x6: add pipe/eventfd fd-from-air syscall support

18 files changed, 971 insertions, 37 deletions

diff --git a/internal/c/generated_tracepoints.c b/internal/c/generated_tracepoints.c
index 0f83f35..c14c61e 100644
--- a/internal/c/generated_tracepoints.c
+++ b/internal/c/generated_tracepoints.c
@@ -3571,89 +3571,109 @@ int handle_sys_exit_userfaultfd(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_eventfd2 is a struct null_event
+/// sys_enter_eventfd2 is a struct eventfd_event
 SEC("tracepoint/syscalls/sys_enter_eventfd2")
 int handle_sys_enter_eventfd2(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
 
-    struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
+    struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = ENTER_NULL_EVENT;
+    ev->event_type = ENTER_EVENTFD_EVENT;
     ev->trace_id = SYS_ENTER_EVENTFD2;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_boot_ns();
+    __s32 flags = (__s32)ctx->args[1];
+    bpf_map_update_elem(&eventfd_flags_map, &tid, &flags, BPF_ANY);
+    ev->flags = flags;
+    ev->ret = -1;
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
 }
 
-/// sys_exit_eventfd2 is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_eventfd2 is a struct eventfd_event
 SEC("tracepoint/syscalls/sys_exit_eventfd2")
 int handle_sys_exit_eventfd2(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
 
-    struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
+    struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = EXIT_RET_EVENT;
+    ev->event_type = EXIT_EVENTFD_EVENT;
     ev->trace_id = SYS_EXIT_EVENTFD2;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_boot_ns();
+    __s32 flags = 0;
+    __s32 *pending = bpf_map_lookup_elem(&eventfd_flags_map, &tid);
+    if (pending) {
+        flags = *pending;
+        bpf_map_delete_elem(&eventfd_flags_map, &tid);
+    }
+    ev->flags = flags;
     ev->ret = ctx->ret;
-    ev->ret_type = UNCLASSIFIED;
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
 }
 
-/// sys_enter_eventfd is a struct null_event
+/// sys_enter_eventfd is a struct eventfd_event
 SEC("tracepoint/syscalls/sys_enter_eventfd")
 int handle_sys_enter_eventfd(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
 
-    struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
+    struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = ENTER_NULL_EVENT;
+    ev->event_type = ENTER_EVENTFD_EVENT;
     ev->trace_id = SYS_ENTER_EVENTFD;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_boot_ns();
+    __s32 flags = 0;
+    bpf_map_update_elem(&eventfd_flags_map, &tid, &flags, BPF_ANY);
+    ev->flags = flags;
+    ev->ret = -1;
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
 }
 
-/// sys_exit_eventfd is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_eventfd is a struct eventfd_event
 SEC("tracepoint/syscalls/sys_exit_eventfd")
 int handle_sys_exit_eventfd(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
 
-    struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
+    struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = EXIT_RET_EVENT;
+    ev->event_type = EXIT_EVENTFD_EVENT;
     ev->trace_id = SYS_EXIT_EVENTFD;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_boot_ns();
+    __s32 flags = 0;
+    __s32 *pending = bpf_map_lookup_elem(&eventfd_flags_map, &tid);
+    if (pending) {
+        flags = *pending;
+        bpf_map_delete_elem(&eventfd_flags_map, &tid);
+    }
+    ev->flags = flags;
     ev->ret = ctx->ret;
-    ev->ret_type = UNCLASSIFIED;
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
@@ -7771,89 +7791,139 @@ int handle_sys_exit_rename(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_pipe2 is a struct null_event
+/// sys_enter_pipe2 is a struct pipe_event
 SEC("tracepoint/syscalls/sys_enter_pipe2")
 int handle_sys_enter_pipe2(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
 
-    struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
+    struct pipe_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct pipe_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = ENTER_NULL_EVENT;
+    ev->event_type = ENTER_PIPE_EVENT;
     ev->trace_id = SYS_ENTER_PIPE2;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_boot_ns();
+    struct pipe_ctx pending;
+    pending.upipefd = ctx->args[0];
+    pending.flags = (__s32)ctx->args[1];
+    bpf_map_update_elem(&pipe_ctx_map, &tid, &pending, BPF_ANY);
+    ev->flags = pending.flags;
+    ev->fd0 = -1;
+    ev->fd1 = -1;
+    ev->ret = 0;
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
 }
 
-/// sys_exit_pipe2 is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_pipe2 is a struct pipe_event
 SEC("tracepoint/syscalls/sys_exit_pipe2")
 int handle_sys_exit_pipe2(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
 
-    struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
+    struct pipe_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct pipe_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = EXIT_RET_EVENT;
+    ev->event_type = EXIT_PIPE_EVENT;
     ev->trace_id = SYS_EXIT_PIPE2;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_boot_ns();
+    __s32 flags = 0;
+    __s32 fd0 = -1;
+    __s32 fd1 = -1;
+    struct pipe_ctx *pending = bpf_map_lookup_elem(&pipe_ctx_map, &tid);
+    if (pending) {
+        flags = pending->flags;
+        if (ctx->ret == 0 && pending->upipefd != 0) {
+            int pipefd[2];
+            if (bpf_probe_read_user(&pipefd, sizeof(pipefd), (void *)pending->upipefd) == 0) {
+                fd0 = (__s32)pipefd[0];
+                fd1 = (__s32)pipefd[1];
+            }
+        }
+        bpf_map_delete_elem(&pipe_ctx_map, &tid);
+    }
+    ev->flags = flags;
+    ev->fd0 = fd0;
+    ev->fd1 = fd1;
     ev->ret = ctx->ret;
-    ev->ret_type = UNCLASSIFIED;
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
 }
 
-/// sys_enter_pipe is a struct null_event
+/// sys_enter_pipe is a struct pipe_event
 SEC("tracepoint/syscalls/sys_enter_pipe")
 int handle_sys_enter_pipe(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
 
-    struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
+    struct pipe_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct pipe_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = ENTER_NULL_EVENT;
+    ev->event_type = ENTER_PIPE_EVENT;
     ev->trace_id = SYS_ENTER_PIPE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_boot_ns();
+    struct pipe_ctx pending;
+    pending.upipefd = ctx->args[0];
+    pending.flags = 0;
+    bpf_map_update_elem(&pipe_ctx_map, &tid, &pending, BPF_ANY);
+    ev->flags = pending.flags;
+    ev->fd0 = -1;
+    ev->fd1 = -1;
+    ev->ret = 0;
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
 }
 
-/// sys_exit_pipe is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_pipe is a struct pipe_event
 SEC("tracepoint/syscalls/sys_exit_pipe")
 int handle_sys_exit_pipe(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
 
-    struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
+    struct pipe_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct pipe_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = EXIT_RET_EVENT;
+    ev->event_type = EXIT_PIPE_EVENT;
     ev->trace_id = SYS_EXIT_PIPE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_boot_ns();
+    __s32 flags = 0;
+    __s32 fd0 = -1;
+    __s32 fd1 = -1;
+    struct pipe_ctx *pending = bpf_map_lookup_elem(&pipe_ctx_map, &tid);
+    if (pending) {
+        flags = pending->flags;
+        if (ctx->ret == 0 && pending->upipefd != 0) {
+            int pipefd[2];
+            if (bpf_probe_read_user(&pipefd, sizeof(pipefd), (void *)pending->upipefd) == 0) {
+                fd0 = (__s32)pipefd[0];
+                fd1 = (__s32)pipefd[1];
+            }
+        }
+        bpf_map_delete_elem(&pipe_ctx_map, &tid);
+    }
+    ev->flags = flags;
+    ev->fd0 = fd0;
+    ev->fd1 = fd1;
     ev->ret = ctx->ret;
-    ev->ret_type = UNCLASSIFIED;
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
diff --git a/internal/c/generated_tracepoints_result.txt b/internal/c/generated_tracepoints_result.txt
index a2ad3ca..8f2564c 100644
--- a/internal/c/generated_tracepoints_result.txt
+++ b/internal/c/generated_tracepoints_result.txt
@@ -38,8 +38,8 @@ sys_enter_epoll_ctl is a struct fd_event
 sys_enter_epoll_pwait is a struct null_event
 sys_enter_epoll_pwait2 is a struct null_event
 sys_enter_epoll_wait is a struct null_event
-sys_enter_eventfd is a struct null_event
-sys_enter_eventfd2 is a struct null_event
+sys_enter_eventfd is a struct eventfd_event
+sys_enter_eventfd2 is a struct eventfd_event
 sys_enter_execve is a struct path_event
 sys_enter_execveat is a struct fd_event
 sys_enter_exit is a struct null_event
@@ -210,8 +210,8 @@ sys_enter_personality is a struct null_event
 sys_enter_pidfd_getfd is a struct fd_event
 sys_enter_pidfd_open is a struct null_event
 sys_enter_pidfd_send_signal is a struct null_event
-sys_enter_pipe is a struct null_event
-sys_enter_pipe2 is a struct null_event
+sys_enter_pipe is a struct pipe_event
+sys_enter_pipe2 is a struct pipe_event
 sys_enter_pivot_root is a struct null_event
 sys_enter_pkey_alloc is a struct null_event
 sys_enter_pkey_free is a struct null_event
@@ -405,8 +405,8 @@ sys_exit_epoll_ctl is a struct ret_event (UNCLASSIFIED)
 sys_exit_epoll_pwait is a struct ret_event (UNCLASSIFIED)
 sys_exit_epoll_pwait2 is a struct ret_event (UNCLASSIFIED)
 sys_exit_epoll_wait is a struct ret_event (UNCLASSIFIED)
-sys_exit_eventfd is a struct ret_event (UNCLASSIFIED)
-sys_exit_eventfd2 is a struct ret_event (UNCLASSIFIED)
+sys_exit_eventfd is a struct eventfd_event
+sys_exit_eventfd2 is a struct eventfd_event
 sys_exit_execve is a struct ret_event (UNCLASSIFIED)
 sys_exit_execveat is a struct ret_event (UNCLASSIFIED)
 sys_exit_exit is a struct ret_event (UNCLASSIFIED)
@@ -577,8 +577,8 @@ sys_exit_personality is a struct ret_event (UNCLASSIFIED)
 sys_exit_pidfd_getfd is a struct ret_event (UNCLASSIFIED)
 sys_exit_pidfd_open is a struct ret_event (UNCLASSIFIED)
 sys_exit_pidfd_send_signal is a struct ret_event (UNCLASSIFIED)
-sys_exit_pipe is a struct ret_event (UNCLASSIFIED)
-sys_exit_pipe2 is a struct ret_event (UNCLASSIFIED)
+sys_exit_pipe is a struct pipe_event
+sys_exit_pipe2 is a struct pipe_event
 sys_exit_pivot_root is a struct ret_event (UNCLASSIFIED)
 sys_exit_pkey_alloc is a struct ret_event (UNCLASSIFIED)
 sys_exit_pkey_free is a struct ret_event (UNCLASSIFIED)
diff --git a/internal/c/maps.h b/internal/c/maps.h
index 1624ff8..665e4ff 100644
--- a/internal/c/maps.h
+++ b/internal/c/maps.h
@@ -12,9 +12,28 @@ struct socketpair_ctx {
     __s32 protocol;
 };
 
+struct pipe_ctx {
+    __u64 upipefd;
+    __s32 flags;
+};
+
 struct {
     __uint(type, BPF_MAP_TYPE_HASH);
     __uint(max_entries, 8192);
     __type(key, __u32);
     __type(value, struct socketpair_ctx);
 } socketpair_ctx_map SEC(".maps");
+
+struct {
+    __uint(type, BPF_MAP_TYPE_HASH);
+    __uint(max_entries, 8192);
+    __type(key, __u32);
+    __type(value, struct pipe_ctx);
+} pipe_ctx_map SEC(".maps");
+
+struct {
+    __uint(type, BPF_MAP_TYPE_HASH);
+    __uint(max_entries, 8192);
+    __type(key, __u32);
+    __type(value, __s32);
+} eventfd_flags_map SEC(".maps");
diff --git a/internal/c/types.h b/internal/c/types.h
index 6365e3f..3e06040 100644
--- a/internal/c/types.h
+++ b/internal/c/types.h
@@ -27,6 +27,10 @@
 #define EXIT_SOCKETPAIR_EVENT 22
 #define ENTER_ACCEPT_EVENT 23
 #define EXIT_ACCEPT_EVENT 24
+#define ENTER_PIPE_EVENT 25
+#define EXIT_PIPE_EVENT 26
+#define ENTER_EVENTFD_EVENT 27
+#define EXIT_EVENTFD_EVENT 28
 
 #define UNCLASSIFIED 0
 #define READ_CLASSIFIED 1
@@ -155,3 +159,25 @@ struct accept_event {
     __s32 fd;
     __s64 ret;
 };
+
+struct pipe_event {
+    __u32 event_type;
+    __u32 trace_id;
+    __u64 time;
+    __u32 pid;
+    __u32 tid;
+    __s32 flags;
+    __s32 fd0;
+    __s32 fd1;
+    __s64 ret;
+};
+
+struct eventfd_event {
+    __u32 event_type;
+    __u32 trace_id;
+    __u64 time;
+    __u32 pid;
+    __u32 tid;
+    __s32 flags;
+    __s64 ret;
+};
diff --git a/internal/event/interface_assertions.go b/internal/event/interface_assertions.go
index fea20ba..8fa6ae9 100644
--- a/internal/event/interface_assertions.go
+++ b/internal/event/interface_assertions.go
@@ -50,4 +50,10 @@ var (
 
 	// *types.AcceptEvent carries listening-fd input and accepted-fd return metadata.
 	_ Event = (*types.AcceptEvent)(nil)
+
+	// *types.PipeEvent carries pipe flags plus the two returned pipe descriptors.
+	_ Event = (*types.PipeEvent)(nil)
+
+	// *types.EventfdEvent carries eventfd flags and the returned descriptor.
+	_ Event = (*types.EventfdEvent)(nil)
 )
diff --git a/internal/eventloop_exit.go b/internal/eventloop_exit.go
index 9953c13..345424c 100644
--- a/internal/eventloop_exit.go
+++ b/internal/eventloop_exit.go
@@ -32,6 +32,10 @@ func (e *eventLoop) handleTracepointExit(ep *event.Pair) bool {
 		return e.handleSocketpairExit(ep, ev)
 	case *types.AcceptEvent:
 		return e.handleAcceptExit(ep, ev)
+	case *types.PipeEvent:
+		return e.handlePipeExit(ep, ev)
+	case *types.EventfdEvent:
+		return e.handleEventfdExit(ep, ev)
 	case *types.NullEvent:
 		return e.handleNullExit(ep, ev)
 	case *types.FcntlEvent:
@@ -322,6 +326,71 @@ func acceptedSocketDescriptorName(listening file.File) string {
 	return name
 }
 
+func (e *eventLoop) handlePipeExit(ep *event.Pair, pipeEv *types.PipeEvent) bool {
+	exitEv, ok := ep.ExitEv.(*types.PipeEvent)
+	if !ok {
+		e.recyclePair(ep, "Dropped malformed pipe exit event")
+		return false
+	}
+
+	flags := exitEv.Flags
+	if flags == 0 {
+		flags = pipeEv.Flags
+	}
+	if exitEv.Ret == 0 {
+		if exitEv.Fd0 >= 0 {
+			fdFile := file.NewFd(exitEv.Fd0, pipeDescriptorName(flags, exitEv.Fd0, exitEv.Fd1), flags)
+			e.fdState().set(exitEv.Fd0, fdFile)
+			ep.File = fdFile
+		}
+		if exitEv.Fd1 >= 0 {
+			fdFile := file.NewFd(exitEv.Fd1, pipeDescriptorName(flags, exitEv.Fd0, exitEv.Fd1), flags)
+			e.fdState().set(exitEv.Fd1, fdFile)
+			if ep.File == nil {
+				ep.File = fdFile
+			}
+		}
+	}
+	ep.Comm = e.comm(pipeEv.GetTid())
+	if !e.Filter().MatchPair(ep) {
+		ep.Recycle()
+		return false
+	}
+	return true
+}
+
+func (e *eventLoop) handleEventfdExit(ep *event.Pair, eventfdEv *types.EventfdEvent) bool {
+	exitEv, ok := ep.ExitEv.(*types.EventfdEvent)
+	if !ok {
+		e.recyclePair(ep, "Dropped malformed eventfd exit event")
+		return false
+	}
+
+	flags := exitEv.Flags
+	if flags == 0 {
+		flags = eventfdEv.Flags
+	}
+	if fd := int32(exitEv.Ret); fd >= 0 {
+		fdFile := file.NewFd(fd, eventfdDescriptorName(flags), flags)
+		e.fdState().set(fd, fdFile)
+		ep.File = fdFile
+	}
+	ep.Comm = e.comm(eventfdEv.GetTid())
+	if !e.Filter().MatchPair(ep) {
+		ep.Recycle()
+		return false
+	}
+	return true
+}
+
+func pipeDescriptorName(flags, fd0, fd1 int32) string {
+	return fmt.Sprintf("pipe:%d:%d:%d", flags, fd0, fd1)
+}
+
+func eventfdDescriptorName(flags int32) string {
+	return fmt.Sprintf("eventfd:%d", flags)
+}
+
 func (e *eventLoop) handleNullExit(ep *event.Pair, nullEv *types.NullEvent) bool {
 	if ep.Is(types.SYS_ENTER_IO_URING_SETUP) {
 		retEvent, ok := ep.ExitEv.(*types.RetEvent)
diff --git a/internal/eventloop_ipc_test.go b/internal/eventloop_ipc_test.go
new file mode 100644
index 0000000..eec819b
--- /dev/null
+++ b/internal/eventloop_ipc_test.go
@@ -0,0 +1,120 @@
+package internal
+
+import (
+	"testing"
+
+	"ior/internal/event"
+	"ior/internal/globalfilter"
+	"ior/internal/types"
+)
+
+func TestHandlePipeExitTracksReturnedFds(t *testing.T) {
+	el := mustNewEventLoop(t, eventLoopConfig{})
+
+	enter := &types.PipeEvent{
+		EventType: types.ENTER_PIPE_EVENT,
+		TraceId:   types.SYS_ENTER_PIPE2,
+		Time:      100,
+		Pid:       70,
+		Tid:       71,
+		Flags:     0x80000,
+		Fd0:       -1,
+		Fd1:       -1,
+		Ret:       0,
+	}
+	exit := &types.PipeEvent{
+		EventType: types.EXIT_PIPE_EVENT,
+		TraceId:   types.SYS_EXIT_PIPE2,
+		Time:      200,
+		Pid:       70,
+		Tid:       71,
+		Flags:     0x80000,
+		Fd0:       52,
+		Fd1:       53,
+		Ret:       0,
+	}
+	ep := &event.Pair{EnterEv: enter, ExitEv: exit}
+
+	if ok := el.handlePipeExit(ep, enter); !ok {
+		t.Fatal("handlePipeExit returned false")
+	}
+	verifyFileDescriptor(t, el, 52, "pipe:524288:52:53")
+	verifyFileDescriptor(t, el, 53, "pipe:524288:52:53")
+}
+
+func TestHandleEventfdExitTracksReturnedFd(t *testing.T) {
+	el := mustNewEventLoop(t, eventLoopConfig{})
+
+	enter := &types.EventfdEvent{
+		EventType: types.ENTER_EVENTFD_EVENT,
+		TraceId:   types.SYS_ENTER_EVENTFD2,
+		Time:      100,
+		Pid:       80,
+		Tid:       81,
+		Flags:     0x800,
+		Ret:       -1,
+	}
+	exit := &types.EventfdEvent{
+		EventType: types.EXIT_EVENTFD_EVENT,
+		TraceId:   types.SYS_EXIT_EVENTFD2,
+		Time:      200,
+		Pid:       80,
+		Tid:       81,
+		Flags:     0x800,
+		Ret:       61,
+	}
+	ep := &event.Pair{EnterEv: enter, ExitEv: exit}
+
+	if ok := el.handleEventfdExit(ep, enter); !ok {
+		t.Fatal("handleEventfdExit returned false")
+	}
+	verifyFileDescriptor(t, el, 61, "eventfd:2048")
+}
+
+func TestHandleEventfdExitAppliesPairFilter(t *testing.T) {
+	el := mustNewEventLoop(t, eventLoopConfig{
+		filter: globalfilter.Filter{
+			Syscall: &globalfilter.StringFilter{Pattern: "openat"},
+		},
+	})
+
+	enter := &types.EventfdEvent{
+		EventType: types.ENTER_EVENTFD_EVENT,
+		TraceId:   types.SYS_ENTER_EVENTFD,
+		Time:      100,
+		Pid:       82,
+		Tid:       83,
+		Flags:     0,
+		Ret:       -1,
+	}
+	exit := &types.EventfdEvent{
+		EventType: types.EXIT_EVENTFD_EVENT,
+		TraceId:   types.SYS_EXIT_EVENTFD,
+		Time:      200,
+		Pid:       82,
+		Tid:       83,
+		Flags:     0,
+		Ret:       44,
+	}
+	ep := &event.Pair{EnterEv: enter, ExitEv: exit}
+
+	if ok := el.handleEventfdExit(ep, enter); ok {
+		t.Fatal("handleEventfdExit should reject pair due to filter mismatch")
+	}
+}
+
+func TestInitRawHandlersRegistersIPCEvents(t *testing.T) {
+	el := mustNewEventLoop(t, eventLoopConfig{})
+	if _, ok := el.rawHandlers[types.ENTER_PIPE_EVENT]; !ok {
+		t.Fatal("ENTER_PIPE_EVENT handler is not registered")
+	}
+	if _, ok := el.rawHandlers[types.EXIT_PIPE_EVENT]; !ok {
+		t.Fatal("EXIT_PIPE_EVENT handler is not registered")
+	}
+	if _, ok := el.rawHandlers[types.ENTER_EVENTFD_EVENT]; !ok {
+		t.Fatal("ENTER_EVENTFD_EVENT handler is not registered")
+	}
+	if _, ok := el.rawHandlers[types.EXIT_EVENTFD_EVENT]; !ok {
+		t.Fatal("EXIT_EVENTFD_EVENT handler is not registered")
+	}
+}
diff --git a/internal/eventloop_runtime.go b/internal/eventloop_runtime.go
index 94648e0..cce7299 100644
--- a/internal/eventloop_runtime.go
+++ b/internal/eventloop_runtime.go
@@ -147,6 +147,7 @@ func (e *eventLoop) initRawHandlers() {
 	e.registerNamePathHandlers()
 	e.registerMiscHandlers()
 	e.registerSocketHandlers()
+	e.registerIPCHandlers()
 }
 
 // registerOpenHandlers wires enter/exit handlers for open-family events.
@@ -301,6 +302,37 @@ func (e *eventLoop) registerSocketHandlers() {
 	}
 }
 
+func (e *eventLoop) registerIPCHandlers() {
+	e.rawHandlers[types.ENTER_PIPE_EVENT] = func(raw []byte, _ chan<- *event.Pair) {
+		pipeEv, ok := decodeRawEvent(e, types.ENTER_PIPE_EVENT, raw, types.NewPipeEventFast)
+		if !ok {
+			return
+		}
+		e.tracepointEntered(pipeEv)
+	}
+	e.rawHandlers[types.EXIT_PIPE_EVENT] = func(raw []byte, ch chan<- *event.Pair) {
+		pipeEv, ok := decodeRawEvent(e, types.EXIT_PIPE_EVENT, raw, types.NewPipeEventFast)
+		if !ok {
+			return
+		}
+		e.tracepointExited(pipeEv, ch)
+	}
+	e.rawHandlers[types.ENTER_EVENTFD_EVENT] = func(raw []byte, _ chan<- *event.Pair) {
+		eventfdEv, ok := decodeRawEvent(e, types.ENTER_EVENTFD_EVENT, raw, types.NewEventfdEventFast)
+		if !ok {
+			return
+		}
+		e.tracepointEntered(eventfdEv)
+	}
+	e.rawHandlers[types.EXIT_EVENTFD_EVENT] = func(raw []byte, ch chan<- *event.Pair) {
+		eventfdEv, ok := decodeRawEvent(e, types.EXIT_EVENTFD_EVENT, raw, types.NewEventfdEventFast)
+		if !ok {
+			return
+		}
+		e.tracepointExited(eventfdEv, ch)
+	}
+}
+
 func decodeRawEvent[T any](e *eventLoop, eventType types.EventType, raw []byte, decode func([]byte) *T) (*T, bool) {
 	decoded := decode(raw)
 	if decoded == nil {
diff --git a/internal/generate/bpfhandler.go b/internal/generate/bpfhandler.go
index bada317..1a6b210 100644
--- a/internal/generate/bpfhandler.go
+++ b/internal/generate/bpfhandler.go
@@ -79,6 +79,10 @@ func generateExtra(tp GeneratedTracepoint, isEnter bool) string {
 		return generateExtraSocketpair(isEnter)
 	case KindAccept:
 		return generateExtraAccept(isEnter)
+	case KindPipe:
+		return generateExtraPipe(f, isEnter)
+	case KindEventfd:
+		return generateExtraEventfd(f, isEnter)
 	case KindOpen:
 		return generateExtraOpen(f)
 	case KindPathname:
@@ -173,6 +177,28 @@ func generateExtraAccept(isEnter bool) string {
 	return "    ev->fd = -1;\n    ev->ret = ctx->ret;\n"
 }
 
+func generateExtraPipe(f *Format, isEnter bool) string {
+	if isEnter {
+		flagsExpr := "0"
+		if f.Name == "sys_enter_pipe2" {
+			flagsExpr = "(__s32)ctx->args[1]"
+		}
+		return "    struct pipe_ctx pending;\n    pending.upipefd = ctx->args[0];\n    pending.flags = " + flagsExpr + ";\n    bpf_map_update_elem(&pipe_ctx_map, &tid, &pending, BPF_ANY);\n    ev->flags = pending.flags;\n    ev->fd0 = -1;\n    ev->fd1 = -1;\n    ev->ret = 0;\n"
+	}
+	return "    __s32 flags = 0;\n    __s32 fd0 = -1;\n    __s32 fd1 = -1;\n    struct pipe_ctx *pending = bpf_map_lookup_elem(&pipe_ctx_map, &tid);\n    if (pending) {\n        flags = pending->flags;\n        if (ctx->ret == 0 && pending->upipefd != 0) {\n            int pipefd[2];\n            if (bpf_probe_read_user(&pipefd, sizeof(pipefd), (void *)pending->upipefd) == 0) {\n                fd0 = (__s32)pipefd[0];\n                fd1 = (__s32)pipefd[1];\n            }\n        }\n        bpf_map_delete_elem(&pipe_ctx_map, &tid);\n    }\n    ev->flags = flags;\n    ev->fd0 = fd0;\n    ev->fd1 = fd1;\n    ev->ret = ctx->ret;\n"
+}
+
+func generateExtraEventfd(f *Format, isEnter bool) string {
+	if isEnter {
+		flagsExpr := "0"
+		if f.Name == "sys_enter_eventfd2" {
+			flagsExpr = "(__s32)ctx->args[1]"
+		}
+		return "    __s32 flags = " + flagsExpr + ";\n    bpf_map_update_elem(&eventfd_flags_map, &tid, &flags, BPF_ANY);\n    ev->flags = flags;\n    ev->ret = -1;\n"
+	}
+	return "    __s32 flags = 0;\n    __s32 *pending = bpf_map_lookup_elem(&eventfd_flags_map, &tid);\n    if (pending) {\n        flags = *pending;\n        bpf_map_delete_elem(&eventfd_flags_map, &tid);\n    }\n    ev->flags = flags;\n    ev->ret = ctx->ret;\n"
+}
+
 // eventStructName returns the C struct name for a TracepointKind. The mapping
 // is driven by kindRegistry so adding a new kind only requires a registry entry.
 func eventStructName(kind TracepointKind) string {
diff --git a/internal/generate/classify.go b/internal/generate/classify.go
index 4f6d14c..0bc00b3 100644
--- a/internal/generate/classify.go
+++ b/internal/generate/classify.go
@@ -18,6 +18,8 @@ const (
 	KindSocket
 	KindSocketpair
 	KindAccept
+	KindPipe
+	KindEventfd
 )
 
 type RetClassification string
@@ -96,6 +98,22 @@ func classifyNameOnly(name string) (ClassificationResult, bool) {
 		return ClassificationResult{Kind: KindAccept}, true
 	case "sys_exit_accept4":
 		return ClassificationResult{Kind: KindAccept}, true
+	case "sys_enter_pipe":
+		return ClassificationResult{Kind: KindPipe}, true
+	case "sys_exit_pipe":
+		return ClassificationResult{Kind: KindPipe}, true
+	case "sys_enter_pipe2":
+		return ClassificationResult{Kind: KindPipe}, true
+	case "sys_exit_pipe2":
+		return ClassificationResult{Kind: KindPipe}, true
+	case "sys_enter_eventfd":
+		return ClassificationResult{Kind: KindEventfd}, true
+	case "sys_exit_eventfd":
+		return ClassificationResult{Kind: KindEventfd}, true
+	case "sys_enter_eventfd2":
+		return ClassificationResult{Kind: KindEventfd}, true
+	case "sys_exit_eventfd2":
+		return ClassificationResult{Kind: KindEventfd}, true
 	case "sys_enter_bind":
 		return ClassificationResult{Kind: KindFd}, true
 	case "sys_enter_connect":
diff --git a/internal/generate/classify_test.go b/internal/generate/classify_test.go
index 5c7111f..09989b8 100644
--- a/internal/generate/classify_test.go
+++ b/internal/generate/classify_test.go
@@ -313,6 +313,62 @@ func TestClassifyExitSocketpair(t *testing.T) {
 	}
 }
 
+func TestClassifyPipe(t *testing.T) {
+	r := classifyFromData(t, FormatPipe)
+	if r.Kind != KindPipe {
+		t.Errorf("pipe: got kind %d, want KindPipe", r.Kind)
+	}
+}
+
+func TestClassifyPipe2(t *testing.T) {
+	r := classifyFromData(t, FormatPipe2)
+	if r.Kind != KindPipe {
+		t.Errorf("pipe2: got kind %d, want KindPipe", r.Kind)
+	}
+}
+
+func TestClassifyExitPipe(t *testing.T) {
+	r := classifyFromData(t, FormatExitPipe)
+	if r.Kind != KindPipe {
+		t.Errorf("exit_pipe: got kind %d, want KindPipe", r.Kind)
+	}
+}
+
+func TestClassifyExitPipe2(t *testing.T) {
+	r := classifyFromData(t, FormatExitPipe2)
+	if r.Kind != KindPipe {
+		t.Errorf("exit_pipe2: got kind %d, want KindPipe", r.Kind)
+	}
+}
+
+func TestClassifyEventfd(t *testing.T) {
+	r := classifyFromData(t, FormatEventfd)
+	if r.Kind != KindEventfd {
+		t.Errorf("eventfd: got kind %d, want KindEventfd", r.Kind)
+	}
+}
+
+func TestClassifyEventfd2(t *testing.T) {
+	r := classifyFromData(t, FormatEventfd2)
+	if r.Kind != KindEventfd {
+		t.Errorf("eventfd2: got kind %d, want KindEventfd", r.Kind)
+	}
+}
+
+func TestClassifyExitEventfd(t *testing.T) {
+	r := classifyFromData(t, FormatExitEventfd)
+	if r.Kind != KindEventfd {
+		t.Errorf("exit_eventfd: got kind %d, want KindEventfd", r.Kind)
+	}
+}
+
+func TestClassifyExitEventfd2(t *testing.T) {
+	r := classifyFromData(t, FormatExitEventfd2)
+	if r.Kind != KindEventfd {
+		t.Errorf("exit_eventfd2: got kind %d, want KindEventfd", r.Kind)
+	}
+}
+
 func TestClassifyKillRequiresGenerationFallback(t *testing.T) {
 	r := classifyFromData(t, FormatKill)
 	if r.Kind != KindNone {
@@ -353,6 +409,10 @@ func TestClassifySyscallPairAccepted(t *testing.T) {
 		{"accept4", FormatAccept4, FormatExitAccept4, KindAccept},
 		{"socket", FormatSocket, FormatExitSocket, KindSocket},
 		{"socketpair", FormatSocketpair, FormatExitSocketpair, KindSocketpair},
+		{"pipe", FormatPipe, FormatExitPipe, KindPipe},
+		{"pipe2", FormatPipe2, FormatExitPipe2, KindPipe},
+		{"eventfd", FormatEventfd, FormatExitEventfd, KindEventfd},
+		{"eventfd2", FormatEventfd2, FormatExitEventfd2, KindEventfd},
 		{"kill", FormatKill, FormatExitKill, KindNull},
 	}
 
@@ -380,6 +440,10 @@ func TestClassifySyscallPairEmitsAllFamilies(t *testing.T) {
 		{"accept4", FormatAccept4, FormatExitAccept4, FamilyNetwork},
 		{"socket", FormatSocket, FormatExitSocket, FamilyNetwork},
 		{"socketpair", FormatSocketpair, FormatExitSocketpair, FamilyNetwork},
+		{"pipe", FormatPipe, FormatExitPipe, FamilyIPC},
+		{"pipe2", FormatPipe2, FormatExitPipe2, FamilyIPC},
+		{"eventfd", FormatEventfd, FormatExitEventfd, FamilyIPC},
+		{"eventfd2", FormatEventfd2, FormatExitEventfd2, FamilyIPC},
 		{"kill", FormatKill, FormatExitKill, FamilySignals},
 	}
 
diff --git a/internal/generate/codegen_test.go b/internal/generate/codegen_test.go
index d8130c8..1c99314 100644
--- a/internal/generate/codegen_test.go
+++ b/internal/generate/codegen_test.go
@@ -225,6 +225,36 @@ func TestGenerateAcceptHandler(t *testing.T) {
 	requireContains(t, output, "ev->ret = ctx->ret;")
 }
 
+func TestGeneratePipeHandler(t *testing.T) {
+	output := generateFromPair(t, FormatPipe2, FormatExitPipe2)
+
+	requireContains(t, output, "struct pipe_event *ev")
+	requireContains(t, output, "ev->event_type = ENTER_PIPE_EVENT;")
+	requireContains(t, output, "struct pipe_ctx pending;")
+	requireContains(t, output, "pending.upipefd = ctx->args[0];")
+	requireContains(t, output, "pending.flags = (__s32)ctx->args[1];")
+	requireContains(t, output, "bpf_map_update_elem(&pipe_ctx_map, &tid, &pending, BPF_ANY);")
+	requireContains(t, output, "ev->fd0 = -1;")
+	requireContains(t, output, "ev->fd1 = -1;")
+	requireContains(t, output, "SEC(\"tracepoint/syscalls/sys_exit_pipe2\")")
+	requireContains(t, output, "ev->event_type = EXIT_PIPE_EVENT;")
+	requireContains(t, output, "struct pipe_ctx *pending = bpf_map_lookup_elem(&pipe_ctx_map, &tid);")
+	requireContains(t, output, "ev->ret = ctx->ret;")
+}
+
+func TestGenerateEventfdHandler(t *testing.T) {
+	output := generateFromPair(t, FormatEventfd2, FormatExitEventfd2)
+
+	requireContains(t, output, "struct eventfd_event *ev")
+	requireContains(t, output, "ev->event_type = ENTER_EVENTFD_EVENT;")
+	requireContains(t, output, "bpf_map_update_elem(&eventfd_flags_map, &tid, &flags, BPF_ANY);")
+	requireContains(t, output, "ev->flags = flags;")
+	requireContains(t, output, "ev->ret = -1;")
+	requireContains(t, output, "SEC(\"tracepoint/syscalls/sys_exit_eventfd2\")")