Add baseline pidfd_getfd tracepoint support

9 files changed, 110 insertions, 9 deletions

diff --git a/internal/c/generated_tracepoints.c b/internal/c/generated_tracepoints.c
index 5917a85..06f8c39 100644
--- a/internal/c/generated_tracepoints.c
+++ b/internal/c/generated_tracepoints.c
@@ -127,7 +127,6 @@
 /// Ignoring sys_enter_pause sys_exit_pause as possibly not file I/O related
 /// Ignoring sys_enter_perf_event_open sys_exit_perf_event_open as possibly not file I/O related
 /// Ignoring sys_enter_personality sys_exit_personality as possibly not file I/O related
-/// Ignoring sys_enter_pidfd_getfd sys_exit_pidfd_getfd as possibly not file I/O related
 /// Ignoring sys_enter_pidfd_open sys_exit_pidfd_open as possibly not file I/O related
 /// Ignoring sys_enter_pidfd_send_signal sys_exit_pidfd_send_signal as possibly not file I/O related
 /// Ignoring sys_enter_pipe sys_exit_pipe as possibly not file I/O related
@@ -481,6 +480,8 @@
 #define SYS_EXIT_FINIT_MODULE 402
 #define SYS_ENTER_SYSLOG 347
 #define SYS_EXIT_SYSLOG 346
+#define SYS_ENTER_PIDFD_GETFD 271
+#define SYS_EXIT_PIDFD_GETFD 270
 #define SYS_ENTER_MMAP 100
 #define SYS_EXIT_MMAP 99
 
@@ -5725,6 +5726,51 @@ int handle_sys_exit_syslog(struct trace_event_raw_sys_exit *ctx) {
     return 0;
 }
 
+/// sys_enter_pidfd_getfd is a struct fd_event
+SEC("tracepoint/syscalls/sys_enter_pidfd_getfd")
+int handle_sys_enter_pidfd_getfd(struct trace_event_raw_sys_enter *ctx) {
+    __u32 pid, tid;
+    if (filter(&pid, &tid))
+        return 0;
+
+    struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
+    if (!ev)
+        return 0;
+
+    ev->event_type = ENTER_FD_EVENT;
+    ev->trace_id = SYS_ENTER_PIDFD_GETFD;
+    ev->pid = pid;
+    ev->tid = tid;
+    ev->time = bpf_ktime_get_boot_ns();
+    ev->fd = (__s32)ctx->args[0];
+
+    bpf_ringbuf_submit(ev, 0);
+    return 0;
+}
+
+/// sys_exit_pidfd_getfd is a struct ret_event (UNCLASSIFIED)
+SEC("tracepoint/syscalls/sys_exit_pidfd_getfd")
+int handle_sys_exit_pidfd_getfd(struct trace_event_raw_sys_exit *ctx) {
+    __u32 pid, tid;
+    if (filter(&pid, &tid))
+        return 0;
+
+    struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
+    if (!ev)
+        return 0;
+
+    ev->event_type = EXIT_RET_EVENT;
+    ev->trace_id = SYS_EXIT_PIDFD_GETFD;
+    ev->pid = pid;
+    ev->tid = tid;
+    ev->time = bpf_ktime_get_boot_ns();
+    ev->ret = ctx->ret;
+    ev->ret_type = UNCLASSIFIED;
+
+    bpf_ringbuf_submit(ev, 0);
+    return 0;
+}
+
 /// sys_enter_mmap is a struct fd_event
 SEC("tracepoint/syscalls/sys_enter_mmap")
 int handle_sys_enter_mmap(struct trace_event_raw_sys_enter *ctx) {
diff --git a/internal/c/generated_tracepoints_result.txt b/internal/c/generated_tracepoints_result.txt
index 87609e8..c18fec5 100644
--- a/internal/c/generated_tracepoints_result.txt
+++ b/internal/c/generated_tracepoints_result.txt
@@ -125,7 +125,6 @@ Ignoring sys_enter_newuname sys_exit_newuname as possibly not file I/O related
 Ignoring sys_enter_pause sys_exit_pause as possibly not file I/O related
 Ignoring sys_enter_perf_event_open sys_exit_perf_event_open as possibly not file I/O related
 Ignoring sys_enter_personality sys_exit_personality as possibly not file I/O related
-Ignoring sys_enter_pidfd_getfd sys_exit_pidfd_getfd as possibly not file I/O related
 Ignoring sys_enter_pidfd_open sys_exit_pidfd_open as possibly not file I/O related
 Ignoring sys_enter_pidfd_send_signal sys_exit_pidfd_send_signal as possibly not file I/O related
 Ignoring sys_enter_pipe sys_exit_pipe as possibly not file I/O related
@@ -329,6 +328,7 @@ sys_enter_open_tree is a struct open_event
 sys_enter_open_tree_attr is a struct open_event
 sys_enter_openat is a struct open_event
 sys_enter_openat2 is a struct open_event
+sys_enter_pidfd_getfd is a struct fd_event
 sys_enter_pread64 is a struct fd_event
 sys_enter_preadv is a struct fd_event
 sys_enter_preadv2 is a struct fd_event
@@ -445,6 +445,7 @@ sys_exit_open_tree is a struct ret_event (UNCLASSIFIED)
 sys_exit_open_tree_attr is a struct ret_event (UNCLASSIFIED)
 sys_exit_openat is a struct ret_event (UNCLASSIFIED)
 sys_exit_openat2 is a struct ret_event (UNCLASSIFIED)
+sys_exit_pidfd_getfd is a struct ret_event (UNCLASSIFIED)
 sys_exit_pread64 is a struct ret_event (READ_CLASSIFIED)
 sys_exit_preadv is a struct ret_event (READ_CLASSIFIED)
 sys_exit_preadv2 is a struct ret_event (READ_CLASSIFIED)
diff --git a/internal/generate/bpfhandler.go b/internal/generate/bpfhandler.go
index eb9c4c4..2c0d648 100644
--- a/internal/generate/bpfhandler.go
+++ b/internal/generate/bpfhandler.go
@@ -59,6 +59,9 @@ func generateExtra(tp GeneratedTracepoint, isEnter bool) string {
 
 	switch tp.Classification.Kind {
 	case KindFd:
+		if f.Name == "sys_enter_pidfd_getfd" {
+			return "    ev->fd = (__s32)ctx->args[0];\n"
+		}
 		fdIdx := f.FieldNumber("fd")
 		if fdIdx >= 0 {
 			return fmt.Sprintf("    ev->fd = (__s32)ctx->args[%d];\n", fdIdx)
diff --git a/internal/generate/classify.go b/internal/generate/classify.go
index a7d9847..f3b9a44 100644
--- a/internal/generate/classify.go
+++ b/internal/generate/classify.go
@@ -78,7 +78,7 @@ func shouldIgnore(name string) bool {
 	}
 
 	if strings.HasPrefix(name, "sys_enter_") {
-		containsIgnores := []string{"recv", "send", "sock", "inotify", "pidfd"}
+		containsIgnores := []string{"recv", "send", "sock", "inotify"}
 		for _, sub := range containsIgnores {
 			if strings.Contains(name, sub) {
 				return true
diff --git a/internal/generate/classify_test.go b/internal/generate/classify_test.go
index b223210..301d4bc 100644
--- a/internal/generate/classify_test.go
+++ b/internal/generate/classify_test.go
@@ -39,6 +39,13 @@ func TestClassifyFdWrite(t *testing.T) {
 	}
 }
 
+func TestClassifyFdPidfdGetfd(t *testing.T) {
+	r := classifyFromData(t, FormatPidfdGetfd)
+	if r.Kind != KindFd {
+		t.Errorf("pidfd_getfd: got kind %d, want KindFd", r.Kind)
+	}
+}
+
 func TestClassifyOpenOpenat(t *testing.T) {
 	r := classifyFromData(t, FormatOpenat)
 	if r.Kind != KindOpen {
@@ -264,7 +271,6 @@ func TestShouldIgnorePatterns(t *testing.T) {
 		"sys_enter_sendto", "sys_enter_sendmsg", "sys_enter_sendmmsg",
 		"sys_enter_socket", "sys_enter_socketpair", "sys_enter_getsockname",
 		"sys_enter_inotify_init", "sys_enter_inotify_add_watch",
-		"sys_enter_pidfd_open", "sys_enter_pidfd_getfd",
 		"sys_enter_bind", "sys_enter_setns", "sys_enter_shutdown",
 		"sys_enter_connect", "sys_enter_fanotify_init", "sys_enter_getpeername",
 	}
@@ -281,6 +287,7 @@ func TestShouldNotIgnore(t *testing.T) {
 		"sys_enter_close", "sys_enter_rename", "sys_enter_unlink",
 		"sys_enter_copy_file_range",
 		"sys_enter_msync",
+		"sys_enter_pidfd_getfd",
 		"sys_exit_read", "sys_exit_openat",
 	}
 	for _, name := range noIgnore {
@@ -308,6 +315,7 @@ func TestClassifySyscallPairAccepted(t *testing.T) {
 		{"sync", FormatSync, FormatExitSync, KindNull},
 		{"msync", FormatMsync, FormatExitMsync, KindNull},
 		{"getcwd", FormatGetcwd, FormatExitGetcwd, KindNull},
+		{"pidfd_getfd", FormatPidfdGetfd, FormatExitPidfdGetfd, KindFd},
 		{"copy_file_range", FormatCopyFileRange, FormatExitCopyFileRange, KindFd},
 		{"syslog", FormatSyslog, FormatExitSyslog, KindNull},
 		{"open_by_handle_at", FormatOpenByHandleAt, FormatExitOpenByHandleAt, KindOpenByHandleAt},
diff --git a/internal/generate/codegen_test.go b/internal/generate/codegen_test.go
index 3e48c79..caad340 100644
--- a/internal/generate/codegen_test.go
+++ b/internal/generate/codegen_test.go
@@ -24,6 +24,15 @@ func TestGenerateFdHandler(t *testing.T) {
 	requireContains(t, output, "#define SYS_ENTER_READ 844")
 }
 
+func TestGeneratePidfdGetfdHandlerUsesPidfdArgument(t *testing.T) {
+	output := generateFromPair(t, FormatPidfdGetfd, FormatExitPidfdGetfd)
+
+	requireContains(t, output, `SEC("tracepoint/syscalls/sys_enter_pidfd_getfd")`)
+	requireContains(t, output, "ev->event_type = ENTER_FD_EVENT;")
+	requireContains(t, output, "ev->trace_id = SYS_ENTER_PIDFD_GETFD;")
+	requireContains(t, output, "ev->fd = (__s32)ctx->args[0];")
+}
+
 func TestGenerateOpenHandler(t *testing.T) {
 	output := generateFromPair(t, FormatOpenat, FormatExitOpenat)
 
@@ -230,9 +239,9 @@ func TestGenerateHandlerStructure(t *testing.T) {
 func TestGenerateAllEventTypes(t *testing.T) {
 	// Verify every event type constant appears correctly
 	tests := []struct {
-		kind    TracepointKind
-		enter   string
-		exit    string
+		kind  TracepointKind
+		enter string
+		exit  string
 	}{
 		{KindFd, "ENTER_FD_EVENT", "EXIT_FD_EVENT"},
 		{KindOpen, "ENTER_OPEN_EVENT", "EXIT_OPEN_EVENT"},
diff --git a/internal/generate/testdata.go b/internal/generate/testdata.go
index a141a49..a9bedc6 100644
--- a/internal/generate/testdata.go
+++ b/internal/generate/testdata.go
@@ -398,6 +398,36 @@ format:
 print fmt: "0x%lx", REC->ret
 `
 
+const FormatPidfdGetfd = `name: sys_enter_pidfd_getfd
+ID: 271
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:int pidfd;	offset:16;	size:8;	signed:0;
+	field:int fd;	offset:24;	size:8;	signed:0;
+	field:unsigned int flags;	offset:32;	size:8;	signed:0;
+
+print fmt: "pidfd: 0x%08lx, fd: 0x%08lx, flags: 0x%08lx", ((unsigned long)(REC->pidfd)), ((unsigned long)(REC->fd)), ((unsigned long)(REC->flags))
+`
+
+const FormatExitPidfdGetfd = `name: sys_exit_pidfd_getfd
+ID: 270
+format:
+	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
+	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
+	field:unsigned char common_preempt_count;	offset:3;	size:1;	signed:0;
+	field:int common_pid;	offset:4;	size:4;	signed:1;
+
+	field:int __syscall_nr;	offset:8;	size:4;	signed:1;
+	field:long ret;	offset:16;	size:8;	signed:1;
+
+print fmt: "0x%lx", REC->ret
+`
+
 const FormatSync = `name: sys_enter_sync
 ID: 1027
 format:
diff --git a/internal/tracepoints/generated_tracepoints.go b/internal/tracepoints/generated_tracepoints.go
index 0268f12..4b6cae9 100644
--- a/internal/tracepoints/generated_tracepoints.go
+++ b/internal/tracepoints/generated_tracepoints.go
@@ -232,6 +232,8 @@ var List = []string{
 	"sys_exit_finit_module",
 	"sys_enter_syslog",
 	"sys_exit_syslog",
+	"sys_enter_pidfd_getfd",
+	"sys_exit_pidfd_getfd",
 	"sys_enter_mmap",
 	"sys_exit_mmap",
 }
diff --git a/internal/types/generated_types.go b/internal/types/generated_types.go
index e19c803..9cdcc5b 100644
--- a/internal/types/generated_types.go
+++ b/internal/types/generated_types.go
@@ -12,11 +12,11 @@ type EventType uint32
 type TraceId uint32
 
 var traceId2String = map[TraceId]string{
-	1515: "enter_io_uring_register", 1514: "exit_io_uring_register", 1496: "enter_io_uring_enter", 1495: "exit_io_uring_enter", 1494: "enter_io_uring_setup", 1493: "exit_io_uring_setup", 1151: "enter_quotactl_fd", 1150: "exit_quotactl_fd", 1135: "enter_name_to_handle_at", 1134: "exit_name_to_handle_at", 1133: "enter_open_by_handle_at", 1132: "exit_open_by_handle_at", 1119: "enter_flock", 1118: "exit_flock", 1105: "enter_io_setup", 1104: "exit_io_setup", 1103: "enter_io_destroy", 1102: "exit_io_destroy", 1101: "enter_io_submit", 1100: "exit_io_submit", 1099: "enter_io_cancel", 1098: "exit_io_cancel", 1097: "enter_io_getevents", 1096: "exit_io_getevents", 1095: "enter_io_pgetevents", 1094: "exit_io_pgetevents", 1063: "enter_fanotify_mark", 1062: "exit_fanotify_mark", 1053: "enter_file_getattr", 1052: "exit_file_getattr", 1051: "enter_file_setattr", 1050: "exit_file_setattr", 1047: "enter_fspick", 1046: "exit_fspick", 1045: "enter_fsconfig", 1044: "exit_fsconfig", 1043: "enter_statfs", 1042: "exit_statfs", 1041: "enter_fstatfs", 1040: "exit_fstatfs", 1037: "enter_getcwd", 1036: "exit_getcwd", 1035: "enter_utimensat", 1034: "exit_utimensat", 1033: "enter_futimesat", 1032: "exit_futimesat", 1027: "enter_sync", 1026: "exit_sync", 1025: "enter_syncfs", 1024: "exit_syncfs", 1023: "enter_fsync", 1022: "exit_fsync", 1021: "enter_fdatasync", 1020: "exit_fdatasync", 1019: "enter_sync_file_range", 1018: "exit_sync_file_range", 1017: "enter_vmsplice", 1016: "exit_vmsplice", 978: "enter_setxattrat", 977: "exit_setxattrat", 976: "enter_setxattr", 975: "exit_setxattr", 974: "enter_lsetxattr", 973: "exit_lsetxattr", 972: "enter_fsetxattr", 971: "exit_fsetxattr", 970: "enter_getxattrat", 969: "exit_getxattrat", 968: "enter_getxattr", 967: "exit_getxattr", 966: "enter_lgetxattr", 965: "exit_lgetxattr", 964: "enter_fgetxattr", 963: "exit_fgetxattr", 962: "enter_listxattrat", 961: "exit_listxattrat", 960: "enter_listxattr", 959: "exit_listxattr", 958: "enter_llistxattr", 957: "exit_llistxattr", 956: "enter_flistxattr", 955: "exit_flistxattr", 954: "enter_removexattrat", 953: "exit_removexattrat", 952: "enter_removexattr", 951: "exit_removexattr", 950: "enter_lremovexattr", 949: "exit_lremovexattr", 948: "enter_fremovexattr", 947: "exit_fremovexattr", 944: "enter_open_tree", 943: "exit_open_tree", 934: "enter_mount_setattr", 933: "exit_mount_setattr", 932: "enter_open_tree_attr", 931: "exit_open_tree_attr", 924: "enter_close_range", 923: "exit_close_range", 922: "enter_dup3", 921: "exit_dup3", 920: "enter_dup2", 919: "exit_dup2", 918: "enter_dup", 917: "exit_dup", 904: "enter_getdents", 903: "exit_getdents", 902: "enter_getdents64", 901: "exit_getdents64", 900: "enter_ioctl", 899: "exit_ioctl", 898: "enter_fcntl", 897: "exit_fcntl", 892: "enter_mkdirat", 891: "exit_mkdirat", 890: "enter_mkdir", 889: "exit_mkdir", 888: "enter_rmdir", 887: "exit_rmdir", 886: "enter_unlinkat", 885: "exit_unlinkat", 884: "enter_unlink", 883: "exit_unlink", 882: "enter_symlinkat", 881: "exit_symlinkat", 880: "enter_symlink", 879: "exit_symlink", 878: "enter_linkat", 877: "exit_linkat", 876: "enter_link", 875: "exit_link", 874: "enter_renameat2", 873: "exit_renameat2", 872: "enter_renameat", 871: "exit_renameat", 870: "enter_rename", 869: "exit_rename", 860: "enter_newstat", 859: "exit_newstat", 858: "enter_newlstat", 857: "exit_newlstat", 856: "enter_newfstatat", 855: "exit_newfstatat", 854: "enter_newfstat", 853: "exit_newfstat", 852: "enter_readlinkat", 851: "exit_readlinkat", 850: "enter_readlink", 849: "exit_readlink", 848: "enter_statx", 847: "exit_statx", 846: "enter_lseek", 845: "exit_lseek", 844: "enter_read", 843: "exit_read", 842: "enter_write", 841: "exit_write", 840: "enter_pread64", 839: "exit_pread64", 838: "enter_pwrite64", 837: "exit_pwrite64", 836: "enter_readv", 835: "exit_readv", 834: "enter_writev", 833: "exit_writev", 832: "enter_preadv", 831: "exit_preadv", 830: "enter_preadv2", 829: "exit_preadv2", 828: "enter_pwritev", 827: "exit_pwritev", 826: "enter_pwritev2", 825: "exit_pwritev2", 822: "enter_copy_file_range", 821: "exit_copy_file_range", 820: "enter_truncate", 819: "exit_truncate", 818: "enter_ftruncate", 817: "exit_ftruncate", 816: "enter_fallocate", 815: "exit_fallocate", 814: "enter_faccessat", 813: "exit_faccessat", 812: "enter_faccessat2", 811: "exit_faccessat2", 810: "enter_access", 809: "exit_access", 808: "enter_chdir", 807: "exit_chdir", 806: "enter_fchdir", 805: "exit_fchdir", 804: "enter_chroot", 803: "exit_chroot", 802: "enter_fchmod", 801: "exit_fchmod", 800: "enter_fchmodat2", 799: "exit_fchmodat2", 798: "enter_fchmodat", 797: "exit_fchmodat", 796: "enter_chmod", 795: "exit_chmod", 794: "enter_fchownat", 793: "exit_fchownat", 792: "enter_chown", 791: "exit_chown", 790: "enter_lchown", 789: "exit_lchown", 788: "enter_fchown", 787: "exit_fchown", 786: "enter_open", 785: "exit_open", 784: "enter_openat", 783: "exit_openat", 782: "enter_openat2", 781: "exit_openat2", 780: "enter_creat", 779: "exit_creat", 778: "enter_close", 777: "exit_close", 707: "enter_msync", 706: "exit_msync", 613: "enter_readahead", 612: "exit_readahead", 611: "enter_fadvise64", 610: "exit_fadvise64", 592: "enter_cachestat", 591: "exit_cachestat", 403: "enter_finit_module", 402: "exit_finit_module", 347: "enter_syslog", 346: "exit_syslog", 100: "enter_mmap", 99: "exit_mmap",
+	1515: "enter_io_uring_register", 1514: "exit_io_uring_register", 1496: "enter_io_uring_enter", 1495: "exit_io_uring_enter", 1494: "enter_io_uring_setup", 1493: "exit_io_uring_setup", 1151: "enter_quotactl_fd", 1150: "exit_quotactl_fd", 1135: "enter_name_to_handle_at", 1134: "exit_name_to_handle_at", 1133: "enter_open_by_handle_at", 1132: "exit_open_by_handle_at", 1119: "enter_flock", 1118: "exit_flock", 1105: "enter_io_setup", 1104: "exit_io_setup", 1103: "enter_io_destroy", 1102: "exit_io_destroy", 1101: "enter_io_submit", 1100: "exit_io_submit", 1099: "enter_io_cancel", 1098: "exit_io_cancel", 1097: "enter_io_getevents", 1096: "exit_io_getevents", 1095: "enter_io_pgetevents", 1094: "exit_io_pgetevents", 1063: "enter_fanotify_mark", 1062: "exit_fanotify_mark", 1053: "enter_file_getattr", 1052: "exit_file_getattr", 1051: "enter_file_setattr", 1050: "exit_file_setattr", 1047: "enter_fspick", 1046: "exit_fspick", 1045: "enter_fsconfig", 1044: "exit_fsconfig", 1043: "enter_statfs", 1042: "exit_statfs", 1041: "enter_fstatfs", 1040: "exit_fstatfs", 1037: "enter_getcwd", 1036: "exit_getcwd", 1035: "enter_utimensat", 1034: "exit_utimensat", 1033: "enter_futimesat", 1032: "exit_futimesat", 1027: "enter_sync", 1026: "exit_sync", 1025: "enter_syncfs", 1024: "exit_syncfs", 1023: "enter_fsync", 1022: "exit_fsync", 1021: "enter_fdatasync", 1020: "exit_fdatasync", 1019: "enter_sync_file_range", 1018: "exit_sync_file_range", 1017: "enter_vmsplice", 1016: "exit_vmsplice", 978: "enter_setxattrat", 977: "exit_setxattrat", 976: "enter_setxattr", 975: "exit_setxattr", 974: "enter_lsetxattr", 973: "exit_lsetxattr", 972: "enter_fsetxattr", 971: "exit_fsetxattr", 970: "enter_getxattrat", 969: "exit_getxattrat", 968: "enter_getxattr", 967: "exit_getxattr", 966: "enter_lgetxattr", 965: "exit_lgetxattr", 964: "enter_fgetxattr", 963: "exit_fgetxattr", 962: "enter_listxattrat", 961: "exit_listxattrat", 960: "enter_listxattr", 959: "exit_listxattr", 958: "enter_llistxattr", 957: "exit_llistxattr", 956: "enter_flistxattr", 955: "exit_flistxattr", 954: "enter_removexattrat", 953: "exit_removexattrat", 952: "enter_removexattr", 951: "exit_removexattr", 950: "enter_lremovexattr", 949: "exit_lremovexattr", 948: "enter_fremovexattr", 947: "exit_fremovexattr", 944: "enter_open_tree", 943: "exit_open_tree", 934: "enter_mount_setattr", 933: "exit_mount_setattr", 932: "enter_open_tree_attr", 931: "exit_open_tree_attr", 924: "enter_close_range", 923: "exit_close_range", 922: "enter_dup3", 921: "exit_dup3", 920: "enter_dup2", 919: "exit_dup2", 918: "enter_dup", 917: "exit_dup", 904: "enter_getdents", 903: "exit_getdents", 902: "enter_getdents64", 901: "exit_getdents64", 900: "enter_ioctl", 899: "exit_ioctl", 898: "enter_fcntl", 897: "exit_fcntl", 892: "enter_mkdirat", 891: "exit_mkdirat", 890: "enter_mkdir", 889: "exit_mkdir", 888: "enter_rmdir", 887: "exit_rmdir", 886: "enter_unlinkat", 885: "exit_unlinkat", 884: "enter_unlink", 883: "exit_unlink", 882: "enter_symlinkat", 881: "exit_symlinkat", 880: "enter_symlink", 879: "exit_symlink", 878: "enter_linkat", 877: "exit_linkat", 876: "enter_link", 875: "exit_link", 874: "enter_renameat2", 873: "exit_renameat2", 872: "enter_renameat", 871: "exit_renameat", 870: "enter_rename", 869: "exit_rename", 860: "enter_newstat", 859: "exit_newstat", 858: "enter_newlstat", 857: "exit_newlstat", 856: "enter_newfstatat", 855: "exit_newfstatat", 854: "enter_newfstat", 853: "exit_newfstat", 852: "enter_readlinkat", 851: "exit_readlinkat", 850: "enter_readlink", 849: "exit_readlink", 848: "enter_statx", 847: "exit_statx", 846: "enter_lseek", 845: "exit_lseek", 844: "enter_read", 843: "exit_read", 842: "enter_write", 841: "exit_write", 840: "enter_pread64", 839: "exit_pread64", 838: "enter_pwrite64", 837: "exit_pwrite64", 836: "enter_readv", 835: "exit_readv", 834: "enter_writev", 833: "exit_writev", 832: "enter_preadv", 831: "exit_preadv", 830: "enter_preadv2", 829: "exit_preadv2", 828: "enter_pwritev", 827: "exit_pwritev", 826: "enter_pwritev2", 825: "exit_pwritev2", 822: "enter_copy_file_range", 821: "exit_copy_file_range", 820: "enter_truncate", 819: "exit_truncate", 818: "enter_ftruncate", 817: "exit_ftruncate", 816: "enter_fallocate", 815: "exit_fallocate", 814: "enter_faccessat", 813: "exit_faccessat", 812: "enter_faccessat2", 811: "exit_faccessat2", 810: "enter_access", 809: "exit_access", 808: "enter_chdir", 807: "exit_chdir", 806: "enter_fchdir", 805: "exit_fchdir", 804: "enter_chroot", 803: "exit_chroot", 802: "enter_fchmod", 801: "exit_fchmod", 800: "enter_fchmodat2", 799: "exit_fchmodat2", 798: "enter_fchmodat", 797: "exit_fchmodat", 796: "enter_chmod", 795: "exit_chmod", 794: "enter_fchownat", 793: "exit_fchownat", 792: "enter_chown", 791: "exit_chown", 790: "enter_lchown", 789: "exit_lchown", 788: "enter_fchown", 787: "exit_fchown", 786: "enter_open", 785: "exit_open", 784: "enter_openat", 783: "exit_openat", 782: "enter_openat2", 781: "exit_openat2", 780: "enter_creat", 779: "exit_creat", 778: "enter_close", 777: "exit_close", 707: "enter_msync", 706: "exit_msync", 613: "enter_readahead", 612: "exit_readahead", 611: "enter_fadvise64", 610: "exit_fadvise64", 592: "enter_cachestat", 591: "exit_cachestat", 403: "enter_finit_module", 402: "exit_finit_module", 347: "enter_syslog", 346: "exit_syslog", 271: "enter_pidfd_getfd", 270: "exit_pidfd_getfd", 100: "enter_mmap", 99: "exit_mmap",
 }
 
 var traceId2Name = map[TraceId]string{
-	1515: "io_uring_register", 1514: "io_uring_register", 1496: "io_uring_enter", 1495: "io_uring_enter", 1494: "io_uring_setup", 1493: "io_uring_setup", 1151: "quotactl_fd", 1150: "quotactl_fd", 1135: "name_to_handle_at", 1134: "name_to_handle_at", 1133: "open_by_handle_at", 1132: "open_by_handle_at", 1119: "flock", 1118: "flock", 1105: "io_setup", 1104: "io_setup", 1103: "io_destroy", 1102: "io_destroy", 1101: "io_submit", 1100: "io_submit", 1099: "io_cancel", 1098: "io_cancel", 1097: "io_getevents", 1096: "io_getevents", 1095: "io_pgetevents", 1094: "io_pgetevents", 1063: "fanotify_mark", 1062: "fanotify_mark", 1053: "file_getattr", 1052: "file_getattr", 1051: "file_setattr", 1050: "file_setattr", 1047: "fspick", 1046: "fspick", 1045: "fsconfig", 1044: "fsconfig", 1043: "statfs", 1042: "statfs", 1041: "fstatfs", 1040: "fstatfs", 1037: "getcwd", 1036: "getcwd", 1035: "utimensat", 1034: "utimensat", 1033: "futimesat", 1032: "futimesat", 1027: "sync", 1026: "sync", 1025: "syncfs", 1024: "syncfs", 1023: "fsync", 1022: "fsync", 1021: "fdatasync", 1020: "fdatasync", 1019: "sync_file_range", 1018: "sync_file_range", 1017: "vmsplice", 1016: "vmsplice", 978: "setxattrat", 977: "setxattrat", 976: "setxattr", 975: "setxattr", 974: "lsetxattr", 973: "lsetxattr", 972: "fsetxattr", 971: "fsetxattr", 970: "getxattrat", 969: "getxattrat", 968: "getxattr", 967: "getxattr", 966: "lgetxattr", 965: "lgetxattr", 964: "fgetxattr", 963: "fgetxattr", 962: "listxattrat", 961: "listxattrat", 960: "listxattr", 959: "listxattr", 958: "llistxattr", 957: "llistxattr", 956: "flistxattr", 955: "flistxattr", 954: "removexattrat", 953: "removexattrat", 952: "removexattr", 951: "removexattr", 950: "lremovexattr", 949: "lremovexattr", 948: "fremovexattr", 947: "fremovexattr", 944: "open_tree", 943: "open_tree", 934: "mount_setattr", 933: "mount_setattr", 932: "open_tree_attr", 931: "open_tree_attr", 924: "close_range", 923: "close_range", 922: "dup3", 921: "dup3", 920: "dup2", 919: "dup2", 918: "dup", 917: "dup", 904: "getdents", 903: "getdents", 902: "getdents64", 901: "getdents64", 900: "ioctl", 899: "ioctl", 898: "fcntl", 897: "fcntl", 892: "mkdirat", 891: "mkdirat", 890: "mkdir", 889: "mkdir", 888: "rmdir", 887: "rmdir", 886: "unlinkat", 885: "unlinkat", 884: "unlink", 883: "unlink", 882: "symlinkat", 881: "symlinkat", 880: "symlink", 879: "symlink", 878: "linkat", 877: "linkat", 876: "link", 875: "link", 874: "renameat2", 873: "renameat2", 872: "renameat", 871: "renameat", 870: "rename", 869: "rename", 860: "newstat", 859: "newstat", 858: "newlstat", 857: "newlstat", 856: "newfstatat", 855: "newfstatat", 854: "newfstat", 853: "newfstat", 852: "readlinkat", 851: "readlinkat", 850: "readlink", 849: "readlink", 848: "statx", 847: "statx", 846: "lseek", 845: "lseek", 844: "read", 843: "read", 842: "write", 841: "write", 840: "pread64", 839: "pread64", 838: "pwrite64", 837: "pwrite64", 836: "readv", 835: "readv", 834: "writev", 833: "writev", 832: "preadv", 831: "preadv", 830: "preadv2", 829: "preadv2", 828: "pwritev", 827: "pwritev", 826: "pwritev2", 825: "pwritev2", 822: "copy_file_range", 821: "copy_file_range", 820: "truncate", 819: "truncate", 818: "ftruncate", 817: "ftruncate", 816: "fallocate", 815: "fallocate", 814: "faccessat", 813: "faccessat", 812: "faccessat2", 811: "faccessat2", 810: "access", 809: "access", 808: "chdir", 807: "chdir", 806: "fchdir", 805: "fchdir", 804: "chroot", 803: "chroot", 802: "fchmod", 801: "fchmod", 800: "fchmodat2", 799: "fchmodat2", 798: "fchmodat", 797: "fchmodat", 796: "chmod", 795: "chmod", 794: "fchownat", 793: "fchownat", 792: "chown", 791: "chown", 790: "lchown", 789: "lchown", 788: "fchown", 787: "fchown", 786: "open", 785: "open", 784: "openat", 783: "openat", 782: "openat2", 781: "openat2", 780: "creat", 779: "creat", 778: "close", 777: "close", 707: "msync", 706: "msync", 613: "readahead", 612: "readahead", 611: "fadvise64", 610: "fadvise64", 592: "cachestat", 591: "cachestat", 403: "finit_module", 402: "finit_module", 347: "syslog", 346: "syslog", 100: "mmap", 99: "mmap",
+	1515: "io_uring_register", 1514: "io_uring_register", 1496: "io_uring_enter", 1495: "io_uring_enter", 1494: "io_uring_setup", 1493: "io_uring_setup", 1151: "quotactl_fd", 1150: "quotactl_fd", 1135: "name_to_handle_at", 1134: "name_to_handle_at", 1133: "open_by_handle_at", 1132: "open_by_handle_at", 1119: "flock", 1118: "flock", 1105: "io_setup", 1104: "io_setup", 1103: "io_destroy", 1102: "io_destroy", 1101: "io_submit", 1100: "io_submit", 1099: "io_cancel", 1098: "io_cancel", 1097: "io_getevents", 1096: "io_getevents", 1095: "io_pgetevents", 1094: "io_pgetevents", 1063: "fanotify_mark", 1062: "fanotify_mark", 1053: "file_getattr", 1052: "file_getattr", 1051: "file_setattr", 1050: "file_setattr", 1047: "fspick", 1046: "fspick", 1045: "fsconfig", 1044: "fsconfig", 1043: "statfs", 1042: "statfs", 1041: "fstatfs", 1040: "fstatfs", 1037: "getcwd", 1036: "getcwd", 1035: "utimensat", 1034: "utimensat", 1033: "futimesat", 1032: "futimesat", 1027: "sync", 1026: "sync", 1025: "syncfs", 1024: "syncfs", 1023: "fsync", 1022: "fsync", 1021: "fdatasync", 1020: "fdatasync", 1019: "sync_file_range", 1018: "sync_file_range", 1017: "vmsplice", 1016: "vmsplice", 978: "setxattrat", 977: "setxattrat", 976: "setxattr", 975: "setxattr", 974: "lsetxattr", 973: "lsetxattr", 972: "fsetxattr", 971: "fsetxattr", 970: "getxattrat", 969: "getxattrat", 968: "getxattr", 967: "getxattr", 966: "lgetxattr", 965: "lgetxattr", 964: "fgetxattr", 963: "fgetxattr", 962: "listxattrat", 961: "listxattrat", 960: "listxattr", 959: "listxattr", 958: "llistxattr", 957: "llistxattr", 956: "flistxattr", 955: "flistxattr", 954: "removexattrat", 953: "removexattrat", 952: "removexattr", 951: "removexattr", 950: "lremovexattr", 949: "lremovexattr", 948: "fremovexattr", 947: "fremovexattr", 944: "open_tree", 943: "open_tree", 934: "mount_setattr", 933: "mount_setattr", 932: "open_tree_attr", 931: "open_tree_attr", 924: "close_range", 923: "close_range", 922: "dup3", 921: "dup3", 920: "dup2", 919: "dup2", 918: "dup", 917: "dup", 904: "getdents", 903: "getdents", 902: "getdents64", 901: "getdents64", 900: "ioctl", 899: "ioctl", 898: "fcntl", 897: "fcntl", 892: "mkdirat", 891: "mkdirat", 890: "mkdir", 889: "mkdir", 888: "rmdir", 887: "rmdir", 886: "unlinkat", 885: "unlinkat", 884: "unlink", 883: "unlink", 882: "symlinkat", 881: "symlinkat", 880: "symlink", 879: "symlink", 878: "linkat", 877: "linkat", 876: "link", 875: "link", 874: "renameat2", 873: "renameat2", 872: "renameat", 871: "renameat", 870: "rename", 869: "rename", 860: "newstat", 859: "newstat", 858: "newlstat", 857: "newlstat", 856: "newfstatat", 855: "newfstatat", 854: "newfstat", 853: "newfstat", 852: "readlinkat", 851: "readlinkat", 850: "readlink", 849: "readlink", 848: "statx", 847: "statx", 846: "lseek", 845: "lseek", 844: "read", 843: "read", 842: "write", 841: "write", 840: "pread64", 839: "pread64", 838: "pwrite64", 837: "pwrite64", 836: "readv", 835: "readv", 834: "writev", 833: "writev", 832: "preadv", 831: "preadv", 830: "preadv2", 829: "preadv2", 828: "pwritev", 827: "pwritev", 826: "pwritev2", 825: "pwritev2", 822: "copy_file_range", 821: "copy_file_range", 820: "truncate", 819: "truncate", 818: "ftruncate", 817: "ftruncate", 816: "fallocate", 815: "fallocate", 814: "faccessat", 813: "faccessat", 812: "faccessat2", 811: "faccessat2", 810: "access", 809: "access", 808: "chdir", 807: "chdir", 806: "fchdir", 805: "fchdir", 804: "chroot", 803: "chroot", 802: "fchmod", 801: "fchmod", 800: "fchmodat2", 799: "fchmodat2", 798: "fchmodat", 797: "fchmodat", 796: "chmod", 795: "chmod", 794: "fchownat", 793: "fchownat", 792: "chown", 791: "chown", 790: "lchown", 789: "lchown", 788: "fchown", 787: "fchown", 786: "open", 785: "open", 784: "openat", 783: "openat", 782: "openat2", 781: "openat2", 780: "creat", 779: "creat", 778: "close", 777: "close", 707: "msync", 706: "msync", 613: "readahead", 612: "readahead", 611: "fadvise64", 610: "fadvise64", 592: "cachestat", 591: "cachestat", 403: "finit_module", 402: "finit_module", 347: "syslog", 346: "syslog", 271: "pidfd_getfd", 270: "pidfd_getfd", 100: "mmap", 99: "mmap",
 }
 
 func (s TraceId) String() string {
@@ -289,6 +289,8 @@ const SYS_ENTER_FINIT_MODULE TraceId = 403
 const SYS_EXIT_FINIT_MODULE TraceId = 402
 const SYS_ENTER_SYSLOG TraceId = 347
 const SYS_EXIT_SYSLOG TraceId = 346
+const SYS_ENTER_PIDFD_GETFD TraceId = 271
+const SYS_EXIT_PIDFD_GETFD TraceId = 270
 const SYS_ENTER_MMAP TraceId = 100
 const SYS_EXIT_MMAP TraceId = 99