grthtrhthjhtyjytjytkergtrhtrjytjerhrfh4:24 29/09/2026a ,-i::@sDddlmZzddlmZWney:ddlmZYn0ddlmZddlZ ddl m Z ddl Z ddl Z ddlZddlZddlZddlmZmZmZmZmZddlmZdd lmZdZd Zd Zd Zd ZdZdZ dZ!dZ"dZ#dZ$dZ%dZ&dZ'dZ(dZ)dZ*dZ+dZ,dZ-dZ.dZ/dZ0d Z1d!Z2d"Z3d#Z4d$Z5d%Z6ed&ed'ed(ed)ed*ed+e d,e!d-e"d.e#d/e$d0e%d1e&d2e'd3e(d4e)d5e*d6e+d7e,d8e-d9e.d:e/d;e0de3d?e4d@e5dAe6dBiZ7dCa8dDZ9dEZ:dFdGZ;ddHdIZdNdOZ?dPdQZ@dRdSZAdTdUZBGdVdWdWeZCGdXdYdYeCZDGdZd[d[eDZEGd\d]d]eCZFGd^d_d_eFZGGd`dadaeFZHGdbdcdcZIGdddedeeFZJGdfdgdgeFZKGdhdidieDZLGdjdkdkeLZMGdldmdmeFZNGdndodoeCZOGdpdqdqeCZPGdrdsdseFZQGdtdudueFZRGdvdwdweFZSGdxdydyeFZTGdzd{d{eDZUGd|d}d}eCZVGd~ddZWdS))print_function)MutableMapping)strftimeN)reduce)lib _RAW_CB_TYPE _LOST_CB_TYPE_RINGBUF_CB_TYPEbcc_perf_buffer_opts)get_online_cpus)get_possible_cpus ZHASHZARRAYZ PROG_ARRAYZPERF_EVENT_ARRAYZ PERCPU_HASHZ PERCPU_ARRAYZ STACK_TRACEZ CGROUP_ARRAYZLRU_HASHZLRU_PERCPU_HASHZLPM_TRIEZ ARRAY_OF_MAPSZ HASH_OF_MAPSZDEVMAPZSOCKMAPZCPUMAPZXSKMAPZSOCKHASHZCGROUP_STORAGEZREUSEPORT_SOCKARRAYZPERCPU_CGROUP_STORAGEZQUEUEZSTACKZ SK_STORAGEZ DEVMAP_HASHZ STRUCT_OPSZRINGBUFZ INODE_STORAGEZ TASK_STORAGE(AicCsXd}d}||||dks<||dkr*q<|d7}|d7}q||krT|ddd}|S)Nrr*+)valval_maxwidthitextr0r0-/usr/lib/python3.9/site-packages/bcc/table.py_starsds  r7cCst||ddS)N)section_bucket)_get_json_hist)valsval_typer8r0r0r6 get_json_histpsr<c Csg}d}tt|D]}||dkr|}qd}d}tt|D]V}|dkr>||kr>|d}i}||d<t|d|d<t|||d<|||}q>td||d} |r|d| |d<| S) Nrrrzinterval-startz interval-endcountz%Y-%m-%d %H:%M:%S)tsr;data)rangelenintappendr) r:r;r8Z hist_listZmax_nonzero_idxr4indexprevZlist_objZ histogramr0r0r6r9ss(  r9c Csd}d}d}t|D] \}}|dkr(|}||kr|}q|dkrLd}d} t} nd}d} ttd } |dkrtt||td |d D]~}d |>d ?} d |>d } | | kr| d 8} ||} |r| rt| | | | | t| || fd }qt| | | | | t| || fqdS) N@r.r z# %-19s : count distributionz%10d -> %-10d : %-8d |%-*s|z- %-29s : count distributionz%20d -> %-20d : %-8d |%-*s|rrF) enumerate stars_maxrBprintr@r7)r:r;strip_leading_zero log2_dist_maxidx_maxr2r4vheaderbodystarsZlowZhighr1r0r0r6_print_log2_hists<         rRc Csd}d}d}t|D] \}}|dkr(|}||kr|}qd}d} t} |dkrVt||td|dD]R}||} |r| rt| || | t| || fd}qdt| || | t| || fqddS)NrFr.rz# %-13s : count distributionz %-10d : %-8d |%-*s|rF)rHrIrJr@r7) r:r;rKrLrMr2r4rNrOrPrQr1r0r0r6_print_linear_hists,      rScCs$z t|WStyYdS0dS)Nz ) map_type_nameKeyError)ttyper0r0r6get_table_type_names  rWc Cstjtjtjtjtjtjtjtjtjtjtjtjtjtjtjtjtj tj tj tj tj tj dtj dtj d}t d}g}t|jj|j}d}||krnt|jj|j|}t d|}|d}|d} t d| rd} || }zD|r||||dt|dfn|||| fWn0tybtd | tjd tdYn0|d7}qtd tj fd |iS) Nr)charZs8z unsigned charu8zu8 *zchar *ZshortZs16zunsigned shortu16rBZs32enumz unsigned intu32Zlongz unsigned longz long longZs64zunsigned long longZu64Z__int128zunsigned __int128zvoid *z(\S+(?: \S+)*) ?\[([0-9]+)\]$rz (.*)#(.*)rzenum .*r[zGType: '%s' not recognized. Please define the data with ctypes manually.)filer,_fields_)!ctZc_charZc_ubyteZc_char_pZc_shortZc_ushortc_intc_uintZc_longZc_ulongZ c_longlongZ c_ulonglongZc_void_precompilerZbpf_perf_event_fieldsbpfmodule_nameZbpf_perf_event_fielddecodematchgrouprCrBrUrJsysstderrexittype Structure) Z event_mapZ ct_mappingZ array_typefields num_fieldsr4Zfieldm field_nameZ field_typer0r0r6_get_event_classsd       ( rsc KsBt|j|}d}|tkr.t|||||}n|tkrJt|||||}n|tkrft|||||}n|t krt ||||||}n|t krt |||||fi|}n|t krt|||||fi|}n\|tkrt|||||}n@|tkrt|||||}n"|tkr$t|||||}n|tkr@t|||||}n|tkr\t|||||}n|tkrxt|||||}n|tkrt|||||}n|tkrt|||||}nx|tkrt |||||}n\|t!krt"|||||}n@|t#ks|t$kr t%||||}n|t&kr(t'||||||}|dkr>t(d||S)z|Table(bpf, map_id, map_fd, keytype, leaftype, **kwargs) Create a python object out of a reference to a bpf table handleNzUnknown table type %d))rbpf_table_type_idreBPF_MAP_TYPE_HASH HashTableBPF_MAP_TYPE_ARRAYArrayBPF_MAP_TYPE_PROG_ARRAY ProgArrayBPF_MAP_TYPE_PERF_EVENT_ARRAYPerfEventArrayBPF_MAP_TYPE_PERCPU_HASH PerCpuHashBPF_MAP_TYPE_PERCPU_ARRAY PerCpuArrayBPF_MAP_TYPE_LPM_TRIELpmTrieBPF_MAP_TYPE_STACK_TRACE StackTraceBPF_MAP_TYPE_LRU_HASHLruHashBPF_MAP_TYPE_LRU_PERCPU_HASH LruPerCpuHashBPF_MAP_TYPE_CGROUP_ARRAY CgroupArrayBPF_MAP_TYPE_DEVMAPDevMapBPF_MAP_TYPE_CPUMAPCpuMapBPF_MAP_TYPE_XSKMAPXskMapBPF_MAP_TYPE_ARRAY_OF_MAPS MapInMapArrayBPF_MAP_TYPE_HASH_OF_MAPS MapInMapHashBPF_MAP_TYPE_QUEUEBPF_MAP_TYPE_STACK QueueStackBPF_MAP_TYPE_RINGBUFRingBuf Exception) rdmap_idmap_fdkeytypeleaftypenamekwargsrVtr0r0r6TablesR            rc@s eZdZdDddZddZddZdd Zd d Zd d ZddZ ddZ ddZ ddZ ddZ ddZddZddZdEdd ZdFd!d"Zd#d$ZdGd%d&Zd'd(Zd)d*ZdHd,d-Zd.d/Zd0d1Zd2d3Zd4d5ZGd6d7d7eZd8d9Zefd:d;Z dId>d?Z!dJd@dAZ"dKdBdCZ#dS)L TableBaseNcCsn||_||_||_||_||_t|jj|j|_t |jj|j|_ i|_ ||_ t t|jj|j|_dSN)rdrrKeyLeafrrtrerVbpf_table_flags_idflags_cbsrfrBbpf_table_max_entries_id max_entries)selfrdrrrrrr0r0r6__init__Cs zTableBase.__init__cCs|jSr)rrr0r0r6get_fdPszTableBase.get_fdc CsNtt|jd}t|jj|j|t |t |}|dkrHt d|j S)NrrzCould not printf key) r_create_string_buffersizeofrrZbpf_table_key_snprintfrdrerrAbyrefrvalue)rkeybufresr0r0r6 key_sprintfSszTableBase.key_sprintfc CsNtt|jd}t|jj|j|t |t |}|dkrHt d|j SNrrzCould not printf leaf r_rrrrZbpf_table_leaf_snprintfrdrerrArrrrleafrrr0r0r6 leaf_sprintf[szTableBase.leaf_sprintfcCs8|}t|jj|j|t|}|dkr4td|S)NrzCould not scanf key) rrZbpf_table_key_sscanfrdrerr_rr)rZkey_strrrr0r0r6 key_scanfcszTableBase.key_scanfcCs8|}t|jj|j|t|}|dkr4td|SNrzCould not scanf leaf rrZbpf_table_leaf_sscanfrdrerr_rrrZleaf_strrrr0r0r6 leaf_scanfkszTableBase.leaf_scanfcCs4|}t|jt|t|}|dkr0t|SNrrrZbpf_lookup_elemrr_rrUrrrrr0r0r6 __getitem__ss zTableBase.__getitem__cCsDt|jt|t|d}|dkr@tt}td|dS)NrzCould not update table: %s rbpf_update_elemrr_rosstrerror get_errnor)rrrrerrstrr0r0r6 __setitem__zszTableBase.__setitem__cCs$t|jt|}|dkr tdSr)rZbpf_delete_elemrr_rrU)rrrr0r0r6 __delitem__szTableBase.__delitem__c cs0|D]&}z||VWqty(Yq0qdSrrUrrr0r0r6 itervaluess  zTableBase.itervaluesc cs4|D]*}z|||fVWqty,Yq0qdSrrrr0r0r6 iteritemss  zTableBase.iteritemscCsdd|DS)NcSsg|]}|qSr0r0).0itemr0r0r6 z#TableBase.items..)rrr0r0r6itemsszTableBase.itemscCsdd|DS)NcSsg|]}|qSr0r0rrr0r0r6rrz$TableBase.values..rrr0r0r6valuesszTableBase.valuescCs|D]}||qdSr)keysrrkr0r0r6clears zTableBase.clearFcCsvd}}|s |s tdddfS|s,|j}n|dks>||jkrFtd|rV|j|}|rf|j|}t|||fS)aAllocate keys and/or values arrays. Useful for in items_*_batch. Args: alloc_k (bool): True to allocate keys array, False otherwise. Default is False. alloc_v (bool): True to allocate values array, False otherwise. Default is False. count (int): number of elements in the array(s) to allocate. If count is None then it allocates the maximum number of elements i.e self.max_entries. Returns: tuple: (count, keys, values). Where count is ct.c_uint32, and keys and values an instance of ct.Array Raises: ValueError: If count is less than 1 or greater than self.max_entries. Nrrz Wrong count)r_c_uint32r ValueErrorrr)ralloc_kalloc_vr=rrr0r0r6_alloc_keys_valuess  zTableBase._alloc_keys_valuescCsrd}||fD]:}|r t|tjs$tt|}|dks>||jkr tdq |rh|rht|t|krhtdt|S)aCheck if the given keys or values have the right type and size. Args: keys (ct.Array): keys array to check values (ct.Array): values array to check Returns: ct.c_uint32 : the size of the array(s) Raises: ValueError: If length of arrays is less than 1 or greater than self.max_entries, or when both arrays length are different. TypeError: If the keys and values are not an instance of ct.Array rrzArray's length is wrongz(keys array length != values array length) isinstancer_rx TypeErrorrArrr)rrrZarr_lenelemr0r0r6_sanity_check_keys_valuess    z#TableBase._sanity_check_keys_valuesccs$|jddD]\}}||fVq dS)aLook up all the key-value pairs in the map. Args: None Yields: tuple: The tuple of (key,value) for every entries that have been looked up. Notes: lookup batch on a keys subset is not supported by the kernel. FdeleteN)_items_lookup_and_optionally_delete_batchrrrNr0r0r6items_lookup_batchs  zTableBase.items_lookup_batchcCsf|durP|j|d}t|jt|t|}|dkrbtdtt n| D]}dSdS)aDelete the key-value pairs related to the keys given as parameters. Note that if no key are given, it is faster to call lib.bpf_lookup_and_delete_batch than create keys array and then call lib.bpf_delete_batch on these keys. Args: ct_keys (ct.Array): keys array to delete. If an array of keys is given then it deletes all the related keys-values. If keys is None (default) then it deletes all entries. Yields: tuple: The tuple of (key,value) for every entries that have been deleted. Raises: Exception: If bpf syscall return value indicates an error. N)rrz#BPF_MAP_DELETE_BATCH has failed: %s) rrZbpf_delete_batchrr_rrrrritems_lookup_and_delete_batch)rct_keysct_cntr_r0r0r6items_delete_batchs   zTableBase.items_delete_batchcCsT|j||d}t|jt|t|t|}|dkrPtdtt dS)aqUpdate all the key-value pairs in the map provided. The arrays must be the same length, between 1 and the maximum number of entries. Args: ct_keys (ct.Array): keys array to update ct_values (ct.Array): values array to update Raises: Exception: If bpf syscall return value indicates an error. )rrrz#BPF_MAP_UPDATE_BATCH has failed: %sN) rrZbpf_update_batchrr_rrrrr)rr ct_valuesrrr0r0r6items_update_batchs  zTableBase.items_update_batchccs$|jddD]\}}||fVq dS)a?Look up and delete all the key-value pairs in the map. Args: None Yields: tuple: The tuple of (key,value) for every entries that have been looked up and deleted. Notes: lookup and delete batch on a keys subset is not supported by the kernel. TrNrrr0r0r6r$s  z'TableBase.items_lookup_and_delete_batchTc csj|durtj}d}n tj}d}|jddd\}}}td}}d} |j| |_||j| rdt|ndt|t|t |j | t|t |j | t|} t } | |j7} | dkr| t jkrtd|t| f| dkrq | |jkrq |jdkrDq qDtd| D]P} || } || }t| tjs@| | } t|tjsX| |}| |fVqdS)aLook up and optionally delete all the key-value pairs in the map. Args: delete (bool) : look up and delete the key-value pairs when True, else just look up. Yields: tuple: The tuple of (key,value) for every entries that have been looked up and deleted. Raises: Exception: If bpf syscall return value indicates an error. Notes: lookup and delete batch on a keys subset is not supported by the kernel. TZBPF_MAP_LOOKUP_AND_DELETE_BATCHZBPF_MAP_LOOKUP_BATCH)rrrNz%s has failed: %s)rZbpf_lookup_and_delete_batchZbpf_lookup_batchrr_rrrrrrrrerrnoENOENTrrrr@rrn)rrZ bpf_batchZbpf_cmdZ ct_buf_sizerrZ ct_out_batchrtotalrZerrcoder4rrNr0r0r6r3sL       z3TableBase._items_lookup_and_optionally_delete_batchcCs"t|D]}|||<q dSr)listrrrr0r0r6zeropszTableBase.zerocCs t|Sr)rIterrr0r0r6__iter__xszTableBase.__iter__cCs|Srrrr0r0r6iter{rzTableBase.itercCs|Srrrr0r0r6r|rzTableBase.keysc@s,eZdZddZddZddZddZd S) zTableBase.ItercCs||_d|_dSr)tabler)rrr0r0r6rszTableBase.Iter.__init__cCs|Srr0rr0r0r6rszTableBase.Iter.__iter__cCs|Srnextrr0r0r6__next__szTableBase.Iter.__next__cCs|j|j|_|jSr)rrrrr0r0r6rszTableBase.Iter.nextN__name__ __module__ __qualname__rrrrr0r0r0r6r~srcCs^|}|dur0t|jt|t|j}nt|jt|t|}|dkrZt|Sr) rrZbpf_get_first_keyrr_rrZbpf_get_next_key StopIteration)rrZnext_keyrr0r0r6rs zTableBase.nextcCs|jjdd}|jjdd}|dkrHt|jjdkrH|jjdd}|D]L\}} t||} |rn|| } || dg|} || <t||} | j| | <qPt|} |r|| } | D]} | | qdS)NrrZ__pad_1rr) rr^rArgetattrgetrrrrC)rtmpbuckets bucket_fnbucket_sort_fnZ index_maxf1f2rrNbucketr:ZslotZ buckets_lstr0r0r6decode_c_structs     zTableBase.decode_c_structr Bucket ptrc Cst|tjrfi}g}||||||D]6}||} |rJ|||f} n||f} tt| || q,n6dgt} |D]\} } | j | | j <qxtt| |dS)a.print_json_hist(val_type="value", section_header="Bucket ptr", section_print_fn=None, bucket_fn=None, bucket_sort_fn=None): Prints a table as a json histogram. The table must be stored as log2. The val_type argument is optional, and is a column header. If the histogram has a secondary key, the dictionary will be split by secondary key If section_print_fn is not None, it will be passed the bucket value to format into a string as it sees fit. If bucket_fn is not None, it will be used to produce a bucket value for the histogram keys. If bucket_sort_fn is not None, it will be used to sort the buckets before iterating them, and it is useful when there are multiple fields in the secondary key. The maximum index allowed is log2_index_max (65), which will accommodate any 64-bit integer in the histogram. rN) rrr_rnrrJr9log2_index_maxrr) rr;section_headersection_print_fnr r rr rr:r8rrNr0r0r6print_json_hists zTableBase.print_json_histc Cst|tjrri}g}||||||D]B} || } |rRtd||| fntd|| ft| ||q,n4dgt} |D]\} } | j | | j <qt| ||dS)aprint_log2_hist(val_type="value", section_header="Bucket ptr", section_print_fn=None, bucket_fn=None, strip_leading_zero=None, bucket_sort_fn=None): Prints a table as a log2 histogram. The table must be stored as log2. The val_type argument is optional, and is a column header. If the histogram has a secondary key, multiple tables will print and section_header can be used as a header description for each. If section_print_fn is not None, it will be passed the bucket value to format into a string as it sees fit. If bucket_fn is not None, it will be used to produce a bucket value for the histogram keys. If the value of strip_leading_zero is not False, prints a histogram that is omitted leading zeros from the beginning. If bucket_sort_fn is not None, it will be used to sort the buckets before iterating them, and it is useful when there are multiple fields in the secondary key. The maximum index allowed is log2_index_max (65), which will accommodate any 64-bit integer in the histogram.  %s = %s %s = %rrN) rrr_rnrrJrRrrr rr;rrr rKr rr rr:rrNr0r0r6print_log2_hists   zTableBase.print_log2_histc Cst|tjrti}g}|||||t|D]B} || } |rTtd||| fntd|| ft| ||q.n^dgt} |D]>\} } z| j | | j <Wqt yt d| j tfYq0qt| ||dS)aprint_linear_hist(val_type="value", section_header="Bucket ptr", section_print_fn=None, bucket_fn=None, strip_leading_zero=None, bucket_sort_fn=None) Prints a table as a linear histogram. This is intended to span integer ranges, eg, from 0 to 100. The val_type argument is optional, and is a column header. If the histogram has a secondary key, multiple tables will print and section_header can be used as a header description for each. If section_print_fn is not None, it will be passed the bucket value to format into a string as it sees fit. If bucket_fn is not None, it will be used to produce a bucket value for the histogram keys. If the value of strip_leading_zero is not False, prints a histogram that is omitted leading zeros from the beginning. If bucket_sort_fn is not None, it will be used to sort the buckets before iterating them, and it is useful when there are multiple fields in the secondary key. The maximum index allowed is linear_index_max (1025), which is hoped to be sufficient for integer ranges spanned. rrrz5Index in print_linear_hist() of %d exceeds max of %d.N) rrr_rnrlinear_index_maxrJrSrr IndexErrorrr0r0r6print_linear_hists*   zTableBase.print_linear_hist)N)FFN)NN)N)T)rrNNN)rrNNNN)rrNNNN)$rrrrrrrrrrrrrrrrrrrrrrrrrrrrobjectrrrrrrrr0r0r0r6rAsN   #   =   $ (rcs$eZdZfddZddZZS)rvcstt|j|i|dSr)superrvrrargsr __class__r0r6r,szHashTable.__init__cCsd}|D] }|d7}q|SNrrr0rr4rr0r0r6__len__/szHashTable.__len__rrrrr$ __classcell__r0r0r r6rv+s rvcseZdZfddZZS)rcstt|j|i|dSr)rrrrr r0r6r5szLruHash.__init__rrrrr&r0r0r r6r4srcspeZdZfddZddZddZfddZfd d Zfd d Zd dZ ddZ Gddde Z Z S) ArrayBasecstt|j|i|dSr)rr(rrr r0r6r9szArrayBase.__init__cCsVt|tr(|dkrt||}||}t|tjs.raw_cb_c sNz |Wn<tyH}z$|jtjkr0tn|WYd}~n d}~00dSrrK)rZlostrO)rHr0r6lost_cb_s   z2PerfEventArray._open_perf_buffer..lost_cb_r.zCould not open perf buffer)rr r_rAr pidrPrIrZbpf_open_perf_buffer_optsrrZperf_reader_fdrrrdr?r>rr<) rrPrFrGrHrIrQrRfnZlost_fnZoptsreaderr/r0)rFrPrHr6rEs   z PerfEventArray._open_perf_bufferr.cCsBt||||}|dkr td|||||<||j|<dS)Nrzbpf_open_perf_event failed)rZbpf_open_perf_eventrrrr<)rrPtypconfigrSr/r0r0r6_open_perf_events zPerfEventArray._open_perf_eventcCs tD]}|||||qdS)zopen_perf_event(typ, config) Configures the table such that calls from the bpf program to table.perf_read(CUR_CPU_IDENTIFIER) will return the hardware counter denoted by event ev on the local cpu. N)r rX)rrVrWrSr4r0r0r6open_perf_events zPerfEventArray.open_perf_event)rNr)r.)r.) rrrrr5rrDrJrErXrYr&r0r0r r6r|s   " r|csTeZdZfddZfddZddZfddZd d Zd d Zd dZ Z S)r~cs|dd|_tt|j|i||j|_tt|_ t |jd|_ |j dkrd|j|j |_n@|jt j krt j|j |_n$|jt jkrt j|j |_ntddSNreducerrrzLeaf must be aligned to 8 bytes)popr[rr~rrsLeafrAr total_cpur_r alignmentrac_uint64r`c_int64rrr r0r6rs    zPerCpuHash.__init__csPtt||}|jdkr |}n,|j|j}td|jD]}||||<q:|Sr)rr~rr_r]r^r@rrresultretr4r r0r6getvalue$s zPerCpuHash.getvaluecCs&|jrt|j||S||SdSrr[rrerr0r0r6r.szPerCpuHash.__getitem__cstt|||dSr)rr~rr*r r0r6r4szPerCpuHash.__setitem__cCs,t|tjrtd|t||SNz6Leaf must be an integer type for default sum functionsrrr_rnrr]sumrerr0r0r6ri7szPerCpuHash.sumcCs,t|tjrtd|t||SNz6Leaf must be an integer type for default max functionsrrr_rnrr]maxrerr0r0r6rl<szPerCpuHash.maxcCs||}|j|jSrrirr^rrrcr0r0r6averageAs zPerCpuHash.average) rrrrrerrrirlror&r0r0r r6r~s   r~cseZdZfddZZS)rcstt|j|i|dSr)rrrrr r0r6rFszLruPerCpuHash.__init__r'r0r0r r6rEsrcs\eZdZfddZfddZddZfddZd d Zd d Zd dZ ddZ Z S)rcs|dd|_tt|j|i||j|_tt|_ t |jd|_ |j dkrd|j|j |_n@|jt j krt j|j |_n$|jt jkrt j|j |_ntddSrZ)r\r[rrrrr]rAr r^r_rr_rar`r`rarrr r0r6rJs    zPerCpuArray.__init__csPtt||}|jdkr |}n,|j|j}td|jD]}||||<q:|Sr)rrrr_r]r^r@rbr r0r6re\s zPerCpuArray.getvaluecCs&|jrt|j||S||SdSrrfrr0r0r6rfszPerCpuArray.__getitem__cstt|||dSr)rrrr*r r0r6rlszPerCpuArray.__setitem__cCs||dSrr.rr0r0r6roszPerCpuArray.__delitem__cCs,t|tjrtd|t||Srgrhrr0r0r6risszPerCpuArray.sumcCs,t|tjrtd|t||Srjrkrr0r0r6rlxszPerCpuArray.maxcCs||}|j|jSrrmrnr0r0r6ro}s zPerCpuArray.average) rrrrrerrrrirlror&r0r0r r6rIs   rcs$eZdZfddZddZZS)rcstt|j|i|dSr)rrrrr r0r6rszLpmTrie.__init__cCstdSr)NotImplementedErrorrr0r0r6r$szLpmTrie.__len__r%r0r0r r6rs rcsZeZdZdZdZdZdZdZfddZGdd d e Z dd d Z d dZ ddZ ZS)rrGrrrcstt|j|i|dSr)rrrrr r0r6rszStackTrace.__init__c@s.eZdZd ddZddZddZdd ZdS) zStackTrace.StackWalkerNcCs||_d|_||_||_dSr,)stacknresolver)rrrrrtr0r0r6rszStackTrace.StackWalker.__init__cCs|Srr0rr0r0r6rszStackTrace.StackWalker.__iter__cCs|Srrrr0r0r6rszStackTrace.StackWalker.__next__cCs|jd7_|jtjkr t|jtj@rZ|jj|j}|jtj ksR|jtj krhtn|jj |j}|dkrt dr|jdkr|jdkrt|jr||S|S)NrrZppcr)rsr MAX_DEPTHrrBPF_F_STACK_BUILD_IDrrZtracestatusBPF_STACK_BUILD_ID_IPBPF_STACK_BUILD_ID_EMPTYipplatformmachine startswithrt)raddrr0r0r6rs    *zStackTrace.StackWalker.next)Nrr0r0r0r6 StackWalkers rNcCst||||j|Sr)rrrr)rZstack_idrtr0r0r6walkszStackTrace.walkcCsd}|D] }|d7}q|Sr"r0r#r0r0r6r$szStackTrace.__len__cCsdSrr0rr0r0r6rszStackTrace.clear)N)rrrrurvryZBPF_STACK_BUILD_ID_VALIDrxrrrrr$rr&r0r0r r6rs  rcseZdZfddZZS)rcstt|j|i|dSr)rrrrr r0r6rszDevMap.__init__r'r0r0r r6rsrcseZdZfddZZS)rcstt|j|i|dSr)rrrrr r0r6rszCpuMap.__init__r'r0r0r r6rsrcseZdZfddZZS)rcstt|j|i|dSr)rrrrr r0r6rszXskMap.__init__r'r0r0r r6rsrcseZdZfddZZS)rcstt|j|i|dSr)rrrrr r0r6rszMapInMapArray.__init__r'r0r0r r6rsrcseZdZfddZZS)rcstt|j|i|dSr)rrrrr r0r6rszMapInMapHash.__init__r'r0r0r r6rsrcsFeZdZfddZddZddZddZd d Zdd d ZZ S)rcs&tt|j|i|d|_d|_dSr)rrrZ_ringbufr=rr r0r6rszRingBuf.__init__cCsdSrr0rr0r0r6Z __delitemszRingBuf.__delitemcCsdSrr0rr0r0r6r5szRingBuf.__del__cCsdSrr0rr0r0r6r$szRingBuf.__len__cCs*|jdkrt||_t|t|jjS)aevent(data) When ring buffers are opened to receive custom event, the underlying event data struct which is defined in C in the BPF program can be deduced via this function. This avoids redundant definitions in Python. Nr@rCr0r0r6rDs  z RingBuf.eventNcs4fdd}t|}|j|j||||jd<dS)zopen_ring_buffer(callback) Opens a ring buffer to receive custom event data from the bpf program. The callback will be invoked for each event submitted from the kernel, up to millions per second. c spz.|||}z t|}Wnd}Yn0Wn<tyj}z$|jtjkrRtn|WYd}~n d}~00|Sr)rBrLrrMrl)ctxr?rNrdrOrFr0r6 ringbuf_cb_s   z-RingBuf.open_ring_buffer..ringbuf_cb_rN)r rdZ_open_ring_bufferrr)rrFrrrTr0rr6open_ring_buffers zRingBuf.open_ring_buffer)N) rrrrZ_RingBuf__delitemr5r$rDrr&r0r0r r6rs   rc@sReZdZdZddZddZddZdd d Zd d Zd dZ ddZ ddZ dS)rrcCs\||_||_||_||_t|jj|j|_t|jj|j|_ t t |jj|j|_ dSr) rdrrrrrtrerVrrrBrr)rrdrrrr0r0r6rs zQueueStack.__init__c CsNtt|jd}t|jj|j|t |t |}|dkrHt d|j Srrrr0r0r6rszQueueStack.leaf_sprintfcCs8|}t|jj|j|t|}|dkr4td|Srrrr0r0r6r!szQueueStack.leaf_scanfrcCs>t|jdt||}|dkr:tt}td|dS)NrzCould not push to table: %sr)rrrrrr0r0r6push)szQueueStack.pushcCs2|}t|jdt|}|dkr.td|S)NrzCould not pop from table)rrZbpf_lookup_and_deleterr_rrUrrrr0r0r6r\/s zQueueStack.popcCs2|}t|jdt|}|dkr.td|S)NrzCould not peek tablerrr0r0r6peek6s zQueueStack.peekccs<|j}|r8z|V|d8}Wqty4YdS0qdSr-)rr\rU)rZcntr0r0r6r=s   zQueueStack.itervaluescCsdd|DS)NcSsg|]}|qSr0r0rr0r0r6rHrz%QueueStack.values..rrr0r0r6rGszQueueStack.valuesN)r) rrrZ BPF_EXISTrrrrr\rrrr0r0r0r6r s   r)N)N)XZ __future__rcollections.abcr ImportError collectionstimerZctypesr_ functoolsrrrrbrjr{Zlibbccrrr r r Zutilsr r rurwryr{r}rrrrrrrrrZBPF_MAP_TYPE_SOCKMAPrrZBPF_MAP_TYPE_SOCKHASHZBPF_MAP_TYPE_CGROUP_STORAGEZ BPF_MAP_TYPE_REUSEPORT_SOCKARRAYZ"BPF_MAP_TYPE_PERCPU_CGROUP_STORAGErrZBPF_MAP_TYPE_SK_STORAGEZBPF_MAP_TYPE_DEVMAP_HASHZBPF_MAP_TYPE_STRUCT_OPSrZBPF_MAP_TYPE_INODE_STORAGEZBPF_MAP_TYPE_TASK_STORAGErTrIrrr7r<r9rRrSrWrsrrrvrr(rxrzr1rr|r~rrrrrrrrrrrr0r0r0r6s         &;0m 8 l4859