github.com/cilium/ebpf@v0.15.1-0.20240517100537-8079b37aa138/examples/kprobepin/kprobe_pin.c (about)

     1  //go:build ignore
     2  
     3  #include "common.h"
     4  
     5  char __license[] SEC("license") = "Dual MIT/GPL";
     6  
     7  struct {
     8  	__uint(type, BPF_MAP_TYPE_ARRAY);
     9  	__type(key, u32);
    10  	__type(value, u64);
    11  	__uint(max_entries, 1);
    12  	__uint(pinning, LIBBPF_PIN_BY_NAME);
    13  } kprobe_map SEC(".maps");
    14  
    15  SEC("kprobe/sys_execve")
    16  int kprobe_execve() {
    17  	u32 key     = 0;
    18  	u64 initval = 1, *valp;
    19  
    20  	valp = bpf_map_lookup_elem(&kprobe_map, &key);
    21  	if (!valp) {
    22  		bpf_map_update_elem(&kprobe_map, &key, &initval, BPF_ANY);
    23  		return 0;
    24  	}
    25  	__sync_fetch_and_add(valp, 1);
    26  
    27  	return 0;
    28  }