update(helpers): add examples for some eBPF helpers

docs/linux/helper-function/bpf_get_current_comm.md

@@ -48,5 +48,19 @@ This helper call can be used in the following program types:
 
 ### Example
 
-!!! example "Docs could be improved"
-    This part of the docs is incomplete, contributions are very welcome
+```c
+#include <vmlinux.h>
+#include <bpf/bpf_helpers.h>
+
+SEC("tp/syscalls/sys_enter_open")
+int sys_open_trace(void *ctx) {
+  // TASK_COMM_LEN is defined in vmlinux.h
+  char comm[TASK_COMM_LEN];
+  if (bpf_get_current_comm(comm, TASK_COMM_LEN)) {
+    bpf_printk("Failed to get comm\n");
+    return 0;
+  }
+  bpf_printk("Hello from %s\n", comm);
+  return 0;
+}
+```

docs/linux/helper-function/bpf_probe_write_user.md

@@ -50,5 +50,29 @@ This helper call can be used in the following program types:
 
 ### Example
 
-!!! example "Docs could be improved"
-    This part of the docs is incomplete, contributions are very welcome
+```c
+#include <vmlinux.h>
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
+#include <bpf/bpf_core_read.h>
+
+// We do it in the exit to not alter the syscall behavior. The userspace program
+// will see the new filename only after the syscall execution.
+SEC("fexit/__x64_sys_open")
+int BPF_PROG(p_open, struct pt_regs *regs, long ret) {
+  // If it is our example program overwrite the open path.
+  struct task_struct *task = (struct task_struct *)bpf_get_current_task_btf();
+  if (bpf_strncmp(task->comm, TASK_COMM_LEN, "example") != 0) {
+    return 0;
+  }
+
+  // SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, umode_t, mode)
+  // first param is the pointer to filename.
+  void *filename_ptr = (void *)PT_REGS_PARM1_CORE_SYSCALL(regs);
+  const char filename[16] = "/tmp/new";
+  if (bpf_probe_write_user(filename_ptr, filename, 16)) {
+    bpf_printk("Failed to write new filename\n");
+  }
+  return 0;
+}
+```

docs/linux/helper-function/bpf_strncmp.md

@@ -68,5 +68,17 @@ This helper call can be used in the following program types:
 
 ### Example
 
-!!! example "Docs could be improved"
-    This part of the docs is incomplete, contributions are very welcome
+```c
+#include <vmlinux.h>
+#include <bpf/bpf_helpers.h>
+
+SEC("tp_btf/sys_enter")
+int sys_enter_trace(void *ctx) {
+  struct task_struct *task = (struct task_struct *)bpf_get_current_task_btf();
+  if (bpf_strncmp(task->comm, TASK_COMM_LEN, "cat") != 0) {
+    return 0;
+  }
+  bpf_printk("Hello, I'm a cat!\n");
+  return 0;
+}
+```