From 2e32f235adee23eea2349c83312bb58f0ee6c7da Mon Sep 17 00:00:00 2001
From: Paul Buetow <paul@buetow.org>
Date: Thu, 21 May 2026 17:52:23 +0300
Subject: 57 add bpf syscall kind classification

---
 internal/tracepoints/dimension_selector_test.go | 15 +++++++++++++++
 internal/tracepoints/generated_tracepoints.go   |  2 +-
 2 files changed, 16 insertions(+), 1 deletion(-)

(limited to 'internal/tracepoints')

diff --git a/internal/tracepoints/dimension_selector_test.go b/internal/tracepoints/dimension_selector_test.go
index 439a153..81a49e5 100644
--- a/internal/tracepoints/dimension_selector_test.go
+++ b/internal/tracepoints/dimension_selector_test.go
@@ -138,6 +138,21 @@ func TestParseSelectorWithDimensionsProcKindOnly(t *testing.T) {
 	}
 }
 
+func TestParseSelectorWithDimensionsBpfKindOnly(t *testing.T) {
+	sel, err := ParseSelectorWithDimensions("", "", DimensionSelectorConfig{
+		TraceKinds: "bpf",
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !sel.ShouldAttach("sys_enter_bpf") {
+		t.Fatal("expected bpf to be attached for bpf kind")
+	}
+	if sel.ShouldAttach("sys_enter_openat") {
+		t.Fatal("expected openat to be excluded when only bpf kind is enabled")
+	}
+}
+
 func TestParseSelectorWithDimensionsSyscallOnly(t *testing.T) {
 	sel, err := ParseSelectorWithDimensions("", "", DimensionSelectorConfig{
 		TraceSyscalls: "openat",
diff --git a/internal/tracepoints/generated_tracepoints.go b/internal/tracepoints/generated_tracepoints.go
index cf9296f..146b068 100644
--- a/internal/tracepoints/generated_tracepoints.go
+++ b/internal/tracepoints/generated_tracepoints.go
@@ -1118,7 +1118,7 @@ var syscallKinds = map[string]string{
 	"alarm":                   "null",
 	"arch_prctl":              "null",
 	"bind":                    "fd",
-	"bpf":                     "null",
+	"bpf":                     "bpf",
 	"brk":                     "null",
 	"cachestat":               "fd",
 	"capget":                  "null",
-- 
cgit v1.2.3