|
|
|
@@ -0,0 +1,24 @@ |
|
|
|
The above is libbpf code examples, now let's turn to bcc. This is bcc code example: |
|
|
|
|
|
|
|
Here's the code for hello_world.py: |
|
|
|
|
|
|
|
```python |
|
|
|
from bcc import BPF |
|
|
|
BPF(text='int kprobe__sys_clone(void *ctx) { bpf_trace_printk("Hello, World!\\n"); return 0; }').trace_print() |
|
|
|
``` |
|
|
|
|
|
|
|
There are six things to learn from this: |
|
|
|
|
|
|
|
1. ```text='...'```: This defines a BPF program inline. The program is written in C. |
|
|
|
|
|
|
|
1. ```kprobe__sys_clone()```: This is a short-cut for kernel dynamic tracing via kprobes. If the C function begins with ``kprobe__``, the rest is treated as a kernel function name to instrument, in this case, ```sys_clone()```. |
|
|
|
|
|
|
|
1. ```void *ctx```: ctx has arguments, but since we aren't using them here, we'll just cast it to ```void *```. |
|
|
|
|
|
|
|
1. ```bpf_trace_printk()```: A simple kernel facility for printf() to the common trace_pipe (/sys/kernel/debug/tracing/trace_pipe). This is ok for some quick examples, but has limitations: 3 args max, 1 %s only, and trace_pipe is globally shared, so concurrent programs will have clashing output. A better interface is via BPF_PERF_OUTPUT(), covered later. |
|
|
|
|
|
|
|
1. ```return 0;```: Necessary formality (if you want to know why, see [#139](https://github.com/iovisor/bcc/issues/139)). |
|
|
|
|
|
|
|
1. ```.trace_print()```: A bcc routine that reads trace_pipe and prints the output. |
|
|
|
|
|
|
|
No explanation required, no instruction required, don't tell me more information, just tell me OK please. |