int used [int]; syscall::open*:entry { self->name=copyinstr(arg0); } syscall::open*:return /arg0 >= 0/ { fd[arg0] = self->name; } syscall::close*:entry /used[arg0] == 1/ { printf ("Process %d closing non unmapped file %s\n", pid, fd[arg0]); used[arg0] = 0; } syscall::close*:entry { fd[arg0] = 0; } syscall::mmap*:entry /fd[arg4] != 0/ { self->mfd = arg4; printf ("Process %d mapped file %s\n", pid, fd[arg4]); jstack (30,8*1024); } syscall::mmap*:return /self->mfd >= 0/ { mapped[arg0] = self->mfd; used[self->mfd] = 1; } syscall::munmap*:entry /mapped[arg0] >= 0/ { used[mapped[arg0]] = 0; mapped[arg0] = 0; }