1*4882a593Smuzhiyun #include <linux/ptrace.h> 2*4882a593Smuzhiyun #include <linux/version.h> 3*4882a593Smuzhiyun #include <uapi/linux/bpf.h> 4*4882a593Smuzhiyun #include <bpf/bpf_helpers.h> 5*4882a593Smuzhiyun #include "trace_common.h" 6*4882a593Smuzhiyun 7*4882a593Smuzhiyun struct { 8*4882a593Smuzhiyun __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY); 9*4882a593Smuzhiyun __uint(key_size, sizeof(int)); 10*4882a593Smuzhiyun __uint(value_size, sizeof(u32)); 11*4882a593Smuzhiyun __uint(max_entries, 2); 12*4882a593Smuzhiyun } my_map SEC(".maps"); 13*4882a593Smuzhiyun SYSCALL(sys_write)14*4882a593SmuzhiyunSEC("kprobe/" SYSCALL(sys_write)) 15*4882a593Smuzhiyun int bpf_prog1(struct pt_regs *ctx) 16*4882a593Smuzhiyun { 17*4882a593Smuzhiyun struct S { 18*4882a593Smuzhiyun u64 pid; 19*4882a593Smuzhiyun u64 cookie; 20*4882a593Smuzhiyun } data; 21*4882a593Smuzhiyun 22*4882a593Smuzhiyun data.pid = bpf_get_current_pid_tgid(); 23*4882a593Smuzhiyun data.cookie = 0x12345678; 24*4882a593Smuzhiyun 25*4882a593Smuzhiyun bpf_perf_event_output(ctx, &my_map, 0, &data, sizeof(data)); 26*4882a593Smuzhiyun 27*4882a593Smuzhiyun return 0; 28*4882a593Smuzhiyun } 29*4882a593Smuzhiyun 30*4882a593Smuzhiyun char _license[] SEC("license") = "GPL"; 31*4882a593Smuzhiyun u32 _version SEC("version") = LINUX_VERSION_CODE; 32