Skip to content

Libbpf userspace function bpf_program__attach_kprobe_opts

0.5.0

Attach a BPF_PROG_TYPE_KPROBE program.

Definition

struct bpf_link * bpf_program__attach_kprobe_opts(const struct bpf_program *prog, const char *func_name, const struct bpf_kprobe_opts *opts);

Parameters

  • prog: pointer to the bpf_program object.
  • func_name: name of the kernel function to attach the probe to.
  • opts: additional options for the kprobe.

struct bpf_kprobe_opts

struct bpf_kprobe_opts {
    /* size of this struct, for forward/backward compatibility */
    size_t sz;
    __u64 bpf_cookie;
    size_t offset;
    bool retprobe;
    /* kprobe attach mode */
    enum probe_attach_mode attach_mode;
    size_t :0;
};

0.5.0

Custom user-provided value fetchable through bpf_get_attach_cookie. This allows you to write one program, load it once, and then attach it to multiple perf events with different bpf_cookie values, allowing the program to detect which event it is attached to.

offset

0.5.0

Function's offset to install kprobe to. By default, the probe is installed at the function's entry. By you can install it at any CPU instruction in the function by specifying the offset.

retprobe

0.5.0

Kprobe is return probe.

attach_mode

1.2.0

The mode to attach kprobe/uprobe. Values are:

enum probe_attach_mode {
    /* attach probe in latest supported mode by kernel */
    PROBE_ATTACH_MODE_DEFAULT = 0,
    /* attach probe in legacy mode, using debugfs/tracefs */
    PROBE_ATTACH_MODE_LEGACY,
    /* create perf event with perf_event_open syscall */
    PROBE_ATTACH_MODE_PERF,
    /* attach probe with BPF link */
    PROBE_ATTACH_MODE_LINK,
};

Usage

Docs could be improved

This part of the docs is incomplete, contributions are very welcome

Example

Docs could be improved

This part of the docs is incomplete, contributions are very welcome