pub struct FExit { /* private fields */ }Expand description
A program that can be attached to the exit point of (almost) anny kernel function.
FExit programs are similar to kretprobes,
but the difference is that fexit has practically zero overhead to call
before kernel function. Fexit programs can be also attached to other eBPF
programs.
§Minimum kernel version
The minimum kernel version required to use this feature is 5.5.
§Examples
use aya::{Ebpf, programs::FExit, BtfError, Btf};
let btf = Btf::from_sys_fs()?;
let program: &mut FExit = bpf.program_mut("filename_lookup").unwrap().try_into()?;
program.load("filename_lookup", &btf)?;
program.attach()?;Implementations§
Source§impl FExit
impl FExit
Sourcepub fn load(&mut self, fn_name: &str, btf: &Btf) -> Result<(), ProgramError>
pub fn load(&mut self, fn_name: &str, btf: &Btf) -> Result<(), ProgramError>
Loads the program inside the kernel.
Loads the program so it’s executed when the kernel function fn_name
is exited. The btf argument must contain the BTF info for the running
kernel.
Sourcepub fn attach(&mut self) -> Result<FExitLinkId, ProgramError>
pub fn attach(&mut self) -> Result<FExitLinkId, ProgramError>
Attaches the program.
The returned value can be used to detach, see FExit::detach.
Sourcepub fn detach(&mut self, link_id: FExitLinkId) -> Result<(), ProgramError>
pub fn detach(&mut self, link_id: FExitLinkId) -> Result<(), ProgramError>
Detaches the program.
See FExit::attach.
Sourcepub fn take_link(
&mut self,
link_id: FExitLinkId,
) -> Result<FExitLink, ProgramError>
pub fn take_link( &mut self, link_id: FExitLinkId, ) -> Result<FExitLink, ProgramError>
Takes ownership of the link referenced by the provided link_id.
The link will be detached on Drop and the caller is now responsible
for managing its lifetime.
Source§impl FExit
impl FExit
Sourcepub fn unload(&mut self) -> Result<(), ProgramError>
pub fn unload(&mut self) -> Result<(), ProgramError>
Unloads the program from the kernel.
Links will be detached before unloading the program. Note
that owned links obtained using take_link() will not be
detached.
Source§impl FExit
impl FExit
Sourcepub fn fd(&self) -> Result<&ProgramFd, ProgramError>
pub fn fd(&self) -> Result<&ProgramFd, ProgramError>
Returns the file descriptor of this Program.
Source§impl FExit
impl FExit
Sourcepub fn pin<P: AsRef<Path>>(&mut self, path: P) -> Result<(), PinError>
pub fn pin<P: AsRef<Path>>(&mut self, path: P) -> Result<(), PinError>
Pins the program to a BPF filesystem.
When a BPF object is pinned to a BPF filesystem it will remain loaded after Aya has unloaded the program. To remove the program, the file on the BPF filesystem must be removed. Any directories in the the path provided should have been created by the caller.
Source§impl FExit
impl FExit
Sourcepub fn from_pin<P: AsRef<Path>>(path: P) -> Result<Self, ProgramError>
pub fn from_pin<P: AsRef<Path>>(path: P) -> Result<Self, ProgramError>
Creates a program from a pinned entry on a bpffs.
Existing links will not be populated. To work with existing links you should use crate::programs::links::PinnedLink.
On drop, any managed links are detached and the program is unloaded. This will not result in the program being unloaded from the kernel if it is still pinned.
Source§impl FExit
impl FExit
Sourcepub fn info(&self) -> Result<ProgramInfo, ProgramError>
pub fn info(&self) -> Result<ProgramInfo, ProgramError>
Returns metadata information of this program.
Uses kernel v4.13 features.