1 files changed, 36 insertions, 0 deletions
diff --git a/doc/langref.tex b/doc/langref.tex
index 6003890a..29de4534 100644
--- a/doc/langref.tex
+++ b/doc/langref.tex
@@ -992,6 +992,42 @@ For more information about marker probes, see
 \url{http://sourceware.org/systemtap/wiki/UsingMarkers}.
 
 
+\subsection{Syscall probes}
+\label{sec:syscall}
+\index{syscall probes}
+The \texttt{syscall.*}  aliases define several hundred probes.  They
+use the following syntax:
+\begin{vindent}
+\begin{verbatim}
+syscall.NAME
+syscall.NAME.return
+\end{verbatim}
+\end{vindent}
+
+Generally, two probes are defined for each normal system call as
+listed in the syscalls(2) manual page: one for entry and one for
+return.   System calls that never return do not have a
+corresponding \texttt{.return} probe.
+
+Each probe alias defines a variety of variables. Look at the tapset
+source code to find the most reliable source of variable definitions.
+Generally, each variable listed in the standard manual page is
+available as a script-level variable. For example,
+\texttt{syscall.open} exposes file name, flags, and mode.  In addition,
+a standard suite of variables is available at most aliases, as follows:
+
+\begin{itemize}
+\item \texttt{argstr}: A pretty-printed form of the entire argument
+  list, without parentheses.
+\item \texttt{name}: The name of the system call.
+\item \texttt{retstr}: For return probes, a pretty-printed form of the
+  system call result.
+\end{itemize}
+
+Not all probe aliases obey all of these general guidelines.  Please
+report exceptions that you encounter as a bug.
+
+
 \subsection{Tracepoints}
 \label{sec:tracepoints}
 \index{tracepoints}