TermTracer.hxx

#pragma once
 
// C++
#include <map>
#include <memory>
#include <set>
#include <tuple>
 
// cosmos
#include <cosmos/BitMask.hxx>
#include <cosmos/io/StdLogger.hxx>
#include <cosmos/main.hxx>
#include <cosmos/types.hxx>
 
// clues
#include <clues/Engine.hxx>
#include <clues/EventConsumer.hxx>
#include <clues/SystemCall.hxx>
 
// termtracer
#include "Args.hxx"
 
namespace clues {
 
class TermTracer :
                public clues::EventConsumer,
                public cosmos::MainPlainArgs {
public: // functions
 
        TermTracer();
 
        TermTracer(const TermTracer&) = delete;
        TermTracer& operator=(const TermTracer&) = delete;
 
protected: // types

        enum class FollowExecContext {
                YES,
                NO,
                ASK,
                CHECK_PATH,
                CHECK_GLOB
        };
 
        enum class FollowChildMode {
                YES,
                NO,
                ASK,
                THREADS
        };
 
        enum class Flag {
                SEEN_INITIAL_EXEC      = 1 << 0, 
                DROPPED_TO_LAST_TRACEE = 1 << 1, 
        };
 
        using Flags = cosmos::BitMask<Flag>;
 
protected: // functions
 
        bool processPars();
 
        void printSyscalls();
 
        void printABISyscalls(const std::string &abi);
 
        void printABIs();
 
        cosmos::ExitStatus main(const int argc, const char **argv) override;
 
        bool configureTracee(const cosmos::ProcessID pid);
 
        void runTrace();
 
        void configureLogger();
 
        std::string formatTraceeInvocation(const Tracee &tracee);
        std::string formatTraceeInvocation(const std::string &exe, const cosmos::StringVector &cmdline) const;
        void printPar(std::ostream &trace, const SystemCallItem &value) const;
        void printParsOnEntry(std::ostream &trace, const SystemCall::ParameterVector &pars) const;
        void printParsOnExit(std::ostream &trace, const SystemCall::ParameterVector &pars) const;
 
        bool followExecutionContext(Tracee &tracee);

        std::ostream& traceStream(const Tracee &tracee, const bool new_line = true);


        void startNewLine(std::ostream &trace, const Tracee &tracee);


        bool storeUnfinishedSyscallCtx();


        void checkResumedSyscall(const Tracee &tracee);
 
        bool hasActiveSyscall(const Tracee &tracee) const {
                return hasActiveSyscall(tracee.pid());
        }
 
        bool hasActiveSyscall(const cosmos::ProcessID pid) const {
                return activeSyscall(pid) != nullptr;
        }
 
        const SystemCall* activeSyscall(const cosmos::ProcessID pid) const {
                if (!m_active_syscall)
                       return nullptr;
 
                const auto info = *m_active_syscall;
 
                if (std::get<cosmos::ProcessID>(info) != pid) {
                        return nullptr;
                }
 
                return std::get<const SystemCall*>(info);
        }
 
        const SystemCall* activeSyscall(const Tracee &tracee) const {
                return activeSyscall(tracee.pid());
        }
 
        const SystemCall* activeSyscall() const {
                if (!m_active_syscall)
                        return nullptr;
 
                return std::get<const SystemCall*>(*m_active_syscall);
        }


        const SystemCall* findSyscall(const Tracee &tracee) const;
 
        bool isExecSyscall(const SystemCall &sc) const;

        bool isEnabled(const SystemCall *sc) const;


        const SystemCall* currentSyscall(const Tracee &tracee) const;
 
        void cleanupTracee(const Tracee &tracee);

        void updateTracee(const Tracee &tracee, const cosmos::ProcessID old_pid);
 
        bool seenInitialExec() const {
                return m_flags[Flag::SEEN_INITIAL_EXEC];
        }


        void abortSyscall(const Tracee &tracee);

        void checkABI(const Tracee &tracee, const SystemCallInfo &info);
 
protected: // EventConsumer interface
 
        void syscallEntry(Tracee &tracee, const SystemCall &sc, const StatusFlags flags) override;
 
        void syscallExit(Tracee &tracee, const SystemCall &sc, const StatusFlags flags) override;
 
        void signaled(Tracee &tracee, const cosmos::SigInfo &info) override;
 
        void attached(Tracee &tracee) override;
 
        void exited(Tracee &tracee, const cosmos::WaitStatus status, const StatusFlags flags) override;
 
        void newExecutionContext(Tracee &tracee,
                        const std::string &old_exe,
                        const cosmos::StringVector &old_cmdline,
                        const std::optional<cosmos::ProcessID> old_pid) override;
 
        void newChildProcess(
                        Tracee &parent,
                        Tracee &child,
                        const cosmos::ptrace::Event event,
                        const StatusFlags flags) override;
 
        void stopped(Tracee &tracee) override;
 
        void disappeared(Tracee &tracee, const cosmos::ChildState &data) override;
 
protected: // data

        Args m_args;

        cosmos::StdLogger m_logger;
        cosmos::Init m_cosmos;

        Engine m_engine;

        bool m_print_pars = true;
        size_t m_par_truncation_len = 64;
        std::string m_exec_context_arg;
        std::set<SystemCallNr> m_syscall_filter;
        FollowExecContext m_follow_exec = FollowExecContext::YES;
        FollowChildMode m_follow_children = FollowChildMode::NO;

        size_t m_num_tracees = 0;
        Flags m_flags;
        cosmos::ProcessID m_main_tracee_pid;
        std::optional<cosmos::WaitStatus> m_main_status;


        std::optional<std::tuple<cosmos::ProcessID, const SystemCall*>> m_active_syscall;

        std::map<cosmos::ProcessID, const SystemCall*> m_unfinished_syscalls;

        std::map<cosmos::ProcessID, std::pair<cosmos::ProcessID, cosmos::ptrace::Event>> m_new_tracees;
        clues::ABI m_last_abi = clues::ABI::UNKNOWN;
 
};
 
} // end ns