2

I am beginning with XDP and BPF maps.

I understand that to access a BPF map from userspace, we use bpf_* syscalls. For example, bpf_map_lookup_elem() is used to lookup an element of a BPF map in the userspace program. However, I noticed that the same syscalls are also used to access maps in the XDP programs loaded on the kernel (ref. here).

I assumed such programs should be running in the kernel space, and hence is there some other way these BPF maps should be accessed from the kernel space? Or is the XDP loaded program also part of the userspace but only running within the kernel?

Dylan Reimerink
  • 5,874
  • 2
  • 15
  • 21
diviquery
  • 569
  • 5
  • 19

1 Answers1

3

To lookup map elements from userspace, you should use the bpf(2) syscall, with command BPF_MAP_LOOKUP_ELEM. The main userspace library for BPF does expose this syscall command as bpf_map_lookup_elem().

To lookup map elements from BPF programs, you indeed need to use the bpf_map_lookup_elem BPF helper. In a nutshell, BPF helpers are kernel functions you can call from the BPF bytecode with instruction call.

Despite having the same name, they are however different things: the first is a library function, while the second is a BPF helper.

pchaigno
  • 11,313
  • 2
  • 29
  • 54