.arg = { [0] = { .scnprintf = SCA_FDAT,       /* dfd */ },
                   [2] = { .scnprintf = SCA_OPEN_FLAGS, /* flags */ }, }, },
        { .name     = "perf_event_open",
-         .arg = { [0] = { .scnprintf = SCA_PERF_ATTR,  /* attr */ },
+         .arg = { [0] = SCA_PERF_ATTR_FROM_USER(attr),
                   [2] = { .scnprintf = SCA_INT,        /* cpu */ },
                   [3] = { .scnprintf = SCA_FD,         /* group_fd */ },
                   [4] = { .scnprintf = SCA_PERF_FLAGS, /* flags */ }, }, },
 
 }
 
 #define SCA_PERF_ATTR syscall_arg__scnprintf_perf_event_attr
+// 'argname' is just documentational at this point, to remove the previous comment with that info
+#define SCA_PERF_ATTR_FROM_USER(argname) \
+          { .scnprintf  = SCA_PERF_ATTR, \
+            .from_user  = true, }