Struct aya::programs::KProbe

pub struct KProbe { /* fields omitted */ }

A kernel probe.

Kernel probes are eBPF programs that can be attached to almost any function inside the kernel. They can be of two kinds:

• kprobe: get attached to the start of the target functions
• kretprobe: get attached to the return address of the target functions

Examples

use aya::{Bpf, programs::KProbe};
use std::convert::TryInto;

let program: &mut KProbe = bpf.program_mut("intercept_wakeups")?.try_into()?;
program.attach("try_to_wake_up", 0, None)?;

Implementations

impl KProbe

pub fn load(&mut self) -> Result<(), ProgramError>

Loads the program inside the kernel.

See also Program::load.

pub fn name(&self) -> String

Returns the name of the program.

pub fn kind(&self) -> ProbeKind

Returns KProbe if the program is a kprobe, or KRetProbe if the program is a kretprobe.

pub fn attach(
    &mut self,
    fn_name: &str,
    offset: u64,
    pid: Option<pid_t>
) -> Result<LinkRef, ProgramError>

Attaches the program.

Attaches the probe to the given function name inside the kernel. If offset is non-zero, it is added to the address of the target function. If pid is not None, the program executes only when the target function is triggered by the given pid.

If the program is a kprobe, it is attached to the start address of the target function. Conversely if the program is a kretprobe, it is attached to the return address of the target function.

Trait Implementations

impl Debug for KProbe

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ProgramFd for KProbe

fn fd(&self) -> Option<RawFd>

impl<'a> TryFrom<&'a Program> for &'a KProbe

type Error = ProgramError

The type returned in the event of a conversion error.

fn try_from(program: &'a Program) -> Result<&'a KProbe, ProgramError>

Performs the conversion.

impl<'a> TryFrom<&'a mut Program> for &'a mut KProbe

type Error = ProgramError

The type returned in the event of a conversion error.

fn try_from(program: &'a mut Program) -> Result<&'a mut KProbe, ProgramError>

Performs the conversion.