# Building objects

> Compile moat rules to a BPF object with moat build, without clang, or through the C backend with --backend c and --emit-c, and load it with ip, bpftool or libbpf.

Source: https://moatfw.dev/docs/building

```sh
$ moat build rules.moat -o rules.o [--emit-c rules.c] [--backend c]
```

- `-o` writes the BPF object.
- `--emit-c` writes the generated C. It works without `-o`; with neither,
  `build` stops with "nothing to do".
- `--backend c` generates C and compiles it with clang, from
  `$MOAT_CLANG` or the path. The default backend writes BPF bytecode
  directly and needs no compiler.

`test`, `bench`, `load` and `reload` accept `--backend c` too. Both
backends produce the same program with the same maps, and moat's tests
check that they give every packet the same verdict, so a program built
one way can be reloaded built the other way without losing sets or
variables.

## The object

moat writes the object the way clang does: the program in section `xdp`,
the functions it calls in `.text`, and maps described with BTF in
`.maps`. `ip`, `bpftool` and other libbpf based loaders accept it as
well. The generated C is self-contained and can be compiled by hand:

```sh
$ clang -O2 -g -target bpf -mcpu=v3 -c rules.c
```

`-mcpu=v3` is needed for the atomic operations rate limits use.

Exit codes: 1 errors in the rules, 2 wrong usage or an output that cannot
be written, 3 clang refused the C.