(CommandList children: [ (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:tracing) op: Equal rhs: {(/sys/kernel/debug/tracing)} spids: [148] ) ] spids: [148] ) (Sentence child: (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:flock) op: Equal rhs: {(/var/tmp/.ftrace-lock)} spids: [151] ) ] spids: [151] ) terminator: <Op_Semi ';'> ) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:wroteflock) op:Equal rhs:{(0)} spids:[155])] spids: [155] ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:opt_duration) op:Equal rhs:{(0)} spids:[158])] spids: [158] ) terminator: <Op_Semi ';'> ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:duration) op:Equal rhs:{(EmptyPart)} spids:[162])] spids: [162] ) terminator: <Op_Semi ';'> ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:opt_name) op:Equal rhs:{(0)} spids:[165])] spids: [165] ) terminator: <Op_Semi ';'> ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:name) op:Equal rhs:{(EmptyPart)} spids:[169])] spids: [169] ) terminator: <Op_Semi ';'> ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:opt_pid) op:Equal rhs:{(0)} spids:[172])] spids: [172] ) terminator: <Op_Semi ';'> ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:pid) op:Equal rhs:{(EmptyPart)} spids:[176])] spids: [176] ) terminator: <Op_Semi ';'> ) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:ftext) op:Equal rhs:{(EmptyPart)} spids:[179])] spids: [179] ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:opt_time) op:Equal rhs:{(0)} spids:[181])] spids: [181] ) terminator: <Op_Semi ';'> ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:opt_fail) op:Equal rhs:{(0)} spids:[185])] spids: [185] ) terminator: <Op_Semi ';'> ) (Sentence child: (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:opt_file) op:Equal rhs:{(0)} spids:[189])] spids: [189] ) terminator: <Op_Semi ';'> ) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:file) op:Equal rhs:{(EmptyPart)} spids:[193])] spids: [193] ) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:kevent_entry) op: Equal rhs: {(events/syscalls/sys_enter_kill)} spids: [195] ) ] spids: [195] ) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:kevent_return) op: Equal rhs: {(events/syscalls/sys_exit_kill)} spids: [198] ) ] spids: [198] ) (C {(trap)} {(SQ <':'>)} {(INT)} {(QUIT)} {(TERM)} {(PIPE)} {(HUP)}) (FuncDef name: usage body: (BraceGroup children: [ (SimpleCommand words: [{(cat)}] redirects: [ (HereDoc op_id: Redir_DLessDash fd: 16777215 body: { (DQ ('USAGE: killsnoop [-hst] [-d secs] [-p PID] [-n name] [filename]\n') (' -d seconds # trace duration, and use buffers\n') (' -n name # process name to match \n') (' -p PID # PID to match on kill issue\n') (' -t # include time (seconds)\n') (' -s # human readable signal names\n') (' -h # this usage message\n') (' eg,\n') (' killsnoop # watch kill()s live (unbuffered)\n') (' killsnoop -d 1 # trace 1 sec (buffered)\n') ( ' killsnoop -p 181 # trace kill()s issued to PID 181 only\n' ) ('\n') ('See the man page and example file for more info.\n') ) } do_expansion: True here_end: END was_filled: T spids: [230] ) (Redir op_id:Redir_GreatAnd fd:16777215 arg_word:{(2)} spids:[233]) ] ) (ControlFlow token:<ControlFlow_Exit exit>) ] spids: [225] ) spids: [221 224] ) (FuncDef name: warn body: (BraceGroup children: [ (If arms: [ (if_arm cond: [ (Sentence child: (Pipeline children:[(C {(eval)} {(DQ ($ VSub_At '$@'))})] negated:T) terminator: <Op_Semi ';'> ) ] action: [ (SimpleCommand words: [ {(echo)} { (DQ ('WARNING: command failed ') (EscapedLiteralPart token: <Lit_EscapedChar '\\"'> ) ($ VSub_At '$@') (EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ) } ] redirects: [(Redir op_id:Redir_GreatAnd fd:16777215 arg_word:{(2)} spids:[279])] ) ] spids: [16777215 274] ) ] spids: [16777215 290] ) ] spids: [260] ) spids: [256 259] ) (FuncDef name: end body: (BraceGroup children: [ (SimpleCommand words: [{(echo)}] redirects: [(Redir op_id:Redir_Great fd:2 arg_word:{(/dev/null)} spids:[308])] ) (SimpleCommand words: [{(echo)} {(DQ ('Ending tracing...'))}] redirects: [(Redir op_id:Redir_Great fd:2 arg_word:{(/dev/null)} spids:[318])] ) (C {(cd)} {($ VSub_Name '$tracing')}) (C {(warn)} {(DQ ('echo 0 > ') ($ VSub_Name '$kevent_entry') (/enable))}) (C {(warn)} {(DQ ('echo 0 > ') ($ VSub_Name '$kevent_return') (/enable))}) (C {(warn)} {(DQ ('echo > trace'))}) (AndOr ops: [Op_DAmp] children: [ (DParen child:(ArithVarRef name:wroteflock)) (C {(warn)} {(DQ ('rm ') ($ VSub_Name '$flock'))}) ] ) ] spids: [299] ) spids: [295 298] ) (FuncDef name: die body: (BraceGroup children: [ (SimpleCommand words: [{(echo)} {(DQ ($ VSub_At '$@'))}] redirects: [(Redir op_id:Redir_GreatAnd fd:16777215 arg_word:{(2)} spids:[380])] ) (ControlFlow token:<ControlFlow_Exit exit> arg_word:{(1)}) ] spids: [375] ) spids: [371 374] ) (FuncDef name: edie body: (BraceGroup children: [ (SimpleCommand words: [{(echo)} {(DQ ($ VSub_At '$@'))}] redirects: [(Redir op_id:Redir_GreatAnd fd:16777215 arg_word:{(2)} spids:[408])] ) (SimpleCommand words: [{(exec)}] redirects: [ (Redir op_id: Redir_Great fd: 16777215 arg_word: {(/dev/null)} spids: [418] ) (Redir op_id:Redir_GreatAnd fd:2 arg_word:{(1)} spids:[421]) ] ) (C {(end)}) (ControlFlow token:<ControlFlow_Exit exit> arg_word:{(1)}) ] spids: [399] ) spids: [395 398] ) (While cond: [ (C {(getopts)} {(d) (Lit_Other ':') (hn) (Lit_Other ':') (p) (Lit_Other ':') (st)} {(opt)}) ] body: (DoGroup children: [ (Case to_match: {($ VSub_Name '$opt')} arms: [ (case_arm pat_list: [{(d)}] action: [ (Sentence child: (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:opt_duration) op: Equal rhs: {(1)} spids: [465] ) ] spids: [465] ) terminator: <Op_Semi ';'> ) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:duration) op: Equal rhs: {($ VSub_Name '$OPTARG')} spids: [469] ) ] spids: [469] ) ] spids: [462 463 472 16777215] ) (case_arm pat_list: [{(n)}] action: [ (Sentence child: (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:opt_name) op: Equal rhs: {(1)} spids: [478] ) ] spids: [478] ) terminator: <Op_Semi ';'> ) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:name) op: Equal rhs: {($ VSub_Name '$OPTARG')} spids: [482] ) ] spids: [482] ) ] spids: [475 476 485 16777215] ) (case_arm pat_list: [{(p)}] action: [ (Sentence child: (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:opt_pid) op: Equal rhs: {(1)} spids: [491] ) ] spids: [491] ) terminator: <Op_Semi ';'> ) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:pid) op: Equal rhs: {($ VSub_Name '$OPTARG')} spids: [495] ) ] spids: [495] ) ] spids: [488 489 498 16777215] ) (case_arm pat_list: [{(t)}] action: [ (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:opt_time) op: Equal rhs: {(1)} spids: [504] ) ] spids: [504] ) ] spids: [501 502 507 16777215] ) (case_arm pat_list: [{(s)}] action: [ (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:opt_fancy) op: Equal rhs: {(1)} spids: [513] ) ] spids: [513] ) ] spids: [510 511 516 16777215] ) (case_arm pat_list: [{(h)} {(Lit_Other '?')}] action: [(C {(usage)})] spids: [519 522 526 16777215] ) ] spids: [455 459 529] ) ] spids: [452 531] ) ) (C {(shift)} { (ArithSubPart anode: (ArithBinary op_id: Arith_Minus left: (ArithWord w:{($ VSub_Name '$OPTIND')}) right: (ArithWord w:{(Lit_Digits 1)}) ) spids: [535 544] ) } ) (AndOr ops: [Op_DAmp] children: [(DParen child:(ArithWord w:{($ VSub_Pound '$#')})) (C {(usage)})] ) (AndOr ops: [Op_DAmp] children: [ (DParen child: (ArithBinary op_id: Arith_DAmp left: (ArithVarRef name:opt_pid) right: (ArithVarRef name:opt_name) ) ) (C {(die)} {(DQ ('ERROR: use either -p or -n.'))}) ] ) (AndOr ops: [Op_DAmp] children: [ (DParen child:(ArithVarRef name:opt_pid)) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:ftext) op: Equal rhs: {(DQ (' issued to PID ') ($ VSub_Name '$pid'))} spids: [589] ) ] spids: [589] ) ] ) (AndOr ops: [Op_DAmp] children: [ (DParen child:(ArithVarRef name:opt_name)) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:ftext) op: Equal rhs: { (DQ (' issued by process name ') (EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ($ VSub_Name '$name') (EscapedLiteralPart token:<Lit_EscapedChar '\\"'>) ) } spids: [604] ) ] spids: [604] ) ] ) (If arms: [ (if_arm cond: [ (Sentence child: (DParen child:(ArithVarRef name:opt_duration)) terminator: <Op_Semi ';'> ) ] action: [ (C {(echo)} { (DQ ('Tracing kill()s') ($ VSub_Name '$ftext') (' for ') ($ VSub_Name '$duration') (' seconds (buffered)...') ) } ) ] spids: [16777215 622] ) ] else_action: [(C {(echo)} {(DQ ('Tracing kill()s') ($ VSub_Name '$ftext') ('. Ctrl-C to end.'))})] spids: [635 646] ) (AndOr ops: [Op_DAmp Op_DAmp Op_DAmp Op_DAmp] children: [ (DBracket expr:(BoolUnary op_id:BoolUnary_x child:{(/usr/bin/mawk)})) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:awk) op:Equal rhs:{(DQ (mawk))} spids:[665])] spids: [665] ) (C {(mawk)} {(-W)} {(interactive)}) (C {(Lit_Other '[')} {($ VSub_QMark '$?')} {(-eq)} {(0)} {(Lit_Other ']')}) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:awk) op: Equal rhs: {(DQ ('mawk -W interactive'))} spids: [693] ) ] spids: [693] ) ] ) (AndOr ops: [Op_DAmp] children: [ (DBracket expr:(BoolUnary op_id:BoolUnary_x child:{(/usr/bin/gawk)})) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:awk) op: Equal rhs: {(DQ ('gawk --non-decimal-data'))} spids: [711] ) ] spids: [711] ) ] ) (AndOr ops: [Op_DPipe] children: [ (C {(cd)} {($ VSub_Name '$tracing')}) (C {(die)} { (DQ ('ERROR: accessing tracing. Root user? Kernel has FTRACE?\n') (' debugfs mounted? (mount -t debugfs debugfs /sys/kernel/debug)') ) } ) ] ) (AndOr ops: [Op_DAmp] children: [ (DBracket expr:(BoolUnary op_id:BoolUnary_e child:{($ VSub_Name '$flock')})) (C {(die)} { (DQ ('ERROR: ftrace may be in use by PID ') (CommandSubPart command_list: (CommandList children:[(C {(cat)} {($ VSub_Name '$flock')})]) left_token: <Left_CommandSub '$('> spids: [751 755] ) (' ') ($ VSub_Name '$flock') ) } ) ] ) (AndOr ops: [Op_DPipe] children: [ (SimpleCommand words: [{(echo)} {($ VSub_Dollar '$$')}] redirects: [ (Redir op_id: Redir_Great fd: 16777215 arg_word: {($ VSub_Name '$flock')} spids: [764] ) ] ) (C {(die)} {(DQ ('ERROR: unable to write ') ($ VSub_Name '$flock') (.))}) ] ) (Assignment keyword: Assign_None pairs: [(assign_pair lhs:(LhsName name:wroteflock) op:Equal rhs:{(1)} spids:[778])] spids: [778] ) (SimpleCommand words: [{(echo)} {(nop)}] redirects: [(Redir op_id:Redir_Great fd:16777215 arg_word:{(current_tracer)} spids:[789])] ) (If arms: [ (if_arm cond: [ (Sentence child: (Pipeline children: [ (SimpleCommand words: [{(echo)} {(1)}] redirects: [ (Redir op_id: Redir_Great fd: 16777215 arg_word: {($ VSub_Name '$kevent_entry') (/enable)} spids: [801] ) ] ) ] negated: T ) terminator: <Op_Semi ';'> ) ] action: [(C {(edie)} {(DQ ('ERROR: enabling kill() entry tracepoint Exiting.'))})] spids: [16777215 807] ) ] spids: [16777215 816] ) (If arms: [ (if_arm cond: [ (Sentence child: (Pipeline children: [ (SimpleCommand words: [{(echo)} {(1)}] redirects: [ (Redir op_id: Redir_Great fd: 16777215 arg_word: {($ VSub_Name '$kevent_return') (/enable)} spids: [826] ) ] ) ] negated: T ) terminator: <Op_Semi ';'> ) ] action: [(C {(edie)} {(DQ ('ERROR: enabling kill() return tracepoint. Exiting.'))})] spids: [16777215 832] ) ] spids: [16777215 841] ) (AndOr ops: [Op_DAmp] children: [ (DParen child:(ArithVarRef name:opt_time)) (C {(printf)} {(DQ ('%-16s '))} {(DQ (TIMEs))}) ] ) (C {(printf)} {(DQ ('%-16.16s %-6s %-8s %-10s %4s') (Lit_Other '\\') (n))} {(DQ (COMM))} {(DQ (PID))} {(DQ (TPID))} {(DQ (SIGNAL))} {(DQ (RETURN))} ) (Assignment keyword: Assign_None pairs: [ (assign_pair lhs: (LhsName name:offset) op: Equal rhs: { (CommandSubPart command_list: (CommandList children: [ (C {($ VSub_Name '$awk')} { (SQ <'BEGIN { o = 0; }\n'> <' $1 == "#" && $2 ~ /TASK/ && NF == 6 { o = 1; }\n'> <' $2 ~ /TASK/ { print o; exit }'> ) } {(trace)} ) ] ) left_token: <Left_CommandSub '$('> spids: [913 923] ) } spids: [912] ) ] spids: [912] ) (C {(warn)} {(DQ ('echo > trace'))}) (Pipeline children: [ (Subshell child: (If arms: [ (if_arm cond: [ (Sentence child: (DParen child:(ArithVarRef name:opt_duration)) terminator: <Op_Semi ';'> ) ] action: [(C {(sleep)} {($ VSub_Name '$duration')}) (C {(cat)} {(trace)})] spids: [16777215 947] ) ] else_action: [(C {(cat)} {(trace_pipe)})] spids: [963 974] ) spids: [935 976] ) (C {($ VSub_Name '$awk')} {(-v)} {(Lit_VarLike 'o=') ($ VSub_Name '$offset')} {(-v)} {(Lit_VarLike 'opt_name=') ($ VSub_Name '$opt_name')} {(-v)} {(Lit_VarLike 'name=') ($ VSub_Name '$name')} {(-v)} {(Lit_VarLike 'opt_duration=') ($ VSub_Name '$opt_duration')} {(-v)} {(Lit_VarLike 'opt_time=') ($ VSub_Name '$opt_time')} {(-v)} {(Lit_VarLike 'opt_pid=') ($ VSub_Name '$pid')} {(-v)} {(Lit_VarLike 'opt_fancy=') ($ VSub_Name '$opt_fancy')} { (SQ <'\n'> <' # fancy signal names\n'> <' BEGIN {\n'> <' signals[1] = "SIGHUP"\n'> <' signals[2] = "SIGINT"\n'> <' signals[3] = "SIGQUIT"\n'> <' signals[4] = "SIGILL"\n'> <' signals[6] = "SIGABRT"\n'> <' signals[8] = "SIGFPE"\n'> <' signals[9] = "SIGKILL"\n'> <' signals[11] = "SIGSEGV"\n'> <' signals[13] = "SIGPIPE"\n'> <' signals[14] = "SIGALRM"\n'> <' signals[15] = "SIGTERM"\n'> <' signals[10] = "SIGUSR1"\n'> <' signals[12] = "SIGUSR2"\n'> <' signals[17] = "SIGCHLD"\n'> <' signals[18] = "SIGCONT"\n'> <' signals[19] = "SIGSTOP"\n'> <' signals[20] = "SIGTSTP"\n'> <' signals[21] = "SIGTTIN"\n'> <' signals[22] = "SIGTTOU"\n'> <' }\n'> <'\n'> <' # common fields\n'> <' $1 != "#" {\n'> <' # task name can contain dashes\n'> <' comm = pid = $1\n'> <' sub(/-[0-9][0-9]*/, "", comm)\n'> <' if (opt_name && match(comm, name) == 0)\n'> <' next\n'> <' sub(/.*-/, "", pid)\n'> <' }\n'> <'\n'> <' # sys_kill() entry\n'> <' $1 != "#" && $(4+o) ~ /sys_kill/ && $(5+o) !~ /->/ {\n'> <' #\n'> <' # eg: ... sys_kill(pid:...\n'> <' #\n'> <' kpid = $(5+o)\n'> <' signal = $(7+o)\n'> <' sub(/,$/, "", kpid)\n'> <' sub(/\\)$/, "", signal)\n'> <' kpid = int("0x"kpid)\n'> <' signal = int("0x"signal)\n'> <' current[pid,"kpid"] = kpid\n'> <' current[pid,"signal"] = signal\n'> <' }\n'> <'\n'> <' # sys_kill exit\n'> <' $1 != "#" && $(5+o) ~ /->/ {\n'> <' rv = int($NF)\n'> <' killed_pid = current[pid,"kpid"]\n'> <' signal = current[pid,"signal"]\n'> <'\n'> <' delete current[pid,"kpid"]\n'> <' delete current[pid,"signal"]\n'> <'\n'> <' if(opt_pid && killed_pid != opt_pid) {\n'> <' next\n'> <' }\n'> <'\n'> <' if (opt_time) {\n'> <' time = $(3+o); sub(":", "", time)\n'> <' printf "%-16s ", time\n'> <' }\n'> <'\n'> <' if (opt_fancy) {\n'> <' if (signals[signal] != "") {\n'> <' signal = signals[signal]\n'> <' }\n'> <' }\n'> <'\n'> < ' printf "%-16.16s %-6s %-8s %-10s %-4s\\n", comm, pid, killed_pid, signal,\n' > <' rv\n'> <' }\n'> <'\n'> <' $0 ~ /LOST.*EVENTS/ { print "WARNING: " $0 > "/dev/stderr" }\n'> ) } ) ] negated: F ) (C {(end)}) ] )