bpf/libbpf/libbpf_overview.rst

1 .. SPDX-License-Identifier: GPL-2.0
7 libbpf is a C-based library containing a BPF loader that takes compiled BPF
13 The following are the high-level features supported by libbpf:
15 * Provides high-level and low-level APIs for user space programs to interact
16   with BPF programs. The low-level APIs wrap all the bpf system call
17   functionality, which is useful when users need more fine-grained control
22 * Provides BPF-side APIS, including BPF helper definitions, BPF maps support,
24 * Supports BPF CO-RE mechanism, enabling BPF developers to write portable
42 The following section provides a brief overview of each phase in the BPF life
45 * **Open phase**: In this phase, libbpf parses the BPF
48   (setting BPF program types, if necessary; pre-setting initial values for
51 * **Load phase**: In the load phase, libbpf creates BPF
55   executed. After the load phase, it’s possible to set up the initial BPF map
58 * **Attachment phase**: In this phase, libbpf
61   phase, BPF programs perform useful work such as processing
65 * **Tear down phase**: In the tear down phase,
87 * ``<name>__attach()`` – attaches all auto-attachable BPF programs (it’s
99 ---------------------------------------
104   BPF programs before the BPF load phase and fetch and update data from user
110   string-based lookups with ``bpf_object_find_map_by_name()`` and
112   code and user-space code getting out of sync.
120 libbpf provides BPF-side APIs that BPF programs can use to interact with the
127 the return value, see the `bpf-helpers
128 <https://man7.org/linux/man-pages/man7/bpf-helpers.7.html>`_ man page.
130 BPF CO-RE (Compile Once – Run Everywhere)
140 libbpf steps up the BPF program portability by supporting the BPF CO-RE concept.
141 BPF CO-RE brings together BTF type information, libbpf, and the compiler to
142 produce a single executable binary that you can run on multiple kernel versions
146 running kernel. Kernel also exposes this self-describing authoritative BTF
158 ``vmlinux.h`` in your BPF program eliminates dependency on system-wide kernel
166 specific kernel on the host. BPF CO-RE concept thus eliminates overhead
172 ``task_struct`` using BPF CO-RE and libbf. The basic helper to read a field in a
173 CO-RE relocatable manner is ``bpf_core_read(dst, sz, src)``, which will read
177 .. code-block:: C
178    :emphasize-lines: 6
185     err = bpf_core_read(&parent_task, sizeof(void *), &task->parent);
190     /* parent_task contains the value of task->parent pointer */
204 Check out the `libbpf-bootstrap <https://github.com/libbpf/libbpf-bootstrap>`_
215 `Libbpf-rs <https://github.com/libbpf/libbpf-rs>`_ library instead of bindgen
216 bindings directly to libbpf. Libbpf-rs wraps libbpf functionality in
217 Rust-idiomatic interfaces and provides libbpf-cargo plugin to handle BPF code
218 compilation and skeleton generation. Using Libbpf-rs will make building user
236 …tps://libbpf.readthedocs.io/en/latest/libbpf_naming_convention.html#api-documentation-convention>`_