From 49b16417d9f52c8ddb48b158b73ccda31fd26982 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Fri, 29 May 2026 10:13:18 +0300 Subject: family: classify futex syscalls as IPC instead of Misc Audit of futex_wake found that the futex family syscalls (futex, futex_wait, futex_wake, futex_requeue, futex_waitv) were absent from the syscallFamilies map and fell through to FamilyMisc. Per futex(2) ("fast user-space locking"), these are shared-memory synchronization/IPC primitives, conceptually identical to the System V semaphores (semop/semget) already tagged FamilyIPC. Group them under IPC so per-family aggregation/reporting bins them with the other synchronization primitives. Argument and return-value handling were already correct: futex_wake's first arg (uaddr) is a userspace pointer, captured via KindFutex (null_event), and the exit ret_event records the woken-waiter count (>=0) or -1 on error. Add lock-in unit tests in family_test.go and regenerate the C/Go artifacts (generated_tracepoints.go, generated_types.go). Co-Authored-By: Claude Opus 4.8 --- internal/generate/family.go | 10 ++++++++++ internal/generate/family_test.go | 10 ++++++++++ 2 files changed, 20 insertions(+) (limited to 'internal/generate') diff --git a/internal/generate/family.go b/internal/generate/family.go index ff75b5a..a883bf8 100644 --- a/internal/generate/family.go +++ b/internal/generate/family.go @@ -41,6 +41,16 @@ var syscallFamilies = map[string]SyscallFamily{ "shmctl": FamilyIPC, "shmdt": FamilyIPC, "shmget": FamilyIPC, "signalfd": FamilyIPC, "signalfd4": FamilyIPC, "timerfd_create": FamilyIPC, "timerfd_gettime": FamilyIPC, "timerfd_settime": FamilyIPC, "userfaultfd": FamilyIPC, + // Futexes ("fast user-space locking", futex(2)) are shared-memory + // synchronization/IPC primitives in the same vein as the System V + // semaphores (semop/semget) above; group them under IPC rather than + // letting them fall through to Misc. Covers the classic futex() plus the + // Linux 6.7+ split syscalls (futex_wait/futex_wake/futex_requeue) and + // futex_waitv. The futex word is a userspace pointer, so argument capture + // is handled by KindFutex (null_event); the family tag only affects + // per-family aggregation/reporting. + "futex": FamilyIPC, "futex_wait": FamilyIPC, "futex_wake": FamilyIPC, + "futex_requeue": FamilyIPC, "futex_waitv": FamilyIPC, "brk": FamilyMemory, "madvise": FamilyMemory, "map_shadow_stack": FamilyMemory, "mbind": FamilyMemory, "membarrier": FamilyMemory, "migrate_pages": FamilyMemory, diff --git a/internal/generate/family_test.go b/internal/generate/family_test.go index 3d6f3bb..98deab5 100644 --- a/internal/generate/family_test.go +++ b/internal/generate/family_test.go @@ -19,6 +19,16 @@ func TestClassifySyscallFamily(t *testing.T) { {"sys_enter_epoll_wait", FamilyPolling}, {"sys_enter_io_uring_enter", FamilyAIO}, {"sys_enter_bpf", FamilySecurity}, + // Futexes are shared-memory synchronization/IPC primitives ("fast + // user-space locking", futex(2)); the classic futex() and the Linux + // 6.7+ split syscalls all classify as IPC alongside the System V + // semaphores, not Misc. + {"sys_enter_futex", FamilyIPC}, + {"sys_enter_futex_wait", FamilyIPC}, + {"sys_enter_futex_wake", FamilyIPC}, + {"sys_exit_futex_wake", FamilyIPC}, + {"sys_enter_futex_requeue", FamilyIPC}, + {"sys_enter_futex_waitv", FamilyIPC}, // x86 I/O-port / CPU-state syscalls are not in the explicit family // table and intentionally fall through to Misc (ioperm/iopl/modify_ldt // set port-access or LDT state, not file I/O). arch_prctl/personality -- cgit v1.2.3