Struct BpfSyscallAccessor 

pub struct BpfSyscallAccessor { /* private fields */ }

Live-host BPF map accessor.

Construction enumerates every map id reachable via BPF_MAP_GET_NEXT_ID, opens an fd for each via BPF_MAP_GET_FD_BY_ID, and caches the metadata. The fd vector is held for the accessor’s lifetime so the maps cannot be freed underneath us — even if the scheduler exits and tears down its struct_ops link mid-walk.

Selectively populating the cache is intentional: the same trait surface accepts a BpfMapInfo argument on every method, so an accessor that holds only the maps a particular failure dump cares about (filtered by name suffix at construction time) is just as valid as one that holds every map on the system. The from_running_kernel_filtered constructor exposes that knob.

Implementations

impl BpfSyscallAccessor

pub fn from_running_kernel() -> Result<Self>

Discover and pin every BPF map currently visible to the running kernel.

Walks the kernel’s id space via BPF_MAP_GET_NEXT_ID (starting from id 0), pinning each map with BPF_MAP_GET_FD_BY_ID and fetching its metadata via BPF_OBJ_GET_INFO_BY_FD. Maps that disappear between the NEXT_ID and GET_FD_BY_ID calls (a concurrent scheduler unload, for instance) are silently skipped — that race is inherent to live-host enumeration and is not an error.

Requires CAP_SYS_ADMIN. ktstr always runs as root in the test environment so this is a non-issue for the primary consumer; live-host CLI users that hit EPERM will see it in the returned error.

pub fn from_running_kernel_filtered<F>(predicate: F) -> Result<Self>

where F: FnMut(&BpfMapInfo) -> bool,

Discover and pin every BPF map for which predicate returns true. Maps that fail the predicate are closed (their fds drop) so the kernel can free them as usual.

Useful when the caller knows which maps the failure dump will touch — typically the scheduler’s named maps that match a specific suffix — and wants to avoid pinning hundreds of unrelated maps that happen to be alive (cilium, systemd, other workloads).

Trait Implementations

impl BpfMapAccessor for BpfSyscallAccessor

fn maps(&self) -> Vec<BpfMapInfo>

Enumerate every BPF map visible to this accessor.

fn read_value( &self, map: &BpfMapInfo, offset: usize, len: usize, ) -> Option<Vec<u8>>

Read a contiguous byte range from a map’s value region.

fn read_array(&self, map: &BpfMapInfo, key: u32) -> Option<Vec<u8>>

Read the value bytes of one entry of a BPF_MAP_TYPE_ARRAY map by entry index.

fn iter_hash_map(&self, map: &BpfMapInfo) -> Vec<(Vec<u8>, Vec<u8>)>

Iterate every entry in a BPF_MAP_TYPE_HASH or BPF_MAP_TYPE_LRU_HASH map.

fn read_percpu_array( &self, map: &BpfMapInfo, key: u32, num_cpus: u32, ) -> Vec<Option<Vec<u8>>>

Read every CPU’s value for a key in a BPF_MAP_TYPE_PERCPU_ARRAY map.

fn iter_percpu_hash_map( &self, map: &BpfMapInfo, num_cpus: u32, ) -> Vec<(Vec<u8>, Vec<Option<Vec<u8>>>)>

Iterate every entry in a BPF_MAP_TYPE_PERCPU_HASH or BPF_MAP_TYPE_LRU_PERCPU_HASH map. Returns (key_bytes, per_cpu_values) where per_cpu_values is one entry per CPU indexed by CPU number; Some(bytes) when the CPU’s slot is readable, None otherwise (unmapped page or out-of-range CPU).

fn read_arena_pages( &self, map: &BpfMapInfo, _arena_offsets: &BpfArenaOffsets, ) -> ArenaSnapshot

Snapshot every mapped page of a BPF_MAP_TYPE_ARENA map.

fn load_program_btf(&self, map: &BpfMapInfo, base_btf: &Btf) -> Option<Btf>

Load the program BTF object referenced by a map.

fn find_map(&self, name_suffix: &str) -> Option<BpfMapInfo>

Find the first BPF map whose name ends with name_suffix.

fn iter_task_storage(&self, _map: &BpfMapInfo) -> Vec<(Vec<u8>, Vec<u8>)>

Iterate every entry in a BPF_MAP_TYPE_TASK_STORAGE map (and the shape-identical INODE_STORAGE / SK_STORAGE / CGRP_STORAGE variants — they all use super::btf_offsets::TaskStorageOffsets).