i7 classify memory P3 syscalls as mem kind

8 files changed, 166 insertions, 35 deletions

diff --git a/internal/c/generated_tracepoints.c b/internal/c/generated_tracepoints.c
index d85508c..9f2f283 100644
--- a/internal/c/generated_tracepoints.c
+++ b/internal/c/generated_tracepoints.c
@@ -12035,7 +12035,7 @@ int handle_sys_exit_process_madvise(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_mseal is a struct null_event (kind=null)
+/// sys_enter_mseal is a struct mem_event (kind=mem)
 SEC("tracepoint/syscalls/sys_enter_mseal")
 int handle_sys_enter_mseal(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -12045,15 +12045,19 @@ int handle_sys_enter_mseal(struct syscall_trace_enter *ctx) {
     if (!ior_on_syscall_enter(tid, SYS_ENTER_MSEAL))
         return 0;
 
-    struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
+    struct mem_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct mem_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = ENTER_NULL_EVENT;
+    ev->event_type = ENTER_MEM_EVENT;
     ev->trace_id = SYS_ENTER_MSEAL;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_boot_ns();
+    ev->addr = (__u64)ctx->args[0];
+    ev->length = (__u64)ctx->args[1];
+    ev->length2 = 0;
+    ev->flags = (__u64)ctx->args[2];
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
@@ -12593,7 +12597,7 @@ int handle_sys_exit_munmap(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_remap_file_pages is a struct null_event (kind=null)
+/// sys_enter_remap_file_pages is a struct mem_event (kind=mem)
 SEC("tracepoint/syscalls/sys_enter_remap_file_pages")
 int handle_sys_enter_remap_file_pages(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -12603,15 +12607,19 @@ int handle_sys_enter_remap_file_pages(struct syscall_trace_enter *ctx) {
     if (!ior_on_syscall_enter(tid, SYS_ENTER_REMAP_FILE_PAGES))
         return 0;
 
-    struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
+    struct mem_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct mem_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = ENTER_NULL_EVENT;
+    ev->event_type = ENTER_MEM_EVENT;
     ev->trace_id = SYS_ENTER_REMAP_FILE_PAGES;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_boot_ns();
+    ev->addr = (__u64)ctx->args[0];
+    ev->length = (__u64)ctx->args[1];
+    ev->length2 = (__u64)ctx->args[3];
+    ev->flags = (__u64)ctx->args[4];
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
@@ -12643,7 +12651,7 @@ int handle_sys_exit_remap_file_pages(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_mlock is a struct null_event (kind=null)
+/// sys_enter_mlock is a struct mem_event (kind=mem)
 SEC("tracepoint/syscalls/sys_enter_mlock")
 int handle_sys_enter_mlock(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -12653,15 +12661,19 @@ int handle_sys_enter_mlock(struct syscall_trace_enter *ctx) {
     if (!ior_on_syscall_enter(tid, SYS_ENTER_MLOCK))
         return 0;
 
-    struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
+    struct mem_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct mem_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = ENTER_NULL_EVENT;
+    ev->event_type = ENTER_MEM_EVENT;
     ev->trace_id = SYS_ENTER_MLOCK;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_boot_ns();
+    ev->addr = (__u64)ctx->args[0];
+    ev->length = (__u64)ctx->args[1];
+    ev->length2 = 0;
+    ev->flags = 0;
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
@@ -12693,7 +12705,7 @@ int handle_sys_exit_mlock(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_mlock2 is a struct null_event (kind=null)
+/// sys_enter_mlock2 is a struct mem_event (kind=mem)
 SEC("tracepoint/syscalls/sys_enter_mlock2")
 int handle_sys_enter_mlock2(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -12703,15 +12715,19 @@ int handle_sys_enter_mlock2(struct syscall_trace_enter *ctx) {
     if (!ior_on_syscall_enter(tid, SYS_ENTER_MLOCK2))
         return 0;
 
-    struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
+    struct mem_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct mem_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = ENTER_NULL_EVENT;
+    ev->event_type = ENTER_MEM_EVENT;
     ev->trace_id = SYS_ENTER_MLOCK2;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_boot_ns();
+    ev->addr = (__u64)ctx->args[0];
+    ev->length = (__u64)ctx->args[1];
+    ev->length2 = 0;
+    ev->flags = (__u64)ctx->args[2];
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
@@ -12743,7 +12759,7 @@ int handle_sys_exit_mlock2(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_munlock is a struct null_event (kind=null)
+/// sys_enter_munlock is a struct mem_event (kind=mem)
 SEC("tracepoint/syscalls/sys_enter_munlock")
 int handle_sys_enter_munlock(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -12753,15 +12769,19 @@ int handle_sys_enter_munlock(struct syscall_trace_enter *ctx) {
     if (!ior_on_syscall_enter(tid, SYS_ENTER_MUNLOCK))
         return 0;
 
-    struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
+    struct mem_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct mem_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = ENTER_NULL_EVENT;
+    ev->event_type = ENTER_MEM_EVENT;
     ev->trace_id = SYS_ENTER_MUNLOCK;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_boot_ns();
+    ev->addr = (__u64)ctx->args[0];
+    ev->length = (__u64)ctx->args[1];
+    ev->length2 = 0;
+    ev->flags = 0;
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
@@ -12893,7 +12913,7 @@ int handle_sys_exit_munlockall(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_mincore is a struct null_event (kind=null)
+/// sys_enter_mincore is a struct mem_event (kind=mem)
 SEC("tracepoint/syscalls/sys_enter_mincore")
 int handle_sys_enter_mincore(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -12903,15 +12923,19 @@ int handle_sys_enter_mincore(struct syscall_trace_enter *ctx) {
     if (!ior_on_syscall_enter(tid, SYS_ENTER_MINCORE))
         return 0;
 
-    struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
+    struct mem_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct mem_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = ENTER_NULL_EVENT;
+    ev->event_type = ENTER_MEM_EVENT;
     ev->trace_id = SYS_ENTER_MINCORE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_boot_ns();
+    ev->addr = (__u64)ctx->args[0];
+    ev->length = (__u64)ctx->args[1];
+    ev->length2 = 0;
+    ev->flags = 0;
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
@@ -19256,7 +19280,7 @@ int handle_sys_exit_unshare(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_map_shadow_stack is a struct null_event (kind=null)
+/// sys_enter_map_shadow_stack is a struct mem_event (kind=mem)
 SEC("tracepoint/syscalls/sys_enter_map_shadow_stack")
 int handle_sys_enter_map_shadow_stack(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -19266,15 +19290,19 @@ int handle_sys_enter_map_shadow_stack(struct syscall_trace_enter *ctx) {
     if (!ior_on_syscall_enter(tid, SYS_ENTER_MAP_SHADOW_STACK))
         return 0;
 
-    struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0);
+    struct mem_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct mem_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = ENTER_NULL_EVENT;
+    ev->event_type = ENTER_MEM_EVENT;
     ev->trace_id = SYS_ENTER_MAP_SHADOW_STACK;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_boot_ns();
+    ev->addr = (__u64)ctx->args[0];
+    ev->length = (__u64)ctx->args[1];
+    ev->length2 = 0;
+    ev->flags = (__u64)ctx->args[2];
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
diff --git a/internal/c/generated_tracepoints_result.txt b/internal/c/generated_tracepoints_result.txt
index 85dc95f..ed07ec6 100644
--- a/internal/c/generated_tracepoints_result.txt
+++ b/internal/c/generated_tracepoints_result.txt
@@ -154,19 +154,19 @@ sys_enter_lsm_get_self_attr is a struct null_event (kind=null)
 sys_enter_lsm_list_modules is a struct null_event (kind=null)
 sys_enter_lsm_set_self_attr is a struct null_event (kind=null)
 sys_enter_madvise is a struct null_event (kind=null)
-sys_enter_map_shadow_stack is a struct null_event (kind=null)
+sys_enter_map_shadow_stack is a struct mem_event (kind=mem)
 sys_enter_mbind is a struct null_event (kind=null)
 sys_enter_membarrier is a struct null_event (kind=null)
 sys_enter_memfd_create is a struct eventfd_event (kind=eventfd)
 sys_enter_memfd_secret is a struct eventfd_event (kind=eventfd)
 sys_enter_migrate_pages is a struct null_event (kind=null)
-sys_enter_mincore is a struct null_event (kind=null)
+sys_enter_mincore is a struct mem_event (kind=mem)
 sys_enter_mkdir is a struct path_event (kind=pathname)
 sys_enter_mkdirat is a struct path_event (kind=pathname)
 sys_enter_mknod is a struct path_event (kind=pathname)
 sys_enter_mknodat is a struct path_event (kind=pathname)
-sys_enter_mlock is a struct null_event (kind=null)
-sys_enter_mlock2 is a struct null_event (kind=null)
+sys_enter_mlock is a struct mem_event (kind=mem)
+sys_enter_mlock2 is a struct mem_event (kind=mem)
 sys_enter_mlockall is a struct null_event (kind=null)
 sys_enter_mmap is a struct fd_event (kind=fd)
 sys_enter_modify_ldt is a struct null_event (kind=null)
@@ -182,13 +182,13 @@ sys_enter_mq_timedreceive is a struct fd_event (kind=fd)
 sys_enter_mq_timedsend is a struct fd_event (kind=fd)
 sys_enter_mq_unlink is a struct path_event (kind=pathname)
 sys_enter_mremap is a struct mem_event (kind=mem)
-sys_enter_mseal is a struct null_event (kind=null)
+sys_enter_mseal is a struct mem_event (kind=mem)
 sys_enter_msgctl is a struct null_event (kind=null)
 sys_enter_msgget is a struct null_event (kind=null)
 sys_enter_msgrcv is a struct null_event (kind=null)
 sys_enter_msgsnd is a struct null_event (kind=null)
 sys_enter_msync is a struct null_event (kind=null)
-sys_enter_munlock is a struct null_event (kind=null)
+sys_enter_munlock is a struct mem_event (kind=mem)
 sys_enter_munlockall is a struct null_event (kind=null)
 sys_enter_munmap is a struct mem_event (kind=mem)
 sys_enter_name_to_handle_at is a struct path_event (kind=pathname)
@@ -243,7 +243,7 @@ sys_enter_reboot is a struct null_event (kind=null)
 sys_enter_recvfrom is a struct fd_event (kind=fd)
 sys_enter_recvmmsg is a struct fd_event (kind=fd)
 sys_enter_recvmsg is a struct fd_event (kind=fd)
-sys_enter_remap_file_pages is a struct null_event (kind=null)
+sys_enter_remap_file_pages is a struct mem_event (kind=mem)
 sys_enter_removexattr is a struct path_event (kind=pathname)
 sys_enter_removexattrat is a struct path_event (kind=pathname)
 sys_enter_rename is a struct name_event (kind=name)
diff --git a/internal/generate/bpfhandler.go b/internal/generate/bpfhandler.go
index fb4a4e3..7dba8d7 100644
--- a/internal/generate/bpfhandler.go
+++ b/internal/generate/bpfhandler.go
@@ -332,6 +332,20 @@ func generateExtraMem(name string) string {
 		return "    ev->addr = (__u64)ctx->args[0];\n    ev->length = (__u64)ctx->args[1];\n    ev->length2 = 0;\n    ev->flags = 0;\n"
 	case "sys_enter_mremap":
 		return "    ev->addr = (__u64)ctx->args[0];\n    ev->length = (__u64)ctx->args[1];\n    ev->length2 = (__u64)ctx->args[2];\n    ev->flags = (__u64)ctx->args[3];\n"
+	case "sys_enter_mincore":
+		return "    ev->addr = (__u64)ctx->args[0];\n    ev->length = (__u64)ctx->args[1];\n    ev->length2 = 0;\n    ev->flags = 0;\n"
+	case "sys_enter_remap_file_pages":
+		return "    ev->addr = (__u64)ctx->args[0];\n    ev->length = (__u64)ctx->args[1];\n    ev->length2 = (__u64)ctx->args[3];\n    ev->flags = (__u64)ctx->args[4];\n"
+	case "sys_enter_mlock":
+		return "    ev->addr = (__u64)ctx->args[0];\n    ev->length = (__u64)ctx->args[1];\n    ev->length2 = 0;\n    ev->flags = 0;\n"
+	case "sys_enter_mlock2":
+		return "    ev->addr = (__u64)ctx->args[0];\n    ev->length = (__u64)ctx->args[1];\n    ev->length2 = 0;\n    ev->flags = (__u64)ctx->args[2];\n"
+	case "sys_enter_munlock":
+		return "    ev->addr = (__u64)ctx->args[0];\n    ev->length = (__u64)ctx->args[1];\n    ev->length2 = 0;\n    ev->flags = 0;\n"
+	case "sys_enter_mseal":
+		return "    ev->addr = (__u64)ctx->args[0];\n    ev->length = (__u64)ctx->args[1];\n    ev->length2 = 0;\n    ev->flags = (__u64)ctx->args[2];\n"
+	case "sys_enter_map_shadow_stack":
+		return "    ev->addr = (__u64)ctx->args[0];\n    ev->length = (__u64)ctx->args[1];\n    ev->length2 = 0;\n    ev->flags = (__u64)ctx->args[2];\n"
 	default:
 		return "    ev->addr = 0;\n    ev->length = 0;\n    ev->length2 = 0;\n    ev->flags = 0;\n"
 	}
diff --git a/internal/generate/classify.go b/internal/generate/classify.go
index 9896976..0bfac0c 100644
--- a/internal/generate/classify.go
+++ b/internal/generate/classify.go
@@ -286,6 +286,20 @@ func classifyNameOnly(name string) (ClassificationResult, bool) {
 		return ClassificationResult{Kind: KindMem}, true
 	case "sys_enter_mremap":
 		return ClassificationResult{Kind: KindMem}, true
+	case "sys_enter_mincore":
+		return ClassificationResult{Kind: KindMem}, true
+	case "sys_enter_remap_file_pages":
+		return ClassificationResult{Kind: KindMem}, true
+	case "sys_enter_mlock":
+		return ClassificationResult{Kind: KindMem}, true
+	case "sys_enter_mlock2":
+		return ClassificationResult{Kind: KindMem}, true
+	case "sys_enter_munlock":
+		return ClassificationResult{Kind: KindMem}, true
+	case "sys_enter_mseal":
+		return ClassificationResult{Kind: KindMem}, true
+	case "sys_enter_map_shadow_stack":
+		return ClassificationResult{Kind: KindMem}, true
 	case "sys_enter_nanosleep":
 		return ClassificationResult{Kind: KindSleep}, true
 	case "sys_enter_clock_nanosleep":
diff --git a/internal/generate/classify_test.go b/internal/generate/classify_test.go
index b51877c..590b0bb 100644
--- a/internal/generate/classify_test.go
+++ b/internal/generate/classify_test.go
@@ -691,6 +691,36 @@ func TestClassifyG7NameOnlyKinds(t *testing.T) {
 	}
 }
 
+func TestClassifyI7NameOnlyKinds(t *testing.T) {
+	tests := []struct {
+		name string
+		want TracepointKind
+	}{
+		{"sys_enter_mincore", KindMem},
+		{"sys_enter_remap_file_pages", KindMem},
+		{"sys_enter_mlock", KindMem},
+		{"sys_enter_mlock2", KindMem},
+		{"sys_enter_munlock", KindMem},
+		{"sys_enter_mseal", KindMem},
+		{"sys_enter_map_shadow_stack", KindMem},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := ClassifyFormat(&Format{
+				Name: tt.name,
+				ExternalFields: []Field{
+					{Type: "long", Name: "__syscall_nr"},
+					{Type: "long", Name: "arg0"},
+				},
+			})
+			if r.Kind != tt.want {
+				t.Fatalf("%s: got kind %d, want %d", tt.name, r.Kind, tt.want)
+			}
+		})
+	}
+}
+
 func TestClassifyMount(t *testing.T) {
 	r := classifyFromData(t, FormatMount)
 	if r.Kind != KindPathname {
@@ -875,6 +905,13 @@ func TestClassifySyscallPairAccepted(t *testing.T) {
 		{"pselect6", FormatPselect6, FormatExitPselect6, KindPoll},
 		{"munmap", FormatMunmap, FormatExitMunmap, KindMem},
 		{"mremap", FormatMremap, FormatExitMremap, KindMem},
+		{"mincore", syntheticEnter("mincore", 9354), syntheticExit("mincore", 9353), KindMem},
+		{"remap_file_pages", syntheticEnter("remap_file_pages", 9356), syntheticExit("remap_file_pages", 9355), KindMem},
+		{"mlock", syntheticEnter("mlock", 9358), syntheticExit("mlock", 9357), KindMem},
+		{"mlock2", syntheticEnter("mlock2", 9360), syntheticExit("mlock2", 9359), KindMem},
+		{"munlock", syntheticEnter("munlock", 9362), syntheticExit("munlock", 9361), KindMem},
+		{"mseal", syntheticEnter("mseal", 9364), syntheticExit("mseal", 9363), KindMem},
+		{"map_shadow_stack", syntheticEnter("map_shadow_stack", 9366), syntheticExit("map_shadow_stack", 9365), KindMem},
 		{"nanosleep", FormatNanosleep, FormatExitNanosleep, KindSleep},
 		{"clock_nanosleep", FormatClockNanosleep, FormatExitClockNanosleep, KindSleep},
 		{"keyctl", syntheticEnter("keyctl", 9200), syntheticExit("keyctl", 9199), KindKeyctl},
diff --git a/internal/generate/codegen_test.go b/internal/generate/codegen_test.go
index 83d316f..4faed24 100644
--- a/internal/generate/codegen_test.go
+++ b/internal/generate/codegen_test.go
@@ -213,6 +213,29 @@ func TestGenerateMemHandler(t *testing.T) {
 	requireContains(t, output, "ev->flags = (__u64)ctx->args[3];")
 }
 
+func TestGenerateMemHandlerMlock2(t *testing.T) {
+	output := GenerateTracepointsC(mustParseAll(t, syntheticPair("mlock2")))
+
+	requireContains(t, output, `SEC("tracepoint/syscalls/sys_enter_mlock2")`)
+	requireContains(t, output, "struct mem_event *ev")
+	requireContains(t, output, "ev->event_type = ENTER_MEM_EVENT;")
+	requireContains(t, output, "ev->addr = (__u64)ctx->args[0];")
+	requireContains(t, output, "ev->length = (__u64)ctx->args[1];")
+	requireContains(t, output, "ev->flags = (__u64)ctx->args[2];")
+}
+
+func TestGenerateMemHandlerRemapFilePages(t *testing.T) {
+	output := GenerateTracepointsC(mustParseAll(t, syntheticPair("remap_file_pages")))
+
+	requireContains(t, output, `SEC("tracepoint/syscalls/sys_enter_remap_file_pages")`)
+	requireContains(t, output, "struct mem_event *ev")
+	requireContains(t, output, "ev->event_type = ENTER_MEM_EVENT;")
+	requireContains(t, output, "ev->addr = (__u64)ctx->args[0];")
+	requireContains(t, output, "ev->length = (__u64)ctx->args[1];")
+	requireContains(t, output, "ev->length2 = (__u64)ctx->args[3];")
+	requireContains(t, output, "ev->flags = (__u64)ctx->args[4];")
+}
+
 func TestGenerateDup3Handler(t *testing.T) {
 	output := generateFromPair(t, FormatDup3, FormatExitDup3)
 
diff --git a/internal/tracepoints/dimension_selector_test.go b/internal/tracepoints/dimension_selector_test.go
index 0a332b5..388ec12 100644
--- a/internal/tracepoints/dimension_selector_test.go
+++ b/internal/tracepoints/dimension_selector_test.go
@@ -78,6 +78,21 @@ func TestParseSelectorWithDimensionsEventfdKindIncludesEpollCreate(t *testing.T)
 	}
 }
 
+func TestParseSelectorWithDimensionsMemKindIncludesMlock(t *testing.T) {
+	sel, err := ParseSelectorWithDimensions("", "", DimensionSelectorConfig{
+		TraceKinds: "mem",
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !sel.ShouldAttach("sys_enter_mlock") {
+		t.Fatal("expected mlock to be attached for mem kind")
+	}
+	if sel.ShouldAttach("sys_enter_nanosleep") {
+		t.Fatal("expected nanosleep to be excluded when only mem kind is enabled")
+	}
+}
+
 func TestParseSelectorWithDimensionsSyscallOnly(t *testing.T) {
 	sel, err := ParseSelectorWithDimensions("", "", DimensionSelectorConfig{
 		TraceSyscalls: "openat",
diff --git a/internal/tracepoints/generated_tracepoints.go b/internal/tracepoints/generated_tracepoints.go
index c45f6d2..b4fb1b0 100644
--- a/internal/tracepoints/generated_tracepoints.go
+++ b/internal/tracepoints/generated_tracepoints.go
@@ -1265,19 +1265,19 @@ var syscallKinds = map[string]string{
 	"lsm_list_modules":        "null",
 	"lsm_set_self_attr":       "null",
 	"madvise":                 "null",
-	"map_shadow_stack":        "null",
+	"map_shadow_stack":        "mem",
 	"mbind":                   "null",
 	"membarrier":              "null",
 	"memfd_create":            "eventfd",
 	"memfd_secret":            "eventfd",
 	"migrate_pages":           "null",
-	"mincore":                 "null",
+	"mincore":                 "mem",
 	"mkdir":                   "pathname",
 	"mkdirat":                 "pathname",
 	"mknod":                   "pathname",
 	"mknodat":                 "pathname",
-	"mlock":                   "null",
-	"mlock2":                  "null",
+	"mlock":                   "mem",
+	"mlock2":                  "mem",
 	"mlockall":                "null",
 	"mmap":                    "fd",
 	"modify_ldt":              "null",
@@ -1293,13 +1293,13 @@ var syscallKinds = map[string]string{
 	"mq_timedsend":            "fd",
 	"mq_unlink":               "pathname",
 	"mremap":                  "mem",
-	"mseal":                   "null",
+	"mseal":                   "mem",
 	"msgctl":                  "null",
 	"msgget":                  "null",
 	"msgrcv":                  "null",
 	"msgsnd":                  "null",
 	"msync":                   "null",
-	"munlock":                 "null",
+	"munlock":                 "mem",
 	"munlockall":              "null",
 	"munmap":                  "mem",
 	"name_to_handle_at":       "pathname",
@@ -1354,7 +1354,7 @@ var syscallKinds = map[string]string{
 	"recvfrom":                "fd",
 	"recvmmsg":                "fd",
 	"recvmsg":                 "fd",
-	"remap_file_pages":        "null",
+	"remap_file_pages":        "mem",
 	"removexattr":             "pathname",
 	"removexattrat":           "pathname",
 	"rename":                  "name",