feat: add syscall aggregate sampling infrastructure (task 17)

3 files changed, 2336 insertions, 1 deletions

diff --git a/internal/c/filter.c b/internal/c/filter.c
index 55632e4..88c4fa0 100644
--- a/internal/c/filter.c
+++ b/internal/c/filter.c
@@ -2,6 +2,104 @@
 
 #define ACCEPT 0
 #define FILTER 1
+#define IOR_HISTOGRAM_BUCKETS 8
+
+static __always_inline __u32 ior_histogram_bucket_index(__u64 duration_ns) {
+    if (duration_ns < 1000)
+        return 0;
+    if (duration_ns < 10000)
+        return 1;
+    if (duration_ns < 100000)
+        return 2;
+    if (duration_ns < 1000000)
+        return 3;
+    if (duration_ns < 10000000)
+        return 4;
+    if (duration_ns < 100000000)
+        return 5;
+    if (duration_ns < 1000000000)
+        return 6;
+    return 7;
+}
+
+static __always_inline void ior_update_syscall_aggregate(__u32 enter_trace_id, __u64 duration_ns, __s64 ret) {
+    __u32 bucket_idx;
+    struct syscall_aggregate *existing;
+    struct syscall_aggregate fresh = {};
+
+    existing = bpf_map_lookup_elem(&syscall_aggregate_map, &enter_trace_id);
+    bucket_idx = ior_histogram_bucket_index(duration_ns);
+    if (bucket_idx >= IOR_HISTOGRAM_BUCKETS)
+        bucket_idx = IOR_HISTOGRAM_BUCKETS - 1;
+
+    if (existing) {
+        existing->count += 1;
+        existing->total_duration_ns += duration_ns;
+        if (ret < 0)
+            existing->errors += 1;
+        if (existing->count == 1 || duration_ns < existing->min_duration_ns)
+            existing->min_duration_ns = duration_ns;
+        if (duration_ns > existing->max_duration_ns)
+            existing->max_duration_ns = duration_ns;
+        existing->duration_histogram[bucket_idx] += 1;
+        return;
+    }
+
+    fresh.count = 1;
+    fresh.total_duration_ns = duration_ns;
+    fresh.min_duration_ns = duration_ns;
+    fresh.max_duration_ns = duration_ns;
+    if (ret < 0)
+        fresh.errors = 1;
+    fresh.duration_histogram[bucket_idx] = 1;
+    bpf_map_update_elem(&syscall_aggregate_map, &enter_trace_id, &fresh, BPF_ANY);
+}
+
+static __always_inline int ior_should_emit_trace(__u32 enter_trace_id) {
+    __u32 default_rate = 1;
+    __u32 *configured = bpf_map_lookup_elem(&syscall_sampling_rate_map, &enter_trace_id);
+    __u32 rate = configured ? *configured : default_rate;
+
+    // A zero rate means aggregate-only mode for this syscall.
+    if (rate == 0)
+        return 0;
+    if (rate == 1)
+        return 1;
+    return (bpf_get_prandom_u32() % rate) == 0;
+}
+
+static __always_inline int ior_on_syscall_enter(__u32 tid, __u32 enter_trace_id) {
+    struct syscall_enter_state state = {};
+
+    state.start_ns = bpf_ktime_get_boot_ns();
+    state.enter_trace_id = enter_trace_id;
+    state.emit_event = ior_should_emit_trace(enter_trace_id) ? 1 : 0;
+    bpf_map_update_elem(&syscall_enter_state_map, &tid, &state, BPF_ANY);
+    return state.emit_event != 0;
+}
+
+static __always_inline int ior_on_syscall_exit(__u32 tid, __u32 exit_trace_id, __s64 ret) {
+    __u64 now;
+    __u64 duration = 0;
+    __u8 emit_event = 1;
+    struct syscall_enter_state *state;
+
+    state = bpf_map_lookup_elem(&syscall_enter_state_map, &tid);
+    if (!state)
+        return 1;
+
+    now = bpf_ktime_get_boot_ns();
+    if (now >= state->start_ns)
+        duration = now - state->start_ns;
+
+    // A tracepoint pair uses enter_id == exit_id + 1 in this codebase.
+    if (state->enter_trace_id == exit_trace_id + 1)
+        ior_update_syscall_aggregate(state->enter_trace_id, duration, ret);
+
+    emit_event = state->emit_event;
+    bpf_map_delete_elem(&syscall_enter_state_map, &tid);
+    return emit_event != 0;
+}
 
 static __always_inline int filter(__u32 *pid, __u32 *tid) {
     u64 pid_tgid = bpf_get_current_pid_tgid();
@@ -21,4 +119,3 @@ static __always_inline int filter(__u32 *pid, __u32 *tid) {
 
     return FILTER;
 }
-
diff --git a/internal/c/generated_tracepoints.c b/internal/c/generated_tracepoints.c
index ad11b06..68aa8a7 100644
--- a/internal/c/generated_tracepoints.c
+++ b/internal/c/generated_tracepoints.c
@@ -743,6 +743,9 @@ int handle_sys_enter_socket(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_SOCKET))
+        return 0;
+
     struct socket_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct socket_event), 0);
     if (!ev)
         return 0;
@@ -767,6 +770,9 @@ int handle_sys_exit_socket(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_SOCKET, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -790,6 +796,9 @@ int handle_sys_enter_socketpair(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_SOCKETPAIR))
+        return 0;
+
     struct socketpair_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct socketpair_event), 0);
     if (!ev)
         return 0;
@@ -823,6 +832,9 @@ int handle_sys_exit_socketpair(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_SOCKETPAIR, ctx->ret))
+        return 0;
+
     struct socketpair_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct socketpair_event), 0);
     if (!ev)
         return 0;
@@ -869,6 +881,9 @@ int handle_sys_enter_bind(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_BIND))
+        return 0;
+
     struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
     if (!ev)
         return 0;
@@ -891,6 +906,9 @@ int handle_sys_exit_bind(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_BIND, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -914,6 +932,9 @@ int handle_sys_enter_listen(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_LISTEN))
+        return 0;
+
     struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
     if (!ev)
         return 0;
@@ -936,6 +957,9 @@ int handle_sys_exit_listen(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_LISTEN, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -959,6 +983,9 @@ int handle_sys_enter_accept4(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_ACCEPT4))
+        return 0;
+
     struct accept_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct accept_event), 0);
     if (!ev)
         return 0;
@@ -982,6 +1009,9 @@ int handle_sys_exit_accept4(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_ACCEPT4, ctx->ret))
+        return 0;
+
     struct accept_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct accept_event), 0);
     if (!ev)
         return 0;
@@ -1005,6 +1035,9 @@ int handle_sys_enter_accept(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_ACCEPT))
+        return 0;
+
     struct accept_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct accept_event), 0);
     if (!ev)
         return 0;
@@ -1028,6 +1061,9 @@ int handle_sys_exit_accept(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_ACCEPT, ctx->ret))
+        return 0;
+
     struct accept_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct accept_event), 0);
     if (!ev)
         return 0;
@@ -1051,6 +1087,9 @@ int handle_sys_enter_connect(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_CONNECT))
+        return 0;
+
     struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
     if (!ev)
         return 0;
@@ -1073,6 +1112,9 @@ int handle_sys_exit_connect(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_CONNECT, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -1096,6 +1138,9 @@ int handle_sys_enter_getsockname(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_GETSOCKNAME))
+        return 0;
+
     struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
     if (!ev)
         return 0;
@@ -1118,6 +1163,9 @@ int handle_sys_exit_getsockname(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_GETSOCKNAME, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -1141,6 +1189,9 @@ int handle_sys_enter_getpeername(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_GETPEERNAME))
+        return 0;
+
     struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
     if (!ev)
         return 0;
@@ -1163,6 +1214,9 @@ int handle_sys_exit_getpeername(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_GETPEERNAME, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -1186,6 +1240,9 @@ int handle_sys_enter_sendto(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_SENDTO))
+        return 0;
+
     struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
     if (!ev)
         return 0;
@@ -1208,6 +1265,9 @@ int handle_sys_exit_sendto(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_SENDTO, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -1231,6 +1291,9 @@ int handle_sys_enter_recvfrom(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_RECVFROM))
+        return 0;
+
     struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
     if (!ev)
         return 0;
@@ -1253,6 +1316,9 @@ int handle_sys_exit_recvfrom(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_RECVFROM, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -1276,6 +1342,9 @@ int handle_sys_enter_setsockopt(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_SETSOCKOPT))
+        return 0;
+
     struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
     if (!ev)
         return 0;
@@ -1298,6 +1367,9 @@ int handle_sys_exit_setsockopt(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_SETSOCKOPT, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -1321,6 +1393,9 @@ int handle_sys_enter_getsockopt(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_GETSOCKOPT))
+        return 0;
+
     struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
     if (!ev)
         return 0;
@@ -1343,6 +1418,9 @@ int handle_sys_exit_getsockopt(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_GETSOCKOPT, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -1366,6 +1444,9 @@ int handle_sys_enter_shutdown(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_SHUTDOWN))
+        return 0;
+
     struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
     if (!ev)
         return 0;
@@ -1388,6 +1469,9 @@ int handle_sys_exit_shutdown(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_SHUTDOWN, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -1411,6 +1495,9 @@ int handle_sys_enter_sendmsg(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_SENDMSG))
+        return 0;
+
     struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
     if (!ev)
         return 0;
@@ -1433,6 +1520,9 @@ int handle_sys_exit_sendmsg(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_SENDMSG, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -1456,6 +1546,9 @@ int handle_sys_enter_sendmmsg(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_SENDMMSG))
+        return 0;
+
     struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
     if (!ev)
         return 0;
@@ -1478,6 +1571,9 @@ int handle_sys_exit_sendmmsg(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_SENDMMSG, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -1501,6 +1597,9 @@ int handle_sys_enter_recvmsg(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_RECVMSG))
+        return 0;
+
     struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
     if (!ev)
         return 0;
@@ -1523,6 +1622,9 @@ int handle_sys_exit_recvmsg(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_RECVMSG, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -1546,6 +1648,9 @@ int handle_sys_enter_recvmmsg(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_RECVMMSG))
+        return 0;
+
     struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
     if (!ev)
         return 0;
@@ -1568,6 +1673,9 @@ int handle_sys_exit_recvmmsg(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_RECVMMSG, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -1591,6 +1699,9 @@ int handle_sys_enter_getrandom(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_GETRANDOM))
+        return 0;
+
     struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
     if (!ev)
         return 0;
@@ -1612,6 +1723,9 @@ int handle_sys_exit_getrandom(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_GETRANDOM, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -1635,6 +1749,9 @@ int handle_sys_enter_io_uring_register(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_IO_URING_REGISTER))
+        return 0;
+
     struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
     if (!ev)
         return 0;
@@ -1657,6 +1774,9 @@ int handle_sys_exit_io_uring_register(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_IO_URING_REGISTER, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -1680,6 +1800,9 @@ int handle_sys_enter_io_uring_enter(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_IO_URING_ENTER))
+        return 0;
+
     struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
     if (!ev)
         return 0;
@@ -1702,6 +1825,9 @@ int handle_sys_exit_io_uring_enter(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_IO_URING_ENTER, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -1725,6 +1851,9 @@ int handle_sys_enter_io_uring_setup(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_IO_URING_SETUP))
+        return 0;
+
     struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
     if (!ev)
         return 0;
@@ -1746,6 +1875,9 @@ int handle_sys_exit_io_uring_setup(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_IO_URING_SETUP, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -1769,6 +1901,9 @@ int handle_sys_enter_ioprio_set(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_IOPRIO_SET))
+        return 0;
+
     struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
     if (!ev)
         return 0;
@@ -1790,6 +1925,9 @@ int handle_sys_exit_ioprio_set(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_IOPRIO_SET, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -1813,6 +1951,9 @@ int handle_sys_enter_ioprio_get(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_IOPRIO_GET))
+        return 0;
+
     struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
     if (!ev)
         return 0;
@@ -1834,6 +1975,9 @@ int handle_sys_exit_ioprio_get(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_IOPRIO_GET, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -1857,6 +2001,9 @@ int handle_sys_enter_landlock_create_ruleset(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_LANDLOCK_CREATE_RULESET))
+        return 0;
+
     struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
     if (!ev)
         return 0;
@@ -1878,6 +2025,9 @@ int handle_sys_exit_landlock_create_ruleset(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_LANDLOCK_CREATE_RULESET, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -1901,6 +2051,9 @@ int handle_sys_enter_landlock_add_rule(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_LANDLOCK_ADD_RULE))
+        return 0;
+
     struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
     if (!ev)
         return 0;
@@ -1922,6 +2075,9 @@ int handle_sys_exit_landlock_add_rule(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_LANDLOCK_ADD_RULE, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -1945,6 +2101,9 @@ int handle_sys_enter_landlock_restrict_self(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_LANDLOCK_RESTRICT_SELF))
+        return 0;
+
     struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
     if (!ev)
         return 0;
@@ -1966,6 +2125,9 @@ int handle_sys_exit_landlock_restrict_self(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_LANDLOCK_RESTRICT_SELF, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -1989,6 +2151,9 @@ int handle_sys_enter_lsm_set_self_attr(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_LSM_SET_SELF_ATTR))
+        return 0;
+
     struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
     if (!ev)
         return 0;
@@ -2010,6 +2175,9 @@ int handle_sys_exit_lsm_set_self_attr(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_LSM_SET_SELF_ATTR, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -2033,6 +2201,9 @@ int handle_sys_enter_lsm_get_self_attr(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_LSM_GET_SELF_ATTR))
+        return 0;
+
     struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
     if (!ev)
         return 0;
@@ -2054,6 +2225,9 @@ int handle_sys_exit_lsm_get_self_attr(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_LSM_GET_SELF_ATTR, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -2077,6 +2251,9 @@ int handle_sys_enter_lsm_list_modules(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_LSM_LIST_MODULES))
+        return 0;
+
     struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
     if (!ev)
         return 0;
@@ -2098,6 +2275,9 @@ int handle_sys_exit_lsm_list_modules(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_LSM_LIST_MODULES, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -2121,6 +2301,9 @@ int handle_sys_enter_add_key(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_ADD_KEY))
+        return 0;
+
     struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
     if (!ev)
         return 0;
@@ -2142,6 +2325,9 @@ int handle_sys_exit_add_key(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_ADD_KEY, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -2165,6 +2351,9 @@ int handle_sys_enter_request_key(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_REQUEST_KEY))
+        return 0;
+
     struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
     if (!ev)
         return 0;
@@ -2186,6 +2375,9 @@ int handle_sys_exit_request_key(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_REQUEST_KEY, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -2209,6 +2401,9 @@ int handle_sys_enter_keyctl(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_KEYCTL))
+        return 0;
+
     struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
     if (!ev)
         return 0;
@@ -2230,6 +2425,9 @@ int handle_sys_exit_keyctl(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_KEYCTL, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -2253,6 +2451,9 @@ int handle_sys_enter_mq_open(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_MQ_OPEN))
+        return 0;
+
     struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
     if (!ev)
         return 0;
@@ -2274,6 +2475,9 @@ int handle_sys_exit_mq_open(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_MQ_OPEN, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -2297,6 +2501,9 @@ int handle_sys_enter_mq_unlink(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_MQ_UNLINK))
+        return 0;
+
     struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
     if (!ev)
         return 0;
@@ -2318,6 +2525,9 @@ int handle_sys_exit_mq_unlink(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_MQ_UNLINK, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -2341,6 +2551,9 @@ int handle_sys_enter_mq_timedsend(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_MQ_TIMEDSEND))
+        return 0;
+
     struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
     if (!ev)
         return 0;
@@ -2362,6 +2575,9 @@ int handle_sys_exit_mq_timedsend(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_MQ_TIMEDSEND, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -2385,6 +2601,9 @@ int handle_sys_enter_mq_timedreceive(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_MQ_TIMEDRECEIVE))
+        return 0;
+
     struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
     if (!ev)
         return 0;
@@ -2406,6 +2625,9 @@ int handle_sys_exit_mq_timedreceive(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_MQ_TIMEDRECEIVE, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -2429,6 +2651,9 @@ int handle_sys_enter_mq_notify(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_MQ_NOTIFY))
+        return 0;
+
     struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
     if (!ev)
         return 0;
@@ -2450,6 +2675,9 @@ int handle_sys_exit_mq_notify(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_MQ_NOTIFY, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -2473,6 +2701,9 @@ int handle_sys_enter_mq_getsetattr(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_MQ_GETSETATTR))
+        return 0;
+
     struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
     if (!ev)
         return 0;
@@ -2494,6 +2725,9 @@ int handle_sys_exit_mq_getsetattr(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_MQ_GETSETATTR, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -2517,6 +2751,9 @@ int handle_sys_enter_shmget(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_SHMGET))
+        return 0;
+
     struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
     if (!ev)
         return 0;
@@ -2538,6 +2775,9 @@ int handle_sys_exit_shmget(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_SHMGET, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -2561,6 +2801,9 @@ int handle_sys_enter_shmctl(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_SHMCTL))
+        return 0;
+
     struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
     if (!ev)
         return 0;
@@ -2582,6 +2825,9 @@ int handle_sys_exit_shmctl(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_SHMCTL, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -2605,6 +2851,9 @@ int handle_sys_enter_shmat(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_SHMAT))
+        return 0;
+
     struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
     if (!ev)
         return 0;
@@ -2626,6 +2875,9 @@ int handle_sys_exit_shmat(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_SHMAT, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -2649,6 +2901,9 @@ int handle_sys_enter_shmdt(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_SHMDT))
+        return 0;
+
     struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
     if (!ev)
         return 0;
@@ -2670,6 +2925,9 @@ int handle_sys_exit_shmdt(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_SHMDT, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -2693,6 +2951,9 @@ int handle_sys_enter_semget(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_SEMGET))
+        return 0;
+
     struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
     if (!ev)
         return 0;
@@ -2714,6 +2975,9 @@ int handle_sys_exit_semget(struct syscall_trace_exit *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_exit(tid, SYS_EXIT_SEMGET, ctx->ret))
+        return 0;
+
     struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
     if (!ev)
         return 0;
@@ -2737,6 +3001,9 @@ int handle_sys_enter_semctl(struct syscall_trace_enter *ctx) {
     if (filter(&pid, &tid))
         return 0;
 
+    if (!ior_on_syscall_enter(tid, SYS_ENTER_SEMCTL))
+        return 0;
+
     struct null_event *ev = bpf_ringbuf_reserve(&event_map, size