57 add bpf syscall kind classification

4 files changed, 24 insertions, 1 deletions

diff --git a/internal/generate/classify.go b/internal/generate/classify.go
index 3b2fb53..ff1bf72 100644
--- a/internal/generate/classify.go
+++ b/internal/generate/classify.go
@@ -36,6 +36,7 @@ const (
 	KindSysVId
 	KindSysVOp
 	KindProc
+	KindBpf
 )
 
 func (k TracepointKind) MetadataName() string {
@@ -100,6 +101,8 @@ func (k TracepointKind) MetadataName() string {
 		return "sysv-op"
 	case KindProc:
 		return "proc"
+	case KindBpf:
+		return "bpf"
 	default:
 		return "none"
 	}
@@ -373,6 +376,8 @@ func classifyNameOnly(name string) (ClassificationResult, bool) {
 		return ClassificationResult{Kind: KindProc}, true
 	case "sys_enter_vfork":
 		return ClassificationResult{Kind: KindProc}, true
+	case "sys_enter_bpf":
+		return ClassificationResult{Kind: KindBpf}, true
 	case "sys_enter_pidfd_send_signal":
 		return ClassificationResult{Kind: KindFd}, true
 	case "sys_enter_kexec_file_load":
diff --git a/internal/generate/classify_test.go b/internal/generate/classify_test.go
index d6d339b..8e77cd4 100644
--- a/internal/generate/classify_test.go
+++ b/internal/generate/classify_test.go
@@ -965,6 +965,21 @@ func TestClassify37NameOnlyKinds(t *testing.T) {
 	}
 }
 
+func TestClassify57NameOnlyKinds(t *testing.T) {
+	r := ClassifyFormat(&Format{
+		Name: "sys_enter_bpf",
+		ExternalFields: []Field{
+			{Type: "long", Name: "__syscall_nr"},
+			{Type: "int", Name: "cmd"},
+			{Type: "union bpf_attr *", Name: "attr"},
+			{Type: "unsigned int", Name: "size"},
+		},
+	})
+	if r.Kind != KindBpf {
+		t.Fatalf("sys_enter_bpf: got kind %d, want KindBpf", r.Kind)
+	}
+}
+
 func TestClassifyAcctPathname(t *testing.T) {
 	r := ClassifyFormat(&Format{
 		Name: "sys_enter_acct",
diff --git a/internal/generate/codegen_test.go b/internal/generate/codegen_test.go
index ffa65d9..d61e0c9 100644
--- a/internal/generate/codegen_test.go
+++ b/internal/generate/codegen_test.go
@@ -587,6 +587,7 @@ func TestGenerateAllEventTypes(t *testing.T) {
 		{KindSysVId, "ENTER_NULL_EVENT", "EXIT_NULL_EVENT"},
 		{KindSysVOp, "ENTER_NULL_EVENT", "EXIT_NULL_EVENT"},
 		{KindProc, "ENTER_NULL_EVENT", "EXIT_NULL_EVENT"},
+		{KindBpf, "ENTER_NULL_EVENT", "EXIT_NULL_EVENT"},
 	}
 
 	for _, tt := range tests {
@@ -634,6 +635,7 @@ func TestEventStructNames(t *testing.T) {
 		{KindSysVId, "null_event"},
 		{KindSysVOp, "null_event"},
 		{KindProc, "null_event"},
+		{KindBpf, "null_event"},
 	}
 
 	for _, tt := range tests {
@@ -652,7 +654,7 @@ func TestEnterReject(t *testing.T) {
 		t.Error("KindNone should be enter-rejected")
 	}
 
-	accepted := []TracepointKind{KindFd, KindOpen, KindMqOpen, KindExec, KindPathname, KindName, KindFcntl, KindNull, KindDup3, KindOpenByHandleAt, KindSocket, KindSocketpair, KindAccept, KindPipe, KindEventfd, KindPidfd, KindEpollCtl, KindTwoFd, KindPoll, KindMem, KindSleep, KindKeyctl, KindPtrace, KindPerfOpen, KindSeccomp, KindModule, KindSysVId, KindSysVOp, KindProc}
+	accepted := []TracepointKind{KindFd, KindOpen, KindMqOpen, KindExec, KindPathname, KindName, KindFcntl, KindNull, KindDup3, KindOpenByHandleAt, KindSocket, KindSocketpair, KindAccept, KindPipe, KindEventfd, KindPidfd, KindEpollCtl, KindTwoFd, KindPoll, KindMem, KindSleep, KindKeyctl, KindPtrace, KindPerfOpen, KindSeccomp, KindModule, KindSysVId, KindSysVOp, KindProc, KindBpf}
 	for _, k := range accepted {
 		if isEnterRejected(k) {
 			t.Errorf("kind %d should NOT be enter-rejected", k)
diff --git a/internal/generate/kindregistry.go b/internal/generate/kindregistry.go
index 8ef0f61..f78bf6f 100644
--- a/internal/generate/kindregistry.go
+++ b/internal/generate/kindregistry.go
@@ -46,6 +46,7 @@ var kindRegistry = map[TracepointKind]kindMeta{
 	KindSysVId:         {structName: "null_event", enterAccepted: true},
 	KindSysVOp:         {structName: "null_event", enterAccepted: true},
 	KindProc:           {structName: "null_event", enterAccepted: true},
+	KindBpf:            {structName: "null_event", enterAccepted: true},
 	// KindNone is intentionally absent: it represents "unclassified" and is
 	// never enter-accepted. lookupKind returns the zero kindMeta (enterAccepted=false)
 	// for any unregistered kind, so KindNone is implicitly rejected.