0001
0002
0003
0004 #include "vmlinux.h"
0005
0006 #include <bpf/bpf_helpers.h>
0007 #include <bpf/bpf_tracing.h>
0008 #include "bpf_misc.h"
0009
0010 __u32 perfbuf_val = 0;
0011 __u32 ringbuf_val = 0;
0012
0013 int test_pid;
0014
0015 struct {
0016 __uint(type, BPF_MAP_TYPE_ARRAY);
0017 __uint(max_entries, 1);
0018 __type(key, __u32);
0019 __type(value, __u32);
0020 } array SEC(".maps");
0021
0022 struct {
0023 __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
0024 __uint(max_entries, 1);
0025 __type(key, __u32);
0026 __type(value, __u32);
0027 } percpu_array SEC(".maps");
0028
0029 struct {
0030 __uint(type, BPF_MAP_TYPE_HASH);
0031 __uint(max_entries, 1);
0032 __type(key, __u32);
0033 __type(value, __u32);
0034 } hash SEC(".maps");
0035
0036 struct {
0037 __uint(type, BPF_MAP_TYPE_PERCPU_HASH);
0038 __uint(max_entries, 1);
0039 __type(key, __u32);
0040 __type(value, __u32);
0041 } percpu_hash SEC(".maps");
0042
0043 struct {
0044 __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
0045 __type(key, __u32);
0046 __type(value, __u32);
0047 } perfbuf SEC(".maps");
0048
0049 struct {
0050 __uint(type, BPF_MAP_TYPE_RINGBUF);
0051 __uint(max_entries, 1 << 12);
0052 } ringbuf SEC(".maps");
0053
0054 struct {
0055 __uint(type, BPF_MAP_TYPE_PROG_ARRAY);
0056 __uint(max_entries, 1);
0057 __uint(key_size, sizeof(__u32));
0058 __uint(value_size, sizeof(__u32));
0059 } prog_array SEC(".maps");
0060
0061 SEC("fentry/" SYS_PREFIX "sys_nanosleep")
0062 int sys_nanosleep_enter(void *ctx)
0063 {
0064 int cur_pid;
0065
0066 cur_pid = bpf_get_current_pid_tgid() >> 32;
0067
0068 if (cur_pid != test_pid)
0069 return 0;
0070
0071 bpf_perf_event_output(ctx, &perfbuf, BPF_F_CURRENT_CPU, &perfbuf_val, sizeof(perfbuf_val));
0072 bpf_ringbuf_output(&ringbuf, &ringbuf_val, sizeof(ringbuf_val), 0);
0073
0074 return 0;
0075 }
0076
0077 SEC("perf_event")
0078 int handle_perf_event(void *ctx)
0079 {
0080 return 0;
0081 }
0082
0083 char _license[] SEC("license") = "GPL";