src/bin/lttng-sessiond/trace-kernel.cpp

   1 /*
   2  * Copyright (C) 2011 EfficiOS Inc.
   3  *
   4  * SPDX-License-Identifier: GPL-2.0-only
   5  *
   6  */
   7
   8 #define _LGPL_SOURCE
   9 #include "consumer.hpp"
  10 #include "lttng-sessiond.hpp"
  11 #include "notification-thread-commands.hpp"
  12 #include "trace-kernel.hpp"
  13
  14 #include <common/common.hpp>
  15 #include <common/defaults.hpp>
  16 #include <common/macros.hpp>
  17 #include <common/trace-chunk.hpp>
  18
  19 #include <lttng/event-rule/event-rule-internal.hpp>
  20 #include <lttng/event-rule/event-rule.h>
  21 #include <lttng/event-rule/kernel-kprobe-internal.hpp>
  22 #include <lttng/event-rule/kernel-kprobe.h>
  23 #include <lttng/event-rule/kernel-syscall-internal.hpp>
  24 #include <lttng/event-rule/kernel-syscall.h>
  25 #include <lttng/event-rule/kernel-tracepoint-internal.hpp>
  26 #include <lttng/event-rule/kernel-tracepoint.h>
  27 #include <lttng/event-rule/kernel-uprobe-internal.hpp>
  28 #include <lttng/event-rule/kernel-uprobe.h>
  29 #include <lttng/event.h>
  30 #include <lttng/kernel-probe.h>
  31 #include <lttng/lttng-error.h>
  32 #include <lttng/userspace-probe-internal.hpp>
  33 #include <lttng/userspace-probe.h>
  34
  35 #include <stdio.h>
  36 #include <stdlib.h>
  37 #include <string.h>
  38 #include <unistd.h>
  39
  40 /*
  41  * Find the channel name for the given kernel session.
  42  */
  43 struct ltt_kernel_channel *trace_kernel_get_channel_by_name(const char *name,
  44                                                             struct ltt_kernel_session *session)
  45 {
  46         struct ltt_kernel_channel *chan;
  47
  48         LTTNG_ASSERT(session);
  49         LTTNG_ASSERT(name);
  50
  51         /*
  52          * If we receive an empty string for channel name, it means the
  53          * default channel name is requested.
  54          */
  55         if (name[0] == '\0')
  56                 name = DEFAULT_CHANNEL_NAME;
  57
  58         DBG("Trying to find channel %s", name);
  59
  60         cds_list_for_each_entry (chan, &session->channel_list.head, list) {
  61                 if (strcmp(name, chan->channel->name) == 0) {
  62                         DBG("Found channel by name %s", name);
  63                         return chan;
  64                 }
  65         }
  66
  67         return nullptr;
  68 }
  69
  70 /*
  71  * Find the event for the given channel.
  72  */
  73 struct ltt_kernel_event *trace_kernel_find_event(char *name,
  74                                                  struct ltt_kernel_channel *channel,
  75                                                  enum lttng_event_type type,
  76                                                  struct lttng_bytecode *filter)
  77 {
  78         struct ltt_kernel_event *ev;
  79         bool found = false;
  80
  81         LTTNG_ASSERT(name);
  82         LTTNG_ASSERT(channel);
  83
  84         cds_list_for_each_entry (ev, &channel->events_list.head, list) {
  85                 if (type != LTTNG_EVENT_ALL && ev->type != type) {
  86                         continue;
  87                 }
  88                 if (strcmp(name, ev->event->name) != 0) {
  89                         continue;
  90                 }
  91                 if ((ev->filter && !filter) || (!ev->filter && filter)) {
  92                         continue;
  93                 }
  94                 if (ev->filter && filter) {
  95                         if (ev->filter->len != filter->len ||
  96                             memcmp(ev->filter->data, filter->data, filter->len) != 0) {
  97                                 continue;
  98                         }
  99                 }
 100
 101                 found = true;
 102                 break;
 103         }
 104
 105         if (found) {
 106                 DBG("Found event %s for channel %s", name, channel->channel->name);
 107                 return ev;
 108         } else {
 109                 return nullptr;
 110         }
 111 }
 112
 113 /*
 114  * Find the event name for the given channel.
 115  */
 116 struct ltt_kernel_event *trace_kernel_get_event_by_name(char *name,
 117                                                         struct ltt_kernel_channel *channel,
 118                                                         enum lttng_event_type type)
 119 {
 120         struct ltt_kernel_event *ev;
 121         bool found = false;
 122
 123         LTTNG_ASSERT(name);
 124         LTTNG_ASSERT(channel);
 125
 126         cds_list_for_each_entry (ev, &channel->events_list.head, list) {
 127                 if (type != LTTNG_EVENT_ALL && ev->type != type) {
 128                         continue;
 129                 }
 130                 if (strcmp(name, ev->event->name) != 0) {
 131                         continue;
 132                 }
 133
 134                 found = true;
 135                 break;
 136         }
 137
 138         if (found) {
 139                 DBG("Found event %s for channel %s", name, channel->channel->name);
 140                 return ev;
 141         } else {
 142                 return nullptr;
 143         }
 144 }
 145
 146 /*
 147  * Allocate and initialize a kernel session data structure.
 148  *
 149  * Return pointer to structure or NULL.
 150  */
 151 struct ltt_kernel_session *trace_kernel_create_session()
 152 {
 153         struct ltt_kernel_session *lks = nullptr;
 154
 155         /* Allocate a new ltt kernel session */
 156         lks = zmalloc<ltt_kernel_session>();
 157         if (lks == nullptr) {
 158                 PERROR("create kernel session zmalloc");
 159                 goto alloc_error;
 160         }
 161
 162         /* Init data structure */
 163         lks->fd = -1;
 164         lks->metadata_stream_fd = -1;
 165         lks->channel_count = 0;
 166         lks->stream_count_global = 0;
 167         lks->metadata = nullptr;
 168         CDS_INIT_LIST_HEAD(&lks->channel_list.head);
 169
 170         lks->tracker_pid = process_attr_tracker_create();
 171         if (!lks->tracker_pid) {
 172                 goto error;
 173         }
 174         lks->tracker_vpid = process_attr_tracker_create();
 175         if (!lks->tracker_vpid) {
 176                 goto error;
 177         }
 178         lks->tracker_uid = process_attr_tracker_create();
 179         if (!lks->tracker_uid) {
 180                 goto error;
 181         }
 182         lks->tracker_vuid = process_attr_tracker_create();
 183         if (!lks->tracker_vuid) {
 184                 goto error;
 185         }
 186         lks->tracker_gid = process_attr_tracker_create();
 187         if (!lks->tracker_gid) {
 188                 goto error;
 189         }
 190         lks->tracker_vgid = process_attr_tracker_create();
 191         if (!lks->tracker_vgid) {
 192                 goto error;
 193         }
 194         lks->consumer = consumer_create_output(CONSUMER_DST_LOCAL);
 195         if (lks->consumer == nullptr) {
 196                 goto error;
 197         }
 198
 199         return lks;
 200
 201 error:
 202         process_attr_tracker_destroy(lks->tracker_pid);
 203         process_attr_tracker_destroy(lks->tracker_vpid);
 204         process_attr_tracker_destroy(lks->tracker_uid);
 205         process_attr_tracker_destroy(lks->tracker_vuid);
 206         process_attr_tracker_destroy(lks->tracker_gid);
 207         process_attr_tracker_destroy(lks->tracker_vgid);
 208         free(lks);
 209
 210 alloc_error:
 211         return nullptr;
 212 }
 213
 214 /*
 215  * Allocate and initialize a kernel channel data structure.
 216  *
 217  * Return pointer to structure or NULL.
 218  */
 219 struct ltt_kernel_channel *trace_kernel_create_channel(struct lttng_channel *chan)
 220 {
 221         struct ltt_kernel_channel *lkc;
 222         struct lttng_channel_extended *extended = nullptr;
 223
 224         LTTNG_ASSERT(chan);
 225
 226         lkc = zmalloc<ltt_kernel_channel>();
 227         if (lkc == nullptr) {
 228                 PERROR("ltt_kernel_channel zmalloc");
 229                 goto error;
 230         }
 231
 232         lkc->channel = zmalloc<lttng_channel>();
 233         if (lkc->channel == nullptr) {
 234                 PERROR("lttng_channel zmalloc");
 235                 goto error;
 236         }
 237
 238         extended = zmalloc<lttng_channel_extended>();
 239         if (!extended) {
 240                 PERROR("lttng_channel_channel zmalloc");
 241                 goto error;
 242         }
 243         memcpy(lkc->channel, chan, sizeof(struct lttng_channel));
 244         memcpy(extended, chan->attr.extended.ptr, sizeof(struct lttng_channel_extended));
 245         lkc->channel->attr.extended.ptr = extended;
 246         extended = nullptr;
 247
 248         /*
 249          * If we receive an empty string for channel name, it means the
 250          * default channel name is requested.
 251          */
 252         if (chan->name[0] == '\0') {
 253                 strncpy(lkc->channel->name, DEFAULT_CHANNEL_NAME, sizeof(lkc->channel->name));
 254         }
 255         lkc->channel->name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
 256
 257         lkc->fd = -1;
 258         lkc->stream_count = 0;
 259         lkc->event_count = 0;
 260         lkc->enabled = true;
 261         lkc->published_to_notification_thread = false;
 262         /* Init linked list */
 263         CDS_INIT_LIST_HEAD(&lkc->events_list.head);
 264         CDS_INIT_LIST_HEAD(&lkc->stream_list.head);
 265         CDS_INIT_LIST_HEAD(&lkc->ctx_list);
 266
 267         return lkc;
 268
 269 error:
 270         if (lkc) {
 271                 free(lkc->channel);
 272         }
 273         free(extended);
 274         free(lkc);
 275         return nullptr;
 276 }
 277
 278 /*
 279  * Allocate and init a kernel context object.
 280  *
 281  * Return the allocated object or NULL on error.
 282  */
 283 struct ltt_kernel_context *trace_kernel_create_context(struct lttng_kernel_abi_context *ctx)
 284 {
 285         struct ltt_kernel_context *kctx;
 286
 287         kctx = zmalloc<ltt_kernel_context>();
 288         if (!kctx) {
 289                 PERROR("zmalloc kernel context");
 290                 goto error;
 291         }
 292
 293         if (ctx) {
 294                 memcpy(&kctx->ctx, ctx, sizeof(kctx->ctx));
 295         }
 296 error:
 297         return kctx;
 298 }
 299
 300 /*
 301  * Allocate and init a kernel context object from an existing kernel context
 302  * object.
 303  *
 304  * Return the allocated object or NULL on error.
 305  */
 306 struct ltt_kernel_context *trace_kernel_copy_context(struct ltt_kernel_context *kctx)
 307 {
 308         struct ltt_kernel_context *kctx_copy;
 309
 310         LTTNG_ASSERT(kctx);
 311         kctx_copy = zmalloc<ltt_kernel_context>();
 312         if (!kctx_copy) {
 313                 PERROR("zmalloc ltt_kernel_context");
 314                 goto error;
 315         }
 316
 317         memcpy(kctx_copy, kctx, sizeof(*kctx_copy));
 318         memset(&kctx_copy->list, 0, sizeof(kctx_copy->list));
 319
 320 error:
 321         return kctx_copy;
 322 }
 323
 324 /*
 325  * Allocate and initialize a kernel event. Set name and event type.
 326  * We own filter_expression, and filter.
 327  *
 328  * Return pointer to structure or NULL.
 329  */
 330 enum lttng_error_code trace_kernel_create_event(struct lttng_event *ev,
 331                                                 char *filter_expression,
 332                                                 struct lttng_bytecode *filter,
 333                                                 struct ltt_kernel_event **kernel_event)
 334 {
 335         enum lttng_error_code ret;
 336         struct lttng_kernel_abi_event *attr;
 337         struct ltt_kernel_event *local_kernel_event;
 338         struct lttng_userspace_probe_location *userspace_probe_location = nullptr;
 339
 340         LTTNG_ASSERT(ev);
 341
 342         local_kernel_event = zmalloc<ltt_kernel_event>();
 343         attr = zmalloc<lttng_kernel_abi_event>();
 344         if (local_kernel_event == nullptr || attr == nullptr) {
 345                 PERROR("kernel event zmalloc");
 346                 ret = LTTNG_ERR_NOMEM;
 347                 goto error;
 348         }
 349
 350         switch (ev->type) {
 351         case LTTNG_EVENT_PROBE:
 352                 attr->instrumentation = LTTNG_KERNEL_ABI_KPROBE;
 353                 attr->u.kprobe.addr = ev->attr.probe.addr;
 354                 attr->u.kprobe.offset = ev->attr.probe.offset;
 355                 strncpy(attr->u.kprobe.symbol_name,
 356                         ev->attr.probe.symbol_name,
 357                         LTTNG_KERNEL_ABI_SYM_NAME_LEN);
 358                 attr->u.kprobe.symbol_name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
 359                 break;
 360         case LTTNG_EVENT_USERSPACE_PROBE:
 361         {
 362                 const struct lttng_userspace_probe_location *location = nullptr;
 363                 const struct lttng_userspace_probe_location_lookup_method *lookup = nullptr;
 364
 365                 location = lttng_event_get_userspace_probe_location(ev);
 366                 if (!location) {
 367                         ret = LTTNG_ERR_PROBE_LOCATION_INVAL;
 368                         goto error;
 369                 }
 370
 371                 /*
 372                  * From this point on, the specific term 'uprobe' is used
 373                  * instead of the generic 'userspace probe' because it's the
 374                  * technology used at the moment for this instrumentation.
 375                  * LTTng currently implements userspace probes using uprobes.
 376                  * In the interactions with the kernel tracer, we use the
 377                  * uprobe term.
 378                  */
 379                 attr->instrumentation = LTTNG_KERNEL_ABI_UPROBE;
 380
 381                 lookup = lttng_userspace_probe_location_get_lookup_method(location);
 382                 if (!lookup) {
 383                         ret = LTTNG_ERR_PROBE_LOCATION_INVAL;
 384                         goto error;
 385                 }
 386
 387                 /*
 388                  * From the kernel tracer's perspective, all userspace probe
 389                  * event types are all the same: a file and an offset.
 390                  */
 391                 switch (lttng_userspace_probe_location_lookup_method_get_type(lookup)) {
 392                 case LTTNG_USERSPACE_PROBE_LOCATION_LOOKUP_METHOD_TYPE_FUNCTION_ELF:
 393                         /* Get the file descriptor on the target binary. */
 394                         attr->u.uprobe.fd =
 395                                 lttng_userspace_probe_location_function_get_binary_fd(location);
 396
 397                         /*
 398                          * Save a reference to the probe location used during
 399                          * the listing of events.
 400                          */
 401                         userspace_probe_location = lttng_userspace_probe_location_copy(location);
 402                         break;
 403                 case LTTNG_USERSPACE_PROBE_LOCATION_LOOKUP_METHOD_TYPE_TRACEPOINT_SDT:
 404                         /* Get the file descriptor on the target binary. */
 405                         attr->u.uprobe.fd =
 406                                 lttng_userspace_probe_location_tracepoint_get_binary_fd(location);
 407
 408                         /*
 409                          * Save a reference to the probe location used during the listing of
 410                          * events.
 411                          */
 412                         userspace_probe_location = lttng_userspace_probe_location_copy(location);
 413                         break;
 414                 default:
 415                         DBG("Unsupported lookup method type");
 416                         ret = LTTNG_ERR_PROBE_LOCATION_INVAL;
 417                         goto error;
 418                 }
 419                 break;
 420         }
 421         case LTTNG_EVENT_FUNCTION:
 422                 attr->instrumentation = LTTNG_KERNEL_ABI_KRETPROBE;
 423                 attr->u.kretprobe.addr = ev->attr.probe.addr;
 424                 attr->u.kretprobe.offset = ev->attr.probe.offset;
 425                 strncpy(attr->u.kretprobe.symbol_name,
 426                         ev->attr.probe.symbol_name,
 427                         LTTNG_KERNEL_ABI_SYM_NAME_LEN);
 428                 attr->u.kretprobe.symbol_name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
 429                 break;
 430         case LTTNG_EVENT_FUNCTION_ENTRY:
 431                 attr->instrumentation = LTTNG_KERNEL_ABI_FUNCTION;
 432                 strncpy(attr->u.ftrace.symbol_name,
 433                         ev->attr.ftrace.symbol_name,
 434                         LTTNG_KERNEL_ABI_SYM_NAME_LEN);
 435                 attr->u.ftrace.symbol_name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
 436                 break;
 437         case LTTNG_EVENT_TRACEPOINT:
 438                 attr->instrumentation = LTTNG_KERNEL_ABI_TRACEPOINT;
 439                 break;
 440         case LTTNG_EVENT_SYSCALL:
 441                 attr->instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
 442                 attr->u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_ALL;
 443                 attr->u.syscall.entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRYEXIT;
 444                 attr->u.syscall.match = LTTNG_KERNEL_ABI_SYSCALL_MATCH_NAME;
 445                 break;
 446         case LTTNG_EVENT_ALL:
 447                 attr->instrumentation = LTTNG_KERNEL_ABI_ALL;
 448                 break;
 449         default:
 450                 ERR("Unknown kernel instrumentation type (%d)", ev->type);
 451                 ret = LTTNG_ERR_INVALID;
 452                 goto error;
 453         }
 454
 455         /* Copy event name */
 456         strncpy(attr->name, ev->name, LTTNG_KERNEL_ABI_SYM_NAME_LEN);
 457         attr->name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
 458
 459         /* Setting up a kernel event */
 460         local_kernel_event->fd = -1;
 461         local_kernel_event->event = attr;
 462         local_kernel_event->enabled = true;
 463         local_kernel_event->filter_expression = filter_expression;
 464         local_kernel_event->filter = filter;
 465         local_kernel_event->userspace_probe_location = userspace_probe_location;
 466
 467         *kernel_event = local_kernel_event;
 468
 469         return LTTNG_OK;
 470
 471 error:
 472         free(filter_expression);
 473         free(filter);
 474         free(local_kernel_event);
 475         free(attr);
 476         return ret;
 477 }
 478
 479 /*
 480  * Allocate and initialize a kernel token event rule.
 481  *
 482  * Return pointer to structure or NULL.
 483  */
 484 enum lttng_error_code
 485 trace_kernel_create_event_notifier_rule(struct lttng_trigger *trigger,
 486                                         uint64_t token,
 487                                         uint64_t error_counter_index,
 488                                         struct ltt_kernel_event_notifier_rule **event_notifier_rule)
 489 {
 490         enum lttng_error_code ret = LTTNG_OK;
 491         enum lttng_condition_type condition_type;
 492         enum lttng_event_rule_type event_rule_type;
 493         enum lttng_condition_status condition_status;
 494         struct ltt_kernel_event_notifier_rule *local_kernel_token_event_rule;
 495         const struct lttng_condition *condition = nullptr;
 496         const struct lttng_event_rule *event_rule = nullptr;
 497
 498         LTTNG_ASSERT(event_notifier_rule);
 499
 500         condition = lttng_trigger_get_const_condition(trigger);
 501         LTTNG_ASSERT(condition);
 502
 503         condition_type = lttng_condition_get_type(condition);
 504         LTTNG_ASSERT(condition_type == LTTNG_CONDITION_TYPE_EVENT_RULE_MATCHES);
 505
 506         condition_status = lttng_condition_event_rule_matches_get_rule(condition, &event_rule);
 507         LTTNG_ASSERT(condition_status == LTTNG_CONDITION_STATUS_OK);
 508         LTTNG_ASSERT(event_rule);
 509
 510         event_rule_type = lttng_event_rule_get_type(event_rule);
 511         LTTNG_ASSERT(event_rule_type != LTTNG_EVENT_RULE_TYPE_UNKNOWN);
 512
 513         local_kernel_token_event_rule = zmalloc<ltt_kernel_event_notifier_rule>();
 514         if (local_kernel_token_event_rule == nullptr) {
 515                 PERROR("Failed to allocate ltt_kernel_token_event_rule structure");
 516                 ret = LTTNG_ERR_NOMEM;
 517                 goto error;
 518         }
 519
 520         local_kernel_token_event_rule->fd = -1;
 521         local_kernel_token_event_rule->enabled = true;
 522         local_kernel_token_event_rule->token = token;
 523         local_kernel_token_event_rule->error_counter_index = error_counter_index;
 524
 525         /* Get the reference of the event rule. */
 526         lttng_trigger_get(trigger);
 527
 528         local_kernel_token_event_rule->trigger = trigger;
 529         /* The event rule still owns the filter and bytecode. */
 530         local_kernel_token_event_rule->filter = lttng_event_rule_get_filter_bytecode(event_rule);
 531
 532         DBG3("Created kernel event notifier rule: token =  %" PRIu64,
 533              local_kernel_token_event_rule->token);
 534 error:
 535         *event_notifier_rule = local_kernel_token_event_rule;
 536         return ret;
 537 }
 538
 539 /*
 540  * Initialize a kernel trigger from an event rule.
 541  */
 542 enum lttng_error_code trace_kernel_init_event_notifier_from_event_rule(
 543         const struct lttng_event_rule *rule,
 544         struct lttng_kernel_abi_event_notifier *kernel_event_notifier)
 545 {
 546         enum lttng_error_code ret_code;
 547         const char *name;
 548         int strncpy_ret;
 549
 550         switch (lttng_event_rule_get_type(rule)) {
 551         case LTTNG_EVENT_RULE_TYPE_KERNEL_KPROBE:
 552         {
 553                 uint64_t address = 0, offset = 0;
 554                 const char *symbol_name = nullptr;
 555                 const struct lttng_kernel_probe_location *location = nullptr;
 556                 enum lttng_kernel_probe_location_status k_status;
 557                 enum lttng_event_rule_status status;
 558
 559                 status = lttng_event_rule_kernel_kprobe_get_location(rule, &location);
 560                 if (status != LTTNG_EVENT_RULE_STATUS_OK) {
 561                         ret_code = LTTNG_ERR_PROBE_LOCATION_INVAL;
 562                         goto error;
 563                 }
 564
 565                 switch (lttng_kernel_probe_location_get_type(location)) {
 566                 case LTTNG_KERNEL_PROBE_LOCATION_TYPE_ADDRESS:
 567                 {
 568                         k_status =
 569                                 lttng_kernel_probe_location_address_get_address(location, &address);
 570                         LTTNG_ASSERT(k_status == LTTNG_KERNEL_PROBE_LOCATION_STATUS_OK);
 571                         break;
 572                 }
 573                 case LTTNG_KERNEL_PROBE_LOCATION_TYPE_SYMBOL_OFFSET:
 574                 {
 575                         k_status = lttng_kernel_probe_location_symbol_get_offset(location, &offset);
 576                         LTTNG_ASSERT(k_status == LTTNG_KERNEL_PROBE_LOCATION_STATUS_OK);
 577                         symbol_name = lttng_kernel_probe_location_symbol_get_name(location);
 578                         break;
 579                 }
 580                 default:
 581                         abort();
 582                 }
 583
 584                 kernel_event_notifier->event.instrumentation = LTTNG_KERNEL_ABI_KPROBE;
 585                 kernel_event_notifier->event.u.kprobe.addr = address;
 586                 kernel_event_notifier->event.u.kprobe.offset = offset;
 587                 if (symbol_name) {
 588                         strncpy_ret = lttng_strncpy(
 589                                 kernel_event_notifier->event.u.kprobe.symbol_name,
 590                                 symbol_name,
 591                                 sizeof(kernel_event_notifier->event.u.kprobe.symbol_name));
 592
 593                         if (strncpy_ret) {
 594                                 ret_code = LTTNG_ERR_INVALID;
 595                                 goto error;
 596                         }
 597                 }
 598
 599                 kernel_event_notifier->event.u.kprobe
 600                         .symbol_name[LTTNG_KERNEL_ABI_SYM_NAME_LEN - 1] = '\0';
 601
 602                 status = lttng_event_rule_kernel_kprobe_get_event_name(rule, &name);
 603                 LTTNG_ASSERT(status == LTTNG_EVENT_RULE_STATUS_OK);
 604                 ret_code = LTTNG_OK;
 605                 break;
 606         }
 607         case LTTNG_EVENT_RULE_TYPE_KERNEL_UPROBE:
 608         {
 609                 const struct lttng_userspace_probe_location *location = nullptr;
 610                 const struct lttng_userspace_probe_location_lookup_method *lookup = nullptr;
 611                 enum lttng_event_rule_status status;
 612
 613                 status = lttng_event_rule_kernel_uprobe_get_location(rule, &location);
 614                 if (status != LTTNG_EVENT_RULE_STATUS_OK) {
 615                         ret_code = LTTNG_ERR_PROBE_LOCATION_INVAL;
 616                         goto error;
 617                 }
 618
 619                 kernel_event_notifier->event.instrumentation = LTTNG_KERNEL_ABI_UPROBE;
 620
 621                 lookup = lttng_userspace_probe_location_get_lookup_method(location);
 622                 if (!lookup) {
 623                         ret_code = LTTNG_ERR_PROBE_LOCATION_INVAL;
 624                         goto error;
 625                 }
 626
 627                 /*
 628                  * From the kernel tracer's perspective, all userspace probe
 629                  * event types are all the same: a file and an offset.
 630                  */
 631                 switch (lttng_userspace_probe_location_lookup_method_get_type(lookup)) {
 632                 case LTTNG_USERSPACE_PROBE_LOCATION_LOOKUP_METHOD_TYPE_FUNCTION_ELF:
 633                         /* Get the file descriptor on the target binary. */
 634                         kernel_event_notifier->event.u.uprobe.fd =
 635                                 lttng_userspace_probe_location_function_get_binary_fd(location);
 636
 637                         break;
 638                 case LTTNG_USERSPACE_PROBE_LOCATION_LOOKUP_METHOD_TYPE_TRACEPOINT_SDT:
 639                         /* Get the file descriptor on the target binary. */
 640                         kernel_event_notifier->event.u.uprobe.fd =
 641                                 lttng_userspace_probe_location_tracepoint_get_binary_fd(location);
 642                         break;
 643                 default:
 644                         abort();
 645                 }
 646
 647                 status = lttng_event_rule_kernel_uprobe_get_event_name(rule, &name);
 648                 LTTNG_ASSERT(status == LTTNG_EVENT_RULE_STATUS_OK);
 649                 ret_code = LTTNG_OK;
 650                 break;
 651         }
 652         case LTTNG_EVENT_RULE_TYPE_KERNEL_TRACEPOINT:
 653         {
 654                 const enum lttng_event_rule_status status =
 655                         lttng_event_rule_kernel_tracepoint_get_name_pattern(rule, &name);
 656
 657                 LTTNG_ASSERT(status == LTTNG_EVENT_RULE_STATUS_OK);
 658                 kernel_event_notifier->event.instrumentation = LTTNG_KERNEL_ABI_TRACEPOINT;
 659
 660                 ret_code = LTTNG_OK;
 661                 break;
 662         }
 663         case LTTNG_EVENT_RULE_TYPE_KERNEL_SYSCALL:
 664         {
 665                 const enum lttng_event_rule_status status =
 666                         lttng_event_rule_kernel_syscall_get_name_pattern(rule, &name);
 667                 const enum lttng_event_rule_kernel_syscall_emission_site emission_site =
 668                         lttng_event_rule_kernel_syscall_get_emission_site(rule);
 669                 enum lttng_kernel_abi_syscall_entryexit entryexit;
 670
 671                 LTTNG_ASSERT(status == LTTNG_EVENT_RULE_STATUS_OK);
 672                 LTTNG_ASSERT(emission_site !=
 673                              LTTNG_EVENT_RULE_KERNEL_SYSCALL_EMISSION_SITE_UNKNOWN);
 674
 675                 switch (emission_site) {
 676                 case LTTNG_EVENT_RULE_KERNEL_SYSCALL_EMISSION_SITE_ENTRY:
 677                         entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRY;
 678                         break;
 679                 case LTTNG_EVENT_RULE_KERNEL_SYSCALL_EMISSION_SITE_EXIT:
 680                         entryexit = LTTNG_KERNEL_ABI_SYSCALL_EXIT;
 681                         break;
 682                 case LTTNG_EVENT_RULE_KERNEL_SYSCALL_EMISSION_SITE_ENTRY_EXIT:
 683                         entryexit = LTTNG_KERNEL_ABI_SYSCALL_ENTRYEXIT;
 684                         break;
 685                 default:
 686                         abort();
 687                         break;
 688                 }
 689
 690                 kernel_event_notifier->event.instrumentation = LTTNG_KERNEL_ABI_SYSCALL;
 691                 kernel_event_notifier->event.u.syscall.abi = LTTNG_KERNEL_ABI_SYSCALL_ABI_ALL;
 692                 kernel_event_notifier->event.u.syscall.entryexit = entryexit;
 693                 kernel_event_notifier->event.u.syscall.match = LTTNG_KERNEL_ABI_SYSCALL_MATCH_NAME;
 694                 ret_code = LTTNG_OK;
 695                 break;
 696         }
 697         default:
 698                 abort();
 699                 break;
 700         }
 701
 702         strncpy_ret = lttng_strncpy(
 703                 kernel_event_notifier->event.name, name, LTTNG_KERNEL_ABI_SYM_NAME_LEN);
 704         if (strncpy_ret) {
 705                 ret_code = LTTNG_ERR_INVALID;
 706                 goto error;
 707         }
 708
 709 error:
 710         return ret_code;
 711 }
 712 /*
 713  * Allocate and initialize a kernel metadata.
 714  *
 715  * Return pointer to structure or NULL.
 716  */
 717 struct ltt_kernel_metadata *trace_kernel_create_metadata()
 718 {
 719         int ret;
 720         struct ltt_kernel_metadata *lkm;
 721         struct lttng_channel *chan;
 722
 723         lkm = zmalloc<ltt_kernel_metadata>();
 724         chan = zmalloc<lttng_channel>();
 725         if (lkm == nullptr || chan == nullptr) {
 726                 PERROR("kernel metadata zmalloc");
 727                 goto error;
 728         }
 729
 730         ret = lttng_strncpy(chan->name, DEFAULT_METADATA_NAME, sizeof(chan->name));
 731         if (ret) {
 732                 ERR("Failed to initialize metadata channel name to `%s`", DEFAULT_METADATA_NAME);
 733                 goto error;
 734         }
 735
 736         /* Set default attributes */
 737         chan->attr.overwrite = DEFAULT_METADATA_OVERWRITE;
 738         chan->attr.subbuf_size = default_get_metadata_subbuf_size();
 739         chan->attr.num_subbuf = DEFAULT_METADATA_SUBBUF_NUM;
 740         chan->attr.switch_timer_interval = DEFAULT_METADATA_SWITCH_TIMER;
 741         chan->attr.read_timer_interval = DEFAULT_METADATA_READ_TIMER;
 742         ;
 743
 744         /*
 745          * The metadata channel of kernel sessions must use the "mmap"
 746          * back-end since the consumer daemon accumulates complete
 747          * metadata units before sending them to the relay daemon in
 748          * live mode. The consumer daemon also needs to extract the contents
 749          * of the metadata cache when computing a rotation position.
 750          *
 751          * In both cases, it is not possible to rely on the splice
 752          * back-end as the consumer daemon may need to accumulate more
 753          * content than can be backed by the ring buffer's underlying
 754          * pages.
 755          */
 756         chan->attr.output = LTTNG_EVENT_MMAP;
 757         chan->attr.tracefile_size = 0;
 758         chan->attr.tracefile_count = 0;
 759         chan->attr.live_timer_interval = 0;
 760
 761         /* Init metadata */
 762         lkm->fd = -1;
 763         lkm->conf = chan;
 764
 765         return lkm;
 766
 767 error:
 768         free(lkm);
 769         free(chan);
 770         return nullptr;
 771 }
 772
 773 /*
 774  * Allocate and initialize a kernel stream. The stream is set to ACTIVE_FD by
 775  * default.
 776  *
 777  * Return pointer to structure or NULL.
 778  */
 779 struct ltt_kernel_stream *trace_kernel_create_stream(const char *name, unsigned int count)
 780 {
 781         int ret;
 782         struct ltt_kernel_stream *lks;
 783
 784         LTTNG_ASSERT(name);
 785
 786         lks = zmalloc<ltt_kernel_stream>();
 787         if (lks == nullptr) {
 788                 PERROR("kernel stream zmalloc");
 789                 goto error;
 790         }
 791
 792         /* Set name */
 793         ret = snprintf(lks->name, sizeof(lks->name), "%s_%u", name, count);
 794         if (ret < 0) {
 795                 PERROR("snprintf stream name");
 796                 goto error;
 797         }
 798         lks->name[sizeof(lks->name) - 1] = '\0';
 799
 800         /* Init stream */
 801         lks->fd = -1;
 802         lks->state = 0;
 803         lks->cpu = count;
 804
 805         return lks;
 806
 807 error:
 808         return nullptr;
 809 }
 810
 811 /*
 812  * Cleanup kernel stream structure.
 813  */
 814 void trace_kernel_destroy_stream(struct ltt_kernel_stream *stream)
 815 {
 816         LTTNG_ASSERT(stream);
 817
 818         DBG("[trace] Closing stream fd %d", stream->fd);
 819         /* Close kernel fd */
 820         if (stream->fd >= 0) {
 821                 int ret;
 822
 823                 ret = close(stream->fd);
 824                 if (ret) {
 825                         PERROR("close");
 826                 }
 827         }
 828         /* Remove from stream list */
 829         cds_list_del(&stream->list);
 830
 831         free(stream);
 832 }
 833
 834 /*
 835  * Cleanup kernel event structure.
 836  */
 837 void trace_kernel_destroy_event(struct ltt_kernel_event *event)
 838 {
 839         LTTNG_ASSERT(event);
 840
 841         if (event->fd >= 0) {
 842                 int ret;
 843
 844                 DBG("[trace] Closing event fd %d", event->fd);
 845                 /* Close kernel fd */
 846                 ret = close(event->fd);
 847                 if (ret) {
 848                         PERROR("close");
 849                 }
 850         } else {
 851                 DBG("[trace] Tearing down event (no associated file descriptor)");
 852         }
 853
 854         /* Remove from event list */
 855         cds_list_del(&event->list);
 856
 857         free(event->filter_expression);
 858         free(event->filter);
 859
 860         free(event->event);
 861         free(event);
 862 }
 863
 864 /*
 865  * Cleanup kernel event structure.
 866  */
 867 static void free_token_event_rule_rcu(struct rcu_head *rcu_node)
 868 {
 869         struct ltt_kernel_event_notifier_rule *rule =
 870                 caa_container_of(rcu_node, struct ltt_kernel_event_notifier_rule, rcu_node);
 871
 872         free(rule);
 873 }
 874
 875 void trace_kernel_destroy_event_notifier_rule(struct ltt_kernel_event_notifier_rule *event)
 876 {
 877         LTTNG_ASSERT(event);
 878
 879         if (event->fd >= 0) {
 880                 const int ret = close(event->fd);
 881
 882                 DBG("Closing kernel event notifier rule file descriptor: fd = %d", event->fd);
 883                 if (ret) {
 884                         PERROR("Failed to close kernel event notifier file descriptor: fd = %d",
 885                                event->fd);
 886                 }
 887         } else {
 888                 DBG("Destroying kernel event notifier rule (no associated file descriptor)");
 889         }
 890
 891         lttng_trigger_put(event->trigger);
 892         call_rcu(&event->rcu_node, free_token_event_rule_rcu);
 893 }
 894 /*
 895  * Cleanup kernel context structure.
 896  */
 897 void trace_kernel_destroy_context(struct ltt_kernel_context *ctx)
 898 {
 899         LTTNG_ASSERT(ctx);
 900
 901         if (ctx->in_list) {
 902                 cds_list_del(&ctx->list);
 903         }
 904         free(ctx);
 905 }
 906
 907 /*
 908  * Cleanup kernel channel structure.
 909  */
 910 void trace_kernel_destroy_channel(struct ltt_kernel_channel *channel)
 911 {
 912         struct ltt_kernel_stream *stream, *stmp;
 913         struct ltt_kernel_event *event, *etmp;
 914         struct ltt_kernel_context *ctx, *ctmp;
 915         int ret;
 916         enum lttng_error_code status;
 917
 918         LTTNG_ASSERT(channel);
 919
 920         DBG("[trace] Closing channel fd %d", channel->fd);
 921         /* Close kernel fd */
 922         if (channel->fd >= 0) {
 923                 ret = close(channel->fd);
 924                 if (ret) {
 925                         PERROR("close");
 926                 }
 927         }
 928
 929         /* For each stream in the channel list */
 930         cds_list_for_each_entry_safe (stream, stmp, &channel->stream_list.head, list) {
 931                 trace_kernel_destroy_stream(stream);
 932         }
 933
 934         /* For each event in the channel list */
 935         cds_list_for_each_entry_safe (event, etmp, &channel->events_list.head, list) {
 936                 trace_kernel_destroy_event(event);
 937         }
 938
 939         /* For each context in the channel list */
 940         cds_list_for_each_entry_safe (ctx, ctmp, &channel->ctx_list, list) {
 941                 trace_kernel_destroy_context(ctx);
 942         }
 943
 944         /* Remove from channel list */
 945         cds_list_del(&channel->list);
 946
 947         if (the_notification_thread_handle && channel->published_to_notification_thread) {
 948                 status = notification_thread_command_remove_channel(
 949                         the_notification_thread_handle, channel->key, LTTNG_DOMAIN_KERNEL);
 950                 LTTNG_ASSERT(status == LTTNG_OK);
 951         }
 952         free(channel->channel->attr.extended.ptr);
 953         free(channel->channel);
 954         free(channel);
 955 }
 956
 957 /*
 958  * Cleanup kernel metadata structure.
 959  */
 960 void trace_kernel_destroy_metadata(struct ltt_kernel_metadata *metadata)
 961 {
 962         LTTNG_ASSERT(metadata);
 963
 964         DBG("[trace] Closing metadata fd %d", metadata->fd);
 965         /* Close kernel fd */
 966         if (metadata->fd >= 0) {
 967                 int ret;
 968
 969                 ret = close(metadata->fd);
 970                 if (ret) {
 971                         PERROR("close");
 972                 }
 973         }
 974
 975         free(metadata->conf);
 976         free(metadata);
 977 }
 978
 979 /*
 980  * Cleanup kernel session structure
 981  */
 982 void trace_kernel_destroy_session(struct ltt_kernel_session *session)
 983 {
 984         struct ltt_kernel_channel *channel, *ctmp;
 985         int ret;
 986
 987         LTTNG_ASSERT(session);
 988
 989         DBG("[trace] Closing session fd %d", session->fd);
 990         /* Close kernel fds */
 991         if (session->fd >= 0) {
 992                 ret = close(session->fd);
 993                 if (ret) {
 994                         PERROR("close");
 995                 }
 996         }
 997
 998         if (session->metadata_stream_fd >= 0) {
 999                 DBG("[trace] Closing metadata stream fd %d", session->metadata_stream_fd);
1000                 ret = close(session->metadata_stream_fd);
1001                 if (ret) {
1002                         PERROR("close");
1003                 }
1004         }
1005
1006         if (session->metadata != nullptr) {
1007                 trace_kernel_destroy_metadata(session->metadata);
1008         }
1009
1010         cds_list_for_each_entry_safe (channel, ctmp, &session->channel_list.head, list) {
1011                 trace_kernel_destroy_channel(channel);
1012         }
1013 }
1014
1015 /* Free elements needed by destroy notifiers. */
1016 void trace_kernel_free_session(struct ltt_kernel_session *session)
1017 {
1018         /* Wipe consumer output object */
1019         consumer_output_put(session->consumer);
1020
1021         process_attr_tracker_destroy(session->tracker_pid);
1022         process_attr_tracker_destroy(session->tracker_vpid);
1023         process_attr_tracker_destroy(session->tracker_uid);
1024         process_attr_tracker_destroy(session->tracker_vuid);
1025         process_attr_tracker_destroy(session->tracker_gid);
1026         process_attr_tracker_destroy(session->tracker_vgid);
1027
1028         free(session);
1029 }