fix BPF tracepoint context type for RHEL 9 stock kernel

The BPF handler generator emitted struct trace_event_raw_sys_enter/
trace_event_raw_sys_exit (the BTF-blessed aliases). RHEL 9 carries an
rt-tree backport that adds preempt_lazy_count to struct trace_entry,
which widens those aliases by 8 bytes and shifts args/ret. The actual
tracepoint context the kernel hands the program is still
syscall_trace_enter / syscall_trace_exit, where the offsets did not
move. Programs typed against the wider alias read past max_ctx_offset
and the verifier rejects the attach with EACCES.

Switching the generator to emit syscall_trace_enter/exit lines up with
the real context on RHEL 9 (and is identical on every other distro,
since the two structs only diverge there). Same fix bcc shipped in
iovisor/bcc#4920 and inspektor-gadget did in inspektor-gadget#2546.
Field accesses (ctx->args[N], ctx->ret) are unchanged.

Verified end-to-end on Rocky Linux 9.7 stock 5.14.0-611.5.1.el9_7
(no kernel-ml needed) and Fedora 6.19. README rewritten accordingly:
drops the elrepo kernel-ml step and the trailing 'permission denied'
troubleshooting paragraph; adds a historical note explaining why the
old workaround existed.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

7 files changed, 765 insertions, 769 deletions

diff --git a/README.md b/README.md
index 4462b8a..f5fb268 100644
--- a/README.md
+++ b/README.md
@@ -78,52 +78,26 @@ Important details:
 - `durationToPrevNs` is attributed to the current syscall pair (the one whose `enter` closes the gap).
 - There is no separate "idle" pseudo-event bucket; use the `durationToPrev` count field when aggregated flamegraph output should emphasize inter-syscall time.
 
-## Fedora
-
-To get this running on Fedora 42, run:
-
-```shell
-mkdir -p ~/git
-git clone https://codeberg.org/snonux/ior ~/git/ior
-git clone https://github.com/aquasecurity/libbpfgo ~/git/libbpfgo
-sudo dnf install -y golang clang bpftool elfutils-libelf-devel zlib-static glibc-static libzstd-static
-git -C ~/git/libbpfgo checkout v0.9.2-libbpf-1.5.1
-git -C ~/git/libbpfgo submodule update --init --recursive
-make -C ~/git/libbpfgo libbpfgo-static
-```
-
-Need libelf static, which isn't in any repos. So we need to compile it ourselves.
-
-```
-sudo dnf install rpmdevtools dnf-utils
-dnf download --source elfutils-libelf
-rpm -ivh elfutils-*.src.rpm
-cd ~
-sudo dnf builddep rpmbuild/SPECS/*.spec
-cd ~/rpmbuild/SPECS
-rpmbuild -ba *.spec
-mkdir ~/src
-tar -C ~/src -xvjpf ~/rpmbuild/SOURCES/elfutils-*.tar.bz2
-cd ~/src/elfutils-*
-rm -Rf ~/rpmbuild
-./configure
-make
-sudo cp -v ./libelf/libelf.a /usr/lib64/
-```
-
 ## Rocky Linux 9
 
-Verified on a fresh Rocky Linux 9.7 install (kernel `5.14.0-611.5.1.el9_7`). Two
-caveats up front before the steps:
-
-1. The stock RHEL 9 kernel (`5.14`) ships a partial backport of BPF features. Specifically,
-   `BPF_LINK_CREATE` for `BPF_PERF_EVENT` returns `EACCES` even as root, so `ior` can load
-   the BPF object but cannot attach tracepoints. This is a kernel-side issue, not an `ior`
-   issue (`bpftrace` works because it uses the older `PERF_EVENT_IOC_SET_BPF` ioctl path).
-   The fix below installs `kernel-ml` from ElRepo (`7.0.x` mainline) and reboots into it.
-2. Rocky 9 ships neither `libelf.a` nor `libzstd.a` (no `*-static` packages). Both have
-   to be built from source — the elfutils dance is the same as the Fedora section above;
-   `libzstd.a` needs an extra `make` from the upstream tarball.
+Verified on a fresh Rocky Linux 9.7 install (e.g. kernel `5.14.0-611.5.1.el9_7`,
+exact stamp not required). Runs on the **stock RHEL 9 kernel** — no kernel
+upgrade needed. One build-time caveat:
+
+- Rocky 9 ships neither `libelf.a` nor `libzstd.a` (no `*-static` packages). Both have
+  to be built from source — the elfutils dance is the same as the Fedora section above;
+  `libzstd.a` needs an extra `make` from the upstream tarball.
+
+> Historical note. Earlier versions of `ior` typed BPF tracepoint context as
+> `struct trace_event_raw_sys_enter`/`_exit` (the BTF-emitted alias). RHEL 9
+> backports an `rt`-tree patch that adds `preempt_lazy_count` to `struct
+> trace_entry`, which widens those aliases by 8 bytes and shifts the `args`/`ret`
+> offsets — but the actual context the kernel hands the program is still
+> `struct syscall_trace_enter`/`_exit`, where the offsets did not move. The
+> verifier saw the program reading past `max_ctx_offset` and rejected the
+> attach with `EACCES`. `ior` now uses `syscall_trace_*` directly (matching
+> the [bcc fix](https://github.com/iovisor/bcc/pull/4920) and inspektor-gadget),
+> so the stock kernel works with no workaround.
 
 ```shell
 # 1) Enable repos and install build dependencies (CRB ships static libs).
@@ -158,19 +132,7 @@ tar xzf zstd-1.5.5.tar.gz
 make -C zstd-1.5.5/lib -j$(nproc) libzstd.a
 sudo cp -v zstd-1.5.5/lib/libzstd.a /usr/lib64/
 
-# 5) Install kernel-ml from ElRepo and reboot into it.
-sudo rpm --import https://www.elrepo.org/RPM-GPG-KEY-elrepo.org
-sudo dnf install -y https://www.elrepo.org/elrepo-release-9.el9.elrepo.noarch.rpm
-sudo dnf --enablerepo=elrepo-kernel install -y kernel-ml
-# kernel-ml becomes the default boot entry automatically (grubby --default-kernel
-# after install reports /boot/vmlinuz-7.x...). Old kernel stays available as a
-# fallback boot entry in case the new one misbehaves.
-sudo reboot
-
-# After reboot:
-uname -r   # should be 7.x.x-... (kernel-ml), not 5.14.x
-
-# 6) Clone ior + libbpfgo, pin libbpfgo, build the static archive, install mage.
+# 5) Clone ior + libbpfgo, pin libbpfgo, build the static archive, install mage.
 mkdir -p ~/git
 git clone https://codeberg.org/snonux/ior ~/git/ior
 git clone https://github.com/aquasecurity/libbpfgo ~/git/libbpfgo
@@ -179,21 +141,45 @@ git -C ~/git/libbpfgo submodule update --init --recursive
 make -C ~/git/libbpfgo libbpfgo-static
 go install github.com/magefile/mage@latest
 
-# 7) Generate against the live kernel (the syscall-coverage audit is
+# 6) Generate against the live kernel (the syscall-coverage audit is
 # kernel-specific; IOR_FORCE_GENERATE skips the strict diff against the
 # committed audit which was generated on a different kernel build).
 cd ~/git/ior
 env IOR_FORCE_GENERATE=1 GOTOOLCHAIN=auto mage generate
 env GOTOOLCHAIN=auto mage all
 
-# 8) Smoke test.
+# 7) Smoke test.
 sudo ./ior -plain -duration 5
 ```
 
-If `./ior -plain -duration 5` prints `Probing for 5s` and a stream of CSV rows, the
-install is good. If it instead prints `permission denied` on tracepoint attach, you
-are still on the stock RHEL kernel — verify with `uname -r` and check
-`grubby --default-kernel`.
+If `./ior -plain -duration 5` prints `Probing for 5s` and a stream of CSV rows,
+the install is good.
+
+## Compile once, run everywhere
+
+The full build dance above only has to happen on **one** machine. The resulting
+`ior` binary is portable across Linux hosts: `scp ior other-host:/usr/local/bin/`
+and run it there. Two reasons it works:
+
+- The Go binary is compiled with `-extldflags "-static"` and links libbpf,
+  libelf, libzstd, and zlib as static archives. There is no runtime dependency
+  on the build host's library versions (a couple of glibc resolver functions —
+  `getpwnam_r` and friends — fall back to the target's libc, which is fine on
+  any reasonable distro).
+- The BPF object inside the binary is built with libbpf's CO-RE
+  (Compile-Once, Run-Everywhere) machinery. Field offsets are not baked into
+  the bytecode; libbpf reads the target kernel's BTF
+  (`/sys/kernel/btf/vmlinux`) at load time and patches the program for that
+  kernel. As long as the target ships BTF — true on every Debian, Ubuntu,
+  Fedora, Arch, RHEL, and now ElRepo `kernel-ml` build at the time of
+  writing — the same `ior` binary runs without recompilation.
+
+So in practice: pick one Rocky 9 / Fedora box, do the build dance once, then
+distribute the 23 MB binary to wherever you want to trace. The build host needs
+all the dev tooling; the trace hosts need only a BTF-enabled kernel and `sudo`.
+
+For the eBPF + CO-RE explanation, see Part 2 of the I/O Riot NG blog series:
+[Unveiling I/O Riot NG — Part 2: under the hood](https://foo.zone/gemfeed/unveiling-ior-ng-part-2.html).
 
 ## TUI Flamegraphs
 
diff --git a/internal/c/generated_tracepoints.c b/internal/c/generated_tracepoints.c
index b4d4e0f..5bc3110 100644
--- a/internal/c/generated_tracepoints.c
+++ b/internal/c/generated_tracepoints.c
@@ -86,6 +86,7 @@
 /// Ignoring sys_enter_landlock_restrict_self sys_exit_landlock_restrict_self as possibly not file I/O related
 /// Ignoring sys_enter_listen sys_exit_listen as possibly not file I/O related
 /// Ignoring sys_enter_listmount sys_exit_listmount as possibly not file I/O related
+/// Ignoring sys_enter_listns sys_exit_listns as possibly not file I/O related
 /// Ignoring sys_enter_lsm_get_self_attr sys_exit_lsm_get_self_attr as possibly not file I/O related
 /// Ignoring sys_enter_lsm_list_modules sys_exit_lsm_list_modules as possibly not file I/O related
 /// Ignoring sys_enter_lsm_set_self_attr sys_exit_lsm_set_self_attr as possibly not file I/O related
@@ -250,236 +251,236 @@
 /// Ignoring sys_enter_wait4 sys_exit_wait4 as possibly not file I/O related
 /// Ignoring sys_enter_waitid sys_exit_waitid as possibly not file I/O related
 
-#define SYS_ENTER_IO_URING_REGISTER 1515
-#define SYS_EXIT_IO_URING_REGISTER 1514
-#define SYS_ENTER_IO_URING_ENTER 1496
-#define SYS_EXIT_IO_URING_ENTER 1495
-#define SYS_ENTER_IO_URING_SETUP 1494
-#define SYS_EXIT_IO_URING_SETUP 1493
-#define SYS_ENTER_QUOTACTL_FD 1151
-#define SYS_EXIT_QUOTACTL_FD 1150
-#define SYS_ENTER_NAME_TO_HANDLE_AT 1135
-#define SYS_EXIT_NAME_TO_HANDLE_AT 1134
-#define SYS_ENTER_OPEN_BY_HANDLE_AT 1133
-#define SYS_EXIT_OPEN_BY_HANDLE_AT 1132
-#define SYS_ENTER_FLOCK 1119
-#define SYS_EXIT_FLOCK 1118
-#define SYS_ENTER_IO_SETUP 1105
-#define SYS_EXIT_IO_SETUP 1104
-#define SYS_ENTER_IO_DESTROY 1103
-#define SYS_EXIT_IO_DESTROY 1102
-#define SYS_ENTER_IO_SUBMIT 1101
-#define SYS_EXIT_IO_SUBMIT 1100
-#define SYS_ENTER_IO_CANCEL 1099
-#define SYS_EXIT_IO_CANCEL 1098
-#define SYS_ENTER_IO_GETEVENTS 1097
-#define SYS_EXIT_IO_GETEVENTS 1096
-#define SYS_ENTER_IO_PGETEVENTS 1095
-#define SYS_EXIT_IO_PGETEVENTS 1094
-#define SYS_ENTER_FANOTIFY_MARK 1063
-#define SYS_EXIT_FANOTIFY_MARK 1062
-#define SYS_ENTER_FILE_GETATTR 1053
-#define SYS_EXIT_FILE_GETATTR 1052
-#define SYS_ENTER_FILE_SETATTR 1051
-#define SYS_EXIT_FILE_SETATTR 1050
-#define SYS_ENTER_FSPICK 1047
-#define SYS_EXIT_FSPICK 1046
-#define SYS_ENTER_FSCONFIG 1045
-#define SYS_EXIT_FSCONFIG 1044
-#define SYS_ENTER_STATFS 1043
-#define SYS_EXIT_STATFS 1042
-#define SYS_ENTER_FSTATFS 1041
-#define SYS_EXIT_FSTATFS 1040
-#define SYS_ENTER_GETCWD 1037
-#define SYS_EXIT_GETCWD 1036
-#define SYS_ENTER_UTIMENSAT 1035
-#define SYS_EXIT_UTIMENSAT 1034
-#define SYS_ENTER_FUTIMESAT 1033
-#define SYS_EXIT_FUTIMESAT 1032
-#define SYS_ENTER_SYNC 1027
-#define SYS_EXIT_SYNC 1026
-#define SYS_ENTER_SYNCFS 1025
-#define SYS_EXIT_SYNCFS 1024
-#define SYS_ENTER_FSYNC 1023
-#define SYS_EXIT_FSYNC 1022
-#define SYS_ENTER_FDATASYNC 1021
-#define SYS_EXIT_FDATASYNC 1020
-#define SYS_ENTER_SYNC_FILE_RANGE 1019
-#define SYS_EXIT_SYNC_FILE_RANGE 1018
-#define SYS_ENTER_VMSPLICE 1017
-#define SYS_EXIT_VMSPLICE 1016
-#define SYS_ENTER_SETXATTRAT 978
-#define SYS_EXIT_SETXATTRAT 977
-#define SYS_ENTER_SETXATTR 976
-#define SYS_EXIT_SETXATTR 975
-#define SYS_ENTER_LSETXATTR 974
-#define SYS_EXIT_LSETXATTR 973
-#define SYS_ENTER_FSETXATTR 972
-#define SYS_EXIT_FSETXATTR 971
-#define SYS_ENTER_GETXATTRAT 970
-#define SYS_EXIT_GETXATTRAT 969
-#define SYS_ENTER_GETXATTR 968
-#define SYS_EXIT_GETXATTR 967
-#define SYS_ENTER_LGETXATTR 966
-#define SYS_EXIT_LGETXATTR 965
-#define SYS_ENTER_FGETXATTR 964
-#define SYS_EXIT_FGETXATTR 963
-#define SYS_ENTER_LISTXATTRAT 962
-#define SYS_EXIT_LISTXATTRAT 961
-#define SYS_ENTER_LISTXATTR 960
-#define SYS_EXIT_LISTXATTR 959
-#define SYS_ENTER_LLISTXATTR 958
-#define SYS_EXIT_LLISTXATTR 957
-#define SYS_ENTER_FLISTXATTR 956
-#define SYS_EXIT_FLISTXATTR 955
-#define SYS_ENTER_REMOVEXATTRAT 954
-#define SYS_EXIT_REMOVEXATTRAT 953
-#define SYS_ENTER_REMOVEXATTR 952
-#define SYS_EXIT_REMOVEXATTR 951
-#define SYS_ENTER_LREMOVEXATTR 950
-#define SYS_EXIT_LREMOVEXATTR 949
-#define SYS_ENTER_FREMOVEXATTR 948
-#define SYS_EXIT_FREMOVEXATTR 947
-#define SYS_ENTER_OPEN_TREE 944
-#define SYS_EXIT_OPEN_TREE 943
-#define SYS_ENTER_MOUNT_SETATTR 934
-#define SYS_EXIT_MOUNT_SETATTR 933
-#define SYS_ENTER_OPEN_TREE_ATTR 932
-#define SYS_EXIT_OPEN_TREE_ATTR 931
-#define SYS_ENTER_CLOSE_RANGE 924
-#define SYS_EXIT_CLOSE_RANGE 923
-#define SYS_ENTER_DUP3 922
-#define SYS_EXIT_DUP3 921
-#define SYS_ENTER_DUP2 920
-#define SYS_EXIT_DUP2 919
-#define SYS_ENTER_DUP 918
-#define SYS_EXIT_DUP 917
-#define SYS_ENTER_GETDENTS 904
-#define SYS_EXIT_GETDENTS 903
-#define SYS_ENTER_GETDENTS64 902
-#define SYS_EXIT_GETDENTS64 901
-#define SYS_ENTER_IOCTL 900
-#define SYS_EXIT_IOCTL 899
-#define SYS_ENTER_FCNTL 898
-#define SYS_EXIT_FCNTL 897
-#define SYS_ENTER_MKDIRAT 892
-#define SYS_EXIT_MKDIRAT 891
-#define SYS_ENTER_MKDIR 890
-#define SYS_EXIT_MKDIR 889
-#define SYS_ENTER_RMDIR 888
-#define SYS_EXIT_RMDIR 887
-#define SYS_ENTER_UNLINKAT 886
-#define SYS_EXIT_UNLINKAT 885
-#define SYS_ENTER_UNLINK 884
-#define SYS_EXIT_UNLINK 883
-#define SYS_ENTER_SYMLINKAT 882
-#define SYS_EXIT_SYMLINKAT 881
-#define SYS_ENTER_SYMLINK 880
-#define SYS_EXIT_SYMLINK 879
-#define SYS_ENTER_LINKAT 878
-#define SYS_EXIT_LINKAT 877
-#define SYS_ENTER_LINK 876
-#define SYS_EXIT_LINK 875
-#define SYS_ENTER_RENAMEAT2 874
-#define SYS_EXIT_RENAMEAT2 873
-#define SYS_ENTER_RENAMEAT 872
-#define SYS_EXIT_RENAMEAT 871
-#define SYS_ENTER_RENAME 870
-#define SYS_EXIT_RENAME 869
-#define SYS_ENTER_NEWSTAT 860
-#define SYS_EXIT_NEWSTAT 859
-#define SYS_ENTER_NEWLSTAT 858
-#define SYS_EXIT_NEWLSTAT 857
-#define SYS_ENTER_NEWFSTATAT 856
-#define SYS_EXIT_NEWFSTATAT 855
-#define SYS_ENTER_NEWFSTAT 854
-#define SYS_EXIT_NEWFSTAT 853
-#define SYS_ENTER_READLINKAT 852
-#define SYS_EXIT_READLINKAT 851
-#define SYS_ENTER_READLINK 850
-#define SYS_EXIT_READLINK 849
-#define SYS_ENTER_STATX 848
-#define SYS_EXIT_STATX 847
-#define SYS_ENTER_LSEEK 846
-#define SYS_EXIT_LSEEK 845
-#define SYS_ENTER_READ 844
-#define SYS_EXIT_READ 843
-#define SYS_ENTER_WRITE 842
-#define SYS_EXIT_WRITE 841
-#define SYS_ENTER_PREAD64 840
-#define SYS_EXIT_PREAD64 839
-#define SYS_ENTER_PWRITE64 838
-#define SYS_EXIT_PWRITE64 837
-#define SYS_ENTER_READV 836
-#define SYS_EXIT_READV 835
-#define SYS_ENTER_WRITEV 834
-#define SYS_EXIT_WRITEV 833
-#define SYS_ENTER_PREADV 832
-#define SYS_EXIT_PREADV 831
-#define SYS_ENTER_PREADV2 830
-#define SYS_EXIT_PREADV2 829
-#define SYS_ENTER_PWRITEV 828
-#define SYS_EXIT_PWRITEV 827
-#define SYS_ENTER_PWRITEV2 826
-#define SYS_EXIT_PWRITEV2 825
-#define SYS_ENTER_COPY_FILE_RANGE 822
-#define SYS_EXIT_COPY_FILE_RANGE 821
-#define SYS_ENTER_TRUNCATE 820
-#define SYS_EXIT_TRUNCATE 819
-#define SYS_ENTER_FTRUNCATE 818
-#define SYS_EXIT_FTRUNCATE 817
-#define SYS_ENTER_FALLOCATE 816
-#define SYS_EXIT_FALLOCATE 815
-#define SYS_ENTER_FACCESSAT 814
-#define SYS_EXIT_FACCESSAT 813
-#define SYS_ENTER_FACCESSAT2 812
-#define SYS_EXIT_FACCESSAT2 811
-#define SYS_ENTER_ACCESS 810
-#define SYS_EXIT_ACCESS 809
-#define SYS_ENTER_CHDIR 808
-#define SYS_EXIT_CHDIR 807
-#define SYS_ENTER_FCHDIR 806
-#define SYS_EXIT_FCHDIR 805
-#define SYS_ENTER_CHROOT 804
-#define SYS_EXIT_CHROOT 803
-#define SYS_ENTER_FCHMOD 802
-#define SYS_EXIT_FCHMOD 801
-#define SYS_ENTER_FCHMODAT2 800
-#define SYS_EXIT_FCHMODAT2 799
-#define SYS_ENTER_FCHMODAT 798
-#define SYS_EXIT_FCHMODAT 797
-#define SYS_ENTER_CHMOD 796
-#define SYS_EXIT_CHMOD 795
-#define SYS_ENTER_FCHOWNAT 794
-#define SYS_EXIT_FCHOWNAT 793
-#define SYS_ENTER_CHOWN 792
-#define SYS_EXIT_CHOWN 791
-#define SYS_ENTER_LCHOWN 790
-#define SYS_EXIT_LCHOWN 789
-#define SYS_ENTER_FCHOWN 788
-#define SYS_EXIT_FCHOWN 787
-#define SYS_ENTER_OPEN 786
-#define SYS_EXIT_OPEN 785
-#define SYS_ENTER_OPENAT 784
-#define SYS_EXIT_OPENAT 783
-#define SYS_ENTER_OPENAT2 782
-#define SYS_EXIT_OPENAT2 781
-#define SYS_ENTER_CREAT 780
-#define SYS_EXIT_CREAT 779
-#define SYS_ENTER_CLOSE 778
-#define SYS_EXIT_CLOSE 777
-#define SYS_ENTER_MSYNC 707
-#define SYS_EXIT_MSYNC 706
-#define SYS_ENTER_READAHEAD 613
-#define SYS_EXIT_READAHEAD 612
-#define SYS_ENTER_FADVISE64 611
-#define SYS_EXIT_FADVISE64 610
-#define SYS_ENTER_CACHESTAT 592
-#define SYS_EXIT_CACHESTAT 591
-#define SYS_ENTER_FINIT_MODULE 403
-#define SYS_EXIT_FINIT_MODULE 402
-#define SYS_ENTER_SYSLOG 347
-#define SYS_EXIT_SYSLOG 346
+#define SYS_ENTER_IO_URING_REGISTER 1521
+#define SYS_EXIT_IO_URING_REGISTER 1520
+#define SYS_ENTER_IO_URING_ENTER 1502
+#define SYS_EXIT_IO_URING_ENTER 1501
+#define SYS_ENTER_IO_URING_SETUP 1500
+#define SYS_EXIT_IO_URING_SETUP 1499
+#define SYS_ENTER_QUOTACTL_FD 1155
+#define SYS_EXIT_QUOTACTL_FD 1154
+#define SYS_ENTER_NAME_TO_HANDLE_AT 1139
+#define SYS_EXIT_NAME_TO_HANDLE_AT 1138
+#define SYS_ENTER_OPEN_BY_HANDLE_AT 1137
+#define SYS_EXIT_OPEN_BY_HANDLE_AT 1136
+#define SYS_ENTER_FLOCK 1123
+#define SYS_EXIT_FLOCK 1122
+#define SYS_ENTER_IO_SETUP 1109
+#define SYS_EXIT_IO_SETUP 1108
+#define SYS_ENTER_IO_DESTROY 1107
+#define SYS_EXIT_IO_DESTROY 1106
+#define SYS_ENTER_IO_SUBMIT 1105
+#define SYS_EXIT_IO_SUBMIT 1104
+#define SYS_ENTER_IO_CANCEL 1103
+#define SYS_EXIT_IO_CANCEL 1102
+#define SYS_ENTER_IO_GETEVENTS 1101
+#define SYS_EXIT_IO_GETEVENTS 1100
+#define SYS_ENTER_IO_PGETEVENTS 1099
+#define SYS_EXIT_IO_PGETEVENTS 1098
+#define SYS_ENTER_FANOTIFY_MARK 1067
+#define SYS_EXIT_FANOTIFY_MARK 1066
+#define SYS_ENTER_FILE_GETATTR 1057
+#define SYS_EXIT_FILE_GETATTR 1056
+#define SYS_ENTER_FILE_SETATTR 1055
+#define SYS_EXIT_FILE_SETATTR 1054
+#define SYS_ENTER_FSPICK 1051
+#define SYS_EXIT_FSPICK 1050
+#define SYS_ENTER_FSCONFIG 1049
+#define SYS_EXIT_FSCONFIG 1048
+#define SYS_ENTER_STATFS 1047
+#define SYS_EXIT_STATFS 1046
+#define SYS_ENTER_FSTATFS 1045
+#define SYS_EXIT_FSTATFS 1044
+#define SYS_ENTER_GETCWD 1041
+#define SYS_EXIT_GETCWD 1040
+#define SYS_ENTER_UTIMENSAT 1039
+#define SYS_EXIT_UTIMENSAT 1038
+#define SYS_ENTER_FUTIMESAT 1037
+#define SYS_EXIT_FUTIMESAT 1036
+#define SYS_ENTER_SYNC 1031
+#define SYS_EXIT_SYNC 1030
+#define SYS_ENTER_SYNCFS 1029
+#define SYS_EXIT_SYNCFS 1028
+#define SYS_ENTER_FSYNC 1027
+#define SYS_EXIT_FSYNC 1026
+#define SYS_ENTER_FDATASYNC 1025
+#define SYS_EXIT_FDATASYNC 1024
+#define SYS_ENTER_SYNC_FILE_RANGE 1023
+#define SYS_EXIT_SYNC_FILE_RANGE 1022
+#define SYS_ENTER_VMSPLICE 1021
+#define SYS_EXIT_VMSPLICE 1020
+#define SYS_ENTER_SETXATTRAT 982
+#define SYS_EXIT_SETXATTRAT 981
+#define SYS_ENTER_SETXATTR 980
+#define SYS_EXIT_SETXATTR 979
+#define SYS_ENTER_LSETXATTR 978
+#define SYS_EXIT_LSETXATTR 977
+#define SYS_ENTER_FSETXATTR 976
+#define SYS_EXIT_FSETXATTR 975
+#define SYS_ENTER_GETXATTRAT 974
+#define SYS_EXIT_GETXATTRAT 973
+#define SYS_ENTER_GETXATTR 972
+#define SYS_EXIT_GETXATTR 971
+#define SYS_ENTER_LGETXATTR 970
+#define SYS_EXIT_LGETXATTR 969
+#define SYS_ENTER_FGETXATTR 968
+#define SYS_EXIT_FGETXATTR 967
+#define SYS_ENTER_LISTXATTRAT 966
+#define SYS_EXIT_LISTXATTRAT 965
+#define SYS_ENTER_LISTXATTR 964
+#define SYS_EXIT_LISTXATTR 963
+#define SYS_ENTER_LLISTXATTR 962
+#define SYS_EXIT_LLISTXATTR 961
+#define SYS_ENTER_FLISTXATTR 960
+#define SYS_EXIT_FLISTXATTR 959
+#define SYS_ENTER_REMOVEXATTRAT 958
+#define SYS_EXIT_REMOVEXATTRAT 957
+#define SYS_ENTER_REMOVEXATTR 956
+#define SYS_EXIT_REMOVEXATTR 955
+#define SYS_ENTER_LREMOVEXATTR 954
+#define SYS_EXIT_LREMOVEXATTR 953
+#define SYS_ENTER_FREMOVEXATTR 952
+#define SYS_EXIT_FREMOVEXATTR 951
+#define SYS_ENTER_OPEN_TREE 948
+#define SYS_EXIT_OPEN_TREE 947
+#define SYS_ENTER_MOUNT_SETATTR 938
+#define SYS_EXIT_MOUNT_SETATTR 937
+#define SYS_ENTER_OPEN_TREE_ATTR 936
+#define SYS_EXIT_OPEN_TREE_ATTR 935
+#define SYS_ENTER_CLOSE_RANGE 928
+#define SYS_EXIT_CLOSE_RANGE 927
+#define SYS_ENTER_DUP3 926
+#define SYS_EXIT_DUP3 925
+#define SYS_ENTER_DUP2 924
+#define SYS_EXIT_DUP2 923
+#define SYS_ENTER_DUP 922
+#define SYS_EXIT_DUP 921
+#define SYS_ENTER_GETDENTS 908
+#define SYS_EXIT_GETDENTS 907
+#define SYS_ENTER_GETDENTS64 906
+#define SYS_EXIT_GETDENTS64 905
+#define SYS_ENTER_IOCTL 904
+#define SYS_EXIT_IOCTL 903
+#define SYS_ENTER_FCNTL 902
+#define SYS_EXIT_FCNTL 901
+#define SYS_ENTER_MKDIRAT 896
+#define SYS_EXIT_MKDIRAT 895
+#define SYS_ENTER_MKDIR 894
+#define SYS_EXIT_MKDIR 893
+#define SYS_ENTER_RMDIR 892
+#define SYS_EXIT_RMDIR 891
+#define SYS_ENTER_UNLINKAT 890
+#define SYS_EXIT_UNLINKAT 889
+#define SYS_ENTER_UNLINK 888
+#define SYS_EXIT_UNLINK 887
+#define SYS_ENTER_SYMLINKAT 886
+#define SYS_EXIT_SYMLINKAT 885
+#define SYS_ENTER_SYMLINK 884
+#define SYS_EXIT_SYMLINK 883
+#define SYS_ENTER_LINKAT 882
+#define SYS_EXIT_LINKAT 881
+#define SYS_ENTER_LINK 880
+#define SYS_EXIT_LINK 879
+#define SYS_ENTER_RENAMEAT2 878
+#define SYS_EXIT_RENAMEAT2 877
+#define SYS_ENTER_RENAMEAT 876
+#define SYS_EXIT_RENAMEAT 875
+#define SYS_ENTER_RENAME 874
+#define SYS_EXIT_RENAME 873
+#define SYS_ENTER_NEWSTAT 864
+#define SYS_EXIT_NEWSTAT 863
+#define SYS_ENTER_NEWLSTAT 862
+#define SYS_EXIT_NEWLSTAT 861
+#define SYS_ENTER_NEWFSTATAT 860
+#define SYS_EXIT_NEWFSTATAT 859
+#define SYS_ENTER_NEWFSTAT 858
+#define SYS_EXIT_NEWFSTAT 857
+#define SYS_ENTER_READLINKAT 856
+#define SYS_EXIT_READLINKAT 855
+#define SYS_ENTER_READLINK 854
+#define SYS_EXIT_READLINK 853
+#define SYS_ENTER_STATX 852
+#define SYS_EXIT_STATX 851
+#define SYS_ENTER_LSEEK 850
+#define SYS_EXIT_LSEEK 849
+#define SYS_ENTER_READ 848
+#define SYS_EXIT_READ 847
+#define SYS_ENTER_WRITE 846
+#define SYS_EXIT_WRITE 845
+#define SYS_ENTER_PREAD64 844
+#define SYS_EXIT_PREAD64 843
+#define SYS_ENTER_PWRITE64 842
+#define SYS_EXIT_PWRITE64 841
+#define SYS_ENTER_READV 840
+#define SYS_EXIT_READV 839
+#define SYS_ENTER_WRITEV 838
+#define SYS_EXIT_WRITEV 837
+#define SYS_ENTER_PREADV 836
+#define SYS_EXIT_PREADV 835
+#define SYS_ENTER_PREADV2 834
+#define SYS_EXIT_PREADV2 833
+#define SYS_ENTER_PWRITEV 832
+#define SYS_EXIT_PWRITEV 831
+#define SYS_ENTER_PWRITEV2 830
+#define SYS_EXIT_PWRITEV2 829
+#define SYS_ENTER_COPY_FILE_RANGE 826
+#define SYS_EXIT_COPY_FILE_RANGE 825
+#define SYS_ENTER_TRUNCATE 824
+#define SYS_EXIT_TRUNCATE 823
+#define SYS_ENTER_FTRUNCATE 822
+#define SYS_EXIT_FTRUNCATE 821
+#define SYS_ENTER_FALLOCATE 820
+#define SYS_EXIT_FALLOCATE 819
+#define SYS_ENTER_FACCESSAT 818
+#define SYS_EXIT_FACCESSAT 817
+#define SYS_ENTER_FACCESSAT2 816
+#define SYS_EXIT_FACCESSAT2 815
+#define SYS_ENTER_ACCESS 814
+#define SYS_EXIT_ACCESS 813
+#define SYS_ENTER_CHDIR 812
+#define SYS_EXIT_CHDIR 811
+#define SYS_ENTER_FCHDIR 810
+#define SYS_EXIT_FCHDIR 809
+#define SYS_ENTER_CHROOT 808
+#define SYS_EXIT_CHROOT 807
+#define SYS_ENTER_FCHMOD 806
+#define SYS_EXIT_FCHMOD 805
+#define SYS_ENTER_FCHMODAT2 804
+#define SYS_EXIT_FCHMODAT2 803
+#define SYS_ENTER_FCHMODAT 802
+#define SYS_EXIT_FCHMODAT 801
+#define SYS_ENTER_CHMOD 800
+#define SYS_EXIT_CHMOD 799
+#define SYS_ENTER_FCHOWNAT 798
+#define SYS_EXIT_FCHOWNAT 797
+#define SYS_ENTER_CHOWN 796
+#define SYS_EXIT_CHOWN 795
+#define SYS_ENTER_LCHOWN 794
+#define SYS_EXIT_LCHOWN 793
+#define SYS_ENTER_FCHOWN 792
+#define SYS_EXIT_FCHOWN 791
+#define SYS_ENTER_OPEN 790
+#define SYS_EXIT_OPEN 789
+#define SYS_ENTER_OPENAT 788
+#define SYS_EXIT_OPENAT 787
+#define SYS_ENTER_OPENAT2 786
+#define SYS_EXIT_OPENAT2 785
+#define SYS_ENTER_CREAT 784
+#define SYS_EXIT_CREAT 783
+#define SYS_ENTER_CLOSE 782
+#define SYS_EXIT_CLOSE 781
+#define SYS_ENTER_MSYNC 710
+#define SYS_EXIT_MSYNC 709
+#define SYS_ENTER_READAHEAD 616
+#define SYS_EXIT_READAHEAD 615
+#define SYS_ENTER_FADVISE64 614
+#define SYS_EXIT_FADVISE64 613
+#define SYS_ENTER_CACHESTAT 595
+#define SYS_EXIT_CACHESTAT 594
+#define SYS_ENTER_FINIT_MODULE 406
+#define SYS_EXIT_FINIT_MODULE 405
+#define SYS_ENTER_SYSLOG 350
+#define SYS_EXIT_SYSLOG 349
 #define SYS_ENTER_PIDFD_GETFD 271
 #define SYS_EXIT_PIDFD_GETFD 270
 #define SYS_ENTER_MMAP 100
@@ -487,7 +488,7 @@
 
 /// sys_enter_io_uring_register is a struct fd_event
 SEC("tracepoint/syscalls/sys_enter_io_uring_register")
-int handle_sys_enter_io_uring_register(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_io_uring_register(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -509,7 +510,7 @@ int handle_sys_enter_io_uring_register(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_io_uring_register is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_io_uring_register")
-int handle_sys_exit_io_uring_register(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_io_uring_register(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -532,7 +533,7 @@ int handle_sys_exit_io_uring_register(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_io_uring_enter is a struct fd_event
 SEC("tracepoint/syscalls/sys_enter_io_uring_enter")
-int handle_sys_enter_io_uring_enter(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_io_uring_enter(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -554,7 +555,7 @@ int handle_sys_enter_io_uring_enter(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_io_uring_enter is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_io_uring_enter")
-int handle_sys_exit_io_uring_enter(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_io_uring_enter(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -577,7 +578,7 @@ int handle_sys_exit_io_uring_enter(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_io_uring_setup is a struct null_event
 SEC("tracepoint/syscalls/sys_enter_io_uring_setup")
-int handle_sys_enter_io_uring_setup(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_io_uring_setup(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -598,7 +599,7 @@ int handle_sys_enter_io_uring_setup(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_io_uring_setup is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_io_uring_setup")
-int handle_sys_exit_io_uring_setup(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_io_uring_setup(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -621,7 +622,7 @@ int handle_sys_exit_io_uring_setup(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_quotactl_fd is a struct fd_event
 SEC("tracepoint/syscalls/sys_enter_quotactl_fd")
-int handle_sys_enter_quotactl_fd(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_quotactl_fd(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -643,7 +644,7 @@ int handle_sys_enter_quotactl_fd(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_quotactl_fd is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_quotactl_fd")
-int handle_sys_exit_quotactl_fd(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_quotactl_fd(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -666,7 +667,7 @@ int handle_sys_exit_quotactl_fd(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_name_to_handle_at is a struct path_event
 SEC("tracepoint/syscalls/sys_enter_name_to_handle_at")
-int handle_sys_enter_name_to_handle_at(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_name_to_handle_at(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -689,7 +690,7 @@ int handle_sys_enter_name_to_handle_at(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_name_to_handle_at is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_name_to_handle_at")
-int handle_sys_exit_name_to_handle_at(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_name_to_handle_at(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -712,7 +713,7 @@ int handle_sys_exit_name_to_handle_at(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_open_by_handle_at is a struct open_by_handle_at_event
 SEC("tracepoint/syscalls/sys_enter_open_by_handle_at")
-int handle_sys_enter_open_by_handle_at(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_open_by_handle_at(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -734,7 +735,7 @@ int handle_sys_enter_open_by_handle_at(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_open_by_handle_at is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_open_by_handle_at")
-int handle_sys_exit_open_by_handle_at(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_open_by_handle_at(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -757,7 +758,7 @@ int handle_sys_exit_open_by_handle_at(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_flock is a struct fd_event
 SEC("tracepoint/syscalls/sys_enter_flock")
-int handle_sys_enter_flock(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_flock(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -779,7 +780,7 @@ int handle_sys_enter_flock(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_flock is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_flock")
-int handle_sys_exit_flock(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_flock(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -802,7 +803,7 @@ int handle_sys_exit_flock(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_io_setup is a struct null_event
 SEC("tracepoint/syscalls/sys_enter_io_setup")
-int handle_sys_enter_io_setup(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_io_setup(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -823,7 +824,7 @@ int handle_sys_enter_io_setup(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_io_setup is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_io_setup")
-int handle_sys_exit_io_setup(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_io_setup(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -846,7 +847,7 @@ int handle_sys_exit_io_setup(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_io_destroy is a struct null_event
 SEC("tracepoint/syscalls/sys_enter_io_destroy")
-int handle_sys_enter_io_destroy(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_io_destroy(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -867,7 +868,7 @@ int handle_sys_enter_io_destroy(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_io_destroy is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_io_destroy")
-int handle_sys_exit_io_destroy(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_io_destroy(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -890,7 +891,7 @@ int handle_sys_exit_io_destroy(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_io_submit is a struct null_event
 SEC("tracepoint/syscalls/sys_enter_io_submit")
-int handle_sys_enter_io_submit(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_io_submit(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -911,7 +912,7 @@ int handle_sys_enter_io_submit(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_io_submit is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_io_submit")
-int handle_sys_exit_io_submit(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_io_submit(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -934,7 +935,7 @@ int handle_sys_exit_io_submit(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_io_cancel is a struct null_event
 SEC("tracepoint/syscalls/sys_enter_io_cancel")
-int handle_sys_enter_io_cancel(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_io_cancel(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -955,7 +956,7 @@ int handle_sys_enter_io_cancel(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_io_cancel is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_io_cancel")
-int handle_sys_exit_io_cancel(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_io_cancel(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -978,7 +979,7 @@ int handle_sys_exit_io_cancel(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_io_getevents is a struct null_event
 SEC("tracepoint/syscalls/sys_enter_io_getevents")
-int handle_sys_enter_io_getevents(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_io_getevents(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -999,7 +1000,7 @@ int handle_sys_enter_io_getevents(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_io_getevents is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_io_getevents")
-int handle_sys_exit_io_getevents(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_io_getevents(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1022,7 +1023,7 @@ int handle_sys_exit_io_getevents(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_io_pgetevents is a struct null_event
 SEC("tracepoint/syscalls/sys_enter_io_pgetevents")
-int handle_sys_enter_io_pgetevents(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_io_pgetevents(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1043,7 +1044,7 @@ int handle_sys_enter_io_pgetevents(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_io_pgetevents is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_io_pgetevents")
-int handle_sys_exit_io_pgetevents(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_io_pgetevents(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1066,7 +1067,7 @@ int handle_sys_exit_io_pgetevents(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_fanotify_mark is a struct path_event
 SEC("tracepoint/syscalls/sys_enter_fanotify_mark")
-int handle_sys_enter_fanotify_mark(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_fanotify_mark(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1089,7 +1090,7 @@ int handle_sys_enter_fanotify_mark(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_fanotify_mark is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_fanotify_mark")
-int handle_sys_exit_fanotify_mark(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_fanotify_mark(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1112,7 +1113,7 @@ int handle_sys_exit_fanotify_mark(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_file_getattr is a struct path_event
 SEC("tracepoint/syscalls/sys_enter_file_getattr")
-int handle_sys_enter_file_getattr(struct trace_event_raw_sys_enter *ctx) {
+int handle_sys_enter_file_getattr(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1135,7 +1136,7 @@ int handle_sys_enter_file_getattr(struct trace_event_raw_sys_enter *ctx) {
 
 /// sys_exit_file_getattr is a struct ret_event (UNCLASSIFIED)
 SEC("tracepoint/syscalls/sys_exit_file_getattr")
-int handle_sys_exit_file_getattr(struct trace_event_raw_sys_exit *ctx) {
+int handle_sys_exit_file_getattr(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
     if (filter(&pid, &tid))
         return 0;
@@ -1158,7 +1159,7 @@ int handle_sys_exit_file_getattr(struct trace_event_raw_sys_exit *ctx) {
 
 /// sys_enter_file_setattr is a struct path_event
 SEC("tracepoint/syscalls/sys_enter_file_setattr")
-int handle_sys_enter_file_setattr(struct trace_event_raw_sys_enter *ctx) {