| Server IP : 45.130.228.180 / Your IP : 216.73.217.162 Web Server : LiteSpeed System : Linux sg-nme-web1519.main-hosting.eu 5.14.0-611.16.1.el9_7.x86_64 #1 SMP PREEMPT_DYNAMIC Mon Dec 22 03:40:39 EST 2025 x86_64 User : u174041621 ( 174041621) PHP Version : 8.2.30 Disable Function : system, exec, shell_exec, passthru, mysql_list_dbs, ini_alter, dl, symlink, link, chgrp, leak, popen, apache_child_terminate, virtual, mb_send_mail MySQL : OFF | cURL : ON | WGET : ON | Perl : OFF | Python : OFF | Sudo : OFF | Pkexec : OFF Directory : /lib/python3.9/site-packages/bcc/__pycache__/ |
Upload File : |
a
u*�h� � @ s� d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
Z
d dl Z ddl m
Z
mZmZmZmZ ddlmZmZmZmZmZ ddlmZ ddlmZm Z m Z m Z m Z ddl m!Z! dd l"m#Z#m$Z$ dd
l%m&Z&m'Z' ze( W n e)y� e*Z(Y n0 d Z+d a,d d
� Z-dZ.ej/�0e.d�Z1ej/�2e1��s4dZ1dZ3dZ4dZ5dZ6dZ7dZ8G dd� de9�Z:G dd� d�Z;G dd� d�Z<G d d � d �Z=G d d � d �Z>G d d!� d!�Z?G d"d#� d#�Z@G d$d%� d%�ZAG d&d'� d'�ZBG d(d)� d)e9�ZCdS )*� )�print_functionN� )�lib�
bcc_symbol�bcc_symbol_option�bcc_stacktrace_build_id� _SYM_CB_TYPE)�Table�PerfEventArray�RingBuf�BPF_MAP_TYPE_QUEUE�BPF_MAP_TYPE_STACK)�Perf)�get_online_cpus�printb�_assert_is_bytes� ArgString�
StrcmpRewrite)� __version__)�disassemble_prog�
decode_map)�USDT�
USDTExceptioni� c C s t S �N)�_num_open_probes� r r �0/usr/lib/python3.9/site-packages/bcc/__init__.py�_get_num_open_probes+ s r z/sys/kernel/debug�tracingz/sys/kernel/tracing� � � � � c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )� SymbolCachec C s t �|t�d t�t���| _d S r )r Zbcc_symcache_new�ct�cast�POINTERr �cache)�self�pidr r r �__init__D s �zSymbolCache.__init__c C s� t � }|r"t�| j|t�|��}nt�| j|t�|��}|dk rp|jrf|jrfd|jt� |jtj
�j fS d|dfS |r�|j }t�
t�|�� n|j}||jt� |jtj
�j fS )a�
Return a tuple of the symbol (function), its offset from the beginning
of the function, and the module in which it lies. For example:
("start_thread", 0x202, "/usr/lib/.../libpthread-2.24.so")
If the symbol cannot be found but we know which module it is in,
return the module name and the offset from the beginning of the
module. If we don't even know the module, return the absolute
address as the offset.
r N)r r Zbcc_symcache_resolver( r% �byrefZ bcc_symcache_resolve_no_demangle�module�offsetr& �c_char_p�valueZ
demangle_nameZ bcc_symbol_free_demangle_name�name)r) �addr�demangle�sym�resZname_resr r r �resolveH s"
� �
zSymbolCache.resolvec C s> t |�}t |�}t�� }t�| j||t�|��dk r8dS |jS )Nr ���)r r% � c_ulonglongr Zbcc_symcache_resolve_namer( r, r0 )r) r- r1 r2 r r r � resolve_namee s ��zSymbolCache.resolve_nameN)�__name__�
__module__� __qualname__r+ r6 r9 r r r r r$ C s r$ c @ s$ e Zd ZdZdZdZdZdZdZdS )�PerfTyper r r � r � N) r: r; r< ZHARDWAREZSOFTWARE�
TRACEPOINTZHW_CACHE�RAWZ
BREAKPOINTr r r r r= n s r= c @ s4 e Zd ZdZdZdZdZdZdZdZ dZ
d Z d
Z d S ) � PerfHWConfigr r r r> r r? � � r! � N)
r: r; r< Z
CPU_CYCLESZ INSTRUCTIONSZCACHE_REFERENCESZ CACHE_MISSESZBRANCH_INSTRUCTIONSZ
BRANCH_MISSESZ
BUS_CYCLESZSTALLED_CYCLES_FRONTENDZSTALLED_CYCLES_BACKENDZREF_CPU_CYCLESr r r r rB w s rB c @ s8 e Zd ZdZdZdZdZdZdZdZ dZ
d Z d
Z d Z
d S )
� PerfSWConfigr r r r> r r? rC rD r! rE �
N)r: r; r< Z CPU_CLOCKZ
TASK_CLOCKZ PAGE_FAULTSZCONTEXT_SWITCHESZCPU_MIGRATIONSZPAGE_FAULTS_MINZPAGE_FAULTS_MAJZALIGNMENT_FAULTSZEMULATION_FAULTSZDUMMYZ
BPF_OUTPUTr r r r rF � s rF c @ sp e Zd ZdZdZdZdZdZdZdZ dZ
d Z d
Z d Z
d Zd
ZdZdZdZdZdZdZdZdZdZdZdZdZdS )�PerfEventSampleFormatr r r r! r" r# �@ � � i � i i i i @ i � i i i i i i i @ i � i N) r: r; r< ZIPZTIDZTIMEZADDRZREADZ CALLCHAINZIDZCPUZPERIODZ STREAM_IDrA Z BRANCH_STACKZ REGS_USERZ
STACK_USERZWEIGHTZDATA_SRCZ
IDENTIFIERZ TRANSACTIONZ REGS_INTRZ PHYS_ADDR�AUXZCGROUPZDATA_PAGE_SIZEZCODE_PAGE_SIZEZ
WEIGHT_STRUCTr r r r rH � s2 rH c @ s` e Zd ZdZdZdZdZdZdZdZ dZ
d Z d
Z d Z
d Zd
ZdZdZdZdZdZdZdZdZdS )� BPFProgTyper r r> r r? rC rD r! rE rG � � �
� � r" � � � � � N)r: r; r< �
SOCKET_FILTER�KPROBE� SCHED_CLS� SCHED_ACTr@ �XDP�
PERF_EVENT�
CGROUP_SKB� CGROUP_SOCK�LWT_IN�LWT_OUT�LWT_XMIT�SOCK_OPS�SK_SKB�
CGROUP_DEVICE�SK_MSG�RAW_TRACEPOINT�CGROUP_SOCK_ADDRZCGROUP_SOCKOPT�TRACING�LSMr r r r rN � s* rN c @ s� e Zd ZdZdZdZdZdZdZdZ dZ
d Z d
Z d Z
d Zd
ZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Z!d Z"d!Z#d"Z$d#Z%d$Z&d%Z'd&Z(d'Z)d(S ))�
BPFAttachTyper r r r> r r? rC rD r! rE rG rO rP rQ rR rS r" rT rU � � � � � � rV rW � � rX � � r# �! �" �# �$ �% �& N)*r: r; r< ZCGROUP_INET_INGRESSZCGROUP_INET_EGRESSZCGROUP_INET_SOCK_CREATEZCGROUP_SOCK_OPSZSK_SKB_STREAM_PARSERZSK_SKB_STREAM_VERDICTrf ZSK_MSG_VERDICTZCGROUP_INET4_BINDZCGROUP_INET6_BINDZCGROUP_INET4_CONNECTZCGROUP_INET6_CONNECTZCGROUP_INET4_POST_BINDZCGROUP_INET6_POST_BINDZCGROUP_UDP4_SENDMSGZCGROUP_UDP6_SENDMSGZ
LIRC_MODE2ZFLOW_DISSECTORZ
CGROUP_SYSCTLZCGROUP_UDP4_RECVMSGZCGROUP_UDP6_RECVMSGZCGROUP_GETSOCKOPTZCGROUP_SETSOCKOPTZ TRACE_RAW_TPZ TRACE_FENTRYZ TRACE_FEXITZ
MODIFY_RETURNZLSM_MACZ
TRACE_ITERZCGROUP_INET4_GETPEERNAMEZCGROUP_INET6_GETPEERNAMEZCGROUP_INET4_GETSOCKNAMEZCGROUP_INET6_GETSOCKNAMEZ
XDP_DEVMAPZCGROUP_INET_SOCK_RELEASEZ
XDP_CPUMAPZ SK_LOOKUPr] ZSK_SKB_VERDICTr r r r rl � sN rl c @ s e Zd ZdZdZdZdZdZdS )� XDPActionr r r r> r N)r: r; r< � XDP_ABORTED�XDP_DROP�XDP_PASS�XDP_TX� XDP_REDIRECTr r r r r} � s
r} c @ s e Zd ZdZdZdZdZdZdS )�XDPFlagsr r r r! r" N)r: r; r< �UPDATE_IF_NOEXIST�SKB_MODE�DRV_MODE�HW_MODE�REPLACEr r r r r� � s
r� c @ s� e Zd ZejZejZejZejZejZej Z ej
Z
ej Z ej Z ej
Z
ejZejZejZejZejZejZejZejZejZejZejZejZejZej Z ej Z e j Z e j!Z"e j#Z$e j%Z&e j'Z(e)�*d�Z+i Z,e-�.� Z/dgddgddgdgdd gd
�Z0g d �Z1d Z2G d
d� de3j4�Z5e3j6ddd�Z7e7j8Z9e3j:e3�;e5�ge9_<e=dd� �Z>e=dd� �Z?e@Z@G dd� deA�ZBeCdd� �ZDeCdd� �ZEd d d d g g dd d f d d!�ZFefd"d#�ZGd�d%d&�ZHd'd(� ZId)d*� ZJd�d+d,�ZKe3jLe3jMe3jNe3jOe3jPe3jQe3j:e3jRe3jSe3jTe3jUe3jVe3jWe3jXe3jYe3jZd- e3j[d- d.�Z\eCd/d0� �Z]d�d1d2�Z^d3d4� Z_d5d6� Z`d7d8� Zad9d:� Zbd;d<� ZceCd�d=d>��ZdeCd?d@� �ZeeCdAdB� �ZfeCdCdD� �ZgdEdF� ZheCdGdH� �ZidIdJ� ZjdKdL� ZkdMdN� ZldOdP� ZmdQdR� ZndSdT� ZodUdV� Zpd�dWdX�Zqd�dYdZ�Zrd[d\� Zsd]d^� Ztd�d_d`�Zud�dadb�ZveCd�dcdd��ZweCd�dedf��Zxe=d�dgdh��ZyeCd�didj��ZzeCdkdl� �Z{eCdmdn� �Z|d�dodp�Z}d�dqdr�Z~d�dsdt�ZeCdudv� �Z�eCdwdx� �Z�eCdydz� �Z�d�d{d|�Z�d�d}d~�Z�d�dd��Z�d�d�d��Z�d�d�d��Z�d�d�d��Z�eCd�d�� �Z�eCd�d�� �Z�eCd�d�� �Z�d�d�d��Z�d�d�� Z�d�d�d��Z�d�d�� Z�d�d�d��Z�d�d�d��Z�eCd�d�� �Z�eCd�d�� �Z�eCd�d�� �Z�d�d�� Z�d�d�d��Z�d�d�d��Z�d�d�� Z�d�d�d��Z�d�d�d��Z�d�d�� Z�d�d�d��Z�d�d�d��Z�d�d�d��Z�d�d�d��Z�eCd�d�� �Z�eCd�d�d���Z�eCd�d�d���Z�eCd�d�� �Z�d�d�� Z�d�d�� Z�d�d Z��d d�dĄZ�d�dƄ Z��dd�dȄZ��dd�dʄZ��dd�d̄Z�d�d΄ Z�d�dЄ Z�eCd�d҄ �Z�d�dԄ Z�d�dք Z�d�d Z�d�dڄ Z�d�d܄ Z�d S ( �BPFs
[^a-zA-Z0-9_]�timeZfs�fileZbioZrequestZallocZsk_buffZ
net_device)z linux/time.hz
linux/fs.hzlinux/blkdev.hz linux/slab.hzlinux/netdevice.h)s sys_s
__x64_sys_s __x32_compat_sys_s __ia32_compat_sys_s __arm64_sys_s __s390x_sys_s __s390_sys_s __riscv_sys_r c @ s e Zd ZdejfdejfgZdS )z BPF.timespec�tv_sec�tv_nsecN)r: r; r< r% �c_long�_fields_r r r r �timespecD s r� z
librt.so.1T)Z use_errnoc C sH | � � }| �| jt�|��dkr8t�� }t|t�|���|j d |j
S )z�monotonic_time()
Returns the system monotonic time from clock_gettime, using the
CLOCK_MONOTONIC constant. The time returned is in nanoseconds.
r g e��A) r� �_clock_gettime�CLOCK_MONOTONICr% r, � get_errno�OSError�os�strerrorr� r� )�cls�t�errnor r r �monotonic_timeK s
zBPF.monotonic_timec C sL d}| j �� D ]8\}}|D ]*}|D ] }||v r"||vr"|d| 7 }q"qq|S )a1
Generates #include statements automatically based on a set of
recognized types such as sk_buff and bio. The input is all the words
that appear in the BPF program, and the output is a (possibly empty)
string of #include statements, such as "#include <linux/fs.h>".
� z#include <%s>
)�_auto_includes�items)r� Z
program_wordsZheaders�header�keywords�keywordZwordr r r �generate_auto_includesW s zBPF.generate_auto_includesc @ s e Zd Zdd� ZdS )z BPF.Functionc C s || _ || _|| _d S r )�bpfr1 �fd)r) r� r1 r� r r r r+ k s zBPF.Function.__init__N)r: r; r< r+ r r r r �Functionj s r� c C sb | r^t j�| �s^ttjd �}d�t j�t j�|� � ��| g�}t j�|�rR|} n t
d| ��| S )z1 If filename is invalid, search in ./ of argv[0] r � /zCould not find file %s) r� �path�isfiler �sys�argv�join�abspath�dirname� __bytes__� Exception)�filenameZargv0r� r r r �
_find_filep s " zBPF._find_filec C sr dd� }t j�| �\}}|r*|| �rn| S nDt jd �t j�D ]0}|�d�}t j�|�� | �}||�r<| S q<dS )a�
find_exe(bin_path)
Traverses the PATH environment variable, looking for the first
directory that contains an executable file named bin_path, and
returns the full path to that file, or None if no such file
can be found. This is meant to replace invocations of the
"which" shell utility, which doesn't have portable semantics
for skipping aliases.
c S s t j�| �ot �| t j�S r )r� r� r� �access�X_OK)�fpathr r r �is_exe� s �z BPF.find_exe.<locals>.is_exe�PATH�"N)r� r� �split�environ�pathsep�stripr� �encode)Zbin_pathr� r� �fnamer� Zexe_filer r r �find_exe} s
z BPF.find_exe� Nr Fc
C s� t |�}t |�}t |�}|r$|r$J �t�� }
|
dk�r"z8tjddgtjd�} | �d��d�} tj �
| �sld} W n( t y� }
zd} W Y d}
~
n
d}
~
0 0 z8tjd dgtjd�}|�d��d�}tj �
|�s�d}W n( t y� }
zd}W Y d}
~
n
d}
~
0 0 | �r|� d
| � |�r"|� d
| � i | _
i | _i | _i | _i | _i | _i | _i | _i | _d| _d| _t�| j� || _i | _ i | _ d| _ t j t!|� � }t"|�D ]\}}t#t$|��||< �q�|�r�t%�&|�}t%�&|�}|�rt'|d d ��}|�(� }W d � n1 �s0 Y t j)t!|� � }t"|�D ] \}}t �)|�*� �||< �q*t+�,|t!|��}|du �rjt d
��|| }t+�-|| j|t!|�||�| _ | j �s�t d|�p�d ��|D ]}|�.| | � �q�| �/� dS )aZ Create a new BPF module with the given source code.
Note:
All fields are marked as optional, but either `src_file` or `text`
must be supplied, and not both.
Args:
src_file (Optional[str]): Path to a source file for the module
hdr_file (Optional[str]): Path to a helper header file for the `src_file`
text (Optional[str]): Contents of a source file for the module
debug (Optional[int]): Flags used for debug prints, can be |'d together
See "Debug flags" for explanation
Z loongarch64Zclangz-print-file-name=include)�stderr�utf-8�
FNZgccz-I�rb)�modezycan't generate USDT probe arguments; possible cause is missing pid when a probe in a shared object has multiple locationsz Failed to compile BPF module %sz<text>)0r �platform�machine�
subprocessZ check_outputZSTDOUT�decoder� r� r� �existsr� �append�
kprobe_fds�
uprobe_fds�tracepoint_fds�raw_tracepoint_fds�kfunc_entry_fds�kfunc_exit_fds�lsm_fds� perf_buffers�open_perf_events�_ringbuf_manager� tracefile�atexit�register�cleanup�debug�funcs�tablesr- r% r/ �len� enumerate�bytesr r� r� �open�read�c_void_pZ get_contextr Zbcc_usdt_genargsZ bpf_module_create_c_from_stringZattach_uprobes�_trace_autoload)r) Zsrc_fileZhdr_file�textr� ZcflagsZ
usdt_contextsZ allow_rlimit�deviceZattach_usdt_ignore_pidZ architectureZclang_include_path_outputZclang_include_path_str�eZgcc_include_path_outputZgcc_include_path_strZ cflags_array�i�sr� Z ctx_array�usdtZ usdt_textZ usdt_contextr r r r+ � s�
$
(
�z BPF.__init__c C s@ g }t dt�| j��D ]$}t�| j|�}|�| �||�� q|S )z�load_funcs(prog_type=KPROBE)
Load all functions in this BPF module with the given type.
Returns a list of the function handles.r )�ranger �bpf_num_functionsr- �bpf_function_namer� � load_func)r) � prog_type�fnsr� � func_namer r r �
load_funcs s
zBPF.load_funcsr7 c C s t |�}|| jv r | j| S t�| j|�s6td| ��d}| jt@ rJd}n| jt@ rXd}t� | j||t�| j|�t�
| j|�t� | j�t� | j�|d d||� }|dk r�t
�| j� t�� tjkr�td��t�t�� �}td||f ��t�| ||�}|| j|< |S )N�Unknown program %sr r r z!Need super-user privileges to runz!Failed to load BPF program %s: %s)r r� r �bpf_function_startr- r� r� �DEBUG_BPF_REGISTER_STATE� DEBUG_BPFZ
bcc_func_load�bpf_function_sizeZbpf_module_licenseZbpf_module_kern_versionr� r� � donothingr% r� r� �EPERMr� r� r� r� ) r) r� r� r� � attach_typeZ log_levelr� �errstr�fnr r r r� s8
� �
z
BPF.load_funcc C sJ t |�}t�| j|�s"td| ��t�| j|�}t�| j|�}t�||�S )zR
Return the eBPF bytecodes for the specified function as a string
r� )r r r� r- r� r� r% Z string_at)r) r� �start�sizer r r � dump_func0 s z
BPF.dump_funcc C s | � |�}t||�S r )r� r )r) r� Zbpfstrr r r �disassemble_func< s
zBPF.disassemble_funcc C s( | | }t �| j|j�}t||||d�S )N)�sizeinfo)r �bpf_table_type_idr- �map_idr )r) Z
table_namer� Z table_objZ
table_typer r r � decode_table@ s zBPF.decode_tabler )Z_Bool�charZwchar_tz
unsigned charZshortzunsigned short�intz unsigned intZlongz
unsigned longz long longzunsigned long long�floatZdoublez long doubleZ__int128zunsigned __int128c C s t | t�rtj| S g }g }| d D �]@}t|�dkrT|�|d t�|d �f� q$t|�dk�rVt |d t�r�|�|d t�|d �|d d f� n�t |d t�r�|�|d t�|d �|d f� n�t |d t��rD|d dk�s|d dk�s|d dk�rD|d }|dk�r.d t|� }|�|� |�|t�|�f� nt d
t
|� ��q$t d
t
|� ��q$t j }d }t| �dk�r�| d dk�r�t j
}n.| d dk�r�t j }n| d dk�r�t j }d }|�r�tt
| d �|ft|d|d
��}n tt
| d �|ft||d��}|S )Nr r r r> �union�structZ
struct_packedr� z__anon%dzFailed to decode type %sFT)� _anonymous_Z_pack_r� )r r� )�
isinstance�
basestringr� � str2ctyper� r� �_decode_table_type�listr r� �strr% � Structure�Union�type�dict)ZdescZanon�fieldsr� r1 �baseZ is_packedr� r r r r X sX
*$
�
�
�
�
�zBPF._decode_table_typec
C s� t |�}t�| j|�}t�| j|�}t�| j|�ttfv }|dk rFt�|s�|s�t� | j|��
d�}|srt d| ��t �
t�|��}|s�t�| j|��
d�} | s�t d| ��t �
t�| ��}t| ||||||d�S )Nr r� z$Failed to load BPF Table %s key descz%Failed to load BPF Table %s leaf desc)�reducer)r r Z bpf_table_idr- Z bpf_table_fdr� r r
�KeyErrorZbpf_table_key_descr� r� r� r �json�loadsZbpf_table_leaf_descr )
r) r1 ZkeytypeZleaftyper r �map_fdZ
is_queuestackZkey_descZ leaf_descr r r � get_table� s" z
BPF.get_tablec C s$ || j vr| �|�| j |< | j | S r )r� r �r) �keyr r r � __getitem__� s
zBPF.__getitem__c C s || j |< d S r �r� )r) r Zleafr r r � __setitem__� s zBPF.__setitem__c C s
t | j�S r )r� r� �r) r r r �__len__� s z BPF.__len__c C s | j |= d S r r r r r r � __delitem__� s zBPF.__delitem__c C s
| j �� S r )r� �__iter__r r r r r" � s z BPF.__iter__c C sJ t | tj�std��t�| j|||�}|dk rFtd�|t� | ����d S )N�"arg 1 must be of type BPF.Functionr z7Failed to attach BPF function with attach_type {0}: {1})
r r� r� r� r Zbpf_prog_attachr� �formatr� r� )r� �
attachable_fdr� �flagsr5 r r r � attach_func� s �zBPF.attach_funcc C sH t | tj�std��t�| j||�}|dk rDtd�|t� | ����d S )Nr# r z7Failed to detach BPF function with attach_type {0}: {1})
r r� r� r� r Zbpf_prog_detach2r� r$ r� r� )r� r% r� r5 r r r � detach_func� s �zBPF.detach_funcc C s� t |�}t| tj�s td��t�|�}|dk rLt�t �
� �}td||f ��t� || j �}|dk r�t�t �
� �}td||f ��|| _
d S )Nr# r z Failed to open raw device %s: %s�%Failed to attach BPF to device %s: %s)r r r� r� r� r Zbpf_open_raw_sockr� r� r% r� Zbpf_attach_socketr� �sock)r� �devr* r� r5 r r r �attach_raw_socket� s
�zBPF.attach_raw_socketc
C s� dt }z@t|d��"}tdd� |D ��}W d � n1 s<0 Y W n< ty� } z$|jtjkrh|�tg �}W Y d }~n
d }~0 0 dt }z@t|d��"}tdd� |D ��}W d � n1 s�0 Y W n> t�y } z$|jtjkr�|�tg �}W Y d }~n
d }~0 0 g }d} d}
tdd���L} | D �]4} | �� �� d d
� \}
}| dk�rh|d k�r�d } �q,n | d k�r�|d k�r,d
} �q,|
dk�r�|dk�r�d }
�q,n|dk�r�d
}
�q,n |
d k�r�|dk�r,d
}
�q,|�d��r�q,nB|�d��s,|�d��r�q,n$|�d��r�q,nt �
d|��r&�q,|
� � dv �r,t � | |��r,||v�r,||v �r,|�
|� �q,W d � n1 �sz0 Y t|�S )Nz%s/kprobes/blacklistr� c S s g | ]}|� � �� d �qS )r ��rstripr� ��.0�liner r r �
<listcomp>� r� z,BPF.get_kprobe_functions.<locals>.<listcomp>z%%s/tracing/available_filter_functionsc S s g | ]}|� � �� d �qS )r r- r/ r r r r2 � r� r �/proc/kallsymsr r> s __init_begins
__init_endr s __irqentry_text_starts __irqentry_text_ends
_kbl_addr_s __perfs perf_s __SCT__s ^.*\.cold(\.\d+)?$)� t� w)�DEBUGFSr� �set�IOErrorr� r� r. r� �
startswith�re�match�lower� fullmatchr� )�event_reZblacklist_fileZ blacklist_fZ blacklistr� Zavail_filter_fileZavail_filter_fZ avail_filterr� Zin_init_sectionZin_irq_sectionZ
avail_filer1 r� r� r r r �get_kprobe_functions� sp 4 4
��.zBPF.get_kprobe_functionsc C s t | t�� krtd��d S )Nz/Number of open probes would exceed global quota)r r� �get_probe_limitr� )r) Znum_new_probesr r r �_check_probe_quota s zBPF._check_probe_quotac C s( t j�d�} | r | �� r t| �S tS d S )NZBCC_PROBE_LIMIT)r� r� �get�isdigitr �_default_probe_limit)Zenv_probe_limitr r r r@ s zBPF.get_probe_limitc C s. || j vri | j |< || j | |< td7 ad S �Nr �r� r )r) �ev_name�fn_namer� r r r �_add_kprobe_fd% s
zBPF._add_kprobe_fdc C s | j | |= td8 ad S rE rF )r) rG rH r r r �_del_kprobe_fd, s zBPF._del_kprobe_fdc C s || j |< td7 ad S rE �r� r )r) r1 r� r r r �_add_uprobe_fd1 s
zBPF._add_uprobe_fdc C s | j |= td8 ad S rE rK �r) r1 r r r �_del_uprobe_fd6 s zBPF._del_uprobe_fdc C s0 | j D ] }| �d| �dkr| S q| j d S )Ns %sbpfr7 r )�_syscall_prefixes�ksymname)r) �prefixr r r �get_syscall_prefix> s
zBPF.get_syscall_prefixc C s t |�}| �� | S r )r rR rM r r r �get_syscall_fnnameG s zBPF.get_syscall_fnnamec C s< t |�}| jD ](}|�|�r| �|t|�d � � S q|S r )r rO r9 rS r� )r) r1 rQ r r r �fix_syscall_fnnameN s
zBPF.fix_syscall_fnnamec C s t |�}t |�}t |�}|r�t�|�}| �t|�� d}g }|D ]6}z| j||d� W q@ |d7 }|�|� Y q@0 q@|t|�kr�td|d�|�f ��d S | �d� | � |tj
�} d|� dd�� d d� }
t �
| jd|
||d�} | dk r�td||f ��| �|
|| � | S )
Nr ��eventrH r zwFailed to attach BPF program %s to kprobe %s, it's not traceable (either non-existing, inlined, or marked as "notrace")�/� p_� +� _� .)r r� r? rA r� �
attach_kprober� r� r� r� rZ �replacer �bpf_attach_kprober� rI ) r) rV Z event_offrH r> �matches�failed�probesr1 r� rG r� r r r r\ U s:
�
�zBPF.attach_kprobec C s t |�}t |�}t |�}|r�t�|�}d}g }|D ]8}z| j|||d� W q2 |d7 }|�|� Y q20 q2|t|�kr�td|d�|�f ��d S | �d� | � |tj
�} d|� dd�� d d� }
t �
| jd|
|d|�} | dk r�td||f ��| �|
|| � | S )
Nr )rV rH � maxactiver zzFailed to attach BPF program %s to kretprobe %s, it's not traceable (either non-existing, inlined, or marked as "notrace")rW � r_rY rZ r[ )r r� r? �attach_kretprober� r� r� r� rA r� rZ r] r r^ r� rI ) r) rV rH r> rb r_ r` ra r1 r� rG r� r r r rd w s<
�
�
�zBPF.attach_kretprobec C s4 t |�}t| j| �� �}|D ]}| �||� q d S r )r r r� �keys�detach_kprobe_event_by_fn)r) rG Zfn_namesrH r r r �detach_kprobe_event� s zBPF.detach_kprobe_eventc C s� t |�}t |�}|| jvr&td| ��t�| j| | �}|dk rJtd��| �||� t| j| �dkr�t�|�}|dk r�td��d S )NzKprobe %s is not attachedr zFailed to close kprobe FDz Failed to detach BPF from kprobe)r r� r� r �bpf_close_perf_event_fdrJ r� Zbpf_detach_kprobe)r) rG rH r5 r r r rf � s
z BPF.detach_kprobe_event_by_fnc C sH t |�}d|�dd��dd� }|r:t |�}| �||� n
| �|� d S )NrX rY rZ r[ �r r] rf rg �r) rV rH rG r r r �
detach_kprobe� s zBPF.detach_kprobec C sH t |�}d|�dd��dd� }|r:t |�}| �||� n
| �|� d S )Nrc rY rZ r[ ri rj r r r �detach_kretprobe� s zBPF.detach_kretprobec C sn t | �} t|tj�s td��t�| |j|�}|dk rjt� � }|t
j krPtd��nt �
|�}td| |f ��dS )zt
This function attaches a BPF function to a device on the device
driver level (XDP)
r# r zMInternal error while attaching BPF to device, try increasing the debug level!r) N)r r r� r� r� r �bpf_attach_xdpr� r% r� r� ZEBADMSGr� r� )r+ r� r& r5 Zerr_nor� r r r �
attach_xdp� s
�zBPF.attach_xdpc C s@ t | �} t�| d|�}|dk r<t�t�� �}td| |f ��dS )zw
This function removes any BPF function from a device on the
device driver level (XDP)
r7 r z'Failed to detach BPF from device %s: %sN)r r rm r� r� r% r� r� )r+ r& r5 r� r r r �
remove_xdp� s �zBPF.remove_xdpc
C s� t |�}t |�}t� }|dkr"dn|}t�|||p4d|t�d t�t��t�|��dk rnt d|�
� |�
� f ��|j | }t�|j tj
�j} t�|j � | |fS )Nr7 r z.could not determine address of symbol %s in %s)r r r Zbcc_resolve_symnamer% r& r' r r, r� r� r. r- r/ r0 �bcc_procutils_free)
r� r- Zsymnamer2 r* �sym_offr4 Zc_pid�new_addrZ module_pathr r r �_check_path_symbol� s& ���
zBPF._check_path_symbolc C sL t | �} |rt�| |�}n t�| d�}|s.dS t�|tj�j}t�|� |S )a&
Find the full path to the shared library whose name starts with "lib{libname}".
If non-zero pid is given, search only the shared libraries mapped by the process with this pid.
Otherwise, search the global ldconfig cache at /etc/ld.so.cache.
Examples:
BPF.find_library(b"c", pid=12345) # returns b"/usr/lib/x86_64-linux-gnu/libc.so.6"
BPF.find_library(b"pthread") # returns b"/lib/x86_64-linux-gnu/libpthread.so.0"
BPF.find_library(b"nonexistent") # returns None
r N) r r Z!bcc_procutils_which_so_in_processZbcc_procutils_which_sor% r& r/ r0 rp )Zlibnamer* r5 Zlibpathr r r � find_library� s
zBPF.find_libraryc C s� g }t j�td�}t �|�D ]t}t j�||�}t j�|�s<q t �|�D ]H}t j�||�}t j�|�rFd||f }t�| �� |�rF|� |�
� � qFq |S )N�eventsz%s:%s) r� r� r� �TRACEFS�listdir�isdirr: r; r� r� r� )�tp_re�resultsZ
events_dir�categoryZcat_dirrV �evt_dir�tpr r r �get_tracepoints s zBPF.get_tracepointsc C s t j�td| |�}t j�|�S )Nru )r� r� r� rv rx )r{ rV r| r r r �tracepoint_exists s zBPF.tracepoint_existsc C s� t |�}t |�}t |�}|r>t�|�D ]}| j||d� q&dS | �|tj�}|�d�\}}t�|j ||�}|dk r�t
d||f ��|| j |< | S )a� attach_tracepoint(tp="", tp_re="", fn_name="")
Run the bpf function denoted by fn_name every time the kernel tracepoint
specified by 'tp' is hit. The optional parameters pid, cpu, and group_fd
can be used to filter the probe. The tracepoint specification is simply
the tracepoint category and the tracepoint name, separated by a colon.
For example: sched:sched_switch, syscalls:sys_enter_bind, etc.
Instead of a tracepoint name, a regular expression can be provided in
tp_re. The program will then attach to tracepoints that match the
provided regular expression.
To obtain a list of kernel tracepoints, use the tplist tool or cat the
file /sys/kernel/debug/tracing/available_events.
Examples:
BPF(text).attach_tracepoint(tp="sched:sched_switch", fn_name="on_switch")
BPF(text).attach_tracepoint(tp_re="sched:.*", fn_name="on_switch")
�r} rH N� :r z0Failed to attach BPF program %s to tracepoint %s) r r� r~ �attach_tracepointr� r@ r� r Zbpf_attach_tracepointr� r� r� )r) r} ry rH r� � tp_category�tp_namer� r r r r� s �
zBPF.attach_tracepointc C s` t |�}|| jv r td| ��t |�}| �|tj�}t�|j|�}|dk rRtd��|| j|< | S )a� attach_raw_tracepoint(self, tp=b"", fn_name=b"")
Run the bpf function denoted by fn_name every time the kernel tracepoint
specified by 'tp' is hit. The bpf function should be loaded as a
RAW_TRACEPOINT type. The fn_name is the kernel tracepoint name,
e.g., sched_switch, sys_enter_bind, etc.
Examples:
BPF(text).attach_raw_tracepoint(tp="sched_switch", fn_name="on_switch")
z#Raw tracepoint %s has been attachedr z&Failed to attach BPF to raw tracepoint) r r� r� r� r� rh r Zbpf_attach_raw_tracepointr� )r) r} rH r� r� r r r �attach_raw_tracepointF s
zBPF.attach_raw_tracepointc C s: t |�}|| jvr td| ��t�| j| � | j|= dS )z�detach_raw_tracepoint(tp="")
Stop running the bpf function that is attached to the kernel tracepoint
specified by 'tp'.
Example: bpf.detach_raw_tracepoint("sched_switch")
z!Raw tracepoint %s is not attachedN)r r� r� r� �close)r) r} r r r �detach_raw_tracepoint^ s
zBPF.detach_raw_tracepointc C s |� | �s| | }|S r )r9 )rQ r1 r r r �
add_prefixm s
zBPF.add_prefixc C s2 t �� dkrdS t�� s dS t�d�dkr.dS dS )NZx86_64FZbpf_trampoline_link_progr7 T)r� r� r �bpf_has_kernel_btfr� rP r r r r �
support_kfuncs s zBPF.support_kfuncc C s" t �� s dS t�d�dkr dS dS )NFs bpf_lsm_bpfr7 T)r r� r� rP r r r r � support_lsm s
zBPF.support_lsmc C sF t |�}t�d|�}|| jvr*td| ��t�| j| � | j|= d S )N� kfunc__z$Kernel entry func %s is not attached)r r� r� r� r� r� r� �r) rH r r r � detach_kfunc� s
zBPF.detach_kfuncc C sF t |�}t�d|�}|| jvr*td| ��t�| j| � | j|= d S )N�
kretfunc__z#Kernel exit func %s is not attached)r r� r� r� r� r� r� r� r r r �detach_kretfunc� s
zBPF.detach_kretfuncc C sb t |�}t�d|�}|| jv r*td| ��| �|tj�}t�|j �}|dk rTtd��|| j|< | S )Nr� z&Kernel entry func %s has been attachedr z)Failed to attach BPF to entry kernel func)
r r� r� r� r� r� rj r �bpf_attach_kfuncr� �r) rH r� r� r r r � attach_kfunc� s
zBPF.attach_kfuncc C sb t |�}t�d|�}|| jv r*td| ��| �|tj�}t�|j �}|dk rTtd��|| j|< | S )Nr� z%Kernel exit func %s has been attachedr z(Failed to attach BPF to exit kernel func)
r r� r� r� r� r� rj r r� r� r� r r r �attach_kretfunc� s
zBPF.attach_kretfuncc C sF t |�}t�d|�}|| jvr*td| ��t�| j| � | j|= d S )N� lsm__zLSM %s is not attached)r r� r� r� r� r� r� r� r r r �
detach_lsm� s
zBPF.detach_lsmc C sb t |�}t�d|�}|| jv r*td| ��| �|tj�}t�|j �}|dk rTtd��|| j|< | S )Nr� zLSM %s has been attachedr zFailed to attach LSM)
r r� r� r� r� r� rk r Zbpf_attach_lsmr� r� r r r �
attach_lsm� s
zBPF.attach_lsmc C s$ t �d�dks t �d�dkr dS dS )NZbpf_find_raw_tracepointr7 Zbpf_get_raw_tracepointTF)r� rP r r r r �support_raw_tracepoint� s
�zBPF.support_raw_tracepointc C sz d} t | ��Z}|D ]B}|�� �dd�\}}}|�d�d }|dkr W d � dS qW d � dS 1 sl0 Y d S ) Nr3 � r � r Zbpf_trace_modulesTF)r� r. r� )ZkallsymsZsymsr1 �_r1 r r r � support_raw_tracepoint_in_module� s
z$BPF.support_raw_tracepoint_in_modulec C s t | �} t |�}t�| |�S r )r r �kernel_struct_has_field)Z struct_name�
field_namer r r r� � s zBPF.kernel_struct_has_fieldc C st t |�}|| jvr td| ��t�| j| �}|dk r>td��|�d�\}}t�||�}|dk rhtd��| j|= dS )z�detach_tracepoint(tp="")
Stop running a bpf function that is attached to the kernel tracepoint
specified by 'tp'.
Example: bpf.detach_tracepoint("sched:sched_switch")
z Tracepoint %s is not attachedr z$Failed to detach BPF from tracepointr� N)r r� r� r rh r� Zbpf_detach_tracepoint)r) r} r5 r� r� r r r �detach_tracepoint� s
zBPF.detach_tracepointc
C s, t �||||||||�} | dk r(td��| S )Nr z"Failed to attach BPF to perf event)r Zbpf_attach_perf_eventr� )
r) �progfd�ev_type� ev_config�
sample_period� sample_freqr* �cpu�group_fdr5 r r r �_attach_perf_event� s
�zBPF._attach_perf_eventc C s~ t |�}| �|tj�} i }
|dkrB| �| j|||||||�|
|< n*t� D ]"} | �| j|||||| |�|
| < qH|
| j||f< d S �Nr )r r� r� r^ r� r� r r� ) r) r� r� rH r� r� r* r� r� r� r5 r� r r r �attach_perf_event s
�
�
zBPF.attach_perf_eventc C s. t �|t�|�|||d�}|dk r*td��|S )Nr z&Failed to attach BPF to perf raw event)r Zbpf_attach_perf_event_rawr% r, r� )r) r� �attrr* r� r� r5 r r r �_attach_perf_event_raw s �zBPF._attach_perf_event_rawc C sv t |�}| �|tj�}i }|dkr<| �|j||||�||< n$t� D ] }| �|j||||�||< qB|| j|j|j f< d S r� )
r r� r� r^ r� r� r r� r Zconfig) r) r� rH r* r� r� r� r5 r� r r r �attach_perf_event_raw s
�
�
zBPF.attach_perf_event_rawc C sv z| j ||f }W n" ty4 td�||���Y n0 d}|�� D ]}t�|�pR|}qB|dkrftd��| j ||f= d S )Nz)Perf event type {} config {} not attachedr z$Failed to detach BPF from perf event)r� r r� r$ �valuesr rh )r) r� r� Zfdsr5 r� r r r �detach_perf_event& s � zBPF.detach_perf_eventc C s t dd� t�| |�D ��S )Nc S s g | ] \}}|�qS r r )r0 r1 r� r r r r2 6 r� z*BPF.get_user_functions.<locals>.<listcomp>�r7 r� � get_user_functions_and_addresses�r1 �sym_rer r r �get_user_functions4 s
�zBPF.get_user_functionsc C s t dd� t�| |�D ��S )a�
We are returning addresses here instead of symbol names because it
turns out that the same name may appear multiple times with different
addresses, and the same address may appear multiple times with the same
name. We can't attach a uprobe to the same address more than once, so
it makes sense to return the unique set of addresses that are mapped to
a symbol that matches the provided regular expression.
c S s g | ] \}}|�qS r r )r0 r� �addressr r r r2 C r� z*BPF.get_user_addresses.<locals>.<listcomp>r� r� r r r �get_user_addresses9 s
�zBPF.get_user_addressesc sN t | �} t ���g � � �fdd�}t�| t|��}|dk rJtd|| f ��� S )Nc s" | }t ��|�r � �||f� dS r� )r: r; r� )Zsym_namer2 Zdname�� addressesr� r r �sym_cbK s z4BPF.get_user_functions_and_addresses.<locals>.sym_cbr z"Error %d enumerating symbols in %s)r r Zbcc_foreach_function_symbolr r� )r1 r� r� r5 r r� r r� F s z$BPF.get_user_functions_and_addressesc C sN |dkr(d|| j �dtj�|��|f S d|| j �dtj�|��||f S d S )Nr7 s
%s_%s_0x%xrZ s
%s_%s_0x%x_%d)� _probe_repl�subr� r� �basename)r) rQ r� r2 r* r r r �_get_uprobe_evnameV s zBPF._get_uprobe_evnamec C s� |dks J �|dur$|dks$J d��t |�}t |�}t |�}t |�}|r�t�||�}| �t|�� |D ]} | j|| ||d� qfdS t�|||||�\}
}| �d� | �|tj�} | � d|
||�} t
� | j d| |
||�}
|
dk r�t
d��| �| |
� | S )a� attach_uprobe(name="", sym="", sym_re="", addr=None, fn_name=""
pid=-1, sym_off=0)
Run the bpf function denoted by fn_name every time the symbol sym in
the library or binary 'name' is encountered. Optional parameters pid,
cpu, and group_fd can be used to filter the probe.
If sym_off is given, attach uprobe to offset within the symbol.
The real address addr may be supplied in place of sym, in which case sym
must be set to its default value. If the file is a non-PIE executable,
addr must be a virtual address, otherwise it must be an offset relative
to the file load address.
Instead of a symbol name, a regular expression can be provided in
sym_re. The uprobe will then attach to symbols that match the provided
regular expression.
Libraries can be given in the name argument without the lib prefix, or
with the full path (/usr/lib/...). Binaries can be given only with the
full path (/bin/sh). If a PID is given, the uprobe will attach to the
version of the library used by the process.
Example: BPF(text).attach_uprobe("c", "malloc")
BPF(text).attach_uprobe("/usr/bin/python", "main")
r Nz!offset with addr is not supported�r1 r2 rH r* r � pz Failed to attach BPF to uprobe)r r� r� rA r� �
attach_uprobers r� rZ r� r �bpf_attach_uprober� r� rL )r) r1 r4 r� r2 rH r* rq r� �sym_addrr� r� rG r� r r r r� ^ s0 �
zBPF.attach_uprobec C s� t |�}t |�}t |�}t |�}|rLt�||�D ]}| j||||d� q0dS t�||||�\}}| �d� | �|tj�} | �d|||�}
t �
| j d|
|||�} | dk r�t d��| �
|
| � | S )a6 attach_uretprobe(name="", sym="", sym_re="", addr=None, fn_name=""
pid=-1)
Run the bpf function denoted by fn_name every time the symbol sym in
the library or binary 'name' finishes execution. See attach_uprobe for
meaning of additional parameters.
r� Nr � rr z!Failed to attach BPF to uretprobe)r r� r� �attach_uretprobers rA r� rZ r� r r� r� r� rL ) r) r1 r4 r� r2 rH r* r� r� r� rG r� r r r r� � s&
�
zBPF.attach_uretprobec C s^ || j vrtd| ��t�| j | �}|dk r6td��t�|�}|dk rPtd��| �|� d S )NzUprobe %s is not attachedr z Failed to detach BPF from uprobe)r� r� r rh Zbpf_detach_uproberN )r) rG r5 r r r �detach_uprobe_event� s
zBPF.detach_uprobe_eventc C sD t |�}t |�}t�|||||�\}}| �d|||�}| �|� dS )z�detach_uprobe(name="", sym="", addr=None, pid=-1)
Stop running a bpf function that is attached to symbol 'sym' in library
or binary 'name'.
r� N�r r� rs r� r� )r) r1 r4 r2 r* rq r� rG r r r �
detach_uprobe� s
zBPF.detach_uprobec C sB t |�}t |�}t�||||�\}}| �d|||�}| �|� dS )z�detach_uretprobe(name="", sym="", addr=None, pid=-1)
Stop running a bpf function that is attached to symbol 'sym' in library
or binary 'name'.
r� Nr� )r) r1 r4 r2 r* r� rG r r r �detach_uretprobe� s
zBPF.detach_uretprobec C sh t dt�| j��D �]N}t�| j|�}|�d�r^| �|tj�}| j | �
|dd � �|j d� q|�d�r�| �|tj�}| j | �
|dd � �|j d� q|�d�r�| �|tj
�}|j td�d � �dd �}| j||j d
� q|�d ��r| �|tj�}|j td �d � }| j||j d
� q|�d ��r2| j|d
� q|�d��rL| j|d
� q|�d�r| j|d
� qd S )Nr s kprobe__r! rU s kretprobe__rO s tracepoint__s __r� r� s raw_tracepoint__r� )rH r� r� )r� r r� r- r� r9 r� r� rZ r\ rT r1 rd r@ r� r] r� rh r� r� r� r� )r) r� r� r� r} r r r r� � s8
�
�
zBPF._trace_autoloadc C sN | j sHtdt d�| _ |rH| j �� }t�|tj�}t�|tj|tjB � | j S )zWtrace_open(nonblocking=False)
Open the trace_pipe if not already open
z
%s/trace_piper� ) r� r� rv �fileno�fcntlZF_GETFLZF_SETFLr� �
O_NONBLOCK)r) � nonblockingr� Zflr r r �
trace_open� s
zBPF.trace_openc
C s | � |�}|s|rdS |�d�r"q |dd� �� }|dd� }|�d�}z |d|� �� \}}}}W n0 ty� } zW Y d} ~ q W Y d} ~ n
d} ~ 0 0 |dd� }||d d� }|�d�}
||
d d� } z |t|�t|�|t|�| fW S t�y } zW Y d} ~ d
S d} ~ 0 0 q dS ) z�trace_fields(nonblocking=False)
Read from the kernel debug trace pipe and return a tuple of the
fields (task, pid, cpu, flags, timestamp, msg) or None if no
line was read (nonblocking=True)
)NNNNNNs CPU:Nr" rT r� r r7 r )�Unknownr r r� g r� )�trace_readliner9 �lstrip�findr� r� r r ) r) r� r1 ZtaskZts_endr* r� r& �tsr� Zsym_end�msgr r r � trace_fields s$
"
zBPF.trace_fieldsc C s8 | � |�}d}z|�d��� }W n ty2 Y n0 |S )z�trace_readline(nonblocking=False)
Read from the kernel debug trace pipe and return one line
If nonblocking is False, this will block until ctrl-C is pressed.
NrL )r� �readliner. r8 )r) r� Ztracer1 r r r r� ) s
zBPF.trace_readlinec C sF |r"| j dd�}|sq |j|� }n | jdd�}t|� tj�� q dS )a trace_print(self, fmt=None)
Read from the kernel debug trace pipe and print on stdout.
If fmt is specified, apply as a format string to the output. See
trace_fields for the members of the tuple
example: trace_print(fmt="pid {1}, msg = {5}")
F)r� N)r� r$ r� �printr� �stdout�flush)r) �fmtr r1 r r r � trace_print9 s
zBPF.trace_printc C s6 | dk r| dkrd} | t jvr,t| �t j| < t j| S )z�_sym_cache(pid)
Returns a symbol cache for the specified PID.
The kernel symbol cache is accessed by providing any PID less than zero.
r r7 )r� � _sym_cachesr$ )r* r r r �
_sym_cacheL s
zBPF._sym_cachec C s4 t t| ��}|�d�dkr�t� }t� }| j|_| j|_| j|j_t �
t j t
�|�t
�|��}|dk r�|jr�|jr�d|jt
�|jt
j�j } }
} q�d| d } }
} q�|j|jt
�|jt
j�j } }
} nt �|��| |�\} }
} |r�| dur�d|
nd}
| p�d} | |
} |�r(| du�r(dtj�| � nd} | | S ) ay sym(addr, pid, show_module=False, show_offset=False)
Translate a memory address into a function name for a pid, which is
returned. When show_module is True, the module name is also included.
When show_offset is True, the instruction offset as a hexadecimal
number is also included in the string.
A pid of less than zero will access the kernel symbol cache.
Example output when both show_module and show_offset are True:
"start_thread+0x202 [libpthread-2.24.so]"
Example output when both show_module and show_offset are False:
"start_thread"
Zbpf_stack_build_idr7 r Ns +0x%xr� s [unknown]s [%s])r
r r� r r �statusZbuild_idr. �ur Zbcc_buildsymcache_resolver� �
_bsymcacher% r, r- r& r/ r0 r1 r� r6 r� r� r� ) r2 r* � show_module� show_offsetr3 Z
typeofaddrr4 �br5 r1 r. r- r r r r4 Y s>
� � � ���zBPF.symc C s t �| d||d�S )a� ksym(addr)
Translate a kernel memory address into a kernel function name, which is
returned. When show_module is True, the module name ("kernel") is also
included. When show_offset is true, the instruction offset as a
hexadecimal number is also included in the string.
Example output when both show_module and show_offset are True:
"default_idle+0x0 [kernel]"
r7 F)r� r4 )r2 r� r� r r r �ksym� s zBPF.ksymc C s t �d��d| �S )z�ksymname(name)
Translate a kernel name into an address. This is the reverse of
ksym. Returns -1 when the function name is unknown.r7 N)r� r� r9 )r1 r r r rP � s z BPF.ksymnamec C s
t | j�S )z�num_open_kprobes()
Get the number of open K[ret]probes. Can be useful for scenarios where
event_re is used while attaching and detaching probes.
)r� r� r r r r �num_open_kprobes� s zBPF.num_open_kprobesc C s
t | j�S )zInum_open_uprobes()
Get the number of open U[ret]probes.
)r� r� r r r r �num_open_uprobes� s zBPF.num_open_uprobesc C s
t | j�S )zLnum_open_tracepoints()
Get the number of open tracepoints.
)r� r� r r r r �num_open_tracepoints� s zBPF.num_open_tracepointsc C sH t jt| j� � }t| j�� �D ]\}}|||< q t�t|�||� dS )z�perf_buffer_poll(self)
Poll from all open perf ring buffers, calling the callback that was
provided when calling open_perf_buffer for each entry.
N)r% r� r� r� r� r� r Zperf_reader_poll)r) �timeout�readersr� �vr r r �perf_buffer_poll� s
zBPF.perf_buffer_pollc C sF t jt| j� � }t| j�� �D ]\}}|||< q t�t|�|� dS )z�perf_buffer_consume(self)
Consume all open perf buffers, regardless of whether or not
they currently contain events data. Necessary to catch 'remainder'
events when wakeup_events > 1 is set in open_perf_buffer
N)r% r� r� r� r� r� r Zperf_reader_consume)r) r� r� r� r r r �perf_buffer_consume� s
zBPF.perf_buffer_consumec C s | � |� dS )zMkprobe_poll(self)
Deprecated. Use perf_buffer_poll instead.
N)r� �r) r� r r r � kprobe_poll� s zBPF.kprobe_pollc C sL | j s&t�|||�| _ | j sHtd��n"t�| j |||�}|dk rHtd��d S )NzCould not open ring bufferr )r� r Zbpf_new_ringbufr� Zbpf_add_ringbuf)r) r r� �ctx�retr r r �_open_ring_buffer� s
zBPF._open_ring_bufferc C s | j std��t�| j |� dS )z�ring_buffer_poll(self)
Poll from all open ringbuf buffers, calling the callback that was
provided when calling open_ring_buffer for each entry.
�No ring buffers to pollN)r� r� r Zbpf_poll_ringbufr� r r r �ring_buffer_poll� s zBPF.ring_buffer_pollc C s | j std��t�| j � dS )a/ ring_buffer_consume(self)
Consume all open ringbuf buffers, regardless of whether or not
they currently contain events data. This is best for use cases
where low latency is desired, but it can impact performance.
If you are unsure, use ring_buffer_poll instead.
r� N)r� r� r Zbpf_consume_ringbufr r r r �ring_buffer_consume� s zBPF.ring_buffer_consumec C s t �� S r )r Zbcc_free_memoryr r r r �free_bcc_memory� s zBPF.free_bcc_memoryc
C sP zt �tj| �� � W n4 tyJ } z tdt|� � W Y d}~n
d}~0 0 dS )zJadd_module(modname)
Add a library or exe to buildsym cache
z&Error adding module to build sym cacheN)r Z bcc_buildsymcache_add_moduler� r� r� r� r� r
)�modnamer� r r r �
add_module� s zBPF.add_modulec C s dS )zthe do nothing exit handlerNr r r r r r� s z
BPF.donothingc C sH t | j�� �D ] \}}t�|j� | j|= q| jrDt�| j� d| _dS )zvclose(self)
Closes all associated files descriptors. Attached BPF programs are not
detached.
N) r r� r� r� r� r� r- r Zbpf_module_destroy)r) r1 r� r r r r� s
z BPF.closec C s� t | j�� �D ]\}}| �|� qt | j�� �D ]\}}| �|� q0t | j�� �D ]\}}| �|� qRt | j�� �D ]\}}| � |� qtt | j
�� �D ]\}}| � |� q�t | j �� �D ]\}}| �
|� q�t | j�� �D ]\}}| �|� q�t | j�� �}|D ] }t| j| t��r | j|= �q t | j�� �D ]\}}| �||� �q0| j�r`| j�� d | _| �� | j�r�t�| j� d | _d S r )r r� r� rg r� r� r� r� r� r� r� r� r� r� r� r� r� re r r
r� r� r� r� r� r Zbpf_free_ringbuf)r) �kr� Z
table_keysr r� r� r r r r� s6
z BPF.cleanupc C s | S r r r r r r � __enter__6 s z
BPF.__enter__c C s | � � d S r )r� )r) �exc_typeZexc_valZexc_tbr r r �__exit__9 s z BPF.__exit__)Nr7 )F)NNN)r )r� r r� r� )r� r� r� r )N)N)r )r )r )r )r� r� r� )r� r� )r� )r� )r� )r� )r� )r� )r� )r� )r7 r7 r� r r r7 r7 r7 )r7 r� r7 r7 r7 )r7 r7 )r� r� r� Nr� r7 r )r� r� r� Nr� r7 )r� r� Nr7 r )r� r� Nr7 )F)F)F)N)FFT)FF)r7 )r7 )N)r7 )�r: r; r< rN rY rZ r[ r\ r@ r] r^ r_ r` ra rb rc rd re rf rg rh ri rj rk r} r~ r r� r� r� r� r� ZXDP_FLAGS_UPDATE_IF_NOEXISTr� ZXDP_FLAGS_SKB_MODEr� ZXDP_FLAGS_DRV_MODEr� ZXDP_FLAGS_HW_MODEr� ZXDP_FLAGS_REPLACEr: �compiler� r� r Zbcc_buildsymcache_newr� r� rO r� r% r r� ZCDLLZ_librt�
clock_gettimer� Zc_intr' �argtypes� classmethodr� r� r �objectr� � staticmethodr� r� r+ r� r� r� r� r Zc_boolZc_charZc_wcharZc_ubyteZc_shortZc_ushortZc_uintr� Zc_ulongZ
c_longlongr8 Zc_floatZc_doubleZ c_longdoubleZc_int64Zc_uint64r
r r r r r r! r" r' r( r, r? rA r@ rI rJ rL rN rR rS rT r\ rd rg rf rk rl rn ro rs rt r~ r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r4 r� rP r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r� s�
�
�
i
�
+
K
"
"
&
�
�
9 �
#
0
#r� )DZ
__future__r r� Zctypesr% r� r r� r: r� r� r� Zlibbccr r r r r �tabler r
r r r
Zperfr Zutilsr r r r r �versionr Z disassemblerr r r� r r r � NameErrorr
rD r r r6 r� r� rv r� Z
DEBUG_LLVM_IRr� ZDEBUG_PREPROCESSORZ DEBUG_SOURCEr� Z DEBUG_BTFr� r$ r= rB rF rH rN rl r} r� r� r r r r �<module> sV
+
*