Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 1 | #!/usr/bin/python |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 2 | # @lint-avoid-python-3-compatibility-imports |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 3 | # |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 4 | # killsnoop Trace signals issued by the kill() syscall. |
| 5 | # For Linux, uses BCC, eBPF. Embedded C. |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 6 | # |
Junli Ou | 5eee5ff | 2016-08-13 17:12:45 +0800 | [diff] [blame] | 7 | # USAGE: killsnoop [-h] [-x] [-p PID] |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 8 | # |
| 9 | # Copyright (c) 2015 Brendan Gregg. |
| 10 | # Licensed under the Apache License, Version 2.0 (the "License") |
| 11 | # |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 12 | # 20-Sep-2015 Brendan Gregg Created this. |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 13 | # 19-Feb-2016 Allan McAleavy migrated to BPF_PERF_OUTPUT |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 14 | |
| 15 | from __future__ import print_function |
| 16 | from bcc import BPF |
| 17 | import argparse |
Junli Ou | 5eee5ff | 2016-08-13 17:12:45 +0800 | [diff] [blame] | 18 | from time import strftime |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 19 | import ctypes as ct |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 20 | |
| 21 | # arguments |
| 22 | examples = """examples: |
| 23 | ./killsnoop # trace all kill() signals |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 24 | ./killsnoop -x # only show failed kills |
| 25 | ./killsnoop -p 181 # only trace PID 181 |
| 26 | """ |
| 27 | parser = argparse.ArgumentParser( |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 28 | description="Trace signals issued by the kill() syscall", |
| 29 | formatter_class=argparse.RawDescriptionHelpFormatter, |
| 30 | epilog=examples) |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 31 | parser.add_argument("-x", "--failed", action="store_true", |
Chris Down | 8ddcbdf | 2016-07-13 15:18:35 +0100 | [diff] [blame] | 32 | help="only show failed kill syscalls") |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 33 | parser.add_argument("-p", "--pid", |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 34 | help="trace this PID only") |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 35 | parser.add_argument("--ebpf", action="store_true", |
| 36 | help=argparse.SUPPRESS) |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 37 | args = parser.parse_args() |
| 38 | debug = 0 |
| 39 | |
| 40 | # define BPF program |
| 41 | bpf_text = """ |
| 42 | #include <uapi/linux/ptrace.h> |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 43 | #include <linux/sched.h> |
| 44 | |
| 45 | struct val_t { |
| 46 | u64 pid; |
mcaleavya | 6262f5d | 2016-02-19 23:48:20 +0000 | [diff] [blame] | 47 | int sig; |
| 48 | int tpid; |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 49 | char comm[TASK_COMM_LEN]; |
| 50 | }; |
| 51 | |
| 52 | struct data_t { |
| 53 | u64 pid; |
Brendan Gregg | 1298998 | 2016-09-14 08:15:09 -0700 | [diff] [blame] | 54 | int tpid; |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 55 | int sig; |
| 56 | int ret; |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 57 | char comm[TASK_COMM_LEN]; |
| 58 | }; |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 59 | |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 60 | BPF_HASH(infotmp, u32, struct val_t); |
| 61 | BPF_PERF_OUTPUT(events); |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 62 | |
yonghong-song | 2da3426 | 2018-06-13 06:12:22 -0700 | [diff] [blame] | 63 | int syscall__kill(struct pt_regs *ctx, int tpid, int sig) |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 64 | { |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 65 | u32 pid = bpf_get_current_pid_tgid(); |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 66 | FILTER |
Brendan Gregg | 1298998 | 2016-09-14 08:15:09 -0700 | [diff] [blame] | 67 | |
| 68 | struct val_t val = {.pid = pid}; |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 69 | if (bpf_get_current_comm(&val.comm, sizeof(val.comm)) == 0) { |
mcaleavya | 6262f5d | 2016-02-19 23:48:20 +0000 | [diff] [blame] | 70 | val.tpid = tpid; |
| 71 | val.sig = sig; |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 72 | infotmp.update(&pid, &val); |
| 73 | } |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 74 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 75 | return 0; |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 76 | }; |
| 77 | |
Yonghong Song | 6433569 | 2018-04-25 00:40:13 -0700 | [diff] [blame] | 78 | int do_ret_sys_kill(struct pt_regs *ctx) |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 79 | { |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 80 | struct data_t data = {}; |
| 81 | struct val_t *valp; |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 82 | u32 pid = bpf_get_current_pid_tgid(); |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 83 | |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 84 | valp = infotmp.lookup(&pid); |
| 85 | if (valp == 0) { |
| 86 | // missed entry |
| 87 | return 0; |
| 88 | } |
| 89 | |
| 90 | bpf_probe_read(&data.comm, sizeof(data.comm), valp->comm); |
| 91 | data.pid = pid; |
mcaleavya | 6262f5d | 2016-02-19 23:48:20 +0000 | [diff] [blame] | 92 | data.tpid = valp->tpid; |
Naveen N. Rao | 4afa96a | 2016-05-03 14:54:21 +0530 | [diff] [blame] | 93 | data.ret = PT_REGS_RC(ctx); |
mcaleavya | 6262f5d | 2016-02-19 23:48:20 +0000 | [diff] [blame] | 94 | data.sig = valp->sig; |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 95 | |
| 96 | events.perf_submit(ctx, &data, sizeof(data)); |
| 97 | infotmp.delete(&pid); |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 98 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 99 | return 0; |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 100 | } |
| 101 | """ |
| 102 | if args.pid: |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 103 | bpf_text = bpf_text.replace('FILTER', |
| 104 | 'if (pid != %s) { return 0; }' % args.pid) |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 105 | else: |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 106 | bpf_text = bpf_text.replace('FILTER', '') |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 107 | if debug or args.ebpf: |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 108 | print(bpf_text) |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 109 | if args.ebpf: |
| 110 | exit() |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 111 | |
| 112 | # initialize BPF |
| 113 | b = BPF(text=bpf_text) |
Yonghong Song | 6433569 | 2018-04-25 00:40:13 -0700 | [diff] [blame] | 114 | kill_fnname = b.get_syscall_fnname("kill") |
yonghong-song | 2da3426 | 2018-06-13 06:12:22 -0700 | [diff] [blame] | 115 | b.attach_kprobe(event=kill_fnname, fn_name="syscall__kill") |
Yonghong Song | 6433569 | 2018-04-25 00:40:13 -0700 | [diff] [blame] | 116 | b.attach_kretprobe(event=kill_fnname, fn_name="do_ret_sys_kill") |
| 117 | |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 118 | |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 119 | TASK_COMM_LEN = 16 # linux/sched.h |
| 120 | |
| 121 | class Data(ct.Structure): |
| 122 | _fields_ = [ |
| 123 | ("pid", ct.c_ulonglong), |
Brendan Gregg | 1298998 | 2016-09-14 08:15:09 -0700 | [diff] [blame] | 124 | ("tpid", ct.c_int), |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 125 | ("sig", ct.c_int), |
| 126 | ("ret", ct.c_int), |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 127 | ("comm", ct.c_char * TASK_COMM_LEN) |
| 128 | ] |
| 129 | |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 130 | # header |
Junli Ou | 5eee5ff | 2016-08-13 17:12:45 +0800 | [diff] [blame] | 131 | print("%-9s %-6s %-16s %-4s %-6s %s" % ( |
| 132 | "TIME", "PID", "COMM", "SIG", "TPID", "RESULT")) |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 133 | |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 134 | # process event |
| 135 | def print_event(cpu, data, size): |
| 136 | event = ct.cast(data, ct.POINTER(Data)).contents |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 137 | |
Brendan Gregg | 1298998 | 2016-09-14 08:15:09 -0700 | [diff] [blame] | 138 | if (args.failed and (event.ret >= 0)): |
| 139 | return |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 140 | |
Junli Ou | 5eee5ff | 2016-08-13 17:12:45 +0800 | [diff] [blame] | 141 | print("%-9s %-6d %-16s %-4d %-6d %d" % (strftime("%H:%M:%S"), |
Rafael F | 78948e4 | 2017-03-26 14:54:25 +0200 | [diff] [blame] | 142 | event.pid, event.comm.decode(), event.sig, event.tpid, event.ret)) |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 143 | |
| 144 | # loop with callback to print_event |
| 145 | b["events"].open_perf_buffer(print_event) |
| 146 | while 1: |
Teng Qin | dbf0029 | 2018-02-28 21:47:50 -0800 | [diff] [blame] | 147 | b.perf_buffer_poll() |