linux-kernel - Re: [PATCH 0/3] tracing/filters: new event parser

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Tue, 28 Apr 2009 11:50:39 -0400 (EDT)
From:	Steven Rostedt <rostedt@...dmis.org>
To:	Tom Zanussi <tzanussi@...il.com>
cc:	LKML <linux-kernel@...r.kernel.org>, Ingo Molnar <mingo@...e.hu>,
	Frederic Weisbecker <fweisbec@...il.com>,
	Li Zefan <lizf@...fujitsu.com>
Subject: Re: [PATCH 0/3] tracing/filters: new event parser


On Tue, 28 Apr 2009, Tom Zanussi wrote:

> This patchset replaces the current event parser hack with a better, more
> extensible version.  See patch 3 for the details on syntax and usage.  
> 
> Basically, instead of defining a filter predicate by predicate as in the
> current version, you now define the whole thing all at once and in
> addition to the current == and != operators, can use >, <, >=, <=,
> parens and the logical operators && and ||.  Some examples:
> 
> # echo "((sig >= 10 && sig < 15) || sig == 17) && comm != bash" > filter
> 
> # echo "common_preempt_count > 4" > filter
> 
> # echo "common_preempt_count > 4 && common_pid != 0" > filter
> 
> It also does some basic error reporting, which you can see by cat'ing
> the filter file after a failed set (this needs a little more work to
> report the error position, but is still useful):
> 
> # echo "(sig >= 10 && sig < 15) || dsig == 17) && comm != bash" > filter
> -bash: echo: write error: Invalid argument
> # cat filter
> (sig >= 10 && sig < 15) || dsig == 17) && comm != bash
> ^
> parse_error: Unbalanced parens
> 
> It should be relatively easy to add new operators; it's implemented as a
> standard infix to postfix converter - when a filter is defined, as
> before, it creates a set of predicates that are evaluated efficiently at
> run-time.
> 
> I tried to make the parser itself reusable so that it could also be
> pointed at a completely separate set of operators and an unevaluated
> operand, with the resulting expression components available in the
> intermediate postfix list. e.g. for say a field of type dev_t, the
> parser could be set up and pointed at an operand of the form (8,3) or
> 8:3 or /dev/sda, and the parsed results retrieved from the parse state
> object, something like this:
> 
> enum kdev_t_filter_op_ids
> {
>        COMMA_OP,
> }; 
> 
> struct filter_op kdev_t_filter_ops[] = {
>        { COMMA_OP, ",", 1 },
>        { NO_OP, "NO_OP", 0 },
>        { OPEN_PAREN_OP, "(", 0 },
> };
> 
> parse_init(parse_state, kdev_t_filter_ops, dev_string);
> filter_parse(parse_state);
> 
> The parsed operator and operands could then be found in the
> parse_state.postfix list and used to generate the dev_t value, or if it
> was specified as a string ('sda' or /dev/sda), there would only be one
> item in the list which could be used in that case to look up the value.
> 

Hi Tom,

Cool stuff. I just skimmed the patches and did not see anything 
I object to.

Acked-by: Steven Rostedt <rostedt@...dmis.org>

-- Steve


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/