Struct KProbe 

pub struct KProbe(/* private fields */);

Kernel-space probe event.

Kprobes allow you to dynamically insert breakpoints into kernel functions. This can be used to count function executions or to attach eBPF programs that run during those breakpoints.

There are two types of kprobes:

• kprobes trigger when the relevant function is called (or, potentially, executed at an offset within that function).
• kretprobes trigger just before the relevant function returns.

Kprobes can be create either for a named function or at a raw address in kernel space.

The internal documentation on how kprobes work is available here.

Implementations

impl KProbe

pub fn for_function(retprobe: bool, func: CString, offset: u64) -> Result<Self>

Create a kprobe or kretprobe for a named kernel function.

Errors

This will attempt to read the kprobe PMU type from /sys/bus/event_source. It will return an error if the kprobe PMU is not available or the filesystem exposed by the kernel there is otherwise unparseable.

pub fn for_addr(retprobe: bool, addr: u64) -> Result<Self>

Create a kprobe or kretprobe for a kernel address.

Errors

This will attempt to read the kprobe PMU type from /sys/bus/event_source. It will return an error if the kprobe PMU is not available or the filesystem exposed by the kernel there is otherwise unparseable.

pub fn probe(func: impl AsRef<[u8]>, offset: u64) -> Result<Self>

Create a kprobe on the given function at offset.

Errors

This will attempt to read the kprobe PMU type from /sys/bus/event_source. It will return an error if the kprobe PMU is not available or the filesystem exposed by the kernel there is otherwise unparseable.

Panics

Panics if func contains a nul byte other than at the very end.

pub fn retprobe(func: impl AsRef<[u8]>, offset: u64) -> Result<Self>

Create a kretprobe on the given function at offset.

Errors

This will attempt to read the kprobe PMU type from /sys/bus/event_source. It will return an error if the kprobe PMU is not available or the filesystem exposed by the kernel there is otherwise unparseable.

Panics

Panics if func contains a nul byte other than at the very end.

Trait Implementations

impl Clone for KProbe

fn clone(&self) -> KProbe

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KProbe

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Event for KProbe

fn update_attrs(self, attr: &mut perf_event_attr)

Update the perf_event_attr struct so that it will record the requested event.

fn update_attrs_with_data( self, attr: &mut perf_event_attr, ) -> Option<Arc<dyn EventData>>

Update the perf_event_attr struct so that it will record the requested event.