libclues
Linux C++ Tracing Library
Loading...
Searching...
No Matches
EventConsumer.hxx
1#pragma once
2
3// cosmos
4#include <cosmos/BitMask.hxx>
5#include <cosmos/proc/process.hxx>
6#include <cosmos/string.hxx>
7
8// clues
9#include <clues/types.hxx>
10
11namespace clues {
12
13class Tracee;
14class SystemCall;
15
17
33 friend class Tracee;
34 friend class Engine;
35public: // types
36
38 enum class StatusFlag {
40 INTERRUPTED = 1 << 0,
42 RESUMED = 1 << 1,
46 ABI_CHANGED = 1 << 3,
48 CLONED_THREAD = 1 << 4,
49 };
50
51 using StatusFlags = cosmos::BitMask<StatusFlag>;
52
53protected: // functions
54
56
62 virtual void syscallEntry(Tracee &tracee, const SystemCall &sc, const StatusFlags flags) {
63 (void)tracee;
64 (void)sc;
65 (void)flags;
66 }
67
69
110 virtual void syscallExit(Tracee &tracee, const SystemCall &sc, const StatusFlags flags) {
111 (void)tracee;
112 (void)sc;
113 (void)flags;
114 }
115
117
135 virtual void attached(Tracee &tracee) {
136 (void)tracee;
137 }
138
140
144 virtual void signaled(Tracee &tracee, const cosmos::SigInfo &info) {
145 (void)tracee;
146 (void)info;
147 };
148
150 virtual void stopped(Tracee &tracee) {
151 (void)tracee;
152 }
153
155 virtual void resumed(Tracee &tracee) {
156 (void)tracee;
157 }
158
160
172 virtual void exited(Tracee &tracee, const cosmos::WaitStatus status, const StatusFlags flags) {
173 (void)tracee;
174 (void)status;
175 (void)flags;
176 }
177
179
196 virtual void disappeared(Tracee &tracee, const cosmos::ChildState &data) {
197 (void)tracee;
198 (void)data;
199 }
200
202
231 Tracee &tracee,
232 const std::string &old_executable,
233 const cosmos::StringVector &old_cmdline,
234 const std::optional<cosmos::ProcessID> old_pid) {
235 (void)tracee;
236 (void)old_cmdline;
237 (void)old_executable;
238 (void)old_pid;
239 }
240
242
260 virtual void newChildProcess(
261 Tracee &parent,
262 Tracee &child,
263 const cosmos::ptrace::Event event,
264 const StatusFlags flags) {
265 (void)parent;
266 (void)child;
267 (void)event;
268 (void)flags;
269 }
270
272
279 virtual void vforkComplete(Tracee &parent, TraceePtr child) {
280 (void)parent;
281 (void)child;
282 }
283};
284
285} // end ns
Callback interface for consumers of tracing events.
virtual void newExecutionContext(Tracee &tracee, const std::string &old_executable, const cosmos::StringVector &old_cmdline, const std::optional< cosmos::ProcessID > old_pid)
A new program is executed in the tracee.
virtual void syscallExit(Tracee &tracee, const SystemCall &sc, const StatusFlags flags)
A system call has been finished.
virtual void newChildProcess(Tracee &parent, Tracee &child, const cosmos::ptrace::Event event, const StatusFlags flags)
A new child process has been created.
virtual void signaled(Tracee &tracee, const cosmos::SigInfo &info)
The tracee has received a signal.
virtual void attached(Tracee &tracee)
The tracee is now properly attached to.
virtual void stopped(Tracee &tracee)
The tracee entered group-stop due to a stopping signal.
virtual void vforkComplete(Tracee &parent, TraceePtr child)
A vfork() in parent for child completed.
virtual void resumed(Tracee &tracee)
The tracee resumed due to SIGCONT.
virtual void exited(Tracee &tracee, const cosmos::WaitStatus status, const StatusFlags flags)
The tracee is about to end execution.
virtual void syscallEntry(Tracee &tracee, const SystemCall &sc, const StatusFlags flags)
A system call is about to be executed in the Tracee.
StatusFlag
Different status flags that can appear in callbacks.
@ ABI_CHANGED
The system call ABI changed since the last observed system call.
@ INTERRUPTED
A system call was interrupted (only appears during syscallExit()).
@ LOST_TO_MT_EXIT
An exit occurs because another thread called execve() or exit() (only appears in exited()).
@ RESUMED
A previously interrupted system call is resumed (only appears during syscallEntry()).
@ CLONED_THREAD
used in newChildProcess() to indicate that a new thread has been created.
virtual void disappeared(Tracee &tracee, const cosmos::ChildState &data)
The tracee disappeared for unclear reasons.
Access to System Call Data.
Base class for traced processes.
Definition Tracee.hxx:39