An opinionated libbpf/BPF CO-RE (Compile Once---Run Everywhere) library for the Python3 (read Python 3.6+) ecosystem.
DISCLAIMER: This library is in pre-alpha version and changes may result in API breakages. Pre-release version API breakages will be accompanied by a minor version number bump. Versions post 1.0.0 will follow semantic versioning and breakages will require a bump in major version number.
- Latest libbpf (https://github.com/libbpf/libbpf)
- Linux kernel compiled with BTF debug info
- bpftool (available from under linux/tools/bpf/bpftool from official kernel repositories)
- Clang/LLVM 10+
- gcc
- Python 3.6+
- A pre-compiled shared library for your BPF program, generated with PyBPF (see requirements above)
- Linux kernel compiled with BTF debug info
- Python 3.6+
Completed Features:
- Python
BPFObjectBuilderthat takes care of BPF program compilation and loading - Python
BPFObjectthat provides an interface into BPF programs and maps - The following map types:
HASHPERCPU_HASHLRU_HASHLRU_PERCPU_HASHARRAYPERCPU_ARRAYQUEUESTACK
Coming Features
- The following map types:
PROG_ARRAYPERF_EVENT_ARRAYSTACK_TRACECGROUP_ARRAYLPM_TRIEARRAY_OF_MAPSHASH_OF_MAPSDEVMAPSOCKMAPCPUMAPXSKMAPSOCKHASHCGROUP_STORAGEREUSEPORT_SOCKARRAYPERCPU_CGROUP_STORAGESK_STORAGEDEVMAP_HASHSTRUCT_OPS
- USDT, uprobe loading
pybpfCLI tool for bootstrapping PyBPF projects
Distant Future:
- Automatic map key/value type inference
- Automatic per-event type inference
Coming soon!
Coming soon!