4 files changed, 76 insertions, 0 deletions
diff --git a/internal/generate/bpfhandler.go b/internal/generate/bpfhandler.go
index 7dba8d7..cd2321b 100644
--- a/internal/generate/bpfhandler.go
+++ b/internal/generate/bpfhandler.go
@@ -328,6 +328,14 @@ func generateExtraPoll(name string) string {
 
 func generateExtraMem(name string) string {
 	switch name {
+	case "sys_enter_mprotect":
+		return "    ev->addr = (__u64)ctx->args[0];\n    ev->length = (__u64)ctx->args[1];\n    ev->length2 = 0;\n    ev->flags = (__u64)ctx->args[2];\n"
+	case "sys_enter_madvise":
+		return "    ev->addr = (__u64)ctx->args[0];\n    ev->length = (__u64)ctx->args[1];\n    ev->length2 = 0;\n    ev->flags = (__u64)ctx->args[2];\n"
+	case "sys_enter_pkey_mprotect":
+		return "    ev->addr = (__u64)ctx->args[0];\n    ev->length = (__u64)ctx->args[1];\n    ev->length2 = (__u64)ctx->args[3];\n    ev->flags = (__u64)ctx->args[2];\n"
+	case "sys_enter_brk":
+		return "    ev->addr = (__u64)ctx->args[0];\n    ev->length = 0;\n    ev->length2 = 0;\n    ev->flags = 0;\n"
 	case "sys_enter_munmap":
 		return "    ev->addr = (__u64)ctx->args[0];\n    ev->length = (__u64)ctx->args[1];\n    ev->length2 = 0;\n    ev->flags = 0;\n"
 	case "sys_enter_mremap":
diff --git a/internal/generate/classify.go b/internal/generate/classify.go
index ff1bf72..191b41e 100644
--- a/internal/generate/classify.go
+++ b/internal/generate/classify.go
@@ -300,6 +300,14 @@ func classifyNameOnly(name string) (ClassificationResult, bool) {
 		return ClassificationResult{Kind: KindPoll}, true
 	case "sys_enter_pselect6":
 		return ClassificationResult{Kind: KindPoll}, true
+	case "sys_enter_mprotect":
+		return ClassificationResult{Kind: KindMem}, true
+	case "sys_enter_madvise":
+		return ClassificationResult{Kind: KindMem}, true
+	case "sys_enter_pkey_mprotect":
+		return ClassificationResult{Kind: KindMem}, true
+	case "sys_enter_brk":
+		return ClassificationResult{Kind: KindMem}, true
 	case "sys_enter_munmap":
 		return ClassificationResult{Kind: KindMem}, true
 	case "sys_enter_mremap":
diff --git a/internal/generate/classify_test.go b/internal/generate/classify_test.go
index 8e77cd4..bbf33d6 100644
--- a/internal/generate/classify_test.go
+++ b/internal/generate/classify_test.go
@@ -721,6 +721,30 @@ func TestClassifyI7NameOnlyKinds(t *testing.T) {
 	}
 }
 
+func TestClassifyH7NameOnlyKinds(t *testing.T) {
+	tests := []string{
+		"sys_enter_mprotect",
+		"sys_enter_madvise",
+		"sys_enter_pkey_mprotect",
+		"sys_enter_brk",
+	}
+
+	for _, name := range tests {
+		t.Run(name, func(t *testing.T) {
+			r := ClassifyFormat(&Format{
+				Name: name,
+				ExternalFields: []Field{
+					{Type: "long", Name: "__syscall_nr"},
+					{Type: "long", Name: "arg0"},
+				},
+			})
+			if r.Kind != KindMem {
+				t.Fatalf("%s: got kind %d, want KindMem", name, r.Kind)
+			}
+		})
+	}
+}
+
 func TestClassify67NameOnlyKinds(t *testing.T) {
 	tests := []struct {
 		name string
diff --git a/internal/generate/codegen_test.go b/internal/generate/codegen_test.go
index d61e0c9..7614ab1 100644
--- a/internal/generate/codegen_test.go
+++ b/internal/generate/codegen_test.go
@@ -236,6 +236,42 @@ func TestGenerateMemHandlerRemapFilePages(t *testing.T) {
 	requireContains(t, output, "ev->flags = (__u64)ctx->args[4];")
 }
 
+func TestGenerateMemHandlerMprotect(t *testing.T) {
+	output := GenerateTracepointsC(mustParseAll(t, syntheticPair("mprotect")))
+
+	requireContains(t, output, `SEC("tracepoint/syscalls/sys_enter_mprotect")`)
+	requireContains(t, output, "struct mem_event *ev")
+	requireContains(t, output, "ev->event_type = ENTER_MEM_EVENT;")
+	requireContains(t, output, "ev->addr = (__u64)ctx->args[0];")
+	requireContains(t, output, "ev->length = (__u64)ctx->args[1];")
+	requireContains(t, output, "ev->length2 = 0;")
+	requireContains(t, output, "ev->flags = (__u64)ctx->args[2];")
+}
+
+func TestGenerateMemHandlerPkeyMprotect(t *testing.T) {
+	output := GenerateTracepointsC(mustParseAll(t, syntheticPair("pkey_mprotect")))
+
+	requireContains(t, output, `SEC("tracepoint/syscalls/sys_enter_pkey_mprotect")`)
+	requireContains(t, output, "struct mem_event *ev")
+	requireContains(t, output, "ev->event_type = ENTER_MEM_EVENT;")
+	requireContains(t, output, "ev->addr = (__u64)ctx->args[0];")
+	requireContains(t, output, "ev->length = (__u64)ctx->args[1];")
+	requireContains(t, output, "ev->length2 = (__u64)ctx->args[3];")
+	requireContains(t, output, "ev->flags = (__u64)ctx->args[2];")
+}
+
+func TestGenerateMemHandlerBrk(t *testing.T) {
+	output := GenerateTracepointsC(mustParseAll(t, syntheticPair("brk")))
+
+	requireContains(t, output, `SEC("tracepoint/syscalls/sys_enter_brk")`)
+	requireContains(t, output, "struct mem_event *ev")
+	requireContains(t, output, "ev->event_type = ENTER_MEM_EVENT;")
+	requireContains(t, output, "ev->addr = (__u64)ctx->args[0];")
+	requireContains(t, output, "ev->length = 0;")
+	requireContains(t, output, "ev->length2 = 0;")
+	requireContains(t, output, "ev->flags = 0;")
+}
+
 func TestGenerateDup3Handler(t *testing.T) {
 	output := generateFromPair(t, FormatDup3, FormatExitDup3)