From b9762202d123160c9a64b804b72e018f61fddd1d Mon Sep 17 00:00:00 2001
From: Paul Buetow <paul@buetow.org>
Date: Sat, 10 Feb 2024 23:35:37 +0200
Subject: add debugfs.TracepointsWithF

---
 internal/debugfs/debugfs.go | 57 +++++++++++++++++++++++++++++++++++++++++++++
 main.go                     |  4 ++++
 2 files changed, 61 insertions(+)
 create mode 100644 internal/debugfs/debugfs.go

diff --git a/internal/debugfs/debugfs.go b/internal/debugfs/debugfs.go
new file mode 100644
index 0000000..80ac436
--- /dev/null
+++ b/internal/debugfs/debugfs.go
@@ -0,0 +1,57 @@
+package debugfs
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// Return tracepoints with 'unsigned int fd', which are I/O tracepoints on FDs
+func TracepointsWithFd() ([]string, error) {
+	return tracepointsWith("unsigned int fd")
+}
+
+func tracepointsWith(field string) ([]string, error) {
+	var tracepoints []string
+
+	matches, err := filepath.Glob("/sys/kernel/debug/tracing/events/syscalls/*/format")
+	if err != nil {
+		return tracepoints, err
+	}
+	if len(matches) == 0 {
+		return tracepoints, fmt.Errorf("Unable to gather tracepoints with FDs")
+	}
+
+	for _, formatPath := range matches {
+		has, err := hasField(formatPath, field)
+		if err != nil {
+			return tracepoints, err
+		}
+		if !has {
+			continue
+		}
+		tracepoints = append(tracepoints, filepath.Base(filepath.Dir(formatPath)))
+	}
+
+	return tracepoints, nil
+}
+
+func hasField(formatPath, field string) (bool, error) {
+	file, err := os.Open(formatPath)
+	if err != nil {
+		return false, err
+	}
+	defer file.Close()
+
+	scanner := bufio.NewScanner(file)
+	for scanner.Scan() {
+		line := scanner.Text()
+		if strings.Contains(line, fmt.Sprintf("field:%s;", field)) {
+			return true, nil
+		}
+	}
+
+	return false, nil
+}
diff --git a/main.go b/main.go
index 5fbcc6c..c21b831 100644
--- a/main.go
+++ b/main.go
@@ -11,6 +11,7 @@ import (
 	"runtime"
 	"sync"
 
+	"ioriotng/internal/debugfs"
 	"ioriotng/internal/tracepoints"
 
 	bpf "github.com/aquasecurity/libbpfgo"
@@ -63,6 +64,9 @@ func resizeMap(module *bpf.Module, name string, size uint32) error {
 }
 
 func main() {
+	// To consider for implementation!
+	log.Println("Tracepoints with FD", debugfs.TracepointsWithFd())
+
 	bpfModule, err := bpf.NewModuleFromFile("main.bpf.o")
 	if err != nil {
 		log.Fatal(err)
-- 
cgit v1.2.3