Add trace_fields

Author: r41k0u

pythonbpf/__init__.py

@@ -1,6 +1,6 @@
 from .decorators import bpf, map, section, bpfglobal, struct
 from .codegen import compile_to_ir, compile, BPF
-from .utils import trace_pipe
+from .utils import trace_pipe, trace_fields
 
 __all__ = [
     "bpf",
@@ -12,4 +12,5 @@
     "compile",
     "BPF",
     "trace_pipe",
+    "trace_fields",
 ]

pythonbpf/utils.py

@@ -1,4 +1,9 @@
 import subprocess
+import re
+
+TRACE_PATTERN = re.compile(
+    rb"^(.{1,16}?)-(\d+)\s+\[(\d+)\]\s+([a-zA-Z.]+)\s+([0-9.]+):\s+.*?:\s+(.*)$"
+)
 
 
 def trace_pipe():
@@ -7,3 +12,20 @@ def trace_pipe():
         subprocess.run(["cat", "/sys/kernel/tracing/trace_pipe"])
     except KeyboardInterrupt:
         print("Tracing stopped.")
+
+
+def trace_fields():
+    """Parse one line from trace_pipe into fields."""
+    with open("/sys/kernel/tracing/trace_pipe", "rb", buffering=0) as f:
+        while True:
+            line = f.readline().rstrip()
+
+            if not line or line.startswith(b"CPU:"):
+                continue
+
+            match = TRACE_PATTERN.match(line)
+            if not match:
+                raise ValueError("Cannot parse trace line")
+
+            task, pid, cpu, flags, ts, msg = match.groups()
+            return (task.strip(), int(pid), int(cpu), flags, float(ts), msg)