Struct aya::programs::kprobe::KProbe

pub struct KProbe { /* private fields */ }

A kernel probe.

Kernel probes are eBPF programs that can be attached to almost any function inside the kernel. They can be of two kinds:

• kprobe: get attached to the start of the target functions
• kretprobe: get attached to the return address of the target functions

Minimum kernel version

The minimum kernel version required to use this feature is 4.1.

Examples

use aya::{Bpf, programs::KProbe};
use std::convert::TryInto;

let program: &mut KProbe = bpf.program_mut("intercept_wakeups").unwrap().try_into()?;
program.load()?;
program.attach("try_to_wake_up", 0)?;

Implementations

impl KProbe

pub fn load(&mut self) -> Result<(), ProgramError>

Loads the program inside the kernel.

pub fn kind(&self) -> ProbeKind

Returns KProbe if the program is a kprobe, or KRetProbe if the program is a kretprobe.

pub fn attach(
    &mut self,
    fn_name: &str,
    offset: u64
) -> Result<KProbeLinkId, ProgramError>

Attaches the program.

Attaches the probe to the given function name inside the kernel. If offset is non-zero, it is added to the address of the target function.

If the program is a kprobe, it is attached to the start address of the target function. Conversely if the program is a kretprobe, it is attached to the return address of the target function.

The returned value can be used to detach from the given function, see KProbe::detach.

pub fn detach(&mut self, link_id: KProbeLinkId) -> Result<(), ProgramError>

Detaches the program.

See KProbe::attach.

pub fn take_link(
    &mut self,
    link_id: KProbeLinkId
) -> Result<OwnedLink<KProbeLink>, ProgramError>

Takes ownership of the link referenced by the provided link_id.

The link will be detached on Drop and the caller is now responsible for managing its lifetime.

impl KProbe

pub fn unload(&mut self) -> Result<(), ProgramError>

Unloads the program from the kernel.

Links will be detached before unloading the program. Note that owned links obtained using take_link() will not be detached.

Trait Implementations

impl Debug for KProbe

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ProgramFd for KProbe

fn fd(&self) -> Option<RawFd>

Returns the RawFd of the program if it has been loaded, or None

impl ProgramFd for &mut KProbe

fn fd(&self) -> Option<RawFd>

Returns the RawFd of the program if it has been loaded, or None

impl<'a> TryFrom<&'a Program> for &'a KProbe

type Error = ProgramError

The type returned in the event of a conversion error.

fn try_from(program: &'a Program) -> Result<&'a KProbe, ProgramError>

Performs the conversion.

impl<'a> TryFrom<&'a mut Program> for &'a mut KProbe

type Error = ProgramError

The type returned in the event of a conversion error.

fn try_from(program: &'a mut Program) -> Result<&'a mut KProbe, ProgramError>

Performs the conversion.