1 // SPDX-License-Identifier: GPL-2.0-only 2 /* Copyright (c) 2017 Facebook 3 */ 4 #include <uapi/linux/bpf.h> 5 #include <bpf/bpf_helpers.h> 6 7 #if !defined(__aarch64__) 8 struct syscalls_enter_open_args { 9 unsigned long long unused; 10 long syscall_nr; 11 long filename_ptr; 12 long flags; 13 long mode; 14 }; 15 #endif 16 17 struct syscalls_exit_open_args { 18 unsigned long long unused; 19 long syscall_nr; 20 long ret; 21 }; 22 23 struct syscalls_enter_open_at_args { 24 unsigned long long unused; 25 long syscall_nr; 26 long long dfd; 27 long filename_ptr; 28 long flags; 29 long mode; 30 }; 31 32 struct { 33 __uint(type, BPF_MAP_TYPE_ARRAY); 34 __type(key, u32); 35 __type(value, u32); 36 __uint(max_entries, 1); 37 } enter_open_map SEC(".maps"); 38 39 struct { 40 __uint(type, BPF_MAP_TYPE_ARRAY); 41 __type(key, u32); 42 __type(value, u32); 43 __uint(max_entries, 1); 44 } exit_open_map SEC(".maps"); 45 46 static __always_inline void count(void *map) 47 { 48 u32 key = 0; 49 u32 *value, init_val = 1; 50 51 value = bpf_map_lookup_elem(map, &key); 52 if (value) 53 *value += 1; 54 else 55 bpf_map_update_elem(map, &key, &init_val, BPF_NOEXIST); 56 } 57 58 #if !defined(__aarch64__) 59 SEC("tracepoint/syscalls/sys_enter_open") 60 int trace_enter_open(struct syscalls_enter_open_args *ctx) 61 { 62 count(&enter_open_map); 63 return 0; 64 } 65 #endif 66 67 SEC("tracepoint/syscalls/sys_enter_openat") 68 int trace_enter_open_at(struct syscalls_enter_open_at_args *ctx) 69 { 70 count(&enter_open_map); 71 return 0; 72 } 73 74 SEC("tracepoint/syscalls/sys_enter_openat2") 75 int trace_enter_open_at2(struct syscalls_enter_open_at_args *ctx) 76 { 77 count(&enter_open_map); 78 return 0; 79 } 80 81 #if !defined(__aarch64__) 82 SEC("tracepoint/syscalls/sys_exit_open") 83 int trace_enter_exit(struct syscalls_exit_open_args *ctx) 84 { 85 count(&exit_open_map); 86 return 0; 87 } 88 #endif 89 90 SEC("tracepoint/syscalls/sys_exit_openat") 91 int trace_enter_exit_at(struct syscalls_exit_open_args *ctx) 92 { 93 count(&exit_open_map); 94 return 0; 95 } 96 97 SEC("tracepoint/syscalls/sys_exit_openat2") 98 int trace_enter_exit_at2(struct syscalls_exit_open_args *ctx) 99 { 100 count(&exit_open_map); 101 return 0; 102 } 103