kernel/bpf-developer-tutorial
1
0
Fork 0
mirror of https://github.com/eunomia-bpf/bpf-developer-tutorial.git synced 2026-02-03 02:04:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

docs: Update bpftrace-tutorial README.md (#166)

Browse Source 
In Lesson 12, point number 4, guard `#include` with backticks so that it is not interpreted as a heading and keeps text formatting consistent.
This commit is contained in:
Maverick
2025-05-29 17:49:37 +02:00
committed by GitHub
parent f2c6458f04
commit 5087bb075a
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/bpftrace-tutorial/README.md
View File

@@ -319,7 +319,7 @@ This uses kernel dynamic tracing of the vfs_open() function, which has a (struct
- kprobe: As mentioned earlier, this is the kernel dynamic tracing probe type, which traces the entry of kernel functions (use kretprobe to trace their returns).
- `arg0` is a builtin variable containing the first probe argument, the meaning of which is defined by the probe type. For `kprobe`, it is the first argument to the function. Other arguments can be accessed as arg1, ..., argN.
- `((struct path *)arg0)->dentry->d_name.name`: this casts `arg0` as `struct path *`, then dereferences dentry, etc.
- #include: these are necessary to include struct definitions for path and dentry on systems where the kernel was built without BTF (BPF Type Format) data.
- `#include`: these are necessary to include struct definitions for path and dentry on systems where the kernel was built without BTF (BPF Type Format) data.
The kernel struct support is the same as bcc, making use of kernel headers. This means that many structs are available, but not everything, and sometimes it might be necessary to manually include a struct. For an example of this, see the [dcsnoop tool](https://github.com/iovisor/bpftrace/blob/master/docs/../tools/dcsnoop.bt), which includes a portion of struct nameidata manually as it wasn't in the available headers. If the kernel has BTF data, all kernel structs are always available.