mirror of
https://github.com/varun-r-mallya/Python-BPF.git
synced 2025-12-31 21:06:25 +00:00
111 lines
2.6 KiB
Plaintext
111 lines
2.6 KiB
Plaintext
{
|
|
"cells": [
|
|
{
|
|
"cell_type": "code",
|
|
"execution_count": null,
|
|
"id": "79b74928-f4b4-4320-96e3-d973997de2f4",
|
|
"metadata": {},
|
|
"outputs": [],
|
|
"source": [
|
|
"from pythonbpf import bpf, map, struct, section, bpfglobal, BPF\n",
|
|
"from pythonbpf.helper import ktime, pid, comm\n",
|
|
"from pythonbpf.maps import PerfEventArray\n",
|
|
"from ctypes import c_void_p, c_int64"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "code",
|
|
"execution_count": null,
|
|
"id": "5bdb0329-ae2d-45e8-808e-5ed5b1374204",
|
|
"metadata": {},
|
|
"outputs": [],
|
|
"source": [
|
|
"@bpf\n",
|
|
"@struct\n",
|
|
"class data_t:\n",
|
|
" pid: c_int64\n",
|
|
" ts: c_int64\n",
|
|
" comm: str(16)\n",
|
|
"\n",
|
|
"\n",
|
|
"@bpf\n",
|
|
"@map\n",
|
|
"def events() -> PerfEventArray:\n",
|
|
" return PerfEventArray(key_size=c_int64, value_size=c_int64)\n",
|
|
"\n",
|
|
"\n",
|
|
"@bpf\n",
|
|
"@section(\"tracepoint/syscalls/sys_enter_clone\")\n",
|
|
"def hello(ctx: c_void_p) -> c_int64:\n",
|
|
" dataobj = data_t()\n",
|
|
" dataobj.pid, dataobj.ts = pid(), ktime()\n",
|
|
" comm(dataobj.comm)\n",
|
|
" events.output(dataobj)\n",
|
|
" return 0\n",
|
|
"\n",
|
|
"\n",
|
|
"@bpf\n",
|
|
"@bpfglobal\n",
|
|
"def LICENSE() -> str:\n",
|
|
" return \"GPL\"\n",
|
|
"\n",
|
|
"\n",
|
|
"# Compile and load\n",
|
|
"b = BPF()\n",
|
|
"b.load()\n",
|
|
"b.attach_all()"
|
|
]
|
|
},
|
|
{
|
|
"cell_type": "code",
|
|
"execution_count": null,
|
|
"id": "4bcc7d57-6cc4-48a3-bbd2-42ad6263afdf",
|
|
"metadata": {},
|
|
"outputs": [],
|
|
"source": [
|
|
"start = 0\n",
|
|
"\n",
|
|
"\n",
|
|
"def callback(cpu, event):\n",
|
|
" global start\n",
|
|
" if start == 0:\n",
|
|
" start = event.ts\n",
|
|
" ts = (event.ts - start) / 1e9\n",
|
|
" print(f\"[CPU {cpu}] PID: {event.pid}, TS: {ts}, COMM: {event.comm.decode()}\")\n",
|
|
"\n",
|
|
"\n",
|
|
"perf = b[\"events\"].open_perf_buffer(callback, struct_name=\"data_t\")\n",
|
|
"print(\"Starting to poll... (Ctrl+C to stop)\")\n",
|
|
"print(\"Try running: fork() or clone() system calls to trigger events\")\n",
|
|
"\n",
|
|
"try:\n",
|
|
" while True:\n",
|
|
" b[\"events\"].poll(1000)\n",
|
|
"except KeyboardInterrupt:\n",
|
|
" print(\"Stopping...\")"
|
|
]
|
|
}
|
|
],
|
|
"metadata": {
|
|
"kernelspec": {
|
|
"display_name": "Python 3 (ipykernel)",
|
|
"language": "python",
|
|
"name": "python3"
|
|
},
|
|
"language_info": {
|
|
"codemirror_mode": {
|
|
"name": "ipython",
|
|
"version": 3
|
|
},
|
|
"file_extension": ".py",
|
|
"mimetype": "text/x-python",
|
|
"name": "python",
|
|
"nbconvert_exporter": "python",
|
|
"pygments_lexer": "ipython3",
|
|
"version": "3.13.3"
|
|
}
|
|
},
|
|
"nbformat": 4,
|
|
"nbformat_minor": 5
|
|
}
|