Struct ProgramLoader 

pub struct ProgramLoader { /* private fields */ }

Prepares helper tables and loads eBPF programs.

Implementations

impl ProgramLoader

pub fn new( rng: &mut impl Rng, event_listener: Arc<dyn ProgramEventListener>, raw_helpers: &[&[(&'static str, Helper)]], ) -> Self

Creates a new ProgramLoader to load eBPF code.

pub fn require_static_region_analysis(self, require: bool) -> Self

Requires every guest memory access to be statically routable to a single region (stack or read-only data). When enabled, compilation fails if the region analysis cannot classify any load, store, or atomic — i.e. no access falls back to the dual-region runtime probe. Memory accesses reached only through unmodeled control flow (e.g. an argument pointer in a local function) count as unresolved and are rejected.

Because functions are JIT-compiled lazily and per pointer-signature specialization, this check runs when each function variant is first compiled — at the start of Program::run, not at load time. The error is therefore surfaced through Program::run. A function variant that is never reached is never compiled and never checked; the guarantee is “every executed access is statically routable”, scoped to the variants actually invoked, rather than a whole-section load-time guarantee. (Soundness does not depend on this flag: unclassified accesses still get the dual-region runtime probe, so the flag only tightens strictness.)

pub fn with_code_size_limit(self, limit: usize) -> Self

Sets the maximum total size of JIT-compiled native code per program.

Must be a non-zero multiple of 64 KiB so the code region stays page-aligned on all supported page sizes.

Note for arm64: conditional branches and literal loads emitted by the JIT have a ±1 MiB range, and a section’s helper calls reference a literal pool at the end of that section’s code. Any single ELF section whose jitted code exceeds ~1 MiB is therefore rejected at load time (“ubpf: code translation failed”) regardless of this limit; raising it past 1 MiB only adds room for more or larger sections within that per-section ceiling. x86-64 has no such per-section constraint.

pub fn load( &self, rng: &mut impl Rng, elf: &[u8], ) -> Result<UnboundProgram, Error>

Loads an ELF image into a new UnboundProgram.