Struct aya::programs::RawTracePoint

pub struct RawTracePoint { /* private fields */ }

A program that can be attached at a pre-defined kernel trace point, but also has an access to kernel internal arguments of trace points, which differentiates them from traditional tracepoint eBPF programs.

The kernel provides a set of pre-defined trace points that eBPF programs can be attached to. See/sys/kernel/debug/tracing/events for a list of which events can be traced.

Minimum kernel version

The minimum kernel version required to use this feature is 4.17.

Examples

use aya::{Bpf, programs::RawTracePoint};
use std::convert::TryInto;

let program: &mut RawTracePoint = bpf.program_mut("sys_enter").unwrap().try_into()?;
program.load()?;
program.attach("sys_enter")?;

Implementations

impl RawTracePoint

pub fn load(&mut self) -> Result<(), ProgramError>

Loads the program inside the kernel.

See also Program::load.

pub fn attach(&mut self, tp_name: &str) -> Result<LinkRef, ProgramError>

Attaches the program to the given tracepoint.

Trait Implementations

impl Debug for RawTracePoint

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ProgramFd for RawTracePoint

fn fd(&self) -> Option<RawFd>

Returns the RawFd of the program if it has been loaded, or None

impl ProgramFd for &mut RawTracePoint

fn fd(&self) -> Option<RawFd>

Returns the RawFd of the program if it has been loaded, or None

impl<'a> TryFrom<&'a Program> for &'a RawTracePoint

type Error = ProgramError

The type returned in the event of a conversion error.

fn try_from(program: &'a Program) -> Result<&'a RawTracePoint, ProgramError>

Performs the conversion.

impl<'a> TryFrom<&'a mut Program> for &'a mut RawTracePoint

type Error = ProgramError

The type returned in the event of a conversion error.

fn try_from(
    program: &'a mut Program
) -> Result<&'a mut RawTracePoint, ProgramError>

Performs the conversion.