BPF_MAP_TYPE_ARRAY: "ARRAY",

BPF_MAP_TYPE_PROG_ARRAY: "PROG_ARRAY",

BPF_MAP_TYPE_PERF_EVENT_ARRAY: "PERF_EVENT_ARRAY",

BPF_MAP_TYPE_PERCPU_HASH: "PERCPU_HASH",

BPF_MAP_TYPE_PERCPU_ARRAY: "PERCPU_ARRAY",

BPF_MAP_TYPE_STACK_TRACE: "STACK_TRACE",

BPF_MAP_TYPE_CGROUP_ARRAY: "CGROUP_ARRAY",

BPF_MAP_TYPE_LRU_HASH: "LRU_HASH",

BPF_MAP_TYPE_LRU_PERCPU_HASH: "LRU_PERCPU_HASH",

BPF_MAP_TYPE_LPM_TRIE: "LPM_TRIE",

BPF_MAP_TYPE_ARRAY_OF_MAPS: "ARRAY_OF_MAPS",

BPF_MAP_TYPE_HASH_OF_MAPS: "HASH_OF_MAPS",

BPF_MAP_TYPE_DEVMAP: "DEVMAP",

BPF_MAP_TYPE_SOCKMAP: "SOCKMAP",

BPF_MAP_TYPE_CPUMAP: "CPUMAP",

BPF_MAP_TYPE_XSKMAP: "XSKMAP",

BPF_MAP_TYPE_SOCKHASH: "SOCKHASH",

BPF_MAP_TYPE_CGROUP_STORAGE: "CGROUP_STORAGE",

BPF_MAP_TYPE_REUSEPORT_SOCKARRAY: "REUSEPORT_SOCKARRAY",

BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE: "PERCPU_CGROUP_STORAGE",

BPF_MAP_TYPE_QUEUE: "QUEUE",

BPF_MAP_TYPE_STACK: "STACK",

BPF_MAP_TYPE_SK_STORAGE: "SK_STORAGE",

BPF_MAP_TYPE_DEVMAP_HASH: "DEVMAP_HASH",

BPF_MAP_TYPE_STRUCT_OPS: "STRUCT_OPS",

i = 0

text = ""

while (1):

if (i > (width * val / val_max) - 1) or (i > width - 1):

break

text += "*"

i += 1

if val > val_max:

text = text[:-1] + "+"

global stars_max

log2_dist_max = 64

idx_max = -1

val_max = 0

for i, v in enumerate(vals):

if v > 0: idx_max = i

if v > val_max: val_max = v

if idx_max <= 32:

header = " %-19s : count distribution"

body = "%10d -> %-10d : %-8d |%-*s|"

stars = stars_max

else:

header = " %-29s : count distribution"

body = "%20d -> %-20d : %-8d |%-*s|"

stars = int(stars_max / 2)

if idx_max > 0:

print(header % val_type)

for i in range(1, idx_max + 1):

low = (1 << i) >> 1

high = (1 << i) - 1

if (low == high):

low -= 1

val = vals[i]

if strip_leading_zero:

if val:

print(body % (low, high, val, stars,

_stars(val, val_max, stars)))

strip_leading_zero = False

else:

print(body % (low, high, val, stars,

global stars_max

log2_dist_max = 64

idx_max = -1

val_max = 0

for i, v in enumerate(vals):

if v > 0: idx_max = i

if v > val_max: val_max = v

header = " %-13s : count distribution"

body = " %-10d : %-8d |%-*s|"

stars = stars_max

if idx_max >= 0:

print(header % val_type);

for i in range(0, idx_max + 1):

val = vals[i]

print(body % (i, val, stars,

try:

return map_type_name[ttype]

except KeyError:

ct_mapping = { 'char' : ct.c_char,

's8' : ct.c_char,

'unsigned char' : ct.c_ubyte,

'u8' : ct.c_ubyte,

'u8 *' : ct.c_char_p,

'char *' : ct.c_char_p,

'short' : ct.c_short,

's16' : ct.c_short,

'unsigned short' : ct.c_ushort,

'u16' : ct.c_ushort,

'int' : ct.c_int,

's32' : ct.c_int,

'enum' : ct.c_int,

'unsigned int' : ct.c_uint,

'u32' : ct.c_uint,

'long' : ct.c_long,

'unsigned long' : ct.c_ulong,

'long long' : ct.c_longlong,

's64' : ct.c_longlong,

'unsigned long long': ct.c_ulonglong,

'u64' : ct.c_ulonglong,

'__int128' : (ct.c_longlong * 2),

'unsigned __int128' : (ct.c_ulonglong * 2),

'void *' : ct.c_void_p }

# handle array types e.g. "int [16] foo"

array_type = re.compile(r"(.+) \[([0-9]+)\]$")

fields = []

num_fields = lib.bpf_perf_event_fields(event_map.bpf.module, event_map._name)

i = 0

while i < num_fields:

field = lib.bpf_perf_event_field(event_map.bpf.module, event_map._name, i).decode()

m = re.match(r"(.*)#(.*)", field)

field_name = m.group(1)

field_type = m.group(2)

if re.match(r"enum .*", field_type):

field_type = "enum"

m = array_type.match(field_type)

try:

if m:

fields.append((field_name, ct_mapping[m.group(1)] * int(m.group(2))))

else:

fields.append((field_name, ct_mapping[field_type]))

except KeyError:

# Using print+sys.exit instead of raising exceptions,

# because exceptions are caught by the caller.

print("Type: '%s' not recognized. Please define the data with ctypes manually."

% field_type, file=sys.stderr)

sys.exit(1)

i += 1

"""Table(bpf, map_id, map_fd, keytype, leaftype, **kwargs)

ttype = lib.bpf_table_type_id(bpf.module, map_id)

t = None

if ttype == BPF_MAP_TYPE_HASH:

t = HashTable(bpf, map_id, map_fd, keytype, leaftype)

elif ttype == BPF_MAP_TYPE_ARRAY:

t = Array(bpf, map_id, map_fd, keytype, leaftype)

elif ttype == BPF_MAP_TYPE_PROG_ARRAY:

t = ProgArray(bpf, map_id, map_fd, keytype, leaftype)

elif ttype == BPF_MAP_TYPE_PERF_EVENT_ARRAY:

t = PerfEventArray(bpf, map_id, map_fd, keytype, leaftype, name)

elif ttype == BPF_MAP_TYPE_PERCPU_HASH:

t = PerCpuHash(bpf, map_id, map_fd, keytype, leaftype, **kwargs)

elif ttype == BPF_MAP_TYPE_PERCPU_ARRAY:

t = PerCpuArray(bpf, map_id, map_fd, keytype, leaftype, **kwargs)

elif ttype == BPF_MAP_TYPE_LPM_TRIE:

t = LpmTrie(bpf, map_id, map_fd, keytype, leaftype)

elif ttype == BPF_MAP_TYPE_STACK_TRACE:

t = StackTrace(bpf, map_id, map_fd, keytype, leaftype)

elif ttype == BPF_MAP_TYPE_LRU_HASH:

t = LruHash(bpf, map_id, map_fd, keytype, leaftype)

elif ttype == BPF_MAP_TYPE_LRU_PERCPU_HASH:

t = LruPerCpuHash(bpf, map_id, map_fd, keytype, leaftype)

elif ttype == BPF_MAP_TYPE_CGROUP_ARRAY:

t = CgroupArray(bpf, map_id, map_fd, keytype, leaftype)

elif ttype == BPF_MAP_TYPE_DEVMAP:

t = DevMap(bpf, map_id, map_fd, keytype, leaftype)

elif ttype == BPF_MAP_TYPE_CPUMAP:

t = CpuMap(bpf, map_id, map_fd, keytype, leaftype)

elif ttype == BPF_MAP_TYPE_XSKMAP:

t = XskMap(bpf, map_id, map_fd, keytype, leaftype)

elif ttype == BPF_MAP_TYPE_ARRAY_OF_MAPS:

t = MapInMapArray(bpf, map_id, map_fd, keytype, leaftype)

elif ttype == BPF_MAP_TYPE_HASH_OF_MAPS:

t = MapInMapHash(bpf, map_id, map_fd, keytype, leaftype)

elif ttype == BPF_MAP_TYPE_QUEUE or ttype == BPF_MAP_TYPE_STACK:

t = QueueStack(bpf, map_id, map_fd, leaftype)

elif ttype == BPF_MAP_TYPE_RINGBUF:

t = RingBuf(bpf, map_id, map_fd, keytype, leaftype, name)

if t == None:

raise Exception("Unknown table type %d" % ttype)

def __init__(self, bpf, map_id, map_fd, keytype, leaftype, name=None):

self.bpf = bpf

self.map_id = map_id

self.map_fd = map_fd

self.Key = keytype

self.Leaf = leaftype

self.ttype = lib.bpf_table_type_id(self.bpf.module, self.map_id)

self.flags = lib.bpf_table_flags_id(self.bpf.module, self.map_id)

self._cbs = {}

self._name = name

def get_fd(self):

return self.map_fd

def key_sprintf(self, key):

buf = ct.create_string_buffer(ct.sizeof(self.Key) * 8)

res = lib.bpf_table_key_snprintf(self.bpf.module, self.map_id, buf,

len(buf), ct.byref(key))

if res < 0:

raise Exception("Could not printf key")

return buf.value

def leaf_sprintf(self, leaf):

buf = ct.create_string_buffer(ct.sizeof(self.Leaf) * 8)

res = lib.bpf_table_leaf_snprintf(self.bpf.module, self.map_id, buf,

len(buf), ct.byref(leaf))

if res < 0:

raise Exception("Could not printf leaf")

return buf.value

def key_scanf(self, key_str):

key = self.Key()

res = lib.bpf_table_key_sscanf(self.bpf.module, self.map_id, key_str,

ct.byref(key))

if res < 0:

raise Exception("Could not scanf key")

return key

def leaf_scanf(self, leaf_str):

leaf = self.Leaf()

res = lib.bpf_table_leaf_sscanf(self.bpf.module, self.map_id, leaf_str,

ct.byref(leaf))

if res < 0:

raise Exception("Could not scanf leaf")

return leaf

def __getitem__(self, key):

leaf = self.Leaf()

res = lib.bpf_lookup_elem(self.map_fd, ct.byref(key), ct.byref(leaf))

if res < 0:

raise KeyError

return leaf

def __setitem__(self, key, leaf):

res = lib.bpf_update_elem(self.map_fd, ct.byref(key), ct.byref(leaf), 0)

if res < 0:

errstr = os.strerror(ct.get_errno())

raise Exception("Could not update table: %s" % errstr)

def __delitem__(self, key):

res = lib.bpf_delete_elem(self.map_fd, ct.byref(key))

if res < 0:

raise KeyError

# override the MutableMapping's implementation of these since they

# don't handle KeyError nicely

def itervalues(self):

for key in self:

# a map entry may be deleted in between discovering the key and

# fetching the value, suppress such errors

try:

yield self[key]

except KeyError:

pass

def iteritems(self):

for key in self:

try:

yield (key, self[key])

except KeyError:

pass

def items(self):

return [item for item in self.iteritems()]

def values(self):

return [value for value in self.itervalues()]

def clear(self):

# default clear uses popitem, which can race with the bpf prog

for k in self.keys():

self.__delitem__(k)

def zero(self):

# Even though this is not very efficient, we grab the entire list of

# keys before enumerating it. This helps avoid a potential race where

# the leaf assignment changes a hash table bucket that is being

# enumerated by the same loop, and may lead to a hang.

for k in list(self.keys()):

self[k] = self.Leaf()

def __iter__(self):

return TableBase.Iter(self)

def iter(self): return self.__iter__()

def keys(self): return self.__iter__()

class Iter(object):

def __init__(self, table):

self.table = table

self.key = None

def __iter__(self):

return self

def __next__(self):

return self.next()

def next(self):

self.key = self.table.next(self.key)

return self.key

def next(self, key):

next_key = self.Key()

if key is None:

res = lib.bpf_get_first_key(self.map_fd, ct.byref(next_key),

ct.sizeof(self.Key))

else:

res = lib.bpf_get_next_key(self.map_fd, ct.byref(key),

ct.byref(next_key))

if res < 0:

raise StopIteration()

return next_key

def print_log2_hist(self, val_type="value", section_header="Bucket ptr",

section_print_fn=None, bucket_fn=None, strip_leading_zero=None,

bucket_sort_fn=None):

"""print_log2_hist(val_type="value", section_header="Bucket ptr",

if isinstance(self.Key(), ct.Structure):

tmp = {}

f1 = self.Key._fields_[0][0]

f2 = self.Key._fields_[1][0]

# The above code assumes that self.Key._fields_[1][0] holds the

# slot. But a padding member may have been inserted here, which

# breaks the assumption and leads to chaos.

# TODO: this is a quick fix. Fixing/working around in the BCC

# internal library is the right thing to do.

if f2 == '__pad_1' and len(self.Key._fields_) == 3:

f2 = self.Key._fields_[2][0]

for k, v in self.items():

bucket = getattr(k, f1)

if bucket_fn:

bucket = bucket_fn(bucket)

vals = tmp[bucket] = tmp.get(bucket, [0] * log2_index_max)

slot = getattr(k, f2)

vals[slot] = v.value

buckets = list(tmp.keys())

if bucket_sort_fn:

buckets = bucket_sort_fn(buckets)

for bucket in buckets:

vals = tmp[bucket]

if section_print_fn:

print("\n%s = %s" % (section_header,

section_print_fn(bucket)))

else:

print("\n%s = %r" % (section_header, bucket))

_print_log2_hist(vals, val_type, strip_leading_zero)

else:

vals = [0] * log2_index_max

for k, v in self.items():

vals[k.value] = v.value

_print_log2_hist(vals, val_type, strip_leading_zero)

def print_linear_hist(self, val_type="value", section_header="Bucket ptr",

section_print_fn=None, bucket_fn=None, bucket_sort_fn=None):

"""print_linear_hist(val_type="value", section_header="Bucket ptr",

if isinstance(self.Key(), ct.Structure):

tmp = {}

f1 = self.Key._fields_[0][0]

f2 = self.Key._fields_[1][0]

for k, v in self.items():

bucket = getattr(k, f1)

if bucket_fn:

bucket = bucket_fn(bucket)

vals = tmp[bucket] = tmp.get(bucket, [0] * linear_index_max)

slot = getattr(k, f2)

vals[slot] = v.value

buckets = tmp.keys()

if bucket_sort_fn:

buckets = bucket_sort_fn(buckets)

for bucket in buckets:

vals = tmp[bucket]

if section_print_fn:

print("\n%s = %s" % (section_header,

section_print_fn(bucket)))

else:

print("\n%s = %r" % (section_header, bucket))

_print_linear_hist(vals, val_type)

else:

vals = [0] * linear_index_max

for k, v in self.items():

try:

vals[k.value] = v.value

except IndexError:

# Improve error text. If the limit proves a nusiance, this

# function be rewritten to avoid having one.

raise IndexError(("Index in print_linear_hist() of %d " +

"exceeds max of %d.") % (k.value, linear_index_max))

def __init__(self, *args, **kwargs):

super(HashTable, self).__init__(*args, **kwargs)

def __len__(self):

i = 0

for k in self: i += 1

def __init__(self, *args, **kwargs):

super(ArrayBase, self).__init__(*args, **kwargs)

self.max_entries = int(lib.bpf_table_max_entries_id(self.bpf.module,

self.map_id))

def _normalize_key(self, key):

if isinstance(key, int):

if key < 0:

key = len(self) + key

key = self.Key(key)

if not isinstance(key, ct._SimpleCData):

raise IndexError("Array index must be an integer type")

if key.value >= len(self):

raise IndexError("Array index out of range")

return key

def __len__(self):

return self.max_entries

def __getitem__(self, key):

key = self._normalize_key(key)

return super(ArrayBase, self).__getitem__(key)

def __setitem__(self, key, leaf):

key = self._normalize_key(key)

super(ArrayBase, self).__setitem__(key, leaf)

def __delitem__(self, key):

key = self._normalize_key(key)

super(ArrayBase, self).__delitem__(key)

def clearitem(self, key):

key = self._normalize_key(key)

leaf = self.Leaf()

res = lib.bpf_update_elem(self.map_fd, ct.byref(key), ct.byref(leaf), 0)

if res < 0:

raise Exception("Could not clear item")

def __iter__(self):

return ArrayBase.Iter(self, self.Key)

class Iter(object):

def __init__(self, table, keytype):

self.Key = keytype

self.table = table

self.i = -1

def __iter__(self):

return self

def __next__(self):

return self.next()

def next(self):

self.i += 1

if self.i == len(self.table):

raise StopIteration()

def __init__(self, *args, **kwargs):

super(Array, self).__init__(*args, **kwargs)

def __delitem__(self, key):

# Delete in Array type does not have an effect, so zero out instead

def __init__(self, *args, **kwargs):

super(ProgArray, self).__init__(*args, **kwargs)

def __setitem__(self, key, leaf):

if isinstance(leaf, int):

leaf = self.Leaf(leaf)

if isinstance(leaf, self.bpf.Function):

leaf = self.Leaf(leaf.fd)

def __init__(self, fd):

if (fd is None) or (fd < 0):

raise Exception("Invalid file descriptor")

self.fd = fd

def clean_up(self):

if (self.fd is not None) and (self.fd >= 0):

os.close(self.fd)

self.fd = None

def __del__(self):

self.clean_up()

def __enter__(self, *args, **kwargs):

return self

def __exit__(self, *args, **kwargs):

def __init__(self, *args, **kwargs):

super(CgroupArray, self).__init__(*args, **kwargs)

def __setitem__(self, key, leaf):

if isinstance(leaf, int):

super(CgroupArray, self).__setitem__(key, self.Leaf(leaf))

elif isinstance(leaf, str):

# TODO: Add os.O_CLOEXEC once we move to Python version >3.3

with FileDesc(os.open(leaf, os.O_RDONLY)) as f:

super(CgroupArray, self).__setitem__(key, self.Leaf(f.fd))

else:

def __init__(self, *args, **kwargs):

super(PerfEventArray, self).__init__(*args, **kwargs)

self._open_key_fds = {}

self._event_class = None

def __del__(self):

keys = list(self._open_key_fds.keys())

for key in keys:

del self[key]

def __delitem__(self, key):

if key not in self._open_key_fds:

return

# Delete entry from the array

super(PerfEventArray, self).__delitem__(key)

key_id = (id(self), key)

if key_id in self.bpf.perf_buffers:

# The key is opened for perf ring buffer

lib.perf_reader_free(self.bpf.perf_buffers[key_id])

del self.bpf.perf_buffers[key_id]

del self._cbs[key]

else:

# The key is opened for perf event read

lib.bpf_close_perf_event_fd(self._open_key_fds[key])

del self._open_key_fds[key]

def event(self, data):

"""event(data)

if self._event_class == None:

self._event_class = _get_event_class(self)

return ct.cast(data, ct.POINTER(self._event_class)).contents

def open_perf_buffer(self, callback, page_cnt=8, lost_cb=None):

"""open_perf_buffers(callback)

if page_cnt & (page_cnt - 1) != 0:

raise Exception("Perf buffer page_cnt must be a power of two")

for i in get_online_cpus():

self._open_perf_buffer(i, callback, page_cnt, lost_cb)

def _open_perf_buffer(self, cpu, callback, page_cnt, lost_cb):

def raw_cb_(_, data, size):

try:

callback(cpu, data, size)

except IOError as e:

if e.errno == errno.EPIPE:

exit()

else:

raise e

def lost_cb_(_, lost):

try:

lost_cb(lost)

except IOError as e:

if e.errno == errno.EPIPE:

exit()

else:

raise e

fn = _RAW_CB_TYPE(raw_cb_)

lost_fn = _LOST_CB_TYPE(lost_cb_) if lost_cb else ct.cast(None, _LOST_CB_TYPE)

reader = lib.bpf_open_perf_buffer(fn, lost_fn, None, -1, cpu, page_cnt)

if not reader:

raise Exception("Could not open perf buffer")

fd = lib.perf_reader_fd(reader)

self[self.Key(cpu)] = self.Leaf(fd)

self.bpf.perf_buffers[(id(self), cpu)] = reader

# keep a refcnt

self._cbs[cpu] = (fn, lost_fn)

# The actual fd is held by the perf reader, add to track opened keys

self._open_key_fds[cpu] = -1

def _open_perf_event(self, cpu, typ, config):

fd = lib.bpf_open_perf_event(typ, config, -1, cpu)

if fd < 0:

raise Exception("bpf_open_perf_event failed")

self[self.Key(cpu)] = self.Leaf(fd)

self._open_key_fds[cpu] = fd

def open_perf_event(self, typ, config):

"""open_perf_event(typ, config)

for i in get_online_cpus():

def __init__(self, *args, **kwargs):

self.reducer = kwargs.pop("reducer", None)

super(PerCpuHash, self).__init__(*args, **kwargs)

self.sLeaf = self.Leaf

self.total_cpu = len(get_possible_cpus())

# This needs to be 8 as hard coded into the linux kernel.

self.alignment = ct.sizeof(self.sLeaf) % 8

if self.alignment == 0:

self.Leaf = self.sLeaf * self.total_cpu

else:

# Currently Float, Char, un-aligned structs are not supported

if self.sLeaf == ct.c_uint:

self.Leaf = ct.c_uint64 * self.total_cpu

elif self.sLeaf == ct.c_int:

self.Leaf = ct.c_int64 * self.total_cpu

else:

raise IndexError("Leaf must be aligned to 8 bytes")

def getvalue(self, key):

result = super(PerCpuHash, self).__getitem__(key)

if self.alignment == 0:

ret = result

else:

ret = (self.sLeaf * self.total_cpu)()

for i in range(0, self.total_cpu):

ret[i] = result[i]

return ret

def __getitem__(self, key):

if self.reducer:

return reduce(self.reducer, self.getvalue(key))

else:

return self.getvalue(key)

def __setitem__(self, key, leaf):

super(PerCpuHash, self).__setitem__(key, leaf)

def sum(self, key):

if isinstance(self.Leaf(), ct.Structure):

raise IndexError("Leaf must be an integer type for default sum functions")

return self.sLeaf(sum(self.getvalue(key)))

def max(self, key):

if isinstance(self.Leaf(), ct.Structure):

raise IndexError("Leaf must be an integer type for default max functions")

return self.sLeaf(max(self.getvalue(key)))

def average(self, key):

result = self.sum(key)

def __init__(self, *args, **kwargs):

self.reducer = kwargs.pop("reducer", None)

super(PerCpuArray, self).__init__(*args, **kwargs)

self.sLeaf = self.Leaf

self.total_cpu = len(get_possible_cpus())

# This needs to be 8 as hard coded into the linux kernel.

self.alignment = ct.sizeof(self.sLeaf) % 8

if self.alignment == 0:

self.Leaf = self.sLeaf * self.total_cpu

else:

# Currently Float, Char, un-aligned structs are not supported

if self.sLeaf == ct.c_uint:

self.Leaf = ct.c_uint64 * self.total_cpu

elif self.sLeaf == ct.c_int:

self.Leaf = ct.c_int64 * self.total_cpu

else:

raise IndexError("Leaf must be aligned to 8 bytes")

def getvalue(self, key):

result = super(PerCpuArray, self).__getitem__(key)

if self.alignment == 0:

ret = result

else:

ret = (self.sLeaf * self.total_cpu)()

for i in range(0, self.total_cpu):

ret[i] = result[i]

return ret

def __getitem__(self, key):

if (self.reducer):

return reduce(self.reducer, self.getvalue(key))

else:

return self.getvalue(key)

def __setitem__(self, key, leaf):

super(PerCpuArray, self).__setitem__(key, leaf)

def __delitem__(self, key):

# Delete in this type does not have an effect, so zero out instead

self.clearitem(key)

def sum(self, key):

if isinstance(self.Leaf(), ct.Structure):

raise IndexError("Leaf must be an integer type for default sum functions")

return self.sLeaf(sum(self.getvalue(key)))

def max(self, key):

if isinstance(self.Leaf(), ct.Structure):

raise IndexError("Leaf must be an integer type for default max functions")

return self.sLeaf(max(self.getvalue(key)))

def average(self, key):

result = self.sum(key)

def __init__(self, *args, **kwargs):

super(LpmTrie, self).__init__(*args, **kwargs)

def __len__(self):

MAX_DEPTH = 127

BPF_F_STACK_BUILD_ID = (1<<5)

BPF_STACK_BUILD_ID_EMPTY = 0 #can't get stacktrace

BPF_STACK_BUILD_ID_VALID = 1 #valid build-id,ip

BPF_STACK_BUILD_ID_IP = 2 #fallback to ip

def __init__(self, *args, **kwargs):

super(StackTrace, self).__init__(*args, **kwargs)

class StackWalker(object):

def __init__(self, stack, flags, resolve=None):

self.stack = stack

self.n = -1

self.resolve = resolve

self.flags = flags

def __iter__(self):

return self

def __next__(self):

return self.next()

def next(self):

self.n += 1

if self.n == StackTrace.MAX_DEPTH:

raise StopIteration()

if self.flags & StackTrace.BPF_F_STACK_BUILD_ID:

addr = self.stack.trace[self.n]

if addr.status == StackTrace.BPF_STACK_BUILD_ID_IP or \

addr.status == StackTrace.BPF_STACK_BUILD_ID_EMPTY:

raise StopIteration()

else:

addr = self.stack.ip[self.n]

if addr == 0 :

raise StopIteration()

return self.resolve(addr) if self.resolve else addr

def walk(self, stack_id, resolve=None):

return StackTrace.StackWalker(self[self.Key(stack_id)], self.flags, resolve)

def __len__(self):

i = 0

for k in self: i += 1

return i

def clear(self):

def __init__(self, *args, **kwargs):

super(RingBuf, self).__init__(*args, **kwargs)

self._ringbuf = None

self._event_class = None

def __delitem(self, key):

pass

def __del__(self):

pass

def __len__(self):

return 0

def event(self, data):

"""event(data)

if self._event_class == None:

self._event_class = _get_event_class(self)

return ct.cast(data, ct.POINTER(self._event_class)).contents

def open_ring_buffer(self, callback, ctx=None):

"""open_ring_buffer(callback)

def ringbuf_cb_(ctx, data, size):

try:

ret = callback(ctx, data, size)

# Callback for ringbufs should _always_ return an integer.

# If the function the user registers does not,

# simply fall back to returning 0.

try:

ret = int(ret)

except:

ret = 0

except IOError as e:

if e.errno == errno.EPIPE:

exit()

else:

raise e

return ret