Struct ProgramInfo

#[repr(C)]
pub struct ProgramInfo {

    pub name: String,
    pub ty: ProgramType,
    pub tag: [u8; 8],
    pub id: u32,
    pub jited_prog_len: u32,
    pub xlated_prog_len: u32,
    pub jited_prog_insns: u64,
    pub xlated_prog_insns: u64,
    pub load_time: Duration,
    pub created_by_uid: u32,
    pub nr_map_ids: u32,
    pub map_ids: u64,
    pub ifindex: u32,
    pub gpl_compatible: bool,
    pub netns_dev: u64,
    pub netns_ino: u64,
    pub nr_jited_ksyms: u32,
    pub nr_jited_func_lens: u32,
    pub jited_ksyms: u64,
    pub jited_func_lens: u64,
    pub btf_id: u32,
    pub func_info_rec_size: u32,
    pub func_info: u64,
    pub nr_func_info: u32,
    pub nr_line_info: u32,
    pub line_info: u64,
    pub jited_line_info: u64,
    pub nr_jited_line_info: u32,
    pub line_info_rec_size: u32,
    pub jited_line_info_rec_size: u32,
    pub nr_prog_tags: u32,
    pub prog_tags: u64,
    pub run_time_ns: u64,
    pub run_cnt: u64,
}

eBPF program object info. Similar to (but not the same) kernel header’s struct bpf_prog_info

Fields

name: String

Name of eBPF program

Note: This is usually set on program load but is not required so it may be an empty string.

ty: ProgramType

Each eBPF program has a unique program type that determines its functionality and available features, such as helper functions.

For more information, see Marsden’s blog post.

tag: [u8; 8]

A SHA hash over the eBPF program instructions which can be used to correlate back to the original object file

Multiple eBPF programs may share the same xlated instructions and therefore may have the same hashes so these are not guaranteed to be unique to each eBPF program. For that, you may want to use ProgramInfo::id.

id: u32

A unique identifier for the eBPF program

Unique here meaning since the boot time of the machine. The counter used to generate these identifiers resets back to 0 to reboot and the identifiers are reused.

jited_prog_len: u32

The amount of instructions that were JIT-ed.

This is useful when attempting to dump the JIT code of the program to pre-allocate the needed memory to write the instructions to.

xlated_prog_len: u32

The amount of instructions that were interpreted (post-translation by the verifier)

This is useful when attempting to dump the xlated code of the program to pre-allocate the needed memory to write the instructions to.

jited_prog_insns: u64

A u64-encoded pointer to the memory region containing JIT-ed instructions.

xlated_prog_insns: u64

A u64-encoded pointer to the memory region contained Xlated instructions.

load_time: Duration

created_by_uid: u32

User id of the creator of the program

nr_map_ids: u32

The count of maps currently used by the program

map_ids: u64

A u64-encoded pointer to the memory region containing ids to maps used by the program.

ifindex: u32

gpl_compatible: bool

If the eBPF program has a GPL compatible license

If the eBPF program has a proprietary license, then some features such as helper functions or even ability to create certain program types are not available.

For more information, see the kernel docs.

netns_dev: u64

netns_ino: u64

nr_jited_ksyms: u32

nr_jited_func_lens: u32

jited_ksyms: u64

jited_func_lens: u64

btf_id: u32

func_info_rec_size: u32

func_info: u64

nr_func_info: u32

nr_line_info: u32

line_info: u64

jited_line_info: u64

nr_jited_line_info: u32

line_info_rec_size: u32

jited_line_info_rec_size: u32

nr_prog_tags: u32

prog_tags: u64

run_time_ns: u64

run_cnt: u64

Trait Implementations

impl Debug for ProgramInfo

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.