now been intergrated with systemtap. Our translation
1030 page can be found at http://www.transifex.net/projects/p/systemtap/ .
1031 "make update-po" will generate the necessary files to use translated
1032 messages. Please refer to the po/README file for more info and
1033 please consider contributing to this I18N effort!
1034
1035 - The new addr() function returns the probe's instruction pointer.
1036
1037 - process("...").library("...") probes are now supported. Wildcards
1038 are supported in the library-name part, to refer to any shared
1039 library that is required by process-name, which matches the glob
1040 pattern and the rest of the probe point.
1041
1042 - The "--remote USER@HOST" functionality can now be specified multiple times
1043 to fan out on multiple targets. If the targets have distinct kernel and
1044 architecture configurations, stap will automatically build the script
1045 appropriately for each one. This option is also no longer considered
1046 experimental.
1047
1048 - The NSS certificate database generated for use by the compile server is now
1049 generated with no password. Previously, a random password was generated and
1050 used to access the database. This change should be transparent to most users.
1051 However, if you are prompted for a password when using systemtap, then
1052 running $libexecdir/stap-gen-cert should correct the problem.
1053
1054 - The timestamp tapset includes jiffies() and HZ() for lightweight approximate
1055 timekeeping.
1056
1057 - A powerful new command line option --version has been added.
1058
1059 - process.mark now supports $$parms for reading probe parameters.
1060
1061 - A new command line option, --use-server-on-error[=yes|no] is available
1062 for stap. It instructs stap to retry compilation of a script using a
1063 compile server if it fails on the local host. The default setting
1064 is 'no'.
1065
1066 - The following deprecated tools have been removed:
1067 stap-client
1068 stap-authorize-server-cert
1069 stap-authorize-signing-cert
1070 stap-find-or-start-server
1071 stap-find-servers
1072 Use the --use-server, --trust-server and --list-servers options of stap
1073 instead.
1074
1075 * What's new in version 1.4, 2011-01-17
1076
1077 - Security fixes for CVE-2010-4170, CVE-2010-4171: staprun module
1078 loading/unloading
1079
1080 - A new /* myproc-unprivileged */ marker is now available for embedded C
1081 code and and expressions. Like the /* unprivileged */ marker, it makes
1082 the code or expression available for use in unprivileged mode (see
1083 --unprivileged). However, it also automatically adds a call to
1084 assert_is_myproc() to the code or expression, thus, making it available
1085 to the unprivileged user only if the target of the current probe is within
1086 the user's own process.
1087
1088 - The experimental "--remote USER@HOST" option will run pass 5 on a given
1089 ssh host, after building locally (or with --use-server) for that target.
1090
1091 - Warning messages from the script may now be suppressed with the stap
1092 and/or staprun -w option. By default, duplicate warning messages are
1093 suppressed (up to a certain limit). With stap --vp 00002 and above,
1094 the duplicate elimination is defeated.
1095
1096 - The print_ubacktrace and usym* functions attempt to print the full
1097 path of the user-space binaries' paths, instead of just the basename.
1098 The maximum saved path length is set by -DTASK_FINDER_VMA_ENTRY_PATHLEN,
1099 default 64. Warning messages are produced if unwinding fails due to
1100 a missing 'stap -d MODULE' option, providing preloaded unwind data.
1101
1102 - The new tz_ctime() tapset function prints times in the local time zone.
1103
1104 - More kernel tracepoints are accessible to the kernel.trace("...") mechanism,
1105 if kernel source trees or debuginfo are available. These formerly "hidden"
1106 tracepoints are those that are declared somewhere other than the usual
1107 include/linux/trace/ headers, such as xfs and kvm.
1108
1109 - debuginfo-based process("...").function/.statement/.mark probes support
1110 wildcards in the process-name part, to refer to any executable files that
1111 match the glob pattern and the rest of the probe point.
1112
1113 - The -t option now displays information per probe-point rather than a summary
1114 for each probe. It also now shows the derivation chain for each probe-point.
1115
1116 - A rewrite of the sys/sdt.h header file provides zero-cost startup (few or
1117 no ELF relocations) for the debuginfo-less near-zero-cost runtime probes.
1118 Binaries compiled with earlier sdt.h versions remain supported. The
1119 stap -L (listing) option now lists parameters for sys/sdt.h markers.
1120
1121 - The implementation of the integrated compile-server client has been
1122 extended.
1123 o --use-server now accepts an argument representing a particular server and
1124 may be specified more than once.
1125 o --list-servers now accepts an expanded range of arguments.
1126 o a new --trust-servers option has been added to stap to replace several
1127 old certificate-management scripts.
1128 o The following tools are now deprecated and will be removed in release 1.5:
1129 stap-client
1130 stap-authorize-server-cert
1131 stap-authorize-signing-cert
1132 stap-find-or-start-server
1133 stap-find-servers
1134 See man stap(1) for complete details.
1135
1136 - The compile-server now returns the uprobes.ko to the client when it is
1137 required by the script being compiled. The integrated compile-server client
1138 now makes it available to be loaded by staprun. The old (deprecated)
1139 stap-client does not do this.
1140
1141 - process probes with scripts as the target are recognized by stap and the
1142 interpreter would be selected for probing.
1143
1144 - Starting in release 1.5, these old variables/functions will be deprecated
1145 and will only be available when the '--compatible=1.4' flag is used:
1146
1147 - In the 'syscall.add_key' probe, the 'description_auddr' variable
1148 has been deprecated in favor of the new 'description_uaddr'
1149 variable.
1150 - In the 'syscall.fgetxattr', 'syscall.fsetxattr',
1151 'syscall.getxattr', 'syscall.lgetxattr', and
1152 'syscall.lremovexattr' probes, the 'name2' variable has been
1153 deprecated in favor of the new 'name_str' variable.
1154 - In the 'nd_syscall.accept' probe the 'flag_str' variable
1155 has been deprecated in favor of the new 'flags_str' variable.
1156 - In the 'nd_syscall.dup' probe the 'old_fd' variable has been
1157 deprecated in favor of the new 'oldfd' variable.
1158 - In the 'nd_syscall.fgetxattr', 'nd_syscall.fremovexattr',
1159 'nd_syscall.fsetxattr', 'nd_syscall.getxattr', and
1160 'nd_syscall.lremovexattr' probes, the 'name2' variable has been
1161 deprecated in favor of the new 'name_str' variable.
1162 - The tapset alias 'nd_syscall.compat_pselect7a' was misnamed. It should
1163 have been 'nd_syscall.compat_pselect7' (without the trailing 'a').
1164 - The tapset function 'cpuid' is deprecated in favor of the better known
1165 'cpu'.
1166 - In the i386 'syscall.sigaltstack' probe, the 'ussp' variable has
1167 been deprecated in favor of the new 'uss_uaddr' variable.
1168 - In the ia64 'syscall.sigaltstack' probe, the 'ss_uaddr' and
1169 'oss_uaddr' variables have been deprecated in favor of the new
1170 'uss_uaddr' and 'uoss_uaddr' variables.
1171 - The powerpc tapset alias 'syscall.compat_sysctl' was deprecated
1172 and renamed 'syscall.sysctl32'.
1173 - In the x86_64 'syscall.sigaltstack' probe, the 'regs_uaddr'
1174 variable has been deprecated in favor of the new 'regs' variable.
1175
1176 * What's new in version 1.3, 2010-07-21
1177
1178 - The uprobes kernel module now has about half the overhead when probing
1179 NOPs, which is particularly relevant for sdt.h markers.
1180
1181 - New stap option -G VAR=VALUE allows overriding global variables
1182 by passing the settings to staprun as module options.
1183
1184 - The tapset alias 'syscall.compat_pselect7a' was misnamed. It should
1185 have been 'syscall.compat_pselect7' (without the trailing 'a').
1186 Starting in release 1.4, the old name will be deprecated and
1187 will only be available when the '--compatible=1.3' flag is used.
1188
1189 - A new procfs parameter .umask(UMASK) which provides modification of
1190 file permissions using the proper umask value. Default file
1191 permissions for a read probe are 0400, 0200 for a write probe, and
1192 0600 for a file with a read and write probe.
1193
1194 - It is now possible in some situations to use print_ubacktrace() to
1195 get a user space stack trace from a kernel probe point. e.g. for
1196 user backtraces when there is a pagefault:
1197 $ stap -d /bin/sort --ldd -e 'probe vm.pagefault {
1198 if (pid() == target()) {
1199 printf("pagefault @0x%x\n", address); print_ubacktrace();
1200 } }' -c /bin/sort
1201 [...]
1202 pagefault @0x7fea0595fa70
1203 0x000000384f07f958 : __GI_strcmp+0x12b8/0x1440 [libc-2.12.so]
1204 0x000000384f02824e : __gconv_lookup_cache+0xee/0x5a0 [libc-2.12.so]
1205 0x000000384f021092 : __gconv_find_transform+0x92/0x2cf [libc-2.12.so]
1206 0x000000384f094896 : __wcsmbs_load_conv+0x106/0x2b0 [libc-2.12.so]
1207 0x000000384f08bd90 : mbrtowc+0x1b0/0x1c0 [libc-2.12.so]
1208 0x0000000000404199 : ismbblank+0x39/0x90 [sort]
1209 0x0000000000404a4f : inittables_mb+0xef/0x290 [sort]
1210 0x0000000000406934 : main+0x174/0x2510 [sort]
1211 0x000000384f01ec5d : __libc_start_main+0xfd/0x1d0 [libc-2.12.so]
1212 0x0000000000402509 : _start+0x29/0x2c [sort]
1213 [...]
1214
1215 - New tapset functions to get a string representation of a stack trace:
1216 sprint_[u]backtrace() and sprint_[u]stack().
1217
1218 - New tapset function to get the module (shared library) name for a
1219 user space address umodname:string(long). The module name will now
1220 also be in the output of usymdata() and in backtrace addresses even
1221 when they were not given with -d at the command line.
1222
1223 - Kernel backtraces are now much faster (replaced a linear search
1224 with a binary search).
1225
1226 - A new integrated compile-server client is now available as part of stap.
1227
1228 o 'stap --use-server ...' is equivalent to 'stap-client ...'
1229 o 'stap --list-servers' is equivalent to 'stap-find-servers'
1230 o 'stap --list-servers=online' is equivalent to 'stap-find-servers --all'
1231 o stap-client and its related tools will soon be deprecated.
1232 o the nss-devel and avahi-devel packages are required for building stap with
1233 the integrated client (checked during configuration).
1234 o nss and avahi are required to run the integrated client.
1235
1236 - A new operator @entry is available for automatically saving an expression
1237 at entry time for use in a .return probe.
1238 probe foo.return { println(get_cycles() - @entry(get_cycles())) }
1239
1240 - Probe $target variables and @cast() can now use a suffix to print complex
1241 data types as strings. Use a single '$' for a shallow view, or '$$' for a
1242 deeper view that includes nested types. For example, with fs_struct:
1243 $fs$ : "{.users=%i, .lock={...}, .umask=%i,
1244 .in_exec=%i, .root={...}, .pwd={...}}"
1245 $fs$$ : "{.users=%i, .lock={.raw_lock={.lock=%u}}, .umask=%i, .in_exec=%i,
1246 .root={.mnt=%p, .dentry=%p}, .pwd={.mnt=%p, .dentry=%p}}"
1247
1248 - The <sys/sdt.h> user-space markers no longer default to an implicit
1249 MARKER_NAME_ENABLED() semaphore check for each marker. To check for
1250 enabled markers use a .d declaration file, then:
1251 if (MARKER_NAME_ENABLED()) MARKER_NAME()
1252
1253 - Hyphenated <sys/sdt.h> marker names such as process(...).mark("foo-bar")
1254 are now accepted in scripts. They are mapped to the double-underscore
1255 form ("foo__bar").
1256
1257 - More robust <sys/sdt.h> user-space markers support is included. For
1258 some platforms (x86*, ppc*), this can let systemtap probe the markers
1259 without debuginfo. This implementation also supports preserving
1260 the "provider" name associated with a marker:
1261 probe process("foo").provider("bar").mark("baz") to match
1262 STAP_PROBE<n>(bar, baz <...>)
1263 (Compile with -DSTAP_SDT_V1 to revert to the previous implementation.
1264 Systemtap supports pre-existing or new binaries using them.)
1265
1266 - Embedded-C may be used within expressions as values, when in guru mode:
1267 num = %{ LINUX_VERSION_CODE %} // int64_t
1268 name = %{ /* string */ THIS_MODULE->name %} // const char*
1269 printf ("%s %x\n", name, num)
1270 The usual /* pure */, /* unprivileged */, and /* guru */ markers may be used
1271 as with embedded-C functions.
1272
1273 - By default the systemtap-runtime RPM builds now include a shared
1274 library, staplog.so, that allows crash to extract systemtap data from
1275 a vmcore image.
1276
1277 - Iterating with "foreach" can now explicitly save the value for the loop.
1278 foreach(v = [i,j] in array)
1279 printf("array[%d,%s] = %d\n", i, j, v /* array[i,j] */)
1280
1281 - The new "--ldd" option automatically adds any additional shared
1282 libraries needed by probed or -d-listed userspace binaries to the -d
1283 list, to enable symbolic backtracing through them. Similarly, the
1284 new "--all-modules" option automatically adds any currently loaded
1285 kernel modules (listed in /proc/modules) to the -d list.
1286
1287 - A new family of set_kernel_* functions make it easier for gurus to write
1288 new values at arbitrary memory addresses.
1289
1290 - Probe wildcards can now use '**' to cross the '.' separator.
1291 $ stap -l 'sys**open'
1292 syscall.mq_open
1293 syscall.open
1294
1295 - Backward compatibility flags (--compatible=VERSION, and matching
1296 script preprocessing predicate %( systemtap_v CMP "version" %)
1297 and a deprecation policy are being introduced, in case future
1298 tapset/language changes break valid scripts.
1299
1300 * What's new in version 1.2, 2010-03-22
1301
1302 - Prototype support for "perf events", where the kernel supports the
1303 2.6.33 in-kernel API. Probe points may refer to low-level
1304 perf_event_attr type/config numbers, or to a number of aliases
1305 defined in the new perf.stp tapset:
1306 probe perf.sw.cpu_clock, perf.type(0).config(4) { }
1307
1308 - Type-casting can now use multiple headers to resolve codependencies.
1309 @cast(task, "task_struct",
1310 "kernel<linux/sched.h><linux/fs_struct.h>")->fs->umask
1311
1312 - Tapset-related man pages have been renamed. 'man -k 3stap' should show
1313 the installed list, which due to prefixing should no longer collide over
1314 ordinary system functions.
1315
1316 - User space marker arguments no longer use volatile if the version of gcc,
1317 which must be at least 4.5.0, supports richer DWARF debuginfo. Use cflags
1318 -DSTAP_SDT_VOLATILE=volatile or -DSTAP_SDT_VOLATILE= when building
1319 the sys/sdt.h application to override this one way or another.
1320
1321 - A new construct for error handling is available. It is similar to c++
1322 exception catching, using try and catch as new keywords. Within a handler
1323 or function, the following is valid and may be nested:
1324 try { /* arbitrary statements */ }
1325 catch (er) { /* e.g. println("caught error ", er) */ }
1326
1327 - A new command line flag '-W' forces systemtap to abort translation of
1328 a script if any warnings are produced. It is similar to gcc's -Werror.
1329 (If '-w' is also supplied to suppress warnings, it wins.)
1330
1331 - A new predicate @defined is available for testing whether a
1332 particular $variable/expression is resolvable at translate time:
1333 probe foo { if (@defined($bar)) log ("$bar is available here") }
1334
1335 - Adjacent string literals are glued together, making this
1336 construct valid:
1337 probe process("/usr" @1 "/bin").function("*") { ... }
1338
1339 - In order to limit potential impact from future security problems,
1340 the stap-server process does not permit its being launched as root.
1341
1342 - On recent kernels, for some architectures/configurations, hardware
1343 breakpoint probes are supported. The probe point syntax is:
1344
1345 probe kernel.data(ADDRESS).write
1346 probe kernel.data(ADDRESS).length(LEN).write
1347 probe kernel.data("SYMBOL_NAME").write
1348
1349 * What's new in version 1.1, 2010-01-15
1350
1351 - New tracepoint based tapset for memory subsystem.
1352
1353 - The loading of signed modules by staprun is no longer allowed for
1354 ordinary, unprivileged users. This means that only root, members of
1355 the group 'stapdev' and members of the group 'stapusr' can load
1356 systemtap modules using staprun, stap or stap-client. The minimum
1357 privilege required to run arbitrary --unprivileged scripts is now
1358 'stapusr' membership.
1359
1360 - The stap-server initscript is available. This initscript allows you
1361 to start systemtap compile servers as a system service and to manage
1362 these servers as a group or individually. The stap-server initscript
1363 is installed by the systemtap-server rpm. The build directory for
1364 the uprobes module (/usr/share/systemtap/runtime/uprobes) is made
1365 writable by the 'stap-server' group. All of the files generated when
1366 building the uprobes module, including the digital signature, are
1367 also writable by members of stap-server.
1368
1369 See initscript/README.stap-server for details.
1370
1371 - Some of the compile server client, server and certificate management
1372 tools have been moved from $bindir to $libexecdir/systemtap.
1373 You should use the new stap-server script or the stap-server initscript
1374 for server management where possible. The stap-server script provides the same
1375 functionality as the stap-server initscript except that the servers are
1376 run by the invoking user by default as opposed to servers started by the
1377 stap-server initscript which are run by the user stap-server
1378 by default. See stap-server(8) for more information.
1379
1380 You may continue to use these tools by adding $libexecdir/systemtap to
1381 your path. You would need to do this, for example, if you are not root,
1382 you want to start a compile server and you are not running systemtap from a
1383 private installation. In this case you still need to use stap-start-server.
1384
1385 - Any diagnostic output line that starts with "ERROR", as in
1386 error("foo"), will promote a "Pass 5: run failed", and the return
1387 code is 1.
1388
1389 - Systemtap now warns about global variables being referenced from other
1390 script files. This aims to protect against unintended local-vs-global
1391 namespace collisions such as:
1392
1393 % cat some_tapset.stp
1394 probe baz.one = bar { foo = $foo; bar = $bar }
1395 % cat end_user_script.stp
1396 global foo # intended to be private variable
1397 probe timer.s(1) { foo ++ }
1398 probe baz.* { println(foo, pp()) }
1399 % stap end_user_script.stp
1400 WARNING: cross-file global variable reference to foo from some_tapset.stp
1401
1402 - Preprocessor conditional for kernel configuration testing:
1403 %( CONFIG_foo == "y" %? ... %)
1404
1405 - ftrace(msg:string) tapset function to send strings to the system-wide
1406 ftrace ring-buffer (if any).
1407
1408 - Better support for richer DWARF debuginfo output from GCC 4.5
1409 (variable tracking assignments). Kernel modules are now always resolved
1410 against all their dependencies to find any info referring to missing
1411 symbols. DW_AT_const_value is now supported when no DW_AT_location
1412 is available.
1413
1414 * What's new in verson 1.0, 2009-09-22
1415
1416 - process().mark() probes now use an enabling semaphore to reduce the
1417 computation overhead of dormant probes.
1418
1419 - The function spec for dwarf probes now supports C++ scopes, so you can
1420 limit the probes to specific namespaces or classes. Multiple scopes
1421 can be specified, and they will be matched progressively outward.
1422 probe process("foo").function("std::vector<*>::*") { }
1423 probe process("foo").function("::global_function") { }
1424
1425 - It is now possible to cross-compile systemtap scripts for foreign
1426 architectures, using the new '-a ARCH' and '-B OPT=VALUE' flags.
1427 For example, put arm-linux-gcc etc. into your $PATH, and point
1428 systemtap at the target kernel build tree with:
1429 stap -a arm -B CROSS_COMPILE=arm-linux- -r /build/tree [...]
1430 The -B option is passed to kbuild make. -r identifies the already
1431 configured/built kernel tree and -a its architecture (kbuild ARCH=...).
1432 Systemtap will infer -p4.
1433
1434 - Cross compilation using the systemtap client and server
1435 - stap-start-server now accepts the -r, -R, -I, -B and -a options in
1436 order to start a cross compiling server. The server will correctly
1437 advertise itself with respect to the kernel release and architecture
1438 that it compiles for.
1439 - When specified on stap-client, the -r and -a options will be
1440 considered when searching for a suitable server.
1441
1442 - When using the systemtap client and server udp port 5353 must be open
1443 in your firewall in order for the client to find servers using
1444 avahi-browse. Also the systemtap server will choose a random port in
1445 the range 1024-63999 for accepting ssl connections.
1446
1447 - Support for unprivileged users:
1448 ***********************************************************************
1449 * WARNING!!!!!!!!!! *
1450 * This feature is EXPERIMENTAL at this time and should be used with *
1451 * care. This feature allows systemtap kernel modules to be loaded by *
1452 * unprivileged users. The user interface and restrictions will change *
1453 * as this feature evolves. *
1454 ***********************************************************************
1455 - Systemtap modules generated from scripts which use a restricted
1456 subset of the features available may be loaded by staprun for
1457 unprivileged users. Previously, staprun would load modules only for
1458 root or for members of the groups stapdev and stapusr.
1459 - Using the --unprivileged option on stap enables translation-time
1460 checking for use by unprivileged users (see restrictions below).
1461 - All modules deemed suitable for use by unprivileged users will be
1462 signed by the systemtap server when --unprivileged is specified on
1463 stap-client. See module signing in release 0.9.8 and stap-server in
1464 release 0.9 below.
1465 - Modules signed by trusted signers (servers) and verified by staprun
1466 will be loaded by staprun regardless of the user's privilege level.
1467 - The system administrator asserts the trustworthiness of a signer
1468 (server) by running stap-authorize-signing-cert <cert-file> as root,
1469 where the <cert-file> can be found in
1470 ~<user>/.systemtap/ssl/server/stap.cert for servers started by
1471 ordinary users and in $sysconfdir/systemtap/ssl/server/stap.cert for
1472 servers started by root.
1473 - Restrictions are intentionally strict at this time and may be
1474 relaxed in the future:
1475 - probe points are restricted to:
1476 begin, begin(n), end, end(n), error, error(n), never,
1477 timer.{jiffies,s,sec,ms,msec,us,usec,ns,nsec}(n)*, timer.hz(n),
1478 process.* (for processes owned by the user).
1479 - use of embedded C code is not allowed.
1480 - use of tapset functions is restricted.
1481 - some tapset functions may not be used at all. A message will be
1482 generated at module compilation time.
1483 - some actions by allowed tapset functions may only be performed
1484 in the context of the user's own process. A runtime fault will
1485 occur in these situations, for example, direct memory access.
1486 - The is_myproc() tapset function has been provided so that
1487 tapset writers for unprivileged users can check that the
1488 context is of the users own process before attempting these
1489 actions.
1490 - accessing the kernel memory space is not allowed.
1491 - The following command line options may not be used by stap-client
1492 -g, -I, -D, -R, -B
1493 - The following environment variables are ignored by stap-client:
1494 SYSTEMTAP_RUNTIME, SYSTEMTAP_TAPSET, SYSTEMTAP_DEBUGINFO_PATH
1495 - nss and nss-tools are required to use this feature.
1496
1497 - Support output file switching by SIGUSR2. Users can command running
1498 stapio to switch output file by sending SIGUSR2.
1499
1500 - Memory consumption for scripts involving many uprobes has been
1501 dramatically reduced.
1502
1503 - The preprocessor now supports || and && in the conditions.
1504 e.g. %( arch == "x86_64" || arch == "ia64" %: ... %)
1505
1506 - The systemtap notion of "architecture" now matches the kernel's, rather
1507 than that of "uname -m". This means that 32-bit i386 family are all
1508 known as "i386" rather than "i386" or "i686"; "ppc64" as "powerpc";
1509 "s390x" as "s390", and so on. This is consistent between the new
1510 "-a ARCH" flag and the script-level %( arch ... %) conditional.
1511
1512 - It is now possible to define multiple probe aliases with the same name.
1513 A probe will expand to all matching aliases.
1514 probe foo = bar { }
1515 probe foo = baz { }
1516 probe foo { } # expands twice, once to bar and once to baz
1517
1518 - A new experimental transport mechanism, using ftrace's ring_buffer,
1519 has been added. This may become the default transport mechanism in
1520 future versions of systemtap. To test this new transport mechanism,
1521 define 'STP_USE_RING_BUFFER'.
1522
1523 - Support for recognizing DW_OP_{stack,implicit}_value DWARF expressions
1524 as emitted by GCC 4.5.
1525
1526 * What's new in version 0.9.9, 2009-08-04
1527
1528 - Systemwide kernel .function.return (kretprobe) maxactive defaults may
1529 be overridden with the -DKRETACTIVE=nnn parameter.
1530
1531 - Translation pass 2 is significantly faster by avoiding unnecessary
1532 searching through a kernel build/module directory tree.
1533
1534 - When compiled against elfutils 0.142 systemtap now handles the new
1535 DW_OP_call_frame_CFA generated by by GCC.
1536
1537 - uprobes and ustack() are more robust when used on applications that
1538 depend on prelinked/separate debuginfo shared libraries.
1539
1540 - User space PROBE marks are not always found with or without separate
1541 debuginfo. The .probes section itself is now always put in the main
1542 elf file and marked as allocated. When building pic code the section
1543 is marked writable. The selinux memory check problems seen with
1544 programs using STAP_PROBES is fixed.
1545
1546 - statement() probes can now override "address not at start of statement"
1547 errors in guru mode. They also provide alternative addresses to use
1548 in non-guru mode.
1549
1550 - The stapgraph application can generate graphs of data and events
1551 emitted by systemtap scripts in real time. Run "stapgraph
1552 testsuite/systemtap.examples/general/grapher.stp" for an example of
1553 graphing the system load average and keyboard events.
1554
1555 - Dwarf probes now show parameters and local variables in the verbose
1556 listing mode (-L).
1557
1558 - Symbol aliases are now resolved to their canonical dwarf names. For
1559 example, probing "malloc" in libc resolves to "__libc_malloc".
1560
1561 - The syntax for dereferencing $target variables and @cast() gained new
1562 capabilities:
1563 - Array indexes can now be arbitrary numeric expressions.
1564 - Array subscripts are now supported on pointer types.
1565 - An '&' operator before a @cast or $target returns the address of the
1566 final component, especially useful for nested structures.
1567
1568 - For reading all probe variables, kernel.mark now supports $$vars and
1569 $$parms, and process.syscall now supports $$vars.
1570
1571 - The SNMP tapset provides probes and functions for many network
1572 statistics. See stapprobes.snmp(3stap) for more details.
1573
1574 - The dentry tapset provides functions to map kernel VFS directory entries
1575 to file or full path names: d_path(), d_name() and reverse_path_walk().
1576
1577 - SystemTap now has userspace markers in its own binaries, and the stap
1578 tapset provides the available probepoints and local variables.
1579
1580 - Miscellaneous new tapset functions:
1581 - pgrp() returns the process group ID of the current process
1582 - str_replace() performs string replacement
1583
1584 * What's new in version 0.9.8, 2009-06-11
1585
1586 - Miscellaneous new tapset functions:
1587 - sid() returns the session ID of the current process
1588 - stringat() indexes a single character from a string.
1589
1590 - Using %M in print formats for hex dumps can now print entire buffers,
1591 instead of just small numbers.
1592
1593 - Dwarfless syscalls: The nd_syscalls tapset is now available to probe
1594 system calls without requiring kernel debugging information. All of
1595 the same probepoints in the normal syscalls tapset are available with
1596 an "nd_" prefix, e.g. syscall.open becomes nd_syscall.open. Most
1597 syscall arguments are also available by name in nd_syscalls.
1598
1599 - Module signing: If the appropriate nss libraries are available on your
1600 system, stap-server will sign each compiled module using a self-generated
1601 certificate. This is the first step toward extending authority to
1602 load certain modules to unprivileged users. For now, if the system
1603 administrator adds a certificate to a database of trusted signers
1604 (stap-authorize-signing-cert), modules signed using that certificate
1605 will be verified by staprun against tampering. Otherwise, you should
1606 notice no difference in the operation of stap or staprun.
1607
1608 * What's new in version 0.9.7, 2009-04-23
1609
1610 - @cast can now determine its type information using an explicit header
1611 specification. For example:
1612 @cast(tv, "timeval", "<sys/time.h>")->tv_sec
1613 @cast(task, "task_struct", "kernel<linux/sched.h>")->tgid
1614
1615 - The overlapping process.* tapsets are now separated. Those probe points
1616 documented in stapprobes(3stap) remain the same. Those that were formerly
1617 in stapprobes.process(3stap) have been renamed to kprocess, to reflect
1618 their kernel perspective on processes.
1619
1620 - The --skip-badvars option now also suppresses run-time error
1621 messages that would otherwise result from erroneous memory accesses.
1622 Such accesses can originate from $context expressions fueled by
1623 erroneous debug data, or by kernel_{long,string,...}() tapset calls.
1624
1625 - New probes kprobe.function(FUNCTION) and kprobe.function(FUNCTION).return
1626 for dwarfless probing. These postpone function address resolution to
1627 run-time and use the kprobe symbol-resolution mechanism.
1628 Probing of absolute statements can be done using the
1629 kprobe.statement(ADDRESS).absolute construct.
1630
1631 - EXPERIMENTAL support for user process unwinding. A new collection of
1632 tapset functions have been added to handle user space backtraces from
1633 probe points that support them (currently process and timer probes -
1634 for timer probes test whether or not in user space first with the
1635 already existing user_mode() function). The new tapset functions are:
1636 uaddr - User space address of current running task.
1637 usymname - Return the symbol of an address in the current task.
1638 usymdata - Return the symbol and module offset of an address.
1639 print_ustack - Print out stack for the current task from string.
1640 print_ubacktrace - Print stack back trace for current task.
1641 ubacktrace - Hex backtrace of current task stack.
1642 Please read http://sourceware.org/ml/systemtap/2009-q2/msg00364.html
1643 on the current restrictions and possible changes in the future and
1644 give feedback if you want to influence future developments.
1645
1646 * What's new in version 0.9.5, 2009-03-27
1647
1648 - New probes process().insn and process().insn.block that allows
1649 inspection of the process after each instruction or block of
1650 instructions executed. So to count the total number of instructions
1651 a process executes during a run do something like:
1652 $ stap -e 'global steps; probe process("/bin/ls").insn {steps++}
1653 probe end {printf("Total instructions: %d\n", steps);}' \
1654 -c /bin/ls
1655 This feature can slow down execution of a process somewhat.
1656
1657 - Systemtap probes and function man pages extracted from the tapsets
1658 are now available under 3stap. To show the page for probe vm.pagefault
1659 or the stap function pexecname do:
1660 $ man 3stap vm.pagefault
1661 $ man 3stap pexecname
1662
1663 - Kernel tracepoints are now supported for probing predefined kernel
1664 events without any debuginfo. Tracepoints incur less overhead than
1665 kprobes, and context parameters are available with full type
1666 information. Any kernel 2.6.28 and later should have defined
1667 tracepoints. Try the following to see what's available:
1668 $ stap -L 'kernel.trace("*")'
1669
1670 - Typecasting with @cast now supports modules search paths, which is
1671 useful in case there are multiple places where the type definition
1672 may be found. For example:
1673 @cast(sdev, "scsi_device", "kernel:scsi_mod")->sdev_state
1674
1675 - On-file flight recorder is supported. It allows stap to record huge
1676 trace log on the disk and to run in background.
1677 Passing -F option with -o option runs stap in background mode. In this
1678 mode, staprun is detached from console, and stap itself shows staprun's
1679 pid and exits.
1680 Specifying the max size and the max number of log files are also available
1681 by passing -S option. This option has one or two arguments seperated by
1682 a comma. The first argument is the max size of a log file in MB. If the
1683 size of a log file exceeds it, stap switches to the next log file
1684 automatically. The second is how many files are kept on the disk. If the
1685 number of log files exceeds it, the oldest log file is removed
1686 automatically. The second argument can be omitted.
1687
1688 For example, this will record output on log files each of them is smaller
1689 than 1024MB and keep last 3 logs, in background.
1690 % stap -F -o /tmp/staplog -S 1024,3 script.stp
1691
1692 - In guru mode (-g), the kernel probing blacklist is disabled, leaving
1693 only a subset - the kernel's own internal kprobe blacklist - to attempt
1694 to filter out areas unsafe to probe. The differences may be enough to
1695 probe more interrupt handlers.
1696
1697 - Variables unavailable in current context may be skipped by setting a
1698 session level flag with command line option --skip-badvars now available.
1699 This replaces any dwarf $variable expressions that could not be resolved
1700 with literal numeric zeros, along with a warning message.
1701
1702 - Both kernel markers and kernel tracepoint support argument listing
1703 through stap -L 'kernel.mark("*")' or stap -L 'kernel.trace("*")'
1704
1705 - Users can use -DINTERRUPTIBLE=0 to prevent interrupt reentrancy in
1706 their script, at the cost of a bit more overhead to toggle the
1707 interrupt mask.
1708
1709 - Added reentrancy debugging. If stap is run with the arguments
1710 "-t -DDEBUG_REENTRANCY", additional warnings will be printed for
1711 every reentrancy event, including the probe points of the
1712 resident and interloper probes.
1713
1714 - Default to --disable-pie for configure.
1715 Use --enable-pie to turn it back on.
1716
1717 - Improved sdt.h compatibility and test suite for static dtrace
1718 compatible user space markers.
1719
1720 - Some architectures now use syscall wrappers (HAVE_SYSCALL_WRAPPERS).
1721 The syscall tapset has been enhanced to take care of the syscall
1722 wrappers in this release.
1723
1724 - Security fix for CVE-2009-0784: stapusr module-path checking race.
1725
1726 * What's new in version 0.9, 2009-02-19
1727
1728 - Typecasting is now supported using the @cast operator. A script can
1729 define a pointer type for a "long" value, and then access type members
1730 using the same syntax as with $target variables. For example, this will
1731 retrieve the parent pid from a kernel task_struct:
1732 @cast(pointer, "task_struct", "kernel")->parent->pid
1733
1734 - process().mark() probes are now possible to trace static user space
1735 markers put in programs with the STAP_PROBE macro using the new
1736 sys/sdt.h include file. This also provides dtrace compatible markers
1737 through DTRACE_PROBE and an associated python 'dtrace' script that
1738 can be used in builds based on dtrace that need dtrace -h or -G
1739 functionality.
1740
1741 - For those that really want to run stap from the build tree there is
1742 now the 'run-stap' script in the top-level build directory that sets
1743 up the SYSTEMTAP_TAPSET, SYSTEMTAP_RUNTIME, SYSTEMTAP_STAPRUN, and
1744 SYSTEMTAP_STAPIO environment variables (installing systemtap, in a
1745 local prefix, is still recommended for common use).
1746
1747 - Systemtap now comes with a new Beginners Guide that walks the user
1748 through their first steps setting up stap, understanding how it all
1749 works, introduces some useful scripts and describes some common
1750 pitfalls. It isn't created by default since it needs a Publican
1751 setup, but full build instructions can be found in the wiki:
1752 http://sourceware.org/systemtap/wiki/PublicanQuikHowto
1753 An online version can be found at:
1754 http://sourceware.org/systemtap/SystemTap_Beginners_Guide.pdf
1755
1756 - Standard tapsets included with Systemtap were modified to include
1757 extractable documentation information based on the kernel-doc
1758 infrastructure. When configured --enabled-docs a HTML and PDF
1759 version of the Tapset Reference Manual is produced explaining probes
1760 defined in each tapset.
1761
1762 - The systemtap client and compile server are now available.
1763 These allow you to compile a systemtap module on a host other than
1764 the one which it will be run, providing the client and server
1765 are compatible. Other than using a server for passes 1 through
1766 4, the client behaves like the 'stap' front end itself. This
1767 means, among other things, that the client will automatically
1768 load the resulting module on the local host unless -p[1234]
1769 was specified. See stap-server(8) for more details.
1770 The client/server now use SSL for network connection security and
1771 for signing.
1772
1773 The systemtap client and server are prototypes only. Interfaces, options
1774 and usage may change at any time.
1775
1776 - function("func").label("label") probes are now supported to allow matching
1777 the label of a function.
1778
1779 - Systemtap initscript is available. This initscript allows you to run
1780 systemtap scripts as system services (in flight recorder mode) and
1781 control those scripts individually.
1782 See README.systemtap for details.
1783
1784 - The stap "-r DIR" option may be used to identify a hand-made kernel
1785 build directory. The tool determines the appropriate release string
1786 automatically from the directory.
1787
1788 - Serious problems associated with user-space probing in shared libraries
1789 were corrected, making it now possible to experiment with probe shared
1790 libraries. Assuming dwarf debugging information is installed, use this
1791 twist on the normal syntax:
1792
1793 probe process("/lib64/libc-2.8.so").function("....") { ... }
1794
1795 This would probe all threads that call into that library. Running
1796 "stap -c CMD" or "stap -x PID" naturally restricts this to the target
1797 command+descendants only. $$vars etc. may be used.
1798
1799 - For scripts that sometimes terminate with excessive "skipped" probes,
1800 rerunning the script with "-t" (timing) will print more details about
1801 the skippage reasons.
1802
1803 - Symbol tables and unwind (backtracing) data support were formerly
1804 compiled in for all probed modules as identified by the script
1805 (kernel; module("name"); process("file")) plus those listed by the
1806 stap "-d BINARY" option. Now, this data is included only if the systemtap
1807 script uses tapset functions like probefunc() or backtrace() that require
1808 such information. This shrinks the probe modules considerably for the rest.
1809
1810 - Per-pass verbosity control is available with the new "--vp {N}+" option.
1811 "stap --vp 040" adds 4 units of -v verbosity only to pass 2. This is useful
1812 for diagnosing errors from one pass without excessive verbosity from others.
1813
1814 - Most probe handlers now run with interrupts enabled, for improved
1815 system responsiveness and less probing overhead. This may result
1816 in more skipped probes, for example if a reentrant probe handler
1817 is attempted from within an interrupt handler. It may also make the
1818 systemtap overload detection facility more likely to be triggered, as
1819 interrupt handlers' run time would be included in the self-assessed
1820 overhead of running probe handlers.
1821
1822 * What's new in version 0.8, 2008-11-13
1823
1824 - Cache limiting is now available. If the compiled module cache size is
1825 over a limit specified in the $SYSTEMTAP_DIR/cache/cache_mb_limit file,
1826 some old cache entries will be unlinked. See man stap(1) for more.
1827
1828 - Error and warning messages are now followed by source context displaying
1829 the erroneous line/s and a handy '^' in the following line pointing to the
1830 appropriate column.
1831
1832 - A bug reporting tool "stap-report" is now available which will quickly
1833 retrieve much of the information requested here:
1834 http://sourceware.org/systemtap/wiki/HowToReportBugs
1835
1836 - The translator can resolve members of anonymous structs / unions:
1837 given struct { int foo; struct { int bar; }; } *p;
1838 this now works: $p->bar
1839
1840 - The stap "-F" flag activates "flight recorder" mode, which consists of
1841 translating the given script as usual, but implicitly launching it into
1842 the background with staprun's existing "-L" (launch) option. A user
1843 can later reattach to the module with "staprun -A MODULENAME".
1844
1845 - Additional context variables are available on user-space syscall probes.
1846 - $argN ($arg1, $arg2, ... $arg6) in process(PATH_OR_PID).syscall
1847 gives you the argument of the system call.
1848 - $return in process(PATH_OR_PID).syscall.return gives you the return
1849 value of the system call.
1850
1851 - Target process mode (stap -c CMD or -x PID) now implicitly restricts all
1852 "process.*" probes to the given child process. (It does not affect
1853 kernel.* or other probe types.) The CMD string is normally run directly,
1854 rather than via a /bin/sh -c subshell, since then utrace/uprobe probes
1855 receive a fairly "clean" event stream. If metacharacters like
1856 redirection operators were present in CMD, then "sh -c CMD" is still
1857 used, and utrace/uprobe probes will receive events from the shell.
1858
1859 % stap -e 'probe process.syscall, process.end {
1860 printf("%s %d %s\n", execname(), pid(), pp())}'\
1861 -c ls
1862 ls 2323 process.syscall
1863 ls 2323 process.syscall
1864 ls 2323 process.end
1865
1866 - Probe listing mode is improved: "-L" lists available script-level variables
1867
1868 % stap -L 'syscall.*open*'
1869 syscall.mq_open name:string name_uaddr:long filename:string mode:long u_attr_uaddr:long oflag:long argstr:string
1870 syscall.open name:string filename:string flags:long mode:long argstr:string
1871 syscall.openat name:string filename:string flags:long mode:long argstr:string
1872
1873 - All user-space-related probes support $PATH-resolved executable
1874 names, so
1875
1876 probe process("ls").syscall {}
1877 probe process("./a.out").syscall {}
1878
1879 work now, instead of just
1880
1881 probe process("/bin/ls").syscall {}
1882 probe process("/my/directory/a.out").syscall {}
1883
1884 - Prototype symbolic user-space probing support:
1885
1886 # stap -e 'probe process("ls").function("*").call {
1887 log (probefunc()." ".$$parms)
1888 }' \
1889 -c 'ls -l'
1890
1891 This requires:
1892 - debugging information for the named program
1893 - a version of utrace in the kernel that is compatible with the "uprobes"
1894 kernel module prototype. This includes RHEL5 and older Fedora, but not
1895 yet current lkml-track utrace; a "pass 4a"-time build failure means
1896 your system cannot use this yet.
1897
1898 - Global variables which are written to but never read are now
1899 automatically displayed when the session does a shutdown. For example:
1900
1901 global running_tasks
1902 probe timer.profile {running_tasks[pid(),tid()] = execname()}
1903 probe timer.ms(8000) {exit()}
1904
1905 - A formatted string representation of the variables, parameters, or local
1906 variables at a probe point is now supported via the special $$vars,
1907 $$parms, and $$locals context variables, which expand to a string
1908 containing a list "var1=0xdead var2=0xbeef var3=?". (Here, var3 exists
1909 but is for some reason unavailable.) In return probes only, $$return
1910 expands to an empty string for a void function, or "return=0xf00".
1911
1912
1913 * What's new in version 0.7, 2008-07-15
1914
1915 - .statement("func@file:*") and .statement("func@file:M-N") probes are now
1916 supported to allow matching a range of lines in a function. This allows
1917 tracing the execution of a function.
1918
1919 - Scripts relying on probe point wildcards like "syscall.*" that expand
1920 to distinct kprobes are processed significantly faster than before.
1921
1922 - The vector of script command line arguments is available in a
1923 tapset-provided global array argv[]. It is indexed 1 ... argc,
1924 another global. This can substitute for of preprocessor
1925 directives @NNN that fail at parse time if there are not
1926 enough arguments.
1927
1928 printf("argv: %s %s %s", argv[1], argv[2], argv[3])
1929
1930 - .statement("func@file+line") probes are now supported to allow a
1931 match relative to the entry of the function incremented by line
1932 number. This allows using the same systemtap script if the rest
1933 of the file.c source only changes slightly.
1934
1935 - A probe listing mode is available.
1936 % stap -l vm.*
1937 vm.brk
1938 vm.mmap
1939 vm.munmap
1940 vm.oom_kill
1941 vm.pagefault
1942 vm.write_shared
1943
1944 - More user-space probe types are added:
1945
1946 probe process(PID).begin { }
1947 probe process("PATH").begin { }
1948 probe process(PID).thread.begin { }
1949 probe process("PATH").thread.begin { }
1950 probe process(PID).end { }
1951 probe process("PATH").end { }
1952 probe process(PID).thread.end { }
1953 probe process("PATH").thread.end { }
1954 probe process(PID).syscall { }
1955 probe process("PATH").syscall { }
1956 probe process(PID).syscall.return { }
1957 probe process("PATH").syscall.return { }
1958
1959 - Globals now accept ; terminators
1960
1961 global odds, evens;
1962 global little[10], big[5];
1963
1964 * What's new in version 0.6, 2007-12-15
1965
1966 - A copy of the systemtap tutorial and language reference guide
1967 are now included.
1968
1969 - There is a new format specifier, %m, for the printf family of
1970 functions. It functions like %s, except that it does not stop when
1971 a nul ('\0') byte is encountered. The number of bytes output is
1972 determined by the precision specifier. The default precision is 1.
1973 For example:
1974
1975 printf ("%m", "My String") // prints one character: M
1976 printf ("%.5", myString) // prints 5 bytes beginning at the start
1977 // of myString
1978
1979 - The %b format specifier for the printf family of functions has been enhanced
1980 as follows:
1981
1982 1) When the width and precision are both unspecified, the default is %8.8b.
1983 2) When only one of the width or precision is specified, the other defaults
1984 to the same value. For example, %4b == %.4b == %4.4b
1985 3) Nul ('\0') bytes are used for field width padding. For example,
1986
1987 printf ("%b", 0x1111deadbeef2222) // prints all eight bytes
1988 printf ("%4.2b", 0xdeadbeef) // prints \0\0\xbe\xef
1989
1990 - Dynamic width and precision are now supported for all printf family format
1991 specifiers. For example:
1992
1993 four = 4
1994 two = 2
1995 printf ("%*.*b", four, two, 0xdeadbbeef) // prints \0\0\xbe\xef
1996 printf ("%*d", four, two) // prints <space><space><space>2
1997
1998 - Preprocessor conditional expressions can now include wildcard style
1999 matches on kernel versions.
2000 %( kernel_vr != "*xen" %? foo %: bar %)
2001
2002 - Prototype support for user-space probing is showing some progress.
2003 No symbolic notations are supported yet (so no probing by function names,
2004 file names, process names, and no access to $context variables), but at
2005 least it's something:
2006
2007 probe process(PID).statement(ADDRESS).absolute { }
2008
2009 This will set a uprobe on the given process-id and given virtual address.
2010 The proble handler runs in kernel-space as usual, and can generally use
2011 existing tapset functions.
2012
2013 - Crash utility can retrieve systemtap's relay buffer from a kernel dump
2014 image by using staplog which is a crash extension module. To use this
2015 feature, type commands as below from crash(8)'s command line:
2016
2017 crash> extend staplog.so
2018 crash> help systemtaplog
2019
2020 Then, you can see more precise help message.
2021
2022 - You can share a relay buffer amoung several scripts and merge outputs from
2023 several scripts by using "-DRELAY_HOST" and "-DRELAY_GUEST" options.
2024 For example:
2025
2026 # run a host script
2027 % stap -ve 'probe begin{}' -o merged.out -DRELAY_HOST &
2028 # wait until starting the host.
2029 % stap -ve 'probe begin{print("hello ");exit()}' -DRELAY_GUEST
2030 % stap -ve 'probe begin{print("world\n");exit()}' -DRELAY_GUEST
2031
2032 Then, you'll see "hello world" in merged.out.
2033
2034 - You can add a conditional statement for each probe point or aliase, which
2035 is evaluated when the probe point is hit. If the condition is false, the
2036 whole probe body(including aliases) is skipped. For example:
2037
2038 global switch = 0;
2039 probe syscall.* if (switch) { ... }
2040 probe procfs.write {switch = strtol($value,10)} /* enable/disable ctrl */
2041
2042 - Systemtap will warn you if your script contains unused variables or
2043 functions. This is helpful in case of misspelled variables. If it
2044 doth protest too much, turn it off with "stap -w ...".
2045
2046 - You can add error-handling probes to a script, which are run if a
2047 script was stopped due to errors. In such a case, "end" probes are
2048 not run, but "error" ones are.
2049
2050 probe error { println ("oops, errors encountered; here's a report anyway")
2051 foreach (coin in mint) { println (coin) } }
2052
2053 - In a related twist, one may list probe points in order of preference,
2054 and mark any of them as "sufficient" beyond just "optional". Probe
2055 point sequence expansion stops if a sufficient-marked probe point has a hit.
2056 This is useful for probes on functions that may be in a module (CONFIG_FOO=m)
2057 or may have been compiled into the kernel (CONFIG_FOO=y), but we don't know
2058 which. Instead of
2059
2060 probe module("sd").function("sd_init_command") ? ,
2061 kernel.function("sd_init_command") ? { ... }
2062
2063 which might match neither, now one can write this:
2064
2065 probe module("sd").function("sd_init_command") ! , /* <-- note excl. mark */
2066 kernel.function("sd_init_command") { ... }
2067
2068 - New security model. To install a systemtap kernel module, a user
2069 must be one of the following: the root user; a member of the
2070 'stapdev' group; or a member of the 'stapusr' group. Members of the
2071 stapusr group can only use modules located in the
2072 /lib/modules/VERSION/systemtap directory (where VERSION is the
2073 output of "uname -r").
2074
2075 - .statement("...@file:line") probes now apply heuristics to allow an
2076 approximate match for the line number. This works similarly to gdb,
2077 where a breakpoint placed on an empty source line is automatically
2078 moved to the next statement. A silly bug that made many $target
2079 variables inaccessible to .statement() probes was also fixed.
2080
2081 - LKET has been retired. Please let us know on <systemtap@sourceware.org>
2082 if you have been a user of the tapset/tools, so we can help you find
2083 another way.
2084
2085 - New families of printing functions println() and printd() have been added.
2086 println() is like print() but adds a newline at the end;
2087 printd() is like a sequence of print()s, with a specified field delimiter.
2088
2089 * What's new since version 0.5.14?, 2007-07-03
2090
2091 - The way in which command line arguments for scripts are substituted has
2092 changed. Previously, $1 etc. would interpret the corresponding command
2093 line argument as an numeric literal, and @1 as a string literal. Now,
2094 the command line arguments are pasted uninterpreted wherever $1 etc.
2095 appears at the beginning of a token. @1 is similar, but is quoted as
2096 a string. This change does not modify old scripts, but has the effect
2097 of permitting substitution of arbitrary token sequences.
2098
2099 # This worked before, and still does:
2100 % stap -e 'probe timer.s($1) {}' 5
2101 # Now this also works:
2102 % stap -e 'probe syscall.$1 {log(@1)}' open
2103 # This won't crash, just signal a recursion error:
2104 % stap -e '$1' '$1'
2105 # As before, $1... is recognized only at the beginning of a token
2106 % stap -e 'probe begin {foo$1=5}'
2107
2108 * What's new since version 0.5.13?, 2007-03-26
2109
2110 - The way in which systemtap resolves function/inline probes has changed:
2111 .function(...) - now refers to all functions, inlined or not
2112 .inline(...) - is deprecated, use instead:
2113 .function(...).inline - filters function() to only inlined instances
2114 .function(...).call - filters function() to only non-inlined instances
2115 .function(...).return - as before, but now pairs best with .function().call
2116 .statement() is unchanged.
2117
2118 * What's new since version 0.5.12?, 2007-01-01
2119
2120 - When running in -p4 (compile-only) mode, the compiled .ko file name
2121 is printed on standard output.
2122
2123 - An array element with a null value such as zero or an empty string
2124 is now preserved, and will show up in a "foreach" loop or "in" test.
2125 To delete such an element, the scripts needs to use an explicit
2126 "delete array[idx]" statement rather than something like "array[idx]=0".
2127
2128 - The new "-P" option controls whether prologue searching heuristics
2129 will be activated for function probes. This was needed to get correct
2130 debugging information (dwarf location list) data for $target variables.
2131 Modern compilers (gcc 4.1+) tend not to need this heuristic, so it is
2132 no longer default. A new configure flag (--enable-prologues) restores
2133 it as a default setting, and is appropriate for older compilers (gcc 3.*).
2134
2135 - Each systemtap module prints a one-line message to the kernel informational
2136 log when it starts. This line identifies the translator version, base
2137 address of the probe module, a broken-down memory consumption estimate, and
2138 the total number of probes. This is meant as a debugging / auditing aid.
2139
2140 - Begin/end probes are run with interrupts enabled (but with
2141 preemption disabled). This will allow begin/end probes to be
2142 longer, to support generating longer reports.
2143
2144 - The numeric forms of kernel.statement() and kernel.function() probe points
2145 are now interpreted as relocatable values - treated as relative to the
2146 _stext symbol in that kernel binary. Since some modern kernel images
2147 are relocated to a different virtual address at startup, such addresses
2148 may shift up or down when actually inserted into a running kernel.
2149
2150 kernel.statement(0xdeadbeef): validated, interpreted relative to _stext,
2151 may map to 0xceadbeef at run time.
2152
2153 In order to specify unrelocated addresses, use the new ".absolute"
2154 probe point suffix for such numeric addresses. These are only
2155 allowed in guru mode, and provide access to no $target variables.
2156 They don't use debugging information at all, actually.
2157
2158 kernel.statement(0xfeedface).absolute: raw, unvalidated, guru mode only
2159
2160 * What's new since version 0.5.10?, 2006-10-19
2161
2162 - Offline processing of debugging information, enabling general
2163 cross-compilation of probe scripts to remote hosts, without
2164 requiring identical module/memory layout. This slows down
2165 compilation/translation somewhat.
2166
2167 - Kernel symbol table data is loaded by staprun at startup time
2168 rather than compiled into the module.
2169
2170 - Support the "limit" keyword for foreach iterations:
2171 foreach ([x,y] in ary limit 5) { ... }
2172 This implicitly exits after the fifth iteration. It also enables
2173 more efficient key/value sorting.
2174
2175 - Support the "maxactive" keyword for return probes:
2176 probe kernel.function("sdfsdf").maxactive(848) { ... }
2177 This allows up to 848 concurrently outstanding entries to
2178 the sdfsdf function before one returns. The default maxactive
2179 number is smaller, and can result in missed return probes.
2180
2181 - Support accessing of saved function arguments from within
2182 return probes. These values are saved by a synthesized
2183 function-entry probe.
2184
2185 - Add substantial version/architecture checking in compiled probes to
2186 assert correct installation of debugging information and correct
2187 execution on a compatible kernel.
2188
2189 - Add probe-time checking for sufficient free stack space when probe
2190 handlers are invoked, as a safety improvement.
2191
2192 - Add an optional numeric parameter for begin/end probe specifications,
2193 to order their execution.
2194 probe begin(10) { } /* comes after */ probe begin(-10) {}
2195
2196 - Add an optional array size declaration, which is handy for very small
2197 or very large ones.
2198 global little[5], big[20000]
2199
2200 - Include some example scripts along with the documentation.
2201
2202 - Change the start-time allocation of probe memory to avoid causing OOM
2203 situations, and to abort cleanly if free kernel memory is short.
2204
2205 - Automatically use the kernel DWARF unwinder, if present, for stack
2206 tracebacks.
2207
2208 - Many minor bug fixes, performance, tapset, and error message
2209 improvements.
This page took 0.124603 seconds and 6 git commands to generate.