From c3177bd82c16429c1bb246d19af76012479f0c01 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Sun, 31 May 2026 19:04:44 +0300 Subject: getxattrat: READ-classify return for xattr-get family consistency getxattrat(2) (Linux 6.13+) returns the xattr value size in bytes, exactly like getxattr/lgetxattr/fgetxattr, but its exit was classified UNCLASSIFIED, so its read bytes were dropped from I/O totals. Classify it as ReadClassified and regenerate the BPF handler (ret_type now READ_CLASSIFIED). Path extraction (args[1], after the dirfd) and the name-not-captured-as-path behaviour were already correct. Update the docs ReadClassified list and the retclassify expectation, and add the first xattr integration coverage: an ioworkload scenario that sets then getxattrat-reads a user xattr on tmpfs, plus a test that asserts enter_getxattrat captures the file path (not the xattr name) and accounts the returned value size as read bytes. Co-Authored-By: Claude Opus 4.8 --- internal/generate/classify.go | 3 +++ internal/generate/retclassify_test.go | 3 +++ 2 files changed, 6 insertions(+) (limited to 'internal/generate') diff --git a/internal/generate/classify.go b/internal/generate/classify.go index f85cb93..3746bd9 100644 --- a/internal/generate/classify.go +++ b/internal/generate/classify.go @@ -588,6 +588,9 @@ var retClassifications = map[string]RetClassification{ "getdents": ReadClassified, "getdents64": ReadClassified, "getxattr": ReadClassified, + // getxattrat (Linux 6.13+) returns the size in bytes of the xattr value, + // exactly like getxattr/lgetxattr/fgetxattr, so it is a read byte-count. + "getxattrat": ReadClassified, "lgetxattr": ReadClassified, "listxattr": ReadClassified, "llistxattr": ReadClassified, diff --git a/internal/generate/retclassify_test.go b/internal/generate/retclassify_test.go index 25c5e71..acd019b 100644 --- a/internal/generate/retclassify_test.go +++ b/internal/generate/retclassify_test.go @@ -5,6 +5,9 @@ import "testing" func TestClassifyRetRead(t *testing.T) { reads := []string{ "fgetxattr", "flistxattr", "getdents", "getdents64", "getxattr", + // getxattrat (Linux 6.13+) returns the xattr value size in bytes, the + // same read byte-count as getxattr/lgetxattr/fgetxattr. + "getxattrat", "lgetxattr", "listxattr", "llistxattr", "pread64", "preadv", "preadv2", "process_vm_readv", "read", "readlink", "readlinkat", "readv", "recvmsg", "recvfrom", "syslog", "mq_timedreceive", "getrandom", "msgrcv", -- cgit v1.2.3