attach_ksyscall
static int attach_ksyscall(const struct bpf_program *prog, long cookie, struct bpf_link **link);
SEC_DEF("ksyscall+", KPROBE, 0, SEC_NONE, attach_ksyscall),
SEC_DEF("kretsyscall+", KPROBE, 0, SEC_NONE, attach_ksyscall),