[Audit] handle-lifecycle XELOGKERNEL probes (cvar-gated)

New cvar `audit_handle_lifecycle` (Auditing group, default false).
When enabled, emits one-line XELOGKERNEL traces tagged AUDIT-HLC at:
  NtCreateEvent return, NtSetEvent entry, KeSetEvent entry,
  NtWaitForSingleObjectEx entry + completion,
  EmulateCPInterruptDPC entry.

Observation-only: zero-overhead when cvar off (single branch + flag
read). Intended for handle disambiguation between xenia-rs and
canary under the Wine cross-build oracle.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
MechaCat02
2026-06-06 11:57:34 +02:00
parent ce67514572
commit fea4ef31ec
4 changed files with 38 additions and 2 deletions

View File

@@ -13,5 +13,6 @@
DECLARE_bool(headless);
DECLARE_bool(log_high_frequency_kernel_calls);
DECLARE_bool(audit_handle_lifecycle);
#endif // XENIA_KERNEL_KERNEL_FLAGS_H_