A compact reference for the names that recur through the book. The Aya
version referenced throughout is the 0.13 line (aya and aya-bpf crates
at 0.13.x); where the API differs in newer versions, the book’s comments
say so. Check the crate docs for the exact signatures of your pinned
version.
Item Purpose Book chapter
Ebpf::load(&[u8])Load an ELF object containing BPF programs and maps 3 Ebpf::programs()Iterate over loaded programs by name 3 Ebpf::map(name)Fetch a map handle from the loaded object 3, 4 Ebpf::attach / program.attach(...)Attach a program to its hook 3, 5, 6 programs::Xdp + attach(iface, XdpFlags)Attach an XDP program to an interface 5 programs::SchedClassifier / SchedClassifierAttachModeAttach a tc program (clsact) 6 programs::SockMap / SockHashAttach sk_msg / sk_skb programs to a sockmap 8 programs::CgroupSkb / CgroupSockAddr / CgroupSockoptcgroup-bound programs 9 programs::KProbe / programs::TracePointkprobe / tracepoint programs 7, 15 maps::HashMap<K, V>Hash map, the workhorse 4 maps::PerCpuHashMap<K, V>Per-CPU hash map 4, 13 maps::Array<T> / maps::PerCpuArray<T>Indexed array maps 4 maps::LruHashMap<K, V>LRU-evicting hash map 4, 16 maps::RingBufLock-free ring buffer for events 4, 12, 16 maps::SockHash / maps::SockMapSocket maps for redirect 8, 16 maps::MapDataRaw map handle for advanced use 4 BpfError, ProgramError, MapErrorError types; always check and log 3, 14
Item Purpose Book chapter
programs::XdpContextXDP program context: data, data_end 5 programs::SchedClassifierContexttc program context 6 programs::SkMsgContextsk_msg program context 8 programs::SkSkbContextsk_skb program context 8 programs::CgroupSkbContextcgroup socket filter context 9 programs::KProbeContextkprobe context (pt_regs) 7, 15 maps::{HashMap, PerCpuHashMap, Array, RingBuf, LruHashMap}Kernel-side map views 4 helpers::bpf_redirect, bpf_redirect_mapPacket redirect helpers 5, 6 helpers::bpf_skb_load_bytes, bpf_skb_store_bytesSafe packet read/write 6 helpers::bpf_get_current_pid_tgid, bpf_get_current_commTask identity 9, 15 helpers::bpf_ktime_get_nsKernel timestamp (ktime) 13 bindings::{ethhdr, iphdr, tcphdr, udphdr}Network header structs (libc-style) 5, 8 ctx::XdpContext::data() / data_end()Bounds-checked packet access 5
Constant Value Meaning
XDP_DROP1 drop the packet in the driver XDP_PASS2 hand the packet to the stack XDP_TX3 transmit out the same interface XDP_REDIRECT4 redirect via bpf_redirect_map BPF_F_INGRESS1 tc/sockmap ingress direction flag TC_ACT_OK / TC_ACT_SHOT0 / 2 tc accept / drop BPF_MAP_TYPE_RINGBUF27 ring buffer map type id BPF_MAXINSNS1,000,000 verifier instruction limit (6.x) BPF_MAX_LOOPS8,388,608 verifier loop bound (6.x)
Everything eBPF goes through bpf(2), and everything you attach to goes
through the usual suspects:
Syscall Used for
bpf(BPF_PROG_LOAD, ...)load and verify a program bpf(BPF_MAP_CREATE, ...)create a map bpf(BPF_PROG_ATTACH, ...) / BPF_LINK_CREATEattach a program to a hook perf_event_open + io_uring (Chapter 12)the I/O plumbing around eBPF in real services
All of them are wrapped by Aya; you will only meet the raw syscalls when
debugging with strace or reading bpftool output (Chapter 14).