pub struct KProbe { /* private fields */ }
Expand description
A kernel probe.
Kernel probes are eBPF programs that can be attached to almost any function inside the kernel. They can be of two kinds:
kprobe
: get attached to the start of the target functionskretprobe
: get attached to the return address of the target functions
Minimum kernel version
The minimum kernel version required to use this feature is 4.1.
Examples
use aya::{Bpf, programs::KProbe};
use std::convert::TryInto;
let program: &mut KProbe = bpf.program_mut("intercept_wakeups").unwrap().try_into()?;
program.load()?;
program.attach("try_to_wake_up", 0)?;
Implementations
sourceimpl KProbe
impl KProbe
sourcepub fn load(&mut self) -> Result<(), ProgramError>
pub fn load(&mut self) -> Result<(), ProgramError>
Loads the program inside the kernel.
See also Program::load
.
sourcepub fn kind(&self) -> ProbeKind
pub fn kind(&self) -> ProbeKind
Returns KProbe
if the program is a kprobe
, or KRetProbe
if the
program is a kretprobe
.
sourcepub fn attach(
&mut self,
fn_name: &str,
offset: u64
) -> Result<LinkRef, ProgramError>
pub fn attach(
&mut self,
fn_name: &str,
offset: u64
) -> Result<LinkRef, ProgramError>
Attaches the program.
Attaches the probe to the given function name inside the kernel. If
offset
is non-zero, it is added to the address of the target
function.
If the program is a kprobe
, it is attached to the start address of the target function.
Conversely if the program is a kretprobe
, it is attached to the return address of the
target function.
Trait Implementations
Auto Trait Implementations
impl !RefUnwindSafe for KProbe
impl !Send for KProbe
impl !Sync for KProbe
impl Unpin for KProbe
impl !UnwindSafe for KProbe
Blanket Implementations
sourceimpl<T> BorrowMut<T> for T where
T: ?Sized,
impl<T> BorrowMut<T> for T where
T: ?Sized,
const: unstable · sourcefn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
Mutably borrows from an owned value. Read more