aya/test/integration-test/src/tests/raw_tracepoint.rs

use aya::{Ebpf, maps::Array, programs::RawTracePoint};
use integration_common::raw_tracepoint::SysEnterEvent;

fn get_event(bpf: &mut Ebpf) -> SysEnterEvent {
    let map: Array<_, SysEnterEvent> = Array::try_from(bpf.map_mut("RESULT").unwrap()).unwrap();
    map.get(&0, 0).unwrap()
}

#[test_log::test]
fn raw_tracepoint() {
    let mut bpf = Ebpf::load(crate::RAW_TRACEPOINT).unwrap();

    // Check start condition.
    {
        let SysEnterEvent {
            common_type,
            common_flags,
            ..
        } = get_event(&mut bpf);
        assert_eq!(common_type, 0);
        assert_eq!(common_flags, 0);
    }

    // NB: we cannot fetch `map` just once above because both `Ebpf::map_mut` and
    // `Ebpf::program_mut` take &mut self, resulting in overlapping mutable borrows.
    let prog: &mut RawTracePoint = bpf.program_mut("sys_enter").unwrap().try_into().unwrap();
    prog.load().unwrap();
    prog.attach("sys_enter").unwrap();

    // Check that a syscall was traced.
    {
        let SysEnterEvent {
            common_type,
            common_flags,
            ..
        } = get_event(&mut bpf);
        assert_ne!(common_type, 0);
        assert_ne!(common_flags, 0);
    }
}