// Copyright (C) 2005, 2006 IBM Corp. // // This file is part of systemtap, and is free software. You can // redistribute it and/or modify it under the terms of the GNU General // Public License (GPL); either version 2, or (at your option) any // later version. /* the trace hooks defined here are used by lket internally and they will be turned on by default */ /* record the newly created process name */ function log_execve_tracedata(var:long) %{ long tmp=(long)THIS->var; _lket_trace(_GROUP_PROCESS, _HOOKID_PROCESS_EXECVE, "%4b%4b%4b%0s", (_FMT_)current->pid, (_FMT_)current->tgid, (_FMT_)current->parent->tgid, (char *)tmp /* FIXME: deref hazard! */); %} /* record the newly forked process id */ function log_fork_tracedata(task:long) %{ /* pid_t pid = (pid_t)THIS->var; _lket_trace(_GROUP_PROCESS, THIS->var_id, "%4b", (_FMT_)pid); */ struct task_struct *task = (struct task_struct *)((long)THIS->task); struct task_struct *parent = kread(&(task->parent)); _lket_trace(_GROUP_PROCESS, _HOOKID_PROCESS_FORK, "%4b%4b%4b", (_FMT_)kread(&(task->pid)), (_FMT_)kread(&(task->tgid)), (_FMT_)kread(&(parent->tgid))); CATCH_DEREF_FAULT(); %} /************************************************************ * This function could be used to take a snapshot of all the * * processes. It's not a probe, so the data format doesn't * * follow the format used by probe handlers * ************************************************************/ function process_snapshot() %{ struct task_struct *tsk; struct list_head *cur, *head; _stp_pbuf *pb; int cpu = smp_processor_id(); char *total_length; head = &(current->tasks); /* iterate all the processes, and record the pid and process name for each entry */ /* FIXME: need some sort of lock before doing this! */ for_each_process(tsk) { _lket_trace(_GROUP_PROCESS, _HOOKID_PROCESS_SNAPSHOT, "%4b%4b%4b%0s", (_FMT_)tsk->pid, (_FMT_)tsk->tgid, (_FMT_)tsk->parent->tgid, tsk->comm); #if !defined(ASCII_TRACE) pb = per_cpu_ptr(Stp_pbuf, smp_processor_id()); total_length = &(pb->buf[0]); *(int16_t *)total_length = pb->len - 4; #endif _stp_print_flush(); } %} probe addevent.process = addevent.process.exit {} probe addevent.process.exit = addevent.process.exit.entry {} probe addevent.process.exit.entry += _addevent.process.exit.entry { update_record() } probe _addevent.process.exit.entry = process.exit { log_process_exit(code) } function log_process_exit(code:long) %{ _lket_trace(_GROUP_PROCESS, _HOOKID_PROCESS_EXIT_ENTRY, "%8b", THIS->code); %} probe lket_internal.process { } probe lket_internal.process = lket_internal.process.execve, lket_internal.process.fork {} /* we should capture both do_execve for 64-bit app and compat_do_execve for 32-bit app */ probe lket_internal.process.execve += _lket_internal.process.execve { update_record() } probe _lket_internal.process.execve = process.exec { if(stoptrace_exec==1) next; log_execve_tracedata($filename) } probe lket_internal.process.fork += _lket_internal.process.fork { update_record() } probe _lket_internal.process.fork = process.create { if(stoptrace_fork==1) next; log_fork_tracedata($return) }