feat: add mount/fs management syscall tracing for c7

7 files changed, 550 insertions, 11 deletions

diff --git a/internal/generate/bpfhandler.go b/internal/generate/bpfhandler.go
index 5c42464..afdb83e 100644
--- a/internal/generate/bpfhandler.go
+++ b/internal/generate/bpfhandler.go
@@ -93,6 +93,8 @@ func generateExtra(tp GeneratedTracepoint, isEnter bool) string {
 		return generateExtraEventfd(f, isEnter)
 	case KindEpollCtl:
 		return generateExtraEpollCtl()
+	case KindTwoFd:
+		return generateExtraTwoFd(f.Name)
 	case KindPoll:
 		return generateExtraPoll(f.Name)
 	case KindMem:
@@ -207,7 +209,12 @@ func generateExtraPipe(f *Format, isEnter bool) string {
 func generateExtraEventfd(f *Format, isEnter bool) string {
 	if isEnter {
 		flagsExpr := "0"
-		if f.Name == "sys_enter_eventfd2" {
+		switch f.Name {
+		case "sys_enter_eventfd2":
+			flagsExpr = "(__s32)ctx->args[1]"
+		case "sys_enter_fsmount":
+			flagsExpr = "(__s32)ctx->args[1]"
+		case "sys_enter_fsopen":
 			flagsExpr = "(__s32)ctx->args[1]"
 		}
 		return "    __s32 flags = " + flagsExpr + ";\n    bpf_map_update_elem(&eventfd_flags_map, &tid, &flags, BPF_ANY);\n    ev->flags = flags;\n    ev->ret = -1;\n"
@@ -219,6 +226,15 @@ func generateExtraEpollCtl() string {
 	return "    ev->epfd = (__s32)ctx->args[0];\n    ev->op = (__s32)ctx->args[1];\n    ev->fd = (__s32)ctx->args[2];\n    ev->events = 0;\n    if (ctx->args[3] != 0) {\n        __u32 user_events = 0;\n        if (bpf_probe_read_user(&user_events, sizeof(user_events), (void *)ctx->args[3]) == 0) {\n            ev->events = user_events;\n        }\n    }\n"
 }
 
+func generateExtraTwoFd(name string) string {
+	switch name {
+	case "sys_enter_move_mount":
+		return "    ev->fd_a = (__s32)ctx->args[0];\n    ev->fd_b = (__s32)ctx->args[2];\n    ev->extra = (__u64)ctx->args[4];\n"
+	default:
+		return "    ev->fd_a = (__s32)ctx->args[0];\n    ev->fd_b = (__s32)ctx->args[1];\n    ev->extra = (__u64)ctx->args[2];\n"
+	}
+}
+
 func generateExtraPoll(name string) string {
 	switch name {
 	case "sys_enter_poll":
diff --git a/internal/generate/classify.go b/internal/generate/classify.go
index 2bb2b81..2b750cf 100644
--- a/internal/generate/classify.go
+++ b/internal/generate/classify.go
@@ -21,6 +21,7 @@ const (
 	KindPipe
 	KindEventfd
 	KindEpollCtl
+	KindTwoFd
 	KindPoll
 	KindMem
 	KindSleep
@@ -142,6 +143,18 @@ func classifyNameOnly(name string) (ClassificationResult, bool) {
 		return ClassificationResult{Kind: KindFd}, true
 	case "sys_enter_epoll_ctl":
 		return ClassificationResult{Kind: KindEpollCtl}, true
+	case "sys_enter_move_mount":
+		return ClassificationResult{Kind: KindTwoFd}, true
+	case "sys_enter_fsmount":
+		return ClassificationResult{Kind: KindEventfd}, true
+	case "sys_exit_fsmount":
+		return ClassificationResult{Kind: KindEventfd}, true
+	case "sys_enter_statmount":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_listmount":
+		return ClassificationResult{Kind: KindNull}, true
+	case "sys_enter_listns":
+		return ClassificationResult{Kind: KindNull}, true
 	case "sys_enter_poll":
 		return ClassificationResult{Kind: KindPoll}, true
 	case "sys_enter_ppoll":
@@ -182,18 +195,42 @@ func classifyNameAndField(name, fieldType, fieldName string) (ClassificationResu
 			return ClassificationResult{Kind: KindDup3}, true
 		}
 	case "sys_enter_name_to_handle_at":
-		if fieldType == "const char *" && fieldName == "name" {
+		if isCStringPtrType(fieldType) && fieldName == "name" {
 			return ClassificationResult{Kind: KindPathname, PathnameField: "name"}, true
 		}
 	case "sys_enter_copy_file_range":
 		if isFdType(fieldType) && fieldName == "fd_in" {
 			return ClassificationResult{Kind: KindFd}, true
 		}
+	case "sys_enter_mount":
+		if isCStringPtrType(fieldType) && fieldName == "dir_name" {
+			return ClassificationResult{Kind: KindPathname, PathnameField: "dir_name"}, true
+		}
+	case "sys_enter_umount":
+		if isCStringPtrType(fieldType) && fieldName == "name" {
+			return ClassificationResult{Kind: KindPathname, PathnameField: "name"}, true
+		}
+	case "sys_enter_pivot_root":
+		if isCStringPtrType(fieldType) && fieldName == "new_root" {
+			return ClassificationResult{Kind: KindPathname, PathnameField: "new_root"}, true
+		}
+	case "sys_enter_quotactl":
+		if isCStringPtrType(fieldType) && fieldName == "special" {
+			return ClassificationResult{Kind: KindPathname, PathnameField: "special"}, true
+		}
+	case "sys_enter_swapon":
+		if isCStringPtrType(fieldType) && fieldName == "specialfile" {
+			return ClassificationResult{Kind: KindPathname, PathnameField: "specialfile"}, true
+		}
+	case "sys_enter_swapoff":
+		if isCStringPtrType(fieldType) && fieldName == "specialfile" {
+			return ClassificationResult{Kind: KindPathname, PathnameField: "specialfile"}, true
+		}
 	}
 
 	if strings.HasPrefix(name, "sys_enter") &&
 		strings.Contains(name, "open") &&
-		fieldType == "const char *" && fieldName == "filename" {
+		isCStringPtrType(fieldType) && fieldName == "filename" {
 		return ClassificationResult{Kind: KindOpen}, true
 	}
 
@@ -204,13 +241,13 @@ func classifyByField(fieldType, fieldName string) (ClassificationResult, bool) {
 	switch {
 	case fieldName == "fd" && isFdType(fieldType):
 		return ClassificationResult{Kind: KindFd}, true
-	case fieldType == "const char *" && fieldName == "newname":
+	case isCStringPtrType(fieldType) && fieldName == "newname":
 		return ClassificationResult{Kind: KindName}, true
-	case fieldType == "const char *" && fieldName == "pathname":
+	case isCStringPtrType(fieldType) && fieldName == "pathname":
 		return ClassificationResult{Kind: KindPathname, PathnameField: "pathname"}, true
-	case fieldType == "const char *" && fieldName == "path":
+	case isCStringPtrType(fieldType) && fieldName == "path":
 		return ClassificationResult{Kind: KindPathname, PathnameField: "path"}, true
-	case fieldType == "const char *" && fieldName == "filename":
+	case isCStringPtrType(fieldType) && fieldName == "filename":
 		return ClassificationResult{Kind: KindPathname, PathnameField: "filename"}, true
 	case fieldType == "long" && fieldName == "ret":
 		return ClassificationResult{Kind: KindRet}, true
@@ -222,6 +259,10 @@ func isFdType(t string) bool {
 	return t == "unsigned int" || t == "unsigned long" || t == "int"
 }
 
+func isCStringPtrType(t string) bool {
+	return t == "const char *" || t == "char *"
+}
+
 // ClassifyRet returns the RetClassification for a syscall exit name.
 func ClassifyRet(name string) RetClassification {
 	syscall := strings.ToLower(strings.TrimPrefix(name, "sys_exit_"))
diff --git a/internal/generate/classify_test.go b/internal/generate/classify_test.go
index daf008a..b853994 100644
--- a/internal/generate/classify_test.go
+++ b/internal/generate/classify_test.go
@@ -453,6 +453,108 @@ func TestClassifyClockNanosleep(t *testing.T) {
 	}
 }
 
+func TestClassifyMount(t *testing.T) {
+	r := classifyFromData(t, FormatMount)
+	if r.Kind != KindPathname {
+		t.Errorf("mount: got kind %d, want KindPathname", r.Kind)
+	}
+	if r.PathnameField != "dir_name" {
+		t.Errorf("mount: PathnameField = %q, want dir_name", r.PathnameField)
+	}
+}
+
+func TestClassifyUmount(t *testing.T) {
+	r := classifyFromData(t, FormatUmount)
+	if r.Kind != KindPathname {
+		t.Errorf("umount: got kind %d, want KindPathname", r.Kind)
+	}
+	if r.PathnameField != "name" {
+		t.Errorf("umount: PathnameField = %q, want name", r.PathnameField)
+	}
+}
+
+func TestClassifyMoveMount(t *testing.T) {
+	r := classifyFromData(t, FormatMoveMount)
+	if r.Kind != KindTwoFd {
+		t.Errorf("move_mount: got kind %d, want KindTwoFd", r.Kind)
+	}
+}
+
+func TestClassifyFsmount(t *testing.T) {
+	r := classifyFromData(t, FormatFsmount)
+	if r.Kind != KindEventfd {
+		t.Errorf("fsmount: got kind %d, want KindEventfd", r.Kind)
+	}
+}
+
+func TestClassifyExitFsmount(t *testing.T) {
+	r := classifyFromData(t, FormatExitFsmount)
+	if r.Kind != KindEventfd {
+		t.Errorf("exit_fsmount: got kind %d, want KindEventfd", r.Kind)
+	}
+}
+
+func TestClassifyPivotRoot(t *testing.T) {
+	r := classifyFromData(t, FormatPivotRoot)
+	if r.Kind != KindPathname {
+		t.Errorf("pivot_root: got kind %d, want KindPathname", r.Kind)
+	}
+	if r.PathnameField != "new_root" {
+		t.Errorf("pivot_root: PathnameField = %q, want new_root", r.PathnameField)
+	}
+}
+
+func TestClassifyQuotactl(t *testing.T) {
+	r := classifyFromData(t, FormatQuotactl)
+	if r.Kind != KindPathname {
+		t.Errorf("quotactl: got kind %d, want KindPathname", r.Kind)
+	}
+	if r.PathnameField != "special" {
+		t.Errorf("quotactl: PathnameField = %q, want special", r.PathnameField)
+	}
+}
+
+func TestClassifyStatmount(t *testing.T) {
+	r := classifyFromData(t, FormatStatmount)
+	if r.Kind != KindNull {
+		t.Errorf("statmount: got kind %d, want KindNull", r.Kind)
+	}
+}
+
+func TestClassifyListmount(t *testing.T) {
+	r := classifyFromData(t, FormatListmount)
+	if r.Kind != KindNull {
+		t.Errorf("listmount: got kind %d, want KindNull", r.Kind)
+	}
+}
+
+func TestClassifyListns(t *testing.T) {
+	r := classifyFromData(t, FormatListns)
+	if r.Kind != KindNull {
+		t.Errorf("listns: got kind %d, want KindNull", r.Kind)
+	}
+}
+
+func TestClassifySwapon(t *testing.T) {
+	r := classifyFromData(t, FormatSwapon)
+	if r.Kind != KindPathname {
+		t.Errorf("swapon: got kind %d, want KindPathname", r.Kind)
+	}
+	if r.PathnameField != "specialfile" {
+		t.Errorf("swapon: PathnameField = %q, want specialfile", r.PathnameField)
+	}
+}
+
+func TestClassifySwapoff(t *testing.T) {
+	r := classifyFromData(t, FormatSwapoff)
+	if r.Kind != KindPathname {
+		t.Errorf("swapoff: got kind %d, want KindPathname", r.Kind)
+	}
+	if r.PathnameField != "specialfile" {
+		t.Errorf("swapoff: PathnameField = %q, want specialfile", r.PathnameField)
+	}
+}
+
 func TestClassifyKillRequiresGenerationFallback(t *testing.T) {
 	r := classifyFromData(t, FormatKill)
 	if r.Kind != KindNone {
@@ -509,6 +611,17 @@ func TestClassifySyscallPairAccepted(t *testing.T) {
 		{"mremap", FormatMremap, FormatExitMremap, KindMem},
 		{"nanosleep", FormatNanosleep, FormatExitNanosleep, KindSleep},
 		{"clock_nanosleep", FormatClockNanosleep, FormatExitClockNanosleep, KindSleep},
+		{"mount", FormatMount, FormatExitMount, KindPathname},
+		{"umount", FormatUmount, FormatExitUmount, KindPathname},
+		{"move_mount", FormatMoveMount, FormatExitMoveMount, KindTwoFd},
+		{"fsmount", FormatFsmount, FormatExitFsmount, KindEventfd},
+		{"pivot_root", FormatPivotRoot, FormatExitPivotRoot, KindPathname},
+		{"quotactl", FormatQuotactl, FormatExitQuotactl, KindPathname},
+		{"statmount", FormatStatmount, FormatExitStatmount, KindNull},
+		{"listmount", FormatListmount, FormatExitListmount, KindNull},
+		{"listns", FormatListns, FormatExitListns, KindNull},
+		{"swapon", FormatSwapon, FormatExitSwapon, KindPathname},
+		{"swapoff", FormatSwapoff, FormatExitSwapoff, KindPathname},
 		{"kill", FormatKill, FormatExitKill, KindNull},
 	}
 
@@ -550,6 +663,16 @@ func TestClassifySyscallPairEmitsAllFamilies(t *testing.T) {
 		{"mremap", FormatMremap, FormatExitMremap, FamilyMemory},
 		{"nanosleep", FormatNanosleep, FormatExitNanosleep, FamilyTime},
 		{"clock_nanosleep", FormatClockNanosleep, FormatExitClockNanosleep, FamilyTime},
+		{"mount", FormatMount, FormatExitMount, FamilyFS},
+		{"umount", FormatUmount, FormatExitUmount, FamilyFS},
+		{"move_mount", FormatMoveMount, FormatExitMoveMount, FamilyFS},
+		{"fsmount", FormatFsmount, FormatExitFsmount, FamilyFS},
+		{"quotactl", FormatQuotactl, FormatExitQuotactl, FamilyFS},
+		{"statmount", FormatStatmount, FormatExitStatmount, FamilyFS},
+		{"listmount", FormatListmount, FormatExitListmount, FamilyFS},
+		{"listns", FormatListns, FormatExitListns, FamilyFS},
+		{"swapon", FormatSwapon, FormatExitSwapon, FamilyFS},
+		{"swapoff", FormatSwapoff, FormatExitSwapoff, FamilyFS},
 		{"kill", FormatKill, FormatExitKill, FamilySignals},
 	}
 
diff --git a/internal/generate/codegen_test.go b/internal/generate/codegen_test.go
index bc4ec3a..ac04eba 100644
--- a/internal/generate/codegen_test.go
+++ b/internal/generate/codegen_test.go
@@ -281,6 +281,27 @@ func TestGenerateEpollCtlHandler(t *testing.T) {
 	requireContains(t, output, "ev->event_type = EXIT_RET_EVENT;")
 }
 
+func TestGenerateMoveMountHandler(t *testing.T) {
+	output := generateFromPair(t, FormatMoveMount, FormatExitMoveMount)
+
+	requireContains(t, output, "struct two_fd_event *ev")
+	requireContains(t, output, "ev->event_type = ENTER_TWO_FD_EVENT;")
+	requireContains(t, output, "ev->fd_a = (__s32)ctx->args[0];")
+	requireContains(t, output, "ev->fd_b = (__s32)ctx->args[2];")
+	requireContains(t, output, "ev->extra = (__u64)ctx->args[4];")
+	requireContains(t, output, "ev->event_type = EXIT_RET_EVENT;")
+}
+
+func TestGenerateFsmountHandler(t *testing.T) {
+	output := generateFromPair(t, FormatFsmount, FormatExitFsmount)
+
+	requireContains(t, output, "struct eventfd_event *ev")
+	requireContains(t, output, "ev->event_type = ENTER_EVENTFD_EVENT;")
+	requireContains(t, output, "flags = (__s32)ctx->args[1];")
+	requireContains(t, output, "ev->event_type = EXIT_EVENTFD_EVENT;")
+	requireContains(t, output, "ev->ret = ctx->ret;")
+}
+
 func TestGenerateEpollWaitHandlerUsesEpollFd(t *testing.T) {
 	output := generateFromPair(t, FormatEpollWait, FormatExitEpollWait)
 
@@ -442,6 +463,7 @@ func TestGenerateAllEventTypes(t *testing.T) {
 		{KindPipe, "ENTER_PIPE_EVENT", "EXIT_PIPE_EVENT"},
 		{KindEventfd, "ENTER_EVENTFD_EVENT", "EXIT_EVENTFD_EVENT"},
 		{KindEpollCtl, "ENTER_EPOLL_CTL_EVENT", "EXIT_EPOLL_CTL_EVENT"},
+		{KindTwoFd, "ENTER_TWO_FD_EVENT", "EXIT_TWO_FD_EVENT"},
 		{KindPoll, "ENTER_POLL_EVENT", "EXIT_POLL_EVENT"},
 		{KindMem, "ENTER_MEM_EVENT", "EXIT_MEM_EVENT"},
 		{KindSleep, "ENTER_SLEEP_EVENT", "EXIT_SLEEP_EVENT"},
@@ -477,6 +499,7 @@ func TestEventStructNames(t *testing.T) {
 		{KindPipe, "pipe_event"},
 		{KindEventfd, "eventfd_event"},
 		{KindEpollCtl, "epoll_ctl_event"},
+		{KindTwoFd, "two_fd_event"},
 		{KindPoll, "poll_event"},
 		{KindMem, "mem_event"},
 		{KindSleep, "sleep_event"},
@@ -498,7 +521,7 @@ func TestEnterReject(t *testing.T) {
 		t.Error("KindNone should be enter-rejected")
 	}
 
-	accepted := []TracepointKind{KindFd, KindOpen, KindPathname, KindName, KindFcntl, KindNull, KindDup3, KindOpenByHandleAt, KindSocket, KindSocketpair, KindAccept, KindPipe, KindEventfd, KindEpollCtl, KindPoll, KindMem, KindSleep}
+	accepted := []TracepointKind{KindFd, KindOpen, KindPathname, KindName, KindFcntl, KindNull, KindDup3, KindOpenByHandleAt, KindSocket, KindSocketpair, KindAccept, KindPipe, KindEventfd, KindEpollCtl, KindTwoFd, KindPoll, KindMem, KindSleep}
 	for _, k := range accepted {
 		if isEnterRejected(k) {
 			t.Errorf("kind %d should NOT be enter-rejected", k)
diff --git a/internal/generate/family.go b/internal/generate/family.go
index f39b13f..ff75b5a 100644
--- a/internal/generate/family.go
+++ b/internal/generate/family.go
@@ -152,15 +152,17 @@ var fsSyscalls = map[string]struct{}{
 	"fsmount": {}, "fsopen": {}, "fspick": {}, "fsync": {}, "ftruncate": {},
 	"futimesat": {}, "getcwd": {}, "getdents": {}, "getdents64": {}, "ioctl": {},
 	"link": {}, "linkat": {}, "lseek": {}, "mkdir": {}, "mkdirat": {},
-	"mknod": {}, "mknodat": {}, "mount": {}, "mount_setattr": {}, "move_mount": {},
+	"listmount": {}, "listns": {}, "mknod": {}, "mknodat": {}, "mount": {},
+	"mount_setattr": {}, "move_mount": {},
 	"msync":             {},
 	"name_to_handle_at": {}, "newfstat": {}, "newfstatat": {}, "newlstat": {},
 	"newstat": {}, "open": {}, "open_by_handle_at": {}, "open_tree": {},
 	"open_tree_attr": {}, "openat": {}, "openat2": {}, "quotactl": {},
 	"quotactl_fd": {}, "read": {}, "readahead": {}, "readlink": {}, "readlinkat": {},
 	"readv": {}, "rename": {}, "renameat": {}, "renameat2": {}, "rmdir": {},
-	"statfs": {}, "sync": {}, "sync_file_range": {}, "syncfs": {}, "symlink": {},
-	"symlinkat": {}, "truncate": {}, "umount2": {}, "unlink": {}, "unlinkat": {},
+	"statfs": {}, "statmount": {}, "swapoff": {}, "swapon": {}, "sync": {},
+	"sync_file_range": {}, "syncfs": {}, "symlink": {}, "symlinkat": {},
+	"truncate": {}, "umount": {}, "umount2": {}, "unlink": {}, "unlinkat": {},
 	"utimensat": {}, "write": {}, "writev": {}, "pread64": {}, "preadv": {},
 	"preadv2": {}, "pwrite64": {}, "pwritev": {}, "pwritev2": {},
 }
diff --git a/internal/generate/kindregistry.go b/internal/generate/kindregistry.go
index 96d98d8..2775f38 100644
--- a/internal/generate/kindregistry.go
+++ b/internal/generate/kindregistry.go
@@ -31,6 +31,7 @@ var kindRegistry = map[TracepointKind]kindMeta{
 	KindPipe:           {structName: "pipe_event", enterAccepted: true},
 	KindEventfd:        {structName: "eventfd_event", enterAccepted: true},
 	KindEpollCtl:       {structName: "epoll_ctl_event", enterAccepted: true},
+	KindTwoFd:          {structName: "two_fd_event", enterAccepted: true},
 	KindPoll:           {structName: "poll_event", enterAccepted: true},
 	KindMem:            {structName: "mem_event", enterAccepted: true},
 	KindSleep:          {structName: "sleep_event", enterAccepted: true},
diff --git a/internal/generate/testdata.go b/internal/generate/testdata.go
index d88a1b9..2bc041e 100644
--- a/internal/generate/testdata.go
+++ b/internal/generate/testdata.go
@@ -733,6 +733,339 @@ format:
 print fmt: "pathname: 0x%08lx, mode: 0x%08lx", ((unsigned long)(REC->pathname)), ((unsigned long)(REC->mode))
 `
 
+const FormatMount = `name: sys_enter_mount
+ID: 949
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:const char * dev_name;	offset:16;	size:8;	signed:0;
+	field:const char * dir_name;	offset:24;	size:8;	signed:0;
+	field:const char * type;	offset:32;	size:8;	signed:0;
+	field:unsigned long flags;	offset:40;	size:8;	signed:0;
+	field:void * data;	offset:48;	size:8;	signed:0;
+
+print fmt: "dev_name: 0x%08lx, dir_name: 0x%08lx, type: 0x%08lx, flags: 0x%08lx, data: 0x%08lx", ((unsigned long)(REC->dev_name)), ((unsigned long)(REC->dir_name)), ((unsigned long)(REC->type)), ((unsigned long)(REC->flags)), ((unsigned long)(REC->data))
+`
+
+const FormatExitMount = `name: sys_exit_mount
+ID: 948
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:long ret;	offset:16;	size:8;	signed:1;
+
+print fmt: "0x%lx", REC->ret
+`
+
+const FormatUmount = `name: sys_enter_umount
+ID: 953
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:const char * name;	offset:16;	size:8;	signed:0;
+	field:int flags;	offset:24;	size:8;	signed:0;
+
+print fmt: "name: 0x%08lx, flags: 0x%08lx", ((unsigned long)(REC->name)), ((unsigned long)(REC->flags))
+`
+
+const FormatExitUmount = `name: sys_exit_umount
+ID: 952
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:long ret;	offset:16;	size:8;	signed:1;
+
+print fmt: "0x%lx", REC->ret
+`
+
+const FormatMoveMount = `name: sys_enter_move_mount
+ID: 945
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:int from_dfd;	offset:16;	size:8;	signed:0;
+	field:const char * from_pathname;	offset:24;	size:8;	signed:0;
+	field:int to_dfd;	offset:32;	size:8;	signed:0;
+	field:const char * to_pathname;	offset:40;	size:8;	signed:0;
+	field:unsigned int flags;	offset:48;	size:8;	signed:0;
+
+print fmt: "from_dfd: 0x%08lx, from_pathname: 0x%08lx, to_dfd: 0x%08lx, to_pathname: 0x%08lx, flags: 0x%08lx", ((unsigned long)(REC->from_dfd)), ((unsigned long)(REC->from_pathname)), ((unsigned long)(REC->to_dfd)), ((unsigned long)(REC->to_pathname)), ((unsigned long)(REC->flags))
+`
+
+const FormatExitMoveMount = `name: sys_exit_move_mount
+ID: 944
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:long ret;	offset:16;	size:8;	signed:1;
+
+print fmt: "0x%lx", REC->ret
+`
+
+const FormatFsmount = `name: sys_enter_fsmount
+ID: 947
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:int fs_fd;	offset:16;	size:8;	signed:0;
+	field:unsigned int flags;	offset:24;	size:8;	signed:0;
+	field:unsigned int attr_flags;	offset:32;	size:8;	signed:0;
+
+print fmt: "fs_fd: 0x%08lx, flags: 0x%08lx, attr_flags: 0x%08lx", ((unsigned long)(REC->fs_fd)), ((unsigned long)(REC->flags)), ((unsigned long)(REC->attr_flags))
+`
+
+const FormatExitFsmount = `name: sys_exit_fsmount
+ID: 946
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:long ret;	offset:16;	size:8;	signed:1;
+
+print fmt: "0x%lx", REC->ret
+`
+
+const FormatPivotRoot = `name: sys_enter_pivot_root
+ID: 943
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:const char * new_root;	offset:16;	size:8;	signed:0;
+	field:const char * put_old;	offset:24;	size:8;	signed:0;
+
+print fmt: "new_root: 0x%08lx, put_old: 0x%08lx", ((unsigned long)(REC->new_root)), ((unsigned long)(REC->put_old))
+`
+
+const FormatExitPivotRoot = `name: sys_exit_pivot_root
+ID: 942
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:long ret;	offset:16;	size:8;	signed:1;
+
+print fmt: "0x%lx", REC->ret
+`
+
+const FormatQuotactl = `name: sys_enter_quotactl
+ID: 1164
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:unsigned int cmd;	offset:16;	size:8;	signed:0;
+	field:const char * special;	offset:24;	size:8;	signed:0;
+	field:qid_t id;	offset:32;	size:8;	signed:0;
+	field:void * addr;	offset:40;	size:8;	signed:0;
+
+print fmt: "cmd: 0x%08lx, special: 0x%08lx, id: 0x%08lx, addr: 0x%08lx", ((unsigned long)(REC->cmd)), ((unsigned long)(REC->special)), ((unsigned long)(REC->id)), ((unsigned long)(REC->addr))
+`
+
+const FormatExitQuotactl = `name: sys_exit_quotactl
+ID: 1163
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:long ret;	offset:16;	size:8;	signed:1;
+
+print fmt: "0x%lx", REC->ret
+`
+
+const FormatStatmount = `name: sys_enter_statmount
+ID: 937
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:struct mnt_id_req * req;	offset:16;	size:8;	signed:0;
+	field:struct statmount * smbuf;	offset:24;	size:8;	signed:0;
+	field:size_t bufsize;	offset:32;	size:8;	signed:0;
+	field:unsigned long flags;	offset:40;	size:8;	signed:0;
+
+print fmt: "req: 0x%08lx, smbuf: 0x%08lx, bufsize: 0x%08lx, flags: 0x%08lx", ((unsigned long)(REC->req)), ((unsigned long)(REC->smbuf)), ((unsigned long)(REC->bufsize)), ((unsigned long)(REC->flags))
+`
+
+const FormatExitStatmount = `name: sys_exit_statmount
+ID: 936
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:long ret;	offset:16;	size:8;	signed:1;
+
+print fmt: "0x%lx", REC->ret
+`
+
+const FormatListmount = `name: sys_enter_listmount
+ID: 935
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:struct mnt_id_req * req;	offset:16;	size:8;	signed:0;
+	field:u64 * mnt_ids;	offset:24;	size:8;	signed:0;
+	field:size_t nr_mnt_ids;	offset:32;	size:8;	signed:0;
+	field:unsigned long flags;	offset:40;	size:8;	signed:0;
+
+print fmt: "req: 0x%08lx, mnt_ids: 0x%08lx, nr_mnt_ids: 0x%08lx, flags: 0x%08lx", ((unsigned long)(REC->req)), ((unsigned long)(REC->mnt_ids)), ((unsigned long)(REC->nr_mnt_ids)), ((unsigned long)(REC->flags))
+`
+
+const FormatExitListmount = `name: sys_exit_listmount
+ID: 934
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:long ret;	offset:16;	size:8;	signed:1;
+
+print fmt: "0x%lx", REC->ret
+`
+
+const FormatListns = `name: sys_enter_listns
+ID: 277
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:const struct ns_id_req * req;	offset:16;	size:8;	signed:0;
+	field:u64 * ns_ids;	offset:24;	size:8;	signed:0;
+	field:size_t nr_ns_ids;	offset:32;	size:8;	signed:0;
+	field:unsigned long flags;	offset:40;	size:8;	signed:0;
+
+print fmt: "req: 0x%08lx, ns_ids: 0x%08lx, nr_ns_ids: 0x%08lx, flags: 0x%08lx", ((unsigned long)(REC->req)), ((unsigned long)(REC->ns_ids)), ((unsigned long)(REC->nr_ns_ids)), ((unsigned long)(REC->flags))
+`
+
+const FormatExitListns = `name: sys_exit_listns
+ID: 276
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:long ret;	offset:16;	size:8;	signed:1;
+
+print fmt: "0x%lx", REC->ret
+`
+
+const FormatSwapon = `name: sys_enter_swapon
+ID: 731
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:const char * specialfile;	offset:16;	size:8;	signed:0;
+	field:int swap_flags;	offset:24;	size:8;	signed:0;
+
+print fmt: "specialfile: 0x%08lx, swap_flags: 0x%08lx", ((unsigned long)(REC->specialfile)), ((unsigned long)(REC->swap_flags))
+`
+
+const FormatExitSwapon = `name: sys_exit_swapon
+ID: 730
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:long ret;	offset:16;	size:8;	signed:1;
+
+print fmt: "0x%lx", REC->ret
+`
+
+const FormatSwapoff = `name: sys_enter_swapoff
+ID: 733
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:const char * specialfile;	offset:16;	size:8;	signed:0;
+
+print fmt: "specialfile: 0x%08lx", ((unsigned long)(REC->specialfile))
+`
+
+const FormatExitSwapoff = `name: sys_exit_swapoff
+ID: 732
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:long ret;	offset:16;	size:8;	signed:1;
+
+print fmt: "0x%lx", REC->ret
+`
+
 // Ignored tracepoints
 
 const FormatExecve = `name: sys_enter_execve