$ show libbpf/libbpf-rs
libbpf-rs is a Rust workspace providing safe, idiomatic bindings to the Linux libbpf C library for eBPF program development. It consists of two main crates: `libbpf-rs`, a high-level runtime library for loading, attaching, and managing eBPF programs and maps, and `libbpf-cargo`, a Cargo plugin that compiles eBPF C source files and generates Rust skeleton code with type-safe accessors and lifecycle management. The library supports a wide range of eBPF attachment types (kprobes, tracepoints, XDP, TC, netfilter, etc.), CO-RE (Compile-Once-Run-Everywhere) via BTF, and includes utilities like ring buffer and perf buffer helpers, a query interface for inspecting loaded kernel objects, and a linker for combining multiple BPF objects. Architecture is a workspace with library crates and numerous example applications (e.g., runqslower, tcp_ca, tproxy) demonstrating real-world usage. Entry points include `ObjectBuilder`, `SkeletonBuilder` (from libbpf-cargo), and generated skeleton APIs. The project relies on `libbpf-sys` for FFI, and examples use `clap` for CLI and `plain` for safe byte conversion. It is heavily tested with integration tests requiring root privileges.
The LLM identified 3 files worth highlighting for reuse:
The `MapCore` trait defines a common interface for map operations (lookup, update, delete, batch, percpu, bloom) shared by `Map`, `MapMut`, and `MapHandle`. It demonstrates a clean abstraction over multiple ownership/mutability variants, enabling reusable map handling code without duplication. The pattern is isolated and could be extracted into a separate crate for generic BPF map interactions.
The `btf_type_match!` macro provides ergonomic pattern matching on BTF kind variants (Int, Struct, Union, FuncProto, etc.). It reduces boilerplate when processing BTF types and is self-contained, making it reusable in any Rust project that needs to dispatch on BTF kinds. The implementation avoids deep coupling to the rest of the library.
The `gen_info_impl!` macro generates ID-based iterators for program, map, link, and BTF info queries. It encapsulates a repetitive pattern of wrapping kernel information structs with iterator support, using libbpf_sys enumeration functions. The macro is parameterized and could be reused for other kernel object types, demonstrating a clean code generation pattern for FFI wrappers.