fddlmZ ddlmZddlmZddlZ ddl m Z ddl Z ddl Z ddlZddlZddlmZmZmZmZmZddlmZdd lmZdZd Zd Zd Zd ZdZdZdZ dZ!dZ"dZ#dZ$dZ%dZ&dZ'dZ(dZ)dZ*dZ+dZ,dZ-dZ.dZ/d Z0d!Z1d"Z2d#Z3d$Z4d%Z5ied&ed'ed(ed)ed*ed+ed,e d-e!d.e"d/e#d0e$d1e%d2e&d3e'd4e(d5e)d6e*d7e+d8e,d9e-d:e.d;e/de2d?e3d@e4dAe5dBi Z6dCa7dDZ8dEZ9dFZ:dxdGZ;dxdHZdKZ?dLZ@dMZAGdNdOeZBGdPdQeBZCGdRdSeCZDGdTdUeBZEGdVdWeEZFGdXdYeEZGGdZd[ZHGd\d]eEZIGd^d_eEZJGd`daeCZKGdbdceKZLGdddeeEZMGdfdgeBZNGdhdieBZOGdjdkeEZPGdldmeEZQGdndoeEZRGdpdqeEZSGdrdseCZTGdtdueBZUGdvdwZVy#e$r ddlmZYwxYw)y)print_function)MutableMapping)strftimeN)reduce)lib _RAW_CB_TYPE _LOST_CB_TYPE_RINGBUF_CB_TYPEbcc_perf_buffer_opts)get_online_cpus)get_possible_cpus HASHARRAY PROG_ARRAYPERF_EVENT_ARRAY PERCPU_HASH PERCPU_ARRAY STACK_TRACE CGROUP_ARRAYLRU_HASHLRU_PERCPU_HASHLPM_TRIE ARRAY_OF_MAPS HASH_OF_MAPSDEVMAPSOCKMAPCPUMAPXSKMAPSOCKHASHCGROUP_STORAGEREUSEPORT_SOCKARRAYPERCPU_CGROUP_STORAGEQUEUESTACK SK_STORAGE DEVMAP_HASH STRUCT_OPSRINGBUF INODE_STORAGE TASK_STORAGE(Aicnd}d} |||z|z dz kDs||dz kDrn |dz }|dz }"||kDr|dddz}|S)Nrr*+)valval_maxwidthitexts +/usr/lib/python3/dist-packages/bcc/table.py_starsrVcsf A D w&!+ +UQY    Q  W}CRy3 Kct||dS)N)section_bucket)_get_json_hist)valsval_typerYs rU get_json_histr]os $ >>rWcbg}d}tt|D] }||dk7s |}d}d}tt|D]O}|dk7s ||ks|dz}i}||d<t|dz |d<t|||d<|j||}Qt d||d} |r |d| |d<| S) Nrrrzinterval-startz interval-endcountz%Y-%m-%d %H:%M:%S)tsr\data)rangelenintappendr) r[r\rY hist_listmax_nonzero_idxrSindexprevlist_obj histograms rUrZrZrsIO 3t9   7a<O  E D 3t9   6a?*AIEH)-H% &'*5zA~H^ $ #DG HW    X &D  34(T]^I'5a'8 .#$ rWc d}d}d}t|D]\}}|dkDr|}||kDs|}|dkr d}d} t} nd}d} ttd z } |dkDrt||zt d |d zD]e}d |zd z } d |zd z } | | k(r| d z} ||} |r$| s't| | | | | t | || fzd }Ht| | | | | t | || fzgy) N@rMr z# %-19s : count distributionz%10d -> %-10d : %-8d |%-*s|z- %-29s : count distributionz%20d -> %-20d : %-8d |%-*s|rrF) enumerate stars_maxrdprintrbrV)r[r\strip_leading_zero log2_dist_maxidx_maxrQrSvheaderbodystarslowhighrPs rU_print_log2_histr{s+MGG$$1 q5A' w;!$"}6,@,IM"{ fx 1gk "8Av!mQ!| 4K 1HC1g dc4e$S'59;;<%*" $#tS% gu577 88rWc Dd}d}d}t|D]\}}|dkDr|}||kDs|}d}d} t} |dk\rt||ztd|dzD]I}||} |r#| s t| || | t | || fzd}-t| || | t | || fzKy)NrmrMrz# %-13s : count distributionz %-10d : %-8d |%-*s|rF)rorprqrbrV) r[r\rrrsrtrQrSrurvrwrxrPs rU_print_linear_histr}sMGG$$1 q5A' w;!$3F (D E!| fx 1gk " <1g dae$S'59;;<%*"dae$S'59;;< ) map_type_nameKeyError)ttypes rUget_table_type_namers$U## s  c idtjdtjdtjdtjdtjdtjdtjdtjd tj d tj d tj d tj d tj dtjdtjdtjdtjtjtjtjtjtjdztjdztjd}tjd}g}tj |j"j$|j&}d}||kr tj(|j"j$|j&|j+}tj,d|}|j/d}|j/d} tj,d| rd } |j-| } |rA|j1|||j/dt3|j/dzfn|j1||| f|dz }||kr t?dtj@fd|iS#t4$r6t7d| zt8j:t9j<dYhwxYw)Nchars8z unsigned charu8zu8 *zchar *shorts16zunsigned shortu16rds32enumz unsigned intu32longz unsigned longr)z long longs64zunsigned long longu64__int128zunsigned __int128zvoid *z(\S+(?: \S+)*) ?\[([0-9]+)\]$rz (.*)#(.*)rzenum .*zGType: '%s' not recognized. Please define the data with ctypes manually.)filerK_fields_)!ctc_charc_ubytec_char_pc_shortc_ushortc_intc_uintc_longc_ulong c_longlong c_ulonglongc_void_precompilerbpf_perf_event_fieldsbpfmodule_namebpf_perf_event_fielddecodematchgrouprerdrrqsysstderrexittype Structure) event_map ct_mapping array_typefields num_fieldsrSfieldm field_name field_types rU_get_event_classrsbii bii bjj bjj  bkk  bkk  bjj bjj bkk bkk bhh bhh bhh bii bii bii!" bjj#$!mm mm nn nn!}}q0!~~1 kk1J8<=J F**9==+?+?QJ A j.(()=)=yPQRYY[ HH\5 )WWQZ WWQZ 88J +J   Z (  z:aggaj+ACPQ O+STU z:j+ABC Q+ j., R\\Oj&%9 ::  [%(ZZ 1 HHQK  sALk(rtA|||||}nS|tBk(rtE|||||}n:|tFk(s |tHk(rtK||||}n|tLk(rtO||||||}|dk(rtQd|z|S)z|Table(bpf, map_id, map_fd, keytype, leaftype, **kwargs) Create a python object out of a reference to a bpf table handleNzUnknown table type %d))rbpf_table_type_idrBPF_MAP_TYPE_HASH HashTableBPF_MAP_TYPE_ARRAYArrayBPF_MAP_TYPE_PROG_ARRAY ProgArrayBPF_MAP_TYPE_PERF_EVENT_ARRAYPerfEventArrayBPF_MAP_TYPE_PERCPU_HASH PerCpuHashBPF_MAP_TYPE_PERCPU_ARRAY PerCpuArrayBPF_MAP_TYPE_LPM_TRIELpmTrieBPF_MAP_TYPE_STACK_TRACE StackTraceBPF_MAP_TYPE_LRU_HASHLruHashBPF_MAP_TYPE_LRU_PERCPU_HASH LruPerCpuHashBPF_MAP_TYPE_CGROUP_ARRAY CgroupArrayBPF_MAP_TYPE_DEVMAPDevMapBPF_MAP_TYPE_CPUMAPCpuMapBPF_MAP_TYPE_XSKMAPXskMapBPF_MAP_TYPE_ARRAY_OF_MAPS MapInMapArrayBPF_MAP_TYPE_HASH_OF_MAPS MapInMapHashBPF_MAP_TYPE_QUEUEBPF_MAP_TYPE_STACK QueueStackBPF_MAP_TYPE_RINGBUFRingBuf Exception) rmap_idmap_fdkeytypeleaftypenamekwargsrts rUTablers6  ! !#**f 5E A !! c667H = $ $ #vvw 9 ) ) c667H = / / 34 H * * sFFGX H H + + VVWh I& I ' ' C( ; * * sFFGX > ' ' C( ; . . #vvw A + + VVWh ? % % 3 : % % 3 : % % 3 : , , #vvw A + + ffgx @ $ $1C(C sFFH 5 & & C(D ADy/%788 HrWceZdZd"dZdZdZdZdZdZdZ d Z d Z d Z d Z d ZdZdZd#dZd$dZdZd"dZdZdZd%dZdZdZdZdZGddeZdZefdZ d&dZ! d'd Z" d'd!Z#y)( TableBaseNc||_||_||_||_||_t j |jj|j|_t j|jj|j|_ i|_ ||_ tt j|jj|j|_yN)rrrKeyLeafrrrrbpf_table_flags_idflags_cbsrrdbpf_table_max_entries_id max_entries)selfrrrrrrs rU__init__zTableBase.__init__Bs   **488??DKKH ++DHHOOT[[I   s;;DHHOO  rWc|jSr)rrs rUget_fdzTableBase.get_fdOs {{rWc Jtjtj|jdz}t j |j j|j|t|tj|}|dkr td|jS)NrrzCould not printf key) rcreate_string_buffersizeofrrbpf_table_key_snprintfrrrrcbyrefrvalue)rkeybufress rU key_sprintfzTableBase.key_sprintfRsu%%bii&9A&=>(($++s),S288C=B 723 3yyrWc Jtjtj|jdz}t j |j j|j|t|tj|}|dkr td|jSNrrzCould not printf leaf rrrrrbpf_table_leaf_snprintfrrrrcrrrrleafrrs rU leaf_sprintfzTableBase.leaf_sprintfZu%%bii &:Q&>?))$((//4;;*-c(BHHTND 734 4yyrWc|j}tj|jj|j |t j|}|dkr td|S)NrzCould not scanf key) rrbpf_table_key_sscanfrrrrrr)rkey_strrrs rU key_scanfzTableBase.key_scanfbsRhhj&&txx W')xx}6 712 2 rWc|j}tj|jj|j |t j|}|dkr td|SNrzCould not scanf leaf rrbpf_table_leaf_sscanfrrrrrrrleaf_strrrs rU leaf_scanfzTableBase.leaf_scanfjRyy{''h(*8 723 3 rWc|j}tj|jt j |t j |}|dkrt |SNrrrbpf_lookup_elemrrrrrrrrs rU __getitem__zTableBase.__getitem__rsFyy{!!$++rxx}bhhtnM 7N rWctj|jtj|tj|d}|dkr5t j tj}td|zy)NrzCould not update table: %s rbpf_update_elemrrrosstrerror get_errnor)rrrrerrstrs rU __setitem__zTableBase.__setitem__ys]!!$++rxx}bhhtnaP 7[[0F86AB B rWctj|jtj|}|dkrt yr)rbpf_delete_elemrrrr)rrrs rU __delitem__zTableBase.__delitem__s1!!$++rxx}= 7N rWc#HK|D] } || y#t$rYwxYwwrrrrs rU itervalueszTableBase.itervaluess6 C 3i     s"" ""c#LK|D] } |||fy#t$rYwxYwwrr)r*s rU iteritemszTableBase.iteritemss< C DI&&   s$ $ !$!$cH|jDcgc]}|c}Scc}wr)r-)ritems rUitemszTableBase.itemss!%!12222 cH|jDcgc]}|c}Scc}wrr+rrs rUvalueszTableBase.values#'??#45%555r1cP|jD]}|j|yr)keysr'rks rUclearzTableBase.clears% A   Q  rWc&dx}}|s|stjdddfS|s |j}n|dks||jkDr td|r|j|z}|r|j |z}tj|||fS)aAllocate keys and/or values arrays. Useful for in items_*_batch. Args: alloc_k (bool): True to allocate keys array, False otherwise. Default is False. alloc_v (bool): True to allocate values array, False otherwise. Default is False. count (int): number of elements in the array(s) to allocate. If count is None then it allocates the maximum number of elements i.e self.max_entries. Returns: tuple: (count, keys, values). Where count is ct.c_uint32, and keys and values an instance of ct.Array Raises: ValueError: If count is less than 1 or greater than self.max_entries. Nrrz Wrong count)rc_uint32r ValueErrorrr)ralloc_kalloc_vr_r8r5s rU_alloc_keys_valueszTableBase._alloc_keys_valuess&vwKKND$/ /$$E QY%$"2"22]+ + $DHHu$'D 'dii%'*F E"D&11rWc(d}||fD]O}|st|tjstt |}|dks||j kDsFt d|r$|r"t |t |k7r t dtj|S)aCheck if the given keys or values have the right type and size. Args: keys (ct.Array): keys array to check values (ct.Array): values array to check Returns: ct.c_uint32 : the size of the array(s) Raises: ValueError: If length of arrays is less than 1 or greater than self.max_entries, or when both arrays length are different. TypeError: If the keys and values are not an instance of ct.Array rrzArray's length is wrongz(keys array length != values array length) isinstancerr TypeErrorrcrr>r=)rr8r5arr_lenelems rU_sanity_check_keys_valuesz#TableBase._sanity_check_keys_valuess6N @D!$1#Od)Q;'D,<,<"<$%>?? @ F4yCK' !KLL{{7##rWc#LK|jdD] \}}||f yw)aLook up all the key-value pairs in the map. Args: None Yields: tuple: The tuple of (key,value) for every entries that have been looked up. Notes: lookup batch on a keys subset is not supported by the kernel. FdeleteN)_items_lookup_and_optionally_delete_batchrr:rus rUitems_lookup_batchzTableBase.items_lookup_batchs5BB%BP DAqQK "$cX||j|}tj|jt j |t j |}|dk7r3t dtjt jzy|jD]}yy)aDelete the key-value pairs related to the keys given as parameters. Note that if no key are given, it is faster to call lib.bpf_lookup_and_delete_batch than create keys array and then call lib.bpf_delete_batch on these keys. Args: ct_keys (ct.Array): keys array to delete. If an array of keys is given then it deletes all the related keys-values. If keys is None (default) then it deletes all entries. Yields: tuple: The tuple of (key,value) for every entries that have been deleted. Raises: Exception: If bpf syscall return value indicates an error. N)r8rz#BPF_MAP_DELETE_BATCH has failed: %s) rGrbpf_delete_batchrrrrr r!r"items_lookup_and_delete_batch)rct_keysct_cntr_s rUitems_delete_batchzTableBase.items_delete_batchs  333AF&&t{{')xx'8')xx'7)Cq E"$++blln"=!>?? 779  rWcP|j||}tj|jt j |t j |t j |}|dk7r3t dtjt jzy)aqUpdate all the key-value pairs in the map provided. The arrays must be the same length, between 1 and the maximum number of entries. Args: ct_keys (ct.Array): keys array to update ct_values (ct.Array): values array to update Raises: Exception: If bpf syscall return value indicates an error. )r8r5rz#BPF_MAP_UPDATE_BATCH has failed: %sN) rGrbpf_update_batchrrrrr r!r")rrS ct_valuesrTrs rUitems_update_batchzTableBase.items_update_batchs//WY/O""4;;#%88G#4#%88I#6#%88F#3% 1HA kk",,.9:; ; rWc#LK|jdD] \}}||f yw)a?Look up and delete all the key-value pairs in the map. Args: None Yields: tuple: The tuple of (key,value) for every entries that have been looked up and deleted. Notes: lookup and delete batch on a keys subset is not supported by the kernel. TrINrKrMs rUrRz'TableBase.items_lookup_and_delete_batch#s5BB$BO DAqQK rOc #ZK|durtj}d}ntj}d}|jdd\}}}t j dx}}d} |j | z |_||j| rt j|ndt j|t j|t j|j| zt j|t j|j| zt j|} t j} | |j z } | dk7r6| tjk7r#t|dt!j"| | dk7rn"| |j k(rn|j dk(rnVt%d| D]h} || } || }t'| tj(s|j| } t'|tj(s|j|}| |fjyw)aLook up and optionally delete all the key-value pairs in the map. Args: delete (bool) : look up and delete the key-value pairs when True, else just look up. Yields: tuple: The tuple of (key,value) for every entries that have been looked up and deleted. Raises: Exception: If bpf syscall return value indicates an error. Notes: lookup and delete batch on a keys subset is not supported by the kernel. TBPF_MAP_LOOKUP_AND_DELETE_BATCHBPF_MAP_LOOKUP_BATCH)r?r@rNz has failed: )rbpf_lookup_and_delete_batchbpf_lookup_batchrArr=rrrrrrr"errnoENOENTrr r!rbrCr)rrJ bpf_batchbpf_cmd ct_buf_sizerSrY ct_out_batchrTtotalrerrcoderSr:rus rUrLz3TableBase._items_lookup_and_optionally_delete_batch2s T>77I7G,,I,G+/*A*A$JN+B+P' Wi " A. v&,,u4FLDKK6;BHH\2HH\2HHWbii.AE.IJHHY $))0Du0LMHHV, CllnG V\\ !EqW 4w79{{77K!MNNax )))||q 14q% A A! Aa.HHQKa.IIaLa&L sH)H+cft|jD]}|j||<yr)listr8rr9s rUzerozTableBase.zeroos- diik" "AiikDG "rWc,tj|Sr)rIterrs rU__iter__zTableBase.__iter__ws~~d##rWc"|jSrrnrs rUiterzTableBase.iterz 4==?*rWc"|jSrrprs rUr8zTableBase.keys{rrrWc$eZdZdZdZdZdZy)TableBase.Iterc ||_d|_yr)tabler)rrws rUrzTableBase.Iter.__init__~sDJDHrWc|SrrOrs rUrnzTableBase.Iter.__iter__KrWc"|jSrnextrs rU__next__zTableBase.Iter.__next__99; rWcn|jj|j|_|jSr)rwr|rrs rUr|zTableBase.Iter.nexts#zztxx0DH88OrWN__name__ __module__ __qualname__rrnr}r|rOrWrUrmru}s    rWrmcz|j}|Rtj|jt j |t j |j}nGtj|jt j |t j |}|dkr t|Sr) rrbpf_get_first_keyrrrrbpf_get_next_key StopIteration)rrnext_keyrs rUr|zTableBase.nexts88: ;'' RXXh5G(* $(((;=C&&t{{BHHSM')xx'9;C 7/ !rWc8|jjdd}|jjdd}|dk(r>t|jjdk(r|jjdd}|jD]Q\}} t ||} |r|| } |j | dg|zx} || <t ||} | j | | <St|j} |r|| } | D]} |j| y)Nrr__pad_1rr) rrrcr0getattrgetrrjr8re)rtmpbuckets bucket_fnbucket_sort_fn index_maxf1f2r:rubucketr[slot buckets_lsts rUdecode_c_structzTableBase.decode_c_structs XX  q !! $ XX  q !! $ ?s488#4#45:""1%a(BJJL !DAqQ^F"6*!$!y!A AD3v;1b>DDJ  !388:& (5K! #F NN6 " #rWct|jtjrLi}g}|j |||||D].}||} |r |||f} n||f} t t | || 0ydgtz} |jD]\} } | j| | j< t t | |y)a.print_json_hist(val_type="value", section_header="Bucket ptr", section_print_fn=None, bucket_fn=None, bucket_sort_fn=None): Prints a table as a json histogram. The table must be stored as log2. The val_type argument is optional, and is a column header. If the histogram has a secondary key, the dictionary will be split by secondary key If section_print_fn is not None, it will be passed the bucket value to format into a string as it sees fit. If bucket_fn is not None, it will be used to produce a bucket value for the histogram keys. If bucket_sort_fn is not None, it will be used to sort the buckets before iterating them, and it is useful when there are multiple fields in the secondary key. The maximum index allowed is log2_index_max (65), which will accommodate any 64-bit integer in the histogram. rN) rCrrrrrqrZlog2_index_maxr0r) rr\section_headersection_print_fnrrrrrr[rYr:rus rUprint_json_histzTableBase.print_json_hists$ dhhj",, /CG  gy. I! F6{#&46Fv6N%ON&4f%=NnT8^DE  F3'D  (1 !QWW  ( .x0 1rWc t|jtjr]i}g}|j |||||D]?} || } |rt d|d|| nt d|d| t | ||Aydgtz} |jD]\} } | j| | j< t | ||y)aprint_log2_hist(val_type="value", section_header="Bucket ptr", section_print_fn=None, bucket_fn=None, strip_leading_zero=None, bucket_sort_fn=None): Prints a table as a log2 histogram. The table must be stored as log2. The val_type argument is optional, and is a column header. If the histogram has a secondary key, multiple tables will print and section_header can be used as a header description for each. If section_print_fn is not None, it will be passed the bucket value to format into a string as it sees fit. If bucket_fn is not None, it will be used to produce a bucket value for the histogram keys. If the value of strip_leading_zero is not False, prints a histogram that is omitted leading zeros from the beginning. If bucket_sort_fn is not None, it will be used to sort the buckets before iterating them, and it is useful when there are multiple fields in the secondary key. The maximum index allowed is log2_index_max (65), which will accommodate any 64-bit integer in the histogram.   = rN) rCrrrrrqr{rr0r rr\rrrrrrrrrr[r:rus rUprint_log2_histzTableBase.print_log2_hists, dhhj",, /CG  gy. I! E6{#(023@A x1CD E3'D  (1 !QWW  ( T8-? @rWc t|jtjrbi}g}|j ||||t |D]?} || } |rt d|d|| nt d|d| t| ||Aydgt z} |jD]\} } | j| | j<!t| ||y#t$rtd| jt fzwxYw)aprint_linear_hist(val_type="value", section_header="Bucket ptr", section_print_fn=None, bucket_fn=None, strip_leading_zero=None, bucket_sort_fn=None) Prints a table as a linear histogram. This is intended to span integer ranges, eg, from 0 to 100. The val_type argument is optional, and is a column header. If the histogram has a secondary key, multiple tables will print and section_header can be used as a header description for each. If section_print_fn is not None, it will be passed the bucket value to format into a string as it sees fit. If bucket_fn is not None, it will be used to produce a bucket value for the histogram keys. If the value of strip_leading_zero is not False, prints a histogram that is omitted leading zeros from the beginning. If bucket_sort_fn is not None, it will be used to sort the buckets before iterating them, and it is useful when there are multiple fields in the secondary key. The maximum index allowed is linear_index_max (1025), which is hoped to be sufficient for integer ranges spanned. rrrz5Index in print_linear_hist() of %d exceeds max of %d.N) rCrrrrlinear_index_maxrqr}r0r IndexErrorrs rUprint_linear_histzTableBase.print_linear_hists, dhhj",, /CG  gy.JZ [! G6{#(023@A"43EF G3))D  M1M$%GGDM M tX/A B "M%'-12:J0K&LMMMs ,C(C=r)FFN)NN)T)r Bucket ptrNNN)rrNNNN)$rrrrrrr rrrr$r'r+r-r0r5r;rArGrNrVrZrRrLrkrnrqr8objectrmr|rrrrrrOrWrUrr@s C 36 !2F$< <;* ;z"$+* v  R`#.@LNR"2H@LFJ&APBNFJ-CrWrc$eZdZfdZdZxZS)rc,tt| |i|yr)superrrrargsr __class__s rUrzHashTable.__init__+ i'88rWc"d}|D]}|dz } |SNrrrOrrSr:s rU__len__zHashTable.__len__. AqAvqrWrrrrr __classcell__rs@rUrr*s 9rWrceZdZfdZxZS)rc,tt| |i|yr)rrrrs rUrzLruHash.__init__4 gt%t6v6rWrrrrrrs@rUrr3s 77rWrcjeZdZfdZdZdZfdZfdZfdZdZ dZ Gd d e Z xZ S) ArrayBasec,tt| |i|yr)rrrrs rUrzArrayBase.__init__8rrWct|tr$|dkrt||z}|j|}t|tj s t d|jt|k\r t d|S)Nrz#Array index must be an integer typezArray index out of range)rCrdrcrr _SimpleCDatarrr*s rU_normalize_keyzArrayBase._normalize_key;sh c3 Qw$i#o((3-C#r/BC C 99D !78 8 rWc|jSr)rrs rUrzArrayBase.__len__FsrWcL|j|}tt||Sr)rrrrrrrs rUrzArrayBase.__getitem__Is%!!#&Y1#66rWcP|j|}tt|||yr)rrrr$rrrrs rUr$zArrayBase.__setitem__Ms$!!#& i*35rWcN|j|}tt||yr)rrrr'rs rUr'zArrayBase.__delitem__Qs"!!#& i*3/rWc|j|}|j}tj|jt j |t j |d}|dkr tdy)NrzCould not clear item)rrrrrrrrrs rU clearitemzArrayBase.clearitemUs_!!#&yy{!!$++rxx}bhhtnaP 723 3 rWcBtj||jSr)rrmrrs rUrnzArrayBase.__iter__\s~~dDHH--rWc$eZdZdZdZdZdZy)ArrayBase.Iterc.||_||_d|_yNrM)rrwrS)rrwrs rUrzArrayBase.Iter.__init__`sDHDJDFrWc|SrrOrs rUrnzArrayBase.Iter.__iter__eryrWc"|jSrr{rs rUr}zArrayBase.Iter.__next__gr~rWc|xjdz c_|jt|jk(r t|j |jSNr)rSrcrwrrrs rUr|zArrayBase.Iter.nextis> FFaKFvvTZZ(#o%88DFF# #rWNrrOrWrUrmr_s     $rWrm)rrrrrrrr$r'rrnrrmrrs@rUrr7s<9  7604.$v$$rWrc$eZdZfdZdZxZS)rc,tt| |i|yr)rrrrs rUrzArray.__init__ps eT#T4V4rWc&|j|yrrr*s rUr'zArray.__delitem__s srW)rrrrr'rrs@rUrros 5rWrc(eZdZfdZfdZxZS)rc,tt| |i|yr)rrrrs rUrzProgArray.__init__xrrWct|tr|j|}t||jjr|j|j }t t|#||yr) rCrdrrFunctionfdrrr$rs rUr$zProgArray.__setitem__{sQ dC 99T?D dDHH-- .99TWW%D i*35rWrrrrr$rrs@rUrrws966rWrc*eZdZdZdZdZdZdZy)FileDescc6||dkr td||_y)NrzInvalid file descriptor)rr)rrs rUrzFileDesc.__init__s JBF56 6rWc|j7|jdk\r'tj|jd|_yyyr)rr closers rUclean_upzFileDesc.clean_ups5 GG dggl HHTWW DG'3 rWc$|jyrrrs rU__del__zFileDesc.__del__  rWc|SrrOrrrs rU __enter__zFileDesc.__enter__s rWc$|jyrrrs rU__exit__zFileDesc.__exit__rrWN)rrrrrrrrrOrWrUrrs  rWrc(eZdZfdZfdZxZS)rc,tt| |i|yr)rrrrs rUrzCgroupArray.__init__s k4)4:6:rWct|tr$tt|||j |yt|t rdttj|tj5}tt|||j |jdddytd#1swYyxYw)Nz1Cgroup array key must be either FD or cgroup path) rCrdrrr$rstrrr openO_RDONLYrr)rrrfrs rUr$zCgroupArray.__setitem__s dC +t 0diio F c ""''$ 45 Kk44S$))ADD/J K KOP P K Ks 3.B55B>rrs@rUrrs;QQrWrcReZdZfdZdZfdZdZd dZdZd dZ d dZ xZ S) rcHtt| |i|i|_d|_yr)rrr _open_key_fds _event_classrs rUrzPerfEventArray.__init__s' nd,d=f= rWc^t|jj}|D]}||=yr)rjrr8)rr8rs rUrzPerfEventArray.__del__s1D&&++-. CS  rWc||jvrytt||t ||f}||j j vrQtj|j j ||j j |=|j|=n"tj|j||j|=yr) rrrr'idr perf_buffersrperf_reader_freerbpf_close_perf_event_fd)rrkey_idrs rUr'zPerfEventArray.__delitem__s d(( (  nd/4T(C TXX** *  !6!6v!> ?%%f- #  ' '(:(:3(? @   s #rWc|jdk(rt||_tj|tj|jj S)a event(data) When perf buffers are opened to receive custom perf event, the underlying event data struct which is defined in C in the BPF program can be deduced via this function. This avoids redundant definitions in Python. NrrrcastPOINTERcontentsrras rUeventzPerfEventArray.eventE    $ 0 6D wwtRZZ(9(9:;DDDrWcx||dz zdk7r tdtD]}|j|||||y)azopen_perf_buffers(callback) Opens a set of per-cpu ring buffer to receive custom perf event data from the bpf program. The callback will be invoked for each event submitted from the kernel, up to millions per second. Use page_cnt to change the size of the per-cpu ring buffer. The value must be a power of two and defaults to 8. rrz+Perf buffer page_cnt must be a power of twoN)rr _open_perf_buffer)rcallbackpage_cntlost_cb wakeup_eventsrSs rUopen_perf_bufferzPerfEventArray.open_perf_buffersK x!| $ )IJ J " RA  " "1h'= Q RrWc ,fd}fd}t|}r t|ntjdt} t } d| _| _|| _tj|| d|tj| } | s tdtj| } |j| ||j<| |jj t#|f<|| f|j$<d|j&<y)Nc ||y#t$r4}|jtjk(r tn|Yd}~yd}~wwxYwrIOErrorraEPIPEr)rUrasizeercpus rUraw_cb_z1PerfEventArray._open_perf_buffer..raw_cb_sC dD) 77ekk)FG s  A *AA c |y#t$r4}|jtjk(r tn|Yd}~yd}~wwxYwrr)rUlostrr s rUlost_cb_z2PerfEventArray._open_perf_buffer..lost_cb_s>   77ekk)FG s A *AA rMzCould not open perf buffer)r r rrr pidrr rbpf_open_perf_buffer_optsrrperf_reader_fdrrrrrrr) rrrr r r rrfnlost_fnoptsreaderrs `` ` rUrz PerfEventArray._open_perf_buffers  ' "-4-)"''$ :V#%*..r7D(BHHUYN[89 9    '"iimTXXc]17r$xo.g #"$3rWctj||||}|dkr td|j|||j |<||j |<y)Nrzbpf_open_perf_event failed)rbpf_open_perf_eventrrrr)rrtypconfigrrs rU_open_perf_eventzPerfEventArray._open_perf_eventsU  $ $S&#s ; 689 9"iimTXXc]"$3rWcJtD]}|j||||y)zopen_perf_event(typ, config) Configures the table such that calls from the bpf program to table.perf_read(CUR_CPU_IDENTIFIER) will return the hardware counter denoted by event ev on the local cpu. N)r r$)rr"r#rrSs rUopen_perf_eventzPerfEventArray.open_perf_events*!" 7A  ! !!S&# 6 7rW)rNr)rM) rrrrrr'rr rr$r&rrs@rUrrs.!  $ ER %D%7rWrcJeZdZfdZfdZdZfdZdZdZdZ xZ S)rcj|jdd|_tt||i||j |_tt|_ tj|j dz|_ |jdk(r|j |jz|_y|j tjk(r#tj|jz|_y|j tjk(r#tj |jz|_yt#dNreducerrrzLeaf must be aligned to 8 bytes)popr*rrrrsLeafrcr total_cpurr alignmentrc_uint64rc_int64rrs rUrzPerCpuHash.__init__szz)T2  j$($9&9YY .014::.2 >>Q  T^^3DIzzRYY&KK$..8 rxx'JJ7  !BCCrWctt| |}|jdk(r|}|S|j|j z}t d|j D] }||||< |Sr)rrrr.r,r-rbrrresultretrSrs rUgetvaluezPerCpuHash.getvalue#sqz44S9 >>Q C  /4::.1C1dnn- #A # rWc|jr%t|j|j|S|j|Srr*rr5r*s rUrzPerCpuHash.__getitem__-s2 <<$,, c(:; ;==% %rWc.tt| ||yr)rrr$rs rUr$zPerCpuHash.__setitem__3s j$+C6rWct|jtjr t d|j t |j|SNz6Leaf must be an integer type for default sum functionsrCrrrrr,sumr5r*s rUr<zPerCpuHash.sum6? diik2<< 0UV Vzz#dmmC0122rWct|jtjr t d|j t |j|SNz6Leaf must be an integer type for default max functionsrCrrrrr,maxr5r*s rUrAzPerCpuHash.max;r=rWcV|j|}|j|jz Srr<rr-rrr3s rUaveragezPerCpuHash.average@"#||dnn,,rW) rrrrr5rr$r<rArErrs@rUrrs'D$& 73 3 -rWrceZdZfdZxZS)rc,tt| |i|yr)rrrrs rUrzLruPerCpuHash.__init__E mT+T>Q  T^^3DIzzRYY&KK$..8 rxx'JJ7  !BCCrWctt| |}|jdk(r|}|S|j|j z}t d|j D] }||||< |Sr)rrrr.r,r-rbr2s rUr5zPerCpuArray.getvalue[sq{D5c: >>Q C  /4::.1C1dnn- #A # rWc|jr%t|j|j|S|j|Srr7r*s rUrzPerCpuArray.__getitem__es2 LL$,, c(:; ;==% %rWc.tt| ||yr)rrr$rs rUr$zPerCpuArray.__setitem__ks k4,S$7rWc&|j|yrrr*s rUr'zPerCpuArray.__delitem__nrrWct|jtjr t d|j t |j|Sr:r;r*s rUr<zPerCpuArray.sumrr=rWct|jtjr t d|j t |j|Sr?r@r*s rUrAzPerCpuArray.maxwr=rWcV|j|}|j|jz SrrCrDs rUrEzPerCpuArray.average|rFrW) rrrrr5rr$r'r<rArErrs@rUrrHs,D$& 83 3 -rWrc$eZdZfdZdZxZS)rc,tt| |i|yr)rrrrs rUrzLpmTrie.__init__rrWctr)NotImplementedErrorrs rUrzLpmTrie.__len__s!!rWrrs@rUrrs 7"rWrc\eZdZdZdZdZdZdZfdZGdde Z d d Z d Z d Z xZS) rrnrrrc,tt| |i|yr)rrrrs rUrzStackTrace.__init__s j$($9&9rWc&eZdZddZdZdZdZy)StackTrace.StackWalkerNc<||_d|_||_||_yr)stacknresolver)rr^rr`s rUrzStackTrace.StackWalker.__init__sDJDF"DLDJrWc|SrrOrs rUrnzStackTrace.StackWalker.__iter__ryrWc"|jSrr{rs rUr}zStackTrace.StackWalker.__next__r~rWc$|xjdz c_|jtjk(r t|jtj zrg|j j|j}|jtjk(s|jtjk(r-t|j j|j}|dk(r t|jr|j|S|S)Nrr) r_r MAX_DEPTHrrBPF_F_STACK_BUILD_IDr^tracestatusBPF_STACK_BUILD_ID_IPBPF_STACK_BUILD_ID_EMPTYipr`)raddrs rUr|zStackTrace.StackWalker.nexts FFaKFvv---#o%zzJ;;;ZZ%%dff-d @ @@ C CC%'ZZ]]466*dqy#o%)-4<<% ?4 ?rWrrrOrWrU StackWalkerr\s     @rWrlchtj||j||j|Sr)rrlrr)rstack_idr`s rUwalkzStackTrace.walks)%%d488H+=&> GTTrWc"d}|D]}|dz } |SrrOrs rUrzStackTrace.__len__rrWcyrrOrs rUr;zStackTrace.clear rWr)rrrrdreriBPF_STACK_BUILD_ID_VALIDrhrrrlrorr;rrs@rUrrsCI  ! :@f@>U  rWrceZdZfdZxZS)rc,tt| |i|yr)rrrrs rUrzDevMap.__init__ fd$d5f5rWrrs@rUrr 66rWrceZdZfdZxZS)rc,tt| |i|yr)rrrrs rUrzCpuMap.__init__rvrWrrs@rUrrrwrWrceZdZfdZxZS)rc,tt| |i|yr)rrrrs rUrzXskMap.__init__rvrWrrs@rUrrrwrWrceZdZfdZxZS)rc,tt| |i|yr)rrrrs rUrzMapInMapArray.__init__rIrWrrs@rUrrrJrWrceZdZfdZxZS)rc,tt| |i|yr)rrrrs rUrzMapInMapHash.__init__s lD*D;F;rWrrs@rUrrs <eZdZfdZdZdZdZdZddZxZ S)rcHtt| |i|d|_d|_yr)rrr_ringbufrrs rUrzRingBuf.__init__s& gt%t6v6  rWcyrrOr*s rU __delitemzRingBuf.__delitemrrrWcyrrOrs rUrzRingBuf.__del__rrrWcyrrOrs rUrzRingBuf.__len__srWc|jdk(rt||_tj|tj|jj S)aevent(data) When ring buffers are opened to receive custom event, the underlying event data struct which is defined in C in the BPF program can be deduced via this function. This avoids redundant definitions in Python. Nrrs rUrz RingBuf.eventrrWcfd}t|}|jj|j||||jd<y)zopen_ring_buffer(callback) Opens a ring buffer to receive custom event data from the bpf program. The callback will be invoked for each event submitted from the kernel, up to millions per second. c |||} t|}|S#d}Y|SxYw#t$r5}|jtjk(r t n|Yd}~Sd}~wwxYwr)rdrrarr)ctxrarr4rrs rU ringbuf_cb_z-RingBuf.open_ring_buffer..ringbuf_cb_su sD$/c(CJC J  77ekk)FGJ  s$ % "%% A#*AA#rN)r r_open_ring_bufferrr)rrrrrs ` rUopen_ring_bufferzRingBuf.open_ring_buffers; "k * ""4;;C8 ! rWr) rrrr_RingBuf__delitemrrrrrrs@rUrrs"!    ErWrcBeZdZdZdZdZdZd dZdZdZ dZ d Z y ) rrc||_||_||_||_t j |jj |j|_t j|jj |j|_ tt j|jj |j|_ yr) rrrrrrrrrrrdrr)rrrrrs rUrzQueueStack.__init__ s   **488??DKKH ++DHHOOT[[I s;;DHHOO  rWc Jtjtj|jdz}t j |j j|j|t|tj|}|dkr td|jSrrrs rUr zQueueStack.leaf_sprintfr rWc|j}tj|jj|j |t j|}|dkr td|Srrrs rUrzQueueStack.leaf_scanfrrWctj|jdtj||}|dkr5t j tj}td|zy)NrzCould not push to table: %sr)rrrrr#s rUpushzQueueStack.push'sU!!$++tRXXd^UK 7[[0F9FBC C rWc|j}tj|jdt j |}|dkr t d|S)NrzCould not pop from table)rrbpf_lookup_and_deleterrrrrrrs rUr+zQueueStack.pop-sEyy{'' T288D>J 756 6 rWc|j}tj|jdt j |}|dkr t d|S)NrzCould not peek tablerrs rUpeekzQueueStack.peek4sEyy{!!$++tRXXd^D 712 2 rWc#~K|j}|r |j|dz}|ryy#t$rYywxYwwr)rr+r)rcnts rUr+zQueueStack.itervalues;sF hhj!q  s =.== :=:=cH|jDcgc]}|c}Scc}wrr3r4s rUr5zQueueStack.valuesEr6r1N)r) rrr BPF_EXISTrr rrr+rr+r5rOrWrUrr s0ID 6rWrr)W __future__rcollections.abcr ImportError collectionstimerctypesr functoolsrr rarrlibbccrr r r r utilsr rrrrrrrrrrrrrrrBPF_MAP_TYPE_SOCKMAPrrBPF_MAP_TYPE_SOCKHASHBPF_MAP_TYPE_CGROUP_STORAGE BPF_MAP_TYPE_REUSEPORT_SOCKARRAY"BPF_MAP_TYPE_PERCPU_CGROUP_STORAGErrBPF_MAP_TYPE_SK_STORAGEBPF_MAP_TYPE_DEVMAP_HASHBPF_MAP_TYPE_STRUCT_OPSrBPF_MAP_TYPE_INODE_STORAGEBPF_MAP_TYPE_TASK_STORAGErrprrrVr]rZr{r}rrrrrrrrrrrrrrrrrrrrrrrrrOrWrUrsW&+. \\"$ !! #% %'"v\"#5  m  ~ m~:!"3:~) !"#$:!1$&;&(?\m\)~; @   ?2$8L<:8;v- `gCgCT 7i76$ 6$pI 6 6( Q) Qi7Yi7X2-2-h=J=6-)6-p"i"2 2 h6Y66Y66Y6=I=<9<7i7r=6=6o'+**+sG G&%G&