Alexey Ivanov | cc01a9c | 2019-01-16 09:50:46 -0800 | [diff] [blame] | 1 | #!/usr/bin/python |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 2 | # @lint-avoid-python-3-compatibility-imports |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 3 | # |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 4 | # killsnoop Trace signals issued by the kill() syscall. |
| 5 | # For Linux, uses BCC, eBPF. Embedded C. |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 6 | # |
Junli Ou | 5eee5ff | 2016-08-13 17:12:45 +0800 | [diff] [blame] | 7 | # USAGE: killsnoop [-h] [-x] [-p PID] |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 8 | # |
| 9 | # Copyright (c) 2015 Brendan Gregg. |
| 10 | # Licensed under the Apache License, Version 2.0 (the "License") |
| 11 | # |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 12 | # 20-Sep-2015 Brendan Gregg Created this. |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 13 | # 19-Feb-2016 Allan McAleavy migrated to BPF_PERF_OUTPUT |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 14 | |
| 15 | from __future__ import print_function |
| 16 | from bcc import BPF |
Brenden Blanco | e8001c3 | 2018-07-23 08:15:56 -0700 | [diff] [blame] | 17 | from bcc.utils import ArgString, printb |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 18 | import argparse |
Junli Ou | 5eee5ff | 2016-08-13 17:12:45 +0800 | [diff] [blame] | 19 | from time import strftime |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 20 | |
| 21 | # arguments |
| 22 | examples = """examples: |
| 23 | ./killsnoop # trace all kill() signals |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 24 | ./killsnoop -x # only show failed kills |
| 25 | ./killsnoop -p 181 # only trace PID 181 |
synical | 7cecd79 | 2020-05-26 11:16:52 -0400 | [diff] [blame] | 26 | ./killsnoop -s 9 # only trace signal 9 |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 27 | """ |
| 28 | parser = argparse.ArgumentParser( |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 29 | description="Trace signals issued by the kill() syscall", |
| 30 | formatter_class=argparse.RawDescriptionHelpFormatter, |
| 31 | epilog=examples) |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 32 | parser.add_argument("-x", "--failed", action="store_true", |
Chris Down | 8ddcbdf | 2016-07-13 15:18:35 +0100 | [diff] [blame] | 33 | help="only show failed kill syscalls") |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 34 | parser.add_argument("-p", "--pid", |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 35 | help="trace this PID only") |
synical | 076a354 | 2020-05-23 12:40:09 -0400 | [diff] [blame] | 36 | parser.add_argument("-s", "--signal", |
| 37 | help="trace this signal only") |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 38 | parser.add_argument("--ebpf", action="store_true", |
| 39 | help=argparse.SUPPRESS) |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 40 | args = parser.parse_args() |
| 41 | debug = 0 |
| 42 | |
| 43 | # define BPF program |
| 44 | bpf_text = """ |
| 45 | #include <uapi/linux/ptrace.h> |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 46 | #include <linux/sched.h> |
| 47 | |
| 48 | struct val_t { |
| 49 | u64 pid; |
mcaleavya | 6262f5d | 2016-02-19 23:48:20 +0000 | [diff] [blame] | 50 | int sig; |
| 51 | int tpid; |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 52 | char comm[TASK_COMM_LEN]; |
| 53 | }; |
| 54 | |
| 55 | struct data_t { |
| 56 | u64 pid; |
Brendan Gregg | 1298998 | 2016-09-14 08:15:09 -0700 | [diff] [blame] | 57 | int tpid; |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 58 | int sig; |
| 59 | int ret; |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 60 | char comm[TASK_COMM_LEN]; |
| 61 | }; |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 62 | |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 63 | BPF_HASH(infotmp, u32, struct val_t); |
| 64 | BPF_PERF_OUTPUT(events); |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 65 | |
yonghong-song | 2da3426 | 2018-06-13 06:12:22 -0700 | [diff] [blame] | 66 | int syscall__kill(struct pt_regs *ctx, int tpid, int sig) |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 67 | { |
Hengqi Chen | f0a0dc7 | 2021-05-20 22:49:25 +0800 | [diff] [blame] | 68 | u64 pid_tgid = bpf_get_current_pid_tgid(); |
| 69 | u32 pid = pid_tgid >> 32; |
| 70 | u32 tid = (u32)pid_tgid; |
| 71 | |
synical | 076a354 | 2020-05-23 12:40:09 -0400 | [diff] [blame] | 72 | PID_FILTER |
| 73 | SIGNAL_FILTER |
Brendan Gregg | 1298998 | 2016-09-14 08:15:09 -0700 | [diff] [blame] | 74 | |
| 75 | struct val_t val = {.pid = pid}; |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 76 | if (bpf_get_current_comm(&val.comm, sizeof(val.comm)) == 0) { |
mcaleavya | 6262f5d | 2016-02-19 23:48:20 +0000 | [diff] [blame] | 77 | val.tpid = tpid; |
| 78 | val.sig = sig; |
Hengqi Chen | f0a0dc7 | 2021-05-20 22:49:25 +0800 | [diff] [blame] | 79 | infotmp.update(&tid, &val); |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 80 | } |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 81 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 82 | return 0; |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 83 | }; |
| 84 | |
Yonghong Song | 6433569 | 2018-04-25 00:40:13 -0700 | [diff] [blame] | 85 | int do_ret_sys_kill(struct pt_regs *ctx) |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 86 | { |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 87 | struct data_t data = {}; |
| 88 | struct val_t *valp; |
Hengqi Chen | f0a0dc7 | 2021-05-20 22:49:25 +0800 | [diff] [blame] | 89 | u64 pid_tgid = bpf_get_current_pid_tgid(); |
| 90 | u32 pid = pid_tgid >> 32; |
| 91 | u32 tid = (u32)pid_tgid; |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 92 | |
Hengqi Chen | f0a0dc7 | 2021-05-20 22:49:25 +0800 | [diff] [blame] | 93 | valp = infotmp.lookup(&tid); |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 94 | if (valp == 0) { |
| 95 | // missed entry |
| 96 | return 0; |
| 97 | } |
| 98 | |
Sumanth Korikkar | 7f6066d | 2020-05-20 10:49:56 -0500 | [diff] [blame] | 99 | bpf_probe_read_kernel(&data.comm, sizeof(data.comm), valp->comm); |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 100 | data.pid = pid; |
mcaleavya | 6262f5d | 2016-02-19 23:48:20 +0000 | [diff] [blame] | 101 | data.tpid = valp->tpid; |
Naveen N. Rao | 4afa96a | 2016-05-03 14:54:21 +0530 | [diff] [blame] | 102 | data.ret = PT_REGS_RC(ctx); |
mcaleavya | 6262f5d | 2016-02-19 23:48:20 +0000 | [diff] [blame] | 103 | data.sig = valp->sig; |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 104 | |
| 105 | events.perf_submit(ctx, &data, sizeof(data)); |
Hengqi Chen | f0a0dc7 | 2021-05-20 22:49:25 +0800 | [diff] [blame] | 106 | infotmp.delete(&tid); |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 107 | |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 108 | return 0; |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 109 | } |
| 110 | """ |
| 111 | if args.pid: |
synical | 076a354 | 2020-05-23 12:40:09 -0400 | [diff] [blame] | 112 | bpf_text = bpf_text.replace('PID_FILTER', |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 113 | 'if (pid != %s) { return 0; }' % args.pid) |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 114 | else: |
synical | 076a354 | 2020-05-23 12:40:09 -0400 | [diff] [blame] | 115 | bpf_text = bpf_text.replace('PID_FILTER', '') |
| 116 | if args.signal: |
| 117 | bpf_text = bpf_text.replace('SIGNAL_FILTER', |
| 118 | 'if (sig != %s) { return 0; }' % args.signal) |
| 119 | else: |
| 120 | bpf_text = bpf_text.replace('SIGNAL_FILTER', '') |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 121 | if debug or args.ebpf: |
Alexei Starovoitov | bdf0773 | 2016-01-14 10:09:20 -0800 | [diff] [blame] | 122 | print(bpf_text) |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 123 | if args.ebpf: |
| 124 | exit() |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 125 | |
| 126 | # initialize BPF |
| 127 | b = BPF(text=bpf_text) |
Yonghong Song | 6433569 | 2018-04-25 00:40:13 -0700 | [diff] [blame] | 128 | kill_fnname = b.get_syscall_fnname("kill") |
yonghong-song | 2da3426 | 2018-06-13 06:12:22 -0700 | [diff] [blame] | 129 | b.attach_kprobe(event=kill_fnname, fn_name="syscall__kill") |
Yonghong Song | 6433569 | 2018-04-25 00:40:13 -0700 | [diff] [blame] | 130 | b.attach_kretprobe(event=kill_fnname, fn_name="do_ret_sys_kill") |
| 131 | |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 132 | # header |
Junli Ou | 5eee5ff | 2016-08-13 17:12:45 +0800 | [diff] [blame] | 133 | print("%-9s %-6s %-16s %-4s %-6s %s" % ( |
| 134 | "TIME", "PID", "COMM", "SIG", "TPID", "RESULT")) |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 135 | |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 136 | # process event |
| 137 | def print_event(cpu, data, size): |
Xiaozhou Liu | 51d62d3 | 2019-02-15 13:03:05 +0800 | [diff] [blame] | 138 | event = b["events"].event(data) |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 139 | |
Brendan Gregg | 1298998 | 2016-09-14 08:15:09 -0700 | [diff] [blame] | 140 | if (args.failed and (event.ret >= 0)): |
| 141 | return |
Brendan Gregg | d9e578b | 2015-09-21 11:59:42 -0700 | [diff] [blame] | 142 | |
yonghong-song | 1d23480 | 2018-10-11 08:32:04 -0700 | [diff] [blame] | 143 | printb(b"%-9s %-6d %-16s %-4d %-6d %d" % (strftime("%H:%M:%S").encode('ascii'), |
Brenden Blanco | e8001c3 | 2018-07-23 08:15:56 -0700 | [diff] [blame] | 144 | event.pid, event.comm, event.sig, event.tpid, event.ret)) |
mcaleavya | f5c40cb | 2016-02-19 23:02:39 +0000 | [diff] [blame] | 145 | |
| 146 | # loop with callback to print_event |
| 147 | b["events"].open_perf_buffer(print_event) |
| 148 | while 1: |
Jerome Marchand | 5167127 | 2018-12-19 01:57:24 +0100 | [diff] [blame] | 149 | try: |
| 150 | b.perf_buffer_poll() |
| 151 | except KeyboardInterrupt: |
| 152 | exit() |