m7 classify time and posix timer syscalls

4 files changed, 94 insertions, 1 deletions

diff --git a/internal/generate/classify.go b/internal/generate/classify.go
index 8ad1d58..e42d4a0 100644
--- a/internal/generate/classify.go
+++ b/internal/generate/classify.go
@@ -39,6 +39,7 @@ const (
 	KindBpf
 	KindFutex
 	KindPrctl
+	KindTimerObj
 )
 
 func (k TracepointKind) MetadataName() string {
@@ -109,6 +110,8 @@ func (k TracepointKind) MetadataName() string {
 		return "futex"
 	case KindPrctl:
 		return "prctl"
+	case KindTimerObj:
+		return "timer-obj"
 	default:
 		return "none"
 	}
@@ -336,6 +339,40 @@ func classifyNameOnly(name string) (ClassificationResult, bool) {
 		return ClassificationResult{Kind: KindSleep}, true
 	case "sys_enter_clock_nanosleep":
 		return ClassificationResult{Kind: KindSleep}, true
+	case "sys_enter_clock_gettime":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_clock_settime":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_clock_getres":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_clock_adjtime":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_gettimeofday":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_settimeofday":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_time":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_times":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_adjtimex":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_alarm":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_getitimer":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_setitimer":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_timer_create":
+		return ClassificationResult{Kind: KindTimerObj}, true
+	case "sys_enter_timer_settime":
+		return ClassificationResult{Kind: KindTimerObj}, true
+	case "sys_enter_timer_gettime":
+		return ClassificationResult{Kind: KindTimerObj}, true
+	case "sys_enter_timer_getoverrun":
+		return ClassificationResult{Kind: KindTimerObj}, true
+	case "sys_enter_timer_delete":
+		return ClassificationResult{Kind: KindTimerObj}, true
 	case "sys_enter_keyctl":
 		return ClassificationResult{Kind: KindKeyctl}, true
 	case "sys_enter_add_key":
diff --git a/internal/generate/classify_test.go b/internal/generate/classify_test.go
index dbc14a0..ae77fb0 100644
--- a/internal/generate/classify_test.go
+++ b/internal/generate/classify_test.go
@@ -834,6 +834,59 @@ func TestClassifyK7NameOnlyKinds(t *testing.T) {
 	}
 }
 
+func TestClassifyM7NameOnlyKinds(t *testing.T) {
+	nullKinds := []string{
+		"sys_enter_clock_gettime",
+		"sys_enter_clock_settime",
+		"sys_enter_clock_getres",
+		"sys_enter_clock_adjtime",
+		"sys_enter_gettimeofday",
+		"sys_enter_settimeofday",
+		"sys_enter_time",
+		"sys_enter_times",
+		"sys_enter_adjtimex",
+		"sys_enter_alarm",
+		"sys_enter_getitimer",
+		"sys_enter_setitimer",
+	}
+	for _, name := range nullKinds {
+		t.Run(name, func(t *testing.T) {
+			r := ClassifyFormat(&Format{
+				Name: name,
+				ExternalFields: []Field{
+					{Type: "long", Name: "__syscall_nr"},
+					{Type: "long", Name: "arg0"},
+				},
+			})
+			if r.Kind != KindNull {
+				t.Fatalf("%s: got kind %d, want KindNull", name, r.Kind)
+			}
+		})
+	}
+
+	timerObjKinds := []string{
+		"sys_enter_timer_create",
+		"sys_enter_timer_settime",
+		"sys_enter_timer_gettime",
+		"sys_enter_timer_getoverrun",
+		"sys_enter_timer_delete",
+	}
+	for _, name := range timerObjKinds {
+		t.Run(name, func(t *testing.T) {
+			r := ClassifyFormat(&Format{
+				Name: name,
+				ExternalFields: []Field{
+					{Type: "long", Name: "__syscall_nr"},
+					{Type: "long", Name: "arg0"},
+				},
+			})
+			if r.Kind != KindTimerObj {
+				t.Fatalf("%s: got kind %d, want KindTimerObj", name, r.Kind)
+			}
+		})
+	}
+}
+
 func TestClassify67NameOnlyKinds(t *testing.T) {
 	tests := []struct {
 		name string
diff --git a/internal/generate/codegen_test.go b/internal/generate/codegen_test.go
index eb3d82a..f469b6c 100644
--- a/internal/generate/codegen_test.go
+++ b/internal/generate/codegen_test.go
@@ -636,6 +636,7 @@ func TestGenerateAllEventTypes(t *testing.T) {
 		{KindBpf, "ENTER_NULL_EVENT", "EXIT_NULL_EVENT"},
 		{KindFutex, "ENTER_NULL_EVENT", "EXIT_NULL_EVENT"},
 		{KindPrctl, "ENTER_NULL_EVENT", "EXIT_NULL_EVENT"},
+		{KindTimerObj, "ENTER_NULL_EVENT", "EXIT_NULL_EVENT"},
 	}
 
 	for _, tt := range tests {
@@ -686,6 +687,7 @@ func TestEventStructNames(t *testing.T) {
 		{KindBpf, "null_event"},
 		{KindFutex, "null_event"},
 		{KindPrctl, "null_event"},
+		{KindTimerObj, "null_event"},
 	}
 
 	for _, tt := range tests {
@@ -704,7 +706,7 @@ func TestEnterReject(t *testing.T) {
 		t.Error("KindNone should be enter-rejected")
 	}
 
-	accepted := []TracepointKind{KindFd, KindOpen, KindMqOpen, KindExec, KindPathname, KindName, KindFcntl, KindNull, KindDup3, KindOpenByHandleAt, KindSocket, KindSocketpair, KindAccept, KindPipe, KindEventfd, KindPidfd, KindEpollCtl, KindTwoFd, KindPoll, KindMem, KindSleep, KindKeyctl, KindPtrace, KindPerfOpen, KindSeccomp, KindModule, KindSysVId, KindSysVOp, KindProc, KindBpf, KindFutex, KindPrctl}
+	accepted := []TracepointKind{KindFd, KindOpen, KindMqOpen, KindExec, KindPathname, KindName, KindFcntl, KindNull, KindDup3, KindOpenByHandleAt, KindSocket, KindSocketpair, KindAccept, KindPipe, KindEventfd, KindPidfd, KindEpollCtl, KindTwoFd, KindPoll, KindMem, KindSleep, KindKeyctl, KindPtrace, KindPerfOpen, KindSeccomp, KindModule, KindSysVId, KindSysVOp, KindProc, KindBpf, KindFutex, KindPrctl, KindTimerObj}
 	for _, k := range accepted {
 		if isEnterRejected(k) {
 			t.Errorf("kind %d should NOT be enter-rejected", k)
diff --git a/internal/generate/kindregistry.go b/internal/generate/kindregistry.go
index 21cdd35..fc5fc52 100644
--- a/internal/generate/kindregistry.go
+++ b/internal/generate/kindregistry.go
@@ -49,6 +49,7 @@ var kindRegistry = map[TracepointKind]kindMeta{
 	KindBpf:            {structName: "null_event", enterAccepted: true},
 	KindFutex:          {structName: "null_event", enterAccepted: true},
 	KindPrctl:          {structName: "null_event", enterAccepted: true},
+	KindTimerObj:       {structName: "null_event", enterAccepted: true},
 	// KindNone is intentionally absent: it represents "unclassified" and is
 	// never enter-accepted. lookupKind returns the zero kindMeta (enterAccepted=false)
 	// for any unregistered kind, so KindNone is implicitly rejected.