1. Dtrace in NetBSD (Ver1.1) @akachochin 2. NetBSDdtrace ** /VM LT( ) 3. NetBSDMFP MIPS () Twitter@akachochin() 4. dtrace SunSolaris () DTrace NetBSD6.0x86dtrace FreeBSDMac OS X 5. 1 dtrace OS dtrace (OracleWeb Page ) dtrace 6. 2 dtrace -l # dtrace -l | head -n 10 ID PROVIDER MODULE FUNCTION NAME 1 dtrace BEGIN 4 fbt netbsd AES_GMAC_Final entry 5 fbt netbsd AES_GMAC_Final return 7. 3 write fbt:netbsd:sys_write:entry { self->ts = timestamp; } fbt:netbsd:sys_write:return { @time[execname] = avg(timestamp self->ts); self->ts = 0; } 8. 4 sys_write() sys_write()return dtrace 9. sys_write() 10. dtrace -l ()fbt dtrace () dtrace_probe()dtrace dtrace dtrace 11. 1 dtrace_probe()fbt_invop() dtrace_invop_add() ...? dtrace_invop_add() external/cddl/osnet/dev/dtrace/i386(amd64)/dtrace_s ubr.c 12. 2 i386 dtrace_invop_add()dtrace_invop_hdlr fbt_invop() dtrace_invop() dtrace_invop_hdlr 13. 3 dtrace_invop()dtrace dtrace_invop_start dtrace_invop_startdtrace dtrace_invop_jump_addr _dtrace_invop_jump_addr dtrace_invop_start() 14. 4 dtrace_invop_jump_addr dtrace_invop_jump_addr dtrace sys/arch/i386/i386/vector.S trap6 15. 5 trap6 --> dtrace_invop_jump_addr dtrace_invop_start --> dtrace_invop_start dtrace_invop() --> dtrace_invop()dtrace_invop_add() dtrace_probe() trap6 16. trap6 Intel 64 and IA-32 ArchitecturesSoftware Developers Manual 1846 Interrupt 6Invalid Opcode Exception (#UD) 17. 6 trap6 dtrace dtrace dtrace dtrace 18. 7 fbt fbt_enable() for (; fbt != NULL; fbt = fbt->fbtp_next) { *fbt->fbtp_patchpoint = fbt->fbtp_patchval; } 19. 8 Write Protection patchpoint patchval patchval patchpoint patchpoint 20. 9 fbtp_patchpointfbtp_patchval fbt_provide_module_cb() push %ebp ret ( 21. 10 FBT_PATCHVAL patchval patchpoint patchpoint 22. 11 fbt_provide_module_cb() ksyms_mod_foreach() ksyms_mod_foreach() () ( fbt_provide_module_cb()) 23. 12 ELF.symtab http://www.skyfree.org/linux/references/ELF_Form at.pdf Elf32_Sym 24. dtracetrap6 .symtab () dtrace trap6 25. m( )m