4 files changed, 77 insertions, 0 deletions
diff --git a/fs-tracer-ebpf/.cargo/config.toml b/fs-tracer-ebpf/.cargo/config.toml
new file mode 100644
index 0000000..4302a7f
--- /dev/null
+++ b/fs-tracer-ebpf/.cargo/config.toml
@@ -0,0 +1,6 @@
+[build]
+target-dir = "../target"
+target = "bpfel-unknown-none"
+
+[unstable]
+build-std = ["core"]
diff --git a/fs-tracer-ebpf/Cargo.toml b/fs-tracer-ebpf/Cargo.toml
new file mode 100644
index 0000000..37af91d
--- /dev/null
+++ b/fs-tracer-ebpf/Cargo.toml
@@ -0,0 +1,32 @@
+[package]
+name = "fs-tracer-ebpf"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+aya-bpf = { git = "https://github.com/aya-rs/aya" }
+aya-log-ebpf = { git = "https://github.com/aya-rs/aya" }
+fs-tracer-common = { path = "../fs-tracer-common" }
+
+[[bin]]
+name = "fs-tracer"
+path = "src/main.rs"
+
+[profile.dev]
+opt-level = 3
+debug = false
+debug-assertions = false
+overflow-checks = false
+lto = true
+panic = "abort"
+incremental = false
+codegen-units = 1
+rpath = false
+
+[profile.release]
+lto = true
+panic = "abort"
+codegen-units = 1
+
+[workspace]
+members = []
diff --git a/fs-tracer-ebpf/rust-toolchain.toml b/fs-tracer-ebpf/rust-toolchain.toml
new file mode 100644
index 0000000..24ce391
--- /dev/null
+++ b/fs-tracer-ebpf/rust-toolchain.toml
@@ -0,0 +1,13 @@
+[toolchain]
+channel = "nightly"
+# The source code of rustc, provided by the rust-src component, is needed for
+# building eBPF programs.
+components = [
+    "cargo",
+    "clippy",
+    "rust-docs",
+    "rust-src",
+    "rust-std",
+    "rustc",
+    "rustfmt",
+]
diff --git a/fs-tracer-ebpf/src/main.rs b/fs-tracer-ebpf/src/main.rs
new file mode 100644
index 0000000..f6d7dfb
--- /dev/null
+++ b/fs-tracer-ebpf/src/main.rs
@@ -0,0 +1,26 @@
+#![no_std]
+#![no_main]
+
+use aya_bpf::{
+    macros::tracepoint,
+    programs::TracePointContext,
+};
+use aya_log_ebpf::info;
+
+#[tracepoint]
+pub fn fs_tracer(ctx: TracePointContext) -> u32 {
+    match try_fs_tracer(ctx) {
+        Ok(ret) => ret,
+        Err(ret) => ret,
+    }
+}
+
+fn try_fs_tracer(ctx: TracePointContext) -> Result<u32, u32> {
+    info!(&ctx, "tracepoint syscalls called");
+    Ok(0)
+}
+
+#[panic_handler]
+fn panic(_info: &core::panic::PanicInfo) -> ! {
+    unsafe { core::hint::unreachable_unchecked() }
+}