stracers-core 0.1.0

use nix::libc::user_regs_struct;
use nix::unistd::Pid;

use crate::event::DecodedArg;
use crate::memory;

/// Extract syscall number and arguments from registers at syscall entry.
pub fn extract_syscall_entry(regs: &user_regs_struct) -> (u64, [u64; 6]) {
    let number = regs.orig_rax;
    let args = [regs.rdi, regs.rsi, regs.rdx, regs.r10, regs.r8, regs.r9];
    (number, args)
}

/// Extract return value from registers at syscall exit.
pub fn extract_return_value(regs: &user_regs_struct) -> i64 {
    regs.rax as i64
}

/// Look up syscall name by number. Returns None for unknown syscalls.
pub fn syscall_name(number: u64) -> Option<&'static str> {
    SYSCALL_NAMES.get(number as usize).copied().flatten()
}

/// Decode syscall arguments at entry (before the syscall executes).
/// This handles paths, flags, fds, and input buffers (e.g. write).
pub fn decode_entry_args(pid: Pid, number: u64, args: &[u64; 6]) -> Vec<DecodedArg> {
    match number {
        // read(fd, buf, count) — buf is output, decode at exit
        0 => vec![
            DecodedArg::Fd(args[0] as i32),
            DecodedArg::Addr(args[1]), // placeholder, replaced at exit
            DecodedArg::Size(args[2]),
        ],
        // write(fd, buf, count) — buf is input, decode now
        1 => {
            let count = args[2] as usize;
            let buf = read_buf(pid, args[1], count.min(32));
            vec![
                DecodedArg::Fd(args[0] as i32),
                DecodedArg::Buf(buf, count),
                DecodedArg::Size(args[2]),
            ]
        }
        // open(path, flags, mode)
        2 => vec![
            read_path(pid, args[0]),
            decode_open_flags(args[1]),
            DecodedArg::Int(args[2] as i64),
        ],
        // close(fd)
        3 => vec![DecodedArg::Fd(args[0] as i32)],
        // stat(path, statbuf)
        4 => vec![read_path(pid, args[0]), DecodedArg::Addr(args[1])],
        // fstat(fd, statbuf)
        5 => vec![DecodedArg::Fd(args[0] as i32), DecodedArg::Addr(args[1])],
        // lstat(path, statbuf)
        6 => vec![read_path(pid, args[0]), DecodedArg::Addr(args[1])],
        // lseek(fd, offset, whence)
        8 => vec![
            DecodedArg::Fd(args[0] as i32),
            DecodedArg::Int(args[1] as i64),
            decode_whence(args[2]),
        ],
        // mmap(addr, length, prot, flags, fd, offset)
        9 => vec![
            DecodedArg::Addr(args[0]),
            DecodedArg::Size(args[1]),
            decode_mmap_prot(args[2]),
            decode_mmap_flags(args[3]),
            DecodedArg::Fd(args[4] as i32),
            DecodedArg::Int(args[5] as i64),
        ],
        // mprotect(addr, len, prot)
        10 => vec![
            DecodedArg::Addr(args[0]),
            DecodedArg::Size(args[1]),
            decode_mmap_prot(args[2]),
        ],
        // munmap(addr, length)
        11 => vec![DecodedArg::Addr(args[0]), DecodedArg::Size(args[1])],
        // brk(addr)
        12 => vec![DecodedArg::Addr(args[0])],
        // rt_sigaction(signum, act, oldact, sigsetsize)
        13 => vec![
            DecodedArg::Int(args[0] as i64),
            DecodedArg::Addr(args[1]),
            DecodedArg::Addr(args[2]),
            DecodedArg::Size(args[3]),
        ],
        // rt_sigprocmask(how, set, oldset, sigsetsize)
        14 => vec![
            DecodedArg::Int(args[0] as i64),
            DecodedArg::Addr(args[1]),
            DecodedArg::Addr(args[2]),
            DecodedArg::Size(args[3]),
        ],
        // ioctl(fd, request, ...)
        16 => vec![
            DecodedArg::Fd(args[0] as i32),
            DecodedArg::Raw(args[1]),
            DecodedArg::Addr(args[2]),
        ],
        // pread64(fd, buf, count, offset)
        17 => vec![
            DecodedArg::Fd(args[0] as i32),
            DecodedArg::Addr(args[1]),
            DecodedArg::Size(args[2]),
            DecodedArg::Int(args[3] as i64),
        ],
        // access(path, mode)
        21 => vec![read_path(pid, args[0]), decode_access_mode(args[1])],
        // dup(fd)
        32 => vec![DecodedArg::Fd(args[0] as i32)],
        // dup2(oldfd, newfd)
        33 => vec![
            DecodedArg::Fd(args[0] as i32),
            DecodedArg::Fd(args[1] as i32),
        ],
        // execve(filename, argv, envp)
        59 => vec![
            read_path(pid, args[0]),
            DecodedArg::Addr(args[1]),
            DecodedArg::Addr(args[2]),
        ],
        // exit(status)
        60 => vec![DecodedArg::Int(args[0] as i64)],
        // fcntl(fd, cmd, ...)
        72 => vec![
            DecodedArg::Fd(args[0] as i32),
            DecodedArg::Int(args[1] as i64),
            DecodedArg::Raw(args[2]),
        ],
        // getcwd(buf, size)
        79 => vec![DecodedArg::Addr(args[0]), DecodedArg::Size(args[1])],
        // chdir(path)
        80 => vec![read_path(pid, args[0])],
        // mkdir(path, mode)
        83 => vec![read_path(pid, args[0]), DecodedArg::Int(args[1] as i64)],
        // unlink(path)
        87 => vec![read_path(pid, args[0])],
        // readlink(path, buf, bufsiz)
        89 => vec![
            read_path(pid, args[0]),
            DecodedArg::Addr(args[1]),
            DecodedArg::Size(args[2]),
        ],
        // getuid/getgid/geteuid/getegid/getpid/getppid/gettid (no args)
        39 | 102 | 104 | 107 | 108 | 110 | 186 => vec![],
        // arch_prctl(code, addr)
        158 => vec![
            decode_arch_prctl_code(args[0]),
            DecodedArg::Addr(args[1]),
        ],
        // set_tid_address(tidptr)
        218 => vec![DecodedArg::Addr(args[0])],
        // exit_group(status)
        231 => vec![DecodedArg::Int(args[0] as i64)],
        // openat(dirfd, pathname, flags, mode)
        257 => vec![
            DecodedArg::Fd(args[0] as i32),
            read_path(pid, args[1]),
            decode_open_flags(args[2]),
            DecodedArg::Int(args[3] as i64),
        ],
        // newfstatat(dirfd, pathname, statbuf, flag)
        262 => vec![
            DecodedArg::Fd(args[0] as i32),
            read_path(pid, args[1]),
            DecodedArg::Addr(args[2]),
            DecodedArg::Raw(args[3]),
        ],
        // readlinkat(dirfd, pathname, buf, bufsiz)
        267 => vec![
            DecodedArg::Fd(args[0] as i32),
            read_path(pid, args[1]),
            DecodedArg::Addr(args[2]),
            DecodedArg::Size(args[3]),
        ],
        // faccessat(dirfd, pathname, mode)
        269 => vec![
            DecodedArg::Fd(args[0] as i32),
            read_path(pid, args[1]),
            decode_access_mode(args[2]),
        ],
        // set_robust_list(head, len)
        273 => vec![DecodedArg::Addr(args[0]), DecodedArg::Size(args[1])],
        // prlimit64(pid, resource, new_limit, old_limit)
        302 => vec![
            DecodedArg::Int(args[0] as i64),
            DecodedArg::Int(args[1] as i64),
            DecodedArg::Addr(args[2]),
            DecodedArg::Addr(args[3]),
        ],
        // getrandom(buf, buflen, flags)
        318 => vec![
            DecodedArg::Addr(args[0]),
            DecodedArg::Size(args[1]),
            DecodedArg::Raw(args[2]),
        ],
        // rseq(rseq, rseq_len, flags, sig)
        334 => vec![
            DecodedArg::Addr(args[0]),
            DecodedArg::Size(args[1]),
            DecodedArg::Raw(args[2]),
            DecodedArg::Raw(args[3]),
        ],
        // Unknown syscall — show all 6 args as raw hex
        _ => args.iter().map(|&a| DecodedArg::Raw(a)).collect(),
    }
}

/// Decode output arguments at syscall exit (e.g. read buffer).
/// Updates decoded_args in place if needed.
pub fn decode_exit_args(
    pid: Pid,
    number: u64,
    args: &[u64; 6],
    ret: i64,
    decoded: &mut Vec<DecodedArg>,
) {
    match number {
        // read(fd, buf, count) — now buf is filled, ret is bytes read
        0 if ret > 0 => {
            let count = ret as usize;
            let buf = read_buf(pid, args[1], count.min(32));
            if decoded.len() > 1 {
                decoded[1] = DecodedArg::Buf(buf, count);
            }
        }
        _ => {}
    }
}

// --- Helpers ---

fn read_path(pid: Pid, addr: u64) -> DecodedArg {
    match memory::read_string(pid, addr, 256) {
        Ok(s) => DecodedArg::Path(s),
        Err(_) => DecodedArg::Addr(addr),
    }
}

fn read_buf(pid: Pid, addr: u64, len: usize) -> Vec<u8> {
    memory::read_bytes(pid, addr, len).unwrap_or_default()
}

fn decode_open_flags(flags: u64) -> DecodedArg {
    let access = flags & 0o3;
    let mut parts = vec![match access {
        0 => "O_RDONLY",
        1 => "O_WRONLY",
        2 => "O_RDWR",
        _ => "O_???",
    }];

    static FLAG_BITS: &[(u64, &str)] = &[
        (0o0100, "O_CREAT"),
        (0o0200, "O_EXCL"),
        (0o0400, "O_NOCTTY"),
        (0o01000, "O_TRUNC"),
        (0o02000, "O_APPEND"),
        (0o04000, "O_NONBLOCK"),
        (0o010000, "O_DSYNC"),
        (0o020000, "O_ASYNC"),
        (0o040000, "O_DIRECT"),
        (0o0100000, "O_LARGEFILE"),
        (0o0200000, "O_DIRECTORY"),
        (0o0400000, "O_NOFOLLOW"),
        (0o01000000, "O_NOATIME"),
        (0o02000000, "O_CLOEXEC"),
        (0o04010000, "O_SYNC"),
        (0o010000000, "O_PATH"),
        (0o020000000, "O_TMPFILE"),
    ];

    for &(bit, name) in FLAG_BITS {
        if flags & bit == bit && bit != 0 {
            parts.push(name);
        }
    }

    DecodedArg::Flags(parts.join("|"))
}

fn decode_mmap_prot(prot: u64) -> DecodedArg {
    if prot == 0 {
        return DecodedArg::Flags("PROT_NONE".to_string());
    }
    let mut parts = Vec::new();
    if prot & 0x1 != 0 { parts.push("PROT_READ"); }
    if prot & 0x2 != 0 { parts.push("PROT_WRITE"); }
    if prot & 0x4 != 0 { parts.push("PROT_EXEC"); }
    DecodedArg::Flags(parts.join("|"))
}

fn decode_mmap_flags(flags: u64) -> DecodedArg {
    let mut parts = Vec::new();
    if flags & 0x01 != 0 { parts.push("MAP_SHARED"); }
    if flags & 0x02 != 0 { parts.push("MAP_PRIVATE"); }
    if flags & 0x10 != 0 { parts.push("MAP_FIXED"); }
    if flags & 0x20 != 0 { parts.push("MAP_ANONYMOUS"); }
    if flags & 0x100 != 0 { parts.push("MAP_GROWSDOWN"); }
    if flags & 0x0800 != 0 { parts.push("MAP_DENYWRITE"); }
    if flags & 0x40000 != 0 { parts.push("MAP_STACK"); }
    if parts.is_empty() {
        DecodedArg::Raw(flags)
    } else {
        DecodedArg::Flags(parts.join("|"))
    }
}

fn decode_access_mode(mode: u64) -> DecodedArg {
    if mode == 0 {
        return DecodedArg::Flags("F_OK".to_string());
    }
    let mut parts = Vec::new();
    if mode & 0x4 != 0 { parts.push("R_OK"); }
    if mode & 0x2 != 0 { parts.push("W_OK"); }
    if mode & 0x1 != 0 { parts.push("X_OK"); }
    DecodedArg::Flags(parts.join("|"))
}

fn decode_whence(whence: u64) -> DecodedArg {
    DecodedArg::Flags(match whence {
        0 => "SEEK_SET".to_string(),
        1 => "SEEK_CUR".to_string(),
        2 => "SEEK_END".to_string(),
        _ => format!("{}", whence),
    })
}

fn decode_arch_prctl_code(code: u64) -> DecodedArg {
    DecodedArg::Flags(match code {
        0x1001 => "ARCH_SET_GS".to_string(),
        0x1002 => "ARCH_SET_FS".to_string(),
        0x1003 => "ARCH_GET_FS".to_string(),
        0x1004 => "ARCH_GET_GS".to_string(),
        _ => format!("{:#x}", code),
    })
}

// Sparse table indexed by syscall number. x86_64 syscalls max out ~450.
static SYSCALL_NAMES: &[Option<&str>] = &[
    /* 0 */ Some("read"),
    /* 1 */ Some("write"),
    /* 2 */ Some("open"),
    /* 3 */ Some("close"),
    /* 4 */ Some("stat"),
    /* 5 */ Some("fstat"),
    /* 6 */ Some("lstat"),
    /* 7 */ Some("poll"),
    /* 8 */ Some("lseek"),
    /* 9 */ Some("mmap"),
    /* 10 */ Some("mprotect"),
    /* 11 */ Some("munmap"),
    /* 12 */ Some("brk"),
    /* 13 */ Some("rt_sigaction"),
    /* 14 */ Some("rt_sigprocmask"),
    /* 15 */ Some("rt_sigreturn"),
    /* 16 */ Some("ioctl"),
    /* 17 */ Some("pread64"),
    /* 18 */ Some("pwrite64"),
    /* 19 */ Some("readv"),
    /* 20 */ Some("writev"),
    /* 21 */ Some("access"),
    /* 22 */ Some("pipe"),
    /* 23 */ Some("select"),
    /* 24 */ Some("sched_yield"),
    /* 25 */ Some("mremap"),
    /* 26 */ Some("msync"),
    /* 27 */ Some("mincore"),
    /* 28 */ Some("madvise"),
    /* 29 */ Some("shmget"),
    /* 30 */ Some("shmat"),
    /* 31 */ Some("shmctl"),
    /* 32 */ Some("dup"),
    /* 33 */ Some("dup2"),
    /* 34 */ Some("pause"),
    /* 35 */ Some("nanosleep"),
    /* 36 */ Some("getitimer"),
    /* 37 */ Some("alarm"),
    /* 38 */ Some("setitimer"),
    /* 39 */ Some("getpid"),
    /* 40 */ Some("sendfile"),
    /* 41 */ Some("socket"),
    /* 42 */ Some("connect"),
    /* 43 */ Some("accept"),
    /* 44 */ Some("sendto"),
    /* 45 */ Some("recvfrom"),
    /* 46 */ Some("sendmsg"),
    /* 47 */ Some("recvmsg"),
    /* 48 */ Some("shutdown"),
    /* 49 */ Some("bind"),
    /* 50 */ Some("listen"),
    /* 51 */ Some("getsockname"),
    /* 52 */ Some("getpeername"),
    /* 53 */ Some("socketpair"),
    /* 54 */ Some("setsockopt"),
    /* 55 */ Some("getsockopt"),
    /* 56 */ Some("clone"),
    /* 57 */ Some("fork"),
    /* 58 */ Some("vfork"),
    /* 59 */ Some("execve"),
    /* 60 */ Some("exit"),
    /* 61 */ Some("wait4"),
    /* 62 */ Some("kill"),
    /* 63 */ Some("uname"),
    /* 64 */ Some("semget"),
    /* 65 */ Some("semop"),
    /* 66 */ Some("semctl"),
    /* 67 */ Some("shmdt"),
    /* 68 */ Some("msgget"),
    /* 69 */ Some("msgsnd"),
    /* 70 */ Some("msgrcv"),
    /* 71 */ Some("msgctl"),
    /* 72 */ Some("fcntl"),
    /* 73 */ Some("flock"),
    /* 74 */ Some("fsync"),
    /* 75 */ Some("fdatasync"),
    /* 76 */ Some("truncate"),
    /* 77 */ Some("ftruncate"),
    /* 78 */ Some("getdents"),
    /* 79 */ Some("getcwd"),
    /* 80 */ Some("chdir"),
    /* 81 */ Some("fchdir"),
    /* 82 */ Some("rename"),
    /* 83 */ Some("mkdir"),
    /* 84 */ Some("rmdir"),
    /* 85 */ Some("creat"),
    /* 86 */ Some("link"),
    /* 87 */ Some("unlink"),
    /* 88 */ Some("symlink"),
    /* 89 */ Some("readlink"),
    /* 90 */ Some("chmod"),
    /* 91 */ Some("fchmod"),
    /* 92 */ Some("chown"),
    /* 93 */ Some("fchown"),
    /* 94 */ Some("lchown"),
    /* 95 */ Some("umask"),
    /* 96 */ Some("gettimeofday"),
    /* 97 */ Some("getrlimit"),
    /* 98 */ Some("getrusage"),
    /* 99 */ Some("sysinfo"),
    /* 100 */ Some("times"),
    /* 101 */ Some("ptrace"),
    /* 102 */ Some("getuid"),
    /* 103 */ Some("syslog"),
    /* 104 */ Some("getgid"),
    /* 105 */ Some("setuid"),
    /* 106 */ Some("setgid"),
    /* 107 */ Some("geteuid"),
    /* 108 */ Some("getegid"),
    /* 109 */ Some("setpgid"),
    /* 110 */ Some("getppid"),
    /* 111 */ Some("getpgrp"),
    /* 112 */ Some("setsid"),
    /* 113 */ Some("setreuid"),
    /* 114 */ Some("setregid"),
    /* 115 */ Some("getgroups"),
    /* 116 */ Some("setgroups"),
    /* 117 */ Some("setresuid"),
    /* 118 */ Some("getresuid"),
    /* 119 */ Some("setresgid"),
    /* 120 */ Some("getresgid"),
    /* 121 */ Some("getpgid"),
    /* 122 */ Some("setfsuid"),
    /* 123 */ Some("setfsgid"),
    /* 124 */ Some("getsid"),
    /* 125 */ Some("capget"),
    /* 126 */ Some("capset"),
    /* 127 */ Some("rt_sigpending"),
    /* 128 */ Some("rt_sigtimedwait"),
    /* 129 */ Some("rt_sigqueueinfo"),
    /* 130 */ Some("rt_sigsuspend"),
    /* 131 */ Some("sigaltstack"),
    /* 132 */ Some("utime"),
    /* 133 */ Some("mknod"),
    /* 134 */ Some("uselib"),
    /* 135 */ Some("personality"),
    /* 136 */ Some("ustat"),
    /* 137 */ Some("statfs"),
    /* 138 */ Some("fstatfs"),
    /* 139 */ Some("sysfs"),
    /* 140 */ Some("getpriority"),
    /* 141 */ Some("setpriority"),
    /* 142 */ Some("sched_setparam"),
    /* 143 */ Some("sched_getparam"),
    /* 144 */ Some("sched_setscheduler"),
    /* 145 */ Some("sched_getscheduler"),
    /* 146 */ Some("sched_get_priority_max"),
    /* 147 */ Some("sched_get_priority_min"),
    /* 148 */ Some("sched_rr_get_interval"),
    /* 149 */ Some("mlock"),
    /* 150 */ Some("munlock"),
    /* 151 */ Some("mlockall"),
    /* 152 */ Some("munlockall"),
    /* 153 */ Some("vhangup"),
    /* 154 */ Some("modify_ldt"),
    /* 155 */ Some("pivot_root"),
    /* 156 */ Some("_sysctl"),
    /* 157 */ Some("prctl"),
    /* 158 */ Some("arch_prctl"),
    /* 159 */ Some("adjtimex"),
    /* 160 */ Some("setrlimit"),
    /* 161 */ Some("chroot"),
    /* 162 */ Some("sync"),
    /* 163 */ Some("acct"),
    /* 164 */ Some("settimeofday"),
    /* 165 */ Some("mount"),
    /* 166 */ Some("umount2"),
    /* 167 */ Some("swapon"),
    /* 168 */ Some("swapoff"),
    /* 169 */ Some("reboot"),
    /* 170 */ Some("sethostname"),
    /* 171 */ Some("setdomainname"),
    /* 172 */ Some("iopl"),
    /* 173 */ Some("ioperm"),
    /* 174 */ Some("create_module"),
    /* 175 */ Some("init_module"),
    /* 176 */ Some("delete_module"),
    /* 177 */ Some("get_kernel_syms"),
    /* 178 */ Some("query_module"),
    /* 179 */ Some("quotactl"),
    /* 180 */ Some("nfsservctl"),
    /* 181 */ Some("getpmsg"),
    /* 182 */ Some("putpmsg"),
    /* 183 */ Some("afs_syscall"),
    /* 184 */ Some("tuxcall"),
    /* 185 */ Some("security"),
    /* 186 */ Some("gettid"),
    /* 187 */ Some("readahead"),
    /* 188 */ Some("setxattr"),
    /* 189 */ Some("lsetxattr"),
    /* 190 */ Some("fsetxattr"),
    /* 191 */ Some("getxattr"),
    /* 192 */ Some("lgetxattr"),
    /* 193 */ Some("fgetxattr"),
    /* 194 */ Some("listxattr"),
    /* 195 */ Some("llistxattr"),
    /* 196 */ Some("flistxattr"),
    /* 197 */ Some("removexattr"),
    /* 198 */ Some("lremovexattr"),
    /* 199 */ Some("fremovexattr"),
    /* 200 */ Some("tkill"),
    /* 201 */ Some("time"),
    /* 202 */ Some("futex"),
    /* 203 */ Some("sched_setaffinity"),
    /* 204 */ Some("sched_getaffinity"),
    /* 205 */ Some("set_thread_area"),
    /* 206 */ Some("io_setup"),
    /* 207 */ Some("io_destroy"),
    /* 208 */ Some("io_getevents"),
    /* 209 */ Some("io_submit"),
    /* 210 */ Some("io_cancel"),
    /* 211 */ Some("get_thread_area"),
    /* 212 */ Some("lookup_dcookie"),
    /* 213 */ Some("epoll_create"),
    /* 214 */ Some("epoll_ctl_old"),
    /* 215 */ Some("epoll_wait_old"),
    /* 216 */ Some("remap_file_pages"),
    /* 217 */ Some("getdents64"),
    /* 218 */ Some("set_tid_address"),
    /* 219 */ Some("restart_syscall"),
    /* 220 */ Some("semtimedop"),
    /* 221 */ Some("fadvise64"),
    /* 222 */ Some("timer_create"),
    /* 223 */ Some("timer_settime"),
    /* 224 */ Some("timer_gettime"),
    /* 225 */ Some("timer_getoverrun"),
    /* 226 */ Some("timer_delete"),
    /* 227 */ Some("clock_settime"),
    /* 228 */ Some("clock_gettime"),
    /* 229 */ Some("clock_getres"),
    /* 230 */ Some("clock_nanosleep"),
    /* 231 */ Some("exit_group"),
    /* 232 */ Some("epoll_wait"),
    /* 233 */ Some("epoll_ctl"),
    /* 234 */ Some("tgkill"),
    /* 235 */ Some("utimes"),
    /* 236 */ Some("vserver"),
    /* 237 */ Some("mbind"),
    /* 238 */ Some("set_mempolicy"),
    /* 239 */ Some("get_mempolicy"),
    /* 240 */ Some("mq_open"),
    /* 241 */ Some("mq_unlink"),
    /* 242 */ Some("mq_timedsend"),
    /* 243 */ Some("mq_timedreceive"),
    /* 244 */ Some("mq_notify"),
    /* 245 */ Some("mq_getsetattr"),
    /* 246 */ Some("kexec_load"),
    /* 247 */ Some("waitid"),
    /* 248 */ Some("add_key"),
    /* 249 */ Some("request_key"),
    /* 250 */ Some("keyctl"),
    /* 251 */ Some("ioprio_set"),
    /* 252 */ Some("ioprio_get"),
    /* 253 */ Some("inotify_init"),
    /* 254 */ Some("inotify_add_watch"),
    /* 255 */ Some("inotify_rm_watch"),
    /* 256 */ Some("migrate_pages"),
    /* 257 */ Some("openat"),
    /* 258 */ Some("mkdirat"),
    /* 259 */ Some("mknodat"),
    /* 260 */ Some("fchownat"),
    /* 261 */ Some("futimesat"),
    /* 262 */ Some("newfstatat"),
    /* 263 */ Some("unlinkat"),
    /* 264 */ Some("renameat"),
    /* 265 */ Some("linkat"),
    /* 266 */ Some("symlinkat"),
    /* 267 */ Some("readlinkat"),
    /* 268 */ Some("fchmodat"),
    /* 269 */ Some("faccessat"),
    /* 270 */ Some("pselect6"),
    /* 271 */ Some("ppoll"),
    /* 272 */ Some("unshare"),
    /* 273 */ Some("set_robust_list"),
    /* 274 */ Some("get_robust_list"),
    /* 275 */ Some("splice"),
    /* 276 */ Some("tee"),
    /* 277 */ Some("sync_file_range"),
    /* 278 */ Some("vmsplice"),
    /* 279 */ Some("move_pages"),
    /* 280 */ Some("utimensat"),
    /* 281 */ Some("epoll_pwait"),
    /* 282 */ Some("signalfd"),
    /* 283 */ Some("timerfd_create"),
    /* 284 */ Some("eventfd"),
    /* 285 */ Some("fallocate"),
    /* 286 */ Some("timerfd_settime"),
    /* 287 */ Some("timerfd_gettime"),
    /* 288 */ Some("accept4"),
    /* 289 */ Some("signalfd4"),
    /* 290 */ Some("eventfd2"),
    /* 291 */ Some("epoll_create1"),
    /* 292 */ Some("dup3"),
    /* 293 */ Some("pipe2"),
    /* 294 */ Some("inotify_init1"),
    /* 295 */ Some("preadv"),
    /* 296 */ Some("pwritev"),
    /* 297 */ Some("rt_tgsigqueueinfo"),
    /* 298 */ Some("perf_event_open"),
    /* 299 */ Some("recvmmsg"),
    /* 300 */ Some("fanotify_init"),
    /* 301 */ Some("fanotify_mark"),
    /* 302 */ Some("prlimit64"),
    /* 303 */ Some("name_to_handle_at"),
    /* 304 */ Some("open_by_handle_at"),
    /* 305 */ Some("clock_adjtime"),
    /* 306 */ Some("syncfs"),
    /* 307 */ Some("sendmmsg"),
    /* 308 */ Some("setns"),
    /* 309 */ Some("getcpu"),
    /* 310 */ Some("process_vm_readv"),
    /* 311 */ Some("process_vm_writev"),
    /* 312 */ Some("kcmp"),
    /* 313 */ Some("finit_module"),
    /* 314 */ Some("sched_setattr"),
    /* 315 */ Some("sched_getattr"),
    /* 316 */ Some("renameat2"),
    /* 317 */ Some("seccomp"),
    /* 318 */ Some("getrandom"),
    /* 319 */ Some("memfd_create"),
    /* 320 */ Some("kexec_file_load"),
    /* 321 */ Some("bpf"),
    /* 322 */ Some("execveat"),
    /* 323 */ Some("userfaultfd"),
    /* 324 */ Some("membarrier"),
    /* 325 */ Some("mlock2"),
    /* 326 */ Some("copy_file_range"),
    /* 327 */ Some("preadv2"),
    /* 328 */ Some("pwritev2"),
    /* 329 */ Some("pkey_mprotect"),
    /* 330 */ Some("pkey_alloc"),
    /* 331 */ Some("pkey_free"),
    /* 332 */ Some("statx"),
    /* 333 */ Some("io_pgetevents"),
    /* 334 */ Some("rseq"),
];