Lines Matching refs:tracer

13 process (tracer). Attachment and subsequent commands are per-thread: in
15 (potentially different) tracer, or left not attached and thus not
28 ptrace commands from the tracer is called ptrace-stop. Ptrace-stops can
37 all threads exit. Tracees report their death to the tracer(s). This is
38 not a ptrace-stop (because tracer can't query tracee status such as
44 tracee only), and only after it is injected by tracer (or after it was
49 generated for SIGKILL and therefore tracer can't suppress it. SIGKILL
61 When tracee executes exit syscall, it reports its death to its tracer.
65 group reports its death to its tracer.
74 Therefore, tracer must always be prepared to handle ESRCH error on any
93 When running tracee enters ptrace-stop, it notifies its tracer using
95 tracee to stop. Most of this document assumes that tracer waits with:
114 wait results available yet") even if tracer knows there should be a
137 is not yet delivered to the process, and can be suppressed by tracer.
138 If tracer doesn't suppress the signal, it passes signal to tracee in
144 Signal-delivery-stop is observed by tracer as waitpid returning with
154 After signal-delivery-stop is observed by tracer, tracer should restart
165 tracer can cause a different signal to be injected.
169 tracer would observe a new syscall-enter-stop for the same syscall,
171 tracer would observe a syscall-enter-stop for restart_syscall(2)
177 is that tracer observes group-stop, mistakes it for
194 suppressed by tracer.
208 tracee only), and only after it is injected by tracer (or after it was
211 tracee reports its group-stop separately to corresponding tracer.
213 Group-stop is observed by tracer as waitpid returning with
222 tracer sees something else, it can't be group-stop. Otherwise, tracer
227 As of kernel 2.6.38, after tracer sees tracee ptrace-stop and until it
229 notifications (except SIGKILL death) to tracer, even if tracer enters
233 signals: if tracer restarts tracee after group-stop, SIGSTOP is
234 effectively ignored: tracee doesn't remain stopped, it runs. If tracer
236 SIGCONT will not be reported to the tracer. Which would make SIGCONT to
242 If tracer sets TRACE_O_TRACEfoo options, tracee will enter ptrace-stops
245 PTRACE_EVENT stops are observed by tracer as waitpid returning with
282 syscall-enter-stop just prior to entering any syscall. If tracer
292 Syscall-enter-stop and syscall-exit-stop are observed by tracer as
294 SIGTRAP. If PTRACE_O_TRACESYSGOOD option was set by tracer, then
317 each other by tracer. Tracer needs to keep track of the sequence of
323 If after syscall-enter-stop tracer uses restarting command other than
340 When tracee is in ptrace-stop, tracer can read and write data to tracee
373 A thread can be attached to tracer using ptrace(PTRACE_ATTACH, pid, 0,
374 0) call. This also sends SIGSTOP to this thread. If tracer wants this
376 signals are concurrently sent to this thread during attach, tracer may
384 Since attaching sends SIGSTOP and tracer usually suppresses it, this
391 allow parent (which is our tracer now) to observe our
397 automatically attached to the same tracer which traced their parent.
406 If tracee is running when tracer wants to detach it, the usual solution
419 If tracer dies, all tracees are automatically detached and restarted,
443 If thread group leader has reported its death by this time, for tracer
445 group leader was still alive, for tracer this may look as if thread
449 tracer), during execve it will appear as if it has become a tracee of
450 the tracer of execve'ing tracee. All these effects are the artifacts of
459 When tracer receives PTRACE_EVENT_EXEC stop notification, it is
463 On receiving this notification, tracer should clean up all its internal
469 If tracer doesn't keep track of its tracees' thread group relations, it
494 Usually, tracer (for example, strace) would not want to show this extra
514 - exit/death by signal is reported first to tracer, then, when tracer
524 Group-stop notifications are sent to tracer, but not to real parent.
532 traced by this tracer, tracer will never know that execve happened.