f7 wire eventfd kind for fd-from-air IPC syscalls

4 files changed, 63 insertions, 1 deletions

diff --git a/internal/generate/bpfhandler.go b/internal/generate/bpfhandler.go
index dce776a..ee56f17 100644
--- a/internal/generate/bpfhandler.go
+++ b/internal/generate/bpfhandler.go
@@ -262,6 +262,16 @@ func generateExtraEventfd(f *Format, isEnter bool) string {
 		switch f.Name {
 		case "sys_enter_eventfd2":
 			flagsExpr = "(__s32)ctx->args[1]"
+		case "sys_enter_memfd_create":
+			flagsExpr = "(__s32)ctx->args[1]"
+		case "sys_enter_memfd_secret":
+			flagsExpr = "(__s32)ctx->args[0]"
+		case "sys_enter_userfaultfd":
+			flagsExpr = "(__s32)ctx->args[0]"
+		case "sys_enter_signalfd4":
+			flagsExpr = "(__s32)ctx->args[3]"
+		case "sys_enter_timerfd_create":
+			flagsExpr = "(__s32)ctx->args[1]"
 		case "sys_enter_fsmount":
 			flagsExpr = "(__s32)ctx->args[1]"
 		case "sys_enter_fsopen":
diff --git a/internal/generate/classify.go b/internal/generate/classify.go
index 9e9df9c..ad9d694 100644
--- a/internal/generate/classify.go
+++ b/internal/generate/classify.go
@@ -179,6 +179,30 @@ func classifyNameOnly(name string) (ClassificationResult, bool) {
 		return ClassificationResult{Kind: KindEventfd}, true
 	case "sys_exit_eventfd2":
 		return ClassificationResult{Kind: KindEventfd}, true
+	case "sys_enter_memfd_create":
+		return ClassificationResult{Kind: KindEventfd}, true
+	case "sys_exit_memfd_create":
+		return ClassificationResult{Kind: KindEventfd}, true
+	case "sys_enter_memfd_secret":
+		return ClassificationResult{Kind: KindEventfd}, true
+	case "sys_exit_memfd_secret":
+		return ClassificationResult{Kind: KindEventfd}, true
+	case "sys_enter_userfaultfd":
+		return ClassificationResult{Kind: KindEventfd}, true
+	case "sys_exit_userfaultfd":
+		return ClassificationResult{Kind: KindEventfd}, true
+	case "sys_enter_signalfd":
+		return ClassificationResult{Kind: KindEventfd}, true
+	case "sys_exit_signalfd":
+		return ClassificationResult{Kind: KindEventfd}, true
+	case "sys_enter_signalfd4":
+		return ClassificationResult{Kind: KindEventfd}, true
+	case "sys_exit_signalfd4":
+		return ClassificationResult{Kind: KindEventfd}, true
+	case "sys_enter_timerfd_create":
+		return ClassificationResult{Kind: KindEventfd}, true
+	case "sys_exit_timerfd_create":
+		return ClassificationResult{Kind: KindEventfd}, true
 	case "sys_enter_bind":
 		return ClassificationResult{Kind: KindFd}, true
 	case "sys_enter_connect":
diff --git a/internal/generate/classify_test.go b/internal/generate/classify_test.go
index 5d6424b..79e6240 100644
--- a/internal/generate/classify_test.go
+++ b/internal/generate/classify_test.go
@@ -377,6 +377,34 @@ func TestClassifyExitEventfd2(t *testing.T) {
 	}
 }
 
+func TestClassifyEventfdSpecializedFdFromAirSyscalls(t *testing.T) {
+	tests := []string{
+		"sys_enter_memfd_create",
+		"sys_exit_memfd_create",
+		"sys_enter_memfd_secret",
+		"sys_exit_memfd_secret",
+		"sys_enter_userfaultfd",
+		"sys_exit_userfaultfd",
+		"sys_enter_signalfd",
+		"sys_exit_signalfd",
+		"sys_enter_signalfd4",
+		"sys_exit_signalfd4",
+		"sys_enter_timerfd_create",
+		"sys_exit_timerfd_create",
+	}
+	for _, name := range tests {
+		t.Run(name, func(t *testing.T) {
+			r, ok := classifyNameOnly(name)
+			if !ok {
+				t.Fatalf("classifyNameOnly(%q) did not match", name)
+			}
+			if r.Kind != KindEventfd {
+				t.Fatalf("classifyNameOnly(%q) kind = %v, want KindEventfd", name, r.Kind)
+			}
+		})
+	}
+}
+
 func TestClassifyEpollCtl(t *testing.T) {
 	r := classifyFromData(t, FormatEpollCtl)
 	if r.Kind != KindEpollCtl {
diff --git a/internal/generate/tracepointsgo.go b/internal/generate/tracepointsgo.go
index 9d92047..47c2e8f 100644
--- a/internal/generate/tracepointsgo.go
+++ b/internal/generate/tracepointsgo.go
@@ -10,7 +10,7 @@ import (
 )
 
 var secRe = regexp.MustCompile(`^SEC.*sys_((?:enter|exit)_[a-z_0-9]+)`)
-var kindLineRe = regexp.MustCompile(`^(sys_enter_[a-z0-9_]+)\s+is a struct\s+([a-z0-9_]+)\s*$`)
+var kindLineRe = regexp.MustCompile(`^(sys_enter_[a-z0-9_]+)\s+is a struct\s+([a-z0-9_]+)(?:\s+.*)?$`)
 
 // ExtractTracepoints reads generated C code and extracts tracepoint names from
 // SEC annotations, producing the generated_tracepoints.go content.