1 // SPDX-License-Identifier: GPL-2.0
2 
3 #include "vmlinux.h"
4 #include <bpf/bpf_helpers.h>
5 
6 struct {
7   __uint(type, BPF_MAP_TYPE_RINGBUF);
8   __uint(max_entries, 4096 /* one page */);
9 } ringbuf SEC(".maps");
10 
11 SEC("ksyscall/kill")
handle__ksyscall(pid_t pid,int sig)12 int handle__ksyscall(pid_t pid, int sig) {
13   int *value;
14 
15   value = bpf_ringbuf_reserve(&ringbuf, sizeof(int), 0);
16   if (!value) {
17     bpf_printk("handle__ksyscall: failed to reserve ring buffer space");
18     return 1;
19   }
20 
21   *value = 1;
22   bpf_ringbuf_submit(value, 0);
23   bpf_printk("handle__ksyscall: submitted ringbuf value");
24   return 0;
25 }
26 
27 char LICENSE[] SEC("license") = "GPL";
28