grthtrhthjhtyjytjytkergtrhtrjytjerhrfh4:24 29/09/2026a ,-ÞiXã@sêddlmZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl mZmZmZmZmZddlmZmZmZmZmZddlmZddlmZmZmZmZm Z ddl!m"Z"dd l#m$Z$m%Z%dd l&m'Z'm(Z(ze)Wne*ye+Z)Yn0d Z,da-d d „Z.dZ/ej0 1e/d¡Z2ej0 3e2¡s>dZ2dZ4dZ5dZ6dZ7dZ8dZ9Gdd„de:ƒZ;Gdd„dƒZGdd„dƒZ?Gd d!„d!ƒZ@Gd"d#„d#ƒZAGd$d%„d%ƒZBGd&d'„d'ƒZCGd(d)„d)e:ƒZDdS)*é)Úprint_functionNé)ÚlibÚ bcc_symbolÚbcc_symbol_optionÚbcc_stacktrace_build_idÚ _SYM_CB_TYPE)ÚTableÚPerfEventArrayÚRingBufÚBPF_MAP_TYPE_QUEUEÚBPF_MAP_TYPE_STACK)ÚPerf)Úget_online_cpusÚprintbÚ_assert_is_bytesÚ ArgStringÚ StrcmpRewrite)Ú __version__)Údisassemble_progÚ decode_map)ÚUSDTÚ USDTExceptioniècCstS©N)Ú_num_open_probes©rrú0/usr/lib/python3.9/site-packages/bcc/__init__.pyÚ_get_num_open_probes,srz/sys/kernel/debugÚtracingz/sys/kernel/tracingééééé c@s$eZdZdd„Zdd„Zdd„ZdS)Ú SymbolCachec Cs t |t dt t¡¡¡|_dSr)rZbcc_symcache_newÚctÚcastÚPOINTERrÚcache)ÚselfÚpidrrrÚ__init__EsÿzSymbolCache.__init__cCs¬tƒ}|r"t |j|t |¡¡}nt |j|t |¡¡}|dkrp|jrf|jrfd|jt  |jtj ¡j fSd|dfS|rŒ|j }t  t |¡¡n|j}||jt  |jtj ¡j fS)aÜ Return a tuple of the symbol (function), its offset from the beginning of the function, and the module in which it lies. For example: ("start_thread", 0x202, "/usr/lib/.../libpthread-2.24.so") If the symbol cannot be found but we know which module it is in, return the module name and the offset from the beginning of the module. If we don't even know the module, return the absolute address as the offset. rN)rrZbcc_symcache_resolver(r%ÚbyrefZ bcc_symcache_resolve_no_demangleÚmoduleÚoffsetr&Úc_char_pÚvalueZ demangle_nameZbcc_symbol_free_demangle_nameÚname)r)ÚaddrÚdemangleÚsymÚresZname_resrrrÚresolveIs"  ÿ ÿ zSymbolCache.resolvecCs>t|ƒ}t|ƒ}t ¡}t |j||t |¡¡dkr8dS|jS)Nréÿÿÿÿ)rr%Ú c_ulonglongrZbcc_symcache_resolve_namer(r,r0)r)r-r1r2rrrÚ resolve_namefs ÿÿzSymbolCache.resolve_nameN)Ú__name__Ú __module__Ú __qualname__r+r6r9rrrrr$Dsr$c@s$eZdZdZdZdZdZdZdZdS)ÚPerfTyperrrér éN) r:r;r<ZHARDWAREZSOFTWAREÚ TRACEPOINTZHW_CACHEÚRAWZ BREAKPOINTrrrrr=os r=c@s4eZdZdZdZdZdZdZdZdZ dZ d Z d Z d S) Ú PerfHWConfigrrrr>r r?éér!é N) r:r;r<Z CPU_CYCLESZ INSTRUCTIONSZCACHE_REFERENCESZ CACHE_MISSESZBRANCH_INSTRUCTIONSZ BRANCH_MISSESZ BUS_CYCLESZSTALLED_CYCLES_FRONTENDZSTALLED_CYCLES_BACKENDZREF_CPU_CYCLESrrrrrBxsrBc@s8eZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d S) Ú PerfSWConfigrrrr>r r?rCrDr!rEé N)r:r;r<Z CPU_CLOCKZ TASK_CLOCKZ PAGE_FAULTSZCONTEXT_SWITCHESZCPU_MIGRATIONSZPAGE_FAULTS_MINZPAGE_FAULTS_MAJZALIGNMENT_FAULTSZEMULATION_FAULTSZDUMMYZ BPF_OUTPUTrrrrrF…srFc@speZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZdZdZdZdZdZdZdZdZdZdS)ÚPerfEventSampleFormatrrr r!r"r#é@é€éiéiii i@i€iiiiii i@i€iN)r:r;r<ZIPZTIDZTIMEZADDRZREADZ CALLCHAINZIDZCPUZPERIODZ STREAM_IDrAZ BRANCH_STACKZ REGS_USERZ STACK_USERZWEIGHTZDATA_SRCZ IDENTIFIERZ TRANSACTIONZ REGS_INTRZ PHYS_ADDRÚAUXZCGROUPZDATA_PAGE_SIZEZCODE_PAGE_SIZEZ WEIGHT_STRUCTrrrrrH“s2rHc@s`eZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZdZdZdZdZdZdS)Ú BPFProgTyperrr>r r?rCrDr!rErGé é é éér"éééééN)r:r;r<Ú SOCKET_FILTERÚKPROBEÚ SCHED_CLSÚ SCHED_ACTr@ÚXDPÚ PERF_EVENTÚ CGROUP_SKBÚ CGROUP_SOCKÚLWT_INÚLWT_OUTÚLWT_XMITÚSOCK_OPSÚSK_SKBÚ CGROUP_DEVICEÚSK_MSGÚRAW_TRACEPOINTÚCGROUP_SOCK_ADDRZCGROUP_SOCKOPTÚTRACINGÚLSMrrrrrN¯s*rNc@s¨eZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ!d Z"d!Z#d"Z$d#Z%d$Z&d%Z'd&Z(d'Z)d(S))Ú BPFAttachTyperrrr>r r?rCrDr!rErGrOrPrQrRrSr"rTrUéééééérVrWéérXéér#é!é"é#é$é%é&N)*r:r;r<ZCGROUP_INET_INGRESSZCGROUP_INET_EGRESSZCGROUP_INET_SOCK_CREATEZCGROUP_SOCK_OPSZSK_SKB_STREAM_PARSERZSK_SKB_STREAM_VERDICTrfZSK_MSG_VERDICTZCGROUP_INET4_BINDZCGROUP_INET6_BINDZCGROUP_INET4_CONNECTZCGROUP_INET6_CONNECTZCGROUP_INET4_POST_BINDZCGROUP_INET6_POST_BINDZCGROUP_UDP4_SENDMSGZCGROUP_UDP6_SENDMSGZ LIRC_MODE2ZFLOW_DISSECTORZ CGROUP_SYSCTLZCGROUP_UDP4_RECVMSGZCGROUP_UDP6_RECVMSGZCGROUP_GETSOCKOPTZCGROUP_SETSOCKOPTZ TRACE_RAW_TPZ TRACE_FENTRYZ TRACE_FEXITZ MODIFY_RETURNZLSM_MACZ TRACE_ITERZCGROUP_INET4_GETPEERNAMEZCGROUP_INET6_GETPEERNAMEZCGROUP_INET4_GETSOCKNAMEZCGROUP_INET6_GETSOCKNAMEZ XDP_DEVMAPZCGROUP_INET_SOCK_RELEASEZ XDP_CPUMAPZ SK_LOOKUPr]ZSK_SKB_VERDICTrrrrrlÇsNrlc@s eZdZdZdZdZdZdZdS)Ú XDPActionrrrr>r N)r:r;r<Ú XDP_ABORTEDÚXDP_DROPÚXDP_PASSÚXDP_TXÚ XDP_REDIRECTrrrrr}ñs r}c@s eZdZdZdZdZdZdZdS)ÚXDPFlagsrrr r!r"N)r:r;r<ÚUPDATE_IF_NOEXISTÚSKB_MODEÚDRV_MODEÚHW_MODEÚREPLACErrrrrƒùs rƒc@sÎeZdZejZejZejZejZejZej Z ej Z ej Z ej Z ej Z ejZejZejZejZejZejZejZejZejZejZejZejZejZejZejZejZ ej!Z"ej#Z$ej%Z&ej'Z(e) *d¡Z+iZ,e- .¡Z/dgddgddgdgdd gd œZ0gd ¢Z1d Z2Gd d„de3j4ƒZ5e3j6dddZ7e7j8Z9e3j:e3 ;e5¡ge9_e=dd„ƒZ?e@Z@Gdd„deAƒZBeCdd„ƒZDeCdd„ƒZEddddggdddf d d!„ZFefd"d#„ZGdåd%d&„ZHd'd(„ZId)d*„ZJdæd+d,„ZKe3jLe3jMe3jNe3jOe3jPe3jQe3j:e3jRe3jSe3jTe3jUe3jVe3jWe3jXe3jYe3jZd-e3j[d-d.œZ\eCd/d0„ƒZ]dçd1d2„Z^d3d4„Z_d5d6„Z`d7d8„Zad9d:„Zbd;d<„ZceCdèd=d>„ƒZdeCd?d@„ƒZeeCdAdB„ƒZfeCdCdD„ƒZgdEdF„ZheCdGdH„ƒZidIdJ„ZjdKdL„ZkdMdN„ZldOdP„ZmdQdR„ZndSdT„ZodUdV„ZpdédWdX„ZqdêdYdZ„Zrd[d\„Zsd]d^„Ztdëd_d`„Zudìdadb„ZveCdídcdd„ƒZweCdîdedf„ƒZxe=dïdgdh„ƒZyeCdðdidj„ƒZzeCdkdl„ƒZ{eCdmdn„ƒZ|dñdodp„Z}dòdqdr„Z~dódsdt„ZeCdudv„ƒZ€eCdwdx„ƒZeCdydz„ƒZ‚eCd{d|„ƒZƒdôd}d~„Z„dõdd€„Z…dödd‚„Z†d÷dƒd„„Z‡død…d†„Zˆdùd‡dˆ„Z‰dúd‰dŠ„ZŠdûd‹dŒ„Z‹eCddŽ„ƒZŒeCdd„ƒZeCd‘d’„ƒZŽeCd“d”„ƒZdüd•d–„Zd—d˜„Z‘dýd™dš„Z’d›dœ„Z“dþddž„Z”dÿdŸd „Z•eCd¡d¢„ƒZ–eCd£d¤„ƒZ—eCd¥d¦„ƒZ˜d§d¨„Z™dd©dª„Zšdd«d¬„Z›d­d®„Zœdd¯d°„Zdd±d²„Zžd³d´„ZŸddµd¶„Z dd·d¸„Z¡dd¹dº„Z¢dd»d¼„Z£eCd½d¾„ƒZ¤eCdd¿dÀ„ƒZ¥eCd dÁd„ƒZ¦eCdÃdÄ„ƒZ§dÅdÆ„Z¨dÇdÈ„Z©dÉdÊ„Zªd dËdÌ„Z«dÍd΄Z¬d dÏdЄZ­d dÑdÒ„Z®d dÓdÔ„Z¯dÕdÖ„Z°d×dØ„Z±eCdÙdÚ„ƒZ²dÛdÜ„Z³dÝdÞ„Z´dßdà„Zµdádâ„Z¶dãdä„Z·dS(ÚBPFs [^a-zA-Z0-9_]ÚtimeZfsÚfileZbioZrequestZallocZsk_buffZ net_device)z linux/time.hz linux/fs.hzlinux/blkdev.hz linux/slab.hzlinux/netdevice.h)ssys_s __x64_sys_s__x32_compat_sys_s__ia32_compat_sys_s __arm64_sys_s __s390x_sys_s __s390_sys_s __riscv_sys_rc@s eZdZdejfdejfgZdS)z BPF.timespecÚtv_secÚtv_nsecN)r:r;r<r%Úc_longÚ_fields_rrrrÚtimespecEsrz librt.so.1T)Z use_errnocCsH| ¡}| |jt |¡¡dkr8t ¡}t|t |¡ƒ‚|j d|j S)z¨monotonic_time() Returns the system monotonic time from clock_gettime, using the CLOCK_MONOTONIC constant. The time returned is in nanoseconds. rgeÍÍA) rÚ_clock_gettimeÚCLOCK_MONOTONICr%r,Ú get_errnoÚOSErrorÚosÚstrerrorrŒr)ÚclsÚtÚerrnorrrÚmonotonic_timeLs zBPF.monotonic_timecCsLd}|j ¡D]8\}}|D]*}|D] }||vr"||vr"|d|7}q"qq|S)a1 Generates #include statements automatically based on a set of recognized types such as sk_buff and bio. The input is all the words that appear in the BPF program, and the output is a (possibly empty) string of #include statements, such as "#include ". Úz#include <%s> )Ú_auto_includesÚitems)r—Z program_wordsZheadersÚheaderÚkeywordsÚkeywordZwordrrrÚgenerate_auto_includesXszBPF.generate_auto_includesc@seZdZdd„ZdS)z BPF.FunctioncCs||_||_||_dSr)Úbpfr1Úfd)r)r¢r1r£rrrr+lszBPF.Function.__init__N)r:r;r<r+rrrrÚFunctionksr¤cCsb|r^tj |¡s^ttjdƒ}d tj tj |  ¡¡¡|g¡}tj |¡rR|}n t d|ƒ‚|S)z1 If filename is invalid, search in ./ of argv[0] ró/zCould not find file %s) r•ÚpathÚisfilerÚsysÚargvÚjoinÚabspathÚdirnameÚ __bytes__Ú Exception)ÚfilenameZargv0r˜rrrÚ _find_fileqs "  zBPF._find_filecCsrdd„}tj |¡\}}|r*||ƒrn|SnDtjd tj¡D]0}| d¡}tj | ¡|¡}||ƒr<|Sq.is_exeÚPATHú"N)r•r¦ÚsplitÚenvironÚpathsepÚstriprªÚencode)Zbin_pathr´r³Úfnamer¦Zexe_filerrrÚfind_exe~s   z BPF.find_exeóNrFc  CsÒt|ƒ}t|ƒ}t|ƒ}|r$|r$J‚t ¡} | dkr"z8tjddgtjd} |  d¡ d¡} tj   | ¡sld} Wn(t y–} zd} WYd} ~ n d} ~ 00z8tjd dgtjd}| d¡ d¡}tj   |¡sÎd}Wn(t yø} zd}WYd} ~ n d} ~ 00| r|  d | ¡|r"|  d |¡i|_ i|_i|_i|_i|_i|_i|_i|_i|_i|_d|_d|_t |j¡||_i|_i|_d|_t j!t"|ƒƒ}t#|ƒD]\}}t$t%|ƒƒ||<q¦|rÜt& '|¡}t& '|¡}|rt(|d d }| )¡}Wdƒn1s0Yt j*t"|ƒƒ}t#|ƒD]\}}t  *| +¡¡||<q0t, -|t"|ƒ¡}|durpt d ƒ‚||}t, .||j|t"|ƒ||¡|_|js®t d|p¨dƒ‚|D]}| /|| ¡q²| 0¡dS)aZCreate a new BPF module with the given source code. Note: All fields are marked as optional, but either `src_file` or `text` must be supplied, and not both. Args: src_file (Optional[str]): Path to a source file for the module hdr_file (Optional[str]): Path to a helper header file for the `src_file` text (Optional[str]): Contents of a source file for the module debug (Optional[int]): Flags used for debug prints, can be |'d together See "Debug flags" for explanation Z loongarch64Zclangz-print-file-name=include)Ústderrúutf-8Ú FNZgccz-IÚrb)Úmodezycan't generate USDT probe arguments; possible cause is missing pid when a probe in a shared object has multiple locationszFailed to compile BPF module %sz)1rÚplatformÚmachineÚ subprocessZ check_outputZSTDOUTÚdecoderºr•r¦Úexistsr®ÚappendÚ kprobe_fdsÚ uprobe_fdsÚtracepoint_fdsÚraw_tracepoint_fdsÚkfunc_entry_fdsÚkfunc_exit_fdsÚ fmod_ret_fdsÚlsm_fdsÚ perf_buffersÚopen_perf_eventsÚ_ringbuf_managerÚ tracefileÚatexitÚregisterÚcleanupÚdebugÚfuncsÚtablesr-r%r/ÚlenÚ enumerateÚbytesrr‰r°ÚopenÚreadÚc_void_pZ get_contextrZbcc_usdt_genargsZbpf_module_create_c_from_stringZattach_uprobesÚ_trace_autoload)r)Zsrc_fileZhdr_fileÚtextrÙZcflagsZ usdt_contextsZ allow_rlimitÚdeviceZattach_usdt_ignore_pidZ architectureZclang_include_path_outputZclang_include_path_strÚeZgcc_include_path_outputZgcc_include_path_strZ cflags_arrayÚiÚsr‹Z ctx_arrayÚusdtZ usdt_textZ usdt_contextrrrr+›s„     $  ( ýz BPF.__init__cCs@g}tdt |j¡ƒD]$}t |j|¡}| | ||¡¡q|S)zload_funcs(prog_type=KPROBE) Load all functions in this BPF module with the given type. Returns a list of the function handles.r)ÚrangerÚbpf_num_functionsr-Úbpf_function_namerÉÚ load_func)r)Ú prog_typeÚfnsræÚ func_namerrrÚ load_funcss zBPF.load_funcsr7c Cst|ƒ}||jvr|j|St |j|¡s6td|ƒ‚d}|jt@rJd}n|jt@rXd}t  |j||t |j|¡t  |j|¡t  |j¡t  |j¡|dd||¡ }|dkræt  |j¡t ¡tjkrÈtdƒ‚t t ¡¡}td||fƒ‚t |||¡}||j|<|S)NúUnknown program %srrrz!Need super-user privileges to runz!Failed to load BPF program %s: %s)rrÚrÚbpf_function_startr-r®rÙÚDEBUG_BPF_REGISTER_STATEÚ DEBUG_BPFZ bcc_func_loadÚbpf_function_sizeZbpf_module_licenseZbpf_module_kern_versionrÖr×Ú donothingr%r“r™ÚEPERMr•r–r‰r¤) r)rïríräÚ attach_typeZ log_levelr£ÚerrstrÚfnrrrrìs8           û ÿ z BPF.load_funccCsJt|ƒ}t |j|¡s"td|ƒ‚t |j|¡}t |j|¡}t ||¡S)zR Return the eBPF bytecodes for the specified function as a string rñ)rrròr-r®rõr%Z string_at)r)rïÚstartÚsizerrrÚ dump_func2s  z BPF.dump_funccCs| |¡}t||ƒSr)rýr)r)rïZbpfstrrrrÚdisassemble_func>s zBPF.disassemble_funccCs(||}t |j|j¡}t||||dS)N)Úsizeinfo)rÚbpf_table_type_idr-Úmap_idr)r)Z table_namerÿZ table_objZ table_typerrrÚ decode_tableBszBPF.decode_tabler)Z_BoolÚcharZwchar_tz unsigned charZshortzunsigned shortÚintz unsigned intZlongz unsigned longz long longzunsigned long longÚfloatZdoublez long doubleZ__int128zunsigned __int128cCst|tƒrtj|Sg}g}|dD]@}t|ƒdkrT| |dt |d¡f¡q$t|ƒdkrVt|dtƒrš| |dt |d¡|ddf¡nºt|dtƒrÌ| |dt |d¡|df¡nˆt|dtƒrD|ddks|ddks|ddkrD|d}|dkr.d t|ƒ}| |¡| |t |¡f¡nt d t |ƒƒ‚q$t d t |ƒƒ‚q$t j }d }t|ƒdkrÄ|ddkr–t j }n.|ddkr¬t j }n|ddkrÄt j }d }|rìtt |dƒ|ft|d|d ƒ}ntt |dƒ|ft||dƒ}|S)Nrrrr>ÚunionÚstructZ struct_packedr›z__anon%dzFailed to decode type %sFT)Ú _anonymous_Z_pack_r)rr)Ú isinstanceÚ basestringr‰Ú str2ctyperÜrÉÚ_decode_table_typeÚlistrr®Ústrr%Ú StructureÚUnionÚtypeÚdict)ZdescZanonÚfieldsr˜r1ÚbaseZ is_packedr—rrrr ZsX   *$ ÿ ÿ þ   ÿ ÿzBPF._decode_table_typec CsÐt|ƒ}t |j|¡}t |j|¡}t |j|¡ttfv}|dkrFt‚|s‚|s‚t  |j|¡  d¡}|srt d|ƒ‚t   t |¡¡}|sºt |j|¡  d¡} | sªt d|ƒ‚t   t | ¡¡}t|||||||dS)NrrÀz$Failed to load BPF Table %s key descz%Failed to load BPF Table %s leaf desc)Úreducer)rrZ bpf_table_idr-Z bpf_table_fdrr r ÚKeyErrorZbpf_table_key_descrÇr®r‰r ÚjsonÚloadsZbpf_table_leaf_descr ) r)r1ZkeytypeZleaftyperrÚmap_fdZ is_queuestackZkey_descZ leaf_descrrrÚ get_table†s"  z BPF.get_tablecCs$||jvr| |¡|j|<|j|Sr)rÛr©r)ÚkeyrrrÚ __getitem__™s zBPF.__getitem__cCs||j|<dSr©rÛ)r)rZleafrrrÚ __setitem__žszBPF.__setitem__cCs t|jƒSr)rÜrÛ©r)rrrÚ__len__¡sz BPF.__len__cCs |j|=dSrrrrrrÚ __delitem__¤szBPF.__delitem__cCs |j ¡Sr)rÛÚ__iter__r rrrr#§sz BPF.__iter__cCsJt|tjƒstdƒ‚t |j|||¡}|dkrFtd |t  | ¡¡ƒ‚dS)Nú"arg 1 must be of type BPF.Functionrz7Failed to attach BPF function with attach_type {0}: {1}) r r‰r¤r®rZbpf_prog_attachr£Úformatr•r–)rúÚ attachable_fdrøÚflagsr5rrrÚ attach_funcªs  ÿzBPF.attach_funccCsHt|tjƒstdƒ‚t |j||¡}|dkrDtd |t  | ¡¡ƒ‚dS)Nr$rz7Failed to detach BPF function with attach_type {0}: {1}) r r‰r¤r®rZbpf_prog_detach2r£r%r•r–)rúr&rør5rrrÚ detach_func´s  ÿzBPF.detach_funccCsŠt|ƒ}t|tjƒstdƒ‚t |¡}|dkrLt t   ¡¡}td||fƒ‚t  ||j ¡}|dkr€t t   ¡¡}td||fƒ‚||_ dS)Nr$rz Failed to open raw device %s: %sú%Failed to attach BPF to device %s: %s)rr r‰r¤r®rZbpf_open_raw_sockr•r–r%r“Zbpf_attach_socketr£Úsock)rúÚdevr+rùr5rrrÚattach_raw_socket¾s  ÿzBPF.attach_raw_socketc CsŒdt}z@t|dƒ"}tdd„|Dƒƒ}Wdƒn1s<0YWn<ty„}z$|jtjkrh|‚tgƒ}WYd}~n d}~00dt}z@t|dƒ"}tdd„|Dƒƒ}Wdƒn1sÂ0YWn>ty }z$|jtjkrð|‚tgƒ}WYd}~n d}~00g}d} d} tddƒL} | D]4} |  ¡ ¡d d …\} }| dkrh|d kr„d } q,n| d kr„|d kr,d } q,| dkr¶|dkr¢d } q,n|dkrÒd } q,n| d krÒ|dkr,d } q,| d¡räq,nB| d¡s,| d¡rq,n$| d¡rq,nt   d|¡r&q,|   ¡dvr,t   ||¡r,||vr,||vr,|  |¡q,Wdƒn1sz0Yt|ƒS)Nz%s/kprobes/blacklistrÂcSsg|]}| ¡ ¡d‘qS)r©Úrstripr·©Ú.0ÚlinerrrÚ Ór¾z,BPF.get_kprobe_functions..z%%s/tracing/available_filter_functionscSsg|]}| ¡ ¡d‘qS)rr.r0rrrr3Ür¾rú/proc/kallsymsrr>s __init_begins __init_endrs__irqentry_text_starts__irqentry_text_ends _kbl_addr_s__perfsperf_s__SCT__s^.*\.cold(\.\d+)?$)ótów)ÚDEBUGFSrßÚsetÚIOErrorr™r÷r/r·Ú startswithÚreÚmatchÚlowerÚ fullmatchrÉ)Úevent_reZblacklist_fileZ blacklist_fZ blacklistråZavail_filter_fileZavail_filter_fZ avail_filterrîZin_init_sectionZin_irq_sectionZ avail_filer2r˜rúrrrÚget_kprobe_functionsÎsp 4  4             ÿþ.zBPF.get_kprobe_functionscCst|t ¡krtdƒ‚dS)Nz/Number of open probes would exceed global quota)rr‰Úget_probe_limitr®)r)Znum_new_probesrrrÚ_check_probe_quotaszBPF._check_probe_quotacCs(tj d¡}|r | ¡r t|ƒStSdS)NZBCC_PROBE_LIMIT)r•r¸ÚgetÚisdigitrÚ_default_probe_limit)Zenv_probe_limitrrrrAs  zBPF.get_probe_limitcCs.||jvri|j|<||j||<td7adS©Nr©rÊr)r)Úev_nameÚfn_namer£rrrÚ_add_kprobe_fd's  zBPF._add_kprobe_fdcCs|j||=td8adSrFrG)r)rHrIrrrÚ_del_kprobe_fd.s zBPF._del_kprobe_fdcCs||j|<td7adSrF©rËr)r)r1r£rrrÚ_add_uprobe_fd3s zBPF._add_uprobe_fdcCs|j|=td8adSrFrL©r)r1rrrÚ_del_uprobe_fd8szBPF._del_uprobe_fdcCs0|jD]}| d|¡dkr|Sq|jdS)Ns%sbpfr7r)Ú_syscall_prefixesÚksymname)r)ÚprefixrrrÚget_syscall_prefix@s  zBPF.get_syscall_prefixcCst|ƒ}| ¡|Sr)rrSrNrrrÚget_syscall_fnnameIszBPF.get_syscall_fnnamecCs<t|ƒ}|jD](}| |¡r| |t|ƒd…¡Sq|Sr)rrPr:rTrÜ)r)r1rRrrrÚfix_syscall_fnnamePs   zBPF.fix_syscall_fnnamec Cst|ƒ}t|ƒ}t|ƒ}|ržt |¡}| t|ƒ¡d}g}|D]6}z|j||dWq@|d7}| |¡Yq@0q@|t|ƒkrštd|d |¡fƒ‚dS| d¡|  |tj ¡} d|  dd¡  d d¡} t   | jd| ||d¡} | dkrütd||fƒ‚| | || ¡|S) Nr©ÚeventrIrzwFailed to attach BPF program %s to kprobe %s, it's not traceable (either non-existing, inlined, or marked as "notrace")ú/óp_ó+ó_ó.)rr‰r@rBrÜÚ attach_kproberÉr®rªrìrZÚreplacerÚbpf_attach_kprober£rJ) r)rWZ event_offrIr?ÚmatchesÚfailedÚprobesr2rúrHr£rrrr]Ws:   þ þzBPF.attach_kprobec Cst|ƒ}t|ƒ}t|ƒ}|r’t |¡}d}g}|D]8}z|j|||dWq2|d7}| |¡Yq20q2|t|ƒkrŽtd|d |¡fƒ‚dS| d¡|  |tj ¡} d|  dd¡  d d¡} t   | jd| |d|¡} | dkrðtd||fƒ‚| | || ¡|S) Nr)rWrIÚ maxactiverzzFailed to attach BPF program %s to kretprobe %s, it's not traceable (either non-existing, inlined, or marked as "notrace")rXór_rZr[r\)rr‰r@Úattach_kretproberÉrÜr®rªrBrìrZr^rr_r£rJ) r)rWrIr?rcr`rarbr2rúrHr£rrrreys< ÿ   þ þzBPF.attach_kretprobecCs4t|ƒ}t|j| ¡ƒ}|D]}| ||¡qdSr)rr rÊÚkeysÚdetach_kprobe_event_by_fn)r)rHZfn_namesrIrrrÚdetach_kprobe_event›szBPF.detach_kprobe_eventcCs†t|ƒ}t|ƒ}||jvr&td|ƒ‚t |j||¡}|dkrJtdƒ‚| ||¡t|j|ƒdkr‚t |¡}|dkr‚tdƒ‚dS)NzKprobe %s is not attachedrzFailed to close kprobe FDz Failed to detach BPF from kprobe)rrÊr®rÚbpf_close_perf_event_fdrKrÜZbpf_detach_kprobe)r)rHrIr5rrrrg¡s    zBPF.detach_kprobe_event_by_fncCsHt|ƒ}d| dd¡ dd¡}|r:t|ƒ}| ||¡n | |¡dS)NrYrZr[r\©rr^rgrh©r)rWrIrHrrrÚ detach_kprobe¯s zBPF.detach_kprobecCsHt|ƒ}d| dd¡ dd¡}|r:t|ƒ}| ||¡n | |¡dS)NrdrZr[r\rjrkrrrÚdetach_kretprobe¸s zBPF.detach_kretprobecCsnt|ƒ}t|tjƒstdƒ‚t ||j|¡}|dkrjt  ¡}|t j krPtdƒ‚nt   |¡}td||fƒ‚dS)zt This function attaches a BPF function to a device on the device driver level (XDP) r$rzMInternal error while attaching BPF to device, try increasing the debug level!r*N)rr r‰r¤r®rÚbpf_attach_xdpr£r%r“r™ZEBADMSGr•r–)r,rúr'r5Zerr_norùrrrÚ attach_xdpÁs    ÿzBPF.attach_xdpcCs@t|ƒ}t |d|¡}|dkrt |¡D]}|j||dq&dS| |tj¡}| d¡\}}t |j ||¡}|dkr‚t d||fƒ‚||j |<|S)a¿attach_tracepoint(tp="", tp_re="", fn_name="") Run the bpf function denoted by fn_name every time the kernel tracepoint specified by 'tp' is hit. The optional parameters pid, cpu, and group_fd can be used to filter the probe. The tracepoint specification is simply the tracepoint category and the tracepoint name, separated by a colon. For example: sched:sched_switch, syscalls:sys_enter_bind, etc. Instead of a tracepoint name, a regular expression can be provided in tp_re. The program will then attach to tracepoints that match the provided regular expression. To obtain a list of kernel tracepoints, use the tplist tool or cat the file /sys/kernel/debug/tracing/available_events. Examples: BPF(text).attach_tracepoint(tp="sched:sched_switch", fn_name="on_switch") BPF(text).attach_tracepoint(tp_re="sched:.*", fn_name="on_switch") ©r~rINó:rz0Failed to attach BPF program %s to tracepoint %s) rr‰rÚattach_tracepointrìr@r·rZbpf_attach_tracepointr£r®rÌ)r)r~rzrIrúÚ tp_categoryÚtp_namer£rrrrƒ"s ÿ zBPF.attach_tracepointcCs`t|ƒ}||jvrtd|ƒ‚t|ƒ}| |tj¡}t |j|¡}|dkrRtdƒ‚||j|<|S)a´attach_raw_tracepoint(self, tp=b"", fn_name=b"") Run the bpf function denoted by fn_name every time the kernel tracepoint specified by 'tp' is hit. The bpf function should be loaded as a RAW_TRACEPOINT type. The fn_name is the kernel tracepoint name, e.g., sched_switch, sys_enter_bind, etc. Examples: BPF(text).attach_raw_tracepoint(tp="sched_switch", fn_name="on_switch") z#Raw tracepoint %s has been attachedrz&Failed to attach BPF to raw tracepoint) rrÍr®rìr‰rhrZbpf_attach_raw_tracepointr£)r)r~rIrúr£rrrÚattach_raw_tracepointHs    zBPF.attach_raw_tracepointcCs:t|ƒ}||jvrtd|ƒ‚t |j|¡|j|=dS)zÍdetach_raw_tracepoint(tp="") Stop running the bpf function that is attached to the kernel tracepoint specified by 'tp'. Example: bpf.detach_raw_tracepoint("sched_switch") z!Raw tracepoint %s is not attachedN)rrÍr®r•Úclose)r)r~rrrÚdetach_raw_tracepoint`s   zBPF.detach_raw_tracepointcCs| |¡s||}|Sr)r:)rRr1rrrÚ add_prefixos zBPF.add_prefixcCs2t ¡dkrdSt ¡sdSt d¡dkr.dSdS)NZx86_64FZbpf_trampoline_link_progr7T)rÄrÅrÚbpf_has_kernel_btfr‰rQrrrrÚ support_kfuncus zBPF.support_kfunccCs"t ¡s dSt d¡dkrdSdS)NFs bpf_lsm_bpfr7T)rrŠr‰rQrrrrÚ support_lsms zBPF.support_lsmcCst dd¡dkS)NZbpf_attach_typeZBPF_MODIFY_RETURNr)r‰Úkernel_enum_has_valrrrrÚsupport_fmod_retŠszBPF.support_fmod_retcCsFt|ƒ}t d|¡}||jvr*td|ƒ‚t |j|¡|j|=dS)Nókfunc__z$Kernel entry func %s is not attached)rr‰r‰rÎr®r•r‡©r)rIrrrÚ detach_kfuncs    zBPF.detach_kfunccCsFt|ƒ}t d|¡}||jvr*td|ƒ‚t |j|¡|j|=dS)Nó kmod_ret__z Fmod_ret func %s is not attached)rr‰r‰rÐr®r•r‡rrrrÚdetach_fmod_ret™s    zBPF.detach_fmod_retcCsFt|ƒ}t d|¡}||jvr*td|ƒ‚t |j|¡|j|=dS)Nó kretfunc__z#Kernel exit func %s is not attached)rr‰r‰rÏr®r•r‡rrrrÚdetach_kretfunc¢s    zBPF.detach_kretfunccCsbt|ƒ}t d|¡}||jvr*td|ƒ‚| |tj¡}t |j ¡}|dkrTtdƒ‚||j|<|S)Nrz&Kernel entry func %s has been attachedrz)Failed to attach BPF to entry kernel func) rr‰r‰rÎr®rìrjrÚbpf_attach_kfuncr£©r)rIrúr£rrrÚ attach_kfunc«s     zBPF.attach_kfunccCsbt|ƒ}t d|¡}||jvr*td|ƒ‚| |tj¡}t |j ¡}|dkrTtdƒ‚||j|<|S)Nr’z"Fmod_ret func %s has been attachedrz,Failed to attach BPF to fmod_ret kernel func) rr‰r‰rÐr®rìrjrr–r£r—rrrÚattach_fmod_ret¹s     zBPF.attach_fmod_retcCsbt|ƒ}t d|¡}||jvr*td|ƒ‚| |tj¡}t |j ¡}|dkrTtdƒ‚||j|<|S)Nr”z%Kernel exit func %s has been attachedrz(Failed to attach BPF to exit kernel func) rr‰r‰rÏr®rìrjrr–r£r—rrrÚattach_kretfuncÉs     zBPF.attach_kretfunccCsFt|ƒ}t d|¡}||jvr*td|ƒ‚t |j|¡|j|=dS)Nólsm__zLSM %s is not attached)rr‰r‰rÑr®r•r‡rrrrÚ detach_lsm×s    zBPF.detach_lsmcCsbt|ƒ}t d|¡}||jvr*td|ƒ‚| |tj¡}t |j ¡}|dkrTtdƒ‚||j|<|S)Nr›zLSM %s has been attachedrzFailed to attach LSM) rr‰r‰rÑr®rìrkrZbpf_attach_lsmr£r—rrrÚ attach_lsmàs     zBPF.attach_lsmcCs$t d¡dkst d¡dkr dSdS)NZbpf_find_raw_tracepointr7Zbpf_get_raw_tracepointTF)r‰rQrrrrÚsupport_raw_tracepointîs  ÿzBPF.support_raw_tracepointcCszd}t|ƒZ}|D]B}| ¡ dd¡\}}}| d¡d}|dkrWdƒdSqWdƒdS1sl0YdS) Nr4ú rú rZbpf_trace_modulesTF)rßr/r·)ZkallsymsZsymsr2Ú_r1rrrÚ support_raw_tracepoint_in_moduleös z$BPF.support_raw_tracepoint_in_modulecCst|ƒ}t|ƒ}t ||¡Sr)rrÚkernel_struct_has_field)Z struct_nameÚ field_namerrrr£szBPF.kernel_struct_has_fieldcCst|ƒ}t|ƒ}t ||¡Sr)rrr)Z enum_nameZ value_namerrrrszBPF.kernel_enum_has_valcCstt|ƒ}||jvrtd|ƒ‚t |j|¡}|dkr>tdƒ‚| d¡\}}t ||¡}|dkrhtdƒ‚|j|=dS)zÉdetach_tracepoint(tp="") Stop running a bpf function that is attached to the kernel tracepoint specified by 'tp'. Example: bpf.detach_tracepoint("sched:sched_switch") zTracepoint %s is not attachedrz$Failed to detach BPF from tracepointr‚N)rrÌr®rrir·Zbpf_detach_tracepoint)r)r~r5r„r…rrrÚdetach_tracepoints    zBPF.detach_tracepointc Cs,t ||||||||¡} | dkr(tdƒ‚| S)Nrz"Failed to attach BPF to perf event)rZbpf_attach_perf_eventr®) r)ÚprogfdÚev_typeÚ ev_configÚ sample_periodÚ sample_freqr*ÚcpuÚgroup_fdr5rrrÚ_attach_perf_event#s   ÿzBPF._attach_perf_eventc Cs~t|ƒ}| |tj¡} i} |dkrB| | j|||||||¡| |<n*tƒD]"} | | j|||||| |¡| | <qH| |j||f<dS©Nr)rrìr‰r^r­r£rrÓ) r)r§r¨rIr©rªr*r«r¬rúr5rærrrÚattach_perf_event+s  ÿ    ÿ zBPF.attach_perf_eventcCs.t |t |¡|||d¡}|dkr*tdƒ‚|S)Nrz&Failed to attach BPF to perf raw event)rZbpf_attach_perf_event_rawr%r,r®)r)r¦Úattrr*r«r¬r5rrrÚ_attach_perf_event_raw9s ÿzBPF._attach_perf_event_rawc Csvt|ƒ}| |tj¡}i}|dkr<| |j||||¡||<n$tƒD]}| |j||||¡||<qB||j|j|j f<dSr®) rrìr‰r^r±r£rrÓrZconfig) r)r°rIr*r«r¬rúr5rærrrÚattach_perf_event_raw@s ÿ   ÿ zBPF.attach_perf_event_rawcCsvz|j||f}Wn"ty4td ||¡ƒ‚Yn0d}| ¡D]}t |¡pR|}qB|dkrftdƒ‚|j||f=dS)Nz)Perf event type {} config {} not attachedrz$Failed to detach BPF from perf event)rÓrr®r%Úvaluesrri)r)r§r¨Zfdsr5r£rrrÚdetach_perf_eventMs ÿ  zBPF.detach_perf_eventcCstdd„t ||¡DƒƒS)NcSsg|] \}}|‘qSrr)r1r1r¡rrrr3]r¾z*BPF.get_user_functions..©r8r‰Ú get_user_functions_and_addresses©r1Úsym_rerrrÚget_user_functions[s ÿzBPF.get_user_functionscCstdd„t ||¡DƒƒS)aÏ We are returning addresses here instead of symbol names because it turns out that the same name may appear multiple times with different addresses, and the same address may appear multiple times with the same name. We can't attach a uprobe to the same address more than once, so it makes sense to return the unique set of addresses that are mapped to a symbol that matches the provided regular expression. cSsg|] \}}|‘qSrr)r1r¡Úaddressrrrr3jr¾z*BPF.get_user_addresses..rµr·rrrÚget_user_addresses`s  ÿzBPF.get_user_addressescsNt|ƒ}tˆƒ‰g‰‡‡fdd„}t |t|ƒ¡}|dkrJtd||fƒ‚ˆS)Ncs"|}t ˆ|¡rˆ ||f¡dSr®)r;r<rÉ)Zsym_namer2Zdname©Ú addressesr¸rrÚsym_cbrs z4BPF.get_user_functions_and_addresses..sym_cbrz"Error %d enumerating symbols in %s)rrZbcc_foreach_function_symbolrr®)r1r¸r¾r5rr¼rr¶msz$BPF.get_user_functions_and_addressescCsN|dkr(d||j dtj |¡¡|fSd||j dtj |¡¡||fSdS)Nr7s %s_%s_0x%xr[s %s_%s_0x%x_%d)Ú _probe_replÚsubr•r¦Úbasename)r)rRr¦r2r*rrrÚ_get_uprobe_evname}s zBPF._get_uprobe_evnamecCsö|dks J‚|dur$|dks$Jdƒ‚t|ƒ}t|ƒ}t|ƒ}t|ƒ}|r‚t ||¡}| t|ƒ¡|D]} |j|| ||dqfdSt |||||¡\} }| d¡| |tj¡} |  d| ||¡} t   | j d| | ||¡} | dkræt dƒ‚| | | ¡|S)aûattach_uprobe(name="", sym="", sym_re="", addr=None, fn_name="" pid=-1, sym_off=0) Run the bpf function denoted by fn_name every time the symbol sym in the library or binary 'name' is encountered. Optional parameters pid, cpu, and group_fd can be used to filter the probe. If sym_off is given, attach uprobe to offset within the symbol. The real address addr may be supplied in place of sym, in which case sym must be set to its default value. If the file is a non-PIE executable, addr must be a virtual address, otherwise it must be an offset relative to the file load address. Instead of a symbol name, a regular expression can be provided in sym_re. The uprobe will then attach to symbols that match the provided regular expression. Libraries can be given in the name argument without the lib prefix, or with the full path (/usr/lib/...). Binaries can be given only with the full path (/bin/sh). If a PID is given, the uprobe will attach to the version of the library used by the process. Example: BPF(text).attach_uprobe("c", "malloc") BPF(text).attach_uprobe("/usr/bin/python", "main") rNz!offset with addr is not supported©r1r2rIr*rópzFailed to attach BPF to uprobe)rr‰r»rBrÜÚ attach_uprobertrìrZrÂrÚbpf_attach_uprober£r®rM)r)r1r4r¸r2rIr*rrr½Úsym_addrr¦rúrHr£rrrrÅ…s0  ÿ  zBPF.attach_uprobec Cs¾t|ƒ}t|ƒ}t|ƒ}t|ƒ}|rLt ||¡D]}|j||||dq0dSt ||||¡\}}| d¡| |tj¡} | d|||¡} t   | j d| |||¡} | dkr®t dƒ‚|  | | ¡|S)a6attach_uretprobe(name="", sym="", sym_re="", addr=None, fn_name="" pid=-1) Run the bpf function denoted by fn_name every time the symbol sym in the library or binary 'name' finishes execution. See attach_uprobe for meaning of additional parameters. rÃNrórrz!Failed to attach BPF to uretprobe)rr‰r»Úattach_uretprobertrBrìrZrÂrrÆr£r®rM) r)r1r4r¸r2rIr*rÇr¦rúrHr£rrrrɾs& ÿ  zBPF.attach_uretprobecCs^||jvrtd|ƒ‚t |j|¡}|dkr6tdƒ‚t |¡}|dkrPtdƒ‚| |¡dS)NzUprobe %s is not attachedrz Failed to detach BPF from uprobe)rËr®rriZbpf_detach_uproberO)r)rHr5rrrÚdetach_uprobe_eventÞs   zBPF.detach_uprobe_eventcCsDt|ƒ}t|ƒ}t |||||¡\}}| d|||¡}| |¡dS)z¥detach_uprobe(name="", sym="", addr=None, pid=-1) Stop running a bpf function that is attached to symbol 'sym' in library or binary 'name'. rÄN©rr‰rtrÂrÊ)r)r1r4r2r*rrr¦rHrrrÚ detach_uprobeés zBPF.detach_uprobecCsBt|ƒ}t|ƒ}t ||||¡\}}| d|||¡}| |¡dS)z¨detach_uretprobe(name="", sym="", addr=None, pid=-1) Stop running a bpf function that is attached to symbol 'sym' in library or binary 'name'. rÈNrË)r)r1r4r2r*r¦rHrrrÚdetach_uretprobeös zBPF.detach_uretprobecCshtdt |j¡ƒD]N}t |j|¡}| d¡r^| |tj¡}|j |  |dd…¡|j dq| d¡r–| |tj¡}|j |  |dd…¡|j dq| d¡rÚ| |tj ¡}|j tdƒd… dd ¡}|j||j d q| d ¡r| |tj¡}|j td ƒd…}|j||j d q| d ¡r2|j|d q| d¡rL|j|d q| d¡r|j|d qdS)Nrskprobe__r!rVs kretprobe__rOs tracepoint__s__r‚rsraw_tracepoint__r)rIr”r›)rérrêr-rër:rìr‰rZr]rUr1rer@rÜr^rƒrhr†r˜ršr)r)rærïrúr~rrrrâs8 þ þ     zBPF._trace_autoloadcCsN|jsHtdtdƒ|_|rH|j ¡}t |tj¡}t |tj|tjB¡|jS)zWtrace_open(nonblocking=False) Open the trace_pipe if not already open z %s/trace_piperÂ) rÕrßrwÚfilenoÚfcntlZF_GETFLZF_SETFLr•Ú O_NONBLOCK)r)Ú nonblockingr£ZflrrrÚ trace_open s zBPF.trace_openc Cs| |¡}|s|rdS| d¡r"q|dd… ¡}|dd…}| d¡}z|d|… ¡\}}}}Wn0ty”} zWYd} ~ qWYd} ~ n d} ~ 00|dd…}||dd…}| d¡} || d d…} z|t|ƒt|ƒ|t|ƒ| fWSty} zWYd} ~ d Sd} ~ 00qdS) zßtrace_fields(nonblocking=False) Read from the kernel debug trace pipe and return a tuple of the fields (task, pid, cpu, flags, timestamp, msg) or None if no line was read (nonblocking=True) )NNNNNNsCPU:Nr"rTr‚rr7r)ÚUnknownrrrÓgrÓ)Útrace_readliner:ÚlstripÚfindr·r®rr) r)rÑr2ZtaskZts_endr*r«r'ÚtsråZsym_endÚmsgrrrÚ trace_fields-s$     "  zBPF.trace_fieldscCs8| |¡}d}z| d¡ ¡}Wnty2Yn0|S)z·trace_readline(nonblocking=False) Read from the kernel debug trace pipe and return one line If nonblocking is False, this will block until ctrl-C is pressed. NrL)rÒÚreadliner/r9)r)rÑZtracer2rrrrÔPs  zBPF.trace_readlinecCsF|r"|jdd}|sq|j|Ž}n |jdd}t|ƒtj ¡qdS)atrace_print(self, fmt=None) Read from the kernel debug trace pipe and print on stdout. If fmt is specified, apply as a format string to the output. See trace_fields for the members of the tuple example: trace_print(fmt="pid {1}, msg = {5}") F)rÑN)rÙr%rÔÚprintr¨ÚstdoutÚflush)r)Úfmtrr2rrrÚ trace_print`s    zBPF.trace_printcCs6|dkr|dkrd}|tjvr,t|ƒtj|<tj|S)z _sym_cache(pid) Returns a symbol cache for the specified PID. The kernel symbol cache is accessed by providing any PID less than zero. rr7)r‰Ú _sym_cachesr$)r*rrrÚ _sym_cachess  zBPF._sym_cachec Cs4tt|ƒƒ}| d¡dkrÈtƒ}tƒ}|j|_|j|_|j|j_t   t j t  |¡t  |¡¡}|dkr¤|jr’|jr’d|jt  |jt j¡j} } } qÆd|d} } } qà|j|jt  |jt j¡j} } } nt  |¡ ||¡\} } } |rô| durôd| nd} | pþd} | | } |r(| dur(dtj | ¡nd} | | S) aysym(addr, pid, show_module=False, show_offset=False) Translate a memory address into a function name for a pid, which is returned. When show_module is True, the module name is also included. When show_offset is True, the instruction offset as a hexadecimal number is also included in the string. A pid of less than zero will access the kernel symbol cache. Example output when both show_module and show_offset are True: "start_thread+0x202 [libpthread-2.24.so]" Example output when both show_module and show_offset are False: "start_thread" Zbpf_stack_build_idr7rNs+0x%xr¾s [unknown]s [%s])rrrÖrrÚstatusZbuild_idr.ÚurZbcc_buildsymcache_resolver‰Ú _bsymcacher%r,r-r&r/r0r1rár6r•r¦rÁ) r2r*Ú show_moduleÚ show_offsetr3Z typeofaddrr4Úbr5r1r.r-rrrr4€s>  þ ÿ ÿ ÿÿÿzBPF.symcCst |d||d¡S)a¦ksym(addr) Translate a kernel memory address into a kernel function name, which is returned. When show_module is True, the module name ("kernel") is also included. When show_offset is true, the instruction offset as a hexadecimal number is also included in the string. Example output when both show_module and show_offset are True: "default_idle+0x0 [kernel]" r7F)r‰r4)r2rårærrrÚksym±s zBPF.ksymcCst d¡ d|¡S)z“ksymname(name) Translate a kernel name into an address. This is the reverse of ksym. Returns -1 when the function name is unknown.r7N)r‰rár9)r1rrrrQ¿sz BPF.ksymnamecCs t|jƒS)zªnum_open_kprobes() Get the number of open K[ret]probes. Can be useful for scenarios where event_re is used while attaching and detaching probes. )rÜrÊr rrrÚnum_open_kprobesÇszBPF.num_open_kprobescCs t|jƒS)zInum_open_uprobes() Get the number of open U[ret]probes. )rÜrËr rrrÚnum_open_uprobesÏszBPF.num_open_uprobescCs t|jƒS)zLnum_open_tracepoints() Get the number of open tracepoints. )rÜrÌr rrrÚnum_open_tracepointsÖszBPF.num_open_tracepointscCsHtjt|jƒƒ}t|j ¡ƒD]\}}|||<q t t|ƒ||¡dS)z«perf_buffer_poll(self) Poll from all open perf ring buffers, calling the callback that was provided when calling open_perf_buffer for each entry. N)r%rárÜrÒrÝr³rZperf_reader_poll)r)ÚtimeoutÚreadersræÚvrrrÚperf_buffer_pollÝs zBPF.perf_buffer_pollcCsFtjt|jƒƒ}t|j ¡ƒD]\}}|||<q t t|ƒ|¡dS)zóperf_buffer_consume(self) Consume all open perf buffers, regardless of whether or not they currently contain events data. Necessary to catch 'remainder' events when wakeup_events > 1 is set in open_perf_buffer N)r%rárÜrÒrÝr³rZperf_reader_consume)r)rírærîrrrÚperf_buffer_consumeès zBPF.perf_buffer_consumecCs| |¡dS)zMkprobe_poll(self) Deprecated. Use perf_buffer_poll instead. N)rï©r)rìrrrÚ kprobe_pollôszBPF.kprobe_pollcCsL|js&t |||¡|_|jsHtdƒ‚n"t |j|||¡}|dkrHtdƒ‚dS)NzCould not open ring bufferr)rÔrZbpf_new_ringbufr®Zbpf_add_ringbuf)r)rrúÚctxÚretrrrÚ_open_ring_bufferûs zBPF._open_ring_buffercCs |jstdƒ‚t |j|¡dS)z©ring_buffer_poll(self) Poll from all open ringbuf buffers, calling the callback that was provided when calling open_ring_buffer for each entry. úNo ring buffers to pollN)rÔr®rZbpf_poll_ringbufrñrrrÚring_buffer_pollszBPF.ring_buffer_pollcCs|jstdƒ‚t |j¡dS)a/ring_buffer_consume(self) Consume all open ringbuf buffers, regardless of whether or not they currently contain events data. This is best for use cases where low latency is desired, but it can impact performance. If you are unsure, use ring_buffer_poll instead. röN)rÔr®rZbpf_consume_ringbufr rrrÚring_buffer_consumeszBPF.ring_buffer_consumecCst ¡Sr)rZbcc_free_memoryr rrrÚfree_bcc_memoryszBPF.free_bcc_memoryc CsPzt tj| ¡¡Wn4tyJ}ztdt|ƒƒWYd}~n d}~00dS)zJadd_module(modname) Add a library or exe to buildsym cache z&Error adding module to build sym cacheN)rZbcc_buildsymcache_add_moduler‰rär»r®rÛr)ÚmodnamerårrrÚ add_moduleszBPF.add_modulecCsdS)zthe do nothing exit handlerNrr rrrrö)sz BPF.donothingcCsHt|j ¡ƒD]\}}t |j¡|j|=q|jrDt |j¡d|_dS)zvclose(self) Closes all associated files descriptors. Attached BPF programs are not detached. N) r rÚrr•r‡r£r-rZbpf_module_destroy)r)r1rúrrrr‡-s    z BPF.closecCs¨t|j ¡ƒD]\}}| |¡qt|j ¡ƒD]\}}| |¡q0t|j ¡ƒD]\}}| |¡qRt|j ¡ƒD]\}}|  |¡qtt|j  ¡ƒD]\}}|  |¡q–t|j  ¡ƒD]\}}|  |¡q¸t|j ¡ƒD]\}}| |¡qÚt|j ¡ƒD]\}}| |¡qüt|j ¡ƒ}|D] }t|j|tƒr"|j|=q"t|j ¡ƒD]\}}| ||¡qR|jr‚|j ¡d|_| ¡|jr¤t |j¡d|_dSr)r rÊrrhrËrÊrÌr¥rÍrˆrÎr‘rÏr•rÑrœrÐr“rÛrfr r rÓr´rÕr‡rÔrZbpf_free_ringbuf)r)ÚkrîZ table_keysrr§r¨rrrrØ:s:           z BPF.cleanupcCs|Srrr rrrÚ __enter___sz BPF.__enter__cCs | ¡dSr)rØ)r)Úexc_typeZexc_valZexc_tbrrrÚ__exit__bsz BPF.__exit__)Nr7)F)NNN)r)r¾rr¾r¾)r¾r¾r¾r)N)N)r)r)r)r)r¾r¾r¾)r¾r¾)r¾)r¾)r¾)r¾)r¾)r¾)r¾)r¾)r¾)r¾)r7r7r¾rrr7r7r7)r7r¾r7r7r7)r7r7)r¾r¾r¾Nr¾r7r)r¾r¾r¾Nr¾r7)r¾r¾Nr7r)r¾r¾Nr7)F)F)F)N)FFT)FF)r7)r7)N)r7)¸r:r;r<rNrYrZr[r\r@r]r^r_r`rarbrcrdrerfrgrhrirjrkr}r~rr€rr‚rƒr„ZXDP_FLAGS_UPDATE_IF_NOEXISTr…ZXDP_FLAGS_SKB_MODEr†ZXDP_FLAGS_DRV_MODEr‡ZXDP_FLAGS_HW_MODErˆZXDP_FLAGS_REPLACEr;Úcompiler¿ràrZbcc_buildsymcache_newrärœrPr’r%rrZCDLLZ_librtÚ clock_gettimer‘Zc_intr'ÚargtypesÚ classmethodršr¡r Úobjectr¤Ú staticmethodr°r½r+rðrìrýrþrZc_boolZc_charZc_wcharZc_ubyteZc_shortZc_ushortZc_uintrŽZc_ulongZ c_longlongr8Zc_floatZc_doubleZ c_longdoubleZc_int64Zc_uint64r r rrrr!r"r#r(r)r-r@rBrArJrKrMrOrSrTrUr]rerhrgrlrmrorprtrurr€rƒr†rˆr‰r‹rŒrŽr‘r“r•r˜r™ršrœrržr¢r£rr¥r­r¯r±r²r´r¹r»r¶rÂrÅrÉrÊrÌrÍrârÒrÙrÔrßrár4rèrQrérêrërïrðròrõr÷rørùrûrör‡rØrýrÿrrrrr‰sž û    þ j   ï +     K   " "        &               ÿ     ÿ 9ÿ   #   0        %r‰)EZ __future__rrÖZctypesr%rÏrr•r;r™r¨rÄrÆZlibbccrrrrrÚtabler r r r r ZperfrZutilsrrrrrÚversionrZ disassemblerrrrèrrr Ú NameErrorrrErrr7r¦rªrwrÈZ DEBUG_LLVM_IRrôZDEBUG_PREPROCESSORZ DEBUG_SOURCEróZ DEBUG_BTFrr$r=rBrFrHrNrlr}rƒr‰rrrrÚsX    +  *