collect enter and exit times of the syscall tracepoints

1 files changed, 14 insertions, 5 deletions

diff --git a/maps.bpf.h b/maps.bpf.h
index 3cdfe25..d0bcb2f 100644
--- a/maps.bpf.h
+++ b/maps.bpf.h
@@ -1,11 +1,13 @@
 //+build ignore
 
+#define TEMP_MAP_SIZES 1024 // Adjust size as needed
+
 struct open_event {
     int fd;
     int op_id;
     u32 tid;
-    long enter_time;
-    long exit_time;
+    __u64 enter_time;
+    __u64 exit_time;
     char filename[256];
     char comm[16];
 };
@@ -21,15 +23,15 @@ struct {
     __uint(type, BPF_MAP_TYPE_HASH);
     __uint(key_size, sizeof(u32));
     __uint(value_size, sizeof(struct open_event));
-    __uint(max_entries, 128); // Adjust size as needed
+    __uint(max_entries, TEMP_MAP_SIZES);
 } open_event_temp_map SEC(".maps");
 
 struct fd_event {
     int fd;
     int op_id;
     u32 tid;
-    long enter_time;
-    long exit_time;
+    __u64 enter_time;
+    __u64 exit_time;
 };
 
 struct {
@@ -38,3 +40,10 @@ struct {
     __uint(value_size, sizeof(u32));
 } fd_event_map SEC(".maps");
 
+// Map to temporarily store info from the enter tracepoinut for the exit one
+struct {
+    __uint(type, BPF_MAP_TYPE_HASH);
+    __uint(key_size, sizeof(u32));
+    __uint(value_size, sizeof(struct fd_event));
+    __uint(max_entries, TEMP_MAP_SIZES);
+} fd_event_temp_map SEC(".maps");