✨ add more syscalls

Makefile

@@ -128,6 +128,12 @@ SRCS += syscall/syscall_get_description.c \
 		syscall/param_log/log_kernel_timex_struct.c \
 		syscall/param_log/log_mount_flags.c \
 		syscall/param_log/log_swap_flags.c \
+		syscall/param_log/log_time_t.c \
+		syscall/param_log/log_io_event_struct.c \
+		syscall/param_log/log_epoll_event_struct.c \
+		syscall/param_log/log_epoll_ctl_cmd.c \
+		syscall/param_log/log_epoll_event_struct_array.c \
+		syscall/param_log/log_advice.c \
 		syscall/syscall_handle.c \
 
 # registers srcs

includes/syscall_strace.h

@@ -91,6 +91,12 @@
 #define KERNEL_TIMEX_STRUCT 77
 #define MOUNT_FLAGS 78
 #define SWAP_FLAGS 79
+#define TIME_T 80
+#define IO_EVENT_STRUCT 81
+#define EPOLL_EVENT_STRUCT 82
+#define EPOLL_CTL_CMD 83
+#define EPOLL_EVENT_STRUCT_ARRAY 84
+#define ADVISE 85
 
 /**
  * @brief Negative if printed before the syscall, positive if printed after the

srcs/syscall/param_log/log_advice.c

@@ -0,0 +1,19 @@
+#include <fcntl.h>
+#include <ft_printf.h>
+#include <macros.h>
+#include <fcntl.h>
+#include "param_log.h"
+
+static const flag_str_t advice_flags[] = {
+    FLAG_STR(POSIX_FADV_NORMAL),
+    FLAG_STR(POSIX_FADV_RANDOM),
+    FLAG_STR(POSIX_FADV_SEQUENTIAL),
+    FLAG_STR(POSIX_FADV_WILLNEED),
+    FLAG_STR(POSIX_FADV_DONTNEED),
+    FLAG_STR(POSIX_FADV_NOREUSE),
+};
+
+int log_ADVISE(uint64_t value)
+{
+    return option_log(value, advice_flags, ELEM_COUNT(advice_flags), "POSIX_FADV_???");
+}

srcs/syscall/param_log/log_epoll_ctl_cmd.c

@@ -0,0 +1,16 @@
+#include "param_log.h"
+#include <ft_printf.h>
+#include <macros.h>
+#include <sys/epoll.h>
+
+static const flag_str_t epoll_ctl_cmd_options[] = {
+	FLAG_STR(EPOLL_CTL_ADD),
+	FLAG_STR(EPOLL_CTL_DEL),
+	FLAG_STR(EPOLL_CTL_MOD),
+};
+
+int log_EPOLL_CTL_CMD(uint64_t value)
+{
+	return option_log(value, epoll_ctl_cmd_options, ELEM_COUNT(epoll_ctl_cmd_options),
+					  "EPOLL_CTL_???");
+}

srcs/syscall/param_log/log_epoll_event_struct.c

@@ -0,0 +1,33 @@
+#include "param_log.h"
+#include <ft_printf.h>
+#include <macros.h>
+#include <sys/epoll.h>
+
+static const flag_str_t events_flags[] = {
+	FLAG_STR(EPOLLIN),	   FLAG_STR(EPOLLPRI),	   FLAG_STR(EPOLLOUT),	  FLAG_STR(EPOLLRDNORM),
+	FLAG_STR(EPOLLRDBAND), FLAG_STR(EPOLLWRNORM),  FLAG_STR(EPOLLWRBAND), FLAG_STR(EPOLLMSG),
+	FLAG_STR(EPOLLERR),	   FLAG_STR(EPOLLHUP),	   FLAG_STR(EPOLLRDHUP),  FLAG_STR(EPOLLEXCLUSIVE),
+	FLAG_STR(EPOLLWAKEUP), FLAG_STR(EPOLLONESHOT), FLAG_STR(EPOLLET),
+};
+
+int log_local_epoll_event_struct(struct epoll_event *event)
+{
+	int size_written = ft_dprintf(STDERR_FILENO, "{.events=");
+	size_written += flags_log(event->events, events_flags, ELEM_COUNT(events_flags));
+	size_written += ft_dprintf(STDERR_FILENO, ", .data=");
+	if (event->events & EPOLLIN || event->events & EPOLLPRI || event->events & EPOLLRDNORM ||
+		event->events & EPOLLRDBAND)
+		size_written += ft_dprintf(STDERR_FILENO, "%d", event->data.fd);
+	else
+		size_written += ft_dprintf(STDERR_FILENO, "%lu", event->data.u64);
+	size_written += ft_dprintf(STDERR_FILENO, "}");
+    return size_written;
+}
+
+int log_EPOLL_EVENT_STRUCT(uint64_t value, syscall_log_param_t *context)
+{
+	STRUCT_HANDLE(struct epoll_event, event);
+	if (context->is_return_log && event.events == 0 && event.data.u64 == 0)
+		return ft_dprintf(STDERR_FILENO, "(Timeout)");
+	return log_local_epoll_event_struct(&event);
+}

srcs/syscall/param_log/log_epoll_event_struct_array.c

@@ -0,0 +1,37 @@
+#include "param_log.h"
+#include <ft_printf.h>
+#include <sys/epoll.h>
+#include <macros.h>
+
+int log_EPOLL_EVENT_STRUCT_ARRAY(uint64_t value, syscall_log_param_t *context)
+{
+    int size_written = 0;
+    void *remote_ptr = handle_ptr(value, context, &size_written);
+    if (remote_ptr == NULL)
+        return size_written;
+    long event_count = registers_get_return(context->regs, context->type);
+    struct epoll_event *events = malloc(sizeof(struct epoll_event) * event_count);
+    if (events == NULL)
+    {
+        log_error("log_EPOLL_EPOLL_EVENT_STRUCT_ARRAY", "malloc failed", true);
+        return size_written;
+    }
+    if (remote_memcpy(events, context->pid, remote_ptr, sizeof(struct epoll_event) * event_count) < 0)
+    {
+        log_error("log_EPOLL_EPOLL_EVENT_STRUCT_ARRAY", "remote_memcpy failed", true);
+        free(events);
+        return size_written;
+    }
+    size_written += ft_dprintf(STDERR_FILENO, "[");
+    bool_t first = true;
+    for (long i = 0; i < event_count; i++)
+    {
+        if (!first)
+            size_written += ft_dprintf(STDERR_FILENO, ", ");
+        first = false;
+        size_written += log_local_epoll_event_struct(&events[i]);
+    }
+    size_written += ft_dprintf(STDERR_FILENO, "]");
+    free(events);
+    return size_written;
+}

srcs/syscall/param_log/log_io_event_struct.c

@@ -0,0 +1,37 @@
+#include "param_log.h"
+#include <ft_printf.h>
+#include <libaio.h>
+
+int log_IO_EVENT_STRUCT(uint64_t value, syscall_log_param_t *context)
+{
+	int size_written = 0;
+	void *remote_ptr = handle_ptr(value, context, &size_written);
+	if (remote_ptr == NULL)
+		return size_written;
+	long event_count = registers_get_return(context->regs, context->type);
+	struct io_event *events = malloc(sizeof(struct io_event) * event_count);
+	if (events == NULL)
+	{
+		log_error("log_IO_EVENT_STRUCT", "malloc failed", true);
+		return size_written;
+	}
+	if (remote_memcpy(events, context->pid, remote_ptr, sizeof(struct io_event) * event_count) < 0)
+	{
+		log_error("log_IO_EVENT_STRUCT", "remote_memcpy failed", true);
+		free(events);
+		return size_written;
+	}
+	size_written += ft_dprintf(STDERR_FILENO, "[");
+	bool_t first = true;
+	for (long i = 0; i < event_count; i++)
+	{
+		if (!first)
+			size_written += ft_dprintf(STDERR_FILENO, ", ");
+		first = false;
+		size_written += ft_dprintf(STDERR_FILENO, "{.data=%lu, .obj=%lu, .res=%ld, .res2=%ld}",
+								   events[i].data, events[i].obj, events[i].res, events[i].res2);
+	}
+    size_written += ft_dprintf(STDERR_FILENO, "]");
+    free(events);
+    return size_written;
+}

srcs/syscall/param_log/log_prctl_option.c

@@ -56,5 +56,5 @@ static const flag_str_t prctl_option_flags[] = {
 
 int log_PRCTL_OPTION(uint64_t value)
 {
-    return option_log(value, prctl_option_flags, ELEM_COUNT(prctl_option_flags), "PR_???");
+    return option_log(value, prctl_option_flags, ELEM_COUNT(prctl_option_flags), "ARCH_???");
 }

srcs/syscall/param_log/log_time_t.c

@@ -0,0 +1,10 @@
+#include <time.h>
+
+#include "param_log.h"
+#include <ft_printf.h>
+
+int log_TIME_T(uint64_t value, syscall_log_param_t *context)
+{
+    STRUCT_HANDLE(time_t, tv);
+    return ft_dprintf(STDERR_FILENO, "%ld", tv);
+}

srcs/syscall/param_log/param_log.h

@@ -1,11 +1,12 @@
 #pragma once
 
 #include <bool_t.h>
+#include <ft_strace_utils.h>
 #include <registers.h>
 #include <stdint.h>
 #include <sys/types.h>
 #include <sys/uio.h>
-#include <ft_strace_utils.h>
+#include <sys/epoll.h>
 
 typedef struct
 {
@@ -547,15 +548,15 @@ int log_SEMBUF_STRUCT(uint64_t value, syscall_log_param_t *context);
 
 /**
  * @brief Log shmctl cmd
- * 
+ *
  * @param value the value to log
  * @return int the number of bytes written
  */
 int log_SEMCTL_CMD(uint64_t value);
 
 /**
  * @brief Log a msgbuf struct
- * 
+ *
  * @param value the pointer to the msgbuf struct
  * @param context the syscall context
  * @return int the number of bytes written
@@ -564,23 +565,23 @@ int log_MSGBUF_STRUCT(uint64_t value, syscall_log_param_t *context);
 
 /**
  * @brief Log msgflg
- * 
+ *
  * @param value the value to log
  * @return int the number of bytes written
  */
 int log_MSGFLG(uint64_t value);
 
 /**
  * @brief Log shmctl cmd
- * 
+ *
  * @param value the value to log
  * @return int the number of bytes written
  */
 int log_MSGCTL_CMD(uint64_t value);
 
 /**
  * @brief Log a msqid_ds struct
- * 
+ *
  * @param value the value to log
  * @param context the context of the syscall
  * @return int the number of bytes written
@@ -589,7 +590,7 @@ int log_MSQID_DS_STRUCT(uint64_t value, syscall_log_param_t *context);
 
 /**
  * @brief Log fcntl cmd
- * 
+ *
  * @param value the value to log
  * @return int the number of bytes written
  */
@@ -621,7 +622,7 @@ int log_RLIMIT_RESOURCE(uint64_t value);
 
 /**
  * @brief Log rlimit struct
- * 
+ *
  * @param value the value to log
  * @param context the context of the syscall
  * @return int the number of bytes written
@@ -630,7 +631,7 @@ int log_RLIMIT_STRUCT(uint64_t value, syscall_log_param_t *context);
 
 /**
  * @brief Log rusage who
- * 
+ *
  * @param value the value to log
  * @return int the number of bytes written
  */
@@ -656,23 +657,23 @@ int log_TMS_STRUCT(uint64_t value, syscall_log_param_t *context);
 
 /**
  * @brief Log ptrace request
- * 
+ *
  * @param value the value to log
  * @return int the number of bytes written
  */
 int log_PTRACE_REQUEST(uint64_t value);
 
 /**
  * @brief Log syslog types
- * 
+ *
  * @param value the value to log
  * @return int the number of bytes written
  */
 int log_SYSLOG_TYPE(uint64_t value);
 
 /**
  * @brief Log a int array
- * 
+ *
  * @param value the pointer to the array
  * @param context the context of the syscall
  * @return int the number of bytes written
@@ -681,7 +682,7 @@ int log_INT_ARRAY(uint64_t value, syscall_log_param_t *context);
 
 /**
  * @brief Log siginfo struct
- * 
+ *
  * @param value the pointer to the siginfo struct
  * @param context the context of the syscall
  * @return int the number of bytes written
@@ -699,4 +700,11 @@ int log_MLOCKALL_FLAGS(uint64_t value);
 int log_PRCTL_OPTION(uint64_t value);
 int log_KERNEL_TIMEX_STRUCT(uint64_t value, syscall_log_param_t *context);
 int log_MOUNT_FLAGS(uint64_t value);
-int log_SWAP_FLAGS(uint64_t value);
+int log_SWAP_FLAGS(uint64_t value);
+int log_TIME_T(uint64_t value, syscall_log_param_t *context);
+int log_IO_EVENT_STRUCT(uint64_t value, syscall_log_param_t *context);
+int log_EPOLL_EVENT_STRUCT(uint64_t value, syscall_log_param_t *context);
+int log_EPOLL_CTL_CMD(uint64_t value);
+int log_local_epoll_event_struct(struct epoll_event *local_struct);
+int log_EPOLL_EVENT_STRUCT_ARRAY(uint64_t value, syscall_log_param_t *context);
+int log_ADVISE(uint64_t value);

srcs/syscall/syscall_64.h

@@ -156,7 +156,9 @@ static const syscall_description_t x86_64_syscalls[] = {
 	[141] = {"setpriority", INT, {-PRIORITY_WHICH, -INT, -INT, NONE}},
 	[142] = {"sched_setparam", INT, {-INT, -SCHED_PARAM_STRUCT, NONE}},
 	[143] = {"sched_getparam", INT, {-INT, SCHED_PARAM_STRUCT, NONE}},
-	[144] = {"sched_setscheduler", INT, {-INT, -SCHED_SETCHEDULER_POLICY, -SCHED_PARAM_STRUCT, NONE}},
+	[144] = {"sched_setscheduler",
+			 INT,
+			 {-INT, -SCHED_SETCHEDULER_POLICY, -SCHED_PARAM_STRUCT, NONE}},
 	[145] = {"sched_getscheduler", INT, {-INT, NONE}},
 	[146] = {"sched_get_priority_max", INT, {-SCHED_SETCHEDULER_POLICY, NONE}},
 	[147] = {"sched_get_priority_min", INT, {-SCHED_SETCHEDULER_POLICY, NONE}},
@@ -213,4 +215,27 @@ static const syscall_description_t x86_64_syscalls[] = {
 	[198] = {"lremovexattr", INT, {-STRING, -STRING, NONE}},
 	[199] = {"fremovexattr", INT, {-INT, -STRING, NONE}},
 	[200] = {"tkill", INT, {-INT, -SIGNAL_NAME, NONE}},
+	[201] = {"time", INT, {TIME_T, NONE}},
+	[202] = {"futex", INT, {INT_PTR, INT, INT, KERNEL_TIMESPEC_STRUCT, INT_PTR, INT}},
+	[203] = {"sched_setaffinity", INT, {-INT, -INT, -INT_PTR, NONE}},
+	[204] = {"sched_getaffinity", INT, {-INT, -INT, -INT_PTR, NONE}},
+	[205] = {"set_thread_area", INT, {-PTR, NONE}},
+	[206] = {"io_setup", INT, {-INT, INT_PTR, NONE}},
+	[207] = {"io_destroy", INT, {-INT, NONE}},
+	[208] = {"io_getevents",
+			 INT,
+			 {-INT, -INT, -INT, IO_EVENT_STRUCT, KERNEL_TIMESPEC_STRUCT, NONE}},
+	[209] = {"io_submit", INT, {-INT, -INT, -PTR, NONE}},
+	[210] = {"io_cancel", INT, {-INT, -PTR, -PTR, NONE}},
+	[211] = {"get_thread_area", INT, {PTR, NONE}},
+	[212] = {"lookup_dcookie", INT, {INT, -MEMSEG, -INT, NONE}},
+	[213] = {"epoll_create", INT, {-INT, NONE}},
+	[214] = {"epoll_ctl_old", INT, {-INT, -EPOLL_CTL_CMD, -EPOLL_EVENT_STRUCT, NONE}},
+	[215] = {"epoll_wait_old", INT, {-INT, EPOLL_EVENT_STRUCT_ARRAY, INT, NONE}},
+	[216] = {"remap_file_pages", INT, {-INT, -INT, -HEX, -INT, -HEX, NONE}},
+	[217] = {"getdents64", INT, {-INT, -PTR, -INT, NONE}},
+	[218] = {"set_tid_address", INT, {PTR, NONE}},
+	[219] = {"restart_syscall", INT, {NONE}},
+	[220] = {"semtimedop", INT, {-INT, -SEMBUF_STRUCT, -INT, KERNEL_TIMESPEC_STRUCT, NONE}},
+	[221] = {"fadvise64", INT, {-INT, -INT, -INT, -ADVISE, NONE}},
 };

srcs/syscall/syscall_log_param.c

@@ -88,6 +88,12 @@ static const log_function_t log_functions[] = {
 	ADD_LOGGER(KERNEL_TIMEX_STRUCT),
 	ADD_LOGGER(MOUNT_FLAGS),
 	ADD_LOGGER(SWAP_FLAGS),
+	ADD_LOGGER(TIME_T),
+	ADD_LOGGER(IO_EVENT_STRUCT),
+	ADD_LOGGER(EPOLL_EVENT_STRUCT),
+	ADD_LOGGER(EPOLL_CTL_CMD),
+	ADD_LOGGER(EPOLL_EVENT_STRUCT_ARRAY),
+	ADD_LOGGER(ADVISE),
 };
 
 typedef int (*log_function_with_param_t)(uint64_t value, syscall_log_param_t *context);