(command.CommandList children: [ (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:tracing) op: assign_op.Equal rhs: {<'/sys/kernel/debug/tracing'>} spids: [148] ) ] ) (command.CommandList children: [ (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:flock) op: assign_op.Equal rhs: {<'/var/tmp/.ftrace-lock'>} spids: [151] ) ] ) terminator: <Id.Op_Semi _> ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:wroteflock) op: assign_op.Equal rhs: {<0>} spids: [155] ) ] ) ] ) (command.CommandList children: [ (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:opt_duration) op: assign_op.Equal rhs: {<0>} spids: [158] ) ] ) terminator: <Id.Op_Semi _> ) (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:duration) op: assign_op.Equal rhs: (word.Empty) spids: [162] ) ] ) terminator: <Id.Op_Semi _> ) (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:opt_name) op: assign_op.Equal rhs: {<0>} spids: [165] ) ] ) terminator: <Id.Op_Semi _> ) (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:name) op: assign_op.Equal rhs: (word.Empty) spids: [169] ) ] ) terminator: <Id.Op_Semi _> ) (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:opt_pid) op: assign_op.Equal rhs: {<0>} spids: [172] ) ] ) terminator: <Id.Op_Semi _> ) (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:pid) op: assign_op.Equal rhs: (word.Empty) spids: [176] ) ] ) terminator: <Id.Op_Semi _> ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:ftext) op: assign_op.Equal rhs: (word.Empty) spids: [179] ) ] ) ] ) (command.CommandList children: [ (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:opt_time) op: assign_op.Equal rhs: {<0>} spids: [181] ) ] ) terminator: <Id.Op_Semi _> ) (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:opt_fail) op: assign_op.Equal rhs: {<0>} spids: [185] ) ] ) terminator: <Id.Op_Semi _> ) (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:opt_file) op: assign_op.Equal rhs: {<0>} spids: [189] ) ] ) terminator: <Id.Op_Semi _> ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:file) op: assign_op.Equal rhs: (word.Empty) spids: [193] ) ] ) ] ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:kevent_entry) op: assign_op.Equal rhs: {<'events/syscalls/sys_enter_kill'>} spids: [195] ) ] ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:kevent_return) op: assign_op.Equal rhs: {<'events/syscalls/sys_exit_kill'>} spids: [198] ) ] ) (C {<trap>} {(SQ <':'>)} {<INT>} {<QUIT>} {<TERM>} {<PIPE>} {<HUP>}) (command.ShFunction name: usage body: (BraceGroup children: [ (command.Simple words: [{<cat>}] redirects: [ (redir op: <Id.Redir_DLessDash '<<-'> loc: (redir_loc.Fd fd:0) arg: (redir_param.HereDoc here_begin: {<END>} here_end_span_id: 250 stdin_parts: [ <'USAGE: killsnoop [-hst] [-d secs] [-p PID] [-n name] [filename]\n'> <' -d seconds # trace duration, and use buffers\n'> <' -n name # process name to match \n'> <' -p PID # PID to match on kill issue\n'> <' -t # include time (seconds)\n'> <' -s # human readable signal names\n'> <' -h # this usage message\n'> <' eg,\n'> <' killsnoop # watch kill()s live (unbuffered)\n'> <' killsnoop -d 1 # trace 1 sec (buffered)\n'> < ' killsnoop -p 181 # trace kill()s issued to PID 181 only\n' > <'\n'> <'See the man page and example file for more info.\n'> ] ) ) (redir op:<Id.Redir_GreatAnd '>&'> loc:(redir_loc.Fd fd:1) arg:{<2>}) ] do_fork: T ) (command.ControlFlow token:<Id.ControlFlow_Exit exit>) ] ) ) (command.ShFunction name: warn body: (BraceGroup children: [ (command.If arms: [ (if_arm cond: (condition.Shell commands: [ (command.Sentence child: (command.Pipeline children: [(C {<eval>} {(DQ ($ Id.VSub_At '$@'))})] negated: T ) terminator: <Id.Op_Semi _> ) ] ) action: [ (command.Simple words: [ {<echo>} { (DQ <'WARNING: command failed '> (word_part.EscapedLiteral token: <Id.Lit_EscapedChar '\\"'> ) ($ Id.VSub_At '$@') (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\"'>) ) } ] redirects: [(redir op:<Id.Redir_GreatAnd '>&'> loc:(redir_loc.Fd fd:1) arg:{<2>})] do_fork: T ) ] spids: [264 275] ) ] ) ] ) ) (command.ShFunction name: end body: (BraceGroup children: [ (command.Simple words: [{<echo>}] redirects: [(redir op:<Id.Redir_Great '2>'> loc:(redir_loc.Fd fd:2) arg:{<'/dev/null'>})] do_fork: T ) (command.Simple words: [{<echo>} {(DQ <'Ending tracing...'>)}] redirects: [(redir op:<Id.Redir_Great '2>'> loc:(redir_loc.Fd fd:2) arg:{<'/dev/null'>})] do_fork: T ) (C {<cd>} {($ Id.VSub_DollarName '$tracing')}) (C {<warn>} {(DQ <'echo 0 > '> ($ Id.VSub_DollarName '$kevent_entry') <'/enable'>)}) (C {<warn>} {(DQ <'echo 0 > '> ($ Id.VSub_DollarName '$kevent_return') <'/enable'>)}) (C {<warn>} {(DQ <'echo > trace'>)}) (command.AndOr ops: [Id.Op_DAmp] children: [ (command.DParen child:<Id.Lit_ArithVarLike wroteflock>) (C {<warn>} {(DQ <'rm '> ($ Id.VSub_DollarName '$flock'))}) ] ) ] ) ) (command.ShFunction name: die body: (BraceGroup children: [ (command.Simple words: [{<echo>} {(DQ ($ Id.VSub_At '$@'))}] redirects: [(redir op:<Id.Redir_GreatAnd '>&'> loc:(redir_loc.Fd fd:1) arg:{<2>})] do_fork: T ) (command.ControlFlow token:<Id.ControlFlow_Exit exit> arg_word:{<1>}) ] ) ) (command.ShFunction name: edie body: (BraceGroup children: [ (command.Simple words: [{<echo>} {(DQ ($ Id.VSub_At '$@'))}] redirects: [(redir op:<Id.Redir_GreatAnd '>&'> loc:(redir_loc.Fd fd:1) arg:{<2>})] do_fork: T ) (command.Simple words: [{<exec>}] redirects: [ (redir op: <Id.Redir_Great '>'> loc: (redir_loc.Fd fd:1) arg: {<'/dev/null'>} ) (redir op:<Id.Redir_GreatAnd '2>&'> loc:(redir_loc.Fd fd:2) arg:{<1>}) ] do_fork: T ) (C {<end>}) (command.ControlFlow token:<Id.ControlFlow_Exit exit> arg_word:{<1>}) ] ) ) (command.WhileUntil keyword: <Id.KW_While while> cond: (condition.Shell commands: [ (C {<getopts>} {<d> <Id.Lit_Colon ':'> <hn> <Id.Lit_Colon ':'> <p> <Id.Lit_Colon ':'> <st>} {<opt>} ) ] ) body: (command.DoGroup children: [ (command.Case to_match: {($ Id.VSub_DollarName '$opt')} arms: [ (case_arm pat_list: [{<d>}] action: [ (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:opt_duration) op: assign_op.Equal rhs: {<1>} spids: [466] ) ] ) terminator: <Id.Op_Semi _> ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:duration) op: assign_op.Equal rhs: {($ Id.VSub_DollarName '$OPTARG')} spids: [470] ) ] ) ] spids: [463 464 473 -1] ) (case_arm pat_list: [{<n>}] action: [ (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:opt_name) op: assign_op.Equal rhs: {<1>} spids: [479] ) ] ) terminator: <Id.Op_Semi _> ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:name) op: assign_op.Equal rhs: {($ Id.VSub_DollarName '$OPTARG')} spids: [483] ) ] ) ] spids: [476 477 486 -1] ) (case_arm pat_list: [{<p>}] action: [ (command.Sentence child: (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:opt_pid) op: assign_op.Equal rhs: {<1>} spids: [492] ) ] ) terminator: <Id.Op_Semi _> ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:pid) op: assign_op.Equal rhs: {($ Id.VSub_DollarName '$OPTARG')} spids: [496] ) ] ) ] spids: [489 490 499 -1] ) (case_arm pat_list: [{<t>}] action: [ (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:opt_time) op: assign_op.Equal rhs: {<1>} spids: [505] ) ] ) ] spids: [502 503 508 -1] ) (case_arm pat_list: [{<s>}] action: [ (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:opt_fancy) op: assign_op.Equal rhs: {<1>} spids: [514] ) ] ) ] spids: [511 512 517 -1] ) (case_arm pat_list: [{<h>} {<Id.Lit_QMark '?'>}] action: [(C {<usage>})] spids: [520 523 527 -1] ) ] ) ] ) ) (C {<shift>} { (word_part.ArithSub anode: (arith_expr.Binary op_id: Id.Arith_Minus left: {($ Id.VSub_DollarName '$OPTIND')} right: {<Id.Lit_Digits 1>} ) ) } ) (command.AndOr ops: [Id.Op_DAmp] children: [(command.DParen child:{($ Id.VSub_Pound '$#')}) (C {<usage>})] ) (command.AndOr ops: [Id.Op_DAmp] children: [ (command.DParen child: (arith_expr.Binary op_id: Id.Arith_DAmp left: <Id.Lit_ArithVarLike opt_pid> right: <Id.Lit_ArithVarLike opt_name> ) ) (C {<die>} {(DQ <'ERROR: use either -p or -n.'>)}) ] ) (command.AndOr ops: [Id.Op_DAmp] children: [ (command.DParen child:<Id.Lit_ArithVarLike opt_pid>) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:ftext) op: assign_op.Equal rhs: {(DQ <' issued to PID '> ($ Id.VSub_DollarName '$pid'))} spids: [590] ) ] ) ] ) (command.AndOr ops: [Id.Op_DAmp] children: [ (command.DParen child:<Id.Lit_ArithVarLike opt_name>) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:ftext) op: assign_op.Equal rhs: { (DQ <' issued by process name '> (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\"'>) ($ Id.VSub_DollarName '$name') (word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\"'>) ) } spids: [605] ) ] ) ] ) (command.If arms: [ (if_arm cond: (condition.Shell commands: [ (command.Sentence child: (command.DParen child:<Id.Lit_ArithVarLike opt_duration>) terminator: <Id.Op_Semi _> ) ] ) action: [ (C {<echo>} { (DQ <'Tracing kill()s'> ($ Id.VSub_DollarName '$ftext') <' for '> ($ Id.VSub_DollarName '$duration') <' seconds (buffered)...'> ) } ) ] spids: [613 623] ) ] else_action: [ (C {<echo>} {(DQ <'Tracing kill()s'> ($ Id.VSub_DollarName '$ftext') <'. Ctrl-C to end.'>)}) ] ) (command.AndOr ops: [Id.Op_DAmp Id.Op_DAmp Id.Op_DAmp Id.Op_DAmp] children: [ (command.DBracket expr:(bool_expr.Unary op_id:Id.BoolUnary_x child:{<'/usr/bin/mawk'>})) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:awk) op: assign_op.Equal rhs: {(DQ <mawk>)} spids: [666] ) ] ) (C {<mawk>} {<-W>} {<interactive>}) (C {<Id.Lit_LBracket '['>} {($ Id.VSub_QMark '$?')} {<-eq>} {<0>} {<Id.Lit_RBracket ']'>}) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:awk) op: assign_op.Equal rhs: {(DQ <'mawk -W interactive'>)} spids: [694] ) ] ) ] ) (command.AndOr ops: [Id.Op_DAmp] children: [ (command.DBracket expr:(bool_expr.Unary op_id:Id.BoolUnary_x child:{<'/usr/bin/gawk'>})) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:awk) op: assign_op.Equal rhs: {(DQ <'gawk --non-decimal-data'>)} spids: [712] ) ] ) ] ) (command.AndOr ops: [Id.Op_DPipe] children: [ (C {<cd>} {($ Id.VSub_DollarName '$tracing')}) (C {<die>} { (DQ <'ERROR: accessing tracing. Root user? Kernel has FTRACE?\n'> <' debugfs mounted? (mount -t debugfs debugfs /sys/kernel/debug)'> ) } ) ] ) (command.AndOr ops: [Id.Op_DAmp] children: [ (command.DBracket expr: (bool_expr.Unary op_id:Id.BoolUnary_e child:{($ Id.VSub_DollarName '$flock')}) ) (C {<die>} { (DQ <'ERROR: ftrace may be in use by PID '> (command_sub left_token: <Id.Left_DollarParen '$('> child: (C {<cat>} {($ Id.VSub_DollarName '$flock')}) ) <' '> ($ Id.VSub_DollarName '$flock') ) } ) ] ) (command.AndOr ops: [Id.Op_DPipe] children: [ (command.Simple words: [{<echo>} {($ Id.VSub_Dollar '$$')}] redirects: [ (redir op: <Id.Redir_Great '>'> loc: (redir_loc.Fd fd:1) arg: {($ Id.VSub_DollarName '$flock')} ) ] do_fork: T ) (C {<die>} {(DQ <'ERROR: unable to write '> ($ Id.VSub_DollarName '$flock') <.>)}) ] ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:wroteflock) op: assign_op.Equal rhs: {<1>} spids: [779] ) ] ) (command.Simple words: [{<echo>} {<nop>}] redirects: [(redir op:<Id.Redir_Great '>'> loc:(redir_loc.Fd fd:1) arg:{<current_tracer>})] do_fork: T ) (command.If arms: [ (if_arm cond: (condition.Shell commands: [ (command.Sentence child: (command.Pipeline children: [ (command.Simple words: [{<echo>} {<1>}] redirects: [ (redir op: <Id.Redir_Great '>'> loc: (redir_loc.Fd fd:1) arg: {($ Id.VSub_DollarName '$kevent_entry') <'/enable'>} ) ] do_fork: T ) ] negated: T ) terminator: <Id.Op_Semi _> ) ] ) action: [(C {<edie>} {(DQ <'ERROR: enabling kill() entry tracepoint Exiting.'>)})] spids: [794 808] ) ] ) (command.If arms: [ (if_arm cond: (condition.Shell commands: [ (command.Sentence child: (command.Pipeline children: [ (command.Simple words: [{<echo>} {<1>}] redirects: [ (redir op: <Id.Redir_Great '>'> loc: (redir_loc.Fd fd:1) arg: {($ Id.VSub_DollarName '$kevent_return') <'/enable'>} ) ] do_fork: T ) ] negated: T ) terminator: <Id.Op_Semi _> ) ] ) action: [(C {<edie>} {(DQ <'ERROR: enabling kill() return tracepoint. Exiting.'>)})] spids: [819 833] ) ] ) (command.AndOr ops: [Id.Op_DAmp] children: [ (command.DParen child:<Id.Lit_ArithVarLike opt_time>) (C {<printf>} {(DQ <'%-16s '>)} {(DQ <TIMEs>)}) ] ) (C {<printf>} {(DQ <'%-16.16s %-6s %-8s %-10s %4s'> <Id.Lit_BadBackslash '\\'> <n>)} {(DQ <COMM>)} {(DQ <PID>)} {(DQ <TPID>)} {(DQ <SIGNAL>)} {(DQ <RETURN>)} ) (command.ShAssignment pairs: [ (assign_pair lhs: (sh_lhs_expr.Name name:offset) op: assign_op.Equal rhs: { (command_sub left_token: <Id.Left_DollarParen '$('> child: (C {($ Id.VSub_DollarName '$awk')} { (SQ <'BEGIN { o = 0; }\n'> <' $1 == "#" && $2 ~ /TASK/ && NF == 6 { o = 1; }\n'> <' $2 ~ /TASK/ { print o; exit }'> ) } {<trace>} ) ) } spids: [913] ) ] ) (C {<warn>} {(DQ <'echo > trace'>)}) (command.Pipeline children: [ (command.Subshell child: (command.If arms: [ (if_arm cond: (condition.Shell commands: [ (command.Sentence child: (command.DParen child:<Id.Lit_ArithVarLike opt_duration>) terminator: <Id.Op_Semi _> ) ] ) action: [(C {<sleep>} {($ Id.VSub_DollarName '$duration')}) (C {<cat>} {<trace>})] spids: [938 948] ) ] else_action: [(C {<cat>} {<trace_pipe>})] ) ) (C {($ Id.VSub_DollarName '$awk')} {<-v>} {<Id.Lit_VarLike 'o='> ($ Id.VSub_DollarName '$offset')} {<-v>} {<Id.Lit_VarLike 'opt_name='> ($ Id.VSub_DollarName '$opt_name')} {<-v>} {<Id.Lit_VarLike 'name='> ($ Id.VSub_DollarName '$name')} {<-v>} {<Id.Lit_VarLike 'opt_duration='> ($ Id.VSub_DollarName '$opt_duration')} {<-v>} {<Id.Lit_VarLike 'opt_time='> ($ Id.VSub_DollarName '$opt_time')} {<-v>} {<Id.Lit_VarLike 'opt_pid='> ($ Id.VSub_DollarName '$pid')} {<-v>} {<Id.Lit_VarLike 'opt_fancy='> ($ Id.VSub_DollarName '$opt_fancy')} { (SQ <'\n'> <' # fancy signal names\n'> <' BEGIN {\n'> <' signals[1] = "SIGHUP"\n'> <' signals[2] = "SIGINT"\n'> <' signals[3] = "SIGQUIT"\n'> <' signals[4] = "SIGILL"\n'> <' signals[6] = "SIGABRT"\n'> <' signals[8] = "SIGFPE"\n'> <' signals[9] = "SIGKILL"\n'> <' signals[11] = "SIGSEGV"\n'> <' signals[13] = "SIGPIPE"\n'> <' signals[14] = "SIGALRM"\n'> <' signals[15] = "SIGTERM"\n'> <' signals[10] = "SIGUSR1"\n'> <' signals[12] = "SIGUSR2"\n'> <' signals[17] = "SIGCHLD"\n'> <' signals[18] = "SIGCONT"\n'> <' signals[19] = "SIGSTOP"\n'> <' signals[20] = "SIGTSTP"\n'> <' signals[21] = "SIGTTIN"\n'> <' signals[22] = "SIGTTOU"\n'> <' }\n'> <'\n'> <' # common fields\n'> <' $1 != "#" {\n'> <' # task name can contain dashes\n'> <' comm = pid = $1\n'> <' sub(/-[0-9][0-9]*/, "", comm)\n'> <' if (opt_name && match(comm, name) == 0)\n'> <' next\n'> <' sub(/.*-/, "", pid)\n'> <' }\n'> <'\n'> <' # sys_kill() entry\n'> <' $1 != "#" && $(4+o) ~ /sys_kill/ && $(5+o) !~ /->/ {\n'> <' #\n'> <' # eg: ... sys_kill(pid:...\n'> <' #\n'> <' kpid = $(5+o)\n'> <' signal = $(7+o)\n'> <' sub(/,$/, "", kpid)\n'> <' sub(/\\)$/, "", signal)\n'> <' kpid = int("0x"kpid)\n'> <' signal = int("0x"signal)\n'> <' current[pid,"kpid"] = kpid\n'> <' current[pid,"signal"] = signal\n'> <' }\n'> <'\n'> <' # sys_kill exit\n'> <' $1 != "#" && $(5+o) ~ /->/ {\n'> <' rv = int($NF)\n'> <' killed_pid = current[pid,"kpid"]\n'> <' signal = current[pid,"signal"]\n'> <'\n'> <' delete current[pid,"kpid"]\n'> <' delete current[pid,"signal"]\n'> <'\n'> <' if(opt_pid && killed_pid != opt_pid) {\n'> <' next\n'> <' }\n'> <'\n'> <' if (opt_time) {\n'> <' time = $(3+o); sub(":", "", time)\n'> <' printf "%-16s ", time\n'> <' }\n'> <'\n'> <' if (opt_fancy) {\n'> <' if (signals[signal] != "") {\n'> <' signal = signals[signal]\n'> <' }\n'> <' }\n'> <'\n'> < ' printf "%-16.16s %-6s %-8s %-10s %-4s\\n", comm, pid, killed_pid, signal,\n' > <' rv\n'> <' }\n'> <'\n'> <' $0 ~ /LOST.*EVENTS/ { print "WARNING: " $0 > "/dev/stderr" }\n'> ) } ) ] negated: F ) (C {<end>}) ] )