From 4e67c348ef1dc2c0d08f3e90c2affb555b205d0e Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Sat, 23 May 2026 20:10:43 +0300 Subject: 2c fix epoll_create and pidfd_open flags in BPF codegen MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit epoll_create(size) was recording size (args[0]) as flags — hardcode to 0 since the syscall has no flags argument. pidfd_open(pid, flags) was recording pid (args[0]) as flags — use args[1] instead. Add test fixtures and codegen tests that verify the correct argument indexes and reject the old wrong ones. Regenerate generated_tracepoints.c. Co-Authored-By: Claude Opus 4.7 --- internal/generate/bpfhandler.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'internal/generate/bpfhandler.go') diff --git a/internal/generate/bpfhandler.go b/internal/generate/bpfhandler.go index 95a14b0..3d3db4a 100644 --- a/internal/generate/bpfhandler.go +++ b/internal/generate/bpfhandler.go @@ -281,7 +281,7 @@ func generateExtraPipe(f *Format, isEnter bool) string { // that captures the flags argument. Syscalls not listed here default to "0". // To add a new eventfd-like syscall, register its flags expression below. var eventfdFlagsExpr = map[string]string{ - "sys_enter_epoll_create": "(__s32)ctx->args[0]", + "sys_enter_epoll_create": "0", // epoll_create(size) has no flags argument "sys_enter_epoll_create1": "(__s32)ctx->args[0]", "sys_enter_inotify_init1": "(__s32)ctx->args[0]", "sys_enter_fanotify_init": "(__s32)ctx->args[0]", @@ -292,7 +292,7 @@ var eventfdFlagsExpr = map[string]string{ "sys_enter_userfaultfd": "(__s32)ctx->args[0]", "sys_enter_signalfd4": "(__s32)ctx->args[3]", "sys_enter_timerfd_create": "(__s32)ctx->args[1]", - "sys_enter_pidfd_open": "(__s32)ctx->args[0]", + "sys_enter_pidfd_open": "(__s32)ctx->args[1]", // pidfd_open(pid, flags): flags at args[1] "sys_enter_fsmount": "(__s32)ctx->args[1]", "sys_enter_fsopen": "(__s32)ctx->args[1]", } -- cgit v1.2.3