libbpf

libbpf is a userspace C library and set of tools for loading, querying, and attaching eBPF programs and maps into the Linux kernel. It provides a stable API over the kernel eBPF syscalls, enabling applications to load BPF object files (ELF format) compiled from LLVM/Clang, create and pin maps in the BPF filesystem, and attach programs to hooks such as XDP, tc classifiers, kprobes, tracepoints, and cgroups. libbpf aims to simplify the typically verbose boilerplate required to work with eBPF, handling object loading, relocation, verifier interaction, and lifecycle management.

Key components include the libbpf runtime library, the bpftool utility that introspects and manipulates BPF objects, and the skeleton mechanism that generates type-safe bindings from an ELF object to reduce boilerplate in the application code. Skeletons provide a set of helper functions to load maps and programs and to attach them to their targets.

ELF object files produced by clang/LLVM include sections for maps and programs, as well as license, version, and metadata. libbpf can parse these objects, relocate code, and optionally pin maps to bpffs for easier reuse across processes. In addition, libbpf supports BTF (BPF Type Format) for richer introspection and compatibility checks, improving verifier feedback and enabling larger, more complex programs.

Libbpf is maintained as part of the Linux eBPF tooling and is widely used by modern eBPF projects and distributions. It is commonly used by developers building in-kernel tracing, networking, and observability tools that rely on dynamic eBPF program loading. See also eBPF, bpftool, BTF.