feat: add syscall aggregate sampling infrastructure (task 17)

1 files changed, 10 insertions, 2 deletions

diff --git a/internal/generate/bpfhandler.go b/internal/generate/bpfhandler.go
index e3d0d67..9e6f5d7 100644
--- a/internal/generate/bpfhandler.go
+++ b/internal/generate/bpfhandler.go
@@ -31,10 +31,10 @@ func generateBPFHandler(tp GeneratedTracepoint) string {
 	eventTypeConst := eventTypeConstant(tp.Classification.Kind, isEnter)
 	extra := generateExtra(tp, isEnter)
 
-	return renderHandler(f.Name, ctxStruct, eventStruct, comment, eventTypeConst, extra)
+	return renderHandler(f.Name, ctxStruct, eventStruct, comment, eventTypeConst, extra, isEnter)
 }
 
-func renderHandler(name, ctxStruct, eventStruct, comment, eventTypeConst, extra string) string {
+func renderHandler(name, ctxStruct, eventStruct, comment, eventTypeConst, extra string, isEnter bool) string {
 	var b strings.Builder
 	fmt.Fprintf(&b, "/// %s is a struct %s\n", name, comment)
 	fmt.Fprintf(&b, "SEC(\"tracepoint/syscalls/%s\")\n", name)
@@ -43,6 +43,14 @@ func renderHandler(name, ctxStruct, eventStruct, comment, eventTypeConst, extra
 	b.WriteString("    if (filter(&pid, &tid))\n")
 	b.WriteString("        return 0;\n")
 	b.WriteString("\n")
+	if isEnter {
+		fmt.Fprintf(&b, "    if (!ior_on_syscall_enter(tid, %s))\n", strings.ToUpper(name))
+		b.WriteString("        return 0;\n")
+	} else {
+		fmt.Fprintf(&b, "    if (!ior_on_syscall_exit(tid, %s, ctx->ret))\n", strings.ToUpper(name))
+		b.WriteString("        return 0;\n")
+	}
+	b.WriteString("\n")
 	fmt.Fprintf(&b, "    struct %s *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct %s), 0);\n", eventStruct, eventStruct)
 	b.WriteString("    if (!ev)\n")
 	b.WriteString("        return 0;\n")