Learning eBPF

Chapter 4. The bpf() System Call

As you saw in Chapter 1, when user space applications want the kernel to do something on their behalf, they make requests using the system call API. It therefore makes sense that if a user space application wants to load an eBPF program into the kernel, there must be some system calls involved. In fact, there’s a system call named bpf(), and in this chapter I’ll show you how it’s used to load and interact with eBPF programs and maps.

It’s worth noting that the eBPF code running in the kernel does not use syscalls to access maps. The syscall interface is only used by user space applications. Instead, eBPF programs use helper functions to read and write to maps; you already saw examples of this in the previous two chapters.

If you go on to write eBPF programs yourself, there’s a good chance you won’t directly call these bpf() system calls yourself. There are libraries that I’ll discuss later in the book that offer higher-level abstractions to make things easier. That said, those abstractions generally map pretty directly to the underlying syscall commands you’ll see in this chapter. Whatever library you’re using, you’ll need a grasp of the underlying operations—loading a program, creating and accessing maps, and so on—that you’ll see in this chapter.

Before I show you examples of bpf() system calls, let’s consider what the manpage for bpf() says, which is that bpf() is used to “perform a command on an extended BPF map or program.” It also tells us ...