z6: add KindPoll wiring for poll/select ready counts

3 files changed, 67 insertions, 16 deletions

diff --git a/internal/c/generated_tracepoints.c b/internal/c/generated_tracepoints.c
index cc7de62..393954c 100644
--- a/internal/c/generated_tracepoints.c
+++ b/internal/c/generated_tracepoints.c
@@ -6794,22 +6794,33 @@ int handle_sys_exit_dup(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_select is a struct null_event
+/// sys_enter_select is a struct poll_event
 SEC("tracepoint/syscalls/sys_enter_select")
 int handle_sys_enter_select(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
 
-    struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
+    struct poll_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct poll_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = ENTER_NULL_EVENT;
+    ev->event_type = ENTER_POLL_EVENT;
     ev->trace_id = SYS_ENTER_SELECT;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_boot_ns();
+    ev->nfds = (__s32)ctx->args[0];
+    ev->timeout_ns = -1;
+    if (ctx->args[4] != 0) {
+        struct __ior_timeval {
+            __s64 tv_sec;
+            __s64 tv_usec;
+        } tv = {};
+        if (bpf_probe_read_user(&tv, sizeof(tv), (void *)ctx->args[4]) == 0) {
+            ev->timeout_ns = tv.tv_sec * 1000000000LL + tv.tv_usec * 1000LL;
+        }
+    }
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
@@ -6838,22 +6849,33 @@ int handle_sys_exit_select(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_pselect6 is a struct null_event
+/// sys_enter_pselect6 is a struct poll_event
 SEC("tracepoint/syscalls/sys_enter_pselect6")
 int handle_sys_enter_pselect6(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
 
-    struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
+    struct poll_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct poll_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = ENTER_NULL_EVENT;
+    ev->event_type = ENTER_POLL_EVENT;
     ev->trace_id = SYS_ENTER_PSELECT6;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_boot_ns();
+    ev->nfds = (__s32)ctx->args[0];
+    ev->timeout_ns = -1;
+    if (ctx->args[4] != 0) {
+        struct __ior_timespec {
+            __s64 tv_sec;
+            __s64 tv_nsec;
+        } ts = {};
+        if (bpf_probe_read_user(&ts, sizeof(ts), (void *)ctx->args[4]) == 0) {
+            ev->timeout_ns = ts.tv_sec * 1000000000LL + ts.tv_nsec;
+        }
+    }
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
@@ -6882,22 +6904,28 @@ int handle_sys_exit_pselect6(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_poll is a struct null_event
+/// sys_enter_poll is a struct poll_event
 SEC("tracepoint/syscalls/sys_enter_poll")
 int handle_sys_enter_poll(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
 
-    struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
+    struct poll_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct poll_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = ENTER_NULL_EVENT;
+    ev->event_type = ENTER_POLL_EVENT;
     ev->trace_id = SYS_ENTER_POLL;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_boot_ns();
+    ev->nfds = (__s32)ctx->args[1];
+    ev->timeout_ns = -1;
+    __s32 timeout_ms = (__s32)ctx->args[2];
+    if (timeout_ms >= 0) {
+        ev->timeout_ns = ((__s64)timeout_ms) * 1000000LL;
+    }
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
@@ -6926,22 +6954,33 @@ int handle_sys_exit_poll(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_ppoll is a struct null_event
+/// sys_enter_ppoll is a struct poll_event
 SEC("tracepoint/syscalls/sys_enter_ppoll")
 int handle_sys_enter_ppoll(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
 
-    struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
+    struct poll_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct poll_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = ENTER_NULL_EVENT;
+    ev->event_type = ENTER_POLL_EVENT;
     ev->trace_id = SYS_ENTER_PPOLL;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_boot_ns();
+    ev->nfds = (__s32)ctx->args[1];
+    ev->timeout_ns = -1;
+    if (ctx->args[2] != 0) {
+        struct __ior_timespec {
+            __s64 tv_sec;
+            __s64 tv_nsec;
+        } ts = {};
+        if (bpf_probe_read_user(&ts, sizeof(ts), (void *)ctx->args[2]) == 0) {
+            ev->timeout_ns = ts.tv_sec * 1000000000LL + ts.tv_nsec;
+        }
+    }
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
diff --git a/internal/c/generated_tracepoints_result.txt b/internal/c/generated_tracepoints_result.txt
index 312c412..4ba2dc8 100644
--- a/internal/c/generated_tracepoints_result.txt
+++ b/internal/c/generated_tracepoints_result.txt
@@ -216,8 +216,8 @@ sys_enter_pivot_root is a struct null_event
 sys_enter_pkey_alloc is a struct null_event
 sys_enter_pkey_free is a struct null_event
 sys_enter_pkey_mprotect is a struct null_event
-sys_enter_poll is a struct null_event
-sys_enter_ppoll is a struct null_event
+sys_enter_poll is a struct poll_event
+sys_enter_ppoll is a struct poll_event
 sys_enter_prctl is a struct null_event
 sys_enter_pread64 is a struct fd_event
 sys_enter_preadv is a struct fd_event
@@ -227,7 +227,7 @@ sys_enter_process_madvise is a struct null_event
 sys_enter_process_mrelease is a struct null_event
 sys_enter_process_vm_readv is a struct null_event
 sys_enter_process_vm_writev is a struct null_event
-sys_enter_pselect6 is a struct null_event
+sys_enter_pselect6 is a struct poll_event
 sys_enter_ptrace is a struct null_event
 sys_enter_pwrite64 is a struct fd_event
 sys_enter_pwritev is a struct fd_event
@@ -274,7 +274,7 @@ sys_enter_sched_setparam is a struct null_event
 sys_enter_sched_setscheduler is a struct null_event
 sys_enter_sched_yield is a struct null_event
 sys_enter_seccomp is a struct null_event
-sys_enter_select is a struct null_event
+sys_enter_select is a struct poll_event
 sys_enter_semctl is a struct null_event
 sys_enter_semget is a struct null_event
 sys_enter_semop is a struct null_event
diff --git a/internal/c/types.h b/internal/c/types.h
index bcc88d2..128d4e9 100644
--- a/internal/c/types.h
+++ b/internal/c/types.h
@@ -33,6 +33,8 @@
 #define EXIT_EVENTFD_EVENT 28
 #define ENTER_EPOLL_CTL_EVENT 29
 #define EXIT_EPOLL_CTL_EVENT 30
+#define ENTER_POLL_EVENT 31
+#define EXIT_POLL_EVENT 32
 
 #define UNCLASSIFIED 0
 #define READ_CLASSIFIED 1
@@ -195,3 +197,13 @@ struct epoll_ctl_event {
     __s32 fd;
     __u32 events;
 };
+
+struct poll_event {
+    __u32 event_type;
+    __u32 trace_id;
+    __u64 time;
+    __u32 pid;
+    __u32 tid;
+    __s32 nfds;
+    __s64 timeout_ns;
+};