summaryrefslogtreecommitdiff
path: root/internal/c
AgeCommit message (Collapse)Author
2026-05-232c fix epoll_create and pidfd_open flags in BPF codegenPaul Buetow
epoll_create(size) was recording size (args[0]) as flags — hardcode to 0 since the syscall has no flags argument. pidfd_open(pid, flags) was recording pid (args[0]) as flags — use args[1] instead. Add test fixtures and codegen tests that verify the correct argument indexes and reject the old wrong ones. Regenerate generated_tracepoints.c. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-235c remove tracepoint ID adjacency dependency from aggregate pairingPaul Buetow
Generated exit handlers now pass the explicit enter trace ID (SYS_ENTER_X) to ior_on_syscall_exit instead of relying on the implicit enter_id == exit_id + 1 arithmetic invariant. filter.c compares directly against the passed enter ID. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-22xb make syscall aggregates per-cpu deltasPaul Buetow
2026-05-21o7 classify landlock add-rule and restrict-self as fdPaul Buetow
2026-05-21m7 classify time and posix timer syscallsPaul Buetow
2026-05-21k7 classify process control and prctl syscallsPaul Buetow
2026-05-21j7 add futex kind and aggregate-only defaultsPaul Buetow
2026-05-21l7 classify numa and process memory syscallsPaul Buetow
2026-05-21h7 classify additional memory syscallsPaul Buetow
2026-05-2157 add bpf syscall kind classificationPaul Buetow
2026-05-2137 classify clone family as proc kindPaul Buetow
2026-05-21b7 classify sysv ipc ids and opsPaul Buetow
2026-05-21e7 classify acct pathname and misc null syscallsPaul Buetow
2026-05-2167 add seccomp and module trace kindsPaul Buetow
2026-05-21i7 classify memory P3 syscalls as mem kindPaul Buetow
2026-05-21g7 classify fd-from-air eventfd usersPaul Buetow
2026-05-21n7 classify pidfd and misc tail syscallsPaul Buetow
2026-05-21f7 wire eventfd kind for fd-from-air IPC syscallsPaul Buetow
2026-05-21task-47: fix execveat dirfd codegen fallbackPaul Buetow
2026-05-20task-47: add KindExec for execve pathsPaul Buetow
2026-05-20feat: add keyctl ptrace perf_event_open tracing (task 77)Paul Buetow
2026-05-20d7: add POSIX mq syscall kind/classification and coveragePaul Buetow
2026-05-20feat: add mount/fs management syscall tracing for c7Paul Buetow
2026-05-20task 27: add KindSleep and requested sleep metricPaul Buetow
2026-05-20feat: add syscall aggregate sampling infrastructure (task 17)Paul Buetow
2026-05-20task 07: add KindMem and separate address-space byte accountingPaul Buetow
2026-05-19z6: add KindPoll wiring for poll/select ready countsPaul Buetow
2026-05-19y6: add epoll ctl/wait tracing and ready-count coveragePaul Buetow
2026-05-19x6: add pipe/eventfd fd-from-air syscall supportPaul Buetow
2026-05-19v6: add KindAccept and wire accept/accept4Paul Buetow
2026-05-19u6: fix socketpair exit fd capture and socket filteringPaul Buetow
2026-05-19u6: add socket/socketpair kind scaffolding and wiringPaul Buetow
2026-05-18j6: defer mmsg byte classificationPaul Buetow
2026-05-18k6: emit tracepoints for all syscall familiesPaul Buetow
2026-05-06add Dockerfile and Rocky Linux 9 build docsPaul Buetow
Introduces a Docker-based build path so ior can be compiled on any Linux host without a native Rocky 9 toolchain setup: - Dockerfile: Rocky 9 minimal image with Go (version from ARG, default from go.mod), static libelf/libzstd built from source, libbpfgo at v0.9.2-libbpf-1.5.1, and mage; CMD runs mage generate + mage all against the repo root mounted as a volume. - scripts/build-with-docker.sh: reads GO_VERSION from go.mod, passes it as --build-arg to docker build, mounts tracefs and BTF into the container, writes the binary to the repo root. - Magefile.go: adds BuildDocker target that wraps the script. - README.md: simplified to the two build paths (Docker + native) with links to docs/; removed GOTOOLCHAIN=auto throughout. - docs/build-rocky-linux-9.md: full manual Rocky 9 steps, libbpfgo toolchain setup/rollback, compile-once-run-everywhere explanation, and timing semantics. - docs/tui-reference.md: complete TUI hotkey reference, recording mode details, and the .ior.zst vs Parquet trade-off table. - AGENTS.md: removed GOTOOLCHAIN=auto from all build commands. - internal/c/generated_tracepoints.c: regenerated against the host kernel. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-02fix BPF tracepoint context type for RHEL 9 stock kernelPaul Buetow
The BPF handler generator emitted struct trace_event_raw_sys_enter/ trace_event_raw_sys_exit (the BTF-blessed aliases). RHEL 9 carries an rt-tree backport that adds preempt_lazy_count to struct trace_entry, which widens those aliases by 8 bytes and shifts args/ret. The actual tracepoint context the kernel hands the program is still syscall_trace_enter / syscall_trace_exit, where the offsets did not move. Programs typed against the wider alias read past max_ctx_offset and the verifier rejects the attach with EACCES. Switching the generator to emit syscall_trace_enter/exit lines up with the real context on RHEL 9 (and is identical on every other distro, since the two structs only diverge there). Same fix bcc shipped in iovisor/bcc#4920 and inspektor-gadget did in inspektor-gadget#2546. Field accesses (ctx->args[N], ctx->ret) are unchanged. Verified end-to-end on Rocky Linux 9.7 stock 5.14.0-611.5.1.el9_7 (no kernel-ml needed) and Fedora 6.19. README rewritten accordingly: drops the elrepo kernel-ml step and the trailing 'permission denied' troubleshooting paragraph; adds a historical note explaining why the old workaround existed. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-03-18cleanupPaul Buetow
2026-02-25Fix initial TUI sizing and align two-row sparklinesPaul Buetow
2026-02-24flamegraph: improve interactive zoom and serve svg over embedded httpPaul Buetow
2026-02-23Add baseline pidfd_getfd tracepoint supportPaul Buetow
2026-02-23Add getcwd tracing support and stabilize comm propagation testPaul Buetow
2026-02-23Fix integration trace expectations and fd/open event handlingPaul Buetow
2026-02-22Add copy_file_range support and tracepoint attach testsPaul Buetow
2026-02-22Implement mmap/msync syscall support with unit and integration coveragePaul Buetow
2026-02-22Implement sync_file_range coverage and document mage world bootstrapPaul Buetow
2026-02-21Enable name_to_handle_at and io_uring fd attributionPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c7fec-eec9-706a-8338-3ce674802680 Co-authored-by: Amp <amp@ampcode.com>
2026-02-21Migrate make targets to magePaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c7f4e-cc5f-76f1-aaf0-dd7cbaabbb18 Co-authored-by: Amp <amp@ampcode.com>
2026-02-21rewrite from Raku to Golang initialPaul Buetow
2025-10-09fix unit tests, initial hard exclude of not working yet syscallsPaul Buetow
2025-10-09initial handle by open_at syscallsPaul Buetow
generated by cgit v1.2.3 (git 2.25.1) at 2026-08-17 07:18:05 +0000