tools/killsnoop: migrate to tracepoints (#5546)

This commit updates the python killsnoop tool to use tracepoints for the
kill, tkill, and tgkill syscalls. Previously, it used kprobes on sys_kill,
which broke on Linux 5.11 due to kernel changes. This brings the python
tool in parity with the libbpf-tools C version (sigsnoop), providing a
more robust and stable tracing mechanism.

Fixes #3592

Author: codebyangelo

tests/python/test_tools_smoke.py

@@ -222,7 +222,7 @@ def test_gethostlatency(self):
     def test_hardirqs(self):
         self.run_with_duration("hardirqs.py 1 1")
 
-    @skipUnless(kernel_version_ge(4,4), "requires kernel >= 4.4")
+    @skipUnless(kernel_version_ge(4,7), "requires kernel >= 4.7")
     def test_killsnoop(self):
         # Because killsnoop intercepts signals, if we send it a SIGINT we we
         # we likely catch it while it is handling the data packet from the

tools/killsnoop.py

@@ -67,7 +67,8 @@
 BPF_HASH(infotmp, u32, struct val_t);
 BPF_PERF_OUTPUT(events);
 
-int syscall__kill(struct pt_regs *ctx, int tpid, int sig)
+
+static int probe_entry(u32 tpid, int sig)
 {
     u64 pid_tgid = bpf_get_current_pid_tgid();
     u32 pid = pid_tgid >> 32;
@@ -85,9 +86,24 @@
     }
 
     return 0;
-};
+}
+
+TRACEPOINT_PROBE(syscalls, sys_enter_kill)
+{
+    return probe_entry(args->pid, args->sig);
+}
+
+TRACEPOINT_PROBE(syscalls, sys_enter_tkill)
+{
+    return probe_entry(args->pid, args->sig);
+}
+
+TRACEPOINT_PROBE(syscalls, sys_enter_tgkill)
+{
+    return probe_entry(args->pid, args->sig);
+}
 
-int do_ret_sys_kill(struct pt_regs *ctx)
+static int probe_exit(void *ctx, int ret)
 {
     struct data_t data = {};
     struct val_t *valp;
@@ -104,14 +120,30 @@
     bpf_probe_read_kernel(&data.comm, sizeof(data.comm), valp->comm);
     data.pid = pid;
     data.tpid = valp->tpid;
-    data.ret = PT_REGS_RC(ctx);
+    data.ret = ret;
     data.sig = valp->sig;
 
     events.perf_submit(ctx, &data, sizeof(data));
     infotmp.delete(&tid);
 
     return 0;
 }
+
+TRACEPOINT_PROBE(syscalls, sys_exit_kill)
+{
+    return probe_exit(args, args->ret);
+}
+
+TRACEPOINT_PROBE(syscalls, sys_exit_tkill)
+{
+    return probe_exit(args, args->ret);
+}
+
+TRACEPOINT_PROBE(syscalls, sys_exit_tgkill)
+{
+    return probe_exit(args, args->ret);
+}
+
 """
 
 if args.tpid:
@@ -141,9 +173,6 @@
 
 # initialize BPF
 b = BPF(text=bpf_text)
-kill_fnname = b.get_syscall_fnname("kill")
-b.attach_kprobe(event=kill_fnname, fn_name="syscall__kill")
-b.attach_kretprobe(event=kill_fnname, fn_name="do_ret_sys_kill")
 
 # detect the length of PID column
 pid_bytes = 6