Struct aya::programs::RawTracePoint

pub struct RawTracePoint { /* private fields */ }

A program that can be attached at a pre-defined kernel trace point, but also has an access to kernel internal arguments of trace points, which differentiates them from traditional tracepoint eBPF programs.

The kernel provides a set of pre-defined trace points that eBPF programs can be attached to. See/sys/kernel/debug/tracing/events for a list of which events can be traced.

Minimum kernel version

The minimum kernel version required to use this feature is 4.17.

Examples

use aya::{Bpf, programs::RawTracePoint};
use std::convert::TryInto;

let program: &mut RawTracePoint = bpf.program_mut("sys_enter").unwrap().try_into()?;
program.load()?;
program.attach("sys_enter")?;

Implementations

impl RawTracePoint

pub fn load(&mut self) -> Result<(), ProgramError>

Loads the program inside the kernel.

pub fn attach(
    &mut self,
    tp_name: &str
) -> Result<RawTracePointLinkId, ProgramError>

Attaches the program to the given tracepoint.

The returned value can be used to detach, see RawTracePoint::detach.

pub fn detach(
    &mut self,
    link_id: RawTracePointLinkId
) -> Result<(), ProgramError>

Detaches from a tracepoint.

See RawTracePoint::attach.

pub fn take_link(
    &mut self,
    link_id: RawTracePointLinkId
) -> Result<OwnedLink<RawTracePointLink>, ProgramError>

Takes ownership of the link referenced by the provided link_id.

The link will be detached on Drop and the caller is now responsible for managing its lifetime.

impl RawTracePoint

pub fn unload(&mut self) -> Result<(), ProgramError>

Unloads the program from the kernel.

Links will be detached before unloading the program. Note that owned links obtained using take_link() will not be detached.

Trait Implementations

impl Debug for RawTracePoint

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ProgramFd for RawTracePoint

fn fd(&self) -> Option<RawFd>

Returns the RawFd of the program if it has been loaded, or None

impl ProgramFd for &mut RawTracePoint

fn fd(&self) -> Option<RawFd>

Returns the RawFd of the program if it has been loaded, or None

impl<'a> TryFrom<&'a Program> for &'a RawTracePoint

type Error = ProgramError

The type returned in the event of a conversion error.

fn try_from(program: &'a Program) -> Result<&'a RawTracePoint, ProgramError>

Performs the conversion.

impl<'a> TryFrom<&'a mut Program> for &'a mut RawTracePoint

type Error = ProgramError

The type returned in the event of a conversion error.

fn try_from(
    program: &'a mut Program
) -> Result<&'a mut RawTracePoint, ProgramError>

Performs the conversion.