Lines Matching +full:use +full:- +full:kernel
1 .. SPDX-License-Identifier: GPL-2.0
7 libbpf is a C-based library containing a BPF loader that takes compiled BPF
8 object files and prepares and loads them into the Linux kernel. libbpf takes the
10 kernel hooks, allowing BPF application developers to focus only on BPF program
13 The following are the high-level features supported by libbpf:
15 * Provides high-level and low-level APIs for user space programs to interact
16 with BPF programs. The low-level APIs wrap all the bpf system call
17 functionality, which is useful when users need more fine-grained control
22 * Provides BPF-side APIS, including BPF helper definitions, BPF maps support,
24 * Supports BPF CO-RE mechanism, enabling BPF developers to write portable
25 BPF programs that can be compiled once and run across different kernel
38 a common set of data. libbpf provides APIs that user space programs can use to
48 (setting BPF program types, if necessary; pre-setting initial values for
53 the kernel. At this point, libbpf validates all the parts of a BPF application
54 and loads the BPF program into the kernel, but no BPF program has yet been
66 libbpf detaches BPF programs and unloads them from the kernel. BPF maps are
87 * ``<name>__attach()`` – attaches all auto-attachable BPF programs (it’s
99 ---------------------------------------
110 string-based lookups with ``bpf_object_find_map_by_name()`` and
112 code and user-space code getting out of sync.
120 libbpf provides BPF-side APIs that BPF programs can use to interact with the
121 system. The BPF helpers definition allows developers to use them in BPF code as
127 the return value, see the `bpf-helpers
128 <https://man7.org/linux/man-pages/man7/bpf-helpers.7.html>`_ man page.
130 BPF CO-RE (Compile Once – Run Everywhere)
133 BPF programs work in the kernel space and have access to kernel memory and data
135 portability across different kernel versions and configurations. `BCC
140 libbpf steps up the BPF program portability by supporting the BPF CO-RE concept.
141 BPF CO-RE brings together BTF type information, libbpf, and the compiler to
142 produce a single executable binary that you can run on multiple kernel versions
146 running kernel. Kernel also exposes this self-describing authoritative BTF
147 information through ``sysfs`` at ``/sys/kernel/btf/vmlinux``.
149 You can generate the BTF information for the running kernel with the following
154 $ bpftool btf dump file /sys/kernel/btf/vmlinux format c > vmlinux.h
156 The command generates a ``vmlinux.h`` header file with all kernel types
157 (:doc:`BTF types <../btf>`) that the running kernel uses. Including
158 ``vmlinux.h`` in your BPF program eliminates dependency on system-wide kernel
163 information (vmlinux) provided by the running kernel. libbpf then resolves and
166 specific kernel on the host. BPF CO-RE concept thus eliminates overhead
171 The following code snippet shows how to read the parent field of a kernel
172 ``task_struct`` using BPF CO-RE and libbf. The basic helper to read a field in a
173 CO-RE relocatable manner is ``bpf_core_read(dst, sz, src)``, which will read
177 .. code-block:: C
178 :emphasize-lines: 6
185 err = bpf_core_read(&parent_task, sizeof(void *), &task->parent);
190 /* parent_task contains the value of task->parent pointer */
193 ``bpf_get_current_task()``. We then use ``bpf_core_read()`` to read the parent
196 about the field that should be relocated on the target kernel. i.e, if the
204 Check out the `libbpf-bootstrap <https://github.com/libbpf/libbpf-bootstrap>`_
214 If you are building BPF applications in Rust, it is recommended to use the
215 `Libbpf-rs <https://github.com/libbpf/libbpf-rs>`_ library instead of bindgen
216 bindings directly to libbpf. Libbpf-rs wraps libbpf functionality in
217 Rust-idiomatic interfaces and provides libbpf-cargo plugin to handle BPF code
218 compilation and skeleton generation. Using Libbpf-rs will make building user
228 …tps://libbpf.readthedocs.io/en/latest/libbpf_naming_convention.html#api-documentation-convention>`_