Python-BPF/examples/struct_and_perf.py at c27da22bcb2146a1b0ea6711de20a8c962407a9e · pythonbpf/Python-BPF · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
from pythonbpf import bpf, map, struct, section, bpfglobal, compile
from pythonbpf.helpers import ktime, pid
from pythonbpf.maps import PerfEventArray

from ctypes import c_void_p, c_int32, c_uint64


@bpf
@struct
class data_t:
    pid: c_uint64
    ts: c_uint64
    comm: str(16)


@bpf
@map
def events() -> PerfEventArray:
    return PerfEventArray(key_size=c_int32, value_size=c_int32)


@bpf
@section("tracepoint/syscalls/sys_enter_clone")
def hello(ctx: c_void_p) -> c_int32:
    dataobj = data_t()
    ts = ktime()
    strobj = "hellohellohello"
    dataobj.pid = pid()
    dataobj.ts = ktime()
    # dataobj.comm = strobj
    print(
        f"clone called at {dataobj.ts} by pid {dataobj.pid}, comm {strobj} at time {ts}"
    )
    events.output(dataobj)
    return c_int32(0)


@bpf
@bpfglobal
def LICENSE() -> str:
    return "GPL"


compile()