The first release of the Aya library has been introduced, allowing the creation of eBPF handlers in the Rust language that run inside the Linux kernel in a special virtual machine with JIT. Unlike other tools for developing eBPF programs, Aya does not use libbpf and the bcc compiler, but offers its own implementation written in Rust, which uses the libc crate package for direct access to kernel system calls. No C language tools or kernel header files are required to build Aya. The library's code is distributed under the MIT and Apache 2.0 licenses.
Main Features:
- Support for the BTF (BPF Type Format) which provides information on types in BPF pseudocode for type checking and matching with types provided by the current kernel. The use of BTF allows the creation of universal eBPF handlers that can be used without recompilation with different versions of the Linux kernel.
- Support for 'bpf-to-bpf' calls, global variables, and initializers, allowing eBPF programs to be structured similarly to regular programs, using Aya as a runtime that overrides functions with consideration for operation in eBPF.
- Support for various kernel types, including regular arrays, hash maps, stacks, queues, stack tracing, as well as structures for sockets and performance tracking.
- The ability to create various types of eBTF programs, including programs for filtering and traffic management, cgroup handlers, and various socket operations, as well as XDP programs.
- Support for platforms for asynchronous request processing in non-blocking mode, such as tokio and async-std.
- Fast build, without being tied to kernel build and header files.
The project is currently considered experimental — the API is not yet stabilized and continues to develop. Not all planned features have been implemented yet. By the end of the year, the developers expect to bring Aya's functionality to parity with libbpf, and in January 2022, to form the first stable release. It is also planned to integrate parts of Aya necessary for writing Rust code for the Linux kernel with components that operate in user space and are used for loading, attaching, and interacting with eBPF programs.
Let us recall that eBPF is a built-in interpreter for bytecode in the Linux kernel, allowing the creation of handlers for network operations, monitoring system performance, intercepting system calls, controlling access, processing events with timing retention, counting the frequency and execution time of operations, and performing tracing with kprobes/uprobes/tracepoints. Thanks to JIT compilation, the bytecode is translated on the fly into machine instructions and executed with the performance of native code. XDP provides means to run BPF programs at the network driver level, enabling direct access to the DMA buffer of packets, which allows creating high-performance handlers for operation under heavy network loads.
Source: opennet.ru
