lttng-filter.c

   1 /*
   2  * lttng-filter.c
   3  *
   4  * LTTng modules filter code.
   5  *
   6  * Copyright (C) 2010-2016 Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
   7  *
   8  * Permission is hereby granted, free of charge, to any person obtaining a copy
   9  * of this software and associated documentation files (the "Software"), to deal
  10  * in the Software without restriction, including without limitation the rights
  11  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  12  * copies of the Software, and to permit persons to whom the Software is
  13  * furnished to do so, subject to the following conditions:
  14  *
  15  * The above copyright notice and this permission notice shall be included in
  16  * all copies or substantial portions of the Software.
  17  *
  18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  20  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  21  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  22  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  23  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  24  * SOFTWARE.
  25  */
  26
  27 #include <linux/list.h>
  28 #include <linux/slab.h>
  29
  30 #include <lttng-filter.h>
  31
  32 static const char *opnames[] = {
  33         [ FILTER_OP_UNKNOWN ] = "UNKNOWN",
  34
  35         [ FILTER_OP_RETURN ] = "RETURN",
  36
  37         /* binary */
  38         [ FILTER_OP_MUL ] = "MUL",
  39         [ FILTER_OP_DIV ] = "DIV",
  40         [ FILTER_OP_MOD ] = "MOD",
  41         [ FILTER_OP_PLUS ] = "PLUS",
  42         [ FILTER_OP_MINUS ] = "MINUS",
  43         [ FILTER_OP_RSHIFT ] = "RSHIFT",
  44         [ FILTER_OP_LSHIFT ] = "LSHIFT",
  45         [ FILTER_OP_BIN_AND ] = "BIN_AND",
  46         [ FILTER_OP_BIN_OR ] = "BIN_OR",
  47         [ FILTER_OP_BIN_XOR ] = "BIN_XOR",
  48
  49         /* binary comparators */
  50         [ FILTER_OP_EQ ] = "EQ",
  51         [ FILTER_OP_NE ] = "NE",
  52         [ FILTER_OP_GT ] = "GT",
  53         [ FILTER_OP_LT ] = "LT",
  54         [ FILTER_OP_GE ] = "GE",
  55         [ FILTER_OP_LE ] = "LE",
  56
  57         /* string binary comparators */
  58         [ FILTER_OP_EQ_STRING ] = "EQ_STRING",
  59         [ FILTER_OP_NE_STRING ] = "NE_STRING",
  60         [ FILTER_OP_GT_STRING ] = "GT_STRING",
  61         [ FILTER_OP_LT_STRING ] = "LT_STRING",
  62         [ FILTER_OP_GE_STRING ] = "GE_STRING",
  63         [ FILTER_OP_LE_STRING ] = "LE_STRING",
  64
  65         /* s64 binary comparators */
  66         [ FILTER_OP_EQ_S64 ] = "EQ_S64",
  67         [ FILTER_OP_NE_S64 ] = "NE_S64",
  68         [ FILTER_OP_GT_S64 ] = "GT_S64",
  69         [ FILTER_OP_LT_S64 ] = "LT_S64",
  70         [ FILTER_OP_GE_S64 ] = "GE_S64",
  71         [ FILTER_OP_LE_S64 ] = "LE_S64",
  72
  73         /* double binary comparators */
  74         [ FILTER_OP_EQ_DOUBLE ] = "EQ_DOUBLE",
  75         [ FILTER_OP_NE_DOUBLE ] = "NE_DOUBLE",
  76         [ FILTER_OP_GT_DOUBLE ] = "GT_DOUBLE",
  77         [ FILTER_OP_LT_DOUBLE ] = "LT_DOUBLE",
  78         [ FILTER_OP_GE_DOUBLE ] = "GE_DOUBLE",
  79         [ FILTER_OP_LE_DOUBLE ] = "LE_DOUBLE",
  80
  81         /* Mixed S64-double binary comparators */
  82         [ FILTER_OP_EQ_DOUBLE_S64 ] = "EQ_DOUBLE_S64",
  83         [ FILTER_OP_NE_DOUBLE_S64 ] = "NE_DOUBLE_S64",
  84         [ FILTER_OP_GT_DOUBLE_S64 ] = "GT_DOUBLE_S64",
  85         [ FILTER_OP_LT_DOUBLE_S64 ] = "LT_DOUBLE_S64",
  86         [ FILTER_OP_GE_DOUBLE_S64 ] = "GE_DOUBLE_S64",
  87         [ FILTER_OP_LE_DOUBLE_S64 ] = "LE_DOUBLE_S64",
  88
  89         [ FILTER_OP_EQ_S64_DOUBLE ] = "EQ_S64_DOUBLE",
  90         [ FILTER_OP_NE_S64_DOUBLE ] = "NE_S64_DOUBLE",
  91         [ FILTER_OP_GT_S64_DOUBLE ] = "GT_S64_DOUBLE",
  92         [ FILTER_OP_LT_S64_DOUBLE ] = "LT_S64_DOUBLE",
  93         [ FILTER_OP_GE_S64_DOUBLE ] = "GE_S64_DOUBLE",
  94         [ FILTER_OP_LE_S64_DOUBLE ] = "LE_S64_DOUBLE",
  95
  96         /* unary */
  97         [ FILTER_OP_UNARY_PLUS ] = "UNARY_PLUS",
  98         [ FILTER_OP_UNARY_MINUS ] = "UNARY_MINUS",
  99         [ FILTER_OP_UNARY_NOT ] = "UNARY_NOT",
 100         [ FILTER_OP_UNARY_PLUS_S64 ] = "UNARY_PLUS_S64",
 101         [ FILTER_OP_UNARY_MINUS_S64 ] = "UNARY_MINUS_S64",
 102         [ FILTER_OP_UNARY_NOT_S64 ] = "UNARY_NOT_S64",
 103         [ FILTER_OP_UNARY_PLUS_DOUBLE ] = "UNARY_PLUS_DOUBLE",
 104         [ FILTER_OP_UNARY_MINUS_DOUBLE ] = "UNARY_MINUS_DOUBLE",
 105         [ FILTER_OP_UNARY_NOT_DOUBLE ] = "UNARY_NOT_DOUBLE",
 106
 107         /* logical */
 108         [ FILTER_OP_AND ] = "AND",
 109         [ FILTER_OP_OR ] = "OR",
 110
 111         /* load field ref */
 112         [ FILTER_OP_LOAD_FIELD_REF ] = "LOAD_FIELD_REF",
 113         [ FILTER_OP_LOAD_FIELD_REF_STRING ] = "LOAD_FIELD_REF_STRING",
 114         [ FILTER_OP_LOAD_FIELD_REF_SEQUENCE ] = "LOAD_FIELD_REF_SEQUENCE",
 115         [ FILTER_OP_LOAD_FIELD_REF_S64 ] = "LOAD_FIELD_REF_S64",
 116         [ FILTER_OP_LOAD_FIELD_REF_DOUBLE ] = "LOAD_FIELD_REF_DOUBLE",
 117
 118         /* load from immediate operand */
 119         [ FILTER_OP_LOAD_STRING ] = "LOAD_STRING",
 120         [ FILTER_OP_LOAD_S64 ] = "LOAD_S64",
 121         [ FILTER_OP_LOAD_DOUBLE ] = "LOAD_DOUBLE",
 122
 123         /* cast */
 124         [ FILTER_OP_CAST_TO_S64 ] = "CAST_TO_S64",
 125         [ FILTER_OP_CAST_DOUBLE_TO_S64 ] = "CAST_DOUBLE_TO_S64",
 126         [ FILTER_OP_CAST_NOP ] = "CAST_NOP",
 127
 128         /* get context ref */
 129         [ FILTER_OP_GET_CONTEXT_REF ] = "GET_CONTEXT_REF",
 130         [ FILTER_OP_GET_CONTEXT_REF_STRING ] = "GET_CONTEXT_REF_STRING",
 131         [ FILTER_OP_GET_CONTEXT_REF_S64 ] = "GET_CONTEXT_REF_S64",
 132         [ FILTER_OP_GET_CONTEXT_REF_DOUBLE ] = "GET_CONTEXT_REF_DOUBLE",
 133
 134         /* load userspace field ref */
 135         [ FILTER_OP_LOAD_FIELD_REF_USER_STRING ] = "LOAD_FIELD_REF_USER_STRING",
 136         [ FILTER_OP_LOAD_FIELD_REF_USER_SEQUENCE ] = "LOAD_FIELD_REF_USER_SEQUENCE",
 137 };
 138
 139 const char *lttng_filter_print_op(enum filter_op op)
 140 {
 141         if (op >= NR_FILTER_OPS)
 142                 return "UNKNOWN";
 143         else
 144                 return opnames[op];
 145 }
 146
 147 static
 148 int apply_field_reloc(struct lttng_event *event,
 149                 struct bytecode_runtime *runtime,
 150                 uint32_t runtime_len,
 151                 uint32_t reloc_offset,
 152                 const char *field_name)
 153 {
 154         const struct lttng_event_desc *desc;
 155         const struct lttng_event_field *fields, *field = NULL;
 156         unsigned int nr_fields, i;
 157         struct field_ref *field_ref;
 158         struct load_op *op;
 159         uint32_t field_offset = 0;
 160
 161         dbg_printk("Apply field reloc: %u %s\n", reloc_offset, field_name);
 162
 163         /* Lookup event by name */
 164         desc = event->desc;
 165         if (!desc)
 166                 return -EINVAL;
 167         fields = desc->fields;
 168         if (!fields)
 169                 return -EINVAL;
 170         nr_fields = desc->nr_fields;
 171         for (i = 0; i < nr_fields; i++) {
 172                 if (!strcmp(fields[i].name, field_name)) {
 173                         field = &fields[i];
 174                         break;
 175                 }
 176                 /* compute field offset */
 177                 switch (fields[i].type.atype) {
 178                 case atype_integer:
 179                 case atype_enum:
 180                         field_offset += sizeof(int64_t);
 181                         break;
 182                 case atype_array:
 183                 case atype_sequence:
 184                         field_offset += sizeof(unsigned long);
 185                         field_offset += sizeof(void *);
 186                         break;
 187                 case atype_string:
 188                         field_offset += sizeof(void *);
 189                         break;
 190                 case atype_struct:              /* Unsupported. */
 191                 case atype_array_compound:      /* Unsupported. */
 192                 case atype_sequence_compound:   /* Unsupported. */
 193                 case atype_variant:             /* Unsupported. */
 194                 default:
 195                         return -EINVAL;
 196                 }
 197         }
 198         if (!field)
 199                 return -EINVAL;
 200
 201         /* Check if field offset is too large for 16-bit offset */
 202         if (field_offset > LTTNG_KERNEL_FILTER_BYTECODE_MAX_LEN - 1)
 203                 return -EINVAL;
 204
 205         /* set type */
 206         op = (struct load_op *) &runtime->data[reloc_offset];
 207         field_ref = (struct field_ref *) op->data;
 208         switch (field->type.atype) {
 209         case atype_integer:
 210         case atype_enum:
 211                 op->op = FILTER_OP_LOAD_FIELD_REF_S64;
 212                 break;
 213         case atype_array:
 214         case atype_sequence:
 215                 if (field->user)
 216                         op->op = FILTER_OP_LOAD_FIELD_REF_USER_SEQUENCE;
 217                 else
 218                         op->op = FILTER_OP_LOAD_FIELD_REF_SEQUENCE;
 219                 break;
 220         case atype_string:
 221                 if (field->user)
 222                         op->op = FILTER_OP_LOAD_FIELD_REF_USER_STRING;
 223                 else
 224                         op->op = FILTER_OP_LOAD_FIELD_REF_STRING;
 225                 break;
 226         case atype_struct:              /* Unsupported. */
 227         case atype_array_compound:      /* Unsupported. */
 228         case atype_sequence_compound:   /* Unsupported. */
 229         case atype_variant:             /* Unsupported. */
 230         default:
 231                 return -EINVAL;
 232         }
 233         /* set offset */
 234         field_ref->offset = (uint16_t) field_offset;
 235         return 0;
 236 }
 237
 238 static
 239 int apply_context_reloc(struct lttng_event *event,
 240                 struct bytecode_runtime *runtime,
 241                 uint32_t runtime_len,
 242                 uint32_t reloc_offset,
 243                 const char *context_name)
 244 {
 245         struct field_ref *field_ref;
 246         struct load_op *op;
 247         struct lttng_ctx_field *ctx_field;
 248         int idx;
 249
 250         dbg_printk("Apply context reloc: %u %s\n", reloc_offset, context_name);
 251
 252         /* Get context index */
 253         idx = lttng_get_context_index(lttng_static_ctx, context_name);
 254         if (idx < 0)
 255                 return -ENOENT;
 256
 257         /* Check if idx is too large for 16-bit offset */
 258         if (idx > LTTNG_KERNEL_FILTER_BYTECODE_MAX_LEN - 1)
 259                 return -EINVAL;
 260
 261         /* Get context return type */
 262         ctx_field = &lttng_static_ctx->fields[idx];
 263         op = (struct load_op *) &runtime->data[reloc_offset];
 264         field_ref = (struct field_ref *) op->data;
 265         switch (ctx_field->event_field.type.atype) {
 266         case atype_integer:
 267         case atype_enum:
 268                 op->op = FILTER_OP_GET_CONTEXT_REF_S64;
 269                 break;
 270                 /* Sequence and array supported as string */
 271         case atype_string:
 272         case atype_array:
 273         case atype_sequence:
 274                 BUG_ON(ctx_field->event_field.user);
 275                 op->op = FILTER_OP_GET_CONTEXT_REF_STRING;
 276                 break;
 277         case atype_struct:      /* Unsupported. */
 278         case atype_array_compound:      /* Unsupported. */
 279         case atype_sequence_compound:   /* Unsupported. */
 280         case atype_variant:             /* Unsupported. */
 281         default:
 282                 return -EINVAL;
 283         }
 284         /* set offset to context index within channel contexts */
 285         field_ref->offset = (uint16_t) idx;
 286         return 0;
 287 }
 288
 289 static
 290 int apply_reloc(struct lttng_event *event,
 291                 struct bytecode_runtime *runtime,
 292                 uint32_t runtime_len,
 293                 uint32_t reloc_offset,
 294                 const char *name)
 295 {
 296         struct load_op *op;
 297
 298         dbg_printk("Apply reloc: %u %s\n", reloc_offset, name);
 299
 300         /* Ensure that the reloc is within the code */
 301         if (runtime_len - reloc_offset < sizeof(uint16_t))
 302                 return -EINVAL;
 303
 304         op = (struct load_op *) &runtime->data[reloc_offset];
 305         switch (op->op) {
 306         case FILTER_OP_LOAD_FIELD_REF:
 307                 return apply_field_reloc(event, runtime, runtime_len,
 308                         reloc_offset, name);
 309         case FILTER_OP_GET_CONTEXT_REF:
 310                 return apply_context_reloc(event, runtime, runtime_len,
 311                         reloc_offset, name);
 312         default:
 313                 printk(KERN_WARNING "Unknown reloc op type %u\n", op->op);
 314                 return -EINVAL;
 315         }
 316         return 0;
 317 }
 318
 319 static
 320 int bytecode_is_linked(struct lttng_filter_bytecode_node *filter_bytecode,
 321                 struct lttng_event *event)
 322 {
 323         struct lttng_bytecode_runtime *bc_runtime;
 324
 325         list_for_each_entry(bc_runtime,
 326                         &event->bytecode_runtime_head, node) {
 327                 if (bc_runtime->bc == filter_bytecode)
 328                         return 1;
 329         }
 330         return 0;
 331 }
 332
 333 /*
 334  * Take a bytecode with reloc table and link it to an event to create a
 335  * bytecode runtime.
 336  */
 337 static
 338 int _lttng_filter_event_link_bytecode(struct lttng_event *event,
 339                 struct lttng_filter_bytecode_node *filter_bytecode,
 340                 struct list_head *insert_loc)
 341 {
 342         int ret, offset, next_offset;
 343         struct bytecode_runtime *runtime = NULL;
 344         size_t runtime_alloc_len;
 345
 346         if (!filter_bytecode)
 347                 return 0;
 348         /* Bytecode already linked */
 349         if (bytecode_is_linked(filter_bytecode, event))
 350                 return 0;
 351
 352         dbg_printk("Linking...\n");
 353
 354         /* We don't need the reloc table in the runtime */
 355         runtime_alloc_len = sizeof(*runtime) + filter_bytecode->bc.reloc_offset;
 356         runtime = kzalloc(runtime_alloc_len, GFP_KERNEL);
 357         if (!runtime) {
 358                 ret = -ENOMEM;
 359                 goto alloc_error;
 360         }
 361         runtime->p.bc = filter_bytecode;
 362         runtime->len = filter_bytecode->bc.reloc_offset;
 363         /* copy original bytecode */
 364         memcpy(runtime->data, filter_bytecode->bc.data, runtime->len);
 365         /*
 366          * apply relocs. Those are a uint16_t (offset in bytecode)
 367          * followed by a string (field name).
 368          */
 369         for (offset = filter_bytecode->bc.reloc_offset;
 370                         offset < filter_bytecode->bc.len;
 371                         offset = next_offset) {
 372                 uint16_t reloc_offset =
 373                         *(uint16_t *) &filter_bytecode->bc.data[offset];
 374                 const char *name =
 375                         (const char *) &filter_bytecode->bc.data[offset + sizeof(uint16_t)];
 376
 377                 ret = apply_reloc(event, runtime, runtime->len, reloc_offset, name);
 378                 if (ret) {
 379                         goto link_error;
 380                 }
 381                 next_offset = offset + sizeof(uint16_t) + strlen(name) + 1;
 382         }
 383         /* Validate bytecode */
 384         ret = lttng_filter_validate_bytecode(runtime);
 385         if (ret) {
 386                 goto link_error;
 387         }
 388         /* Specialize bytecode */
 389         ret = lttng_filter_specialize_bytecode(runtime);
 390         if (ret) {
 391                 goto link_error;
 392         }
 393         runtime->p.filter = lttng_filter_interpret_bytecode;
 394         runtime->p.link_failed = 0;
 395         list_add_rcu(&runtime->p.node, insert_loc);
 396         dbg_printk("Linking successful.\n");
 397         return 0;
 398
 399 link_error:
 400         runtime->p.filter = lttng_filter_false;
 401         runtime->p.link_failed = 1;
 402         list_add_rcu(&runtime->p.node, insert_loc);
 403 alloc_error:
 404         dbg_printk("Linking failed.\n");
 405         return ret;
 406 }
 407
 408 void lttng_filter_sync_state(struct lttng_bytecode_runtime *runtime)
 409 {
 410         struct lttng_filter_bytecode_node *bc = runtime->bc;
 411
 412         if (!bc->enabler->enabled || runtime->link_failed)
 413                 runtime->filter = lttng_filter_false;
 414         else
 415                 runtime->filter = lttng_filter_interpret_bytecode;
 416 }
 417
 418 /*
 419  * Link bytecode for all enablers referenced by an event.
 420  */
 421 void lttng_enabler_event_link_bytecode(struct lttng_event *event,
 422                 struct lttng_enabler *enabler)
 423 {
 424         struct lttng_filter_bytecode_node *bc;
 425         struct lttng_bytecode_runtime *runtime;
 426
 427         /* Can only be called for events with desc attached */
 428         WARN_ON_ONCE(!event->desc);
 429
 430         /* Link each bytecode. */
 431         list_for_each_entry(bc, &enabler->filter_bytecode_head, node) {
 432                 int found = 0, ret;
 433                 struct list_head *insert_loc;
 434
 435                 list_for_each_entry(runtime,
 436                                 &event->bytecode_runtime_head, node) {
 437                         if (runtime->bc == bc) {
 438                                 found = 1;
 439                                 break;
 440                         }
 441                 }
 442                 /* Skip bytecode already linked */
 443                 if (found)
 444                         continue;
 445
 446                 /*
 447                  * Insert at specified priority (seqnum) in increasing
 448                  * order.
 449                  */
 450                 list_for_each_entry_reverse(runtime,
 451                                 &event->bytecode_runtime_head, node) {
 452                         if (runtime->bc->bc.seqnum < bc->bc.seqnum) {
 453                                 /* insert here */
 454                                 insert_loc = &runtime->node;
 455                                 goto add_within;
 456                         }
 457                 }
 458                 /* Add to head to list */
 459                 insert_loc = &event->bytecode_runtime_head;
 460         add_within:
 461                 dbg_printk("linking bytecode\n");
 462                 ret = _lttng_filter_event_link_bytecode(event, bc,
 463                                 insert_loc);
 464                 if (ret) {
 465                         dbg_printk("[lttng filter] warning: cannot link event bytecode\n");
 466                 }
 467         }
 468 }
 469
 470 /*
 471  * We own the filter_bytecode if we return success.
 472  */
 473 int lttng_filter_enabler_attach_bytecode(struct lttng_enabler *enabler,
 474                 struct lttng_filter_bytecode_node *filter_bytecode)
 475 {
 476         list_add(&filter_bytecode->node, &enabler->filter_bytecode_head);
 477         return 0;
 478 }
 479
 480 void lttng_free_enabler_filter_bytecode(struct lttng_enabler *enabler)
 481 {
 482         struct lttng_filter_bytecode_node *filter_bytecode, *tmp;
 483
 484         list_for_each_entry_safe(filter_bytecode, tmp,
 485                         &enabler->filter_bytecode_head, node) {
 486                 kfree(filter_bytecode);
 487         }
 488 }
 489
 490 void lttng_free_event_filter_runtime(struct lttng_event *event)
 491 {
 492         struct bytecode_runtime *runtime, *tmp;
 493
 494         list_for_each_entry_safe(runtime, tmp,
 495                         &event->bytecode_runtime_head, p.node) {
 496                 kfree(runtime);
 497         }
 498 }