-
Notifications
You must be signed in to change notification settings - Fork 10
/
NEWS
1557 lines (1235 loc) · 70.7 KB
/
NEWS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
* What's new in version 1.8
- staprun accepts a -T timeout option to allow less frequent wake-ups
to poll for low-throughput output from scripts.
- When invoked by systemtap, the kbuild $PATH environment is sanitized
(prefixed with /usr/bin:/bin:) in an attempt to exclude compilers
other than the one the kernel was presumed built with.
- Printf formats can now use "%#c" to escape non-printing characters.
- Pretty-printed bitfields use integers and chars use escaped formatting
for printing.
- The systemtap compile-server and client now support IPv6 networks.
- IPv6 addresses may now be specified on the --use-server option and will
be displayed by --list-servers, if the avahi-daemon service is running and
has IPv6 enabled.
- Automatic server selection will automatically choose IPv4 or IPv6 servers
according to the normal server selection criteria when avahi-daemon is
running. One is not preferred over the other.
- The compile-server will automatically listen on IPv6 addresses, if
available.
- To enable IPv6 in avahi-daemon, ensure that /etc/avahi/avahi-daemon.conf
contains an active "use-ipv6=yes" line. After adding this line run
"service avahi-daemon restart" to activate IPv6 support.
- See man stap(1) for details on how to use IPv6 addresses with the
--use-server option.
- Support for DWARF4 .debug_types sections (for executables and shared
libraries compiled with recent GCC's -gdwarf-4 / -fdebug-types-section).
PR12997. SystemTap now requires elfutils 0.148+, full .debug_types support
depends on elfutils 0.154+.
- Systemtap modules are somewhat smaller & faster to compile. Their
debuginfo is now suppressed by default; use -B CONFIG_DEBUG_INFO=y to
re-enable.
- @var now an alternative language syntax for accessing DWARF variables
in uprobe and kprobe handlers (process, kernel, module). @var("somevar")
can be used where $somevar can be used. The @var syntax also makes it
possible to access non-local, global compile unit (CU) variables by
specifying the CU source file as follows @var("somevar@some/src/file.c").
This will provide the target variable value of global "somevar" as defined
in the source file "some/src/file.c". The @var syntax combines with all
normal features of DWARF target variables like @defined(), @entry(),
[N] array indexing, field access through ->, taking the address with
the & prefix and shallow or deep pretty printing with a $ or $$ suffix.
- Stap now has resource limit options:
--rlimit-as=NUM
--rlimit-cpu=NUM
--rlimit-nproc=NUM
--rlimit-stack=NUM
--rlimit-fsize=NUM
All resource limiting has been moved from the compile server to stap
itself. When running the server as "stap-server", default resource
limit values are specified in ~stap-server/.systemtap/rc.
- Bug CVE-2012-0875 (kernel panic when processing malformed DWARF unwind data)
is fixed.
- The systemtap compile-server now supports multiple concurrent connections.
Specify the desired maximum number of concurrent connections with
the new stap-server/stap-serverd --max-threads option. Specify a
value of '0' to tell the server not to spawn any new threads (handle
all connections serially in the main thread). The default value is
the number of processor cores on the host.
- The following tapset functions are deprecated in release 1.8 and will be
removed in release 1.9:
daddr_to_string()
* What's new in version 1.7, 2012-02-01
- Map inserting and deleting is now significantly faster due to
improved hashing and larger hash tables. The hashes are also
now randomized to provide better protection against deliberate
collision attacks.
- Formatted printing is faster by compiling the formatting directives
to C code rather than interpreting at run time.
- Systemtap loads extra command line options from $SYSTEMTAP_DIR/rc
($HOME/.systemtap/rc by default) before the normal argc/argv. This
may be useful to activate site options such as --use-server or
--download-debuginfo or --modinfo.
- The stap-server has seen many improvements, and is no longer considered
experimental.
- The stap-server service (initscript) now supports four new options:
-D MACRO[=VALUE]
--log LOGFILE
--port PORT-NUMBER
--SSL CERT-DATABASE
These allow the specification of macro definitions to be passed to stap
by the server, the location of the log file, network port number and
NSS certificate database location respectively. These options are also
supported within individual server configuration files. See stap-server
and initscript/README.stap-server for details. The stap-server is no
longer activated by default.
- process("PATH").[library("PATH")].function("NAME").exported probes are now
supported to filter function() to only exported instances.
- The translator supports a new --suppress-handler-errors option, which
causes most runtime errors to be turned into quiet skipped probes. This
also disables the MAXERRORS and MAXSKIPPED limits.
- Translator warnings have been standardized and controlled by the -w / -W
flags.
- The translator supports a new --modinfo NAME=VALUE option to emit additional
MODULE_INFO(n,v) macros into the generated code.
- There is no more fixed maximum number of VMA pages that will be tracked
at runtime. This reduces memory use for those scripts that don't need any,
or only limited target process VMA tracking and allows easier system
wide probes inspecting shared library variables and/or user backtraces.
stap will now silently ignore -DTASK_FINDER_VMA_ENTRY_ITEMS.
- The tapset functions remote_id() and remote_uri() identify the member of a
swarm of "stap --remote FOO --remote BAR baz.stp" concurrent executions.
- Systemtap now supports a new privilege level and group, "stapsys", which
is equivalent to the privilege afforded by membership in the group "stapdev",
except that guru mode (-g) functionality may not be used. To support this, a
new option, --privilege=[stapusr|stapsys|stapdev] has been added.
--privilege=stapusr is equivalent to specifying the existing --unprivileged
option. --privilege=stapdev is the default. See man stap(1) for details.
- Scripts that use kernel.trace("...") probes compile much faster.
- The systemtap module cache is cleaned less frequently, governed by the
number of seconds in the $SYSTEMTAP_DIR/cache/cache_clean_interval_s file.
- SDT can now define up to 12 arguments in a probe point.
- Parse errors no longer generate a cascade of false errors. Instead, a
parse error skips the rest of the current probe or function, and resumes
at the next one. This should generate fewer and better messages.
- Global array wrapping is now supported for both associative and statistics typed
arrays using the '%' character to signify a wrapped array. For example,
'global foo%[100]' would allow the array 'foo' to be wrapped if more than 100
elements are inserted.
- process("PATH").library("PATH").plt("NAME") probes are now supported.
Wildcards are supported in the plt-name part, to refer to any function in the
program linkage table which matches the glob pattern and the rest of the
probe point.
- A new option, --dump-probe-types, will dump a list of supported probe types.
If --unprivileged is also specified, the list will be limited to probe types
which are available to unprivileged users.
- Systemtap can now automatically download the required debuginfo
using abrt. The --download-debuginfo[=OPTION] can be used to
control this feature. Possible values are: 'yes', 'no', 'ask',
and a positive number representing the timeout desired. The
default behavior is to not automatically download the debuginfo.
- The translator has better support for probing C++ applications by
better undertanding of compilation units, nested types, templates,
as used in probe point and @cast constructs.
- On 2.6.29+ kernels, systemtap can now probe kernel modules that
arrive and/or depart during the run-time of a session. This allows
probing of device driver initialization functions, which had formerly been
blacklisted.
- New tapset functions for cpu_clock and local_clock access were added.
- There is some limited preliminary support for user-space probing
against kernels >= 3.5, which have no utrace but do have
the newer inode-uprobes work by Srikar Dronamraju and colleagues.
For kernels < 3.5, the following 3 sets of kernel patches would need
to be backported to your kernel to use this preliminary user-space
probing support:
- inode-uprobes patches: An entire series of patches, starting with:
- 2b144498350860b6ee9dc57ff27a93ad488de5dc: uprobes, mm, x86: Add
the ability to install and remove uprobes breakpoints
- 7b2d81d48a2d8e37efb6ce7b4d5ef58822b30d89: uprobes/core: Clean
up, refactor and improve the code
- a5f4374a9610fd7286c2164d4e680436727eff71: uprobes: Move to
kernel/events/
- 04a3d984d32e47983770d314cdb4e4d8f38fccb7: uprobes/core: Make
instruction tables volatile
- 96379f60075c75b261328aa7830ef8aa158247ac: uprobes/core: Remove
uprobe_opcode_sz
- 3ff54efdfaace9e9b2b7c1959a865be6b91de96c: uprobes/core: Move
insn to arch specific structure
- 35aa621b5ab9d08767f7bc8d209b696df281d715: uprobes: Update
copyright notices
- 900771a483ef28915a48066d7895d8252315607a: uprobes/core: Make
macro names consistent
- e3343e6a2819ff5d0dfc4bb5c9fb7f9a4d04da73: uprobes/core: Make
order of function parameters consistent across functions
- exec tracepoint kernel patch:
- 4ff16c25e2cc48cbe6956e356c38a25ac063a64d: tracepoint, vfs,
sched: Add exec() tracepoint
- task_work_add kernel patches:
- e73f8959af0439d114847eab5a8a5ce48f1217c4: task_work_add:
generic process-context callbacks
- 4d1d61a6b203d957777d73fcebf19d90b038b5b2: genirq: reimplement
exit_irq_thread() hook via task_work_add()
- 413cd3d9abeaef590e5ce00564f7a443165db238: keys: change
keyctl_session_to_parent() to use task_work_add()
- dea649b8ac1861107c5d91e1a71121434fc64193: keys: kill the dummy
key_replace_session_keyring()
- f23ca335462e3c84f13270b9e65f83936068ec2c: keys: kill
task_struct->replacement_session_keyring
- The following probe types are deprecated in release 1.7 and will be
removed in release 1.8:
kernel.function(number).inline
module(string).function(number).inline
process.function(number).inline
process.library(string).function(number).inline
process(string).function(number).inline
process(string).library(string).function(number).inline
- The systemtap-grapher is deprecated in release 1.7 and will be removed in
release 1.8.
- The task_backtrace() tapset function was deprecated in 1.6 and has been
removed in 1.7.
- MAXBACKTRACE did work in earlier releases, but has now been documented
in the stap 1 manual page.
- New tapset function probe_type(). Returns a short string describing
the low level probe handler type for the current probe point.
- Both unwind and symbol data is now only collected and emitted for
scripts actually using backtracing or function/data symbols.
Tapset functions are marked with /* pragma:symbols */ or
/* pragma:unwind */ to indicate they need the specific data.
- Kernel backtraces can now be generated for non-pt_regs probe context
if the kernel support dump_trace(). This enables backtraces from
certain timer probes and tracepoints.
- ubacktrace() should now also work for some kernel probes on x86 which can
use the dwarf unwinder to recover the user registers to provide
more accurate user backtraces.
- For s390x the systemtap runtime now properly splits kernel and user
addresses (which are in separate address spaces on that architecture)
which enable user space introspection.
- ppc and s390x now supports user backtraces through the DWARF unwinder.
- ppc now handles function descriptors as symbol names correctly.
- arm support kernel backtraces through the DWARF unwinder.
- arm now have a uprobes port which enables user probes. This still
requires some kernel patches (user_regsets and tracehook support for
arm).
- Starting in release 1.7, these old variables will be deprecated:
- The 'pid' variable in the 'kprocess.release' probe has been
deprecated in favor of the new 'released_pid' variable.
- The 'args' variable in the
'_sunrpc.clnt.create_client.rpc_new_client_inline' probe has been
deprecated in favor of the new internal-only '__args' variable.
- Experimental support for recent kernels without utrace has been
added for the following probe types:
process(PID).begin
process("PATH").begin
process.begin
process(PID).thread.begin
process("PATH").thread.begin
process.thread.begin
process(PID).end
process("PATH").end
process.end
process(PID).thread.end
process("PATH").thread.end
process.thread.end
process(PID).syscall
process("PATH").syscall
process.syscall
process(PID).syscall.return
process("PATH").syscall.return
process.syscall.return
- staprun disables kprobe-optimizations in recent kernels, as problems
were found. (PR13193)
* What's new in version 1.6, 2011-07-25
- Security fixes for CVE-2011-2503: read instead of mmap to load modules,
CVE-2011-2502: Don't allow path-based auth for uprobes
- The systemtap compile-server no longer uses the -k option when calling the
translator (stap). As a result, the server will now take advantage of the
module cache when compiling the same script more than once. You may observe
an improvement in the performance of the server in this situation.
- The systemtap compile-server and client now each check the version of the
other, allowing both to adapt when communicating with a down-level
counterpart. As a result, all version of the client can communicate
with all versions of the server and vice-versa. Client will prefer newer
servers when selecting a server automatically.
- SystemTap has improved support for the ARM architecture. The
kread() and kwrite() operations for ARM were corrected allowing many
of the tapsets probes and function to work properly on the ARM
architecture.
- Staprun can now rename the module to a unique name with the '-R' option before
inserting it. Systemtap itself will also call staprun with '-R' by default.
This allows the same module to be inserted more than once, without conflicting
duplicate names.
- Systemtap error messages now provide feedback when staprun or any other
process fails to launch. This also specifically covers when the user
doesn't have the proper permissions to launch staprun.
- Systemtap will now map - to _ in module names. Previously,
stap -L 'module("i2c-core").function("*")' would be empty. It now returns
a list had stap -L 'module("i2c_core").function("*") been specified.
- Systemtap now fills in missing process names to probe points, to
avoid having to name them twice twice:
% stap -e 'probe process("a.out").function("*") {}' -c 'a.out ...'
Now the probed process name is inferred from the -c CMD argument.
% stap -e 'probe process.function("*") {}' -c 'a.out ...'
- stap -L 'process("PATH").syscall' will now list context variables
- Depends on elfutils 0.142+.
- Deprecated task_backtrace:string (task:long). This function will go
away after 1.6. Please run your scripts with stap --check-version.
* What's new in version 1.5, 2011-05-23
- Security fixes for CVE-2011-1781, CVE-2011-1769: correct DW_OP_{mod,div}
division-by-zero bug
- The compile server and its related tools (stap-gen-ert, stap-authorize-cert,
stap-sign-module) have been re-implemented in C++. Previously, these
components were a mix of bash scripts and C code. These changes should be
transparent to the end user with the exception of NSS certificate database
password prompting (see below). The old implementation would prompt more
than once for the same password in some situations.
- eventcount.stp now allows for event counting in the format of
'stap eventcount.stp process.end syscall.* ...', and also reports
corresponding event tid's.
- Systemtap checks that the build-id of the module being probed matches the
build-id saved in the systemtap module. Invoking systemtap with
-DSTP_NO_BUILDID_CHECK will bypass this build-id runtime verification. See
man ld(1) for info on --build-id.
- stapio will now report if a child process has an abnormal exit along with
the associated status or signal.
- Compiler optimization may sometimes result in systemtap not being able to
access a user-space probe argument. Compiling the application with
-DSTAP_SDT_ARG_CONSTRAINT=nr will force the argument to be an immediate or
register value which should enable systemtap to access the argument.
- GNU Gettext has now been intergrated with systemtap. Our translation
page can be found at http://www.transifex.net/projects/p/systemtap/ .
"make update-po" will generate the necessary files to use translated
messages. Please refer to the po/README file for more info and
please consider contributing to this I18N effort!
- The new addr() function returns the probe's instruction pointer.
- process("...").library("...") probes are now supported. Wildcards
are supported in the library-name part, to refer to any shared
library that is required by process-name, which matches the glob
pattern and the rest of the probe point.
- The "--remote USER@HOST" functionality can now be specified multiple times
to fan out on multiple targets. If the targets have distinct kernel and
architecture configurations, stap will automatically build the script
appropriately for each one. This option is also no longer considered
experimental.
- The NSS certificate database generated for use by the compile server is now
generated with no password. Previously, a random password was generated and
used to access the database. This change should be transparent to most users.
However, if you are prompted for a password when using systemtap, then
running $libexecdir/stap-gen-cert should correct the problem.
- The timestamp tapset includes jiffies() and HZ() for lightweight approximate
timekeeping.
- A powerful new command line option --version has been added.
- process.mark now supports $$parms for reading probe parameters.
- A new command line option, --use-server-on-error[=yes|no] is available
for stap. It instructs stap to retry compilation of a script using a
compile server if it fails on the local host. The default setting
is 'no'.
- The following deprecated tools have been removed:
stap-client
stap-authorize-server-cert
stap-authorize-signing-cert
stap-find-or-start-server
stap-find-servers
Use the --use-server, --trust-server and --list-servers options of stap
instead.
* What's new in version 1.4, 2011-01-17
- Security fixes for CVE-2010-4170, CVE-2010-4171: staprun module
loading/unloading
- A new /* myproc-unprivileged */ marker is now available for embedded C
code and and expressions. Like the /* unprivileged */ marker, it makes
the code or expression available for use in unprivileged mode (see
--unprivileged). However, it also automatically adds a call to
assert_is_myproc() to the code or expression, thus, making it available
to the unprivileged user only if the target of the current probe is within
the user's own process.
- The experimental "--remote USER@HOST" option will run pass 5 on a given
ssh host, after building locally (or with --use-server) for that target.
- Warning messages from the script may now be suppressed with the stap
and/or staprun -w option. By default, duplicate warning messages are
suppressed (up to a certain limit). With stap --vp 00002 and above,
the duplicate elimination is defeated.
- The print_ubacktrace and usym* functions attempt to print the full
path of the user-space binaries' paths, instead of just the basename.
The maximum saved path length is set by -DTASK_FINDER_VMA_ENTRY_PATHLEN,
default 64. Warning messages are produced if unwinding fails due to
a missing 'stap -d MODULE' option, providing preloaded unwind data.
- The new tz_ctime() tapset function prints times in the local time zone.
- More kernel tracepoints are accessible to the kernel.trace("...") mechanism,
if kernel source trees or debuginfo are available. These formerly "hidden"
tracepoints are those that are declared somewhere other than the usual
include/linux/trace/ headers, such as xfs and kvm.
- debuginfo-based process("...").function/.statement/.mark probes support
wildcards in the process-name part, to refer to any executable files that
match the glob pattern and the rest of the probe point.
- The -t option now displays information per probe-point rather than a summary
for each probe. It also now shows the derivation chain for each probe-point.
- A rewrite of the sys/sdt.h header file provides zero-cost startup (few or
no ELF relocations) for the debuginfo-less near-zero-cost runtime probes.
Binaries compiled with earlier sdt.h versions remain supported. The
stap -L (listing) option now lists parameters for sys/sdt.h markers.
- The implementation of the integrated compile-server client has been
extended.
o --use-server now accepts an argument representing a particular server and
may be specified more than once.
o --list-servers now accepts an expanded range of arguments.
o a new --trust-servers option has been added to stap to replace several
old certificate-management scripts.
o The following tools are now deprecated and will be removed in release 1.5:
stap-client
stap-authorize-server-cert
stap-authorize-signing-cert
stap-find-or-start-server
stap-find-servers
See man stap(1) for complete details.
- The compile-server now returns the uprobes.ko to the client when it is
required by the script being compiled. The integrated compile-server client
now makes it available to be loaded by staprun. The old (deprecated)
stap-client does not do this.
- process probes with scripts as the target are recognized by stap and the
interpreter would be selected for probing.
- Starting in release 1.5, these old variables/functions will be deprecated
and will only be available when the '--compatible=1.4' flag is used:
- In the 'syscall.add_key' probe, the 'description_auddr' variable
has been deprecated in favor of the new 'description_uaddr'
variable.
- In the 'syscall.fgetxattr', 'syscall.fsetxattr',
'syscall.getxattr', 'syscall.lgetxattr', and
'syscall.lremovexattr' probes, the 'name2' variable has been
deprecated in favor of the new 'name_str' variable.
- In the 'nd_syscall.accept' probe the 'flag_str' variable
has been deprecated in favor of the new 'flags_str' variable.
- In the 'nd_syscall.dup' probe the 'old_fd' variable has been
deprecated in favor of the new 'oldfd' variable.
- In the 'nd_syscall.fgetxattr', 'nd_syscall.fremovexattr',
'nd_syscall.fsetxattr', 'nd_syscall.getxattr', and
'nd_syscall.lremovexattr' probes, the 'name2' variable has been
deprecated in favor of the new 'name_str' variable.
- The tapset alias 'nd_syscall.compat_pselect7a' was misnamed. It should
have been 'nd_syscall.compat_pselect7' (without the trailing 'a').
- The tapset function 'cpuid' is deprecated in favor of the better known
'cpu'.
- In the i386 'syscall.sigaltstack' probe, the 'ussp' variable has
been deprecated in favor of the new 'uss_uaddr' variable.
- In the ia64 'syscall.sigaltstack' probe, the 'ss_uaddr' and
'oss_uaddr' variables have been deprecated in favor of the new
'uss_uaddr' and 'uoss_uaddr' variables.
- The powerpc tapset alias 'syscall.compat_sysctl' was deprecated
and renamed 'syscall.sysctl32'.
- In the x86_64 'syscall.sigaltstack' probe, the 'regs_uaddr'
variable has been deprecated in favor of the new 'regs' variable.
* What's new in version 1.3, 2010-07-21
- The uprobes kernel module now has about half the overhead when probing
NOPs, which is particularly relevant for sdt.h markers.
- New stap option -G VAR=VALUE allows overriding global variables
by passing the settings to staprun as module options.
- The tapset alias 'syscall.compat_pselect7a' was misnamed. It should
have been 'syscall.compat_pselect7' (without the trailing 'a').
Starting in release 1.4, the old name will be deprecated and
will only be available when the '--compatible=1.3' flag is used.
- A new procfs parameter .umask(UMASK) which provides modification of
file permissions using the proper umask value. Default file
permissions for a read probe are 0400, 0200 for a write probe, and
0600 for a file with a read and write probe.
- It is now possible in some situations to use print_ubacktrace() to
get a user space stack trace from a kernel probe point. e.g. for
user backtraces when there is a pagefault:
$ stap -d /bin/sort --ldd -e 'probe vm.pagefault {
if (pid() == target()) {
printf("pagefault @0x%x\n", address); print_ubacktrace();
} }' -c /bin/sort
[...]
pagefault @0x7fea0595fa70
0x000000384f07f958 : __GI_strcmp+0x12b8/0x1440 [libc-2.12.so]
0x000000384f02824e : __gconv_lookup_cache+0xee/0x5a0 [libc-2.12.so]
0x000000384f021092 : __gconv_find_transform+0x92/0x2cf [libc-2.12.so]
0x000000384f094896 : __wcsmbs_load_conv+0x106/0x2b0 [libc-2.12.so]
0x000000384f08bd90 : mbrtowc+0x1b0/0x1c0 [libc-2.12.so]
0x0000000000404199 : ismbblank+0x39/0x90 [sort]
0x0000000000404a4f : inittables_mb+0xef/0x290 [sort]
0x0000000000406934 : main+0x174/0x2510 [sort]
0x000000384f01ec5d : __libc_start_main+0xfd/0x1d0 [libc-2.12.so]
0x0000000000402509 : _start+0x29/0x2c [sort]
[...]
- New tapset functions to get a string representation of a stack trace:
sprint_[u]backtrace() and sprint_[u]stack().
- New tapset function to get the module (shared library) name for a
user space address umodname:string(long). The module name will now
also be in the output of usymdata() and in backtrace addresses even
when they were not given with -d at the command line.
- Kernel backtraces are now much faster (replaced a linear search
with a binary search).
- A new integrated compile-server client is now available as part of stap.
o 'stap --use-server ...' is equivalent to 'stap-client ...'
o 'stap --list-servers' is equivalent to 'stap-find-servers'
o 'stap --list-servers=online' is equivalent to 'stap-find-servers --all'
o stap-client and its related tools will soon be deprecated.
o the nss-devel and avahi-devel packages are required for building stap with
the integrated client (checked during configuration).
o nss and avahi are required to run the integrated client.
- A new operator @entry is available for automatically saving an expression
at entry time for use in a .return probe.
probe foo.return { println(get_cycles() - @entry(get_cycles())) }
- Probe $target variables and @cast() can now use a suffix to print complex
data types as strings. Use a single '$' for a shallow view, or '$$' for a
deeper view that includes nested types. For example, with fs_struct:
$fs$ : "{.users=%i, .lock={...}, .umask=%i,
.in_exec=%i, .root={...}, .pwd={...}}"
$fs$$ : "{.users=%i, .lock={.raw_lock={.lock=%u}}, .umask=%i, .in_exec=%i,
.root={.mnt=%p, .dentry=%p}, .pwd={.mnt=%p, .dentry=%p}}"
- The <sys/sdt.h> user-space markers no longer default to an implicit
MARKER_NAME_ENABLED() semaphore check for each marker. To check for
enabled markers use a .d declaration file, then:
if (MARKER_NAME_ENABLED()) MARKER_NAME()
- Hyphenated <sys/sdt.h> marker names such as process(...).mark("foo-bar")
are now accepted in scripts. They are mapped to the double-underscore
form ("foo__bar").
- More robust <sys/sdt.h> user-space markers support is included. For
some platforms (x86*, ppc*), this can let systemtap probe the markers
without debuginfo. This implementation also supports preserving
the "provider" name associated with a marker:
probe process("foo").provider("bar").mark("baz") to match
STAP_PROBE<n>(bar, baz <...>)
(Compile with -DSTAP_SDT_V1 to revert to the previous implementation.
Systemtap supports pre-existing or new binaries using them.)
- Embedded-C may be used within expressions as values, when in guru mode:
num = %{ LINUX_VERSION_CODE %} // int64_t
name = %{ /* string */ THIS_MODULE->name %} // const char*
printf ("%s %x\n", name, num)
The usual /* pure */, /* unprivileged */, and /* guru */ markers may be used
as with embedded-C functions.
- By default the systemtap-runtime RPM builds now include a shared
library, staplog.so, that allows crash to extract systemtap data from
a vmcore image.
- Iterating with "foreach" can now explicitly save the value for the loop.
foreach(v = [i,j] in array)
printf("array[%d,%s] = %d\n", i, j, v /* array[i,j] */)
- The new "--ldd" option automatically adds any additional shared
libraries needed by probed or -d-listed userspace binaries to the -d
list, to enable symbolic backtracing through them. Similarly, the
new "--all-modules" option automatically adds any currently loaded
kernel modules (listed in /proc/modules) to the -d list.
- A new family of set_kernel_* functions make it easier for gurus to write
new values at arbitrary memory addresses.
- Probe wildcards can now use '**' to cross the '.' separator.
$ stap -l 'sys**open'
syscall.mq_open
syscall.open
- Backward compatibility flags (--compatible=VERSION, and matching
script preprocessing predicate %( systemtap_v CMP "version" %)
and a deprecation policy are being introduced, in case future
tapset/language changes break valid scripts.
* What's new in version 1.2, 2010-03-22
- Prototype support for "perf events", where the kernel supports the
2.6.33 in-kernel API. Probe points may refer to low-level
perf_event_attr type/config numbers, or to a number of aliases
defined in the new perf.stp tapset:
probe perf.sw.cpu_clock, perf.type(0).config(4) { }
- Type-casting can now use multiple headers to resolve codependencies.
@cast(task, "task_struct",
"kernel<linux/sched.h><linux/fs_struct.h>")->fs->umask
- Tapset-related man pages have been renamed. 'man -k 3stap' should show
the installed list, which due to prefixing should no longer collide over
ordinary system functions.
- User space marker arguments no longer use volatile if the version of gcc,
which must be at least 4.5.0, supports richer DWARF debuginfo. Use cflags
-DSTAP_SDT_VOLATILE=volatile or -DSTAP_SDT_VOLATILE= when building
the sys/sdt.h application to override this one way or another.
- A new construct for error handling is available. It is similar to c++
exception catching, using try and catch as new keywords. Within a handler
or function, the following is valid and may be nested:
try { /* arbitrary statements */ }
catch (er) { /* e.g. println("caught error ", er) */ }
- A new command line flag '-W' forces systemtap to abort translation of
a script if any warnings are produced. It is similar to gcc's -Werror.
(If '-w' is also supplied to suppress warnings, it wins.)
- A new predicate @defined is available for testing whether a
particular $variable/expression is resolvable at translate time:
probe foo { if (@defined($bar)) log ("$bar is available here") }
- Adjacent string literals are glued together, making this
construct valid:
probe process("/usr" @1 "/bin").function("*") { ... }
- In order to limit potential impact from future security problems,
the stap-server process does not permit its being launched as root.
- On recent kernels, for some architectures/configurations, hardware
breakpoint probes are supported. The probe point syntax is:
probe kernel.data(ADDRESS).write
probe kernel.data(ADDRESS).length(LEN).write
probe kernel.data("SYMBOL_NAME").write
* What's new in version 1.1, 2010-01-15
- New tracepoint based tapset for memory subsystem.
- The loading of signed modules by staprun is no longer allowed for
ordinary, unprivileged users. This means that only root, members of
the group 'stapdev' and members of the group 'stapusr' can load
systemtap modules using staprun, stap or stap-client. The minimum
privilege required to run arbitrary --unprivileged scripts is now
'stapusr' membership.
- The stap-server initscript is available. This initscript allows you
to start systemtap compile servers as a system service and to manage
these servers as a group or individually. The stap-server initscript
is installed by the systemtap-server rpm. The build directory for
the uprobes module (/usr/share/systemtap/runtime/uprobes) is made
writable by the 'stap-server' group. All of the files generated when
building the uprobes module, including the digital signature, are
also writable by members of stap-server.
See initscript/README.stap-server for details.
- Some of the compile server client, server and certificate management
tools have been moved from $bindir to $libexecdir/systemtap.
You should use the new stap-server script or the stap-server initscript
for server management where possible. The stap-server script provides the same
functionality as the stap-server initscript except that the servers are
run by the invoking user by default as opposed to servers started by the
stap-server initscript which are run by the user stap-server
by default. See stap-server(8) for more information.
You may continue to use these tools by adding $libexecdir/systemtap to
your path. You would need to do this, for example, if you are not root,
you want to start a compile server and you are not running systemtap from a
private installation. In this case you still need to use stap-start-server.
- Any diagnostic output line that starts with "ERROR", as in
error("foo"), will promote a "Pass 5: run failed", and the return
code is 1.
- Systemtap now warns about global variables being referenced from other
script files. This aims to protect against unintended local-vs-global
namespace collisions such as:
% cat some_tapset.stp
probe baz.one = bar { foo = $foo; bar = $bar }
% cat end_user_script.stp
global foo # intended to be private variable
probe timer.s(1) { foo ++ }
probe baz.* { println(foo, pp()) }
% stap end_user_script.stp
WARNING: cross-file global variable reference to foo from some_tapset.stp
- Preprocessor conditional for kernel configuration testing:
%( CONFIG_foo == "y" %? ... %)
- ftrace(msg:string) tapset function to send strings to the system-wide
ftrace ring-buffer (if any).
- Better support for richer DWARF debuginfo output from GCC 4.5
(variable tracking assignments). Kernel modules are now always resolved
against all their dependencies to find any info referring to missing
symbols. DW_AT_const_value is now supported when no DW_AT_location
is available.
* What's new in verson 1.0, 2009-09-22
- process().mark() probes now use an enabling semaphore to reduce the
computation overhead of dormant probes.
- The function spec for dwarf probes now supports C++ scopes, so you can
limit the probes to specific namespaces or classes. Multiple scopes
can be specified, and they will be matched progressively outward.
probe process("foo").function("std::vector<*>::*") { }
probe process("foo").function("::global_function") { }
- It is now possible to cross-compile systemtap scripts for foreign
architectures, using the new '-a ARCH' and '-B OPT=VALUE' flags.
For example, put arm-linux-gcc etc. into your $PATH, and point
systemtap at the target kernel build tree with:
stap -a arm -B CROSS_COMPILE=arm-linux- -r /build/tree [...]
The -B option is passed to kbuild make. -r identifies the already
configured/built kernel tree and -a its architecture (kbuild ARCH=...).
Systemtap will infer -p4.
- Cross compilation using the systemtap client and server
- stap-start-server now accepts the -r, -R, -I, -B and -a options in
order to start a cross compiling server. The server will correctly
advertise itself with respect to the kernel release and architecture
that it compiles for.
- When specified on stap-client, the -r and -a options will be
considered when searching for a suitable server.
- When using the systemtap client and server udp port 5353 must be open
in your firewall in order for the client to find servers using
avahi-browse. Also the systemtap server will choose a random port in
the range 1024-63999 for accepting ssl connections.
- Support for unprivileged users:
***********************************************************************
* WARNING!!!!!!!!!! *
* This feature is EXPERIMENTAL at this time and should be used with *
* care. This feature allows systemtap kernel modules to be loaded by *
* unprivileged users. The user interface and restrictions will change *
* as this feature evolves. *
***********************************************************************
- Systemtap modules generated from scripts which use a restricted
subset of the features available may be loaded by staprun for
unprivileged users. Previously, staprun would load modules only for
root or for members of the groups stapdev and stapusr.
- Using the --unprivileged option on stap enables translation-time
checking for use by unprivileged users (see restrictions below).
- All modules deemed suitable for use by unprivileged users will be
signed by the systemtap server when --unprivileged is specified on
stap-client. See module signing in release 0.9.8 and stap-server in
release 0.9 below.
- Modules signed by trusted signers (servers) and verified by staprun
will be loaded by staprun regardless of the user's privilege level.
- The system administrator asserts the trustworthiness of a signer
(server) by running stap-authorize-signing-cert <cert-file> as root,
where the <cert-file> can be found in
~<user>/.systemtap/ssl/server/stap.cert for servers started by
ordinary users and in $sysconfdir/systemtap/ssl/server/stap.cert for
servers started by root.
- Restrictions are intentionally strict at this time and may be
relaxed in the future:
- probe points are restricted to:
begin, begin(n), end, end(n), error, error(n), never,
timer.{jiffies,s,sec,ms,msec,us,usec,ns,nsec}(n)*, timer.hz(n),
process.* (for processes owned by the user).
- use of embedded C code is not allowed.
- use of tapset functions is restricted.
- some tapset functions may not be used at all. A message will be
generated at module compilation time.
- some actions by allowed tapset functions may only be performed
in the context of the user's own process. A runtime fault will
occur in these situations, for example, direct memory access.
- The is_myproc() tapset function has been provided so that
tapset writers for unprivileged users can check that the
context is of the users own process before attempting these
actions.
- accessing the kernel memory space is not allowed.
- The following command line options may not be used by stap-client
-g, -I, -D, -R, -B
- The following environment variables are ignored by stap-client:
SYSTEMTAP_RUNTIME, SYSTEMTAP_TAPSET, SYSTEMTAP_DEBUGINFO_PATH
- nss and nss-tools are required to use this feature.
- Support output file switching by SIGUSR2. Users can command running
stapio to switch output file by sending SIGUSR2.
- Memory consumption for scripts involving many uprobes has been
dramatically reduced.
- The preprocessor now supports || and && in the conditions.
e.g. %( arch == "x86_64" || arch == "ia64" %: ... %)
- The systemtap notion of "architecture" now matches the kernel's, rather
than that of "uname -m". This means that 32-bit i386 family are all
known as "i386" rather than "i386" or "i686"; "ppc64" as "powerpc";
"s390x" as "s390", and so on. This is consistent between the new
"-a ARCH" flag and the script-level %( arch ... %) conditional.
- It is now possible to define multiple probe aliases with the same name.
A probe will expand to all matching aliases.
probe foo = bar { }
probe foo = baz { }
probe foo { } # expands twice, once to bar and once to baz
- A new experimental transport mechanism, using ftrace's ring_buffer,
has been added. This may become the default transport mechanism in
future versions of systemtap. To test this new transport mechanism,
define 'STP_USE_RING_BUFFER'.
- Support for recognizing DW_OP_{stack,implicit}_value DWARF expressions
as emitted by GCC 4.5.
* What's new in version 0.9.9, 2009-08-04
- Systemwide kernel .function.return (kretprobe) maxactive defaults may
be overridden with the -DKRETACTIVE=nnn parameter.
- Translation pass 2 is significantly faster by avoiding unnecessary
searching through a kernel build/module directory tree.
- When compiled against elfutils 0.142 systemtap now handles the new
DW_OP_call_frame_CFA generated by by GCC.
- uprobes and ustack() are more robust when used on applications that
depend on prelinked/separate debuginfo shared libraries.
- User space PROBE marks are not always found with or without separate
debuginfo. The .probes section itself is now always put in the main
elf file and marked as allocated. When building pic code the section
is marked writable. The selinux memory check problems seen with
programs using STAP_PROBES is fixed.
- statement() probes can now override "address not at start of statement"
errors in guru mode. They also provide alternative addresses to use
in non-guru mode.
- The stapgraph application can generate graphs of data and events
emitted by systemtap scripts in real time. Run "stapgraph
testsuite/systemtap.examples/general/grapher.stp" for an example of
graphing the system load average and keyboard events.
- Dwarf probes now show parameters and local variables in the verbose
listing mode (-L).
- Symbol aliases are now resolved to their canonical dwarf names. For
example, probing "malloc" in libc resolves to "__libc_malloc".
- The syntax for dereferencing $target variables and @cast() gained new
capabilities:
- Array indexes can now be arbitrary numeric expressions.
- Array subscripts are now supported on pointer types.
- An '&' operator before a @cast or $target returns the address of the
final component, especially useful for nested structures.
- For reading all probe variables, kernel.mark now supports $$vars and
$$parms, and process.syscall now supports $$vars.
- The SNMP tapset provides probes and functions for many network
statistics. See stapprobes.snmp(3stap) for more details.
- The dentry tapset provides functions to map kernel VFS directory entries
to file or full path names: d_path(), d_name() and reverse_path_walk().
- SystemTap now has userspace markers in its own binaries, and the stap
tapset provides the available probepoints and local variables.
- Miscellaneous new tapset functions:
- pgrp() returns the process group ID of the current process
- str_replace() performs string replacement
* What's new in version 0.9.8, 2009-06-11
- Miscellaneous new tapset functions:
- sid() returns the session ID of the current process
- stringat() indexes a single character from a string.
- Using %M in print formats for hex dumps can now print entire buffers,
instead of just small numbers.
- Dwarfless syscalls: The nd_syscalls tapset is now available to probe
system calls without requiring kernel debugging information. All of
the same probepoints in the normal syscalls tapset are available with
an "nd_" prefix, e.g. syscall.open becomes nd_syscall.open. Most
syscall arguments are also available by name in nd_syscalls.
- Module signing: If the appropriate nss libraries are available on your
system, stap-server will sign each compiled module using a self-generated
certificate. This is the first step toward extending authority to
load certain modules to unprivileged users. For now, if the system
administrator adds a certificate to a database of trusted signers
(stap-authorize-signing-cert), modules signed using that certificate
will be verified by staprun against tampering. Otherwise, you should
notice no difference in the operation of stap or staprun.
* What's new in version 0.9.7, 2009-04-23
- @cast can now determine its type information using an explicit header
specification. For example:
@cast(tv, "timeval", "<sys/time.h>")->tv_sec
@cast(task, "task_struct", "kernel<linux/sched.h>")->tgid
- The overlapping process.* tapsets are now separated. Those probe points
documented in stapprobes(3stap) remain the same. Those that were formerly
in stapprobes.process(3stap) have been renamed to kprocess, to reflect
their kernel perspective on processes.
- The --skip-badvars option now also suppresses run-time error
messages that would otherwise result from erroneous memory accesses.
Such accesses can originate from $context expressions fueled by
erroneous debug data, or by kernel_{long,string,...}() tapset calls.
- New probes kprobe.function(FUNCTION) and kprobe.function(FUNCTION).return
for dwarfless probing. These postpone function address resolution to
run-time and use the kprobe symbol-resolution mechanism.
Probing of absolute statements can be done using the
kprobe.statement(ADDRESS).absolute construct.
- EXPERIMENTAL support for user process unwinding. A new collection of
tapset functions have been added to handle user space backtraces from
probe points that support them (currently process and timer probes -
for timer probes test whether or not in user space first with the
already existing user_mode() function). The new tapset functions are:
uaddr - User space address of current running task.
usymname - Return the symbol of an address in the current task.
usymdata - Return the symbol and module offset of an address.
print_ustack - Print out stack for the current task from string.
print_ubacktrace - Print stack back trace for current task.
ubacktrace - Hex backtrace of current task stack.
Please read http://sourceware.org/ml/systemtap/2009-q2/msg00364.html
on the current restrictions and possible changes in the future and
give feedback if you want to influence future developments.
* What's new in version 0.9.5, 2009-03-27
- New probes process().insn and process().insn.block that allows
inspection of the process after each instruction or block of
instructions executed. So to count the total number of instructions
a process executes during a run do something like:
$ stap -e 'global steps; probe process("/bin/ls").insn {steps++}