m7 classify time and posix timer syscalls

10 files changed, 126 insertions, 17 deletions

diff --git a/internal/c/generated_tracepoints.c b/internal/c/generated_tracepoints.c
index 8939cd7..06e486c 100644
--- a/internal/c/generated_tracepoints.c
+++ b/internal/c/generated_tracepoints.c
@@ -14058,7 +14058,7 @@ int handle_sys_exit_setitimer(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_timer_create is a struct null_event (kind=null)
+/// sys_enter_timer_create is a struct null_event (kind=timer-obj)
 SEC("tracepoint/syscalls/sys_enter_timer_create")
 int handle_sys_enter_timer_create(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -14108,7 +14108,7 @@ int handle_sys_exit_timer_create(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_timer_gettime is a struct null_event (kind=null)
+/// sys_enter_timer_gettime is a struct null_event (kind=timer-obj)
 SEC("tracepoint/syscalls/sys_enter_timer_gettime")
 int handle_sys_enter_timer_gettime(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -14158,7 +14158,7 @@ int handle_sys_exit_timer_gettime(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_timer_getoverrun is a struct null_event (kind=null)
+/// sys_enter_timer_getoverrun is a struct null_event (kind=timer-obj)
 SEC("tracepoint/syscalls/sys_enter_timer_getoverrun")
 int handle_sys_enter_timer_getoverrun(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -14208,7 +14208,7 @@ int handle_sys_exit_timer_getoverrun(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_timer_settime is a struct null_event (kind=null)
+/// sys_enter_timer_settime is a struct null_event (kind=timer-obj)
 SEC("tracepoint/syscalls/sys_enter_timer_settime")
 int handle_sys_enter_timer_settime(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -14258,7 +14258,7 @@ int handle_sys_exit_timer_settime(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_timer_delete is a struct null_event (kind=null)
+/// sys_enter_timer_delete is a struct null_event (kind=timer-obj)
 SEC("tracepoint/syscalls/sys_enter_timer_delete")
 int handle_sys_enter_timer_delete(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
diff --git a/internal/c/generated_tracepoints_result.txt b/internal/c/generated_tracepoints_result.txt
index e04bdbd..96caaaa 100644
--- a/internal/c/generated_tracepoints_result.txt
+++ b/internal/c/generated_tracepoints_result.txt
@@ -335,11 +335,11 @@ sys_enter_syslog is a struct null_event (kind=null)
 sys_enter_tee is a struct null_event (kind=null)
 sys_enter_tgkill is a struct null_event (kind=null)
 sys_enter_time is a struct null_event (kind=null)
-sys_enter_timer_create is a struct null_event (kind=null)
-sys_enter_timer_delete is a struct null_event (kind=null)
-sys_enter_timer_getoverrun is a struct null_event (kind=null)
-sys_enter_timer_gettime is a struct null_event (kind=null)
-sys_enter_timer_settime is a struct null_event (kind=null)
+sys_enter_timer_create is a struct null_event (kind=timer-obj)
+sys_enter_timer_delete is a struct null_event (kind=timer-obj)
+sys_enter_timer_getoverrun is a struct null_event (kind=timer-obj)
+sys_enter_timer_gettime is a struct null_event (kind=timer-obj)
+sys_enter_timer_settime is a struct null_event (kind=timer-obj)
 sys_enter_timerfd_create is a struct eventfd_event (kind=eventfd)
 sys_enter_timerfd_gettime is a struct null_event (kind=null)
 sys_enter_timerfd_settime is a struct null_event (kind=null)
diff --git a/internal/flags/sampling.go b/internal/flags/sampling.go
index 2f63ada..0f0af2a 100644
--- a/internal/flags/sampling.go
+++ b/internal/flags/sampling.go
@@ -14,6 +14,7 @@ var defaultAggregateOnlySyscalls = []string{
 	"futex_wake",
 	"futex_requeue",
 	"futex_waitv",
+	"clock_gettime",
 }
 
 func cloneFamilySamplingRates(in map[types.SyscallFamily]uint32) map[types.SyscallFamily]uint32 {
diff --git a/internal/flags/sampling_test.go b/internal/flags/sampling_test.go
index 82a43ec..c43c2fc 100644
--- a/internal/flags/sampling_test.go
+++ b/internal/flags/sampling_test.go
@@ -82,7 +82,7 @@ func TestDefaultSamplingRatesIncludeFutexAggregateOnly(t *testing.T) {
 	if err != nil {
 		t.Fatalf("parse returned error: %v", err)
 	}
-	for _, syscall := range []string{"futex", "futex_wait", "futex_wake", "futex_requeue", "futex_waitv"} {
+	for _, syscall := range []string{"futex", "futex_wait", "futex_wake", "futex_requeue", "futex_waitv", "clock_gettime"} {
 		rate, ok := cfg.SyscallSamplingRates[syscall]
 		if !ok {
 			t.Fatalf("expected default sampling entry for %s", syscall)
diff --git a/internal/generate/classify.go b/internal/generate/classify.go
index 8ad1d58..e42d4a0 100644
--- a/internal/generate/classify.go
+++ b/internal/generate/classify.go
@@ -39,6 +39,7 @@ const (
 	KindBpf
 	KindFutex
 	KindPrctl
+	KindTimerObj
 )
 
 func (k TracepointKind) MetadataName() string {
@@ -109,6 +110,8 @@ func (k TracepointKind) MetadataName() string {
 		return "futex"
 	case KindPrctl:
 		return "prctl"
+	case KindTimerObj:
+		return "timer-obj"
 	default:
 		return "none"
 	}
@@ -336,6 +339,40 @@ func classifyNameOnly(name string) (ClassificationResult, bool) {
 		return ClassificationResult{Kind: KindSleep}, true
 	case "sys_enter_clock_nanosleep":
 		return ClassificationResult{Kind: KindSleep}, true
+	case "sys_enter_clock_gettime":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_clock_settime":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_clock_getres":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_clock_adjtime":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_gettimeofday":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_settimeofday":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_time":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_times":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_adjtimex":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_alarm":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_getitimer":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_setitimer":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_timer_create":
+		return ClassificationResult{Kind: KindTimerObj}, true
+	case "sys_enter_timer_settime":
+		return ClassificationResult{Kind: KindTimerObj}, true
+	case "sys_enter_timer_gettime":
+		return ClassificationResult{Kind: KindTimerObj}, true
+	case "sys_enter_timer_getoverrun":
+		return ClassificationResult{Kind: KindTimerObj}, true
+	case "sys_enter_timer_delete":
+		return ClassificationResult{Kind: KindTimerObj}, true
 	case "sys_enter_keyctl":
 		return ClassificationResult{Kind: KindKeyctl}, true
 	case "sys_enter_add_key":
diff --git a/internal/generate/classify_test.go b/internal/generate/classify_test.go
index dbc14a0..ae77fb0 100644
--- a/internal/generate/classify_test.go
+++ b/internal/generate/classify_test.go
@@ -834,6 +834,59 @@ func TestClassifyK7NameOnlyKinds(t *testing.T) {
 	}
 }
 
+func TestClassifyM7NameOnlyKinds(t *testing.T) {
+	nullKinds := []string{
+		"sys_enter_clock_gettime",
+		"sys_enter_clock_settime",
+		"sys_enter_clock_getres",
+		"sys_enter_clock_adjtime",
+		"sys_enter_gettimeofday",
+		"sys_enter_settimeofday",
+		"sys_enter_time",
+		"sys_enter_times",
+		"sys_enter_adjtimex",
+		"sys_enter_alarm",
+		"sys_enter_getitimer",
+		"sys_enter_setitimer",
+	}
+	for _, name := range nullKinds {
+		t.Run(name, func(t *testing.T) {
+			r := ClassifyFormat(&Format{
+				Name: name,
+				ExternalFields: []Field{
+					{Type: "long", Name: "__syscall_nr"},
+					{Type: "long", Name: "arg0"},
+				},
+			})
+			if r.Kind != KindNull {
+				t.Fatalf("%s: got kind %d, want KindNull", name, r.Kind)
+			}
+		})
+	}
+
+	timerObjKinds := []string{
+		"sys_enter_timer_create",
+		"sys_enter_timer_settime",
+		"sys_enter_timer_gettime",
+		"sys_enter_timer_getoverrun",
+		"sys_enter_timer_delete",
+	}
+	for _, name := range timerObjKinds {
+		t.Run(name, func(t *testing.T) {
+			r := ClassifyFormat(&Format{
+				Name: name,
+				ExternalFields: []Field{
+					{Type: "long", Name: "__syscall_nr"},
+					{Type: "long", Name: "arg0"},
+				},
+			})
+			if r.Kind != KindTimerObj {
+				t.Fatalf("%s: got kind %d, want KindTimerObj", name, r.Kind)
+			}
+		})
+	}
+}
+
 func TestClassify67NameOnlyKinds(t *testing.T) {
 	tests := []struct {
 		name string
diff --git a/internal/generate/codegen_test.go b/internal/generate/codegen_test.go
index eb3d82a..f469b6c 100644
--- a/internal/generate/codegen_test.go
+++ b/internal/generate/codegen_test.go
@@ -636,6 +636,7 @@ func TestGenerateAllEventTypes(t *testing.T) {
 		{KindBpf, "ENTER_NULL_EVENT", "EXIT_NULL_EVENT"},
 		{KindFutex, "ENTER_NULL_EVENT", "EXIT_NULL_EVENT"},
 		{KindPrctl, "ENTER_NULL_EVENT", "EXIT_NULL_EVENT"},
+		{KindTimerObj, "ENTER_NULL_EVENT", "EXIT_NULL_EVENT"},
 	}
 
 	for _, tt := range tests {
@@ -686,6 +687,7 @@ func TestEventStructNames(t *testing.T) {
 		{KindBpf, "null_event"},
 		{KindFutex, "null_event"},
 		{KindPrctl, "null_event"},
+		{KindTimerObj, "null_event"},
 	}
 
 	for _, tt := range tests {
@@ -704,7 +706,7 @@ func TestEnterReject(t *testing.T) {
 		t.Error("KindNone should be enter-rejected")
 	}
 
-	accepted := []TracepointKind{KindFd, KindOpen, KindMqOpen, KindExec, KindPathname, KindName, KindFcntl, KindNull, KindDup3, KindOpenByHandleAt, KindSocket, KindSocketpair, KindAccept, KindPipe, KindEventfd, KindPidfd, KindEpollCtl, KindTwoFd, KindPoll, KindMem, KindSleep, KindKeyctl, KindPtrace, KindPerfOpen, KindSeccomp, KindModule, KindSysVId, KindSysVOp, KindProc, KindBpf, KindFutex, KindPrctl}
+	accepted := []TracepointKind{KindFd, KindOpen, KindMqOpen, KindExec, KindPathname, KindName, KindFcntl, KindNull, KindDup3, KindOpenByHandleAt, KindSocket, KindSocketpair, KindAccept, KindPipe, KindEventfd, KindPidfd, KindEpollCtl, KindTwoFd, KindPoll, KindMem, KindSleep, KindKeyctl, KindPtrace, KindPerfOpen, KindSeccomp, KindModule, KindSysVId, KindSysVOp, KindProc, KindBpf, KindFutex, KindPrctl, KindTimerObj}
 	for _, k := range accepted {
 		if isEnterRejected(k) {
 			t.Errorf("kind %d should NOT be enter-rejected", k)
diff --git a/internal/generate/kindregistry.go b/internal/generate/kindregistry.go
index 21cdd35..fc5fc52 100644
--- a/internal/generate/kindregistry.go
+++ b/internal/generate/kindregistry.go
@@ -49,6 +49,7 @@ var kindRegistry = map[TracepointKind]kindMeta{
 	KindBpf:            {structName: "null_event", enterAccepted: true},
 	KindFutex:          {structName: "null_event", enterAccepted: true},
 	KindPrctl:          {structName: "null_event", enterAccepted: true},
+	KindTimerObj:       {structName: "null_event", enterAccepted: true},
 	// KindNone is intentionally absent: it represents "unclassified" and is
 	// never enter-accepted. lookupKind returns the zero kindMeta (enterAccepted=false)
 	// for any unregistered kind, so KindNone is implicitly rejected.
diff --git a/internal/tracepoints/dimension_selector_test.go b/internal/tracepoints/dimension_selector_test.go
index 4eb555b..01d48e7 100644
--- a/internal/tracepoints/dimension_selector_test.go
+++ b/internal/tracepoints/dimension_selector_test.go
@@ -201,6 +201,21 @@ func TestParseSelectorWithDimensionsPrctlKindOnly(t *testing.T) {
 	}
 }
 
+func TestParseSelectorWithDimensionsTimerObjKindOnly(t *testing.T) {
+	sel, err := ParseSelectorWithDimensions("", "", DimensionSelectorConfig{
+		TraceKinds: "timer-obj",
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !sel.ShouldAttach("sys_enter_timer_settime") {
+		t.Fatal("expected timer_settime to be attached for timer-obj kind")
+	}
+	if sel.ShouldAttach("sys_enter_openat") {
+		t.Fatal("expected openat to be excluded when only timer-obj kind is enabled")
+	}
+}
+
 func TestParseSelectorWithDimensionsSyscallOnly(t *testing.T) {
 	sel, err := ParseSelectorWithDimensions("", "", DimensionSelectorConfig{
 		TraceSyscalls: "openat",
diff --git a/internal/tracepoints/generated_tracepoints.go b/internal/tracepoints/generated_tracepoints.go
index bd641dd..f9b756e 100644
--- a/internal/tracepoints/generated_tracepoints.go
+++ b/internal/tracepoints/generated_tracepoints.go
@@ -1446,11 +1446,11 @@ var syscallKinds = map[string]string{
 	"tee":                     "null",
 	"tgkill":                  "null",
 	"time":                    "null",
-	"timer_create":            "null",
-	"timer_delete":            "null",
-	"timer_getoverrun":        "null",
-	"timer_gettime":           "null",
-	"timer_settime":           "null",
+	"timer_create":            "timer-obj",
+	"timer_delete":            "timer-obj",
+	"timer_getoverrun":        "timer-obj",
+	"timer_gettime":           "timer-obj",
+	"timer_settime":           "timer-obj",
 	"timerfd_create":          "eventfd",
 	"timerfd_gettime":         "null",
 	"timerfd_settime":         "null",