Add baseline pidfd_getfd tracepoint support

5 files changed, 55 insertions, 5 deletions

diff --git a/internal/generate/bpfhandler.go b/internal/generate/bpfhandler.go
index eb9c4c4..2c0d648 100644
--- a/internal/generate/bpfhandler.go
+++ b/internal/generate/bpfhandler.go
@@ -59,6 +59,9 @@ func generateExtra(tp GeneratedTracepoint, isEnter bool) string {
 
 	switch tp.Classification.Kind {
 	case KindFd:
+		if f.Name == "sys_enter_pidfd_getfd" {
+			return "    ev->fd = (__s32)ctx->args[0];\n"
+		}
 		fdIdx := f.FieldNumber("fd")
 		if fdIdx >= 0 {
 			return fmt.Sprintf("    ev->fd = (__s32)ctx->args[%d];\n", fdIdx)
diff --git a/internal/generate/classify.go b/internal/generate/classify.go
index a7d9847..f3b9a44 100644
--- a/internal/generate/classify.go
+++ b/internal/generate/classify.go
@@ -78,7 +78,7 @@ func shouldIgnore(name string) bool {
 	}
 
 	if strings.HasPrefix(name, "sys_enter_") {
-		containsIgnores := []string{"recv", "send", "sock", "inotify", "pidfd"}
+		containsIgnores := []string{"recv", "send", "sock", "inotify"}
 		for _, sub := range containsIgnores {
 			if strings.Contains(name, sub) {
 				return true
diff --git a/internal/generate/classify_test.go b/internal/generate/classify_test.go
index b223210..301d4bc 100644
--- a/internal/generate/classify_test.go
+++ b/internal/generate/classify_test.go
@@ -39,6 +39,13 @@ func TestClassifyFdWrite(t *testing.T) {
 	}
 }
 
+func TestClassifyFdPidfdGetfd(t *testing.T) {
+	r := classifyFromData(t, FormatPidfdGetfd)
+	if r.Kind != KindFd {
+		t.Errorf("pidfd_getfd: got kind %d, want KindFd", r.Kind)
+	}
+}
+
 func TestClassifyOpenOpenat(t *testing.T) {
 	r := classifyFromData(t, FormatOpenat)
 	if r.Kind != KindOpen {
@@ -264,7 +271,6 @@ func TestShouldIgnorePatterns(t *testing.T) {
 		"sys_enter_sendto", "sys_enter_sendmsg", "sys_enter_sendmmsg",
 		"sys_enter_socket", "sys_enter_socketpair", "sys_enter_getsockname",
 		"sys_enter_inotify_init", "sys_enter_inotify_add_watch",
-		"sys_enter_pidfd_open", "sys_enter_pidfd_getfd",
 		"sys_enter_bind", "sys_enter_setns", "sys_enter_shutdown",
 		"sys_enter_connect", "sys_enter_fanotify_init", "sys_enter_getpeername",
 	}
@@ -281,6 +287,7 @@ func TestShouldNotIgnore(t *testing.T) {
 		"sys_enter_close", "sys_enter_rename", "sys_enter_unlink",
 		"sys_enter_copy_file_range",
 		"sys_enter_msync",
+		"sys_enter_pidfd_getfd",
 		"sys_exit_read", "sys_exit_openat",
 	}
 	for _, name := range noIgnore {
@@ -308,6 +315,7 @@ func TestClassifySyscallPairAccepted(t *testing.T) {
 		{"sync", FormatSync, FormatExitSync, KindNull},
 		{"msync", FormatMsync, FormatExitMsync, KindNull},
 		{"getcwd", FormatGetcwd, FormatExitGetcwd, KindNull},
+		{"pidfd_getfd", FormatPidfdGetfd, FormatExitPidfdGetfd, KindFd},
 		{"copy_file_range", FormatCopyFileRange, FormatExitCopyFileRange, KindFd},
 		{"syslog", FormatSyslog, FormatExitSyslog, KindNull},
 		{"open_by_handle_at", FormatOpenByHandleAt, FormatExitOpenByHandleAt, KindOpenByHandleAt},
diff --git a/internal/generate/codegen_test.go b/internal/generate/codegen_test.go
index 3e48c79..caad340 100644
--- a/internal/generate/codegen_test.go
+++ b/internal/generate/codegen_test.go
@@ -24,6 +24,15 @@ func TestGenerateFdHandler(t *testing.T) {
 	requireContains(t, output, "#define SYS_ENTER_READ 844")
 }
 
+func TestGeneratePidfdGetfdHandlerUsesPidfdArgument(t *testing.T) {
+	output := generateFromPair(t, FormatPidfdGetfd, FormatExitPidfdGetfd)
+
+	requireContains(t, output, `SEC("tracepoint/syscalls/sys_enter_pidfd_getfd")`)
+	requireContains(t, output, "ev->event_type = ENTER_FD_EVENT;")
+	requireContains(t, output, "ev->trace_id = SYS_ENTER_PIDFD_GETFD;")
+	requireContains(t, output, "ev->fd = (__s32)ctx->args[0];")
+}
+
 func TestGenerateOpenHandler(t *testing.T) {
 	output := generateFromPair(t, FormatOpenat, FormatExitOpenat)
 
@@ -230,9 +239,9 @@ func TestGenerateHandlerStructure(t *testing.T) {
 func TestGenerateAllEventTypes(t *testing.T) {
 	// Verify every event type constant appears correctly
 	tests := []struct {
-		kind    TracepointKind
-		enter   string
-		exit    string
+		kind  TracepointKind
+		enter string
+		exit  string
 	}{
 		{KindFd, "ENTER_FD_EVENT", "EXIT_FD_EVENT"},
 		{KindOpen, "ENTER_OPEN_EVENT", "EXIT_OPEN_EVENT"},
diff --git a/internal/generate/testdata.go b/internal/generate/testdata.go
index a141a49..a9bedc6 100644
--- a/internal/generate/testdata.go
+++ b/internal/generate/testdata.go
@@ -398,6 +398,36 @@ format:
 print fmt: "0x%lx", REC->ret
 `
 
+const FormatPidfdGetfd = `name: sys_enter_pidfd_getfd
+ID: 271
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:int pidfd;	offset:16;	size:8;	signed:0;
+	field:int fd;	offset:24;	size:8;	signed:0;
+	field:unsigned int flags;	offset:32;	size:8;	signed:0;
+
+print fmt: "pidfd: 0x%08lx, fd: 0x%08lx, flags: 0x%08lx", ((unsigned long)(REC->pidfd)), ((unsigned long)(REC->fd)), ((unsigned long)(REC->flags))
+`
+
+const FormatExitPidfdGetfd = `name: sys_exit_pidfd_getfd
+ID: 270
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:long ret;	offset:16;	size:8;	signed:1;
+
+print fmt: "0x%lx", REC->ret
+`
+
 const FormatSync = `name: sys_enter_sync
 ID: 1027
 format: