From b105c70b383267b3471ac748a25a59dc2f2b9482 Mon Sep 17 00:00:00 2001
From: Pragyansh Chaturvedi <pragyanshchaturvedi18@gmail.com>
Date: Wed, 15 Oct 2025 12:35:59 +0530
Subject: [PATCH] Add hello_perf_output BCC-Example skeleton

---
 BCC-Examples/hello_perf_output.py | 40 +++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 BCC-Examples/hello_perf_output.py

diff --git a/BCC-Examples/hello_perf_output.py b/BCC-Examples/hello_perf_output.py
new file mode 100644
index 0000000..3b41d79
--- /dev/null
+++ b/BCC-Examples/hello_perf_output.py
@@ -0,0 +1,40 @@
+from pythonbpf import bpf, map, struct, section, bpfglobal, compile
+from pythonbpf.helper import ktime, pid
+from pythonbpf.maps import PerfEventArray
+
+from ctypes import c_void_p, c_int64, c_uint64
+
+
+@bpf
+@struct
+class data_t:
+    pid: c_uint64
+    ts: c_uint64
+    comm: str(16)  # type: ignore [valid-type]
+
+
+@bpf
+@map
+def events() -> PerfEventArray:
+    return PerfEventArray(key_size=c_int64, value_size=c_int64)
+
+
+@bpf
+@section("tracepoint/syscalls/sys_enter_clone")
+def hello(ctx: c_void_p) -> c_int64:
+    dataobj = data_t()
+    strobj = "hellohellohello"
+    dataobj.pid, dataobj.ts = pid(), ktime()
+    # get_curr_comm(dataobj.comm)
+    print(f"clone called at {dataobj.ts} by pid {dataobj.pid}, comm {strobj}")
+    events.output(dataobj)
+    return 0  # type: ignore [return-value]
+
+
+@bpf
+@bpfglobal
+def LICENSE() -> str:
+    return "GPL"
+
+
+compile()