i7 classify memory P3 syscalls as mem kind

4 files changed, 88 insertions, 0 deletions

diff --git a/internal/generate/bpfhandler.go b/internal/generate/bpfhandler.go
index fb4a4e3..7dba8d7 100644
--- a/internal/generate/bpfhandler.go
+++ b/internal/generate/bpfhandler.go
@@ -332,6 +332,20 @@ func generateExtraMem(name string) string {
 		return "    ev->addr = (__u64)ctx->args[0];\n    ev->length = (__u64)ctx->args[1];\n    ev->length2 = 0;\n    ev->flags = 0;\n"
 	case "sys_enter_mremap":
 		return "    ev->addr = (__u64)ctx->args[0];\n    ev->length = (__u64)ctx->args[1];\n    ev->length2 = (__u64)ctx->args[2];\n    ev->flags = (__u64)ctx->args[3];\n"
+	case "sys_enter_mincore":
+		return "    ev->addr = (__u64)ctx->args[0];\n    ev->length = (__u64)ctx->args[1];\n    ev->length2 = 0;\n    ev->flags = 0;\n"
+	case "sys_enter_remap_file_pages":
+		return "    ev->addr = (__u64)ctx->args[0];\n    ev->length = (__u64)ctx->args[1];\n    ev->length2 = (__u64)ctx->args[3];\n    ev->flags = (__u64)ctx->args[4];\n"
+	case "sys_enter_mlock":
+		return "    ev->addr = (__u64)ctx->args[0];\n    ev->length = (__u64)ctx->args[1];\n    ev->length2 = 0;\n    ev->flags = 0;\n"
+	case "sys_enter_mlock2":
+		return "    ev->addr = (__u64)ctx->args[0];\n    ev->length = (__u64)ctx->args[1];\n    ev->length2 = 0;\n    ev->flags = (__u64)ctx->args[2];\n"
+	case "sys_enter_munlock":
+		return "    ev->addr = (__u64)ctx->args[0];\n    ev->length = (__u64)ctx->args[1];\n    ev->length2 = 0;\n    ev->flags = 0;\n"
+	case "sys_enter_mseal":
+		return "    ev->addr = (__u64)ctx->args[0];\n    ev->length = (__u64)ctx->args[1];\n    ev->length2 = 0;\n    ev->flags = (__u64)ctx->args[2];\n"
+	case "sys_enter_map_shadow_stack":
+		return "    ev->addr = (__u64)ctx->args[0];\n    ev->length = (__u64)ctx->args[1];\n    ev->length2 = 0;\n    ev->flags = (__u64)ctx->args[2];\n"
 	default:
 		return "    ev->addr = 0;\n    ev->length = 0;\n    ev->length2 = 0;\n    ev->flags = 0;\n"
 	}
diff --git a/internal/generate/classify.go b/internal/generate/classify.go
index 9896976..0bfac0c 100644
--- a/internal/generate/classify.go
+++ b/internal/generate/classify.go
@@ -286,6 +286,20 @@ func classifyNameOnly(name string) (ClassificationResult, bool) {
 		return ClassificationResult{Kind: KindMem}, true
 	case "sys_enter_mremap":
 		return ClassificationResult{Kind: KindMem}, true
+	case "sys_enter_mincore":
+		return ClassificationResult{Kind: KindMem}, true
+	case "sys_enter_remap_file_pages":
+		return ClassificationResult{Kind: KindMem}, true
+	case "sys_enter_mlock":
+		return ClassificationResult{Kind: KindMem}, true
+	case "sys_enter_mlock2":
+		return ClassificationResult{Kind: KindMem}, true
+	case "sys_enter_munlock":
+		return ClassificationResult{Kind: KindMem}, true
+	case "sys_enter_mseal":
+		return ClassificationResult{Kind: KindMem}, true
+	case "sys_enter_map_shadow_stack":
+		return ClassificationResult{Kind: KindMem}, true
 	case "sys_enter_nanosleep":
 		return ClassificationResult{Kind: KindSleep}, true
 	case "sys_enter_clock_nanosleep":
diff --git a/internal/generate/classify_test.go b/internal/generate/classify_test.go
index b51877c..590b0bb 100644
--- a/internal/generate/classify_test.go
+++ b/internal/generate/classify_test.go
@@ -691,6 +691,36 @@ func TestClassifyG7NameOnlyKinds(t *testing.T) {
 	}
 }
 
+func TestClassifyI7NameOnlyKinds(t *testing.T) {
+	tests := []struct {
+		name string
+		want TracepointKind
+	}{
+		{"sys_enter_mincore", KindMem},
+		{"sys_enter_remap_file_pages", KindMem},
+		{"sys_enter_mlock", KindMem},
+		{"sys_enter_mlock2", KindMem},
+		{"sys_enter_munlock", KindMem},
+		{"sys_enter_mseal", KindMem},
+		{"sys_enter_map_shadow_stack", KindMem},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := ClassifyFormat(&Format{
+				Name: tt.name,
+				ExternalFields: []Field{
+					{Type: "long", Name: "__syscall_nr"},
+					{Type: "long", Name: "arg0"},
+				},
+			})
+			if r.Kind != tt.want {
+				t.Fatalf("%s: got kind %d, want %d", tt.name, r.Kind, tt.want)
+			}
+		})
+	}
+}
+
 func TestClassifyMount(t *testing.T) {
 	r := classifyFromData(t, FormatMount)
 	if r.Kind != KindPathname {
@@ -875,6 +905,13 @@ func TestClassifySyscallPairAccepted(t *testing.T) {
 		{"pselect6", FormatPselect6, FormatExitPselect6, KindPoll},
 		{"munmap", FormatMunmap, FormatExitMunmap, KindMem},
 		{"mremap", FormatMremap, FormatExitMremap, KindMem},
+		{"mincore", syntheticEnter("mincore", 9354), syntheticExit("mincore", 9353), KindMem},
+		{"remap_file_pages", syntheticEnter("remap_file_pages", 9356), syntheticExit("remap_file_pages", 9355), KindMem},
+		{"mlock", syntheticEnter("mlock", 9358), syntheticExit("mlock", 9357), KindMem},
+		{"mlock2", syntheticEnter("mlock2", 9360), syntheticExit("mlock2", 9359), KindMem},
+		{"munlock", syntheticEnter("munlock", 9362), syntheticExit("munlock", 9361), KindMem},
+		{"mseal", syntheticEnter("mseal", 9364), syntheticExit("mseal", 9363), KindMem},
+		{"map_shadow_stack", syntheticEnter("map_shadow_stack", 9366), syntheticExit("map_shadow_stack", 9365), KindMem},
 		{"nanosleep", FormatNanosleep, FormatExitNanosleep, KindSleep},
 		{"clock_nanosleep", FormatClockNanosleep, FormatExitClockNanosleep, KindSleep},
 		{"keyctl", syntheticEnter("keyctl", 9200), syntheticExit("keyctl", 9199), KindKeyctl},
diff --git a/internal/generate/codegen_test.go b/internal/generate/codegen_test.go
index 83d316f..4faed24 100644
--- a/internal/generate/codegen_test.go
+++ b/internal/generate/codegen_test.go
@@ -213,6 +213,29 @@ func TestGenerateMemHandler(t *testing.T) {
 	requireContains(t, output, "ev->flags = (__u64)ctx->args[3];")
 }
 
+func TestGenerateMemHandlerMlock2(t *testing.T) {
+	output := GenerateTracepointsC(mustParseAll(t, syntheticPair("mlock2")))
+
+	requireContains(t, output, `SEC("tracepoint/syscalls/sys_enter_mlock2")`)
+	requireContains(t, output, "struct mem_event *ev")
+	requireContains(t, output, "ev->event_type = ENTER_MEM_EVENT;")
+	requireContains(t, output, "ev->addr = (__u64)ctx->args[0];")
+	requireContains(t, output, "ev->length = (__u64)ctx->args[1];")
+	requireContains(t, output, "ev->flags = (__u64)ctx->args[2];")
+}
+
+func TestGenerateMemHandlerRemapFilePages(t *testing.T) {
+	output := GenerateTracepointsC(mustParseAll(t, syntheticPair("remap_file_pages")))
+
+	requireContains(t, output, `SEC("tracepoint/syscalls/sys_enter_remap_file_pages")`)
+	requireContains(t, output, "struct mem_event *ev")
+	requireContains(t, output, "ev->event_type = ENTER_MEM_EVENT;")
+	requireContains(t, output, "ev->addr = (__u64)ctx->args[0];")
+	requireContains(t, output, "ev->length = (__u64)ctx->args[1];")
+	requireContains(t, output, "ev->length2 = (__u64)ctx->args[3];")
+	requireContains(t, output, "ev->flags = (__u64)ctx->args[4];")
+}
+
 func TestGenerateDup3Handler(t *testing.T) {
 	output := generateFromPair(t, FormatDup3, FormatExitDup3)