Fix fanotify_mark decoding on 32-bit architectures

The fanotify_mark syscall takes a 64-bit mask, and on 32-bit
architectures it is split up into two syscall arguments.

* configure.ac (AC_CHECK_FUNCS): Add fanotify_mark.
(AC_CHECK_HEADERS): Add sys/fanotify.h.
* defs.h (getllval): New prototype.
* util.c (getllval): New function based on printllval.
(printllval): Use getllval.
* fanotify.c (sys_fanotify_mark): Use getllval to properly decode
64-bit mask and two syscall arguments followed by it.
* tests/fanotify_mark.c: New file.
* tests/fanotify_mark.test: New test.
* tests/Makefile.am (check_PROGRAMS): Add fanotify_mark.
(TESTS): Add fanotify_mark.test.
* tests/.gitignore: Add fanotify_mark.
diff --git a/fanotify.c b/fanotify.c
index 32a3667..02094ea 100644
--- a/fanotify.c
+++ b/fanotify.c
@@ -31,6 +31,9 @@
 int
 sys_fanotify_mark(struct tcb *tcp)
 {
+	unsigned long long mask = 0;
+	int argn;
+
 	if (exiting(tcp))
 		return 0;
 
@@ -38,13 +41,18 @@
 	tprints(", ");
 	printflags(fan_mark_flags, (unsigned) tcp->u_arg[1], "FAN_MARK_???");
 	tprints(", ");
-	printflags(fan_event_flags, tcp->u_arg[2], "FAN_???");
+	/*
+	 * the mask argument is defined as 64-bit,
+	 * but kernel uses the lower 32 bits only.
+	 */
+	argn = getllval(tcp, &mask, 2);
+	printflags(fan_event_flags, mask, "FAN_???");
 	tprints(", ");
-	if ((int) tcp->u_arg[3] == FAN_NOFD)
+	if ((int) tcp->u_arg[argn] == FAN_NOFD)
 		tprints("FAN_NOFD, ");
 	else
-		print_dirfd(tcp, tcp->u_arg[3]);
-	printpath(tcp, tcp->u_arg[4]);
+		print_dirfd(tcp, tcp->u_arg[argn]);
+	printpath(tcp, tcp->u_arg[argn + 1]);
 
 	return 0;
 }