From 3bcdbe94d8b72ebcd829dbf7c1a582d2268fef45 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Fri, 29 May 2026 09:57:50 +0300 Subject: test(family): assert ioperm/iopl/modify_ldt classify as Misc Audit of ioperm(2) confirmed the syscall is traced correctly: classified as KindNull (name-only enter, no arg decoding) with the exit handler capturing the raw int return value, matching the man-page semantics (int ioperm(unsigned long from, unsigned long num, int turn_on) -> 0/-1). ioperm and its x86 port/CPU-state siblings (iopl, modify_ldt) are not in the explicit family table and intentionally fall through to Misc. Add explicit family-classification assertions so a future regression that accidentally remaps them is caught. No implementation change was needed. Co-Authored-By: Claude Opus 4.8 --- internal/generate/family_test.go | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/internal/generate/family_test.go b/internal/generate/family_test.go index 93431b4..3d6f3bb 100644 --- a/internal/generate/family_test.go +++ b/internal/generate/family_test.go @@ -19,6 +19,13 @@ func TestClassifySyscallFamily(t *testing.T) { {"sys_enter_epoll_wait", FamilyPolling}, {"sys_enter_io_uring_enter", FamilyAIO}, {"sys_enter_bpf", FamilySecurity}, + // x86 I/O-port / CPU-state syscalls are not in the explicit family + // table and intentionally fall through to Misc (ioperm/iopl/modify_ldt + // set port-access or LDT state, not file I/O). arch_prctl/personality + // are deliberately classified as Process, so they are not listed here. + {"sys_enter_ioperm", FamilyMisc}, + {"sys_enter_iopl", FamilyMisc}, + {"sys_enter_modify_ldt", FamilyMisc}, {"sys_enter_unlisted_future_syscall", FamilyMisc}, } -- cgit v1.2.3