github.com/cilium/ebpf@v0.15.1-0.20240517100537-8079b37aa138/examples/uretprobe/uretprobe.c (about)

     1  //go:build ignore
     2  
     3  #include "common.h"
     4  
     5  #include "bpf_tracing.h"
     6  
     7  char __license[] SEC("license") = "Dual MIT/GPL";
     8  
     9  struct event {
    10  	u32 pid;
    11  	u8 line[80];
    12  };
    13  
    14  struct {
    15  	__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
    16  } events SEC(".maps");
    17  
    18  // Force emitting struct event into the ELF.
    19  const struct event *unused __attribute__((unused));
    20  
    21  SEC("uretprobe/bash_readline")
    22  int uretprobe_bash_readline(struct pt_regs *ctx) {
    23  	struct event event;
    24  
    25  	event.pid = bpf_get_current_pid_tgid();
    26  	bpf_probe_read(&event.line, sizeof(event.line), (void *)PT_REGS_RC(ctx));
    27  
    28  	bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, &event, sizeof(event));
    29  
    30  	return 0;
    31  }