l7 classify numa and process memory syscalls

7 files changed, 96 insertions, 10 deletions

diff --git a/internal/c/generated_tracepoints.c b/internal/c/generated_tracepoints.c
index 8e66d2a..8dbacc2 100644
--- a/internal/c/generated_tracepoints.c
+++ b/internal/c/generated_tracepoints.c
@@ -11989,7 +11989,7 @@ int handle_sys_exit_madvise(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_process_madvise is a struct null_event (kind=null)
+/// sys_enter_process_madvise is a struct fd_event (kind=fd)
 SEC("tracepoint/syscalls/sys_enter_process_madvise")
 int handle_sys_enter_process_madvise(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -11999,15 +11999,16 @@ int handle_sys_enter_process_madvise(struct syscall_trace_enter *ctx) {
     if (!ior_on_syscall_enter(tid, SYS_ENTER_PROCESS_MADVISE))
         return 0;
 
-    struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
+    struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = ENTER_NULL_EVENT;
+    ev->event_type = ENTER_FD_EVENT;
     ev->trace_id = SYS_ENTER_PROCESS_MADVISE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_boot_ns();
+    ev->fd = (__s32)ctx->args[0];
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
@@ -13085,7 +13086,7 @@ int handle_sys_exit_fadvise64(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_process_mrelease is a struct null_event (kind=null)
+/// sys_enter_process_mrelease is a struct fd_event (kind=fd)
 SEC("tracepoint/syscalls/sys_enter_process_mrelease")
 int handle_sys_enter_process_mrelease(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -13095,15 +13096,16 @@ int handle_sys_enter_process_mrelease(struct syscall_trace_enter *ctx) {
     if (!ior_on_syscall_enter(tid, SYS_ENTER_PROCESS_MRELEASE))
         return 0;
 
-    struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
+    struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = ENTER_NULL_EVENT;
+    ev->event_type = ENTER_FD_EVENT;
     ev->trace_id = SYS_ENTER_PROCESS_MRELEASE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_boot_ns();
+    ev->fd = (__s32)ctx->args[0];
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
diff --git a/internal/c/generated_tracepoints_result.txt b/internal/c/generated_tracepoints_result.txt
index 4a1f137..2da645d 100644
--- a/internal/c/generated_tracepoints_result.txt
+++ b/internal/c/generated_tracepoints_result.txt
@@ -223,8 +223,8 @@ sys_enter_pread64 is a struct fd_event (kind=fd)
 sys_enter_preadv is a struct fd_event (kind=fd)
 sys_enter_preadv2 is a struct fd_event (kind=fd)
 sys_enter_prlimit64 is a struct null_event (kind=null)
-sys_enter_process_madvise is a struct null_event (kind=null)
-sys_enter_process_mrelease is a struct null_event (kind=null)
+sys_enter_process_madvise is a struct fd_event (kind=fd)
+sys_enter_process_mrelease is a struct fd_event (kind=fd)
 sys_enter_process_vm_readv is a struct null_event (kind=null)
 sys_enter_process_vm_writev is a struct null_event (kind=null)
 sys_enter_pselect6 is a struct poll_event (kind=poll)
diff --git a/internal/generate/classify.go b/internal/generate/classify.go
index 191b41e..3fa8d23 100644
--- a/internal/generate/classify.go
+++ b/internal/generate/classify.go
@@ -376,6 +376,30 @@ func classifyNameOnly(name string) (ClassificationResult, bool) {
 		return ClassificationResult{Kind: KindSysVOp}, true
 	case "sys_enter_shmctl":
 		return ClassificationResult{Kind: KindSysVOp}, true
+	case "sys_enter_pkey_alloc":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_pkey_free":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_mbind":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_set_mempolicy":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_get_mempolicy":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_set_mempolicy_home_node":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_migrate_pages":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_move_pages":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_mlockall":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_munlockall":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_process_madvise":
+		return ClassificationResult{Kind: KindFd}, true
+	case "sys_enter_process_mrelease":
+		return ClassificationResult{Kind: KindFd}, true
 	case "sys_enter_clone":
 		return ClassificationResult{Kind: KindProc}, true
 	case "sys_enter_clone3":
diff --git a/internal/generate/classify_test.go b/internal/generate/classify_test.go
index bbf33d6..07445ec 100644
--- a/internal/generate/classify_test.go
+++ b/internal/generate/classify_test.go
@@ -745,6 +745,41 @@ func TestClassifyH7NameOnlyKinds(t *testing.T) {
 	}
 }
 
+func TestClassifyL7NameOnlyKinds(t *testing.T) {
+	tests := []struct {
+		name string
+		want TracepointKind
+	}{
+		{"sys_enter_pkey_alloc", KindNull},
+		{"sys_enter_pkey_free", KindNull},
+		{"sys_enter_mbind", KindNull},
+		{"sys_enter_set_mempolicy", KindNull},
+		{"sys_enter_get_mempolicy", KindNull},
+		{"sys_enter_set_mempolicy_home_node", KindNull},
+		{"sys_enter_migrate_pages", KindNull},
+		{"sys_enter_move_pages", KindNull},
+		{"sys_enter_mlockall", KindNull},
+		{"sys_enter_munlockall", KindNull},
+		{"sys_enter_process_madvise", KindFd},
+		{"sys_enter_process_mrelease", KindFd},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := ClassifyFormat(&Format{
+				Name: tt.name,
+				ExternalFields: []Field{
+					{Type: "long", Name: "__syscall_nr"},
+					{Type: "long", Name: "arg0"},
+				},
+			})
+			if r.Kind != tt.want {
+				t.Fatalf("%s: got kind %d, want %d", tt.name, r.Kind, tt.want)
+			}
+		})
+	}
+}
+
 func TestClassify67NameOnlyKinds(t *testing.T) {
 	tests := []struct {
 		name string
diff --git a/internal/generate/codegen_test.go b/internal/generate/codegen_test.go
index 7614ab1..220d77e 100644
--- a/internal/generate/codegen_test.go
+++ b/internal/generate/codegen_test.go
@@ -33,6 +33,16 @@ func TestGeneratePidfdGetfdHandlerUsesPidfdArgument(t *testing.T) {
 	requireContains(t, output, "ev->fd = (__s32)ctx->args[0];")
 }
 
+func TestGenerateProcessMadviseHandlerUsesFirstArgumentAsFd(t *testing.T) {
+	output := GenerateTracepointsC(mustParseAll(t, syntheticPair("process_madvise")))
+
+	requireContains(t, output, `SEC("tracepoint/syscalls/sys_enter_process_madvise")`)
+	requireContains(t, output, "struct fd_event *ev")
+	requireContains(t, output, "ev->event_type = ENTER_FD_EVENT;")
+	requireContains(t, output, "ev->trace_id = SYS_ENTER_PROCESS_MADVISE;")
+	requireContains(t, output, "ev->fd = (__s32)ctx->args[0];")
+}
+
 func TestGenerateOpenHandler(t *testing.T) {
 	output := generateFromPair(t, FormatOpenat, FormatExitOpenat)
 
diff --git a/internal/tracepoints/dimension_selector_test.go b/internal/tracepoints/dimension_selector_test.go
index a8b432a..eab18dc 100644
--- a/internal/tracepoints/dimension_selector_test.go
+++ b/internal/tracepoints/dimension_selector_test.go
@@ -63,6 +63,21 @@ func TestParseSelectorWithDimensionsPidfdKindOnly(t *testing.T) {
 	}
 }
 
+func TestParseSelectorWithDimensionsFdKindIncludesProcessMadvise(t *testing.T) {
+	sel, err := ParseSelectorWithDimensions("", "", DimensionSelectorConfig{
+		TraceKinds: "fd",
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !sel.ShouldAttach("sys_enter_process_madvise") {
+		t.Fatal("expected process_madvise to be attached for fd kind")
+	}
+	if sel.ShouldAttach("sys_enter_nanosleep") {
+		t.Fatal("expected nanosleep to be excluded when only fd kind is enabled")
+	}
+}
+
 func TestParseSelectorWithDimensionsEventfdKindIncludesEpollCreate(t *testing.T) {
 	sel, err := ParseSelectorWithDimensions("", "", DimensionSelectorConfig{
 		TraceKinds: "eventfd",
diff --git a/internal/tracepoints/generated_tracepoints.go b/internal/tracepoints/generated_tracepoints.go
index 5b98b95..f27d185 100644
--- a/internal/tracepoints/generated_tracepoints.go
+++ b/internal/tracepoints/generated_tracepoints.go
@@ -1334,8 +1334,8 @@ var syscallKinds = map[string]string{
 	"preadv":                  "fd",
 	"preadv2":                 "fd",
 	"prlimit64":               "null",
-	"process_madvise":         "null",
-	"process_mrelease":        "null",
+	"process_madvise":         "fd",
+	"process_mrelease":        "fd",
 	"process_vm_readv":        "null",
 	"process_vm_writev":       "null",
 	"pselect6":                "poll",