Notes

A personal collection of notes and cheatsheets.

Source code is located at johannst/notes.

Shells

• zsh
• bash
• fish

zsh(1)

Keybindings

Change input mode:

bindkey -v              change to vi keymap
bindkey -e              change to emacs keymap

Define key-mappings:

bindkey                 list mappings in current keymap
bindkey in-str cmd      create mapping for `in-str` to `cmd`
bindkey -r in-str       remove binding for `in-str`

# C-v <key>             dump <key> code, which can be used in `in-str`
# zle -l                list all functions for keybindings
# man zshzle(1)         STANDARD WIDGETS: get description of functions

Access edit buffer in zle widget:

$BUFFER       # Entire edit buffer content
$LBUFFER      # Edit buffer content left to cursor
$RBUFFER      # Edit buffer content right to cursor

# create zle widget which adds text right of the cursor
function add-text() {
    RBUFFER="some text $RBUFFER"
}
zle -N add-text

bindkey "^p" add-text

Parameter

Default value:

# default value
echo ${foo:-defval}   # defval
foo=bar
echo ${foo:-defval}   # bar

Alternative value:

echo ${foo:+altval}   # ''
foo=bar
echo ${foo:+altval}   # altval

Check variable set, error if not set:

echo ${foo:?msg}      # print `msg` and return errno `1`
foo=bar
echo ${foo:?msg}      # bar

Sub-string ${var:offset:length}:

foo=abcdef
echo ${foo:1:3}       # bcd

Trim prefix ${var#prefix}:

foo=bar.baz
echo ${foo#bar}       # .baz

Trim suffix ${var%suffix}:

foo=bar.baz
echo ${foo%.baz}      # bar

Substitute pattern ${var/pattern/replace}:

foo=aabbccbbdd
echo ${foo/bb/XX}    # aaXXccbbdd
echo ${foo//bb/XX}   # aaXXccXXdd
# replace prefix
echo ${foo/#bb/XX}   # aabbccbbdd
echo ${foo/#aa/XX}   # XXbbccbbdd
# replace suffix
echo ${foo/%bb/XX}   # aabbccbbdd
echo ${foo/%dd/XX}   # aabbccbbXX

Note: prefix/suffix/pattern are expanded as pathnames.

Variables

# Variable with local scope
local var=val

# Read-only variable
readonly var=bal

Indexed arrays:

arr=(aa bb cc dd)
echo $arr[1]           # aa
echo $arr[-1]          # dd

arr+=(ee)
echo $arr[-1]          # ee

echo $arr[1,3]         # aa bb cc

Associative arrays:

typeset -A arr
arr[x]='aa'
arr[y]='bb'
echo $arr[x]           # aa

Tied arrays:

typeset -T VEC vec=(1 2 3) '|'

echo $vec              # 1 2 3
echo $VEC              # 1|2|3

Unique arrays (set):

typeset -U vec=(1 2 3)

echo $vec             # 1 2 3
vec+=(1 2 4)
echo $vec             # 1 2 3 4

Expansion Flags

Join array to string j:sep::

foo=(1 2 3 4)
echo ${(j:-:)foo}     # 1-2-3-4
echo ${(j:\n:)foo}    # join with new lines

Split string to array s:sep:

foo='1-2-3-4'
bar=(${(s:-:)foo})    # capture as array
echo $bar             # 1 2 3 4
echo $bar[2]          # 2

Upper/Lower case string:

foo=aaBB
echo ${(L)foo}        # aabb
echo ${(U)foo}        # AABB

Key/values in associative arrays:

typeset -A vec; vec[a]='aa'; vec[b]='bb'

echo ${(k)vec}        # a b
echo ${(v)vec}        # aa bb
echo ${(kv)vec}       # a aa b bb

# Iterate over key value pairs.
for k v in ${(kv)vec)}; do ...; done

I/O redirections

See bash - I/O redirection

Process substitution

Process substitution allows to redirect the stdout of multiple processes at once.

vim -d <(grep foo bar) <(grep foo moose)

Argument parsing with zparseopts

zparseopts [-D] [-E] [-A assoc] specs

Arguments are copied into the associative array assoc according to specs. Each spec is described by an entry as opt[:][=array].

• opt is the option without the - char. Passing -f is matched against f opt, --long is matched against -long.
• Using : means the option will take an argument.
• The optional =array specifies an alternate storage container where this option should be stored.

Documentation can be found in man zshmodules.

Example

#!/bin/zsh
function test() {
    zparseopts -D -E -A opts f=flag o: -long:
    echo "flag $flag"
    echo "o    $opts[-o]"
    echo "long $opts[--long]"
    echo "pos  $1"
}

test -f -o OPTION --long LONG_OPT POSITIONAL

# Outputs:
#   flag -f
#   o    OPTION
#   long LONG_OPT
#   pos  POSITIONAL

Regular Expressions

Zsh supports regular expression matching with the binary operator =~. The match results can be accessed via the $MATCH variable and $match indexed array:

• $MATCH contains the full match
• $match[1] contains match of the first capture group

INPUT='title foo : 1234'
REGEX='^title (.+) : ([0-9]+)$'
if [[ $INPUT =~ $REGEX ]]; then
    echo "$MATCH"       # title foo : 1234
    echo "$match[1]"    # foo
    echo "$match[2]"    # 1234
fi

Trap Handling

trap "<CMDs>" <SIG>/EXIT

# Show current trap handler.
trap -p
# List signal names.
trap -l

Example: Run handler only on error exit

trap 'test $? -ne 0 && echo "run exit trap"' EXIT

# -> no print
exit 0
# -> print
exit 1

Example: Mutex in shell script

For example if a script is triggered in unsynchronized, we may want to ensure that a single script instance runs.

# open file=LOCK with fd=100
exec 100>LOCK
# take exclusive lock, wait maximal for 3600s
flock -w 3600 -x 100 || { echo "flock timeout"; exit 1; }

# eg automatically release lock when script exits
trap "flock -u 100" EXIT

Completion

Installation

Completion functions are provided via files and need to be placed in a location covered by $fpath. By convention the completion files are names as _<CMD>.

A completion skeleton for the command foo, stored in _foo

#compdef _foo foo

function _foo() {
    ...
}

Alternatively one can install a completion function explicitly by calling compdef <FUNC> <CMD>.

Completion Variables

Following variables are available in Completion functions:

$words              # array with command line in words
$#words             # number words
$CURRENT            # index into $words for cursor position
$words[CURRENT-1]   # previous word (relative to cursor position)

Completion Functions

• _describe simple completion, just words + description
• _arguments sophisticated completion, allow to specify actions

Completion with _describe

_describe MSG COMP

• MSG simple string with header message
• COMP array of completions where each entry is "opt:description"

function _foo() {
    local -a opts
    opts=('bla:desc for bla' 'blu:desc for blu')
    _describe 'foo-msg' opts
}
compdef _foo foo

foo <TAB><TAB>
 -- foo-msg --
bla  -- desc for bla
blu  -- desc for blu

Completion with _arguments

_arguments SPEC [SPEC...]

where SPEC can have one of the following forms:

• OPT[DESC]:MSG:ACTION for option flags
• N:MSG:ACTION for positional arguments

Available actions

(op1 op2)   list possible matches
->VAL       set $state=VAL and continue, `$state` can be checked later in switch case
FUNC        call func to generate matches
{STR}       evaluate `STR` to generate matches

Example

Skeleton to copy/paste for writing simple completions.

Assume a program foo with the following interface:

foo -c green|red|blue -s low|high -f <file> -d <dir> -h

The completion handler could be implemented as follows in a file called _foo:

#compdef _foo foo

function _foo_color() {
    local colors=()
    colors+=('green:green color')
    colors+=('red:red color')
    colors+=('blue:blue color')
    _describe "color" colors
}

function _foo() {
    _arguments                              \
        "-c[define color]:color:->s_color"  \
        "-s[select sound]:sound:(low high)" \
        "-f[select file]:file:_files"       \
        "-d[select dir]:dir:_files -/"      \
        "-h[help]"

    case $state in
        s_color) _foo_color;;
    esac
}

Example with optional arguments

For this example we assume that the command foo takes at least three optional arguments such as

foo arg1 arg2 arg3 [argN..]

function _foo() {
    _arguments              \
        "1:opt 1:(a b c)"   \
        ":opt next:(d e f)" \
        "*:opt all:(u v w)"
}

Explanation:

• 1:MSG:ACTION sets completion for the first optional argument
• :MSG:ACTION sets completion for the next optional argument
• *:MSG:ACTION sets completion for the optional argument where none of the previous rules apply, so in our example for arg3, argN...

_files is a zsh builtin utility function to complete files/dirs see

• zsh completion functions
• zsh completion utility functions

bash(1)

Expansion

Generator

# generate sequence from n to m
{n..m}
# generate sequence from n to m step by s
{n..m..s}

# expand cartesian product
{a,b}{c,d}

Parameter

# default value
bar=${foo:-some_val}  # if $foo set, then bar=$foo else bar=some_val

# alternate value
bar=${foo:+bla $foo}  # if $foo set, then bar="bla $foo" else bar=""

# check param set
bar=${foo:?msg}  # if $foo set, then bar=$foo else exit and print msg

# indirect
FOO=foo
BAR=FOO
bar=${!BAR}  # deref value of BAR -> bar=$FOO

# prefix
${foo#prefix}  # remove prefix when expanding $foo
# suffix
${foo%suffix}  # remove suffix when expanding $foo

# substitute
${foo/pattern/string}  # replace pattern with string when expanding foo
# pattern starts with
# '/'   replace all occurences of pattern
# '#'   pattern match at beginning
# '%'   pattern match at end

# set programmatically with priintf builtin
printf -v "VAR1" "abc"
NAME=VAR2
printf -v "$NAME" "%s" "def"

Note: prefix/suffix/pattern are expanded as pathnames.

Pathname

*           match any string
?           match any single char
\\          match backslash
[abc]       match any char of 'a' 'b' 'c'
[a-z]       match any char between 'a' - 'z'
[^ab]       negate, match all not 'a' 'b'
[:class:]   match any char in class, available:
              alnum,alpha,ascii,blank,cntrl,digit,graph,lower,
              print,punct,space,upper,word,xdigit

With extglob shell option enabled it is possible to have more powerful patterns. In the following pattern-list is one ore more patterns separated by | char.

?(pattern-list)   matches zero or one occurrence of the given patterns
*(pattern-list)   matches zero or more occurrences of the given patterns
+(pattern-list)   matches one or more occurrences of the given patterns
@(pattern-list)   matches one of the given patterns
!(pattern-list)   matches anything except one of the given patterns

Note: shopt -s extglob/shopt -u extglob to enable/disable extglob option.

I/O redirection

Note: The trick with bash I/O redirection is to interpret from left-to-right.

# stdout & stderr to file
command >file 2>&1
# equivalent
command &>file

# stderr to stdout & stdout to file
command 2>&1 >file

The article Bash One-Liners Explained, Part III: All about redirections contains some nice visualization to explain bash redirections.

Explanation

j>&i

Duplicate fd i to fd j, making j a copy of i. See dup2(2).

Example:

command 2>&1 >file

1. duplicate fd 1 to fd 2, effectively redirecting stderr to stdout
2. redirect stdout to file

Process substitution (ref)

Process substitution allows to redirect the stdout of multiple processes at once.

vim -d <(grep foo bar) <(grep foo moose)

Command grouping

Execute commands in a group with or without subshell. Can be used to easily redirect stdout/stderr of all commands in the group into one file.

# Group commands without subshell.
v=abc ; { v=foo; echo $v; } ; echo $v
# foo
# foo

# Group commands with subshell.
v=abc ; ( v=foo; echo $v; ) ; echo $v
# foo
# abc

Trap Handling

trap "<CMDs>" <SIG>/EXIT

# Show current trap handler.
trap -p
# List signal names.
trap -l

Example: Run handler only on error exit

trap 'test $? -ne 0 && echo "run exit trap"' EXIT

# -> no print
exit 0
# -> print
exit 1

Example: Mutex in shell script

For example if a script is triggered in unsynchronized, we may want to ensure that a single script instance runs.

# open file=LOCK with fd=100
exec 100>LOCK
# take exclusive lock, wait maximal for 3600s
flock -w 3600 -x 100 || { echo "flock timeout"; exit 1; }

# eg automatically release lock when script exits
trap "flock -u 100" EXIT

Argument parsing with getopts

The getopts builtin uses following global variables:

• OPTARG, value of last option argument
• OPTIND, index of the next argument to process (user must reset)
• OPTERR, display errors if set to 1

getopts <optstring> <param> [<args>]

• <optstring> specifies the names of supported options, eg f:c
  • f: means -f option with an argument
  • c means -c option without an argument
• <param> specifies a variable name which getopts fills with the last parsed option argument
• <args> optionally specify argument string to parse, by default getopts parses $@

Example

#!/bin/bash
function parse_args() {
    while getopts "f:c" PARAM; do
        case $PARAM in
            f) echo "GOT -f $OPTARG";;
            c) echo "GOT -c";;
            *) echo "ERR: print usage"; exit 1;;
        esac
    done
    # users responsibility to reset OPTIND
    OPTIND=1
}

parse_args -f xxx -c
parse_args -f yyy

Regular Expressions

Bash supports regular expression matching with the binary operator =~. The match results can be accessed via the $BASH_REMATCH variable:

• ${BASH_REMATCH[0]} contains the full match
• ${BASH_REMATCH[1]} contains match of the first capture group

INPUT='title foo : 1234'
REGEX='^title (.+) : ([0-9]+)$'
if [[ $INPUT =~ $REGEX ]]; then
    echo "${BASH_REMATCH[0]}"    # title foo : 1234
    echo "${BASH_REMATCH[1]}"    # foo
    echo "${BASH_REMATCH[2]}"    # 1234
fi

Caution: When specifying a regex in the [[ ]] block directly, quotes will be treated as part of the pattern. [[ $INPUT =~ "foo" ]] will match against "foo" not foo!

Completion

The complete builtin is used to interact with the completion system.

complete                    # print currently installed completion handler
complete -F <func> <cmd>    # install <func> as completion handler for <cmd>
complete -r <cmd>           # uninstall completion handler for <cmd>

Variables available in completion functions:

# in
$1              # <cmd>
$2              # current word
$3              # privous word

COMP_WORDS      # array with current command line words
COMP_CWORD      # index into COMP_WORDS with current cursor position

# out
COMPREPLY       # array with possible completions

The compgen builtin is used to generate possible matches by comparing word against words generated by option.

compgen <option> <word>

# usefule options:
# -W <list>    specify list of possible completions
# -d           generate list with dirs
# -f           generate list with files
# -u           generate list with users
# -e           generate list with exported variables

# compare "f" against words "foo" "foobar" "bar" and generate matches
compgen -W "foo foobar bar" "f"

# compare "hom" against file/dir names and generate matches
compgen -d -f "hom"

Example

Skeleton to copy/paste for writing simple completions.

Assume a program foo with the following interface:

foo -c green|red|blue -s low|high -f <file> -h

The completion handler could be implemented as follows:

function _foo() {
    local curr=$2
    local prev=$3

    local opts="-c -s -f -h"
    case $prev in
        -c) COMPREPLY=( $(compgen -W "green red blue" -- $curr) );;
        -s) COMPREPLY=( $(compgen -W "low high" -- $curr) );;
        -f) COMPREPLY=( $(compgen -f -- $curr) );;
        *)  COMPREPLY=( $(compgen -W "$opts" -- $curr) );;
    esac
}

complete -F _foo foo

fish(1)

Quick Info

Fish initialization file ~/.config/fish/config.fish

Switch between different key bindings:

• fish_default_key_bindings to use default key bindings
• fish_vi_key_bindings to use vi key bindings

Variables

Available scopes

• local variable local to a block
• global variable global to shell instance
• universal variable universal to all shell instances + preserved across shell restart

Set/Unset Variables

set <name> [<values>]
    -l  local scope
    -g  global scope
    -U  universal scope
    -e  erase variable
    -S  show verbose info
    -x  export to ENV
    -u  unexport from ENV

Special Variables ref

$status      # exit code of last command
$pipestatus  # list of exit codes of pipe chain

$fish_pid    # pid of parent fish shell    ($$ in bash)
$last_pid    # pid of last started process ($! in bash)

$CMD_DURATION   # runtime of last command in ms

Lists

In fish all variables are lists (start with index 1, but lists can't contain lists.

set foo a b c d

echo $foo[1]      # a
echo $foo[-1]     # d
echo $foo[2..3]   # b c
echo $foo[1 3]    # a c

$ can be seen as dereference operator.

set foo a; set a 1337
echo $$foo  # outputs 1337

Cartesian product.

echo file.{h,cc}
# file.h file.cc

echo {a,b}{1,2}
# a1 b1 a2 b2

*PATH ref

Lists ending with PATH are automatically split at : when used and joined with : when quoted or exported to the environment.

set -x BLA_PATH a:b:c:d
echo $BLA_PATH           # a b c d
echo "$BLA_PATH"         # a:b:c:d          (quoted)
env | grep BLA_PATH      # BLA_PATH=a:b:c:d (env)

set FOO_PATH x y z
echo $FOO_PATH           # x y z
echo "$FOO_PATH"         # x:y:z

Command Handling

# sub-commands are not run in quotes
echo "ls output: "(ls)

I/O redirection

# 'noclobber', fail if 'log' already exists
echo foo >? log

Process substitution

Redirect output of multiple processes. Same as <(..) in bash.

diff (sort a | psub) (sort b | psub)

Control Flow

if / else

if grep foo bar
    # do sth
else if grep foobar bar
    # do sth else
else
    # do sth else
end

switch

switch (echo foo)
case 'foo*'
    # do start with foo
case bar dudel
    # do bar and dudel
case '*'
    # do else
end

while Loop

while true
    echo foo
end

for Loop

for f in (ls)
    echo $f
end

Functions

Function arguments are passed via $argv list.

function fn_foo
    echo $argv
end

Autoloading

When running a command fish attempts to autoload a function. The shell looks for <cmd>.fish in the locations defined by $fish_function_path and loads the function lazily if found.

This is the preferred way over monolithically defining all functions in a startup script.

Helper

functions         # list al functions
functions foo     # describe function 'foo'
functions -e foo  # erase function 'foo'

funced foo        # edit function 'foo'
                  # '-e vim' to edit in vim

Argument parsing and completion

argparse puts options into variables of name _flag_NAME.

References:

• Argument Handling
• argparse
• Writing your own completions
• complete

function moose --d "my moose fn"
    # h/help   : short / long option (boolean)
    # color    : only long option (boolean)
    # u/user=  : option with required argument, only last specified is taken
    # f/file+= : option with required argument, can be specified multiple times
    #
    argparse h/help color= u/user= f/file=+ -- $argv
    or return

    if set -ql _flag_help
        echo "usage ..."
        return 0
    end

    set -ql _flag_file
    and echo "file=$_flag_file | cnt:" (count $_flag_file)

    set -ql _flag_color
    and echo "color=$_flag_color"

    set -ql _flag_user
    and echo "user=$_flag_user"
end

# Delete all previous defined completions for 'moose'.
complete -c moose -e

# Don't complete files for command.
complete -c moose --no-files

# Help completion.
#   -n specifies a conditions. The completion is only active if the command
#      returns 0.
complete -c moose -s h -l help -n "not __fish_contains_opt -s h help" \
    --description "Print usage help and exit"

# File completion.
#   -F force complete files (overwrite --no-files).
#   -r requires argument.
complete -c moose -s f -l file -F -r \
    --description "Specify file (can be passed multiple times)"

# Color completion.
#    -a options for completion.
#    -x short for -r and --no-files (-f)
complete -c moose -x -l color -a "red blue" \
    --description "Specify a color."

# User completion.
#    -a options for completion. Call a function to generate arguments.
complete -c moose -x -s u -l user -a "(__fish_complete_users)" \
    --description "Specify a user"

Prompt

The prompt is defined by the output of the fish_prompt function.

function fish_prompt
    set -l cmd_ret
    echo "> "(pwd) $cmd_ret" "
end

Use set_color to manipulate terminal colors and set_color -c to print the current colors.

Useful Builtins

List all builtins with builtins -n.

# history
history search <str>   # search history for <str>
history merge          # merge histories from fish sessions

# list
count $var             # count elements in list

contains /bin $PATH    # return 0 (true) 1 (false)
contains -i /bin $PATH # additionally print index on stdout

# string
string split SEP STRING

# math
math -b hex 4096       # output dec as hex
math 0x1000            # output hex as dec
math "log2(1024)"      # call functions
math -s0 7/3           # integer division (by default float)

# status
status -f              # abs path of current file

Keymaps

  Shift-Tab .............. tab-completion with search
  Alt-Up / Alt-Down ...... search history with token under the cursor
  Alt-l .................. list content of dir under cursor
  Alt-p .................. append '2>&1 | less;' to current cmdline
  Alt-Left / Alt - Right . prevd / nextd, walk dir history

Debug

  status print-stack-trace .. prints function stacktrace (can be used in scripts)
  breakpoint ................ halt script execution and gives shell (C-d | exit
                              to continue)

CLI foo

• awk
• cut
• sed
• column
• sort
• tr
• tac
• rev
• paste
• xargs
• grep
• find

awk(1)

awk [opt] program [input]
    -F <sepstr>        field separator string (can be regex)
    program            awk program
    input              file or stdin if not file given

Input processing

Input is processed in two stages:

1. Splitting input into a sequence of records. By default split at newline character, but can be changed via the builtin RS variable.
2. Splitting a record into fields. By default strings without whitespace, but can be changed via the builtin variable FS or command line option -F.

Fields are accessed as follows:

• $0 whole record
• $1 field one
• $2 field two
• ...

Program

An awk program is composed of pairs of the form:

pattern { action }

The program is run against each record in the input stream. If a pattern matches a record the corresponding action is executed and can access the fields.

INPUT
  |
  v
record ----> ∀ pattern matched
  |                   |
  v                   v
fields ----> run associated action

Any valid awk expr can be a pattern.

An example is the regex pattern /abc/ { print $1 } which prints the first field if the record matches the regex /abc/. This form is actually a short version for $0 ~ /abc/ { print $1 }, see the regex comparison operator below.

Special pattern

awk provides two special patterns, BEGIN and END, which can be used multiple times. Actions with those patterns are executed exactly once.

• BEGIN actions are run before processing the first record
• END actions are run after processing the last record

Special variables

• RS record separator: first char is the record separator, by default
• FS field separator: regex to split records into fields, by default
• NR number record: number of current record
• NF number fields: number of fields in the current record

Special statements & functions

• printf "fmt", args...

  Print format string, args are comma separated.

  • %s string
  • %d decimal
  • %x hex
  • %f float

  Width can be specified as %Ns, this reserves N chars for a string. For floats one can use %N.Mf, N is the total number including . and M.

• sprintf("fmt", expr, ...)

  Format the expressions according to the format string. Similar as printf, but this is a function and return value can be assigned to a variable.

• strftime("fmt")

  Print time stamp formatted by fmt.

  • %Y full year (eg 2020)
  • %m month (01-12)
  • %d day (01-31)
  • %F alias for %Y-%m-%d
  • %H hour (00-23)
  • %M minute (00-59)
  • %S second (00-59)
  • %T alias for %H:%M:%S

• S ~ R, S !~ R

  The regex comparison operator, where the former returns true if the string S matches the regex R, and the latter is the negated form. The regex can be either a constant or dynamic regex.

Examples

Filter records

awk 'NR%2 == 0 { print $0 }' <file>

The pattern NR%2 == 0 matches every second record and the action { print $0 } prints the whole record.

Negative patterns

awk '!/^#/ { print $1 }' <file>

Matches records not starting with #.

Range patterns

echo -e "a\nFOO\nb\nc\nBAR\nd" | \
    awk '/FOO/,/BAR/ { print }'

/FOO/,/BAR/ define a range pattern of begin_pattern, end_pattern. When begin_pattern is matched the range is turned on and when the end_pattern is matched the range is turned off. This matches every record in the range inclusive.

An exclusive range must be handled explicitly, for example as follows.

echo -e "a\nFOO\nb\nc\nBAR\nd" | \
    awk '/FOO/,/BAR/ { if (!($1 ~ "FOO") && !($1 ~ "BAR")) { print } }'

Access last fields in records

echo 'a b c d e f' | awk '{ print $NF $(NF-1) }'

Access last fields with arithmetic on the NF number of fields variable.

Split on multiple tokens

echo 'a,b;c:d' | awk -F'[,;:]' '{ printf "1=%s | 4=%s\n", $1, $4 }'

Use regex as field separator.

Capture in variables

# /proc/<pid>/status
#   Name:    cat
#   ...
#   VmRSS:   516 kB
#   ...

for f in /proc/*/status; do
    cat $f | awk '
             /^VmRSS/ { rss = $2/1024 }
             /^Name/ { name = $2 }
             END { printf "%16s %6d MB\n", name, rss }';
done | sort -k2 -n

We capture values from VmRSS and Name into variables and print them at the END once processing all records is done.

Capture in array

echo 'a 10
b 2
b 4
a 1' | awk '{
    vals[$1] += $2
    cnts[$1] += 1
}
END {
    for (v in vals)
        printf "%s %d\n", v, vals[v] / cnts [v]
}'

Capture keys and values from different columns and some up the values. At the END we compute the average of each key.

Run shell command and capture output

cat /proc/1/status | awk '
                     /^Pid/ {
                        "ps --no-header -o user " $2 | getline user;
                         print user
                     }'

We build a ps command line and capture the first line of the processes output in the user variable and then print it.

cut(1)

# Remove sections from each line of files(s).
cut OPT FILE [FILE]
    -d DELIM     delimiter to tokenize
    -f LIST      field selector
    -c LIST      character selector

Example: only selected characters

echo 'aa bb cc dd' | cut -c "1-4"
# aa b

# Inverted selection.
echo 'aa bb cc dd' | cut --complement -c "1-4"
# b cc dd

Example: only selected fields

Fields in cut are indexed starting from 1 rather than 0.

# Fields 2 until 3.
echo 'aa bb cc dd' | cut -d ' ' -f 2-3
# bb cc

# First field until the 2nd.
echo 'aa bb cc dd' | cut -d ' ' -f -2
# aa bb

# Third field until the end.
echo 'aa bb cc dd' | cut -d ' ' -f 3-
# cc dd

# If the number of tokens in a line is unkown but we want to remove the last 2
# tokens we can use rev(1).
echo 'aa bb cc dd' | rev | cut -d ' ' -f3- | rev
# aa bb

sed(1)

sed [opts] [script] [file]
  opts:
    -i          edit file in place
    -i.bk       edit file in place and create backup file
                (with .bk suffix, can be specified differently)
    --follow-symlinks
                follow symlinks when editing in place
    -e SCRIPT   add SCRIPT to commands to be executed
                (can be specified multiple times)
    -f FILE     add content of FILE to command to be executed

    --debug     annotate program execution

Examples

Delete lines

# Delete two lines.
echo -e 'aa\nbb\ncc\ndd' | sed '1d;3d'
# bb
# dd

# Delete last ($) line.
echo -e 'aa\nbb\ncc\ndd' | sed '$d'
# aa
# bb
# cc

# Delete range of lines.
echo -e 'aa\nbb\ncc\ndd' | sed '1,3d'
# dd

# Delete lines matching pattern.
echo -e 'aa\nbb\ncc\ndd' | sed '/bb/d'
# aa
# cc
# dd

# Delete lines NOT matching pattern.
echo -e 'aa\nbb\ncc\ndd' | sed '/bb/!d'
# bb

Insert lines

# Insert before line.
echo -e 'aa\nbb' | sed '2iABC'
# aa
# ABC
# bb

# Insert after line.
echo -e 'aa\nbb' | sed '2aABC'
# aa
# bb
# ABC

# Replace line.
echo -e 'aa\nbb' | sed '2cABC'
# aa
# ABC

# Insert before pattern match.
echo -e 'aa\nbb' | sed '/bb/i 123'
# aa
# 123
# bb

Substitute lines

# Substitute by regex.
echo -e 'aafooaa\ncc' | sed 's/foo/MOOSE/'
# aaMOOSEaa
# cc

Multiple scripts

echo -e 'foo\nbar' | sed -e 's/foo/FOO/' -e 's/FOO/BAR/'
# BAR
# bar

Edit inplace through symlink

touch file
ln -s file link
ls -l link
# lrwxrwxrwx 1 johannst johannst 4 Feb  7 23:02 link -> file

sed -i --follow-symlinks '1iabc' link
ls -l link
# lrwxrwxrwx 1 johannst johannst 4 Feb  7 23:02 link -> file

sed -i '1iabc' link
ls -l link
# -rw-r--r-- 1 johannst johannst 0 Feb  7 23:02 link

column(1)

Examples

# Show as table (aligned columns), with comma as delimiter from stdin.
echo -e 'a,b,c\n111,22222,33' | column -t -s ','

# Show file as table.
column -t -s ',' test.csv

sort(1)

sort [opts] [file]
  opts:
    -r      reverse output
    -b      ignore leading blanks

    -n      sort by numeric
    -h      sort by human numeric
    -V      sort by version

    -k<N>  sort by Nth key
    -t<S>  field separator

Examples

# Sort by directory sizes.
du -sh * | sort -h

# Sort numeric by second key.
# The default key separator is non-blank to blank transition.
echo 'a 4
d 10
c 21' | sort -k2 -n

# Sort numeric by second key, split at comma.
echo 'a,4
d,10
c,21' | sort -k2 -n -t,

Use --debug to annotate part of the line used to sort and hence debug the key usage.

tr(1)

tr [opt] str1 [str2]
    -d      delete characters in str1
    -s      squeeze repeating sequence of characters in str1

Examples

To lower

echo MoOsE | tr '[:upper:]' '[:lower:]'
# output: moose

Replace characters

echo moose | tr 'o' '-'
# output: m--se

echo moose | tr 'os' '-'
# output: m---e

Remove specific characters

echo moose | tr -d 'o'
# output: mse

echo moose | tr -d 'os'
# output: me

Squeeze character sequences

echo moooooossse | tr -s 'os'
# output: mose

tac(1)

# Reverse output lines of file(s) and concatenate (reverse of cat).
tac FILE [FILE]

echo -e 'a1\nb2\nc3\nd4' | tac
# d4
# c3
# b2
# a1

rev(1)

# Reverse each line of file(s), character by character.
rev FILE [FILE]

echo -e '123\nabc' | rev
# 321
# cba

Example: remove the last 2 tokens with unknown length

# If the number of tokens in a line is unkown but we want to remove the last 2
# tokens we can use rev(1).
echo 'aa bb cc dd' | rev | cut -d ' ' -f3- | rev
# aa bb

paste(1)

# Concatenate input files linewise and join them by a TAB char.

paste FILE [FILE]
    -d CHAR     delimiter to join each line

Examples

# Read two files.
paste <(echo -e 'a1\na2') <(echo -e 'b1\nb2')
a1	b1
a2	b2

# Can read from stdin.
echo -e 'a1 a2\nb1 b2\nc1 c2\nd1 d2' | paste - -
# a1 a2	b1 b2
# c1 c2	d1 d2

xargs(1)

xargs [opts] [cmd [init-args]]
    -l [<num>]   maximal number of lines per cmd invocation
                 if <num> it not provided, num=1 is assumed
    -I <str>     replace <str> in the [init-args] with the arg;
                 this implies -l, and hence processes one arg at a time

Example

Collect arguments and prefix them with another option.

# Using -l to process one arg at a time.
eval strace -f (find /dev -name 'std*' | xargs -l echo -P | xargs) ls

# Using -I to place the arg at the specified location.
eval strace -f (find /dev -name 'std*' | xargs -I {} echo -P {}) ls

# Both commands achieve the same thing and result in something like:
#   eval strace -f -P /dev/stdin -P /dev/stdout -P /dev/stderr ls

grep(1)

sort [opts] [pattern] [files]
    -e <pattern>        pattern to search for (can be supplied multiple times)
    -i                  ignore case in patterns
    -v                  invert match

    -n                  add line numbers to matched lines
    -H                  add file name to matched lines

    -r                  recursively read all files
    -I                  skip binary files
    --include <glob>    search only files matching glob
    --exclude <glob>    skip searching files matching glob

    -c                  count occurrence of matched patterns
    -l                  list only file name which contain the pattern

<glob> patterns may need to be quoted or escaped if the shell also does glob expansion.

find(1)

find <start> [opts]
    -maxdepth <n>        maximally search n dirs deep
    -type <t>            match on file type
                           f    regular file
                           d    directory
    -user <name>         list files owned by username
    -name <glob>         list files matching glob (only filename)
    -iname <glob>        list files matching glob case-insensitive

    -exec <cmd> {} ;     run cmd on each file
    -exec <cmd> {} +     run cmd with all files as argument

Depending on the shell the <glob> must be quoted or escaped. The exec modifier characters ; and + also may need to be escaped.

Example -exec option

> find . -maxdepth 1 -type d -exec echo x {} \;
# x .
# x ./.github
# x ./book
# x ./src
# x ./.git
# x ./docs

> find . -maxdepth 1 -type d -exec echo x {} +
# x . ./.github ./book ./src ./.git ./docs

Tools

• tmux
• screen
• emacs
• gpg
• radare2
• qemu
• pacman
• dot
• ffmpeg
• gnuplot
• restic
• qrencode

tmux(1)

Terminology:

• session is a collection of pseudo terminals which can have multiple windows
• window uses the entire screen and can be split into rectangular panes
• pane is a single pseudo terminal instance

Tmux cli

# Session
tmux                        creates new session
tmux ls                     list running sessions
tmux kill-session -t <s>    kill running session <s>
tmux attach -t <s> [-d]     attach to session <s>, detach other clients [-d]
tmux detach -s <s>          detach all clients from session <s>

# Environment
tmux showenv -g             show global tmux environment variables
tmux setenv -g <var> <val>  set variable in global tmux env

# Misc
tmux source-file <file>     source config <file>
tmux lscm                   list available tmux commnds
tmux show -g                show global tmux options
tmux display <msg>          display message in tmux status line

Scripting

# Session
tmux list-sessions -F '#S'           list running sessions, only IDs

# Window
tmux list-windows -F '#I' -t <s>     list window IDs for session <s>
tmux selectw -t <s>:<w>              select window <w> in session <s>

# Pane
tmux list-panes -F '#P' -t <s>:<w>   list pane IDs for window <w> in session <s>
tmux selectp -t <s>:<w>.<p>          select pane <p> in window <w> in session <s>

# Run commands
tmux send -t <s>:<w>.<p> "ls" C-m    send cmds/keys to pane
tmux run -t <p> <sh-cmd>             run shell command <sh-cmd> in background and report output on pane -t <p>

For example cycle through all panes in all windows in all sessions:

# bash
for s in $(tmux list-sessions -F '#S'); do
    for w in $(tmux list-windows -F '#I' -t $s); do
        for p in $(tmux list-panes -F '#P' -t $s:$w); do
            echo $s:$w.$p
        done
    done
done

Bindings

prefix d    detach from current session
prefix c    create new window
prefix w    open window list
prefix $    rename session
prefix ,    rename window
prefix .    move current window

Following bindings are specific to my tmux.conf:

C-s         prefix

# Panes
prefix s    horizontal split
prefix v    vertical split
prefix f    toggle maximize/minimize current pane

# Movement
prefix Tab  toggle between window

prefix h    move to pane left
prefix j    move to pane down
prefix k    move to pane up
prefix l    move to pane right

# Resize
prefix C-h  resize pane left
prefix C-j  resize pane down
prefix C-k  resize pane up
prefix C-l  resize pane right

# Copy/Paste
prefix C-v    enter copy mode
prefix C-p    paste yanked text
prefix C-b    open copy-buffer list

# In Copy Mode
v     enable visual mode
y     yank selected text

Command mode

To enter command mode prefix :.

Some useful commands are:

setw synchronize-panes on/off       enables/disables synchronized input to all panes
list-keys -t vi-copy                list keymaps for vi-copy mode

screen(1)

# Create new session.
screen

# List active session.
screen -list

# Attach to specific session.
screen -r SESSION

Options

# Enable logfile, default name screenlog.0.
screen -L
# Enable log and set logfile name.
screen -L -Logfile out.txt

Keymaps

Ctrl-A d            # Detach from session.
Ctrl-A + \          # Terminate session.
Ctrl-A + :          # Open cmand prompt.
    kill            # Kill session.

Examples

USB serial console.

# 1500000 -> baudrate
# cs8     -> 8 data bits
# -cstopb -> 1 stop bit
# -parenb -> no parity bit
# see stty(1) for all settings.
screen /dev/ttyUSB0 1500000,cs8,-cstopb,-parenb

# Print current tty settings.
sudo stty -F /dev/ttyUSB0 -a

emacs(1)

help

  C-h ?         list available help modes
  C-h e         show message output (`*Messages*` buffer)
  C-h f         describe function
  C-h v         describe variable
  C-h w         describe which key invoke function (where-is)
  C-h c <KEY>   print command bound to <KEY>
  C-h k <KEY>   describe command bound to <KEY>
  C-h b         list buffer local key-bindings
  C-h F         show emacs manual for command/function
  <kseq> C-h    list possible key-bindings with <kseq>
                eg C-x C-h -> list key-bindings beginning with C-x

package manager

  key    fn                          description
------------------------------------------------
         package-refresh-contents    refresh package list
         package-list-packages       list available/installed packages
                                     `U x` to mark packages for Upgrade & eXecute

window

  key      fn                      description
----------------------------------------------
  C-x 0    delete-window           kill focused window
  C-x 1    delete-other-windows    kill all other windows
  C-x 2    split-window-below      split horizontal
  C-x 3    split-window-right      split vertical
  C-x o    other-window            other window (cycle)

  C-x r w  window-configuration-to-register
                                   save window configuration in a register
                                   (use C-x r j to jump to the windows config again)

minibuffer

  key            description
----------------------------
  M-e            enter edit minibuffer edit mode

  M-up           focus previous completion
  M-down         focus next completion
  M-ret          select focused completion

buffer

  key        fn                   description
---------------------------------------------
  C-x C-q    read-only-mode       toggle read-only mode for buffer
  C-x k      kill-buffer          kill buffer
  C-x s      save-some-buffers    save buffer
  C-x w      write-file           write buffer (save as)
  C-x b      switch-to-buffer     switch buffer
  C-x C-b    list-buffers         buffer list
  C-x x r    rename-buffer        renames a buffer (allows multiple shell, compile, grep, .. buffers)

ibuffer

Builtin advanced buffer selection mode

  key        fn            description
--------------------------------------
             ibuffer       enter buffer selection

  h                        ibuffer help

  d                        mark for deletion
  x                        kill buffers marked for deletion

  o                        open buffer in other window
  C-o                      open buffer in other window keep focus in ibuffer

  s a                      sort by buffer name
  s f                      sort by file name
  s v                      sort by last viewed
  s v                      sort by major mode
  ,                        cycle sorting mode

  =                        compare buffer against file on disk (if file is dirty `*`)

  /m                       filter by major mode
  /n                       filter by buffer name
  /f                       filter by file name
  /i                       filter by modified buffers
  /E                       filter by process buffers
  //                       remove all filter

  /g                       create filter group
  /\                       remove all filter groups

goto navigation

  key      fn                description
----------------------------------------
  M-g g    goto-line         go to line
  M-g M-n  next-error        go to next error (grep, xref, compilation, ...)
  M-g M-p  previous-error    go to previous error

  M-g i    imenu             go to place in buffer (symbol, ...)

  M-<                        go to begin of buffer
  M->                        go to end of buffer

isearch

  key    fn                           description
-------------------------------------------------
  C-s    isearch-forward              search forward from current position (C-s to go to next match)
  C-r    isearch-backward             search backwards from current position (C-r to go to next match)
  C-w    isearch-yank-word-or-char    feed next word to current search (extend)
  M-p    isearch-ring-advance         previous search input
  M-n    isearch-ring-retreat         next search input
  M-e    isearch-edit-string          edit search string again
  M-s o  occur                        open search string in occur

occur

  key      fn           description
-----------------------------------
  M-s o    occur        get matches for regexp in buffer
                        use during `isearch` to use current search term
  e                     enter occur edit mode (C-c C-c to quit)

  n                     move to next entry and keep focus in occur buffer
  p                     move to previous entry and keep focus in occur buffer
  C-n                   goto next line
  C-p                   goto previous line
  o                     open match in other window
  C-o                   open match in other window keep focus in ibuffer

  key      fn                                 description
---------------------------------------------------------
           multi-occur-in-matching-buffers    run occur in buffers matching regexp

grep

  key    fn           description
-----------------------------------
         rgrep        recursive grep
         lgrep        local dir grep
         grep         raw grep command
         find-grep    run find-grep result in *grep* buffer

  n/p                 navigate next/previous match in *grep* buffer
  q                   quit *grep* buffer

yank/paste

  key         fn                      description
-------------------------------------------------
  C-<SPACE>   set-mark-command        set start mark to select text
  C-x C-x     exchange-point-and-mark swap mark and point position
  M-w         kill-ring-save          copy selected text
  C-w         kill-region             kill selected text
  C-y         yank                    paste selected text
  M-y         yank-pop                cycle through kill-ring (only after paste)
  M-y         yank-from-kill-ring     interactively select yank from kill ring

register

  key             fn                 description
------------------------------------------------
  C-x r s <reg>   copy-to-register   save region in register <reg>
  C-x r i <reg>   insert-register    insert content of register <reg>

bookmarks

  key             fn            description
-------------------------------------------
  C-x r m  bookmark-set         set a bookmark
  C-x r b  bookmark-jump        jump to a bookmark
  C-x r l  bookmark-bmenu-list  list all bookmarks

block/rect

  key          fn                    description
------------------------------------------------
  C-x <SPC>    rectangle-mark-mode   activate rectangle-mark-mode
               string-rectangle      insert text in marked rect

mass edit

  key       fn                       description
------------------------------------------------
  C-x h     mark-whole-buffer        mark whole buffer
            delete-matching-line     delete lines matchng regex
            kill-matching-line       kill lines matching regex (puts them in kill ring)
            keep-lines               keep matching lines
            replace-string           replace unconditional
  M-%       query-replace            search & replace
  C-M-%     query-replace-regexp     search & replace regex

narrow

  key       fn                    description
---------------------------------------------
  C-x n n   narrow-to-region      show only focused region (narrow)
  C-x n w   widen                 show whole buffer (wide)

org

  key              fn   description
------------------------------------
  M-up/M-down           re-arrange items in same hierarchy
  M-left/M-right        change item hierarchy
  C-RET                 create new item below current
  C-S-RET               create new TODO item below current
  S-left/S-right        cycle TODO states

org source

  key       fn     description
------------------------------
  <s TAB           generate a source block
  C-c '            edit source block (in lang specific buffer)
  C-c C-c          eval source block

project

  key       fn                                 description
----------------------------------------------------------
  C-x p p   project-switch-project             switch project
  C-x p f   project-find-file                  find file in project
  C-x p r   project-query-replace-regexp       query replace on project
  C-x p x   project-execute-extended-command   exec command on project
  C-x p !   project-shell-command              shell command on project
  C-x p &   project-async-shell-command        async shell command on project

tags / lsp

To generate etags using ctags

  ctags -R -e .         generate emacs tag file (important `-e`)

Navigate using tags

  key      fn                       description
-----------------------------------------------
  M-.      xref-find-definitions    find definition of tag
                                    (C-u prefix to enter symbol manually)
           xref-find-apropos        find symbols matching regexp
  M-?      xref-find-references     find references of tag

lisp

  key   fn        description
------------------------------
        ielm      open interactive elips shell

In lisp-interaction-mode (*scratch* buffer by defult)

  key              fn                           description
-----------------------------------------------------------
  C-j              eval-print-last-sexp         evaluate & print preceeding lisp expr

  C-x C-e          eval-last-sexp               evaluate lisp expr
  C-u C-x C-e      eval-last-sexp               evaluate & print
  C-c C-e          elisp-eval-region-or-buffer  eval buffer or region (elisp mode)

ido

Builtin fuzzy completion mode (eg buffer select, dired, ...).

  key              fn          description
------------------------------------------
                  ido-mode     toggle ido mode
  <Left>/<Right>               cycle through available competions
  <RET>                        select completion

There is also fido, which is the successor of ido, which also supports fido-vertical-mode in case vertical mode is preferred.

evil

  key    fn    description
--------------------------
  C-z          toggle emacs/evil mode
  C-^          toggle between previous and current buffer
  C-p          after paste cycle kill-ring back
  C-n          after paste cycle kill-ring forward

dired

  key    fn    description
--------------------------
  i            open sub-dir in same buffer
  +            create new directory
  C            copy file/dir
  R            move file/dir (rename)
  S            absolute symbolic link
  Y            relative symbolic link

  d            mark for deletion
  m            mark file/dir at point
  * %          mark by regex
  * *          mark all executables
  * /          mark all dirs
  u            un-mark file/dir
  U            un-mark all
  t            toggle marks

  x            execute marked actions
  !            run shell command on marked files
  &            run shell command on marked files (async)

  q            quit

info

  key fn                    description
---------------------------------------
  n   Info-next             next page
  p   Info-prev             previous page

  l   Info-history-back     history go back
  r   Info-history-forward  history go forward

  ^   Info-Up               up in info node tree

  m   Info-menu             goto menu (by minibuf completion)
  s   Info-search           search info
  g   Info-goto-node        goto info node (by minibuf completion)

      Info-history          open info history in buffer

shell commands

  key   fn                        description
---------------------------------------------
  M-!   shell-command             run shell command synchronously
  M-&   async-shell-command       run shell command asynchronously
  M-|   shell-command-on-region   run shell command on region;
                                  prefix with C-u to replace region with
                                  output of the command

interactive shell

Set ESHELL environment variable before starting emacs to change default shell, else customize the explicit-shell-file-name variable.

  key      fn                    description
---------------------------------------------
  M-x      shell                 start interactive shell
  C-u M-x  shell                 start interactive shell & rename


  M-r      comint-history-isearch-backward-regexp
                                 search history, invoke at end of shell buffer
  M-p      comint-previous-input go one up in history
  C-<UP>
  M-n      comint-next-input     go one down in history
  C-<DOWN>

  C-c C-a                        go begin of line (honors prompt)
  C-c C-e                        go to end of line
  C-c C-c                        interrupt active command

gpg(1)

gpg
  -o|--output                 Specify output file
  -a|--armor                  Create ascii output
  -u|--local-user <name>      Specify key for signing
  -r|--recipient              Encrypt for user

Generate new keypair

gpg --full-generate-key

List keys

gpg -k / --list-key               # public keys
gpg -K / --list-secret-keys       # secret keys

Edit keys

gpg --edit-key <KEY ID>

Gives prompt to modify KEY ID, common commands:

help         show help
save         save & quit

list         list keys and user IDs
key <N>      select subkey <N>
uid <N>      select user ID <N>

expire       change expiration of selected key

adduid       add user ID
deluid       delete selected user ID

addkey       add subkey
delkey       delete selected subkey

Export & Import Keys

gpg --export --armor --output <KEY.PUB> <KEY ID>
gpg --export-secret-key --armor --output <KEY.PRIVATE> <KEY ID>
gpg --import <FILE>

Search & Send keys

gpg --keyserver <SERVER> --send-keys <KEY ID>
gpg --keyserver <SERVER> --search-keys <KEY ID>

Encrypt (passphrase)

Encrypt file using passphrase and write encrypted data to <file>.gpg.

gpg --symmetric <file>

# Decrypt using passphrase
gpg -o <file> --decrypt <file>.gpg

Encrypt (public key)

Encrypt file with public key of specified recipient and write encrypted data to <file>.gpg.

gpg --encrypt -r foo@bar.de <file>

# Decrypt at foos side (private key required)
gpg -o <file> --decrypt <file>.gpg

Signing

Generate a signed file and write to <file>.gpg.

# Sign with private key of foo@bar.de
gpg --sign -u foor@bar.de <file>

# Verify with public key of foo@bar.de
gpg --verify <file>

# Extract content from signed file
gpg -o <file> --decrypt <file>.gpg

Without -u use first private key in list gpg -K for signing.

Files can also be signed and encrypted at once, gpg will first sign the file and then encrypt it.

gpg --sign --encrypt -r <recipient> <file>

Signing (detached)

Generate a detached signature and write to <file>.asc. Send <file>.asc along with <file> when distributing.

gpg --detach-sign --armor -u foor@bar.de <file>

# Verify
gpg --verify <file>.asc <file>

Without -u use first private key in list gpg -K for signing.

Abbreviations

• sec secret key
• ssb secret subkey
• pub public key
• sub public subkey

Key usage flags:

• [S] signing
• [C] create certificates
• [E] encrypting
• [A] authentication

Keyservers

• http://pgp.mit.edu
• http://keyserver.ubuntu.com
• hkps://pgp.mailbox.org

Examples

List basic key information from file with long keyids

gpg --keyid-format 0xlong <key.asc>

Extend expiring key

gpg --edit-key <key id>

# By default we are on the primary key, can switch to sub key.
gpg> key 1

# Update the expire date.
gpg> expire

gpg> save

# Update keyserver(s) and/or export new pub keyfile.

radare2(1)

print

  pd <n> [@ <addr>]     # print disassembly for <n> instructions
                        # with optional temporary seek to <addr>

flags

  fs            # list flag-spaces
  fs <fs>       # select flag-space <fs>
  f             # print flags of selected flag-space

help

  ?*~<kw>       # '?*' list all commands and '~' grep for <kw>
  ?*~...        # '..' less mode /'...' interactive search

relocation

  > r2 -B <baddr> <exe>         # open <exe> mapped to addr <baddr>
  oob <addr>                    # reopen current file at <baddr>

Examples

Patch file (alter bytes)

  > r2 [-w] <file>
  oo+           # re-open for write if -w was not passed
  s <addr>      # seek to position
  wv <data>     # write 4 byte (dword)

Assemble / Disassmble (rasm2)

  rasm2 -L      # list supported archs

  > rasm2 -a x86 'mov eax, 0xdeadbeef'
  b8efbeadde

  > rasm2 -a x86 -d "b8efbeadde"
  mov eax, 0xdeadbeef

qemu(1)

All the examples & notes use qemu-system-x86_64 but in most cases this can be swapped with the system emulator for other architectures.

Keybindings

Graphic mode:

Ctrl+Alt+g         release mouse capture from VM

Ctrl+Alt+1         switch to display of VM
Ctrl+Alt+2         switch to qemu monitor

No graphic mode:

Ctrl+a h           print help
Ctrl+a x           exit emulator
Ctrl+a c           switch between monitor and console

VM config snippet

Following command-line gives a good starting point to assemble a VM:

qemu-system-x86_64                 \
    -cpu host -enable-kvm -smp 4   \
    -m 8G                          \
    -vga virtio -display sdl,gl=on \
    -boot menu=on                  \
    -cdrom <iso>                   \
    -hda <disk>                    \
    -device qemu-xhci,id=xhci      \
    -device usb-host,bus=xhci.0,vendorid=0x05e1,productid=0x0408,id=capture-card

CPU & RAM

# Emulate host CPU in guest VM, enabling all supported host featured (requires KVM).
# List available CPUs `qemu-system-x86_64 -cpu help`.
-cpu host

# Enable KVM instead software emulation.
-enable-kvm

# Configure number of guest CPUs.
-smp <N>

# Configure size of guest RAM.
-m 8G

Graphic & Display

# Use sdl window as display and enable openGL context.
-display sdl,gl=on

# Use vnc server as display (eg on display `:42` here).
-display vnc=localhost:42

# Confifure virtio as 3D video graphic accelerator (requires virgl in guest).
-vga virtio

Boot Menu

# Enables boot menu to select boot device (enter with `ESC`).
-boot menu=on

Block devices

# Attach cdrom drive with iso to a VM.
-cdrom <iso>

# Attach disk drive to a VM.
-hda <disk>

# Generic way to configure & attach a drive to a VM.
-drive file=<file>,format=qcow2

Create a disk with qemu-img

To create a qcow2 disk (qemu copy-on-write) of size 10G:

qemu-img create -f qcow2 disk.qcow2 10G

The disk does not contain any partitions or a partition table. We can format the disk from within the guest as following example:

# Create `gpt` partition table.
sudo parted /dev/sda mktable gpt

# Create two equally sized primary partitions.
sudo parted /dev/sda mkpart primary 0% 50%
sudo parted /dev/sda mkpart primary 50% 100%

# Create filesystem on each partition.
sudo mkfs.ext3 /dev/sda1
sudo mkfs.ext4 /dev/sda2

lsblk -f /dev/sda
  NAME   FSTYPE LABEL UUID FSAVAIL FSUSE% MOUNTPOINT
  sda
  ├─sda1 ext3         ....
  └─sda2 ext4         ....

USB

Host Controller

# Add XHCI USB controller to the VM (supports USB 3.0, 2.0, 1.1).
# `id=xhci` creates a usb bus named `xhci`.
-device qemu-xhci,id=xhci

USB Device

# Pass-through USB device from host identified by vendorid & productid and
# attach to usb bus `xhci.0` (defined with controller `id`).
-device usb-host,bus=xhci.0,vendorid=0x05e1,productid=0x0408

Debugging

# Open gdbstub on tcp `<port>` (`-s` shorthand for `-gdb tcp::1234`).
-gdb tcp::<port>

# Freeze guest CPU at startup and wait for debugger connection.
-S

IO redirection

# Create raw tcp server for `serial IO` and wait until a client connects
# before executing the guest.
-serial tcp:localhost:12345,server,wait

# Create telnet server for `serial IO` and wait until a client connects
# before executing the guest.
-serial telnet:localhost:12345,server,wait

# Configure redirection for the QEMU `mointor`, arguments similar to `-serial`
# above.
-monitor ...

In server mode use nowait to execute guest without waiting for a client connection.

Network

# Redirect host tcp port `1234` to guest port `4321`.
-nic user,hostfwd=tcp:localhost:1234-:4321

Shared drives

# Attach a `virtio-9p-pci` device to the VM.
# The guest requires 9p support and can mount the shared drive as:
#   mount -t 9p -o trans=virtio someName /mnt
-virtfs local,id=someName,path=<someHostPath>,mount_tag=someName,security_model=none

Debug logging

# List debug items.
-d help

# Write debug log to file instead stderr.
-D <file>

# Examples
-d in_asm       Log executed guest instructions.

Tracing

# List name of all trace points.
-trace help

# Enable trace points matching pattern and optionally write trace to file.
-trace <pattern>[,file=<file>]

# Enable trace points for all events listed in the <events> file.
# File must contain one event/pattern per line.
-trace events=<events>

VM snapshots

VM snapshots require that there is at least on qcow2 disk attached to the VM (VM Snapshots).

Commands for qemu Monitor or QMP:

# List available snapshots.
info snapshots

# Create/Load/Delete snapshot with name <tag>.
savevm <tag>
loadvm <tag>
delvm <tag>

The snapshot can also be directly specified when invoking qemu as:

qemu-system-x86_64 \
    -loadvm <tag>  \
    ...

VM Migration

Online migration example:

# Start machine 1 on host ABC.
qemu-system-x86_64 -monitor stdio -cdrom <iso>

# Prepare machine 2 on host DEF as migration target.
# Listen for any connection on port 12345.
qemu-system-x86_64 -monitor stdio -incoming tcp:0.0.0.0:12345

# Start migration from the machine 1 monitor console.
(qemu) migrate tcp:DEF:12345

Save to external file example:

```bash
# Start machine 1.
qemu-system-x86_64 -monitor stdio -cdrom <iso>

# Save VM state to file.
(qemu) migrate "exec:gzip -c > vm.gz"

# Load VM from file.
qemu-system-x86_64 -monitor stdio -incoming "exec: gzip -d -c vm.gz"

The migration source machine and the migration target machine should be launched with the same parameters.

Appendix: Direct Kernel boot

Example command line to directly boot a Kernel with an initrd ramdisk.

qemu-system-x86_64                                                     \
    -cpu host                                                          \
    -enable-kvm                                                        \
    -kernel <dir>/arch/x86/boot/bzImage                                \
    -append "earlyprintk=ttyS0 console=ttyS0 nokaslr init=/init debug" \
    -initrd <dir>/initramfs.cpio.gz                                    \
    ...

Instructions to build a minimal Kernel and initrd.

Appendix: Cheap instruction tracer

test: test.s
	as -o test.o test.s
	ld -o test test.o testc.o

trace: test
	qemu-x86_64 -singlestep -d nochain,cpu ./test 2>&1 | awk '/RIP/ { print $$1; }'

clean:
	$(RM) test test-bin test.o

.section .text, "ax"

.global _start
_start:
    xor %rax, %rax
    mov $0x8, %rax
1:
    cmp $0, %rax
    je 2f
    dec %rax
    jmp 1b
2:
    # x86-64 exit(2) syscall
    mov $0, %rdi
    mov $60, %rax
    syscall

References

• QEMU USB
• QEMU IMG
• QEMU Tools
• QEMU System
• QEMU Invocation (command line args)
• QEMU Monitor
• QEMU machine protocol (QMP)
• QEMU VM Snapshots

pacman(1)

Remote package repositories

pacman -Sy              refresh package database
pacman -S <pkg>         install pkg
pacman -Ss <regex>      search remote package database
pacman -Si <pkg>        get info for pkg
pacman -Su              upgrade installed packages
pacman -Sc              clean local package cache

Remove packages

pacman -Rsn <pkg>               uninstall package and unneeded deps + config files

Local package database

Local package database of installed packages.

pacman -Q               list all installed packages
pacman -Qs <regex>      search local package database
pacman -Ql <pkg>        list files installed by pkg
pacman -Qo <file>       query package that owns file
pacman -Qe              only list explicitly installed packages

Local file database

Local file database which allows to search packages owning certain files. Also searches non installed packages, but database must be synced.

pacman -Fy              refresh file database
pacman -Fl <pkg>        list files in pkg (must not be installed)
pacman -Fx <regex>      search 

Hacks

Uninstall all orphaned packages (including config files) that were installed as dependencies.

pacman -Rsn $(pacman -Qtdq)

List explicitly installed packages that are not required as dependency by any package and sort by size.

pacman -Qetq | xargs pacman -Qi |
    awk '/Name/ { name=$3 }
         /Installed Size/ { printf "%8.2f%s %s\n", $4, $5, name }' |
    sort -h

Install package into different root directory but keep using the default database.

pacman --root abc --dbpath /var/lib/pacman -S mingw-w64-gcc

dot(1)

Online playground

Example dot file to copy & paste from.

Can be rendered to svg with the following command.

dot -T svg -o g.svg g.dot

Example dot file.

// file: g.dot
digraph {
    // Render ranks from left to right.
    rankdir=LR
    // Make background transparent.
    bgcolor=transparent

    // Global node attributes.
    node [shape=box]
    // Global edge attributes.
    edge [style=dotted,color=red]

    // Add nodes & edge.
    stage1 -> stage2
    // Add multiple edges at once.
    stage2 -> { stage3_1, stage3_2 }
    // Add edge with custom attributes.
    stage3_2 -> stage4 [label="some text"]

    // Set custom attributes for specific node.
    stage4 [color=green,fillcolor=lightgray,style="filled,dashed",label="s4"]

    // Create a subgraph. This can be used to group nodes/edges or as scope for
    // global node/edge attributes.
    // If the name starts with 'cluster' a border is drawn.
    subgraph cluster_1 {
        stage5_1
        stage5_2
    }

    // Add some edges to subgraph nodes.
    stage3_1 -> { stage5_1, stage5_2 }
}

Rendered svg file.

References

• DOT language
• Attributes
• Node shapes
• Colors
• User manual

ffmpeg (1)

screen capture specific window (x11)

Following snippet allows to select a window which is then captured.

#!/bin/bash

echo "Click on window to record .."
# Extract window size and x,y offset.
video_args=$(xwininfo \
    | awk '/Absolute upper-left X:/ { xoff = $4 }
           /Absolute upper-left Y:/ { yoff=$4 }
           /Width:/ { if ($2 % 2 == 1) { width=$2-1; } else { width=$2; } }
           /Height:/ { if ($2 % 2 == 1) { height=$2-1; } else { height=$2; } }
           END { printf "-video_size %dx%d -i :0.0+%d,%d", width, height, xoff, yoff  }')

ffmpeg -framerate 25 -f x11grab $video_args -pix_fmt yuv420p $@ output.mp4

Use yuv420p pixel format if video is played on the web (ref)

The input -i 0,0+xoff,yoff means to capture $DISPLAY=0.0 starting at the coordinate (xoff, yoff), which is the left-upper corner, and the size of the capture is defined by the -video_size argument.

gnuplot (1)

# Launch interactive shell.
gnuplot

# Launch interactive shell.
gnuplot [opt]
  opt:
    -p ................ persist plot window
    -c <file> ......... run script file
    -e "<cmd1>; .." ... run cmd(s)

Frequently used configuration

# Plot title.
set title "the plot"

# Labels.
set xlabel "abc"
set ylabel "def"

# Grid.
set grind

# Output format, 'help set term' for all output formats.
set term svg
# Output file.
set output "out.svg"

# Make axis logarithmic to given base.
set logscale x 2

# Change separator, default is whitespace.
set datafile separator ","

Plot

# With specific style (eg lines, linespoint, boxes, steps, impulses, ..).
plot "<data_file>" with <plot_style>

> cat data.txt
1 1 3
2 2 2
3 3 1
4 2 2

# Plot specific column.
plot "data.txt" using 1:2, "data.txt" using 1:3
# Equivalent using the special file "", which re-uses the previous input file.
plot "data.txt" using 1:2, "" using 1:3

# Plot piped data.
plot "< head -n2 data.txt"

# Plot with alternate title.
plot "data.txt" title "moose"

Example: Specify range directly during plot

# Plot two functions in the range 0-10.
plot [0:10] 10*x, 20*x

Example: multiple data sets in plot

# file: mem_lat.plot

set title  "memory latency (different strides)"
set xlabel "array in KB"
set ylabel "cycles / access"

set logscale x 2

plot "stride_32.txt"  title "32"  with linespoints, \
     "stride_64.txt"  title "64"  with linespoints, \
     "stride_128.txt" title "128" with linespoints, \
     "stride_256.txt" title "256" with linespoints, \
     "stride_512.txt" title "512" with linespoints

On Linux x86_64, mem_lat.c provides an example which can be run as follows.

gcc -o mem_lat mem_lat.c -g -O3 -Wall -Werror

for stride in 32 64 128 256 512; do \
    taskset -c 1 ./mem_lat 128 $stride | tee stride_$stride.txt ; \
done

gnuplot -p -c mem_lat.plot

restic(1)

Create new snapshot repository

# Create a local backup repository.
restic -r <path> init

# Create a backup repository on a remote host.
restic -r sftp:user@host:<path> init

Example: Restore file pattern from latest snapshot

Restore files matching <file_pattern> from the latest snapshot (pseudo snapshot ID) into <dest>.

restic -r <repo> restore -i <file_pattern> --target <dest> latest

Mount snapshots

Mount snapshots as user filesystem (fuse) to given mount point.

restic -r <repo> mount <mntpoint>

# Mounted snapshots can be limited by host.
restic -r <repo> mount --host <host> <mntpoint>

# Mounted snapshots can be limited by path (abs path).
restic -r <repo> mount --path <abspath> <mntpoint>

Repository maintenance

Check the repository for errors and report them.

restic -r <repo> check

Check the repository for non-referenced data and remove it.

restic -r <repo> prune

References

• restic read the docs
• sftp

qrencode(1)

qrencode
    -s N     pixels per feature length

Generate wifi qr code for WPA2 secured network.

# Generate on terminal.
qrencode -t ansiutf8 'WIFI:S:<wifiname>;T:WPA2;P:<wifipasswd>;;'

# Generate picture for printing.
qrencode -t png -o wifi.png 'WIFI:S:<wifiname>;T:WPA2;P:<wifipasswd>;;'

Process management & inspection

• lsof
• pidstat
• pgrep
• ps
• pmap
• pstack
• taskset
• nice

lsof(8)

lsof
  -r <s> ..... repeatedly execute command ervery <s> seconds
  -a ......... AND slection filters instead ORing (OR: default)
  -p <pid> ... filter by <pid>
  +fg ........ show file flags for file descripros
  -n ......... don't convert network addr to hostnames
  -P ......... don't convert network port to service names
  -i <@h[:p]>. show connections to h (hostname|ip addr) with optional port p
  -s <p:s> ... in conjunction with '-i' filter for protocol <p> in state <s>
  -U ......... show unix domain sockets ('@' indicates abstract sock name, see unix(7))

file flags:
  R/W/RW ..... read/write/read-write
  CR ......... create
  AP ......... append
  TR ......... truncate

-s protocols
  TCP, UDP

-s states (TCP)
  CLOSED, IDLE, BOUND, LISTEN, ESTABLISHED, SYN_SENT, SYN_RCDV, ESTABLISHED,
  CLOSE_WAIT, FIN_WAIT1, CLOSING, LAST_ACK, FIN_WAIT_2, TIME_WAIT

-s states (UDP)
  Unbound, Idle

Examples

File flags

Show open files with file flags for process:

lsof +fg -p <pid>

Open TCP connections

Show open tcp connections for $USER:

lsof -a -u $USER -i TCP

Note: -a ands the results. If -a is not given all open files matching $USER and all tcp connections are listed (ored).

Open connection to specific host

Show open connections to localhost for $USER:

lsof -a -u $USER -i @localhost

Open connection to specific port

Show open connections to port :1234 for $USER:

lsof -a -u $USER -i :1234

IPv4 TCP connections in ESTABLISHED state

lsof -i 4TCP -s TCP:ESTABLISHED

List open files in a mounted directory.

This may help to find which processes keep devices busy when trying to unmount and the device is currently busy.

# Assuming /proc is a mount point.
lsof /proc

pidstat(1)

pidstat [opt] [interval] [cont]
  -U [user]     show username instead UID, optionally only show for user
  -r            memory statistics
  -d            I/O statistics
  -h            single line per process and no lines with average

Page fault and memory utilization

pidstat -r -p <pid> [interval] [count]

minor_pagefault: Happens when the page needed is already in memory but not
                 allocated to the faulting process, in that case the kernel
                 only has to create a new page-table entry pointing to the
                 shared physical page (not required to load a memory page from
                 disk).

major_pagefault: Happens when the page needed is NOT in memory, the kernel
                 has to create a new page-table entry and populate the
                 physical page (required to load a memory page from disk).

I/O statistics

pidstat -d -p <pid> [interval] [count]

pgrep(1)

pgrep [opts] <pattern>
  -n         only list newest matching process
  -u <usr>   only show matching for user <usr>
  -l         additionally list command
  -a         additionally list command + arguments
  -x         match exactly

Debug newest process

For example attach gdb to newest zsh process from $USER.

gdb -p $(pgrep -n -u $USER zsh)

ps(1)

ps [opt]
  opt:
    --no-header .... do not print column header
    -o <OUT> ....... comma separated list of output columns
    -p <PID> ....... only show pid
    -C <name> ...... only show processes matching name
    -T ............. list threads
    --signames ..... use short signames instead bitmasks

Set PS_FORMAT env variable to setup default output columns.

Frequently used output columns

pid        process id
ppid       parent process id
pgid       process group id
tid        thread id

comm       name of process
cmd        name of process + args (full)

etime      elapsed time (since process started)
user       user owning process
thcount    thread count of process
nice       nice value (-20 highest priority to 19 lowest)

pcpu       cpu utilization (percent)
pmem       physical resident set (rss) (percent)
rss        physical memory (in kb)
vsz        virtual memory (in kb)

sig        mask of pending signals
sigcatch   mask of caught signals
sigignore  mask of ignored signals
sigmask    mask of blocked signals

Example: Use output for scripting

# Print the cpu affinity for each thread of process 31084.
for tid in $(ps -o tid --no-header -T -p 31084); do
    taskset -c -p $tid;
done

Example: Watch processes by name

watch -n1 ps -o pid,pcpu,pmem,rss,vsz,state,user,comm -C fish

Example: Show signal information

# With signal masks.
ps -o pid,user,sig,sigcatch,sigignore,sigmask,comm -p 66570

# With signal names.
ps --signames -o pid,user,sig,sigcatch,sigignore,sigmask,comm -p 66570

pmap(1)

pmap [opts] <pid>
    Dump virtual memory map of process.
    Compared to /proc/<pid>/maps it shows the size of the mappings.
opts:
  -p         show full path in the mapping
  -x         show details (eg RSS usage of each segment)

pstack(1)

pstack <pid>
    Dump stack for all threads of process.

taskset(1)

Set cpu affinity for new processes or already running ones.

# Pin all (-a) tasks of new command on cores 0,1,2,4.
taskset -ac 0-2,4 CMD [ARGS]

# Pin all tasks of running PID onto cores 0,2,4.
taskset -ac 0-5:2 -p PID

Example

Utility script to extract cpu lists grouped by the last-level-cache.

import subprocess

res = subprocess.run(["lscpu", "-p=cpu,cache"], capture_output=True, check=True)

LLC2CPU = dict()

for line in res.stdout.decode().splitlines():
    if line.startswith("#"):
        continue

    cpu, cache = line.split(",")
    llc        = cache.split(":")[-1]

    LLC2CPU.setdefault(llc, list()).append(int(cpu))

LLC2RANGE = dict()

for llc, cpus in LLC2CPU.items():
    first_cpu = cpus[0]
    prev_cpu  = cpus[0]
    for cpu in cpus[1:]:
        if cpu != prev_cpu + 1:
            LLC2RANGE.setdefault(llc, list()).append(f"{first_cpu}-{prev_cpu}")
            # New range begins.
            first_cpu = cpu
        prev_cpu = cpu
    # Trailing range.
    LLC2RANGE.setdefault(llc, list()).append(f"{first_cpu}-{prev_cpu}")

print(LLC2RANGE)

nice(1)

Adjust niceness of a new command or running process.

Niceness influences the scheduling priority and ranges between:

• -20 most favorable
• 19 least favorable

# Adjust niceness +5 for the launched process.
nice -n 5 yes

# Adjust niceness of running process.
renice -n 5 -p PID

Trace and Profile

• time
• strace
• ltrace
• perf
• OProfile
• callgrind
• valgrind
• vtune
• tracy

/usr/bin/time(1)

# statistics of process run
/usr/bin/time -v <cmd>

strace(1)

strace [opts] [prg]
  -f .......... follow child processes on fork(2)
  -ff ......... follow fork and separate output file per child
  -p <pid> .... attach to running process
  -s <size> ... max string size, truncate of longer (default: 32)
  -e <expr> ... expression for trace filtering
  -o <file> ... log output into <file>
  -c .......... dump syscall statitics at the end
  -C .......... like -c but dump regular ouput as well
  -k .......... dump stack trace for each syscall
  -P <path> ... only trace syscall accesing path
  -y .......... print paths for FDs
  -tt ......... print absolute timestamp (with us precision)
  -r .......... print relative timestamp
  -z .......... log only successful syscalls
  -Z .......... log only failed syscalls
  -n .......... print syscall numbers
  -y .......... translate fds (eg file path, socket)
  -yy ......... translate fds with all information (eg IP)
  -x .......... print non-ASCII chars as hex string
  -v .......... print all arguments (non-abbreviated)

<expr>:
  trace=syscall[,syscall] .... trace only syscall listed
  trace=file ................. trace all syscall that take a filename as arg
  trace=process .............. trace process management related syscalls
  trace=signal ............... trace signal related syscalls
  signal ..................... trace signals delivered to the process

Examples

Trace open(2) & socket(2) syscalls for a running process + child processes:

strace -f -e trace=open,socket -p <pid>

Trace signals delivered to a running process:

strace -e signal -e 'trace=!all' -p <pid>

Show successful calls to perf_event_open((2) without abbreviating arguments.

strace -v -z -e trace=perf_event_open perf stat -e cycles ls

ltrace(1)

ltrace [opts] [prg]
  -f .......... follow child processes on fork(2)
  -p <pid> .... attach to running process
  -o <file> ... log output into <file>
  -l <filter> . show who calls into lib matched by <filter>
  -C .......... demangle
  -e <filter> . show calls symbols matched by <filter>
  -x <filter> . which symbol table entry points to trace
                (can be of form sym_pattern@lib_pattern)
  -n <num>      number of spaces to indent nested calls

Example

List which program/libs call into libstdc++:

ltrace -l '*libstdc++*' -C -o ltrace.log ./main

List calls to specific symbols:

ltrace -e malloc -e free ./main

Trace symbols from dlopen(3)ed libraries.

# Assume libfoo.so would be dynamically loaded via dlopen.
ltrace -x '@libfoo.so'

# Trace all dlopened symbols.
ltrace -x '*'
# Trace all symbols from dlopened libraries which name match the
# pattern "liby*".
ltrace -x '@liby*'
# Trace symbol "foo" from all dlopened libraries matching the pattern.
ltrace -x 'foo@liby*'

perf(1)

perf list     show supported hw/sw events & metrics
  -v ........ print longer event descriptions
  --details . print information on the perf event names
              and expressions used internally by events

perf stat
  -p <pid> ..... show stats for running process
  -o <file> .... write output to file (default stderr)
  -I <ms> ...... show stats periodically over interval <ms>
  -e <ev> ...... select event(s)
  -M <met> ..... print metric(s), this adds the metric events
  --all-user ... configure all selected events for user space
  --all-kernel . configure all selected events for kernel space

perf top
  -p <pid> .. show stats for running process
  -F <hz> ... sampling frequency
  -K ........ hide kernel threads

perf record
  -p <pid> ............... record stats for running process
  -o <file> .............. write output to file (default perf.data)
  -F <hz> ................ sampling frequency
  --call-graph <method> .. [fp, dwarf, lbr] method how to caputre backtrace
                           fp   : use frame-pointer, need to compile with
                                  -fno-omit-frame-pointer
                           dwarf: use .cfi debug information
                           lbr  : use hardware last branch record facility
  -g ..................... short-hand for --call-graph fp
  -e <ev> ................ select event(s)
  --all-user ............. configure all selected events for user space
  --all-kernel ........... configure all selected events for kernel space
  -M intel ............... use intel disassembly in annotate

perf report
  -n .................... annotate symbols with nr of samples
  --stdio ............... report to stdio, if not presen tui mode
  -g graph,0.5,callee ... show callee based call chains with value >0.5

Useful <ev>:
  page-faults
  minor-faults
  major-faults
  cpu-cycles`
  task-clock

Select specific events

Events to sample are specified with the -e option, either pass a comma separated list or pass -e multiple times.

Events are specified in the following form name[:modifier]. The list and description of the modifier can be found in the perf-list(1) manpage under EVENT MODIFIERS.

# L1 i$ misses in user space
# L2 i$ stats in user/kernel space mixed
# Sample specified events.
perf stat -e L1-icache-load-misses:u \
          -e l2_rqsts.all_code_rd:uk,l2_rqsts.code_rd_hit:k,l2_rqsts.code_rd_miss:k \
          -- stress -c 2

The --all-user and --all-kernel options append a :u and :k modifier to all specified events. Therefore the following two command lines are equivalent.

# 1)
perf stat -e cycles:u,instructions:u -- ls

# 2)
perf stat --all-user -e cycles,instructions -- ls

Raw events

In case perf does not provide a symbolic name for an event, the event can be specified in a raw form as r + UMask + EventCode.

The following is an example for the L2_RQSTS.CODE_RD_HIT event with EventCode=0x24 and UMask=0x10 on my laptop with a sandybridge uarch.

perf stat -e l2_rqsts.code_rd_hit -e r1024 -- ls
# Performance counter stats for 'ls':
#
#       33.942      l2_rqsts.code_rd_hit
#       33.942      r1024

Find raw performance counter events (intel)

The intel/perfmon repository provides a performance event databases for the different intel uarchs.

The table in mapfile.csv can be used to lookup the corresponding uarch, just grab the family model from the procfs.

 cat /proc/cpuinfo | awk '/^vendor_id/  { V=$3 }
                          /^cpu family/ { F=$4 }
                          /^model\s*:/  { printf "%s-%d-%x\n",V,F,$3 }'

The table in performance monitoring events describes how events are sorted into the different files.

Raw events for perfs own symbolic names

Perf also defines some own symbolic names for events. An example is the cache-references event. The perf_event_open(2) manpage gives the following description.

perf_event_open(2)

PERF_COUNT_HW_CACHE_REFERENCES
    Cache accesses.  Usually this indicates Last Level Cache accesses but this
    may vary depending on your CPU.  This may include prefetches and coherency
    messages; again this depends on the design of your CPU.

The sysfs can be consulted to get the concrete performance counter on the given system.

cat /sys/devices/cpu/events/cache-misses
# event=0x2e,umask=0x41

Flamegraph

Flamegraph with single event trace

perf record -g -e cpu-cycles -p <pid>
perf script | FlameGraph/stackcollapse-perf.pl | FlameGraph/flamegraph.pl > cycles-flamegraph.svg

Flamegraph with multiple event traces

perf record -g -e cpu-cycles,page-faults -p <pid>
perf script --per-event-dump
# fold & generate as above

Examples

Estimate max instructions per cycle

#define NOP4        "nop\nnop\nnop\nnop\n"
#define NOP32       NOP4   NOP4   NOP4   NOP4   NOP4   NOP4   NOP4   NOP4
#define NOP256      NOP32  NOP32  NOP32  NOP32  NOP32  NOP32  NOP32  NOP32
#define NOP2048     NOP256 NOP256 NOP256 NOP256 NOP256 NOP256 NOP256 NOP256

int main() {
  for (unsigned i = 0; i < 2000000; ++i) {
    asm volatile(NOP2048);
  }
}

perf stat -e cycles,instructions ./noploop
# Performance counter stats for './noploop':
#
#     1.031.075.940      cycles
#     4.103.534.341      instructions       #    3,98  insn per cycle

Caller vs callee callstacks

The following gives an example for a scenario where we have the following calls

• main -> do_foo() -> do_work()
• main -> do_bar() -> do_work()

perf report --stdio -g graph,caller

# Children      Self  Command  Shared Object         Symbols
# ........  ........  .......  ....................  .................
#
#  49.71%    49.66%   bench    bench                 [.] do_work
#          |
#           --49.66%--_start                <- callstack bottom
#                     __libc_start_main
#                     0x7ff366c62ccf
#                     main
#                     |
#                     |--25.13%--do_bar
#                     |          do_work    <- callstack top
#                     |
#                      --24.53%--do_foo
#                                do_work

perf report --stdio -g graph,callee

# Children      Self  Command  Shared Object         Symbols
# ........  ........  .......  ....................  .................
#
#  49.71%    49.66%   bench    bench                 [.] do_work
#          |
#          ---do_work                       <- callstack top
#             |
#             |--25.15%--do_bar
#             |          main
#             |          0x7ff366c62ccf
#             |          __libc_start_main
#             |          _start             <- callstack bottom
#             |
#              --24.55%--do_foo
#                        main
#                        0x7ff366c62ccf
#                        __libc_start_main
#                        _start             <- callstack bottom

References

• intel/perfmon - intel PMU event database per uarch
• intel/perfmon-html - a html rendered version of the PMU events with search
• intel/perfmon/mapfile.csv - processor family to uarch mapping
• linux/perf/events - x86 PMU events known to perf tools
• linux/arch/events - x86 PMU events linux kernel
• wikichip - computer architecture wiki
• perf-list(1) - manpage
• perf_event_open(2) - manpage
• intel/sdm - intel software developer manuals (eg Optimization Reference Manual)

OProfile

operf -g -p <pid>
  -g ...... caputre call-graph information

opreport [opt] FILE
            show time spent per binary image
  -l ...... show time spent per symbol
  -c ...... show callgraph information (see below)
  -a ...... add column with time spent accumulated over child nodes

ophelp      show supported hw/sw events

callgrind

Callgrind is a tracing profiler which records the function call history of a target program and collects the number of executed instructions. It is part of the valgrind tool suite.

Profiling data is collected by instrumentation rather than sampling of the target program.

Callgrind does not capture the actual time spent in a function but computes the inclusive & exclusive cost of a function based on the instructions fetched (Ir = Instruction read). This provides reproducibility and high-precision and is a major difference to sampling profilers like perf or vtune. Therefore effects like slow IO are not reflected, which should be kept in mind when analyzing callgrind results.

By default the profiler data is dumped when the target process is terminating, but callgrind_control allows for interactive control of callgrind.

# Run a program under callgrind.
valgrind --tool=callgrind -- <prog> [<args>]

# Interactive control of callgrind.
callgrind_control [opts]
  opts:
    -b ............. show current backtrace
    -e ............. show current event counters
    -s ............. show current stats
    --dump[=file] .. dump current collection
    -i=on|off ...... turn instrumentation on|off

Results can be analyzed by using one of the following tools

• callgrind_annotate (cli)

  # Show only specific trace events (default is all).
  callgrind_annotate --show=Ir,Dr,Dw [callgrind_out_file]
  

• kcachegrind (ui)

The following is a collection of frequently used callgrind options.

valgrind --tool=callgrind [opts] -- <prog>
  opts:
    --callgrind-out-file=<file> .... output file, rather than callgrind.out.<pid>
    --dump-instr=<yes|no> .......... annotation on instrucion level,
                                     allows for asm annotations

    --instr-atstart=<yes|no> ....... control if instrumentation is enabled from 
                                     beginning of the program

    --separate-threads=<yes|no> .... create separate output files per thread,
                                     appends -<thread_id> to the output file

    --cache-sim=<yes|no> ........... control if cache simulation is enabled

Trace events

By default callgrind collects following events:

• Ir: Instruction read

Callgrind also provides a functional cache simulation with their own model, which is enabled by passing --cache-sim=yes. This simulates a 2-level cache hierarchy with separate L1 instruction and data caches (L1i/ L1d) and a unified last level (LL) cache. When enabled, this collects the following additional events:

• I1mr: L1 cache miss on instruction read
• ILmr: LL cache miss on instruction read
• Dr: Data reads access
• D1mr: L1 cache miss on data read
• DLmr: LL cache miss on data read
• Dw: Data write access
• D1mw: L1 cache miss on data write
• DLmw: LL cache miss on data write

Profile specific part of the target

Programmatically enable/disable instrumentation using the macros defined in the callgrind header.

#include <valgrind/callgrind.h>

int main() {
    // init ..

    CALLGRIND_START_INSTRUMENTATION;
    compute();
    CALLGRIND_STOP_INSTRUMENTATION;

    // shutdown ..
}

In this case, callgrind should be launched with --instr-atstart=no.

Alternatively instrumentation can be controlled with callgrind_control -i on/off.

The files cg_example.cc and Makefile provide a full example.

valgrind(1)

Memcheck --tool=memcheck

Is the default tool when invoking valgrind without explicitly specifying --tool.

Memory checker used to identify:

• memory leaks
• out of bound accesses
• uninitialized reads

valgrind [OPTIONS] PROGRAM [ARGS]
    --log-file=FILE             Write valgrind output to FILE.
    --leak-check=full           Enable full leak check.
    --track-origins=yes         Show origins of undefined values.
    --keep-debuginfo=no|yes     Keep symbols etc for unloaded code.

    --gen-suppressions=yes      Generate suppressions file from the run.
    --suppressions=FILE         Load suppressions file.

vtune(1)

Vtune offers different analysis. Run vtune -collect help to list the availale analysis.

Profiling

The following shows some common flows with the hotspot analsysis as an example.

# Launch and profile process.
vtune -collect hotspots [opts] -- target [args]

# Attach and profile running process.
vtune -collect hotspots [opts] -target-pid <pid>

Some common options are the following.

-r <dir>           output directory for the profile
-no-follow-child   dont attach to to child processes (default is to follow)
-start-paused      start with paused profiling

Analyze

vtune-gui <dir>

Programmatically control sampling

Vtune offers an API to resume and pause the profile collection from within the profilee itself. This can be helpful if either only a certain phase should be profiled or some phase should be skipped.

The following gives an example where only one phase in the program is profiled. The program makes calls to the vtune API to resume and pause the collection, while vtune is invoked with -start-paused to pause profiling initially.

#include <ittnotify.h>

void init();
void compute();
void shutdown();

int main() {
  init();

  __itt_resume();
  compute();
  __itt_pause();

  shutdown();
  return 0;
}

The makefile gives an example how to build and profile the application.

VTUNE ?= /opt/intel/oneapi/vtune/latest

main: main.c
    gcc -o $@ $^ -I$(VTUNE)/include -L$(VTUNE)/lib64 -littnotify

vtune: main
    $(VTUNE)/bin64/vtune -collect hotspots -start-paused -- ./main

tracy(1)

Tracy is a frame profiler, supporting manual code instrumentation and providing a sampling profiler.

One can either record and visualize the profiling data live using tracy-profiler or record the profiling data to a file using tracy-capture.

tracy-profiler [file] [-p port]

tracy-capture -o file [-f] [-p port]
    -f   overwrite <file> if it exists

Example

The example showcases different cases:

1. Use tracy from a single binary. In that case the TracyClient.cpp can be directly linked / included in the instrumented binary.
2. Use tracy from different binaries (eg main executable + shared library). In this case the TracyClient.cpp should be compiled into its own shared library, such that there is a single tracy client.
3. Use tracy from different binaries on windows. In this case the TracyClient.cpp must be compiled again into a separate shared library, while defining TRACY_EXPORTS. The code being instrumented must be compiled with TRACY_IMPORTS defined.

An instrumented c++ example:

#include <chrono>
#include <thread>

#include <tracy/Tracy.hpp>

#ifdef USE_FOO
extern "C" void foo_comp_hook(int64_t);
#endif

void init() {
  // Create a named zone (active for the current scope).
  // Name will be used when rendering the zone in the thread timeline.
  ZoneScopedN("init()");
  // Set explicit color for the rendered zone.
  ZoneColor(0xff0000);

  std::this_thread::sleep_for(std::chrono::seconds(1));
}

void comp(const char* name) {
  // Track call count.
  static int64_t ccnt = 0;
  ccnt += 1;

  // Create an unnamed zone for the current scope.
  ZoneScoped;
  // Name the zone by formatting the name dynamically.
  // This name is shown for the zone in the thread timeline, however
  // in the zone statistics they are all accounted under one common
  // zone "comp".
  ZoneNameF("comp(%s)", name);
  // Additional text to attach to the zone.
  ZoneTextF("text(%s)", name);
  // Additional value to attach to the zone measurement.
  ZoneValue(ccnt);

  // Statistics for dynamic names, text and values can be looked at in the zone
  // statistics.There measurements can be grouped by different categories.

  // Add a simple plot.
  TracyPlot("comp-plot", ccnt % 4);

  std::this_thread::sleep_for(std::chrono::milliseconds(100));

#ifdef USE_FOO
  foo_comp_hook(ccnt);
#endif
}

void post_comp() {
  // Create an unnamed zone for the current scope and capture callstack (max
  // depth 10). Capturing callstack requires platform with TRACY_HAS_CALLSTACK
  // support.
  ZoneScopedS(10);
  // Name the zone, w/o formatting.
  const char name[] = "post_comp()";
  ZoneName(name, sizeof(name));

  // Add trace messages to the timeline.
  TracyMessageL("start sleep in post_comp()");
  std::this_thread::sleep_for(std::chrono::milliseconds(50));
  TracyMessageL("end sleep in post_comp()");
}

void fini() {
  // Create a named zone with an explicit color.
  ZoneScopedNC("fini()", 0x00ff00);
  std::this_thread::sleep_for(std::chrono::seconds(1));
}

int main() {
  // Create a named zone.
  ZoneScopedN("main()");

  init();

  int step = 0;
  while (step++ < 10) {
    // Create a frame message, this start a new frame with the name
    // "step" and end the previous frame with the name "step".
    FrameMarkNamed("step");
    // Create a named scope.
    ZoneScopedN("step()");
    comp("a");
    comp("b");
    comp("c");
    post_comp();
  }

  fini();
}

An instrumented c example:

#include <stdint.h>
#include <inttypes.h>
#include <stdio.h>

#include <tracy/TracyC.h>

static void comp_helper(int64_t i) {
  char buf[64];
  int cnt = snprintf(buf, sizeof(buf), "helper(%" PRId64 ")", i);

  // Create an active unnamed zone.
  TracyCZone(ctx, 1);

  // Name the zone.
  TracyCZoneName(ctx, buf, cnt);
  // Add custom text to the zone measurement.
  TracyCZoneText(ctx, buf, cnt);
  // Add custom value to the zone measurement.
  TracyCZoneValue(ctx, i);

  for (int ii = 0; ii < i * 100000; ++ii) {
    /* fake work */
  }

  // End the zone measurement.
  TracyCZoneEnd(ctx);
}

void foo_comp_hook(int64_t cnt) {
  // Create an active named zone.
  TracyCZoneN(ctx, "foo", 1);

  for (int i = 0; i < cnt; ++i) {
    // Plot value.
    TracyCPlot("foo_comp_hook", cnt + i);

    comp_helper(i);
  }

  // Configure plot "foo", probably best done once during initialization..
  TracyCPlotConfig("foo", TracyPlotFormatNumber, 1 /* step */, 1 /* fill */,
                   0xff0000);
  // Plot value.
  TracyCPlot("foo", cnt);

  // End the zone measurement.
  TracyCZoneEnd(ctx);
}

Raw build commands to demonstrate compiling tracy w/o cmake, in case we need to integrate it into a different build system.

B := BUILD

main: $(B)/main-static $(B)/main-dynamic $(B)/main-dynamic-win
tracy: $(B)/tracy
.PHONY: main tracy

# -- TRACY STATIC ---------------------------------------------------------------

$(B)/main-static: main.cpp | $(B)
    clang++ -DTRACY_ENABLE -I$(B)/tracy/public -o $@ $^ $(B)/tracy/public/TracyClient.cpp

# -- TRACY DYNAMIC --------------------------------------------------------------

$(B)/main-dynamic: main.cpp $(B)/foo.so $(B)/TracyClient.so | $(B)
    clang++ -DTRACY_ENABLE -I$(B)/tracy/public -DUSE_FOO -o $@ $^

$(B)/foo.so: foo.c $(B)/TracyClient.so
    clang -DTRACY_ENABLE -I$(B)/tracy/public -fPIC -shared -o $@ $^

$(B)/TracyClient.so: $(B)/tracy/public/TracyClient.cpp
    clang++ -DTRACY_ENABLE -I$(B)/tracy/public -fPIC -shared -o $@ $^

# -- TRACY DYNAMIC WINDOWS ------------------------------------------------------

$(B)/main-dynamic-win: main.cpp $(B)/foo.dll $(B)/TracyClient.dll
    @# eg run with wine
    zig c++ -target x86_64-windows -DTRACY_ENABLE -DTRACY_IMPORTS -DUSE_FOO -o $@ $^ -I $(B)/tracy/public

$(B)/foo.dll: foo.c $(B)/TracyClient.dll
    zig c++ -target x86_64-windows -DTRACY_ENABLE -DTRACY_IMPORTS -fPIC -shared -o $@ $^ -I $(B)/tracy/public

$(B)/TracyClient.dll: $(B)/tracy/public/TracyClient.cpp
    @# win libs from 'pragma comment(lib, ..)'
    zig c++ -target x86_64-windows -DTRACY_ENABLE -DTRACY_EXPORTS -fPIC -shared -o $@ $^ -lws2_32 -ldbghelp -ladvapi32 -luser32

# -- TRACY ----------------------------------------------------------------------

# Get latest tracy and build profiler.
$(B)/tracy: $(B)
    cd $(B); bash $(CURDIR)/get-tracy.sh
.PHONY: $(B)/tracy

$B:
    mkdir -p $(B)
.PHONY: $(B)

# -- CLEAN ----------------------------------------------------------------------

clean:
    $(RM) $(B)/*.so $(B)/*.dll $(B)/*.pdb $(B)/*.lib $(B)/main*

distclean:
    rm -rf $(B)

Find get-tracy.sh here.

Debug

• gdb
• gdbserver

gdb(1)

CLI

  gdb [opts] [prg [-c coredump | -p pid]]
  gdb [opts] --args prg <prg-args>
    opts:
      -p <pid>        attach to pid
      -c <coredump>   use <coredump>
      -x <file>       execute script <file> before prompt
      -ex <cmd>       execute command <cmd> before prompt
      --tty <tty>     set I/O tty for debugee
      --batch         run in batch mode, exit after processing options (eg used
                      for scripting)
      --batch-silent  link --batch, but surpress gdb stdout

Interactive usage

Misc

  apropos <regex>
          Search commands matching regex.

  tty <tty>
          Set <tty> as tty for debugee.
          Make sure nobody reads from target tty, easiest is to spawn a shell
          and run following in target tty:
          > while true; do sleep 1024; done

  sharedlibrary [<regex>]
          Load symbols of shared libs loaded by debugee. Optionally use <regex>
          to filter libs for symbol loading.

  display [/FMT] <expr>
          Print <expr> every time debugee stops. Eg print next instr, see
          examples below.

  undisplay [<num>]
          Delete display expressions either all or one referenced by <num>.

  info display
          List display expressions.

  info sharedlibrary [<regex>]
          List shared libraries loaded. Optionally use <regex> to filter.

Breakpoints

  break [-qualified] <sym> thread <tnum>
          Set a breakpoint only for a specific thread.
          -qualified: Treat <sym> as fully qualified symbol (quiet handy to set
          breakpoints on C symbols in C++ contexts)

  break <sym> if <cond>
          Set conditional breakpoint (see examples below).

  delete [<num>]
          Delete breakpoint either all or one referenced by <num>.

  info break
          List breakpoints.

  cond <bp> <cond>
          Make existing breakpoint <bp> conditional with <cond>.

  cond <bp>
          Remove condition from breakpoint <bp>.

  tbreak
          Set temporary breakpoint, will be deleted when hit.
          Same syntax as `break`.

  rbreak <regex>
          Set breakpoints matching <regex>, where matching internally is done
          on: .*<regex>.*

  command [<bp_list>]
          Define commands to run after breakpoint hit. If <bp_list> is not
          specified attach command to last created breakpoint. Command block
          terminated with 'end' token.

          <bp_list>: Space separates list, eg 'command 2 5-8' to run command
          for breakpoints: 2,5,6,7,8.

  save break <file>
          Save breakpoints to <file>. Can be loaded with the `source` command.

Watchpoints

  watch [-location|-l] <expr> [thread <tnum>]
          Create a watchpoint for <expr>, will break if <expr> is written to.
          Watchpoints respect scope of variables, -l can be used to watch the
          memory location instead.

  rwatch ...
          Sets a read watchpoint, will break if <expr> is read from.

  awatch ...
          Sets an access watchpoint, will break if <expr> is written to or read
          from.

Catchpoints

  catch load [<regex>]
          Stop when shared libraries are loaded, optionally specify a <regex>
          to stop only on matches.
  catch unload [<regex>]
          Stop when shared libraries are unloaded, optionally specify a <regex>
          to stop only on matches.

  catch throw
          Stop when an exception is thrown.
  catch rethrow
          Stop when an exception is rethrown.
  catch catch
          Stop when an exception is caught.

  catch fork
          Stop at calls to fork (also stops at clones, as some systems
          implement fork via clone).

  catch syscall [<syscall> <syscall> ..]
          Stop at syscall. If no argument is given, stop at all syscalls.
          Optionally give a list of syscalls to stop at.

Inspection

  info functions [<regex>]
          List functions matching <regex>. List all functions if no <regex>
          provided.

  info variables [<regex>]
          List variables matching <regex>. List all variables if no <regex>
          provided.

  info register [<reg> <reg> ..]
          Dump content of all registers or only the specified <reg>ister.

Signal handling

  info handle [<signal>]
          Print how to handle <signal>. If no <signal> specified print for all
          signals.

  handle <signal> <action>
          Configure how gdb handles <signal> sent to debugee.
          <action>:
            stop/nostop       Catch signal in gdb and break.
            print/noprint     Print message when gdb catches signal.
            pass/nopass       Pass signal down to debugee.

  catch signal <signal>
          Create a catchpoint for <signal>.

Multi-threading

info thread
          List all threads.

thread apply <id> [<id>] <command>
          Run command on all threads listed by <id> (space separated list).
          When 'all' is specified as <id> the <command> is run on all threads.

thread name <name>
          The <name> for the current thread.

Multi-process

  set follow-fork-mode <child | parent>
          Specify which process to follow when debuggee makes a fork(2)
          syscall.

  set detach-on-fork <on | off>
          Turn on/off detaching from new child processes (on by default).
          Turning this off allows to debug multiple processes (inferiors) with
          one gdb session.

  info inferiors
          List all processes gdb debugs.

  inferior <id>
          Switch to inferior with <id>.

Scheduling

  set schedule-multiple <on | off>
          on: Resume all threads of all processes (inferiors) when continuing
              or stepping.
          off: (default) Resume only threads of current process (inferior).

Shell commands

  shell <shell_cmd>
          Run the shell_cmd and print the output, can also contain a pipeline.

  pipe <gdb_cmd> | <shell_cmd>
          Evaluate the gdb_cmd and run the shell_cmd which receives the output
          of the gdb_cmd via stdin.

Source file locations

  dir <path>
          Add <path> to the beginning of the searh path for source files.

  show dir
          Show current search path.

  set substitute-path <from> <to>
          Add substitution rule checked during source file lookup.

  show substitute-path
          Show current substitution rules.

Configuration

  set disassembly-flavor <intel | att>
          Set the disassembly style "flavor".

  set pagination <on | off>
          Turn on/off gdb's pagination.

  set breakpoint pending <on | off | auto>
          on: always set pending breakpoints.
          off: error when trying to set pending breakpoints.
          auto: interatively query user to set breakpoint.

  set print pretty <on | off>
          Turn on/off pertty printing of structures.

  set style enabled <on | off>
          Turn on/off styling (eg colored output).

  set logging <on | off>
          Enable output logging to file (default gdb.txt).

  set logging file <fname>
          Change output log file to <fname>

  set logging redirect <on | off>
          on: only log to file.
          off: log to file and tty.

  set logging overwrite <on | off>
          on: Truncate log file on each run.
          off: Append to logfile (default).

  set trace-commands <on | off>
          on: Echo comamands executed (good with logging).
          off: Do not echo commands executedt (default).

  set history filename <fname>
          Change file where to save and restore command history to and from.

  set history <on | off>
          Enable or disable saving of command history.

  set exec-wrapper <cli>
          Set an exec wrapper which sets up the env and execs the debugee.

Logging options should be configured before logging is turned on.

Text user interface (TUI)

  C-x a     Toggle UI.
  C-l       Redraw UI (curses UI can be messed up after the debugee prints to
            stdout/stderr).
  C-x o     Change focus.

User commands (macros)

Gdb allows to create & document user commands as follows:

  define <cmd>
    # cmds
  end

  document <cmd>
    # docu
  end

To get all user commands or documentations one can use:

  help user-defined
  help <cmd>

Hooks

Gdb allows to create two types of command hooks

• hook- will be run before <cmd>
• hookpost- will be run after <cmd>

  define hook-<cmd>
    # cmds
  end

  define hookpost-<cmd>
    # cmds
  end

Examples

Automatically print next instr

When ever the debugee stops automatically print the memory at the current instruction pointer ($rip x86) and format as instruction /i.

  # rip - x86
  display /i $rip

  # step instruction, after the step the next instruction is automatically printed
  si

Conditional breakpoints

Create conditional breakpoints for a function void foo(int i) in the debugee.

  # Create conditional breakpoint
  b foo if i == 42

  b foo     # would create bp 2
  # Make existing breakpoint conditional
  cond 2 i == 7

Set breakpoint on all threads except one

Create conditional breakpoint using the $_thread convenience variable.

  # Create conditional breakpoint on all threads except thread 12.
  b foo if $_thread != 12

Catch SIGSEGV and execute commands

This creates a catchpoint for the SIGSEGV signal and attached the command to it.

  catch signal SIGSEGV
  command
    bt
    c
  end

Run backtrace on thread 1 (batch mode)

  gdb --batch -ex 'thread 1' -ex 'bt' -p <pid>

Script gdb for automating debugging sessions

To script gdb add commands into a file and pass it to gdb via -x. For example create run.gdb:

  set pagination off

  break mmap
  command
    info reg rdi rsi rdx
    bt
    c
  end

  #initial drop
  c

This script can be used as:

  gdb --batch -x ./run.gdb -p <pid>

Hook to automatically save breakpoints on quit

define break-save
    save breakpoint $arg0.gdb.bp
end
define break-load
    source $arg0.gdb.bp
end

define hook-quit
    break-save quit
end

Watchpoint on struct / class member

A symbolic watchpoint defined on a member variable for debugging is only valid as long as the expression is in scope. Once out of scope the watchpoint gets deleted.

When debugging some memory corruption we want to keep the watchpoint even the expression goes out of scope to find the location that overrides the variable and introduces the corruption.

(gdb) l
1  struct S { int v; };
2
3  void set(struct S* s, int v) {
4      s->v = v;
5  }
6
7  int main() {
8      struct S s;
9      set(&s, 1);
10     set(&s, 2);
11     set(&s, 3);
...

(gdb) s
set (s=0x7fffffffe594, v=1) at test.c:4
4    s->v = v;

# Define a new watchpoint on the member of the struct. The expression however
# is only valid in the current functions scope.

(gdb) watch s->v
Hardware watchpoint 2: s->v

(gdb) c
Hardware watchpoint 2: s->v
Old value = 0
New value = 1
set (s=0x7fffffffe594, v=1) at test.c:5
5   }

# The watchpoint gets deleted as soon as we leave the function scope.

(gdb) c
Watchpoint 2 deleted because the program has left the block in
which its expression is valid.
main () at test.c:10
10      set(&s, 2);

# Define the watchpoint on the location of the object to watch.

(gdb) watch -l s->v

# This is equivalent to the following.

(gdb) p &s->v
$1 = (int *) 0x7fffffffe594

# Define a watchpoint to the address of the member variable of the s instance.
# This of course only makes sense as long as the s instance is not moved in memory.

(gdb) watch *0x7fffffffe594
Hardware watchpoint 3: *0x7fffffffe594

(gdb) c
Hardware watchpoint 3: *0x7fffffffe594
Old value = 1
New value = 2
set (s=0x7fffffffe594, v=2) at test.c:5
5   }

(gdb) c
Hardware watchpoint 3: *0x7fffffffe594
Old value = 2
New value = 3
set (s=0x7fffffffe594, v=3) at test.c:5
5   }

Shell commands

# Run shell commands.

(gdb) shell zcat /proc/config.gz | grep CONFIG_KVM=
CONFIG_KVM=m

# Pipe gdb command to shell command.

(gdb) pipe info proc mapping | grep libc
    0x7ffff7a1a000     0x7ffff7a42000    0x28000        0x0  r--p   /usr/lib/libc.so.6
    0x7ffff7a42000     0x7ffff7b9d000   0x15b000    0x28000  r-xp   /usr/lib/libc.so.6
    0x7ffff7b9d000     0x7ffff7bf2000    0x55000   0x183000  r--p   /usr/lib/libc.so.6
    0x7ffff7bf2000     0x7ffff7bf6000     0x4000   0x1d7000  r--p   /usr/lib/libc.so.6
    0x7ffff7bf6000     0x7ffff7bf8000     0x2000   0x1db000  rw-p   /usr/lib/libc.so.6

Know Bugs

Workaround command + finish bug

When using finish inside a command block, commands after finish are not executed. To workaround that bug one can create a wrapper function which calls finish.

  define handler
    bt
    finish
    info reg rax
  end

  command
    handler
  end

Launch debuggee through an exec wrapper

> cat test.c
#include <stdio.h>
#include <stdlib.h>

int main() {
  const char* env = getenv("MOOSE");
  printf("$MOOSE=%s\n", env ? env : "<nullptr>");
}

> cat test.sh
#!/bin/bash

echo "running test.sh wapper"
export MOOSE=moose
exec ./test

> gcc -g -o test test.c

> gdb test
(gdb) r
$MOOSE=<nullptr>

(gdb) set exec-wrapper bash test.sh
(gdb) r
running test.sh wapper
$MOOSE=moose

gdbserver(1)

CLI

  gdbserver [opts] comm prog [args]
    opts:
      --disable-randomization
      --no-disable-randomization
      --wrapper W --

    comm:
      host:port
      tty

Example

# Start gdbserver.
gdbserver localhost:1234 /bin/ls

# Attach gdb.
gdb -ex 'target remote localhost:1234'

Wrapper example: Set environment variables just for the debugee

Set env as execution wrapper with some variables. The wrapper will be executed before the debugee.

gdbserver --wrapper env FOO=123 BAR=321 -- :12345 /bin/ls

Binary

• od
• xxd
• readelf
• objdump
• nm

od(1)

  od [opts] <file>
    -An         don't print addr info
    -tx4        print hex in 4 byte chunks
    -ta         print as named character
    -tc         printable chars or backslash escape
    -w4         print 4 bytes per line
    -j <n>      skip <n> bytes from <file> (hex if start with 0x)
    -N <n>      dump <n> bytes (hex of start with 0x)

ASCII to hex string

  echo -n AAAABBBB | od -An -w4 -tx4
    >> 41414141
    >> 42424242

  echo -n '\x7fELF\n' | od -tx1 -ta -tc
    >> 0000000  7f  45  4c  46  0a      # tx1
    >>         del   E   L   F  nl      # ta
    >>         177   E   L   F  \n      # tc

Extract parts of file

For example .rodata section from an elf file. We can use readelf to get the offset into the file where the .rodata section starts.

  readelf -W -S foo
    >> Section Headers:
    >> [Nr] Name              Type            Address          Off    Size   ES Flg Lk Inf Al
    >> ...
    >> [15] .rodata           PROGBITS        00000000004009c0 0009c0 000030 00   A  0   0 16

With the offset of -j 0x0009c0 we can dump -N 0x30 bytes from the beginning of the .rodata section as follows:

  od -j 0x0009c0 -N 0x30 -tx4 -w4 foo
    >> 0004700 00020001
    >> 0004704 00000000
    >> *
    >> 0004740 00000001
    >> 0004744 00000002
    >> 0004750 00000003
    >> 0004754 00000004

Note: Numbers starting with 0x will be interpreted as hex by od.

xxd(1)

  xxd [opts]
    -p          dump continuous hexdump
    -r          convert hexdump into binary ('revert')
    -e          dump as little endian mode
    -i          output as C array

ASCII to hex stream

  echo -n 'aabb' | xxd -p
    >> 61616262

Hex to binary stream

  echo -n '61616262' | xxd -p -r
    >> aabb

ASCII to binary

  echo -n '\x7fELF' | xxd -p | xxd -p -r | file -p -
    >> ELF

ASCII to C array (hex encoded)

  xxd -i <(echo -n '\x7fELF')
    >> unsigned char _proc_self_fd_11[] = {
    >>   0x7f, 0x45, 0x4c, 0x46
    >> };
    >> unsigned int _proc_self_fd_11_len = 4;

readelf(1)

  readelf [opts] <elf>
    -W|--wide     wide output, dont break output at 80 chars
    -h            print ELF header
    -S            print section headers
    -l            print program headers + segment mapping
    -d            print .dynamic section (dynamic link information)
    --syms        print symbol tables (.symtab .dynsym)
    --dyn-syms    print dynamic symbol table (exported symbols for dynamic linker)
    -r            print relocation sections (.rel.*, .rela.*)

objdump(1)

  objdump [opts] <elf>
    -M intel                   use intil syntax
    -d                         disassemble text section
    -D                         disassemble all sections
    --disassemble=<sym>        disassemble symbol <sym>
    -S                         mix disassembly with source code
    -C                         demangle
    -j <section>               display info for section
    --[no-]show-raw-insn       [dont] show object code next to disassembly
    --visualize-jumps[=color]  visualize jumps with ascii art, optionally color arrows

Disassemble section

For example .plt section:

  objdump -j .plt -d <elf>

Example: disassemble raw binary

This can be helpful for example as a cheap analysis tool when toying with JIT generating code. We could just write thee binary code buffer to a file and disassemble with objdump.

To re-create that case, we just assemble and link some ELF file and then create a raw binary of the text section with objcopy.

# file: test.s
.section .text, "ax"

.global _start
_start:
    xor %rax, %rax
    mov $0x8, %rax
1:
    cmp $0, %rax
    je 2f
    dec %rax
    jmp 1b
2:
    # x86-64 exit(2) syscall
    mov $0, %rdi
    mov $60, %rax
    syscall

# Assemble & link.
as -o test.o test.s
ld -o test test.o testc.o
# ELF -> binary (only take .text section).
objcopy -O binary --only-section .text test test-bin

# Disassemble raw binary.
objdump -D -b binary -m i386:x86-64 test-bin

Example: disassemble specific symbol

# Disassemble main().
objdump --disassemble=main <bin>
# Disassemble 'foo::bar()' (mangled).
objdump --disassemble=_ZN3foo3barEvr <bin>

# Disassemble 'foo::bar()' (demangled), requires -C
objdump -C --disassemble=foo::bar <bin>

nm(1)

  nm [opts] <elf>
    -C          demangle
    -u          undefined only

Development

• c++filt
• c++
• glibc
• gcc
• gas
• git
• cmake
• make
• ld.so
• symbol versioning
• python
• gcov
• pgo

c++filt(1)

Demangle symbol

  c++-filt [opts] <symbol_str>
    -t    Try to also demangle types.

Demangle stream

For example dynamic symbol table:

  readelf -W --dyn-syms <elf> | c++filt

Demangle types

// file: type.cc
#include <cstdio>
#include <typeinfo>

#define P(ty) printf(#ty " -> %s\n", typeid(ty).name())

template <typename T = void>
struct Foo {};

int main() {
  P(int);
  P(unsigned char);
  P(Foo<>);
  P(Foo<int>);
}

Build and run:

$ clang++ type.cc && ./a.out | c++filt
int -> i
unsigned char -> h
Foo<> -> 3FooIvE
Foo<int> -> 3FooIiE

$ clang++ type.cc && ./a.out | c++filt -t
int -> int
unsigned char -> unsigned char
Foo<> -> Foo<void>
Foo<int> -> Foo<int>

c++

openstd cpp standards.

Source files of most examples is available here.

Type deduction

Force compile error to see what auto is deduced to.

auto foo = bar();

// force compile error
typename decltype(foo)::_;

Strict aliasing and type punning

The strict aliasing rules describe via which alias a value can be accessed.

Informal: an alias is a reference / pointer to a value.

Accessing a value through an alias that violates the strict aliasing rules is undefined behavior (UB).

Examples below on godbolt.

int i = 0;

// Valid aliasing (signed / unsigned type).
*reinterpret_cast<signed int*>(&i);
*reinterpret_cast<unsigned int*>(&i);

// Valid aliasing (cv qualified type).
*reinterpret_cast<const int*>(&i);
*reinterpret_cast<const unsigned*>(&i);

// Valid aliasing (byte type).
*reinterpret_cast<char*>(&i);
*reinterpret_cast<std::byte*>(&i);

// Invalid aliasing, dereferencing pointer is UB.
*reinterpret_cast<short*>(&i);
*reinterpret_cast<float*>(&i);

NOTE: Casting pointer to invalid aliasing type is not directly UB, but dereferencing the pointer is UB.

short s[2] = { 1, 2 };

// Invalid aliasing (UB) - type punning, UB to deref ptr (int has stricter
// alignment requirements than short).
*reinterpret_cast<int*>(s);


// Arbitrary byte pointer.
char c[4] = { 1, 2, 3, 4 };

// Invalid aliasing (UB) - type punning, UB to deref ptr (int has stricter
// alignment requirements than char).
*reinterpret_cast<int*>(c);

At the time of writing, the current c++ std draft contains the following.

If a program attempts to access the stored value of an object through a glvalue
whose type is not **similar** (7.3.6) to one of the following types the
behavior is undefined [44]

(11.1) the dynamic type of the object,
(11.2) a type that is the signed or unsigned type corresponding to the dynamic
       type of the object, or
(11.3) a char, unsigned char, or std::byte type.

[44]: The intent of this list is to specify those circumstances in which an
      object can or cannot be aliased.

The paragraph is short but one also needs to understand the meaning of similar (similar_types).

This paragraph is actually somewhat more explicit in the c++17 std.

If a program attempts to access the stored value of an object through a glvalue
of other than one of the following types the behavior is undefined [63]

(11.1) the dynamic type of the object,
(11.2) a cv-qualified version of the dynamic type of the object,
(11.3) a type similar (as defined in 7.5) to the dynamic type of the object,
(11.4) a type that is the signed or unsigned type corresponding to the dynamic
       type of the object,
(11.5) a type that is the signed or unsigned type corresponding to a
       cv-qualified version of the dynamic type of the object,
(11.6) an aggregate or union type that includes one of the aforementioned types
       among its elements or non- static data members (including, recursively,
       an element or non-static data member of a subaggregate or contained
       union),
(11.7) a type that is a (possibly cv-qualified) base class type of the dynamic
       type of the object,
(11.8) a char, unsigned char, or std::byte type.

[63]: The intent of this list is to specify those circumstances in which an
      object may or may not be aliased.

Additional references:

• What is the Strict Aliasing Rule and Why do we care

  The article shows a small example how the compiler may optimized using the strict aliasing rules.

  int alias(int* i, char* c) {
    *i = 1;
    *c = 'a';  // char* may alias int*
    return *i;
  }
  
  int noalias(int* i, short* s) {
      *i = 1;
      *s = 2;  // short* does not alias int*
      return *i;
  }
  

  alias(int*, char*):
  mov    DWORD PTR [rdi] ,0x1  ; *i = 1;
  mov    BYTE PTR [rsi], 0x61  ; *c = 'a';
  mov    eax,DWORD PTR [rdi]   ; Must reload, char* can alias int*.
  ret
  
  noalias(int*, short*):
  mov    DWORD PTR [rdi], 0x1  ; *i = 1;
  mov    WORD PTR [rsi], 0x2   ; *s = 2;
  mov    eax,0x1               ; Must not reload, short* can not alias int*.
  ret
  

• reinterpret_cast type aliasing

  5. Any object pointer type T1* can be converted to another object pointer type cv T2*. This is exactly equivalent to static_cast<cv T2*>(static_cast<cv void*>(expression)) (which implies that if T2's alignment requirement is not stricter than T1's, the value of the pointer does not change and conversion of the resulting pointer back to its original type yields the original value). In any case, the resulting pointer may only be dereferenced safely if allowed by the type aliasing rules (see below).

  int I;
  char* X = reinterpret_cast<char*>(&I);  // Valid, char allowed to alias int.
  *X = 42;
  int* Y = reinterpret_cast<int*>(X);     // Cast back to original type.
  *Y = 1337;  // safe
  
  char C[4];
  int* P = reinterpret_cast<int*>(C);     // Cast is ok, not yet UB.
  *P = 1337; // UB, violates strict aliasing / alignment rules.
             // https://stackoverflow.com/questions/52492229/c-byte-array-to-int
  

• On gcc strict aliasing is enabled starting with -O2.

  for i in {0..3} g s; do echo "-O$i $(g++ -Q --help=optimizers -O$i | grep fstrict-aliasing)"; done
  -O0   -fstrict-aliasing           [disabled]
  -O1   -fstrict-aliasing           [disabled]
  -O2   -fstrict-aliasing           [enabled]
  -O3   -fstrict-aliasing           [enabled]
  -Og   -fstrict-aliasing           [disabled]
  -Os   -fstrict-aliasing           [enabled]
  

__restrict keyword

The __restrict keyword allows the programmer to tell the compiler that two pointer will not alias each other.

int alias(int* a, int* b) {
    *a = 1;
    *b = 2;
    return *a;
}

// alias(int*, int*):                           # @alias(int*, int*)
//         mov     dword ptr [rdi], 1
//         mov     dword ptr [rsi], 2
//         mov     eax, dword ptr [rdi]
//         ret

int noalias(int* __restrict a, int* __restrict b) {
    *a = 1;
    *b = 2;
    return *a;
}

// noalias(int*, int*):                         # @noalias(int*, int*)
//         mov     dword ptr [rdi], 1
//         mov     dword ptr [rsi], 2
//         mov     eax, 1
//         ret

However this should only be used with care and in a narrow scope, as it is easy to violate self defined contract, see godbolt.

Type punning

The correct way to do type-punning in c++:

1. std::bit_cast (c++20)
2. std::memcpy

Variadic templates (parameter pack)

#include <iostream>

// -- Example 1 - print template value arguments.

// Base case with one parameter.
template<int P>
void show_int() {
    printf("%d\n", P);
}

// General case with at least two parameters, to disambiguate from base case.
template<int P0, int P1, int... Params>
void show_int() {
    printf("%d, ", P0);
    show_int<P1, Params...>();
}

// -- Example 2 - print values of different types.

// Base case with one parameter.
template<typename T>
void show(const T& t) {
    std::cout << t << '\n';
}

// General case with at least two parameters, to disambiguate from base case.
template<typename T0, typename T1, typename... Types>
void show(const T0& t0, const T1& t1, const Types&... types) {
    std::cout << t0 << ", ";
    show(t1, types...);
}

int main() {
    show_int<1, 2, 3, 4, 5>();
    show(1, 1.0, "foo", 'a');
}

Forwarding reference (fwd ref)

A forwarding reference is a special references that preserves the value category of a function parameter and therefore allows for perfect forwarding.

A forwarding reference is a parameter of a function template, which is declared as rvalue reference to a non-cv qualified type template parameter.

template<typename T>
void fn(T&& param); // param is a forwarding reference

Perfect forwarding can be achieved with std::forward. This for example allows a wrapper function to pass a parameter with the exact same value category to a down-stream function which is being invoked in the wrapper.

#include <cstdio>
#include <utility>

struct M {};

// -- CONSUMER -----------------------------------------------------------------

void use(M&) {
    puts(__PRETTY_FUNCTION__);
}

void use(M&&) {
    puts(__PRETTY_FUNCTION__);
}

// -- TESTER -------------------------------------------------------------------

template<typename T>
void wrapper(T&& param) {  // forwarding reference
    puts(__PRETTY_FUNCTION__);
    // PARAM is an lvalue, therefore this always calls use(M&).
    use(param);
}

template<typename T>
void fwd_wrapper(T&& param) {  // forwarding reference
    puts(__PRETTY_FUNCTION__);
    // PARAM is an lvalue, but std::forward returns PARAM with the same value
    // category as the forwarding reference takes.
    use(std::forward<T>(param));
}

// -- MAIN ---------------------------------------------------------------------

int main() {
    {
        std::puts("==> wrapper rvalue reference");
        wrapper(M{});
        // calls use(M&).

        std::puts("==> wrapper lvalue reference");
        struct M m;
        wrapper(m);
        // calls use(M&).
    }
    {
        std::puts("==> fwd_wrapper rvalue reference");
        fwd_wrapper(M{});
        // calls use(M&&).

        std::puts("==> fwd_wrapper lvalue reference");
        struct M m;
        fwd_wrapper(m);
        // calls use(M&).
    }
}

Example: any_of template meta function

#include <type_traits>

template<typename T, typename... U>
struct any_of : std::false_type {};

// Found our type T in the list of types U.
template<typename T, typename... U>
struct any_of<T, T, U...> : std::true_type {};

// Pop off the first element in the list of types U,
// since it didn't match our type T.
template<typename T, typename U0, typename... U>
struct any_of<T, U0, U...> : any_of<T, U...> {};

// Convenience template variable to invoke meta function.
template<typename T, typename... U>
constexpr bool any_of_v = any_of<T, U...>::value;

static_assert(any_of_v<int, char, bool, int>, "");
static_assert(!any_of_v<int, char, bool, float>, "");

Example: SFINAE (enable_if)

Provide a single entry point Invoke to call some Operations. Use enable_if to enable/disable the template functions depending on the two available traits an operation can have:

• Operation returns a result
• Operation requires a context

#include <iostream>
#include <type_traits>

// Helper meta fns.

template<typename T>
using enable_if_bool = std::enable_if_t<T::value, bool>;

template<typename T>
using disable_if_bool = std::enable_if_t<!T::value, bool>;

template<typename T>
using has_dst = std::integral_constant<bool, !std::is_same<typename T::Return, void>::value>;

// Template meta programming invoke machinery.

namespace impl {
    // Invoke an OPERATION which *USES* a context.
    template<typename Ctx, template<typename> class Op, typename... P,
             enable_if_bool<typename Op<Ctx>::HasCtx> = true>
    typename Op<Ctx>::Return Invoke(const Ctx& C, P... params) {
        return Op<Ctx>()(C, params...);
    }

    // Invoke an OPERATION which uses *NO* context.
    template<typename Ctx, template<typename> class Op, typename... P,
             disable_if_bool<typename Op<Ctx>::HasCtx> = true>
    typename Op<Ctx>::Return Invoke(const Ctx&, P... params) {
        return Op<Ctx>()(params...);
    }
}  // namespace impl

// Invoke an OPERATION which *HAS* a DESTINATION with arbitrary number of arguments.
template<typename Ctx, template<typename> class Op, typename... P,
         enable_if_bool<has_dst<Op<Ctx>>> = true>
void Invoke(const Ctx& C, P... params) {
    std::cout << "Invoke " << Op<Ctx>::Name << '\n';
    typename Op<Ctx>::Return R = impl::Invoke<Ctx, Op>(C, params...);
    std::cout << "returned -> " << R << '\n';
}

// Invoke an OPERATION which has *NOT* a DESTINATION with arbitrary number of arguments.
template<typename Ctx, template<typename> class Op, typename... P,
         disable_if_bool<has_dst<Op<Ctx>>> = true>
void Invoke(const Ctx& C, P... params) {
    std::cout << "Invoke " << Op<Ctx>::Name << " without destination." << '\n';
    impl::Invoke<Ctx, Op>(C, params...);
}

// Custom context.

struct Ctx {
    void out(const char* s, unsigned v) const {
        printf("%s%x\n", s, v);
    }
};

// Operations to invoke.

template<typename Ctx>
struct OpA {
    using HasCtx = std::false_type;
    using Return = int;
    static constexpr const char* const Name = "OpA";

    constexpr Return operator()(int a, int b) const {
        return a + b;
    }
};

template<typename Ctx>
struct OpB {
    using HasCtx = std::true_type;
    using Return = void;
    static constexpr const char* const Name = "OpB";

    Return operator()(const Ctx& C, unsigned a) const {
        C.out("a = ", a);
    }
};

int main() {
    Ctx C;

    Invoke<Ctx, OpA>(C, 1, 2);
    Invoke<Ctx, OpB>(C, 0xf00du);

    return 0;
}

Example: Minimal templatized test registry

A small test function registry bringing together a few different template features.

#include <cstdio>
#include <functional>
#include <map>
#include <string>
#include <type_traits>

template<typename R, typename... P>
struct registry {
    using FUNC = R (*)(P...);
    using SELF = registry<R, P...>;
    using RET = R;

    static SELF& get() {
        static SELF r;
        return r;
    }

    bool add(std::string nm, FUNC fn) {
        const auto r = m_fns.insert({std::move(nm), std::move(fn)});
        return r.second;
    }

    R invoke(const std::string& nm, P... p) const {
        return invoke_impl<R>(nm, p...);
    }

    void dump() const {
        for (const auto& it : m_fns) {
            std::puts(it.first.c_str());
        }
    }

  private:
    std::map<std::string, FUNC> m_fns;

    template<typename RET>
    std::enable_if_t<std::is_same_v<RET, void>> invoke_impl(const std::string& nm, P... p) const {
        const auto it = m_fns.find(nm);
        if (it == m_fns.end()) {
            return;
        }
        std::invoke(it->second, p...);
    }

    template<typename RET>
    std::enable_if_t<!std::is_same_v<RET, void>, RET> invoke_impl(const std::string& nm,
                                                                  P... p) const {
        const auto it = m_fns.find(nm);
        if (it == m_fns.end()) {
            static_assert(std::is_default_constructible_v<RET>,
                          "RET must be default constructible");
            return {};
        }
        return std::invoke(it->second, p...);
    }
};

#define TEST_REGISTER(REGISTRY, NAME)                                                      \
    static bool regfn_##REGISTRY##NAME() {                                                 \
        const bool r = REGISTRY::get().add(#NAME, NAME);                                   \
        if (!r) {                                                                          \
            std::puts("Failed to register test " #NAME ", same name already registered!"); \
            std::abort();                                                                  \
        }                                                                                  \
        return r;                                                                          \
    }                                                                                      \
    static const bool reg_##REGISTRY##NAME = regfn_##REGISTRY##NAME();

#define TEST(REGISTRY, NAME, ...)    \
    REGISTRY::RET NAME(__VA_ARGS__); \
    TEST_REGISTER(REGISTRY, NAME);   \
    REGISTRY::RET NAME(__VA_ARGS__)

// -- Usage 1 simple usage.

using REG1 = registry<void>;
TEST(REG1, test1) {
    std::puts("REG1::test1");
}
TEST(REG1, test2) {
    std::puts("REG1::test2");
}

// -- Usage 2 with convenience macro wrapper.

using REG2 = registry<void, bool>;
#define TEST2(NAME, ...) TEST(REG2, NAME, ##__VA_ARGS__)

TEST2(test1, bool val) {
    printf("REG2::test1 val %d\n", val);
}

int main() {
    const auto& R1 = REG1::get();
    R1.dump();
    R1.invoke("test1");
    R1.invoke("test2");

    const auto& R2 = REG2::get();
    R2.dump();
    R2.invoke("test1", true);

    return 0;
}

Example: Concepts pre c++20

Prior to c++20's concepts, SFINAE and std::void_t can be leveraged to build something similar allowing to define an interface (aka trait) for a template parameter.

template<typename T, template<typename> class Checker, typename = void>
struct is_valid : std::false_type {};

template<typename T, template<typename> class Checker>
struct is_valid<T, Checker, std::void_t<Checker<T>>> : std::true_type {};

template<typename T, template<typename> class Checker>
static constexpr bool is_valid_v = is_valid<T, Checker>::value;

// -----------------------------------------------------------------------------

template<typename T, typename R, template<typename> class Checker, typename = void>
struct is_valid_with_ret : std::false_type {};

template<typename T, typename R, template<typename> class Checker>
struct is_valid_with_ret<T, R, Checker, std::void_t<Checker<T>>> : std::is_same<R, Checker<T>> {};

template<typename T, typename R, template<typename> class Checker>
static constexpr bool is_valid_with_ret_v = is_valid_with_ret<T, R, Checker>::value;

// -----------------------------------------------------------------------------

template<typename T>
struct is_entry {
    template<typename TT>
    using init = decltype(std::declval<TT>().init());
    template<typename TT>
    using tag = decltype(std::declval<TT>().tag());
    template<typename TT>
    using val = decltype(std::declval<TT>().val());

    static constexpr bool value = is_valid_v<T, init> && is_valid_with_ret_v<T, int, tag> &&
                                  is_valid_with_ret_v<T, typename T::Type, val>;
};

template<typename T>
static constexpr bool is_entry_v = is_entry<T>::value;

template<typename E>
struct Entry {
    using Type = E;
    void init();
    int tag() const;
    E val() const;
};

int main() {
    static_assert(is_entry_v<Entry<bool>>, "");
}

The main mechanic can be explained with the following reduced example. If one of the decltype(std:declval<T>... expressions is ill-formed, the template specialization for is_valid will be removed from the candidate set due to SFINAE.

#include <type_traits>

// (1) Primary template.
template<typename T, typename = void>
struct is_valid : std::false_type {};

// (2) Partial template specialization.
template<typename T>
struct is_valid<T, std::void_t<decltype(std::declval<T>().some_fun1()),
                               decltype(std::declval<T>().some_fun2())>> : std::true_type {};
struct A {
    void some_fun1() {}
    void some_fun2() {}
};

struct B {};

static_assert(is_valid<A>::value, "is true");
// * Compare template arg list with primary template, we only supplied one
//   arg, the second one will be defaulted as
//   is_valid<A, void>
// * Compare template arg list against available specializations, this will
//   try to match the pattern <A, void> against the patterns defined in the
//   partial specializations.
// * Try specialization (2)
//   * T -> A
//   * Evaluate std::void_t -> decltype's are well-formed
//     std::void_t<...> -> void
//   * Specialization (2) matches <A, void>
// * Pick the most specialized version -> (2)

static_assert(!is_valid<B>::value, "is false");
// * Compare template arg list with primary template, we only supplied one
//   arg, the second one will be defaulted as
//   is_valid<A, void>
// * Compare template arg list against available specializations, this will
//   try to match the pattern <B, void> against the patterns defined in the
//   partial specializations.
// * Try specialization (2)
//   * T -> B
//   * Evaluate std::void_t -> decltype's are ill-formed
//   * Specialization (2) is removed from candidate set, no hard error (SFINAE)
// * No specialization matches, take the primary template.

std::declval<T>() creates an instance of type T in an unevaluated context.

A more detailed description is available in the SO discussion How does void_t work.

Example: Concepts since c++20

// REQUIRES EXPRESSION
//   requires { requirement-seq }
//   requires ( parameter-list ) { requirement-seq }
//
// [1] https://en.cppreference.com/w/cpp/language/requires
// [2] https://en.cppreference.com/w/cpp/language/constraints#Constraints
//
// REQUIREMENT CLAUSE
//   Not the same as a REQUIREMENT EXPRESSIONS, and is used to require
//   constraints (express concept bounds).
//
// [1] https://en.cppreference.com/w/cpp/language/constraints#Requires_clauses

// -- HELPER -------------------------------------------------------------------

template<typename T>
using Alias = T;

void print(int);

// -- CONCEPTS & REQUIRE EXPRESSIONS -------------------------------------------

// Simple concept from a type trait.
template<typename T, typename U>
concept Same = std::is_same<T, U>::value;

// Simple requirement concepts.
template<typename T>
concept TraitAddAndPrint = requires(T t, int i) {
    // Adding T + int must be supported.
    t + i;
    // Calling print(T) must be available.
    print(t);
};

// Type requirement concepts.
template<typename T>
concept TraitTypes = requires(T t) {
    // T must have a type definition inner.
    typename T::inner;
    // Type alias must exist.
    typename Alias<T>;
};

// Compound requirement concepts.
template<typename T>
concept TraitFns = requires(T t, const T c) {
    // void T::foo() must exist.
    { t.foo() };
    // bool T::bar() const; must exist.
    { c.bar() } -> Same<bool>;
    // static void T::stat(); must exist.
    { T::stat() } -> Same<int>;
};

// Nested requirement concepts.
template<typename T>
concept TraitNested = requires(T t) {
    // Must satisfy other concepts.
    requires TraitTypes<T>;
    requires TraitFns<T>;
};

// -- REQUIRE EXPRESSIONS ------------------------------------------------------

// Require expressions can be evaluated to booleans.
template<typename T>
static constexpr bool IsTraitFns = requires { requires TraitFns<T>; };

// Require expressions can also be used in static assertions.
static_assert(requires { requires Same<int, int>; });
static_assert(!requires {
    typename Alias<int>;
    requires Same<int, void>;
});

// -- TESTS --------------------------------------------------------------------

static_assert(requires { requires TraitAddAndPrint<int>; });

struct FnTypeGood {
    using inner = int;
};
struct FnTypeBad {};
static_assert(requires { requires TraitTypes<FnTypeGood>; });
static_assert(!requires { requires TraitTypes<FnTypeBad>; });

struct FnGood {
    void foo();
    bool bar() const;
    static int stat();
};
struct FnBad {};
static_assert(requires { requires TraitFns<FnGood>; });
static_assert(!requires { requires TraitFns<FnBad>; });

struct NestedGood : FnTypeGood, FnGood {};
struct NestedBad1 : FnGood {};
struct NestedBad2 : FnTypeGood {};
static_assert(requires { requires TraitNested<NestedGood>; });
static_assert(!requires { requires TraitNested<NestedBad1>; });
static_assert(!requires { requires TraitNested<NestedBad2>; });

Template selection with partially / fully specializations.

enum Kind {
    kPrimary,
    kTT,
    kIntBool,
    kIntInt,
};

// (1) Primary template.
template<typename T, typename U = bool>
struct pair {
    static constexpr Kind kind = kPrimary;
};

// (2) Partial template specialization.
template<typename T>
struct pair<T, T> {
    static constexpr Kind kind = kTT;
};

// (3) Template specialization.
template<>
struct pair<int, bool> {
    static constexpr Kind kind = kIntBool;
};

// (4) Template specialization.
template<>
struct pair<int, int> {
    static constexpr Kind kind = kIntInt;
};

int main() {
    static_assert(pair<int>::kind == kIntBool, "");
    // * Compare template arg list with primary template, we only supplied one
    //   arg, the second one will be defaulted as
    //   pair<int, bool>
    // * Compare template arg list against available specializations, this will
    //   try to match the pattern <int, bool> against the patterns defined in the
    //   partial specializations.
    // * (2) <int, bool> pattern does not match
    // * (3) <int, bool> pattern does match
    // * (4) <int, bool> pattern does not match
    // * Pick the most specialized version -> (3)

    static_assert(pair<char, char>::kind == kTT, "");
    // * Compare template arg list against available specializations, this will
    //   try to match the pattern <char, char> against the patterns defined in the
    //   partial specializations.
    // * (2) <char, char> pattern does match
    // * (3) <char, char> pattern does not match
    // * (4) <char, char> pattern does not match
    // * Pick the most specialized version -> (2)

    static_assert(pair<int, int>::kind == kIntInt, "");
    // * Compare template arg list against available specializations, this will
    //   try to match the pattern <int, int> against the patterns defined in the
    //   partial specializations.
    // * (2) <int, int> pattern does match
    // * (3) <int, int> pattern does match
    // * (4) <int, int> pattern does not match
    // * Pick the most specialized version -> (3)

    static_assert(pair<char, short>::kind == kPrimary, "");
    // * Compare template arg list against available specializations, this will
    //   try to match the pattern <char, short> against the patterns defined in the
    //   partial specializations.
    // * (2) <char, short> pattern does not match
    // * (3) <char, short> pattern does not match
    // * (4) <char, short> pattern does not match
    // * No specialization matches, take the primary template.
}

Example: Perfect forwarding

#include <cassert>
#include <cstdio>
#include <new>
#include <type_traits>
#include <utility>

struct S {};

struct M {
    M() {
        std::puts("M()");
    }
    M(const M&) {
        std::puts("M(M&)");
    }
    M(M&&) {
        std::puts("M(M&&)");
    }
    M& operator=(const M&) = delete;
    M& operator=(M&&) = delete;

    M(S&, int) {
        std::puts("M(S&)");
    }
    M(S&&, int) {
        std::puts("M(S&&)");
    }
    ~M() {
        std::puts("~M()");
    }
};

template<typename T>
struct option {
    static_assert(!std::is_reference_v<T>);

    constexpr option() = default;

    template<typename... Params>
    constexpr option(Params&&... params) : m_has_val(true) {
        // BAD: does not perfectly forward!
        //      eg, if option(S&&) is invoked, this would invoke M(S&).
        // new (&m_val) T(params...);

        // GOOD: perfectly forwards params to constructor of T.
        new (m_val) T(std::forward<Params>(params)...);
    }

    ~option() {
        reset();
    }

    constexpr T& value() {
        assert(m_has_val);
        // Placement new starts a new lifetime, launder pointer returned to the
        // aligned storage.
        //
        // [1] https://en.cppreference.com/w/cpp/utility/launder
        return *__builtin_launder(reinterpret_cast<T*>(m_val));
    }

  private:
    constexpr void reset() {
        if (!m_has_val) {
            return;
        }
        if constexpr (!std::is_trivially_destructible_v<T>) {
            value().~T();
        };
    }

    alignas(T) char m_val[sizeof(T)];
    bool m_has_val{false};
};

int main() {
    std::puts("==> case 1");
    // invokes M(S&&, int)
    option<M> opt1(S{}, 123);

    std::puts("==> case 2");
    // invokes M() + M(M&&)
    option<M> x /* option(M&&) + M(M&&) */ = M{} /* M() */;
}

glibc

malloc tracer mtrace(3)

Trace memory allocation and de-allocation to detect memory leaks. Need to call mtrace(3) to install the tracing hooks.

If we can't modify the binary to call mtrace we can create a small shared library and pre-load it.

// libmtrace.c
#include <mcheck.h>
__attribute__((constructor))  static void init_mtrace() { mtrace(); }

Compile as:

gcc -shared -fPIC -o libmtrace.so libmtrace.c

To generate the trace file run:

export MALLOC_TRACE=<file>
LD_PRELOAD=./libmtrace.so <binary>

Note: If MALLOC_TRACE is not set mtrace won't install tracing hooks.

To get the results of the trace file:

mtrace <binary> $MALLOC_TRACE

malloc check mallopt(3)

Configure action when glibc detects memory error.

export MALLOC_CHECK_=<N>

Useful values:

1   print detailed error & continue
3   print detailed error + stack trace + memory mappings & abort
7   print simple error message + stack trace + memory mappings & abort

gcc(1)

CLI

• -v verbose, outputs exact compiler/linker invocations made by the gcc driver
• -### dry-run, outputting exact compiler/linker invocations
• -print-multi-lib print available multilib configurations
• --help=<class> print description of cmdline options for given class, eg warnings, optimizers, target, c, c++
• -Wl,<opt> additional option passed to the linker invocation (can be specified multiple times)
• -Wl,--trace trace each file the linker touches

Preprocessing

While debugging can be helpful to just pre-process files.

gcc -E [-dM] ...

• -E run only preprocessor
• -dM list only #define statements

Target options

# List all target options with their description.
gcc --help=target

# Configure for current cpu arch and query (-Q) value of options.
gcc -march=native -Q --help=target

Warnings / optimizations

# List available warnings with short description.
gcc --help=warnings
# List available optimizations with short description.
gcc --help=optimizers

# Prepend --help with `-Q` to print wheter options are enabled or disabled
# instead showing their description.

Sanitizer

# Enable address sanitizer, a memory error checker (out of bounds, use after free, ..).
gcc -fsanitize=address ...

# Enable leak sanitizer, a memory leak detector.
gcc -fsanitize=leak

# Enable undefined behavior sanitizer, detects various UBs (integer overflow, ..).
gcc -fsanitize=undefined ...

# Enable thread sanitizer, a data race detector.
gcc -fsanitize=thread

Builtins

__builtin_expect(expr, cond)

Give the compiler a hint which branch is hot, so it can lay out the code accordingly to reduce number of jump instructions. See on compiler explorer.

The semantics of this hint are as follows, the compiler prioritises expr == cond. So __builtin_expect(expr, 0) means that we expect the expr to be 0 most of the time.

echo "
extern void foo();
extern void bar();
void run0(int x) {
  if (__builtin_expect(x,0)) { foo(); }
  else { bar(); }
}
void run1(int x) {
  if (__builtin_expect(x,1)) { foo(); }
  else { bar(); }
}
" | gcc -O2 -S -masm=intel -o /dev/stdout -xc -

Will generate something similar to the following.

• run0: bar is on the path without branch
• run1: foo is on the path without branch

run0:
        test    edi, edi
        jne     .L4
        xor     eax, eax
        jmp     bar
.L4:
        xor     eax, eax
        jmp     foo
run1:
        test    edi, edi
        je      .L6
        xor     eax, eax
        jmp     foo
.L6:
        xor     eax, eax
        jmp     bar

ABI (Linux)

• C ABI (x86_64) - SystemV ABI
• C++ ABI - C++ Itanium ABI

gas

Frequently used directives

• .byte, .2byte, .4byte, .8byte to define a N byte value

  .byte 0xaa
  .2byte 0xaabb
  .2byte 0xaa, 0xbb
  .4byte 0xaabbccdd
  .8byte 0xaabbccdd11223344
  

• .ascii to define an ascii string

  .ascii "foo"   ; allocates 3 bytes
  

• .asciz to define an ascii string with '\0' terminator

  .asciz "foo"   ; allocates 4 bytes (str + \0)
  

• .macro to define assembler macros. Arguments are accessed with the \arg syntax.

  .macro defstr name str
  \name:
      .ascii "\str"
  \name\()_len:
      .8byte . - \name
  .endm
  
  ; use as
  defstr foo, "foobar"
  

  Use \() to concatenate macro argument and literal.

• GNU Assembler

• GNU Assembler Directives

• GNU Assembler x86_64 dependent features

git(1)

Working areas

+-------------------+ --- stash -----> +-------+
| working directory |                  | stash |  // Shelving area.
|     (worktree)    | <-- stash pop -- +-------+
+-------------------+
      |       ^
     add      |
      |     reset
      v       |
+-------------------+
|   staging area    |
|      (index)      |
+-------------------+
      |
    commit
      |
      v
+-------------------+
| local repository  |
+-------------------+
      |       ^
     push     |
      |     fetch /
      |      pull
      v       |
+-------------------+
| remote repository |
+-------------------+

Config

  git config --list --show-origin ..... list currently set configs and where
                                        they are coming from
  git --edit [--global] ............... open config in editor (local or global)

Clean

  git clean -X ......... remove only ignored files (-n for dry run)
  git clean -f -d -x ... remove untracked & ignored files / folders
  git clean -e <pat> ... exclude pattern from deletion

Staging

  git add -p [<file>] ............ partial staging (interactive)

Remote

  git remote -v .................. list remotes verbose (with URLs)
  git remote show [-n] <remote> .. list info for <remote> (like remote HEAD,
                                   remote branches, tracking mapping)

Branching

  git branch [-a] ................ list available branches; -a to include
                                   remote branches
  git branch -vv ................. list branch & annotate with head sha1 &
                                   remote tracking branch
  git branch <bname> ............. create local branch with name <bname>
  git branch -d <bname> .......... delete local branch with name <bname>
  git checkout <bname> ........... switch to branch with name <bname>
  git checkout --track <branch> .. start to locally track a remote branch
  git branch --unset-upstream .... unset remote tracking branch

  # Remote

  git push -u origin <rbname> ........ push local branch to origin (or other
                                       remote), and setup <rbname> as tracking
                                       branch
  git push origin --delete <rbname> .. delete branch <rbname> from origin (or
                                       other remote)

Update local from remote

  git fetch --prune .................. update all remote references and
                                       remove delete non-existing ones
                                       (does not merge into local tracking branch)
  git pull [--rebase] ................ fetch remote references and merge into
                                       local tracking branch (fast-forward by default).
                                       Optionally rebase local tracking branch
                                       on-top of remote branch (in case local
                                       branch has additional commits compared to remote branch).

Tags

  git tag -a <tname> -m "descr" ........ creates an annotated tag (full object
                                         containing tagger, date, ...)
  git tag -l ........................... list available tags
  git checkout tag/<tname> ............. checkout specific tag
  git checkout tag/<tname> -b <bname> .. checkout specific tag in a new branch

  # Remote

  git push origin --tags .... push local tags to origin (or other remote)

Merging

  git merge [opt] <commit> .... integrate changes from <commit> since
    opt:                        current branch and <commit> diverged
      --squash ................ merge all commits into a single one
      --no-commit ............. dont generate commit if the merge succeeds

  git merge-base <commit> <commit>
                                get the common ancestor, since both commits diverged

  git rebase -i <upstream> .... interactively rebase on <upstream>, also supports actions
                                like squashing, editing, rewording, etc of commits

  git cherry-pick <commit> .... apply commit on current branch

Worktree

Worktrees allow to maintain multiple working trees in the filesystem linked to the same repository (shared .git folder).

  git worktree add <path> .............. create a tree at <path> with a new branch
                                         checked out (bname is basename of <path>)
  git worktree add <path> <bname> ...... create a tree at <path> from existing <bname>
  git worktree list .................... list existing work trees
  git worktree remove <tree> ........... remove work tree
  git worktree prune ................... remove stale bookkeeping files

Log & Commit History

  git log --oneline ......... shows log in single line per commit -> alias for
                              '--pretty=oneline --abbrev-commit'
  git log --graph ........... text based graph of commit history
  git log --decorate ........ decorate log with REFs

  git log -p <file> ......... show commit history + diffs for <file>
  git log --oneline <file> .. show commit history for <file> in compact format
  git log -nN ............... show last N history entries

Diff & Commit Info

  git diff <commit>..<commit> [<file>] .... show changes between two arbitrary
                                            commits. If one <commit> is omitted
                                            it is if HEAD is specified.
  git diff --name-only <commit>..<commit> . show names of files changed
  git diff -U$(wc -l <file>) <file> ....... shows complete file with diffs
                                            instead of usual diff snippets
  git diff --staged ....................... show diffs of staged files

  git show --stat <commit> ................ show files changed by <commit>
  git show <commit> [<file>] .............. show diffs for <commit>

  git show <commit>:<file> ................ show <file> at <commit>

Patching

  git format-patch <opt> <since>/<revision range>
    opt:
      -N ................... use [PATCH] instead [PATCH n/m] in subject when
                             generating patch description (for patches spanning
                             multiple commits)
      --start-number <n> ... start output file generation with <n> as start
                             number instead '1'
    since spcifier:
      -3 .................. e.g: create a patch from last three commits
      <commit hash> ....... create patch with commits starting after <commit hash>

  git am <patch> ......... apply patch and create a commit for it

  git apply --stat <PATCH> ... see which files the patch would change
  git apply --check <PATCH> .. see if the patch can be applied cleanly
  git apply [-3] <PATCH> ..... apply the patch locally without creating a commit,
                               if the patch does not cleanly apply -3 allows for
                               a 3-way merge

  # eg: generate patches for each commit from initial commit on
  git format-patch -N $(git rev-list --max-parents=0 HEAD)

  # generate single patch file from a certain commit/ref
  git format-patch <COMMIT/REF> --stdout > my-patch.patch

Resetting

  git reset [opt] <ref|commit>
    opt:
      --mixed .................... resets index, but not working tree
      --hard ..................... matches the working tree and index to that
                                   of the tree being switched to any changes to
                                   tracked files in the working tree since
                                   <commit> are lost
  git reset HEAD <file> .......... remove file from staging
  git reset --soft HEAD~1 ........ delete most recent commit; dont revert index & worktree
  git reset --mixed HEAD~1 ....... delete most recent commit; revert index; dont revert worktree
  git reset --hard HEAD~1 ........ delete most recent commit; revert index & worktree

Assuming an initial history A - B - C - D where HEAD currently points at D, the different reset operations work as shown below.

Soft reset.

git reset --soft HEAD~2

history:    A - B
                ^HEAD

-> local history is reverted, HEAD moved to B.
-> changes from C + D are still in the worktree & index (appear as staged changes).

Mixed reset.

git reset --mixed HEAD~2

history:    A - B
                ^HEAD

-> local history is reverted, HEAD moved to B.
-> changed from C + D are reverted in the index.
-> changes from C + D are still in the worktree (appear as unstaged changes).

Hard reset.

git reset --head HEAD~2

history:    A - B
                ^HEAD

-> local history is reverted, HEAD moved to B.
-> changes from C + D also reverted in the worktree & index (no pending changes).

Submodules

  git submodule add <url> [<path>] .......... add new submodule to current project
  git clone --recursive <url> ............... clone project and recursively all
                                              submodules (same as using
                                              'git submodule update --init
                                              --recursive' after clone)
  git submodule update --init --recursive ... checkout submodules recursively
                                              using the commit listed in the
                                              super-project (in detached HEAD)
  git submodule update --remote <submod> .... fetch & merge remote changes for
                                              <submod>, this will pull
                                              origin/HEAD or a branch specified
                                              for the submodule
  git diff --submodule ...................... show commits that are part of the
                                              submodule diff

Bisect

  git bisect start BAD GOOD ........ start bisect process in range BAD..GOOD commits
  git bisect good .................. mark current commit as good
  git bisect bad ................... mark current commit as bad

  # Automate bisecting.
  git bisect run <script> <args> ... run script to automate bisect process
                                     exit 0   - mark commit as good
                                     exit 1   - mark commit as bad
                                     exit 125 - skip commit (eg doesn't build)

Inspection

  git ls-tree [-r] <ref> .... show git tree for <ref>, -r to recursively ls sub-trees
  git show <obj> ............ show <obj>
  git cat-file -p <obj> ..... print content of <obj>

Revision Specifier

  HEAD ........ last commit
  HEAD~1 ...... last commit-1
  HEAD~N ...... last commit-N (linear backwards when in tree structure, check
                difference between HEAD^ and HEAD~)
  git rev-list --max-parents=0 HEAD ........... first commit

cmake(1)

Frequently used variables

# Install location.
CMAKE_INSTALL_PREFIX=<path>

# Generate compile_commands.json?
CMAKE_EXPORT_COMPILE_COMMANDS={0,1}

# Project build type.
CMAKE_BUILD_TYPE={Debug, Release, RelWithDebInfo, MinSizeRel}

# C++ standard.
CMAKE_CXX_STANDARD={14,17,..}

PRIVATE / PUBLIC / INTERFACE

These modifier control where properties for a given target are visible.

• PRIVATE: Only for the target itself.
• INTERFACE: Only for anyone linking against the target.
• PUBLIC: For the target itself and anyone linking against it (effectively PRIVATE + INTERFACE).

The following gives an example for preprocessor definitions specified on a library target. This behaves in the same way for other properties like for example include directories.

# CMakeLists.txt

cmake_minimum_required(VERSION 3.14)
project(moose)

# -- LIBRARY
add_library(liba STATIC liba.cc)
target_compile_definitions(liba PUBLIC DEF_PUBLIC)
target_compile_definitions(liba PRIVATE DEF_PRIVATE)
target_compile_definitions(liba INTERFACE DEF_INTERFACE)

# -- APPLICATION
add_executable(main main.cc)
target_link_libraries(main liba)

> touch liba.cc; echo "int main() {}" > main.cc
> cmake -B build -S . -G Ninja
> ninja -C build -j1 --verbose
[1/4] /usr/bin/c++ -DDEF_PRIVATE -DDEF_PUBLIC  [..] .../liba.cc
[2/4] [..]
[3/4] /usr/bin/c++ -DDEF_INTERFACE -DDEF_PUBLIC [..] .../main.cc
[4/4] [..]

find_package [ref]

A small example to play with can be found in cmake/module.

find_package(Name MODULE)

Looks for FindName.cmake in paths given by CMAKE_MODULE_PATH and then builtin paths.

find_package(Name CONFIG)

Looks for name-config.cmake or NameConfig.cmake in paths given by CMAKE_PREFIX_PATH, or path given by Name_DIR and then builtin paths.

make(1)

Anatomy of make rules

target .. : prerequisite ..
	recipe
	..

• target: an output generated by the rule
• prerequisite: an input that is used to generate the target
• recipe: list of actions to generate the output from the input

Use make -p to print all rules and variables (implicitly + explicitly defined).

Pattern rules & variables

Pattern rules

A pattern rule contains the % char (exactly one of them) and look like this example:

%.o : %.c
	$(CC) -c $(CFLAGS) $(CPPFLAGS) $< -o $@

The target matches files of the pattern %.o, where % matches any none-empty substring and other character match just them self.

The substring matched by % is called the stem.

% in the prerequisite stands for the matched stem in the target.

Automatic variables

As targets and prerequisites in pattern rules can't be spelled explicitly in the recipe, make provides a set of automatic variables to work with:

• $@: Name of the target that triggered the rule.
• $<: Name of the first prerequisite.
• $^: Names of all prerequisites (without duplicates).
• $+: Names of all prerequisites (with duplicates).
• $*: Stem of the pattern rule.

# file: Makefile

all: foobar blabla

foo% bla%: aaa bbb bbb
	@echo "@ = $@"
	@echo "< = $<"
	@echo "^ = $^"
	@echo "+ = $+"
	@echo "* = $*"
	@echo "----"

aaa:
bbb:

Running above Makefile gives:

@ = foobar
< = aaa
^ = aaa bbb
+ = aaa bbb bbb
* = bar
----
@ = blabla
< = aaa
^ = aaa bbb
+ = aaa bbb bbb
* = bla
----

Variables related to filesystem paths:

• $(CURDIR): Path of current working dir after using make -C path

Multi-line variables

define my_var
@echo foo
@echo bar
endef

all:
	$(my_var)

Running above Makefile gives:

foo
bar

Arguments

Arguments specified on the command line override ordinary variable assignments in the makefile (overriding variables).

VAR = abc
all:
	@echo VAR=$(VAR)

# make
VAR=abc

# make VAR=123
VAR=123

Useful functions

Substitution references

Substitute strings matching pattern in a list.

in  := a.o l.a c.o
out := $(in:.o=.c)
# => out = a.c l.a c.c

patsubst (ref)

in  := a.c b.c
out := $(patsubst %.c, build/%.o, $(in))
# => out = build/a.o build/b.o

# This is actually equivalent to $(in:%.c=build/%.o)

filter

Keep strings matching a pattern in a list.

in  := a.a b.b c.c d.d
out := $(filter %.b %.c, $(in))
# => out = b.b c.c

filter-out

Remove strings matching a pattern from a list.

in  := a.a b.b c.c d.d
out := $(filter-out %.b %.c, $(in))
# => out = a.a d.d

abspath

Resolve each file name as absolute path (don't resolve symlinks).

$(abspath fname1 fname2 ..)

realpath

Resolve each file name as canonical path.

$(realpath fname1 fname2 ..)