Module notify 

The listener pool: leader/followers over one seccomp listener descriptor.

The kernel hands a notification to the longest-waiting receiver, which on an idle host means a cold core. So exactly one thread (the leader) waits at a time, spinning on poll for a short while before sleeping. When it receives it releases the token and serves the request itself; whichever spinning follower grabs the token becomes the next leader. Idle threads park after spin_us.

Structs

Pool

The listener pool; see start.

Constants

FOLLOWER_SPIN_US 🔒

Longest a follower spins for the token before parking, in microseconds.

Functions

addfd

Installs fd into the tracee at the lowest free descriptor number, without answering the notification. Closes the supervisor’s copy.

addfd_at

Installs fd into the tracee at descriptor number newfd, closing what was there, without answering the notification.

recv 🔒

Blocking receive; None once no process uses the filter any more.

reply

Answers a notification with a plain result or an error.

reply_continue

Lets the kernel execute the syscall unchanged.

reply_fd

Installs fd into the tracee and completes the syscall with its number.

start

Starts the supervisor threads. They run until the listener closes.

still_valid

Checks that the tracee is still blocked in this notification.

thread_main 🔒

wait_ready 🔒

Spins on poll(0) for up to budget microseconds, then blocks until readable.