fix(prober): skip readdir on pseudo filesystems (/proc, /sys, cgroup, ...)

read/write/open already filter pseudo-filesystems via is_regular_file(), but the
readdir probe (iterate_dir) operates on a directory and so was never filtered.
As a result /proc-walking monitors dominated the trace: analysis of the v4
capture showed readdir was ~35% of ALL VFS events, and htop alone — reading
/proc/<pid>/task on every refresh — was ~27% of all events, none of it real
storage I/O.

- Factor the (previously duplicated) pseudo-fs magic denylist into a single
  is_pseudo_fs_magic() helper, plus an is_pseudo_fs_file() convenience wrapper.
  is_regular_file()/is_regular_file_from_path() now call it (no behavior change —
  identical magic set, including tmpfs).
- trace_readdir() now returns early when the directory lives on a pseudo fs.

Effect: drops the /proc/sys/cgroup readdir flood at the source (~25-30% fewer
fs events on this workload), cutting trace size, tracer overhead, and the
observer effect from monitoring tools and the tracer's own /proc polling. Real
storage readdir (ext4/overlayfs/squashfs/nfs/...) is unaffected.

tmpfs is kept in the denylist to preserve existing read/write behavior; to also
capture tmpfs (/tmp, /dev/shm) as real I/O, drop TMPFS_MAGIC from
is_pseudo_fs_magic() — deferred because its volume impact (esp. vLLM /dev/shm)
needs a real-run measurement.

No eBPF C compile-tested here (needs clang+BCC+root); run scripts/smoke_test.sh.
pytest: 71 passed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: 1a1a11a

src/tracer/prober/prober.c

@@ -907,29 +907,22 @@ static __always_inline void get_file_source(struct file *file, u32 *dev,
 }
 
 /**
- * @brief Check if a file is a regular file (not virtual/pseudo filesystem)
- *
- * Filters out pseudo-filesystems (proc, sys, devtmpfs, etc.) to focus
- * tracing on real storage I/O. Uses filesystem magic numbers for detection.
- *
- * @param file  Kernel file structure pointer
- * @return      true if regular file on real filesystem, false otherwise
+ * @brief True if a superblock magic belongs to a pseudo / virtual filesystem
+ *        that carries no durable storage I/O (procfs, sysfs, cgroup, tracefs,
+ *        debugfs, bpffs, sockets, pipes, ptys, ...).
+ *
+ * Single source of truth for the pseudo-fs denylist, used by both the regular-
+ * file checks (read/write/open) and the directory-iteration probe (readdir).
+ * Skipping these keeps the trace focused on real storage and removes the large
+ * readdir flood from /proc-walking monitors (htop/top/ps) and the tracer's own
+ * /proc polling — see analysis: ~27% of all VFS events were htop reading
+ * /proc/<pid>/task.
+ *
+ * NOTE: TMPFS_MAGIC is listed here to preserve the existing read/write filtering
+ * behavior unchanged. To also capture tmpfs (/tmp, /dev/shm) as real I/O, remove
+ * the TMPFS_MAGIC case below — it then applies uniformly to every op.
  */
-static bool is_regular_file(struct file *file) {
-  bool is_reg, is_virtual;
-  if (!file || !file->f_path.dentry || !file->f_path.dentry->d_inode ||
-      !file->f_path.dentry->d_sb) {
-    return false;
-  }
-  umode_t mode;
-  bpf_probe_read_kernel(&mode, sizeof(mode),
-                        &file->f_path.dentry->d_inode->i_mode);
-  is_reg = S_ISREG(mode);  /* Check if regular file (not dir/socket/pipe) */
-
-  struct super_block *sb = file->f_path.dentry->d_sb;
-  unsigned long magic = 0;
-  bpf_probe_read_kernel(&magic, sizeof(magic), &sb->s_magic);
-
+static __always_inline bool is_pseudo_fs_magic(unsigned long magic) {
   switch (magic) {
   case PROC_SUPER_MAGIC:
   case SYSFS_MAGIC:
@@ -948,14 +941,48 @@ static bool is_regular_file(struct file *file) {
   case TRACEFS_MAGIC:
   case 0x63677270:  /* CGROUP2_SUPER_MAGIC — cgroup v2 unified hierarchy */
   case 0xCAFE4A11:  /* BPF_FS_MAGIC — bpffs */
-  case 0x19800202:
-    is_virtual = true;
-    break;
+  case 0x19800202:  /* mqueue / eventpoll / aio-ring family */
+    return true;
   default:
-    is_virtual = false;
+    return false;
   }
+}
+
+/**
+ * @brief True if the file lives on a pseudo / virtual filesystem.
+ */
+static __always_inline bool is_pseudo_fs_file(struct file *file) {
+  if (!file) return false;
+  struct dentry *d = NULL;
+  bpf_probe_read_kernel(&d, sizeof(d), &file->f_path.dentry);
+  if (!d) return false;
+  struct super_block *sb = NULL;
+  bpf_probe_read_kernel(&sb, sizeof(sb), &d->d_sb);
+  if (!sb) return false;
+  unsigned long magic = 0;
+  bpf_probe_read_kernel(&magic, sizeof(magic), &sb->s_magic);
+  return is_pseudo_fs_magic(magic);
+}
 
-  return !is_virtual && is_reg;
+/**
+ * @brief Check if a file is a regular file on a real (non-pseudo) filesystem.
+ *
+ * Filters out pseudo-filesystems (proc, sys, devtmpfs, etc.) to focus
+ * tracing on real storage I/O. Uses filesystem magic numbers for detection.
+ *
+ * @param file  Kernel file structure pointer
+ * @return      true if regular file on real filesystem, false otherwise
+ */
+static bool is_regular_file(struct file *file) {
+  if (!file || !file->f_path.dentry || !file->f_path.dentry->d_inode ||
+      !file->f_path.dentry->d_sb) {
+    return false;
+  }
+  umode_t mode;
+  bpf_probe_read_kernel(&mode, sizeof(mode),
+                        &file->f_path.dentry->d_inode->i_mode);
+  if (!S_ISREG(mode)) return false;  /* not dir/socket/pipe/etc. */
+  return !is_pseudo_fs_file(file);
 }
 
 static bool is_regular_file_from_path(const struct path *path) {
@@ -977,30 +1004,7 @@ static bool is_regular_file_from_path(const struct path *path) {
 
   unsigned long magic = 0;
   bpf_probe_read_kernel(&magic, sizeof(magic), &sb->s_magic);
-
-  switch (magic) {
-  case PROC_SUPER_MAGIC:
-  case SYSFS_MAGIC:
-  case TMPFS_MAGIC:
-  case SOCKFS_MAGIC:
-  case DEBUGFS_MAGIC:
-  case DEVPTS_SUPER_MAGIC:
-  case DEVTMPFS_MAGIC:
-  case PIPEFS_MAGIC:
-  case CGROUP_SUPER_MAGIC:
-  case SELINUX_MAGIC:
-  case FUTEXFS_SUPER_MAGIC:
-  case INOTIFYFS_SUPER_MAGIC:
-  case XENFS_SUPER_MAGIC:
-  case RPCAUTH_GSSMAGIC:
-  case TRACEFS_MAGIC:
-  case 0x63677270:  /* CGROUP2_SUPER_MAGIC — cgroup v2 unified hierarchy */
-  case 0xCAFE4A11:  /* BPF_FS_MAGIC — bpffs */
-  case 0x19800202:
-    return false;
-  default:
-    return true;
-  }
+  return !is_pseudo_fs_magic(magic);
 }
 
 /**
@@ -2133,6 +2137,15 @@ int trace_readdir(struct pt_regs *ctx, struct file *file,
     return 0;
   }
 
+  /* Skip directory reads on pseudo filesystems (/proc, /sys, cgroup, ...).
+   * Unlike read/write/open (which go through is_regular_file), readdir operates
+   * on a directory and so was never filtered — and it dominated event volume:
+   * /proc-walking monitors (htop/top/ps reading /proc/<pid>/task) accounted for
+   * ~27% of all VFS events, none of it real storage I/O. */
+  if (is_pseudo_fs_file(file)) {
+    return 0;
+  }
+
   struct data_t data = {};
   data.pid = pid;
   data.ts = bpf_ktime_get_ns();