IABSD.fr/src/usr.sbin/btrace
Branch :
Log
| Author | Commit | Date | CI | Message |
|---|---|---|---|---|
 |
4ed6f7c2 | 2021-12-07 22:17:02 | Delete the last emulation callbacks: we're Just ELF, so declare exec_elf_fixup() and coredump_elf() in <sys/exec_elf.h> and call them and the MD setregs() directly in kern_exec.c and kern_sig.c Also delete e_name[] (only used by sysctl), e_errno (unused), and e_syscallnames[] (only used by SYSCALL_DEBUG) and constipate syscallnames to 'const char *const[]' ok kettenis@ | |
 |
1e8bdbf0 | 2021-11-15 14:57:57 | Change printing of maps to use qsort to order the output using a pointer array. This replaces the current solution that only prints one element for a certain value and not all elements with tha same value. This can be further optimized but printing is not really a hot path in btrace. OK mpi@ | |
|
ca210abe | 2021-11-12 16:57:24 | Implement the probe variable. Can be used for example with @map[probe] = count(); OK mpi@ | |
 |
5247768d | 2021-10-24 14:18:58 | Use unveil(2) for the possible script file, dt(4) and ksyms(4) nodes. btrace(8) cannot be pledge due to its use of special ioctl()s. ok deraadt@ | |
 |
b005393a | 2021-10-03 22:01:48 | bt(5)/btrace(8): add support for str() Implement initial support for the str() function, which is used primarily to truncate or NUL-terminate strings from either cli args or args to tracepoints and syscalls. Current implementation only supports cli args and is primarily for compatability with bpftrace. Future work is needed once dt(4) supports builtin args other than long values. Adds a regress test and wires in argument-based tests again. ok mpi@ | |
 |
aa1e5e88 | 2021-09-21 21:33:35 | Add NUL termination to btfile content to avoid that strlcpy(3) reads too much in btrace(8). OK mpi@ deraadt@ | |
 |
e694d233 | 2021-09-09 20:07:49 | fix crash when passing empty cli arguments as B_AT_NIL wasn't handled as a valid argument type found with afl++ ok mpi@ | |
|
122a1b33 | 2021-09-09 12:09:11 | Relax the check for accessing variable before setting them. First we can't assume rules are written in the order they will be executed. Secondly filters might need to check variables before they had a chance to be populated by the right event. | |
|
0291cf98 | 2021-09-09 11:20:40 | Let ba2str() handle unitialized map just like ba2long() does. | |
|
1694fc34 | 2021-09-09 09:53:11 | Make it possible to associate multiple probes to a single rule. The following syntax, reducing duplication, is now allowed: END, interval:hz:2 { ... } Rule descriptors are now linked to a list of probe descriptors instead of a single one. Enabled kernel probes are now linked to btrace(8) probe descriptors. While here stop parsing filter and probe if debug is not enabled. | |
|
5dead9d9 | 2021-09-09 09:43:49 | Handle new NIL type in ba_name(). Fix filter debugging. | |
|
2e354f38 | 2021-09-09 07:17:31 | Do not treat empty map has invalid. | |
|
6968164d | 2021-09-09 07:03:10 | Use a dynamic buffer to allow parsing scripts bigger than BUFSIZ. ok jasper@ | |
|
7ccb822d | 2021-09-09 06:58:39 | Make sure all map operators work after calling clear() on a map. Fix assertions found by jasper@ with AFL++. ok jasper@ | |
|
c60ad60d | 2021-09-08 15:34:01 | Revert a chunk committed by inadvertence in my last fix. | |
|
58afdee7 | 2021-09-08 13:29:51 | btrace(8): add initial support for cli arguments This adds initial support for passing cli args to btrace(8) for use in bt(5) scripts. Similar to bpftrace, they are referenced via $1, $2, etc. with $# being the number of command line arguments provided. Adds an initial regress test and a Makefile change to allow providing arguments to regress tests in a .args file. Currently no limit is imposed on the number of arguments, keeping a similar approach as observed in bpftrace. References to undefined arguments result in a new "nil" type that contextually acts as a zero or empty string. More work can be done here to improve bpftrace compatibility. ok mpi@, jasper@ | |
|
0e0170ac | 2021-09-07 19:29:12 | Check that map/hist functions are called with the right argument. Change the parser to make clear() and zero() accept only local and global variables as arguments. Since the parser has no knowledge of the type of a variable abort the execution if clear() or zero() are being called with something other than a map or hist. Fix assertions found by jasper@ with AFL++ (port coming soon!). ok jasper@ | |
|
6e5d64e6 | 2021-09-07 19:18:08 | Return early if a parsing error has been found and do not perform any sanity check as they might obviously fail. Fix an assert found by jasper@ with AFL++ (port coming soon!). ok jasper@ | |
 |
1f722e99 | 2021-09-06 13:37:50 | we do not build binaries -g by default | |
|
840df46f | 2021-09-03 16:45:44 | add kprobes provider for dt this allows us to dynamically trace function boundaries with btrace by patching prologues and epilogues with a breakpoint upon which the handler records the data, sends it back to userland for btrace to consume. currently it's hidden behind DDBPROF, and there is still a lot to cleanup and improve, but basic scripts that observe return codes from a probed function work. from Tom Rollet, with various changes by me feedback and ok mpi@ | |
|
63d5bccf | 2021-09-02 17:21:39 | rename struct dt_evt fields to make it clear this isn't only used for tracing syscalls and adjust btrace(8) accordingly. extracted from a larger diff by Tom Rollet. ok mpi@ | |
|
b303712a | 2021-09-01 13:21:24 | Handle the case where map/hist can be read after calling clear(). Fix a NULL-derference found by jasper@ with AFL++ (port coming soon!). ok jasper@ | |
|
b81ef55c | 2021-09-01 08:06:49 | Imitate how free(3) behaves and make map_clear() works on NULL map. | |
|
42cd3088 | 2021-09-01 08:01:09 | Always print non-empty map & hist on exit even if there's an END rule. Match bpftrace behavior. | |
|
b8fe31fa | 2021-09-01 07:35:21 | Support for insert pid/tid/cpu builtins in map/hist. | |
|
4846dae3 | 2021-08-31 12:51:24 | Basic test, if (no else atm), support with a single statement. | |
|
8a02394d | 2021-08-31 11:30:21 | Support storing syscall arguments in a map/hist. | |
|
89f39301 | 2021-08-31 08:39:26 | Rewrite grammar to implement operator precedence without using %right or %prec. Arithmetic operator should now behave as expeted and tests can now be written without superfluous parenthesis, for example: syscall:select:entry /($1 == 0) || (pid == $1)/ { } Can now be written: syscall:select:entry /$1 == 0 || pid == $1/ { } While here improve filter debugging support. | |
|
25efc3b0 | 2021-08-30 11:57:45 | Implement '<' and '>' operators in filters. Based on a diff from and ok dv@ | |
|
1897e8bf | 2021-06-28 08:55:06 | Also show the time spent in userland when analyzing the kernel stack in flame graph. Only when both kernel and userland are displayed, the whole picture of system activity becomes clear. Fixes a parsing bug in the flame graph tool where userland time was interpreted as invalid kernel stack. OK kn@ | |
|
24fbf86f | 2021-06-23 11:24:01 | btrace(8): init and update timespec for BEGIN/END event BEGIN and END use a fake dt(4) event, so in order to use the nsecs var or time() it needs a timespec set. Init for BEGIN and update at END. ok mpi@ | |
|
db788fbb | 2021-06-07 12:55:19 | btrace(8): add "cpu" to long conversion Special values need to be translated to longs for use with functions like hist/lhist. Add "cpu" to conversion list. ok mpi@ | |
|
5fd09555 | 2021-04-22 11:53:13 | Indent and simplify the grammar. | |
|
5fe2fdbf | 2021-04-22 11:36:11 | Eliminate S/R conflicts and simplify filter grammar. | |
|
37bd7b46 | 2021-04-22 10:06:52 | Simplify token declaration. | |
|
f864534a | 2021-04-22 09:44:38 | Simplify now that TID and PID are now only being parsed as builtin. | |
|
466f7318 | 2021-04-22 09:36:39 | Remove support for in-kernel filters. This might be added back in a future if copying events to userland becomes a performance issue. However note that it is not always possible to filter in-kernel if, for example. a variable has to be evaluated when a rule fires. | |
 |
3049f605 | 2021-04-21 13:23:56 | remove -p from usage; | |
|
822ace7e | 2021-04-21 10:53:17 | Extend filters to support any conditionnal test including global variables. Stop using in-kernel filtering for the moment except for not tracing the tracer. Keep track of the number of filtered events. | |
|
9f622a61 | 2021-04-21 10:34:36 | Always initialized min value for an histogram. | |
|
891bd5a4 | 2021-04-21 10:29:49 | typo | |
|
7aa3827d | 2021-04-21 10:28:54 | Support for local (scratch) variables: "$var_name". Every rule gets its own list of (local) variables. | |
|
d2392c66 | 2021-04-21 10:26:18 | Extend print() to support any kind of variable. | |
|
6ca6ae3f | 2021-04-21 10:22:36 | Support first shell argument as $1 in order to use it in filters. Remove '-p' option now that scripts can filter by pid/tid. | |
|
8ffe87a0 | 2021-03-21 06:44:24 | add -n to SYNOPSIS; | |
 |
b69b24c5 | 2021-03-21 01:24:35 | Add -n (no action) mode, which just parses the program and exits. ok mpi@ kn@ | |
|
06176cf5 | 2021-02-10 00:34:57 | cast large to reduce warning on 32-bit machines (an ELF type is printed with %ll) | |
|
a31d03f7 | 2021-02-08 09:46:45 | Extend binary operators support, required for more filter features. Improve debugging of filters and print operator names in debug output. | |
|
ea0c567a | 2021-02-01 11:26:28 | Start implementing conditionals for filters. Allows to check the existence of a variable in predicates, making it possible to trace syscall latency, as follow: syscall:select:entry { @start[pid] = nsecs; } syscall:select:return /@start[pid]/ { @usecs = hist((nsecs - @start[pid]) / 1000); delete(@start[pid]); } | |
|
87df4dee | 2021-01-27 07:19:54 | commons used rather than externs, fix for -fno-common | |
|
03b76035 | 2021-01-21 13:19:25 | Make it possible to convert map arguments to long and insert nsecs in maps. Necessary to measure latency, example below to better understand the kqueue select(2) regression: syscall:select:entry { @start[pid] = nsecs; } syscall:select:return { @usecs = hist((nsecs - @start[pid]) / 1000); } | |
|
676820ed | 2021-01-10 11:06:08 | Exclude the 'hz' token from the lexer backdoor, so interval and profile probes can be parsed again. ok anton@ kn@ | |
 |
85e665dc | 2020-12-11 07:27:55 | Tracing syscalls which conflict with reserved bt(5) keywords currently causes btrace to reject such programs. An example is exit which is both a syscall and a builtin btrace function. Pointed out by bluhm@ To resolve the conflict, make use of a lexer backdoor. A concept described in the original yacc paper and also found in other yacc parsers in our tree. ok bluhm@ mpi@ | |
|
8c6b709b | 2020-12-07 20:14:35 | In revision 1.18 of bt_parse.y, I missed the fact that the print() function accepts an optional argument representing the number of map entries to print. ok bluhm@ mpi@ | |
|
27f0efda | 2020-12-07 18:28:09 | In btrace(8) handle snprintf(3) errors correctly. If snprintf fails, buffer is unchanged; initialize it with empty string. snprintf may return negative value or the length that would have been written; check and calculate remaining size. snprintf writes size - 1 characters; pass buffer size as length. OK mpi@ | |
|
9060cbc8 | 2020-12-01 18:47:25 | The print() function only accepts a single argument. ok mpi@ | |
|
ca7c1b32 | 2020-09-18 19:19:38 | fix typo in comment and trailing whitespace | |
|
b897e42e | 2020-09-18 18:05:20 | various fixes; ok mpi | |
|
d3f38c9f | 2020-09-17 19:18:18 | document min/max/sum function ok mpi@ | |
|
4417fdbb | 2020-09-15 10:59:05 | consistently format/word the function documentation | |
|
28fab4ca | 2020-09-14 18:45:19 | add support for '&' and '|' operators in btrace scripts feedback from otto@ ok mpi@ kn@ semarie@ | |
|
ccff7ee9 | 2020-09-11 08:16:15 | Support '-p' a flag to filter all actions by PID. | |
|
199e5b12 | 2020-08-13 11:35:21 | Be compatible with bpftrace(8)'s output when printing stack traces in maps. This allows us to use `stackcollapse-bpftrace.pl' from Brendan Gregg's FrameGraph without pre-processing outputs. | |
|
76f89280 | 2020-08-13 11:31:47 | When dealing with integers, it seems that [1] and [1, 2) are the same. | |
|
12999ef2 | 2020-08-13 11:29:39 | Improve documentation. | |
|
42858fb0 | 2020-08-07 14:04:59 | Do not hardcode the key length. | |
|
9c84395d | 2020-07-11 14:52:14 | Implement linear and power-of-two histograms: hist() and lhist() keywords. This is built on top of maps which are currently built on top of RB-trees. Improvements are welcome! For example the use of a hashing table as pointed by espie@. The following one-liner produce an histogram of power-of-two values returned by the read(2) syscall: btrace 'syscall:read:return { @bytes = hist(retval); }' ^C @bytes: [0] 19 |@@@@@@@@@@@@@@@@@@@@@@@@@@ | [1] 26 |@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ | [1, 2) 1 |@ | [2, 4) 13 |@@@@@@@@@@@@@@@@@@ | [4, 8) 4 |@@@@@ | [8, 16) 3 |@@@@ | [16, 32) 1 |@ | [32, 64) 8 |@@@@@@@@@@@ | [64, 128) 14 |@@@@@@@@@@@@@@@@@@@ | [128, 256) 7 |@@@@@@@@@ | [256, 512) 37 |@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@| [512, 1K) 1 |@ | [1K, 2K) 10 |@@@@@@@@@@@@@@ | [2K, 4K) 11 |@@@@@@@@@@@@@@@ | [8K, 16K) 1 |@ | | |
|
405649c2 | 2020-07-04 10:16:15 | Print the correct register for syscall return value. While here make it possible to store syscall return values in maps. | |
|
e9c69d2b | 2020-07-03 17:58:09 | Increment line number when skipping multi-line comments. | |
 |
2579caaf | 2020-06-22 13:14:47 | Fix "the symbol HZ is undefined" yacc warning OK mpi | |
|
fb49df2d | 2020-06-18 10:26:53 | Apply rules to the number of events returned by the last read(2). Fix a corner case where old events could be re-evaluated. From Yuichiro NAITO. | |
|
adc7d920 | 2020-04-24 15:10:41 | Simplify the grammar by letting the lexer handle builtin keywords. Also clarify various constructs by using commonly understood names like 'expr' and 'vargs'. | |
|
bef33816 | 2020-04-24 14:56:43 | Print given identifier in the error message when no matching probe exist. | |
|
0948ba6c | 2020-04-23 18:36:51 | Implement builtin 'cpu' keyword. This is useful to know which CPU recorded a given event. While here document 'retval' and comment out 'ustack' until we have a way to capture userland stacks. | |
|
6f386ca5 | 2020-04-23 14:54:12 | Extend map to support keys composed of multiple arguments. Keys are still strings representing the output value. The following example is now possible to count the number of "on CPU" events ordered by thread ID and executable name: # btrace -e 'tracepoint:sched:on__cpu { @[tid, comm] = count() }' ^C @[138836, idle0]: 830941 @[161307, sshd]: 716476 @[482901, softnet]: 582008 @[104443, systqmp]: 405749 @[269230, update]: 396133 @[326533, softclock]: 316926 @[61040, sshd]: 177201 @[453567, reaper]: 119676 @[446052, ksh]: 85675 @[26270, syslogd]: 66625 @[504699, sshd]: 52958 @[446052, sshd]: 32207 @[44046, tset]: 13333 @[162960, zerothread]: 101 @[313046, ntpd]: 1 | |
|
b9f00a1b | 2020-04-23 09:14:27 | Make debug output less verbose. | |
|
244912e4 | 2020-04-15 16:59:04 | Make map functions accept a "struct map *" instead of a "struct bt_var *". This is a step towards reducing the type casting crazyness. | |
|
baafb2b7 | 2020-04-15 15:00:04 | Document filters: one type of predicates checked in kernel. By default a PID filter is set by dt(4) to not record events for the tracing program. The other type of predicates, which are checked in userland, is coming soon! | |
|
b8592645 | 2020-04-15 14:51:45 | Crank key size to 256 to avoid conflicts when storing stack traces in maps. | |
|
a96fa468 | 2020-04-15 14:50:14 | Stop including <machine/param.h> and <machine/vmparam.h>. There's no need to redefine the INKERNEL() macro in userland because stacktrace_save_at() only saves kernel stack traces. If we decide to use the same interface to unwind & save userland stack traces we can simply indicate that in the "struct stacktrace". Discussed with deraadt@ and kettenis@ | |
 |
28f863d2 | 2020-03-27 16:22:26 | btrace(8): simplify builtin_nsecs(); ok mpi@ | |
|
70d67bf8 | 2020-03-27 09:37:06 | Skip first line if it starts with '#!' | |
|
7828ed3f | 2020-03-23 15:42:48 | Map are printed by default now, document that option "-c" is needed :) | |
|
58187bcb | 2020-03-23 15:36:30 | Some architectures require <machine/param.h> to use VM_MIN_KERNEL_ADDRESS. Fix build on at least sparc64 | |
|
a77acc3d | 2020-03-23 15:34:45 | Document some functions. | |
|
1b29203b | 2020-03-23 14:55:51 | Print maps when exiting unless an END rule has been defined. This allows to use oneliners like: # btrace -e 'profile:hz:99 { @[tid] = count(); }' ok kn@ | |
|
5d3454a6 | 2020-03-20 12:07:48 | Document exit, zero and delete functions While here, reword existing function descriptions a little. Feedback OK mpi jmc | |
|
9936fd19 | 2020-03-19 15:55:55 | Use bv_name() in debug output and include the hash of a map. | |
|
477314cb | 2020-03-19 15:52:30 | Add support for unnamed map. The following is now possible but won't print anything by default: # btrace -e 'profile:hz:99 { @[kstack] = count() }' ok patrick@, tobhe@ | |
|
66793fc5 | 2020-03-19 15:48:13 | When looking at which data should be recorded by the kernel include the key of a map. This makes map indexed by stack traces work. For example to know where the sleeps are coming from: tracepoint:sched:sleep { @map[kstack] = count(); } ok patrick@, tobhe@ | |
|
fee6f174 | 2020-03-18 20:19:42 | time() takes a strftime(3) format string OK mpi | |
|
c356cc37 | 2020-03-18 20:10:34 | Whitelist 'map' type in order to use them in real (non BEGIN/END) rules. | |
|
e504d9bf | 2020-03-16 08:54:08 | Fix affectation that should be conditionnal tests inside asserts. From tom@ | |
|
0dac42ec | 2020-01-28 16:39:51 | Implement map functions min(), max() and sum(). For the moment map values are currently limited to integers. | |
|
91575186 | 2020-01-28 16:02:28 | Use %left to prevent S/R conflicts, arithmetic precedence is still broken. | |
|
1d6f9355 | 2020-01-28 16:00:12 | Simplify statement rules by using an optional new line. | |
|
88be68db | 2020-01-28 12:13:49 | Implement delete() and @map[key] access. | |
|
a710f35b | 2020-01-28 12:09:19 | Rename *_concat() into *_append() to match reality. | |
|
09b6fe41 | 2020-01-28 10:24:00 | Parse '==' without error in filters. From Benjamin Baier. | |
|
a378a2aa | 2020-01-27 14:15:25 | Implement builtin time() function. |