[PATCH v3 0/3] trace-cruncher: Add support for event probes

[PATCH v3 0/3] trace-cruncher: Add support for event probes

[Tzvetomir Stoyanov (VMware)]

Event probe (eprobe) is a new type of ftrace dynamic events, introduced
in the Linux kernel 5.15 version. It is useful to have support for them
in trace-cruncher, as it allows more flexibility when printing event's
data.

v3 changes:
 - Added eporbe example.
v2 changes:
 - Rebase.
 - Moved unit test in a separate patch.
 - Added a check in the unit test if the kernel supports eprobes.
 - Renamed the API from PyFtrace_register_eprobe() to PyFtrace_eprobe(), for
   consistency with the other dynamic events APIs.

Tzvetomir Stoyanov (VMware) (3):
  trace-cruncher: Add support for event probes
  trace-cruncher: Unit test for event probes API
  trace-cruncher: Example for event probes API

 examples/eprobe.py                            | 29 +++++++++++
 src/ftracepy-utils.c                          | 32 ++++++++++++
 src/ftracepy-utils.h                          |  2 +
 src/ftracepy.c                                |  5 ++
 .../tests/1_unit/test_01_ftracepy_unit.py     | 50 +++++++++++++++++++
 5 files changed, 118 insertions(+)
 create mode 100755 examples/eprobe.py

-- 
2.34.1

[PATCH v3 1/3] trace-cruncher: Add support for event probes

[Tzvetomir Stoyanov (VMware)]

Event probe (eprobe) is a new type of ftrace dynamic events, introduced
in the Linux kernel 5.15 version. It is useful to have support for it in
trace-cruncher, as it allows more flexibility when printing event's
data.

Signed-off-by: Tzvetomir Stoyanov (VMware) <tz.stoyanov@gmail.com>
---
 src/ftracepy-utils.c | 32 ++++++++++++++++++++++++++++++++
 src/ftracepy-utils.h |  2 ++
 src/ftracepy.c       |  5 +++++
 3 files changed, 39 insertions(+)

diff --git a/src/ftracepy-utils.c b/src/ftracepy-utils.c
index 8c46590..053b659 100644
--- a/src/ftracepy-utils.c
+++ b/src/ftracepy-utils.c
@@ -2315,6 +2315,38 @@ struct tep_event *dynevent_get_event(PyDynevent *event,
 	return tep_evt;
 }
 
+PyObject *PyFtrace_eprobe(PyObject *self, PyObject *args, PyObject *kwargs)
+{
+	static char *kwlist[] = {"event", "target_system", "target_event", "fetchargs", NULL};
+	const char *event, *target_system, *target_event, *fetchargs;
+	struct tracefs_dynevent *eprobe;
+
+	if (!PyArg_ParseTupleAndKeywords(args,
+					 kwargs,
+					 "ssss",
+					 kwlist,
+					 &event,
+					 &target_system,
+					 &target_event,
+					 &fetchargs)) {
+		return NULL;
+	}
+
+	eprobe = tracefs_eprobe_alloc(TC_SYS, event, target_system, target_event, fetchargs);
+	if (!eprobe) {
+		MEM_ERROR;
+		return NULL;
+	}
+
+	if (tracefs_dynevent_create(eprobe) < 0) {
+		TfsError_fmt(NULL, "Failed to create eprobe '%s'", event);
+		tracefs_dynevent_free(eprobe);
+		return NULL;
+	}
+
+	return PyDynevent_New(eprobe);
+}
+
 static PyObject *set_filter(PyObject *args, PyObject *kwargs,
 			    struct tep_handle *tep,
 			    struct tep_event *event)
diff --git a/src/ftracepy-utils.h b/src/ftracepy-utils.h
index 7612df6..c96fd85 100644
--- a/src/ftracepy-utils.h
+++ b/src/ftracepy-utils.h
@@ -251,6 +251,8 @@ PyObject *PyFtrace_register_kprobe(PyObject *self, PyObject *args,
 PyObject *PyFtrace_register_kretprobe(PyObject *self, PyObject *args,
 						      PyObject *kwargs);
 
+PyObject *PyFtrace_eprobe(PyObject *self, PyObject *args, PyObject *kwargs);
+
 PyObject *PyFtrace_hist(PyObject *self, PyObject *args,
 					PyObject *kwargs);
 
diff --git a/src/ftracepy.c b/src/ftracepy.c
index 3f71b5e..464e8d3 100644
--- a/src/ftracepy.c
+++ b/src/ftracepy.c
@@ -460,6 +460,11 @@ static PyMethodDef ftracepy_methods[] = {
 	 METH_VARARGS | METH_KEYWORDS,
 	 "Define a kretprobe."
 	},
+	{"eprobe",
+	 (PyCFunction) PyFtrace_eprobe,
+	 METH_VARARGS | METH_KEYWORDS,
+	 "Define an eprobe."
+	},
 	{"hist",
 	 (PyCFunction) PyFtrace_hist,
 	 METH_VARARGS | METH_KEYWORDS,
-- 
2.34.1

[PATCH v3 2/3] trace-cruncher: Unit test for event probes API

[Tzvetomir Stoyanov (VMware)]

All trace-cruncher APIs should be covered by unit tests. Added a test
for newly introduced event probes API.

Signed-off-by: Tzvetomir Stoyanov (VMware) <tz.stoyanov@gmail.com>
---
 .../tests/1_unit/test_01_ftracepy_unit.py     | 50 +++++++++++++++++++
 1 file changed, 50 insertions(+)

diff --git a/tracecruncher/tests/1_unit/test_01_ftracepy_unit.py b/tracecruncher/tests/1_unit/test_01_ftracepy_unit.py
index 2de3d89..d773acc 100644
--- a/tracecruncher/tests/1_unit/test_01_ftracepy_unit.py
+++ b/tracecruncher/tests/1_unit/test_01_ftracepy_unit.py
@@ -14,6 +14,7 @@ import tracecruncher.ft_utils as tc
 
 instance_name = 'test_instance1'
 another_instance_name = 'test_instance2'
+kernel_version = tuple(map(int, (os.uname()[2].split('.')[:2])))
 
 class InstanceTestCase(unittest.TestCase):
     def test_dir(self):
@@ -457,6 +458,55 @@ class KprobeTestCase(unittest.TestCase):
         ret = kp1.is_enabled(instance=inst)
         self.assertEqual(ret, '0')
 
+class EprobeTestCase(unittest.TestCase):
+    def test_eprobe(self):
+        """ Event probes are introduced in Linux kernel 5.15
+        """
+        if kernel_version < (5, 15):
+            return
+
+        evt1 = 'sopen_in'
+        evt1_tsys = 'syscalls'
+        evt1_tevent = 'sys_enter_openat'
+        evt1_args = 'file=+0($filename):ustring'
+        evt2 = 'sopen_out'
+        evt2_tsys = 'syscalls'
+        evt2_tevent = 'sys_exit_openat'
+        evt2_args = 'res=$ret:u64'
+
+        ep1 = ft.eprobe(event=evt1, target_system=evt1_tsys, target_event=evt1_tevent,
+                        fetchargs=evt1_args)
+        self.assertEqual(evt1, ep1.event())
+        self.assertEqual("{}.{}".format(evt1_tsys, evt1_tevent), ep1.address())
+        self.assertEqual(evt1_args, ep1.probe())
+
+        ep2 = ft.eprobe(event=evt2, target_system=evt2_tsys, target_event=evt2_tevent,
+                        fetchargs=evt2_args)
+        self.assertEqual(evt2, ep2.event())
+        self.assertEqual("{}.{}".format(evt2_tsys, evt2_tevent), ep2.address())
+        self.assertEqual(evt2_args, ep2.probe())
+
+    def test_enable_eprobe(self):
+        """ Event probes are introduced in Linux kernel 5.15
+        """
+        if kernel_version < (5, 15):
+            return
+
+        evt1 = 'sopen_out'
+        evt1_tsys = 'syscalls'
+        evt1_tevent = 'sys_exit_openat'
+        evt1_args = 'res=$ret:u64'
+
+        ep1 = ft.eprobe(event=evt1, target_system=evt1_tsys, target_event=evt1_tevent,
+                        fetchargs=evt1_args)
+        inst = ft.create_instance(instance_name)
+        ep1.enable(instance=inst)
+        ret = ep1.is_enabled(instance=inst)
+        self.assertEqual(ret, '1')
+
+        ep1.disable(instance=inst)
+        ret = ep1.is_enabled(instance=inst)
+        self.assertEqual(ret, '0')
 
 class TracingOnTestCase(unittest.TestCase):
     def test_ON_OF(self):
-- 
2.34.1

[PATCH v3 3/3] trace-cruncher: Example for event probes API

[Tzvetomir Stoyanov (VMware)]

trace-cruncher APIs should have examples, to demonstrate their usage
in a real use case. Added an example for newly introduced event
probes API.

Signed-off-by: Tzvetomir Stoyanov (VMware) <tz.stoyanov@gmail.com>
---
 examples/eprobe.py | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100755 examples/eprobe.py

diff --git a/examples/eprobe.py b/examples/eprobe.py
new file mode 100755
index 0000000..85b0685
--- /dev/null
+++ b/examples/eprobe.py
@@ -0,0 +1,29 @@
+#!/usr/bin/env python3
+
+"""
+SPDX-License-Identifier: CC-BY-4.0
+
+Copyright 2022 VMware Inc, Tzvetomir Stoyanov (VMware) <tz.stoyanov@gmail.com>
+"""
+
+import sys
+
+import tracecruncher.ftracepy as ft
+import tracecruncher.ft_utils as tc
+
+open_probe = ft.eprobe(event='sopen_in', target_system='syscalls',
+                       target_event='sys_enter_openat', fetchargs='file=+0($filename):ustring')
+
+tep = tc.local_tep()
+
+def callback(event, record):
+    print(tep.info(event, record))
+
+if __name__ == "__main__":
+    if len(sys.argv) < 2:
+        print('Usage: ', sys.argv[0], ' [PROCESS]')
+        sys.exit(1)
+
+    inst = ft.create_instance(tracing_on=False)
+    open_probe.enable(instance=inst)
+    ft.trace_process(instance=inst, argv=sys.argv[1:])
-- 
2.34.1

Re: [PATCH v3 0/3] trace-cruncher: Add support for event probes

[Yordan Karadzhov]

Hi Ceco,

I am applying this patch-set. Thanks a lot!

However, there is more work to do. Now, when we have the low-level API for eprobes, it is time to think for adding also 
some high-level APIs. You can have a look in:
tracecruncher/ft_utils.py

and get some ideas from the classes 'kprobe' and 'kretval_probe'

cheers,
Yordan


On 27.01.22 г. 9:01 ч., Tzvetomir Stoyanov (VMware) wrote:
> Event probe (eprobe) is a new type of ftrace dynamic events, introduced
> in the Linux kernel 5.15 version. It is useful to have support for them
> in trace-cruncher, as it allows more flexibility when printing event's
> data.
> 
> v3 changes:
>   - Added eporbe example.
> v2 changes:
>   - Rebase.
>   - Moved unit test in a separate patch.
>   - Added a check in the unit test if the kernel supports eprobes.
>   - Renamed the API from PyFtrace_register_eprobe() to PyFtrace_eprobe(), for
>     consistency with the other dynamic events APIs.
> 
> Tzvetomir Stoyanov (VMware) (3):
>    trace-cruncher: Add support for event probes
>    trace-cruncher: Unit test for event probes API
>    trace-cruncher: Example for event probes API
> 
>   examples/eprobe.py                            | 29 +++++++++++
>   src/ftracepy-utils.c                          | 32 ++++++++++++
>   src/ftracepy-utils.h                          |  2 +
>   src/ftracepy.c                                |  5 ++
>   .../tests/1_unit/test_01_ftracepy_unit.py     | 50 +++++++++++++++++++
>   5 files changed, 118 insertions(+)
>   create mode 100755 examples/eprobe.py
>