seccomp-tools 1.6.2 → 1.7.0

data/lib/seccomp-tools/explain/summary.rb

@@ -0,0 +1,218 @@
+# frozen_string_literal: true
+
+require 'seccomp-tools/const'
+require 'seccomp-tools/explain/analysis'
+require 'seccomp-tools/explain/qword'
+require 'seccomp-tools/explain/renderer'
+require 'seccomp-tools/explain/verdict'
+require 'seccomp-tools/util'
+
+module SeccompTools
+  class Explain
+    # Turns the raw {Symbolic::Executor::Leaf}s collected by the walk into a human-readable policy,
+    # grouped by architecture and then by action (+ALLOW+, +KILL+, +ERRNO(n)+, ...).
+    #
+    # This class owns the presentation: sections, buckets and the default rule. It reads each
+    # leaf's path through {PathFacts}, decodes the returned action with {Verdict}, reassembles
+    # 64-bit word checks with {QwordFusion}, and stringifies conditions with {Renderer}.
+    class Summary
+      # Display name of the syscall-number field, for the range subjects.
+      SYS_NAME = Const::BPF::SeccompData::NAMES.fetch(Const::BPF::SeccompData::SYS_NUMBER)
+      # The x32 ABI bit (+__X32_SYSCALL_BIT+); a lower-bound-only range at exactly this value is the
+      # conventional x32 guard, worth annotating.
+      X32_SYSCALL_BIT = 0x40000000
+      # Widest a wrapped bucket line may get, in columns.
+      WRAP_WIDTH = 72
+
+      # @param [Array<Symbolic::Executor::Leaf>] leaves
+      # @param [Symbol] arch
+      #   The filter's declared architecture, used when the filter itself does not branch on +arch+.
+      # @param [String?] source
+      #   Label shown in the header.
+      # @param [Boolean] truncated
+      #   Whether the walk hit {Symbolic::Executor::STEP_CAP}.
+      def initialize(leaves, arch:, source: nil, truncated: false)
+        @arch = arch
+        @source = source
+        @truncated = truncated
+        @fusion = QwordFusion.new(arch)
+        @renderer = Renderer.new(@fusion)
+        @analysis = Analysis.new(leaves)
+      end
+
+      # Renders the policy.
+      # @return [String]
+      def to_s
+        out = +''
+        out << "Seccomp policy for #{@source}\n" if @source
+        out << "WARNING: analysis truncated (filter too large); results may be incomplete.\n" if @truncated
+        @analysis.sections(@arch).each do |_arch_val, arch_sym, title, leaves|
+          out << "\n" << render_section(title, section_buckets(arch_sym, leaves))
+        end
+        out << render_other_arches
+        out
+      end
+
+      private
+
+      # The {PathFacts} of +leaf+, computed once (shared with {Analysis}).
+      def facts(leaf)
+        @analysis.facts(leaf)
+      end
+
+      # Renders what happens on the architectures the filter does not explicitly check for. Usually
+      # those paths just fall to one action and a one-liner suffices; when they carry rules of their
+      # own, a full section is rendered so the rules are not silently dropped.
+      def render_other_arches
+        return '' if @analysis.arch_values.empty?
+
+        leaves = @analysis.other_leaves
+        default = @analysis.default_label(leaves)
+        return '' unless default
+
+        buckets = rule_buckets(nil, leaves, default)
+        return "\nOther architectures: #{default}\n" if buckets.empty?
+
+        add_default(buckets, default)
+        "\n#{render_section('<any other>', buckets)}"
+      end
+
+      # The action buckets of one section: its non-default rules plus the default rule. +arch_sym+
+      # names syscalls/arguments; +nil+ (architecture unknown) leaves them numeric.
+      def section_buckets(arch_sym, leaves)
+        default = @analysis.default_label(leaves)
+        buckets = rule_buckets(arch_sym, leaves, default)
+        add_default(buckets, default)
+        buckets
+      end
+
+      # Renders one architecture section from its prebuilt +buckets+.
+      def render_section(title, buckets)
+        out = "Architecture: #{Util.colorize(title, t: :arch)}\n"
+        return out << "\n  (no return reached; filter runs off the end)\n" if buckets.empty?
+
+        sorted_buckets(buckets).each { |label, b| out << render_bucket(label, b) }
+        out
+      end
+
+      # Buckets the non-default rules of a section by action label. Every leaf falls into exactly
+      # one bucket source: it pins a syscall number, restricts a range of numbers, checks arguments
+      # only, or is the catch-all (rendered by {#add_default}).
+      def rule_buckets(arch_sym, leaves, default)
+        named, rest = leaves.partition { |l| facts(l).sys_eq }
+        ranged, rest = rest.partition { |l| facts(l).sys_range }
+        conditional, = rest.partition { |l| !facts(l).residual.empty? }
+
+        buckets = {}
+        add_named(buckets, arch_sym, named, default)
+        add_ranges(buckets, ranged)
+        add_conditional(buckets, conditional, default)
+        buckets
+      end
+
+      # Explicitly matched syscalls (+A == nr+), grouped by number then verdict.
+      def add_named(buckets, arch_sym, leaves, default)
+        leaves.group_by { |l| facts(l).sys_eq }.sort_by(&:first).each do |nr, group|
+          sys = syscall_name(arch_sym, nr)
+          name = Util.colorize(sys ? sys.to_s : "0x#{nr.to_s(16)}", t: :syscall)
+          group.group_by { |l| Verdict.label(l.ret) }.each do |label, ls|
+            next if label == default # falls through to the default action
+
+            conds = merged_conds(ls, sys)
+            plain = conds.include?('') # some path reaches this verdict with no extra condition
+            entry = plain ? name : "#{name} when #{conds.join(' or ')}"
+            add(buckets, label, entry, simple: plain)
+          end
+        end
+      end
+
+      # Fall-through rules that restrict a range of syscall numbers, e.g. the x32 ABI guard,
+      # together with whatever else those paths check. A range whose action is the default is still
+      # shown when unconditional (the explicit guard is worth surfacing), and its conditional
+      # variants are shown too so no check is silently dropped.
+      def add_ranges(buckets, leaves)
+        leaves.group_by { |l| facts(l).sys_range }.each do |(lo, hi), group|
+          range = "#{SYS_NAME} >= 0x#{lo.to_s(16)}"
+          range << " && #{SYS_NAME} <= 0x#{hi.to_s(16)}" if hi
+          group.group_by { |l| Verdict.label(l.ret) }.each do |label, ls|
+            conds = merged_conds(ls, nil)
+            entry = conds.include?('') ? range.dup : "#{range} when #{conds.join(' or ')}"
+            entry << '  (x32 ABI)' if x32?(lo, hi)
+            add(buckets, label, entry, simple: false)
+          end
+        end
+      end
+
+      # Fall-through rules that inspect arguments (or a transformed syscall number) without pinning a
+      # specific syscall. Kept so such checks are never silently dropped.
+      def add_conditional(buckets, leaves, default)
+        leaves.group_by { |l| Verdict.label(l.ret) }.each do |label, ls|
+          next if label == default
+
+          conds = merged_conds(ls, nil)
+          add(buckets, label, "any syscall when #{conds.join(' or ')}", simple: false)
+        end
+      end
+
+      # The rendered or-branch conditions of the leaves +ls+, deduplicated, with 64-bit word checks
+      # fused back into whole-field facts (see {QwordFusion}).
+      def merged_conds(ls, sys)
+        @fusion.merge_or(ls.map { |l| facts(l).residual })
+               .map { |list| @renderer.conjunction(@fusion.fold(list), sys) }.uniq
+      end
+
+      def add_default(buckets, default)
+        return unless default
+
+        # "other" only makes sense when some syscall was singled out; otherwise the default is the
+        # whole policy.
+        text = buckets.empty? ? '<default> (any syscall)' : '<default> (any other syscall)'
+        add(buckets, default, text, simple: false)
+      end
+
+      def add(buckets, label, text, simple:)
+        b = buckets[label] ||= { simple: [], complex: [] }
+        (simple ? b[:simple] : b[:complex]) << text
+      end
+
+      def sorted_buckets(buckets)
+        buckets.sort_by { |label, _b| Verdict.rank(label) }
+      end
+
+      def render_bucket(label, bucket)
+        out = "\n  #{label}:\n"
+        wrap(bucket[:simple]).each { |line| out << "    #{line}\n" }
+        bucket[:complex].each { |line| out << "    #{line}\n" }
+        out
+      end
+
+      # Wraps a list of short tokens into comma-separated lines no wider than 72 columns.
+      def wrap(tokens)
+        return [] if tokens.empty?
+
+        lines = []
+        line = +''
+        tokens.each do |tok|
+          piece = line.empty? ? tok : ", #{tok}"
+          if !line.empty? && line.size + piece.size > WRAP_WIDTH
+            lines << line
+            line = +tok
+          else
+            line << piece
+          end
+        end
+        lines << line
+      end
+
+      def x32?(lo, hi)
+        lo == X32_SYSCALL_BIT && hi.nil?
+      end
+
+      def syscall_name(arch_sym, nr)
+        arch_sym && Const::Syscall.const_get(arch_sym.upcase).invert[nr]
+      rescue NameError
+        nil
+      end
+    end
+  end
+end

data/lib/seccomp-tools/explain/verdict.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require 'seccomp-tools/const'
+
+module SeccompTools
+  class Explain
+    # Decodes the value a filter path returns into the action it stands for: the label a policy
+    # shows (+ALLOW+, +ERRNO(5)+, ...) and where that action sorts among the buckets.
+    module Verdict
+      # Buckets are printed in this order; unlisted actions sort last.
+      ORDER = %i[ALLOW USER_NOTIF LOG TRACE TRAP ERRNO KILL KILL_PROCESS UNKNOWN].freeze
+
+      module_function
+
+      # The label for the value +ret+ a leaf returns, including the +SECCOMP_RET_DATA+ part when
+      # it is meaningful for the action.
+      # @param [Symbolic::Expr] ret
+      # @return [String]
+      def label(ret)
+        return 'UNKNOWN' unless ret.imm?
+
+        # An unrecognized action value loads fine; the kernel treats it as KILL_PROCESS
+        # (KILL_THREAD before Linux 4.14). See seccomp(2).
+        Const::BPF.action_label(ret.val) || format('KILL_PROCESS (unknown action 0x%x)', ret.val)
+      end
+
+      # Where the bucket labeled +label+ sorts: by its action's position in {ORDER}, then
+      # alphabetically. Works on any label {.label} produces, data and annotations included.
+      # @param [String] label
+      # @return [Array(Integer, String)]
+      def rank(label)
+        [ORDER.index(action_of(label)) || ORDER.size, label]
+      end
+
+      # The bare action symbol of a label, recovered by stripping any +(data)+ / + (annotation)+
+      # suffix {.label} appended. Safe because no action name itself contains +" ("+.
+      # @param [String] label
+      # @return [Symbol]
+      def action_of(label)
+        label.sub(/\s*\(.*/, '').to_sym
+      end
+    end
+  end
+end

data/lib/seccomp-tools/explain.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require 'seccomp-tools/explain/summary'
+require 'seccomp-tools/symbolic/executor'
+
+module SeccompTools
+  # Analyzes a whole seccomp filter across all execution paths and summarizes it as a per-action
+  # policy: which syscalls end in +ALLOW+, +KILL+, +ERRNO(n)+, etc., and under what argument
+  # constraints.
+  #
+  # It runs the generic {Symbolic::Executor} over the filter to collect every reachable +return+
+  # together with the path condition that leads to it, then hands those leaves to {Summary}, which
+  # interprets them with seccomp semantics (syscall numbers, architectures, actions, ...).
+  #
+  # @example
+  #   insts = SeccompTools::Disasm.to_bpf(raw, :amd64).map(&:inst)
+  #   puts SeccompTools::Explain.new(insts, arch: :amd64).summarize
+  class Explain
+    # @param [Array<Instruction::Base>] instructions
+    #   The filter, as +SeccompTools::Disasm.to_bpf(raw, arch).map(&:inst)+.
+    # @param [Symbol] arch
+    #   The architecture the filter is written for, used for syscall/argument names.
+    # @param [String?] source
+    #   A label for the filter (e.g. a filename) shown in the summary header.
+    def initialize(instructions, arch:, source: nil)
+      @instructions = instructions
+      @arch = arch
+      @source = source
+    end
+
+    # Walks the filter and returns a printable {Summary}.
+    # @return [Summary]
+    def summarize
+      leaves, truncated = Symbolic::Executor.new(@instructions).run
+      Summary.new(leaves, arch: @arch, source: @source, truncated:)
+    end
+  end
+end

data/lib/seccomp-tools/instruction/alu.rb

@@ -4,7 +4,9 @@ require 'seccomp-tools/instruction/base'
 
 module SeccompTools
   module Instruction
-    # Instruction alu.
+    # Instruction alu, performs an arithmetic or bitwise operation on the accumulator register A.
+    #
+    # The right operand is either the X register or the immediate +k+.
     class ALU < Base
       # Mapping from name to operator.
       OP_SYM = {
@@ -17,10 +19,12 @@ module SeccompTools
         lsh: :<<,
         rsh: :>>,
         # neg: :-, # should not be invoked
-        # mod: :%, # unsupported
+        # mod: :%, # the kernel rejects BPF_MOD (see Const::BPF::OP), so it never reaches here
         xor: :^
       }.freeze
       # Decompile instruction.
+      # @return [String]
+      #   The operation as assembly, e.g. +"A &= 0x7fff"+.
       def decompile
         return 'A = -A' if op == :neg
 
@@ -29,6 +33,8 @@ module SeccompTools
 
       # See {Instruction::Base#symbolize}.
       # @return [[:alu, Symbol, (:x, Integer, nil)]]
+      #   The operator and its right operand, which is +:x+ for the X register, an Integer for an
+      #   immediate, or +nil+ for the unary +neg+.
       def symbolize
         return [:alu, :neg, nil] if op == :neg
 
@@ -36,13 +42,12 @@ module SeccompTools
       end
 
       # See {Base#branch}.
-      # @param [Context] context
-      #   Current context.
-      # @return [Array<(Integer, Context)>]
-      def branch(context)
-        ctx = context.dup
-        ctx[:a] = Disasm::Context::Value.new
-        [[line + 1, ctx]]
+      # @param [Symbolic::State] state
+      #   Current state.
+      # @return [Array<(Integer, Symbolic::State)>]
+      #   Always the next line, with A marked as no longer tracked.
+      def branch(state)
+        [[line + 1, state.with(a: Symbolic::Expr.opaque)]]
       end
 
       private

data/lib/seccomp-tools/instruction/base.rb

@@ -3,9 +3,15 @@
 require 'seccomp-tools/const'
 
 module SeccompTools
-  # For instructions' class.
+  # Classes of BPF instructions, one per opcode class.
+  #
+  # Each instruction wraps a {SeccompTools::BPF} and knows how to render itself as assembly
+  # (+decompile+), as tokens ({Base#symbolize}), and how it moves the disassembler's state
+  # forward ({Base#branch}).
   module Instruction
     # Base class of instructions.
+    #
+    # Subclasses must implement {#branch} and {#symbolize}.
     class Base
       include SeccompTools::Const::BPF
 
@@ -25,29 +31,52 @@ module SeccompTools
       end
 
       # Returns the possible branches after executing this instruction.
-      # @param [Context] _context
-      #   Current context.
-      # @return [Array<(Integer, Context)>]
+      #
+      # Each branch is the line number to be executed next, paired with the {Symbolic::State} that
+      # reaching that line implies. Non-jump instructions have exactly one branch, the following
+      # line.
+      # @param [Symbolic::State] _state
+      #   Current state.
+      # @return [Array<(Integer, Symbolic::State)>]
+      #   Pairs of the next line number and the state at that line.
+      # @raise [NotImplementedError]
+      #   Always, subclasses must override this method.
       # @example
       #   # For ALU, LD, LDX, ST, STX
       #   inst.line #=> 10
-      #   inst.branch(ctx)
-      #   #=> [[11, ctx]]
-      def branch(_context); raise NotImplmentedError
+      #   inst.branch(state)
+      #   #=> [[11, state]]
+      def branch(_state); raise NotImplementedError
       end
 
-      # Return tokens stand for this instruction.
+      # Returns tokens that represent this instruction.
       # @return [Array<Symbol, Integer>]
+      #   The instruction as a tuple, the exact shape depends on the instruction class.
+      # @raise [NotImplementedError]
+      #   Always, subclasses must override this method.
       # @example
       #   ret_a.symbolize #=> [:ret, :a]
       #   ret_k.symbolize #=> [:ret, 0x7fff0000]
       #   jeq.symbolize #=> [:cmp, :==, 0, 0, 1]
-      def symbolize; raise NotImplmentedError
+      def symbolize; raise NotImplementedError
       end
 
       private
 
-      %i(code jt jf k arch line contexts show_arg_infer?).each do |sym|
+      # The architecture this instruction's operands should be read as: the one the filter has
+      # branched on (+arch == AUDIT_ARCH_*+) when the reaching states pin a single value, else +nil+
+      # so callers fall back to the declared {#arch}. Lets syscall/argument names stay correct even
+      # when the filter is disassembled under a different +--arch+ than it targets.
+      # @return [Symbol?]
+      def infer_arch
+        arches = states.map { |st| st.pinned(Const::BPF::SeccompData::ARCH) }.uniq
+        return nil unless arches.size == 1 && !arches.first.nil?
+
+        Const::Audit.arch_symbol(arches.first)
+      end
+
+      # Delegate the accessors of the wrapped {SeccompTools::BPF} so subclasses can use them directly.
+      %i(code jt jf k arch line states show_arg_infer?).each do |sym|
         define_method(sym) do
           @bpf.__send__(sym)
         end

data/lib/seccomp-tools/instruction/jmp.rb

@@ -5,9 +5,13 @@ require 'seccomp-tools/instruction/base'
 
 module SeccompTools
   module Instruction
-    # Instruction jmp.
+    # Instruction jmp, an unconditional jump or a comparison of A against X or an immediate.
+    #
+    # Jumps are always forward, +jt+ and +jf+ being offsets relative to the following line.
     class JMP < Base
       # Decompile instruction.
+      # @return [String]
+      #   The jump as assembly, e.g. +"if (A == read) goto 0003"+.
       def decompile
         return goto(k) if jop == :none
         # if jt == 0 && jf == 0 => no-op # should not happen
@@ -23,6 +27,8 @@ module SeccompTools
 
       # See {Instruction::Base#symbolize}.
       # @return [[:cmp, Symbol, (:x, Integer), Integer, Integer], [:jmp, Integer]]
+      #   +[:jmp, offset]+ for an unconditional jump, otherwise +[:cmp, operator, right operand,
+      #   jt, jf]+.
       def symbolize
         return [:jmp, k] if jop == :none
 
@@ -30,19 +36,49 @@ module SeccompTools
       end
 
       # See {Base#branch}.
-      # @param [Context] context
-      #   Current context.
-      # @return [Array<(Integer, Context)>]
-      def branch(context)
-        return [[at(k), context]] if jop == :none
-        return [[at(jt), context]] if jt == jf
-        return [[at(jt), context.dup.eql!(src)], [at(jf), context]] if jop == :==
-
-        [[at(jt), context], [at(jf), context]]
+      #
+      # Unlike the other instructions, a conditional jump has two possible successors. On the
+      # taken branch of an equality test the state is narrowed, recording that A is known to equal
+      # the compared value.
+      # @param [Symbolic::State] state
+      #   Current state.
+      # @return [Array<(Integer, Symbolic::State)>]
+      #   One pair for an unconditional jump, two otherwise.
+      # @example
+      #   # 0000: if (A == 0) goto 0002 else goto 0003
+      #   jeq.branch(state) #=> [[2, narrowed_state], [3, state]]
+      def branch(state)
+        return [[at(k), state]] if jop == :none
+        return [[at(jt), state]] if jt == jf
+        return [[at(jt), narrow(state)], [at(jf), state]] if jop == :==
+
+        [[at(jt), state], [at(jf), state]]
       end
 
       private
 
+      # The taken branch of +A == src+ learns +A == value+. When A holds a plain data word and the
+      # compared side is (or resolves to) a constant, that pins the word - recorded as a
+      # {Symbolic::Constraint} on the path. Anything else leaves the state unchanged.
+      # @param [Symbolic::State] state
+      # @return [Symbolic::State]
+      def narrow(state)
+        return state unless state.a.plain_data?
+
+        rhs = src == :x ? resolve(state, state.x) : Symbolic::Expr.imm(k)
+        return state unless rhs.imm?
+
+        state.with(path: state.path + [Symbolic::Constraint.new(state.a, :==, rhs)])
+      end
+
+      # Replaces a data-word +expr+ with the constant it is pinned to on +state+'s path, if any;
+      # otherwise returns it unchanged.
+      def resolve(state, expr)
+        return expr unless expr.plain_data?
+
+        state.path.find { |c| c.plain_data_eq?(expr.offset) }&.rhs || expr
+      end
+
       def jop
         case Const::BPF::JMP.invert[code & 0x70]
         when :ja then :none
@@ -57,15 +93,15 @@ module SeccompTools
       def src_str
         return 'X' if src == :x
 
-        # if A in all contexts are same
-        a = contexts.map(&:a).uniq
+        # only when A holds the same data word across every reaching state
+        a = states.map(&:a).uniq
         return k.to_s if a.size != 1
 
         a = a[0]
-        return k.to_s unless a.data?
+        return k.to_s unless a.plain_data?
 
         hex = "0x#{k.to_s(16)}"
-        case a.val
+        case a.offset
           # interpret as syscalls only if it's an equality test
         when 0 then Util.colorize(jop == :== ? sysname_by_k || hex : hex, t: :syscall)
         when 4 then Util.colorize(Const::Audit::ARCH.invert[k] || hex, t: :arch)
@@ -81,15 +117,6 @@ module SeccompTools
         a == arch ? name : "#{a}.#{name}"
       end
 
-      # Infers the architecture from context.
-      # @return [Symbol?]
-      def infer_arch
-        arches = contexts.map { |ctx| ctx.known_data[4] }.uniq
-        return nil unless arches.size == 1 && !arches.first.nil?
-
-        Const::Audit::ARCH_NAME.invert[Const::Audit::ARCH.invert[arches.first]]
-      end
-
       def src
         SRC.invert[code & 8] == :x ? :x : k
       end

data/lib/seccomp-tools/instruction/ld.rb

@@ -6,9 +6,14 @@ require 'seccomp-tools/util'
 
 module SeccompTools
   module Instruction
-    # Instruction ld.
+    # Instruction ld, loads a value into the accumulator register A.
+    #
+    # The value can be an immediate, a word of +struct seccomp_data+, or a slot of the scratch
+    # memory. {LDX} inherits from this class and targets the X register instead.
     class LD < Base
       # Decompile instruction.
+      # @return [String]
+      #   The assignment as assembly, e.g. +"A = sys_number"+.
       def decompile
         ret = "#{reg} = "
         _, _reg, type = symbolize
@@ -18,26 +23,35 @@ module SeccompTools
         ret + seccomp_data_str
       end
 
-      # @return [void]
+      # See {Instruction::Base#symbolize}.
+      # @return [[:ld, Symbol, {rel: Symbol, val: Integer}]]
+      #   The target register and the value being loaded, whose +:rel+ is one of +:immi+, +:mem+
+      #   or +:data+.
       def symbolize
         type = load_val
         [:ld, reg.downcase.to_sym, type]
       end
 
-      # Accumulator register.
-      # @return ['A']
+      # Name of the register being loaded into.
+      # @return [String]
+      #   The accumulator register, +"A"+.
       def reg
         'A'
       end
 
       # See {Base#branch}.
-      # @param [Context] context
-      #   Current context.
-      # @return [Array<(Integer, Context)>]
-      def branch(context)
-        ctx = context.dup
-        ctx.load(reg, **load_val)
-        [[line + 1, ctx]]
+      # @param [Symbolic::State] state
+      #   Current state.
+      # @return [Array<(Integer, Symbolic::State)>]
+      #   Always the next line, with the loaded value recorded in the register.
+      def branch(state)
+        v = load_val
+        val = case v[:rel]
+              when :immi then Symbolic::Expr.imm(v[:val])
+              when :mem then state.mem[v[:val]]
+              when :data then Symbolic::Expr.data(v[:val])
+              end
+        [[line + 1, reg == 'X' ? state.with(x: val) : state.with(a: val)]]
       end
 
       private
@@ -64,33 +78,44 @@ module SeccompTools
       #   __u64 args[6];
       # };
       def seccomp_data_str
+        data = Const::BPF::SeccompData
         case k
-        when 0 then 'sys_number'
-        when 4 then 'arch'
-        when 8 then 'instruction_pointer'
-        when 12 then 'instruction_pointer >> 32'
+        when data::SYS_NUMBER, data::ARCH then data::NAMES[k]
+        when data::INSTRUCTION_POINTER, data::INSTRUCTION_POINTER + 4
+          ip = data::NAMES[data::INSTRUCTION_POINTER]
+          hi_word?(k) ? "#{ip} >> 32" : ip
         else
-          idx = Array.new(12) { |i| (i * 4) + 16 }.index(k)
+          idx = (data::ARGS...data::SIZE).step(4).to_a.index(k)
           return 'INVALID' if idx.nil?
 
           args_name(idx)
         end
       end
 
+      # Is the 32-bit word at byte offset +k+ the high half of its 64-bit +seccomp_data+ field?
+      # The high word comes second on little-endian architectures but first on big-endian ones
+      # (s390x); see +arch_arg_offset_hi+ in libseccomp.
+      def hi_word?(k)
+        (k % 8 == 4) ^ Const::Endian.big?(arch)
+      end
+
       def args_name(idx)
-        default = idx.even? ? "args[#{idx / 2}]" : "args[#{idx / 2}] >> 32"
+        hi = hi_word?((idx * 4) + Const::BPF::SeccompData::ARGS)
+        default = hi ? "args[#{idx / 2}] >> 32" : "args[#{idx / 2}]"
         return default unless show_arg_infer?
 
-        sys_nrs = contexts.map { |ctx| ctx.known_data[0] }.uniq
+        sys_nrs = states.map { |st| st.pinned(Const::BPF::SeccompData::SYS_NUMBER) }.uniq
         return default if sys_nrs.size != 1 || sys_nrs.first.nil?
 
-        sys = Const::Syscall.const_get(arch.upcase.to_sym).invert[sys_nrs.first]
+        a = infer_arch || arch
+        sys = Const::Syscall.const_get(a.upcase.to_sym).invert[sys_nrs.first]
         args = Const::SYS_ARG[sys]
         return default if args.nil? || args[idx / 2].nil? # function prototype doesn't have that argument
 
-        comment = "# #{sys}(#{args.join(', ')})"
+        name = a == arch ? sys : "#{a}.#{sys}"
+        comment = "# #{name}(#{args.join(', ')})"
         arg_name = Util.colorize(args[idx / 2], t: :args)
-        "#{idx.even? ? arg_name : "#{arg_name} >> 32"} #{Util.colorize(comment, t: :gray)}"
+        "#{hi ? "#{arg_name} >> 32" : arg_name} #{Util.colorize(comment, t: :gray)}"
       end
     end
   end