1 // SPDX-License-Identifier: GPL-2.0-only 1 // SPDX-License-Identifier: GPL-2.0-only
2 /* Copyright (c) 2017 Facebook 2 /* Copyright (c) 2017 Facebook
3 */ 3 */
4 #include <uapi/linux/bpf.h> 4 #include <uapi/linux/bpf.h>
5 #include <bpf/bpf_helpers.h> 5 #include <bpf/bpf_helpers.h>
6 6
7 #if !defined(__aarch64__) 7 #if !defined(__aarch64__)
8 struct syscalls_enter_open_args { 8 struct syscalls_enter_open_args {
9 unsigned long long unused; 9 unsigned long long unused;
10 long syscall_nr; 10 long syscall_nr;
11 long filename_ptr; 11 long filename_ptr;
12 long flags; 12 long flags;
13 long mode; 13 long mode;
14 }; 14 };
15 #endif 15 #endif
16 16
17 struct syscalls_exit_open_args { 17 struct syscalls_exit_open_args {
18 unsigned long long unused; 18 unsigned long long unused;
19 long syscall_nr; 19 long syscall_nr;
20 long ret; 20 long ret;
21 }; 21 };
22 22
23 struct syscalls_enter_open_at_args { 23 struct syscalls_enter_open_at_args {
24 unsigned long long unused; 24 unsigned long long unused;
25 long syscall_nr; 25 long syscall_nr;
26 long long dfd; 26 long long dfd;
27 long filename_ptr; 27 long filename_ptr;
28 long flags; 28 long flags;
29 long mode; 29 long mode;
30 }; 30 };
31 31
32 struct { 32 struct {
33 __uint(type, BPF_MAP_TYPE_ARRAY); 33 __uint(type, BPF_MAP_TYPE_ARRAY);
34 __type(key, u32); 34 __type(key, u32);
35 __type(value, u32); 35 __type(value, u32);
36 __uint(max_entries, 1); 36 __uint(max_entries, 1);
37 } enter_open_map SEC(".maps"); 37 } enter_open_map SEC(".maps");
38 38
39 struct { 39 struct {
40 __uint(type, BPF_MAP_TYPE_ARRAY); 40 __uint(type, BPF_MAP_TYPE_ARRAY);
41 __type(key, u32); 41 __type(key, u32);
42 __type(value, u32); 42 __type(value, u32);
43 __uint(max_entries, 1); 43 __uint(max_entries, 1);
44 } exit_open_map SEC(".maps"); 44 } exit_open_map SEC(".maps");
45 45
46 static __always_inline void count(void *map) 46 static __always_inline void count(void *map)
47 { 47 {
48 u32 key = 0; 48 u32 key = 0;
49 u32 *value, init_val = 1; 49 u32 *value, init_val = 1;
50 50
51 value = bpf_map_lookup_elem(map, &key) 51 value = bpf_map_lookup_elem(map, &key);
52 if (value) 52 if (value)
53 *value += 1; 53 *value += 1;
54 else 54 else
55 bpf_map_update_elem(map, &key, 55 bpf_map_update_elem(map, &key, &init_val, BPF_NOEXIST);
56 } 56 }
57 57
58 #if !defined(__aarch64__) 58 #if !defined(__aarch64__)
59 SEC("tracepoint/syscalls/sys_enter_open") 59 SEC("tracepoint/syscalls/sys_enter_open")
60 int trace_enter_open(struct syscalls_enter_ope 60 int trace_enter_open(struct syscalls_enter_open_args *ctx)
61 { 61 {
62 count(&enter_open_map); 62 count(&enter_open_map);
63 return 0; 63 return 0;
64 } 64 }
65 #endif 65 #endif
66 66
67 SEC("tracepoint/syscalls/sys_enter_openat") 67 SEC("tracepoint/syscalls/sys_enter_openat")
68 int trace_enter_open_at(struct syscalls_enter_ 68 int trace_enter_open_at(struct syscalls_enter_open_at_args *ctx)
69 { 69 {
70 count(&enter_open_map); 70 count(&enter_open_map);
71 return 0; 71 return 0;
72 } 72 }
73 73
74 SEC("tracepoint/syscalls/sys_enter_openat2") 74 SEC("tracepoint/syscalls/sys_enter_openat2")
75 int trace_enter_open_at2(struct syscalls_enter 75 int trace_enter_open_at2(struct syscalls_enter_open_at_args *ctx)
76 { 76 {
77 count(&enter_open_map); 77 count(&enter_open_map);
78 return 0; 78 return 0;
79 } 79 }
80 80
81 #if !defined(__aarch64__) 81 #if !defined(__aarch64__)
82 SEC("tracepoint/syscalls/sys_exit_open") 82 SEC("tracepoint/syscalls/sys_exit_open")
83 int trace_enter_exit(struct syscalls_exit_open 83 int trace_enter_exit(struct syscalls_exit_open_args *ctx)
84 { 84 {
85 count(&exit_open_map); 85 count(&exit_open_map);
86 return 0; 86 return 0;
87 } 87 }
88 #endif 88 #endif
89 89
90 SEC("tracepoint/syscalls/sys_exit_openat") 90 SEC("tracepoint/syscalls/sys_exit_openat")
91 int trace_enter_exit_at(struct syscalls_exit_o 91 int trace_enter_exit_at(struct syscalls_exit_open_args *ctx)
92 { 92 {
93 count(&exit_open_map); 93 count(&exit_open_map);
94 return 0; 94 return 0;
95 } 95 }
96 96
97 SEC("tracepoint/syscalls/sys_exit_openat2") 97 SEC("tracepoint/syscalls/sys_exit_openat2")
98 int trace_enter_exit_at2(struct syscalls_exit_ 98 int trace_enter_exit_at2(struct syscalls_exit_open_args *ctx)
99 { 99 {
100 count(&exit_open_map); 100 count(&exit_open_map);
101 return 0; 101 return 0;
102 } 102 }
103 103
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.