initial RwEvent (read-write event) returning size

8 files changed, 61 insertions, 10 deletions

diff --git a/Makefile b/Makefile
index 7037e78..3c14d7a 100644
--- a/Makefile
+++ b/Makefile
@@ -12,12 +12,15 @@ bpfbuild:
 	make -C ./internal/c redo
 	cp -v ./internal/c/ioriotng.bpf.o .
 
+gen: generated
+generate: generated
+
 .PHONY: generated
 generated:
 	make -C ./internal/generated
 
 .PHONY: gobuild
-gobuild: generated
+gobuild:
 	go build -tags netgo -ldflags '-w -extldflags "-static"' -o ioriotng ./cmd/ioriotng/main.go
 
 .PHONY: clean
@@ -25,3 +28,7 @@ clean:
 	find . -type f -name ioriotng -delete
 	if [ -e ioriotng.bpf.o ]; then rm ioriotng.bpf.o; fi
 	make -C ./internal/c clean
+
+.PHONY: foo
+foo: clean generate all
+	sudo ./ioriotng --uid $$(id -u)
diff --git a/internal/c/tracepoints/close.c b/internal/c/tracepoints/close.c
index 199a6fa..f98b39c 100644
--- a/internal/c/tracepoints/close.c
+++ b/internal/c/tracepoints/close.c
@@ -21,7 +21,7 @@ int handle_enter_close(struct trace_event_raw_sys_enter *ctx) {
 }
 
 SEC("tracepoint/syscalls/sys_exit_close")
-int handle_exit_close(struct trace_event_raw_sys_enter *ctx) {
+int handle_exit_close(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
diff --git a/internal/c/tracepoints/write.c b/internal/c/tracepoints/write.c
index 7caff5d..b79ae92 100644
--- a/internal/c/tracepoints/write.c
+++ b/internal/c/tracepoints/write.c
@@ -21,12 +21,12 @@ int handle_enter_write(struct trace_event_raw_sys_enter *ctx) {
 }
 
 SEC("tracepoint/syscalls/sys_exit_write")
-int handle_exit_write(struct trace_event_raw_sys_enter *ctx) {
+int handle_exit_write(struct trace_event_raw_sys_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
 
-    struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
+    struct rw_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct rw_event), 0);
     if (!ev)
         return 0;
 
@@ -35,6 +35,7 @@ int handle_exit_write(struct trace_event_raw_sys_enter *ctx) {
     ev->tid = tid;
     ev->time = bpf_ktime_get_ns();
 
+    ev->size = ctx->ret;
     bpf_ringbuf_submit(ev, 0);
 
     return 0;
diff --git a/internal/c/types.h b/internal/c/types.h
index a2d3b4b..b62c19a 100644
--- a/internal/c/types.h
+++ b/internal/c/types.h
@@ -31,6 +31,14 @@ struct fd_event {
     __s32 fd;
 };
 
+struct rw_event {
+    __u32 op_id;
+    __u32 pid;
+    __u32 tid;
+    __u64 time;
+    __s64 size;
+};
+
 struct open_enter_event {
     __u32 op_id; 
     char filename[MAX_FILENAME_LENGTH];
diff --git a/internal/eventloop.go b/internal/eventloop.go
index a754897..5f754a5 100644
--- a/internal/eventloop.go
+++ b/internal/eventloop.go
@@ -98,7 +98,7 @@ func eventLoop(bpfModule *bpf.Module, ch <-chan []byte) {
 		case WRITE_EXIT_OP_ID:
 			fallthrough
 		case WRITEV_EXIT_OP_ID:
-			ev := NewNullEvent(raw)
+			ev := NewRwEvent(raw)
 			enterEv, ok := enterFd[ev.Tid]
 			if !ok {
 				ev.Recycle()
@@ -106,7 +106,7 @@ func eventLoop(bpfModule *bpf.Module, ch <-chan []byte) {
 			}
 			duration := float64(ev.Time-enterEv.Time) / float64(1_000_000)
 			if file, ok := openFdMap[enterEv.Fd]; ok {
-				fmt.Println(duration, "ms", "wrote", file)
+				fmt.Println(duration, "ms", "wrote", ev.Size, "bytes", file)
 			}
 
 			delete(enterFd, ev.Tid)
diff --git a/internal/generated/Makefile b/internal/generated/Makefile
index 1f5bf05..32911d2 100644
--- a/internal/generated/Makefile
+++ b/internal/generated/Makefile
@@ -4,9 +4,14 @@ generate: tracepoints types
 
 .PHONY: tracepoints
 tracepoints:
-	cat ../c/tracepoints/*.c | raku tracepoints.raku | goimports | gofmt > tracepoints/tracepoints.go
+	cat ../c/tracepoints/*.c \
+		| raku tracepoints.raku \
+		| goimports | gofmt \
+		| tee tracepoints/tracepoints.go
 
 .PHONY: types
 types:
-	cat ../c/types.h | raku nqc.raku | goimports | gofmt > types/types.go
-
+	cat ../c/types.h \
+		| raku nqc.raku \
+		| goimports | gofmt \
+		| tee types/types.go
diff --git a/internal/generated/nqc.raku b/internal/generated/nqc.raku
index 5e1ae1f..e5ea4e1 100644
--- a/internal/generated/nqc.raku
+++ b/internal/generated/nqc.raku
@@ -18,7 +18,7 @@ grammar NQC {
     rule single-line-comment { '//' <-[\n]>+ }
     rule multi-line-comment { '/*' .*? '*/' }
     token arraysize { '[' <identifier> ']' }
-    token type { 'char' | '__s32' | '__u32' | '__u64' }
+    token type { 'char' | '__s32' | '__u32' | '__s64' | '__u64' }
     token identifier { <[a..z A..Z 0..9 _]>+ }
     token number { \d+ }
 }
@@ -129,6 +129,7 @@ class NQCToGoActions {
             when 'char' { 'byte' }
             when '__s32' { 'int32' }
             when '__u32' { 'uint32' }
+            when '__s64' { 'int64' }
             when '__u64' { 'uint64' }
         }
     }
diff --git a/internal/generated/types/types.go b/internal/generated/types/types.go
index d93a8c0..3d5dc48 100644
--- a/internal/generated/types/types.go
+++ b/internal/generated/types/types.go
@@ -107,6 +107,35 @@ func (f *FdEvent) Recycle() {
 	poolOfFdEvents.Put(f)
 }
 
+type RwEvent struct {
+	OpId OpId
+	Pid  uint32
+	Tid  uint32
+	Time uint64
+	Size int64
+}
+
+func (r RwEvent) String() string {
+	return fmt.Sprintf("OpId:%v Pid:%v Tid:%v Time:%v Size:%v", r.OpId, r.Pid, r.Tid, r.Time, r.Size)
+}
+
+var poolOfRwEvents = sync.Pool{
+	New: func() interface{} { return &RwEvent{} },
+}
+
+func NewRwEvent(raw []byte) *RwEvent {
+	r := poolOfRwEvents.Get().(*RwEvent)
+	if err := binary.Read(bytes.NewReader(raw), binary.LittleEndian, r); err != nil {
+		fmt.Println(r, raw, len(raw), err)
+		panic(raw)
+	}
+	return r
+}
+
+func (r *RwEvent) Recycle() {
+	poolOfRwEvents.Put(r)
+}
+
 type OpenEnterEvent struct {
 	OpId     OpId
 	Filename [MAX_FILENAME_LENGTH]byte