diff --git a/src/bpftrace-tutorial/README.md b/src/bpftrace-tutorial/README.md index bb5788b..e90c511 100644 --- a/src/bpftrace-tutorial/README.md +++ b/src/bpftrace-tutorial/README.md @@ -319,7 +319,7 @@ This uses kernel dynamic tracing of the vfs_open() function, which has a (struct - kprobe: As mentioned earlier, this is the kernel dynamic tracing probe type, which traces the entry of kernel functions (use kretprobe to trace their returns). - `arg0` is a builtin variable containing the first probe argument, the meaning of which is defined by the probe type. For `kprobe`, it is the first argument to the function. Other arguments can be accessed as arg1, ..., argN. - `((struct path *)arg0)->dentry->d_name.name`: this casts `arg0` as `struct path *`, then dereferences dentry, etc. -- #include: these are necessary to include struct definitions for path and dentry on systems where the kernel was built without BTF (BPF Type Format) data. +- `#include`: these are necessary to include struct definitions for path and dentry on systems where the kernel was built without BTF (BPF Type Format) data. The kernel struct support is the same as bcc, making use of kernel headers. This means that many structs are available, but not everything, and sometimes it might be necessary to manually include a struct. For an example of this, see the [dcsnoop tool](https://github.com/iovisor/bpftrace/blob/master/docs/../tools/dcsnoop.bt), which includes a portion of struct nameidata manually as it wasn't in the available headers. If the kernel has BTF data, all kernel structs are always available.