Skip to content

Instantly share code, notes, and snippets.

@jim3ma

jim3ma/ioctlsnoop.bt

Last active December 19, 2022 05:57
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save jim3ma/071108d90b7bb9b4067d64889d826415 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save jim3ma/071108d90b7bb9b4067d64889d826415 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. jim3ma revised this gist Dec 19, 2022. 1 changed file with 0 additions and 2 deletions.
    2 changes: 0 additions & 2 deletions ioctlsnoop.bt
    View file
    Original file line number Diff line number Diff line change
    @@ -5,8 +5,6 @@
    *
    * USAGE: ioctlsnoop.bt
    *
    * This is a bpftrace version of the bcc tool of the same name.
    *
    * Copyright 2022 Jim Ma.
    * Licensed under the Apache License, Version 2.0 (the "License")
    *
  2. jim3ma created this gist Dec 19, 2022.
    66 changes: 66 additions & 0 deletions ioctlsnoop.bt
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,66 @@
    #!/usr/bin/env bpftrace
    /*
    * ioctlsnoop Trace ioctl() syscalls.
    * For Linux, uses bpftrace and eBPF.
    *
    * USAGE: ioctlsnoop.bt
    *
    * This is a bpftrace version of the bcc tool of the same name.
    *
    * Copyright 2022 Jim Ma.
    * Licensed under the Apache License, Version 2.0 (the "License")
    *
    * 18-Dec-2022 Jim Ma Created this.
    */

    BEGIN
    {
    printf("Tracing ioctl syscalls... Hit Ctrl-C to end.\n");
    printf("%-6s %-16s %4s %3s %s %s\n", "PID", "COMM", "FD", "ERR", "CMD", "PATH");
    }

    tracepoint:syscalls:sys_enter_open,
    tracepoint:syscalls:sys_enter_openat
    {
    @filename[tid] = args->filename;
    }

    tracepoint:syscalls:sys_exit_open,
    tracepoint:syscalls:sys_exit_openat
    //@filename[tid]
    //@fd2filename[fd]
    {
    $ret = args->ret;
    $fd = $ret > 0 ? $ret : -1;
    @fd2filename[$fd] = @filename[tid];
    delete(@filename[tid]);
    }

    tracepoint:syscalls:sys_enter_ioctl
    {
    // save args
    @fds[tid] = args->fd;
    @cmd[tid] = args->cmd;
    }

    tracepoint:syscalls:sys_exit_ioctl
    //@fds[tid]
    //@cmd[tid]
    {
    $ret = args->ret;
    $fd = @fds[tid];
    $errno = $ret > 0 ? 0 : - $ret;

    printf("%-6d %-16s %4d 0x%x %3d %s\n", pid, comm, $fd,
    @cmd[tid], $errno, str(@fd2filename[$fd]));
    delete(@fds[tid]);
    delete(@cmd[tid]);
    }

    END
    {
    clear(@filename);
    clear(@fd2filename);
    clear(@fds);
    clear(@cmd);
    }