Commit a47a3b15 authored by Brendan Gregg's avatar Brendan Gregg Committed by GitHub

Merge pull request #671 from pchaigno/fix-doc

Minor adjustments to the documentation
parents f9ada2cb 31bb7f3b
...@@ -7,7 +7,7 @@ This guide is incomplete. If something feels missing, check the bcc and kernel s ...@@ -7,7 +7,7 @@ This guide is incomplete. If something feels missing, check the bcc and kernel s
## Contents ## Contents
- [BPF C](#bpf-c) - [BPF C](#bpf-c)
- [Events & Arguments](#events-arguments) - [Events & Arguments](#events--arguments)
- [1. kprobes](#1-kprobes) - [1. kprobes](#1-kprobes)
- [2. kretprobes](#2-kretprobes) - [2. kretprobes](#2-kretprobes)
- [3. Tracepoints](#3-tracepoints) - [3. Tracepoints](#3-tracepoints)
...@@ -501,7 +501,7 @@ Examples in situ: ...@@ -501,7 +501,7 @@ Examples in situ:
Syntax: ```map.update(&key, &val)``` Syntax: ```map.update(&key, &val)```
Set the key to equal the value in the second argument. Associate the value in the second argument to the key, overwriting any previous value.
Examples in situ: Examples in situ:
[search /examples](https://github.com/iovisor/bcc/search?q=update+path%3Aexamples&type=Code), [search /examples](https://github.com/iovisor/bcc/search?q=update+path%3Aexamples&type=Code),
......
...@@ -36,7 +36,7 @@ There are six things to learn from this: ...@@ -36,7 +36,7 @@ There are six things to learn from this:
1. ```bpf_trace_printk()```: A simple kernel facility for printf() to the common trace_pipe (/sys/kernel/debug/tracing/trace_pipe). This is ok for some quick examples, but has limitations: 3 args max, 1 %s only, and trace_pipe is globally shared, so concurrent programs will have clashing output. A better interface is via BPF_PERF_OUTPUT(), covered later. 1. ```bpf_trace_printk()```: A simple kernel facility for printf() to the common trace_pipe (/sys/kernel/debug/tracing/trace_pipe). This is ok for some quick examples, but has limitations: 3 args max, 1 %s only, and trace_pipe is globally shared, so concurrent programs will have clashing output. A better interface is via BPF_PERF_OUTPUT(), covered later.
1. ```return 0;```: Necessary formality (if you want to know why, see #139). 1. ```return 0;```: Necessary formality (if you want to know why, see [#139](https://github.com/iovisor/bcc/issues/139)).
1. ```.trace_print()```: A bcc routine that reads trace_pipe and prints the output. 1. ```.trace_print()```: A bcc routine that reads trace_pipe and prints the output.
...@@ -88,7 +88,7 @@ while 1: ...@@ -88,7 +88,7 @@ while 1:
print("%-18.9f %-16s %-6d %s" % (ts, task, pid, msg)) print("%-18.9f %-16s %-6d %s" % (ts, task, pid, msg))
``` ```
This is simalar to hello_world.py, and traces new processes via sys_clone() again, but has a few more things to learn: This is similar to hello_world.py, and traces new processes via sys_clone() again, but has a few more things to learn:
1. ```prog =```: This time we declare the C program as a variable, and later refer to it. This is useful if you want to add some string substitutions based on command line arguments. 1. ```prog =```: This time we declare the C program as a variable, and later refer to it. This is useful if you want to add some string substitutions based on command line arguments.
...@@ -163,7 +163,7 @@ Things to learn: ...@@ -163,7 +163,7 @@ Things to learn:
1. ```key = 0```: We'll only store one key/value pair in this hash, where the key is hardwired to zero. 1. ```key = 0```: We'll only store one key/value pair in this hash, where the key is hardwired to zero.
1. ```last.lookup(&key)```: Lookup the key in the hash, and return a pointer to its value if it exists, else NULL. We pass the key in as an address to a pointer. 1. ```last.lookup(&key)```: Lookup the key in the hash, and return a pointer to its value if it exists, else NULL. We pass the key in as an address to a pointer.
1. ```last.delete(&key)```: Delete the key from the hash. This is currently required because of [a kernel bug in `.update()`](https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=a6ed3ea65d9868fdf9eff84e6fe4f666b8d14b02). 1. ```last.delete(&key)```: Delete the key from the hash. This is currently required because of [a kernel bug in `.update()`](https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=a6ed3ea65d9868fdf9eff84e6fe4f666b8d14b02).
1. ```last.update(&key)```: Set the key to equal the value in the 2nd argument. This records the timestamp. 1. ```last.update(&key, &ts)```: Associate the value in the 2nd argument to the key, overwriting any previous value. This records the timestamp.
### Lesson 5. sync_count.py ### Lesson 5. sync_count.py
...@@ -183,7 +183,7 @@ TIME(s) T BYTES LAT(ms) ...@@ -183,7 +183,7 @@ TIME(s) T BYTES LAT(ms)
[...] [...]
``` ```
And a code snippit: And a code snippet:
```Python ```Python
[...] [...]
...@@ -486,7 +486,7 @@ while 1: ...@@ -486,7 +486,7 @@ while 1:
Things to learn: Things to learn:
1. ```TRACEPOINT_PROBE(random, urandom_read)```: Instrument the kernel tracepoint ```random:urandom_read```. These have a stable API, and thus are recommend to use instead of kprobes, wherever possible. You can run ```perf list``` for a list of tracepoints. 1. ```TRACEPOINT_PROBE(random, urandom_read)```: Instrument the kernel tracepoint ```random:urandom_read```. These have a stable API, and thus are recommend to use instead of kprobes, wherever possible. You can run ```perf list``` for a list of tracepoints. Linux >= 4.7 is required to attach BPF programs to tracepoints.
1. ```args->got_bits```: ```args``` is auto-populated to be a structure of the tracepoint arguments. The comment above says where you can see that structure. Eg: 1. ```args->got_bits```: ```args``` is auto-populated to be a structure of the tracepoint arguments. The comment above says where you can see that structure. Eg:
``` ```
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment