Skip to content

Commit

Permalink
Merge branch 'master' into dcsnoop
Browse files Browse the repository at this point in the history
  • Loading branch information
markdrayton committed Aug 11, 2016
2 parents 44b4b5f + e2a8290 commit 0078936
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion docs/tutorial_bcc_python_developer.md
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@ This is simalar to hello_world.py, and traces new processes via sys_clone() agai

1. ```prog =```: This time we declare the C program as a variable, and later refer to it. This is useful if you want to add some string substitutions based on command line arguments.

1. ```hello()```: Now we're just declaring a C function, instead of the ```kprobe__``` shortcut. We'll refer to this later.
1. ```hello()```: Now we're just declaring a C function, instead of the ```kprobe__``` shortcut. We'll refer to this later. All C functions declared in the BPF program are expected to be executed on a probe, hence they all need to take a ```pt_reg* ctx``` as first argument. If you need to define some helper function that will not be executed on a probe, they need to be defined as ```static inline``` in order to be inlined by the compiler. Sometimes you would also need to add ```_always_inline``` function attribute to it.

1. ```b.attach_kprobe(event="sys_clone", fn_name="hello")```: Creates a kprobe for the sys_clone() kernel function, which will execute our defined hello() function. You can call attach_kprobe() more than once, and attach your C function to multiple kernel functions.

Expand Down

0 comments on commit 0078936

Please sign in to comment.