Commit eff67bfb authored by Brendan Gregg's avatar Brendan Gregg

Merge pull request #404 from mcaleavya/master

Migrated killsnoop to bpf_perf_event
parents ca6ac5ad 6262f5d9
...@@ -11,6 +11,10 @@ is sending signals. ...@@ -11,6 +11,10 @@ is sending signals.
This works by tracing the kernel sys_kill() function using dynamic tracing, and This works by tracing the kernel sys_kill() function using dynamic tracing, and
will need updating to match any changes to this function. will need updating to match any changes to this function.
This makes use of a Linux 4.5 feature (bpf_perf_event_output());
for kernels older than 4.5, see the version under tools/old,
which uses an older mechanism.
Since this uses BPF, only the root user can use this tool. Since this uses BPF, only the root user can use this tool.
.SH REQUIREMENTS .SH REQUIREMENTS
CONFIG_BPF and bcc. CONFIG_BPF and bcc.
......
...@@ -10,10 +10,12 @@ ...@@ -10,10 +10,12 @@
# Licensed under the Apache License, Version 2.0 (the "License") # Licensed under the Apache License, Version 2.0 (the "License")
# #
# 20-Sep-2015 Brendan Gregg Created this. # 20-Sep-2015 Brendan Gregg Created this.
# 19-Feb-2016 Allan McAleavy migrated to BPF_PERF_OUTPUT
from __future__ import print_function from __future__ import print_function
from bcc import BPF from bcc import BPF
import argparse import argparse
import ctypes as ct
# arguments # arguments
examples = """examples: examples = """examples:
...@@ -38,35 +40,69 @@ debug = 0 ...@@ -38,35 +40,69 @@ debug = 0
# define BPF program # define BPF program
bpf_text = """ bpf_text = """
#include <uapi/linux/ptrace.h> #include <uapi/linux/ptrace.h>
#include <linux/sched.h>
struct val_t {
u64 pid;
u64 ts;
int sig;
int tpid;
char comm[TASK_COMM_LEN];
};
struct data_t {
u64 pid;
u64 tpid;
int sig;
int ret;
u64 ts;
u64 delta;
char comm[TASK_COMM_LEN];
};
BPF_HASH(args_pid, u32, int); BPF_HASH(infotmp, u32, struct val_t);
BPF_HASH(args_sig, u32, int); BPF_PERF_OUTPUT(events);
int kprobe__sys_kill(struct pt_regs *ctx, int tpid, int sig) int kprobe__sys_kill(struct pt_regs *ctx, int tpid, int sig)
{ {
struct val_t val = {};
u32 pid = bpf_get_current_pid_tgid(); u32 pid = bpf_get_current_pid_tgid();
FILTER FILTER
args_pid.update(&pid, &tpid); if (bpf_get_current_comm(&val.comm, sizeof(val.comm)) == 0) {
args_sig.update(&pid, &sig); val.pid = bpf_get_current_pid_tgid();
val.ts = bpf_ktime_get_ns();
val.tpid = tpid;
val.sig = sig;
infotmp.update(&pid, &val);
}
return 0; return 0;
}; };
int kretprobe__sys_kill(struct pt_regs *ctx) int kretprobe__sys_kill(struct pt_regs *ctx)
{ {
int *tpidp, *sigp, ret = ctx->ax; struct data_t data = {};
struct val_t *valp;
u32 pid = bpf_get_current_pid_tgid(); u32 pid = bpf_get_current_pid_tgid();
u64 tsp = bpf_ktime_get_ns();
tpidp = args_pid.lookup(&pid); valp = infotmp.lookup(&pid);
sigp = args_sig.lookup(&pid); if (valp == 0) {
if (tpidp == 0 || sigp == 0) { // missed entry
return 0; // missed entry return 0;
} }
bpf_trace_printk("%d %d %d\\n", *tpidp, *sigp, ret); bpf_probe_read(&data.comm, sizeof(data.comm), valp->comm);
args_pid.delete(&pid); data.pid = pid;
args_sig.delete(&pid); data.delta = tsp - valp->ts;
data.ts = tsp / 1000;
data.tpid = valp->tpid;
data.ret = ctx->ax;
data.sig = valp->sig;
events.perf_submit(ctx, &data, sizeof(data));
infotmp.delete(&pid);
return 0; return 0;
} }
...@@ -82,25 +118,57 @@ if debug: ...@@ -82,25 +118,57 @@ if debug:
# initialize BPF # initialize BPF
b = BPF(text=bpf_text) b = BPF(text=bpf_text)
TASK_COMM_LEN = 16 # linux/sched.h
class Data(ct.Structure):
_fields_ = [
("pid", ct.c_ulonglong),
("tpid", ct.c_ulonglong),
("sig", ct.c_int),
("ret", ct.c_int),
("ts", ct.c_ulonglong),
("delta", ct.c_ulonglong),
("comm", ct.c_char * TASK_COMM_LEN)
]
start_ts = 0
prev_ts = 0
delta = 0
# header # header
if args.timestamp: if args.timestamp:
print("%-14s" % ("TIME(s)"), end="") print("%-14s" % ("TIME(s)"), end="")
print("%-6s %-16s %-4s %-6s %s" % ("PID", "COMM", "SIG", "TPID", "RESULT")) print("%-6s %-16s %-4s %-6s %s" % ("PID", "COMM", "SIG", "TPID", "RESULT"))
start_ts = 0 # process event
def print_event(cpu, data, size):
event = ct.cast(data, ct.POINTER(Data)).contents
global start_ts
global prev_ts
global delta
# format output if start_ts == 0:
while 1: prev_ts = start_ts
(task, pid, cpu, flags, ts, msg) = b.trace_fields()
(tpid_s, sig_s, ret_s) = msg.split(" ") if start_ts == 1:
delta = float(delta) + (event.ts - prev_ts)
ret = int(ret_s) if (args.failed and (event.ret >= 0)):
if (args.failed and (ret >= 0)): start_ts = 1
continue prev_ts = event.ts
return
# print columns # print columns
if args.timestamp: if args.timestamp:
if start_ts == 0: print("%-14.9f" % (delta / 1000000), end="")
start_ts = ts
print("%-14.9f" % (ts - start_ts), end="") print("%-6d %-16s %-4d %-6d %d" % (event.pid, event.comm, event.sig,
print("%-6d %-16s %-4s %-6s %s" % (pid, task, sig_s, tpid_s, ret_s)) event.tpid, event.ret))
prev_ts = event.ts
start_ts = 1
# loop with callback to print_event
b["events"].open_perf_buffer(print_event)
while 1:
b.kprobe_poll()
#!/usr/bin/python
# @lint-avoid-python-3-compatibility-imports
#
# killsnoop Trace signals issued by the kill() syscall.
# For Linux, uses BCC, eBPF. Embedded C.
#
# USAGE: killsnoop [-h] [-t] [-x] [-p PID]
#
# Copyright (c) 2015 Brendan Gregg.
# Licensed under the Apache License, Version 2.0 (the "License")
#
# 20-Sep-2015 Brendan Gregg Created this.
from __future__ import print_function
from bcc import BPF
import argparse
# arguments
examples = """examples:
./killsnoop # trace all kill() signals
./killsnoop -t # include timestamps
./killsnoop -x # only show failed kills
./killsnoop -p 181 # only trace PID 181
"""
parser = argparse.ArgumentParser(
description="Trace signals issued by the kill() syscall",
formatter_class=argparse.RawDescriptionHelpFormatter,
epilog=examples)
parser.add_argument("-t", "--timestamp", action="store_true",
help="include timestamp on output")
parser.add_argument("-x", "--failed", action="store_true",
help="only show failed opens")
parser.add_argument("-p", "--pid",
help="trace this PID only")
args = parser.parse_args()
debug = 0
# define BPF program
bpf_text = """
#include <uapi/linux/ptrace.h>
BPF_HASH(args_pid, u32, int);
BPF_HASH(args_sig, u32, int);
int kprobe__sys_kill(struct pt_regs *ctx, int tpid, int sig)
{
u32 pid = bpf_get_current_pid_tgid();
FILTER
args_pid.update(&pid, &tpid);
args_sig.update(&pid, &sig);
return 0;
};
int kretprobe__sys_kill(struct pt_regs *ctx)
{
int *tpidp, *sigp, ret = ctx->ax;
u32 pid = bpf_get_current_pid_tgid();
tpidp = args_pid.lookup(&pid);
sigp = args_sig.lookup(&pid);
if (tpidp == 0 || sigp == 0) {
return 0; // missed entry
}
bpf_trace_printk("%d %d %d\\n", *tpidp, *sigp, ret);
args_pid.delete(&pid);
args_sig.delete(&pid);
return 0;
}
"""
if args.pid:
bpf_text = bpf_text.replace('FILTER',
'if (pid != %s) { return 0; }' % args.pid)
else:
bpf_text = bpf_text.replace('FILTER', '')
if debug:
print(bpf_text)
# initialize BPF
b = BPF(text=bpf_text)
# header
if args.timestamp:
print("%-14s" % ("TIME(s)"), end="")
print("%-6s %-16s %-4s %-6s %s" % ("PID", "COMM", "SIG", "TPID", "RESULT"))
start_ts = 0
# format output
while 1:
(task, pid, cpu, flags, ts, msg) = b.trace_fields()
(tpid_s, sig_s, ret_s) = msg.split(" ")
ret = int(ret_s)
if (args.failed and (ret >= 0)):
continue
# print columns
if args.timestamp:
if start_ts == 0:
start_ts = ts
print("%-14.9f" % (ts - start_ts), end="")
print("%-6d %-16s %-4s %-6s %s" % (pid, task, sig_s, tpid_s, ret_s))
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment