+ iX^RIHt^RIt^RIt^RIt^RIt^RIt^RIt^RI t ^RI t ^RI t ^RI t ^RI HtHtHtHtHt^RIHtHtHtHtHt^RIHt^RIHtHtHtHtH t ^RI!H"t"^RI#H$t$H%t%^R I&H't'H(t(])R t,^s-R t.R t/]P`Pc]/R 4t2]P`Pg]24'gRt2^t4^t5^t6^t7^t8^ t9!RR]:4t;!RR4t<!RR4t=!RR4t>!RR4t?!RR4t@!RR4tA!RR4tB!RR 4tC!R!R"]:4tDR# ]*d]+t)Li;i)#)print_functionN)lib bcc_symbolbcc_symbol_optionbcc_stacktrace_build_id _SYM_CB_TYPE)TablePerfEventArrayRingBufBPF_MAP_TYPE_QUEUEBPF_MAP_TYPE_STACK)Perf)get_online_cpusprintb_assert_is_bytes ArgString StrcmpRewrite) __version__)disassemble_prog decode_map)USDT USDTExceptionic\#N)_num_open_probes./usr/lib/python3/dist-packages/bcc/__init__.py_get_num_open_probesr,s rz/sys/kernel/debugtracingz/sys/kernel/tracingc2a]tRt^DtoRtRtRtRtVtR#) SymbolCachec \P!V\P!R\P!\ 444VnR#r)rbcc_symcache_newctcastPOINTERrcache)selfpids&&r__init__SymbolCache.__init__Es/))RWWT2::.?#@AC rc \4pV'd8\P!VPV\P !V44pM6\P !VPV\P !V44pV^8dpVP'dYVP'dGRVP\P!VP\P4P3#RVR3#V'd8VPp\P!\P !V44M VPpWSP\P!VP\P4P3#)a Return a tuple of the symbol (function), its offset from the beginning of the function, and the module in which it lies. For example: ("start_thread", 0x202, "/usr/lib/.../libpthread-2.24.so") If the symbol cannot be found but we know which module it is in, return the module name and the offset from the beginning of the module. If we don't even know the module, return the absolute address as the offset. N)rrbcc_symcache_resolver(r%byref bcc_symcache_resolve_no_demanglemoduleoffsetr&c_char_pvalue demangle_namebcc_symbol_free_demangle_namename)r)addrdemanglesymresname_ress&&& rresolveSymbolCache.resolveIsl **4::tRXXc]KC66tzz479xx}FC 7zzzcjjjcjj BKK8>>@@$% % ((H  - -bhhsm <xxH**bggcjj"++&F&L&LMMrc\V4p\V4p\P!4p\P!VP W\P !V44^8dR#VP#)r)rr% c_ulonglongrbcc_symcache_resolve_namer(r/r4)r)r1r7r8s&&& r resolve_nameSymbolCache.resolve_namefsZ!&)%~~  ( (V "# $Izzr)r(N) __name__ __module__ __qualname____firstlineno__r+r=rC__static_attributes____classdictcell__ __classdict__s@rr"r"DsCN:rr"c.]tRt^ot^t^t^t^t^t^t Rt R#)PerfTyperN) rErFrGrHHARDWARESOFTWARE TRACEPOINTHW_CACHERAW BREAKPOINTrIrrrrNrNos HHJH CJrrNc>]tRt^xt^t^t^t^t^t^t ^t ^t ^t ^ t RtR#) PerfHWConfigrN)rErFrGrH CPU_CYCLES INSTRUCTIONSCACHE_REFERENCES CACHE_MISSESBRANCH_INSTRUCTIONS BRANCH_MISSES BUS_CYCLESSTALLED_CYCLES_FRONTENDSTALLED_CYCLES_BACKENDREF_CPU_CYCLESrIrrrrVrVxs8JLLMJNrrVcB]tRt^t^t^t^t^t^t^t ^t ^t ^t ^ t ^ tRtR#) PerfSWConfigrN)rErFrGrH CPU_CLOCK TASK_CLOCK PAGE_FAULTSCONTEXT_SWITCHESCPU_MIGRATIONSPAGE_FAULTS_MINPAGE_FAULTS_MAJALIGNMENT_FAULTSEMULATION_FAULTSDUMMY BPF_OUTPUTrIrrrrbrbs<IJKNOO EJrrbcz]tRt^t^t^t^t^t^t^ t ^@t ^t Rt Rt RtRtRtRtR tR tR tR tR tRtRtRtRtRtRtRtR#)PerfEventSampleFormatrNiiii i@iiiiiii i@ii)rErFrGrHIPTIDTIMEADDRREAD CALLCHAINIDCPUPERIOD STREAM_IDrS BRANCH_STACK REGS_USER STACK_USERWEIGHTDATA_SRC IDENTIFIER TRANSACTION REGS_INTR PHYS_ADDRAUXCGROUPDATA_PAGE_SIZECODE_PAGE_SIZE WEIGHT_STRUCTrIrrrroros B C D D DI B CFI CLIJFHJKII CFNNMrrocj]tRt^t^t^t^t^t^t^t ^t ^t ^ t ^ t ^ t^ t^ t^t^t^t^t^t^t^t^tRtR#) BPFProgTyperN)rErFrGrH SOCKET_FILTERKPROBE SCHED_CLS SCHED_ACTrQXDP PERF_EVENT CGROUP_SKB CGROUP_SOCKLWT_INLWT_OUTLWT_XMITSOCK_OPSSK_SKB CGROUP_DEVICESK_MSGRAW_TRACEPOINTCGROUP_SOCK_ADDRCGROUP_SOCKOPTTRACINGLSMrIrrrrrslM FIIJ CJJK FGHH FM FNNG Crrc]tRt^t^t^t^t^t^t^t ^t ^t ^t ^ t ^ t^ t^ t^ t^t^t^t^t^t^t^t^t^t^t^t^t^t^t^t ^t!^t"^t#^ t$^!t%^"t&^#t'^$t(^%t)^&t*Rt+R#) BPFAttachTyperN),rErFrGrHCGROUP_INET_INGRESSCGROUP_INET_EGRESSCGROUP_INET_SOCK_CREATECGROUP_SOCK_OPSSK_SKB_STREAM_PARSERSK_SKB_STREAM_VERDICTrSK_MSG_VERDICTCGROUP_INET4_BINDCGROUP_INET6_BINDCGROUP_INET4_CONNECTCGROUP_INET6_CONNECTCGROUP_INET4_POST_BINDCGROUP_INET6_POST_BINDCGROUP_UDP4_SENDMSGCGROUP_UDP6_SENDMSG LIRC_MODE2FLOW_DISSECTOR CGROUP_SYSCTLCGROUP_UDP4_RECVMSGCGROUP_UDP6_RECVMSGCGROUP_GETSOCKOPTCGROUP_SETSOCKOPT TRACE_RAW_TP TRACE_FENTRY TRACE_FEXIT MODIFY_RETURNLSM_MAC TRACE_ITERCGROUP_INET4_GETPEERNAMECGROUP_INET6_GETPEERNAMECGROUP_INET4_GETSOCKNAMECGROUP_INET6_GETSOCKNAME XDP_DEVMAPCGROUP_INET_SOCK_RELEASE XDP_CPUMAP SK_LOOKUPrSK_SKB_VERDICTrIrrrrrsOMNJNMLLKMGJ!!!!J!JI CNrrc*]tRt^t^t^t^t^t^tRt R#) XDPActionrN) rErFrGrH XDP_ABORTEDXDP_DROPXDP_PASSXDP_TX XDP_REDIRECTrIrrrrrsKHH FLrrc*]tRt^t^t^t^t^t^tRt R#)XDPFlagsrN) rErFrGrHUPDATE_IF_NOEXISTSKB_MODEDRV_MODEHW_MODEREPLACErIrrrrrs HHGGrrc p a]tRtRto]P t]P t]Pt]Pt]Pt ]Pt ]Pt ]Pt ]Pt ]Pt]Pt]P t]P"t]P$t]P&t]P(t]P*t]P,t]P.t]P0t]P4t]P6t]P8t]P:t]P<t]P@t!]PDt#]PHt%]PLt']PPt)]*PV!R4t,/t-].P^!4t0RR.RRR.RR R .R R .R RR./t1.ROt2^t3!RR]4Pj4t6]4Pn!RRR7t8]8Prt:]4Pv]4Px!]64.]:n=]>R4t?]>R4t@]AtA!RR]B4tC]DR4tE]DR4tFRRR^..RRR3 RltG]3RltHRR ltIR!tJR"tKRR#ltL/R$]4PbR%]4PbR&]4PbR']4PbR(]4PbR)]4PbR*]4PvbR+]4PbR,]4PbR-]4PbR.]4PbR/]4PbR0]4PbR1]4PbR2]4PbR3]4P^,bR4]4P^,bt]]DR54t^RR6lt_R7t`R8taR9tbR:tcR;td]DRR<l4te]DR=4tf]DR>4tg]DR?4thR@ti]DRA4tjRBtkRCtlRDtmREtnRFtoRGtpRHtqRRIltrRRJltsRKttRLtuRRMltvRRNltw]DRROl4tx]DRRPl4ty]>RRQl4tz]DRRRl4t{]DRS4t|]DRT4t}RRUlt~RRVltRRWlt]DRX4t]DRY4t]DRZ4t]DR[4tRR\ltRR]ltRR^ltRR_ltRR`ltRRaltRRbltRRclt]DRd4t]DRe4t]DRf4t]DRg4tRRhltRitRRjltRktRRlltRRmlt]DRn4t]DRo4t]DRp4tRqtRRrltRRsltRttRRultRRvltRwtRRxltRRyltRRzltRR{lt]DR|4t]DRR}l4t]DRR~l4t]DR4tRtRtRtRRltRtRRltRRltRRltRtRt]DR4tRtRtRtRtRtRtVtR#)BPFis [^a-zA-Z0-9_]z linux/time.htimez linux/fs.hfsfilezlinux/blkdev.hbiorequestz linux/slab.halloczlinux/netdevice.hsk_buff net_devicecN]tRtRtR]P 3R]P 3.tRtR#) BPF.timespeciEtv_sectv_nsecrN)rErFrGrHr%c_long_fields_rIrrrtimespecrEsryy)Iryy+ABrrz librt.so.1T) use_errnoc >VP4pVPVP\P!V44^8wd6\P !4p\ V\P!V44hVPR,VP,#)zmonotonic_time() Returns the system monotonic time from clock_gettime, using the CLOCK_MONOTONIC constant. The time returned is in nanoseconds. geA) r_clock_gettimeCLOCK_MONOTONICr%r/ get_errnoOSErrorosstrerrorrr)clsterrnos& rmonotonic_timeBPF.monotonic_timeLsj LLN   c11288A; ?1 DLLNE%U!34 4xx#~ ))rc RpVPP4F7wr4VF,pVF#pWV9gK W29gKVRV,, pK% K. K9 V#)a  Generates #include statements automatically based on a set of recognized types such as sk_buff and bio. The input is all the words that appear in the BPF program, and the output is a (possibly empty) string of #include statements, such as "#include ". z#include <%s> )_auto_includesitems)r program_wordsheadersheaderkeywordskeywordwords&& rgenerate_auto_includesBPF.generate_auto_includesXsZ # 2 2 8 8 : F#)D6+@#4v#==*$!; rc&a]tRtRtoRtRtVtR#) BPF.Functionikc*WnW nW0nR#r)bpfr7fd)r)rr7rs&&&&rr+BPF.Function.__init__lsHIGr)rrr7N)rErFrGrHr+rIrJrKs@rFunctionrks  rrc V'd\PPV4'g\\P ^,4pRP \PP\PPVP444V.4p\PPV4'dTpV#\RV,4hV#)z0If filename is invalid, search in ./ of argv[0] /zCould not find file %s) rpathisfilersysargvjoinabspathdirname __bytes__ Exception)filenameargv0rs& r _find_fileBPF._find_fileqs 77>>(++!#((1+.IIrwwrwwu?P/QRT\]^77>>!$$ H$$.is_exes377>>%(** %) *rPATH"N)rrsplitenvironpathsepstripr encode)bin_pathrrfnamerexe_files& rfind_exe BPF.find_exe~s *ww}}X.  h   6*00<zz#77<< x@(###O = rrNFc  P\V4p\V4p\V4pV'd V'dQh\P!4p V R8XEd!\P!RR.\P R7p V P R4PR4p \PPV 4'gRp \P!R R.\P R7pTP R4PR4p\PPT4'gRpT 'dTPR T ,4T'dTPR T,4/Vn /Vn/Vn/Vn/Vn/Vn/Vn/Vn/Vn/VnRVnRVn\2P4!VP64W@n/Vn/VnRVn\@PB\EV4,!4p\GV4Fwpp\I\KV44VV&K V'd+\LPOV4p\LPOV4pV'd/\QVR R 7;_uu_4pVPS4pRRR4\@PT\EV4,!4p\GV4F-wpp\@PT!VPW44VV&K/ \XPZ!V\EV44pVf \R4hVV,p\XP\!VVP8V\EV4Wx4VnVP>'g\R T;'gR,4hVFpVP_W 4K VPa4R# \dp Rp Rp ? EL0Rp ? ii;i \dp RpRp ? ELRp ? ii;i +'giELl;i)a Create a new BPF module with the given source code. Note: All fields are marked as optional, but either `src_file` or `text` must be supplied, and not both. Args: src_file (Optional[str]): Path to a source file for the module hdr_file (Optional[str]): Path to a helper header file for the `src_file` text (Optional[str]): Contents of a source file for the module debug (Optional[int]): Flags used for debug prints, can be |'d together See "Debug flags" for explanation loongarch64clangz-print-file-name=include)stderrutf-8 FNgccz-Irb)modezFailed to compile BPF module %szzycan't generate USDT probe arguments; possible cause is missing pid when a probe in a shared object has multiple locations)1rplatformmachine subprocess check_outputSTDOUTdecoder!rrexistsrappend kprobe_fds uprobe_fdstracepoint_fdsraw_tracepoint_fdskfunc_entry_fdskfunc_exit_fds fmod_ret_fdslsm_fds perf_buffersopen_perf_events_ringbuf_manager tracefileatexitregistercleanupdebugfuncstablesr1r%r3len enumeratebytesrrropenreadc_void_p get_contextrbcc_usdt_genargsbpf_module_create_c_from_stringattach_uprobes_trace_autoload)r)src_filehdr_filetextrHcflags usdt_contexts allow_rlimitdeviceattach_usdt_ignore_pid architectureclang_include_path_outputclang_include_path_stregcc_include_path_outputgcc_include_path_str cflags_arrayisr ctx_arrayusdt usdt_text usdt_contexts&&&&&&&&&& rr+ BPF.__init__sj"$H-#H-%X&& '') = ( /,6,C,CWNhDir|sDsD-E))B)I)I')R)X)XY])^&ww~~&<==-2* -*4*A*A5JdBenxnn+A''>'E'Eg'N'T'TUY'Z$ww~~&:;;+0(& d%;;<# d%99: "$!   " $ %     c&k14 f%DAqy|9L|A% ~~h/H~~h/H hT**dyy{+[[3}#558  /GAt;;t'7'7'9:IaL0((C 4FG  () )499$:>**:FLHY:FP {{{=AUAUXVW W)L  ' ' E* Q /).& / -',$ -H+**sJA,O?OA,O9/O9 P O6)O11O69 PP  P P% c .p\^\P!VP44FDp\P!VPV4pVP VP WA44KF V#)zload_funcs(prog_type=KPROBE) Load all functions in this BPF module with the given type. Returns a list of the function handles.)rangerbpf_num_functionsr1bpf_function_namer8 load_func)r) prog_typefnsre func_names&& r load_funcsBPF.load_funcss[ q#// <=A--dkk1=I JJt~~i; <> rc\V4pWP9dVPV,#\P!VPV4'g\ RV,4h^pVP \,'d^pMVP \,'d^p\P!VPW!\P!VPV4\P!VPV4\P!VP4\P!VP4VR^W44 pV^8d\P!VP4\ P"!4\$P&8Xd \ R4h\(P*!\ P"!44p\ RV: RV: 24h\,P/WV4pWPV&V#)Unknown program %sNz!Need super-user privileges to runzFailed to load BPF program : )rrIrbpf_function_startr1rrHDEBUG_BPF_REGISTER_STATE DEBUG_BPF bcc_func_loadbpf_function_sizebpf_module_licensebpf_module_kern_versionrErF donothingr%rrEPERMrrrr) r)rsrqr\ attach_type log_levelrerrstrfns &&&&& rrp BPF.load_funcsm$Y/  "::i( (%%dkk9==09<= = JJ1 1 1Ijj9$$I   t{{I&&t{{I>%%dkk9=&&t{{3++DKK84F 9 6 OODNN +||~, CDD[[0F&01 1\\$2 . " 9 rc :\V4p\P!VPV4'g\ RV,4h\P!VPV4p\P !VPV4p\ P!W#4#)zB Return the eBPF bytecodes for the specified function as a string rw)rrryr1rr}r% string_at)r)rsstartsizes&& r dump_func BPF.dump_func2sq%Y/ %%dkk9==09<= ='' Y?%%dkk9=||E((rc:VPV4p\W4#r)rr)r)rsbpfstrs&& rdisassemble_funcBPF.disassemble_func>s * 22rcW,p\P!VPVP4p\ WWBR7#))sizeinfo)rbpf_table_type_idr1map_idr)r) table_namer table_obj table_types&&& r decode_tableBPF.decode_tableBs3$ **4;; 8H8HI *OOr_Boolcharwchar_tz unsigned charshortzunsigned shortintz unsigned intlongz unsigned longz long longzunsigned long longfloatdoublez long double__int128zunsigned __int128c (\V\4'd\PV,#.p.pV^,EFp\ V4^8Xd7VP V^,\P V^,434KJ\ V4^8XEd\V^,\4'dLVP V^,\P V^,4V^,^,,34K\V^,\4'd@VP V^,\P V^,4V^,34EK\V^,\4'dV^,R8XgV^,R8XgV^,R8Xd]V^,pVR8Xd$R\ V4,pVP V4VP V\P V434EK\R\V4,4h\R\V4,4h \PpRp\ V4^8d_V^,R8Xd\PpM?V^,R8Xd\PpM V^,R8Xd\PpRpV'd-\\V^,4V3\V^VR 74pV#\\V^,4V3\VVR 74pV#) unionstruct struct_packedrz__anon%dzFailed to decode type %sFT) _anonymous__pack_r)rr) isinstance basestringr str2ctyperKr8_decode_table_typelistrrstrr% StructureUniontypedict)descanonfieldsrr7base is_packedrs& rrBPF._decode_table_typeZsO dJ ' '==& &aA1v{ qtS%;%;AaD%ABCQ1adD))MM1Q4)?)?!)E!Q)O"PQ!c**MM1Q4)?)?!)Eqt"LM!j11!(AaDI,=! 00Q4Drz)CI5 D)MM4)?)?)B"CD#$>Q$GHH :SV CDD'(|| t9q=Aw("xxaI%||a,,|| s47|dWdtA/!"C  s47|dWdt/!"C rc ,\V4p\P!VPV4p\P!VPV4p\P !VPV4\ \39pV^8d\hV'g|V'gt\P!VPV4PR4pV'g\RV,4h\P\P!V44pV'gt\P !VPV4PR4p V 'g\RV,4h\P\P!V 44p\#WWbW1VR7#)rr,z$Failed to load BPF Table %s key descz%Failed to load BPF Table %s leaf desc)reducer)rr bpf_table_idr1 bpf_table_fdrr r KeyErrorbpf_table_key_descr6rrrjsonloadsbpf_table_leaf_descr ) r)r7keytypeleaftyperrmap_fd is_queuestackkey_desc leaf_descs &&&&& r get_table BPF.get_tables%!!$++t4!!$++t4--dkk6BGY[mFnn A:N}--dkk4@GGPH F MNN,,TZZ-ABG// TBII'RI G$ NOO--djj.CDHT6HGTTrcWP9dVPV4VPV&VPV,#r)rJrr)keys&&r __getitem__BPF.__getitem__s2 kk !#~~c2DKK {{3rc"W PV&R#rrJ)r)rleafs&&&r __setitem__BPF.__setitem__s Crc,\VP4#r)rKrJr)s&r__len__ BPF.__len__s4;;rc VPVR#rrrs&&r __delitem__BPF.__delitem__s KK rc6VPP4#r)rJ__iter__rs&rr BPF.__iter__s{{##%%rc\V\P4'g \R4h\P !VP WV4pV^8d1\RPV\P!V)444hR#)"arg 1 must be of type BPF.Functionz7Failed to attach BPF function with attach_type {0}: {1}N) rrrrrbpf_prog_attachrformatrr)r attachable_fdrflagsr;s&&&& r attach_funcBPF.attach_funcsn"cll++@A A!!"%%UK 7''-vk2;;t;L'MO O rc \V\P4'g \R4h\P !VP W4pV^8d1\RPV\P!V)444hR#)rz7Failed to detach BPF function with attach_type {0}: {1}N) rrrrrbpf_prog_detach2rrrr)rrrr;s&&& r detach_funcBPF.detach_funcsl"cll++@A A""255-E 7''-vk2;;t;L'MO O rc\V4p\V\P4'g \ R4h\ P !V4pV^8d=\P!\P!44p\ RV: RV: 24h\ P!W P4pV^8d=\P!\P!44p\ RV: RV: 24hW n R#)rzFailed to open raw device rxFailed to attach BPF to device N)rrrrrrbpf_open_raw_sockrrr%rbpf_attach_socketrsock)rdevrrr;s&& rattach_raw_socketBPF.attach_raw_socketss#"cll++@A A$$S) !8[[0F#vNO O##D%%0 7[[0FF$% %rc fR\,p\VR4;_uu_4p\VUu.uF'q3P4P 4^,NK) up4pRRR4R\,p\TR4;_uu_4p\TUu.uF'q3P4P 4^,NK) up4pRRR4.p ^p ^p \RR4;_uu_4p T EF^pTP4P 4R,wrT ^8Xd TR8Xd^p K=MT ^8Xd TR8Xd^p KPT ^8XdTR8Xd^p KbTR 8Xd^p KmMT ^8Xd TR 8Xd^p KTPR 4'dKTPR 4'gTPR 4'dKTPR 4'dK\P!RT4'dEKT P4R9gEK\P!Y4'gEK9TX9gEKCTX9gEKMT PT4EKa RRR4\T 4#uupi +'giEL;i \ d8pTP \ P8wdTh\.4pRp?ELQRp?ii;iuupi +'giEL;i \ d8pTP \ P8wdTh\.4pRp?ELGRp?ii;i +'giL;i)z%s/kprobes/blacklistr/Nz%%s/tracing/available_filter_functions/proc/kallsyms:rNs __init_begins __init_ends__irqentry_text_starts__irqentry_text_ends _kbl_addr_s__perfsperf_s__SCT__s^.*\.cold(\.\d+)?$)tw)DEBUGFSrNsetrstriprIOErrorrr startswithrematchlower fullmatchr8)event_reblacklist_file blacklist_fline blacklistraavail_filter_fileavail_filter_f avail_filterrrin_init_sectionin_irq_section avail_filerrs& rget_kprobe_functionsBPF.get_kprobe_functionss/'9 nd++{k Rkd!4!4!6q!9!9k RS ,DgM #'..."#XKKM$7$7$9!$<$<#XY / "D ) )Z"++---/4#a'_,*+ -%)]**+"Q&55)* 55)* 6$q(33)* ==//]]9--x1H1H]]:..XX4b99GGI-2<<3M3M)+l*JJrNa#*d3xK!S,++ ww%++%BI $Y/.. #ww%++%r7L #* )sI= I)-I$ I)!I=7K K-K K K+BL L L 5L L -L L 'L 1L ;L $I)) I: 4I=:I== J?,J::J?K K KK L&,LL L0 cd\V,\P48d \R4hR#)z/Number of open probes would exceed global quotaN)rrget_probe_limitr)r)num_new_probess&&r_check_probe_quotaBPF._check_probe_quotas* n ,s/B/B/D DMN N Erc\PPR4pV'd"VP4'd \ V4#\ #)BCC_PROBE_LIMIT)rrgetisdigitr_default_probe_limit)env_probe_limits rrBPF.get_probe_limits7**..):; 6688' '' 'rcWP9d/VPV&W0PV,V&\^, sR#rNr9r)r)ev_namefn_namers&&&&r_add_kprobe_fdBPF._add_kprobe_fd's6 // )')DOOG $,. )ArcHVPV,V\^,sR#rr)r)rrs&&&r_del_kprobe_fdBPF._del_kprobe_fd.s OOG $W -Arc<W PV&\^, sR#rr:r)r)r7rs&&&r_add_uprobe_fdBPF._add_uprobe_fd3s "Arc:VPV\^,sR#rr%r)r7s&&r_del_uprobe_fdBPF._del_uprobe_fd8s OOD !ArcVPF$pVPRV,4R8wgK"Vu# VP^,#)s%sbpfr@)_syscall_prefixesksymname)r)prefixs& rget_syscall_prefixBPF.get_syscall_prefix@s@,,F}}X./25 -%%a((rcF\V4pVP4V,#r)rr0r)s&&rget_syscall_fnnameBPF.get_syscall_fnnameIs %&&(4//rc\V4pVPF9pVPV4'gKVPV\ V4R4u# V#r)rr-rr3rK)r)r7r/s&& rfix_syscall_fnnameBPF.fix_syscall_fnnamePsN%,,Fv&&..tCKL/ABB- rc\V4p\V4p\V4pV'd\PV4pVP\ V44^p.pVFpVP WR7K V\ V48Xd$\RV: RRPV4: R24hR#VP^4VPV\P4p RVPRR 4PR R 4,p \P!V P^WV^4p V ^8d\RV: RV: R24hVPWV 4V# T^, pTP T4EK;i) reventrFailed to attach BPF program z to kprobe /K, it's not traceable (either non-existing, inlined, or marked as "notrace")Np_+_.)rrr rrK attach_kprober8rr rprreplacerbpf_attach_kproberr) r)r: event_offrrmatchesfailedprobesrrrrs &&&&& rrBBPF.attach_kprobeWsX '"7+#H- ..x8G  # #CL 1FF(&&T&C W%!(#((6*:!<==  " ^^GSZZ 0%--d3;;D$GG  " "255!WY J 6$e-. . Gb1 %(aKFMM$''s #EE;c\V4p\V4p\V4pV'dl\PV4p^p.pVFpVPWVR7K V\ V48Xd$\ RV: RRPV4: R24hR#VP^4VPV\P4p RVPRR 4PR R 4,p \P!V P^W^V4p V ^8d\ RV: RV: R24hVPWV 4V# T^, pTP T4EK;i) r)r:r maxactiver;z to kretprobe r<r=Nr_r?r@rA)rrr attach_kretprober8rKrr rrprrCrrDrr) r)r:rrrKrFrGrHrrrrs &&&&& rrMBPF.attach_kretprobeysM '"7+#H- ..x8GFF())4=*? W%!(#((6*:!<==  " ^^GSZZ 0%--d3;;D$GG  " "255!WQ J 6$e-. . Gb1 %(aKFMM$''s EE"c\V4p\VPV,P44pVFpVP W4K R#r)rrr9keysdetach_kprobe_event_by_fn)r)rfn_namesrs&& rdetach_kprobe_eventBPF.detach_kprobe_events@"7+05578G  * *7 < rc\V4p\V4pWP9d\RV,4h\P!VPV,V,4pV^8d \R4hVP W4\ VPV,4^8Xd+\P!V4pV^8d \R4hR#R#)zKprobe %s is not attachedzFailed to close kprobe FDz Failed to detach BPF from kprobeN)rr9rrbpf_close_perf_event_fdr"rKbpf_detach_kprobe)r)rrr;s&&& rrQBPF.detach_kprobe_event_by_fns"7+"7+ // )7'AB B))$//'*B7*KL 778 8 G- tw' (A -''0CQw BCC .rc\V4pRVPRR4PRR4,pV'd\V4pVPW24R#VPV4R#)r>r?r@rANrrCrQrSr)r:rrs&&& r detach_kprobeBPF.detach_kprobeW '%--d3;;D$GG &w/G  * *7 <  $ $W -rc\V4pRVPRR4PRR4,pV'd\V4pVPW24R#VPV4R#)rLr?r@rANrZr[s&&& rdetach_kretprobeBPF.detach_kretprober^rc ~\V4p\V\P4'g \ R4h\ P !WPV4pV^8d_\P!4pV\P8Xd \ R4h\P!V4p\ RV: RV: 24hR#)zT This function attaches a BPF function to a device on the device driver level (XDP) rrrxNzMInternal error while attaching BPF to device, try increasing the debug level!)rrrrrrbpf_attach_xdprr%rrEBADMSGrr)rrrr;err_nors&&& r attach_xdpBPF.attach_xdps s#"cll++@A A  eeU3 7\\^F&!788V,"F!,-- rc \V4p\P!VRV4pV^8d=\P!\ P !44p\RV: RV: 24hR#)zW This function removes any BPF function from a device on the device driver level (XDP) z!Failed to detach BPF from device rxNr@)rrrcrrr%rr)rrr;rs&& r remove_xdpBPF.remove_xdpsY s#  b%0 7[[0F"F,- - rc h\V4p\V4p\4pVR8Xd^MTp\P!YT;'g^V\P !R\P !\44\P!V44^8d0\RVP4: RVP4: 24hVPV,p\P !VP\P4Pp \P!VP4W3#)rNz&could not determine address of symbol z in r@)rrrbcc_resolve_symnamer%r&r'rr/rr6r2r1r3r4bcc_procutils_free) rr1symnamer8r*sym_offr:c_pidnew_addr module_paths &&&&&& r_check_path_symbolBPF._check_path_symbols!&)"7+lBYC  " "  KKC GGD"**%67 8 HHSM     &~~/BC C::'ggcjj"++6<<  szz*$$rc &\V4pV'd\P!W4pM\P!V^4pV'gR#\P !V\P 4Pp\P!V4V#)a Find the full path to the shared library whose name starts with "lib{libname}". If non-zero pid is given, search only the shared libraries mapped by the process with this pid. Otherwise, search the global ldconfig cache at /etc/ld.so.cache. Examples: BPF.find_library(b"c", pid=12345) # returns b"/usr/lib/x86_64-linux-gnu/libc.so.6" BPF.find_library(b"pthread") # returns b"/lib/x86_64-linux-gnu/libpthread.so.0" BPF.find_library(b"nonexistent") # returns None N) rr!bcc_procutils_which_so_in_processbcc_procutils_which_sor%r&r3r4rm)libnamer*r;libpaths&& r find_libraryBPF.find_librarysf#7+ 77EC,,Wa8C''#r{{+11 s#rc.p\PP\R4p\P!V4EFp\PPW#4p\PP V4'gKJ\P!V4Fp\PPWE4p\PP V4'gKIV: RV: 2p\ P!VP4V4'gKVPVP44K EK V#)events:) rrr TRACEFSlistdirisdirrrr6r8r")tp_reresults events_dircategorycat_dirr:evt_dirtps& rget_tracepointsBPF.get_tracepoints sWW\\'84  :.Hggll:8G77==))G,'',,w677==))%-u5Bxx 33ryy{3 - /rc\PP\RW4p\PP V4#)r})rrr rr)rr:rs&& rtracepoint_existsBPF.tracepoint_existss+'',,w(Bww}}W%%rc \V4p\V4p\V4pV'd1\PV4FpVPWR7K R#VP V\P 4pVP R4wrV\P!VPWV4pV^8d\RV: RV: 24hWpPV&V#)aOattach_tracepoint(tp="", tp_re="", fn_name="") Run the bpf function denoted by fn_name every time the kernel tracepoint specified by 'tp' is hit. The optional parameters pid, cpu, and group_fd can be used to filter the probe. The tracepoint specification is simply the tracepoint category and the tracepoint name, separated by a colon. For example: sched:sched_switch, syscalls:sys_enter_bind, etc. Instead of a tracepoint name, a regular expression can be provided in tp_re. The program will then attach to tracepoints that match the provided regular expression. To obtain a list of kernel tracepoints, use the tplist tool or cat the file /sys/kernel/debug/tracing/available_events. Examples: BPF(text).attach_tracepoint(tp="sched:sched_switch", fn_name="on_switch") BPF(text).attach_tracepoint(tp_re="sched:.*", fn_name="on_switch") rrN:r;z to tracepoint ) rrrattach_tracepointrprQrrbpf_attach_tracepointrrr;)r)rrrr tp_categorytp_namers&&&& rrBPF.attach_tracepoint"s*b ! '"7+ ))%0&&"&>1  ^^GS^^ 4!#$  & &ruuk C 6$b*+ +"$B rc 8\V4pWP9d\RV,4h\V4pVPV\P 4p\ P!VPV4pV^8d \R4hW@PV&V#)a|attach_raw_tracepoint(self, tp=b"", fn_name=b"") Run the bpf function denoted by fn_name every time the kernel tracepoint specified by 'tp' is hit. The bpf function should be loaded as a RAW_TRACEPOINT type. The fn_name is the kernel tracepoint name, e.g., sched_switch, sys_enter_bind, etc. Examples: BPF(text).attach_raw_tracepoint(tp="sched_switch", fn_name="on_switch") z#Raw tracepoint %s has been attachedz&Failed to attach BPF to raw tracepoint) rr<rrprrrbpf_attach_raw_tracepointr)r)rrrrs&&& rattach_raw_tracepointBPF.attach_raw_tracepointHsb ! (( (ABFG G"7+ ^^GS%7%7 8  * *255" 5 6DE E&(# rc \V4pWP9d\RV,4h\P!VPV,4VPVR#)zdetach_raw_tracepoint(tp="") Stop running the bpf function that is attached to the kernel tracepoint specified by 'tp'. Example: bpf.detach_raw_tracepoint("sched_switch") z!Raw tracepoint %s is not attachedN)rr<rrclose)r)rs&&rdetach_raw_tracepointBPF.detach_raw_tracepoint`sPb ! ,, ,?"DE E ((,-  # #B 'rcDVPV4'g W,pV#r)r)r/r7s&&r add_prefixBPF.add_prefixosv&&=D rc\P!4R8wdR#\P!4'gR#\P R4R8wdR#R#)x86_64Fbpf_trampoline_link_progTr@)r1r2rbpf_has_kernel_btfrr.rrr support_kfuncBPF.support_kfuncusB     )%%'' <<2 3r 9rcx\P!4'gR#\PR4R8wdR#R#)Fs bpf_lsm_bpfTr@)rrrr.rrr support_lsmBPF.support_lsms+%%'' << '2 -rc4\PRR4^8H#)bpf_attach_typeBPF_MODIFY_RETURN)rkernel_enum_has_valrrrsupport_fmod_retBPF.support_fmod_rets&&'8:MNRSSSrc\V4p\PRV4pWP9d\ RV,4h\ P !VPV,4VPVR#)kfunc__z$Kernel entry func %s is not attachedN)rrrr=rrrr)rs&&r detach_kfuncBPF.detach_kfuncs^"7+..W5 .. .BWLM M %%g./   )rc\V4p\PRV4pWP9d\ RV,4h\ P !VPV,4VPVR#) kmod_ret__z Fmod_ret func %s is not attachedN)rrrr?rrrrs&&rdetach_fmod_retBPF.detach_fmod_rets^"7+..8 ++ +>HI I ""7+,   g &rc\V4p\PRV4pWP9d\ RV,4h\ P !VPV,4VPVR#) kretfunc__z#Kernel exit func %s is not attachedN)rrrr>rrrrs&&rdetach_kretfuncBPF.detach_kretfuncs^"7+..8 -- -AGKL L $$W-.    (rcL\V4p\PRV4pWP9d\ RV,4hVP V\P 4p\P!VP4pV^8d \ R4hW0PV&V#)rz&Kernel entry func %s has been attachedz)Failed to attach BPF to entry kernel func) rrrr=rrprrbpf_attach_kfuncrr)rrrs&& r attach_kfuncBPF.attach_kfuncs"7+..W5 ** *DwNO O ^^GS[[ 1  ! !"%% ( 6GH H(*W% rcL\V4p\PRV4pWP9d\ RV,4hVP V\P 4p\P!VP4pV^8d \ R4hW0PV&V#)rz"Fmod_ret func %s has been attachedz,Failed to attach BPF to fmod_ret kernel func) rrrr?rrprrrrrs&& rattach_fmod_retBPF.attach_fmod_rets"7+..8 '' '@7JK K ^^GS[[ 1  ! !"%% ( 6JK K%''" rcL\V4p\PRV4pWP9d\ RV,4hVP V\P 4p\P!VP4pV^8d \ R4hW0PV&V#)rz%Kernel exit func %s has been attachedz(Failed to attach BPF to exit kernel func) rrrr>rrprrrrrs&& rattach_kretfuncBPF.attach_kretfuncs"7+..8 )) )CgMN N ^^GS[[ 1  ! !"%% ( 6FG G')G$ rc\V4p\PRV4pWP9d\ RV,4h\ P !VPV,4VPVR#)lsm__zLSM %s is not attachedN)rrrr@rrrrs&&r detach_lsmBPF.detach_lsmsX"7+..73 ,, &4w>? ? g&' LL !rcL\V4p\PRV4pWP9d\ RV,4hVP V\P 4p\P!VP4pV^8d \ R4hW0PV&V#)rzLSM %s has been attachedzFailed to attach LSM) rrrr@rrprrbpf_attach_lsmrrs&& r attach_lsmBPF.attach_lsms"7+..73 ll "6@A A ^^GSWW -    & 623 3 " W rcr\PR4R8wg\PR4R8wdR#R#)bpf_find_raw_tracepointbpf_get_raw_tracepointTFr@)rr.rrrsupport_raw_tracepointBPF.support_raw_tracepoints. <<1 2b 8 <<0 1R 7rcRp\V4;_uu_4pVFPpVP4PR^4wr4VPR4^,pVR8XgKGRRR4R# RRR4R# +'giR#;i)r  bpf_trace_modulesNTF)rNrr)kallsymssymsr_r7s r support_raw_tracepoint_in_module$BPF.support_raw_tracepoint_in_moduleso$ (^^t#{{}223: Azz$'*.. ^  ^^^sAA8 A8+A88 B cZ\V4p\V4p\P!W4#r)rrkernel_struct_has_field) struct_name field_names&&rrBPF.kernel_struct_has_fields'&{3 %j1 **;CCrcZ\V4p\V4p\P!W4#r)rrr) enum_name value_names&&rrBPF.kernel_enum_has_vals'$Y/ %j1 &&y==rc b\V4pWP9d\RV,4h\P!VPV,4pV^8d \R4hVP R4wr4\P !W44pV^8d \R4hVPVR#)zdetach_tracepoint(tp="") Stop running a bpf function that is attached to the kernel tracepoint specified by 'tp'. Example: bpf.detach_tracepoint("sched:sched_switch") zTracepoint %s is not attachedz$Failed to detach BPF from tracepointrN)rr;rrrVrbpf_detach_tracepoint)r)rr;rrs&& rdetach_tracepointBPF.detach_tracepointsb ! (( (;b@A A))$*=*=b*AB 7BC C!#$'' = 7BC C    #rc ^\P!WVWEWgV4p V ^8d \R4hV #)rz"Failed to attach BPF to perf event)rbpf_attach_perf_eventr) r)progfdev_type ev_config sample_period sample_freqr*cpugroup_fdr;s &&&&&&&&& r_attach_perf_eventBPF._attach_perf_event#s6''Ch@ 7@A A rc 4\V4pVPV\P4p /p V^8d#VP V P WWEWgV4W&M2\ 4F$p VP V P WWEWkV4W&K& WPW3&R#rN)rrprrrrrrB) r)rrrrrr*rrrr;res &&&&&&&&& rattach_perf_eventBPF.attach_perf_event+s"7+ ^^GS^^ 4 !8..ruug!(DCH%&00%CHF'7:w23rc\P!V\P!V4VWE^4pV^8d \ R4hV#)rz&Failed to attach BPF to perf raw event)rbpf_attach_perf_event_rawr%r/r)r)rattrr*rrr;s&&&&&& r_attach_perf_event_rawBPF._attach_perf_event_raw9s=++FBHHTNCq" 7DE E rcZ\V4pVPV\P4p/pV^8d"VP VP VW4V4Wt&M1\ 4F#pVP VP VW8V4Wx&K% WpPVPVP3&R#r) rrprrrrrrBrconfig) r)rrr*rrrr;res &&&&&& rattach_perf_event_rawBPF.attach_perf_event_raw@s"7+ ^^GS^^ 4 !822255$h(CH%&44RUUD*';>tyy$++67rc4VPW3,p^pTP 4F#p\ P !T4;'gTpK% T^8wd \R4hTPY3R# \d\RPY44hi;i)z)Perf event type {} config {} not attachedz$Failed to detach BPF from perf eventN)rBrrrvaluesrrV)r)rrfdsr;rs&&& rdetach_perf_eventBPF.detach_perf_eventMs %''(<=C **,B--b188SC !8BC C  ! !7"6 7 %GNN$% % %s A11&Bcr\\PW4UUu.uFwrVNK upp4#uuppirrr get_user_functions_and_addresses)r7sym_rers&& rget_user_functionsBPF.get_user_functions[sA88FHF'dDFHI IH 3 c r\\PW4UUu.uFwr#VNK upp4#uuppi)a We are returning addresses here instead of symbol names because it turns out that the same name may appear multiple times with different addresses, and the same address may appear multiple times with the same name. We can't attach a uprobe to the same address more than once, so it makes sense to return the unique set of addresses that are mapped to a symbol that matches the provided regular expression. r )r7r raddresss&& rget_user_addressesBPF.get_user_addresses`sC88FHF!-GFHI IHrcaa\V4p\S4o.oVV3Rlp\P!V\V44pV^8d\ RW03,4hS#)cj<Tp\P!SV4'dSPW!34^#r)rrr8)sym_namer8dname addressesr s&& rsym_cb4BPF.get_user_functions_and_addresses..sym_cbrs,Exx&&  %/rz"Error %d enumerating symbols in %s)rrbcc_foreach_function_symbolrr)r7r rr;rs&f @rr $BPF.get_user_functions_and_addressesmsZ%!&)   --dL4HI 7@C;NO OrcVR8XdCRWPPR\PP V44V3,#RWPPR\PP V44W43,#)rs %s_%s_0x%xr@s %s_%s_0x%x_%dr@) _probe_replsubrrbasename)r)r/rr8r*s&&&&&r_get_uprobe_evnameBPF._get_uprobe_evname}ss "9 F,<,<,@,@rwwGWGWX\G],^`d#ee e$v/?/?/C/CD"''JZJZ[_J`/acg&mm mrc V^8gQhVeV^8XgQR4h\V4p\V4p\V4p\V4pV'dN\PW4pVP\ V44VFp VP WWVR7K R#\P WWFV4wrVP^4VPV\P4p VPRWV4p \P!V P^WWF4p V ^8d \R4hVPW4V#)acattach_uprobe(name="", sym="", sym_re="", addr=None, fn_name="" pid=-1, sym_off=0) Run the bpf function denoted by fn_name every time the symbol sym in the library or binary 'name' is encountered. Optional parameters pid, cpu, and group_fd can be used to filter the probe. If sym_off is given, attach uprobe to offset within the symbol. The real address addr may be supplied in place of sym, in which case sym must be set to its default value. If the file is a non-PIE executable, addr must be a virtual address, otherwise it must be an offset relative to the file load address. Instead of a symbol name, a regular expression can be provided in sym_re. The uprobe will then attach to symbols that match the provided regular expression. Libraries can be given in the name argument without the lib prefix, or with the full path (/usr/lib/...). Binaries can be given only with the full path (/bin/sh). If a PID is given, the uprobe will attach to the version of the library used by the process. Example: BPF(text).attach_uprobe("c", "malloc") BPF(text).attach_uprobe("/usr/bin/python", "main") Nz!offset with addr is not supportedr7r8rr*pzFailed to attach BPF to uprobe)rrrrrK attach_uprobersrprr!rbpf_attach_uproberrr&)r)r7r:r r8rr*rorsym_addrrrrrs&&&&&&&& rr&BPF.attach_uprobes(:!||  a< D!D D<%s#!&)"7+ ..t? ?##G, 7>? ? G$rc \V4p\V4p\PWW4V4wrcVPRWcV4pVP V4R#)zdetach_uprobe(name="", sym="", addr=None, pid=-1) Stop running a bpf function that is attached to symbol 'sym' in library or binary 'name'. r%Nrrrsr!r0)r)r7r:r8r*rorrs&&&&&& r detach_uprobeBPF.detach_uprobesP %s#--dGL ))$C@   )rc \V4p\V4p\PWW44wrSVPRWSV4pVP V4R#)zdetach_uretprobe(name="", sym="", addr=None, pid=-1) Stop running a bpf function that is attached to symbol 'sym' in library or binary 'name'. r+Nr3)r)r7r:r8r*rrs&&&&& rdetach_uretprobeBPF.detach_uretprobesN %s#--dC ))$C@   )rc>\^\P!VP44EFmp\P!VPV4pVP R4'dVVP V\P4pVPVPVR,4VPR7KVP R4'dVVP V\P4pVPVPVR,4VPR7KVP R4'dhVP V\P4pVP\R4RPRR 4pVP!WCPR 7EK{VP R 4'dXVP V\P"4pVP\R 4RpVP%WCPR 7EKVP R 4'dVP'VR 7EKVP R4'dVP)VR 7EKAVP R4'gEK[VP+VR 7EKp R#)rskprobe__:NNr9s kretprobe__: NNs tracepoint__Ns__rrsraw_tracepoint__r)rrr)rmrrnr1rorrprrrBr6r7rMrQrKrCrrrrrr)r)rersrrs& rrUBPF._trace_autoloadsq#// <=A--dkk1=I##K00^^Iszz:""11)B-@GG#%%%n55^^Iszz:%%11)C.AGG&%%%o66^^Is~~>WWS123;;E4H&&"gg&>%%&9::^^Is/A/ABWWS!4567**b''*B%%j11!!)!4%%m44$$Y$7%%h// 23>rc zVP'g\R\,R4VnV'd{VPP4p\P!V\P 4p\P!V\P V\P,4VP#)zGtrace_open(nonblocking=False) Open the trace_pipe if not already open z %s/trace_piper/) rDrNrfilenofcntlF_GETFLF_SETFLr O_NONBLOCK)r) nonblockingrfls&& r trace_openBPF.trace_open sp ~~~!/G";TBDN^^**,[[U]]3 B rBMM/AB~~rc VPV4pV'g V'dR#VPR4'dK=VR,P4pVR,pVPR4pVRVP 4wrVrxT^RpY$^,RpTPR4p Y*^,Rp T\ T4\ T4T\T4T 3# \ d p Rp ? KRp ? ii;i \ d p RuRp ? #Rp ? ii;i) ztrace_fields(nonblocking=False) Read from the kernel debug trace pipe and return a tuple of the fields (task, pid, cpu, flags, timestamp, msg) or None if no line was read (nonblocking=True) NsCPU::NN:NNr)NNNNNNr@)UnknownrrrJgrJ)trace_readlinerlstripfindrrrr) r)rCrtaskts_endr*rrtsrasym_endmsgs && r trace_fieldsBPF.trace_fields-s&&{3DK );w''9##%D9DYYt_F &*7Fm&9&9&;#%a)C $DiioG{|$C Dc#hC%rCHH   DCC Ds00C3"C/ C,'C,/ D:D;DDc VPV4pRpVPR4P4pV# \dT#i;i)ztrace_readline(nonblocking=False) Read from the kernel debug trace pipe and return one line If nonblocking is False, this will block until ctrl-C is pressed. Nrq)rEreadlinerr)r)rCtracers&& rrKBPF.trace_readlinePsS , >>$'..0D     s6 AAc V'd.VPRR7pV'gK%VP!V!pMVPRR7p\V4\P P 4Ks)ztrace_print(self, fmt=None) Read from the kernel debug trace pipe and print on stdout. If fmt is specified, apply as a format string to the output. See trace_fields for the members of the tuple example: trace_print(fmt="pid {1}, msg = {5}") F)rC)rSrrKprintr stdoutflush)r)fmtrrs&& r trace_printBPF.trace_print`sZ**u*=xzz6***u*= $K JJ   rc V^8d VR8wdRpV\P9g\V4\PV&\PV,#)z_sym_cache(pid) Returns a symbol cache for the specified PID. The kernel symbol cache is accessed by providing any PID less than zero. r@)r _sym_cachesr")r*s&r _sym_cacheBPF._sym_cachessD 7sbyCcoo%#.s#3COOC s##rc D\\V44pVPR4R8wEdi\4p\ 4pVP VnVP VnVPVPn\P!\P\P!V4\P!V44pV^8drVP'dZVP'dHRVP\P !VP\P"4P$rp M~RTRrp MxVP&VP\P !VP\P"4P$rp M'\P)V4P+W4wrp V'dV e RV ,MRp T ;'gRp W,p V'd+V e'R\,P.P1V 4,MRp W,#)a)sym(addr, pid, show_module=False, show_offset=False) Translate a memory address into a function name for a pid, which is returned. When show_module is True, the module name is also included. When show_offset is True, the instruction offset as a hexadecimal number is also included in the string. A pid of less than zero will access the kernel symbol cache. Example output when both show_module and show_offset are True: "start_thread+0x202 [libpthread-2.24.so]" Example output when both show_module and show_offset are False: "start_thread" bpf_stack_build_idNs+0x%xrs [unknown]s [%s]r@)rrrMrrstatusbuild_idr2urbcc_buildsymcache_resolver _bsymcacher%r/r1r&r3r4r7rbr=rrr ) r8r* show_module show_offsetr9 typeofaddrr:br;r7r2r1s &&&&& rr:BPF.syms(d_ ??/ 0B 6 #%'![[!(}}!*{{!##*--cnn.0hhqk.0hhsm=#1Wzzzcjjj$(#** BKK8>>!d&'+D$FdF$'HHcjj$&GGCJJ $D$J$J!D&"%!4! 1 is set in open_perf_buffer N)r%rPrKrArLrrperf_reader_consume)r)rrers& rperf_buffer_consumeBPF.perf_buffer_consumes[;;T%6%6!77:d//6689DAAJ: G g6rc (VPV4R#)z=kprobe_poll(self) Deprecated. Use perf_buffer_poll instead. N)rr)rs&&r kprobe_pollBPF.kprobe_polls g&rcVP'g<\P!WV4VnVP'g \R4hR#\P!VPWV4pV^8d \R4hR#)zCould not open ring bufferN)rCrbpf_new_ringbufrbpf_add_ringbuf)r)rrctxrets&&&& r_open_ring_bufferBPF._open_ring_bufferst$$$$'$7$7C$HD !((( <==)%%d&;&;VMCQw <==rc VP'g \R4h\P!VPV4R#)zring_buffer_poll(self) Poll from all open ringbuf buffers, calling the callback that was provided when calling open_ring_buffer for each entry. No ring buffers to pollN)rCrrbpf_poll_ringbufrs&&rring_buffer_pollBPF.ring_buffer_polls2 $$$56 6 T22G>?s37 A(A##A(c R#)zthe do nothing exit handlerNrrs&rr BPF.donothing)src .\VPP44F2wr\P!VP 4VPVK4 VP 'd*\P!VP 4RVnR#R#)z^close(self) Closes all associated files descriptors. Attached BPF programs are not detached. N) rrIrrrrr1rbpf_module_destroy)r)r7rs& rr BPF.close-sf TZZ--/0HD HHRUUO 4 1 ;;;  " "4;; /DK rc\VPP44FwrVPV4K \VPP44FwrVP V4K \VP P44FwrVPV4K \VPP44FwrVPV4K \VPP44FwrVPV4K \VPP44FwrVPV4K \VPP44FwrVPV4K \VP P44FwrVP#V4K \VP$P'44pVF9p\)VP$V,\*4'gK,VP$VK; \VP,P'44FwrVVP/WV4K VP0'd"VP0P34RVnVP34VP4'd*\6P8!VP44RVnR#R#r)rr9rrSr:r0r;rr<rr=rr>rr@rr?rrJrPrr rBrrDrrCrbpf_free_ringbuf)r)kr table_keysrrrs& rrG BPF.cleanup:s9..01DA  $ $Q '2..01DA  $ $Q '2,,2245DA  " "1 %6006689DA  & &q ):--3356DA   a 7,,2245DA   #6++-.DA OOA /**0023DA   #4$++**,- C$++c*N;;KK$%))>)>)C)C)E$F W  " "7 6%G >>> NN "!DN    !6!6 7$(D ! !rcV#rrrs&r __enter__ BPF.__enter___s rc&VP4R#r)rG)r)exc_typeexc_valexc_tbs&&&&r__exit__ BPF.__exit__bs  r)rCrHr?rIr=r>r9r@r1rBrAr<rJrDr;r:)ssys_s __x64_sys_s__x32_compat_sys_s__ia32_compat_sys_s __arm64_sys_s __s390x_sys_s __s390_sys_s __riscv_sys_)Nr@)F)NNNr)rrrr)rrrrr)rrr)rr)r)r@r@rrrr@r@r@)r@rr@r@r@)r@r@)rrrNrr@r)rrrNrr@)rrNr@r)rrNr@)FFT)FF)r@)rErFrGrHrrrrrrQrrrrrrrrrrrrrrrrrrrrrrrXDP_FLAGS_UPDATE_IF_NOEXISTrXDP_FLAGS_SKB_MODErXDP_FLAGS_DRV_MODErXDP_FLAGS_HW_MODErXDP_FLAGS_REPLACErcompilerrarbcc_buildsymcache_newrjrr-rr%rrCDLL_librt clock_gettimerc_intr'argtypes classmethodrrr objectr staticmethodrr&r+rtrprrrc_boolc_charc_wcharc_ubytec_shortc_ushortc_uintrc_ulong c_longlongrAc_floatc_double c_longdoublec_int64c_uint64rrrrrrrrrrrr rrrr"r&r*r0r3r6rBrMrSrQr\r`rfrirsrzrrrrrrrrrrrrrrrrrrrrrrrrrrrr rr r!r&r,r0r4r7rUrErSrKr^rbr:rqr.rvryr|rrrrrrrrrrrGrrrIrJrKs@rrrsL --M   F%%I%%I''J //C''J''J))K   F!!G##H##H   F--M   F //N"33!!G //C''K!!H!!H   F))L"*"<"<!**!** (( ((**-.KK**,J tVn5), i6 N OC2<<CWW\T 2F))N!xxH)=>N * *   E6   8!$cARd4#(hT$* @ )3P ")) BJJ "**  "**  2;;     "** bmm r~~ "** 2;;  RZZ!^!" bkkAo#I&))VU&   &OOOO  IIVO ((  )0 D D= D..--& - -%%$.  &&$L0 (   TT *')  "   DD >> $* : > 8II I I  n7r@ % * *38 !DF & $ $..` B B;;$$( = 7'>= 7%??* #)Jrr)E __future__rrEctypesr%r?rrrrr r1r3libbccrrrrrtabler r r r r perfrutilsrrrrrversionr disassemblerrrrhrrr NameErrorrrrrrrr rr7 DEBUG_LLVM_IRr{DEBUG_PREPROCESSOR DEBUG_SOURCErz DEBUG_BTFrr"rNrVrbrorrrrrrrrrs9&  ]]YYVV 6%  '',,w * ww~~g#G      )&)V    8  0((T`&`}Js6D44 E?E