tables.c

/*
 * Functions for handling the system call tables.
 */

#include <string.h>
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>

#include "arch.h"
#include "arch-syscalls.h"
#include "params.h"
#include "results.h"
#include "stats.h"
#include "syscall.h"
#include "syscall-gate.h"
#include "shm.h"
#include "tables.h"
#include "trinity.h"	// MAX_LOGLEVEL
#include "uid.h"
#include "utils.h"	// ARRAY_SIZE

unsigned long syscalls_todo = 0;

bool biarch = false;

/*
 * EXPENSIVE-syscall bitmaps, one bit per table index, populated by
 * select_syscall_tables() after copy_syscall_table() has stamped the
 * caches.  EXPENSIVE is a static, compile-time flag never modified at
 * runtime, so the bitmap is built once at init and read-only after.
 * Lets the three pickers reject the 999/1000 of EXPENSIVE picks
 * before validate_specific_syscall_silent() and get_syscall_entry(),
 * skipping the cache miss on the syscallentry on the common reject
 * path.  Indexed by from-table index (== entry->number), the same
 * value the pickers hold in syscallnr after the active_syscalls[]
 * reduction.
 */
#define EXPENSIVE_BITMAP_WORDS ((MAX_NR_SYSCALL + 63) / 64)
static uint64_t expensive_bits_uniarch[EXPENSIVE_BITMAP_WORDS];
static uint64_t expensive_bits_32[EXPENSIVE_BITMAP_WORDS];
static uint64_t expensive_bits_64[EXPENSIVE_BITMAP_WORDS];

static void build_expensive_bitmap(const struct syscalltable *table,
				   unsigned int nr, uint64_t *bitmap)
{
	unsigned int i;
	unsigned int cap = (nr < MAX_NR_SYSCALL) ? nr : MAX_NR_SYSCALL;

	for (i = 0; i < cap; i++) {
		if (table[i].entry == NULL)
			continue;
		if (table[i].entry->flags & EXPENSIVE)
			bitmap[i / 64] |= ((uint64_t) 1) << (i % 64);
	}
}

bool syscall_is_expensive(unsigned int nr, bool do32)
{
	const uint64_t *bm;

	if (nr >= MAX_NR_SYSCALL)
		return false;

	if (biarch == false)
		bm = expensive_bits_uniarch;
	else
		bm = do32 ? expensive_bits_32 : expensive_bits_64;

	return (bm[nr / 64] >> (nr % 64)) & 1;
}

int search_syscall_table(const struct syscalltable *table, unsigned int nr_syscalls, const char *arg)
{
	unsigned int i;

	/* search by name */
	for (i = 0; i < nr_syscalls; i++) {
		if (table[i].entry == NULL)
			continue;

		if (strcmp(arg, table[i].entry->name) == 0) {
			//debugf("Found %s at %u\n", table[i].entry->name, i);
			return i;
		}
	}

	return -1;
}

void validate_specific_syscall(const struct syscalltable *table, int call)
{
	struct syscallentry *entry;

	if (call == -1)
		return;

	entry = table[call].entry;
	if (entry == NULL)
		return;

	if (entry->flags & AVOID_SYSCALL)
		output(0, "%s is marked as AVOID. Skipping\n", entry->name);

	if (entry->flags & NI_SYSCALL)
		output(0, "%s is NI_SYSCALL. Skipping\n", entry->name);

	if ((entry->flags & NEEDS_ROOT) && orig_uid != 0)
		output(0, "%s needs root. Skipping\n", entry->name);
}

int validate_specific_syscall_silent(const struct syscalltable *table, int call)
{
	struct syscallentry *entry;

	if (call == -1)
		return false;

	entry = table[call].entry;
	if (entry == NULL)
		return false;

	if (entry->flags & AVOID_SYSCALL)
		return false;

	if (entry->flags & NI_SYSCALL)
		return false;

	if ((entry->flags & NEEDS_ROOT) && orig_uid != 0)
		return false;

	return true;
}

void activate_syscall_in_table(unsigned int calln, unsigned int *nr_active, const struct syscalltable *table, int *active_syscall)
{
	struct syscallentry *entry = table[calln].entry;

	if ((entry->flags & NEEDS_ROOT) && orig_uid != 0)
		return;

	//Check if the call is activated already, and activate it only if needed
	if (entry->active_number == 0) {
		//Sanity check
		if ((*nr_active + 1) > MAX_NR_SYSCALL) {
			output(0, "[tables] MAX_NR_SYSCALL needs to be increased. More syscalls than active table can fit.\n");
			exit(EXIT_FAILURE);
		}

		//save the call no
		active_syscall[*nr_active] = calln + 1;
		(*nr_active) += 1;
		entry->active_number = *nr_active;
	}
}

void deactivate_syscall_in_table(unsigned int calln, unsigned int *nr_active, const struct syscalltable *table, int *active_syscall)
{
	struct syscallentry *entry;

	entry = table[calln].entry;

	//Check if the call is activated already, and deactivate it only if needed
	if ((entry->active_number != 0) && (*nr_active > 0)) {
		unsigned int idx = entry->active_number - 1;
		unsigned int last = *nr_active - 1;

		// Swap with the last active entry to avoid O(N) memmove.
		if (idx != last) {
			active_syscall[idx] = active_syscall[last];
			table[active_syscall[idx] - 1].entry->active_number = idx + 1;
		}
		active_syscall[last] = 0;
		(*nr_active) -= 1;
		entry->active_number = 0;
	}
}

/*
 * Remove a syscall from the active table.  Caller must already hold
 * shm->syscalltable_lock; the swap-with-last update mutates the shared
 * active_syscall[] array and entry->active_number atomically with the
 * *nr_active counter, and those three fields must be consistent for
 * concurrent pickers.
 */
void deactivate_syscall_nolock(unsigned int call, bool do32bit)
{
	if (biarch == false) {
		deactivate_syscall_uniarch(call);
	} else {
		if (do32bit == true)
			deactivate_syscall32(call);
		else
			deactivate_syscall64(call);
	}
}

/*
 * Lock-taking wrapper for picker-side deactivations.  Pickers run
 * concurrently across children and previously mutated the active table
 * with no serialisation, which could leave duplicate active entries,
 * stale entries, a wrong active_number, or a drifted nr_active count
 * when two children deactivated overlapping slots.  The active_number
 * recheck under the lock mirrors deactivate_enosys() in syscall.c and
 * absorbs a concurrent removal by a sibling.
 */
void deactivate_syscall_locked(unsigned int call, bool do32bit)
{
	struct syscallentry *entry;

	lock(&shm->syscalltable_lock);

	entry = get_syscall_entry(call, do32bit);
	if (entry == NULL)
		goto already_done;

	/* Another child may have raced us and already removed this slot. */
	if (entry->active_number == 0)
		goto already_done;

	deactivate_syscall_nolock(call, do32bit);
already_done:
	unlock(&shm->syscalltable_lock);
}

void count_syscalls_enabled(void)
{
	if (biarch == true) {
		char str32[40];
		char str64[40];
		unsigned int nr;

		memset(str32, 0, sizeof(str32));
		memset(str64, 0, sizeof(str64));

		/* first the 32bit syscalls */
		if (shm->nr_active_32bit_syscalls != 0) {
			char *p = str32;
			char *end = str32 + sizeof(str32);
			int n;

			n = snprintf(p, end - p, "%u enabled", shm->nr_active_32bit_syscalls);
			if (n > 0 && n < end - p)
				p += n;

			nr = max_nr_32bit_syscalls - shm->nr_active_32bit_syscalls;
			if (nr != 0)
				snprintf(p, end - p, ", %u disabled", nr);
		} else {
			snprintf(str32, sizeof(str32), "all disabled.");
		}

		/* now the 64bit syscalls. */
		if (shm->nr_active_64bit_syscalls != 0) {
			char *p = str64;
			char *end = str64 + sizeof(str64);
			int n;

			n = snprintf(p, end - p, "%u enabled", shm->nr_active_64bit_syscalls);
			if (n > 0 && n < end - p)
				p += n;

			nr = max_nr_64bit_syscalls - shm->nr_active_64bit_syscalls;
			if (nr != 0)
				snprintf(p, end - p, ", %u disabled", nr);
		} else {
			snprintf(str64, sizeof(str64), "all disabled");
		}

		output(0, "32-bit syscalls: %s.  64-bit syscalls: %s.\n",
			str32, str64);

	} else {
		output(0, "Enabled %d syscalls. Disabled %d syscalls.\n",
			shm->nr_active_syscalls, max_nr_syscalls - shm->nr_active_syscalls);
	}
}

void init_syscalls(void)
{
	if (biarch == true)
		init_syscalls_biarch();
	else
		init_syscalls_uniarch();
}

bool no_syscalls_enabled(void)
{
	unsigned int total;

	if (biarch == true)
		total = shm->nr_active_32bit_syscalls + shm->nr_active_64bit_syscalls;
	else
		total = shm->nr_active_syscalls;

	if (total == 0)
		return true;
	else
		return false;
}

/* Make sure there's at least one syscall enabled. */
int validate_syscall_tables(void)
{
	if (biarch == true) {
		unsigned int ret;

		ret = validate_syscall_table_32();
		ret |= validate_syscall_table_64();
		return ret;
	}

	/* non-biarch case*/
	if (shm->nr_active_syscalls == 0)
		return false;
	else
		return true;
}

static void check_syscall(struct syscallentry *entry)
{
	/* check that we have a name set. */
#define CHECK(NUMARGS, ARGNUM, ARGIDX)				\
	if (entry == NULL)					\
		return;						\
	if (entry->num_args > 0) {				\
		if (entry->num_args > NUMARGS) {		\
			if (entry->argname[ARGIDX] == NULL)  {	\
				outputerr("arg %d of %s has no name\n", ARGNUM, entry->name);      \
				exit(EXIT_FAILURE);		\
			}					\
		}						\
	}							\

	CHECK(0, 1, 0);
	CHECK(1, 2, 1);
	CHECK(2, 3, 2);
	CHECK(3, 4, 3);
	CHECK(4, 5, 4);
	CHECK(5, 6, 5);
}

static void sanity_check(const struct syscalltable *table, unsigned int nr)
{
	unsigned int i;

	for (i = 0; i < nr; i++)
		check_syscall(table[i].entry);
}

void sanity_check_tables(void)
{
	if (biarch == true) {
		sanity_check(syscalls_32bit, max_nr_32bit_syscalls);
		sanity_check(syscalls_64bit, max_nr_64bit_syscalls);
		return;
	}

	/* non-biarch case*/
	sanity_check(syscalls, max_nr_syscalls);
}

void mark_all_syscalls_active(void)
{
	outputstd("Marking all syscalls as enabled.\n");

	if (biarch == true)
		mark_all_syscalls_active_biarch();
	else
		mark_all_syscalls_active_uniarch();
}

void check_user_specified_arch(const char *arg, char **arg_name, bool *only_64bit, bool *only_32bit)
{
	//Check if the arch is specified
	char *arg_arch = strstr(arg,",");

	if (arg_arch  != NULL) {
		unsigned long size = 0;

		size = (unsigned long)arg_arch - (unsigned long)arg;
		*arg_name = malloc(size + 1);
		if (*arg_name == NULL)
			exit(EXIT_FAILURE);
		(*arg_name)[size] = 0;
		memcpy(*arg_name, arg, size);

		//identify architecture
		if ((only_64bit != NULL) && (only_32bit != NULL)) {
			if ((strcmp(arg_arch + 1, "64") == 0)) {
				*only_64bit = true;
				*only_32bit = false;
			} else if ((strcmp(arg_arch + 1,"32") == 0)) {
				*only_64bit = false;
				*only_32bit = true;
			} else {
				outputerr("Unknown bit width (%s). Choose 32, or 64.\n", arg);
				exit(EXIT_FAILURE);
			}
		}
	} else {
		*arg_name = (char*)arg;//castaway const.
	}
}

void clear_check_user_specified_arch(const char *arg, char **arg_name)
{
	//Release memory only if we have allocated it
	if (((char *)arg) != *arg_name) {
		free(*arg_name);
		*arg_name = NULL;
	}
}

void toggle_syscall(const char *arg, bool state)
{
	int specific_syscall = 0;
	char * arg_name = NULL;

	if (biarch == true) {
		toggle_syscall_biarch(arg, state);
		return;
	}

	/* non-biarch case. */
	check_user_specified_arch(arg, &arg_name, NULL, NULL); //We do not care about arch here, just to get rid of arg flags.

	specific_syscall = search_syscall_table(syscalls, max_nr_syscalls, arg_name);
	if (specific_syscall == -1) {
		outputerr("No idea what syscall (%s) is.\n", arg);
		goto out;
	}

	toggle_syscall_n(specific_syscall, state, arg, arg_name);

out:
	clear_check_user_specified_arch(arg, &arg_name);
}

void deactivate_disabled_syscalls(void)
{
	output(0, "Disabling syscalls marked as disabled by command line options\n");

	if (biarch == true)
		deactivate_disabled_syscalls_biarch();
	else
		deactivate_disabled_syscalls_uniarch();
}

void dump_syscall_tables(void)
{
	if (biarch == true)
		dump_syscall_tables_biarch();
	else
		dump_syscall_tables_uniarch();
}

static void print_disabled_in_table(const struct syscalltable *table,
				    unsigned int nr, const char *label)
{
	struct syscallentry *entry;
	unsigned int i, count = 0;

	for (i = 0; i < nr; i++) {
		entry = table[i].entry;
		if (entry == NULL)
			continue;

		if (!(entry->flags & (AVOID_SYSCALL | NEED_ALARM)))
			continue;

		outputstd("%s %u %s :", label, entry->number, entry->name);
		if (entry->flags & AVOID_SYSCALL)
			outputstd(" AVOID_SYSCALL");
		if (entry->flags & NEED_ALARM)
			outputstd(" NEED_ALARM");
		outputstd("\n");
		count++;
	}

	outputstd("%s: %u disabled syscall%s\n",
		label, count, count == 1 ? "" : "s");
}

void print_disabled_syscalls(void)
{
	if (biarch == true) {
		print_disabled_in_table(syscalls_32bit, max_nr_32bit_syscalls,
					"[32-bit]");
		print_disabled_in_table(syscalls_64bit, max_nr_64bit_syscalls,
					"[64-bit]");
	} else {
		print_disabled_in_table(syscalls, max_nr_syscalls, "syscall");
	}
}

static void show_unannotated_biarch(void)
{
	struct syscallentry *entry;
	unsigned int i, j;
	unsigned int count = 0;

	for_each_32bit_syscall(i) {
		entry = syscalls_32bit[i].entry;
		if (entry == NULL)
			continue;

		count = 0;

		for (j = 0; j < entry->num_args; j++) {
			if (entry->argtype[j] == ARG_UNDEFINED)
				count++;
		}
		if (count != 0)
			output(0, "%s has %u unannotated arguments\n", entry->name, count);
	}

	output(0, "\n");

	for_each_64bit_syscall(i) {
		entry = syscalls_64bit[i].entry;
		if (entry == NULL)
			continue;

		count = 0;

		for (j = 0; j < entry->num_args; j++) {
			if (search_syscall_table(syscalls_32bit, max_nr_32bit_syscalls, entry->name) == -1) {
				if (entry->argtype[j] == ARG_UNDEFINED)
					count++;
			}
		}
		if (count != 0)
			output(0, "%s has %u unannotated arguments\n", entry->name, count);
	}
}

void show_unannotated_args(void)
{
	if (biarch == true)
		show_unannotated_biarch();
}

/*
 * This changes the pointers in the table 'from' to be copies in
 * shared mmaps across all children.  We do this so that a child can
 * modify the flags field (adding AVOID for eg) and have other processes see the change.
 *
 * Wild-write risk: a child syscall buffer pointer aliasing into the
 * table could corrupt a syscallentry's argtype[] / num_args / flags,
 * which would then drive the random-syscall generator down a wrong
 * arg path until the corruption clears.  Bounded — random-syscall.c
 * gates on the shape it sees and won't crash the parent on a
 * malformed entry.
 */
static struct syscalltable * copy_syscall_table(struct syscalltable *from, unsigned int nr)
{
	unsigned int n, m;
	struct syscallentry *copy;
	size_t bytes;

	if (!shared_size_mul(nr, sizeof(struct syscallentry), &bytes)) {
		outputerr("copy_syscall_table: nr=%u * sizeof(struct syscallentry) overflows size_t\n",
			  nr);
		exit(EXIT_FAILURE);
	}
	copy = alloc_shared(bytes);
	if (copy == NULL)
		exit(EXIT_FAILURE);

	for (n = 0, m = 0; n < nr; n++) {
		struct syscallentry *entry = from[n].entry;

		if (entry == NULL)
			continue;

		memcpy(copy + m , entry, sizeof(struct syscallentry));
		copy[m].number = n;
		copy[m].active_number = 0;
		copy[m].syscall_category = stats_syscall_category(copy[m].name);
		copy[m].is_close_syscall = (strcmp(copy[m].name, "close") == 0);
		/*
		 * Per-discriminator flags consumed by the shared .sanitise /
		 * .post hooks for the five biarch / variant pairs trinity
		 * fuzzes.  Resolved once here so the per-call discriminator
		 * collapses to a single-byte load (see current_entry_is_*()
		 * in include/tables.h) instead of running this_syscallname()'s
		 * lookup-and-strcmp on every probe.
		 */
		copy[m].is_mmap2 = (strcmp(copy[m].name, "mmap2") == 0);
		copy[m].is_sync_file_range2 = (strcmp(copy[m].name, "sync_file_range2") == 0);
		copy[m].is_inotify_init1 = (strcmp(copy[m].name, "inotify_init1") == 0);
		copy[m].is_epoll_create1 = (strcmp(copy[m].name, "epoll_create1") == 0);
		copy[m].is_execve = (strcmp(copy[m].name, "execve") == 0);
		copy[m].is_epoll_wait_family =
			(strcmp(copy[m].name, "epoll_wait") == 0 ||
			 strcmp(copy[m].name, "epoll_pwait") == 0 ||
			 strcmp(copy[m].name, "epoll_pwait2") == 0);
		copy[m].numeric_substitute_mask = compute_numeric_substitute_mask(&copy[m]);
		copy[m].address_scrub_mask = compute_address_scrub_mask(&copy[m]);
		/*
		 * SKIP_BLANKET_SCRUB syscalls opt out of the defense-in-depth
		 * walk in blanket_address_scrub() — their sanitisers place
		 * pointers whose VA and backing bytes the kernel must observe
		 * unchanged.  Zeroing the cached mask collapses the per-dispatch
		 * walk to the existing mask==0 early-return without any extra
		 * branch on the hot path.
		 */
		if (copy[m].flags & SKIP_BLANKET_SCRUB)
			copy[m].address_scrub_mask = 0;
		copy[m].cleanup_arg_mask = compute_cleanup_arg_mask(&copy[m]);
		copy[m].fd_arg_mask = compute_fd_arg_mask(&copy[m]);
		copy[m].len_arg_mask = compute_len_arg_mask(&copy[m]);
		populate_arglist_all_bits(&copy[m]);
		copy[m].nested_address_scrub_mask =
			compute_nested_address_scrub_mask(&copy[m]);
		if (copy[m].flags & SKIP_BLANKET_SCRUB)
			copy[m].nested_address_scrub_mask = 0;

		/* memcpy + alloc_shared zero-init leaves results[].len_score
		 * decoding as (min=0, max=0) -- a valid range, not the
		 * not-seen sentinel.  Stamp every per-arg slot so a reader
		 * sees min > max on a fresh slot. */
		{
			unsigned int i;
			for (i = 0; i < 6; i++)
				results_init_one(&copy[m].results[i]);
		}

		from[n].entry = &copy[m];
		m++;
	}
	return from;
}

void select_syscall_tables(void)
{
#ifdef ARCH_IS_BIARCH
	syscalls_64bit = copy_syscall_table(SYSCALLS64, ARRAY_SIZE(SYSCALLS64));
	syscalls_32bit = copy_syscall_table(SYSCALLS32, ARRAY_SIZE(SYSCALLS32));

	max_nr_64bit_syscalls = ARRAY_SIZE(SYSCALLS64);
	max_nr_32bit_syscalls = ARRAY_SIZE(SYSCALLS32);
	biarch = true;

	build_expensive_bitmap(syscalls_64bit, max_nr_64bit_syscalls,
			       expensive_bits_64);
	build_expensive_bitmap(syscalls_32bit, max_nr_32bit_syscalls,
			       expensive_bits_32);
#else
	syscalls = copy_syscall_table(SYSCALLS, ARRAY_SIZE(SYSCALLS));
	max_nr_syscalls = ARRAY_SIZE(SYSCALLS);

	build_expensive_bitmap(syscalls, max_nr_syscalls,
			       expensive_bits_uniarch);
#endif
}

/*
 * Subgroup inheritance for `-g <group>`: a syscall is selected under
 * group G if its .group is G, OR if its .group's parent is G.  The
 * lookup is selection-only -- xattr syscalls keep .group = GROUP_XATTR
 * so per-group stats/bias keep attributing to the leaf group.  Only
 * GROUP_XATTR currently has a parent (GROUP_VFS); every other slot
 * defaults to GROUP_NONE.
 */
const unsigned int group_parent[NR_GROUPS] = {
	[GROUP_XATTR] = GROUP_VFS,
};

int setup_syscall_group(unsigned int group)
{
	if (biarch == true)
		return setup_syscall_group_biarch(group);
	else
		return setup_syscall_group_uniarch(group);
}

const char * print_syscall_name(unsigned int callno, bool is32bit)
{
	const struct syscalltable *table;
	unsigned int max;

	if (biarch == false) {
		max = max_nr_syscalls;
		table = syscalls;
	} else {
		if (is32bit == false) {
			max = max_nr_64bit_syscalls;
			table = syscalls_64bit;
		} else {
			max = max_nr_32bit_syscalls;
			table = syscalls_32bit;
		}
	}

	if (callno >= max) {
		outputstd("Bogus syscall number in %s (%u)\n", __func__, callno);
		return "invalid-syscall";
	}

	if (table[callno].entry == NULL)
		return "unknown";

	return table[callno].entry->name;
}

void display_enabled_syscalls(void)
{
	if (biarch == true)
		display_enabled_syscalls_biarch();
	else
		display_enabled_syscalls_uniarch();
}

static void enable_random_syscalls(void)
{
	unsigned int i;

	if (random_selection_num == 0) {
		outputerr("-r 0 syscalls ? what?\n");
		exit(EXIT_FAILURE);
	}

	if (biarch == true) {
		if ((random_selection_num > max_nr_64bit_syscalls) && do_64_arch) {
			outputerr("-r val %d out of range (1-%d)\n", random_selection_num, max_nr_64bit_syscalls);
			exit(EXIT_FAILURE);
		}
	} else {
		if (random_selection_num > max_nr_syscalls) {
			outputerr("-r val %d out of range (1-%d)\n", random_selection_num, max_nr_syscalls);
			exit(EXIT_FAILURE);
		}
	}

	outputerr("Enabling %d random syscalls\n", random_selection_num);

	for (i = 0; i < random_selection_num; i++) {
		if (biarch == true)
			enable_random_syscalls_biarch();
		else
			enable_random_syscalls_uniarch();
	}
}

/* Pick up syscalls flagged ACTIVE before create_shm() ran (the
 * `-c <syscall>` handler in parse_args) and stamp them into the
 * shm-backed active table.  Idempotent: activate_syscall_in_table()
 * skips entries with entry->active_number != 0. */
static void activate_flagged_syscalls(void)
{
	if (biarch == true)
		activate_flagged_syscalls_biarch();
	else
		activate_flagged_syscalls_uniarch();
}

/* By default, all syscall entries will be disabled.
 * If we didn't pass -c, -x, -r, or -g then mark all syscalls active.
 */
static void decide_if_active(void)
{
	if (do_specific_syscall == true)
		return;
	if (do_exclude_syscall == true)
		return;
	if (random_selection == true)
		return;
	if (desired_group != GROUP_NONE)
		return;

	mark_all_syscalls_active();
}

/* This is run *after* we've parsed params */
int munge_tables(void)
{
	decide_if_active();

	activate_flagged_syscalls();

	if (desired_group != GROUP_NONE) {
		unsigned int ret;

		ret = setup_syscall_group(desired_group);
		if (ret == false)
			return false;
	}

	if (random_selection == true)
		enable_random_syscalls();

	/* If we saw a '-x', set all syscalls to enabled, then selectively disable.
	 * Unless:
	 * - we've started enabling them already (with -r)
	 * - or if we specified a group -g
	 * - we've also specified syscalls with -c
	 */
	if (do_exclude_syscall == true) {
		if ((random_selection == false) && (desired_group == GROUP_NONE) && (do_specific_syscall == false))
			mark_all_syscalls_active();
		deactivate_disabled_syscalls();
	}

	sanity_check_tables();

	count_syscalls_enabled();

	if (verbosity >= MAX_LOGLEVEL)
		display_enabled_syscalls();

	if (validate_syscall_tables() == false) {
		outputstd("No syscalls were enabled!\n");
		outputstd("Use 32bit:%d 64bit:%d\n", use_32bit, use_64bit);
		return false;
	}

	return true;
}

/*
 * Honor -x <syscall> at raw syscall(__NR_X, ...) sites in childops /
 * fds that bypass the syscall-table picker entirely.  Returns true if
 * `nr` names a syscall the user named in -x at parse time: the
 * EXPLICITLY_EXCLUDED flag is stamped on the entry by toggle_syscall_n()
 * / toggle_syscall_biarch_n() alongside TO_BE_DEACTIVATED, and survives
 * the ACTIVE|TO_BE_DEACTIVATED clear that deactivate_disabled_syscalls()
 * performs in munge_tables() -- so the flag is the authoritative,
 * targeting-mode-independent record of "this syscall is excluded".
 *
 * Returns false in every other case, including the common ones:
 *   - do_exclude_syscall is false (one load + branch, no table touch),
 *   - nr is negative or out of range for the host arch table,
 *   - the table slot is NULL (gaps for arch-specific syscalls),
 *   - the entry was not named in -x (flag not set).
 *
 * Targeting selectors (-c / -r / -g) no longer change the answer.  The
 * previous implementation inferred exclusion from (flags & ACTIVE) == 0
 * and had to short-circuit to false under any targeting selector to
 * avoid misreporting unrelated syscalls (a non-targeted entry is
 * inactive because it was never enabled, not because it was -x'd) --
 * but that workaround also silently dropped the legitimate -x exclusion
 * when targeting was active (targeting/exclusion bug: e.g. `-c foo -x bar` left
 * bar reachable from raw-syscall sites).  Reading the explicit bit
 * fixes both directions at once.
 *
 * Biarch: trinity itself runs as the host's native (64bit) binary; a
 * raw syscall(__NR_X) from a childop / fd-provider invokes the 64bit
 * syscall regardless of which table -c <name> resolved against, so
 * consult the 64bit table only.  -x toggles the 32bit and 64bit slots
 * in lockstep (toggle_syscall_biarch in tables-biarch.c) so an entry
 * flagged in one table is flagged in the other.
 *
 * Callers should treat a true return as "skip this syscall"; the
 * trinity_raw_syscall() wrapper in include/syscall-gate.h sets
 * errno = ENOSYS and returns -1, which existing childops already
 * handle gracefully (kernels legitimately ENOSYS unsupported calls).
 */
bool syscall_nr_is_excluded(int nr)
{
	struct syscallentry *entry;

	if (do_exclude_syscall == false)
		return false;
	if (nr < 0)
		return false;

#ifdef ARCH_IS_BIARCH
	if ((unsigned int)nr >= max_nr_64bit_syscalls)
		return false;
	entry = syscalls_64bit[nr].entry;
#else
	if ((unsigned int)nr >= max_nr_syscalls)
		return false;
	entry = syscalls[nr].entry;
#endif

	if (entry == NULL)
		return false;

	return (entry->flags & EXPLICITLY_EXCLUDED) != 0;
}

/*
 * return a ptr to a syscall table entry, allowing calling code to be
 * ignorant about things like biarch.
 *
 * Takes the actual syscall number from the syscallrecord struct as an arg.
 */
struct syscallentry * get_syscall_entry(unsigned int callno, bool do32 __attribute__((unused)))
{
#ifndef ARCH_IS_BIARCH
	if (callno >= max_nr_syscalls)
		return NULL;
	return syscalls[callno].entry;
#else
	if (do32 == true) {
		if (callno >= max_nr_32bit_syscalls)
			return NULL;
		return syscalls_32bit[callno].entry;
	}

	if (callno >= max_nr_64bit_syscalls)
		return NULL;
	return syscalls_64bit[callno].entry;
#endif
}

/*
 * Check the name of the syscall we're in the ->sanitise of.
 * This is useful for syscalls where we have a common ->sanitise
 * for multiple syscallentry's. (mmap/mmap2, sync_file_range/sync_file_range2)
 *
 * Reads the resolved entry pointer that dispatch_step() stamps on the rec
 * before invoking do_syscall(); this elides the per-call
 * get_syscall_entry(nr, do32bit) table lookup + biarch branch the original
 * shape paid for on every callsite (mmap/mmap2 fires this twice per call).
 * All current callers run inside .sanitise / .post hooks, both of which
 * fire after dispatch_step has set rec->entry, so the NULL guard only
 * matters for any future caller that fires before dispatch.
 */
bool this_syscallname(const char *thisname)
{
	struct syscallentry *e = this_child()->syscall.entry;

	if (e == NULL)
		return false;

	return strcmp(thisname, e->name) == 0;
}