From a6ab1e66fc05a02178e051ea2441633996d5871e Mon Sep 17 00:00:00 2001
From: Nathan Baker <7409217+nathan-b@users.noreply.github.com>
Date: Thu, 23 May 2019 09:59:06 -0400
Subject: [PATCH] Changes to build the kmod with 5.1 kernels [SMAGENT-1643]
 (#1413)

[SMAGENT-1643] Changes to build the kmod with 5.1 kernels

* The syscall_get_arguments function changed its parameters.
* The mmap symbols changed header locations
* Wrapped the kernel version check in a function
---
 driver/main.c             |  21 ++-
 driver/ppm.h              |   2 +
 driver/ppm_events.c       |  47 +++---
 driver/ppm_fillers.c      | 345 ++++++++++++++++++++------------------
 driver/ppm_flag_helpers.h |   3 +-
 5 files changed, 227 insertions(+), 191 deletions(-)

Index: sysdig-0.24.1/driver/main.c
===================================================================
--- sysdig-0.24.1.orig/driver/main.c
+++ sysdig-0.24.1/driver/main.c
@@ -216,6 +216,15 @@ do {								\
 		pr_info(fmt, ##__VA_ARGS__);			\
 } while (0)
 
+inline void ppm_syscall_get_arguments(struct task_struct *task, struct pt_regs *regs, unsigned long *args)
+{
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 1, 0))
+    syscall_get_arguments(task, regs, 0, 6, args);
+#else
+    syscall_get_arguments(task, regs, args);
+#endif
+}
+
 /* compat tracepoint functions */
 static int compat_register_trace(void *func, const char *probename, struct tracepoint *tp)
 {
@@ -1266,11 +1275,10 @@ static const unsigned char compat_nas[21
 #ifdef _HAS_SOCKETCALL
 static enum ppm_event_type parse_socketcall(struct event_filler_arguments *filler_args, struct pt_regs *regs)
 {
-	unsigned long __user args[2];
+	unsigned long __user args[6] = {};
 	unsigned long __user *scargs;
 	int socketcall_id;
-
-	syscall_get_arguments(current, regs, 0, 2, args);
+	ppm_syscall_get_arguments(current, regs, args);
 	socketcall_id = args[0];
 	scargs = (unsigned long __user *)args[1];
 
@@ -1385,6 +1393,7 @@ static inline void record_drop_x(struct
 static inline int drop_nostate_event(enum ppm_event_type event_type,
 				     struct pt_regs *regs)
 {
+	unsigned long args[6] = {};
 	unsigned long arg = 0;
 	int close_fd = -1;
 	struct files_struct *files;
@@ -1406,7 +1415,8 @@ static inline int drop_nostate_event(enu
 		 * The invalid fd events don't matter to userspace in dropping mode,
 		 * so we do this before the UF_NEVER_DROP check
 		 */
-		syscall_get_arguments(current, regs, 0, 1, &arg);
+		ppm_syscall_get_arguments(current, regs, args);
+		arg = args[0];
 		close_fd = (int)arg;
 
 		files = current->files;
@@ -1426,7 +1436,8 @@ static inline int drop_nostate_event(enu
 	case PPME_SYSCALL_FCNTL_E:
 	case PPME_SYSCALL_FCNTL_X:
 		// cmd arg
-		syscall_get_arguments(current, regs, 1, 1, &arg);
+		ppm_syscall_get_arguments(current, regs, args);
+		arg = args[1];
 		if (arg != F_DUPFD && arg != F_DUPFD_CLOEXEC)
 			drop = true;
 		break;
Index: sysdig-0.24.1/driver/ppm.h
===================================================================
--- sysdig-0.24.1.orig/driver/ppm.h
+++ sysdig-0.24.1/driver/ppm.h
@@ -111,4 +111,6 @@ extern const struct syscall_evt_pair g_s
 extern const enum ppm_syscall_code g_syscall_ia32_code_routing_table[];
 #endif
 
+extern void ppm_syscall_get_arguments(struct task_struct *task, struct pt_regs *regs, unsigned long *args);
+
 #endif /* PPM_H_ */
Index: sysdig-0.24.1/driver/ppm_events.c
===================================================================
--- sysdig-0.24.1.orig/driver/ppm_events.c
+++ sysdig-0.24.1/driver/ppm_events.c
@@ -244,14 +244,16 @@ inline u32 compute_snaplen(struct event_
 			if (err == 0) {
 				if(args->event_type == PPME_SOCKET_SENDTO_X)
 				{
+					unsigned long syscall_args[6] = {};
 					unsigned long val;
 					struct sockaddr __user * usrsockaddr;
 					/*
 					 * Get the address
 					 */
-					if (!args->is_socketcall)
-						syscall_get_arguments(current, args->regs, 4, 1, &val);
-					else
+					if (!args->is_socketcall) {
+						ppm_syscall_get_arguments(current, args->regs, syscall_args);
+						val = syscall_args[4];
+					} else
 						val = args->socketcall_args[4];
 
 					usrsockaddr = (struct sockaddr __user *)val;
@@ -265,9 +267,10 @@ inline u32 compute_snaplen(struct event_
 						/*
 						 * Get the address len
 						 */
-						if (!args->is_socketcall)
-							syscall_get_arguments(current, args->regs, 5, 1, &val);
-						else
+						if (!args->is_socketcall) {
+							ppm_syscall_get_arguments(current, args->regs, syscall_args);
+							val = syscall_args[5];
+						} else
 							val = args->socketcall_args[5];
 
 						if (val != 0) {
@@ -283,6 +286,7 @@ inline u32 compute_snaplen(struct event_
 						}
 					}
 				} else if (args->event_type == PPME_SOCKET_SENDMSG_X) {
+					unsigned long syscall_args[6] = {};
 					unsigned long val;
 					struct sockaddr __user * usrsockaddr;
 					int addrlen;
@@ -295,9 +299,10 @@ inline u32 compute_snaplen(struct event_
 					struct msghdr mh;
 #endif
 
-					if (!args->is_socketcall)
-						syscall_get_arguments(current, args->regs, 1, 1, &val);
-					else
+					if (!args->is_socketcall) {
+						ppm_syscall_get_arguments(current, args->regs, syscall_args);
+						val = syscall_args[1];
+					} else
 						val = args->socketcall_args[1];
 
 #ifdef CONFIG_COMPAT
@@ -1097,6 +1102,7 @@ int32_t parse_readv_writev_bufs(struct e
 	unsigned long bufsize;
 	char *targetbuf = args->str_storage;
 	u32 targetbuflen = STR_STORAGE_SIZE;
+	unsigned long syscall_args[6] = {};
 	unsigned long val;
 	u32 notcopied_len;
 	size_t tocopy_len;
@@ -1142,9 +1148,10 @@ int32_t parse_readv_writev_bufs(struct e
 			/*
 			 * Retrieve the FD. It will be used for dynamic snaplen calculation.
 			 */
-			if (!args->is_socketcall)
-				syscall_get_arguments(current, args->regs, 0, 1, &val);
-			else
+			if (!args->is_socketcall) {
+				ppm_syscall_get_arguments(current, args->regs, syscall_args);
+				val = syscall_args[0];
+			} else
 				val = args->socketcall_args[0];
 			args->fd = (int)val;
 
@@ -1228,6 +1235,7 @@ int32_t compat_parse_readv_writev_bufs(s
 	unsigned long bufsize;
 	char *targetbuf = args->str_storage;
 	u32 targetbuflen = STR_STORAGE_SIZE;
+	unsigned long syscall_args[6] = {};
 	unsigned long val;
 	u32 notcopied_len;
 	compat_size_t tocopy_len;
@@ -1273,9 +1281,10 @@ int32_t compat_parse_readv_writev_bufs(s
 			/*
 			 * Retrieve the FD. It will be used for dynamic snaplen calculation.
 			 */
-			if (!args->is_socketcall)
-				syscall_get_arguments(current, args->regs, 0, 1, &val);
-			else
+			if (!args->is_socketcall) {
+				ppm_syscall_get_arguments(current, args->regs, syscall_args);
+				val = syscall_args[0];
+			} else
 				val = args->socketcall_args[0];
 			args->fd = (int)val;
 
@@ -1359,6 +1368,7 @@ int32_t compat_parse_readv_writev_bufs(s
 int f_sys_autofill(struct event_filler_arguments *args)
 {
 	int res;
+	unsigned long syscall_args[6] = {};
 	unsigned long val;
 	u32 j;
 	int64_t retval;
@@ -1377,11 +1387,8 @@ int f_sys_autofill(struct event_filler_a
 				/*
 				 * Regular argument
 				 */
-				syscall_get_arguments(current,
-						args->regs,
-						evinfo->autofill_args[j].id,
-						1,
-						&val);
+				ppm_syscall_get_arguments(current, args->regs, syscall_args);
+				val = syscall_args[evinfo->autofill_args[j].id];
 			}
 
 			res = val_to_ring(args, val, 0, true, 0);
Index: sysdig-0.24.1/driver/ppm_fillers.c
===================================================================
--- sysdig-0.24.1.orig/driver/ppm_fillers.c
+++ sysdig-0.24.1/driver/ppm_fillers.c
@@ -48,6 +48,23 @@ or GPL2.txt for full copies of the licen
 
 #define merge_64(hi, lo) ((((unsigned long long)(hi)) << 32) + ((lo) & 0xffffffffUL))
 
+/*
+ * Linux 5.1 kernels modify the syscall_get_arguments function to always
+ * return all arguments rather than allowing the caller to select which
+ * arguments are desired. This wrapper replicates the original
+ * functionality.
+ */
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(5, 1, 0))
+#define syscall_get_arguments_deprecated syscall_get_arguments
+#else
+#define syscall_get_arguments_deprecated(_task, _reg, _start, _len, _args) \
+	do { \
+		unsigned long _sga_args[6] = {}; \
+		syscall_get_arguments(_task, _reg, _sga_args); \
+		memcpy(_args, &_sga_args[_start], _len); \
+	} while(0)
+#endif
+
 int f_sys_generic(struct event_filler_arguments *args)
 {
 	int res;
@@ -107,7 +124,7 @@ int f_sys_single(struct event_filler_arg
 	int res;
 	unsigned long val;
 
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	res = val_to_ring(args, val, 0, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -147,7 +164,7 @@ int f_sys_open_x(struct event_filler_arg
 	/*
 	 * name
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	res = val_to_ring(args, val, 0, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -156,7 +173,7 @@ int f_sys_open_x(struct event_filler_arg
 	 * Flags
 	 * Note that we convert them into the ppm portable representation before pushing them to the ring
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &flags);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &flags);
 	res = val_to_ring(args, open_flags_to_scap(flags), 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -164,7 +181,7 @@ int f_sys_open_x(struct event_filler_arg
 	/*
 	 *  mode
 	 */
-	syscall_get_arguments(current, args->regs, 2, 1, &modes);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &modes);
 	res = val_to_ring(args, open_modes_to_scap(flags, modes), 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -182,7 +199,7 @@ int f_sys_read_x(struct event_filler_arg
 	/*
 	 * Retrieve the FD. It will be used for dynamic snaplen calculation.
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	args->fd = (int)val;
 
 	/*
@@ -203,7 +220,7 @@ int f_sys_read_x(struct event_filler_arg
 		val = 0;
 		bufsize = 0;
 	} else {
-		syscall_get_arguments(current, args->regs, 1, 1, &val);
+		syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 
 		/*
 		 * The return value can be lower than the value provided by the user,
@@ -233,7 +250,7 @@ int f_sys_write_x(struct event_filler_ar
 	/*
 	 * Retrieve the FD. It will be used for dynamic snaplen calculation.
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	args->fd = (int)val;
 
 	/*
@@ -248,13 +265,13 @@ int f_sys_write_x(struct event_filler_ar
 	/*
 	 * data
 	 */
-	syscall_get_arguments(current, args->regs, 2, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &val);
 	bufsize = val;
 
 	/*
 	 * Copy the buffer
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 	args->enforce_snaplen = true;
 	res = val_to_ring(args, val, bufsize, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
@@ -693,7 +710,7 @@ int f_proc_startupdate(struct event_fill
 			 */
 			args->str_storage[0] = 0;
 
-			syscall_get_arguments(current, args->regs, 1, 1, &val);
+			syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 #ifdef CONFIG_COMPAT
 			if (unlikely(args->compat))
 				args_len = compat_accumulate_argv_or_env((compat_uptr_t)val,
@@ -865,9 +882,9 @@ cgroups_error:
 		 */
 		if (args->event_type == PPME_SYSCALL_CLONE_20_X) {
 #ifdef CONFIG_S390
-			syscall_get_arguments(current, args->regs, 1, 1, &val);
+			syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 #else
-			syscall_get_arguments(current, args->regs, 0, 1, &val);
+			syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 #endif
 		} else
 			val = 0;
@@ -940,7 +957,7 @@ cgroups_error:
 			/*
 			 * The call failed, so get the env from the arguments
 			 */
-			syscall_get_arguments(current, args->regs, 2, 1, &val);
+			syscall_get_arguments_deprecated(current, args->regs, 2, 1, &val);
 #ifdef CONFIG_COMPAT
 			if (unlikely(args->compat))
 				env_len = compat_accumulate_argv_or_env((compat_uptr_t)val,
@@ -1009,7 +1026,7 @@ int f_sys_execve_e(struct event_filler_a
 	/*
 	 * filename
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	res = val_to_ring(args, val, 0, true, 0);
 	if (res == PPM_FAILURE_INVALID_USER_MEMORY)
 		res = val_to_ring(args, (unsigned long)"<NA>", 0, false, 0);
@@ -1041,7 +1058,7 @@ int f_sys_socket_bind_x(struct event_fil
 	 * addr
 	 */
 	if (!args->is_socketcall)
-		syscall_get_arguments(current, args->regs, 1, 1, &val);
+		syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 	else
 		val = args->socketcall_args[1];
 
@@ -1051,7 +1068,7 @@ int f_sys_socket_bind_x(struct event_fil
 	 * Get the address len
 	 */
 	if (!args->is_socketcall)
-		syscall_get_arguments(current, args->regs, 2, 1, &val);
+		syscall_get_arguments_deprecated(current, args->regs, 2, 1, &val);
 	else
 		val = args->socketcall_args[2];
 
@@ -1109,7 +1126,7 @@ int f_sys_connect_x(struct event_filler_
 	 * in the stack, and therefore we can consume them.
 	 */
 	if (!args->is_socketcall) {
-		syscall_get_arguments(current, args->regs, 0, 1, &val);
+		syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 		fd = (int)val;
 	} else
 		fd = (int)args->socketcall_args[0];
@@ -1119,7 +1136,7 @@ int f_sys_connect_x(struct event_filler_
 		 * Get the address
 		 */
 		if (!args->is_socketcall)
-			syscall_get_arguments(current, args->regs, 1, 1, &val);
+			syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 		else
 			val = args->socketcall_args[1];
 
@@ -1129,7 +1146,7 @@ int f_sys_connect_x(struct event_filler_
 		 * Get the address len
 		 */
 		if (!args->is_socketcall)
-			syscall_get_arguments(current, args->regs, 2, 1, &val);
+			syscall_get_arguments_deprecated(current, args->regs, 2, 1, &val);
 		else
 			val = args->socketcall_args[2];
 
@@ -1194,7 +1211,7 @@ int f_sys_socketpair_x(struct event_fill
 		 * fds
 		 */
 		if (!args->is_socketcall)
-			syscall_get_arguments(current, args->regs, 3, 1, &val);
+			syscall_get_arguments_deprecated(current, args->regs, 3, 1, &val);
 		else
 			val = args->socketcall_args[3];
 #ifdef CONFIG_COMPAT
@@ -1314,7 +1331,7 @@ int f_sys_accept_x(struct event_filler_a
 	 * queuepct
 	 */
 	if (!args->is_socketcall)
-		syscall_get_arguments(current, args->regs, 0, 1, &srvskfd);
+		syscall_get_arguments_deprecated(current, args->regs, 0, 1, &srvskfd);
 	else
 		srvskfd = args->socketcall_args[0];
 
@@ -1356,7 +1373,7 @@ int f_sys_send_e_common(struct event_fil
 	 * fd
 	 */
 	if (!args->is_socketcall)
-		syscall_get_arguments(current, args->regs, 0, 1, &val);
+		syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	else
 		val = args->socketcall_args[0];
 
@@ -1370,7 +1387,7 @@ int f_sys_send_e_common(struct event_fil
 	 * size
 	 */
 	if (!args->is_socketcall)
-		syscall_get_arguments(current, args->regs, 2, 1, &size);
+		syscall_get_arguments_deprecated(current, args->regs, 2, 1, &size);
 	else
 		size = args->socketcall_args[2];
 
@@ -1417,7 +1434,7 @@ int f_sys_sendto_e(struct event_filler_a
 	 * Get the address
 	 */
 	if (!args->is_socketcall)
-		syscall_get_arguments(current, args->regs, 4, 1, &val);
+		syscall_get_arguments_deprecated(current, args->regs, 4, 1, &val);
 	else
 		val = args->socketcall_args[4];
 
@@ -1427,7 +1444,7 @@ int f_sys_sendto_e(struct event_filler_a
 	 * Get the address len
 	 */
 	if (!args->is_socketcall)
-		syscall_get_arguments(current, args->regs, 5, 1, &val);
+		syscall_get_arguments_deprecated(current, args->regs, 5, 1, &val);
 	else
 		val = args->socketcall_args[5];
 
@@ -1475,7 +1492,7 @@ int f_sys_send_x(struct event_filler_arg
 	 * Retrieve the FD. It will be used for dynamic snaplen calculation.
 	 */
 	if (!args->is_socketcall)
-		syscall_get_arguments(current, args->regs, 0, 1, &val);
+		syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	else
 		val = args->socketcall_args[0];
 
@@ -1500,7 +1517,7 @@ int f_sys_send_x(struct event_filler_arg
 		bufsize = 0;
 	} else {
 		if (!args->is_socketcall)
-			syscall_get_arguments(current, args->regs, 1, 1, &val);
+			syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 		else
 			val = args->socketcall_args[1];
 
@@ -1529,7 +1546,7 @@ int f_sys_recv_x_common(struct event_fil
 	 * Retrieve the FD. It will be used for dynamic snaplen calculation.
 	 */
 	if (!args->is_socketcall)
-		syscall_get_arguments(current, args->regs, 0, 1, &val);
+		syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	else
 		val = args->socketcall_args[1];
 
@@ -1554,7 +1571,7 @@ int f_sys_recv_x_common(struct event_fil
 		bufsize = 0;
 	} else {
 		if (!args->is_socketcall)
-			syscall_get_arguments(current, args->regs, 1, 1, &val);
+			syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 		else
 			val = args->socketcall_args[1];
 
@@ -1610,7 +1627,7 @@ int f_sys_recvfrom_x(struct event_filler
 		 * Get the fd
 		 */
 		if (!args->is_socketcall) {
-			syscall_get_arguments(current, args->regs, 0, 1, &val);
+			syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 			fd = (int)val;
 		} else
 			fd = (int)args->socketcall_args[0];
@@ -1619,7 +1636,7 @@ int f_sys_recvfrom_x(struct event_filler
 		 * Get the address
 		 */
 		if (!args->is_socketcall)
-			syscall_get_arguments(current, args->regs, 4, 1, &val);
+			syscall_get_arguments_deprecated(current, args->regs, 4, 1, &val);
 		else
 			val = args->socketcall_args[4];
 		usrsockaddr = (struct sockaddr __user *)val;
@@ -1628,7 +1645,7 @@ int f_sys_recvfrom_x(struct event_filler
 		 * Get the address len
 		 */
 		if (!args->is_socketcall)
-			syscall_get_arguments(current, args->regs, 5, 1, &val);
+			syscall_get_arguments_deprecated(current, args->regs, 5, 1, &val);
 		else
 			val = args->socketcall_args[5];
 		if (usrsockaddr != NULL && val != 0) {
@@ -1704,7 +1721,7 @@ int f_sys_sendmsg_e(struct event_filler_
 	 * fd
 	 */
 	if (!args->is_socketcall)
-		syscall_get_arguments(current, args->regs, 0, 1, &val);
+		syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	else
 		val = args->socketcall_args[0];
 
@@ -1717,7 +1734,7 @@ int f_sys_sendmsg_e(struct event_filler_
 	 * Retrieve the message header
 	 */
 	if (!args->is_socketcall)
-		syscall_get_arguments(current, args->regs, 1, 1, &val);
+		syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 	else
 		val = args->socketcall_args[1];
 
@@ -1829,7 +1846,7 @@ int f_sys_sendmsg_x(struct event_filler_
 	 * Retrieve the message header
 	 */
 	if (!args->is_socketcall)
-		syscall_get_arguments(current, args->regs, 1, 1, &val);
+		syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 	else
 		val = args->socketcall_args[1];
 
@@ -1902,7 +1919,7 @@ int f_sys_recvmsg_x(struct event_filler_
 	 * Retrieve the message header
 	 */
 	if (!args->is_socketcall)
-		syscall_get_arguments(current, args->regs, 1, 1, &val);
+		syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 	else
 		val = args->socketcall_args[1];
 
@@ -1946,7 +1963,7 @@ int f_sys_recvmsg_x(struct event_filler_
 		 * Get the fd
 		 */
 		if (!args->is_socketcall) {
-			syscall_get_arguments(current, args->regs, 0, 1, &val);
+			syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 			fd = (int)val;
 		} else
 			fd = (int)args->socketcall_args[0];
@@ -2008,7 +2025,7 @@ int f_sys_pipe_x(struct event_filler_arg
 	/*
 	 * fds
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 
 #ifdef CONFIG_COMPAT
 	if (!args->compat) {
@@ -2056,7 +2073,7 @@ int f_sys_eventfd_e(struct event_filler_
 	/*
 	 * initval
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	res = val_to_ring(args, val, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2065,7 +2082,7 @@ int f_sys_eventfd_e(struct event_filler_
 	 * flags
 	 * XXX not implemented yet
 	 */
-	/* syscall_get_arguments(current, args->regs, 1, 1, &val); */
+	/* syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val); */
 	val = 0;
 	res = val_to_ring(args, val, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
@@ -2083,7 +2100,7 @@ int f_sys_shutdown_e(struct event_filler
 	 * fd
 	 */
 	if (!args->is_socketcall)
-		syscall_get_arguments(current, args->regs, 0, 1, &val);
+		syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	else
 		val = args->socketcall_args[0];
 
@@ -2095,7 +2112,7 @@ int f_sys_shutdown_e(struct event_filler
 	 * how
 	 */
 	if (!args->is_socketcall)
-		syscall_get_arguments(current, args->regs, 1, 1, &val);
+		syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 	else
 		val = args->socketcall_args[1];
 
@@ -2114,7 +2131,7 @@ int f_sys_futex_e(struct event_filler_ar
 	/*
 	 * addr
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	res = val_to_ring(args, val, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2122,7 +2139,7 @@ int f_sys_futex_e(struct event_filler_ar
 	/*
 	 * op
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 	res = val_to_ring(args, (unsigned long)futex_op_to_scap(val), 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2130,7 +2147,7 @@ int f_sys_futex_e(struct event_filler_ar
 	/*
 	 * val
 	 */
-	syscall_get_arguments(current, args->regs, 2, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &val);
 	res = val_to_ring(args, val, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2146,7 +2163,7 @@ int f_sys_lseek_e(struct event_filler_ar
 	/*
 	 * fd
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	res = val_to_ring(args, val, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2154,7 +2171,7 @@ int f_sys_lseek_e(struct event_filler_ar
 	/*
 	 * offset
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 	res = val_to_ring(args, val, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2162,7 +2179,7 @@ int f_sys_lseek_e(struct event_filler_ar
 	/*
 	 * whence
 	 */
-	syscall_get_arguments(current, args->regs, 2, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &val);
 	res = val_to_ring(args, lseek_whence_to_scap(val), 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2181,7 +2198,7 @@ int f_sys_llseek_e(struct event_filler_a
 	/*
 	 * fd
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	res = val_to_ring(args, val, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2190,8 +2207,8 @@ int f_sys_llseek_e(struct event_filler_a
 	 * offset
 	 * We build it by combining the offset_high and offset_low system call arguments
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &oh);
-	syscall_get_arguments(current, args->regs, 2, 1, &ol);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &oh);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &ol);
 	offset = (((uint64_t)oh) << 32) + ((uint64_t)ol);
 	res = val_to_ring(args, offset, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
@@ -2200,7 +2217,7 @@ int f_sys_llseek_e(struct event_filler_a
 	/*
 	 * whence
 	 */
-	syscall_get_arguments(current, args->regs, 4, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 4, 1, &val);
 	res = val_to_ring(args, lseek_whence_to_scap(val), 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2224,7 +2241,7 @@ static int poll_parse_fds(struct event_f
 	 *
 	 * Get the number of fds
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &nfds);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &nfds);
 
 	/*
 	 * Check if we have enough space to store both the fd list
@@ -2234,7 +2251,7 @@ static int poll_parse_fds(struct event_f
 		return PPM_FAILURE_BUFFER_FULL;
 
 	/* Get the fds pointer */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 
 	fds = (struct pollfd *)args->str_storage;
 #ifdef CONFIG_COMPAT
@@ -2291,7 +2308,7 @@ int f_sys_poll_e(struct event_filler_arg
 	/*
 	 * timeout
 	 */
-	syscall_get_arguments(current, args->regs, 2, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &val);
 	res = val_to_ring(args, val, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2346,7 +2363,7 @@ int f_sys_ppoll_e(struct event_filler_ar
 	/*
 	 * timeout
 	 */
-	syscall_get_arguments(current, args->regs, 2, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &val);
 	/* NULL timeout specified as 0xFFFFFF.... */
 	if (val == (unsigned long)NULL)
 		res = val_to_ring(args, (uint64_t)(-1), 0, false, 0);
@@ -2358,7 +2375,7 @@ int f_sys_ppoll_e(struct event_filler_ar
 	/*
 	 * sigmask
 	 */
-	syscall_get_arguments(current, args->regs, 3, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 3, 1, &val);
 	if (val != (unsigned long)NULL)
 		if (0 != ppm_copy_from_user(&val, (void __user *)val, sizeof(val)))
 			return PPM_FAILURE_INVALID_USER_MEMORY;
@@ -2400,7 +2417,7 @@ int f_sys_mount_e(struct event_filler_ar
 	 * Fix mount flags in arg 3.
 	 * See http://lxr.free-electrons.com/source/fs/namespace.c?v=4.2#L2650
 	 */
-	syscall_get_arguments(current, args->regs, 3, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 3, 1, &val);
 	if ((val & PPM_MS_MGC_MSK) == PPM_MS_MGC_VAL)
 		val &= ~PPM_MS_MGC_MSK;
 	res = val_to_ring(args, val, 0, false, 0);
@@ -2426,7 +2443,7 @@ int f_sys_openat_x(struct event_filler_a
 	/*
 	 * dirfd
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 
 	if ((int)val == AT_FDCWD)
 		val = PPM_AT_FDCWD;
@@ -2438,7 +2455,7 @@ int f_sys_openat_x(struct event_filler_a
 	/*
 	 * name
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 	res = val_to_ring(args, val, 0, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2447,7 +2464,7 @@ int f_sys_openat_x(struct event_filler_a
 	 * Flags
 	 * Note that we convert them into the ppm portable representation before pushing them to the ring
 	 */
-	syscall_get_arguments(current, args->regs, 2, 1, &flags);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &flags);
 	res = val_to_ring(args, open_flags_to_scap(flags), 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2455,7 +2472,7 @@ int f_sys_openat_x(struct event_filler_a
 	/*
 	 *  mode
 	 */
-	syscall_get_arguments(current, args->regs, 3, 1, &modes);
+	syscall_get_arguments_deprecated(current, args->regs, 3, 1, &modes);
 	res = val_to_ring(args, open_modes_to_scap(flags, modes), 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2477,7 +2494,7 @@ int f_sys_unlinkat_x(struct event_filler
 	/*
 	 * dirfd
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 
 	if ((int)val == AT_FDCWD)
 		val = PPM_AT_FDCWD;
@@ -2489,7 +2506,7 @@ int f_sys_unlinkat_x(struct event_filler
 	/*
 	 * name
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 	res = val_to_ring(args, val, 0, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2498,7 +2515,7 @@ int f_sys_unlinkat_x(struct event_filler
 	 * flags
 	 * Note that we convert them into the ppm portable representation before pushing them to the ring
 	 */
-	syscall_get_arguments(current, args->regs, 2, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &val);
 	res = val_to_ring(args, unlinkat_flags_to_scap(val), 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2521,7 +2538,7 @@ int f_sys_linkat_x(struct event_filler_a
 	/*
 	 * olddir
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 
 	if ((int)val == AT_FDCWD)
 		val = PPM_AT_FDCWD;
@@ -2533,7 +2550,7 @@ int f_sys_linkat_x(struct event_filler_a
 	/*
 	 * oldpath
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 	res = val_to_ring(args, val, 0, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2541,7 +2558,7 @@ int f_sys_linkat_x(struct event_filler_a
 	/*
 	 * newdir
 	 */
-	syscall_get_arguments(current, args->regs, 2, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &val);
 
 	if ((int)val == AT_FDCWD)
 		val = PPM_AT_FDCWD;
@@ -2553,7 +2570,7 @@ int f_sys_linkat_x(struct event_filler_a
 	/*
 	 * newpath
 	 */
-	syscall_get_arguments(current, args->regs, 3, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 3, 1, &val);
 	res = val_to_ring(args, val, 0, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2562,7 +2579,7 @@ int f_sys_linkat_x(struct event_filler_a
 	 * Flags
 	 * Note that we convert them into the ppm portable representation before pushing them to the ring
 	 */
-	syscall_get_arguments(current, args->regs, 4, 1, &flags);
+	syscall_get_arguments_deprecated(current, args->regs, 4, 1, &flags);
 	res = val_to_ring(args, linkat_flags_to_scap(flags), 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2583,7 +2600,7 @@ int f_sys_pread64_e(struct event_filler_
 	/*
 	 * fd
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	res = val_to_ring(args, val, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2591,7 +2608,7 @@ int f_sys_pread64_e(struct event_filler_
 	/*
 	 * size
 	 */
-	syscall_get_arguments(current, args->regs, 2, 1, &size);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &size);
 	res = val_to_ring(args, size, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2600,11 +2617,11 @@ int f_sys_pread64_e(struct event_filler_
 	 * pos
 	 */
 #if defined CONFIG_X86
-	syscall_get_arguments(current, args->regs, 3, 1, &pos0);
-	syscall_get_arguments(current, args->regs, 4, 1, &pos1);
+	syscall_get_arguments_deprecated(current, args->regs, 3, 1, &pos0);
+	syscall_get_arguments_deprecated(current, args->regs, 4, 1, &pos1);
 #elif defined CONFIG_ARM && CONFIG_AEABI
-	syscall_get_arguments(current, args->regs, 4, 1, &pos0);
-	syscall_get_arguments(current, args->regs, 5, 1, &pos1);
+	syscall_get_arguments_deprecated(current, args->regs, 4, 1, &pos0);
+	syscall_get_arguments_deprecated(current, args->regs, 5, 1, &pos1);
 #else
  #error This architecture/abi not yet supported
 #endif
@@ -2634,7 +2651,7 @@ int f_sys_pwrite64_e(struct event_filler
 	/*
 	 * fd
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	res = val_to_ring(args, val, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2642,7 +2659,7 @@ int f_sys_pwrite64_e(struct event_filler
 	/*
 	 * size
 	 */
-	syscall_get_arguments(current, args->regs, 2, 1, &size);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &size);
 	res = val_to_ring(args, size, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2653,17 +2670,17 @@ int f_sys_pwrite64_e(struct event_filler
 	 * separate registers that we need to merge.
 	 */
 #ifdef _64BIT_ARGS_SINGLE_REGISTER
-	syscall_get_arguments(current, args->regs, 3, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 3, 1, &val);
 	res = val_to_ring(args, val, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
 #else
  #if defined CONFIG_X86
-	syscall_get_arguments(current, args->regs, 3, 1, &pos0);
-	syscall_get_arguments(current, args->regs, 4, 1, &pos1);
+	syscall_get_arguments_deprecated(current, args->regs, 3, 1, &pos0);
+	syscall_get_arguments_deprecated(current, args->regs, 4, 1, &pos1);
  #elif defined CONFIG_ARM && CONFIG_AEABI
-	syscall_get_arguments(current, args->regs, 4, 1, &pos0);
-	syscall_get_arguments(current, args->regs, 5, 1, &pos1);
+	syscall_get_arguments_deprecated(current, args->regs, 4, 1, &pos0);
+	syscall_get_arguments_deprecated(current, args->regs, 5, 1, &pos1);
  #else
   #error This architecture/abi not yet supported
  #endif
@@ -2701,8 +2718,8 @@ int f_sys_readv_preadv_x(struct event_fi
 	/*
 	 * data and size
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &val);
-	syscall_get_arguments(current, args->regs, 2, 1, &iovcnt);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &iovcnt);
 
 #ifdef CONFIG_COMPAT
 	if (unlikely(args->compat)) {
@@ -2733,7 +2750,7 @@ int f_sys_writev_e(struct event_filler_a
 	/*
 	 * fd
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	res = val_to_ring(args, val, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2741,12 +2758,12 @@ int f_sys_writev_e(struct event_filler_a
 	/*
 	 * size
 	 */
-	syscall_get_arguments(current, args->regs, 2, 1, &iovcnt);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &iovcnt);
 
 	/*
 	 * Copy the buffer
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 #ifdef CONFIG_COMPAT
 	if (unlikely(args->compat)) {
 		compat_iov = (const struct compat_iovec __user *)compat_ptr(val);
@@ -2789,13 +2806,13 @@ int f_sys_writev_pwritev_x(struct event_
 	/*
 	 * data and size
 	 */
-	syscall_get_arguments(current, args->regs, 2, 1, &iovcnt);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &iovcnt);
 
 
 	/*
 	 * Copy the buffer
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 #ifdef CONFIG_COMPAT
 	if (unlikely(args->compat)) {
 		compat_iov = (const struct compat_iovec __user *)compat_ptr(val);
@@ -2824,7 +2841,7 @@ int f_sys_preadv64_e(struct event_filler
 	/*
 	 * fd
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	res = val_to_ring(args, val, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2839,8 +2856,8 @@ int f_sys_preadv64_e(struct event_filler
 	 * requirements apply here. For an overly-detailed discussion about
 	 * this, see https://lwn.net/Articles/311630/
 	 */
-	syscall_get_arguments(current, args->regs, 3, 1, &pos0);
-	syscall_get_arguments(current, args->regs, 4, 1, &pos1);
+	syscall_get_arguments_deprecated(current, args->regs, 3, 1, &pos0);
+	syscall_get_arguments_deprecated(current, args->regs, 4, 1, &pos1);
 
 	pos64 = merge_64(pos1, pos0);
 
@@ -2870,7 +2887,7 @@ int f_sys_pwritev_e(struct event_filler_
 	/*
 	 * fd
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	res = val_to_ring(args, val, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2878,12 +2895,12 @@ int f_sys_pwritev_e(struct event_filler_
 	/*
 	 * size
 	 */
-	syscall_get_arguments(current, args->regs, 2, 1, &iovcnt);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &iovcnt);
 
 	/*
 	 * Copy the buffer
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 #ifdef CONFIG_COMPAT
 	if (unlikely(args->compat)) {
 		compat_iov = (const struct compat_iovec __user *)compat_ptr(val);
@@ -2906,7 +2923,7 @@ int f_sys_pwritev_e(struct event_filler_
 	 * separate registers that we need to merge.
 	 */
 #ifdef _64BIT_ARGS_SINGLE_REGISTER
-	syscall_get_arguments(current, args->regs, 3, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 3, 1, &val);
 	res = val_to_ring(args, val, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2917,8 +2934,8 @@ int f_sys_pwritev_e(struct event_filler_
 	 * requirements apply here. For an overly-detailed discussion about
 	 * this, see https://lwn.net/Articles/311630/
 	 */
-	syscall_get_arguments(current, args->regs, 3, 1, &pos0);
-	syscall_get_arguments(current, args->regs, 4, 1, &pos1);
+	syscall_get_arguments_deprecated(current, args->regs, 3, 1, &pos0);
+	syscall_get_arguments_deprecated(current, args->regs, 4, 1, &pos1);
 
 	pos64 = merge_64(pos1, pos0);
 
@@ -2935,7 +2952,7 @@ int f_sys_nanosleep_e(struct event_fille
 	unsigned long val;
 	int res;
 
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	res = timespec_parse(args, val);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -2952,7 +2969,7 @@ int f_sys_getrlimit_setrlimit_e(struct e
 	/*
 	 * resource
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 
 	ppm_resource = rlimit_resource_to_scap(val);
 
@@ -2987,7 +3004,7 @@ int f_sys_getrlimit_setrlrimit_x(struct
 	 * Copy the user structure and extract cur and max
 	 */
 	if (retval >= 0 || args->event_type == PPME_SYSCALL_SETRLIMIT_X) {
-		syscall_get_arguments(current, args->regs, 1, 1, &val);
+		syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 
 #ifdef CONFIG_COMPAT
 		if (!args->compat) {
@@ -3035,7 +3052,7 @@ int f_sys_prlimit_e(struct event_filler_
 	/*
 	 * pid
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 
 	res = val_to_ring(args, val, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
@@ -3044,7 +3061,7 @@ int f_sys_prlimit_e(struct event_filler_
 	/*
 	 * resource
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 
 	ppm_resource = rlimit_resource_to_scap(val);
 
@@ -3081,7 +3098,7 @@ int f_sys_prlimit_x(struct event_filler_
 	 * Copy the user structure and extract cur and max
 	 */
 	if (retval >= 0) {
-		syscall_get_arguments(current, args->regs, 2, 1, &val);
+		syscall_get_arguments_deprecated(current, args->regs, 2, 1, &val);
 
 #ifdef CONFIG_COMPAT
 		if (!args->compat) {
@@ -3109,7 +3126,7 @@ int f_sys_prlimit_x(struct event_filler_
 		newmax = -1;
 	}
 
-	syscall_get_arguments(current, args->regs, 3, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 3, 1, &val);
 
 #ifdef CONFIG_COMPAT
 	if (!args->compat) {
@@ -3264,7 +3281,7 @@ int f_sys_fcntl_e(struct event_filler_ar
 	/*
 	 * fd
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	res = val_to_ring(args, val, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -3272,7 +3289,7 @@ int f_sys_fcntl_e(struct event_filler_ar
 	/*
 	 * cmd
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 	res = val_to_ring(args, fcntl_cmd_to_scap(val), 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -3286,7 +3303,7 @@ static inline int parse_ptrace_addr(stru
 	uint64_t dst;
 	u8 idx;
 
-	syscall_get_arguments(current, args->regs, 2, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &val);
 	switch (request) {
 	default:
 		idx = PPM_PTRACE_IDX_UINT64;
@@ -3303,7 +3320,7 @@ static inline int parse_ptrace_data(stru
 	uint64_t dst;
 	u8 idx;
 
-	syscall_get_arguments(current, args->regs, 3, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 3, 1, &val);
 	switch (request) {
 	case PPM_PTRACE_PEEKTEXT:
 	case PPM_PTRACE_PEEKDATA:
@@ -3351,7 +3368,7 @@ int f_sys_ptrace_e(struct event_filler_a
 	/*
 	 * request
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	res = val_to_ring(args, ptrace_requests_to_scap(val), 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -3359,7 +3376,7 @@ int f_sys_ptrace_e(struct event_filler_a
 	/*
 	 * pid
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 	res = val_to_ring(args, val, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -3397,7 +3414,7 @@ int f_sys_ptrace_x(struct event_filler_a
 	/*
 	 * request
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	request = ptrace_requests_to_scap(val);
 
 	res = parse_ptrace_addr(args, request);
@@ -3463,7 +3480,7 @@ int f_sys_mmap_e(struct event_filler_arg
 	/*
 	 * addr
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	res = val_to_ring(args, val, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -3471,7 +3488,7 @@ int f_sys_mmap_e(struct event_filler_arg
 	/*
 	 * length
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 	res = val_to_ring(args, val, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -3479,7 +3496,7 @@ int f_sys_mmap_e(struct event_filler_arg
 	/*
 	 * prot
 	 */
-	syscall_get_arguments(current, args->regs, 2, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &val);
 	res = val_to_ring(args, prot_flags_to_scap(val), 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -3487,7 +3504,7 @@ int f_sys_mmap_e(struct event_filler_arg
 	/*
 	 * flags
 	 */
-	syscall_get_arguments(current, args->regs, 3, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 3, 1, &val);
 	res = val_to_ring(args, mmap_flags_to_scap(val), 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -3495,7 +3512,7 @@ int f_sys_mmap_e(struct event_filler_arg
 	/*
 	 * fd
 	 */
-	syscall_get_arguments(current, args->regs, 4, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 4, 1, &val);
 	res = val_to_ring(args, val, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -3503,7 +3520,7 @@ int f_sys_mmap_e(struct event_filler_arg
 	/*
 	 * offset/pgoffset
 	 */
-	syscall_get_arguments(current, args->regs, 5, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 5, 1, &val);
 	res = val_to_ring(args, val, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -3525,7 +3542,7 @@ int f_sys_renameat_x(struct event_filler
 	/*
 	 * olddirfd
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 
 	if ((int)val == AT_FDCWD)
 		val = PPM_AT_FDCWD;
@@ -3537,7 +3554,7 @@ int f_sys_renameat_x(struct event_filler
 	/*
 	 * oldpath
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 	res = val_to_ring(args, val, 0, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -3545,7 +3562,7 @@ int f_sys_renameat_x(struct event_filler
 	/*
 	 * newdirfd
 	 */
-	syscall_get_arguments(current, args->regs, 2, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &val);
 
 	if ((int)val == AT_FDCWD)
 		val = PPM_AT_FDCWD;
@@ -3557,7 +3574,7 @@ int f_sys_renameat_x(struct event_filler
 	/*
 	 * newpath
 	 */
-	syscall_get_arguments(current, args->regs, 3, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 3, 1, &val);
 	res = val_to_ring(args, val, 0, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -3579,7 +3596,7 @@ int f_sys_symlinkat_x(struct event_fille
 	/*
 	 * oldpath
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	res = val_to_ring(args, val, 0, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -3587,7 +3604,7 @@ int f_sys_symlinkat_x(struct event_fille
 	/*
 	 * newdirfd
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 
 	if ((int)val == AT_FDCWD)
 		val = PPM_AT_FDCWD;
@@ -3599,7 +3616,7 @@ int f_sys_symlinkat_x(struct event_fille
 	/*
 	 * newpath
 	 */
-	syscall_get_arguments(current, args->regs, 2, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &val);
 	res = val_to_ring(args, val, 0, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -3635,7 +3652,7 @@ int f_sys_sendfile_e(struct event_filler
 	/*
 	 * out_fd
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	res = val_to_ring(args, val, 0, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -3643,7 +3660,7 @@ int f_sys_sendfile_e(struct event_filler
 	/*
 	 * in_fd
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 	res = val_to_ring(args, val, 0, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -3651,7 +3668,7 @@ int f_sys_sendfile_e(struct event_filler
 	/*
 	 * offset
 	 */
-	syscall_get_arguments(current, args->regs, 2, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &val);
 
 	if (val != 0) {
 #ifdef CONFIG_COMPAT
@@ -3676,7 +3693,7 @@ int f_sys_sendfile_e(struct event_filler
 	/*
 	 * size
 	 */
-	syscall_get_arguments(current, args->regs, 3, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 3, 1, &val);
 	res = val_to_ring(args, val, 0, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -3702,7 +3719,7 @@ int f_sys_sendfile_x(struct event_filler
 	/*
 	 * offset
 	 */
-	syscall_get_arguments(current, args->regs, 2, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &val);
 
 	if (val != 0) {
 #ifdef CONFIG_COMPAT
@@ -3738,7 +3755,7 @@ int f_sys_quotactl_e(struct event_filler
 	/*
 	 * extract cmd
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	cmd = quotactl_cmd_to_scap(val);
 	res = val_to_ring(args, cmd, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
@@ -3755,7 +3772,7 @@ int f_sys_quotactl_e(struct event_filler
 	 *  extract id
 	 */
 	id = 0;
-	syscall_get_arguments(current, args->regs, 2, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &val);
 	if ((cmd == PPM_Q_GETQUOTA) ||
 		 (cmd == PPM_Q_SETQUOTA) ||
 		 (cmd == PPM_Q_XGETQUOTA) ||
@@ -3798,7 +3815,7 @@ int f_sys_quotactl_x(struct event_filler
 	/*
 	 * extract cmd
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	cmd = quotactl_cmd_to_scap(val);
 
 	/*
@@ -3812,7 +3829,7 @@ int f_sys_quotactl_x(struct event_filler
 	/*
 	 * Add special
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 	res = val_to_ring(args, val, 0, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -3820,7 +3837,7 @@ int f_sys_quotactl_x(struct event_filler
 	/*
 	 * get addr
 	 */
-	syscall_get_arguments(current, args->regs, 3, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 3, 1, &val);
 
 	/*
 	 * get quotafilepath only for QUOTAON
@@ -3998,7 +4015,7 @@ int f_sys_getresuid_and_gid_x(struct eve
 	/*
 	 * ruid
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 #ifdef CONFIG_COMPAT
 	if (!args->compat) {
 #endif
@@ -4018,7 +4035,7 @@ int f_sys_getresuid_and_gid_x(struct eve
 	/*
 	 * euid
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 	len = ppm_copy_from_user(&uid, (void *)val, sizeof(uint32_t));
 	if (unlikely(len != 0))
 		return PPM_FAILURE_INVALID_USER_MEMORY;
@@ -4030,7 +4047,7 @@ int f_sys_getresuid_and_gid_x(struct eve
 	/*
 	 * suid
 	 */
-	syscall_get_arguments(current, args->regs, 2, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &val);
 	len = ppm_copy_from_user(&uid, (void *)val, sizeof(uint32_t));
 	if (unlikely(len != 0))
 		return PPM_FAILURE_INVALID_USER_MEMORY;
@@ -4048,12 +4065,12 @@ int f_sys_flock_e(struct event_filler_ar
 	int res;
 	u32 flags;
 
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	res = val_to_ring(args, val, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
 
-	syscall_get_arguments(current, args->regs, 1, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 	flags = flock_flags_to_scap(val);
 	res = val_to_ring(args, flags, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
@@ -4071,7 +4088,7 @@ int f_sys_setns_e(struct event_filler_ar
 	/*
 	 * parse fd
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	res = val_to_ring(args, val, 0, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -4079,7 +4096,7 @@ int f_sys_setns_e(struct event_filler_ar
 	/*
 	 * get type, parse as clone flags as it's a subset of it
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 	flags = clone_flags_to_scap(val);
 	res = val_to_ring(args, flags, 0, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
@@ -4097,7 +4114,7 @@ int f_sys_unshare_e(struct event_filler_
 	/*
 	 * get type, parse as clone flags as it's a subset of it
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	flags = clone_flags_to_scap(val);
 	res = val_to_ring(args, flags, 0, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
@@ -4198,7 +4215,7 @@ int f_sys_semop_x(struct event_filler_ar
 	 * actually this could be read in the enter function but
 	 * we also need to know the value to access the sembuf structs
 	 */
-	syscall_get_arguments(current, args->regs, 2, 1, &nsops);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &nsops);
 	res = val_to_ring(args, nsops, 0, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -4206,7 +4223,7 @@ int f_sys_semop_x(struct event_filler_ar
 	/*
 	 * sembuf
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, (unsigned long *) &ptr);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, (unsigned long *) &ptr);
 
 	if (nsops && ptr) {
 		/* max length of sembuf array in g_event_info = 2 */
@@ -4245,7 +4262,7 @@ int f_sys_semget_e(struct event_filler_a
 	/*
 	 * key
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	res = val_to_ring(args, val, 0, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -4253,7 +4270,7 @@ int f_sys_semget_e(struct event_filler_a
 	/*
 	 * nsems
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 	res = val_to_ring(args, val, 0, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -4261,7 +4278,7 @@ int f_sys_semget_e(struct event_filler_a
 	/*
 	 * semflg
 	 */
-	syscall_get_arguments(current, args->regs, 2, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &val);
 	res = val_to_ring(args, semget_flags_to_scap(val), 0, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -4277,7 +4294,7 @@ int f_sys_semctl_e(struct event_filler_a
 	/*
 	 * semid
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 	res = val_to_ring(args, val, 0, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -4285,7 +4302,7 @@ int f_sys_semctl_e(struct event_filler_a
 	/*
 	 * semnum
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 	res = val_to_ring(args, val, 0, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -4293,7 +4310,7 @@ int f_sys_semctl_e(struct event_filler_a
 	/*
 	 * cmd
 	 */
-	syscall_get_arguments(current, args->regs, 2, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &val);
 	res = val_to_ring(args, semctl_cmd_to_scap(val), 0, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -4302,7 +4319,7 @@ int f_sys_semctl_e(struct event_filler_a
 	 * optional argument semun/val
 	 */
 	if (val == SETVAL)
-		syscall_get_arguments(current, args->regs, 3, 1, &val);
+		syscall_get_arguments_deprecated(current, args->regs, 3, 1, &val);
 	else
 		val = 0;
 	res = val_to_ring(args, val, 0, true, 0);
@@ -4320,7 +4337,7 @@ int f_sys_access_e(struct event_filler_a
 	/*
 	 * mode
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 	res = val_to_ring(args, access_flags_to_scap(val), 0, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -4348,7 +4365,7 @@ int f_sys_bpf_x(struct event_filler_argu
 	/*
 	 * fd, depending on cmd
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &cmd);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &cmd);
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0)
 	if(cmd == BPF_MAP_CREATE || cmd == BPF_PROG_LOAD)
 #else
@@ -4381,7 +4398,7 @@ int f_sys_mkdirat_x(struct event_filler_
 	/*
 	 * dirfd
 	 */
-	syscall_get_arguments(current, args->regs, 0, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 0, 1, &val);
 
 	if ((int)val == AT_FDCWD)
 		val = PPM_AT_FDCWD;
@@ -4393,7 +4410,7 @@ int f_sys_mkdirat_x(struct event_filler_
 	/*
 	 * path
 	 */
-	syscall_get_arguments(current, args->regs, 1, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 1, 1, &val);
 	res = val_to_ring(args, val, 0, true, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
@@ -4401,7 +4418,7 @@ int f_sys_mkdirat_x(struct event_filler_
 	/*
 	 * mode
 	 */
-	syscall_get_arguments(current, args->regs, 2, 1, &val);
+	syscall_get_arguments_deprecated(current, args->regs, 2, 1, &val);
 	res = val_to_ring(args, val, 0, false, 0);
 	if (unlikely(res != PPM_SUCCESS))
 		return res;
Index: sysdig-0.24.1/driver/ppm_flag_helpers.h
===================================================================
--- sysdig-0.24.1.orig/driver/ppm_flag_helpers.h
+++ sysdig-0.24.1/driver/ppm_flag_helpers.h
@@ -9,8 +9,7 @@ or GPL2.txt for full copies of the licen
 
 #ifndef PPM_FLAG_HELPERS_H_
 #define PPM_FLAG_HELPERS_H_
-
-#include <asm/mman.h>
+#include <linux/mman.h>
 #include <linux/futex.h>
 #include <linux/ptrace.h>
 
