task 07: add KindMem and separate address-space byte accounting

3 files changed, 30 insertions, 8 deletions

diff --git a/internal/c/generated_tracepoints.c b/internal/c/generated_tracepoints.c
index 393954c..ad11b06 100644
--- a/internal/c/generated_tracepoints.c
+++ b/internal/c/generated_tracepoints.c
@@ -10736,22 +10736,26 @@ int handle_sys_exit_msync(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_mremap is a struct null_event
+/// sys_enter_mremap is a struct mem_event
 SEC("tracepoint/syscalls/sys_enter_mremap")
 int handle_sys_enter_mremap(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
 
-    struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
+    struct mem_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct mem_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = ENTER_NULL_EVENT;
+    ev->event_type = ENTER_MEM_EVENT;
     ev->trace_id = SYS_ENTER_MREMAP;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_boot_ns();
+    ev->addr = (__u64)ctx->args[0];
+    ev->length = (__u64)ctx->args[1];
+    ev->length2 = (__u64)ctx->args[2];
+    ev->flags = (__u64)ctx->args[3];
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
@@ -11000,22 +11004,26 @@ int handle_sys_exit_brk(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_munmap is a struct null_event
+/// sys_enter_munmap is a struct mem_event
 SEC("tracepoint/syscalls/sys_enter_munmap")
 int handle_sys_enter_munmap(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
 
-    struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
+    struct mem_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct mem_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = ENTER_NULL_EVENT;
+    ev->event_type = ENTER_MEM_EVENT;
     ev->trace_id = SYS_ENTER_MUNMAP;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_boot_ns();
+    ev->addr = (__u64)ctx->args[0];
+    ev->length = (__u64)ctx->args[1];
+    ev->length2 = 0;
+    ev->flags = 0;
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
diff --git a/internal/c/generated_tracepoints_result.txt b/internal/c/generated_tracepoints_result.txt
index 4ba2dc8..77339f5 100644
--- a/internal/c/generated_tracepoints_result.txt
+++ b/internal/c/generated_tracepoints_result.txt
@@ -181,7 +181,7 @@ sys_enter_mq_open is a struct null_event
 sys_enter_mq_timedreceive is a struct null_event
 sys_enter_mq_timedsend is a struct null_event
 sys_enter_mq_unlink is a struct null_event
-sys_enter_mremap is a struct null_event
+sys_enter_mremap is a struct mem_event
 sys_enter_mseal is a struct null_event
 sys_enter_msgctl is a struct null_event
 sys_enter_msgget is a struct null_event
@@ -190,7 +190,7 @@ sys_enter_msgsnd is a struct null_event
 sys_enter_msync is a struct null_event
 sys_enter_munlock is a struct null_event
 sys_enter_munlockall is a struct null_event
-sys_enter_munmap is a struct null_event
+sys_enter_munmap is a struct mem_event
 sys_enter_name_to_handle_at is a struct path_event
 sys_enter_nanosleep is a struct null_event
 sys_enter_newfstat is a struct fd_event
diff --git a/internal/c/types.h b/internal/c/types.h
index 128d4e9..a496c1a 100644
--- a/internal/c/types.h
+++ b/internal/c/types.h
@@ -35,6 +35,8 @@
 #define EXIT_EPOLL_CTL_EVENT 30
 #define ENTER_POLL_EVENT 31
 #define EXIT_POLL_EVENT 32
+#define ENTER_MEM_EVENT 33
+#define EXIT_MEM_EVENT 34
 
 #define UNCLASSIFIED 0
 #define READ_CLASSIFIED 1
@@ -207,3 +209,15 @@ struct poll_event {
     __s32 nfds;
     __s64 timeout_ns;
 };
+
+struct mem_event {
+    __u32 event_type;
+    __u32 trace_id;
+    __u64 time;
+    __u32 pid;
+    __u32 tid;
+    __u64 addr;
+    __u64 length;
+    __u64 length2;
+    __u64 flags;
+};