| Dir : /lib/python3.6/site-packages/bcc/__pycache__/ |
| Server: Linux premium155.web-hosting.com 4.18.0-553.89.1.lve.el8.x86_64 #1 SMP Wed Dec 10 13:58:50 UTC 2025 x86_64 IP: 162.0.235.198 |
| Dir : //lib/python3.6/site-packages/bcc/__pycache__/__init__.cpython-36.pyc |
3
:�)gh � @ s� d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
Z
d dl Z ddl m
Z
mZmZmZmZ ddlmZmZmZmZmZ ddlmZ ddlmZm Z m Z m Z m Z ddl m!Z! dd l"m#Z#m$Z$ dd
l%m&Z&m'Z' ye( W n e)k
�r e*Z(Y nX d Z+d a,d d
� Z-dZ.dZ/dZ0dZ1dZ2dZ3dZ4G dd� de5�Z6G dd� d�Z7G dd� d�Z8G dd� d�Z9G d d � d �Z:G d d � d �Z;G d d!� d!�Z<G d"d#� d#�Z=G d$d%� d%�Z>G d&d'� d'e5�Z?dS )(� )�print_functionN� )�lib�
bcc_symbol�bcc_symbol_option�bcc_stacktrace_build_id� _SYM_CB_TYPE)�Table�PerfEventArray�RingBuf�BPF_MAP_TYPE_QUEUE�BPF_MAP_TYPE_STACK)�Perf)�get_online_cpus�printb�_assert_is_bytes� ArgString�
StrcmpRewrite)� __version__)�disassemble_prog�
decode_map)�USDT�
USDTExceptioni� c C s t S )N)�_num_open_probes� r r � /usr/lib/python3.6/__init__.py�_get_num_open_probes+ s r z/sys/kernel/debug/tracing� � � � � c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )� SymbolCachec C s t j|tjd tjt���| _d S )N)r Zbcc_symcache_new�ct�cast�POINTERr �cache)�self�pidr r r �__init__A s zSymbolCache.__init__c C s� t � }|r"tj| j|tj|��}ntj| j|tj|��}|dk rp|jrf|jrfd|jtj |jtj
�j fS d|dfS |r�|j }tj
tj|�� n|j}||jtj |jtj
�j fS )a�
Return a tuple of the symbol (function), its offset from the beginning
of the function, and the module in which it lies. For example:
("start_thread", 0x202, "/usr/lib/.../libpthread-2.24.so")
If the symbol cannot be found but we know which module it is in,
return the module name and the offset from the beginning of the
module. If we don't even know the module, return the absolute
address as the offset.
r N)r r Zbcc_symcache_resolver& r# �byrefZ bcc_symcache_resolve_no_demangle�module�offsetr$ �c_char_p�valueZ
demangle_nameZ bcc_symbol_free_demangle_name�name)r' �addr�demangle�sym�resZname_resr r r �resolveE s
zSymbolCache.resolvec C s> t |�}t |�}tj� }tj| j||tj|��dk r8dS |jS )Nr r ���)r r# � c_ulonglongr Zbcc_symcache_resolve_namer& r* r. )r' r+ r/ r0 r r r � resolve_nameb s zSymbolCache.resolve_nameN)�__name__�
__module__� __qualname__r) r4 r7 r r r r r" @ s r" c @ s$ e Zd ZdZdZdZdZdZdZdS )�PerfTyper r r � r � N) r8 r9 r: ZHARDWAREZSOFTWARE�
TRACEPOINTZHW_CACHE�RAWZ
BREAKPOINTr r r r r; k s r; c @ s4 e Zd ZdZdZdZdZdZdZdZ dZ
d Z d
Z d S ) � PerfHWConfigr r r r< r r= � � r � N)
r8 r9 r: Z
CPU_CYCLESZ INSTRUCTIONSZCACHE_REFERENCESZ CACHE_MISSESZBRANCH_INSTRUCTIONSZ
BRANCH_MISSESZ
BUS_CYCLESZSTALLED_CYCLES_FRONTENDZSTALLED_CYCLES_BACKENDZREF_CPU_CYCLESr r r r r@ t s r@ c @ s8 e Zd ZdZdZdZdZdZdZdZ dZ
d Z d
Z d Z
d S )
� PerfSWConfigr r r r< r r= rA rB r rC �
N)r8 r9 r: Z CPU_CLOCKZ
TASK_CLOCKZ PAGE_FAULTSZCONTEXT_SWITCHESZCPU_MIGRATIONSZPAGE_FAULTS_MINZPAGE_FAULTS_MAJZALIGNMENT_FAULTSZEMULATION_FAULTSZDUMMYZ
BPF_OUTPUTr r r r rD � s rD c @ sp e Zd ZdZd Zd Zd Zd Zd Zd!Z d"Z
d#Z d$Z d%Z
d&Zd'Zd(Zd)Zd*Zd+Zd,Zd-Zd.Zd/Zd0Zd1Zd2Zd3ZdS )4�PerfEventSampleFormatr r r r< r r= rA rB r rC rE � � �
� � r � � � � � � � � Nr r r r r r! �@ � � i i i i i i @ i � i i i i i i i @ i � i ) r8 r9 r: ZIPZTIDZTIMEZADDRZREADZ CALLCHAINZIDZCPUZPERIODZ STREAM_IDr? Z BRANCH_STACKZ REGS_USERZ
STACK_USERZWEIGHTZDATA_SRCZ
IDENTIFIERZ TRANSACTIONZ REGS_INTRZ PHYS_ADDRZAUXZCGROUPZDATA_PAGE_SIZEZCODE_PAGE_SIZEZ
WEIGHT_STRUCTr r r r rF � s2 rF c @ s` e Zd ZdZdZdZdZdZdZdZ dZ
d Z d
Z d Z
d Zd
ZdZdZdZdZdZdZdZdZdS )� BPFProgTyper r r< r r= rA rB r rC rE rG rH rI rJ rK r rL rM � � � N)r8 r9 r: �
SOCKET_FILTER�KPROBE� SCHED_CLS� SCHED_ACTr> �XDP�
PERF_EVENT�
CGROUP_SKB� CGROUP_SOCK�LWT_IN�LWT_OUT�LWT_XMIT�SOCK_OPS�SK_SKB�
CGROUP_DEVICE�SK_MSG�RAW_TRACEPOINT�CGROUP_SOCK_ADDRZCGROUP_SOCKOPT�TRACING�LSMr r r r rW � s* rW c @ s� e Zd ZdZdZdZdZdZdZdZ dZ
d Z d
Z d Z
d Zd
ZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Z!d Z"d!Z#d"Z$d#Z%d$Z&d%Z'd&Z(d'Z)d(S ))�
BPFAttachTyper r r r< r r= rA rB r rC rE rG rH rI rJ rK r rL rM rN rO rP rQ rR rS rX rY � � rZ � � r! �! �" �# �$ �% �& N)*r8 r9 r: ZCGROUP_INET_INGRESSZCGROUP_INET_EGRESSZCGROUP_INET_SOCK_CREATEZCGROUP_SOCK_OPSZSK_SKB_STREAM_PARSERZSK_SKB_STREAM_VERDICTrh ZSK_MSG_VERDICTZCGROUP_INET4_BINDZCGROUP_INET6_BINDZCGROUP_INET4_CONNECTZCGROUP_INET6_CONNECTZCGROUP_INET4_POST_BINDZCGROUP_INET6_POST_BINDZCGROUP_UDP4_SENDMSGZCGROUP_UDP6_SENDMSGZ
LIRC_MODE2ZFLOW_DISSECTORZ
CGROUP_SYSCTLZCGROUP_UDP4_RECVMSGZCGROUP_UDP6_RECVMSGZCGROUP_GETSOCKOPTZCGROUP_SETSOCKOPTZ TRACE_RAW_TPZ TRACE_FENTRYZ TRACE_FEXITZ
MODIFY_RETURNZLSM_MACZ
TRACE_ITERZCGROUP_INET4_GETPEERNAMEZCGROUP_INET6_GETPEERNAMEZCGROUP_INET4_GETSOCKNAMEZCGROUP_INET6_GETSOCKNAMEZ
XDP_DEVMAPZCGROUP_INET_SOCK_RELEASEZ
XDP_CPUMAPZ SK_LOOKUPr_ ZSK_SKB_VERDICTr r r r rn � sN rn c @ s e Zd ZdZdZdZdZdZdS )� XDPActionr r r r< r N)r8 r9 r: � XDP_ABORTED�XDP_DROP�XDP_PASS�XDP_TX� XDP_REDIRECTr r r r ry � s
ry c @ s e Zd ZdZdZd Zd
Zd ZdS ) �XDPFlagsr r r r< r Nr r r r r )r8 r9 r: �UPDATE_IF_NOEXIST�SKB_MODE�DRV_MODE�HW_MODE�REPLACEr r r r r � s
r c @ s� e Zd ZejZejZejZejZejZej Z ej
Z
ej Z ej Z ej
Z
ejZejZejZejZejZejZejZejZejZejZejZejZejZej Z ej Z e j Z e j!Z"e j#Z$e j%Z&e j'Z(e)j*d�Z+i Z,e-j.� Z/dgddgddgdgdd gd
�Z0d d d
ddddgZ1dZ2G dd� de3j4�Z5e3j6ddd�Z7e7j8Z9e3j:e3j;e5�ge9_<e=dd� �Z>e=dd� �Z?e@Z@G d d � d eA�ZBeCd d � �ZDeCd d!� �ZEd"d"d#d$g g dd#d%f d&d'�ZFefd(d)�ZGd�d*d+�ZHd,d-� ZId.d/� ZJd�d0d1�ZKe3jLe3jMe3jNe3jOe3jPe3jQe3j:e3jRe3jSe3jTe3jUe3jVe3jWe3jXe3jYe3jZd2 e3j[d2 d3�Z\eCd4d5� �Z]d�d6d7�Z^d8d9� Z_d:d;� Z`d<d=� Zad>d?� Zbd@dA� ZceCd�dBdC��ZdeCdDdE� �ZeeCdFdG� �ZfeCdHdI� �ZgdJdK� ZheCdLdM� �ZidNdO� ZjdPdQ� ZkdRdS� ZldTdU� ZmdVdW� ZndXdY� ZodZd[� Zpd�d\d]�Zqd�d^d_�Zrd`da� Zsdbdc� Ztd�ddde�Zud�dfdg�ZveCd�dhdi��ZweCd�djdk��Zxe=d�dldm��ZyeCdndo� �ZzeCdpdq� �Z{eCdrds� �Z|d�dtdu�Z}d�dvdw�Z~d�dxdy�ZeCdzd{� �Z�eCd|d}� �Z�eCd~d� �Z�d�d�d��Z�d�d�d��Z�d�d�d��Z�d�d�d��Z�d�d�d��Z�d�d�d��Z�eCd�d�� �Z�eCd�d�� �Z�eCd�d�� �Z�d�d�d��Z�d�d�� Z�d�d�d��Z�d�d�� Z��dd�d��Z��dd�d��Z�eCd�d�� �Z�eCd�d�� �Z�eCd�d�� �Z�d�d�� Z��dd�d��Z��d d�d��Z�d�d�� Z��d d�d��Z��d
d�d��Z�d�d�� Z��dd�d��Z��dd�d��Z��dd�d��Z��dd�d��Z�eCd�d�� �Z�eC�dd�d���Z�eC�dd�d���Z�eCd�d�� �Z�d�dÄ Z�d�dń Z�d�dDŽ Z��dd�dɄZ�d�d˄ Z��dd�d̈́Z��dd�dτZ��dd�dфZ�d�dӄ Z�d�dՄ Z�eCd�dׄ �Z�d�dل Z�d�dۄ Z�d�d݄ Z�d�d߄ Z�d�d� Z�d#S ( �BPFs
[^a-zA-Z0-9_]ZtimeZfs�fileZbioZrequestZallocZsk_buffZ
net_device)z linux/time.hz
linux/fs.hzlinux/blkdev.hz linux/slab.hzlinux/netdevice.hs sys_s
__x64_sys_s __x32_compat_sys_s __ia32_compat_sys_s __arm64_sys_s __s390x_sys_s __s390_sys_r c @ s e Zd ZdejfdejfgZdS )z BPF.timespec�tv_sec�tv_nsecN)r8 r9 r: r# �c_long�_fields_r r r r �timespec@ s r� z
librt.so.1T)Z use_errnoc C sH | j � }| j| jtj|��dkr8tj� }t|tj|���|j d |j
S )z�monotonic_time()
Returns the system monotonic time from clock_gettime, using the
CLOCK_MONOTONIC constant. The time returned is in nanoseconds.
r g e��A) r� �_clock_gettime�CLOCK_MONOTONICr# r* � get_errno�OSError�os�strerrorr� r� )�cls�t�errnor r r �monotonic_timeG s
zBPF.monotonic_timec C sX d}xN| j j� D ]@\}}x6|D ].}x(|D ] }||kr(||kr(|d| 7 }q(W q W qW |S )a1
Generates #include statements automatically based on a set of
recognized types such as sk_buff and bio. The input is all the words
that appear in the BPF program, and the output is a (possibly empty)
string of #include statements, such as "#include <linux/fs.h>".
� z#include <%s>
)�_auto_includes�items)r� Z
program_wordsZheaders�header�keywords�keywordZwordr r r �generate_auto_includesS s
zBPF.generate_auto_includesc @ s e Zd Zdd� ZdS )z BPF.Functionc C s || _ || _|| _d S )N)�bpfr/ �fd)r' r� r/ r� r r r r) g s zBPF.Function.__init__N)r8 r9 r: r) r r r r �Functionf s r� c C sb | r^t jj| �s^ttjd �}djt jjt jj|j � ��| g�}t jj|�rR|} n t
d| ��| S )z1 If filename is invalid, search in ./ of argv[0] r � /zCould not find file %s) r� �path�isfiler �sys�argv�join�abspath�dirname� __bytes__� Exception)�filenameZargv0r� r r r �
_find_filel s " zBPF._find_filec C sr dd� }t jj| �\}}|r*|| �rn| S nDxBt jd jt j�D ],}|jd�}t jj|j� | �}||�r>|S q>W dS )a�
find_exe(bin_path)
Traverses the PATH environment variable, looking for the first
directory that contains an executable file named bin_path, and
returns the full path to that file, or None if no such file
can be found. This is meant to replace invocations of the
"which" shell utility, which doesn't have portable semantics
for skipping aliases.
c S s t jj| �ot j| t j�S )N)r� r� r� �access�X_OK)�fpathr r r �is_exe� s z BPF.find_exe.<locals>.is_exe�PATH�"N)r� r� �split�environ�pathsep�stripr� �encode)Zbin_pathr� r� Zfnamer� Zexe_filer r r �find_exey s
z BPF.find_exe� Nr Fc
C s� t |�}t |�}t |�}|o | s&t�i | _i | _i | _i | _i | _i | _i | _i | _ i | _
d| _ d| _ t
j| j� || _i | _i | _d| _tjt|� � }
x$t|�D ]\} } tt| ��|
| < q�W |r�tj|�}tj|�}|r�t |dd��}
|
j � }W dQ R X tj t|� � }x(t|�D ] \} }tj |j � �|| < �qW t j!|t|��}|dk�rZt"d ��|| }t j#|| j|
t|
�||�| _| j�s�t"d|�p�d ��x|D ]}|j$| | � �q�W | j%� dS )
aZ Create a new BPF module with the given source code.
Note:
All fields are marked as optional, but either `src_file` or `text`
must be supplied, and not both.
Args:
src_file (Optional[str]): Path to a source file for the module
hdr_file (Optional[str]): Path to a helper header file for the `src_file`
text (Optional[str]): Contents of a source file for the module
debug (Optional[int]): Flags used for debug prints, can be |'d together
See "Debug flags" for explanation
N�rb)�modez%can't generate USDT probe arguments; z%possible cause is missing pid when a z&probe in a shared object has multiple Z locationsz Failed to compile BPF module %sz<text>zJcan't generate USDT probe arguments; possible cause is missing pid when a zpcan't generate USDT probe arguments; possible cause is missing pid when a probe in a shared object has multiple zycan't generate USDT probe arguments; possible cause is missing pid when a probe in a shared object has multiple locations)&r �AssertionError�
kprobe_fds�
uprobe_fds�tracepoint_fds�raw_tracepoint_fds�kfunc_entry_fds�kfunc_exit_fds�lsm_fds� perf_buffers�open_perf_events�_ringbuf_manager� tracefile�atexit�register�cleanup�debug�funcs�tablesr+ r# r- �len� enumerate�bytesr r� r� �open�read�c_void_pZ get_contextr Zbcc_usdt_genargsr� Z bpf_module_create_c_from_stringZattach_uprobes�_trace_autoload)r' Zsrc_fileZhdr_file�textr� ZcflagsZ
usdt_contextsZ allow_rlimit�deviceZattach_usdt_ignore_pidZ cflags_array�i�sr� Z ctx_array�usdtZ usdt_textZ usdt_contextr r r r) � s^
z BPF.__init__c C sD g }x:t dtj| j��D ]$}tj| j|�}|j| j||�� qW |S )z�load_funcs(prog_type=KPROBE)
Load all functions in this BPF module with the given type.
Returns a list of the function handles.r )�ranger �bpf_num_functionsr+ �bpf_function_name�append� load_func)r' � prog_type�fnsr� � func_namer r r �
load_funcs� s
zBPF.load_funcsc
C s t |�}|| jkr | j| S tj| j|�s6td| ��d}| jt@ rJd}n| jt@ rXd}tj | j||tj| j|�tj
| j|�tj | j�tj | j�|d d||� }|dk r�t
j| j� tj� tjkr�td��tjtj� �}td||f ��tj| ||�}|| j|< |S )NzUnknown program %sr r r z!Need super-user privileges to runz!Failed to load BPF program %s: %s)r r� r �bpf_function_startr+ r� r� �DEBUG_BPF_REGISTER_STATE� DEBUG_BPFZ
bcc_func_load�bpf_function_sizeZbpf_module_licenseZbpf_module_kern_versionr� r� � donothingr# r� r� �EPERMr� r� r� r� ) r' r� r� r� � attach_typeZ log_levelr� �errstr�fnr r r r� � s4
z
BPF.load_funcc C sJ t |�}tj| j|�s"td| ��tj| j|�}tj| j|�}tj||�S )zR
Return the eBPF bytecodes for the specified function as a string
zUnknown program %s)r r r� r+ r� r� r# Z string_at)r' r� �start�sizer r r � dump_func s z
BPF.dump_funcc C s | j |�}t||�S )N)r� r )r' r� Zbpfstrr r r �disassemble_func s
zBPF.disassemble_funcc C s( | | }t j| j|j�}t||||d�S )N)�sizeinfo)r �bpf_table_type_idr+ �map_idr )r' Z
table_namer� Z table_objZ
table_typer r r � decode_table# s zBPF.decode_tabler )Z_Bool�charZwchar_tz
unsigned charZshortzunsigned short�intz unsigned intZlongz
unsigned longz long longzunsigned long long�floatZdoublez long doubleZ__int128zunsigned __int128c C s t | t�rtj| S g }g }�xN| d D �]@}t|�dkrX|j|d tj|d �f� q(t|�dk�rZt |d t�r�|j|d tj|d �|d d f� n�t |d t�r�|j|d tj|d �|d f� n�t |d t��rH|d dk�s
|d dk�s
|d dk�rH|d }|dk�r2d t|� }|j|� |j|tj|�f� nt d
t
|� ��q(t d
t
|� ��q(W t j }d }t| �dk�r�| d dk�r�t j
}n.| d dk�r�t j }n| d dk�r�t j }d }|�r�tt
| d �|ft|d|d
��}n tt
| d �|ft||d��}|S )Nr r r r< �union�structZ
struct_packedr� z__anon%dzFailed to decode type %sFT)� _anonymous_Z_pack_r� )r� r� )�
isinstance�
basestringr� � str2ctyper� r� �_decode_table_type�listr� r� �strr# � StructureZUnion�type�dict)ZdescZanon�fieldsr� r/ �baseZ is_packedr� r r r r� ; sL
*$
zBPF._decode_table_typec
C s� t |�}tj| j|�}tj| j|�}tj| j|�ttgk}|dk rFt�| r�| r�tj | j|�j
d�}|svt d| ��t j
tj|��}|s�tj| j|�j
d�} | s�t d| ��t j
tj| ��}t| ||||||d�S )Nr zutf-8z$Failed to load BPF Table %s key descz%Failed to load BPF Table %s leaf desc)�reducer)r r Z bpf_table_idr+ Z bpf_table_fdr� r r
�KeyErrorZbpf_table_key_desc�decoder� r� r� �json�loadsZbpf_table_leaf_descr )
r' r/ ZkeytypeZleaftyper r� �map_fdZ
is_queuestackZkey_descZ leaf_descr r r � get_tableg s" z
BPF.get_tablec C s$ || j kr| j|�| j |< | j | S )N)r� r
)r' �keyr r r � __getitem__z s
zBPF.__getitem__c C s || j |< d S )N)r� )r' r Zleafr r r � __setitem__ s zBPF.__setitem__c C s
t | j�S )N)r� r� )r' r r r �__len__� s z BPF.__len__c C s | j |= d S )N)r� )r' r r r r � __delitem__� s zBPF.__delitem__c C s
| j j� S )N)r� �__iter__)r' r r r r � s z BPF.__iter__c C sJ t | tj�std��tj| j|||�}|dk rFtdj|tj | ����d S )Nz"arg 1 must be of type BPF.Functionr z7Failed to attach BPF function with attach_type {0}: {1})
r� r� r� r� r Zbpf_prog_attachr� �formatr� r� )r� �
attachable_fdr� �flagsr3 r r r � attach_func� s zBPF.attach_funcc C sH t | tj�std��tj| j||�}|dk rDtdj|tj | ����d S )Nz"arg 1 must be of type BPF.Functionr z7Failed to detach BPF function with attach_type {0}: {1})
r� r� r� r� r Zbpf_prog_detach2r� r r� r� )r� r r� r3 r r r � detach_func� s zBPF.detach_funcc C s� t |�}t| tj�s td��tj|�}|dk rLtjt j
� �}td||f ��tj || j �}|dk r�tjt j
� �}td||f ��|| _
d S )Nz"arg 1 must be of type BPF.Functionr z Failed to open raw device %s: %sz%Failed to attach BPF to device %s: %s)r r� r� r� r� r Zbpf_open_raw_sockr� r� r# r� Zbpf_attach_socketr� �sock)r� �devr r� r3 r r r �attach_raw_socket� s
zBPF.attach_raw_socketc C s� dt }y,t|d��}tdd� |D ��}W d Q R X W n: tk
rn } z |jtjkrV|�tg �}W Y d d }~X nX g }d}d}tdd���}�x |D �]} | j� j� dd� \}
} |dkr�| d kr�d}q�n|dkr�| d
kr�d }q�|dk�r
| d kr�d}q�n| d
k�r"d }q�n|dk�r"| d
kr�d }q�| jd��r2q�n:| jd�s�| jd��rLq�n | jd��r\q�nt j
d| ��rlq�|
j � dkr�t j | | �r�| |kr�|j
| � q�W W d Q R X t|�S )Nz%s/../kprobes/blacklistr� c S s g | ]}|j � j� d �qS )r )�rstripr� )�.0�liner r r �
<listcomp>� s z,BPF.get_kprobe_functions.<locals>.<listcomp>r z/proc/kallsymsr r< s __init_begins
__init_endr s __irqentry_text_starts __irqentry_text_ends
_kbl_addr_s __perfs perf_s __SCT__s ^.*\.cold(\.\d+)?$� t� w)r r )�TRACEFSr� �set�IOErrorr� r� r r� �
startswith�re�match�lower� fullmatchr� ) �event_reZblacklist_fileZ blacklist_fZ blacklist�er� Zin_init_sectionZin_irq_sectionZ
avail_filer r� r� r r r �get_kprobe_functions� sZ
zBPF.get_kprobe_functionsc C s t | tj� krtd��d S )Nz/Number of open probes would exceed global quota)r r� �get_probe_limitr� )r' Znum_new_probesr r r �_check_probe_quota� s zBPF._check_probe_quotac C s( t jjd�} | r | j� r t| �S tS d S )NZBCC_PROBE_LIMIT)r� r� �get�isdigitr� �_default_probe_limit)Zenv_probe_limitr r r r* � s zBPF.get_probe_limitc C s. || j kri | j |< || j | |< td7 ad S )Nr )r� r )r' �ev_name�fn_namer� r r r �_add_kprobe_fd� s
zBPF._add_kprobe_fdc C s | j | |= td8 ad S )Nr )r� r )r' r/ r0 r r r �_del_kprobe_fd s zBPF._del_kprobe_fdc C s || j |< td7 ad S )Nr )r� r )r' r/ r� r r r �_add_uprobe_fd
s
zBPF._add_uprobe_fdc C s | j |= td8 ad S )Nr )r� r )r' r/ r r r �_del_uprobe_fd s zBPF._del_uprobe_fdc C s0 x$| j D ]}| jd| �dkr|S qW | j d S )Ns %sbpfr r r5 )�_syscall_prefixes�ksymname)r' �prefixr r r �get_syscall_prefix s zBPF.get_syscall_prefixc C s t |�}| j� | S )N)r r8 )r' r/ r r r �get_syscall_fnname s zBPF.get_syscall_fnnamec C s< t |�}x.| jD ]$}|j|�r| j|t|�d � �S qW |S )N)r r5 r" r9 r� )r' r/ r7 r r r �fix_syscall_fnname' s
zBPF.fix_syscall_fnnamec C s t |�}t |�}t |�}|r�tj|�}| jt|�� d}g }x>|D ]6}y| j||d� W qB |d7 }|j|� Y qBX qBW |t|�kr�td|dj|�f ��d S | jd� | j |tj
�} d|j dd�j d d� }
t j
| jd|
||d�} | dk �rtd||f ��| j|
|| � | S )
Nr )�eventr0 r zwFailed to attach BPF program %s to kprobe %s, it's not traceable (either non-existing, inlined, or marked as "notrace")�/s p_� +� _� .)r r� r) r+ r� �
attach_kprober� r� r� r� r\ �replacer �bpf_attach_kprober� r1 ) r' r; Z event_offr0 r' �matches�failed�probesr r� r/ r� r r r r@ . s6
zBPF.attach_kprobec C s t |�}t |�}t |�}|r�tj|�}d}g }x@|D ]8}y| j|||d� W q4 |d7 }|j|� Y q4X q4W |t|�kr�td|dj|�f ��d S | jd� | j |tj
�} d|j dd�j d d� }
t j
| jd|
|d|�} | dk r�td||f ��| j|
|| � | S )
Nr )r; r0 � maxactiver zzFailed to attach BPF program %s to kretprobe %s, it's not traceable (either non-existing, inlined, or marked as "notrace")r< s r_r= r> r? )r r� r) �attach_kretprober� r� r� r� r+ r� r\ rA r rB r� r1 ) r' r; r0 r' rF rC rD rE r r� r/ r� r r r rG P s6
zBPF.attach_kretprobec C s8 t |�}t| j| j� �}x|D ]}| j||� q W d S )N)r r� r� �keys�detach_kprobe_event_by_fn)r' r/ Zfn_namesr0 r r r �detach_kprobe_eventr s
zBPF.detach_kprobe_eventc C s� t |�}t |�}|| jkr&td| ��tj| j| | �}|dk rJtd��| j||� t| j| �dkr�tj|�}|dk r�td��d S )NzKprobe %s is not attachedr zFailed to close kprobe FDz Failed to detach BPF from kprobe)r r� r� r �bpf_close_perf_event_fdr2 r� Zbpf_detach_kprobe)r' r/ r0 r3 r r r rI x s
z BPF.detach_kprobe_event_by_fnc C sH t |�}d|jdd�jdd� }|r:t |�}| j||� n
| j|� d S )Ns p_r= r> r? )r rA rI rJ )r' r; r0 r/ r r r �
detach_kprobe� s zBPF.detach_kprobec C sH t |�}d|jdd�jdd� }|r:t |�}| j||� n
| j|� d S )Ns r_r= r> r? )r rA rI rJ )r' r; r0 r/ r r r �detach_kretprobe� s zBPF.detach_kretprobec C sn t | �} t|tj�s td��tj| |j|�}|dk rjtj � }|t
j krPtd��nt j
|�}td| |f ��dS )zt
This function attaches a BPF function to a device on the device
driver level (XDP)
z"arg 1 must be of type BPF.Functionr z-Internal error while attaching BPF to device,z try increasing the debug level!z%Failed to attach BPF to device %s: %sNzMInternal error while attaching BPF to device, try increasing the debug level!)r r� r� r� r� r �bpf_attach_xdpr� r# r� r� ZEBADMSGr� r� )r r� r r3 Zerr_nor� r r r �
attach_xdp� s
zBPF.attach_xdpc C s@ t | �} tj| d|�}|dk r<tjtj� �}td| |f ��dS )zw
This function removes any BPF function from a device on the
device driver level (XDP)
r r z'Failed to detach BPF from device %s: %sNr5 )r r rN r� r� r# r� r� )r r r3 r� r r r �
remove_xdp� s zBPF.remove_xdpc
C s� t |�}t |�}t� }|dkr"dn|}tj|||p4d|tjd tjt��tj|��dk rnt d|j
� |j
� f ��|j | }tj|j tj
�j} tj|j � | |fS )Nr r z.could not determine address of symbol %s in %sr5 )r r r Zbcc_resolve_symnamer# r$ r% r r* r� r r, r+ r- r. �bcc_procutils_free)
r� r+ Zsymnamer0 r( �sym_offr2 Zc_pidZnew_addrZ module_pathr r r �_check_path_symbol� s
zBPF._check_path_symbolc C s: t | �} tj| d�}|s d S tj|tj�j}tj|� |S )Nr )r r Zbcc_procutils_which_sor# r$ r- r. rQ )Zlibnamer3 Zlibpathr r r � find_library� s
zBPF.find_libraryc C s� g }t jjtd�}x�t j|�D ]t}t jj||�}t jj|�s>q xRt j|�D ]D}t jj||�}t jj|�rJd||f }tj| j� |�rJ|j |� qJW q W |S )N�eventsz%s:%s)
r� r� r� r �listdir�isdirr# r$ r r� )�tp_re�resultsZ
events_dir�categoryZcat_dirr; �evt_dir�tpr r r �get_tracepoints� s zBPF.get_tracepointsc C s t jjtd| |�}t jj|�S )NrU )r� r� r� r rW )rZ r; r[ r r r �tracepoint_exists� s zBPF.tracepoint_existsc C s� t |�}t |�}t |�}|rBx tj|�D ]}| j||d� q(W dS | j|tj�}|jd�\}}tj|j ||�}|dk r�t
d||f ��|| j |< | S )a� attach_tracepoint(tp="", tp_re="", fn_name="")
Run the bpf function denoted by fn_name every time the kernel tracepoint
specified by 'tp' is hit. The optional parameters pid, cpu, and group_fd
can be used to filter the probe. The tracepoint specification is simply
the tracepoint category and the tracepoint name, separated by a colon.
For example: sched:sched_switch, syscalls:sys_enter_bind, etc.
Instead of a tracepoint name, a regular expression can be provided in
tp_re. The program will then attach to tracepoints that match the
provided regular expression.
To obtain a list of kernel tracepoints, use the tplist tool or cat the
file /sys/kernel/debug/tracing/available_events.
Examples:
BPF(text).attach_tracepoint(tp="sched:sched_switch", fn_name="on_switch")
BPF(text).attach_tracepoint(tp_re="sched:.*", fn_name="on_switch")
)r\ r0 N� :r z0Failed to attach BPF program %s to tracepoint %s) r r� r] �attach_tracepointr� r> r� r Zbpf_attach_tracepointr� r� r� )r' r\ rX r0 r� � tp_category�tp_namer� r r r r` � s
zBPF.attach_tracepointc C s` t |�}|| jkr td| ��t |�}| j|tj�}tj|j|�}|dk rRtd��|| j|< | S )a� attach_raw_tracepoint(self, tp=b"", fn_name=b"")
Run the bpf function denoted by fn_name every time the kernel tracepoint
specified by 'tp' is hit. The bpf function should be loaded as a
RAW_TRACEPOINT type. The fn_name is the kernel tracepoint name,
e.g., sched_switch, sys_enter_bind, etc.
Examples:
BPF(text).attach_raw_tracepoint(tp="sched_switch", fn_name="on_switch")
z#Raw tracepoint %s has been attachedr z&Failed to attach BPF to raw tracepoint) r r� r� r� r� rj r Zbpf_attach_raw_tracepointr� )r' r\ r0 r� r� r r r �attach_raw_tracepoint s
zBPF.attach_raw_tracepointc C s: t |�}|| jkr td| ��tj| j| � | j|= dS )z�detach_raw_tracepoint(tp="")
Stop running the bpf function that is attached to the kernel tracepoint
specified by 'tp'.
Example: bpf.detach_raw_tracepoint("sched_switch")
z!Raw tracepoint %s is not attachedN)r r� r� r� �close)r' r\ r r r �detach_raw_tracepoint) s
zBPF.detach_raw_tracepointc C s |j | �s| | }|S )N)r" )r7 r/ r r r �
add_prefix8 s
zBPF.add_prefixc C s2 t j� dkrdS tj� s dS tjd�dkr.dS dS )NZx86_64FZbpf_trampoline_link_progr Tr5 )�platform�machiner �bpf_has_kernel_btfr� r6 r r r r �
support_kfunc> s zBPF.support_kfuncc C s" t j� s dS tjd�dkr dS dS )NFs bpf_lsm_bpfr Tr5 )r ri r� r6 r r r r � support_lsmJ s
zBPF.support_lsmc C sF t |�}tjd|�}|| jkr*td| ��tj| j| � | j|= d S )Ns kfunc__z$Kernel entry func %s is not attached)r r� rf r� r� r� rd )r' r0 r r r � detach_kfuncS s
zBPF.detach_kfuncc C sF t |�}tjd|�}|| jkr*td| ��tj| j| � | j|= d S )Ns
kretfunc__z#Kernel exit func %s is not attached)r r� rf r� r� r� rd )r' r0 r r r �detach_kretfunc\ s
zBPF.detach_kretfuncc C sb t |�}tjd|�}|| jkr*td| ��| j|tj�}tj|j �}|dk rTtd��|| j|< | S )Ns kfunc__z&Kernel entry func %s has been attachedr z)Failed to attach BPF to entry kernel func)
r r� rf r� r� r� rl r �bpf_attach_kfuncr� )r' r0 r� r� r r r � attach_kfunce s
zBPF.attach_kfuncc C sb t |�}tjd|�}|| jkr*td| ��| j|tj�}tj|j �}|dk rTtd��|| j|< | S )Ns
kretfunc__z%Kernel exit func %s has been attachedr z(Failed to attach BPF to exit kernel func)
r r� rf r� r� r� rl r rn r� )r' r0 r� r� r r r �attach_kretfuncs s
zBPF.attach_kretfuncc C sF t |�}tjd|�}|| jkr*td| ��tj| j| � | j|= d S )Ns lsm__zLSM %s is not attached)r r� rf r� r� r� rd )r' r0 r r r �
detach_lsm� s
zBPF.detach_lsmc C sb t |�}tjd|�}|| jkr*td| ��| j|tj�}tj|j �}|dk rTtd��|| j|< | S )Ns lsm__zLSM %s has been attachedr zFailed to attach LSM)
r r� rf r� r� r� rm r Zbpf_attach_lsmr� )r' r0 r� r� r r r �
attach_lsm� s
zBPF.attach_lsmc C s$ t jd�dks t jd�dkr dS dS )NZbpf_find_raw_tracepointr Zbpf_get_raw_tracepointTFr5 r5 )r� r6 r r r r �support_raw_tracepoint� s zBPF.support_raw_tracepointc C sZ d} t | ��D}x<|D ]4}|j� jdd�\}}}|jd�d }|dkrdS qW dS Q R X d S ) Nz/proc/kallsyms� r � r Zbpf_trace_modulesTF)r� r r� )ZkallsymsZsymsr �_r/ r r r � support_raw_tracepoint_in_module� s
z$BPF.support_raw_tracepoint_in_modulec C s t | �} t |�}tj| |�S )N)r r �kernel_struct_has_field)Z struct_nameZ
field_namer r r rx � s zBPF.kernel_struct_has_fieldc C st t |�}|| jkr td| ��tj| j| �}|dk r>td��|jd�\}}tj||�}|dk rhtd��| j|= dS )z�detach_tracepoint(tp="")
Stop running a bpf function that is attached to the kernel tracepoint
specified by 'tp'.
Example: bpf.detach_tracepoint("sched:sched_switch")
z Tracepoint %s is not attachedr z$Failed to detach BPF from tracepointr_ N)r r� r� r rK r� Zbpf_detach_tracepoint)r' r\ r3 ra rb r r r �detach_tracepoint� s
zBPF.detach_tracepointc
C s, t j||||||||�} | dk r(td��| S )Nr z"Failed to attach BPF to perf event)r Zbpf_attach_perf_eventr� )
r' �progfd�ev_type� ev_config�
sample_period� sample_freqr( �cpu�group_fdr3 r r r �_attach_perf_event� s
zBPF._attach_perf_eventc
C s� t |�}| j|tj�} i }
|dkrB| j| j|||||||�|
|< n.x,t� D ]"} | j| j|||||| |�|
| < qJW |
| j||f< d S )Nr )r r� r� r` r� r� r r� ) r' r{ r| r0 r} r~ r( r r� r� r3 r� r r r �attach_perf_event� s zBPF.attach_perf_eventc C s. t j|tj|�|||d�}|dk r*td��|S )Nr z&Failed to attach BPF to perf raw event)r Zbpf_attach_perf_event_rawr# r* r� )r' rz �attrr( r r� r3 r r r �_attach_perf_event_raw� s
zBPF._attach_perf_event_rawc C sz t |�}| j|tj�}i }|dkr<| j|j||||�||< n(x&t� D ] }| j|j||||�||< qDW || j|j|j f< d S )Nr )
r r� r� r` r� r� r r� r �config) r' r� r0 r( r r� r� r3 r� r r r �attach_perf_event_raw� s
zBPF.attach_perf_event_rawc C s| y| j ||f }W n$ tk
r6 tdj||���Y nX d}x |j� D ]}tj|�pV|}qFW |dkrltd��| j ||f= d S )Nz)Perf event type {} config {} not attachedr z$Failed to detach BPF from perf event)r� r r� r �valuesr rK )r' r{ r| Zfdsr3 r� r r r �detach_perf_event� s zBPF.detach_perf_eventc C s t dd� tj| |�D ��S )Nc S s g | ] \}}|�qS r r )r r/ rv r r r r s z*BPF.get_user_functions.<locals>.<listcomp>)r r� � get_user_functions_and_addresses)r/ �sym_rer r r �get_user_functions� s zBPF.get_user_functionsc C s t dd� tj| |�D ��S )a�
We are returning addresses here instead of symbol names because it
turns out that the same name may appear multiple times with different
addresses, and the same address may appear multiple times with the same
name. We can't attach a uprobe to the same address more than once, so
it makes sense to return the unique set of addresses that are mapped to
a symbol that matches the provided regular expression.
c S s g | ] \}}|�qS r r )r rv Zaddressr r r r s z*BPF.get_user_addresses.<locals>.<listcomp>)r r� r� )r/ r� r r r �get_user_addresses s
zBPF.get_user_addressesc sN t | �} t ���g � � �fdd�}tj| t|��}|dk rJtd|| f ��� S )Nc s" | }t j�|�r � j||f� dS )Nr )r# r$ r� )Zsym_namer0 Zdname)� addressesr� r r �sym_cb s z4BPF.get_user_functions_and_addresses.<locals>.sym_cbr z"Error %d enumerating symbols in %s)r r Zbcc_foreach_function_symbolr r� )r/ r� r� r3 r )r� r� r r� s z$BPF.get_user_functions_and_addressesc C s> |dkr d|| j jd|�|f S d|| j jd|�||f S d S )Nr s
%s_%s_0x%xr> s
%s_%s_0x%x_%dr5 )� _probe_repl�sub)r' r7 r� r0 r( r r r �_get_uprobe_evname! s zBPF._get_uprobe_evnamec C s� |dks t �|dk r$|dks$t d��t|�}t|�}t|�}t|�}|r�tj||�}| jt|�� x |D ]} | j|| ||d� qhW dS tj|||||�\}
}| jd� | j|tj �} | j
d|
||�} t j | j
d| |
||�}
|
dk r�td��| j| |
� | S )a� attach_uprobe(name="", sym="", sym_re="", addr=None, fn_name=""
pid=-1, sym_off=0)
Run the bpf function denoted by fn_name every time the symbol sym in
the library or binary 'name' is encountered. Optional parameters pid,
cpu, and group_fd can be used to filter the probe.
If sym_off is given, attach uprobe to offset within the symbol.
The real address addr may be supplied in place of sym, in which case sym
must be set to its default value. If the file is a non-PIE executable,
addr must be a virtual address, otherwise it must be an offset relative
to the file load address.
Instead of a symbol name, a regular expression can be provided in
sym_re. The uprobe will then attach to symbols that match the provided
regular expression.
Libraries can be given in the name argument without the lib prefix, or
with the full path (/usr/lib/...). Binaries can be given only with the
full path (/bin/sh). If a PID is given, the uprobe will attach to the
version of the library used by the process.
Example: BPF(text).attach_uprobe("c", "malloc")
BPF(text).attach_uprobe("/usr/bin/python", "main")
r Nz!offset with addr is not supported)r/ r0 r0 r( r � pz Failed to attach BPF to uprobe)r� r r� r� r+ r� �
attach_uproberS r� r\ r� r �bpf_attach_uprober� r� r3 )r' r/ r2 r� r0 r0 r( rR r� �sym_addrr� r� r/ r� r r r r� ) s.
zBPF.attach_uprobec C s� t |�}t |�}t |�}t |�}|rPx&tj||�D ]}| j||||d� q2W dS tj||||�\}}| jd� | j|tj�} | jd|||�}
t j
| j d|
|||�} | dk r�t d��| j
|
| � | S )a6 attach_uretprobe(name="", sym="", sym_re="", addr=None, fn_name=""
pid=-1)
Run the bpf function denoted by fn_name every time the symbol sym in
the library or binary 'name' finishes execution. See attach_uprobe for
meaning of additional parameters.
)r/ r0 r0 r( Nr � rr z!Failed to attach BPF to uretprobe)r r� r� �attach_uretproberS r+ r� r\ r� r r� r� r� r3 ) r' r/ r2 r� r0 r0 r( r� r� r� r/ r� r r r r� b s$
zBPF.attach_uretprobec C s^ || j krtd| ��tj| j | �}|dk r6td��tj|�}|dk rPtd��| j|� d S )NzUprobe %s is not attachedr z Failed to detach BPF from uprobe)r� r� r rK Zbpf_detach_uprober4 )r' r/ r3 r r r �detach_uprobe_event� s
zBPF.detach_uprobe_eventc C sD t |�}t |�}tj|||||�\}}| jd|||�}| j|� dS )z�detach_uprobe(name="", sym="", addr=None, pid=-1)
Stop running a bpf function that is attached to symbol 'sym' in library
or binary 'name'.
r� N)r r� rS r� r� )r' r/ r2 r0 r( rR r� r/ r r r �
detach_uprobe� s
zBPF.detach_uprobec C sB t |�}t |�}tj||||�\}}| jd|||�}| j|� dS )z�detach_uretprobe(name="", sym="", addr=None, pid=-1)
Stop running a bpf function that is attached to symbol 'sym' in library
or binary 'name'.
r� N)r r� rS r� r� )r' r/ r2 r0 r( r� r/ r r r �detach_uretprobe� s
zBPF.detach_uretprobec C sn �xft dtj| j��D �]N}tj| j|�}|jd�rb| j|tj�}| j | j
|dd � �|j d� q|jd�r�| j|tj�}| j | j
|dd � �|j d� q|jd�r�| j|tj
�}|j td�d � jdd �}| j||j d
� q|jd ��r | j|tj�}|j td �d � }| j||j d
� q|jd ��r6| j|d
� q|jd��rP| j|d
� q|jd�r| j|d
� qW d S )Nr s kprobe__r )r; r0 s kretprobe__rG s tracepoint__s __r_ )r\ r0 s raw_tracepoint__s kfunc__)r0 s
kretfunc__s lsm__)r� r r� r+ r� r" r� r� r\ r@ r: r/ rG r> r� rA r` rj rc ro rp rr )r' r� r� r� r\ r r r r� � s4
zBPF._trace_autoloadc C sN | j sHtdt d�| _ |rH| j j� }tj|tj�}tj|tj|tjB � | j S )zWtrace_open(nonblocking=False)
Open the trace_pipe if not already open
z
%s/trace_piper� ) r� r� r �fileno�fcntlZF_GETFLZF_SETFLr� �
O_NONBLOCK)r' � nonblockingr� Zflr r r �
trace_open� s
zBPF.trace_openc C s �x| j |�}| r |r d
S |jd�r(q|dd� j� }|dd� }|jd�}y |d|� j� \}}}}W n$ tk
r� } zwW Y dd} ~ X nX |dd� }||d d� }|jd�}
||
d d� } y |t|�t|�|t|�| fS tk
�r } zdS d} ~ X qX qW dS )z�trace_fields(nonblocking=False)
Read from the kernel debug trace pipe and return a tuple of the
fields (task, pid, cpu, flags, timestamp, msg) or None if no
line was read (nonblocking=True)
NrA s CPU:r rL r_ r r �Unknownr � )N)NNNNNNr5 )r� r r r� r� r� )�trace_readliner" �lstrip�findr� r� r� r� ) r' r� r ZtaskZts_endr( r r Ztsr( Zsym_end�msgr r r � trace_fields� s*
zBPF.trace_fieldsc C s: | j |�}d}y|jd�j� }W n tk
r4 Y nX |S )z�trace_readline(nonblocking=False)
Read from the kernel debug trace pipe and return one line
If nonblocking is False, this will block until ctrl-C is pressed.
Ni )r� �readliner r! )r' r� Ztracer r r r r� � s
zBPF.trace_readlinec C sJ xD|r$| j dd�}|sq|j|� }n | jdd�}t|� tjj� qW dS )a trace_print(self, fmt=None)
Read from the kernel debug trace pipe and print on stdout.
If fmt is specified, apply as a format string to the output. See
trace_fields for the members of the tuple
example: trace_print(fmt="pid {1}, msg = {5}")
F)r� N)r� r r� �printr� �stdout�flush)r' Zfmtr r r r r � trace_print s zBPF.trace_printc C s6 | dk r| dkrd} | t jkr,t| �t j| < t j| S )z�_sym_cache(pid)
Returns a symbol cache for the specified PID.
The kernel symbol cache is accessed by providing any PID less than zero.
r r r5 r5 )r� � _sym_cachesr" )r( r r r �
_sym_cache s
zBPF._sym_cachec C s6 t t| ��}|jd�d kr�t� }t� }| j|_| j|_| j|j_t j
t j t
j|�t
j|��}|dk r�|jr�|jr�d|jt
j|jt
j�j } }
} q�d| d } }
} q�|j|jt
j|jt
j�j } }
} nt j|�j| |�\} }
} |r�| dk r�d|
nd}
| �p d} | |
} |�r*| dk �r*dtjj| � nd} | | S )
ay sym(addr, pid, show_module=False, show_offset=False)
Translate a memory address into a function name for a pid, which is
returned. When show_module is True, the module name is also included.
When show_offset is True, the instruction offset as a hexadecimal
number is also included in the string.
A pid of less than zero will access the kernel symbol cache.
Example output when both show_module and show_offset are True:
"start_thread+0x202 [libpthread-2.24.so]"
Example output when both show_module and show_offset are False:
"start_thread"
Zbpf_stack_build_idr r Ns +0x%xr� s [unknown]s [%s]r5 )r� r r� r r ZstatusZbuild_idr, �ur Zbcc_buildsymcache_resolver� �
_bsymcacher# r* r+ r$ r- r. r/ r� r4 r� r� �basename) r0 r( � show_module� show_offsetr1 Z
typeofaddrr2 �br3 r/ r, r+ r r r r2 $ s.
$zBPF.symc C s t j| d||d�S )a� ksym(addr)
Translate a kernel memory address into a kernel function name, which is
returned. When show_module is True, the module name ("kernel") is also
included. When show_offset is true, the instruction offset as a
hexadecimal number is also included in the string.
Example output when both show_module and show_offset are True:
"default_idle+0x0 [kernel]"
r Fr5 )r� r2 )r0 r� r� r r r �ksymU s zBPF.ksymc C s t jd�jd| �S )z�ksymname(name)
Translate a kernel name into an address. This is the reverse of
ksym. Returns -1 when the function name is unknown.r Nr5 )r� r� r7 )r/ r r r r6 c s z BPF.ksymnamec C s
t | j�S )z�num_open_kprobes()
Get the number of open K[ret]probes. Can be useful for scenarios where
event_re is used while attaching and detaching probes.
)r� r� )r' r r r �num_open_kprobesk s zBPF.num_open_kprobesc C s
t | j�S )zInum_open_uprobes()
Get the number of open U[ret]probes.
)r� r� )r' r r r �num_open_uprobess s zBPF.num_open_uprobesc C s
t | j�S )zLnum_open_tracepoints()
Get the number of open tracepoints.
)r� r� )r' r r r �num_open_tracepointsz s zBPF.num_open_tracepointsc C sL t jt| j� � }x"t| jj� �D ]\}}|||< q"W tjt|�||� dS )z�perf_buffer_poll(self)
Poll from all open perf ring buffers, calling the callback that was
provided when calling open_perf_buffer for each entry.
N)r# r� r� r� r� r� r Zperf_reader_poll)r' �timeout�readersr� �vr r r �perf_buffer_poll� s zBPF.perf_buffer_pollc C sJ t jt| j� � }x"t| jj� �D ]\}}|||< q"W tjt|�|� dS )z�perf_buffer_consume(self)
Consume all open perf buffers, regardless of whether or not
they currently contain events data. Necessary to catch 'remainder'
events when wakeup_events > 1 is set in open_perf_buffer
N)r# r� r� r� r� r� r Zperf_reader_consume)r' r� r� r� r r r �perf_buffer_consume� s zBPF.perf_buffer_consumec C s | j |� dS )zMkprobe_poll(self)
Deprecated. Use perf_buffer_poll instead.
N)r� )r' r� r r r � kprobe_poll� s zBPF.kprobe_pollc C sL | j s&tj|||�| _ | j sHtd��n"tj| j |||�}|dk rHtd��d S )NzCould not open ring bufferr )r� r Zbpf_new_ringbufr� Zbpf_add_ringbuf)r' r r� Zctx�retr r r �_open_ring_buffer� s
zBPF._open_ring_bufferc C s | j std��tj| j |� dS )z�ring_buffer_poll(self)
Poll from all open ringbuf buffers, calling the callback that was
provided when calling open_ring_buffer for each entry.
zNo ring buffers to pollN)r� r� r Zbpf_poll_ringbuf)r' r� r r r �ring_buffer_poll� s zBPF.ring_buffer_pollc C s | j std��tj| j � dS )a/ ring_buffer_consume(self)
Consume all open ringbuf buffers, regardless of whether or not
they currently contain events data. This is best for use cases
where low latency is desired, but it can impact performance.
If you are unsure, use ring_buffer_poll instead.
zNo ring buffers to pollN)r� r� r Zbpf_consume_ringbuf)r' r r r �ring_buffer_consume� s zBPF.ring_buffer_consumec C s t j� S )N)r Zbcc_free_memory)r' r r r �free_bcc_memory� s zBPF.free_bcc_memoryc C sN yt jtj| j� � W n2 tk
rH } ztdt|� � W Y dd}~X nX dS )zJadd_module(modname)
Add a library or exe to buildsym cache
z&Error adding module to build sym cacheN)r Z bcc_buildsymcache_add_moduler� r� r� r� r� r� )�modnamer( r r r �
add_module� s zBPF.add_modulec C s dS )zthe do nothing exit handlerNr )r' r r r r� � s z
BPF.donothingc C sL x.t | jj� �D ] \}}tj|j� | j|= qW | jrHtj| j� d| _dS )zvclose(self)
Closes all associated files descriptors. Attached BPF programs are not
detached.
N) r� r� r� r� rd r� r+ r Zbpf_module_destroy)r' r/ r� r r r rd � s z BPF.closec C s� x$t | jj� �D ]\}}| j|� qW x$t | jj� �D ]\}}| j|� q6W x$t | jj� �D ]\}}| j|� q\W x$t | jj� �D ]\}}| j |� q�W x$t | j
j� �D ]\}}| j |� q�W x$t | j j� �D ]\}}| j
|� q�W x$t | jj� �D ]\}}| j|� q�W t | jj� �}x(|D ] }t| j| t��r | j|= �q W x(t | jj� �D ]\}}| j||� �qRW | j�r�| jj� d | _| j� | j�r�tj| j� d | _d S )N)r� r� r� rJ r� r� r� ry r� re r� rl r� rm r� rq r� rH r� r
r� r� r� rd r� r Zbpf_free_ringbuf)r' �kr� Z
table_keysr r{ r| r r r r� � s6
z BPF.cleanupc C s | S )Nr )r' r r r � __enter__ s z
BPF.__enter__c C s | j � d S )N)r� )r' �exc_typeZexc_valZexc_tbr r r �__exit__ s z BPF.__exit__r5 )Nr5 )F)NNN)r )r� r r� r� )r� r� r� r )N)N)r )r )r )r� r� r� )r� r� )r� )r� )r� )r� )r� )r� )r� )r� r5 r5 r5 r5 r5 )r5 r5 r� r r r5 r5 r5 r5 r5 r5 r5 )r5 r� r5 r5 r5 r5 r5 )r5 r5 r5 )r� r� r� Nr� r5 r r5 )r� r� r� Nr� r5 r5 )r� r� Nr5 r r5 )r� r� Nr5 )F)F)F)N)FFT)FFr5 )r5 r5 )r5 )Nr5 )r5 )�r8 r9 r: rW r[ r\ r] r^ r> r_ r` ra rb rc rd re rf rg rh ri rj rk rl rm ry rz r{ r| r} r~ r r� ZXDP_FLAGS_UPDATE_IF_NOEXISTr� ZXDP_FLAGS_SKB_MODEr� ZXDP_FLAGS_DRV_MODEr� ZXDP_FLAGS_HW_MODEr� ZXDP_FLAGS_REPLACEr# �compiler� r� r Zbcc_buildsymcache_newr� r� r5 r� r# r� r� ZCDLLZ_librtZ
clock_gettimer� Zc_intr% Zargtypes� classmethodr� r� r �objectr� � staticmethodr� r� r) r� r� r� r� r� Zc_boolZc_charZc_wcharZc_ubyteZc_shortZc_ushortZc_uintr� Zc_ulongZ
c_longlongr6 Zc_floatZc_doubleZ c_longdoubleZc_int64Zc_uint64r� r� r
r r
r r r r r r r) r+ r* r1 r2 r3 r4 r8 r9 r: r@ rG rJ rI rL rM rO rP rS rT r] r^ r` rc re rf rj rk rl rm ro rp rq rr rs rw rx ry r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r2 r� r6 r� r� r� r� r� r� r� r� r� r� r� r� rd r� r� r� r r r r r� � sb
N
,
B
"
"
&
8
#
0
#r� )@Z
__future__r r� Zctypesr# r� r r� r# r� r� rg Zlibbccr r r r r �tabler r
r r r
Zperfr Zutilsr r r r r �versionr Z disassemblerr r r� r r r� � NameErrorr� r. r r r Z
DEBUG_LLVM_IRr� ZDEBUG_PREPROCESSORZ DEBUG_SOURCEr� Z DEBUG_BTFr� r" r; r@ rD rF rW rn ry r r� r r r r �<module> sP
+
*