103 lines · c
1// SPDX-License-Identifier: GPL-2.0-only2/* Copyright (c) 2017 Facebook3 */4#include <uapi/linux/bpf.h>5#include <bpf/bpf_helpers.h>6 7#if !defined(__aarch64__)8struct syscalls_enter_open_args {9 unsigned long long unused;10 long syscall_nr;11 long filename_ptr;12 long flags;13 long mode;14};15#endif16 17struct syscalls_exit_open_args {18 unsigned long long unused;19 long syscall_nr;20 long ret;21};22 23struct syscalls_enter_open_at_args {24 unsigned long long unused;25 long syscall_nr;26 long long dfd;27 long filename_ptr;28 long flags;29 long mode;30};31 32struct {33 __uint(type, BPF_MAP_TYPE_ARRAY);34 __type(key, u32);35 __type(value, u32);36 __uint(max_entries, 1);37} enter_open_map SEC(".maps");38 39struct {40 __uint(type, BPF_MAP_TYPE_ARRAY);41 __type(key, u32);42 __type(value, u32);43 __uint(max_entries, 1);44} exit_open_map SEC(".maps");45 46static __always_inline void count(void *map)47{48 u32 key = 0;49 u32 *value, init_val = 1;50 51 value = bpf_map_lookup_elem(map, &key);52 if (value)53 *value += 1;54 else55 bpf_map_update_elem(map, &key, &init_val, BPF_NOEXIST);56}57 58#if !defined(__aarch64__)59SEC("tracepoint/syscalls/sys_enter_open")60int trace_enter_open(struct syscalls_enter_open_args *ctx)61{62 count(&enter_open_map);63 return 0;64}65#endif66 67SEC("tracepoint/syscalls/sys_enter_openat")68int trace_enter_open_at(struct syscalls_enter_open_at_args *ctx)69{70 count(&enter_open_map);71 return 0;72}73 74SEC("tracepoint/syscalls/sys_enter_openat2")75int trace_enter_open_at2(struct syscalls_enter_open_at_args *ctx)76{77 count(&enter_open_map);78 return 0;79}80 81#if !defined(__aarch64__)82SEC("tracepoint/syscalls/sys_exit_open")83int trace_enter_exit(struct syscalls_exit_open_args *ctx)84{85 count(&exit_open_map);86 return 0;87}88#endif89 90SEC("tracepoint/syscalls/sys_exit_openat")91int trace_enter_exit_at(struct syscalls_exit_open_args *ctx)92{93 count(&exit_open_map);94 return 0;95}96 97SEC("tracepoint/syscalls/sys_exit_openat2")98int trace_enter_exit_at2(struct syscalls_exit_open_args *ctx)99{100 count(&exit_open_map);101 return 0;102}103