Implement mmap/msync syscall support with unit and integration coverage

2 files changed, 48 insertions, 2 deletions

diff --git a/internal/c/generated_tracepoints.c b/internal/c/generated_tracepoints.c
index a40f558..72cb070 100644
--- a/internal/c/generated_tracepoints.c
+++ b/internal/c/generated_tracepoints.c
@@ -121,7 +121,6 @@
 /// Ignoring sys_enter_msgget sys_exit_msgget as possibly not file I/O related
 /// Ignoring sys_enter_msgrcv sys_exit_msgrcv as possibly not file I/O related
 /// Ignoring sys_enter_msgsnd sys_exit_msgsnd as possibly not file I/O related
-/// Ignoring sys_enter_msync sys_exit_msync as possibly not file I/O related
 /// Ignoring sys_enter_munlock sys_exit_munlock as possibly not file I/O related
 /// Ignoring sys_enter_munlockall sys_exit_munlockall as possibly not file I/O related
 /// Ignoring sys_enter_munmap sys_exit_munmap as possibly not file I/O related
@@ -468,6 +467,8 @@
 #define SYS_EXIT_CREAT 779
 #define SYS_ENTER_CLOSE 778
 #define SYS_EXIT_CLOSE 777
+#define SYS_ENTER_MSYNC 707
+#define SYS_EXIT_MSYNC 706
 #define SYS_ENTER_READAHEAD 613
 #define SYS_EXIT_READAHEAD 612
 #define SYS_ENTER_FADVISE64 611
@@ -5365,6 +5366,50 @@ int handle_sys_exit_close(struct trace_event_raw_sys_exit *ctx) {
     return 0;
 }
 
+/// sys_enter_msync is a struct null_event
+SEC("tracepoint/syscalls/sys_enter_msync")
+int handle_sys_enter_msync(struct trace_event_raw_sys_enter *ctx) {
+    __u32 pid, tid;
+    if (filter(&pid, &tid))
+        return 0;
+
+    struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
+    if (!ev)
+        return 0;
+
+    ev->event_type = ENTER_NULL_EVENT;
+    ev->trace_id = SYS_ENTER_MSYNC;
+    ev->pid = pid;
+    ev->tid = tid;
+    ev->time = bpf_ktime_get_boot_ns();
+
+    bpf_ringbuf_submit(ev, 0);
+    return 0;
+}
+
+/// sys_exit_msync is a struct ret_event (UNCLASSIFIED)
+SEC("tracepoint/syscalls/sys_exit_msync")
+int handle_sys_exit_msync(struct trace_event_raw_sys_exit *ctx) {
+    __u32 pid, tid;
+    if (filter(&pid, &tid))
+        return 0;
+
+    struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
+    if (!ev)
+        return 0;
+
+    ev->event_type = EXIT_RET_EVENT;
+    ev->trace_id = SYS_EXIT_MSYNC;
+    ev->pid = pid;
+    ev->tid = tid;
+    ev->time = bpf_ktime_get_boot_ns();
+    ev->ret = ctx->ret;
+    ev->ret_type = UNCLASSIFIED;
+
+    bpf_ringbuf_submit(ev, 0);
+    return 0;
+}
+
 /// sys_enter_readahead is a struct fd_event
 SEC("tracepoint/syscalls/sys_enter_readahead")
 int handle_sys_enter_readahead(struct trace_event_raw_sys_enter *ctx) {
diff --git a/internal/c/generated_tracepoints_result.txt b/internal/c/generated_tracepoints_result.txt
index fc722c1..357d279 100644
--- a/internal/c/generated_tracepoints_result.txt
+++ b/internal/c/generated_tracepoints_result.txt
@@ -119,7 +119,6 @@ Ignoring sys_enter_msgctl sys_exit_msgctl as possibly not file I/O related
 Ignoring sys_enter_msgget sys_exit_msgget as possibly not file I/O related
 Ignoring sys_enter_msgrcv sys_exit_msgrcv as possibly not file I/O related
 Ignoring sys_enter_msgsnd sys_exit_msgsnd as possibly not file I/O related
-Ignoring sys_enter_msync sys_exit_msync as possibly not file I/O related
 Ignoring sys_enter_munlock sys_exit_munlock as possibly not file I/O related
 Ignoring sys_enter_munlockall sys_exit_munlockall as possibly not file I/O related
 Ignoring sys_enter_munmap sys_exit_munmap as possibly not file I/O related
@@ -318,6 +317,7 @@ sys_enter_mkdir is a struct path_event
 sys_enter_mkdirat is a struct path_event
 sys_enter_mmap is a struct fd_event
 sys_enter_mount_setattr is a struct path_event
+sys_enter_msync is a struct null_event
 sys_enter_name_to_handle_at is a struct path_event
 sys_enter_newfstat is a struct fd_event
 sys_enter_newfstatat is a struct path_event
@@ -431,6 +431,7 @@ sys_exit_mkdir is a struct ret_event (UNCLASSIFIED)
 sys_exit_mkdirat is a struct ret_event (UNCLASSIFIED)
 sys_exit_mmap is a struct ret_event (UNCLASSIFIED)
 sys_exit_mount_setattr is a struct ret_event (UNCLASSIFIED)
+sys_exit_msync is a struct ret_event (UNCLASSIFIED)
 sys_exit_name_to_handle_at is a struct ret_event (UNCLASSIFIED)
 sys_exit_newfstat is a struct ret_event (UNCLASSIFIED)
 sys_exit_newfstatat is a struct ret_event (UNCLASSIFIED)