f7 wire eventfd kind for fd-from-air IPC syscalls

12 files changed, 1725 insertions, 1508 deletions

diff --git a/cmd/ioworkload/scenario_ipc.go b/cmd/ioworkload/scenario_ipc.go
index 221c3c9..af22505 100644
--- a/cmd/ioworkload/scenario_ipc.go
+++ b/cmd/ioworkload/scenario_ipc.go
@@ -3,6 +3,7 @@ package main
 import (
 	"fmt"
 	"syscall"
+	"unsafe"
 
 	"golang.org/x/sys/unix"
 )
@@ -54,3 +55,35 @@ func createEventfd(number uintptr, initval, flags uintptr) (int, error) {
 	}
 	return int(fd), nil
 }
+
+func fdFromAirEventfdUsers() error {
+	memfdName, err := syscall.BytePtrFromString("ior-memfd")
+	if err != nil {
+		return fmt.Errorf("memfd name: %w", err)
+	}
+	fd, _, _ := syscall.RawSyscall(unix.SYS_MEMFD_CREATE, uintptr(unsafe.Pointer(memfdName)), uintptr(unix.MFD_CLOEXEC), 0)
+	closeIfValid(int(fd))
+
+	fd, _, _ = syscall.RawSyscall(unix.SYS_MEMFD_SECRET, 0, 0, 0)
+	closeIfValid(int(fd))
+
+	fd, _, _ = syscall.RawSyscall(unix.SYS_USERFAULTFD, uintptr(unix.O_CLOEXEC), 0, 0)
+	closeIfValid(int(fd))
+
+	var mask unix.Sigset_t
+	fd, _, _ = syscall.RawSyscall(unix.SYS_SIGNALFD, ^uintptr(0), uintptr(unsafe.Pointer(&mask)), uintptr(unsafe.Sizeof(mask)))
+	closeIfValid(int(fd))
+
+	fd, _, _ = syscall.RawSyscall(unix.SYS_SIGNALFD4, ^uintptr(0), uintptr(unsafe.Pointer(&mask)), uintptr(unsafe.Sizeof(mask)))
+	closeIfValid(int(fd))
+
+	fd, _, _ = syscall.RawSyscall(unix.SYS_TIMERFD_CREATE, uintptr(unix.CLOCK_MONOTONIC), uintptr(unix.TFD_CLOEXEC), 0)
+	closeIfValid(int(fd))
+	return nil
+}
+
+func closeIfValid(fd int) {
+	if fd >= 0 {
+		_ = syscall.Close(fd)
+	}
+}
diff --git a/cmd/ioworkload/scenarios.go b/cmd/ioworkload/scenarios.go
index 1ec8e6d..ba444ef 100644
--- a/cmd/ioworkload/scenarios.go
+++ b/cmd/ioworkload/scenarios.go
@@ -34,6 +34,7 @@ var scenarios = map[string]func() error{
 	"pipe2-basic":                   pipe2Basic,
 	"eventfd-basic":                 eventfdBasic,
 	"eventfd2-basic":                eventfd2Basic,
+	"fd-from-air-eventfd-users":     fdFromAirEventfdUsers,
 	"mq-posix-basic":                mqPosixBasic,
 	"mountfs-management":            mountfsManagement,
 	"polling-epoll":                 pollingEpoll,
diff --git a/integrationtests/ipc_test.go b/integrationtests/ipc_test.go
index 007ebc2..c48abb8 100644
--- a/integrationtests/ipc_test.go
+++ b/integrationtests/ipc_test.go
@@ -51,6 +51,30 @@ func TestEventfd2Basic(t *testing.T) {
 	assertTracepointPathPrefix(t, result, "enter_close", "eventfd:")
 }
 
+func TestFdFromAirEventfdUsers(t *testing.T) {
+	enableParallelIfRequested(t)
+	h := newTestHarness(t)
+	result, pid, err := h.RunWithIorArgs("fd-from-air-eventfd-users", defaultDuration, []string{
+		"-trace-families", "IPC",
+	})
+	if err != nil {
+		t.Fatalf("run scenario fd-from-air-eventfd-users: %v", err)
+	}
+	AssertNoUnexpectedPID(t, result, pid)
+	AssertNoUnexpectedComm(t, result, "ioworkload")
+	AssertEventsPresent(t, result, []ExpectedEvent{
+		{Tracepoint: "enter_memfd_create", MinCount: 1},
+		{Tracepoint: "enter_memfd_secret", MinCount: 1},
+		{Tracepoint: "enter_userfaultfd", MinCount: 1},
+		{Tracepoint: "enter_signalfd", MinCount: 1},
+		{Tracepoint: "enter_signalfd4", MinCount: 1},
+		{Tracepoint: "enter_timerfd_create", MinCount: 1},
+	})
+
+	assertTracepointPathPrefix(t, result, "enter_memfd_create", "memfd:")
+	assertTracepointPathPrefix(t, result, "enter_timerfd_create", "timerfd:")
+}
+
 func TestPosixMqBasic(t *testing.T) {
 	enableParallelIfRequested(t)
 	h := newTestHarness(t)
diff --git a/internal/c/generated_tracepoints.c b/internal/c/generated_tracepoints.c
index 479e926..bbacb84 100644
--- a/internal/c/generated_tracepoints.c
+++ b/internal/c/generated_tracepoints.c
@@ -736,7 +736,7 @@
 #define SYS_ENTER_RT_SIGRETURN 57
 #define SYS_EXIT_RT_SIGRETURN 56
 
-/// sys_enter_socket is a struct socket_event
+/// sys_enter_socket is a struct socket_event (kind=socket)
 SEC("tracepoint/syscalls/sys_enter_socket")
 int handle_sys_enter_socket(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -763,7 +763,7 @@ int handle_sys_enter_socket(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_socket is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_socket is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_socket")
 int handle_sys_exit_socket(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -789,7 +789,7 @@ int handle_sys_exit_socket(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_socketpair is a struct socketpair_event
+/// sys_enter_socketpair is a struct socketpair_event (kind=socketpair)
 SEC("tracepoint/syscalls/sys_enter_socketpair")
 int handle_sys_enter_socketpair(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -825,7 +825,7 @@ int handle_sys_enter_socketpair(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_socketpair is a struct socketpair_event
+/// sys_exit_socketpair is a struct socketpair_event (kind=socketpair)
 SEC("tracepoint/syscalls/sys_exit_socketpair")
 int handle_sys_exit_socketpair(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -874,7 +874,7 @@ int handle_sys_exit_socketpair(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_bind is a struct fd_event
+/// sys_enter_bind is a struct fd_event (kind=fd)
 SEC("tracepoint/syscalls/sys_enter_bind")
 int handle_sys_enter_bind(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -899,7 +899,7 @@ int handle_sys_enter_bind(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_bind is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_bind is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_bind")
 int handle_sys_exit_bind(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -925,7 +925,7 @@ int handle_sys_exit_bind(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_listen is a struct fd_event
+/// sys_enter_listen is a struct fd_event (kind=fd)
 SEC("tracepoint/syscalls/sys_enter_listen")
 int handle_sys_enter_listen(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -950,7 +950,7 @@ int handle_sys_enter_listen(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_listen is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_listen is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_listen")
 int handle_sys_exit_listen(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -976,7 +976,7 @@ int handle_sys_exit_listen(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_accept4 is a struct accept_event
+/// sys_enter_accept4 is a struct accept_event (kind=accept)
 SEC("tracepoint/syscalls/sys_enter_accept4")
 int handle_sys_enter_accept4(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -1002,7 +1002,7 @@ int handle_sys_enter_accept4(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_accept4 is a struct accept_event
+/// sys_exit_accept4 is a struct accept_event (kind=accept)
 SEC("tracepoint/syscalls/sys_exit_accept4")
 int handle_sys_exit_accept4(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -1028,7 +1028,7 @@ int handle_sys_exit_accept4(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_accept is a struct accept_event
+/// sys_enter_accept is a struct accept_event (kind=accept)
 SEC("tracepoint/syscalls/sys_enter_accept")
 int handle_sys_enter_accept(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -1054,7 +1054,7 @@ int handle_sys_enter_accept(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_accept is a struct accept_event
+/// sys_exit_accept is a struct accept_event (kind=accept)
 SEC("tracepoint/syscalls/sys_exit_accept")
 int handle_sys_exit_accept(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -1080,7 +1080,7 @@ int handle_sys_exit_accept(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_connect is a struct fd_event
+/// sys_enter_connect is a struct fd_event (kind=fd)
 SEC("tracepoint/syscalls/sys_enter_connect")
 int handle_sys_enter_connect(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -1105,7 +1105,7 @@ int handle_sys_enter_connect(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_connect is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_connect is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_connect")
 int handle_sys_exit_connect(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -1131,7 +1131,7 @@ int handle_sys_exit_connect(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_getsockname is a struct fd_event
+/// sys_enter_getsockname is a struct fd_event (kind=fd)
 SEC("tracepoint/syscalls/sys_enter_getsockname")
 int handle_sys_enter_getsockname(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -1156,7 +1156,7 @@ int handle_sys_enter_getsockname(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_getsockname is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_getsockname is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_getsockname")
 int handle_sys_exit_getsockname(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -1182,7 +1182,7 @@ int handle_sys_exit_getsockname(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_getpeername is a struct fd_event
+/// sys_enter_getpeername is a struct fd_event (kind=fd)
 SEC("tracepoint/syscalls/sys_enter_getpeername")
 int handle_sys_enter_getpeername(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -1207,7 +1207,7 @@ int handle_sys_enter_getpeername(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_getpeername is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_getpeername is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_getpeername")
 int handle_sys_exit_getpeername(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -1233,7 +1233,7 @@ int handle_sys_exit_getpeername(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_sendto is a struct fd_event
+/// sys_enter_sendto is a struct fd_event (kind=fd)
 SEC("tracepoint/syscalls/sys_enter_sendto")
 int handle_sys_enter_sendto(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -1258,7 +1258,7 @@ int handle_sys_enter_sendto(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_sendto is a struct ret_event (WRITE_CLASSIFIED)
+/// sys_exit_sendto is a struct ret_event (WRITE_CLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_sendto")
 int handle_sys_exit_sendto(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -1284,7 +1284,7 @@ int handle_sys_exit_sendto(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_recvfrom is a struct fd_event
+/// sys_enter_recvfrom is a struct fd_event (kind=fd)
 SEC("tracepoint/syscalls/sys_enter_recvfrom")
 int handle_sys_enter_recvfrom(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -1309,7 +1309,7 @@ int handle_sys_enter_recvfrom(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_recvfrom is a struct ret_event (READ_CLASSIFIED)
+/// sys_exit_recvfrom is a struct ret_event (READ_CLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_recvfrom")
 int handle_sys_exit_recvfrom(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -1335,7 +1335,7 @@ int handle_sys_exit_recvfrom(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_setsockopt is a struct fd_event
+/// sys_enter_setsockopt is a struct fd_event (kind=fd)
 SEC("tracepoint/syscalls/sys_enter_setsockopt")
 int handle_sys_enter_setsockopt(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -1360,7 +1360,7 @@ int handle_sys_enter_setsockopt(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_setsockopt is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_setsockopt is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_setsockopt")
 int handle_sys_exit_setsockopt(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -1386,7 +1386,7 @@ int handle_sys_exit_setsockopt(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_getsockopt is a struct fd_event
+/// sys_enter_getsockopt is a struct fd_event (kind=fd)
 SEC("tracepoint/syscalls/sys_enter_getsockopt")
 int handle_sys_enter_getsockopt(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -1411,7 +1411,7 @@ int handle_sys_enter_getsockopt(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_getsockopt is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_getsockopt is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_getsockopt")
 int handle_sys_exit_getsockopt(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -1437,7 +1437,7 @@ int handle_sys_exit_getsockopt(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_shutdown is a struct fd_event
+/// sys_enter_shutdown is a struct fd_event (kind=fd)
 SEC("tracepoint/syscalls/sys_enter_shutdown")
 int handle_sys_enter_shutdown(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -1462,7 +1462,7 @@ int handle_sys_enter_shutdown(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_shutdown is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_shutdown is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_shutdown")
 int handle_sys_exit_shutdown(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -1488,7 +1488,7 @@ int handle_sys_exit_shutdown(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_sendmsg is a struct fd_event
+/// sys_enter_sendmsg is a struct fd_event (kind=fd)
 SEC("tracepoint/syscalls/sys_enter_sendmsg")
 int handle_sys_enter_sendmsg(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -1513,7 +1513,7 @@ int handle_sys_enter_sendmsg(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_sendmsg is a struct ret_event (WRITE_CLASSIFIED)
+/// sys_exit_sendmsg is a struct ret_event (WRITE_CLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_sendmsg")
 int handle_sys_exit_sendmsg(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -1539,7 +1539,7 @@ int handle_sys_exit_sendmsg(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_sendmmsg is a struct fd_event
+/// sys_enter_sendmmsg is a struct fd_event (kind=fd)
 SEC("tracepoint/syscalls/sys_enter_sendmmsg")
 int handle_sys_enter_sendmmsg(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -1564,7 +1564,7 @@ int handle_sys_enter_sendmmsg(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_sendmmsg is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_sendmmsg is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_sendmmsg")
 int handle_sys_exit_sendmmsg(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -1590,7 +1590,7 @@ int handle_sys_exit_sendmmsg(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_recvmsg is a struct fd_event
+/// sys_enter_recvmsg is a struct fd_event (kind=fd)
 SEC("tracepoint/syscalls/sys_enter_recvmsg")
 int handle_sys_enter_recvmsg(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -1615,7 +1615,7 @@ int handle_sys_enter_recvmsg(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_recvmsg is a struct ret_event (READ_CLASSIFIED)
+/// sys_exit_recvmsg is a struct ret_event (READ_CLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_recvmsg")
 int handle_sys_exit_recvmsg(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -1641,7 +1641,7 @@ int handle_sys_exit_recvmsg(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_recvmmsg is a struct fd_event
+/// sys_enter_recvmmsg is a struct fd_event (kind=fd)
 SEC("tracepoint/syscalls/sys_enter_recvmmsg")
 int handle_sys_enter_recvmmsg(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -1666,7 +1666,7 @@ int handle_sys_enter_recvmmsg(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_recvmmsg is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_recvmmsg is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_recvmmsg")
 int handle_sys_exit_recvmmsg(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -1692,7 +1692,7 @@ int handle_sys_exit_recvmmsg(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_getrandom is a struct null_event
+/// sys_enter_getrandom is a struct null_event (kind=null)
 SEC("tracepoint/syscalls/sys_enter_getrandom")
 int handle_sys_enter_getrandom(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -1716,7 +1716,7 @@ int handle_sys_enter_getrandom(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_getrandom is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_getrandom is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_getrandom")
 int handle_sys_exit_getrandom(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -1742,7 +1742,7 @@ int handle_sys_exit_getrandom(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_io_uring_register is a struct fd_event
+/// sys_enter_io_uring_register is a struct fd_event (kind=fd)
 SEC("tracepoint/syscalls/sys_enter_io_uring_register")
 int handle_sys_enter_io_uring_register(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -1767,7 +1767,7 @@ int handle_sys_enter_io_uring_register(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_io_uring_register is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_io_uring_register is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_io_uring_register")
 int handle_sys_exit_io_uring_register(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -1793,7 +1793,7 @@ int handle_sys_exit_io_uring_register(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_io_uring_enter is a struct fd_event
+/// sys_enter_io_uring_enter is a struct fd_event (kind=fd)
 SEC("tracepoint/syscalls/sys_enter_io_uring_enter")
 int handle_sys_enter_io_uring_enter(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -1818,7 +1818,7 @@ int handle_sys_enter_io_uring_enter(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_io_uring_enter is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_io_uring_enter is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_io_uring_enter")
 int handle_sys_exit_io_uring_enter(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -1844,7 +1844,7 @@ int handle_sys_exit_io_uring_enter(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_io_uring_setup is a struct null_event
+/// sys_enter_io_uring_setup is a struct null_event (kind=null)
 SEC("tracepoint/syscalls/sys_enter_io_uring_setup")
 int handle_sys_enter_io_uring_setup(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -1868,7 +1868,7 @@ int handle_sys_enter_io_uring_setup(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_io_uring_setup is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_io_uring_setup is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_io_uring_setup")
 int handle_sys_exit_io_uring_setup(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -1894,7 +1894,7 @@ int handle_sys_exit_io_uring_setup(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_ioprio_set is a struct null_event
+/// sys_enter_ioprio_set is a struct null_event (kind=null)
 SEC("tracepoint/syscalls/sys_enter_ioprio_set")
 int handle_sys_enter_ioprio_set(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -1918,7 +1918,7 @@ int handle_sys_enter_ioprio_set(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_ioprio_set is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_ioprio_set is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_ioprio_set")
 int handle_sys_exit_ioprio_set(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -1944,7 +1944,7 @@ int handle_sys_exit_ioprio_set(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_ioprio_get is a struct null_event
+/// sys_enter_ioprio_get is a struct null_event (kind=null)
 SEC("tracepoint/syscalls/sys_enter_ioprio_get")
 int handle_sys_enter_ioprio_get(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -1968,7 +1968,7 @@ int handle_sys_enter_ioprio_get(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_ioprio_get is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_ioprio_get is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_ioprio_get")
 int handle_sys_exit_ioprio_get(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -1994,7 +1994,7 @@ int handle_sys_exit_ioprio_get(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_landlock_create_ruleset is a struct null_event
+/// sys_enter_landlock_create_ruleset is a struct null_event (kind=null)
 SEC("tracepoint/syscalls/sys_enter_landlock_create_ruleset")
 int handle_sys_enter_landlock_create_ruleset(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -2018,7 +2018,7 @@ int handle_sys_enter_landlock_create_ruleset(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_landlock_create_ruleset is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_landlock_create_ruleset is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_landlock_create_ruleset")
 int handle_sys_exit_landlock_create_ruleset(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -2044,7 +2044,7 @@ int handle_sys_exit_landlock_create_ruleset(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_landlock_add_rule is a struct null_event
+/// sys_enter_landlock_add_rule is a struct null_event (kind=null)
 SEC("tracepoint/syscalls/sys_enter_landlock_add_rule")
 int handle_sys_enter_landlock_add_rule(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -2068,7 +2068,7 @@ int handle_sys_enter_landlock_add_rule(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_landlock_add_rule is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_landlock_add_rule is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_landlock_add_rule")
 int handle_sys_exit_landlock_add_rule(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -2094,7 +2094,7 @@ int handle_sys_exit_landlock_add_rule(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_landlock_restrict_self is a struct null_event
+/// sys_enter_landlock_restrict_self is a struct null_event (kind=null)
 SEC("tracepoint/syscalls/sys_enter_landlock_restrict_self")
 int handle_sys_enter_landlock_restrict_self(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -2118,7 +2118,7 @@ int handle_sys_enter_landlock_restrict_self(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_landlock_restrict_self is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_landlock_restrict_self is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_landlock_restrict_self")
 int handle_sys_exit_landlock_restrict_self(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -2144,7 +2144,7 @@ int handle_sys_exit_landlock_restrict_self(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_lsm_set_self_attr is a struct null_event
+/// sys_enter_lsm_set_self_attr is a struct null_event (kind=null)
 SEC("tracepoint/syscalls/sys_enter_lsm_set_self_attr")
 int handle_sys_enter_lsm_set_self_attr(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -2168,7 +2168,7 @@ int handle_sys_enter_lsm_set_self_attr(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_lsm_set_self_attr is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_lsm_set_self_attr is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_lsm_set_self_attr")
 int handle_sys_exit_lsm_set_self_attr(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -2194,7 +2194,7 @@ int handle_sys_exit_lsm_set_self_attr(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_lsm_get_self_attr is a struct null_event
+/// sys_enter_lsm_get_self_attr is a struct null_event (kind=null)
 SEC("tracepoint/syscalls/sys_enter_lsm_get_self_attr")
 int handle_sys_enter_lsm_get_self_attr(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -2218,7 +2218,7 @@ int handle_sys_enter_lsm_get_self_attr(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_lsm_get_self_attr is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_lsm_get_self_attr is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_lsm_get_self_attr")
 int handle_sys_exit_lsm_get_self_attr(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -2244,7 +2244,7 @@ int handle_sys_exit_lsm_get_self_attr(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_lsm_list_modules is a struct null_event
+/// sys_enter_lsm_list_modules is a struct null_event (kind=null)
 SEC("tracepoint/syscalls/sys_enter_lsm_list_modules")
 int handle_sys_enter_lsm_list_modules(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -2268,7 +2268,7 @@ int handle_sys_enter_lsm_list_modules(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_lsm_list_modules is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_lsm_list_modules is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_lsm_list_modules")
 int handle_sys_exit_lsm_list_modules(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -2294,7 +2294,7 @@ int handle_sys_exit_lsm_list_modules(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_add_key is a struct keyctl_event
+/// sys_enter_add_key is a struct keyctl_event (kind=keyctl)
 SEC("tracepoint/syscalls/sys_enter_add_key")
 int handle_sys_enter_add_key(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -2321,7 +2321,7 @@ int handle_sys_enter_add_key(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_add_key is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_add_key is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_add_key")
 int handle_sys_exit_add_key(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -2347,7 +2347,7 @@ int handle_sys_exit_add_key(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_request_key is a struct keyctl_event
+/// sys_enter_request_key is a struct keyctl_event (kind=keyctl)
 SEC("tracepoint/syscalls/sys_enter_request_key")
 int handle_sys_enter_request_key(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -2374,7 +2374,7 @@ int handle_sys_enter_request_key(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_request_key is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_request_key is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_request_key")
 int handle_sys_exit_request_key(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -2400,7 +2400,7 @@ int handle_sys_exit_request_key(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_keyctl is a struct keyctl_event
+/// sys_enter_keyctl is a struct keyctl_event (kind=keyctl)
 SEC("tracepoint/syscalls/sys_enter_keyctl")
 int handle_sys_enter_keyctl(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -2427,7 +2427,7 @@ int handle_sys_enter_keyctl(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_keyctl is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_keyctl is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_keyctl")
 int handle_sys_exit_keyctl(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -2453,7 +2453,7 @@ int handle_sys_exit_keyctl(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_mq_open is a struct open_event
+/// sys_enter_mq_open is a struct open_event (kind=mq-open)
 SEC("tracepoint/syscalls/sys_enter_mq_open")
 int handle_sys_enter_mq_open(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -2481,7 +2481,7 @@ int handle_sys_enter_mq_open(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_mq_open is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_mq_open is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_mq_open")
 int handle_sys_exit_mq_open(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -2507,7 +2507,7 @@ int handle_sys_exit_mq_open(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_mq_unlink is a struct path_event
+/// sys_enter_mq_unlink is a struct path_event (kind=pathname)
 SEC("tracepoint/syscalls/sys_enter_mq_unlink")
 int handle_sys_enter_mq_unlink(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -2533,7 +2533,7 @@ int handle_sys_enter_mq_unlink(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_mq_unlink is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_mq_unlink is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_mq_unlink")
 int handle_sys_exit_mq_unlink(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -2559,7 +2559,7 @@ int handle_sys_exit_mq_unlink(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_mq_timedsend is a struct fd_event
+/// sys_enter_mq_timedsend is a struct fd_event (kind=fd)
 SEC("tracepoint/syscalls/sys_enter_mq_timedsend")
 int handle_sys_enter_mq_timedsend(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -2584,7 +2584,7 @@ int handle_sys_enter_mq_timedsend(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_mq_timedsend is a struct ret_event (WRITE_CLASSIFIED)
+/// sys_exit_mq_timedsend is a struct ret_event (WRITE_CLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_mq_timedsend")
 int handle_sys_exit_mq_timedsend(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -2610,7 +2610,7 @@ int handle_sys_exit_mq_timedsend(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_mq_timedreceive is a struct fd_event
+/// sys_enter_mq_timedreceive is a struct fd_event (kind=fd)
 SEC("tracepoint/syscalls/sys_enter_mq_timedreceive")
 int handle_sys_enter_mq_timedreceive(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -2635,7 +2635,7 @@ int handle_sys_enter_mq_timedreceive(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_mq_timedreceive is a struct ret_event (READ_CLASSIFIED)
+/// sys_exit_mq_timedreceive is a struct ret_event (READ_CLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_mq_timedreceive")
 int handle_sys_exit_mq_timedreceive(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -2661,7 +2661,7 @@ int handle_sys_exit_mq_timedreceive(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_mq_notify is a struct fd_event
+/// sys_enter_mq_notify is a struct fd_event (kind=fd)
 SEC("tracepoint/syscalls/sys_enter_mq_notify")
 int handle_sys_enter_mq_notify(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -2686,7 +2686,7 @@ int handle_sys_enter_mq_notify(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_mq_notify is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_mq_notify is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_mq_notify")
 int handle_sys_exit_mq_notify(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -2712,7 +2712,7 @@ int handle_sys_exit_mq_notify(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_mq_getsetattr is a struct fd_event
+/// sys_enter_mq_getsetattr is a struct fd_event (kind=fd)
 SEC("tracepoint/syscalls/sys_enter_mq_getsetattr")
 int handle_sys_enter_mq_getsetattr(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -2737,7 +2737,7 @@ int handle_sys_enter_mq_getsetattr(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_mq_getsetattr is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_mq_getsetattr is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_mq_getsetattr")
 int handle_sys_exit_mq_getsetattr(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -2763,7 +2763,7 @@ int handle_sys_exit_mq_getsetattr(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_shmget is a struct null_event
+/// sys_enter_shmget is a struct null_event (kind=null)
 SEC("tracepoint/syscalls/sys_enter_shmget")
 int handle_sys_enter_shmget(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -2787,7 +2787,7 @@ int handle_sys_enter_shmget(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_shmget is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_shmget is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_shmget")
 int handle_sys_exit_shmget(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -2813,7 +2813,7 @@ int handle_sys_exit_shmget(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_shmctl is a struct null_event
+/// sys_enter_shmctl is a struct null_event (kind=null)
 SEC("tracepoint/syscalls/sys_enter_shmctl")
 int handle_sys_enter_shmctl(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -2837,7 +2837,7 @@ int handle_sys_enter_shmctl(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_shmctl is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_shmctl is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_shmctl")
 int handle_sys_exit_shmctl(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -2863,7 +2863,7 @@ int handle_sys_exit_shmctl(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_shmat is a struct null_event
+/// sys_enter_shmat is a struct null_event (kind=null)
 SEC("tracepoint/syscalls/sys_enter_shmat")
 int handle_sys_enter_shmat(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -2887,7 +2887,7 @@ int handle_sys_enter_shmat(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_shmat is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_shmat is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_shmat")
 int handle_sys_exit_shmat(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -2913,7 +2913,7 @@ int handle_sys_exit_shmat(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_shmdt is a struct null_event
+/// sys_enter_shmdt is a struct null_event (kind=null)
 SEC("tracepoint/syscalls/sys_enter_shmdt")
 int handle_sys_enter_shmdt(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -2937,7 +2937,7 @@ int handle_sys_enter_shmdt(struct syscall_trace_enter *ctx) {
     return 0;
 }
 
-/// sys_exit_shmdt is a struct ret_event (UNCLASSIFIED)
+/// sys_exit_shmdt is a struct ret_event (UNCLASSIFIED) (kind=ret)
 SEC("tracepoint/syscalls/sys_exit_shmdt")
 int handle_sys_exit_shmdt(struct syscall_trace_exit *ctx) {
     __u32 pid, tid;
@@ -2963,7 +2