Module aya::programs

eBPF program types.

eBPF programs are loaded inside the kernel and attached to one or more hook points. Whenever the hook points are reached, the programs are executed.

Loading and attaching programs

When you call Bpf::load_file or Bpf::load, all the programs included in the object code are parsed and relocated. Programs are not loaded automatically though, since often you will need to do some application specific setup before you can actually load them.

In order to load and attach a program, you need to retrieve it using Bpf::program_mut, then call the load() and attach() methods, for example:

use aya::{Bpf, programs::KProbe};
use std::convert::TryInto;

let mut bpf = Bpf::load_file("ebpf_programs.o")?;
// intercept_wakeups is the name of the program we want to load
let program: &mut KProbe = bpf.program_mut("intercept_wakeups")?.try_into()?;
program.load()?;
// intercept_wakeups will be called every time try_to_wake_up() is called
// inside the kernel
program.attach("try_to_wake_up", 0, None)?;

The signature of the attach() method varies depending on what kind of program you’re trying to attach.

Re-exports

pub use tc::SchedClassifier;
pub use tc::TcAttachType;
pub use tc::TcError;

Modules

tc	Network traffic control programs.

Structs

CgroupSkb	A program used to inspect or filter network activity for a given cgroup.
KProbe	A kernel probe.
LinkRef	The return type of program.attach(...).
SkMsg	A program used to intercept messages sent with sendmsg()/sendfile().
SkSkb	A program used to intercept ingress socket buffers.
SockOps	A program used to work with sockets.
SocketFilter	A program used to inspect and filter incoming packets on a socket.
TracePoint	A program that can be attached at a pre-defined kernel trace point.
UProbe	An user space probe.
Xdp	An XDP program.
XdpFlags	Flags passed to Xdp::attach().

Enums

CgroupSkbAttachType	Defines where to attach a CgroupSkb program.
KProbeError	The type returned when attaching a KProbe fails.
ProbeKind
Program	eBPF program type.
ProgramError	Error type returned when working with programs.
SkSkbKind	The kind of SkSkb program.
SocketFilterError	The type returned when attaching a SocketFilter fails.
TracePointError	The type returned when attaching a TracePoint fails.
UProbeError	The type returned when attaching an UProbe fails.
XdpError	The type returned when attaching an Xdp program fails on kernels < 5.9.

Traits

Link	Detach an attached program.
ProgramFd