PythonBPF

Getting Started

  • Getting Started
    • What You’ll Learn
    • Prerequisites
    • Next Steps
    • Need Help?
  • Installation
    • Prerequisites
      • System Requirements
      • Required System Packages
        • On Ubuntu/Debian:
        • On Fedora/RHEL/CentOS:
        • On Arch Linux:
    • Installing PythonBPF
      • From PyPI (Recommended)
      • Development Installation
      • Installing Documentation Dependencies
    • Generating vmlinux.py
    • Verifying Installation
    • Troubleshooting
      • Permission Errors
      • LLVM/Clang Not Found
      • Import Errors
    • Next Steps
  • Quick Start
    • Your First BPF Program
      • Step 1: Create the Program
      • Step 2: Run the Program
      • Step 3: See it in Action
    • Understanding the Code
      • Imports
      • The BPF Function
      • License Declaration
      • Compilation and Execution
    • Next Example: Tracking Process IDs
    • Common Patterns
      • Tracepoints
      • Kprobes
      • XDP (eXpress Data Path)
    • Best Practices
    • Common Issues
      • Program Won’t Load
      • No Output
      • Compilation Errors
      • Verification Failure
    • Next Steps

User Guide

  • User Guide
    • Overview
    • Core Concepts
      • Decorators
      • Compilation Pipeline
    • Code Organization
    • Type System
    • Example Structure
    • Next Steps
  • Decorators
    • @bpf
      • Usage
      • Description
      • Rules
      • Example
    • @section
      • Usage
      • Section Types
        • Tracepoints
        • Kprobes
        • Kretprobes
        • XDP (eXpress Data Path)
      • Finding Tracepoints
    • @map
      • Usage
      • Description
      • Example
    • @struct
      • Usage
      • Description
      • Field Types
      • Example
    • @bpfglobal
      • Usage
      • Description
      • Common Global Variables
        • LICENSE (Required)
        • Custom Global Variables
    • Combining Decorators
      • Correct Order
      • Examples by Use Case
        • Simple Tracepoint
        • Map Definition
        • Struct Definition
        • Global Variable
    • Best Practices
    • Common Errors
      • Missing @bpf Decorator
      • Wrong Decorator Order
      • Missing Type Hints
    • Next Steps
  • BPF Maps
    • Map Types
      • HashMap
        • Definition
        • Parameters
        • Operations
        • Use Cases
        • Example: Process Counter
      • PerfEventArray
        • Definition
        • Parameters
        • Operations
        • Use Cases
        • Example: Event Logging
      • RingBuffer
        • Definition
        • Parameters
        • Operations
        • Use Cases
        • Advantages over PerfEventArray
      • BPFMapType Enum
    • Using Maps with Structs
    • Accessing Maps from Userspace
    • Common Patterns
      • Counter Pattern
      • Latency Tracking
      • Event Sampling
    • Troubleshooting
      • Map Not Found
      • Map Full
      • Type Errors
    • Examples
    • Next Steps
  • BPF Structs
    • Defining Structs
    • Field Types
      • Integer Types
      • String Types
      • Pointer Types
      • Nested Structs
    • Using Structs
      • As Local Variables
      • As Map Keys and Values
      • With Perf Events
      • With Ring Buffers
    • Field Access and Modification
      • Reading Fields
      • Writing Fields
    • StructType Class
    • Complex Examples
      • Network Packet Event
      • Process Lifecycle Tracking
    • Troubleshooting
      • Struct Size Issues
      • Initialization Problems
      • Type Mismatch Errors
    • Reading Struct Data in Userspace
    • Next Steps
  • Compilation
    • Overview
    • Compilation Functions
      • compile_to_ir()
        • Signature
        • Parameters
        • Usage
        • Output
      • compile()
        • Signature
        • Parameters
        • Usage
        • Output
      • BPF Class
        • Signature
        • Parameters
        • Methods
    • Complete Example
    • Compilation Pipeline Details
      • AST Parsing
      • IR Generation
      • BPF Compilation
      • Kernel Loading
    • Debugging Compilation
      • Logging
      • Inspecting LLVM IR
      • Using bpftool
      • Verifier Errors
    • Compilation Options
      • Optimization Levels
      • Debug Information
    • Working with Compiled Objects
      • Loading Pre-compiled Objects
      • Distribution
      • Version Compatibility
    • Troubleshooting
      • Compilation Fails
      • Loading Fails
      • Programs Don’t Attach
    • Next Steps
  • Helper Functions and Utilities
    • BPF Helper Functions
      • Process and Task Information
        • pid()
        • comm()
        • uid()
      • Time and Timing
        • ktime()
      • CPU Information
        • smp_processor_id()
      • Memory Operations
        • probe_read()
        • probe_read_str()
      • Random Numbers
        • random()
      • Network Helpers
        • skb_store_bytes()
    • Userspace Utilities
      • trace_pipe()
      • trace_fields()
    • Helper Function Examples
      • Example 1: Latency Measurement
      • Example 2: Process Tracking
      • Example 3: CPU Load Monitoring
      • Example 4: Event Sampling
    • Troubleshooting
      • Helper Not Available
      • Trace Pipe Access Denied
    • Examples
    • Next Steps

API Reference

  • API Reference
    • Module Overview
    • Public API
    • Decorators
      • bpf()
      • bpfglobal()
      • map()
      • struct()
      • section()
      • bpf
      • map
      • section
      • bpfglobal
      • struct
    • Compilation Functions
      • finalize_module()
      • bpf_passthrough_gen()
      • find_bpf_chunks()
      • processor()
      • compile_to_ir()
      • compile()
      • BPF()
      • compile_to_ir()
      • compile()
      • BPF
    • Utilities
      • trace_pipe()
      • trace_fields()
      • trace_pipe()
      • trace_fields()
    • Map Types
      • HashMap
        • HashMap.__init__()
        • HashMap.lookup()
        • HashMap.delete()
        • HashMap.update()
      • PerfEventArray
        • PerfEventArray.__init__()
        • PerfEventArray.output()
      • RingBuffer
        • RingBuffer.__init__()
        • RingBuffer.output()
        • RingBuffer.reserve()
        • RingBuffer.submit()
        • RingBuffer.discard()
      • HashMap
      • PerfEventArray
      • RingBuffer
    • Helper Functions
      • ktime()
      • pid()
      • deref()
      • comm()
      • probe_read_str()
      • random()
      • probe_read()
      • smp_processor_id()
      • uid()
      • skb_store_bytes()
      • get_stack()
      • get_current_cgroup_id()
      • Process Information
      • Time
      • CPU
      • Memory
      • Random
    • Type System
      • Integer Types
      • Other Types
    • Examples
      • Basic Usage
      • With Maps
      • With Structs
    • See Also
PythonBPF
  • Search

© Copyright 2026, Pragyansh Chaturvedi, Varun Mallya.

Built with Sphinx using a theme provided by Read the Docs.