The main construct in the scripting language identifies probes. Probes associate abstract events with a statement block, or probe handler, that is to be executed when any of those events occur.
The following example shows how to trace entry and exit from a function using two probes.
probe kernel.function("sys_mkdir").call { log ("enter") }
probe kernel.function("sys_mkdir").return { log ("exit") }
To list the probe-able functions in the kernel, use the listing option (-l). For example:
$ stap -l 'kernel.function("*")' | sort
The general syntax is as follows.
probe PROBEPOINT [, PROBEPOINT] { [STMT ...] }
The probe handler is interpreted relative to the context of each event. For events associated with kernel code, this context may include variables defined in the source code at that location. These target variables are presented to the script as variables whose names are prefixed with a dollar sign ($). They may be accessed only if the compiler used to compile the kernel preserved them, despite optimization. This is the same constraint imposed by a debugger when working with optimized code. Other events may have very little context.
probe <alias> = <probepoint> { <prologue_stmts> }
probe <alias> += <probepoint> { <epilogue_stmts> }
New probe points may be defined using aliases. A probe point alias looks similar to probe definitions, but instead of activating a probe at the given point, it defines a new probe point name as an alias to an existing one. New probe aliases may refer to one or more existing probe aliases. Multiple aliases may share the same underlying probe points. The following is an example.
probe socket.sendmsg = kernel.function ("sock_sendmsg") { ... }
probe socket.do_write = kernel.function ("do_sock_write") { ... }
probe socket.send = socket.sendmsg, socket.do_write { ... }
There are two types of aliases, the prologue style and the epilogue style which are identified by the equal sign (=) and "+=" respectively.
A probe that uses a probe point alias will create an actual probe, with the handler of the alias pre-pended.
This pre-pending behavior serves several purposes. It allows the alias definition to pre-process the context of the probe before passing control to the handler specified by the user. This has several possible uses, demonstrated as follows.
# Skip probe unless given condition is met: if ($flag1 != $flag2) next # Supply values describing probes: name = "foo" # Extract the target variable to a plain local variable: var = $var
# Defines a new probe point syscall.read, which expands to
# kernel.function("sys_read"), with the given statement as
# a prologue.
#
probe syscall.read = kernel.function("sys_read") {
fildes = $fd
}
# Defines a new probe point with the given statement as an
# epilogue.
#
probe syscall.read += kernel.function("sys_read") {
if (traceme) println ("tracing me")
}
A probe alias is used the same way as any built-in probe type, by naming it:
probe syscall.read {
printf("reading fd=%d\n", fildes)
}
The translator performs type inference on all identifiers, including array indexes and function parameters. Inconsistent type-related use of identifiers results in an error.
Variables may be declared global. Global variables are shared among all probes and remain instantiated as long as the SystemTap session. There is one namespace for all global variables, regardless of the script file in which they are found. Because of possible concurrency limits, such as multiple probe handlers, each global variable used by a probe is automatically read- or write-locked while the handler is running. A global declaration may be written at the outermost level anywhere in a script file, not just within a block of code. Global variables which are written but never read will be displayed automatically at session shutdown. The following declaration marks var1 and var2 as global. The translator will infer a value type for each, and if the variable is used as an array, its key types.
global var1[=<value>], var2[=<value>]
The SystemTap translator removes unused variables. Global variable that are never written or read are discarded. Every local variables where the variable is only written but never read are also discarded. This optimization prunes unused variables defined in the probe aliases, but never used in the probe handler. If desired, this optimization can disabled with the -u option.
function <name>[:<type>] ( <arg1>[:<type>], ... ) { <stmts> }
function thisfn (arg1, arg2) {
return arg1 + arg2
}
Note the general absence of type declarations, which are inferred by the translator. If desired, a function definition may include explicit type declarations for its return value, its arguments, or both. This is helpful for embedded-C functions. In the following example, the type inference engine need only infer the type of arg2, a string.
function thatfn:string(arg1:long, arg2) {
return sprintf("%d%s", arg1, arg2)
}
Functions may call others or themselves recursively, up to a fixed nesting limit. See Section 1.6.
General syntax:
function <name>:<type> ( <arg1>:<type>, ... ) %{ <C_stmts> %}
There are a number of undocumented but complex safety constraints on concurrency, resource consumption and runtime limits that are applied to code written in the SystemTap language. These constraints are not applied to embedded C code, so use embedded C code with extreme caution. Be especially careful when dereferencing pointers. Use the kread() macro to dereference any pointers that could potentially be invalid or dangerous. If you are unsure, err on the side of caution and use kread(). The kread() macro is one of the safety mechanisms used in code generated by embedded C. It protects against pointer accesses that could crash the system.
For example, to access the pointer chain name = skb->dev->name in embedded C, use the following code.
struct net_device *dev; char *name; dev = kread(&(skb->dev)); name = kread(&(dev->name));
The memory locations reserved for input and output values are provided to a function using a macro named THIS. The following are examples.
function add_one (val:long) %{
THIS->__retvalue = THIS->val + 1;
%}
function add_one_str:string (val:string) %{
strlcpy (THIS->__retvalue, THIS->val, MAXSTRINGLEN);
strlcat (THIS->__retvalue, "one", MAXSTRINGLEN);
%}
The function argument and return value types should be stated; the translator does not analyze the embedded C code within the function. You should examine C code generated for ordinary script language functions to write compatible embedded-C. Note that all SystemTap functions and probes run with interrupts disabled, thus you cannot call functions that might sleep within the embedded C.