Module aya::maps [−][src]
Expand description
Data structures used to setup and share data with eBPF programs.
The eBPF platform provides data structures - maps in eBPF speak - that are
used to setup and share data with eBPF programs. When you call
Bpf::load_file
or
Bpf::load
, all the maps defined in the eBPF code get
initialized and can then be accessed using Bpf::map
and
Bpf::map_mut
.
Typed maps
The eBPF API includes many map types each supporting different operations.
Bpf::map
and Bpf::map_mut
always return the
opaque MapRef
and MapRefMut
types respectively. Those two types can be converted to
typed maps using the TryFrom
trait. For example:
use std::convert::{TryFrom, TryInto};
use aya::maps::SockMap;
use aya::programs::SkMsg;
let intercept_egress = SockMap::try_from(bpf.map_mut("INTERCEPT_EGRESS")?)?;
let prog: &mut SkMsg = bpf.program_mut("intercept_egress_packet")?.try_into()?;
prog.load()?;
prog.attach(&intercept_egress)?;
Maps and Pod
values
Many map operations copy data from kernel space to user space and vice versa. Because of that, all map values must be plain old data and therefore implement the Pod trait.
Re-exports
Modules
Array types.
Hash map types.
Ring buffer types used to receive events from eBPF programs using the linux perf
API.
A FIFO queue.
Socket maps.
A LIFO stack.
A hash map of kernel or user space stack traces.
Structs
A fixed-size array.
A hash map that can be shared between eBPF programs and user space.
A generic handle to a BPF map.
Iterator returned by map.iter()
.
Iterator returned by map.keys()
.
A borrowed reference to a BPF map.
A mutable borrowed reference to a BPF map.
A per-CPU fixed-size array.
Similar to HashMap
but each CPU holds a separate value for a given key. Tipically used to
minimize lock contention in eBPF programs.
A slice of per-CPU values.
A map that can be used to receive events from eBPF programs using the linux perf
API.
An array of eBPF program file descriptors used as a jump table.
A hash map of TCP or UDP sockets.
An array of TCP or UDP sockets.