From 55f52dc3d270bd0edbaa1f338c8798598721e2f1 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Fri, 29 May 2026 10:26:01 +0300 Subject: codegen: suppress unreachable sys_exit handlers for noreturn syscalls exit and exit_group never return to userspace, so their sys_exit tracepoints can never fire. The generator previously emitted matching EXIT_RET_EVENT handlers anyway, producing dead code in the generated BPF program. classifySyscall now skips exit-handler emission for noreturn syscalls via isNoreturnSyscall, and the regenerated artifacts drop the sys_exit_exit / sys_exit_exit_group handlers (enter handlers are kept). Tests updated to match the new reality: - TestGenerateExitNoreturnHandlers asserts no exit handler is emitted. - TestClassifySyscallPairEmitsAllFamilies exempts noreturn syscalls from the exit-handler-required assertion while staying strict for all others. Co-Authored-By: Claude Opus 4.8 --- internal/c/generated_tracepoints.c | 54 ----------------------------- internal/c/generated_tracepoints_result.txt | 2 -- 2 files changed, 56 deletions(-) (limited to 'internal/c') diff --git a/internal/c/generated_tracepoints.c b/internal/c/generated_tracepoints.c index 48c1f84..51e30be 100644 --- a/internal/c/generated_tracepoints.c +++ b/internal/c/generated_tracepoints.c @@ -696,9 +696,7 @@ #define SYS_ENTER_CAPSET 159 #define SYS_EXIT_CAPSET 158 #define SYS_ENTER_EXIT 150 -#define SYS_EXIT_EXIT 149 #define SYS_ENTER_EXIT_GROUP 148 -#define SYS_EXIT_EXIT_GROUP 147 #define SYS_ENTER_WAITID 146 #define SYS_EXIT_WAITID 145 #define SYS_ENTER_WAIT4 144 @@ -18772,32 +18770,6 @@ int handle_sys_enter_exit(struct syscall_trace_enter *ctx) { return 0; } -/// sys_exit_exit is a struct ret_event (UNCLASSIFIED) (kind=ret) -SEC("tracepoint/syscalls/sys_exit_exit") -int handle_sys_exit_exit(struct syscall_trace_exit *ctx) { - __u32 pid, tid; - if (filter(&pid, &tid)) - return 0; - - if (!ior_on_syscall_exit(tid, SYS_ENTER_EXIT, ctx->ret)) - return 0; - - struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); - if (!ev) - return 0; - - ev->event_type = EXIT_RET_EVENT; - ev->trace_id = SYS_EXIT_EXIT; - ev->pid = pid; - ev->tid = tid; - ev->time = bpf_ktime_get_boot_ns(); - ev->ret = ctx->ret; - ev->ret_type = UNCLASSIFIED; - - bpf_ringbuf_submit(ev, 0); - return 0; -} - /// sys_enter_exit_group is a struct null_event (kind=null) SEC("tracepoint/syscalls/sys_enter_exit_group") int handle_sys_enter_exit_group(struct syscall_trace_enter *ctx) { @@ -18822,32 +18794,6 @@ int handle_sys_enter_exit_group(struct syscall_trace_enter *ctx) { return 0; } -/// sys_exit_exit_group is a struct ret_event (UNCLASSIFIED) (kind=ret) -SEC("tracepoint/syscalls/sys_exit_exit_group") -int handle_sys_exit_exit_group(struct syscall_trace_exit *ctx) { - __u32 pid, tid; - if (filter(&pid, &tid)) - return 0; - - if (!ior_on_syscall_exit(tid, SYS_ENTER_EXIT_GROUP, ctx->ret)) - return 0; - - struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); - if (!ev) - return 0; - - ev->event_type = EXIT_RET_EVENT; - ev->trace_id = SYS_EXIT_EXIT_GROUP; - ev->pid = pid; - ev->tid = tid; - ev->time = bpf_ktime_get_boot_ns(); - ev->ret = ctx->ret; - ev->ret_type = UNCLASSIFIED; - - bpf_ringbuf_submit(ev, 0); - return 0; -} - /// sys_enter_waitid is a struct null_event (kind=proc) SEC("tracepoint/syscalls/sys_enter_waitid") int handle_sys_enter_waitid(struct syscall_trace_enter *ctx) { diff --git a/internal/c/generated_tracepoints_result.txt b/internal/c/generated_tracepoints_result.txt index 7918006..f59a820 100644 --- a/internal/c/generated_tracepoints_result.txt +++ b/internal/c/generated_tracepoints_result.txt @@ -409,8 +409,6 @@ sys_exit_eventfd is a struct eventfd_event (kind=eventfd) sys_exit_eventfd2 is a struct eventfd_event (kind=eventfd) sys_exit_execve is a struct ret_event (UNCLASSIFIED) (kind=ret) sys_exit_execveat is a struct ret_event (UNCLASSIFIED) (kind=ret) -sys_exit_exit is a struct ret_event (UNCLASSIFIED) (kind=ret) -sys_exit_exit_group is a struct ret_event (UNCLASSIFIED) (kind=ret) sys_exit_faccessat is a struct ret_event (UNCLASSIFIED) (kind=ret) sys_exit_faccessat2 is a struct ret_event (UNCLASSIFIED) (kind=ret) sys_exit_fadvise64 is a struct ret_event (UNCLASSIFIED) (kind=ret) -- cgit v1.2.3