From 04c0c9abbf079922ce312fe786bdc9986c31b665 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Mon, 1 Jun 2026 15:24:28 +0300 Subject: fix(classify): assign alarm to FamilyTime, not Misc MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit alarm(2) arranges for a SIGALRM after a given number of seconds; it is a simplified setitimer(ITIMER_REAL) and, per alarm(2) NOTES, "alarm() and setitimer(2) share the same timer; calls to one will interfere with use of the other." The syscallFamilies table omitted alarm, so it fell through to FamilyMisc while its siblings setitimer/getitimer/timer_create were correctly FamilyTime — an adjtimex-style misclassification (cf. 7243b7c). Add alarm -> FamilyTime and move it from Misc to Time in the tracing plan; regenerate the family maps (trace IDs 468/469 now FamilyTime, "alarm": "Time"). Kind classification (KindNull/null_event: the single arg is an unsigned int seconds, no fd/path) and the UNCLASSIFIED return (seconds remaining, not a byte count; alarm never fails) were already correct. Also harden the misc-basic integration test with a deterministic enter_alarm assertion (alarm(0) is issued unconditionally by the scenario; the syscall-entry tracepoint always fires) so the alarm enter path is covered end-to-end even though alarm is now FamilyTime rather than Misc. Co-Authored-By: Claude Opus 4.8 --- internal/tracepoints/generated_tracepoints.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'internal/tracepoints') diff --git a/internal/tracepoints/generated_tracepoints.go b/internal/tracepoints/generated_tracepoints.go index 152fcf5..1fa2a27 100644 --- a/internal/tracepoints/generated_tracepoints.go +++ b/internal/tracepoints/generated_tracepoints.go @@ -742,7 +742,7 @@ var syscallFamilies = map[string]string{ "acct": "Misc", "add_key": "Security", "adjtimex": "Time", - "alarm": "Misc", + "alarm": "Time", "arch_prctl": "Process", "bind": "Network", "bpf": "Security", -- cgit v1.2.3