???<!-- GIF89;a -->
123123123123
.....................................................................................................................................???<!-- GIF89;a -->
123123123123
.....................................................................................................................................3
:)gh                @   s  d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl	Z	d dl
Z
d dlZddlmZmZmZmZmZ ddlmZmZmZmZmZ ddlmZ ddlmZmZmZmZmZ ddl m!Z! dd	l"m#Z#m$Z$ dd
l%m&Z&m'Z' ye( W n e)k
r   e*Z(Y nX dZ+d a,dd Z-dZ.dZ/dZ0dZ1dZ2dZ3dZ4G dd de5Z6G dd dZ7G dd dZ8G dd dZ9G dd dZ:G dd dZ;G d d! d!Z<G d"d# d#Z=G d$d% d%Z>G d&d' d'e5Z?dS )(    )print_functionN   )lib
bcc_symbolbcc_symbol_optionbcc_stacktrace_build_id_SYM_CB_TYPE)TablePerfEventArrayRingBufBPF_MAP_TYPE_QUEUEBPF_MAP_TYPE_STACK)Perf)get_online_cpusprintb_assert_is_bytes	ArgStringStrcmpRewrite)__version__)disassemble_prog
decode_map)USDTUSDTExceptioni  c               C   s   t S )N)_num_open_probes r   r   /usr/lib/python3.6/__init__.py_get_num_open_probes+   s    r   z/sys/kernel/debug/tracing                c               @   s$   e Zd Zdd Zdd Zdd ZdS )SymbolCachec             C   s    t j|tjd tjt| _d S )N)r   Zbcc_symcache_newctcastPOINTERr   cache)selfpidr   r   r   __init__A   s    zSymbolCache.__init__c             C   s   t  }|r"tj| j|tj|}ntj| j|tj|}|dk rp|jrf|jrfd|jtj	|jtj
jfS d|dfS |r|j}tjtj| n|j}||jtj	|jtj
jfS )a  
        Return a tuple of the symbol (function), its offset from the beginning
        of the function, and the module in which it lies. For example:
            ("start_thread", 0x202, "/usr/lib/.../libpthread-2.24.so")
        If the symbol cannot be found but we know which module it is in,
        return the module name and the offset from the beginning of the
        module. If we don't even know the module, return the absolute
        address as the offset.
        r   N)r   r   Zbcc_symcache_resolver&   r#   byrefZ bcc_symcache_resolve_no_demanglemoduleoffsetr$   c_char_pvalueZdemangle_nameZbcc_symbol_free_demangle_namename)r'   addrdemanglesymresZname_resr   r   r   resolveE   s    

zSymbolCache.resolvec             C   s>   t |}t |}tj }tj| j||tj|dk r8dS |jS )Nr   r   )r   r#   c_ulonglongr   Zbcc_symcache_resolve_namer&   r*   r.   )r'   r+   r/   r0   r   r   r   resolve_nameb   s    zSymbolCache.resolve_nameN)__name__
__module____qualname__r)   r4   r7   r   r   r   r   r"   @   s   r"   c               @   s$   e Zd ZdZdZdZdZdZdZdS )PerfTyper   r   r      r      N)	r8   r9   r:   ZHARDWAREZSOFTWARE
TRACEPOINTZHW_CACHERAWZ
BREAKPOINTr   r   r   r   r;   k   s   r;   c               @   s4   e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdS )PerfHWConfigr   r   r   r<   r   r=         r   	   N)r8   r9   r:   Z
CPU_CYCLESZINSTRUCTIONSZCACHE_REFERENCESZCACHE_MISSESZBRANCH_INSTRUCTIONSZBRANCH_MISSESZ
BUS_CYCLESZSTALLED_CYCLES_FRONTENDZSTALLED_CYCLES_BACKENDZREF_CPU_CYCLESr   r   r   r   r@   t   s   r@   c               @   s8   e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdS )PerfSWConfigr   r   r   r<   r   r=   rA   rB   r   rC   
   N)r8   r9   r:   Z	CPU_CLOCKZ
TASK_CLOCKZPAGE_FAULTSZCONTEXT_SWITCHESZCPU_MIGRATIONSZPAGE_FAULTS_MINZPAGE_FAULTS_MAJZALIGNMENT_FAULTSZEMULATION_FAULTSZDUMMYZ
BPF_OUTPUTr   r   r   r   rD      s   rD   c               @   sp   e Zd ZdZdZdZdZdZd Zd!Z	d"Z
d#Zd$Zd%Zd&Zd'Zd(Zd)Zd*Zd+Zd,Zd-Zd.Zd/Zd0Zd1Zd2Zd3ZdS )4PerfEventSampleFormatr   r   r   r<   r   r=   rA   rB   r   rC   rE                  r                            Nr   r   r   r   r    r!   @         i   i   i   i   i    i @  i   i   i   i   i   i   i    i  @ i   i   )r8   r9   r:   ZIPZTIDZTIMEZADDRZREADZ	CALLCHAINZIDZCPUZPERIODZ	STREAM_IDr?   ZBRANCH_STACKZ	REGS_USERZ
STACK_USERZWEIGHTZDATA_SRCZ
IDENTIFIERZTRANSACTIONZ	REGS_INTRZ	PHYS_ADDRZAUXZCGROUPZDATA_PAGE_SIZEZCODE_PAGE_SIZEZWEIGHT_STRUCTr   r   r   r   rF      s2   rF   c               @   s`   e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdZdZdZdZdZdZdZdZdZdS )BPFProgTyper   r   r<   r   r=   rA   rB   r   rC   rE   rG   rH   rI   rJ   rK   r    rL   rM            N)r8   r9   r:   SOCKET_FILTERKPROBE	SCHED_CLS	SCHED_ACTr>   XDP
PERF_EVENT
CGROUP_SKBCGROUP_SOCKLWT_INLWT_OUTLWT_XMITSOCK_OPSSK_SKBCGROUP_DEVICESK_MSGRAW_TRACEPOINTCGROUP_SOCK_ADDRZCGROUP_SOCKOPTTRACINGLSMr   r   r   r   rW      s*   rW   c               @   s   e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ!d Z"d!Z#d"Z$d#Z%d$Z&d%Z'd&Z(d'Z)d(S ))BPFAttachTyper   r   r   r<   r   r=   rA   rB   r   rC   rE   rG   rH   rI   rJ   rK   r    rL   rM   rN   rO   rP   rQ   rR   rS   rX   rY         rZ         r!   !   "   #   $   %   &   N)*r8   r9   r:   ZCGROUP_INET_INGRESSZCGROUP_INET_EGRESSZCGROUP_INET_SOCK_CREATEZCGROUP_SOCK_OPSZSK_SKB_STREAM_PARSERZSK_SKB_STREAM_VERDICTrh   ZSK_MSG_VERDICTZCGROUP_INET4_BINDZCGROUP_INET6_BINDZCGROUP_INET4_CONNECTZCGROUP_INET6_CONNECTZCGROUP_INET4_POST_BINDZCGROUP_INET6_POST_BINDZCGROUP_UDP4_SENDMSGZCGROUP_UDP6_SENDMSGZ
LIRC_MODE2ZFLOW_DISSECTORZCGROUP_SYSCTLZCGROUP_UDP4_RECVMSGZCGROUP_UDP6_RECVMSGZCGROUP_GETSOCKOPTZCGROUP_SETSOCKOPTZTRACE_RAW_TPZTRACE_FENTRYZTRACE_FEXITZMODIFY_RETURNZLSM_MACZ
TRACE_ITERZCGROUP_INET4_GETPEERNAMEZCGROUP_INET6_GETPEERNAMEZCGROUP_INET4_GETSOCKNAMEZCGROUP_INET6_GETSOCKNAMEZ
XDP_DEVMAPZCGROUP_INET_SOCK_RELEASEZ
XDP_CPUMAPZ	SK_LOOKUPr_   ZSK_SKB_VERDICTr   r   r   r   rn      sN   rn   c               @   s    e Zd ZdZdZdZdZdZdS )	XDPActionr   r   r   r<   r   N)r8   r9   r:   XDP_ABORTEDXDP_DROPXDP_PASSXDP_TXXDP_REDIRECTr   r   r   r   ry      s
   ry   c               @   s    e Zd ZdZdZd	Zd
ZdZdS )XDPFlagsr   r   r   r<   r   Nr   r   r   r   r    )r8   r9   r:   UPDATE_IF_NOEXISTSKB_MODEDRV_MODEHW_MODEREPLACEr   r   r   r   r      s
   r   c               @   s  e Zd ZejZejZejZejZejZej	Z	ej
Z
ejZejZejZejZejZejZejZejZejZejZejZejZejZejZejZejZejZejZejZ ej!Z"ej#Z$ej%Z&ej'Z(e)j*dZ+i Z,e-j. Z/dgddgddgdgdd	gd
Z0dddddddgZ1dZ2G dd de3j4Z5e3j6dddZ7e7j8Z9e3j:e3j;e5ge9_<e=dd Z>e=dd Z?e@Z@G dd deAZBeCdd ZDeCd d! ZEd"d"d#d$g g dd#d%f	d&d'ZFefd(d)ZGdd*d+ZHd,d- ZId.d/ ZJdd0d1ZKe3jLe3jMe3jNe3jOe3jPe3jQe3j:e3jRe3jSe3jTe3jUe3jVe3jWe3jXe3jYe3jZd2 e3j[d2 d3Z\eCd4d5 Z]dd6d7Z^d8d9 Z_d:d; Z`d<d= Zad>d? Zbd@dA ZceCddBdCZdeCdDdE ZeeCdFdG ZfeCdHdI ZgdJdK ZheCdLdM ZidNdO ZjdPdQ ZkdRdS ZldTdU ZmdVdW ZndXdY ZodZd[ Zpdd\d]Zqdd^d_Zrd`da Zsdbdc ZtddddeZuddfdgZveCddhdiZweCddjdkZxe=ddldmZyeCdndo ZzeCdpdq Z{eCdrds Z|ddtduZ}ddvdwZ~ddxdyZeCdzd{ ZeCd|d} ZeCd~d ZdddZdddZdddZdddZdddZdddZeCdd ZeCdd ZeCdd ZdddZdd ZdddZdd ZdddZdddZeCdd ZeCdd ZeCdd Zdd ZdddZd	ddZdd ZdddZdddZdd ZdddZdddZdddZdddZeCdd ZeCdddZeCdddZeCdd ZddÄ Zddń ZddǄ ZdddɄZdd˄ Zddd̈́ZdddτZdddфZddӄ ZddՄ ZeCddׄ Zddل Zddۄ Zdd݄ Zdd߄ Zdd Zd#S (  BPFs   [^a-zA-Z0-9_]ZtimeZfsfileZbioZrequestZallocZsk_buffZ
net_device)zlinux/time.hz
linux/fs.hzlinux/blkdev.hzlinux/slab.hzlinux/netdevice.hs   sys_s
   __x64_sys_s   __x32_compat_sys_s   __ia32_compat_sys_s   __arm64_sys_s   __s390x_sys_s   __s390_sys_r   c               @   s    e Zd ZdejfdejfgZdS )zBPF.timespectv_sectv_nsecN)r8   r9   r:   r#   c_long_fields_r   r   r   r   timespec@  s   r   z
librt.so.1T)Z	use_errnoc             C   sH   | j  }| j| jtj|dkr8tj }t|tj||j	d |j
 S )zmonotonic_time()
        Returns the system monotonic time from clock_gettime, using the
        CLOCK_MONOTONIC constant. The time returned is in nanoseconds.
        r   g    eA)r   _clock_gettimeCLOCK_MONOTONICr#   r*   	get_errnoOSErrorosstrerrorr   r   )clsterrnor   r   r   monotonic_timeG  s
    zBPF.monotonic_timec             C   sX   d}xN| j j D ]@\}}x6|D ].}x(|D ] }||kr(||kr(|d| 7 }q(W qW qW |S )a1  
        Generates #include statements automatically based on a set of
        recognized types such as sk_buff and bio. The input is all the words
        that appear in the BPF program, and the output is a (possibly empty)
        string of #include statements, such as "#include <linux/fs.h>".
         z#include <%s>
)_auto_includesitems)r   Zprogram_wordsZheadersheaderkeywordskeywordZwordr   r   r   generate_auto_includesS  s    

zBPF.generate_auto_includesc               @   s   e Zd Zdd ZdS )zBPF.Functionc             C   s   || _ || _|| _d S )N)bpfr/   fd)r'   r   r/   r   r   r   r   r)   g  s    zBPF.Function.__init__N)r8   r9   r:   r)   r   r   r   r   Functionf  s   r   c             C   sb   | r^t jj| s^ttjd }djt jjt jj|j	 | g}t jj|rR|} nt
d|  | S )z1 If filename is invalid, search in ./ of argv[0] r      /zCould not find file %s)r   pathisfiler   sysargvjoinabspathdirname	__bytes__	Exception)filenameZargv0r   r   r   r   
_find_filel  s    "zBPF._find_filec             C   sr   dd }t jj| \}}|r*|| rn| S nDxBt jd jt jD ],}|jd}t jj|j | }||r>|S q>W dS )a  
        find_exe(bin_path)

        Traverses the PATH environment variable, looking for the first
        directory that contains an executable file named bin_path, and
        returns the full path to that file, or None if no such file
        can be found. This is meant to replace invocations of the
        "which" shell utility, which doesn't have portable semantics
        for skipping aliases.
        c             S   s   t jj| ot j| t jS )N)r   r   r   accessX_OK)fpathr   r   r   is_exe  s    zBPF.find_exe.<locals>.is_exePATH"N)r   r   splitenvironpathsepstripr   encode)Zbin_pathr   r   Zfnamer   Zexe_filer   r   r   find_exey  s    
zBPF.find_exe    Nr   Fc
             C   s  t |}t |}t |}|o| s&ti | _i | _i | _i | _i | _i | _i | _i | _	i | _
d| _d| _tj| j || _i | _i | _d| _tjt|  }
x$t|D ]\}}tt||
|< qW |rtj|}tj|}|rt|dd}|j }W dQ R X tjt|  }x(t|D ]\}}tj|j ||< qW t j!|t|}|dkrZt"d|| }t j#|| j|
t|
||| _| jst"d|pd	 x|D ]}|j$| |	 qW | j%  dS )aZ  Create a new BPF module with the given source code.

        Note:
            All fields are marked as optional, but either `src_file` or `text`
            must be supplied, and not both.

        Args:
            src_file (Optional[str]): Path to a source file for the module
            hdr_file (Optional[str]): Path to a helper header file for the `src_file`
            text (Optional[str]): Contents of a source file for the module
            debug (Optional[int]): Flags used for debug prints, can be |'d together
                                   See "Debug flags" for explanation
        Nrb)modez%can't generate USDT probe arguments; z%possible cause is missing pid when a z&probe in a shared object has multiple Z	locationszFailed to compile BPF module %sz<text>zJcan't generate USDT probe arguments; possible cause is missing pid when a zpcan't generate USDT probe arguments; possible cause is missing pid when a probe in a shared object has multiple zycan't generate USDT probe arguments; possible cause is missing pid when a probe in a shared object has multiple locations)&r   AssertionError
kprobe_fds
uprobe_fdstracepoint_fdsraw_tracepoint_fdskfunc_entry_fdskfunc_exit_fdslsm_fdsperf_buffersopen_perf_events_ringbuf_manager	tracefileatexitregistercleanupdebugfuncstablesr+   r#   r-   len	enumeratebytesr   r   r   openreadc_void_pZget_contextr   Zbcc_usdt_genargsr   Zbpf_module_create_c_from_stringZattach_uprobes_trace_autoload)r'   Zsrc_fileZhdr_filetextr   ZcflagsZusdt_contextsZallow_rlimitdeviceZattach_usdt_ignore_pidZcflags_arrayisr   Z	ctx_arrayusdtZ	usdt_textZusdt_contextr   r   r   r)     s^     


 

zBPF.__init__c             C   sD   g }x:t dtj| jD ]$}tj| j|}|j| j|| qW |S )zload_funcs(prog_type=KPROBE)

        Load all functions in this BPF module with the given type.
        Returns a list of the function handles.r   )ranger   bpf_num_functionsr+   bpf_function_nameappend	load_func)r'   	prog_typefnsr   	func_namer   r   r   
load_funcs  s
    zBPF.load_funcsc       	      C   s  t |}|| jkr| j| S tj| j|s6td| d}| jt@ rJd}n| jt@ rXd}tj	| j||tj| j|tj
| j|tj| jtj| j|d d||}|dk rtj| j tj tjkrtdtjtj }td||f tj| ||}|| j|< |S )NzUnknown program %sr   r   r   z!Need super-user privileges to runz!Failed to load BPF program %s: %s)r   r   r   bpf_function_startr+   r   r   DEBUG_BPF_REGISTER_STATE	DEBUG_BPFZbcc_func_loadbpf_function_sizeZbpf_module_licenseZbpf_module_kern_versionr   r   	donothingr#   r   r   EPERMr   r   r   r   )	r'   r   r   r   attach_typeZ	log_levelr   errstrfnr   r   r   r     s4    






zBPF.load_funcc             C   sJ   t |}tj| j|s"td| tj| j|}tj| j|}tj||S )zR
        Return the eBPF bytecodes for the specified function as a string
        zUnknown program %s)r   r   r   r+   r   r   r#   Z	string_at)r'   r   startsizer   r   r   	dump_func  s    zBPF.dump_funcc             C   s   | j |}t||S )N)r   r   )r'   r   Zbpfstrr   r   r   disassemble_func  s    
zBPF.disassemble_funcc             C   s(   | | }t j| j|j}t||||dS )N)sizeinfo)r   bpf_table_type_idr+   map_idr   )r'   Z
table_namer   Z	table_objZ
table_typer   r   r   decode_table#  s    zBPF.decode_tabler   )Z_BoolcharZwchar_tzunsigned charZshortzunsigned shortintzunsigned intZlongzunsigned longz	long longzunsigned long longfloatZdoublezlong doubleZ__int128zunsigned __int128c             C   s  t | trtj|  S g }g }xN| d D ]@}t|dkrX|j|d tj|d f q(t|dkrZt |d tr|j|d tj|d |d d  f nt |d tr|j|d tj|d |d f nt |d trH|d dks
|d dks
|d dkrH|d }|dkr2d	t| }|j| |j|tj|f nt	d
t
| q(t	d
t
| q(W tj}d}t| dkr| d dkrtj}n.| d dkrtj}n| d dkrtj}d}|rtt
| d |ft|d|d}ntt
| d |ft||d}|S )Nr   r   r   r<   unionstructZstruct_packedr   z__anon%dzFailed to decode type %sFT)_anonymous_Z_pack_r   )r   r   )
isinstance
basestringr   	str2ctyper   r   _decode_table_typelistr   r   strr#   	StructureZUniontypedict)ZdescZanonfieldsr   r/   baseZ	is_packedr   r   r   r   r   ;  sL    

*$


zBPF._decode_table_typec       
   	   C   s   t |}tj| j|}tj| j|}tj| j|ttgk}|dk rFt| r| rtj	| j|j
d}|svtd| tjtj|}|stj| j|j
d}	|	std| tjtj|	}t| ||||||dS )Nr   zutf-8z$Failed to load BPF Table %s key descz%Failed to load BPF Table %s leaf desc)reducer)r   r   Zbpf_table_idr+   Zbpf_table_fdr   r   r   KeyErrorZbpf_table_key_descdecoder   r   r   jsonloadsZbpf_table_leaf_descr	   )
r'   r/   ZkeytypeZleaftyper  r   map_fdZis_queuestackZkey_descZ	leaf_descr   r   r   	get_tableg  s"    zBPF.get_tablec             C   s$   || j kr| j|| j |< | j | S )N)r   r
  )r'   keyr   r   r   __getitem__z  s    
zBPF.__getitem__c             C   s   || j |< d S )N)r   )r'   r  Zleafr   r   r   __setitem__  s    zBPF.__setitem__c             C   s
   t | jS )N)r   r   )r'   r   r   r   __len__  s    zBPF.__len__c             C   s   | j |= d S )N)r   )r'   r  r   r   r   __delitem__  s    zBPF.__delitem__c             C   s
   | j j S )N)r   __iter__)r'   r   r   r   r    s    zBPF.__iter__c             C   sJ   t | tjstdtj| j|||}|dk rFtdj|tj	| d S )Nz"arg 1 must be of type BPF.Functionr   z7Failed to attach BPF function with attach_type {0}: {1})
r   r   r   r   r   Zbpf_prog_attachr   formatr   r   )r   attachable_fdr   flagsr3   r   r   r   attach_func  s    zBPF.attach_funcc             C   sH   t | tjstdtj| j||}|dk rDtdj|tj	| d S )Nz"arg 1 must be of type BPF.Functionr   z7Failed to detach BPF function with attach_type {0}: {1})
r   r   r   r   r   Zbpf_prog_detach2r   r  r   r   )r   r  r   r3   r   r   r   detach_func  s    zBPF.detach_funcc             C   s   t |}t| tjstdtj|}|dk rLtjt	j
 }td||f tj|| j}|dk rtjt	j
 }td||f || _d S )Nz"arg 1 must be of type BPF.Functionr   z Failed to open raw device %s: %sz%Failed to attach BPF to device %s: %s)r   r   r   r   r   r   Zbpf_open_raw_sockr   r   r#   r   Zbpf_attach_socketr   sock)r   devr  r   r3   r   r   r   attach_raw_socket  s    
zBPF.attach_raw_socketc             C   s  dt  }y,t|d}tdd |D }W d Q R X W n: tk
rn } z|jtjkrV|tg }W Y d d }~X nX g }d}d}tdd}x|D ]}	|	j j dd \}
}|dkr|d	krd}qn|dkr|d
krd}q|dkr
|dkrd}qn|dkr"d}qn|dkr"|dkrd}q|jdr2qn:|jds|jdrLqn |jdr\qnt	j
d|rlq|
j dkrt	j| |r||kr|j| qW W d Q R X t|S )Nz%s/../kprobes/blacklistr   c             S   s   g | ]}|j  j d  qS )r   )rstripr   ).0liner   r   r   
<listcomp>  s    z,BPF.get_kprobe_functions.<locals>.<listcomp>r   z/proc/kallsymsr   r<   s   __init_begins
   __init_endr   s   __irqentry_text_starts   __irqentry_text_ends
   _kbl_addr_s   __perfs   perf_s   __SCT__s   ^.*\.cold(\.\d+)?$   t   w)r  r  )TRACEFSr   setIOErrorr   r   r  r   
startswithrematchlower	fullmatchr   )event_reZblacklist_fileZblacklist_fZ	blacklister   Zin_init_sectionZin_irq_sectionZ
avail_filer  r   r   r   r   r   get_kprobe_functions  sZ     


zBPF.get_kprobe_functionsc             C   s   t | tj krtdd S )Nz/Number of open probes would exceed global quota)r   r   get_probe_limitr   )r'   Znum_new_probesr   r   r   _check_probe_quota  s    zBPF._check_probe_quotac              C   s(   t jjd} | r | j r t| S tS d S )NZBCC_PROBE_LIMIT)r   r   getisdigitr   _default_probe_limit)Zenv_probe_limitr   r   r   r*    s    zBPF.get_probe_limitc             C   s.   || j kri | j |< || j | |< td7 ad S )Nr   )r   r   )r'   ev_namefn_namer   r   r   r   _add_kprobe_fd  s    

zBPF._add_kprobe_fdc             C   s   | j | |= td8 ad S )Nr   )r   r   )r'   r/  r0  r   r   r   _del_kprobe_fd  s    zBPF._del_kprobe_fdc             C   s   || j |< td7 ad S )Nr   )r   r   )r'   r/   r   r   r   r   _add_uprobe_fd
  s    
zBPF._add_uprobe_fdc             C   s   | j |= td8 ad S )Nr   )r   r   )r'   r/   r   r   r   _del_uprobe_fd  s    zBPF._del_uprobe_fdc             C   s0   x$| j D ]}| jd| dkr|S qW | j d S )Ns   %sbpfr   r   r5   )_syscall_prefixesksymname)r'   prefixr   r   r   get_syscall_prefix  s    zBPF.get_syscall_prefixc             C   s   t |}| j | S )N)r   r8  )r'   r/   r   r   r   get_syscall_fnname   s    zBPF.get_syscall_fnnamec             C   s<   t |}x.| jD ]$}|j|r| j|t|d  S qW |S )N)r   r5  r"  r9  r   )r'   r/   r7  r   r   r   fix_syscall_fnname'  s
    
zBPF.fix_syscall_fnnamec             C   s  t |}t |}t |}|rtj|}| jt| d}g }x>|D ]6}y| j||d W qB   |d7 }|j| Y qBX qBW |t|krtd|dj|f d S | jd | j	|tj
}	d|jddjd	d }
tj|	jd|
||d}|dk rtd||f | j|
|| | S )
Nr   )eventr0  r   zwFailed to attach BPF program %s to kprobe %s, it's not traceable (either non-existing, inlined, or marked as "notrace")/s   p_   +   _   .)r   r   r)  r+  r   attach_kprober   r   r   r   r\   replacer   bpf_attach_kprober   r1  )r'   r;  Z	event_offr0  r'  matchesfailedprobesr  r   r/  r   r   r   r   r@  .  s6    



zBPF.attach_kprobec             C   s  t |}t |}t |}|rtj|}d}g }x@|D ]8}y| j|||d W q4   |d7 }|j| Y q4X q4W |t|krtd|dj|f d S | jd | j	|tj
}	d|jddjd	d }
tj|	jd|
|d|}|dk rtd||f | j|
|| | S )
Nr   )r;  r0  	maxactiver   zzFailed to attach BPF program %s to kretprobe %s, it's not traceable (either non-existing, inlined, or marked as "notrace")r<  s   r_r=  r>  r?  )r   r   r)  attach_kretprober   r   r   r   r+  r   r\   rA  r   rB  r   r1  )r'   r;  r0  r'  rF  rC  rD  rE  r  r   r/  r   r   r   r   rG  P  s6    


zBPF.attach_kretprobec             C   s8   t |}t| j| j }x|D ]}| j|| q W d S )N)r   r   r   keysdetach_kprobe_event_by_fn)r'   r/  Zfn_namesr0  r   r   r   detach_kprobe_eventr  s    
zBPF.detach_kprobe_eventc             C   s   t |}t |}|| jkr&td| tj| j| | }|dk rJtd| j|| t| j| dkrtj|}|dk rtdd S )NzKprobe %s is not attachedr   zFailed to close kprobe FDz Failed to detach BPF from kprobe)r   r   r   r   bpf_close_perf_event_fdr2  r   Zbpf_detach_kprobe)r'   r/  r0  r3   r   r   r   rI  x  s    

zBPF.detach_kprobe_event_by_fnc             C   sH   t |}d|jddjdd }|r:t |}| j|| n
| j| d S )Ns   p_r=  r>  r?  )r   rA  rI  rJ  )r'   r;  r0  r/  r   r   r   detach_kprobe  s    zBPF.detach_kprobec             C   sH   t |}d|jddjdd }|r:t |}| j|| n
| j| d S )Ns   r_r=  r>  r?  )r   rA  rI  rJ  )r'   r;  r0  r/  r   r   r   detach_kretprobe  s    zBPF.detach_kretprobec             C   sn   t | } t|tjstdtj| |j|}|dk rjtj	 }|t
jkrPtdntj|}td| |f dS )zt
            This function attaches a BPF function to a device on the device
            driver level (XDP)
        z"arg 1 must be of type BPF.Functionr   z-Internal error while attaching BPF to device,z  try increasing the debug level!z%Failed to attach BPF to device %s: %sNzMInternal error while attaching BPF to device, try increasing the debug level!)r   r   r   r   r   r   bpf_attach_xdpr   r#   r   r   ZEBADMSGr   r   )r  r   r  r3   Zerr_nor   r   r   r   
attach_xdp  s    

zBPF.attach_xdpc             C   s@   t | } tj| d|}|dk r<tjtj }td| |f dS )zw
            This function removes any BPF function from a device on the
            device driver level (XDP)
        r   r   z'Failed to detach BPF from device %s: %sNr5   )r   r   rN  r   r   r#   r   r   )r  r  r3   r   r   r   r   
remove_xdp  s    zBPF.remove_xdpc       
   	   C   s   t |}t |}t }|dkr"dn|}tj|||p4d|tjd tjttj|dk rnt	d|j
 |j
 f |j| }tj|jtjj}	tj|j |	|fS )Nr   r   z.could not determine address of symbol %s in %sr5   )r   r   r   Zbcc_resolve_symnamer#   r$   r%   r   r*   r   r  r,   r+   r-   r.   bcc_procutils_free)
r   r+   Zsymnamer0   r(   sym_offr2   Zc_pidZnew_addrZmodule_pathr   r   r   _check_path_symbol  s     

zBPF._check_path_symbolc             C   s:   t | } tj| d}|sd S tj|tjj}tj| |S )Nr   )r   r   Zbcc_procutils_which_sor#   r$   r-   r.   rQ  )Zlibnamer3   Zlibpathr   r   r   find_library  s    
zBPF.find_libraryc             C   s   g }t jjtd}xt j|D ]t}t jj||}t jj|s>qxRt j|D ]D}t jj||}t jj|rJd||f }tj| j |rJ|j	| qJW qW |S )Neventsz%s:%s)
r   r   r   r  listdirisdirr#  r$  r  r   )tp_reresultsZ
events_dircategoryZcat_dirr;  evt_dirtpr   r   r   get_tracepoints  s    zBPF.get_tracepointsc             C   s   t jjtd| |}t jj|S )NrU  )r   r   r   r  rW  )rZ  r;  r[  r   r   r   tracepoint_exists  s    zBPF.tracepoint_existsc             C   s   t |}t |}t |}|rBx tj|D ]}| j||d q(W dS | j|tj}|jd\}}tj|j	||}|dk rt
d||f || j|< | S )a  attach_tracepoint(tp="", tp_re="", fn_name="")

        Run the bpf function denoted by fn_name every time the kernel tracepoint
        specified by 'tp' is hit. The optional parameters pid, cpu, and group_fd
        can be used to filter the probe. The tracepoint specification is simply
        the tracepoint category and the tracepoint name, separated by a colon.
        For example: sched:sched_switch, syscalls:sys_enter_bind, etc.

        Instead of a tracepoint name, a regular expression can be provided in
        tp_re. The program will then attach to tracepoints that match the
        provided regular expression.

        To obtain a list of kernel tracepoints, use the tplist tool or cat the
        file /sys/kernel/debug/tracing/available_events.

        Examples:
            BPF(text).attach_tracepoint(tp="sched:sched_switch", fn_name="on_switch")
            BPF(text).attach_tracepoint(tp_re="sched:.*", fn_name="on_switch")
        )r\  r0  N   :r   z0Failed to attach BPF program %s to tracepoint %s)r   r   r]  attach_tracepointr   r>   r   r   Zbpf_attach_tracepointr   r   r   )r'   r\  rX  r0  r   tp_categorytp_namer   r   r   r   r`    s    
zBPF.attach_tracepointc             C   s`   t |}|| jkrtd| t |}| j|tj}tj|j|}|dk rRtd|| j|< | S )a  attach_raw_tracepoint(self, tp=b"", fn_name=b"")

        Run the bpf function denoted by fn_name every time the kernel tracepoint
        specified by 'tp' is hit. The bpf function should be loaded as a
        RAW_TRACEPOINT type. The fn_name is the kernel tracepoint name,
        e.g., sched_switch, sys_enter_bind, etc.

        Examples:
            BPF(text).attach_raw_tracepoint(tp="sched_switch", fn_name="on_switch")
        z#Raw tracepoint %s has been attachedr   z&Failed to attach BPF to raw tracepoint)	r   r   r   r   r   rj   r   Zbpf_attach_raw_tracepointr   )r'   r\  r0  r   r   r   r   r   attach_raw_tracepoint  s    

zBPF.attach_raw_tracepointc             C   s:   t |}|| jkrtd| tj| j|  | j|= dS )zdetach_raw_tracepoint(tp="")

        Stop running the bpf function that is attached to the kernel tracepoint
        specified by 'tp'.

        Example: bpf.detach_raw_tracepoint("sched_switch")
        z!Raw tracepoint %s is not attachedN)r   r   r   r   close)r'   r\  r   r   r   detach_raw_tracepoint)  s
    	
zBPF.detach_raw_tracepointc             C   s   |j | s| | }|S )N)r"  )r7  r/   r   r   r   
add_prefix8  s    
zBPF.add_prefixc               C   s2   t j dkrdS tj sdS tjddkr.dS dS )NZx86_64FZbpf_trampoline_link_progr   Tr5   )platformmachiner   bpf_has_kernel_btfr   r6  r   r   r   r   support_kfunc>  s    zBPF.support_kfuncc               C   s"   t j sdS tjddkrdS dS )NFs   bpf_lsm_bpfr   Tr5   )r   ri  r   r6  r   r   r   r   support_lsmJ  s
    zBPF.support_lsmc             C   sF   t |}tjd|}|| jkr*td| tj| j|  | j|= d S )Ns   kfunc__z$Kernel entry func %s is not attached)r   r   rf  r   r   r   rd  )r'   r0  r   r   r   detach_kfuncS  s    
zBPF.detach_kfuncc             C   sF   t |}tjd|}|| jkr*td| tj| j|  | j|= d S )Ns
   kretfunc__z#Kernel exit func %s is not attached)r   r   rf  r   r   r   rd  )r'   r0  r   r   r   detach_kretfunc\  s    
zBPF.detach_kretfuncc             C   sb   t |}tjd|}|| jkr*td| | j|tj}tj|j	}|dk rTtd|| j|< | S )Ns   kfunc__z&Kernel entry func %s has been attachedr   z)Failed to attach BPF to entry kernel func)
r   r   rf  r   r   r   rl   r   bpf_attach_kfuncr   )r'   r0  r   r   r   r   r   attach_kfunce  s    

zBPF.attach_kfuncc             C   sb   t |}tjd|}|| jkr*td| | j|tj}tj|j	}|dk rTtd|| j|< | S )Ns
   kretfunc__z%Kernel exit func %s has been attachedr   z(Failed to attach BPF to exit kernel func)
r   r   rf  r   r   r   rl   r   rn  r   )r'   r0  r   r   r   r   r   attach_kretfuncs  s    

zBPF.attach_kretfuncc             C   sF   t |}tjd|}|| jkr*td| tj| j|  | j|= d S )Ns   lsm__zLSM %s is not attached)r   r   rf  r   r   r   rd  )r'   r0  r   r   r   
detach_lsm  s    
zBPF.detach_lsmc             C   sb   t |}tjd|}|| jkr*td| | j|tj}tj|j	}|dk rTtd|| j|< | S )Ns   lsm__zLSM %s has been attachedr   zFailed to attach LSM)
r   r   rf  r   r   r   rm   r   Zbpf_attach_lsmr   )r'   r0  r   r   r   r   r   
attach_lsm  s    

zBPF.attach_lsmc               C   s$   t jddkst jddkr dS dS )NZbpf_find_raw_tracepointr   Zbpf_get_raw_tracepointTFr5   r5   )r   r6  r   r   r   r   support_raw_tracepoint  s    zBPF.support_raw_tracepointc              C   sZ   d} t | D}x<|D ]4}|j jdd\}}}|jdd }|dkrdS qW dS Q R X d S )	Nz/proc/kallsyms r   	r   Zbpf_trace_modulesTF)r   r  r   )ZkallsymsZsymsr  _r/   r   r   r    support_raw_tracepoint_in_module  s    

z$BPF.support_raw_tracepoint_in_modulec             C   s   t | } t |}tj| |S )N)r   r   kernel_struct_has_field)Zstruct_nameZ
field_namer   r   r   rx    s    zBPF.kernel_struct_has_fieldc             C   st   t |}|| jkrtd| tj| j| }|dk r>td|jd\}}tj||}|dk rhtd| j|= dS )zdetach_tracepoint(tp="")

        Stop running a bpf function that is attached to the kernel tracepoint
        specified by 'tp'.

        Example: bpf.detach_tracepoint("sched:sched_switch")
        zTracepoint %s is not attachedr   z$Failed to detach BPF from tracepointr_  N)r   r   r   r   rK  r   Zbpf_detach_tracepoint)r'   r\  r3   ra  rb  r   r   r   detach_tracepoint  s    	
zBPF.detach_tracepointc	       
   	   C   s,   t j||||||||}	|	dk r(td|	S )Nr   z"Failed to attach BPF to perf event)r   Zbpf_attach_perf_eventr   )
r'   progfdev_type	ev_configsample_periodsample_freqr(   cpugroup_fdr3   r   r   r   _attach_perf_event  s
    
zBPF._attach_perf_eventc	          
   C   s   t |}| j|tj}	i }
|dkrB| j|	j||||||||
|< n.x,t D ]"}| j|	j||||||||
|< qJW |
| j||f< d S )Nr   )r   r   r   r`   r  r   r   r   )r'   r{  r|  r0  r}  r~  r(   r  r  r   r3   r   r   r   r   attach_perf_event  s    zBPF.attach_perf_eventc             C   s.   t j|tj||||d}|dk r*td|S )Nr   z&Failed to attach BPF to perf raw event)r   Zbpf_attach_perf_event_rawr#   r*   r   )r'   rz  attrr(   r  r  r3   r   r   r   _attach_perf_event_raw  s
    
zBPF._attach_perf_event_rawc       	      C   sz   t |}| j|tj}i }|dkr<| j|j||||||< n(x&t D ]}| j|j||||||< qDW || j|j|j	f< d S )Nr   )
r   r   r   r`   r  r   r   r   r   config)	r'   r  r0  r(   r  r  r   r3   r   r   r   r   attach_perf_event_raw  s    

zBPF.attach_perf_event_rawc             C   s|   y| j ||f }W n$ tk
r6   tdj||Y nX d}x|j D ]}tj|pV|}qFW |dkrltd| j ||f= d S )Nz)Perf event type {} config {} not attachedr   z$Failed to detach BPF from perf event)r   r  r   r  valuesr   rK  )r'   r{  r|  Zfdsr3   r   r   r   r   detach_perf_event  s    zBPF.detach_perf_eventc             C   s   t dd tj| |D S )Nc             S   s   g | ]\}}|qS r   r   )r  r/   rv  r   r   r   r    s    z*BPF.get_user_functions.<locals>.<listcomp>)r   r    get_user_functions_and_addresses)r/   sym_rer   r   r   get_user_functions  s    zBPF.get_user_functionsc             C   s   t dd tj| |D S )a  
        We are returning addresses here instead of symbol names because it
        turns out that the same name may appear multiple times with different
        addresses, and the same address may appear multiple times with the same
        name. We can't attach a uprobe to the same address more than once, so
        it makes sense to return the unique set of addresses that are mapped to
        a symbol that matches the provided regular expression.
        c             S   s   g | ]\}}|qS r   r   )r  rv  Zaddressr   r   r   r    s    z*BPF.get_user_addresses.<locals>.<listcomp>)r   r   r  )r/   r  r   r   r   get_user_addresses  s    
zBPF.get_user_addressesc                sN   t | } t g   fdd}tj| t|}|dk rJtd|| f  S )Nc                s"   | }t j|r j||f dS )Nr   )r#  r$  r   )Zsym_namer0   Zdname)	addressesr  r   r   sym_cb  s    z4BPF.get_user_functions_and_addresses.<locals>.sym_cbr   z"Error %d enumerating symbols in %s)r   r   Zbcc_foreach_function_symbolr   r   )r/   r  r  r3   r   )r  r  r   r    s    z$BPF.get_user_functions_and_addressesc             C   s>   |dkr d|| j jd||f S d|| j jd|||f S d S )Nr   s
   %s_%s_0x%xr>  s   %s_%s_0x%x_%dr5   )_probe_replsub)r'   r7  r   r0   r(   r   r   r   _get_uprobe_evname!  s    zBPF._get_uprobe_evnamec             C   s   |dkst |dk	r$|dks$t dt|}t|}t|}t|}|rtj||}| jt| x|D ]}	| j||	||d qhW dS tj|||||\}
}| jd | j|tj	}| j
d|
||}tj|jd||
||}|dk rtd| j|| | S )a  attach_uprobe(name="", sym="", sym_re="", addr=None, fn_name=""
                         pid=-1, sym_off=0)

        Run the bpf function denoted by fn_name every time the symbol sym in
        the library or binary 'name' is encountered. Optional parameters pid,
        cpu, and group_fd can be used to filter the probe.

        If sym_off is given, attach uprobe to offset within the symbol.

        The real address addr may be supplied in place of sym, in which case sym
        must be set to its default value. If the file is a non-PIE executable,
        addr must be a virtual address, otherwise it must be an offset relative
        to the file load address.

        Instead of a symbol name, a regular expression can be provided in
        sym_re. The uprobe will then attach to symbols that match the provided
        regular expression.

        Libraries can be given in the name argument without the lib prefix, or
        with the full path (/usr/lib/...). Binaries can be given only with the
        full path (/bin/sh). If a PID is given, the uprobe will attach to the
        version of the library used by the process.

        Example: BPF(text).attach_uprobe("c", "malloc")
                 BPF(text).attach_uprobe("/usr/bin/python", "main")
        r   Nz!offset with addr is not supported)r/   r0   r0  r(   r      pzFailed to attach BPF to uprobe)r   r   r   r  r+  r   attach_uproberS  r   r\   r  r   bpf_attach_uprober   r   r3  )r'   r/   r2   r  r0   r0  r(   rR  r  sym_addrr   r   r/  r   r   r   r   r  )  s.    

zBPF.attach_uprobec             C   s   t |}t |}t |}t |}|rPx&tj||D ]}| j||||d q2W dS tj||||\}}| jd | j|tj}	| jd|||}
t	j
|	jd|
|||}|dk rtd| j|
| | S )a6  attach_uretprobe(name="", sym="", sym_re="", addr=None, fn_name=""
                            pid=-1)

        Run the bpf function denoted by fn_name every time the symbol sym in
        the library or binary 'name' finishes execution. See attach_uprobe for
        meaning of additional parameters.
        )r/   r0   r0  r(   Nr      rr   z!Failed to attach BPF to uretprobe)r   r   r  attach_uretproberS  r+  r   r\   r  r   r  r   r   r3  )r'   r/   r2   r  r0   r0  r(   r  r   r   r/  r   r   r   r   r  b  s$    

zBPF.attach_uretprobec             C   s^   || j krtd| tj| j | }|dk r6tdtj|}|dk rPtd| j| d S )NzUprobe %s is not attachedr   z Failed to detach BPF from uprobe)r   r   r   rK  Zbpf_detach_uprober4  )r'   r/  r3   r   r   r   detach_uprobe_event  s    

zBPF.detach_uprobe_eventc             C   sD   t |}t |}tj|||||\}}| jd|||}| j| dS )zdetach_uprobe(name="", sym="", addr=None, pid=-1)

        Stop running a bpf function that is attached to symbol 'sym' in library
        or binary 'name'.
        r  N)r   r   rS  r  r  )r'   r/   r2   r0   r(   rR  r   r/  r   r   r   detach_uprobe  s
    zBPF.detach_uprobec             C   sB   t |}t |}tj||||\}}| jd|||}| j| dS )zdetach_uretprobe(name="", sym="", addr=None, pid=-1)

        Stop running a bpf function that is attached to symbol 'sym' in library
        or binary 'name'.
        r  N)r   r   rS  r  r  )r'   r/   r2   r0   r(   r   r/  r   r   r   detach_uretprobe  s
    zBPF.detach_uretprobec             C   sn  xft dtj| jD ]N}tj| j|}|jdrb| j|tj}| j	| j
|dd  |jd q|jdr| j|tj}| j| j
|dd  |jd q|jdr| j|tj}|jtdd  jdd	}| j||jd
 q|jdr| j|tj}|jtdd  }| j||jd
 q|jdr6| j|d q|jdrP| j|d q|jdr| j|d qW d S )Nr   s   kprobe__r   )r;  r0  s   kretprobe__rG   s   tracepoint__s   __r_  )r\  r0  s   raw_tracepoint__s   kfunc__)r0  s
   kretfunc__s   lsm__)r   r   r   r+   r   r"  r   r   r\   r@  r:  r/   rG  r>   r   rA  r`  rj   rc  ro  rp  rr  )r'   r   r   r   r\  r   r   r   r     s4    



zBPF._trace_autoloadc             C   sN   | j sHtdt d| _ |rH| j j }tj|tj}tj|tj|tjB  | j S )zWtrace_open(nonblocking=False)

        Open the trace_pipe if not already open
        z%s/trace_piper   )	r   r   r  filenofcntlZF_GETFLZF_SETFLr   
O_NONBLOCK)r'   nonblockingr   Zflr   r   r   
trace_open  s    
zBPF.trace_openc              C   s  x| j |}| r|rdS |jdr(q|dd j }|dd }|jd}y|d| j \}}}}W n$ tk
r }	 zwW Y dd}	~	X nX |dd }||d d }|jd}
||
d d }y|t|t||t||fS  tk
r }	 zdS d}	~	X qX qW dS )ztrace_fields(nonblocking=False)

        Read from the kernel debug trace pipe and return a tuple of the
        fields (task, pid, cpu, flags, timestamp, msg) or None if no
        line was read (nonblocking=True)
        NrA   s   CPU:r    rL   r_  r   r   Unknownr           )N)NNNNNNr5   )r  r   r   r  r  r  )trace_readliner"  lstripfindr   r   r   r   )r'   r  r  ZtaskZts_endr(   r  r  Ztsr(  Zsym_endmsgr   r   r   trace_fields  s*    

 
 

zBPF.trace_fieldsc             C   s:   | j |}d}y|jdj }W n tk
r4   Y nX |S )ztrace_readline(nonblocking=False)

        Read from the kernel debug trace pipe and return one line
        If nonblocking is False, this will block until ctrl-C is pressed.
        Ni   )r  readliner  r!  )r'   r  Ztracer  r   r   r   r    s    
zBPF.trace_readlinec             C   sJ   xD|r$| j dd}|sq|j| }n| jdd}t| tjj  qW dS )a  trace_print(self, fmt=None)

        Read from the kernel debug trace pipe and print on stdout.
        If fmt is specified, apply as a format string to the output. See
        trace_fields for the members of the tuple
        example: trace_print(fmt="pid {1}, msg = {5}")
        F)r  N)r  r  r  printr   stdoutflush)r'   Zfmtr  r  r   r   r   trace_print  s    	 zBPF.trace_printc             C   s6   | dk r| dkrd} | t jkr,t| t j| < t j|  S )z_sym_cache(pid)

        Returns a symbol cache for the specified PID.
        The kernel symbol cache is accessed by providing any PID less than zero.
        r   r   r5   r5   )r   _sym_cachesr"   )r(   r   r   r   
_sym_cache  s
    
zBPF._sym_cachec             C   s6  t t| }|jdd	krt }t }| j|_| j|_| j|j_t	j
tjtj|tj|}|dk r|jr|jrd|jtj|jtjj  }	}
}qd| d  }	}
}q|j|jtj|jtjj  }	}
}ntj|j| |\}	}
}|r|	dk	rd|
 nd}
|	p d}	|	|
 }	|r*|dk	r*dtjj| nd}|	| S )
ay  sym(addr, pid, show_module=False, show_offset=False)

        Translate a memory address into a function name for a pid, which is
        returned. When show_module is True, the module name is also included.
        When show_offset is True, the instruction offset as a hexadecimal
        number is also included in the string.

        A pid of less than zero will access the kernel symbol cache.

        Example output when both show_module and show_offset are True:
            "start_thread+0x202 [libpthread-2.24.so]"

        Example output when both show_module and show_offset are False:
            "start_thread"
        Zbpf_stack_build_idr   r   Ns   +0x%xr   s	   [unknown]s    [%s]r5   )r   r   r  r   r   ZstatusZbuild_idr,   ur   Zbcc_buildsymcache_resolver   
_bsymcacher#   r*   r+   r$   r-   r.   r/   r  r4   r   r   basename)r0   r(   show_moduleshow_offsetr1   Z
typeofaddrr2   br3   r/   r,   r+   r   r   r   r2   $  s.    

$zBPF.symc             C   s   t j| d||dS )a  ksym(addr)

        Translate a kernel memory address into a kernel function name, which is
        returned. When show_module is True, the module name ("kernel") is also
        included. When show_offset is true, the instruction offset as a
        hexadecimal number is also included in the string.

        Example output when both show_module and show_offset are True:
            "default_idle+0x0 [kernel]"
        r   Fr5   )r   r2   )r0   r  r  r   r   r   ksymU  s    zBPF.ksymc             C   s   t jdjd| S )zksymname(name)

        Translate a kernel name into an address. This is the reverse of
        ksym. Returns -1 when the function name is unknown.r   Nr5   )r   r  r7   )r/   r   r   r   r6  c  s    zBPF.ksymnamec             C   s
   t | jS )znum_open_kprobes()

        Get the number of open K[ret]probes. Can be useful for scenarios where
        event_re is used while attaching and detaching probes.
        )r   r   )r'   r   r   r   num_open_kprobesk  s    zBPF.num_open_kprobesc             C   s
   t | jS )zInum_open_uprobes()

        Get the number of open U[ret]probes.
        )r   r   )r'   r   r   r   num_open_uprobess  s    zBPF.num_open_uprobesc             C   s
   t | jS )zLnum_open_tracepoints()

        Get the number of open tracepoints.
        )r   r   )r'   r   r   r   num_open_tracepointsz  s    zBPF.num_open_tracepointsc             C   sL   t jt| j  }x"t| jj D ]\}}|||< q"W tjt||| dS )zperf_buffer_poll(self)

        Poll from all open perf ring buffers, calling the callback that was
        provided when calling open_perf_buffer for each entry.
        N)r#   r   r   r   r   r  r   Zperf_reader_poll)r'   timeoutreadersr   vr   r   r   perf_buffer_poll  s    zBPF.perf_buffer_pollc             C   sJ   t jt| j  }x"t| jj D ]\}}|||< q"W tjt|| dS )zperf_buffer_consume(self)

        Consume all open perf buffers, regardless of whether or not
        they currently contain events data. Necessary to catch 'remainder'
        events when wakeup_events > 1 is set in open_perf_buffer
        N)r#   r   r   r   r   r  r   Zperf_reader_consume)r'   r  r   r  r   r   r   perf_buffer_consume  s    zBPF.perf_buffer_consumec             C   s   | j | dS )zMkprobe_poll(self)

        Deprecated. Use perf_buffer_poll instead.
        N)r  )r'   r  r   r   r   kprobe_poll  s    zBPF.kprobe_pollc             C   sL   | j s&tj|||| _ | j sHtdn"tj| j |||}|dk rHtdd S )NzCould not open ring bufferr   )r   r   Zbpf_new_ringbufr   Zbpf_add_ringbuf)r'   r	  r   Zctxretr   r   r   _open_ring_buffer  s    
zBPF._open_ring_bufferc             C   s    | j stdtj| j | dS )zring_buffer_poll(self)

        Poll from all open ringbuf buffers, calling the callback that was
        provided when calling open_ring_buffer for each entry.
        zNo ring buffers to pollN)r   r   r   Zbpf_poll_ringbuf)r'   r  r   r   r   ring_buffer_poll  s    zBPF.ring_buffer_pollc             C   s   | j stdtj| j  dS )a/  ring_buffer_consume(self)

        Consume all open ringbuf buffers, regardless of whether or not
        they currently contain events data. This is best for use cases
        where low latency is desired, but it can impact performance.
        If you are unsure, use ring_buffer_poll instead.
        zNo ring buffers to pollN)r   r   r   Zbpf_consume_ringbuf)r'   r   r   r   ring_buffer_consume  s    zBPF.ring_buffer_consumec             C   s   t j S )N)r   Zbcc_free_memory)r'   r   r   r   free_bcc_memory  s    zBPF.free_bcc_memoryc             C   sN   yt jtj| j  W n2 tk
rH } ztdt|  W Y dd}~X nX dS )zJadd_module(modname)

        Add a library or exe to buildsym cache
      z&Error adding module to build sym cacheN)r   Zbcc_buildsymcache_add_moduler   r  r   r   r  r   )modnamer(  r   r   r   
add_module  s    zBPF.add_modulec             C   s   dS )zthe do nothing exit handlerNr   )r'   r   r   r   r     s    zBPF.donothingc             C   sL   x.t | jj D ]\}}tj|j | j|= qW | jrHtj| j d| _dS )zvclose(self)

        Closes all associated files descriptors. Attached BPF programs are not
        detached.
        N)	r   r   r   r   rd  r   r+   r   Zbpf_module_destroy)r'   r/   r   r   r   r   rd    s    z	BPF.closec             C   s  x$t | jj D ]\}}| j| qW x$t | jj D ]\}}| j| q6W x$t | jj D ]\}}| j| q\W x$t | jj D ]\}}| j	| qW x$t | j
j D ]\}}| j| qW x$t | jj D ]\}}| j| qW x$t | jj D ]\}}| j| qW t | jj }x(|D ] }t| j| tr| j|= qW x(t | jj D ]\}}| j|| qRW | jr| jj  d | _| j  | jrtj| j d | _d S )N)r   r   r   rJ  r   r  r   ry  r   re  r   rl  r   rm  r   rq  r   rH  r   r
   r   r  r   rd  r   r   Zbpf_free_ringbuf)r'   kr  Z
table_keysr  r{  r|  r   r   r   r     s6    

zBPF.cleanupc             C   s   | S )Nr   )r'   r   r   r   	__enter__  s    zBPF.__enter__c             C   s   | j   d S )N)r   )r'   exc_typeZexc_valZexc_tbr   r   r   __exit__  s    zBPF.__exit__r5   )Nr5   )F)NNN)r   )r   r   r   r   )r   r   r   r   )N)N)r   )r   )r   )r   r   r   )r   r   )r   )r   )r   )r   )r   )r   )r   )r   r5   r5   r5   r5   r5   )r5   r5   r   r   r   r5   r5   r5   r5   r5   r5   r5   )r5   r   r5   r5   r5   r5   r5   )r5   r5   r5   )r   r   r   Nr   r5   r   r5   )r   r   r   Nr   r5   r5   )r   r   Nr5   r   r5   )r   r   Nr5   )F)F)F)N)FFT)FFr5   )r5   r5   )r5   )Nr5   )r5   )r8   r9   r:   rW   r[   r\   r]   r^   r>   r_   r`   ra   rb   rc   rd   re   rf   rg   rh   ri   rj   rk   rl   rm   ry   rz   r{   r|   r}   r~   r   r   ZXDP_FLAGS_UPDATE_IF_NOEXISTr   ZXDP_FLAGS_SKB_MODEr   ZXDP_FLAGS_DRV_MODEr   ZXDP_FLAGS_HW_MODEr   ZXDP_FLAGS_REPLACEr#  compiler  r  r   Zbcc_buildsymcache_newr  r   r5  r   r#   r   r   ZCDLLZ_librtZclock_gettimer   Zc_intr%   Zargtypesclassmethodr   r   r	   objectr   staticmethodr   r   r)   r   r   r   r   r   Zc_boolZc_charZc_wcharZc_ubyteZc_shortZc_ushortZc_uintr   Zc_ulongZ
c_longlongr6   Zc_floatZc_doubleZc_longdoubleZc_int64Zc_uint64r   r   r
  r  r  r  r  r  r  r  r  r)  r+  r*  r1  r2  r3  r4  r8  r9  r:  r@  rG  rJ  rI  rL  rM  rO  rP  rS  rT  r]  r^  r`  rc  re  rf  rj  rk  rl  rm  ro  rp  rq  rr  rs  rw  rx  ry  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r   r  r  r  r  r  r2   r  r6  r  r  r  r  r  r  r  r  r  r  r  r   rd  r   r  r  r   r   r   r   r      sb  
N
 
,
	
B	
"
"
	
	

&

	
	
	


	

 
 8 #0

#r   )@Z
__future__r   r   Zctypesr#   r  r  r   r#  r   r   rg  Zlibbccr   r   r   r   r   tabler	   r
   r   r   r   Zperfr   Zutilsr   r   r   r   r   versionr   Zdisassemblerr   r   r   r   r   r   	NameErrorr   r.  r   r   r  ZDEBUG_LLVM_IRr   ZDEBUG_PREPROCESSORZDEBUG_SOURCEr   Z	DEBUG_BTFr  r"   r;   r@   rD   rF   rW   rn   ry   r   r   r   r   r   r   <module>   sP   
+	*
