4 files changed, 52 insertions, 0 deletions
diff --git a/internal/generate/classify_test.go b/internal/generate/classify_test.go
index dc265a6..768e367 100644
--- a/internal/generate/classify_test.go
+++ b/internal/generate/classify_test.go
@@ -88,6 +88,21 @@ func TestClassifyPathnameUnlink(t *testing.T) {
 	}
 }
 
+// TestClassifyPathnameUtime locks in that utime's args[0] "filename" is
+// captured as a real path. utime(2) changes a file's access/modification
+// times; its filename argument is a genuine filesystem path (not a
+// domain/host name string), so it must classify as KindPathname with the
+// path wired to the "filename" field — matching siblings utimensat/futimesat.
+func TestClassifyPathnameUtime(t *testing.T) {
+	r := classifyFromData(t, FormatUtime)
+	if r.Kind != KindPathname {
+		t.Errorf("utime: got kind %d, want KindPathname", r.Kind)
+	}
+	if r.PathnameField != "filename" {
+		t.Errorf("utime: PathnameField = %q, want filename", r.PathnameField)
+	}
+}
+
 func TestClassifyNameRename(t *testing.T) {
 	r := classifyFromData(t, FormatRename)
 	if r.Kind != KindName {
diff --git a/internal/generate/family.go b/internal/generate/family.go
index 1ea8bca..fb36cbd 100644
--- a/internal/generate/family.go
+++ b/internal/generate/family.go
@@ -179,6 +179,11 @@ var fsSyscalls = map[string]struct{}{
 	"statfs": {}, "statmount": {}, "swapoff": {}, "swapon": {}, "sync": {},
 	"sync_file_range": {}, "syncfs": {}, "symlink": {}, "symlinkat": {},
 	"truncate": {}, "umount": {}, "umount2": {}, "unlink": {}, "unlinkat": {},
+	// utime/utimes change a file's access and modification times by path
+	// (filename at args[0] is a real filesystem path, captured as
+	// KindPathname). They belong with their siblings utimensat/futimesat
+	// in the FS family rather than falling through to Misc.
+	"utime": {}, "utimes": {},
 	"utimensat": {}, "write": {}, "writev": {}, "pread64": {}, "preadv": {},
 	"preadv2": {}, "pwrite64": {}, "pwritev": {}, "pwritev2": {},
 }
diff --git a/internal/generate/family_test.go b/internal/generate/family_test.go
index 4a5ccc5..f6c9ca4 100644
--- a/internal/generate/family_test.go
+++ b/internal/generate/family_test.go
@@ -43,6 +43,19 @@ func TestClassifySyscallFamily(t *testing.T) {
 		{"sys_exit_gettimeofday", FamilyTime},
 		{"sys_enter_sched_yield", FamilySched},
 		{"sys_enter_openat", FamilyFS},
+		// utime(2)/utimes(2) change a file's access and modification times by
+		// path (filename at args[0] is a real filesystem path, captured as
+		// KindPathname). They are filesystem-metadata syscalls and share
+		// FamilyFS with their siblings utimensat(2) and futimesat(2); they must
+		// NOT fall through to Misc. Assert all four siblings so a stray
+		// reclassification of any one trips this test. Keep in sync with the FS
+		// list in docs/syscall-tracing-plan.md.
+		{"sys_enter_utime", FamilyFS},
+		{"sys_exit_utime", FamilyFS},
+		{"sys_enter_utimes", FamilyFS},
+		{"sys_exit_utimes", FamilyFS},
+		{"sys_enter_utimensat", FamilyFS},
+		{"sys_enter_futimesat", FamilyFS},
 		{"sys_enter_epoll_wait", FamilyPolling},
 		{"sys_enter_io_uring_enter", FamilyAIO},
 		{"sys_enter_bpf", FamilySecurity},
diff --git a/internal/generate/testdata.go b/internal/generate/testdata.go
index 9676491..50efc00 100644
--- a/internal/generate/testdata.go
+++ b/internal/generate/testdata.go
@@ -370,6 +370,25 @@ format:
 print fmt: "pathname: 0x%08lx", ((unsigned long)(REC->pathname))
 `
 
+// FormatUtime mirrors the real sys_enter_utime tracepoint format: its first
+// argument "filename" is a genuine const char * filesystem path (args[0]),
+// so utime classifies as KindPathname with PathnameField "filename" — the
+// path is captured, just like its siblings utimensat/futimesat.
+const FormatUtime = `name: sys_enter_utime
+ID: 1035
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:char * filename;	offset:16;	size:8;	signed:0;
+	field:struct utimbuf * times;	offset:24;	size:8;	signed:0;
+
+print fmt: "filename: 0x%08lx, times: 0x%08lx", ((unsigned long)(REC->filename)), ((unsigned long)(REC->times))
+`
+
 const FormatDup3 = `name: sys_enter_dup3
 ID: 922
 format: