Struct aya::programs::fexit::FExit

pub struct FExit { /* private fields */ }

A program that can be attached to the exit point of (almost) anny kernel function.

FExit programs are similar to kretprobes, but the difference is that fexit has practically zero overhead to call before kernel function. Fexit programs can be also attached to other eBPF programs.

Minimum kernel version

The minimum kernel version required to use this feature is 5.5.

Examples

use aya::{Bpf, programs::FExit, BtfError, Btf};
use std::convert::TryInto;

let btf = Btf::from_sys_fs()?;
let program: &mut FExit = bpf.program_mut("filename_lookup").unwrap().try_into()?;
program.load("filename_lookup", &btf)?;
program.attach()?;

Implementations

impl FExit

pub fn load(&mut self, fn_name: &str, btf: &Btf) -> Result<(), ProgramError>

Loads the program inside the kernel.

Loads the program so it’s executed when the kernel function fn_name is exited. The btf argument must contain the BTF info for the running kernel.

pub fn attach(&mut self) -> Result<FExitLinkId, ProgramError>

Attaches the program.

The returned value can be used to detach, see FExit::detach.

pub fn detach(&mut self, link_id: FExitLinkId) -> Result<(), ProgramError>

Detaches the program.

See FExit::attach.

pub fn take_link(
    &mut self,
    link_id: FExitLinkId
) -> Result<OwnedLink<FExitLink>, ProgramError>

Takes ownership of the link referenced by the provided link_id.

The link will be detached on Drop and the caller is now responsible for managing its lifetime.

impl FExit

pub fn unload(&mut self) -> Result<(), ProgramError>

Unloads the program from the kernel.

Links will be detached before unloading the program. Note that owned links obtained using take_link() will not be detached.

Trait Implementations

impl Debug for FExit

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ProgramFd for FExit

fn fd(&self) -> Option<RawFd>

Returns the RawFd of the program if it has been loaded, or None

impl ProgramFd for &mut FExit

fn fd(&self) -> Option<RawFd>

Returns the RawFd of the program if it has been loaded, or None

impl<'a> TryFrom<&'a Program> for &'a FExit

type Error = ProgramError

The type returned in the event of a conversion error.

fn try_from(program: &'a Program) -> Result<&'a FExit, ProgramError>

Performs the conversion.

impl<'a> TryFrom<&'a mut Program> for &'a mut FExit

type Error = ProgramError

The type returned in the event of a conversion error.

fn try_from(program: &'a mut Program) -> Result<&'a mut FExit, ProgramError>

Performs the conversion.