57 add bpf syscall kind classification

2 files changed, 16 insertions, 1 deletions

diff --git a/internal/tracepoints/dimension_selector_test.go b/internal/tracepoints/dimension_selector_test.go
index 439a153..81a49e5 100644
--- a/internal/tracepoints/dimension_selector_test.go
+++ b/internal/tracepoints/dimension_selector_test.go
@@ -138,6 +138,21 @@ func TestParseSelectorWithDimensionsProcKindOnly(t *testing.T) {
 	}
 }
 
+func TestParseSelectorWithDimensionsBpfKindOnly(t *testing.T) {
+	sel, err := ParseSelectorWithDimensions("", "", DimensionSelectorConfig{
+		TraceKinds: "bpf",
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !sel.ShouldAttach("sys_enter_bpf") {
+		t.Fatal("expected bpf to be attached for bpf kind")
+	}
+	if sel.ShouldAttach("sys_enter_openat") {
+		t.Fatal("expected openat to be excluded when only bpf kind is enabled")
+	}
+}
+
 func TestParseSelectorWithDimensionsSyscallOnly(t *testing.T) {
 	sel, err := ParseSelectorWithDimensions("", "", DimensionSelectorConfig{
 		TraceSyscalls: "openat",
diff --git a/internal/tracepoints/generated_tracepoints.go b/internal/tracepoints/generated_tracepoints.go
index cf9296f..146b068 100644
--- a/internal/tracepoints/generated_tracepoints.go
+++ b/internal/tracepoints/generated_tracepoints.go
@@ -1118,7 +1118,7 @@ var syscallKinds = map[string]string{
 	"alarm":                   "null",
 	"arch_prctl":              "null",
 	"bind":                    "fd",
-	"bpf":                     "null",
+	"bpf":                     "bpf",
 	"brk":                     "null",
 	"cachestat":               "fd",
 	"capget":                  "null",