Using Python in the Linux Kernel

Kernel development is typically harder compared to usermode development. Partly because the developed program is more complex, but also because development tools are fewer and less capable, build cycles are slower, fewer types of debuggers are available, you might need to reboot frequently, etc. And primarily, interactive prototyping is missing.

Wishing for a tool that'll close some of these gaps, I ported an existing Python implementation to run in kernel mode. Created as a research tool for inspection, it picked up extra features. From basic, read-only introspection it gained interactive, full interop abilities on a live kernel.

We'll see how it can be used to easily inspect & modify functionality of a running kernel. We'll also see the differences between this unsafe (& non production-ready) approach to safe, stable tools like eBPF & existing tracing frameworks.

About the speaker:

Yonatan Goldschmidt is a senior software engineer at Granulate, overseeing the development and deployment of their real-time continuous optimization solution as an expert in low-level programming. Before joining Granulate, Yonatan served for nearly six years in the Israel Defense Forces as a Team Lead and R&D Specialist.