*** empty log message ***

1 files changed, 726 insertions, 668 deletions

diff --git a/tapset/syscalls.stp b/tapset/syscalls.stp
index 0d4f85bd..0e09bda1 100644
--- a/tapset/syscalls.stp
+++ b/tapset/syscalls.stp
@@ -15,10 +15,12 @@
 *
 * argstr - a string containing the decoded args in an easy-to-read format.
 *          It doesn't need to contain everything, but should have all the
-*          important args. Set in entry probes only.
+*          important args. Set in entry probes only. Values enclosed in
+*          square brackets are user-space pointers. Values in curly
+*          braces are decoded structs.
 *
 * retstr - a string containing the return value in an easy-to-read format.
-*          Set in return probes only.
+*          Set in return probes only. 
 */
 
 
@@ -51,6 +53,43 @@ probe syscall.access.return = kernel.function("sys_access").return {
 	retstr = returnstr(1)
 }
 
+# acct _______________________________________________________
+# long sys_acct(const char __user *name)
+probe syscall.acct = kernel.function("sys_acct") {
+	name = "acct"
+        filename = user_string($name)
+	argstr = user_string_quoted($name)
+}
+probe syscall.acct.return = kernel.function("sys_acct").return {
+	name = "acct"
+	retstr = returnstr(1)
+}
+
+# add_key ____________________________________________________
+# long sys_add_key(const char __user *_type,
+#             const char __user *_description,
+#             const void __user *_payload,
+#             size_t plen,
+#             key_serial_t ringid)
+#
+probe syscall.add_key = kernel.function("sys_add_key") {
+	name = "add_key"
+	type_uaddr = $_type
+	description_auddr = $_description
+	payload_uaddr = $_payload
+	plen = $plen
+	ringid = $ringid
+	argstr = sprintf("%s, %s, %s, %d, %d", 
+			user_string_quoted($_type),
+			user_string_quoted($_description),
+			text_strn(user_string($_payload),20,1),
+			$plen, $ringid)
+}
+probe syscall.add_key.return = kernel.function("sys_add_key").return {
+	name = "add_key"
+	retstr = returnstr(1)
+}
+
 # adjtimex ___________________________________________________
 # long sys_adjtimex(struct timex __user *txc_p)
 probe syscall.adjtimex = kernel.function("sys_adjtimex") {
@@ -251,7 +290,7 @@ probe syscall.clock_getres = kernel.function("sys_clock_getres") {
 	clk_id = $which_clock
 	clk_id_str = _get_wc_str($which_clock)
 	res_uaddr = $tp
-	#fixme argstr
+	argstr = sprintf("%s, %p", _get_wc_str($which_clock), $tp)
 }
 probe syscall.clock_getres.return = kernel.function("sys_clock_getres").return {
 	name = "clock_getres"
@@ -265,51 +304,53 @@ probe syscall.clock_gettime = kernel.function("sys_clock_gettime") {
 	clk_id = $which_clock
 	clk_id_str = _get_wc_str($which_clock)
 	tp_uaddr = $tp
-	#fixme argstr
+	argstr = sprintf("%s, %p", _get_wc_str($which_clock), $tp)
 }
 probe syscall.clock_gettime.return = kernel.function("sys_clock_gettime").return {
 	name = "clock_gettime"
 	retstr = returnstr(1)
 }
+
 # clock_nanosleep ____________________________________________
-/*
- * asmlinkage long
- * sys_clock_nanosleep(clockid_t which_clock,
- *                     int flags,
- *                     const struct timespec __user *rqtp,
- *                     struct timespec __user *rmtp)
- */
-probe kernel.syscall.clock_nanosleep =
-   kernel.function("sys_clock_nanosleep") {
-      name = "clock_nanosleep"
-      clock_id = $which_clock
-      clock_id_str = _get_wc_str($which_clock)
-      flags = $flags
-      flag_str = "TIMER_ABSTIME"
-      rqtp_uaddr = $rqtp
-      rmtp_uaddr = $rmtp
-   }
-probe kernel.syscall.clock_nanosleep.return =
-   kernel.function("sys_clock_nanosleep").return {
-      name = "clock_nanosleep.return"
-   }
+# long sys_clock_nanosleep(clockid_t which_clock,
+#                     int flags,
+#                     const struct timespec __user *rqtp,
+#                     struct timespec __user *rmtp)
+#
+probe syscall.clock_nanosleep = kernel.function("sys_clock_nanosleep") {
+	name = "clock_nanosleep"
+	clock_id = $which_clock
+	clock_id_str = _get_wc_str($which_clock)
+	flags = $flags
+	if ($flags == 0)
+		flag_str = "0"
+	else
+		flag_str = "TIMER_ABSTIME"
+	rqtp_uaddr = $rqtp
+	rmtp_uaddr = $rmtp
+	argstr = sprintf("%s, %s, %s, %p", clock_id_str, flag_str, 
+			_struct_timespec_u($rqtp), $rmtp)
+}
+probe syscall.clock_nanosleep.return = kernel.function("sys_clock_nanosleep").return {
+	name = "clock_nanosleep"
+	retstr = returnstr(1)
+}
+
 # clock_settime ______________________________________________
-/*
- * asmlinkage long
- * sys_clock_settime(clockid_t which_clock,
- *                   const struct timespec __user *tp)
- */
-probe kernel.syscall.clock_settime =
-   kernel.function("sys_clock_settime") {
-      name = "clock_settime"
-      clk_id = $which_clock
-      clk_id_str = _get_wc_str($which_clock)
-      tp_uaddr = $tp
-   }
-probe kernel.syscall.clock_settime.return =
-   kernel.function("sys_clock_settime").return {
-      name = "clock_settime.return"
-   }
+# long sys_clock_settime(clockid_t which_clock,
+#                   const struct timespec __user *tp)
+#
+probe syscall.clock_settime = kernel.function("sys_clock_settime") {
+	name = "clock_settime"
+	clk_id = $which_clock
+	clk_id_str = _get_wc_str($which_clock)
+	tp_uaddr = $tp
+	argstr = sprintf("%s, %s", clk_id_str, _struct_timespec_u($tp))
+}
+probe syscall.clock_settime.return = kernel.function("sys_clock_settime").return {
+	name = "clock_settime"
+	retstr = returnstr(1)
+}
 
 # close ______________________________________________________
 # long sys_close(unsigned int fd)
@@ -387,46 +428,40 @@ probe syscall.epoll_create.return = kernel.function("sys_epoll_create").return {
 }
 
 # epoll_ctl __________________________________________________
-/*
- * asmlinkage long
- * sys_epoll_ctl(int epfd,
- *               int op,
- *               int fd,
- *               struct epoll_event __user *event)
- */
-probe kernel.syscall.epoll_ctl =
-   kernel.function("sys_epoll_ctl") {
-      name = "epoll_ctl"
-      epfd = $epfd
-      op = $op
-      op_str = _opoll_op_str($op)
-      fd = $fd
-      event_uaddr = $event
-   }
-probe kernel.syscall.epoll_ctl.return =
-   kernel.function("sys_epoll_ctl").return {
-      name = "epoll_ctl.return"
-   }
+#
+# long sys_epoll_ctl(int epfd, int op, int fd, struct epoll_event __user *event)
+#
+probe syscall.epoll_ctl = kernel.function("sys_epoll_ctl") {
+	name = "epoll_ctl"
+	epfd = $epfd
+	op = $op
+	op_str = _opoll_op_str($op)
+	fd = $fd
+	event_uaddr = $event
+	argstr = sprintf("%d, %s, %d, %p", $epfd, _opoll_op_str($op), $fd, $event)
+}
+probe syscall.epoll_ctl.return = kernel.function("sys_epoll_ctl").return {
+	name = "epoll_ctl"
+	retstr = returnstr(1)
+}
+
 # epoll_wait _________________________________________________
-/*
- * asmlinkage long
- * sys_epoll_wait(int epfd,
- *                struct epoll_event __user *events,
- *                int maxevents,
- *                int timeout)
- */
-probe kernel.syscall.epoll_wait =
-   kernel.function("sys_epoll_wait") {
-      name = "epoll_wait"
-      epfd = $epfd
-      events_uaddr = $events
-      maxevents = $maxevents
-      timeout = $timeout
-   }
-probe kernel.syscall.epoll_wait.return =
-   kernel.function("sys_epoll_wait").return {
-      name = "epoll_wait.return"
-   }
+#
+# long sys_epoll_wait(int epfd, struct epoll_event __user *events,
+#               int maxevents, int timeout)
+#
+probe syscall.epoll_wait = kernel.function("sys_epoll_wait") {
+	name = "epoll_wait"
+	epfd = $epfd
+	events_uaddr = $events
+	maxevents = $maxevents
+	timeout = $timeout
+	argstr = sprintf("%d, %p, %d, %d", $epfd, $events, $maxevents, $timeout)
+}
+probe syscall.epoll_wait.return = kernel.function("sys_epoll_wait").return {
+	name = "epoll_wait"
+	retstr = returnstr(1)
+}
 
 # execve _____________________________________________________
 # int sys_execve(struct pt_regs regs)
@@ -458,58 +493,47 @@ probe syscall.exit = kernel.function("do_exit") {
 probe syscall.exit.return = end {}
 
 # exit_group _________________________________________________
-/*
- * asmlinkage void
- * sys_exit_group(int error_code)
- */
-probe kernel.syscall.exit_group =
-   kernel.function("sys_exit_group") {
-      name = "exit_group"
-      status = $error_code
-   }
+# void sys_exit_group(int error_code)
+#
+probe syscall.exit_group = kernel.function("sys_exit_group") {
+	name = "exit_group"
+	status = $error_code
+	argstr = sprint($error_code)
+}
 
-probe kernel.syscall.exit_group.return = end {}
+probe syscall.exit_group.return = end {}
 
 # fadvise64 __________________________________________________
-/*
- * asmlinkage long
- * sys_fadvise64_64(int fd,
- *                  loff_t offset,
- *                  loff_t len,
- *                  int advice)
- */
-probe kernel.syscall.fadvise64 =
-   kernel.function("sys_fadvise64_64") {
-      name = "fadvise64"
-      fd = $fd
-      offset = $offset
-      len = $len
-      advice = $advice
-   }
-probe kernel.syscall.fadvise64.return =
-   kernel.function("sys_fadvise64_64").return {
-      name = "fadvise64.return"
-   }
+# long sys_fadvise64(int fd, loff_t offset, size_t len,  int advice)
+#
+probe syscall.fadvise64 = kernel.function("sys_fadvise64") {
+	name = "fadvise64"
+	fs = $fd
+	offset = $offset
+	len = $len
+	advice = $advice
+	argstr = sprintf("%d, %d, %d, %s", $fd, $offset, $len, _fadvice_advice_str($advice))
+}
+probe syscall.fadvise64.return = kernel.function("sys_fadvise64").return {
+	name = "fadvise64"
+	retstr = returnstr(1)
+}
+
 # fadvise64_64 _______________________________________________
-/*
- * asmlinkage long
- * sys_fadvise64_64(int fd,
- *                  loff_t offset,
- *                  loff_t len,
- *                  int advice)
- */
-probe kernel.syscall.fadvise64_64 =
-   kernel.function("sys_fadvise64_64") {
-      name = "fadvise64_64"
-      fs = $fd
-      offset = $offset
-      len = $len
-      advice = $advice
-   }
-probe kernel.syscall.fadvise64_64.return =
-   kernel.function("sys_fadvise64_64").return {
-      name = "fadvise64_64.return"
-   }
+# long sys_fadvise64_64(int fd, loff_t offset, loff_t len,  int advice)
+#
+probe syscall.fadvise64_64 = kernel.function("sys_fadvise64_64") {
+	name = "fadvise64_64"
+	fs = $fd
+	offset = $offset
+	len = $len
+	advice = $advice
+	argstr = sprintf("%d, %d, %d, %s", $fd, $offset, $len, _fadvice_advice_str($advice))
+}
+probe syscall.fadvise64_64.return =  kernel.function("sys_fadvise64_64").return {
+	name = "fadvise64_64"
+	retstr = returnstr(1)
+}
 
 # fchdir _____________________________________________________
 # long sys_fchdir(unsigned int fd)
@@ -601,7 +625,7 @@ probe syscall.fgetxattr = kernel.function("sys_fgetxattr") {
 	name2 = user_string($name)
 	value_uaddr = $value
 	size  = $size
-	argstr = sprintf("%d, %s, [%p], %d", filedes, user_string_quoted($name), value_uaddr, size)
+	argstr = sprintf("%d, %s, %p, %d", filedes, user_string_quoted($name), value_uaddr, size)
 }
 probe syscall.fgetxattr.return = kernel.function("sys_fgetxattr").return {
 	name = "fgetxattr"
@@ -614,7 +638,7 @@ probe syscall.flistxattr = kernel.function("sys_flistxattr") {
 	filedes = $fd
 	list_uaddr = $list
 	size = $size
-	argstr = sprintf("%d, [%p], %d", filedes, list_uaddr, size)
+	argstr = sprintf("%d, %p, %d", filedes, list_uaddr, size)
 }
 probe syscall.flistxattr.return = kernel.function("sys_flistxattr").return {
 	name = "flistxattr"
@@ -695,7 +719,7 @@ probe syscall.fsetxattr = kernel.function("sys_fsetxattr") {
 	value_uaddr = $value
 	size = $size
 	flags = $flags
-	argstr = sprintf("%d, %s, [%p], %d, %p", filedes, user_string_quoted($name), value_uaddr, size, flags)
+	argstr = sprintf("%d, %s, %p, %d, %p", filedes, user_string_quoted($name), value_uaddr, size, flags)
 }
 probe syscall.fsetxattr.return = kernel.function("sys_fsetxattr").return {
 	name = "fsetxattr"
@@ -716,7 +740,7 @@ probe syscall.fstat =
 	name = "fstat"
 	filedes = $fd
 	buf_uaddr = $statbuf
-	argstr = sprintf("%d, [%p]", $fd, $statbuf)
+	argstr = sprintf("%d, %p", $fd, $statbuf)
 }
 probe syscall.fstat.return = 
 		kernel.function("sys_fstat").return ?,
@@ -734,7 +758,7 @@ probe syscall.fstatfs = kernel.function("sys_fstatfs") {
 	name = "fstatfs"
 	fd = $fd
 	buf_uaddr = $buf
-	argstr = sprintf("%d, [%p]", fd, buf_uaddr)
+	argstr = sprintf("%d, %p", fd, buf_uaddr)
 }
 probe syscall.fstatfs.return = kernel.function("sys_fstatfs").return {
 	name = "fstatfs"
@@ -748,7 +772,7 @@ probe syscall.fstatfs64 = kernel.function("sys_fstatfs64") {
 	fd = $fd
 	sz = $sz
 	buf_uaddr = $buf
-	argstr = sprintf("%d, %d, [%p]", fd, sz, buf_uaddr)
+	argstr = sprintf("%d, %d, %p", fd, sz, buf_uaddr)
 }
 probe syscall.fstatfs64.return = kernel.function("sys_fstatfs64").return {
 	name = "fstatfs"
@@ -826,7 +850,7 @@ probe syscall.getcwd = kernel.function("sys_getcwd") {
 	name = "getcwd"
 	buf_uaddr = $buf
 	size = $size
-	argstr = sprintf("[%p], %d", buf_uaddr, size)
+	argstr = sprintf("%p, %d", buf_uaddr, size)
 }
 probe syscall.getcwd.return = kernel.function("sys_getcwd").return {
 	name = "getcwd"
@@ -842,7 +866,7 @@ probe syscall.getdents = kernel.function("sys_getdents") {
 	fd = $fd
 	dirp_uaddr = $dirent
 	count = $count
-	argstr = sprintf("%d, [%p], %d", fd, dirp_uaddr, count)
+	argstr = sprintf("%d, %p, %d", fd, dirp_uaddr, count)
 }
 probe syscall.getdents.return = kernel.function("sys_getdents").return {
 	name = "getdents"
@@ -858,7 +882,7 @@ probe syscall.getdents64 = kernel.function("sys_getdents64") {
 	fd = $fd
 	dirp_uaddr = $dirent
 	count = $count
-	argstr = sprintf("%d, [%p], %d", fd, dirp_uaddr, count)
+	argstr = sprintf("%d, %p, %d", fd, dirp_uaddr, count)
 }
 probe syscall.getdents64.return = kernel.function("sys_getdents64").return {
 	name = "getdents"
@@ -931,7 +955,7 @@ probe syscall.getgroups = kernel.function("sys_getgroups") {
 	name = "getgroups"
 	size = $gidsetsize
 	list_uaddr = $grouplist
-	argstr = sprintf("%d, [%p]", size, list_uaddr)
+	argstr = sprintf("%d, %p", size, list_uaddr)
 }
 probe syscall.getgroups.return = kernel.function("sys_getgroups").return {
 	name = "getgroups"
@@ -944,7 +968,7 @@ probe syscall.gethostname = kernel.function("sys_gethostname") {
 	name = "gethostname"
 	name_uaddr = $name
 	len = $len
-	argstr = sprintf ("[%p], %d", name_uaddr, len)
+	argstr = sprintf ("%p, %d", name_uaddr, len)
 }
 probe syscall.gethostname.return = kernel.function("sys_gethostname").return {
 	name = "gethostname"
@@ -957,31 +981,50 @@ probe syscall.getitimer = kernel.function("sys_getitimer") {
 	name = "getitimer"
 	which = $which
 	value_uaddr = $value
-	argstr = sprintf("%s, [%p]", _itimer_which_str(which), value_uaddr) 
+	argstr = sprintf("%s, %p", _itimer_which_str($which), $value) 
 }
 probe syscall.getitimer.return = kernel.function("sys_getitimer").return {
 	name = "getitimer"
 	retstr = returnstr(1)
 }
 
+# get_mempolicy ______________________________________________
+# long sys_get_mempolicy(int __user *policy,
+#                   unsigned long __user *nmask,
+#                   unsigned long maxnode,
+#                   unsigned long addr,
+#                   unsigned long flags)
+#
+probe syscall.get_mempolicy = kernel.function("sys_get_mempolicy") ? {
+	name = "get_mempolicy"
+	policy_uaddr = $policy
+	nmask_uaddr = $nmask
+	maxnode = $maxnode
+	addr = $addr
+	flags = $flags
+	argstr = sprintf("%p, %p, %d, %p, %d", policy_uaddr,
+			nmask_uaddr, $maxnode, $addr, $flags)
+}
+probe syscall.get_mempolicy.return = 
+		kernel.function("sys_get_mempolicy").return ? {
+	name = "get_mempolicy"
+	retstr = returnstr(1)
+}
+
 # getpeername ________________________________________________
-/*
- * asmlinkage long
- * sys_getpeername(int fd,
- *                 struct sockaddr __user *usockaddr,
- *                 int __user *usockaddr_len)
- */
-probe kernel.syscall.getpeername =
-   kernel.function("sys_getpeername") {
-      name = "getpeername"
-      s = $fd
-      name_uaddr = $usockaddr
-      namelen_uaddr = $usockaddr_len
-   }
-probe kernel.syscall.getpeername.return =
-   kernel.function("sys_getpeername").return {
-      name = "getpeername.return"
-   }
+# long sys_getpeername(int fd, struct sockaddr __user *usockaddr, int __user *usockaddr_len)
+#
+probe syscall.getpeername = kernel.function("sys_getpeername") {
+	name = "getpeername"
+	s = $fd
+	name_uaddr = $usockaddr
+	namelen_uaddr = $usockaddr_len
+	argstr = sprintf("%d, %p, %p", $fd, $usockaddr, $usockaddr_len)
+}
+probe syscall.getpeername.return = kernel.function("sys_getpeername").return {
+	name = "getpeername"
+	retstr = returnstr(1)
+}
 
 # getpgid ____________________________________________________
 # long sys_getpgid(void)
@@ -1044,7 +1087,7 @@ probe syscall.getresgid = kernel.function("sys_getresgid") {
 	rgid_uaddr = $rgid
 	egid_uaddr = $egid
 	sgid_uaddr = $sgid
-	argstr = sprintf("[%p], [%p], [%p]", rgid_uaddr, egid_uaddr, sgid_uaddr)
+	argstr = sprintf("%p, %p, %p", rgid_uaddr, egid_uaddr, sgid_uaddr)
 }
 probe syscall.getresgid.return = kernel.function("sys_getresgid").return {
 	name = "getresgid"
@@ -1060,7 +1103,7 @@ probe syscall.getresgid16 = kernel.function("sys_getresgid16") ? {
 	rgid_uaddr = $rgid
 	egid_uaddr = $egid
 	sgid_uaddr = $sgid
-	argstr = sprintf("[%p], [%p], [%p]", rgid_uaddr, egid_uaddr, sgid_uaddr)
+	argstr = sprintf("%p, %p, %p", rgid_uaddr, egid_uaddr, sgid_uaddr)
 }
 probe syscall.getresgid16.return = kernel.function("sys_getresgid16").return ? {
 	name = "getresgid16"
@@ -1076,7 +1119,7 @@ probe syscall.getresuid = kernel.function("sys_getresuid") {
 	ruid_uaddr = $ruid
 	euid_uaddr = $euid
 	suid_uaddr = $suid
-	argstr = sprintf("[%p], [%p], [%p]", ruid_uaddr, euid_uaddr, suid_uaddr)
+	argstr = sprintf("%p, %p, %p", ruid_uaddr, euid_uaddr, suid_uaddr)
 }
 probe syscall.getresuid.return = kernel.function("sys_getresuid").return {
 	name = "getresuid"
@@ -1092,7 +1135,7 @@ probe syscall.getresuid16 = kernel.function("sys_getresuid16") ? {
 	ruid_uaddr = $ruid
 	euid_uaddr = $euid
 	suid_uaddr = $suid
-	argstr = sprintf("[%p], [%p], [%p]", ruid_uaddr, euid_uaddr, suid_uaddr)
+	argstr = sprintf("%p, %p, %p", ruid_uaddr, euid_uaddr, suid_uaddr)
 }
 probe syscall.getresuid16.return = kernel.function("sys_getresuid16").return ? {
 	name = "getresuid16"
@@ -1105,7 +1148,7 @@ probe syscall.getrlimit = kernel.function("sys_getrlimit") {
 	name = "getrlimit"
 	resource = $resource
 	rlim_uaddr = $rlim
-	argstr = sprintf("%s, [%p]", _rlimit_resource_str($resource), rlim_uaddr)
+	argstr = sprintf("%s, %p", _rlimit_resource_str($resource), rlim_uaddr)
 }
 probe syscall.getrlimit.return = kernel.function("sys_getrlimit").return {
 	name = "getrlimit"
@@ -1118,7 +1161,7 @@ probe syscall.getrusage = kernel.function("sys_getrusage") {
 	name = "getrusage"
 	who = $who
 	usage_uaddr = $ru
-	argstr = sprintf("%s, [%p]",_rusage_who_str($who), usage_uaddr)
+	argstr = sprintf("%s, %p",_rusage_who_str($who), usage_uaddr)
 }
 probe syscall.getrusage.return = kernel.function("sys_getrusage").return {
 	name = "getrusage"
@@ -1141,42 +1184,40 @@ probe syscall.getsid.return = kernel.function("sys_getsid").return {
 # long sys_getsockname(int fd,
 #		struct sockaddr __user *usockaddr,
 #		int __user *usockaddr_len)
-probe kernel.syscall.getsockname =
-   kernel.function("sys_getsockname") {
-      name = "getsockname"
-      s = $fd
-      name_uaddr = $usockaddr
-      namelen_uaddr = $usockaddr_len
-   }
-probe kernel.syscall.getsockname.return =
-   kernel.function("sys_getsockname").return {
-      name = "getsockname.return"
-   }
+probe syscall.getsockname = kernel.function("sys_getsockname") {
+	name = "getsockname"
+	s = $fd
+	name_uaddr = $usockaddr
+	namelen_uaddr = $usockaddr_len
+	argstr = sprintf("%d, %p, %p", $fd, $usockaddr, $usockaddr_len)
+}
+probe syscall.getsockname.return = kernel.function("sys_getsockname").return {
+	name = "getsockname"
+	retstr = returnstr(1)
+}
 
 # getsockopt _________________________________________________
-/*
- * asmlinkage long
- * sys_getsockopt(int fd,
- *                int level,
- *                int optname,
- *                char __user *optval,
- *                int __user *optlen)
- */
-probe kernel.syscall.getsockopt =
-   kernel.function("sys_getsockopt") {
-      name = "getsockopt"
-      fd = $fd
-      level = $level
-      level_str = _sockopt_level_str($level)
-      optname = $optname
-      optname_str = _sockopt_optname_str($optname)
-      optval_uaddr = $optval
-      optlen_uaddr = $optlen
-   }
-probe kernel.syscall.getsockopt.return =
-   kernel.function("sys_getsockopt").return {
-      name = "getsockopt.return"
-   }
+# long sys_getsockopt(int fd,
+#                int level,
+#                int optname,
+#                char __user *optval,
+#                int __user *optlen)
+#
+probe syscall.getsockopt = kernel.function("sys_getsockopt") {
+	name = "getsockopt"
+	fd = $fd
+	level = $level
+	level_str = _sockopt_level_str($level)
+	optname = $optname
+	optname_str = _sockopt_optname_str($optname)
+	optval_uaddr = $optval
+	optlen_uaddr = $optlen
+	argstr = sprintf("%d, %s, %s, %p, %p", $fd,  _sockopt_level_str($level),
+			_sockopt_optname_str($optname), $optval, $optlen)
+}
+probe syscall.getsockopt.return = kernel.function("sys_getsockopt").return {
+	name = "getsockopt.return"
+}
 
 # gettid _____________________________________________________
 # long sys_gettid(void)
@@ -1195,7 +1236,7 @@ probe syscall.gettimeofday = kernel.function("sys_gettimeofday") {
 	name = "gettimeofday"
 	tv_uaddr = $tv
 	tz_uaddr = $tz
-	argstr = sprintf("[%p], [%p]", tv_uaddr, tz_uaddr)
+	argstr = sprintf("%p, %p", $tv, $tz)
 }
 probe syscall.gettimeofday.return = kernel.function("sys_gettimeofday").return {
 	name = "gettimeofday"
@@ -1232,7 +1273,7 @@ probe syscall.getxattr = kernel.function("sys_getxattr") {
 	name2 = user_string($name)
 	value_uaddr = $value
 	size = $size
-	argstr = sprintf("%s, %s, [%p], %d", 
+	argstr = sprintf("%s, %s, %p, %d", 
 		user_string_quoted($path), 
 		user_string_quoted($name),
 		value_uaddr, size)
@@ -1251,7 +1292,7 @@ probe syscall.init_module = kernel.function("sys_init_module") {
 	umod_uaddr = $umod
 	len = $len
 	uargs = user_string($uargs)
-	argstr = sprintf("[%p], %d, %s", umod_uaddr, len, uargs)
+	argstr = sprintf("%p, %d, %s", umod_uaddr, len, uargs)
 }
 probe syscall.init_module.return = kernel.function("sys_init_module").return {
 	name = "init_module"
@@ -1267,7 +1308,7 @@ probe syscall.io_cancel = kernel.function("sys_io_cancel") {
 	ctx_id = $ctx_id
 	iocb_uaddr = $iocb
 	result_uaddr = $result
-	argstr = sprintf("%d, [%p], [%p]", ctx_id, iocb_uaddr, result_uaddr)	
+	argstr = sprintf("%d, %p, %p", ctx_id, iocb_uaddr, result_uaddr)	
 }
 probe syscall.io_cancel.return = kernel.function("sys_io_cancel").return {
 	name = "io_cancel"
@@ -1282,7 +1323,7 @@ probe syscall.ioctl = kernel.function("sys_ioctl") {
 	fd = $fd
 	request = $cmd
 	argp = $arg
-	argstr = sprintf("%d, %d, [%p]", fd, request, argp)
+	argstr = sprintf("%d, %d, %p", fd, request, argp)
 }
 probe syscall.ioctl.return = kernel.function("sys_ioctl").return {
 	name = "ioctl"
@@ -1316,7 +1357,7 @@ probe syscall.io_getevents = kernel.function("sys_io_getevents") {
 	events_uaddr = $events
 	timeout_uaddr = $timeout
 	timestr = _struct_timespec_u($timeout)
-	argstr = sprintf("%d, %d, %d, [%p], [%p], %s", ctx_id, min_nr,
+	argstr = sprintf("%d, %d, %d, %p, %p, %s", ctx_id, min_nr,
 		nr, events_uaddr, timeout_uaddr, timestr)
 }
 probe syscall.io_getevents.return = kernel.function("sys_io_getevents").return {
@@ -1325,106 +1366,120 @@ probe syscall.io_getevents.return = kernel.function("sys_io_getevents").return {
 }
 
 # ioperm _____________________________________________________
-/*
- * asmlinkage long
- * sys_ioperm(unsigned long from,
- *            unsigned long num,
- *            int turn_on)
- */
-probe kernel.syscall.ioperm =
-   kernel.function("sys_ioperm") {
-      name = "ioperm"
-      from = $from
-      num = $num
-      turn_on = $turn_on
-   }
-probe kernel.syscall.ioperm.return =
-   kernel.function("sys_ioperm").return {
-      name = "ioperm.return"
-   }
+# long sys_ioperm(unsigned long from, unsigned long num, int turn_on)
+#
+probe syscall.ioperm = kernel.function("sys_ioperm") ? {
+	name = "ioperm"
+	from = $from
+	num = $num
+	turn_on = $turn_on
+	argstr = sprintf("%d, %d, %d", $from, $num, $turn_on)
+}
+probe syscall.ioperm.return = kernel.function("sys_ioperm").return ? {
+	name = "ioperm"
+	retstr = returnstr(1)
+}
+
 # io_setup ___________________________________________________
-/*
- * asmlinkage long
- * sys_io_setup(unsigned nr_events,
- *              aio_context_t __user *ctxp)
- */
-probe syscall.io_setup =
-   kernel.function("sys_io_setup") {
+# long sys_io_setup(unsigned nr_events, aio_context_t __user *ctxp)
+#
+probe syscall.io_setup = kernel.function("sys_io_setup") {
 	name = "io_setup"
 	maxevents = $nr_events
 	ctxp_uaddr = $ctxp
 	argstr = sprintf("%d, %p", maxevents, ctxp_uaddr)
 }
 
-probe syscall.io_setup.return =
-   kernel.function("sys_io_setup").return {
+probe syscall.io_setup.return = kernel.function("sys_io_setup").return {
 	name = "io_setup"
 	retstr = returnstr(1)
-   }
+}
+
 # io_submit __________________________________________________
-/*
- * asmlinkage long
- * sys_io_submit(aio_context_t ctx_id,
- *               long nr,
- *               struct iocb __user * __user *iocbpp)
- */
-probe syscall.io_submit =
-   kernel.function("sys_io_submit") {
-      name = "io_submit"
-      ctx_id = $ctx_id
-      nr = $nr
-      iocbpp_uaddr = $iocbpp
-      argstr = sprintf("%d, %d, %p", ctx_id, nr, iocbpp_uaddr)
-}
-probe syscall.io_submit.return =
-   kernel.function("sys_io_submit").return {
-      name = "io_submit"
-      retstr = returnstr(1)
-   }
+# long sys_io_submit(aio_context_t ctx_id,
+#               long nr,
+#               struct iocb __user * __user *iocbpp)
+#
+probe syscall.io_submit = kernel.function("sys_io_submit") {
+	name = "io_submit"
+	ctx_id = $ctx_id
+	nr = $nr
+	iocbpp_uaddr = $iocbpp
+	argstr = sprintf("%d, %d, %p", ctx_id, nr, iocbpp_uaddr)
+}
+probe syscall.io_submit.return = kernel.function("sys_io_submit").return {
+	name = "io_submit"
+	retstr = returnstr(1)
+}
+
+# ioprio_get _________________________________________________
+# long sys_ioprio_get(int which, int who)
+#
+probe syscall.ioprio_get = kernel.function("sys_ioprio_get") {
+	name = "ioprio_get"
+	which = $which
+	who = $who
+	argstr = sprintf("%d, %d", $which, $who)
+}
+probe syscall.ioprio_get.return = kernel.function("sys_ioprio_get").return {
+	name = "ioprio_get"
+	retstr = returnstr(1)
+}
+
+# ioprio_set _________________________________________________
+# long sys_ioprio_set(int which, int who, int ioprio)
+#
+probe syscall.ioprio_set = kernel.function("sys_ioprio_set") {
+	name = "ioprio_set"
+	which = $which
+	who = $who
+	ioprio = $ioprio
+	argstr = sprintf("%d, %d, %d", $which, $who, $ioprio)
+}
+probe syscall.ioprio_set.return = kernel.function("sys_ioprio_set").return {
+	name = "ioprio_set"
+	retstr = returnstr(1)
+}
+
 # kexec_load _________________________________________________
-/*
- * asmlinkage long
- * sys_kexec_load(unsigned long entry,
- *                unsigned long nr_segments,
- *                struct kexec_segment __user *segments,
- *                unsigned long flags)
- */
-/*
-probe kernel.syscall.kexec_load =
-   kernel.function("sys_kexec_load") {
-      name = "kexec_load"
-      entry = $entry
-      nr_segments = $nr_segments
-      segments_uaddr = $segments_uaddr
-      flags = $flags
-   }
-probe kernel.syscall.kexec_load.return =
-   kernel.function("sys_kexec_load").return {
-      name = "kexec_load.return"
-   }
-*/
+# long sys_kexec_load(unsigned long entry,
+#                unsigned long nr_segments,
+#                struct kexec_segment __user *segments,
+#                unsigned long flags)
+#
+probe syscall.kexec_load = kernel.function("sys_kexec_load") {
+	name = "kexec_load"
+	entry = $entry
+	nr_segments = $nr_segments
+	segments_uaddr = $segments_uaddr
+	flags = $flags
+	argstr = sprintf("%p, %d, %p, %d", $entry, $nr_segments, $segments, $flags)
+}
+probe syscall.kexec_load.return = kernel.function("sys_kexec_load").return {
+	name = "kexec_load"
+	retstr = returnstr(1)	
+}
+
 # keyctl _____________________________________________________
-/*
- * asmlinkage long
- * sys_keyctl(int option,
- *            unsigned long arg2,
- *            unsigned long arg3,
- *            unsigned long arg4,
- *            unsigned long arg5)
- */
-probe kernel.syscall.keyctl =
-   kernel.function("sys_keyctl") {
-      name = "keyctl"
-      option = $option
-      arg2 = $arg2
-      arg3 = $arg3
-      arg4 = $arg4
-      arg5 = $arg5
-   }
-probe kernel.syscall.keyctl.return =
-   kernel.function("sys_keyctl").return {
-      name = "keyctl.return"
-   }
+# long sys_keyctl(int option,
+#            unsigned long arg2,
+#            unsigned long arg3,
+#            unsigned long arg4,
+#            unsigned long arg5)
+#
+probe syscall.keyctl = kernel.function("sys_keyctl") {
+	name = "keyctl"
+	option = $option
+	arg2 = $arg2
+	arg3 = $arg3
+	arg4 = $arg4
+	arg5 = $arg5
+	argstr = sprintf("%d", $option)
+}
+probe syscall.keyctl.return = kernel.function("sys_keyctl").return {
+	name = "keyctl"
+	retstr = returnstr(1)
+}
 
 # kill _______________________________________________________
 # long sys_kill(int pid, int sig)
@@ -1470,25 +1525,27 @@ probe syscall.lchown16.return = kernel.function("sys_lchown16").return ? {
 	retstr = returnstr(1)
 }
 # lgetxattr __________________________________________________
-/*
- * asmlinkage ssize_t
- * sys_lgetxattr(char __user *path,
- *               char __user *name,
- *               void __user *value,
- *               size_t size)
- */
-probe kernel.syscall.lgetxattr =
-   kernel.function("sys_lgetxattr") {
-      name = "lgetxattr"
-      path_uaddr = $path
-      name_uaddr = $name
-      value_uaddr = $value
-      size = $size
-   }
-probe kernel.syscall.lgetxattr.return =
-   kernel.function("sys_lgetxattr").return {
-      name = "lgetxattr.return"
-   }
+# ssize_t sys_lgetxattr(char __user *path,
+#               char __user *name,
+#               void __user *value,
+#               size_t size)
+#
+probe syscall.lgetxattr = kernel.function("sys_lgetxattr") {
+	name = "lgetxattr"
+	path = user_string($path)
+	# FIXME
+	name2 = user_string($name)
+	value_uaddr = $value
+	size = $size
+	argstr = sprintf("%s, %s, %p, %d", 
+		user_string_quoted($path), 
+		user_string_quoted($name),
+		value_uaddr, size)
+}
+probe syscall.lgetxattr.return = kernel.function("sys_lgetxattr").return {
+	name = "lgetxattr"
+	retstr = returnstr(1)
+}
 # link _______________________________________________________
 # long sys_link(const char __user * oldname,
 #          const char __user * newname)
@@ -1519,41 +1576,37 @@ probe syscall.listen.return = kernel.function("sys_listen").return {
 }
 
 # listxattr __________________________________________________
-/*
- * asmlinkage ssize_t
- * sys_listxattr(char __user *path,
- *               char __user *list,
- *               size_t size)
- */
-probe kernel.syscall.listxattr =
-   kernel.function("sys_listxattr") {
-      name = "listxattr"
-      path_uaddr = $path
-      list_uaddr = $list
-      size = $size
-   }
-probe kernel.syscall.listxattr.return =
-   kernel.function("sys_listxattr").return {
-      name = "listxattr.return"
-   }
+# ssize_t sys_listxattr(char __user *path, char __user *list, size_t size)
+#
+probe syscall.listxattr = kernel.function("sys_listxattr") {
+	name = "listxattr"
+	path_uaddr = $path
+	path = user_string($path)
+	list_uaddr = $list
+	size = $size
+	argstr = sprintf("%s, %p, %d", user_string_quoted($path), $list, $size)
+}
+probe syscall.listxattr.return = kernel.function("sys_listxattr").return {
+	name = "listxattr"
+	retstr = returnstr(1)
+}
+
 # llistxattr _________________________________________________
-/*
- * asmlinkage ssize_t
- * sys_llistxattr(char __user *path,
- *                char __user *list,
- *                size_t size)
- */
-probe kernel.syscall.llistxattr =
-   kernel.function("sys_llistxattr") {
-      name = "llistxattr"
-      path_uaddr = $path
-      list_uaddr = $list
-      size = $size
-   }
-probe kernel.syscall.llistxattr.return =
-   kernel.function("sys_llistxattr").return {
-      name = "llistxattr.return"
-   }
+# ssize_t sys_llistxattr(char __user *path, char __user *list, size_t size)
+#
+probe syscall.llistxattr = kernel.function("sys_llistxattr") {
+	name = "llistxattr"
+	path_uaddr = $path
+	path = user_string($path)
+	list_uaddr = $list
+	size = $size
+	argstr = sprintf("%s, %p, %d", user_string_quoted($path), $list, $size)
+}
+probe syscall.llistxattr.return = kernel.function("sys_llistxattr").return {
+	name = "llistxattr"
+	retstr = returnstr(1)
+}
+
 # llseek _____________________________________________________
 # long sys_llseek(unsigned int fd,
 #            unsigned long offset_high,
@@ -1575,40 +1628,38 @@ probe syscall.llseek.return = kernel.function("sys_llseek").return {
 	name = "llseek"
 	retstr = returnstr(1)
 }
+
 # lookup_dcookie _____________________________________________
-/*
- * asmlinkage long
- * sys_lookup_dcookie(u64 cookie64,
- *                    char __user * buf,
- *                    size_t len)
- */
-probe kernel.syscall.lookup_dcookie =
-   kernel.function("sys_lookup_dcookie") {
-      name = "lookup_dcookie"
-      cookie = $cookie64
-      buffer_uaddr = $buf
-      len = $len
-   }
-probe kernel.syscall.lookup_dcookie.return =
-   kernel.function("sys_lookup_dcookie").return {
-      name = "lookup_dcookie.return"
-   }
+# long sys_lookup_dcookie(u64 cookie64, char __user * buf, size_t len)
+#
+probe syscall.lookup_dcookie = kernel.function("sys_lookup_dcookie") {
+	name = "lookup_dcookie"
+	cookie = $cookie64
+	buffer_uaddr = $buf
+	len = $len
+	argstr = sprintf("%d, %p, %d", $cookie64, $buf, $len)
+}
+probe syscall.lookup_dcookie.return = kernel.function("sys_lookup_dcookie").return {
+	name = "lookup_dcookie"
+	retstr = returnstr(1)
+}
+
 # lremovexattr _______________________________________________
-/*
- * asmlinkage long
- * sys_lremovexattr(char __user *path,
- *                  char __user *name)
- */
-probe kernel.syscall.lremovexattr =
-   kernel.function("sys_lremovexattr") {
-      name = "lremovexattr"
-      path_uaddr = $path
-      name_uaddr = $name
-   }
-probe kernel.syscall.lremovexattr.return =
-   kernel.function("sys_lremovexattr").return {
-      name = "lremovexattr.return"
-   }
+# long sys_lremovexattr(char __user *path, char __user *name)
+#
+probe syscall.lremovexattr = kernel.function("sys_lremovexattr") {
+	name = "lremovexattr"
+	path_uaddr = $path
+	path = user_string($path)
+	name_uaddr = $name
+	name2 = user_string($name)
+	argstr = sprintf("%s, %s", user_string_quoted($path), user_string_quoted($name)) 
+}
+probe syscall.lremovexattr.return = kernel.function("sys_lremovexattr").return {
+	name = "lremovexattr"
+	retstr = returnstr(1)
+}
+
 # lseek ______________________________________________________
 # off_t sys_lseek(unsigned int fd, off_t offset, unsigned int origin)
 probe syscall.lseek = kernel.function("sys_lseek") {
@@ -1623,28 +1674,32 @@ probe syscall.lseek.return = kernel.function("sys_lseek").return {
 	name = "lseek"
 	retstr = returnstr(1)
 }
+
 # lsetxattr __________________________________________________
-/*
- * asmlinkage long
- * sys_lsetxattr(char __user *path,
- *               char __user *name,
- *               void __user *value,
- *               size_t size,
- *               int flags)
- */
-probe kernel.syscall.lsetxattr =
-   kernel.function("sys_lsetxattr") {
-      name = "lsetxattr"
-      path_uaddr = $path
-      name_uaddr = $name
-      value_uaddr = $value
-      size = $size
-      flags = $flags
-   }
-probe kernel.syscall.lsetxattr.return =
-   kernel.function("sys_lsetxattr").return {
-      name = "lsetxattr.return"
-   }
+# long sys_lsetxattr(char __user *path,
+#               char __user *name,
+#               void __user *value,
+#               size_t size,
+#               int flags)
+#
+probe syscall.lsetxattr = kernel.function("sys_lsetxattr") {
+	name = "lsetxattr"
+	path_uaddr = $path
+	path = user_string($path)
+	name_uaddr = $name
+	name_str = user_string($name)
+	value_uaddr = $value
+	size = $size
+	flags = $flags
+	argstr = sprintf("%s, %s, %p, %d, %d", 
+			user_string_quoted($path), 
+			user_string_quoted($name),
+			value_uaddr, $size, $flags)
+}
+probe syscall.lsetxattr.return = kernel.function("sys_lsetxattr").return {
+	name = "lsetxattr"
+	retstr = returnstr(1)
+}
 
 # lstat ______________________________________________________
 # long sys_lstat(char __user * filename, struct __old_kernel_stat __user * statbuf)
@@ -1654,7 +1709,7 @@ probe syscall.lstat =
 	name = "lstat"
 	file_name = user_string($filename)
 	buf_uaddr = $statbuf
-	argstr = sprintf("%s, [%p]", user_string_quoted($filename), buf_uaddr) 
+	argstr = sprintf("%s, %p", user_string_quoted($filename), buf_uaddr) 
 }
 probe syscall.lstat.return = 
 		kernel.function("sys_lstat").return ?
@@ -1664,42 +1719,59 @@ probe syscall.lstat.return =
 }
 
 # madvise ____________________________________________________
-/*
- * asmlinkage long
- * sys_madvise(unsigned long start,
- *             size_t len_in,
- *             int behavior)
- */
-probe kernel.syscall.madvise =
-   kernel.function("sys_madvise") {
-      name = "madvise"
-      start = $start
-      length = $len_in
-      advice = $behavior
-      advice_str = _madvice_advice_str($behavior)
-   }
-probe kernel.syscall.madvise.return =
-   kernel.function("sys_madvise").return {
-      name = "madvise.return"
-   }
+# long sys_madvise(unsigned long start, size_t len_in, int behavior)
+#
+probe syscall.madvise = kernel.function("sys_madvise") {
+	name = "madvise"
+	start = $start
+	length = $len_in
+	advice = $behavior
+	advice_str = _madvice_advice_str($behavior)
+	argstr = sprintf("%p, %d, %s", $start, $len_in, _madvice_advice_str($behavior))
+}
+probe syscall.madvise.return = kernel.function("sys_madvise").return {
+	name = "madvise"
+	retstr = returnstr(1)
+}
+
+# mbind ______________________________________________________
+# long sys_mbind(unsigned long start,
+#	unsigned long len,
+#	unsigned long mode,
+#	unsigned long __user *nmask,
+#	unsigned long maxnode,
+#	unsigned flags)
+#
+probe syscall.mbind = kernel.function("sys_mbind") ? {
+	name = "mbind"
+	start = $start
+	len = $len
+	mode = $mode
+	nmask_uaddr = $nmask
+	maxnode = $maxnode
+	flags = $flags
+	argstr = sprintf("%d, %d, %d, %p, %d, %d", $start, $len, $mode,
+				nmask_uaddr, $maxnode, $flags)
+}
+probe syscall.mbind.return = kernel.function("sys_mbind").return ? {
+	name = "mbind"
+	retstr = returnstr(1)
+}
+
 # mincore ____________________________________________________
-/*
- * asmlinkage long
- * sys_mincore(unsigned long start,
- *             size_t len,
- *             unsigned char __user * vec)
- */
-probe kernel.syscall.mincore =
-   kernel.function("sys_mincore") {
-      name = "mincore"
-      start = $start
-      length = $len
-      vec_uaddr = $vec
-   }
-probe kernel.syscall.mincore.return =
-   kernel.function("sys_mincore").return {
-      name = "mincore.return"
-   }
+# long sys_mincore(unsigned long start, size_t len, unsigned char __user * vec)
+#
+probe syscall.mincore = kernel.function("sys_mincore") {
+	name = "mincore"
+	start = $start
+	length = $len
+	vec_uaddr = $vec
+	argstr = sprintf("%p, %d, %p", $start, $len, $vec)
+}
+probe syscall.mincore.return = kernel.function("sys_mincore").return {
+	name = "mincore"
+	retstr = returnstr(1)	
+}
 
 # mkdir ______________________________________________________
 # long sys_mkdir(const char __user * pathname, int mode)
@@ -1823,23 +1895,20 @@ probe syscall.mmap2.return = kernel.function("sys_mmap2").return ? {
 
 
 # modify_ldt _________________________________________________
-/*
- * asmlinkage int
- * sys_modify_ldt(int func,
- *                void __user *ptr,
- *                unsigned long bytecount)
- */
-probe kernel.syscall.modify_ldt =
-   kernel.function("sys_modify_ldt") {
-      name = "modify_ldt"
-      func = $func
-      ptr_uaddr = $ptr
-      bytecount = $bytecount
-   }
-probe kernel.syscall.modify_ldt.return =
-   kernel.function("sys_modify_ldt").return {
-      name = "modify_ldt.return"
-   }
+# int sys_modify_ldt(int func, void __user *ptr, unsigned long bytecount)
+#
+probe syscall.modify_ldt = kernel.function("sys_modify_ldt") {
+	name = "modify_ldt"
+	func = $func
+	ptr_uaddr = $ptr
+	bytecount = $bytecount
+	argstr = sprintf("%d, %p, %d", $func, $ptr, $bytecount)
+}
+probe syscall.modify_ldt.return = kernel.function("sys_modify_ldt").return {
+	name = "modify_ldt"
+	retstr = returnstr(1)
+}
+
 # mount ______________________________________________________
 # long sys_mount(char __user * dev_name,
 #          char __user * dir_name,
@@ -1866,235 +1935,224 @@ probe syscall.mount.return = kernel.function("sys_mount").return {
 }
 
 # mprotect ___________________________________________________
-/*
- * asmlinkage long
- * sys_mprotect(unsigned long start,
- *              size_t len,
- *              unsigned long prot)
- */
-probe kernel.syscall.mprotect =
-   kernel.function("sys_mprotect") {
-      name = "mprotect"
-      addr = $start
-      len = $len
-      prot = $prot
-      prot_str = _mprotect_prot_str($prot)
-   }
-probe kernel.syscall.mprotect.return =
-   kernel.function("sys_mprotect").return {
-      name = "mprotect.return"
-   }
+# long sys_mprotect(unsigned long start, size_t len, unsigned long prot)
+#
+probe syscall.mprotect = kernel.function("sys_mprotect") {
+	name = "mprotect"
+	addr = $start
+	len = $len
+	prot = $prot
+	prot_str = _mprotect_prot_str($prot)
+	argstr = sprintf("%p, %d, %s", $start, $len, _mprotect_prot_str($prot))
+}
+probe syscall.mprotect.return = kernel.function("sys_mprotect").return {
+	name = "mprotect"
+	retstr = returnstr(1)
+}
+
 # mq_getsetattr ______________________________________________
-/*
- * asmlinkage long
- * sys_mq_getsetattr(mqd_t mqdes,
- *                   const struct mq_attr __user *u_mqstat,
- *                   struct mq_attr __user *u_omqstat)
- */
-probe kernel.syscall.mq_getsetattr =
-   kernel.function("sys_mq_getsetattr") {
-      name = "mq_getsetattr"
-      mqdes = $mqdes
-      u_mqstat_uaddr = $u_mqstat
-      u_omqstat_uaddr = $u_omqstat
-   }
-probe kernel.syscall.mq_getsetattr.return =
-   kernel.function("sys_mq_getsetattr").return {
-      name = "mq_getsetattr.return"
-   }
+# long sys_mq_getsetattr(mqd_t mqdes,
+#                  const struct mq_attr __user *u_mqstat,
+#                  struct mq_attr __user *u_omqstat)
+#
+probe syscall.mq_getsetattr = kernel.function("sys_mq_getsetattr") {
+	name = "mq_getsetattr"
+	mqdes = $mqdes
+	u_mqstat_uaddr = $u_mqstat
+	u_omqstat_uaddr = $u_omqstat
+	argstr = sprintf("%d, %p, %p", $mqdes, $u_mqstat, $u_omqstat)
+}
+probe syscall.mq_getsetattr.return = kernel.function("sys_mq_getsetattr").return {
+	name = "mq_getsetattr"
+	retstr = returnstr(1)
+}
+
 # mq_notify __________________________________________________
-/*
- * asmlinkage long
- * sys_mq_notify(mqd_t mqdes,
- *               const struct sigevent __user *u_notification)
- */
-probe kernel.syscall.mq_notify =
-   kernel.function("sys_mq_notify") {
-      name = "mq_notify"
-      mqdes = $mqdes
-      notification_uaddr = $u_notification
-   }
-probe kernel.syscall.mq_notify.return =
-   kernel.function("sys_mq_notify").return {
-      name = "mq_notify.return"
-   }
+# long sys_mq_notify(mqd_t mqdes, const struct sigevent __user *u_notification)
+#
+probe syscall.mq_notify = kernel.function("sys_mq_notify") {
+	name = "mq_notify"
+	mqdes = $mqdes
+	notification_uaddr = $u_notification
+	argstr = sprintf("%d, %p", $mqdes, $u_notification)
+}
+probe syscall.mq_notify.return = kernel.function("sys_mq_notify").return {
+	name = "mq_notify"
+	retstr = returnstr(1)
+}
+
 # mq_open ____________________________________________________
-/*
- * asmlinkage long
- * sys_mq_open(const char __user *u_name,
- *             int oflag,
- *             mode_t mode,
- *             struct mq_attr __user *u_attr)
- */
-probe kernel.syscall.mq_open =
-   kernel.function("sys_mq_open") {
-      name = "mq_open"
-      name_uaddr = $u_name
-      oflag = $oflag
-      mode = $mode
-      u_attr_uaddr = $u_attr
-   }
-probe kernel.syscall.mq_open.return =
-   kernel.function("sys_mq_open").return {
-      name = "mq_open.return"
-   }
+# long  sys_mq_open(const char __user *u_name,
+#             int oflag,
+#             mode_t mode,
+#             struct mq_attr __user *u_attr)
+#
+probe syscall.mq_open = kernel.function("sys_mq_open") {
+	name = "mq_open"
+	name_uaddr = $u_name
+	filename = user_string($u_name)
+	mode = $mode
+	u_attr_uaddr = $u_attr
+	oflag = $oflag
+	if (oflag & 64)
+		argstr = sprintf("%s, %s, %#o, %p", user_string_quoted($u_name), 
+			_sys_open_flag_str(oflag), $mode, $u_attr)
+	else
+		argstr = sprintf("%s, %s", user_string_quoted($u_name), _sys_open_flag_str(oflag))
+}
+probe syscall.mq_open.return = kernel.function("sys_mq_open").return {
+	name = "mq_open"
+	retstr = returnstr(1)
+}
+
 # mq_timedreceive ____________________________________________
-/*
- * asmlinkage ssize_t
- * sys_mq_timedreceive(mqd_t mqdes,
- *                     char __user *u_msg_ptr,
- *                     size_t msg_len,
- *                     unsigned int __user *u_msg_prio,
- *                     const struct timespec __user *u_abs_timeout)
- */
-probe kernel.syscall.mq_timedreceive =
-   kernel.function("sys_mq_timedreceive") {
-      name = "mq_timedreceive"
-      mqdes = $mqdes
-      msg_ptr_uaddr = $u_msg_ptr
-      msg_len = $msg_len
-      msg_prio_uaddr = $u_msg_prio
-      abs_timout_uaddr = $u_abs_timeout
-   }
-probe kernel.syscall.mq_timedreceive.return =
-   kernel.function("sys_mq_timedreceive").return {
-      name = "mq_timedreceive.return"
-   }
+# ssize_t sys_mq_timedreceive(mqd_t mqdes,
+#                     char __user *u_msg_ptr,
+#                     size_t msg_len,
+#                     unsigned int __user *u_msg_prio,
+#                     const struct timespec __user *u_abs_timeout)
+#
+probe syscall.mq_timedreceive = kernel.function("sys_mq_timedreceive") {
+	name = "mq_timedreceive"
+	mqdes = $mqdes
+	msg_ptr_uaddr = $u_msg_ptr
+	msg_len = $msg_len
+	msg_prio_uaddr = $u_msg_prio
+	abs_timout_uaddr = $u_abs_timeout
+	argstr = sprintf("%d, %p, %d, %p, %p", $mqdes, $u_msg_ptr, $msg_len,
+			$u_msg_prio, $u_abs_timeout)
+}
+probe syscall.mq_timedreceive.return = kernel.function("sys_mq_timedreceive").return {
+	name = "mq_timedreceive"
+	retstr = returnstr(1)
+}
+
 # mq_timedsend _______________________________________________
-/*
- * asmlinkage long
- * sys_mq_timedsend(mqd_t mqdes,
- *                  const char __user *u_msg_ptr,
- *                  size_t msg_len,
- *                  unsigned int msg_prio,
- *                  const struct timespec __user *u_abs_timeout)
- */
-probe kernel.syscall.mq_timedsend =
-   kernel.function("sys_mq_timedsend") {
-      name = "mq_timedsend"
-      mqdes = $mqdes
-      msg_ptr_uaddr = $u_msg_ptr
-      msg_len = $msg_len
-      msg_prio = $msg_prio
-      abs_timeout_uaddr = $u_abs_timeout
-   }
-probe kernel.syscall.mq_timedsend.return =
-   kernel.function("sys_mq_timedsend").return {
-      name = "mq_timedsend.return"
-   }
+# long sys_mq_timedsend(mqd_t mqdes,
+#                  const char __user *u_msg_ptr,
+#                  size_t msg_len,
+#                  unsigned int msg_prio,
+#                  const struct timespec __user *u_abs_timeout)
+#
+probe syscall.mq_timedsend = kernel.function("sys_mq_timedsend") {
+	name = "mq_timedsend"
+	mqdes = $mqdes
+	msg_ptr_uaddr = $u_msg_ptr
+	msg_len = $msg_len
+	msg_prio = $msg_prio
+	abs_timeout_uaddr = $u_abs_timeout
+	argstr = sprintf("%d, %p, %d, %d, %p", $mqdes, $u_msg_ptr, $msg_len,
+			$msg_prio, $u_abs_timeout)
+}
+probe syscall.mq_timedsend.return = kernel.function("sys_mq_timedsend").return {
+	name = "mq_timedsend"
+	retstr = returnstr(1)
+}
+
 # mq_unlink __________________________________________________
-/*
- * asmlinkage long
- * sys_mq_unlink(const char __user *u_name)
- */
-probe kernel.syscall.mq_unlink =
-   kernel.function("sys_mq_unlink") {
-      name = "mq_unlink"
-      u_name_uaddr = $u_name
-   }
-probe kernel.syscall.mq_unlink.return =
-   kernel.function("sys_mq_unlink").return {
-      name = "mq_unlink.return"
-   }
+# long sys_mq_unlink(const char __user *u_name)
+#
+probe syscall.mq_unlink = kernel.function("sys_mq_unlink") {
+	name = "mq_unlink"
+	u_name_uaddr = $u_name
+	u_name = user_string($u_name)
+	argstr = user_string_quoted($u_name)
+}
+probe syscall.mq_unlink.return = kernel.function("sys_mq_unlink").return {
+	name = "mq_unlink"
+	retstr = returnstr(1)
+}
+
 # mremap _____________________________________________________
-/*
- * asmlinkage unsigned long
- * sys_mremap(unsigned long addr,
- *            unsigned long old_len,
- *            unsigned long new_len,
- *            unsigned long flags,
- *            unsigned long new_addr)
- */
-probe kernel.syscall.mremap =
-   kernel.function("sys_mremap") {
-      name = "mremap"
-      old_address = $addr
-      old_size = $old_len
-      new_size = $new_len
-      flags = $flags
-      new_address = $new_addr
-   }
-probe kernel.syscall.mremap.return =
-   kernel.function("sys_mremap").return {
-      name = "mremap.return"
-   }
+# unsigned long sys_mremap(unsigned long addr,
+#            unsigned long old_len,
+#            unsigned long new_len,
+#            unsigned long flags,
+#            unsigned long new_addr)
+#
+probe syscall.mremap = kernel.function("sys_mremap") {
+	name = "mremap"
+	old_address = $addr
+	old_size = $old_len
+	new_size = $new_len
+	flags = $flags
+	new_address = $new_addr
+	argstr = sprintf("%p, %d, %d, %s, %p", $addr, $old_len, $new_len,
+		_mmap_flags($flags), $new_addr)
+}
+probe syscall.mremap.return = kernel.function("sys_mremap").return {
+	name = "mremap"
+	retstr = returnstr(2)
+}
+
 # msgctl _____________________________________________________
-/*
- * asmlinkage long
- * sys_msgctl (int msqid,
- *             int cmd,
- *             struct msqid_ds __user *buf)
- */
-probe kernel.syscall.msgctl =
-   kernel.function("sys_msgctl") {
-      name = "msgctl"
-      msqid = $msqid
-      cmd = $cmd
-      buf_uaddr = $buf
-   }
-probe kernel.syscall.msgctl.return =
-   kernel.function("sys_msgctl").return {
-      name = "msgctl.return"
-   }
+# long sys_msgctl (int msqid, int cmd, struct msqid_ds __user *buf)
+#
+probe syscall.msgctl = kernel.function("sys_msgctl") {
+	name = "msgctl"
+	msqid = $msqid
+	cmd = $cmd
+	buf_uaddr = $buf
+	argstr = sprintf("%d, %d, %p", $msqid, $cmd, $buf)
+}
+probe syscall.msgctl.return = kernel.function("sys_msgctl").return {
+	name = "msgctl"
+	retstr = returnstr(1)
+}
+
 # msgget _____________________________________________________
-/*
- * asmlinkage long
- * sys_msgget (key_t key,
- *             int msgflg)
- */
-probe kernel.syscall.msgget =
-   kernel.function("sys_msgget") {
-      name = "msgget"
-      key = $key
-      msgflg = $msgflg
-      msgflg_str = _sys_open_flag_str($msgflg)
-   }
-probe kernel.syscall.msgget.return =
-   kernel.function("sys_msgget").return {
-      name = "msgget.return"
-   }
+# long sys_msgget (key_t key, int msgflg)
+#
+probe syscall.msgget = kernel.function("sys_msgget") {
+	name = "msgget"
+	key = $key
+	msgflg = $msgflg
+	msgflg_str = _sys_open_flag_str($msgflg)
+	argstr = sprintf("%d, %s", $key, _sys_open_flag_str($msgflg))
+}
+probe syscall.msgget.return = kernel.function("sys_msgget").return {
+	name = "msgget"
+	retstr = returnstr(1)
+}
+
 # msgrcv _____________________________________________________
-/*
- * asmlinkage long
- * sys_msgrcv (int msqid,
- *             struct msgbuf __user *msgp,
- *             size_t msgsz,
- *             long msgtyp,
- *             int msgflg)
- */
-probe kernel.syscall.msgrcv =
-   kernel.function("sys_msgrcv") {
-      name = "msgrcv"
-      msqid = $msqid
-      msgp_uaddr = $msgp
-      msgsz = $msgsz
-      msgtyp = $msgtyp
-      msgflg = $msgflg
-   }
-probe kernel.syscall.msgrcv.return =
-   kernel.function("sys_msgrcv").return {
-      name = "msgrcv.return"
-   }
+# long sys_msgrcv (int msqid,
+#             struct msgbuf __user *msgp,
+#             size_t msgsz,
+#             long msgtyp,
+#             int msgflg)
+#
+probe syscall.msgrcv = kernel.function("sys_msgrcv") {
+	name = "msgrcv"
+	msqid = $msqid
+	msgp_uaddr = $msgp
+	msgsz = $msgsz
+	msgtyp = $msgtyp
+	msgflg = $msgflg
+	argstr = sprintf("%d, %p, %d, %d, %d", $msqid, $msgp, $msgsz, $msgtyp, $msgflg)
+}
+probe syscall.msgrcv.return = kernel.function("sys_msgrcv").return {
+	name = "msgrcv"
+	retstr = returnstr(1)
+}
+
 # msgsnd _____________________________________________________
-/*
- * asmlinkage long
- * sys_msgsnd (int msqid,
- *             struct msgbuf __user *msgp,
- *             size_t msgsz,
- *             int msgflg)
- */
-probe kernel.syscall.msgsnd =
-   kernel.function("sys_msgsnd") {
-      name = "msgsnd"
-      msqid = $msqid
-      msgp_uaddr = $msgp
-      msgsz = $msgsz
-      msgflg = $msgflg
-   }
-probe kernel.syscall.msgsnd.return =
-   kernel.function("sys_msgsnd").return {
-      name = "msgsnd.return"
-   }
+# long sys_msgsnd (int msqid,
+#             struct msgbuf __user *msgp,
+#             size_t msgsz,
+#             int msgflg)
+#
+probe syscall.msgsnd = kernel.function("sys_msgsnd") {
+	name = "msgsnd"
+	msqid = $msqid
+	msgp_uaddr = $msgp
+	msgsz = $msgsz
+	msgflg = $msgflg
+	argstr = sprintf("%d, %p, %d, %d", $msqid, $msgp, $msgsz, $msgflg)
+}
+probe syscall.msgsnd.return = kernel.function("sys_msgsnd").return {
+	name = "msgsnd"
+	retstr = returnstr(1)}
 
 # msync ______________________________________________________
 # long sys_msync(unsigned long start, size_t len, int flags)