]> sourceware.org Git - systemtap.git/blob - NEWS
NEWS: mention commit d8ef032e
[systemtap.git] / NEWS
1 * What's new in version 2.8
2
3 - Colorization of error string tokens is made more robust, especially
4 in presence of $N/@N substitution.
5
6 - The following tapset variables and functions are deprecated in
7 version 2.8:
8 - The 'hostname_uaddr' variable in the syscall.setdomainname and
9 nd_syscall.setdomainname probe aliases have been deprecated in
10 favor of the new 'domainname_uaddr' variable.
11 - The 'fd' and 'fd_str' variables in the syscall.execveat and
12 nd_syscall.execveat probe aliases have been deprecated in favor of
13 the new 'dirfd' and 'dirfd_str' variables.
14
15 * What's new in version 2.7, 2015-02-18
16
17 - Some systemtap sample scripts are now identified with the "_best" keyword,
18 because they are generally useful or educational. They are now promoted
19 within the generated index files.
20
21 - Passing strings to and from functions has become faster due to optimization
22 (passing some strings by reference instead of by value/copy). It may
23 be disabled by using the unoptimize flag (-u).
24
25 To make embedded-C functions eligible for the same optimization, use the pragma
26 /* unmodified-fnargs */ to indicate that the function body will not modify
27 the function arguments. Remember to use MAXSTRINGLEN for string length,
28 rather than sizeof(string_arg) (which might now be a pointer).
29
30 - SystemTap now allows .function probes to be specified by their full function
31 name, file, and declaration line number. Use the .statement probe to probe a
32 specific line number.
33
34 - Tracepoint probes can now also be specified by the target subsystem. For
35 example, the following are all supported:
36
37 probe kernel.trace("sched:sched_switch") --> probe sched_switch found in the
38 sched subsystem
39 probe kernel.trace("sched:*") --> probe all tracepoints in sched subsystem
40
41 As a result, tapset functions such as pn() will now return a different string
42 than before. To retain the previous behaviour, use '--compatible=2.6'.
43
44 - The following functions are deprecated in release 2.7:
45 - _adjtx_mode_str(), _statfs_f_type_str(), _waitid_opt_str(),
46 _internal_wait_opt_str(), and _epoll_events_str().
47
48 - New tapset functions [u]symfileline(), [u]symfile() and [u]symline() will
49 return a string containing the specified portion of the filename:linenumber
50 match from a given address.
51
52 Using these functions may result in large generated modules from stored
53 address->file:line information.
54
55 * What's new in version 2.6, 2014-09-05
56
57 - SystemTap now supports on-the-fly arming/disarming of certain probe types:
58 kprobes, uprobes, and timer.*s(NUM) probes. For example, this probe
59
60 probe kernel.function("vfs_read") if (i > 4) { ... }
61
62 will automatically register/unregister the associated kprobe on vfs_read
63 whenever the value of the condition changes (as some probe handler
64 modifies 'i'). This allows us to avoid probe overhead when we're not
65 interested. If the arming capability is not relevant/useful, nest the
66 condition in the normal probe handler:
67
68 probe kernel.function("vfs_read") { if (i > 4) { ... } }
69
70 - statement("*@file:NNN").nearest probes now available to let systemtap
71 translate probe to nearest probe-able line to one given if necessary
72
73 - process("PATH").library("PATH").plt("NAME").return probes are now supported.
74
75 - SystemTap now supports SDT probes with operands that refer to symbols.
76
77 - While in listing mode (-l/-L), probes printed are now more consistent
78 and precise.
79
80 - Statement probes now support enumerated linenos to probe discontiguous
81 linenos using the form:
82
83 process.statement("foo@file.c:3,5-7,9")
84
85 - Statement counting is now suppressed in the generated c code for probes that
86 are non-recursive and loop-free. Statement counting can be turned back on in
87 unoptimize mode (-u).
88
89 - SystemTap now asserts that the PID provided for a process probe corresponds
90 to a running process.
91
92 - DWARF process probes can be bound to a specific process using the form:
93
94 process(PID).function("*")
95
96 - SystemTap now accepts additional scripts through the new -E SCRIPT option.
97 There still needs to be a main script specified through -e or file in order
98 to provide an additional script. This makes it feasible to have scripts in
99 the $HOME/.systemtap/rc file. For example:
100
101 -E 'probe begin, end, error { log("systemtap script " . pn()) }'
102 -E 'probe timer.s(30) { error ("timeout") }
103
104 The -E SCRIPT option can also be used in listing mode (-l/-L), such that
105 probe points for the additional scripts will not listed, but other parts of
106 the script are still available, such as macros or aliases.
107
108 - SystemTap now supports array slicing within foreach loop conditions, delete
109 statements and membership tests. Wildcards are represented by "*". Examples
110 of the expressions are:
111
112 foreach ([a,b,c] in val[*,2,*])
113 delete val[*, 2, *]
114 [*, 2, *] in val
115
116 - Integer expressions which are derived from DWARF values, like context $vars,
117 @cast, and @var, will now carry that type information into subsequent reads.
118 Such expressions can now use "->" and "[]" operators, as can local variables
119 which were assigned such values.
120
121 foo = $param->foo; printf("x:%d y:%d\n", foo->x, foo->y)
122 printf("my value is %d\n", ($type == 42 ? $foo : $bar)->value)
123 printf("my parent pid is %d\n", task_parent(task_current())->tgid)
124
125 * What's new in version 2.5, 2014-04-30
126
127 - Systemtap now supports backtracing through its own, invoking module.
128
129 - Java probes now support backtracing using the print_java_backtrace()
130 and sprint_java_backtrace() functions.
131
132 - Statement probes (e.g. process.statement) are now faster to resolve,
133 more precise, and work better with inlined functions.
134
135 - New switches have been added to help inspect the contents of installed
136 library files:
137
138 stap --dump-functions --> list all library functions and their args
139 stap --dump-probe-aliases --> list all library probe aliases
140
141 - The heuristic algorithms used to search for function-prologue
142 endings were improved, to cover more optimization (or
143 lack-of-optimization, or incorrect-debuginfo) cases. These
144 heuristics are necessary to find $context parameters for some
145 function-call/entry probes. We recommend programs be built with
146 CFLAGS+=-grecord-gcc-switches to feed information to the heuristics.
147
148 - The stap --use-server option now more correctly supports address:port
149 type parametrization, for manual use in the absence of avahi.
150
151 - A new probe alias "oneshot" allows a single quick script fragment to run,
152 then exit.
153
154 - The argv tapset now merges translate-time and run-time positional
155 arguments, so all of these work:
156
157 stap -e 'probe oneshot {println(argv[1]," ",argv[2])}' hello world
158
159 stap -e 'probe oneshot {println(argv[1]," ",argv[2])}' \
160 -G argv_1=hello -G argv_2=world
161
162 staprun hello.ko argv_1=hello argv_2=world
163
164 - SystemTap now falls back on the symbol table for probing
165 functions in processes if the debuginfo is not available.
166
167 - SystemTap now supports a %( guru_mode == 0 /* or 1 */ %)
168 conditional for making dual-use scripts.
169
170 - SystemTap now supports UEFI/SecureBoot systems, via
171 machine-owner-keys maintained by a trusted stap-server on the
172 network. (Key enrollment requires a one-time reboot and BIOS
173 conversation.)
174 https://sourceware.org/systemtap/wiki/SecureBoot
175
176 - SystemTap now reports more accurate and succinct errors on type
177 mismatches.
178
179 - Embedded-C functions may use STAP_RETURN(value) instead of the
180 more wordy STAP_RETVALUE assignment followed by a "goto out".
181 The macro supports numeric or string values as appropriate.
182 STAP_ERROR(...) is available to return with a (catchable) error.
183
184 - Some struct-sockaddr fields are now individually decoded for
185 socket-related syscalls:
186 probe syscall.connect { println (uaddr_af, ":", uaddr_ip) }
187
188 - The documentation for the SystemTap initscript service and the
189 SystemTap compile-server service have been completely converted from
190 README files to man pages (see systemtap(8) and stap-server(8)).
191
192 - SystemTap is now capable of inserting modules early during the boot
193 process on dracut-based systems. See the 'onboot' command in
194 systemtap(8) for more information.
195
196 - DWARF probes can now use the '.callee[s]' variants, which allow more
197 precise function probing. For example, the probe point
198
199 process("myproc").function("foo").callee("bar")
200
201 will fire upon entering bar() from foo(). A '.callees' probe will
202 instead place probes on all callees of foo().
203 Note that this also means that probe point wildcards should be used
204 with more care. For example, use signal.*.return rather than
205 signal.*.*, which would also match '.callees'. See stapprobes(3stap)
206 for more info. This feature requires at least GCC 4.7.
207
208 - A few new functions in the task_time tapsets, as well as a new tapset
209 function task_ancestry(), which prints out the parentage of a process.
210
211 - The kprocess.exec probe has been updated to use syscall.execve, which
212 allows access to the new process' arguments (through the new 'argstr'
213 or 'args' variables) as well as giving better support across kernel
214 versions. Note also that the 'filename' variable now holds the
215 filename (quoted), or the address (unquoted) if it couldn't be
216 retrieved.
217
218 - The [s]println() function can now be called without any arguments to
219 simply print a newline.
220
221 - Suggestions are now provided when markers could not be resolved. For
222 example, process("stap").mark("benchmart") will suggest 'benchmark'.
223
224 - SystemTap colors can now be turned off by simply setting
225 SYSTEMTAP_COLORS to be empty, rather than having to make it invalid.
226
227 - There is a new context tapset function, pnlabel(), which returns the
228 name of the label which fired.
229
230 - The following tapset variables and functions are deprecated in
231 release 2.5:
232 - The 'clone_flags', 'stack_start', 'stack_size',
233 'parent_tid_uaddr', and 'child_tid_uaddr' variables in the
234 'syscall.fork' and 'nd_syscall.fork' probe aliases.
235 - The '_sendflags_str()' and '_recvflags_str()' functions have been
236 deprecated in favor of the new '_msg_flags_str()' function.
237 - The 'flags' and 'flags_str' variables in the 'syscall.accept' and
238 'nd_syscall.accept' probe alias.
239 - The 'first', 'second', and 'uptr_uaddr' variables in the
240 'syscall.compat_sys_shmctl', and 'nd_syscall.compat_sys_shmctl'
241 probe aliases have been deprecated in favor of the new 'shmid',
242 'cmd', and 'buf_uaddr' variables.
243
244 * What's new in version 2.4, 2013-11-06
245
246 - Better suggestions are given in many of the semantic errors in which
247 alternatives are provided. Additionally, suggestions are now provided
248 when plt and trace probes could not be resolved. For example,
249 kernel.trace("sched_siwtch") will suggest 'sched_switch'.
250
251 - SystemTap is now smarter about error reporting. Errors from the same
252 source are considered duplicates and suppressed. A message is
253 displayed on exit if any errors/warnings were suppressed.
254
255 - Statistics aggregate typed objects are now implemented locklessly,
256 if the translator finds that they are only ever read (using the
257 foreach / @count / etc. constructs) in a probe-begin/end/error.
258
259 - SystemTap now supports probing inside virtual machines using the
260 libvirt and unix schemes, e.g.
261
262 stap -ve 'probe timer.s(1) { printf("hello!\n") }' \
263 --remote=libvirt://MyVirtualMachine
264
265 Virtual machines managed by libvirt can be prepared using stapvirt.
266 See stapvirt(1) and the --remote option in stap(1) for more details.
267
268 - Systemtap now checks for and uses (when available) the .gnu_debugdata
269 section which contains a subset of debuginfo, useful for backtraces
270 and function probing
271
272 - SystemTap map variables are now allocated with vmalloc() instead of
273 with kmalloc(), which should cause memory to be less fragmented.
274
275 - Although SystemTap itself requires elfutils 0.148+, staprun only
276 requires elfutils 0.142+, which could be useful with the
277 '--disable-translator' configure switch.
278
279 - Under FIPS mode (/proc/sys/crypto/fips_enabled=1), staprun will
280 refuse to load systemtap modules (since these are not normally
281 signed with the kernel's build-time keys). This protection may
282 be suppressed with the $STAP_FIPS_OVERRIDE environment variable.
283
284 - The stap-server client & server code now enable all SSL/TLS
285 ciphers rather than just the "export" subset.
286
287 - For systems with in-kernel utrace, 'process.end' and 'thread.end'
288 probes will hit before the target's parent process is notified of
289 the target's death. This matches the behavior of newer kernels
290 without in-kernel utrace.
291
292 * What's new in version 2.3, 2013-07-25
293
294 - More context-accessing functions throw systemtap exceptions upon a
295 failure, whereas in previous versions they might return non-error
296 sentinel values like "" or "<unknown>". Use try { } / catch { }
297 around these, or new wrapper functions such as user_string_{n_}quoted()
298 that internally absorb exceptions.
299
300 - java("org.my.MyApp") probes are now restricted to pre-existing jvm pid's with
301 a listing in jps -l output to avoid recursive calls
302
303 - The tapset [nd_]syscall.semop parameter tsops_uaddr is renamed sops_uaddr for
304 consistency with [nd_]syscall.semtimedop.
305
306 - The udp.stp tapset adds some ip-address/port variables.
307
308 - A new guru-mode-only tapset function raise() is available to send signals
309 to the current task.
310
311 - Support for the standard Posix ERE named character classes has been
312 added to the regexp engine, e.g. [:digit:], [:alpha:], ...
313
314 - A substantial internal overhaul of the regexp engine has resulted in
315 correct behaviour on further obscure edge cases. The regexp engine
316 now implements the ERE standard and correctly passes the testsuite
317 for the glibc regexp engine (minus portions corresponding to
318 unimplemented features -- i.e. subexpression capture and reuse).
319
320 - Alternative functions are now suggested when function probes could not be
321 resolved. For example, kernel.function("vfs_reads") will suggest vfs_read.
322 Other probes for which suggestions are made are module.function,
323 process.function, and process.library.function.
324
325 - Has life been a bit bland lately? Want to spice things up? Why not write a
326 few faulty probes and feast your eyes upon the myriad of colours adorning
327 your terminal as SystemTap softly whispers in your ear... 'parse error'.
328 Search for '--color' in 'man stap' for more info.
329
330 - The following tapset functions are deprecated in release 2.3:
331 'stap_NFS_CLIENT', '__getfh_inode', '_success_check',
332 '_sock_prot_num', '_sock_fam_num', '_sock_state_num',
333 '_sock_type_num', and '_sock_flags_num'.
334
335 * What's new in version 2.2.1, 2013-05-16
336 * What's new in version 2.2, 2013-05-14
337
338 - Experimental support has been added for probing Java methods using
339 Byteman 2.0 as a backend. Java method probes can target method entries,
340 returns, or specific statements in the method as specified by line number.
341
342 probe java("org.my.MyApp").class("^java.lang.Object").method("foo(int)")
343 { println($$parms) }
344
345 See java/README for information on how to set up Java/Byteman
346 functionality. Set env STAPBM_VERBOSE=yes for more tracing.
347
348 - The stap -l output and pn() tapset function's return value may be slightly
349 different for complicated web of wildcarded/aliased probes.
350
351 - The dyninst backend has improved in several aspects:
352
353 - Setting custom values for global variables is now supported, both
354 with -G when compiling a script, and from the stapdyn command line
355 when loading a precompiled module.
356
357 - A high-performance shared-memory-based transport is used for
358 trace data.
359
360 - A systemd service file and tmpfile have been added to allow
361 systemtap-server to be managed natively by systemd.
362
363 - Due to the removal of register_timer_hook in recent kernels, the
364 behaviour of timer.profile has been changed slightly. This probe is
365 now an alias which uses the old mechanism where possible, but falls
366 back to perf.sw.cpu_clock or another mechanism when the kernel timer
367 hook is not available.
368
369 To require the kernel timer hook mechanism in your script, use
370 timer.profile.tick instead of timer.profile.
371
372 - The following tapset variables are deprecated in release 2.2:
373 - The 'origin' variables in the 'generic.fop.llseek',
374 'generic.fop.llseek.return', and 'nfs.fop.llseek' probes. The
375 'origin' variable has been replaced by the 'whence' variable.
376 - The 'page_index' variable in the 'vfs.block_sync_page' and
377 'vfs.buffer_migrate_page' probe aliases.
378 - The 'write_from' and 'write_upto' variables in the
379 '_vfs.block_prepare_write' and '_vfs.block_prepare_write.return'
380 probe aliases.
381 - The 'regs' variable in the 'syscall.sigaltstack',
382 'nd_syscall.sigaltstack', 'syscall.fork', and 'nd_syscall.fork'
383 probe aliases.
384 - The 'first', 'second', 'third', and 'uptr_uaddr' variables in the
385 'syscall.compat_sys_shmat' and 'nd_syscall.compat_sys_shmat' probe
386 aliases.
387
388 - The following tapset functions are deprecated in release 2.2:
389 'ppos_pos', '_dev_minor', and '_dev_major'
390
391 - The folowing tapset functions used to return error strings instead
392 of raising an error. The original behavior is deprecated in release
393 2.2.
394
395 'ctime', 'probemod', 'modname'
396
397 * What's new in version 2.1, 2013-02-13
398
399 - EMACS and VIM editor modes for systemtap source files are included / updated.
400
401 - The translator now eliminates duplicate tapset files between its
402 preferred directory (as configured during the build with --prefix=/
403 or specified with the -I /path option), and files it may find under
404 $XDG_DATA_DIRS. This should eliminate a class of conflicts between
405 parallel system- and hand-built systemtap installations.
406
407 - The translator accepts a --suppress-time-limits option, which defeats
408 time-related constraints, to allows probe handlers to run for indefinite
409 periods. It requires the guru mode (-g) flag to work. Add the earlier
410 --suppress-handler-errors flag for a gung-ho "just-keep-going" attitude.
411
412 - Perf event probes may now be read on demand. The counter probe is
413 defined using the counter-name part:
414 probe perf.type(0).config(0).counter("NAME"). The counter is
415 read in a user space probe using @perf("NAME"), e.g.
416 process("PROCESS").statement("func@file") {stat <<< @perf("NAME")}
417
418 - Perf event probes may now be bound to a specific task using the
419 process-name part: probe perf.type(0).config(0).process("NAME") { }
420 If the probed process name is not specified, then it is inferred
421 from the -c CMD argument.
422
423 - Some error messages and warnings now refer to additional information
424 that is found in man pages. These are generally named
425 error::FOO or warning::BAR (in the 7stap man page section)
426 and may be read via
427 % man error::FOO
428 % man warning::BAR
429
430 - The dyninst backend has improved in several aspects:
431 - The runtime now allows much more concurrency when probing multithreaded
432 processes, and will also follow probes across forks.
433 - Several new probe types are now supported, including timers, function
434 return, and process.begin/end and process.thread.begin/end.
435 - Semaphores for SDT probes are now set properly.
436 - Attaching to existing processes with -x PID now works.
437
438 - The foreach looping construct can now sort aggregate arrays by the user's
439 choice of aggregating function. Previously, @count was implied. e.g.:
440 foreach ([x,y] in array @sum +) { println(@sum(array[x,y])) }
441
442 - Proof of concept support for regular expression matching has been added:
443 if ("aqqqqqb" =~ "q*b") { ... }
444 if ("abc" !~ "q*b") { ... }
445
446 The eventual aim is to support roughly the same functionality as
447 the POSIX Extended Regular Expressions implemented by glibc.
448 Currently missing features include extraction of the matched string
449 and subexpressions, and named character classes ([:alpha:], [:digit:], &c).
450
451 Special thanks go to the re2c project, whose public domain code this
452 functionality has been based on. For more info on re2c, see:
453 http://sourceforge.net/projects/re2c/
454
455 - The folowing tapset variables are deprecated in release 2.1 and will
456 be removed in release 2.2:
457 - The 'send2queue' variable in the 'signal.send' probe.
458 - The 'oldset_addr' and 'regs' variables in the 'signal.handle' probe.
459
460 - The following tapset probes are deprecated in release 2.1 and will
461 be removed in release 2.2:
462 - signal.send.return
463 - signal.handle.return
464
465 * What's new in version 2.0, 2012-10-09
466
467 - Systemtap includes a new prototype backend, which uses Dyninst to instrument
468 a user's own processes at runtime. This backend does not use kernel modules,
469 and does not require root privileges, but is restricted with respect to the
470 kinds of probes and other constructs that a script may use.
471
472 Users from source should configure --with-dyninst and install a
473 fresh dyninst snapshot such as that in Fedora rawhide. It may be
474 necessary to disable conflicting selinux checks; systemtap will advise.
475
476 Select this new backend with the new stap option --runtime=dyninst
477 and a -c target process, along with normal options. (-x target
478 processes are not supported in this prototype version.) For example:
479
480 stap --runtime=dyninst -c 'stap -l begin' \
481 -e 'probe process.function("main") { println("hi from dyninst!") }'
482
483 - To aid diagnosis, when a kernel panic occurs systemtap now uses
484 the panic_notifier_list facility to dump a summary of its trace
485 buffers to the serial console.
486
487 - The systemtap preprocessor now has a simple macro facility as follows:
488
489 @define add(a,b) %( ((@a)+(@b)) %)
490 @define probegin(x) %(
491 probe begin {
492 @x
493 }
494 %)
495
496 @probegin( foo = @add(40, 2); print(foo) )
497
498 Macros defined in the user script and regular tapset .stp files are
499 local to the file. To get around this, the tapset library can define
500 globally visible 'library macros' inside .stpm files. (A .stpm file
501 must contain a series of @define directives and nothing else.)
502
503 The status of the feature is experimental; semantics of macroexpansion
504 may change (unlikely) or expand in the future.
505
506 - Systemtap probe aliases may be used with additional suffixes
507 attached. The suffixes are passed on to the underlying probe
508 point(s) as shown below:
509
510 probe foo = bar, baz { }
511 probe foo.subfoo.option("gronk") { }
512 // expands to: bar.subfoo.option("gronk"), baz.subfoo.option("gronk")
513
514 In practical terms, this allows us to specify additional options to
515 certain tapset probe aliases, by writing e.g.
516 probe syscall.open.return.maxactive(5) { ... }
517
518 - To support the possibility of separate kernel and dyninst backends,
519 the tapsets have been reorganized into separate folders according to
520 backend. Thus kernel-specific tapsets are located under linux/, the
521 dyninst-specific ones under dyninst/
522
523 - The backtrace/unwind tapsets have been expanded to allow random
524 access to individual elements of the backtrace. (A caching mechanism
525 ensures that the backtrace computation run at most once for each
526 time a probe fires, regardless of how many times or what order the
527 query functions are called in.) New tapset functions are:
528 stack/ustack - return n'th element of backtrace
529 callers/ucallers - return first n elements of backtrace
530 print_syms/print_usyms - print full information on a list of symbols
531 sprint_syms/sprint_usyms - as above, but return info as a string
532
533 The following existing functions have been superseded by print_syms()
534 et al.; new scripts are recommended to avoid using them:
535 print_stack()
536 print_ustack()
537 sprint_stack()
538 sprint_ustack()
539
540 - The probefunc() tapset function is now myproc-unprivileged, and can
541 now be used in unprivileged scripts for such things as profiling in
542 userspace programs. For instance, try running
543 systemtap.examples/general/para-callgraph.stp in unprivileged mode
544 with a stapusr-permitted probe. The previous implementation of
545 probefunc() is available with "stap --compatible=1.8".
546
547 - Preprocessor conditional to vary code based on script privilege level:
548 unprivileged -- %( systemtap_privilege == "stapusr" %? ... %)
549 privileged -- %( systemtap_privilege != "stapusr" %? ... %)
550 or, alternately %( systemtap_privilege == "stapsys"
551 || systemtap_privilege == "stapdev" %? ... %)
552
553 - To ease migration to the embedded-C locals syntax introduced in 1.8
554 (namely, STAP_ARG_* and STAP_RETVALUE), the old syntax can now be
555 re-enabled on a per-function basis using the /* unmangled */ pragma:
556
557 function add_foo:long(a:long, b:long) %{ /* unmangled */
558 THIS->__retvalue = THIS->a + STAP_ARG_b;
559 %}
560
561 Note that both the old and the new syntax may be used in an
562 /* unmangled */ function. Functions not marked /* unmangled */
563 can only use the new syntax.
564
565 - Adjacent string literals are now glued together irrespective of
566 intervening whitespace or comments:
567 "foo " "bar" --> "foo bar"
568 "foo " /* comment */ "bar" --> "foo bar"
569 Previously, the first pair of literals would be glued correctly,
570 while the second would cause a syntax error.
571
572 * What's new in version 1.8, 2012-06-17
573
574 - staprun accepts a -T timeout option to allow less frequent wake-ups
575 to poll for low-throughput output from scripts.
576
577 - When invoked by systemtap, the kbuild $PATH environment is sanitized
578 (prefixed with /usr/bin:/bin:) in an attempt to exclude compilers
579 other than the one the kernel was presumed built with.
580
581 - Printf formats can now use "%#c" to escape non-printing characters.
582
583 - Pretty-printed bitfields use integers and chars use escaped formatting
584 for printing.
585
586 - The systemtap compile-server and client now support IPv6 networks.
587 - IPv6 addresses may now be specified on the --use-server option and will
588 be displayed by --list-servers, if the avahi-daemon service is running and
589 has IPv6 enabled.
590 - Automatic server selection will automatically choose IPv4 or IPv6 servers
591 according to the normal server selection criteria when avahi-daemon is
592 running. One is not preferred over the other.
593 - The compile-server will automatically listen on IPv6 addresses, if
594 available.
595 - To enable IPv6 in avahi-daemon, ensure that /etc/avahi/avahi-daemon.conf
596 contains an active "use-ipv6=yes" line. After adding this line run
597 "service avahi-daemon restart" to activate IPv6 support.
598 - See man stap(1) for details on how to use IPv6 addresses with the
599 --use-server option.
600
601 - Support for DWARF4 .debug_types sections (for executables and shared
602 libraries compiled with recent GCC's -gdwarf-4 / -fdebug-types-section).
603 PR12997. SystemTap now requires elfutils 0.148+, full .debug_types support
604 depends on elfutils 0.154+.
605
606 - Systemtap modules are somewhat smaller & faster to compile. Their
607 debuginfo is now suppressed by default; use -B CONFIG_DEBUG_INFO=y to
608 re-enable.
609
610 - @var now an alternative language syntax for accessing DWARF variables
611 in uprobe and kprobe handlers (process, kernel, module). @var("somevar")
612 can be used where $somevar can be used. The @var syntax also makes it
613 possible to access non-local, global compile unit (CU) variables by
614 specifying the CU source file as follows @var("somevar@some/src/file.c").
615 This will provide the target variable value of global "somevar" as defined
616 in the source file "some/src/file.c". The @var syntax combines with all
617 normal features of DWARF target variables like @defined(), @entry(),
618 [N] array indexing, field access through ->, taking the address with
619 the & prefix and shallow or deep pretty printing with a $ or $$ suffix.
620
621 - Stap now has resource limit options:
622 --rlimit-as=NUM
623 --rlimit-cpu=NUM
624 --rlimit-nproc=NUM
625 --rlimit-stack=NUM
626 --rlimit-fsize=NUM
627 All resource limiting has been moved from the compile server to stap
628 itself. When running the server as "stap-server", default resource
629 limit values are specified in ~stap-server/.systemtap/rc.
630
631 - Bug CVE-2012-0875 (kernel panic when processing malformed DWARF unwind data)
632 is fixed.
633
634 - The systemtap compile-server now supports multiple concurrent connections.
635 Specify the desired maximum number of concurrent connections with
636 the new stap-server/stap-serverd --max-threads option. Specify a
637 value of '0' to tell the server not to spawn any new threads (handle
638 all connections serially in the main thread). The default value is
639 the number of processor cores on the host.
640
641 - The following tapset functions are deprecated in release 1.8 and will be
642 removed in release 1.9:
643 daddr_to_string()
644
645 - SystemTap now mangles local variables to avoid collisions with C
646 headers included by tapsets. This required a change in how
647 embedded-C functions access local parameters and the return value slot.
648
649 Instead of THIS->foo in an embedded-C function, please use the newly
650 defined macro STAP_ARG_foo (substitute the actual name of the
651 argument for 'foo'); instead of THIS->__retvalue, use the newly
652 defined STAP_RETVALUE. All of the tapsets and test cases have been
653 adapted to use this new notation.
654
655 If you need to run code which uses the old THIS-> notation, run stap
656 with the --compatible=1.7 option.
657
658 - There is updated support for user-space probing against kernels >=
659 3.5, which have no utrace but do have the newer inode-uprobes work
660 by Srikar Dronamraju and colleagues. For kernels < 3.5, the
661 following 3 sets of kernel patches would need to be backported to
662 your kernel to use this preliminary user-space probing support:
663
664 - inode-uprobes patches:
665 - 2b144498350860b6ee9dc57ff27a93ad488de5dc
666 - 7b2d81d48a2d8e37efb6ce7b4d5ef58822b30d89
667 - a5f4374a9610fd7286c2164d4e680436727eff71
668 - 04a3d984d32e47983770d314cdb4e4d8f38fccb7
669 - 96379f60075c75b261328aa7830ef8aa158247ac
670 - 3ff54efdfaace9e9b2b7c1959a865be6b91de96c
671 - 35aa621b5ab9d08767f7bc8d209b696df281d715
672 - 900771a483ef28915a48066d7895d8252315607a
673 - e3343e6a2819ff5d0dfc4bb5c9fb7f9a4d04da73
674 - exec tracepoint kernel patch:
675 - 4ff16c25e2cc48cbe6956e356c38a25ac063a64d
676 - task_work_add kernel patches:
677 - e73f8959af0439d114847eab5a8a5ce48f1217c4
678 - 4d1d61a6b203d957777d73fcebf19d90b038b5b2
679 - 413cd3d9abeaef590e5ce00564f7a443165db238
680 - dea649b8ac1861107c5d91e1a71121434fc64193
681 - f23ca335462e3c84f13270b9e65f83936068ec2c
682
683 * What's new in version 1.7, 2012-02-01
684
685 - Map inserting and deleting is now significantly faster due to
686 improved hashing and larger hash tables. The hashes are also
687 now randomized to provide better protection against deliberate
688 collision attacks.
689
690 - Formatted printing is faster by compiling the formatting directives
691 to C code rather than interpreting at run time.
692
693 - Systemtap loads extra command line options from $SYSTEMTAP_DIR/rc
694 ($HOME/.systemtap/rc by default) before the normal argc/argv. This
695 may be useful to activate site options such as --use-server or
696 --download-debuginfo or --modinfo.
697
698 - The stap-server has seen many improvements, and is no longer considered
699 experimental.
700
701 - The stap-server service (initscript) now supports four new options:
702 -D MACRO[=VALUE]
703 --log LOGFILE
704 --port PORT-NUMBER
705 --SSL CERT-DATABASE
706 These allow the specification of macro definitions to be passed to stap
707 by the server, the location of the log file, network port number and
708 NSS certificate database location respectively. These options are also
709 supported within individual server configuration files. See stap-server
710 and initscript/README.stap-server for details. The stap-server is no
711 longer activated by default.
712
713 - process("PATH").[library("PATH")].function("NAME").exported probes are now
714 supported to filter function() to only exported instances.
715
716 - The translator supports a new --suppress-handler-errors option, which
717 causes most runtime errors to be turned into quiet skipped probes. This
718 also disables the MAXERRORS and MAXSKIPPED limits.
719
720 - Translator warnings have been standardized and controlled by the -w / -W
721 flags.
722
723 - The translator supports a new --modinfo NAME=VALUE option to emit additional
724 MODULE_INFO(n,v) macros into the generated code.
725
726 - There is no more fixed maximum number of VMA pages that will be tracked
727 at runtime. This reduces memory use for those scripts that don't need any,
728 or only limited target process VMA tracking and allows easier system
729 wide probes inspecting shared library variables and/or user backtraces.
730 stap will now silently ignore -DTASK_FINDER_VMA_ENTRY_ITEMS.
731
732 - The tapset functions remote_id() and remote_uri() identify the member of a
733 swarm of "stap --remote FOO --remote BAR baz.stp" concurrent executions.
734
735 - Systemtap now supports a new privilege level and group, "stapsys", which
736 is equivalent to the privilege afforded by membership in the group "stapdev",
737 except that guru mode (-g) functionality may not be used. To support this, a
738 new option, --privilege=[stapusr|stapsys|stapdev] has been added.
739 --privilege=stapusr is equivalent to specifying the existing --unprivileged
740 option. --privilege=stapdev is the default. See man stap(1) for details.
741
742 - Scripts that use kernel.trace("...") probes compile much faster.
743
744 - The systemtap module cache is cleaned less frequently, governed by the
745 number of seconds in the $SYSTEMTAP_DIR/cache/cache_clean_interval_s file.
746
747 - SDT can now define up to 12 arguments in a probe point.
748
749 - Parse errors no longer generate a cascade of false errors. Instead, a
750 parse error skips the rest of the current probe or function, and resumes
751 at the next one. This should generate fewer and better messages.
752
753 - Global array wrapping is now supported for both associative and statistics typed
754 arrays using the '%' character to signify a wrapped array. For example,
755 'global foo%[100]' would allow the array 'foo' to be wrapped if more than 100
756 elements are inserted.
757
758 - process("PATH").library("PATH").plt("NAME") probes are now supported.
759 Wildcards are supported in the plt-name part, to refer to any function in the
760 program linkage table which matches the glob pattern and the rest of the
761 probe point.
762
763 - A new option, --dump-probe-types, will dump a list of supported probe types.
764 If --unprivileged is also specified, the list will be limited to probe types
765 which are available to unprivileged users.
766
767 - Systemtap can now automatically download the required debuginfo
768 using abrt. The --download-debuginfo[=OPTION] can be used to
769 control this feature. Possible values are: 'yes', 'no', 'ask',
770 and a positive number representing the timeout desired. The
771 default behavior is to not automatically download the debuginfo.
772
773 - The translator has better support for probing C++ applications by
774 better undertanding of compilation units, nested types, templates,
775 as used in probe point and @cast constructs.
776
777 - On 2.6.29+ kernels, systemtap can now probe kernel modules that
778 arrive and/or depart during the run-time of a session. This allows
779 probing of device driver initialization functions, which had formerly been
780 blacklisted.
781
782 - New tapset functions for cpu_clock and local_clock access were added.
783
784 - There is some limited preliminary support for user-space probing
785 against kernels such as linux-next, which have no utrace but do have
786 the newer inode-uprobes work by Srikar Dronamraju and colleagues.
787
788 - The following probe types are deprecated in release 1.7 and will be
789 removed in release 1.8:
790 kernel.function(number).inline
791 module(string).function(number).inline
792 process.function(number).inline
793 process.library(string).function(number).inline
794 process(string).function(number).inline
795 process(string).library(string).function(number).inline
796
797 - The systemtap-grapher is deprecated in release 1.7 and will be removed in
798 release 1.8.
799
800 - The task_backtrace() tapset function was deprecated in 1.6 and has been
801 removed in 1.7.
802
803 - MAXBACKTRACE did work in earlier releases, but has now been documented
804 in the stap 1 manual page.
805
806 - New tapset function probe_type(). Returns a short string describing
807 the low level probe handler type for the current probe point.
808
809 - Both unwind and symbol data is now only collected and emitted for
810 scripts actually using backtracing or function/data symbols.
811 Tapset functions are marked with /* pragma:symbols */ or
812 /* pragma:unwind */ to indicate they need the specific data.
813
814 - Kernel backtraces can now be generated for non-pt_regs probe context
815 if the kernel support dump_trace(). This enables backtraces from
816 certain timer probes and tracepoints.
817
818 - ubacktrace() should now also work for some kernel probes on x86 which can
819 use the dwarf unwinder to recover the user registers to provide
820 more accurate user backtraces.
821
822 - For s390x the systemtap runtime now properly splits kernel and user
823 addresses (which are in separate address spaces on that architecture)
824 which enable user space introspection.
825
826 - ppc and s390x now supports user backtraces through the DWARF unwinder.
827
828 - ppc now handles function descriptors as symbol names correctly.
829
830 - arm support kernel backtraces through the DWARF unwinder.
831
832 - arm now have a uprobes port which enables user probes. This still
833 requires some kernel patches (user_regsets and tracehook support for
834 arm).
835
836 - Starting in release 1.7, these old variables will be deprecated:
837 - The 'pid' variable in the 'kprocess.release' probe has been
838 deprecated in favor of the new 'released_pid' variable.
839 - The 'args' variable in the
840 '_sunrpc.clnt.create_client.rpc_new_client_inline' probe has been
841 deprecated in favor of the new internal-only '__args' variable.
842
843 - Experimental support for recent kernels without utrace has been
844 added for the following probe types:
845
846 process(PID).begin
847 process("PATH").begin
848 process.begin
849 process(PID).thread.begin
850 process("PATH").thread.begin
851 process.thread.begin
852 process(PID).end
853 process("PATH").end
854 process.end
855 process(PID).thread.end
856 process("PATH").thread.end
857 process.thread.end
858 process(PID).syscall
859 process("PATH").syscall
860 process.syscall
861 process(PID).syscall.return
862 process("PATH").syscall.return
863 process.syscall.return
864
865 - staprun disables kprobe-optimizations in recent kernels, as problems
866 were found. (PR13193)
867
868 * What's new in version 1.6, 2011-07-25
869
870 - Security fixes for CVE-2011-2503: read instead of mmap to load modules,
871 CVE-2011-2502: Don't allow path-based auth for uprobes
872
873 - The systemtap compile-server no longer uses the -k option when calling the
874 translator (stap). As a result, the server will now take advantage of the
875 module cache when compiling the same script more than once. You may observe
876 an improvement in the performance of the server in this situation.
877
878 - The systemtap compile-server and client now each check the version of the
879 other, allowing both to adapt when communicating with a down-level
880 counterpart. As a result, all version of the client can communicate
881 with all versions of the server and vice-versa. Client will prefer newer
882 servers when selecting a server automatically.
883
884 - SystemTap has improved support for the ARM architecture. The
885 kread() and kwrite() operations for ARM were corrected allowing many
886 of the tapsets probes and function to work properly on the ARM
887 architecture.
888
889 - Staprun can now rename the module to a unique name with the '-R' option before
890 inserting it. Systemtap itself will also call staprun with '-R' by default.
891 This allows the same module to be inserted more than once, without conflicting
892 duplicate names.
893
894 - Systemtap error messages now provide feedback when staprun or any other
895 process fails to launch. This also specifically covers when the user
896 doesn't have the proper permissions to launch staprun.
897
898 - Systemtap will now map - to _ in module names. Previously,
899 stap -L 'module("i2c-core").function("*")' would be empty. It now returns
900 a list had stap -L 'module("i2c_core").function("*") been specified.
901
902 - Systemtap now fills in missing process names to probe points, to
903 avoid having to name them twice twice:
904 % stap -e 'probe process("a.out").function("*") {}' -c 'a.out ...'
905 Now the probed process name is inferred from the -c CMD argument.
906 % stap -e 'probe process.function("*") {}' -c 'a.out ...'
907
908 - stap -L 'process("PATH").syscall' will now list context variables
909
910 - Depends on elfutils 0.142+.
911
912 - Deprecated task_backtrace:string (task:long). This function will go
913 away after 1.6. Please run your scripts with stap --check-version.
914
915 * What's new in version 1.5, 2011-05-23
916
917 - Security fixes for CVE-2011-1781, CVE-2011-1769: correct DW_OP_{mod,div}
918 division-by-zero bug
919
920 - The compile server and its related tools (stap-gen-ert, stap-authorize-cert,
921 stap-sign-module) have been re-implemented in C++. Previously, these
922 components were a mix of bash scripts and C code. These changes should be
923 transparent to the end user with the exception of NSS certificate database
924 password prompting (see below). The old implementation would prompt more
925 than once for the same password in some situations.
926
927 - eventcount.stp now allows for event counting in the format of
928 'stap eventcount.stp process.end syscall.* ...', and also reports
929 corresponding event tid's.
930
931 - Systemtap checks that the build-id of the module being probed matches the
932 build-id saved in the systemtap module. Invoking systemtap with
933 -DSTP_NO_BUILDID_CHECK will bypass this build-id runtime verification. See
934 man ld(1) for info on --build-id.
935
936 - stapio will now report if a child process has an abnormal exit along with
937 the associated status or signal.
938
939 - Compiler optimization may sometimes result in systemtap not being able to
940 access a user-space probe argument. Compiling the application with
941 -DSTAP_SDT_ARG_CONSTRAINT=nr will force the argument to be an immediate or
942 register value which should enable systemtap to access the argument.
943
944 - GNU Gettext has now been intergrated with systemtap. Our translation
945 page can be found at http://www.transifex.net/projects/p/systemtap/ .
946 "make update-po" will generate the necessary files to use translated
947 messages. Please refer to the po/README file for more info and
948 please consider contributing to this I18N effort!
949
950 - The new addr() function returns the probe's instruction pointer.
951
952 - process("...").library("...") probes are now supported. Wildcards
953 are supported in the library-name part, to refer to any shared
954 library that is required by process-name, which matches the glob
955 pattern and the rest of the probe point.
956
957 - The "--remote USER@HOST" functionality can now be specified multiple times
958 to fan out on multiple targets. If the targets have distinct kernel and
959 architecture configurations, stap will automatically build the script
960 appropriately for each one. This option is also no longer considered
961 experimental.
962
963 - The NSS certificate database generated for use by the compile server is now
964 generated with no password. Previously, a random password was generated and
965 used to access the database. This change should be transparent to most users.
966 However, if you are prompted for a password when using systemtap, then
967 running $libexecdir/stap-gen-cert should correct the problem.
968
969 - The timestamp tapset includes jiffies() and HZ() for lightweight approximate
970 timekeeping.
971
972 - A powerful new command line option --version has been added.
973
974 - process.mark now supports $$parms for reading probe parameters.
975
976 - A new command line option, --use-server-on-error[=yes|no] is available
977 for stap. It instructs stap to retry compilation of a script using a
978 compile server if it fails on the local host. The default setting
979 is 'no'.
980
981 - The following deprecated tools have been removed:
982 stap-client
983 stap-authorize-server-cert
984 stap-authorize-signing-cert
985 stap-find-or-start-server
986 stap-find-servers
987 Use the --use-server, --trust-server and --list-servers options of stap
988 instead.
989
990 * What's new in version 1.4, 2011-01-17
991
992 - Security fixes for CVE-2010-4170, CVE-2010-4171: staprun module
993 loading/unloading
994
995 - A new /* myproc-unprivileged */ marker is now available for embedded C
996 code and and expressions. Like the /* unprivileged */ marker, it makes
997 the code or expression available for use in unprivileged mode (see
998 --unprivileged). However, it also automatically adds a call to
999 assert_is_myproc() to the code or expression, thus, making it available
1000 to the unprivileged user only if the target of the current probe is within
1001 the user's own process.
1002
1003 - The experimental "--remote USER@HOST" option will run pass 5 on a given
1004 ssh host, after building locally (or with --use-server) for that target.
1005
1006 - Warning messages from the script may now be suppressed with the stap
1007 and/or staprun -w option. By default, duplicate warning messages are
1008 suppressed (up to a certain limit). With stap --vp 00002 and above,
1009 the duplicate elimination is defeated.
1010
1011 - The print_ubacktrace and usym* functions attempt to print the full
1012 path of the user-space binaries' paths, instead of just the basename.
1013 The maximum saved path length is set by -DTASK_FINDER_VMA_ENTRY_PATHLEN,
1014 default 64. Warning messages are produced if unwinding fails due to
1015 a missing 'stap -d MODULE' option, providing preloaded unwind data.
1016
1017 - The new tz_ctime() tapset function prints times in the local time zone.
1018
1019 - More kernel tracepoints are accessible to the kernel.trace("...") mechanism,
1020 if kernel source trees or debuginfo are available. These formerly "hidden"
1021 tracepoints are those that are declared somewhere other than the usual
1022 include/linux/trace/ headers, such as xfs and kvm.
1023
1024 - debuginfo-based process("...").function/.statement/.mark probes support
1025 wildcards in the process-name part, to refer to any executable files that
1026 match the glob pattern and the rest of the probe point.
1027
1028 - The -t option now displays information per probe-point rather than a summary
1029 for each probe. It also now shows the derivation chain for each probe-point.
1030
1031 - A rewrite of the sys/sdt.h header file provides zero-cost startup (few or
1032 no ELF relocations) for the debuginfo-less near-zero-cost runtime probes.
1033 Binaries compiled with earlier sdt.h versions remain supported. The
1034 stap -L (listing) option now lists parameters for sys/sdt.h markers.
1035
1036 - The implementation of the integrated compile-server client has been
1037 extended.
1038 o --use-server now accepts an argument representing a particular server and
1039 may be specified more than once.
1040 o --list-servers now accepts an expanded range of arguments.
1041 o a new --trust-servers option has been added to stap to replace several
1042 old certificate-management scripts.
1043 o The following tools are now deprecated and will be removed in release 1.5:
1044 stap-client
1045 stap-authorize-server-cert
1046 stap-authorize-signing-cert
1047 stap-find-or-start-server
1048 stap-find-servers
1049 See man stap(1) for complete details.
1050
1051 - The compile-server now returns the uprobes.ko to the client when it is
1052 required by the script being compiled. The integrated compile-server client
1053 now makes it available to be loaded by staprun. The old (deprecated)
1054 stap-client does not do this.
1055
1056 - process probes with scripts as the target are recognized by stap and the
1057 interpreter would be selected for probing.
1058
1059 - Starting in release 1.5, these old variables/functions will be deprecated
1060 and will only be available when the '--compatible=1.4' flag is used:
1061
1062 - In the 'syscall.add_key' probe, the 'description_auddr' variable
1063 has been deprecated in favor of the new 'description_uaddr'
1064 variable.
1065 - In the 'syscall.fgetxattr', 'syscall.fsetxattr',
1066 'syscall.getxattr', 'syscall.lgetxattr', and
1067 'syscall.lremovexattr' probes, the 'name2' variable has been
1068 deprecated in favor of the new 'name_str' variable.
1069 - In the 'nd_syscall.accept' probe the 'flag_str' variable
1070 has been deprecated in favor of the new 'flags_str' variable.
1071 - In the 'nd_syscall.dup' probe the 'old_fd' variable has been
1072 deprecated in favor of the new 'oldfd' variable.
1073 - In the 'nd_syscall.fgetxattr', 'nd_syscall.fremovexattr',
1074 'nd_syscall.fsetxattr', 'nd_syscall.getxattr', and
1075 'nd_syscall.lremovexattr' probes, the 'name2' variable has been
1076 deprecated in favor of the new 'name_str' variable.
1077 - The tapset alias 'nd_syscall.compat_pselect7a' was misnamed. It should
1078 have been 'nd_syscall.compat_pselect7' (without the trailing 'a').
1079 - The tapset function 'cpuid' is deprecated in favor of the better known
1080 'cpu'.
1081 - In the i386 'syscall.sigaltstack' probe, the 'ussp' variable has
1082 been deprecated in favor of the new 'uss_uaddr' variable.
1083 - In the ia64 'syscall.sigaltstack' probe, the 'ss_uaddr' and
1084 'oss_uaddr' variables have been deprecated in favor of the new
1085 'uss_uaddr' and 'uoss_uaddr' variables.
1086 - The powerpc tapset alias 'syscall.compat_sysctl' was deprecated
1087 and renamed 'syscall.sysctl32'.
1088 - In the x86_64 'syscall.sigaltstack' probe, the 'regs_uaddr'
1089 variable has been deprecated in favor of the new 'regs' variable.
1090
1091 * What's new in version 1.3, 2010-07-21
1092
1093 - The uprobes kernel module now has about half the overhead when probing
1094 NOPs, which is particularly relevant for sdt.h markers.
1095
1096 - New stap option -G VAR=VALUE allows overriding global variables
1097 by passing the settings to staprun as module options.
1098
1099 - The tapset alias 'syscall.compat_pselect7a' was misnamed. It should
1100 have been 'syscall.compat_pselect7' (without the trailing 'a').
1101 Starting in release 1.4, the old name will be deprecated and
1102 will only be available when the '--compatible=1.3' flag is used.
1103
1104 - A new procfs parameter .umask(UMASK) which provides modification of
1105 file permissions using the proper umask value. Default file
1106 permissions for a read probe are 0400, 0200 for a write probe, and
1107 0600 for a file with a read and write probe.
1108
1109 - It is now possible in some situations to use print_ubacktrace() to
1110 get a user space stack trace from a kernel probe point. e.g. for
1111 user backtraces when there is a pagefault:
1112 $ stap -d /bin/sort --ldd -e 'probe vm.pagefault {
1113 if (pid() == target()) {
1114 printf("pagefault @0x%x\n", address); print_ubacktrace();
1115 } }' -c /bin/sort
1116 [...]
1117 pagefault @0x7fea0595fa70
1118 0x000000384f07f958 : __GI_strcmp+0x12b8/0x1440 [libc-2.12.so]
1119 0x000000384f02824e : __gconv_lookup_cache+0xee/0x5a0 [libc-2.12.so]
1120 0x000000384f021092 : __gconv_find_transform+0x92/0x2cf [libc-2.12.so]
1121 0x000000384f094896 : __wcsmbs_load_conv+0x106/0x2b0 [libc-2.12.so]
1122 0x000000384f08bd90 : mbrtowc+0x1b0/0x1c0 [libc-2.12.so]
1123 0x0000000000404199 : ismbblank+0x39/0x90 [sort]
1124 0x0000000000404a4f : inittables_mb+0xef/0x290 [sort]
1125 0x0000000000406934 : main+0x174/0x2510 [sort]
1126 0x000000384f01ec5d : __libc_start_main+0xfd/0x1d0 [libc-2.12.so]
1127 0x0000000000402509 : _start+0x29/0x2c [sort]
1128 [...]
1129
1130 - New tapset functions to get a string representation of a stack trace:
1131 sprint_[u]backtrace() and sprint_[u]stack().
1132
1133 - New tapset function to get the module (shared library) name for a
1134 user space address umodname:string(long). The module name will now
1135 also be in the output of usymdata() and in backtrace addresses even
1136 when they were not given with -d at the command line.
1137
1138 - Kernel backtraces are now much faster (replaced a linear search
1139 with a binary search).
1140
1141 - A new integrated compile-server client is now available as part of stap.
1142
1143 o 'stap --use-server ...' is equivalent to 'stap-client ...'
1144 o 'stap --list-servers' is equivalent to 'stap-find-servers'
1145 o 'stap --list-servers=online' is equivalent to 'stap-find-servers --all'
1146 o stap-client and its related tools will soon be deprecated.
1147 o the nss-devel and avahi-devel packages are required for building stap with
1148 the integrated client (checked during configuration).
1149 o nss and avahi are required to run the integrated client.
1150
1151 - A new operator @entry is available for automatically saving an expression
1152 at entry time for use in a .return probe.
1153 probe foo.return { println(get_cycles() - @entry(get_cycles())) }
1154
1155 - Probe $target variables and @cast() can now use a suffix to print complex
1156 data types as strings. Use a single '$' for a shallow view, or '$$' for a
1157 deeper view that includes nested types. For example, with fs_struct:
1158 $fs$ : "{.users=%i, .lock={...}, .umask=%i,
1159 .in_exec=%i, .root={...}, .pwd={...}}"
1160 $fs$$ : "{.users=%i, .lock={.raw_lock={.lock=%u}}, .umask=%i, .in_exec=%i,
1161 .root={.mnt=%p, .dentry=%p}, .pwd={.mnt=%p, .dentry=%p}}"
1162
1163 - The <sys/sdt.h> user-space markers no longer default to an implicit
1164 MARKER_NAME_ENABLED() semaphore check for each marker. To check for
1165 enabled markers use a .d declaration file, then:
1166 if (MARKER_NAME_ENABLED()) MARKER_NAME()
1167
1168 - Hyphenated <sys/sdt.h> marker names such as process(...).mark("foo-bar")
1169 are now accepted in scripts. They are mapped to the double-underscore
1170 form ("foo__bar").
1171
1172 - More robust <sys/sdt.h> user-space markers support is included. For
1173 some platforms (x86*, ppc*), this can let systemtap probe the markers
1174 without debuginfo. This implementation also supports preserving
1175 the "provider" name associated with a marker:
1176 probe process("foo").provider("bar").mark("baz") to match
1177 STAP_PROBE<n>(bar, baz <...>)
1178 (Compile with -DSTAP_SDT_V1 to revert to the previous implementation.
1179 Systemtap supports pre-existing or new binaries using them.)
1180
1181 - Embedded-C may be used within expressions as values, when in guru mode:
1182 num = %{ LINUX_VERSION_CODE %} // int64_t
1183 name = %{ /* string */ THIS_MODULE->name %} // const char*
1184 printf ("%s %x\n", name, num)
1185 The usual /* pure */, /* unprivileged */, and /* guru */ markers may be used
1186 as with embedded-C functions.
1187
1188 - By default the systemtap-runtime RPM builds now include a shared
1189 library, staplog.so, that allows crash to extract systemtap data from
1190 a vmcore image.
1191
1192 - Iterating with "foreach" can now explicitly save the value for the loop.
1193 foreach(v = [i,j] in array)
1194 printf("array[%d,%s] = %d\n", i, j, v /* array[i,j] */)
1195
1196 - The new "--ldd" option automatically adds any additional shared
1197 libraries needed by probed or -d-listed userspace binaries to the -d
1198 list, to enable symbolic backtracing through them. Similarly, the
1199 new "--all-modules" option automatically adds any currently loaded
1200 kernel modules (listed in /proc/modules) to the -d list.
1201
1202 - A new family of set_kernel_* functions make it easier for gurus to write
1203 new values at arbitrary memory addresses.
1204
1205 - Probe wildcards can now use '**' to cross the '.' separator.
1206 $ stap -l 'sys**open'
1207 syscall.mq_open
1208 syscall.open
1209
1210 - Backward compatibility flags (--compatible=VERSION, and matching
1211 script preprocessing predicate %( systemtap_v CMP "version" %)
1212 and a deprecation policy are being introduced, in case future
1213 tapset/language changes break valid scripts.
1214
1215 * What's new in version 1.2, 2010-03-22
1216
1217 - Prototype support for "perf events", where the kernel supports the
1218 2.6.33 in-kernel API. Probe points may refer to low-level
1219 perf_event_attr type/config numbers, or to a number of aliases
1220 defined in the new perf.stp tapset:
1221 probe perf.sw.cpu_clock, perf.type(0).config(4) { }
1222
1223 - Type-casting can now use multiple headers to resolve codependencies.
1224 @cast(task, "task_struct",
1225 "kernel<linux/sched.h><linux/fs_struct.h>")->fs->umask
1226
1227 - Tapset-related man pages have been renamed. 'man -k 3stap' should show
1228 the installed list, which due to prefixing should no longer collide over
1229 ordinary system functions.
1230
1231 - User space marker arguments no longer use volatile if the version of gcc,
1232 which must be at least 4.5.0, supports richer DWARF debuginfo. Use cflags
1233 -DSTAP_SDT_VOLATILE=volatile or -DSTAP_SDT_VOLATILE= when building
1234 the sys/sdt.h application to override this one way or another.
1235
1236 - A new construct for error handling is available. It is similar to c++
1237 exception catching, using try and catch as new keywords. Within a handler
1238 or function, the following is valid and may be nested:
1239 try { /* arbitrary statements */ }
1240 catch (er) { /* e.g. println("caught error ", er) */ }
1241
1242 - A new command line flag '-W' forces systemtap to abort translation of
1243 a script if any warnings are produced. It is similar to gcc's -Werror.
1244 (If '-w' is also supplied to suppress warnings, it wins.)
1245
1246 - A new predicate @defined is available for testing whether a
1247 particular $variable/expression is resolvable at translate time:
1248 probe foo { if (@defined($bar)) log ("$bar is available here") }
1249
1250 - Adjacent string literals are glued together, making this
1251 construct valid:
1252 probe process("/usr" @1 "/bin").function("*") { ... }
1253
1254 - In order to limit potential impact from future security problems,
1255 the stap-server process does not permit its being launched as root.
1256
1257 - On recent kernels, for some architectures/configurations, hardware
1258 breakpoint probes are supported. The probe point syntax is:
1259
1260 probe kernel.data(ADDRESS).write
1261 probe kernel.data(ADDRESS).length(LEN).write
1262 probe kernel.data("SYMBOL_NAME").write
1263
1264 * What's new in version 1.1, 2010-01-15
1265
1266 - New tracepoint based tapset for memory subsystem.
1267
1268 - The loading of signed modules by staprun is no longer allowed for
1269 ordinary, unprivileged users. This means that only root, members of
1270 the group 'stapdev' and members of the group 'stapusr' can load
1271 systemtap modules using staprun, stap or stap-client. The minimum
1272 privilege required to run arbitrary --unprivileged scripts is now
1273 'stapusr' membership.
1274
1275 - The stap-server initscript is available. This initscript allows you
1276 to start systemtap compile servers as a system service and to manage
1277 these servers as a group or individually. The stap-server initscript
1278 is installed by the systemtap-server rpm. The build directory for
1279 the uprobes module (/usr/share/systemtap/runtime/uprobes) is made
1280 writable by the 'stap-server' group. All of the files generated when
1281 building the uprobes module, including the digital signature, are
1282 also writable by members of stap-server.
1283
1284 See initscript/README.stap-server for details.
1285
1286 - Some of the compile server client, server and certificate management
1287 tools have been moved from $bindir to $libexecdir/systemtap.
1288 You should use the new stap-server script or the stap-server initscript
1289 for server management where possible. The stap-server script provides the same
1290 functionality as the stap-server initscript except that the servers are
1291 run by the invoking user by default as opposed to servers started by the
1292 stap-server initscript which are run by the user stap-server
1293 by default. See stap-server(8) for more information.
1294
1295 You may continue to use these tools by adding $libexecdir/systemtap to
1296 your path. You would need to do this, for example, if you are not root,
1297 you want to start a compile server and you are not running systemtap from a
1298 private installation. In this case you still need to use stap-start-server.
1299
1300 - Any diagnostic output line that starts with "ERROR", as in
1301 error("foo"), will promote a "Pass 5: run failed", and the return
1302 code is 1.
1303
1304 - Systemtap now warns about global variables being referenced from other
1305 script files. This aims to protect against unintended local-vs-global
1306 namespace collisions such as:
1307
1308 % cat some_tapset.stp
1309 probe baz.one = bar { foo = $foo; bar = $bar }
1310 % cat end_user_script.stp
1311 global foo # intended to be private variable
1312 probe timer.s(1) { foo ++ }
1313 probe baz.* { println(foo, pp()) }
1314 % stap end_user_script.stp
1315 WARNING: cross-file global variable reference to foo from some_tapset.stp
1316
1317 - Preprocessor conditional for kernel configuration testing:
1318 %( CONFIG_foo == "y" %? ... %)
1319
1320 - ftrace(msg:string) tapset function to send strings to the system-wide
1321 ftrace ring-buffer (if any).
1322
1323 - Better support for richer DWARF debuginfo output from GCC 4.5
1324 (variable tracking assignments). Kernel modules are now always resolved
1325 against all their dependencies to find any info referring to missing
1326 symbols. DW_AT_const_value is now supported when no DW_AT_location
1327 is available.
1328
1329 * What's new in verson 1.0, 2009-09-22
1330
1331 - process().mark() probes now use an enabling semaphore to reduce the
1332 computation overhead of dormant probes.
1333
1334 - The function spec for dwarf probes now supports C++ scopes, so you can
1335 limit the probes to specific namespaces or classes. Multiple scopes
1336 can be specified, and they will be matched progressively outward.
1337 probe process("foo").function("std::vector<*>::*") { }
1338 probe process("foo").function("::global_function") { }
1339
1340 - It is now possible to cross-compile systemtap scripts for foreign
1341 architectures, using the new '-a ARCH' and '-B OPT=VALUE' flags.
1342 For example, put arm-linux-gcc etc. into your $PATH, and point
1343 systemtap at the target kernel build tree with:
1344 stap -a arm -B CROSS_COMPILE=arm-linux- -r /build/tree [...]
1345 The -B option is passed to kbuild make. -r identifies the already
1346 configured/built kernel tree and -a its architecture (kbuild ARCH=...).
1347 Systemtap will infer -p4.
1348
1349 - Cross compilation using the systemtap client and server
1350 - stap-start-server now accepts the -r, -R, -I, -B and -a options in
1351 order to start a cross compiling server. The server will correctly
1352 advertise itself with respect to the kernel release and architecture
1353 that it compiles for.
1354 - When specified on stap-client, the -r and -a options will be
1355 considered when searching for a suitable server.
1356
1357 - When using the systemtap client and server udp port 5353 must be open
1358 in your firewall in order for the client to find servers using
1359 avahi-browse. Also the systemtap server will choose a random port in
1360 the range 1024-63999 for accepting ssl connections.
1361
1362 - Support for unprivileged users:
1363 ***********************************************************************
1364 * WARNING!!!!!!!!!! *
1365 * This feature is EXPERIMENTAL at this time and should be used with *
1366 * care. This feature allows systemtap kernel modules to be loaded by *
1367 * unprivileged users. The user interface and restrictions will change *
1368 * as this feature evolves. *
1369 ***********************************************************************
1370 - Systemtap modules generated from scripts which use a restricted
1371 subset of the features available may be loaded by staprun for
1372 unprivileged users. Previously, staprun would load modules only for
1373 root or for members of the groups stapdev and stapusr.
1374 - Using the --unprivileged option on stap enables translation-time
1375 checking for use by unprivileged users (see restrictions below).
1376 - All modules deemed suitable for use by unprivileged users will be
1377 signed by the systemtap server when --unprivileged is specified on
1378 stap-client. See module signing in release 0.9.8 and stap-server in
1379 release 0.9 below.
1380 - Modules signed by trusted signers (servers) and verified by staprun
1381 will be loaded by staprun regardless of the user's privilege level.
1382 - The system administrator asserts the trustworthiness of a signer
1383 (server) by running stap-authorize-signing-cert <cert-file> as root,
1384 where the <cert-file> can be found in
1385 ~<user>/.systemtap/ssl/server/stap.cert for servers started by
1386 ordinary users and in $sysconfdir/systemtap/ssl/server/stap.cert for
1387 servers started by root.
1388 - Restrictions are intentionally strict at this time and may be
1389 relaxed in the future:
1390 - probe points are restricted to:
1391 begin, begin(n), end, end(n), error, error(n), never,
1392 timer.{jiffies,s,sec,ms,msec,us,usec,ns,nsec}(n)*, timer.hz(n),
1393 process.* (for processes owned by the user).
1394 - use of embedded C code is not allowed.
1395 - use of tapset functions is restricted.
1396 - some tapset functions may not be used at all. A message will be
1397 generated at module compilation time.
1398 - some actions by allowed tapset functions may only be performed
1399 in the context of the user's own process. A runtime fault will
1400 occur in these situations, for example, direct memory access.
1401 - The is_myproc() tapset function has been provided so that
1402 tapset writers for unprivileged users can check that the
1403 context is of the users own process before attempting these
1404 actions.
1405 - accessing the kernel memory space is not allowed.
1406 - The following command line options may not be used by stap-client
1407 -g, -I, -D, -R, -B
1408 - The following environment variables are ignored by stap-client:
1409 SYSTEMTAP_RUNTIME, SYSTEMTAP_TAPSET, SYSTEMTAP_DEBUGINFO_PATH
1410 - nss and nss-tools are required to use this feature.
1411
1412 - Support output file switching by SIGUSR2. Users can command running
1413 stapio to switch output file by sending SIGUSR2.
1414
1415 - Memory consumption for scripts involving many uprobes has been
1416 dramatically reduced.
1417
1418 - The preprocessor now supports || and && in the conditions.
1419 e.g. %( arch == "x86_64" || arch == "ia64" %: ... %)
1420
1421 - The systemtap notion of "architecture" now matches the kernel's, rather
1422 than that of "uname -m". This means that 32-bit i386 family are all
1423 known as "i386" rather than "i386" or "i686"; "ppc64" as "powerpc";
1424 "s390x" as "s390", and so on. This is consistent between the new
1425 "-a ARCH" flag and the script-level %( arch ... %) conditional.
1426
1427 - It is now possible to define multiple probe aliases with the same name.
1428 A probe will expand to all matching aliases.
1429 probe foo = bar { }
1430 probe foo = baz { }
1431 probe foo { } # expands twice, once to bar and once to baz
1432
1433 - A new experimental transport mechanism, using ftrace's ring_buffer,
1434 has been added. This may become the default transport mechanism in
1435 future versions of systemtap. To test this new transport mechanism,
1436 define 'STP_USE_RING_BUFFER'.
1437
1438 - Support for recognizing DW_OP_{stack,implicit}_value DWARF expressions
1439 as emitted by GCC 4.5.
1440
1441 * What's new in version 0.9.9, 2009-08-04
1442
1443 - Systemwide kernel .function.return (kretprobe) maxactive defaults may
1444 be overridden with the -DKRETACTIVE=nnn parameter.
1445
1446 - Translation pass 2 is significantly faster by avoiding unnecessary
1447 searching through a kernel build/module directory tree.
1448
1449 - When compiled against elfutils 0.142 systemtap now handles the new
1450 DW_OP_call_frame_CFA generated by by GCC.
1451
1452 - uprobes and ustack() are more robust when used on applications that
1453 depend on prelinked/separate debuginfo shared libraries.
1454
1455 - User space PROBE marks are not always found with or without separate
1456 debuginfo. The .probes section itself is now always put in the main
1457 elf file and marked as allocated. When building pic code the section
1458 is marked writable. The selinux memory check problems seen with
1459 programs using STAP_PROBES is fixed.
1460
1461 - statement() probes can now override "address not at start of statement"
1462 errors in guru mode. They also provide alternative addresses to use
1463 in non-guru mode.
1464
1465 - The stapgraph application can generate graphs of data and events
1466 emitted by systemtap scripts in real time. Run "stapgraph
1467 testsuite/systemtap.examples/general/grapher.stp" for an example of
1468 graphing the system load average and keyboard events.
1469
1470 - Dwarf probes now show parameters and local variables in the verbose
1471 listing mode (-L).
1472
1473 - Symbol aliases are now resolved to their canonical dwarf names. For
1474 example, probing "malloc" in libc resolves to "__libc_malloc".
1475
1476 - The syntax for dereferencing $target variables and @cast() gained new
1477 capabilities:
1478 - Array indexes can now be arbitrary numeric expressions.
1479 - Array subscripts are now supported on pointer types.
1480 - An '&' operator before a @cast or $target returns the address of the
1481 final component, especially useful for nested structures.
1482
1483 - For reading all probe variables, kernel.mark now supports $$vars and
1484 $$parms, and process.syscall now supports $$vars.
1485
1486 - The SNMP tapset provides probes and functions for many network
1487 statistics. See stapprobes.snmp(3stap) for more details.
1488
1489 - The dentry tapset provides functions to map kernel VFS directory entries
1490 to file or full path names: d_path(), d_name() and reverse_path_walk().
1491
1492 - SystemTap now has userspace markers in its own binaries, and the stap
1493 tapset provides the available probepoints and local variables.
1494
1495 - Miscellaneous new tapset functions:
1496 - pgrp() returns the process group ID of the current process
1497 - str_replace() performs string replacement
1498
1499 * What's new in version 0.9.8, 2009-06-11
1500
1501 - Miscellaneous new tapset functions:
1502 - sid() returns the session ID of the current process
1503 - stringat() indexes a single character from a string.
1504
1505 - Using %M in print formats for hex dumps can now print entire buffers,
1506 instead of just small numbers.
1507
1508 - Dwarfless syscalls: The nd_syscalls tapset is now available to probe
1509 system calls without requiring kernel debugging information. All of
1510 the same probepoints in the normal syscalls tapset are available with
1511 an "nd_" prefix, e.g. syscall.open becomes nd_syscall.open. Most
1512 syscall arguments are also available by name in nd_syscalls.
1513
1514 - Module signing: If the appropriate nss libraries are available on your
1515 system, stap-server will sign each compiled module using a self-generated
1516 certificate. This is the first step toward extending authority to
1517 load certain modules to unprivileged users. For now, if the system
1518 administrator adds a certificate to a database of trusted signers
1519 (stap-authorize-signing-cert), modules signed using that certificate
1520 will be verified by staprun against tampering. Otherwise, you should
1521 notice no difference in the operation of stap or staprun.
1522
1523 * What's new in version 0.9.7, 2009-04-23
1524
1525 - @cast can now determine its type information using an explicit header
1526 specification. For example:
1527 @cast(tv, "timeval", "<sys/time.h>")->tv_sec
1528 @cast(task, "task_struct", "kernel<linux/sched.h>")->tgid
1529
1530 - The overlapping process.* tapsets are now separated. Those probe points
1531 documented in stapprobes(3stap) remain the same. Those that were formerly
1532 in stapprobes.process(3stap) have been renamed to kprocess, to reflect
1533 their kernel perspective on processes.
1534
1535 - The --skip-badvars option now also suppresses run-time error
1536 messages that would otherwise result from erroneous memory accesses.
1537 Such accesses can originate from $context expressions fueled by
1538 erroneous debug data, or by kernel_{long,string,...}() tapset calls.
1539
1540 - New probes kprobe.function(FUNCTION) and kprobe.function(FUNCTION).return
1541 for dwarfless probing. These postpone function address resolution to
1542 run-time and use the kprobe symbol-resolution mechanism.
1543 Probing of absolute statements can be done using the
1544 kprobe.statement(ADDRESS).absolute construct.
1545
1546 - EXPERIMENTAL support for user process unwinding. A new collection of
1547 tapset functions have been added to handle user space backtraces from
1548 probe points that support them (currently process and timer probes -
1549 for timer probes test whether or not in user space first with the
1550 already existing user_mode() function). The new tapset functions are:
1551 uaddr - User space address of current running task.
1552 usymname - Return the symbol of an address in the current task.
1553 usymdata - Return the symbol and module offset of an address.
1554 print_ustack - Print out stack for the current task from string.
1555 print_ubacktrace - Print stack back trace for current task.
1556 ubacktrace - Hex backtrace of current task stack.
1557 Please read http://sourceware.org/ml/systemtap/2009-q2/msg00364.html
1558 on the current restrictions and possible changes in the future and
1559 give feedback if you want to influence future developments.
1560
1561 * What's new in version 0.9.5, 2009-03-27
1562
1563 - New probes process().insn and process().insn.block that allows
1564 inspection of the process after each instruction or block of
1565 instructions executed. So to count the total number of instructions
1566 a process executes during a run do something like:
1567 $ stap -e 'global steps; probe process("/bin/ls").insn {steps++}
1568 probe end {printf("Total instructions: %d\n", steps);}' \
1569 -c /bin/ls
1570 This feature can slow down execution of a process somewhat.
1571
1572 - Systemtap probes and function man pages extracted from the tapsets
1573 are now available under 3stap. To show the page for probe vm.pagefault
1574 or the stap function pexecname do:
1575 $ man 3stap vm.pagefault
1576 $ man 3stap pexecname
1577
1578 - Kernel tracepoints are now supported for probing predefined kernel
1579 events without any debuginfo. Tracepoints incur less overhead than
1580 kprobes, and context parameters are available with full type
1581 information. Any kernel 2.6.28 and later should have defined
1582 tracepoints. Try the following to see what's available:
1583 $ stap -L 'kernel.trace("*")'
1584
1585 - Typecasting with @cast now supports modules search paths, which is
1586 useful in case there are multiple places where the type definition
1587 may be found. For example:
1588 @cast(sdev, "scsi_device", "kernel:scsi_mod")->sdev_state
1589
1590 - On-file flight recorder is supported. It allows stap to record huge
1591 trace log on the disk and to run in background.
1592 Passing -F option with -o option runs stap in background mode. In this
1593 mode, staprun is detached from console, and stap itself shows staprun's
1594 pid and exits.
1595 Specifying the max size and the max number of log files are also available
1596 by passing -S option. This option has one or two arguments seperated by
1597 a comma. The first argument is the max size of a log file in MB. If the
1598 size of a log file exceeds it, stap switches to the next log file
1599 automatically. The second is how many files are kept on the disk. If the
1600 number of log files exceeds it, the oldest log file is removed
1601 automatically. The second argument can be omitted.
1602
1603 For example, this will record output on log files each of them is smaller
1604 than 1024MB and keep last 3 logs, in background.
1605 % stap -F -o /tmp/staplog -S 1024,3 script.stp
1606
1607 - In guru mode (-g), the kernel probing blacklist is disabled, leaving
1608 only a subset - the kernel's own internal kprobe blacklist - to attempt
1609 to filter out areas unsafe to probe. The differences may be enough to
1610 probe more interrupt handlers.
1611
1612 - Variables unavailable in current context may be skipped by setting a
1613 session level flag with command line option --skip-badvars now available.
1614 This replaces any dwarf $variable expressions that could not be resolved
1615 with literal numeric zeros, along with a warning message.
1616
1617 - Both kernel markers and kernel tracepoint support argument listing
1618 through stap -L 'kernel.mark("*")' or stap -L 'kernel.trace("*")'
1619
1620 - Users can use -DINTERRUPTIBLE=0 to prevent interrupt reentrancy in
1621 their script, at the cost of a bit more overhead to toggle the
1622 interrupt mask.
1623
1624 - Added reentrancy debugging. If stap is run with the arguments
1625 "-t -DDEBUG_REENTRANCY", additional warnings will be printed for
1626 every reentrancy event, including the probe points of the
1627 resident and interloper probes.
1628
1629 - Default to --disable-pie for configure.
1630 Use --enable-pie to turn it back on.
1631
1632 - Improved sdt.h compatibility and test suite for static dtrace
1633 compatible user space markers.
1634
1635 - Some architectures now use syscall wrappers (HAVE_SYSCALL_WRAPPERS).
1636 The syscall tapset has been enhanced to take care of the syscall
1637 wrappers in this release.
1638
1639 - Security fix for CVE-2009-0784: stapusr module-path checking race.
1640
1641 * What's new in version 0.9, 2009-02-19
1642
1643 - Typecasting is now supported using the @cast operator. A script can
1644 define a pointer type for a "long" value, and then access type members
1645 using the same syntax as with $target variables. For example, this will
1646 retrieve the parent pid from a kernel task_struct:
1647 @cast(pointer, "task_struct", "kernel")->parent->pid
1648
1649 - process().mark() probes are now possible to trace static user space
1650 markers put in programs with the STAP_PROBE macro using the new
1651 sys/sdt.h include file. This also provides dtrace compatible markers
1652 through DTRACE_PROBE and an associated python 'dtrace' script that
1653 can be used in builds based on dtrace that need dtrace -h or -G
1654 functionality.
1655
1656 - For those that really want to run stap from the build tree there is
1657 now the 'run-stap' script in the top-level build directory that sets
1658 up the SYSTEMTAP_TAPSET, SYSTEMTAP_RUNTIME, SYSTEMTAP_STAPRUN, and
1659 SYSTEMTAP_STAPIO environment variables (installing systemtap, in a
1660 local prefix, is still recommended for common use).
1661
1662 - Systemtap now comes with a new Beginners Guide that walks the user
1663 through their first steps setting up stap, understanding how it all
1664 works, introduces some useful scripts and describes some common
1665 pitfalls. It isn't created by default since it needs a Publican
1666 setup, but full build instructions can be found in the wiki:
1667 http://sourceware.org/systemtap/wiki/PublicanQuikHowto
1668 An online version can be found at:
1669 http://sourceware.org/systemtap/SystemTap_Beginners_Guide.pdf
1670
1671 - Standard tapsets included with Systemtap were modified to include
1672 extractable documentation information based on the kernel-doc
1673 infrastructure. When configured --enabled-docs a HTML and PDF
1674 version of the Tapset Reference Manual is produced explaining probes
1675 defined in each tapset.
1676
1677 - The systemtap client and compile server are now available.
1678 These allow you to compile a systemtap module on a host other than
1679 the one which it will be run, providing the client and server
1680 are compatible. Other than using a server for passes 1 through
1681 4, the client behaves like the 'stap' front end itself. This
1682 means, among other things, that the client will automatically
1683 load the resulting module on the local host unless -p[1234]
1684 was specified. See stap-server(8) for more details.
1685 The client/server now use SSL for network connection security and
1686 for signing.
1687
1688 The systemtap client and server are prototypes only. Interfaces, options
1689 and usage may change at any time.
1690
1691 - function("func").label("label") probes are now supported to allow matching
1692 the label of a function.
1693
1694 - Systemtap initscript is available. This initscript allows you to run
1695 systemtap scripts as system services (in flight recorder mode) and
1696 control those scripts individually.
1697 See README.systemtap for details.
1698
1699 - The stap "-r DIR" option may be used to identify a hand-made kernel
1700 build directory. The tool determines the appropriate release string
1701 automatically from the directory.
1702
1703 - Serious problems associated with user-space probing in shared libraries
1704 were corrected, making it now possible to experiment with probe shared
1705 libraries. Assuming dwarf debugging information is installed, use this
1706 twist on the normal syntax:
1707
1708 probe process("/lib64/libc-2.8.so").function("....") { ... }
1709
1710 This would probe all threads that call into that library. Running
1711 "stap -c CMD" or "stap -x PID" naturally restricts this to the target
1712 command+descendants only. $$vars etc. may be used.
1713
1714 - For scripts that sometimes terminate with excessive "skipped" probes,
1715 rerunning the script with "-t" (timing) will print more details about
1716 the skippage reasons.
1717
1718 - Symbol tables and unwind (backtracing) data support were formerly
1719 compiled in for all probed modules as identified by the script
1720 (kernel; module("name"); process("file")) plus those listed by the
1721 stap "-d BINARY" option. Now, this data is included only if the systemtap
1722 script uses tapset functions like probefunc() or backtrace() that require
1723 such information. This shrinks the probe modules considerably for the rest.
1724
1725 - Per-pass verbosity control is available with the new "--vp {N}+" option.
1726 "stap --vp 040" adds 4 units of -v verbosity only to pass 2. This is useful
1727 for diagnosing errors from one pass without excessive verbosity from others.
1728
1729 - Most probe handlers now run with interrupts enabled, for improved
1730 system responsiveness and less probing overhead. This may result
1731 in more skipped probes, for example if a reentrant probe handler
1732 is attempted from within an interrupt handler. It may also make the
1733 systemtap overload detection facility more likely to be triggered, as
1734 interrupt handlers' run time would be included in the self-assessed
1735 overhead of running probe handlers.
1736
1737 * What's new in version 0.8, 2008-11-13
1738
1739 - Cache limiting is now available. If the compiled module cache size is
1740 over a limit specified in the $SYSTEMTAP_DIR/cache/cache_mb_limit file,
1741 some old cache entries will be unlinked. See man stap(1) for more.
1742
1743 - Error and warning messages are now followed by source context displaying
1744 the erroneous line/s and a handy '^' in the following line pointing to the
1745 appropriate column.
1746
1747 - A bug reporting tool "stap-report" is now available which will quickly
1748 retrieve much of the information requested here:
1749 http://sourceware.org/systemtap/wiki/HowToReportBugs
1750
1751 - The translator can resolve members of anonymous structs / unions:
1752 given struct { int foo; struct { int bar; }; } *p;
1753 this now works: $p->bar
1754
1755 - The stap "-F" flag activates "flight recorder" mode, which consists of
1756 translating the given script as usual, but implicitly launching it into
1757 the background with staprun's existing "-L" (launch) option. A user
1758 can later reattach to the module with "staprun -A MODULENAME".
1759
1760 - Additional context variables are available on user-space syscall probes.
1761 - $argN ($arg1, $arg2, ... $arg6) in process(PATH_OR_PID).syscall
1762 gives you the argument of the system call.
1763 - $return in process(PATH_OR_PID).syscall.return gives you the return
1764 value of the system call.
1765
1766 - Target process mode (stap -c CMD or -x PID) now implicitly restricts all
1767 "process.*" probes to the given child process. (It does not affect
1768 kernel.* or other probe types.) The CMD string is normally run directly,
1769 rather than via a /bin/sh -c subshell, since then utrace/uprobe probes
1770 receive a fairly "clean" event stream. If metacharacters like
1771 redirection operators were present in CMD, then "sh -c CMD" is still
1772 used, and utrace/uprobe probes will receive events from the shell.
1773
1774 % stap -e 'probe process.syscall, process.end {
1775 printf("%s %d %s\n", execname(), pid(), pp())}'\
1776 -c ls
1777 ls 2323 process.syscall
1778 ls 2323 process.syscall
1779 ls 2323 process.end
1780
1781 - Probe listing mode is improved: "-L" lists available script-level variables
1782
1783 % stap -L 'syscall.*open*'
1784 syscall.mq_open name:string name_uaddr:long filename:string mode:long u_attr_uaddr:long oflag:long argstr:string
1785 syscall.open name:string filename:string flags:long mode:long argstr:string
1786 syscall.openat name:string filename:string flags:long mode:long argstr:string
1787
1788 - All user-space-related probes support $PATH-resolved executable
1789 names, so
1790
1791 probe process("ls").syscall {}
1792 probe process("./a.out").syscall {}
1793
1794 work now, instead of just
1795
1796 probe process("/bin/ls").syscall {}
1797 probe process("/my/directory/a.out").syscall {}
1798
1799 - Prototype symbolic user-space probing support:
1800
1801 # stap -e 'probe process("ls").function("*").call {
1802 log (probefunc()." ".$$parms)
1803 }' \
1804 -c 'ls -l'
1805
1806 This requires:
1807 - debugging information for the named program
1808 - a version of utrace in the kernel that is compatible with the "uprobes"
1809 kernel module prototype. This includes RHEL5 and older Fedora, but not
1810 yet current lkml-track utrace; a "pass 4a"-time build failure means
1811 your system cannot use this yet.
1812
1813 - Global variables which are written to but never read are now
1814 automatically displayed when the session does a shutdown. For example:
1815
1816 global running_tasks
1817 probe timer.profile {running_tasks[pid(),tid()] = execname()}
1818 probe timer.ms(8000) {exit()}
1819
1820 - A formatted string representation of the variables, parameters, or local
1821 variables at a probe point is now supported via the special $$vars,
1822 $$parms, and $$locals context variables, which expand to a string
1823 containing a list "var1=0xdead var2=0xbeef var3=?". (Here, var3 exists
1824 but is for some reason unavailable.) In return probes only, $$return
1825 expands to an empty string for a void function, or "return=0xf00".
1826
1827
1828 * What's new in version 0.7, 2008-07-15
1829
1830 - .statement("func@file:*") and .statement("func@file:M-N") probes are now
1831 supported to allow matching a range of lines in a function. This allows
1832 tracing the execution of a function.
1833
1834 - Scripts relying on probe point wildcards like "syscall.*" that expand
1835 to distinct kprobes are processed significantly faster than before.
1836
1837 - The vector of script command line arguments is available in a
1838 tapset-provided global array argv[]. It is indexed 1 ... argc,
1839 another global. This can substitute for of preprocessor
1840 directives @NNN that fail at parse time if there are not
1841 enough arguments.
1842
1843 printf("argv: %s %s %s", argv[1], argv[2], argv[3])
1844
1845 - .statement("func@file+line") probes are now supported to allow a
1846 match relative to the entry of the function incremented by line
1847 number. This allows using the same systemtap script if the rest
1848 of the file.c source only changes slightly.
1849
1850 - A probe listing mode is available.
1851 % stap -l vm.*
1852 vm.brk
1853 vm.mmap
1854 vm.munmap
1855 vm.oom_kill
1856 vm.pagefault
1857 vm.write_shared
1858
1859 - More user-space probe types are added:
1860
1861 probe process(PID).begin { }
1862 probe process("PATH").begin { }
1863 probe process(PID).thread.begin { }
1864 probe process("PATH").thread.begin { }
1865 probe process(PID).end { }
1866 probe process("PATH").end { }
1867 probe process(PID).thread.end { }
1868 probe process("PATH").thread.end { }
1869 probe process(PID).syscall { }
1870 probe process("PATH").syscall { }
1871 probe process(PID).syscall.return { }
1872 probe process("PATH").syscall.return { }
1873
1874 - Globals now accept ; terminators
1875
1876 global odds, evens;
1877 global little[10], big[5];
1878
1879 * What's new in version 0.6, 2007-12-15
1880
1881 - A copy of the systemtap tutorial and language reference guide
1882 are now included.
1883
1884 - There is a new format specifier, %m, for the printf family of
1885 functions. It functions like %s, except that it does not stop when
1886 a nul ('\0') byte is encountered. The number of bytes output is
1887 determined by the precision specifier. The default precision is 1.
1888 For example:
1889
1890 printf ("%m", "My String") // prints one character: M
1891 printf ("%.5", myString) // prints 5 bytes beginning at the start
1892 // of myString
1893
1894 - The %b format specifier for the printf family of functions has been enhanced
1895 as follows:
1896
1897 1) When the width and precision are both unspecified, the default is %8.8b.
1898 2) When only one of the width or precision is specified, the other defaults
1899 to the same value. For example, %4b == %.4b == %4.4b
1900 3) Nul ('\0') bytes are used for field width padding. For example,
1901
1902 printf ("%b", 0x1111deadbeef2222) // prints all eight bytes
1903 printf ("%4.2b", 0xdeadbeef) // prints \0\0\xbe\xef
1904
1905 - Dynamic width and precision are now supported for all printf family format
1906 specifiers. For example:
1907
1908 four = 4
1909 two = 2
1910 printf ("%*.*b", four, two, 0xdeadbbeef) // prints \0\0\xbe\xef
1911 printf ("%*d", four, two) // prints <space><space><space>2
1912
1913 - Preprocessor conditional expressions can now include wildcard style
1914 matches on kernel versions.
1915 %( kernel_vr != "*xen" %? foo %: bar %)
1916
1917 - Prototype support for user-space probing is showing some progress.
1918 No symbolic notations are supported yet (so no probing by function names,
1919 file names, process names, and no access to $context variables), but at
1920 least it's something:
1921
1922 probe process(PID).statement(ADDRESS).absolute { }
1923
1924 This will set a uprobe on the given process-id and given virtual address.
1925 The proble handler runs in kernel-space as usual, and can generally use
1926 existing tapset functions.
1927
1928 - Crash utility can retrieve systemtap's relay buffer from a kernel dump
1929 image by using staplog which is a crash extension module. To use this
1930 feature, type commands as below from crash(8)'s command line:
1931
1932 crash> extend staplog.so
1933 crash> help systemtaplog
1934
1935 Then, you can see more precise help message.
1936
1937 - You can share a relay buffer amoung several scripts and merge outputs from
1938 several scripts by using "-DRELAY_HOST" and "-DRELAY_GUEST" options.
1939 For example:
1940
1941 # run a host script
1942 % stap -ve 'probe begin{}' -o merged.out -DRELAY_HOST &
1943 # wait until starting the host.
1944 % stap -ve 'probe begin{print("hello ");exit()}' -DRELAY_GUEST
1945 % stap -ve 'probe begin{print("world\n");exit()}' -DRELAY_GUEST
1946
1947 Then, you'll see "hello world" in merged.out.
1948
1949 - You can add a conditional statement for each probe point or aliase, which
1950 is evaluated when the probe point is hit. If the condition is false, the
1951 whole probe body(including aliases) is skipped. For example:
1952
1953 global switch = 0;
1954 probe syscall.* if (switch) { ... }
1955 probe procfs.write {switch = strtol($value,10)} /* enable/disable ctrl */
1956
1957 - Systemtap will warn you if your script contains unused variables or
1958 functions. This is helpful in case of misspelled variables. If it
1959 doth protest too much, turn it off with "stap -w ...".
1960
1961 - You can add error-handling probes to a script, which are run if a
1962 script was stopped due to errors. In such a case, "end" probes are
1963 not run, but "error" ones are.
1964
1965 probe error { println ("oops, errors encountered; here's a report anyway")
1966 foreach (coin in mint) { println (coin) } }
1967
1968 - In a related twist, one may list probe points in order of preference,
1969 and mark any of them as "sufficient" beyond just "optional". Probe
1970 point sequence expansion stops if a sufficient-marked probe point has a hit.
1971 This is useful for probes on functions that may be in a module (CONFIG_FOO=m)
1972 or may have been compiled into the kernel (CONFIG_FOO=y), but we don't know
1973 which. Instead of
1974
1975 probe module("sd").function("sd_init_command") ? ,
1976 kernel.function("sd_init_command") ? { ... }
1977
1978 which might match neither, now one can write this:
1979
1980 probe module("sd").function("sd_init_command") ! , /* <-- note excl. mark */
1981 kernel.function("sd_init_command") { ... }
1982
1983 - New security model. To install a systemtap kernel module, a user
1984 must be one of the following: the root user; a member of the
1985 'stapdev' group; or a member of the 'stapusr' group. Members of the
1986 stapusr group can only use modules located in the
1987 /lib/modules/VERSION/systemtap directory (where VERSION is the
1988 output of "uname -r").
1989
1990 - .statement("...@file:line") probes now apply heuristics to allow an
1991 approximate match for the line number. This works similarly to gdb,
1992 where a breakpoint placed on an empty source line is automatically
1993 moved to the next statement. A silly bug that made many $target
1994 variables inaccessible to .statement() probes was also fixed.
1995
1996 - LKET has been retired. Please let us know on <systemtap@sourceware.org>
1997 if you have been a user of the tapset/tools, so we can help you find
1998 another way.
1999
2000 - New families of printing functions println() and printd() have been added.
2001 println() is like print() but adds a newline at the end;
2002 printd() is like a sequence of print()s, with a specified field delimiter.
2003
2004 * What's new since version 0.5.14?, 2007-07-03
2005
2006 - The way in which command line arguments for scripts are substituted has
2007 changed. Previously, $1 etc. would interpret the corresponding command
2008 line argument as an numeric literal, and @1 as a string literal. Now,
2009 the command line arguments are pasted uninterpreted wherever $1 etc.
2010 appears at the beginning of a token. @1 is similar, but is quoted as
2011 a string. This change does not modify old scripts, but has the effect
2012 of permitting substitution of arbitrary token sequences.
2013
2014 # This worked before, and still does:
2015 % stap -e 'probe timer.s($1) {}' 5
2016 # Now this also works:
2017 % stap -e 'probe syscall.$1 {log(@1)}' open
2018 # This won't crash, just signal a recursion error:
2019 % stap -e '$1' '$1'
2020 # As before, $1... is recognized only at the beginning of a token
2021 % stap -e 'probe begin {foo$1=5}'
2022
2023 * What's new since version 0.5.13?, 2007-03-26
2024
2025 - The way in which systemtap resolves function/inline probes has changed:
2026 .function(...) - now refers to all functions, inlined or not
2027 .inline(...) - is deprecated, use instead:
2028 .function(...).inline - filters function() to only inlined instances
2029 .function(...).call - filters function() to only non-inlined instances
2030 .function(...).return - as before, but now pairs best with .function().call
2031 .statement() is unchanged.
2032
2033 * What's new since version 0.5.12?, 2007-01-01
2034
2035 - When running in -p4 (compile-only) mode, the compiled .ko file name
2036 is printed on standard output.
2037
2038 - An array element with a null value such as zero or an empty string
2039 is now preserved, and will show up in a "foreach" loop or "in" test.
2040 To delete such an element, the scripts needs to use an explicit
2041 "delete array[idx]" statement rather than something like "array[idx]=0".
2042
2043 - The new "-P" option controls whether prologue searching heuristics
2044 will be activated for function probes. This was needed to get correct
2045 debugging information (dwarf location list) data for $target variables.
2046 Modern compilers (gcc 4.1+) tend not to need this heuristic, so it is
2047 no longer default. A new configure flag (--enable-prologues) restores
2048 it as a default setting, and is appropriate for older compilers (gcc 3.*).
2049
2050 - Each systemtap module prints a one-line message to the kernel informational
2051 log when it starts. This line identifies the translator version, base
2052 address of the probe module, a broken-down memory consumption estimate, and
2053 the total number of probes. This is meant as a debugging / auditing aid.
2054
2055 - Begin/end probes are run with interrupts enabled (but with
2056 preemption disabled). This will allow begin/end probes to be
2057 longer, to support generating longer reports.
2058
2059 - The numeric forms of kernel.statement() and kernel.function() probe points
2060 are now interpreted as relocatable values - treated as relative to the
2061 _stext symbol in that kernel binary. Since some modern kernel images
2062 are relocated to a different virtual address at startup, such addresses
2063 may shift up or down when actually inserted into a running kernel.
2064
2065 kernel.statement(0xdeadbeef): validated, interpreted relative to _stext,
2066 may map to 0xceadbeef at run time.
2067
2068 In order to specify unrelocated addresses, use the new ".absolute"
2069 probe point suffix for such numeric addresses. These are only
2070 allowed in guru mode, and provide access to no $target variables.
2071 They don't use debugging information at all, actually.
2072
2073 kernel.statement(0xfeedface).absolute: raw, unvalidated, guru mode only
2074
2075 * What's new since version 0.5.10?, 2006-10-19
2076
2077 - Offline processing of debugging information, enabling general
2078 cross-compilation of probe scripts to remote hosts, without
2079 requiring identical module/memory layout. This slows down
2080 compilation/translation somewhat.
2081
2082 - Kernel symbol table data is loaded by staprun at startup time
2083 rather than compiled into the module.
2084
2085 - Support the "limit" keyword for foreach iterations:
2086 foreach ([x,y] in ary limit 5) { ... }
2087 This implicitly exits after the fifth iteration. It also enables
2088 more efficient key/value sorting.
2089
2090 - Support the "maxactive" keyword for return probes:
2091 probe kernel.function("sdfsdf").maxactive(848) { ... }
2092 This allows up to 848 concurrently outstanding entries to
2093 the sdfsdf function before one returns. The default maxactive
2094 number is smaller, and can result in missed return probes.
2095
2096 - Support accessing of saved function arguments from within
2097 return probes. These values are saved by a synthesized
2098 function-entry probe.
2099
2100 - Add substantial version/architecture checking in compiled probes to
2101 assert correct installation of debugging information and correct
2102 execution on a compatible kernel.
2103
2104 - Add probe-time checking for sufficient free stack space when probe
2105 handlers are invoked, as a safety improvement.
2106
2107 - Add an optional numeric parameter for begin/end probe specifications,
2108 to order their execution.
2109 probe begin(10) { } /* comes after */ probe begin(-10) {}
2110
2111 - Add an optional array size declaration, which is handy for very small
2112 or very large ones.
2113 global little[5], big[20000]
2114
2115 - Include some example scripts along with the documentation.
2116
2117 - Change the start-time allocation of probe memory to avoid causing OOM
2118 situations, and to abort cleanly if free kernel memory is short.
2119
2120 - Automatically use the kernel DWARF unwinder, if present, for stack
2121 tracebacks.
2122
2123 - Many minor bug fixes, performance, tapset, and error message
2124 improvements.
This page took 0.12691 seconds and 6 git commands to generate.