[DTrace-devel] [RELEASE] DTrace 2.0.5

[Eugene Loh]

We are happy to announce the availability of DTrace for Linux 2.0.5!

DTrace for Linux is based on BPF and other Linux kernel tracing features 
and is implemented entirely as a userspace application. It can be used 
for tracing on any Linux kernel that provides BPF based tracing and BTF 
type data, although (as mentioned below) improved functionality benefits 
from an (optional) kernel patch.

The functionality is close to being feature-complete in comparison with 
the kernel-module-based version of DTrace for Linux (version 1.2.1-1).  
Development continues in an incremental fashion to make the full feature 
set of DTrace available using existing kernel features.

WHERE TO FIND IT?

The new version of DTrace for Linux is available at:

     https://github.com/oracle/dtrace-utils/tree/stable

The main development branch for DTrace for Linux is at:

     https://github.com/oracle/dtrace-utils/tree/devel

The most recent release tag is 2.0.5.

NEW

       + PID-specific uprobes.

       + Fix bugs:  proper output when CPUs are not numbered consecutively,
         let both rawfbt and fbt probes be seen, do not convert "__" to "-"
         for stapsdt provider names, argument handling for multi-location
         user probes.

       + Support non-libctf environments for tcp.

       + Add the DTrace Tutorial to the git repo and install package.
       + Update documentation.
       + Update LLM context files to forbid "if" statements.

FEATURES

   - Providers:
       + cpc: CPU Performance Counter probes
       + dtrace: BEGIN, END, and ERROR probes
       + fbt: Function Boundary Tracing (FBT) probes
              (Using fentry/fexit probes where available)
       + lockstat: Locking related probes
       + pid: Userspace function boundary tracing and offset-based 
instruction
              probes
       + proc: Process lifecycle related probes
       + profile: Timer-based profile-* and tick-* probes
       + rawfbt: Function Boundary Tracing style provider that always
                 uses kprobes - it can be used to trace <func>.<suffix> 
symbols
                 that are generated by compiler optimizations
       + rawtp: SDT-style probes for kernel tracepoints with access to raw
                (untranslated) tracepoint arguments
       + sched: CPU scheduling probes [partial implementation]
       + sdt: Statically Defined Tracing (SDT) probes for kernel tracepoints
       + stapsdt: Probes defined via stapsdt ELF notes and probes created
                  dynamically via libstapsdt
       + sycall: System call entry and exit probes
       + tcp: New provider making tcp probes available
       + udp: New provider making udp probes available
       + usdt: Userspace Statically Defined Tracing (USDT) probes

   - Aggregations:
       + Regular and indexed aggregations
       + Aggregation functions: avg, count, llquantize, lquantize, max, min,
                                quantize, stddev, and sum.
       + Aggregation actions: clear, normalize, normalize, printa

   - Speculative tracing:
       + Functions: speculation, speculate, commit, and discard

   - Variables:
       + Global variables
       + Thread-Local Storage (TLS) variables
       + Clause-local variables
       + Associative arrays for global and TLS variables
       + Full support for NULL-strings
       + Built-in: arg0 - arg9, args[], caller, curcpu, curthread, epid, 
errno,
         execname, gid, id, pid, ppid, probefunc, probemod, probename,
         probeprov, stackdepth, tid, timestamp, ucaller, uid, uregs[],
         ustackdepth, walltimestamp
       + Inline variables (e.g., cwd, root, ...)
       + Variables can have [u]stack() values.

   - Actions:
       + exit, freopen, ftruncate, mod, print, printa, printf, raise, 
return,
         setopt, stack, sym, system, trace, tracemem, uaddr, umod, 
ustack, usym

   - Subroutines:
       + alloca, basename, bcopy, cleanpath, copyin, copyinstr, copyinto,
         copyout, copyoutstr, dirname, d_path [dummy], getmajor, getminor,
         htonl, htonll, htons, index, inet_ntoa, link_ntop, lltostr,
         mutex_owned, mutex_owner, mutex_type_adaptive, mutex_type_spin, 
ntohl,
         ntohll, ntohs, progenyof, rand, rindex, rw_iswriter, rw_read_held,
         rw_write_held, strchr, strjoin, strlen, strrchr, strstr, 
strtok, substr

   - Runtime features:
       + Reporting of drop-counters for trace data that could not be 
recorded
         for the principal buffer, aggregation buffers, and speculation 
buffers.
       + Pre-generated translator files to support kernels from 5.2 to 
current.

   - BPF support:
       + Direct compilation of D source code into BPF programs.
       + Efficient use of pre-compiled BPF functions for library functions.
       + A bpflog option to request the BPF verifier log for loaded 
programs.
       + BPF program linking of dynamically generated code and pre-compiled
         code to facilitate code sharing and code re-use.
       + Improved integrated disassembler for generated BPF code at the 
clause
         and program level (-S in combination with the new -xdisasm=# 
option).
       + Improved trace data buffer handling based on memory mapped perf 
event
         ring-buffers.
       + BTF type data support.

   - Development and debugging:
       + Support to run dtrace under valgrind.
       + Configure script based building is supported.
       + Improved support for building and using DTrace on upstream kernels.
       + Installation paths for all components are configurable.
       + Header files for USDT (sdt.h, etc) have been moved to avoid 
conflicts
         with projects that supply files with the same name.

   - Documentation:
       + The User's Guide is included in Markdown form.
       + Example scripts are installed under /usr/share/doc/dtrace/examples.
       + A context file, explaining DTrace, can be used with LLMs (AI).

DEPENDENCIES

DTrace for Linux makes use of BPF library functions that are compiled at
build time. It depends on BPF support in GCC and binutils to generate the
pre-compiled BPF function library.

DTrace for Linux benefits from an optional kernel feature that is not 
commonly
available in Linux kernels:  CTF data generation at compile time. This
provides important datatype information for kernel and kernel module 
symbols.
DTrace for Linux can be used for tracing without this patch, albeit with 
some
limitations.  This additional support feature for tracing is available at:

     https://github.com/oracle/dtrace-linux-kernel/tree/v2/6.10

Please consider joining our development list: dtrace at lists.linux.dev
and/or our IRC channel: #linux-dtrace at libera.chat

     Enjoy!