2c fix epoll_create and pidfd_open flags in BPF codegen

epoll_create(size) was recording size (args[0]) as flags — hardcode to
0 since the syscall has no flags argument.  pidfd_open(pid, flags) was
recording pid (args[0]) as flags — use args[1] instead.

Add test fixtures and codegen tests that verify the correct argument
indexes and reject the old wrong ones.  Regenerate generated_tracepoints.c.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

1 files changed, 35 insertions, 0 deletions

diff --git a/internal/generate/codegen_test.go b/internal/generate/codegen_test.go
index 276a832..d74939b 100644
--- a/internal/generate/codegen_test.go
+++ b/internal/generate/codegen_test.go
@@ -379,6 +379,41 @@ func TestGenerateEventfdHandler(t *testing.T) {
 	requireContains(t, output, "ev->ret = ctx->ret;")
 }
 
+func TestGenerateEpollCreateHandlerUsesZeroFlags(t *testing.T) {
+	output := generateFromPair(t, FormatEpollCreate, FormatExitEpollCreate)
+
+	requireContains(t, output, "struct eventfd_event *ev")
+	requireContains(t, output, "ev->event_type = ENTER_EVENTFD_EVENT;")
+	requireContains(t, output, "ev->trace_id = SYS_ENTER_EPOLL_CREATE;")
+	// epoll_create(size) has no flags argument; the generated code must
+	// hardcode flags to 0 instead of reading ctx->args[0] (which is size).
+	requireContains(t, output, "__s32 flags = 0;")
+	if strings.Contains(output, "flags = (__s32)ctx->args[0]") {
+		t.Error("epoll_create handler must not use ctx->args[0] (size) as flags")
+	}
+	requireContains(t, output, "ev->ret = -1;")
+	requireContains(t, output, "SEC(\"tracepoint/syscalls/sys_exit_epoll_create\")")
+	requireContains(t, output, "ev->event_type = EXIT_EVENTFD_EVENT;")
+	requireContains(t, output, "ev->ret = ctx->ret;")
+}
+
+func TestGeneratePidfdOpenHandlerUsesArg1Flags(t *testing.T) {
+	output := generateFromPair(t, FormatPidfdOpen, FormatExitPidfdOpen)
+
+	requireContains(t, output, "struct eventfd_event *ev")
+	requireContains(t, output, "ev->event_type = ENTER_EVENTFD_EVENT;")
+	requireContains(t, output, "ev->trace_id = SYS_ENTER_PIDFD_OPEN;")
+	// pidfd_open(pid, flags): flags is at args[1], not args[0] (which is pid).
+	requireContains(t, output, "__s32 flags = (__s32)ctx->args[1];")
+	if strings.Contains(output, "flags = (__s32)ctx->args[0]") {
+		t.Error("pidfd_open handler must not use ctx->args[0] (pid) as flags")
+	}
+	requireContains(t, output, "ev->ret = -1;")
+	requireContains(t, output, "SEC(\"tracepoint/syscalls/sys_exit_pidfd_open\")")
+	requireContains(t, output, "ev->event_type = EXIT_EVENTFD_EVENT;")
+	requireContains(t, output, "ev->ret = ctx->ret;")
+}
+
 func TestGenerateEpollCtlHandler(t *testing.T) {
 	output := generateFromPair(t, FormatEpollCtl, FormatExitEpollCtl)