#!/usr/bin/env bpftrace
//
// dev/syd-tor.bt
// Trace every splice, epoll_wait/pwait, accept4, connect and pipe2 in syd-tor.
// Prefix each line with comm and pid. Runs indefinitely until you Ctrl-C.

// Helper macro for prefix
#define PREFIX printf("[%s:%d]", comm, pid)

// -- splice enter/exit --
tracepoint:syscalls:sys_enter_splice
/ comm == "syd-tor" /
{
  PREFIX;
  printf(" ENTER splice in=%d out=%d len=%d flags=0x%x\n",
    args->fd_in, args->fd_out, args->len, args->flags);
}

tracepoint:syscalls:sys_exit_splice
/ comm == "syd-tor" /
{
  PREFIX;
  printf(" EXIT splice ret=%d\n", args->ret);
}

// -- epoll_wait enter/exit --
tracepoint:syscalls:sys_enter_epoll_wait
/ comm == "syd-tor" /
{
  PREFIX;
  printf(" ENTER epoll_wait epfd=%d maxevents=%d timeout=%d\n",
    args->epfd, args->maxevents, args->timeout);
}

tracepoint:syscalls:sys_exit_epoll_wait
/ comm == "syd-tor" /
{
  PREFIX;
  printf(" EXIT epoll_wait ret=%d\n", args->ret);
}

// -- epoll_pwait enter/exit --
tracepoint:syscalls:sys_enter_epoll_pwait
/ comm == "syd-tor" /
{
  PREFIX;
  printf(" ENTER epoll_pwait epfd=%d maxevents=%d timeout=%d\n",
    args->epfd, args->maxevents, args->timeout);
}

tracepoint:syscalls:sys_exit_epoll_pwait
/ comm == "syd-tor" /
{
  PREFIX;
  printf(" EXIT epoll_pwait ret=%d\n", args->ret);
}

// -- accept4 enter/exit --
tracepoint:syscalls:sys_enter_accept4
/ comm == "syd-tor" /
{
  PREFIX;
  printf(" ENTER accept4 listen_fd=%d flags=0x%x\n",
    args->fd, args->flags);
}

tracepoint:syscalls:sys_exit_accept4
/ comm == "syd-tor" /
{
  PREFIX;
  printf(" EXIT accept4 ret=%d errno=%d\n",
    args->ret, -args->ret);
}

// -- connect enter/exit --
tracepoint:syscalls:sys_enter_connect
/ comm == "syd-tor" /
{
  PREFIX;
  printf(" ENTER connect fd=%d addr=0x%lx addrlen=%d\n",
    args->fd, args->uservaddr, args->addrlen);
}

tracepoint:syscalls:sys_exit_connect
/ comm == "syd-tor" /
{
  PREFIX;
  printf(" EXIT connect ret=%d errno=%d\n",
    args->ret, -args->ret);
}

// -- pipe2 enter/exit --
tracepoint:syscalls:sys_enter_pipe2
/ comm == "syd-tor" /
{
  PREFIX;
  printf(" ENTER pipe2 flags=0x%x\n", args->flags);
}

tracepoint:syscalls:sys_exit_pipe2
/ comm == "syd-tor" /
{
  PREFIX;
  printf(" EXIT pipe2 ret=%d errno=%d\n",
    args->ret, -args->ret);
}
