merge uprobe and package counter

pkg/ebpf/uretprobe.c

@@ -0,0 +1,52 @@
+//go:build ignore
+
+#include "common.h"
+#include <bpf/bpf_helpers.h>
+#include "bpf_tracing.h"
+
+char __license[] SEC("license") = "Dual MIT/GPL";
+
+struct event {
+	u32 pid;
+	u8 line[80];
+};
+
+struct {
+	__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
+} events SEC(".maps");
+
+// Force emitting struct event into the ELF.
+const struct event *unused __attribute__((unused));
+
+SEC("uretprobe/bash_readline")
+int uretprobe_bash_readline(struct pt_regs *ctx) {
+	struct event event;
+
+	event.pid = bpf_get_current_pid_tgid();
+	bpf_probe_read(&event.line, sizeof(event.line), (void *)PT_REGS_RC(ctx));
+
+	bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, &event, sizeof(event));
+
+	return 0;
+}
+
+
+struct {
+    __uint(type, BPF_MAP_TYPE_ARRAY); 
+    __type(key, __u32);
+    __type(value, __u64);
+    __uint(max_entries, 1);
+} pkt_count SEC(".maps"); 
+
+// count_packets atomically increases a packet counter on every invocation.
+SEC("xdp") 
+int count_packets() {
+    __u32 key    = 0; 
+    __u64 *count = bpf_map_lookup_elem(&pkt_count, &key); 
+    if (count) { 
+        __sync_fetch_and_add(count, 1); 
+    }
+
+    return XDP_PASS; 
+}
+