📁 File Manager Pro
v10.0.3 | PHP: 8.1.34
Server: Apache
2026-06-21 11:07:55
📂
/ (Root)
/
usr
/
lib
/
python3.6
/
site-packages
/
bcc
/
__pycache__
📍 /usr/lib/python3.6/site-packages/bcc/__pycache__
🔄 Refresh
✏️
Editing: __init__.cpython-36.pyc
Read Only
3 :�)gh � @ s� d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl Z d dl Z ddl m Z mZmZmZmZ ddlmZmZmZmZmZ ddlmZ ddlmZm Z m Z m Z m Z ddl m!Z! dd l"m#Z#m$Z$ dd l%m&Z&m'Z' ye( W n e)k �r e*Z(Y nX d Z+d a,d d � Z-dZ.dZ/dZ0dZ1dZ2dZ3dZ4G dd� de5�Z6G dd� d�Z7G dd� d�Z8G dd� d�Z9G d d � d �Z:G d d � d �Z;G d d!� d!�Z<G d"d#� d#�Z=G d$d%� d%�Z>G d&d'� d'e5�Z?dS )(� )�print_functionN� )�lib� bcc_symbol�bcc_symbol_option�bcc_stacktrace_build_id� _SYM_CB_TYPE)�Table�PerfEventArray�RingBuf�BPF_MAP_TYPE_QUEUE�BPF_MAP_TYPE_STACK)�Perf)�get_online_cpus�printb�_assert_is_bytes� ArgString� StrcmpRewrite)� __version__)�disassemble_prog� decode_map)�USDT� USDTExceptioni� c C s t S )N)�_num_open_probes� r r � /usr/lib/python3.6/__init__.py�_get_num_open_probes+ s r z/sys/kernel/debug/tracing� � � � � c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )� SymbolCachec C s t j|tjd tjt���| _d S )N)r Zbcc_symcache_new�ct�cast�POINTERr �cache)�self�pidr r r �__init__A s zSymbolCache.__init__c C s� t � }|r"tj| j|tj|��}ntj| j|tj|��}|dk rp|jrf|jrfd|jtj |jtj �j fS d|dfS |r�|j }tj tj|�� n|j}||jtj |jtj �j fS )a� Return a tuple of the symbol (function), its offset from the beginning of the function, and the module in which it lies. For example: ("start_thread", 0x202, "/usr/lib/.../libpthread-2.24.so") If the symbol cannot be found but we know which module it is in, return the module name and the offset from the beginning of the module. If we don't even know the module, return the absolute address as the offset. r N)r r Zbcc_symcache_resolver& r# �byrefZ bcc_symcache_resolve_no_demangle�module�offsetr$ �c_char_p�valueZ demangle_nameZ bcc_symbol_free_demangle_name�name)r' �addr�demangle�sym�resZname_resr r r �resolveE s zSymbolCache.resolvec C s> t |�}t |�}tj� }tj| j||tj|��dk r8dS |jS )Nr r ���)r r# � c_ulonglongr Zbcc_symcache_resolve_namer& r* r. )r' r+ r/ r0 r r r � resolve_nameb s zSymbolCache.resolve_nameN)�__name__� __module__� __qualname__r) r4 r7 r r r r r" @ s r" c @ s$ e Zd ZdZdZdZdZdZdZdS )�PerfTyper r r � r � N) r8 r9 r: ZHARDWAREZSOFTWARE� TRACEPOINTZHW_CACHE�RAWZ BREAKPOINTr r r r r; k s r; c @ s4 e Zd ZdZdZdZdZdZdZdZ dZ d Z d Z d S ) � PerfHWConfigr r r r< r r= � � r � N) r8 r9 r: Z CPU_CYCLESZ INSTRUCTIONSZCACHE_REFERENCESZ CACHE_MISSESZBRANCH_INSTRUCTIONSZ BRANCH_MISSESZ BUS_CYCLESZSTALLED_CYCLES_FRONTENDZSTALLED_CYCLES_BACKENDZREF_CPU_CYCLESr r r r r@ t s r@ c @ s8 e Zd ZdZdZdZdZdZdZdZ dZ d Z d Z d Z d S ) � PerfSWConfigr r r r< r r= rA rB r rC � N)r8 r9 r: Z CPU_CLOCKZ TASK_CLOCKZ PAGE_FAULTSZCONTEXT_SWITCHESZCPU_MIGRATIONSZPAGE_FAULTS_MINZPAGE_FAULTS_MAJZALIGNMENT_FAULTSZEMULATION_FAULTSZDUMMYZ BPF_OUTPUTr r r r rD � s rD c @ sp e Zd ZdZd Zd Zd Zd Zd Zd!Z d"Z d#Z d$Z d%Z d&Zd'Zd(Zd)Zd*Zd+Zd,Zd-Zd.Zd/Zd0Zd1Zd2Zd3ZdS )4�PerfEventSampleFormatr r r r< r r= rA rB r rC rE � � � � � r � � � � � � � � Nr r r r r r! �@ � � i i i i i i @ i � i i i i i i i @ i � i ) r8 r9 r: ZIPZTIDZTIMEZADDRZREADZ CALLCHAINZIDZCPUZPERIODZ STREAM_IDr? Z BRANCH_STACKZ REGS_USERZ STACK_USERZWEIGHTZDATA_SRCZ IDENTIFIERZ TRANSACTIONZ REGS_INTRZ PHYS_ADDRZAUXZCGROUPZDATA_PAGE_SIZEZCODE_PAGE_SIZEZ WEIGHT_STRUCTr r r r rF � s2 rF c @ s` e Zd ZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZdZdZdZdZdZdS )� BPFProgTyper r r< r r= rA rB r rC rE rG rH rI rJ rK r rL rM � � � N)r8 r9 r: � SOCKET_FILTER�KPROBE� SCHED_CLS� SCHED_ACTr> �XDP� PERF_EVENT� CGROUP_SKB� CGROUP_SOCK�LWT_IN�LWT_OUT�LWT_XMIT�SOCK_OPS�SK_SKB� CGROUP_DEVICE�SK_MSG�RAW_TRACEPOINT�CGROUP_SOCK_ADDRZCGROUP_SOCKOPT�TRACING�LSMr r r r rW � s* rW c @ s� e Zd ZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Z!d Z"d!Z#d"Z$d#Z%d$Z&d%Z'd&Z(d'Z)d(S ))� BPFAttachTyper r r r< r r= rA rB r rC rE rG rH rI rJ rK r rL rM rN rO rP rQ rR rS rX rY � � rZ � � r! �! �" �# �$ �% �& N)*r8 r9 r: ZCGROUP_INET_INGRESSZCGROUP_INET_EGRESSZCGROUP_INET_SOCK_CREATEZCGROUP_SOCK_OPSZSK_SKB_STREAM_PARSERZSK_SKB_STREAM_VERDICTrh ZSK_MSG_VERDICTZCGROUP_INET4_BINDZCGROUP_INET6_BINDZCGROUP_INET4_CONNECTZCGROUP_INET6_CONNECTZCGROUP_INET4_POST_BINDZCGROUP_INET6_POST_BINDZCGROUP_UDP4_SENDMSGZCGROUP_UDP6_SENDMSGZ LIRC_MODE2ZFLOW_DISSECTORZ CGROUP_SYSCTLZCGROUP_UDP4_RECVMSGZCGROUP_UDP6_RECVMSGZCGROUP_GETSOCKOPTZCGROUP_SETSOCKOPTZ TRACE_RAW_TPZ TRACE_FENTRYZ TRACE_FEXITZ MODIFY_RETURNZLSM_MACZ TRACE_ITERZCGROUP_INET4_GETPEERNAMEZCGROUP_INET6_GETPEERNAMEZCGROUP_INET4_GETSOCKNAMEZCGROUP_INET6_GETSOCKNAMEZ XDP_DEVMAPZCGROUP_INET_SOCK_RELEASEZ XDP_CPUMAPZ SK_LOOKUPr_ ZSK_SKB_VERDICTr r r r rn � sN rn c @ s e Zd ZdZdZdZdZdZdS )� XDPActionr r r r< r N)r8 r9 r: � XDP_ABORTED�XDP_DROP�XDP_PASS�XDP_TX� XDP_REDIRECTr r r r ry � s ry c @ s e Zd ZdZdZd Zd Zd ZdS ) �XDPFlagsr r r r< r Nr r r r r )r8 r9 r: �UPDATE_IF_NOEXIST�SKB_MODE�DRV_MODE�HW_MODE�REPLACEr r r r r � s r c @ s� e Zd ZejZejZejZejZejZej Z ej Z ej Z ej Z ej Z ejZejZejZejZejZejZejZejZejZejZejZejZejZej Z ej Z e j Z e j!Z"e j#Z$e j%Z&e j'Z(e)j*d�Z+i Z,e-j.� Z/dgddgddgdgdd gd �Z0d d d ddddgZ1dZ2G dd� de3j4�Z5e3j6ddd�Z7e7j8Z9e3j:e3j;e5�ge9_<e=dd� �Z>e=dd� �Z?e@Z@G d d � d eA�ZBeCd d � �ZDeCd d!� �ZEd"d"d#d$g g dd#d%f d&d'�ZFefd(d)�ZGd�d*d+�ZHd,d-� ZId.d/� ZJd�d0d1�ZKe3jLe3jMe3jNe3jOe3jPe3jQe3j:e3jRe3jSe3jTe3jUe3jVe3jWe3jXe3jYe3jZd2 e3j[d2 d3�Z\eCd4d5� �Z]d�d6d7�Z^d8d9� Z_d:d;� Z`d<d=� Zad>d?� Zbd@dA� ZceCd�dBdC��ZdeCdDdE� �ZeeCdFdG� �ZfeCdHdI� �ZgdJdK� ZheCdLdM� �ZidNdO� ZjdPdQ� ZkdRdS� ZldTdU� ZmdVdW� ZndXdY� ZodZd[� Zpd�d\d]�Zqd�d^d_�Zrd`da� Zsdbdc� Ztd�ddde�Zud�dfdg�ZveCd�dhdi��ZweCd�djdk��Zxe=d�dldm��ZyeCdndo� �ZzeCdpdq� �Z{eCdrds� �Z|d�dtdu�Z}d�dvdw�Z~d�dxdy�ZeCdzd{� �Z�eCd|d}� �Z�eCd~d� �Z�d�d�d��Z�d�d�d��Z�d�d�d��Z�d�d�d��Z�d�d�d��Z�d�d�d��Z�eCd�d�� �Z�eCd�d�� �Z�eCd�d�� �Z�d�d�d��Z�d�d�� Z�d�d�d��Z�d�d�� Z��dd�d��Z��dd�d��Z�eCd�d�� �Z�eCd�d�� �Z�eCd�d�� �Z�d�d�� Z��dd�d��Z��d d�d��Z�d�d�� Z��d d�d��Z��d d�d��Z�d�d�� Z��dd�d��Z��dd�d��Z��dd�d��Z��dd�d��Z�eCd�d�� �Z�eC�dd�d���Z�eC�dd�d���Z�eCd�d�� �Z�d�dÄ Z�d�dń Z�d�dDŽ Z��dd�dɄZ�d�d˄ Z��dd�d̈́Z��dd�dτZ��dd�dфZ�d�dӄ Z�d�dՄ Z�eCd�dׄ �Z�d�dل Z�d�dۄ Z�d�d݄ Z�d�d߄ Z�d�d� Z�d#S ( �BPFs [^a-zA-Z0-9_]ZtimeZfs�fileZbioZrequestZallocZsk_buffZ net_device)z linux/time.hz linux/fs.hzlinux/blkdev.hz linux/slab.hzlinux/netdevice.hs sys_s __x64_sys_s __x32_compat_sys_s __ia32_compat_sys_s __arm64_sys_s __s390x_sys_s __s390_sys_r c @ s e Zd ZdejfdejfgZdS )z BPF.timespec�tv_sec�tv_nsecN)r8 r9 r: r# �c_long�_fields_r r r r �timespec@ s r� z librt.so.1T)Z use_errnoc C sH | j � }| j| jtj|��dkr8tj� }t|tj|���|j d |j S )z�monotonic_time() Returns the system monotonic time from clock_gettime, using the CLOCK_MONOTONIC constant. The time returned is in nanoseconds. r g e��A) r� �_clock_gettime�CLOCK_MONOTONICr# r* � get_errno�OSError�os�strerrorr� r� )�cls�t�errnor r r �monotonic_timeG s zBPF.monotonic_timec C sX d}xN| j j� D ]@\}}x6|D ].}x(|D ] }||kr(||kr(|d| 7 }q(W q W qW |S )a1 Generates #include statements automatically based on a set of recognized types such as sk_buff and bio. The input is all the words that appear in the BPF program, and the output is a (possibly empty) string of #include statements, such as "#include <linux/fs.h>". � z#include <%s> )�_auto_includes�items)r� Z program_wordsZheaders�header�keywords�keywordZwordr r r �generate_auto_includesS s zBPF.generate_auto_includesc @ s e Zd Zdd� ZdS )z BPF.Functionc C s || _ || _|| _d S )N)�bpfr/ �fd)r' r� r/ r� r r r r) g s zBPF.Function.__init__N)r8 r9 r: r) r r r r �Functionf s r� c C sb | r^t jj| �s^ttjd �}djt jjt jj|j � ��| g�}t jj|�rR|} n t d| ��| S )z1 If filename is invalid, search in ./ of argv[0] r � /zCould not find file %s) r� �path�isfiler �sys�argv�join�abspath�dirname� __bytes__� Exception)�filenameZargv0r� r r r � _find_filel s " zBPF._find_filec C sr dd� }t jj| �\}}|r*|| �rn| S nDxBt jd jt j�D ],}|jd�}t jj|j� | �}||�r>|S q>W dS )a� find_exe(bin_path) Traverses the PATH environment variable, looking for the first directory that contains an executable file named bin_path, and returns the full path to that file, or None if no such file can be found. This is meant to replace invocations of the "which" shell utility, which doesn't have portable semantics for skipping aliases. c S s t jj| �ot j| t j�S )N)r� r� r� �access�X_OK)�fpathr r r �is_exe� s z BPF.find_exe.<locals>.is_exe�PATH�"N)r� r� �split�environ�pathsep�stripr� �encode)Zbin_pathr� r� Zfnamer� Zexe_filer r r �find_exey s z BPF.find_exe� Nr Fc C s� t |�}t |�}t |�}|o | s&t�i | _i | _i | _i | _i | _i | _i | _i | _ i | _ d| _ d| _ t j| j� || _i | _i | _d| _tjt|� � } x$t|�D ]\} } tt| ��| | < q�W |r�tj|�}tj|�}|r�t |dd��} | j � }W dQ R X tj t|� � }x(t|�D ] \} }tj |j � �|| < �qW t j!|t|��}|dk�rZt"d ��|| }t j#|| j| t| �||�| _| j�s�t"d|�p�d ��x|D ]}|j$| | � �q�W | j%� dS ) aZ Create a new BPF module with the given source code. Note: All fields are marked as optional, but either `src_file` or `text` must be supplied, and not both. Args: src_file (Optional[str]): Path to a source file for the module hdr_file (Optional[str]): Path to a helper header file for the `src_file` text (Optional[str]): Contents of a source file for the module debug (Optional[int]): Flags used for debug prints, can be |'d together See "Debug flags" for explanation N�rb)�modez%can't generate USDT probe arguments; z%possible cause is missing pid when a z&probe in a shared object has multiple Z locationsz Failed to compile BPF module %sz<text>zJcan't generate USDT probe arguments; possible cause is missing pid when a zpcan't generate USDT probe arguments; possible cause is missing pid when a probe in a shared object has multiple zycan't generate USDT probe arguments; possible cause is missing pid when a probe in a shared object has multiple locations)&r �AssertionError� kprobe_fds� uprobe_fds�tracepoint_fds�raw_tracepoint_fds�kfunc_entry_fds�kfunc_exit_fds�lsm_fds� perf_buffers�open_perf_events�_ringbuf_manager� tracefile�atexit�register�cleanup�debug�funcs�tablesr+ r# r- �len� enumerate�bytesr r� r� �open�read�c_void_pZ get_contextr Zbcc_usdt_genargsr� Z bpf_module_create_c_from_stringZattach_uprobes�_trace_autoload)r' Zsrc_fileZhdr_file�textr� ZcflagsZ usdt_contextsZ allow_rlimit�deviceZattach_usdt_ignore_pidZ cflags_array�i�sr� Z ctx_array�usdtZ usdt_textZ usdt_contextr r r r) � s^ z BPF.__init__c C sD g }x:t dtj| j��D ]$}tj| j|�}|j| j||�� qW |S )z�load_funcs(prog_type=KPROBE) Load all functions in this BPF module with the given type. Returns a list of the function handles.r )�ranger �bpf_num_functionsr+ �bpf_function_name�append� load_func)r' � prog_type�fnsr� � func_namer r r � load_funcs� s zBPF.load_funcsc C s t |�}|| jkr | j| S tj| j|�s6td| ��d}| jt@ rJd}n| jt@ rXd}tj | j||tj| j|�tj | j|�tj | j�tj | j�|d d||� }|dk r�t j| j� tj� tjkr�td��tjtj� �}td||f ��tj| ||�}|| j|< |S )NzUnknown program %sr r r z!Need super-user privileges to runz!Failed to load BPF program %s: %s)r r� r �bpf_function_startr+ r� r� �DEBUG_BPF_REGISTER_STATE� DEBUG_BPFZ bcc_func_load�bpf_function_sizeZbpf_module_licenseZbpf_module_kern_versionr� r� � donothingr# r� r� �EPERMr� r� r� r� ) r' r� r� r� � attach_typeZ log_levelr� �errstr�fnr r r r� � s4 z BPF.load_funcc C sJ t |�}tj| j|�s"td| ��tj| j|�}tj| j|�}tj||�S )zR Return the eBPF bytecodes for the specified function as a string zUnknown program %s)r r r� r+ r� r� r# Z string_at)r' r� �start�sizer r r � dump_func s z BPF.dump_funcc C s | j |�}t||�S )N)r� r )r' r� Zbpfstrr r r �disassemble_func s zBPF.disassemble_funcc C s( | | }t j| j|j�}t||||d�S )N)�sizeinfo)r �bpf_table_type_idr+ �map_idr )r' Z table_namer� Z table_objZ table_typer r r � decode_table# s zBPF.decode_tabler )Z_Bool�charZwchar_tz unsigned charZshortzunsigned short�intz unsigned intZlongz unsigned longz long longzunsigned long long�floatZdoublez long doubleZ__int128zunsigned __int128c C s t | t�rtj| S g }g }�xN| d D �]@}t|�dkrX|j|d tj|d �f� q(t|�dk�rZt |d t�r�|j|d tj|d �|d d f� n�t |d t�r�|j|d tj|d �|d f� n�t |d t��rH|d dk�s |d dk�s |d dk�rH|d }|dk�r2d t|� }|j|� |j|tj|�f� nt d t |� ��q(t d t |� ��q(W t j }d }t| �dk�r�| d dk�r�t j }n.| d dk�r�t j }n| d dk�r�t j }d }|�r�tt | d �|ft|d|d ��}n tt | d �|ft||d��}|S )Nr r r r< �union�structZ struct_packedr� z__anon%dzFailed to decode type %sFT)� _anonymous_Z_pack_r� )r� r� )� isinstance� basestringr� � str2ctyper� r� �_decode_table_type�listr� r� �strr# � StructureZUnion�type�dict)ZdescZanon�fieldsr� r/ �baseZ is_packedr� r r r r� ; sL *$ zBPF._decode_table_typec C s� t |�}tj| j|�}tj| j|�}tj| j|�ttgk}|dk rFt�| r�| r�tj | j|�j d�}|svt d| ��t j tj|��}|s�tj| j|�j d�} | s�t d| ��t j tj| ��}t| ||||||d�S )Nr zutf-8z$Failed to load BPF Table %s key descz%Failed to load BPF Table %s leaf desc)�reducer)r r Z bpf_table_idr+ Z bpf_table_fdr� r r �KeyErrorZbpf_table_key_desc�decoder� r� r� �json�loadsZbpf_table_leaf_descr ) r' r/ ZkeytypeZleaftyper r� �map_fdZ is_queuestackZkey_descZ leaf_descr r r � get_tableg s" z BPF.get_tablec C s$ || j kr| j|�| j |< | j | S )N)r� r )r' �keyr r r � __getitem__z s zBPF.__getitem__c C s || j |< d S )N)r� )r' r Zleafr r r � __setitem__ s zBPF.__setitem__c C s t | j�S )N)r� r� )r' r r r �__len__� s z BPF.__len__c C s | j |= d S )N)r� )r' r r r r � __delitem__� s zBPF.__delitem__c C s | j j� S )N)r� �__iter__)r' r r r r � s z BPF.__iter__c C sJ t | tj�std��tj| j|||�}|dk rFtdj|tj | ����d S )Nz"arg 1 must be of type BPF.Functionr z7Failed to attach BPF function with attach_type {0}: {1}) r� r� r� r� r Zbpf_prog_attachr� �formatr� r� )r� � attachable_fdr� �flagsr3 r r r � attach_func� s zBPF.attach_funcc C sH t | tj�std��tj| j||�}|dk rDtdj|tj | ����d S )Nz"arg 1 must be of type BPF.Functionr z7Failed to detach BPF function with attach_type {0}: {1}) r� r� r� r� r Zbpf_prog_detach2r� r r� r� )r� r r� r3 r r r � detach_func� s zBPF.detach_funcc C s� t |�}t| tj�s td��tj|�}|dk rLtjt j � �}td||f ��tj || j �}|dk r�tjt j � �}td||f ��|| _ d S )Nz"arg 1 must be of type BPF.Functionr z Failed to open raw device %s: %sz%Failed to attach BPF to device %s: %s)r r� r� r� r� r Zbpf_open_raw_sockr� r� r# r� Zbpf_attach_socketr� �sock)r� �devr r� r3 r r r �attach_raw_socket� s zBPF.attach_raw_socketc C s� dt }y,t|d��}tdd� |D ��}W d Q R X W n: tk rn } z |jtjkrV|�tg �}W Y d d }~X nX g }d}d}tdd���}�x |D �]} | j� j� dd� \} } |dkr�| d kr�d}q�n|dkr�| d kr�d }q�|dk�r | d kr�d}q�n| d k�r"d }q�n|dk�r"| d kr�d }q�| jd��r2q�n:| jd�s�| jd��rLq�n | jd��r\q�nt j d| ��rlq�| j � dkr�t j | | �r�| |kr�|j | � q�W W d Q R X t|�S )Nz%s/../kprobes/blacklistr� c S s g | ]}|j � j� d �qS )r )�rstripr� )�.0�liner r r � <listcomp>� s z,BPF.get_kprobe_functions.<locals>.<listcomp>r z/proc/kallsymsr r< s __init_begins __init_endr s __irqentry_text_starts __irqentry_text_ends _kbl_addr_s __perfs perf_s __SCT__s ^.*\.cold(\.\d+)?$� t� w)r r )�TRACEFSr� �set�IOErrorr� r� r r� � startswith�re�match�lower� fullmatchr� ) �event_reZblacklist_fileZ blacklist_fZ blacklist�er� Zin_init_sectionZin_irq_sectionZ avail_filer r� r� r r r �get_kprobe_functions� sZ zBPF.get_kprobe_functionsc C s t | tj� krtd��d S )Nz/Number of open probes would exceed global quota)r r� �get_probe_limitr� )r' Znum_new_probesr r r �_check_probe_quota� s zBPF._check_probe_quotac C s( t jjd�} | r | j� r t| �S tS d S )NZBCC_PROBE_LIMIT)r� r� �get�isdigitr� �_default_probe_limit)Zenv_probe_limitr r r r* � s zBPF.get_probe_limitc C s. || j kri | j |< || j | |< td7 ad S )Nr )r� r )r' �ev_name�fn_namer� r r r �_add_kprobe_fd� s zBPF._add_kprobe_fdc C s | j | |= td8 ad S )Nr )r� r )r' r/ r0 r r r �_del_kprobe_fd s zBPF._del_kprobe_fdc C s || j |< td7 ad S )Nr )r� r )r' r/ r� r r r �_add_uprobe_fd s zBPF._add_uprobe_fdc C s | j |= td8 ad S )Nr )r� r )r' r/ r r r �_del_uprobe_fd s zBPF._del_uprobe_fdc C s0 x$| j D ]}| jd| �dkr|S qW | j d S )Ns %sbpfr r r5 )�_syscall_prefixes�ksymname)r' �prefixr r r �get_syscall_prefix s zBPF.get_syscall_prefixc C s t |�}| j� | S )N)r r8 )r' r/ r r r �get_syscall_fnname s zBPF.get_syscall_fnnamec C s< t |�}x.| jD ]$}|j|�r| j|t|�d � �S qW |S )N)r r5 r" r9 r� )r' r/ r7 r r r �fix_syscall_fnname' s zBPF.fix_syscall_fnnamec C s t |�}t |�}t |�}|r�tj|�}| jt|�� d}g }x>|D ]6}y| j||d� W qB |d7 }|j|� Y qBX qBW |t|�kr�td|dj|�f ��d S | jd� | j |tj �} d|j dd�j d d� } t j | jd| ||d�} | dk �rtd||f ��| j| || � | S ) Nr )�eventr0 r zwFailed to attach BPF program %s to kprobe %s, it's not traceable (either non-existing, inlined, or marked as "notrace")�/s p_� +� _� .)r r� r) r+ r� � attach_kprober� r� r� r� r\ �replacer �bpf_attach_kprober� r1 ) r' r; Z event_offr0 r' �matches�failed�probesr r� r/ r� r r r r@ . s6 zBPF.attach_kprobec C s t |�}t |�}t |�}|r�tj|�}d}g }x@|D ]8}y| j|||d� W q4 |d7 }|j|� Y q4X q4W |t|�kr�td|dj|�f ��d S | jd� | j |tj �} d|j dd�j d d� } t j | jd| |d|�} | dk r�td||f ��| j| || � | S ) Nr )r; r0 � maxactiver zzFailed to attach BPF program %s to kretprobe %s, it's not traceable (either non-existing, inlined, or marked as "notrace")r< s r_r= r> r? )r r� r) �attach_kretprober� r� r� r� r+ r� r\ rA r rB r� r1 ) r' r; r0 r' rF rC rD rE r r� r/ r� r r r rG P s6 zBPF.attach_kretprobec C s8 t |�}t| j| j� �}x|D ]}| j||� q W d S )N)r r� r� �keys�detach_kprobe_event_by_fn)r' r/ Zfn_namesr0 r r r �detach_kprobe_eventr s zBPF.detach_kprobe_eventc C s� t |�}t |�}|| jkr&td| ��tj| j| | �}|dk rJtd��| j||� t| j| �dkr�tj|�}|dk r�td��d S )NzKprobe %s is not attachedr zFailed to close kprobe FDz Failed to detach BPF from kprobe)r r� r� r �bpf_close_perf_event_fdr2 r� Zbpf_detach_kprobe)r' r/ r0 r3 r r r rI x s z BPF.detach_kprobe_event_by_fnc C sH t |�}d|jdd�jdd� }|r:t |�}| j||� n | j|� d S )Ns p_r= r> r? )r rA rI rJ )r' r; r0 r/ r r r � detach_kprobe� s zBPF.detach_kprobec C sH t |�}d|jdd�jdd� }|r:t |�}| j||� n | j|� d S )Ns r_r= r> r? )r rA rI rJ )r' r; r0 r/ r r r �detach_kretprobe� s zBPF.detach_kretprobec C sn t | �} t|tj�s td��tj| |j|�}|dk rjtj � }|t j krPtd��nt j |�}td| |f ��dS )zt This function attaches a BPF function to a device on the device driver level (XDP) z"arg 1 must be of type BPF.Functionr z-Internal error while attaching BPF to device,z try increasing the debug level!z%Failed to attach BPF to device %s: %sNzMInternal error while attaching BPF to device, try increasing the debug level!)r r� r� r� r� r �bpf_attach_xdpr� r# r� r� ZEBADMSGr� r� )r r� r r3 Zerr_nor� r r r � attach_xdp� s zBPF.attach_xdpc C s@ t | �} tj| d|�}|dk r<tjtj� �}td| |f ��dS )zw This function removes any BPF function from a device on the device driver level (XDP) r r z'Failed to detach BPF from device %s: %sNr5 )r r rN r� r� r# r� r� )r r r3 r� r r r � remove_xdp� s zBPF.remove_xdpc C s� t |�}t |�}t� }|dkr"dn|}tj|||p4d|tjd tjt��tj|��dk rnt d|j � |j � f ��|j | }tj|j tj �j} tj|j � | |fS )Nr r z.could not determine address of symbol %s in %sr5 )r r r Zbcc_resolve_symnamer# r$ r% r r* r� r r, r+ r- r. �bcc_procutils_free) r� r+ Zsymnamer0 r( �sym_offr2 Zc_pidZnew_addrZ module_pathr r r �_check_path_symbol� s zBPF._check_path_symbolc C s: t | �} tj| d�}|s d S tj|tj�j}tj|� |S )Nr )r r Zbcc_procutils_which_sor# r$ r- r. rQ )Zlibnamer3 Zlibpathr r r � find_library� s zBPF.find_libraryc C s� g }t jjtd�}x�t j|�D ]t}t jj||�}t jj|�s>q xRt j|�D ]D}t jj||�}t jj|�rJd||f }tj| j� |�rJ|j |� qJW q W |S )N�eventsz%s:%s) r� r� r� r �listdir�isdirr# r$ r r� )�tp_re�resultsZ events_dir�categoryZcat_dirr; �evt_dir�tpr r r �get_tracepoints� s zBPF.get_tracepointsc C s t jjtd| |�}t jj|�S )NrU )r� r� r� r rW )rZ r; r[ r r r �tracepoint_exists� s zBPF.tracepoint_existsc C s� t |�}t |�}t |�}|rBx tj|�D ]}| j||d� q(W dS | j|tj�}|jd�\}}tj|j ||�}|dk r�t d||f ��|| j |< | S )a� attach_tracepoint(tp="", tp_re="", fn_name="") Run the bpf function denoted by fn_name every time the kernel tracepoint specified by 'tp' is hit. The optional parameters pid, cpu, and group_fd can be used to filter the probe. The tracepoint specification is simply the tracepoint category and the tracepoint name, separated by a colon. For example: sched:sched_switch, syscalls:sys_enter_bind, etc. Instead of a tracepoint name, a regular expression can be provided in tp_re. The program will then attach to tracepoints that match the provided regular expression. To obtain a list of kernel tracepoints, use the tplist tool or cat the file /sys/kernel/debug/tracing/available_events. Examples: BPF(text).attach_tracepoint(tp="sched:sched_switch", fn_name="on_switch") BPF(text).attach_tracepoint(tp_re="sched:.*", fn_name="on_switch") )r\ r0 N� :r z0Failed to attach BPF program %s to tracepoint %s) r r� r] �attach_tracepointr� r> r� r Zbpf_attach_tracepointr� r� r� )r' r\ rX r0 r� � tp_category�tp_namer� r r r r` � s zBPF.attach_tracepointc C s` t |�}|| jkr td| ��t |�}| j|tj�}tj|j|�}|dk rRtd��|| j|< | S )a� attach_raw_tracepoint(self, tp=b"", fn_name=b"") Run the bpf function denoted by fn_name every time the kernel tracepoint specified by 'tp' is hit. The bpf function should be loaded as a RAW_TRACEPOINT type. The fn_name is the kernel tracepoint name, e.g., sched_switch, sys_enter_bind, etc. Examples: BPF(text).attach_raw_tracepoint(tp="sched_switch", fn_name="on_switch") z#Raw tracepoint %s has been attachedr z&Failed to attach BPF to raw tracepoint) r r� r� r� r� rj r Zbpf_attach_raw_tracepointr� )r' r\ r0 r� r� r r r �attach_raw_tracepoint s zBPF.attach_raw_tracepointc C s: t |�}|| jkr td| ��tj| j| � | j|= dS )z�detach_raw_tracepoint(tp="") Stop running the bpf function that is attached to the kernel tracepoint specified by 'tp'. Example: bpf.detach_raw_tracepoint("sched_switch") z!Raw tracepoint %s is not attachedN)r r� r� r� �close)r' r\ r r r �detach_raw_tracepoint) s zBPF.detach_raw_tracepointc C s |j | �s| | }|S )N)r" )r7 r/ r r r � add_prefix8 s zBPF.add_prefixc C s2 t j� dkrdS tj� s dS tjd�dkr.dS dS )NZx86_64FZbpf_trampoline_link_progr Tr5 )�platform�machiner �bpf_has_kernel_btfr� r6 r r r r � support_kfunc> s zBPF.support_kfuncc C s" t j� s dS tjd�dkr dS dS )NFs bpf_lsm_bpfr Tr5 )r ri r� r6 r r r r � support_lsmJ s zBPF.support_lsmc C sF t |�}tjd|�}|| jkr*td| ��tj| j| � | j|= d S )Ns kfunc__z$Kernel entry func %s is not attached)r r� rf r� r� r� rd )r' r0 r r r � detach_kfuncS s zBPF.detach_kfuncc C sF t |�}tjd|�}|| jkr*td| ��tj| j| � | j|= d S )Ns kretfunc__z#Kernel exit func %s is not attached)r r� rf r� r� r� rd )r' r0 r r r �detach_kretfunc\ s zBPF.detach_kretfuncc C sb t |�}tjd|�}|| jkr*td| ��| j|tj�}tj|j �}|dk rTtd��|| j|< | S )Ns kfunc__z&Kernel entry func %s has been attachedr z)Failed to attach BPF to entry kernel func) r r� rf r� r� r� rl r �bpf_attach_kfuncr� )r' r0 r� r� r r r � attach_kfunce s zBPF.attach_kfuncc C sb t |�}tjd|�}|| jkr*td| ��| j|tj�}tj|j �}|dk rTtd��|| j|< | S )Ns kretfunc__z%Kernel exit func %s has been attachedr z(Failed to attach BPF to exit kernel func) r r� rf r� r� r� rl r rn r� )r' r0 r� r� r r r �attach_kretfuncs s zBPF.attach_kretfuncc C sF t |�}tjd|�}|| jkr*td| ��tj| j| � | j|= d S )Ns lsm__zLSM %s is not attached)r r� rf r� r� r� rd )r' r0 r r r � detach_lsm� s zBPF.detach_lsmc C sb t |�}tjd|�}|| jkr*td| ��| j|tj�}tj|j �}|dk rTtd��|| j|< | S )Ns lsm__zLSM %s has been attachedr zFailed to attach LSM) r r� rf r� r� r� rm r Zbpf_attach_lsmr� )r' r0 r� r� r r r � attach_lsm� s zBPF.attach_lsmc C s$ t jd�dks t jd�dkr dS dS )NZbpf_find_raw_tracepointr Zbpf_get_raw_tracepointTFr5 r5 )r� r6 r r r r �support_raw_tracepoint� s zBPF.support_raw_tracepointc C sZ d} t | ��D}x<|D ]4}|j� jdd�\}}}|jd�d }|dkrdS qW dS Q R X d S ) Nz/proc/kallsyms� r � r Zbpf_trace_modulesTF)r� r r� )ZkallsymsZsymsr �_r/ r r r � support_raw_tracepoint_in_module� s z$BPF.support_raw_tracepoint_in_modulec C s t | �} t |�}tj| |�S )N)r r �kernel_struct_has_field)Z struct_nameZ field_namer r r rx � s zBPF.kernel_struct_has_fieldc C st t |�}|| jkr td| ��tj| j| �}|dk r>td��|jd�\}}tj||�}|dk rhtd��| j|= dS )z�detach_tracepoint(tp="") Stop running a bpf function that is attached to the kernel tracepoint specified by 'tp'. Example: bpf.detach_tracepoint("sched:sched_switch") z Tracepoint %s is not attachedr z$Failed to detach BPF from tracepointr_ N)r r� r� r rK r� Zbpf_detach_tracepoint)r' r\ r3 ra rb r r r �detach_tracepoint� s zBPF.detach_tracepointc C s, t j||||||||�} | dk r(td��| S )Nr z"Failed to attach BPF to perf event)r Zbpf_attach_perf_eventr� ) r' �progfd�ev_type� ev_config� sample_period� sample_freqr( �cpu�group_fdr3 r r r �_attach_perf_event� s zBPF._attach_perf_eventc C s� t |�}| j|tj�} i } |dkrB| j| j|||||||�| |< n.x,t� D ]"} | j| j|||||| |�| | < qJW | | j||f< d S )Nr )r r� r� r` r� r� r r� ) r' r{ r| r0 r} r~ r( r r� r� r3 r� r r r �attach_perf_event� s zBPF.attach_perf_eventc C s. t j|tj|�|||d�}|dk r*td��|S )Nr z&Failed to attach BPF to perf raw event)r Zbpf_attach_perf_event_rawr# r* r� )r' rz �attrr( r r� r3 r r r �_attach_perf_event_raw� s zBPF._attach_perf_event_rawc C sz t |�}| j|tj�}i }|dkr<| j|j||||�||< n(x&t� D ] }| j|j||||�||< qDW || j|j|j f< d S )Nr ) r r� r� r` r� r� r r� r �config) r' r� r0 r( r r� r� r3 r� r r r �attach_perf_event_raw� s zBPF.attach_perf_event_rawc C s| y| j ||f }W n$ tk r6 tdj||���Y nX d}x |j� D ]}tj|�pV|}qFW |dkrltd��| j ||f= d S )Nz)Perf event type {} config {} not attachedr z$Failed to detach BPF from perf event)r� r r� r �valuesr rK )r' r{ r| Zfdsr3 r� r r r �detach_perf_event� s zBPF.detach_perf_eventc C s t dd� tj| |�D ��S )Nc S s g | ] \}}|�qS r r )r r/ rv r r r r s z*BPF.get_user_functions.<locals>.<listcomp>)r r� � get_user_functions_and_addresses)r/ �sym_rer r r �get_user_functions� s zBPF.get_user_functionsc C s t dd� tj| |�D ��S )a� We are returning addresses here instead of symbol names because it turns out that the same name may appear multiple times with different addresses, and the same address may appear multiple times with the same name. We can't attach a uprobe to the same address more than once, so it makes sense to return the unique set of addresses that are mapped to a symbol that matches the provided regular expression. c S s g | ] \}}|�qS r r )r rv Zaddressr r r r s z*BPF.get_user_addresses.<locals>.<listcomp>)r r� r� )r/ r� r r r �get_user_addresses s zBPF.get_user_addressesc sN t | �} t ���g � � �fdd�}tj| t|��}|dk rJtd|| f ��� S )Nc s" | }t j�|�r � j||f� dS )Nr )r# r$ r� )Zsym_namer0 Zdname)� addressesr� r r �sym_cb s z4BPF.get_user_functions_and_addresses.<locals>.sym_cbr z"Error %d enumerating symbols in %s)r r Zbcc_foreach_function_symbolr r� )r/ r� r� r3 r )r� r� r r� s z$BPF.get_user_functions_and_addressesc C s> |dkr d|| j jd|�|f S d|| j jd|�||f S d S )Nr s %s_%s_0x%xr> s %s_%s_0x%x_%dr5 )� _probe_repl�sub)r' r7 r� r0 r( r r r �_get_uprobe_evname! s zBPF._get_uprobe_evnamec C s� |dks t �|dk r$|dks$t d��t|�}t|�}t|�}t|�}|r�tj||�}| jt|�� x |D ]} | j|| ||d� qhW dS tj|||||�\} }| jd� | j|tj �} | j d| ||�} t j | j d| | ||�} | dk r�td��| j| | � | S )a� attach_uprobe(name="", sym="", sym_re="", addr=None, fn_name="" pid=-1, sym_off=0) Run the bpf function denoted by fn_name every time the symbol sym in the library or binary 'name' is encountered. Optional parameters pid, cpu, and group_fd can be used to filter the probe. If sym_off is given, attach uprobe to offset within the symbol. The real address addr may be supplied in place of sym, in which case sym must be set to its default value. If the file is a non-PIE executable, addr must be a virtual address, otherwise it must be an offset relative to the file load address. Instead of a symbol name, a regular expression can be provided in sym_re. The uprobe will then attach to symbols that match the provided regular expression. Libraries can be given in the name argument without the lib prefix, or with the full path (/usr/lib/...). Binaries can be given only with the full path (/bin/sh). If a PID is given, the uprobe will attach to the version of the library used by the process. Example: BPF(text).attach_uprobe("c", "malloc") BPF(text).attach_uprobe("/usr/bin/python", "main") r Nz!offset with addr is not supported)r/ r0 r0 r( r � pz Failed to attach BPF to uprobe)r� r r� r� r+ r� � attach_uproberS r� r\ r� r �bpf_attach_uprober� r� r3 )r' r/ r2 r� r0 r0 r( rR r� �sym_addrr� r� r/ r� r r r r� ) s. zBPF.attach_uprobec C s� t |�}t |�}t |�}t |�}|rPx&tj||�D ]}| j||||d� q2W dS tj||||�\}}| jd� | j|tj�} | jd|||�} t j | j d| |||�} | dk r�t d��| j | | � | S )a6 attach_uretprobe(name="", sym="", sym_re="", addr=None, fn_name="" pid=-1) Run the bpf function denoted by fn_name every time the symbol sym in the library or binary 'name' finishes execution. See attach_uprobe for meaning of additional parameters. )r/ r0 r0 r( Nr � rr z!Failed to attach BPF to uretprobe)r r� r� �attach_uretproberS r+ r� r\ r� r r� r� r� r3 ) r' r/ r2 r� r0 r0 r( r� r� r� r/ r� r r r r� b s$ zBPF.attach_uretprobec C s^ || j krtd| ��tj| j | �}|dk r6td��tj|�}|dk rPtd��| j|� d S )NzUprobe %s is not attachedr z Failed to detach BPF from uprobe)r� r� r rK Zbpf_detach_uprober4 )r' r/ r3 r r r �detach_uprobe_event� s zBPF.detach_uprobe_eventc C sD t |�}t |�}tj|||||�\}}| jd|||�}| j|� dS )z�detach_uprobe(name="", sym="", addr=None, pid=-1) Stop running a bpf function that is attached to symbol 'sym' in library or binary 'name'. r� N)r r� rS r� r� )r' r/ r2 r0 r( rR r� r/ r r r � detach_uprobe� s zBPF.detach_uprobec C sB t |�}t |�}tj||||�\}}| jd|||�}| j|� dS )z�detach_uretprobe(name="", sym="", addr=None, pid=-1) Stop running a bpf function that is attached to symbol 'sym' in library or binary 'name'. r� N)r r� rS r� r� )r' r/ r2 r0 r( r� r/ r r r �detach_uretprobe� s zBPF.detach_uretprobec C sn �xft dtj| j��D �]N}tj| j|�}|jd�rb| j|tj�}| j | j |dd � �|j d� q|jd�r�| j|tj�}| j | j |dd � �|j d� q|jd�r�| j|tj �}|j td�d � jdd �}| j||j d � q|jd ��r | j|tj�}|j td �d � }| j||j d � q|jd ��r6| j|d � q|jd��rP| j|d � q|jd�r| j|d � qW d S )Nr s kprobe__r )r; r0 s kretprobe__rG s tracepoint__s __r_ )r\ r0 s raw_tracepoint__s kfunc__)r0 s kretfunc__s lsm__)r� r r� r+ r� r" r� r� r\ r@ r: r/ rG r> r� rA r` rj rc ro rp rr )r' r� r� r� r\ r r r r� � s4 zBPF._trace_autoloadc C sN | j sHtdt d�| _ |rH| j j� }tj|tj�}tj|tj|tjB � | j S )zWtrace_open(nonblocking=False) Open the trace_pipe if not already open z %s/trace_piper� ) r� r� r �fileno�fcntlZF_GETFLZF_SETFLr� � O_NONBLOCK)r' � nonblockingr� Zflr r r � trace_open� s zBPF.trace_openc C s �x| j |�}| r |r d S |jd�r(q|dd� j� }|dd� }|jd�}y |d|� j� \}}}}W n$ tk r� } zwW Y dd} ~ X nX |dd� }||d d� }|jd�} || d d� } y |t|�t|�|t|�| fS tk �r } zdS d} ~ X qX qW dS )z�trace_fields(nonblocking=False) Read from the kernel debug trace pipe and return a tuple of the fields (task, pid, cpu, flags, timestamp, msg) or None if no line was read (nonblocking=True) NrA s CPU:r rL r_ r r �Unknownr � )N)NNNNNNr5 )r� r r r� r� r� )�trace_readliner" �lstrip�findr� r� r� r� ) r' r� r ZtaskZts_endr( r r Ztsr( Zsym_end�msgr r r � trace_fields� s* zBPF.trace_fieldsc C s: | j |�}d}y|jd�j� }W n tk r4 Y nX |S )z�trace_readline(nonblocking=False) Read from the kernel debug trace pipe and return one line If nonblocking is False, this will block until ctrl-C is pressed. Ni )r� �readliner r! )r' r� Ztracer r r r r� � s zBPF.trace_readlinec C sJ xD|r$| j dd�}|sq|j|� }n | jdd�}t|� tjj� qW dS )a trace_print(self, fmt=None) Read from the kernel debug trace pipe and print on stdout. If fmt is specified, apply as a format string to the output. See trace_fields for the members of the tuple example: trace_print(fmt="pid {1}, msg = {5}") F)r� N)r� r r� �printr� �stdout�flush)r' Zfmtr r r r r � trace_print s zBPF.trace_printc C s6 | dk r| dkrd} | t jkr,t| �t j| < t j| S )z�_sym_cache(pid) Returns a symbol cache for the specified PID. The kernel symbol cache is accessed by providing any PID less than zero. r r r5 r5 )r� � _sym_cachesr" )r( r r r � _sym_cache s zBPF._sym_cachec C s6 t t| ��}|jd�d kr�t� }t� }| j|_| j|_| j|j_t j t j t j|�t j|��}|dk r�|jr�|jr�d|jt j|jt j�j } } } q�d| d } } } q�|j|jt j|jt j�j } } } nt j|�j| |�\} } } |r�| dk r�d| nd} | �p d} | | } |�r*| dk �r*dtjj| � nd} | | S ) ay sym(addr, pid, show_module=False, show_offset=False) Translate a memory address into a function name for a pid, which is returned. When show_module is True, the module name is also included. When show_offset is True, the instruction offset as a hexadecimal number is also included in the string. A pid of less than zero will access the kernel symbol cache. Example output when both show_module and show_offset are True: "start_thread+0x202 [libpthread-2.24.so]" Example output when both show_module and show_offset are False: "start_thread" Zbpf_stack_build_idr r Ns +0x%xr� s [unknown]s [%s]r5 )r� r r� r r ZstatusZbuild_idr, �ur Zbcc_buildsymcache_resolver� � _bsymcacher# r* r+ r$ r- r. r/ r� r4 r� r� �basename) r0 r( � show_module� show_offsetr1 Z typeofaddrr2 �br3 r/ r, r+ r r r r2 $ s. $zBPF.symc C s t j| d||d�S )a� ksym(addr) Translate a kernel memory address into a kernel function name, which is returned. When show_module is True, the module name ("kernel") is also included. When show_offset is true, the instruction offset as a hexadecimal number is also included in the string. Example output when both show_module and show_offset are True: "default_idle+0x0 [kernel]" r Fr5 )r� r2 )r0 r� r� r r r �ksymU s zBPF.ksymc C s t jd�jd| �S )z�ksymname(name) Translate a kernel name into an address. This is the reverse of ksym. Returns -1 when the function name is unknown.r Nr5 )r� r� r7 )r/ r r r r6 c s z BPF.ksymnamec C s t | j�S )z�num_open_kprobes() Get the number of open K[ret]probes. Can be useful for scenarios where event_re is used while attaching and detaching probes. )r� r� )r' r r r �num_open_kprobesk s zBPF.num_open_kprobesc C s t | j�S )zInum_open_uprobes() Get the number of open U[ret]probes. )r� r� )r' r r r �num_open_uprobess s zBPF.num_open_uprobesc C s t | j�S )zLnum_open_tracepoints() Get the number of open tracepoints. )r� r� )r' r r r �num_open_tracepointsz s zBPF.num_open_tracepointsc C sL t jt| j� � }x"t| jj� �D ]\}}|||< q"W tjt|�||� dS )z�perf_buffer_poll(self) Poll from all open perf ring buffers, calling the callback that was provided when calling open_perf_buffer for each entry. N)r# r� r� r� r� r� r Zperf_reader_poll)r' �timeout�readersr� �vr r r �perf_buffer_poll� s zBPF.perf_buffer_pollc C sJ t jt| j� � }x"t| jj� �D ]\}}|||< q"W tjt|�|� dS )z�perf_buffer_consume(self) Consume all open perf buffers, regardless of whether or not they currently contain events data. Necessary to catch 'remainder' events when wakeup_events > 1 is set in open_perf_buffer N)r# r� r� r� r� r� r Zperf_reader_consume)r' r� r� r� r r r �perf_buffer_consume� s zBPF.perf_buffer_consumec C s | j |� dS )zMkprobe_poll(self) Deprecated. Use perf_buffer_poll instead. N)r� )r' r� r r r � kprobe_poll� s zBPF.kprobe_pollc C sL | j s&tj|||�| _ | j sHtd��n"tj| j |||�}|dk rHtd��d S )NzCould not open ring bufferr )r� r Zbpf_new_ringbufr� Zbpf_add_ringbuf)r' r r� Zctx�retr r r �_open_ring_buffer� s zBPF._open_ring_bufferc C s | j std��tj| j |� dS )z�ring_buffer_poll(self) Poll from all open ringbuf buffers, calling the callback that was provided when calling open_ring_buffer for each entry. zNo ring buffers to pollN)r� r� r Zbpf_poll_ringbuf)r' r� r r r �ring_buffer_poll� s zBPF.ring_buffer_pollc C s | j std��tj| j � dS )a/ ring_buffer_consume(self) Consume all open ringbuf buffers, regardless of whether or not they currently contain events data. This is best for use cases where low latency is desired, but it can impact performance. If you are unsure, use ring_buffer_poll instead. zNo ring buffers to pollN)r� r� r Zbpf_consume_ringbuf)r' r r r �ring_buffer_consume� s zBPF.ring_buffer_consumec C s t j� S )N)r Zbcc_free_memory)r' r r r �free_bcc_memory� s zBPF.free_bcc_memoryc C sN yt jtj| j� � W n2 tk rH } ztdt|� � W Y dd}~X nX dS )zJadd_module(modname) Add a library or exe to buildsym cache z&Error adding module to build sym cacheN)r Z bcc_buildsymcache_add_moduler� r� r� r� r� r� )�modnamer( r r r � add_module� s zBPF.add_modulec C s dS )zthe do nothing exit handlerNr )r' r r r r� � s z BPF.donothingc C sL x.t | jj� �D ] \}}tj|j� | j|= qW | jrHtj| j� d| _dS )zvclose(self) Closes all associated files descriptors. Attached BPF programs are not detached. N) r� r� r� r� rd r� r+ r Zbpf_module_destroy)r' r/ r� r r r rd � s z BPF.closec C s� x$t | jj� �D ]\}}| j|� qW x$t | jj� �D ]\}}| j|� q6W x$t | jj� �D ]\}}| j|� q\W x$t | jj� �D ]\}}| j |� q�W x$t | j j� �D ]\}}| j |� q�W x$t | j j� �D ]\}}| j |� q�W x$t | jj� �D ]\}}| j|� q�W t | jj� �}x(|D ] }t| j| t��r | j|= �q W x(t | jj� �D ]\}}| j||� �qRW | j�r�| jj� d | _| j� | j�r�tj| j� d | _d S )N)r� r� r� rJ r� r� r� ry r� re r� rl r� rm r� rq r� rH r� r r� r� r� rd r� r Zbpf_free_ringbuf)r' �kr� Z table_keysr r{ r| r r r r� � s6 z BPF.cleanupc C s | S )Nr )r' r r r � __enter__ s z BPF.__enter__c C s | j � d S )N)r� )r' �exc_typeZexc_valZexc_tbr r r �__exit__ s z BPF.__exit__r5 )Nr5 )F)NNN)r )r� r r� r� )r� r� r� r )N)N)r )r )r )r� r� r� )r� r� )r� )r� )r� )r� )r� )r� )r� )r� r5 r5 r5 r5 r5 )r5 r5 r� r r r5 r5 r5 r5 r5 r5 r5 )r5 r� r5 r5 r5 r5 r5 )r5 r5 r5 )r� r� r� Nr� r5 r r5 )r� r� r� Nr� r5 r5 )r� r� Nr5 r r5 )r� r� Nr5 )F)F)F)N)FFT)FFr5 )r5 r5 )r5 )Nr5 )r5 )�r8 r9 r: rW r[ r\ r] r^ r> r_ r` ra rb rc rd re rf rg rh ri rj rk rl rm ry rz r{ r| r} r~ r r� ZXDP_FLAGS_UPDATE_IF_NOEXISTr� ZXDP_FLAGS_SKB_MODEr� ZXDP_FLAGS_DRV_MODEr� ZXDP_FLAGS_HW_MODEr� ZXDP_FLAGS_REPLACEr# �compiler� r� r Zbcc_buildsymcache_newr� r� r5 r� r# r� r� ZCDLLZ_librtZ clock_gettimer� Zc_intr% Zargtypes� classmethodr� r� r �objectr� � staticmethodr� r� r) r� r� r� r� r� Zc_boolZc_charZc_wcharZc_ubyteZc_shortZc_ushortZc_uintr� Zc_ulongZ c_longlongr6 Zc_floatZc_doubleZ c_longdoubleZc_int64Zc_uint64r� r� r r r r r r r r r r) r+ r* r1 r2 r3 r4 r8 r9 r: r@ rG rJ rI rL rM rO rP rS rT r] r^ r` rc re rf rj rk rl rm ro rp rq rr rs rw rx ry r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r2 r� r6 r� r� r� r� r� r� r� r� r� r� r� r� rd r� r� r� r r r r r� � sb N , B " " & 8 # 0 #r� )@Z __future__r r� Zctypesr# r� r r� r# r� r� rg Zlibbccr r r r r �tabler r r r r Zperfr Zutilsr r r r r �versionr Z disassemblerr r r� r r r� � NameErrorr� r. r r r Z DEBUG_LLVM_IRr� ZDEBUG_PREPROCESSORZ DEBUG_SOURCEr� Z DEBUG_BTFr� r" r; r@ rD rF rW rn ry r r� r r r r �<module> sP + *
💾 Save Changes
❌ Cancel