summaryrefslogtreecommitdiff
path: root/internal/generate/codegen_test.go
AgeCommit message (Collapse)Author
2026-05-29test(generate): lock in sched_get_priority_min classificationPaul Buetow
Audit of sched_get_priority_min(2): the syscall takes a single int policy scheduling-policy enum (not an fd or path) and returns the minimum static priority for that policy, or -1 on error. ior classifies it as KindNull in FamilySched, consistent with every sibling sched_* syscall and the man page. Add TestGenerateSchedGetPriorityMinHandler (covering the identical sibling sched_get_priority_max too) to lock in that the enter handler emits a null_event without capturing the int policy arg, that the family is FamilySched, and that a live exit handler emitting EXIT_RET_EVENT is generated since this syscall returns (unlike the noreturn exit syscalls). No classification change was required, so generated artifacts are unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-05-29test(generate): lock in mincore BPF handler wiring (zv)Paul Buetow
Audit of mincore(2) confirmed the existing tracing is correct: KindMem + FamilyMemory, with addr=args[0], length=args[1], and both flags and length2 held at zero. args[2] is the userspace 'vec' output pointer, not a flags value, so it is correctly NOT wired into ev->flags. Add TestGenerateMemHandlerMincore to lock in this wiring and explicitly guard against the historical mistake of mapping args[2] onto ev->flags the way flags-bearing siblings (madvise/mlock2/mseal) do. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-05-29test(generate): lock in madvise BPF handler field wiringPaul Buetow
Audit of madvise(2) (int madvise(void *addr, size_t length, int advice)) confirmed the existing classification and BPF wiring are correct: KindMem / FamilyMemory, addr=args[0], length=args[1], advice (flags-like) at args[2], length2=0, and the int return captured generically as UNCLASSIFIED. This is correctly distinct from process_madvise(2) (KindFd, pidfd at args[0]). Unlike its KindMem siblings (mprotect, mlock2, brk, map_shadow_stack), madvise lacked a dedicated handler-field lock-in test. Add TestGenerateMemHandlerMadvise with positive field assertions plus negative guards: advice must come from args[2] (not args[0]/addr), length2 must stay zero (no second region), and the exit must return ctx->ret as UNCLASSIFIED. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-05-29test(generate): lock in map_shadow_stack BPF handler field wiringPaul Buetow
Audit of the x86 CET map_shadow_stack syscall (Linux 6.6+, void *map_shadow_stack(unsigned long addr, unsigned long size, unsigned int flags)) confirmed the existing tracing is correct: KindMem / FamilyMemory classification, memFieldSpec wires addr=args[0], length=args[1] (size), flags=args[2], length2=0, and the return (mapped address or -errno) is captured generically as ev->ret like every other KindMem exit. Docs and classify tests already match. The only gap was the lack of a codegen lock-in test for the BPF handler field wiring, which mlock2/remap_file_pages/mprotect/brk all have. Add TestGenerateMemHandlerMapShadowStack to guard against future drift. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-05-29codegen: suppress unreachable sys_exit handlers for noreturn syscallsPaul Buetow
exit and exit_group never return to userspace, so their sys_exit tracepoints can never fire. The generator previously emitted matching EXIT_RET_EVENT handlers anyway, producing dead code in the generated BPF program. classifySyscall now skips exit-handler emission for noreturn syscalls via isNoreturnSyscall, and the regenerated artifacts drop the sys_exit_exit / sys_exit_exit_group handlers (enter handlers are kept). Tests updated to match the new reality: - TestGenerateExitNoreturnHandlers asserts no exit handler is emitted. - TestClassifySyscallPairEmitsAllFamilies exempts noreturn syscalls from the exit-handler-required assertion while staying strict for all others. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-05-29test(exit): lock in noreturn exit/exit_group null_event handlingPaul Buetow
exit(2) and exit_group(2) take a single int status arg and never return. ior classifies both as KindNull (FamilyProcess): the enter handler emits a null_event without capturing the status arg, and the kernel-exposed sys_exit_{exit,exit_group} EXIT_RET_EVENT handlers are emitted but never fire at runtime. Audit confirmed the implementation already matches the man page; this adds a lock-in test documenting the noreturn behavior. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-05-29test(epoll_create): lock in epoll_create1 args[0] flags capturePaul Buetow
Audited epoll_create/epoll_create1 against man 2 epoll_create. Implementation already correct: both classify as KindEventfd (fd-creating), epoll_create(size) hardcodes flags=0 (no flags arg), epoll_create1(flags) reads ctx->args[0], and exit captures the returned fd via ev->ret. Add FormatEpollCreate1/FormatExitEpollCreate1 fixtures and TestGenerateEpollCreate1HandlerUsesArg0Flags as the positive counterpart to the existing TestGenerateEpollCreateHandlerUsesZeroFlags negative test, asserting the enter handler captures args[0] as flags rather than 0. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-05-232c fix epoll_create and pidfd_open flags in BPF codegenPaul Buetow
epoll_create(size) was recording size (args[0]) as flags — hardcode to 0 since the syscall has no flags argument. pidfd_open(pid, flags) was recording pid (args[0]) as flags — use args[1] instead. Add test fixtures and codegen tests that verify the correct argument indexes and reject the old wrong ones. Regenerate generated_tracepoints.c. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-235c remove tracepoint ID adjacency dependency from aggregate pairingPaul Buetow
Generated exit handlers now pass the explicit enter trace ID (SYS_ENTER_X) to ior_on_syscall_exit instead of relying on the implicit enter_id == exit_id + 1 arithmetic invariant. filter.c compares directly against the passed enter ID. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-21o7 classify landlock add-rule and restrict-self as fdPaul Buetow
2026-05-21m7 classify time and posix timer syscallsPaul Buetow
2026-05-21k7 classify process control and prctl syscallsPaul Buetow
2026-05-21j7 add futex kind and aggregate-only defaultsPaul Buetow
2026-05-21l7 classify numa and process memory syscallsPaul Buetow
2026-05-21h7 classify additional memory syscallsPaul Buetow
2026-05-2157 add bpf syscall kind classificationPaul Buetow
2026-05-2137 classify clone family as proc kindPaul Buetow
2026-05-21b7 classify sysv ipc ids and opsPaul Buetow
2026-05-2167 add seccomp and module trace kindsPaul Buetow
2026-05-21i7 classify memory P3 syscalls as mem kindPaul Buetow
2026-05-21n7 classify pidfd and misc tail syscallsPaul Buetow
2026-05-21task-47: fix execveat dirfd codegen fallbackPaul Buetow
2026-05-20task-47: add KindExec for execve pathsPaul Buetow
2026-05-20feat: add keyctl ptrace perf_event_open tracing (task 77)Paul Buetow
2026-05-20d7: add POSIX mq syscall kind/classification and coveragePaul Buetow
2026-05-20feat: add mount/fs management syscall tracing for c7Paul Buetow
2026-05-20task 27: add KindSleep and requested sleep metricPaul Buetow
2026-05-20task 07: add KindMem and separate address-space byte accountingPaul Buetow
2026-05-19z6: add KindPoll wiring for poll/select ready countsPaul Buetow
2026-05-19y6: add epoll ctl/wait tracing and ready-count coveragePaul Buetow
2026-05-19x6: add pipe/eventfd fd-from-air syscall supportPaul Buetow
2026-05-19v6: add KindAccept and wire accept/accept4Paul Buetow
2026-05-19u6: fix socketpair exit fd capture and socket filteringPaul Buetow
2026-05-19u6: add socket/socketpair kind scaffolding and wiringPaul Buetow
2026-05-18k6: emit tracepoints for all syscall familiesPaul Buetow
2026-05-02fix BPF tracepoint context type for RHEL 9 stock kernelPaul Buetow
The BPF handler generator emitted struct trace_event_raw_sys_enter/ trace_event_raw_sys_exit (the BTF-blessed aliases). RHEL 9 carries an rt-tree backport that adds preempt_lazy_count to struct trace_entry, which widens those aliases by 8 bytes and shifts args/ret. The actual tracepoint context the kernel hands the program is still syscall_trace_enter / syscall_trace_exit, where the offsets did not move. Programs typed against the wider alias read past max_ctx_offset and the verifier rejects the attach with EACCES. Switching the generator to emit syscall_trace_enter/exit lines up with the real context on RHEL 9 (and is identical on every other distro, since the two structs only diverge there). Same fix bcc shipped in iovisor/bcc#4920 and inspektor-gadget did in inspektor-gadget#2546. Field accesses (ctx->args[N], ctx->ret) are unchanged. Verified end-to-end on Rocky Linux 9.7 stock 5.14.0-611.5.1.el9_7 (no kernel-ml needed) and Fedora 6.19. README rewritten accordingly: drops the elrepo kernel-ml step and the trailing 'permission denied' troubleshooting paragraph; adds a historical note explaining why the old workaround existed. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-02-23Add baseline pidfd_getfd tracepoint supportPaul Buetow
2026-02-23Fix integration trace expectations and fd/open event handlingPaul Buetow
2026-02-21Add negative tests for all internal unit tests (task 348)Paul Buetow
- internal/types: Fix StringValue panic with no null terminator, add negative tests for serialization, Equals, and StringValue edge cases - internal/file: Add negative tests for empty name, unknown flags, SetFlags/AddFlags, Dup, empty OldnameNewname and Pathname - internal/flamegraph: Add negative tests for StringByName unknown field, Counter.ValueByName panic, merge empty, deserialize invalid data, serialize/deserialize round-trip - internal/generate/format: Add negative tests for empty input, ID errors, malformed fields, empty declarations - internal/generate/typesgo: Add negative tests for snakeToCamel edge cases, unknown types, invalid member/define parsing, no-import case - internal/generate/tracepointsgo: Add negative tests for malformed SEC, no SEC lines - internal/generate/codegen: Add negative tests for unknown event kind, invalid syscall grouping, missing exit tracepoint - internal/generate/classify: Add negative tests for empty external fields, non-fd types Amp-Thread-ID: https://ampcode.com/threads/T-019c81bf-3d5c-7216-b1b6-890db1374414 Co-authored-by: Amp <amp@ampcode.com>
2026-02-21Enable name_to_handle_at and io_uring fd attributionPaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c7fec-eec9-706a-8338-3ce674802680 Co-authored-by: Amp <amp@ampcode.com>
2026-02-21Migrate make targets to magePaul Buetow
Amp-Thread-ID: https://ampcode.com/threads/T-019c7f4e-cc5f-76f1-aaf0-dd7cbaabbb18 Co-authored-by: Amp <amp@ampcode.com>
generated by cgit v1.2.3 (git 2.25.1) at 2026-06-18 01:19:46 +0000