Skip to content

Libbpf userspace function bpf_program__attach_kprobe_opts

0.5.0

Attach a BPF_PROG_TYPE_KPROBE program.

Definition

struct bpf_link * bpf_program__attach_kprobe_opts(const struct bpf_program *prog, const char *func_name, const struct bpf_kprobe_opts *opts);

Parameters

  • prog: pointer to the bpf_program object.
  • func_name: name of the kernel function to attach the probe to.
  • opts: additional options for the kprobe.

struct bpf_kprobe_opts

struct bpf_kprobe_opts {
    /* size of this struct, for forward/backward compatibility */
    size_t sz;
    __u64 bpf_cookie;
    /* function offset, or raw address if func_name == NULL */
    size_t offset;
    bool retprobe;
    /* kprobe attach mode */
    enum probe_attach_mode attach_mode;
    size_t :0;
};

0.5.0

Custom user-provided value fetchable through bpf_get_attach_cookie. This allows you to write one program, load it once, and then attach it to multiple perf events with different bpf_cookie values, allowing the program to detect which event it is attached to.

offset

0.5.0

Function's offset to install kprobe to. By default, the probe is installed at the function's entry. By you can install it at any CPU instruction in the function by specifying the offset.

If func_name is NULL, offset is treated as a raw kernel address for PROBE_ATTACH_MODE_PERF and PROBE_ATTACH_MODE_LINK.

This is not supported with PROBE_ATTACH_MODE_LEGACY. With PROBE_ATTACH_MODE_DEFAULT, it can still fail with -EOPNOTSUPP if libbpf falls back to legacy attach.

retprobe

0.5.0

Kprobe is return probe.

attach_mode

1.2.0

The mode to attach kprobe/uprobe. Values are:

enum probe_attach_mode {
    /* attach probe in latest supported mode by kernel */
    PROBE_ATTACH_MODE_DEFAULT = 0,
    /* attach probe in legacy mode, using debugfs/tracefs */
    PROBE_ATTACH_MODE_LEGACY,
    /* create perf event with perf_event_open syscall */
    PROBE_ATTACH_MODE_PERF,
    /* attach probe with BPF link */
    PROBE_ATTACH_MODE_LINK,
};

Usage

Docs could be improved

This part of the docs is incomplete, contributions are very welcome

Example

Docs could be improved

This part of the docs is incomplete, contributions are very welcome