blob: 3a957e9b304bea21eb30bf5516f529689bf24b00 [file] [log] [blame]
Sasha Goldshtein38847f02016-02-22 02:19:24 -08001#!/usr/bin/env python
2#
3# trace Trace a function and print a trace message based on its
4# parameters, with an optional filter.
5#
Sasha Goldshtein49d50ba2016-12-19 10:17:38 +00006# usage: trace [-h] [-p PID] [-L TID] [-v] [-Z STRING_SIZE] [-S]
7# [-M MAX_EVENTS] [-T] [-t] [-K] [-U] [-I header]
Mark Draytonaa6c9162016-11-03 15:36:29 +00008# probe [probe ...]
Sasha Goldshteinfd60d552016-03-01 12:15:34 -08009#
Sasha Goldshtein38847f02016-02-22 02:19:24 -080010# Licensed under the Apache License, Version 2.0 (the "License")
11# Copyright (C) 2016 Sasha Goldshtein.
12
Sasha Goldshtein376ae5c2016-10-04 19:49:57 +030013from bcc import BPF, USDT
Teng Qin6b0ed372016-09-29 21:30:13 -070014from functools import partial
Sasha Goldshtein38847f02016-02-22 02:19:24 -080015from time import sleep, strftime
16import argparse
17import re
18import ctypes as ct
19import os
20import traceback
21import sys
22
Sasha Goldshtein38847f02016-02-22 02:19:24 -080023class Probe(object):
24 probe_count = 0
Sasha Goldshteinf4797b02016-10-17 01:44:56 -070025 streq_index = 0
Sasha Goldshtein38847f02016-02-22 02:19:24 -080026 max_events = None
27 event_count = 0
28 first_ts = 0
29 use_localtime = True
Mark Draytonaa6c9162016-11-03 15:36:29 +000030 tgid = -1
Sasha Goldshtein3e39a082016-03-24 08:39:47 -070031 pid = -1
Sasha Goldshtein38847f02016-02-22 02:19:24 -080032
33 @classmethod
34 def configure(cls, args):
35 cls.max_events = args.max_events
Sasha Goldshtein49d50ba2016-12-19 10:17:38 +000036 cls.print_time = args.timestamp or args.time
37 cls.use_localtime = not args.timestamp
Sasha Goldshtein60c41922017-02-09 04:19:53 -050038 cls.first_ts = BPF.monotonic_time()
Mark Draytonaa6c9162016-11-03 15:36:29 +000039 cls.tgid = args.tgid or -1
Sasha Goldshtein3e39a082016-03-24 08:39:47 -070040 cls.pid = args.pid or -1
Sasha Goldshtein38847f02016-02-22 02:19:24 -080041
Teng Qin6b0ed372016-09-29 21:30:13 -070042 def __init__(self, probe, string_size, kernel_stack, user_stack):
Sasha Goldshtein69e361a2016-09-27 19:40:00 +030043 self.usdt = None
Sasha Goldshteinf4797b02016-10-17 01:44:56 -070044 self.streq_functions = ""
Sasha Goldshtein38847f02016-02-22 02:19:24 -080045 self.raw_probe = probe
46 self.string_size = string_size
Teng Qin6b0ed372016-09-29 21:30:13 -070047 self.kernel_stack = kernel_stack
48 self.user_stack = user_stack
Sasha Goldshtein38847f02016-02-22 02:19:24 -080049 Probe.probe_count += 1
50 self._parse_probe()
51 self.probe_num = Probe.probe_count
52 self.probe_name = "probe_%s_%d" % \
Sasha Goldshtein3e39a082016-03-24 08:39:47 -070053 (self._display_function(), self.probe_num)
Sasha Goldshtein3fa7ba12017-01-14 11:17:40 +000054 self.probe_name = re.sub(r'[^A-Za-z0-9_]', '_', self.probe_name)
Sasha Goldshtein38847f02016-02-22 02:19:24 -080055
56 def __str__(self):
Sasha Goldshtein3e39a082016-03-24 08:39:47 -070057 return "%s:%s:%s FLT=%s ACT=%s/%s" % (self.probe_type,
58 self.library, self._display_function(), self.filter,
Sasha Goldshtein38847f02016-02-22 02:19:24 -080059 self.types, self.values)
60
61 def is_default_action(self):
62 return self.python_format == ""
63
64 def _bail(self, error):
Sasha Goldshtein3e39a082016-03-24 08:39:47 -070065 raise ValueError("error in probe '%s': %s" %
Sasha Goldshtein38847f02016-02-22 02:19:24 -080066 (self.raw_probe, error))
67
68 def _parse_probe(self):
69 text = self.raw_probe
70
Sasha Goldshtein23e72b82017-01-17 08:49:36 +000071 # There might be a function signature preceding the actual
72 # filter/print part, or not. Find the probe specifier first --
73 # it ends with either a space or an open paren ( for the
74 # function signature part.
75 # opt. signature
76 # probespec | rest
77 # --------- ---------- --
78 (spec, sig, rest) = re.match(r'([^ \t\(]+)(\([^\(]*\))?(.*)',
79 text).groups()
Sasha Goldshtein38847f02016-02-22 02:19:24 -080080
Sasha Goldshtein23e72b82017-01-17 08:49:36 +000081 self._parse_spec(spec)
82 self.signature = sig[1:-1] if sig else None # remove the parens
83 if self.signature and self.probe_type in ['u', 't']:
84 self._bail("USDT and tracepoint probes can't have " +
85 "a function signature; use arg1, arg2, " +
86 "... instead")
87
88 text = rest.lstrip()
Sasha Goldshtein38847f02016-02-22 02:19:24 -080089 # If we now have a (, wait for the balanced closing ) and that
90 # will be the predicate
91 self.filter = None
92 if len(text) > 0 and text[0] == "(":
93 balance = 1
94 for i in range(1, len(text)):
95 if text[i] == "(":
96 balance += 1
97 if text[i] == ")":
98 balance -= 1
99 if balance == 0:
Sasha Goldshteinf41ae862016-10-19 01:14:30 +0300100 self._parse_filter(text[:i + 1])
101 text = text[i + 1:]
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800102 break
103 if self.filter is None:
104 self._bail("unmatched end of predicate")
105
106 if self.filter is None:
107 self.filter = "1"
108
109 # The remainder of the text is the printf action
110 self._parse_action(text.lstrip())
111
112 def _parse_spec(self, spec):
113 parts = spec.split(":")
114 # Two special cases: 'func' means 'p::func', 'lib:func' means
115 # 'p:lib:func'. Other combinations need to provide an empty
116 # value between delimiters, e.g. 'r::func' for a kretprobe on
117 # the function func.
118 if len(parts) == 1:
119 parts = ["p", "", parts[0]]
120 elif len(parts) == 2:
121 parts = ["p", parts[0], parts[1]]
122 if len(parts[0]) == 0:
123 self.probe_type = "p"
Sasha Goldshtein3e39a082016-03-24 08:39:47 -0700124 elif parts[0] in ["p", "r", "t", "u"]:
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800125 self.probe_type = parts[0]
126 else:
Sasha Goldshtein3e39a082016-03-24 08:39:47 -0700127 self._bail("probe type must be '', 'p', 't', 'r', " +
128 "or 'u', but got '%s'" % parts[0])
Sasha Goldshteinfd60d552016-03-01 12:15:34 -0800129 if self.probe_type == "t":
130 self.tp_category = parts[1]
131 self.tp_event = parts[2]
Sasha Goldshteinfd60d552016-03-01 12:15:34 -0800132 self.library = "" # kernel
Sasha Goldshteinf41ae862016-10-19 01:14:30 +0300133 self.function = "" # from TRACEPOINT_PROBE
Sasha Goldshtein3e39a082016-03-24 08:39:47 -0700134 elif self.probe_type == "u":
135 self.library = parts[1]
136 self.usdt_name = parts[2]
137 self.function = "" # no function, just address
138 # We will discover the USDT provider by matching on
139 # the USDT name in the specified library
140 self._find_usdt_probe()
Sasha Goldshteinfd60d552016-03-01 12:15:34 -0800141 else:
142 self.library = parts[1]
143 self.function = parts[2]
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800144
Sasha Goldshtein3e39a082016-03-24 08:39:47 -0700145 def _find_usdt_probe(self):
Sasha Goldshteindd045362016-11-13 05:07:38 -0800146 target = Probe.pid if Probe.pid and Probe.pid != -1 \
147 else Probe.tgid
Mark Draytonaa6c9162016-11-03 15:36:29 +0000148 self.usdt = USDT(path=self.library, pid=target)
Sasha Goldshtein69e361a2016-09-27 19:40:00 +0300149 for probe in self.usdt.enumerate_probes():
Sasha Goldshtein3e39a082016-03-24 08:39:47 -0700150 if probe.name == self.usdt_name:
Sasha Goldshteinf41ae862016-10-19 01:14:30 +0300151 return # Found it, will enable later
Sasha Goldshtein3e39a082016-03-24 08:39:47 -0700152 self._bail("unrecognized USDT probe %s" % self.usdt_name)
153
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800154 def _parse_filter(self, filt):
Sasha Goldshteinf4797b02016-10-17 01:44:56 -0700155 self.filter = self._rewrite_expr(filt)
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800156
157 def _parse_types(self, fmt):
158 for match in re.finditer(
Sasha Goldshteinf41ae862016-10-19 01:14:30 +0300159 r'[^%]%(s|u|d|llu|lld|hu|hd|x|llx|c|K|U)', fmt):
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800160 self.types.append(match.group(1))
161 fmt = re.sub(r'([^%]%)(u|d|llu|lld|hu|hd)', r'\1d', fmt)
162 fmt = re.sub(r'([^%]%)(x|llx)', r'\1x', fmt)
Sasha Goldshteinaccd4cf2016-10-11 07:56:13 -0700163 fmt = re.sub('%K|%U', '%s', fmt)
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800164 self.python_format = fmt.strip('"')
165
166 def _parse_action(self, action):
167 self.values = []
168 self.types = []
169 self.python_format = ""
170 if len(action) == 0:
171 return
172
Sasha Goldshteinfd60d552016-03-01 12:15:34 -0800173 action = action.strip()
Sasha Goldshteinf4797b02016-10-17 01:44:56 -0700174 match = re.search(r'(\".*?\"),?(.*)', action)
Sasha Goldshteinfd60d552016-03-01 12:15:34 -0800175 if match is None:
176 self._bail("expected format string in \"s")
177
178 self.raw_format = match.group(1)
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800179 self._parse_types(self.raw_format)
Sasha Goldshteinf4797b02016-10-17 01:44:56 -0700180 for part in re.split('(?<!"),', match.group(2)):
181 part = self._rewrite_expr(part)
Sasha Goldshteinfd60d552016-03-01 12:15:34 -0800182 if len(part) > 0:
183 self.values.append(part)
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800184
185 aliases = {
Naveen N. Rao4afa96a2016-05-03 14:54:21 +0530186 "retval": "PT_REGS_RC(ctx)",
187 "arg1": "PT_REGS_PARM1(ctx)",
188 "arg2": "PT_REGS_PARM2(ctx)",
189 "arg3": "PT_REGS_PARM3(ctx)",
190 "arg4": "PT_REGS_PARM4(ctx)",
191 "arg5": "PT_REGS_PARM5(ctx)",
192 "arg6": "PT_REGS_PARM6(ctx)",
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800193 "$uid": "(unsigned)(bpf_get_current_uid_gid() & 0xffffffff)",
194 "$gid": "(unsigned)(bpf_get_current_uid_gid() >> 32)",
195 "$pid": "(unsigned)(bpf_get_current_pid_tgid() & 0xffffffff)",
196 "$tgid": "(unsigned)(bpf_get_current_pid_tgid() >> 32)",
197 "$cpu": "bpf_get_smp_processor_id()"
198 }
199
Sasha Goldshteinf4797b02016-10-17 01:44:56 -0700200 def _generate_streq_function(self, string):
201 fname = "streq_%d" % Probe.streq_index
202 Probe.streq_index += 1
203 self.streq_functions += """
Sasha Goldshteinb9aec342017-01-16 18:41:22 +0000204static inline bool %s(char const *ignored, uintptr_t str) {
Sasha Goldshteinf4797b02016-10-17 01:44:56 -0700205 char needle[] = %s;
206 char haystack[sizeof(needle)];
207 bpf_probe_read(&haystack, sizeof(haystack), (void *)str);
Sasha Goldshteindcf16752017-01-17 07:40:57 +0000208 for (int i = 0; i < sizeof(needle) - 1; ++i) {
Sasha Goldshteinf4797b02016-10-17 01:44:56 -0700209 if (needle[i] != haystack[i]) {
210 return false;
211 }
212 }
213 return true;
214}
215 """ % (fname, string)
216 return fname
217
218 def _rewrite_expr(self, expr):
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800219 for alias, replacement in Probe.aliases.items():
Sasha Goldshtein3e39a082016-03-24 08:39:47 -0700220 # For USDT probes, we replace argN values with the
Sasha Goldshteinf41ae862016-10-19 01:14:30 +0300221 # actual arguments for that probe obtained using
Sasha Goldshtein69e361a2016-09-27 19:40:00 +0300222 # bpf_readarg_N macros emitted at BPF construction.
Sasha Goldshtein3e39a082016-03-24 08:39:47 -0700223 if alias.startswith("arg") and self.probe_type == "u":
224 continue
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800225 expr = expr.replace(alias, replacement)
Sasha Goldshteinf4797b02016-10-17 01:44:56 -0700226 matches = re.finditer('STRCMP\\(("[^"]+\\")', expr)
227 for match in matches:
228 string = match.group(1)
229 fname = self._generate_streq_function(string)
230 expr = expr.replace("STRCMP", fname, 1)
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800231 return expr
232
Sasha Goldshteinf41ae862016-10-19 01:14:30 +0300233 p_type = {"u": ct.c_uint, "d": ct.c_int,
234 "llu": ct.c_ulonglong, "lld": ct.c_longlong,
235 "hu": ct.c_ushort, "hd": ct.c_short,
236 "x": ct.c_uint, "llx": ct.c_ulonglong, "c": ct.c_ubyte,
237 "K": ct.c_ulonglong, "U": ct.c_ulonglong}
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800238
239 def _generate_python_field_decl(self, idx, fields):
240 field_type = self.types[idx]
241 if field_type == "s":
242 ptype = ct.c_char * self.string_size
243 else:
244 ptype = Probe.p_type[field_type]
245 fields.append(("v%d" % idx, ptype))
246
247 def _generate_python_data_decl(self):
248 self.python_struct_name = "%s_%d_Data" % \
Sasha Goldshtein3e39a082016-03-24 08:39:47 -0700249 (self._display_function(), self.probe_num)
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800250 fields = [
251 ("timestamp_ns", ct.c_ulonglong),
Mark Draytonaa6c9162016-11-03 15:36:29 +0000252 ("tgid", ct.c_uint),
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800253 ("pid", ct.c_uint),
254 ("comm", ct.c_char * 16) # TASK_COMM_LEN
255 ]
256 for i in range(0, len(self.types)):
257 self._generate_python_field_decl(i, fields)
Teng Qin6b0ed372016-09-29 21:30:13 -0700258 if self.kernel_stack:
259 fields.append(("kernel_stack_id", ct.c_int))
260 if self.user_stack:
261 fields.append(("user_stack_id", ct.c_int))
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800262 return type(self.python_struct_name, (ct.Structure,),
263 dict(_fields_=fields))
264
Sasha Goldshteinf41ae862016-10-19 01:14:30 +0300265 c_type = {"u": "unsigned int", "d": "int",
266 "llu": "unsigned long long", "lld": "long long",
267 "hu": "unsigned short", "hd": "short",
268 "x": "unsigned int", "llx": "unsigned long long",
269 "c": "char", "K": "unsigned long long",
270 "U": "unsigned long long"}
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800271 fmt_types = c_type.keys()
272
273 def _generate_field_decl(self, idx):
274 field_type = self.types[idx]
275 if field_type == "s":
276 return "char v%d[%d];\n" % (idx, self.string_size)
277 if field_type in Probe.fmt_types:
278 return "%s v%d;\n" % (Probe.c_type[field_type], idx)
279 self._bail("unrecognized format specifier %s" % field_type)
280
281 def _generate_data_decl(self):
282 # The BPF program will populate values into the struct
283 # according to the format string, and the Python program will
284 # construct the final display string.
285 self.events_name = "%s_events" % self.probe_name
286 self.struct_name = "%s_data_t" % self.probe_name
Teng Qin6b0ed372016-09-29 21:30:13 -0700287 self.stacks_name = "%s_stacks" % self.probe_name
288 stack_table = "BPF_STACK_TRACE(%s, 1024);" % self.stacks_name \
289 if (self.kernel_stack or self.user_stack) else ""
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800290 data_fields = ""
291 for i, field_type in enumerate(self.types):
292 data_fields += " " + \
293 self._generate_field_decl(i)
294
Teng Qin6b0ed372016-09-29 21:30:13 -0700295 kernel_stack_str = " int kernel_stack_id;" \
296 if self.kernel_stack else ""
297 user_stack_str = " int user_stack_id;" \
298 if self.user_stack else ""
299
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800300 text = """
301struct %s
302{
303 u64 timestamp_ns;
Mark Draytonaa6c9162016-11-03 15:36:29 +0000304 u32 tgid;
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800305 u32 pid;
306 char comm[TASK_COMM_LEN];
307%s
Teng Qin6b0ed372016-09-29 21:30:13 -0700308%s
309%s
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800310};
311
312BPF_PERF_OUTPUT(%s);
Teng Qin6b0ed372016-09-29 21:30:13 -0700313%s
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800314"""
Teng Qin6b0ed372016-09-29 21:30:13 -0700315 return text % (self.struct_name, data_fields,
316 kernel_stack_str, user_stack_str,
317 self.events_name, stack_table)
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800318
319 def _generate_field_assign(self, idx):
320 field_type = self.types[idx]
Sasha Goldshtein69e361a2016-09-27 19:40:00 +0300321 expr = self.values[idx].strip()
322 text = ""
323 if self.probe_type == "u" and expr[0:3] == "arg":
Sasha Goldshteinb6db17f2016-10-04 19:50:50 +0300324 text = (" u64 %s = 0;\n" +
Sasha Goldshteinf41ae862016-10-19 01:14:30 +0300325 " bpf_usdt_readarg(%s, ctx, &%s);\n") \
326 % (expr, expr[3], expr)
Sasha Goldshtein69e361a2016-09-27 19:40:00 +0300327
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800328 if field_type == "s":
Sasha Goldshtein69e361a2016-09-27 19:40:00 +0300329 return text + """
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800330 if (%s != 0) {
331 bpf_probe_read(&__data.v%d, sizeof(__data.v%d), (void *)%s);
332 }
Sasha Goldshteinf41ae862016-10-19 01:14:30 +0300333 """ % (expr, idx, idx, expr)
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800334 if field_type in Probe.fmt_types:
Sasha Goldshtein69e361a2016-09-27 19:40:00 +0300335 return text + " __data.v%d = (%s)%s;\n" % \
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800336 (idx, Probe.c_type[field_type], expr)
337 self._bail("unrecognized field type %s" % field_type)
338
Teng Qin0615bff2016-09-28 08:19:40 -0700339 def _generate_usdt_filter_read(self):
340 text = ""
Sasha Goldshteinb6300922017-01-16 18:43:11 +0000341 if self.probe_type != "u":
342 return text
343 for arg, _ in Probe.aliases.items():
344 if not (arg.startswith("arg") and
345 (arg in self.filter)):
346 continue
347 arg_index = int(arg.replace("arg", ""))
348 arg_ctype = self.usdt.get_probe_arg_ctype(
Sasha Goldshteindcf16752017-01-17 07:40:57 +0000349 self.usdt_name, arg_index - 1)
Sasha Goldshteinb6300922017-01-16 18:43:11 +0000350 if not arg_ctype:
351 self._bail("Unable to determine type of {} "
352 "in the filter".format(arg))
353 text += """
Teng Qin0615bff2016-09-28 08:19:40 -0700354 {} {}_filter;
355 bpf_usdt_readarg({}, ctx, &{}_filter);
Sasha Goldshteinb6300922017-01-16 18:43:11 +0000356 """.format(arg_ctype, arg, arg_index, arg)
357 self.filter = self.filter.replace(
358 arg, "{}_filter".format(arg))
Teng Qin0615bff2016-09-28 08:19:40 -0700359 return text
360
Sasha Goldshtein3e39a082016-03-24 08:39:47 -0700361 def generate_program(self, include_self):
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800362 data_decl = self._generate_data_decl()
Sasha Goldshteinb6300922017-01-16 18:43:11 +0000363 if Probe.pid != -1:
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800364 pid_filter = """
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800365 if (__pid != %d) { return 0; }
Sasha Goldshteinf41ae862016-10-19 01:14:30 +0300366 """ % Probe.pid
Sasha Goldshteinb6300922017-01-16 18:43:11 +0000367 # uprobes can have a built-in tgid filter passed to
368 # attach_uprobe, hence the check here -- for kprobes, we
369 # need to do the tgid test by hand:
Mark Draytonaa6c9162016-11-03 15:36:29 +0000370 elif len(self.library) == 0 and Probe.tgid != -1:
371 pid_filter = """
372 if (__tgid != %d) { return 0; }
373 """ % Probe.tgid
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800374 elif not include_self:
375 pid_filter = """
Mark Draytonaa6c9162016-11-03 15:36:29 +0000376 if (__tgid == %d) { return 0; }
Sasha Goldshteinf41ae862016-10-19 01:14:30 +0300377 """ % os.getpid()
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800378 else:
379 pid_filter = ""
380
Sasha Goldshtein3e39a082016-03-24 08:39:47 -0700381 prefix = ""
Sasha Goldshtein3e39a082016-03-24 08:39:47 -0700382 signature = "struct pt_regs *ctx"
Sasha Goldshtein23e72b82017-01-17 08:49:36 +0000383 if self.signature:
384 signature += ", " + self.signature
Sasha Goldshtein3e39a082016-03-24 08:39:47 -0700385
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800386 data_fields = ""
387 for i, expr in enumerate(self.values):
388 data_fields += self._generate_field_assign(i)
389
Sasha Goldshtein376ae5c2016-10-04 19:49:57 +0300390 if self.probe_type == "t":
391 heading = "TRACEPOINT_PROBE(%s, %s)" % \
392 (self.tp_category, self.tp_event)
393 ctx_name = "args"
394 else:
395 heading = "int %s(%s)" % (self.probe_name, signature)
396 ctx_name = "ctx"
Sasha Goldshtein4725a722016-10-18 20:54:47 +0300397
398 stack_trace = ""
399 if self.user_stack:
400 stack_trace += """
401 __data.user_stack_id = %s.get_stackid(
402 %s, BPF_F_REUSE_STACKID | BPF_F_USER_STACK
403 );""" % (self.stacks_name, ctx_name)
404 if self.kernel_stack:
405 stack_trace += """
406 __data.kernel_stack_id = %s.get_stackid(
407 %s, BPF_F_REUSE_STACKID
408 );""" % (self.stacks_name, ctx_name)
409
Sasha Goldshtein376ae5c2016-10-04 19:49:57 +0300410 text = heading + """
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800411{
Mark Draytonaa6c9162016-11-03 15:36:29 +0000412 u64 __pid_tgid = bpf_get_current_pid_tgid();
413 u32 __tgid = __pid_tgid >> 32;
414 u32 __pid = __pid_tgid; // implicit cast to u32 for bottom half
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800415 %s
Sasha Goldshteinfd60d552016-03-01 12:15:34 -0800416 %s
Teng Qin0615bff2016-09-28 08:19:40 -0700417 %s
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800418 if (!(%s)) return 0;
419
420 struct %s __data = {0};
421 __data.timestamp_ns = bpf_ktime_get_ns();
Mark Draytonaa6c9162016-11-03 15:36:29 +0000422 __data.tgid = __tgid;
423 __data.pid = __pid;
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800424 bpf_get_current_comm(&__data.comm, sizeof(__data.comm));
425%s
Teng Qin6b0ed372016-09-29 21:30:13 -0700426%s
Sasha Goldshtein376ae5c2016-10-04 19:49:57 +0300427 %s.perf_submit(%s, &__data, sizeof(__data));
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800428 return 0;
429}
430"""
Sasha Goldshtein376ae5c2016-10-04 19:49:57 +0300431 text = text % (pid_filter, prefix,
Teng Qin0615bff2016-09-28 08:19:40 -0700432 self._generate_usdt_filter_read(), self.filter,
Teng Qin6b0ed372016-09-29 21:30:13 -0700433 self.struct_name, data_fields,
Sasha Goldshtein376ae5c2016-10-04 19:49:57 +0300434 stack_trace, self.events_name, ctx_name)
Sasha Goldshtein3e39a082016-03-24 08:39:47 -0700435
Sasha Goldshteinf4797b02016-10-17 01:44:56 -0700436 return self.streq_functions + data_decl + "\n" + text
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800437
438 @classmethod
439 def _time_off_str(cls, timestamp_ns):
440 return "%.6f" % (1e-9 * (timestamp_ns - cls.first_ts))
441
Sasha Goldshteinfd60d552016-03-01 12:15:34 -0800442 def _display_function(self):
Sasha Goldshtein3e39a082016-03-24 08:39:47 -0700443 if self.probe_type == 'p' or self.probe_type == 'r':
Sasha Goldshteinfd60d552016-03-01 12:15:34 -0800444 return self.function
Sasha Goldshtein3e39a082016-03-24 08:39:47 -0700445 elif self.probe_type == 'u':
446 return self.usdt_name
447 else: # self.probe_type == 't'
448 return self.tp_event
Sasha Goldshteinfd60d552016-03-01 12:15:34 -0800449
Mark Draytonaa6c9162016-11-03 15:36:29 +0000450 def print_stack(self, bpf, stack_id, tgid):
Teng Qin6b0ed372016-09-29 21:30:13 -0700451 if stack_id < 0:
Sasha Goldshteinaccd4cf2016-10-11 07:56:13 -0700452 print(" %d" % stack_id)
453 return
Teng Qin6b0ed372016-09-29 21:30:13 -0700454
455 stack = list(bpf.get_table(self.stacks_name).walk(stack_id))
456 for addr in stack:
Mark Draytonaa6c9162016-11-03 15:36:29 +0000457 print(" %016x %s" % (addr, bpf.sym(addr, tgid)))
Sasha Goldshteinaccd4cf2016-10-11 07:56:13 -0700458
Mark Draytonaa6c9162016-11-03 15:36:29 +0000459 def _format_message(self, bpf, tgid, values):
460 # Replace each %K with kernel sym and %U with user sym in tgid
Rafael Fonsecaaee5ecf2017-02-08 16:14:31 +0100461 kernel_placeholders = [i for i, t in enumerate(self.types)
462 if t == 'K']
463 user_placeholders = [i for i, t in enumerate(self.types)
464 if t == 'U']
Sasha Goldshteinaccd4cf2016-10-11 07:56:13 -0700465 for kp in kernel_placeholders:
466 values[kp] = bpf.ksymaddr(values[kp])
467 for up in user_placeholders:
Mark Draytonaa6c9162016-11-03 15:36:29 +0000468 values[up] = bpf.symaddr(values[up], tgid)
Sasha Goldshteinaccd4cf2016-10-11 07:56:13 -0700469 return self.python_format % tuple(values)
Teng Qin6b0ed372016-09-29 21:30:13 -0700470
471 def print_event(self, bpf, cpu, data, size):
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800472 # Cast as the generated structure type and display
473 # according to the format string in the probe.
474 event = ct.cast(data, ct.POINTER(self.python_struct)).contents
475 values = map(lambda i: getattr(event, "v%d" % i),
476 range(0, len(self.values)))
Mark Draytonaa6c9162016-11-03 15:36:29 +0000477 msg = self._format_message(bpf, event.tgid, values)
Sasha Goldshtein49d50ba2016-12-19 10:17:38 +0000478 if not Probe.print_time:
479 print("%-6d %-6d %-12s %-16s %s" %
480 (event.tgid, event.pid, event.comm,
481 self._display_function(), msg))
482 else:
483 time = strftime("%H:%M:%S") if Probe.use_localtime else \
484 Probe._time_off_str(event.timestamp_ns)
485 print("%-8s %-6d %-6d %-12s %-16s %s" %
486 (time[:8], event.tgid, event.pid, event.comm,
487 self._display_function(), msg))
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800488
Teng Qin6b0ed372016-09-29 21:30:13 -0700489 if self.kernel_stack:
Sasha Goldshteinaccd4cf2016-10-11 07:56:13 -0700490 self.print_stack(bpf, event.kernel_stack_id, -1)
Mark Draytonaa6c9162016-11-03 15:36:29 +0000491 if self.user_stack:
492 self.print_stack(bpf, event.user_stack_id, event.tgid)
Teng Qin6b0ed372016-09-29 21:30:13 -0700493 if self.user_stack or self.kernel_stack:
Sasha Goldshteinaccd4cf2016-10-11 07:56:13 -0700494 print("")
Teng Qin6b0ed372016-09-29 21:30:13 -0700495
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800496 Probe.event_count += 1
497 if Probe.max_events is not None and \
498 Probe.event_count >= Probe.max_events:
499 exit()
500
501 def attach(self, bpf, verbose):
502 if len(self.library) == 0:
503 self._attach_k(bpf)
504 else:
505 self._attach_u(bpf)
506 self.python_struct = self._generate_python_data_decl()
Teng Qin6b0ed372016-09-29 21:30:13 -0700507 callback = partial(self.print_event, bpf)
508 bpf[self.events_name].open_perf_buffer(callback)
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800509
510 def _attach_k(self, bpf):
511 if self.probe_type == "r":
512 bpf.attach_kretprobe(event=self.function,
513 fn_name=self.probe_name)
Sasha Goldshtein376ae5c2016-10-04 19:49:57 +0300514 elif self.probe_type == "p":
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800515 bpf.attach_kprobe(event=self.function,
516 fn_name=self.probe_name)
Sasha Goldshtein376ae5c2016-10-04 19:49:57 +0300517 # Note that tracepoints don't need an explicit attach
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800518
519 def _attach_u(self, bpf):
520 libpath = BPF.find_library(self.library)
521 if libpath is None:
522 # This might be an executable (e.g. 'bash')
Sasha Goldshteinec679712016-10-04 18:33:36 +0300523 libpath = BPF.find_exe(self.library)
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800524 if libpath is None or len(libpath) == 0:
525 self._bail("unable to find library %s" % self.library)
526
Sasha Goldshtein3e39a082016-03-24 08:39:47 -0700527 if self.probe_type == "u":
Sasha Goldshteinf41ae862016-10-19 01:14:30 +0300528 pass # Was already enabled by the BPF constructor
Sasha Goldshtein3e39a082016-03-24 08:39:47 -0700529 elif self.probe_type == "r":
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800530 bpf.attach_uretprobe(name=libpath,
531 sym=self.function,
532 fn_name=self.probe_name,
Sasha Goldshteinb6300922017-01-16 18:43:11 +0000533 pid=Probe.tgid)
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800534 else:
535 bpf.attach_uprobe(name=libpath,
536 sym=self.function,
537 fn_name=self.probe_name,
Sasha Goldshteinb6300922017-01-16 18:43:11 +0000538 pid=Probe.tgid)
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800539
540class Tool(object):
541 examples = """
542EXAMPLES:
543
Sasha Goldshtein8acd0152016-02-22 02:25:03 -0800544trace do_sys_open
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800545 Trace the open syscall and print a default trace message when entered
Sasha Goldshtein8acd0152016-02-22 02:25:03 -0800546trace 'do_sys_open "%s", arg2'
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800547 Trace the open syscall and print the filename being opened
Sasha Goldshtein8acd0152016-02-22 02:25:03 -0800548trace 'sys_read (arg3 > 20000) "read %d bytes", arg3'
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800549 Trace the read syscall and print a message for reads >20000 bytes
Sasha Goldshtein23e72b82017-01-17 08:49:36 +0000550trace 'r::do_sys_open "%llx", retval'
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800551 Trace the return from the open syscall and print the return value
Sasha Goldshtein8acd0152016-02-22 02:25:03 -0800552trace 'c:open (arg2 == 42) "%s %d", arg1, arg2'
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800553 Trace the open() call from libc only if the flags (arg2) argument is 42
Sasha Goldshtein8acd0152016-02-22 02:25:03 -0800554trace 'c:malloc "size = %d", arg1'
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800555 Trace malloc calls and print the size being allocated
Sasha Goldshtein8acd0152016-02-22 02:25:03 -0800556trace 'p:c:write (arg1 == 1) "writing %d bytes to STDOUT", arg3'
557 Trace the write() call from libc to monitor writes to STDOUT
Mark Draytonaa6c9162016-11-03 15:36:29 +0000558trace 'r::__kmalloc (retval == 0) "kmalloc failed!"'
Sasha Goldshtein8acd0152016-02-22 02:25:03 -0800559 Trace returns from __kmalloc which returned a null pointer
Mark Draytonaa6c9162016-11-03 15:36:29 +0000560trace 'r:c:malloc (retval) "allocated = %x", retval'
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800561 Trace returns from malloc and print non-NULL allocated buffers
Sasha Goldshtein376ae5c2016-10-04 19:49:57 +0300562trace 't:block:block_rq_complete "sectors=%d", args->nr_sector'
Sasha Goldshteinfd60d552016-03-01 12:15:34 -0800563 Trace the block_rq_complete kernel tracepoint and print # of tx sectors
Sasha Goldshtein3e39a082016-03-24 08:39:47 -0700564trace 'u:pthread:pthread_create (arg4 != 0)'
565 Trace the USDT probe pthread_create when its 4th argument is non-zero
Sasha Goldshtein23e72b82017-01-17 08:49:36 +0000566trace 'p::SyS_nanosleep(struct timespec *ts) "sleep for %lld ns", ts->tv_nsec'
567 Trace the nanosleep syscall and print the sleep duration in ns
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800568"""
569
570 def __init__(self):
Sasha Goldshteinf41ae862016-10-19 01:14:30 +0300571 parser = argparse.ArgumentParser(description="Attach to " +
572 "functions and print trace messages.",
573 formatter_class=argparse.RawDescriptionHelpFormatter,
574 epilog=Tool.examples)
Mark Draytonaa6c9162016-11-03 15:36:29 +0000575 # we'll refer to the userspace concepts of "pid" and "tid" by
576 # their kernel names -- tgid and pid -- inside the script
577 parser.add_argument("-p", "--pid", type=int, metavar="PID",
578 dest="tgid", help="id of the process to trace (optional)")
Sasha Goldshtein49d50ba2016-12-19 10:17:38 +0000579 parser.add_argument("-L", "--tid", type=int, metavar="TID",
Mark Draytonaa6c9162016-11-03 15:36:29 +0000580 dest="pid", help="id of the thread to trace (optional)")
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800581 parser.add_argument("-v", "--verbose", action="store_true",
582 help="print resulting BPF program code before executing")
583 parser.add_argument("-Z", "--string-size", type=int,
584 default=80, help="maximum size to read from strings")
Sasha Goldshteinf41ae862016-10-19 01:14:30 +0300585 parser.add_argument("-S", "--include-self",
586 action="store_true",
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800587 help="do not filter trace's own pid from the trace")
588 parser.add_argument("-M", "--max-events", type=int,
589 help="number of events to print before quitting")
Sasha Goldshtein49d50ba2016-12-19 10:17:38 +0000590 parser.add_argument("-t", "--timestamp", action="store_true",
591 help="print timestamp column (offset from trace start)")
592 parser.add_argument("-T", "--time", action="store_true",
593 help="print time column")
Sasha Goldshteinf41ae862016-10-19 01:14:30 +0300594 parser.add_argument("-K", "--kernel-stack",
595 action="store_true", help="output kernel stack trace")
596 parser.add_argument("-U", "--user-stack",
597 action="store_true", help="output user stack trace")
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800598 parser.add_argument(metavar="probe", dest="probes", nargs="+",
599 help="probe specifier (see examples)")
Sasha Goldshtein4725a722016-10-18 20:54:47 +0300600 parser.add_argument("-I", "--include", action="append",
601 metavar="header",
ShelbyFrancesf5dbbdb2017-02-08 05:56:52 +0300602 help="additional header files to include in the BPF program "
603 "as either full path, or relative to '/usr/include'")
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800604 self.args = parser.parse_args()
Mark Draytonaa6c9162016-11-03 15:36:29 +0000605 if self.args.tgid and self.args.pid:
606 parser.error("only one of -p and -t may be specified")
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800607
608 def _create_probes(self):
609 Probe.configure(self.args)
610 self.probes = []
611 for probe_spec in self.args.probes:
612 self.probes.append(Probe(
Teng Qin6b0ed372016-09-29 21:30:13 -0700613 probe_spec, self.args.string_size,
614 self.args.kernel_stack, self.args.user_stack))
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800615
616 def _generate_program(self):
617 self.program = """
618#include <linux/ptrace.h>
619#include <linux/sched.h> /* For TASK_COMM_LEN */
620
621"""
Sasha Goldshtein4725a722016-10-18 20:54:47 +0300622 for include in (self.args.include or []):
ShelbyFrancesf5dbbdb2017-02-08 05:56:52 +0300623 if include.startswith((".", "/")):
624 include = os.path.abspath(include)
625 self.program += "#include \"%s\"\n" % include
626 else:
627 self.program += "#include <%s>\n" % include
Sasha Goldshteinb950d6f2016-03-21 04:06:15 -0700628 self.program += BPF.generate_auto_includes(
Sasha Goldshteinfd60d552016-03-01 12:15:34 -0800629 map(lambda p: p.raw_probe, self.probes))
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800630 for probe in self.probes:
631 self.program += probe.generate_program(
Sasha Goldshtein3e39a082016-03-24 08:39:47 -0700632 self.args.include_self)
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800633
634 if self.args.verbose:
635 print(self.program)
636
637 def _attach_probes(self):
Sasha Goldshtein69e361a2016-09-27 19:40:00 +0300638 usdt_contexts = []
639 for probe in self.probes:
640 if probe.usdt:
641 # USDT probes must be enabled before the BPF object
642 # is initialized, because that's where the actual
643 # uprobe is being attached.
644 probe.usdt.enable_probe(
645 probe.usdt_name, probe.probe_name)
Sasha Goldshteinf733cac2016-10-04 18:39:01 +0300646 if self.args.verbose:
647 print(probe.usdt.get_text())
Sasha Goldshtein69e361a2016-09-27 19:40:00 +0300648 usdt_contexts.append(probe.usdt)
649 self.bpf = BPF(text=self.program, usdt_contexts=usdt_contexts)
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800650 for probe in self.probes:
651 if self.args.verbose:
652 print(probe)
653 probe.attach(self.bpf, self.args.verbose)
654
655 def _main_loop(self):
656 all_probes_trivial = all(map(Probe.is_default_action,
657 self.probes))
658
659 # Print header
Sasha Goldshtein49d50ba2016-12-19 10:17:38 +0000660 if self.args.timestamp or self.args.time:
661 print("%-8s %-6s %-6s %-12s %-16s %s" %
662 ("TIME", "PID", "TID", "COMM", "FUNC",
663 "-" if not all_probes_trivial else ""))
664 else:
665 print("%-6s %-6s %-12s %-16s %s" %
666 ("PID", "TID", "COMM", "FUNC",
667 "-" if not all_probes_trivial else ""))
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800668
669 while True:
670 self.bpf.kprobe_poll()
671
672 def run(self):
673 try:
674 self._create_probes()
675 self._generate_program()
676 self._attach_probes()
677 self._main_loop()
678 except:
679 if self.args.verbose:
680 traceback.print_exc()
Brenden Blancode14f4f2016-04-08 15:52:55 -0700681 elif sys.exc_info()[0] is not SystemExit:
682 print(sys.exc_info()[1])
Sasha Goldshtein38847f02016-02-22 02:19:24 -0800683
684if __name__ == "__main__":
Sasha Goldshteinf41ae862016-10-19 01:14:30 +0300685 Tool().run()