Struct aya::programs::FExit

pub struct FExit { /* private fields */ }

A program that can be attached to the exit point of (almost) anny kernel function.

FExit programs are similar to kretprobes, but the difference is that fexit has practically zero overhead to call before kernel function. Fexit programs can be also attached to other eBPF programs.

Minimum kernel version

The minimum kernel version required to use this feature is 5.5.

Examples

use aya::{Bpf, programs::FExit, BtfError, Btf};
use std::convert::TryInto;

let btf = Btf::from_sys_fs()?;
let program: &mut FExit = bpf.program_mut("filename_lookup").unwrap().try_into()?;
program.load("filename_lookup", &btf)?;
program.attach()?;

Implementations

impl FExit

pub fn load(&mut self, fn_name: &str, btf: &Btf) -> Result<(), ProgramError>

Loads the program inside the kernel.

See also Program::load.

Loads the program so it’s executed when the kernel function fn_name is exited. The btf argument must contain the BTF info for the running kernel.

pub fn attach(&mut self) -> Result<LinkRef, ProgramError>

Attaches the program

Trait Implementations

impl Debug for FExit

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ProgramFd for FExit

fn fd(&self) -> Option<RawFd>

Returns the RawFd of the program if it has been loaded, or None

impl ProgramFd for &mut FExit

fn fd(&self) -> Option<RawFd>

Returns the RawFd of the program if it has been loaded, or None

impl<'a> TryFrom<&'a Program> for &'a FExit

type Error = ProgramError

The type returned in the event of a conversion error.

fn try_from(program: &'a Program) -> Result<&'a FExit, ProgramError>

Performs the conversion.

impl<'a> TryFrom<&'a mut Program> for &'a mut FExit

type Error = ProgramError

The type returned in the event of a conversion error.

fn try_from(program: &'a mut Program) -> Result<&'a mut FExit, ProgramError>

Performs the conversion.