feat: record when observing a clone

We need to know when we've seen a process fork so that we know which
clone_exit tracepoint triggers we can ignore.

I've also noticed that the exec args are broken again.

build.zig

···
     return run_btf_sanitizer.addPrefixedOutputFileArg("-o", b.fmt("{s}_sanitized.o", .{name}));
 }
 
-fn create_test_step(b: *std.Build, target: std.Build.ResolvedTarget, optimize: std.builtin.OptimizeMode, config: *std.Build.Step.Options, test_filter: ?[]const u8) !*std.Build.Step {
+fn create_test_step(b: *std.Build, target: std.Build.ResolvedTarget, optimize: std.builtin.OptimizeMode, _: *std.Build.Step.Options, test_filter: ?[]const u8) !*std.Build.Step {
     const test_step = b.step("test", "Build and run all unit tests");
 
     if (target.result.os.tag != .linux) {
···
     // Create bpf programs for test
     const build_options = b.addOptions();
     build_options.addOption(bool, "debug", debugging);
-    var sample_dir = try fs.cwd().openDir("samples", .{ .iterate = true });
-    defer sample_dir.close();
-    var it = sample_dir.iterate();
-    while (try it.next()) |entry| {
-        if (test_filter) |f| {
-            if (!std.mem.containsAtLeast(u8, entry.name, 1, f)) {
-                continue;
-            }
-        }
-        const prog = create_bpf_prog(b, optimize, target.result.cpu.arch.endian(), try fs.path.join(b.allocator, &.{ "samples", entry.name }), null, config);
-        build_options.addOptionPath(b.fmt("prog_{s}_path", .{fs.path.stem(entry.name)}), prog);
-    }
     bpf_exe_tests.root_module.addOptions("@build_options", build_options);
 
     const run_unit_test = b.addRunArtifact(bpf_exe_tests);

src/bpf_collector.zig

···
 var events_ringbuf = bpf.Map.RingBuffer("events", 10, 0).init();
 var diagnostics_ringbuf = bpf.Map.RingBuffer("diagnostics", 10, 0).init();
 
+// This one isn't needed by userspace, we use it to keep track of which
+// processes we've seen a `clone_enter`/`clone3_enter` from so that we can know
+// which `clone_exit`/`clone3_exit` calls to record.
+//
+// Remember that you can see a `clone`/`clone3` when a *thread* is created,
+// and you can only tell apart a thread from a process when you have access
+// to the clone flags that are passed in as an argument. Once you're on the
+// exit side of the tracepoint you no longer have access to those flags, so
+// you need some other way to tell whether or not to record the event.
+var clone_seen_map = bpf.Map.HashMap("seen", bridge.Pid, bool, 10, 0).init();
+
 const raw_tp_enter = bpf.RawTracepoint{ .side = .enter };
 const raw_tp_exit = bpf.RawTracepoint{ .side = .exit };
 
···
     //     unsigned long, tls)
 
     const clone_flags = args[0];
-    if (is_new_process(clone_flags)) {
-        const meta = new_event_meta();
-        if (events_ringbuf.reserve(bridge.Event)) |reserved| {
-            reserved.ptr.* = .{ .fork_start = .{ .meta = meta } };
-            reserved.submit();
-        } else {
-            if (diagnostics_ringbuf.reserve(bridge.Diagnostic)) |r| {
-                var buf: [64]u8 = [_]u8{0} ** 64;
-                const str = "failed to reserve space in ringbuf";
-                @memcpy(buf[0..str.len], str);
-                r.ptr.* = .{ .meta = meta, .tp = .clone_enter, .err = bridge.CollectorError.RingbufReserve, .msg = buf };
-                r.submit();
-            }
-        }
-    }
+    clone_enter_common(clone_flags, .clone_enter);
 }
 
 fn handle_clone3_enter(args: *const [6]u64) void {
···
         }
         return;
     }
+    clone_enter_common(flags, .clone3_enter);
+}
+
+fn clone_enter_common(flags: u64, tp_kind: bridge.TracepointKind) void {
     if (is_new_process(flags)) {
         const meta = new_event_meta();
         if (events_ringbuf.reserve(bridge.Event)) |reserved| {
···
                 var buf: [64]u8 = [_]u8{0} ** 64;
                 const str = "failed to reserve space in ringbuf";
                 @memcpy(buf[0..str.len], str);
-                r.ptr.* = .{ .meta = meta, .tp = .clone3_enter, .err = bridge.CollectorError.RingbufReserve, .msg = buf };
+                r.ptr.* = .{ .meta = meta, .tp = tp_kind, .err = bridge.CollectorError.RingbufReserve, .msg = buf };
                 r.submit();
+                return;
             }
         }
+        clone_seen_map.update(.any, meta.pid, true);
     }
 }