tools: Introduce full-path helpers

In bcc PR [1], add common path helpers for serial of tools, this patch
do the same thing.

After analysis and experiments, libbpf-tools/c and tools/py codes about
path-helpers cannot be reused. Thus, this patch add:

1. full_path.h: defined FULL_PATH_FIELD(name);
2. path_helpers.bpf.c: add bpf_dentry_full_path() and bpf_getcwd()
   helpers same as commit [1];
3. path_helpers.py: add get_full_path() to parse full-path in
   full_path.h;

[1] #5340

Signed-off-by: Rong Tao <[email protected]>

Author: Rtoax

tools/CMakeLists.txt

@@ -1,11 +1,16 @@
-file(GLOB C_FILES *.c)
+file(GLOB C_FILES *.c *.h)
 file(GLOB PY_FILES *.py)
 file(GLOB SH_FILES *.sh)
 file(GLOB TXT_FILES *.txt)
 list(REMOVE_ITEM TXT_FILES ${CMAKE_CURRENT_SOURCE_DIR}/CMakeLists.txt)
 foreach(FIL ${PY_FILES})
   get_filename_component(FIL_WE ${FIL} NAME_WE)
-  install(PROGRAMS ${FIL} DESTINATION share/bcc/tools RENAME ${FIL_WE})
+  # python helpers for import need suffix .py
+  if (FIL_WE MATCHES "_helpers")
+    install(FILES ${FIL} DESTINATION share/bcc/tools)
+  else()
+    install(PROGRAMS ${FIL} DESTINATION share/bcc/tools RENAME ${FIL_WE})
+  endif()
 endforeach()
 foreach(FIL ${SH_FILES})
   if(${FIL} STREQUAL ${CMAKE_CURRENT_SOURCE_DIR}/reset-trace.sh)

tools/full_path.h

@@ -0,0 +1,22 @@
+// SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause)
+/* Copyright (c) 2025 Rong Tao */
+/**
+ * This code only for bcc/tools/, not for bcc/libbpf-tools/
+ */
+#pragma once
+#ifndef __FULL_PATH_H
+#define __FULL_PATH_H
+
+#define NAME_MAX 255
+#define MAX_ENTRIES 32
+
+/**
+ * Example: "/CCCCC/BB/AAAA"
+ * name[]: "AAAA000000000000BB0000000000CCCCC00000000000"
+ *          |<- NAME_MAX ->|
+ *
+ * name[] must be u8, because char [] will be truncated by ctypes.cast(),
+ * such as above example, will be truncated to "AAAA0".
+ */
+#define FULL_PATH_FIELD(name)	u8 name[NAME_MAX * MAX_ENTRIES];
+#endif

tools/opensnoop.py

@@ -102,24 +102,10 @@
 #include <linux/fcntl.h>
 #include <linux/sched.h>
 #ifdef FULLPATH
-#include <linux/fs_struct.h>
-#include <linux/dcache.h>
-#include <linux/fs.h>
-#include <linux/mount.h>
-
-/* see https://github.com/torvalds/linux/blob/master/fs/mount.h */
-struct mount {
-    struct hlist_node mnt_hash;
-    struct mount *mnt_parent;
-    struct dentry *mnt_mountpoint;
-    struct vfsmount mnt;
-    /* ... */
-};
+INCLUDE_FULL_PATH_H
+INCLUDE_PATH_HELPERS_BPF_H
 #endif
 
-#define NAME_MAX 255
-#define MAX_ENTRIES 32
-
 struct val_t {
     u64 id;
     char comm[TASK_COMM_LEN];
@@ -136,15 +122,7 @@
     char comm[TASK_COMM_LEN];
     u32 path_depth;
 #ifdef FULLPATH
-    /**
-     * Example: "/CCCCC/BB/AAAA"
-     * name[]: "AAAA000000000000BB0000000000CCCCC00000000000"
-     *          |<- NAME_MAX ->|
-     *
-     * name[] must be u8, because char [] will be truncated by ctypes.cast(),
-     * such as above example, will be truncated to "AAAA0".
-     */
-    u8 name[NAME_MAX * MAX_ENTRIES];
+    FULL_PATH_FIELD(name);
 #else
     /* If not fullpath, avoid transfer big data */
     char name[NAME_MAX];
@@ -187,7 +165,9 @@
     data->mode = valp->mode; // EXTENDED_STRUCT_MEMBER
     data->ret = PT_REGS_RC(ctx);
 
-    SUBMIT_DATA
+    GET_FULL_PATH
+
+    events.ringbuf_submit(data, sizeof(*data));
 
 cleanup:
     infotmp.delete(&id);
@@ -347,7 +327,9 @@
     data->mode  = mode; // EXTENDED_STRUCT_MEMBER
     data->ret   = ret;
 
-    SUBMIT_DATA
+    GET_FULL_PATH
+
+    events.ringbuf_submit(data, sizeof(*data));
 
     return 0;
 }
@@ -416,73 +398,22 @@
         if 'EXTENDED_STRUCT_MEMBER' not in x)
 
 if args.full_path:
-    bpf_text = bpf_text.replace('SUBMIT_DATA', """
+    bpf_text = bpf_text.replace('GET_FULL_PATH', """
     if (data->name[0] != '/') { // relative path
-        struct task_struct *task;
-        struct dentry *dentry, *parent_dentry, *mnt_root;
-        struct vfsmount *vfsmnt;
-        struct fs_struct *fs;
-        struct path *path;
-        struct mount *mnt;
-        size_t filepart_length;
-        char *payload = data->name;
-        struct qstr d_name;
-        int i;
-
-        task = (struct task_struct *)bpf_get_current_task_btf();
-
-        fs = task->fs;
-        path = &fs->pwd;
-        dentry = path->dentry;
-        vfsmnt = path->mnt;
-
-        mnt = container_of(vfsmnt, struct mount, mnt);
-
-        for (i = 1, payload += NAME_MAX; i < MAX_ENTRIES; i++) {
-            bpf_probe_read_kernel(&d_name, sizeof(d_name), &dentry->d_name);
-            filepart_length =
-                bpf_probe_read_kernel_str(payload, NAME_MAX, (void *)d_name.name);
-
-            if (filepart_length < 0 || filepart_length > NAME_MAX)
-                break;
-
-            bpf_probe_read_kernel(&mnt_root, sizeof(mnt_root), &vfsmnt->mnt_root);
-            bpf_probe_read_kernel(&parent_dentry, sizeof(parent_dentry), &dentry->d_parent);
-
-            if (dentry == parent_dentry || dentry == mnt_root) {
-                struct mount *mnt_parent;
-                bpf_probe_read_kernel(&mnt_parent, sizeof(mnt_parent), &mnt->mnt_parent);
-
-                if (mnt != mnt_parent) {
-                    bpf_probe_read_kernel(&dentry, sizeof(dentry), &mnt->mnt_mountpoint);
-
-                    mnt = mnt_parent;
-                    vfsmnt = &mnt->mnt;
-
-                    bpf_probe_read_kernel(&mnt_root, sizeof(mnt_root), &vfsmnt->mnt_root);
-
-                    data->path_depth++;
-                    payload += NAME_MAX;
-                    continue;
-                } else {
-                    /* Real root directory */
-                    break;
-                }
-            }
-
-            payload += NAME_MAX;
-
-            dentry = parent_dentry;
-            data->path_depth++;
-        }
+        bpf_getcwd(data->name + NAME_MAX, NAME_MAX, MAX_ENTRIES - 1,
+                    &data->path_depth);
     }
-
-    events.ringbuf_submit(data, sizeof(*data));
     """)
+
+    with open(BPF._find_file("full_path.h".encode("utf-8"))) as fileobj:
+        progtxt = fileobj.read()
+    bpf_text = bpf_text.replace('INCLUDE_FULL_PATH_H', progtxt)
+
+    with open(BPF._find_file("path_helpers.bpf.c".encode("utf-8"))) as fileobj:
+        progtxt = fileobj.read()
+    bpf_text = bpf_text.replace('INCLUDE_PATH_HELPERS_BPF_H', progtxt)
 else:
-    bpf_text = bpf_text.replace('SUBMIT_DATA', """
-    events.ringbuf_submit(data, sizeof(*data));
-    """)
+    bpf_text = bpf_text.replace('GET_FULL_PATH', """""")
 
 if debug or args.ebpf:
     print(bpf_text)
@@ -517,12 +448,6 @@
 
 entries = defaultdict(list)
 
-def split_names(str):
-    NAME_MAX = 255
-    MAX_ENTRIES = 32
-    chunks = [str[i:i + NAME_MAX] for i in range(0, NAME_MAX * MAX_ENTRIES, NAME_MAX)]
-    return [chunk.split(b'\x00', 1)[0] for chunk in chunks]
-
 # process event
 def print_event(cpu, data, size):
     event = b["events"].event(data)
@@ -569,17 +494,10 @@ def print_event(cpu, data, size):
                 printb(b"%08o %04o " % (event.flags, event.mode), nl="")
 
         if args.full_path:
-            # see struct data_t::name field comment.
-            names = split_names(bytes(event.name))
-            picked = names[:event.path_depth + 1]
-            picked_str = []
-            for x in picked:
-                s = x.decode('utf-8', 'ignore') if isinstance(x, bytes) else str(x)
-                # remove mountpoint '/' and empty string
-                if s != "/" and s != "":
-                    picked_str.append(s)
-            joined = '/'.join(picked_str[::-1])
-            result = joined if joined.startswith('/') else '/' + joined
+            import sys
+            sys.path.append(os.path.dirname(sys.argv[0]))
+            from path_helpers import get_full_path
+            result = get_full_path(event.name, event.path_depth)
             printb(b"%s" % result.encode("utf-8"))
         else:
             printb(b"%s" % event.name)

tools/path_helpers.bpf.c

@@ -0,0 +1,92 @@
+// SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause)
+/* Copyright (c) 2025 Rong Tao */
+#ifndef __PATH_HELPERS_BPF_H
+#define __PATH_HELPERS_BPF_H 1
+
+#include <linux/fs_struct.h>
+#include <linux/dcache.h>
+#include <linux/fs.h>
+#include <linux/mount.h>
+
+/* see https://github.com/torvalds/linux/blob/master/fs/mount.h */
+struct mount {
+	struct hlist_node mnt_hash;
+	struct mount *mnt_parent;
+	struct dentry *mnt_mountpoint;
+	struct vfsmount mnt;
+	/* ... */
+};
+
+
+static __always_inline
+int bpf_dentry_full_path(char *pathes, int name_len, int max_depth,
+			 struct dentry *dentry, struct vfsmount *vfsmnt,
+			 __u32 *path_depth)
+{
+	struct dentry *parent_dentry, *mnt_root;
+	struct mount *mnt;
+	size_t filepart_length;
+	char *payload = pathes;
+	struct qstr d_name;
+	int i;
+
+	mnt = container_of(vfsmnt, struct mount, mnt);
+
+	for (i = 1, payload += name_len; i < max_depth; i++) {
+		bpf_probe_read_kernel(&d_name, sizeof(d_name), &dentry->d_name);
+		filepart_length =
+			bpf_probe_read_kernel_str(payload, name_len, (void *)d_name.name);
+
+		if (filepart_length < 0 || filepart_length > name_len)
+			break;
+
+		bpf_probe_read_kernel(&mnt_root, sizeof(mnt_root), &vfsmnt->mnt_root);
+		bpf_probe_read_kernel(&parent_dentry, sizeof(parent_dentry), &dentry->d_parent);
+
+		if (dentry == parent_dentry || dentry == mnt_root) {
+			struct mount *mnt_parent;
+			bpf_probe_read_kernel(&mnt_parent, sizeof(mnt_parent), &mnt->mnt_parent);
+
+			if (mnt != mnt_parent) {
+				bpf_probe_read_kernel(&dentry, sizeof(dentry), &mnt->mnt_mountpoint);
+
+				mnt = mnt_parent;
+				vfsmnt = &mnt->mnt;
+
+				bpf_probe_read_kernel(&mnt_root, sizeof(mnt_root), &vfsmnt->mnt_root);
+
+				(*path_depth)++;
+				payload += name_len;
+				continue;
+			} else {
+				/* Real root directory */
+				break;
+			}
+		}
+
+		payload += name_len;
+
+		dentry = parent_dentry;
+		(*path_depth)++;
+	}
+
+	return 0;
+}
+
+static __always_inline
+int bpf_getcwd(char *pathes, int name_len, int max_depth, __u32 *path_depth)
+{
+	struct task_struct *task;
+        struct fs_struct *fs;
+	struct dentry *dentry;
+	struct vfsmount *vfsmnt;
+
+	task = (struct task_struct *)bpf_get_current_task_btf();
+	bpf_probe_read_kernel(&fs, sizeof(fs), &task->fs);
+	bpf_probe_read_kernel(&dentry, sizeof(dentry), &fs->pwd.dentry);
+	bpf_probe_read_kernel(&vfsmnt, sizeof(vfsmnt), &fs->pwd.mnt);
+
+	return bpf_dentry_full_path(pathes, name_len, max_depth, dentry, vfsmnt,
+			     path_depth);
+}
+#endif

tools/path_helpers.py

@@ -0,0 +1,30 @@
+#!/usr/bin/env python
+# Path related helper functions
+#
+# Copyright (c) 2025 Rong Tao
+# Licensed under the Apache License, Version 2.0 (the "License")
+#
+# 30-Jun-2025   Rong Tao        Created this.
+
+import os
+
+def split_names(str):
+    NAME_MAX = 255
+    MAX_ENTRIES = 32
+    chunks = [str[i:i + NAME_MAX] for i in range(0, NAME_MAX * MAX_ENTRIES, NAME_MAX)]
+    return [chunk.split(b'\x00', 1)[0] for chunk in chunks]
+
+
+# parse full-path, see tools/full_path.h
+def get_full_path(name, depth):
+    names = split_names(bytes(name))
+    picked = names[:depth + 1]
+    picked_str = []
+    for x in picked:
+        s = x.decode('utf-8', 'ignore') if isinstance(x, bytes) else str(x)
+        # remove mountpoint '/' and empty string
+        if s != "/" and s != "":
+            picked_str.append(s)
+    joined = '/'.join(picked_str[::-1])
+    result = joined if joined.startswith('/') else '/' + joined
+    return result