@@ -42,11 +42,11 @@ This guide is incomplete. If something feels missing, check the bcc and kernel s
-[1. BPF](#1-bpf)
-[2. USDT](#2-usdt)
-[Events](#events)
-[1. attach_kprobe](#1-attach_kprobe)
-[2. attach_kretprobe](#2-attach_kretprobe)
-[3. attach_tracepoint](#3-attach_tracepoint)
-[4. attach_uprobe](#4-attach_uprobe)
-[5. attach_uretprobe](#5-attach_uretprobe)
-[1. attach_kprobe()](#1-attach_kprobe)
-[2. attach_kretprobe()](#2-attach_kretprobe)
-[3. attach_tracepoint()](#3-attach_tracepoint)
-[4. attach_uprobe()](#4-attach_uprobe)
-[5. attach_uretprobe()](#5-attach_uretprobe)
-[6. USDT.enable_probe()](#6-usdtenable_probe)
-[Debug Output](#debug-output)
-[1. trace_print()](#1-trace_print)
...
...
@@ -154,7 +154,7 @@ Examples in situ:
### 4. uprobes
These are instrumented by declaring a normal funciton in C, then associating it as a uprobe probe in Python via ```BPF.attach_uprobe()``` (covered later).
These are instrumented by declaring a normal function in C, then associating it as a uprobe probe in Python via ```BPF.attach_uprobe()``` (covered later).
Arguments can be examined using ```PT_REGS_PARM``` macros.
...
...
@@ -176,7 +176,7 @@ Examples in situ:
### 5. uretprobes
These are instrumented by declaring a normal funciton in C, then associating it as a uretprobe probe in Python via ```BPF.attach_uretprobe()``` (covered later).
These are instrumented by declaring a normal function in C, then associating it as a uretprobe probe in Python via ```BPF.attach_uretprobe()``` (covered later).
Return value is available as ```PT_REGS_RC(ctx)```, given a function declaration of: *function_name*(struct pt_regs *ctx)
...
...
@@ -198,7 +198,7 @@ Examples in situ:
### 6. USDT probes
These are instrumented by declaring a normal funciton in C, then associating it as a USDT probe in Python via ```USDT.enable_probe()```.
These are User Statically-Defined Tracing (USDT) probes, which may be placed in some applications or libraries to provide a user-level equivalent of tracepoints. The primary BPF method provided for USDT support method is ```enable_probe()```. USDT probes are instrumented by declaring a normal function in C, then associating it as a USDT probe in Python via ```USDT.enable_probe()```.
Arguments can be read via: bpf_usdt_readarg(*index*, ctx, &addr)
This copies a memory location to the BPF stack, so that BPF can later operate on it. For safety, all memory reads must pass through bpf_probe_read(). This happens automatically in some cases, such as dereferencing kernel varibles, as bcc will rewrite the BPF program to include the necessary bpf_probe_reads().
This copies a memory location to the BPF stack, so that BPF can later operate on it. For safety, all memory reads must pass through bpf_probe_read(). This happens automatically in some cases, such as dereferencing kernel variables, as bcc will rewrite the BPF program to include the necessary bpf_probe_reads().