diff options
Diffstat (limited to 'internal/generate')
| -rw-r--r-- | internal/generate/classify.go | 21 | ||||
| -rw-r--r-- | internal/generate/classify_test.go | 4 |
2 files changed, 23 insertions, 2 deletions
diff --git a/internal/generate/classify.go b/internal/generate/classify.go index 3ba0c00..efc9917 100644 --- a/internal/generate/classify.go +++ b/internal/generate/classify.go @@ -202,6 +202,16 @@ var nameOnlyKindsTable = map[string]TracepointKind{ "sys_exit_signalfd4": KindEventfd, "sys_enter_timerfd_create": KindEventfd, "sys_exit_timerfd_create": KindEventfd, + // timerfd_settime/timerfd_gettime operate on an EXISTING timerfd whose + // tracepoint arg0 is named "ufd" (int), not literally "fd". The generic + // field matcher (classifyByField) only maps fieldName=="fd" -> KindFd, so + // without these overrides they fall through to KindNull and capture NO + // descriptor — dropping the timerfd they act on. Classify them KindFd so + // the enter handler captures the timerfd at args[0], mirroring the + // epoll_wait(epfd) and mq_*(mqdes) precedent. timerfd_create above is the + // fd CREATOR (KindEventfd) and is intentionally left unchanged. + "sys_enter_timerfd_settime": KindFd, + "sys_enter_timerfd_gettime": KindFd, "sys_enter_epoll_create": KindEventfd, "sys_exit_epoll_create": KindEventfd, @@ -257,6 +267,17 @@ var nameOnlyKindsTable = map[string]TracepointKind{ // the single-fd KindFd convention used for copy_file_range and the // read/write/sendto/recvfrom families. "sys_enter_sendfile64": KindFd, + // splice(fd_in, off_in, fd_out, off_out, len, flags) and + // tee(fdin, fdout, len, flags) are in-kernel transfers between two + // EXISTING file descriptors (TransferClassified, see retClassifications), + // exactly like copy_file_range/sendfile64. Their arg0 is the source fd + // named "fd_in"/"fdin" — not literally "fd" — so the generic field matcher + // (classifyByField) leaves them at KindNull, capturing NO descriptor and + // dropping the fds they operate on. Classify them KindFd to capture the + // source fd at args[0], matching the single-fd KindFd convention already + // used for copy_file_range and sendfile64. + "sys_enter_splice": KindFd, + "sys_enter_tee": KindFd, "sys_enter_statmount": KindNull, "sys_enter_listmount": KindNull, "sys_enter_listns": KindNull, diff --git a/internal/generate/classify_test.go b/internal/generate/classify_test.go index 4993293..7d68e40 100644 --- a/internal/generate/classify_test.go +++ b/internal/generate/classify_test.go @@ -304,8 +304,8 @@ func TestClassifyPhaseAByteSyscallPairsAccepted(t *testing.T) { {"sendto", "struct fd_event", "WRITE_CLASSIFIED"}, {"sendmsg", "struct fd_event", "WRITE_CLASSIFIED"}, {"sendfile64", "struct fd_event", "TRANSFER_CLASSIFIED"}, - {"splice", "struct null_event", "TRANSFER_CLASSIFIED"}, - {"tee", "struct null_event", "TRANSFER_CLASSIFIED"}, + {"splice", "struct fd_event", "TRANSFER_CLASSIFIED"}, + {"tee", "struct fd_event", "TRANSFER_CLASSIFIED"}, {"process_vm_readv", "struct null_event", "READ_CLASSIFIED"}, {"process_vm_writev", "struct null_event", "WRITE_CLASSIFIED"}, } |