2

If I understood well there are different ebpf loaders:

  • bpf_load.c into the kernel source code
  • libbpf
  • bpftool
  • tc
  • ... <-- others?

Which are the main differences between them? Are they always interchangeably? Should I always prefer libbpf?

pchaigno
  • 11,313
  • 2
  • 29
  • 54
Maicake
  • 1,046
  • 10
  • 34

1 Answers1

4

In their last versions, bpftool, bcc, and bpf_load.c use libbpf. iproute2, and therefore tc, uses its own wrappers for BPF syscalls.

There likely are differences in APIs between libbpf and iproute2's own wrapper. You should prefer libbpf as it's becoming the standard (I think the plan it to use it in iproute2 as well).

pchaigno
  • 11,313
  • 2
  • 29
  • 54
  • 2
    There are patchsets being discussed at the moment to move iproute2 from its own wrappers to libbpf. Most alternatives (in C) to libbpf are here because they predate libbpf, so I agree, libbpf should be the one to pick. If using [go](https://github.com/iovisor/gobpf) or other languages, that's another matter, of course. – Qeole Aug 27 '19 at 09:00
  • gobpf relies on bcc which uses libbpf though :-) – pchaigno Aug 27 '19 at 09:10
  • Ooh! I didn't known that one. – pchaigno Aug 27 '19 at 12:04