TCC Syntax Checker (x86_64)

#include "task.h"
#include "sched.h"
#include <bpf/bpf_helpers.h>

#undef SEC
#define SEC(name) __attribute__((section(name), used))

char LICENSE[] SEC("license") = "GPL";

struct event {
    __u32 pid;
    __u32 ppid;
    __u32 old_pid;
    char filename[16];
};

struct {
    __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
    __uint(key_size, sizeof(__u32));
    __uint(value_size, sizeof(__u32));
} events SEC(".maps");

SEC("tp/sched/sched_process_exec")
int handle_exec(struct trace_event_raw_sched_process_exec* ctx)
{
    struct event event = {};

// Access the tracepoint context directly!
    event.pid = ctx->pid;
    event.old_pid = ctx->old_pid;

// The filename is stored as a dynamic string
    // __data_loc contains offset in lower 16 bits
    unsigned short offset = ctx->__data_loc_filename & 0xFFFF;
    bpf_probe_read_kernel_str(&event.filename, sizeof(event.filename),
                              (void *)ctx + offset);

bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, &event, sizeof(event));
    return 0;
}

WASM Runtime is initializing...