5c remove tracepoint ID adjacency dependency from aggregate pairing

Generated exit handlers now pass the explicit enter trace ID
(SYS_ENTER_X) to ior_on_syscall_exit instead of relying on the
implicit enter_id == exit_id + 1 arithmetic invariant. filter.c
compares directly against the passed enter ID.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

1 files changed, 20 insertions, 3 deletions

diff --git a/internal/generate/bpfhandler.go b/internal/generate/bpfhandler.go
index ed672c8..95a14b0 100644
--- a/internal/generate/bpfhandler.go
+++ b/internal/generate/bpfhandler.go
@@ -31,10 +31,27 @@ func generateBPFHandler(tp GeneratedTracepoint) string {
 	eventTypeConst := eventTypeConstant(tp.Classification.Kind, isEnter)
 	extra := generateExtra(tp, isEnter)
 
-	return renderHandler(f.Name, ctxStruct, eventStruct, comment, eventTypeConst, extra, isEnter)
+	// Derive the explicit enter trace ID constant for exit handlers so the
+	// generated ior_on_syscall_exit call does not rely on numeric adjacency
+	// between kernel-assigned enter/exit IDs.
+	enterName := enterConstForHandler(f.Name, isEnter)
+
+	return renderHandler(f.Name, ctxStruct, eventStruct, comment, eventTypeConst, extra, isEnter, enterName)
+}
+
+// enterConstForHandler returns the C #define constant name for the
+// corresponding enter tracepoint. For enter handlers it returns
+// strings.ToUpper(name) directly; for exit handlers it replaces "EXIT"
+// with "ENTER" so the generated code passes the explicit enter ID.
+func enterConstForHandler(name string, isEnter bool) string {
+	upper := strings.ToUpper(name)
+	if isEnter {
+		return upper
+	}
+	return strings.Replace(upper, "SYS_EXIT_", "SYS_ENTER_", 1)
 }
 
-func renderHandler(name, ctxStruct, eventStruct, comment, eventTypeConst, extra string, isEnter bool) string {
+func renderHandler(name, ctxStruct, eventStruct, comment, eventTypeConst, extra string, isEnter bool, enterName string) string {
 	var b strings.Builder
 	fmt.Fprintf(&b, "/// %s is a struct %s\n", name, comment)
 	fmt.Fprintf(&b, "SEC(\"tracepoint/syscalls/%s\")\n", name)
@@ -47,7 +64,7 @@ func renderHandler(name, ctxStruct, eventStruct, comment, eventTypeConst, extra
 		fmt.Fprintf(&b, "    if (!ior_on_syscall_enter(tid, %s))\n", strings.ToUpper(name))
 		b.WriteString("        return 0;\n")
 	} else {
-		fmt.Fprintf(&b, "    if (!ior_on_syscall_exit(tid, %s, ctx->ret))\n", strings.ToUpper(name))
+		fmt.Fprintf(&b, "    if (!ior_on_syscall_exit(tid, %s, ctx->ret))\n", enterName)
 		b.WriteString("        return 0;\n")
 	}
 	b.WriteString("\n")