tools/lib/traceevent/parse-filter.c

   1 /*
   2  * Copyright (C) 2010 Red Hat Inc, Steven Rostedt <srostedt@redhat.com>
   3  *
   4  * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   5  * This program is free software; you can redistribute it and/or
   6  * modify it under the terms of the GNU Lesser General Public
   7  * License as published by the Free Software Foundation;
   8  * version 2.1 of the License (not later!)
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  * GNU Lesser General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU Lesser General Public
  16  * License along with this program; if not,  see <http://www.gnu.org/licenses>
  17  *
  18  * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  19  */
  20 #include <stdio.h>
  21 #include <stdlib.h>
  22 #include <string.h>
  23 #include <stdarg.h>
  24 #include <errno.h>
  25 #include <sys/types.h>
  26
  27 #include "event-parse.h"
  28 #include "event-utils.h"
  29
  30 #define COMM "COMM"
  31
  32 static struct format_field comm = {
  33         .name = "COMM",
  34 };
  35
  36 struct event_list {
  37         struct event_list       *next;
  38         struct event_format     *event;
  39 };
  40
  41 #define MAX_ERR_STR_SIZE 256
  42
  43 static void show_error(char **error_str, const char *fmt, ...)
  44 {
  45         unsigned long long index;
  46         const char *input;
  47         char *error;
  48         va_list ap;
  49         int len;
  50         int i;
  51
  52         if (!error_str)
  53                 return;
  54
  55         input = pevent_get_input_buf();
  56         index = pevent_get_input_buf_ptr();
  57         len = input ? strlen(input) : 0;
  58
  59         error = malloc_or_die(MAX_ERR_STR_SIZE + (len*2) + 3);
  60
  61         if (len) {
  62                 strcpy(error, input);
  63                 error[len] = '\n';
  64                 for (i = 1; i < len && i < index; i++)
  65                         error[len+i] = ' ';
  66                 error[len + i] = '^';
  67                 error[len + i + 1] = '\n';
  68                 len += i+2;
  69         }
  70
  71         va_start(ap, fmt);
  72         vsnprintf(error + len, MAX_ERR_STR_SIZE, fmt, ap);
  73         va_end(ap);
  74
  75         *error_str = error;
  76 }
  77
  78 static void free_token(char *token)
  79 {
  80         pevent_free_token(token);
  81 }
  82
  83 static enum event_type read_token(char **tok)
  84 {
  85         enum event_type type;
  86         char *token = NULL;
  87
  88         do {
  89                 free_token(token);
  90                 type = pevent_read_token(&token);
  91         } while (type == EVENT_NEWLINE || type == EVENT_SPACE);
  92
  93         /* If token is = or ! check to see if the next char is ~ */
  94         if (token &&
  95             (strcmp(token, "=") == 0 || strcmp(token, "!") == 0) &&
  96             pevent_peek_char() == '~') {
  97                 /* append it */
  98                 *tok = malloc_or_die(3);
  99                 sprintf(*tok, "%c%c", *token, '~');
 100                 free_token(token);
 101                 /* Now remove the '~' from the buffer */
 102                 pevent_read_token(&token);
 103                 free_token(token);
 104         } else
 105                 *tok = token;
 106
 107         return type;
 108 }
 109
 110 static int filter_cmp(const void *a, const void *b)
 111 {
 112         const struct filter_type *ea = a;
 113         const struct filter_type *eb = b;
 114
 115         if (ea->event_id < eb->event_id)
 116                 return -1;
 117
 118         if (ea->event_id > eb->event_id)
 119                 return 1;
 120
 121         return 0;
 122 }
 123
 124 static struct filter_type *
 125 find_filter_type(struct event_filter *filter, int id)
 126 {
 127         struct filter_type *filter_type;
 128         struct filter_type key;
 129
 130         key.event_id = id;
 131
 132         filter_type = bsearch(&key, filter->event_filters,
 133                               filter->filters,
 134                               sizeof(*filter->event_filters),
 135                               filter_cmp);
 136
 137         return filter_type;
 138 }
 139
 140 static struct filter_type *
 141 add_filter_type(struct event_filter *filter, int id)
 142 {
 143         struct filter_type *filter_type;
 144         int i;
 145
 146         filter_type = find_filter_type(filter, id);
 147         if (filter_type)
 148                 return filter_type;
 149
 150         filter->event_filters = realloc(filter->event_filters,
 151                                         sizeof(*filter->event_filters) *
 152                                         (filter->filters + 1));
 153         if (!filter->event_filters)
 154                 die("Could not allocate filter");
 155
 156         for (i = 0; i < filter->filters; i++) {
 157                 if (filter->event_filters[i].event_id > id)
 158                         break;
 159         }
 160
 161         if (i < filter->filters)
 162                 memmove(&filter->event_filters[i+1],
 163                         &filter->event_filters[i],
 164                         sizeof(*filter->event_filters) *
 165                         (filter->filters - i));
 166
 167         filter_type = &filter->event_filters[i];
 168         filter_type->event_id = id;
 169         filter_type->event = pevent_find_event(filter->pevent, id);
 170         filter_type->filter = NULL;
 171
 172         filter->filters++;
 173
 174         return filter_type;
 175 }
 176
 177 /**
 178  * pevent_filter_alloc - create a new event filter
 179  * @pevent: The pevent that this filter is associated with
 180  */
 181 struct event_filter *pevent_filter_alloc(struct pevent *pevent)
 182 {
 183         struct event_filter *filter;
 184
 185         filter = malloc_or_die(sizeof(*filter));
 186         memset(filter, 0, sizeof(*filter));
 187         filter->pevent = pevent;
 188         pevent_ref(pevent);
 189
 190         return filter;
 191 }
 192
 193 static struct filter_arg *allocate_arg(void)
 194 {
 195         struct filter_arg *arg;
 196
 197         arg = malloc_or_die(sizeof(*arg));
 198         memset(arg, 0, sizeof(*arg));
 199
 200         return arg;
 201 }
 202
 203 static void free_arg(struct filter_arg *arg)
 204 {
 205         if (!arg)
 206                 return;
 207
 208         switch (arg->type) {
 209         case FILTER_ARG_NONE:
 210         case FILTER_ARG_BOOLEAN:
 211                 break;
 212
 213         case FILTER_ARG_NUM:
 214                 free_arg(arg->num.left);
 215                 free_arg(arg->num.right);
 216                 break;
 217
 218         case FILTER_ARG_EXP:
 219                 free_arg(arg->exp.left);
 220                 free_arg(arg->exp.right);
 221                 break;
 222
 223         case FILTER_ARG_STR:
 224                 free(arg->str.val);
 225                 regfree(&arg->str.reg);
 226                 free(arg->str.buffer);
 227                 break;
 228
 229         case FILTER_ARG_VALUE:
 230                 if (arg->value.type == FILTER_STRING ||
 231                     arg->value.type == FILTER_CHAR)
 232                         free(arg->value.str);
 233                 break;
 234
 235         case FILTER_ARG_OP:
 236                 free_arg(arg->op.left);
 237                 free_arg(arg->op.right);
 238         default:
 239                 break;
 240         }
 241
 242         free(arg);
 243 }
 244
 245 static void add_event(struct event_list **events,
 246                       struct event_format *event)
 247 {
 248         struct event_list *list;
 249
 250         list = malloc_or_die(sizeof(*list));
 251         list->next = *events;
 252         *events = list;
 253         list->event = event;
 254 }
 255
 256 static int event_match(struct event_format *event,
 257                        regex_t *sreg, regex_t *ereg)
 258 {
 259         if (sreg) {
 260                 return !regexec(sreg, event->system, 0, NULL, 0) &&
 261                         !regexec(ereg, event->name, 0, NULL, 0);
 262         }
 263
 264         return !regexec(ereg, event->system, 0, NULL, 0) ||
 265                 !regexec(ereg, event->name, 0, NULL, 0);
 266 }
 267
 268 static int
 269 find_event(struct pevent *pevent, struct event_list **events,
 270            char *sys_name, char *event_name)
 271 {
 272         struct event_format *event;
 273         regex_t ereg;
 274         regex_t sreg;
 275         int match = 0;
 276         char *reg;
 277         int ret;
 278         int i;
 279
 280         if (!event_name) {
 281                 /* if no name is given, then swap sys and name */
 282                 event_name = sys_name;
 283                 sys_name = NULL;
 284         }
 285
 286         reg = malloc_or_die(strlen(event_name) + 3);
 287         sprintf(reg, "^%s$", event_name);
 288
 289         ret = regcomp(&ereg, reg, REG_ICASE|REG_NOSUB);
 290         free(reg);
 291
 292         if (ret)
 293                 return -1;
 294
 295         if (sys_name) {
 296                 reg = malloc_or_die(strlen(sys_name) + 3);
 297                 sprintf(reg, "^%s$", sys_name);
 298                 ret = regcomp(&sreg, reg, REG_ICASE|REG_NOSUB);
 299                 free(reg);
 300                 if (ret) {
 301                         regfree(&ereg);
 302                         return -1;
 303                 }
 304         }
 305
 306         for (i = 0; i < pevent->nr_events; i++) {
 307                 event = pevent->events[i];
 308                 if (event_match(event, sys_name ? &sreg : NULL, &ereg)) {
 309                         match = 1;
 310                         add_event(events, event);
 311                 }
 312         }
 313
 314         regfree(&ereg);
 315         if (sys_name)
 316                 regfree(&sreg);
 317
 318         if (!match)
 319                 return -1;
 320
 321         return 0;
 322 }
 323
 324 static void free_events(struct event_list *events)
 325 {
 326         struct event_list *event;
 327
 328         while (events) {
 329                 event = events;
 330                 events = events->next;
 331                 free(event);
 332         }
 333 }
 334
 335 static struct filter_arg *
 336 create_arg_item(struct event_format *event, const char *token,
 337                 enum event_type type, char **error_str)
 338 {
 339         struct format_field *field;
 340         struct filter_arg *arg;
 341
 342         arg = allocate_arg();
 343
 344         switch (type) {
 345
 346         case EVENT_SQUOTE:
 347         case EVENT_DQUOTE:
 348                 arg->type = FILTER_ARG_VALUE;
 349                 arg->value.type =
 350                         type == EVENT_DQUOTE ? FILTER_STRING : FILTER_CHAR;
 351                 arg->value.str = strdup(token);
 352                 if (!arg->value.str)
 353                         die("malloc string");
 354                 break;
 355         case EVENT_ITEM:
 356                 /* if it is a number, then convert it */
 357                 if (isdigit(token[0])) {
 358                         arg->type = FILTER_ARG_VALUE;
 359                         arg->value.type = FILTER_NUMBER;
 360                         arg->value.val = strtoull(token, NULL, 0);
 361                         break;
 362                 }
 363                 /* Consider this a field */
 364                 field = pevent_find_any_field(event, token);
 365                 if (!field) {
 366                         if (strcmp(token, COMM) != 0) {
 367                                 /* not a field, Make it false */
 368                                 arg->type = FILTER_ARG_BOOLEAN;
 369                                 arg->boolean.value = FILTER_FALSE;
 370                                 break;
 371                         }
 372                         /* If token is 'COMM' then it is special */
 373                         field = &comm;
 374                 }
 375                 arg->type = FILTER_ARG_FIELD;
 376                 arg->field.field = field;
 377                 break;
 378         default:
 379                 free_arg(arg);
 380                 show_error(error_str, "expected a value but found %s",
 381                            token);
 382                 return NULL;
 383         }
 384         return arg;
 385 }
 386
 387 static struct filter_arg *
 388 create_arg_op(enum filter_op_type btype)
 389 {
 390         struct filter_arg *arg;
 391
 392         arg = allocate_arg();
 393         arg->type = FILTER_ARG_OP;
 394         arg->op.type = btype;
 395
 396         return arg;
 397 }
 398
 399 static struct filter_arg *
 400 create_arg_exp(enum filter_exp_type etype)
 401 {
 402         struct filter_arg *arg;
 403
 404         arg = allocate_arg();
 405         arg->type = FILTER_ARG_EXP;
 406         arg->op.type = etype;
 407
 408         return arg;
 409 }
 410
 411 static struct filter_arg *
 412 create_arg_cmp(enum filter_exp_type etype)
 413 {
 414         struct filter_arg *arg;
 415
 416         arg = allocate_arg();
 417         /* Use NUM and change if necessary */
 418         arg->type = FILTER_ARG_NUM;
 419         arg->op.type = etype;
 420
 421         return arg;
 422 }
 423
 424 static int add_right(struct filter_arg *op, struct filter_arg *arg,
 425                      char **error_str)
 426 {
 427         struct filter_arg *left;
 428         char *str;
 429         int op_type;
 430         int ret;
 431
 432         switch (op->type) {
 433         case FILTER_ARG_EXP:
 434                 if (op->exp.right)
 435                         goto out_fail;
 436                 op->exp.right = arg;
 437                 break;
 438
 439         case FILTER_ARG_OP:
 440                 if (op->op.right)
 441                         goto out_fail;
 442                 op->op.right = arg;
 443                 break;
 444
 445         case FILTER_ARG_NUM:
 446                 if (op->op.right)
 447                         goto out_fail;
 448                 /*
 449                  * The arg must be num, str, or field
 450                  */
 451                 switch (arg->type) {
 452                 case FILTER_ARG_VALUE:
 453                 case FILTER_ARG_FIELD:
 454                         break;
 455                 default:
 456                         show_error(error_str,
 457                                    "Illegal rvalue");
 458                         return -1;
 459                 }
 460
 461                 /*
 462                  * Depending on the type, we may need to
 463                  * convert this to a string or regex.
 464                  */
 465                 switch (arg->value.type) {
 466                 case FILTER_CHAR:
 467                         /*
 468                          * A char should be converted to number if
 469                          * the string is 1 byte, and the compare
 470                          * is not a REGEX.
 471                          */
 472                         if (strlen(arg->value.str) == 1 &&
 473                             op->num.type != FILTER_CMP_REGEX &&
 474                             op->num.type != FILTER_CMP_NOT_REGEX) {
 475                                 arg->value.type = FILTER_NUMBER;
 476                                 goto do_int;
 477                         }
 478                         /* fall through */
 479                 case FILTER_STRING:
 480
 481                         /* convert op to a string arg */
 482                         op_type = op->num.type;
 483                         left = op->num.left;
 484                         str = arg->value.str;
 485
 486                         /* reset the op for the new field */
 487                         memset(op, 0, sizeof(*op));
 488
 489                         /*
 490                          * If left arg was a field not found then
 491                          * NULL the entire op.
 492                          */
 493                         if (left->type == FILTER_ARG_BOOLEAN) {
 494                                 free_arg(left);
 495                                 free_arg(arg);
 496                                 op->type = FILTER_ARG_BOOLEAN;
 497                                 op->boolean.value = FILTER_FALSE;
 498                                 break;
 499                         }
 500
 501                         /* Left arg must be a field */
 502                         if (left->type != FILTER_ARG_FIELD) {
 503                                 show_error(error_str,
 504                                            "Illegal lvalue for string comparison");
 505                                 return -1;
 506                         }
 507
 508                         /* Make sure this is a valid string compare */
 509                         switch (op_type) {
 510                         case FILTER_CMP_EQ:
 511                                 op_type = FILTER_CMP_MATCH;
 512                                 break;
 513                         case FILTER_CMP_NE:
 514                                 op_type = FILTER_CMP_NOT_MATCH;
 515                                 break;
 516
 517                         case FILTER_CMP_REGEX:
 518                         case FILTER_CMP_NOT_REGEX:
 519                                 ret = regcomp(&op->str.reg, str, REG_ICASE|REG_NOSUB);
 520                                 if (ret) {
 521                                         show_error(error_str,
 522                                                    "RegEx '%s' did not compute",
 523                                                    str);
 524                                         return -1;
 525                                 }
 526                                 break;
 527                         default:
 528                                 show_error(error_str,
 529                                            "Illegal comparison for string");
 530                                 return -1;
 531                         }
 532
 533                         op->type = FILTER_ARG_STR;
 534                         op->str.type = op_type;
 535                         op->str.field = left->field.field;
 536                         op->str.val = strdup(str);
 537                         if (!op->str.val)
 538                                 die("malloc string");
 539                         /*
 540                          * Need a buffer to copy data for tests
 541                          */
 542                         op->str.buffer = malloc_or_die(op->str.field->size + 1);
 543                         /* Null terminate this buffer */
 544                         op->str.buffer[op->str.field->size] = 0;
 545
 546                         /* We no longer have left or right args */
 547                         free_arg(arg);
 548                         free_arg(left);
 549
 550                         break;
 551
 552                 case FILTER_NUMBER:
 553
 554  do_int:
 555                         switch (op->num.type) {
 556                         case FILTER_CMP_REGEX:
 557                         case FILTER_CMP_NOT_REGEX:
 558                                 show_error(error_str,
 559                                            "Op not allowed with integers");
 560                                 return -1;
 561
 562                         default:
 563                                 break;
 564                         }
 565
 566                         /* numeric compare */
 567                         op->num.right = arg;
 568                         break;
 569                 default:
 570                         goto out_fail;
 571                 }
 572                 break;
 573         default:
 574                 goto out_fail;
 575         }
 576
 577         return 0;
 578
 579  out_fail:
 580         show_error(error_str,
 581                    "Syntax error");
 582         return -1;
 583 }
 584
 585 static struct filter_arg *
 586 rotate_op_right(struct filter_arg *a, struct filter_arg *b)
 587 {
 588         struct filter_arg *arg;
 589
 590         arg = a->op.right;
 591         a->op.right = b;
 592         return arg;
 593 }
 594
 595 static int add_left(struct filter_arg *op, struct filter_arg *arg)
 596 {
 597         switch (op->type) {
 598         case FILTER_ARG_EXP:
 599                 if (arg->type == FILTER_ARG_OP)
 600                         arg = rotate_op_right(arg, op);
 601                 op->exp.left = arg;
 602                 break;
 603
 604         case FILTER_ARG_OP:
 605                 op->op.left = arg;
 606                 break;
 607         case FILTER_ARG_NUM:
 608                 if (arg->type == FILTER_ARG_OP)
 609                         arg = rotate_op_right(arg, op);
 610
 611                 /* left arg of compares must be a field */
 612                 if (arg->type != FILTER_ARG_FIELD &&
 613                     arg->type != FILTER_ARG_BOOLEAN)
 614                         return -1;
 615                 op->num.left = arg;
 616                 break;
 617         default:
 618                 return -1;
 619         }
 620         return 0;
 621 }
 622
 623 enum op_type {
 624         OP_NONE,
 625         OP_BOOL,
 626         OP_NOT,
 627         OP_EXP,
 628         OP_CMP,
 629 };
 630
 631 static enum op_type process_op(const char *token,
 632                                enum filter_op_type *btype,
 633                                enum filter_cmp_type *ctype,
 634                                enum filter_exp_type *etype)
 635 {
 636         *btype = FILTER_OP_NOT;
 637         *etype = FILTER_EXP_NONE;
 638         *ctype = FILTER_CMP_NONE;
 639
 640         if (strcmp(token, "&&") == 0)
 641                 *btype = FILTER_OP_AND;
 642         else if (strcmp(token, "||") == 0)
 643                 *btype = FILTER_OP_OR;
 644         else if (strcmp(token, "!") == 0)
 645                 return OP_NOT;
 646
 647         if (*btype != FILTER_OP_NOT)
 648                 return OP_BOOL;
 649
 650         /* Check for value expressions */
 651         if (strcmp(token, "+") == 0) {
 652                 *etype = FILTER_EXP_ADD;
 653         } else if (strcmp(token, "-") == 0) {
 654                 *etype = FILTER_EXP_SUB;
 655         } else if (strcmp(token, "*") == 0) {
 656                 *etype = FILTER_EXP_MUL;
 657         } else if (strcmp(token, "/") == 0) {
 658                 *etype = FILTER_EXP_DIV;
 659         } else if (strcmp(token, "%") == 0) {
 660                 *etype = FILTER_EXP_MOD;
 661         } else if (strcmp(token, ">>") == 0) {
 662                 *etype = FILTER_EXP_RSHIFT;
 663         } else if (strcmp(token, "<<") == 0) {
 664                 *etype = FILTER_EXP_LSHIFT;
 665         } else if (strcmp(token, "&") == 0) {
 666                 *etype = FILTER_EXP_AND;
 667         } else if (strcmp(token, "|") == 0) {
 668                 *etype = FILTER_EXP_OR;
 669         } else if (strcmp(token, "^") == 0) {
 670                 *etype = FILTER_EXP_XOR;
 671         } else if (strcmp(token, "~") == 0)
 672                 *etype = FILTER_EXP_NOT;
 673
 674         if (*etype != FILTER_EXP_NONE)
 675                 return OP_EXP;
 676
 677         /* Check for compares */
 678         if (strcmp(token, "==") == 0)
 679                 *ctype = FILTER_CMP_EQ;
 680         else if (strcmp(token, "!=") == 0)
 681                 *ctype = FILTER_CMP_NE;
 682         else if (strcmp(token, "<") == 0)
 683                 *ctype = FILTER_CMP_LT;
 684         else if (strcmp(token, ">") == 0)
 685                 *ctype = FILTER_CMP_GT;
 686         else if (strcmp(token, "<=") == 0)
 687                 *ctype = FILTER_CMP_LE;
 688         else if (strcmp(token, ">=") == 0)
 689                 *ctype = FILTER_CMP_GE;
 690         else if (strcmp(token, "=~") == 0)
 691                 *ctype = FILTER_CMP_REGEX;
 692         else if (strcmp(token, "!~") == 0)
 693                 *ctype = FILTER_CMP_NOT_REGEX;
 694         else
 695                 return OP_NONE;
 696
 697         return OP_CMP;
 698 }
 699
 700 static int check_op_done(struct filter_arg *arg)
 701 {
 702         switch (arg->type) {
 703         case FILTER_ARG_EXP:
 704                 return arg->exp.right != NULL;
 705
 706         case FILTER_ARG_OP:
 707                 return arg->op.right != NULL;
 708
 709         case FILTER_ARG_NUM:
 710                 return arg->num.right != NULL;
 711
 712         case FILTER_ARG_STR:
 713                 /* A string conversion is always done */
 714                 return 1;
 715
 716         case FILTER_ARG_BOOLEAN:
 717                 /* field not found, is ok */
 718                 return 1;
 719
 720         default:
 721                 return 0;
 722         }
 723 }
 724
 725 enum filter_vals {
 726         FILTER_VAL_NORM,
 727         FILTER_VAL_FALSE,
 728         FILTER_VAL_TRUE,
 729 };
 730
 731 void reparent_op_arg(struct filter_arg *parent, struct filter_arg *old_child,
 732                   struct filter_arg *arg)
 733 {
 734         struct filter_arg *other_child;
 735         struct filter_arg **ptr;
 736
 737         if (parent->type != FILTER_ARG_OP &&
 738             arg->type != FILTER_ARG_OP)
 739                 die("can not reparent other than OP");
 740
 741         /* Get the sibling */
 742         if (old_child->op.right == arg) {
 743                 ptr = &old_child->op.right;
 744                 other_child = old_child->op.left;
 745         } else if (old_child->op.left == arg) {
 746                 ptr = &old_child->op.left;
 747                 other_child = old_child->op.right;
 748         } else
 749                 die("Error in reparent op, find other child");
 750
 751         /* Detach arg from old_child */
 752         *ptr = NULL;
 753
 754         /* Check for root */
 755         if (parent == old_child) {
 756                 free_arg(other_child);
 757                 *parent = *arg;
 758                 /* Free arg without recussion */
 759                 free(arg);
 760                 return;
 761         }
 762
 763         if (parent->op.right == old_child)
 764                 ptr = &parent->op.right;
 765         else if (parent->op.left == old_child)
 766                 ptr = &parent->op.left;
 767         else
 768                 die("Error in reparent op");
 769         *ptr = arg;
 770
 771         free_arg(old_child);
 772 }
 773
 774 enum filter_vals test_arg(struct filter_arg *parent, struct filter_arg *arg)
 775 {
 776         enum filter_vals lval, rval;
 777
 778         switch (arg->type) {
 779
 780                 /* bad case */
 781         case FILTER_ARG_BOOLEAN:
 782                 return FILTER_VAL_FALSE + arg->boolean.value;
 783
 784                 /* good cases: */
 785         case FILTER_ARG_STR:
 786         case FILTER_ARG_VALUE:
 787         case FILTER_ARG_FIELD:
 788                 return FILTER_VAL_NORM;
 789
 790         case FILTER_ARG_EXP:
 791                 lval = test_arg(arg, arg->exp.left);
 792                 if (lval != FILTER_VAL_NORM)
 793                         return lval;
 794                 rval = test_arg(arg, arg->exp.right);
 795                 if (rval != FILTER_VAL_NORM)
 796                         return rval;
 797                 return FILTER_VAL_NORM;
 798
 799         case FILTER_ARG_NUM:
 800                 lval = test_arg(arg, arg->num.left);
 801                 if (lval != FILTER_VAL_NORM)
 802                         return lval;
 803                 rval = test_arg(arg, arg->num.right);
 804                 if (rval != FILTER_VAL_NORM)
 805                         return rval;
 806                 return FILTER_VAL_NORM;
 807
 808         case FILTER_ARG_OP:
 809                 if (arg->op.type != FILTER_OP_NOT) {
 810                         lval = test_arg(arg, arg->op.left);
 811                         switch (lval) {
 812                         case FILTER_VAL_NORM:
 813                                 break;
 814                         case FILTER_VAL_TRUE:
 815                                 if (arg->op.type == FILTER_OP_OR)
 816                                         return FILTER_VAL_TRUE;
 817                                 rval = test_arg(arg, arg->op.right);
 818                                 if (rval != FILTER_VAL_NORM)
 819                                         return rval;
 820
 821                                 reparent_op_arg(parent, arg, arg->op.right);
 822                                 return FILTER_VAL_NORM;
 823
 824                         case FILTER_VAL_FALSE:
 825                                 if (arg->op.type == FILTER_OP_AND)
 826                                         return FILTER_VAL_FALSE;
 827                                 rval = test_arg(arg, arg->op.right);
 828                                 if (rval != FILTER_VAL_NORM)
 829                                         return rval;
 830
 831                                 reparent_op_arg(parent, arg, arg->op.right);
 832                                 return FILTER_VAL_NORM;
 833                         }
 834                 }
 835
 836                 rval = test_arg(arg, arg->op.right);
 837                 switch (rval) {
 838                 case FILTER_VAL_NORM:
 839                         break;
 840                 case FILTER_VAL_TRUE:
 841                         if (arg->op.type == FILTER_OP_OR)
 842                                 return FILTER_VAL_TRUE;
 843                         if (arg->op.type == FILTER_OP_NOT)
 844                                 return FILTER_VAL_FALSE;
 845
 846                         reparent_op_arg(parent, arg, arg->op.left);
 847                         return FILTER_VAL_NORM;
 848
 849                 case FILTER_VAL_FALSE:
 850                         if (arg->op.type == FILTER_OP_AND)
 851                                 return FILTER_VAL_FALSE;
 852                         if (arg->op.type == FILTER_OP_NOT)
 853                                 return FILTER_VAL_TRUE;
 854
 855                         reparent_op_arg(parent, arg, arg->op.left);
 856                         return FILTER_VAL_NORM;
 857                 }
 858
 859                 return FILTER_VAL_NORM;
 860         default:
 861                 die("bad arg in filter tree");
 862         }
 863         return FILTER_VAL_NORM;
 864 }
 865
 866 /* Remove any unknown event fields */
 867 static struct filter_arg *collapse_tree(struct filter_arg *arg)
 868 {
 869         enum filter_vals ret;
 870
 871         ret = test_arg(arg, arg);
 872         switch (ret) {
 873         case FILTER_VAL_NORM:
 874                 return arg;
 875
 876         case FILTER_VAL_TRUE:
 877         case FILTER_VAL_FALSE:
 878                 free_arg(arg);
 879                 arg = allocate_arg();
 880                 arg->type = FILTER_ARG_BOOLEAN;
 881                 arg->boolean.value = ret == FILTER_VAL_TRUE;
 882         }
 883
 884         return arg;
 885 }
 886
 887 static int
 888 process_filter(struct event_format *event, struct filter_arg **parg,
 889                char **error_str, int not)
 890 {
 891         enum event_type type;
 892         char *token = NULL;
 893         struct filter_arg *current_op = NULL;
 894         struct filter_arg *current_exp = NULL;
 895         struct filter_arg *left_item = NULL;
 896         struct filter_arg *arg = NULL;
 897         enum op_type op_type;
 898         enum filter_op_type btype;
 899         enum filter_exp_type etype;
 900         enum filter_cmp_type ctype;
 901         int ret;
 902
 903         *parg = NULL;
 904
 905         do {
 906                 free(token);
 907                 type = read_token(&token);
 908                 switch (type) {
 909                 case EVENT_SQUOTE:
 910                 case EVENT_DQUOTE:
 911                 case EVENT_ITEM:
 912                         arg = create_arg_item(event, token, type, error_str);
 913                         if (!arg)
 914                                 goto fail;
 915                         if (!left_item)
 916                                 left_item = arg;
 917                         else if (current_exp) {
 918                                 ret = add_right(current_exp, arg, error_str);
 919                                 if (ret < 0)
 920                                         goto fail;
 921                                 left_item = NULL;
 922                                 /* Not's only one one expression */
 923                                 if (not) {
 924                                         arg = NULL;
 925                                         if (current_op)
 926                                                 goto fail_print;
 927                                         free(token);
 928                                         *parg = current_exp;
 929                                         return 0;
 930                                 }
 931                         } else
 932                                 goto fail_print;
 933                         arg = NULL;
 934                         break;
 935
 936                 case EVENT_DELIM:
 937                         if (*token == ',') {
 938                                 show_error(error_str,
 939                                            "Illegal token ','");
 940                                 goto fail;
 941                         }
 942
 943                         if (*token == '(') {
 944                                 if (left_item) {
 945                                         show_error(error_str,
 946                                                    "Open paren can not come after item");
 947                                         goto fail;
 948                                 }
 949                                 if (current_exp) {
 950                                         show_error(error_str,
 951                                                    "Open paren can not come after expression");
 952                                         goto fail;
 953                                 }
 954
 955                                 ret = process_filter(event, &arg, error_str, 0);
 956                                 if (ret != 1) {
 957                                         if (ret == 0)
 958                                                 show_error(error_str,
 959                                                            "Unbalanced number of '('");
 960                                         goto fail;
 961                                 }
 962                                 ret = 0;
 963
 964                                 /* A not wants just one expression */
 965                                 if (not) {
 966                                         if (current_op)
 967                                                 goto fail_print;
 968                                         *parg = arg;
 969                                         return 0;
 970                                 }
 971
 972                                 if (current_op)
 973                                         ret = add_right(current_op, arg, error_str);
 974                                 else
 975                                         current_exp = arg;
 976
 977                                 if (ret < 0)
 978                                         goto fail;
 979
 980                         } else { /* ')' */
 981                                 if (!current_op && !current_exp)
 982                                         goto fail_print;
 983
 984                                 /* Make sure everything is finished at this level */
 985                                 if (current_exp && !check_op_done(current_exp))
 986                                         goto fail_print;
 987                                 if (current_op && !check_op_done(current_op))
 988                                         goto fail_print;
 989
 990                                 if (current_op)
 991                                         *parg = current_op;
 992                                 else
 993                                         *parg = current_exp;
 994                                 return 1;
 995                         }
 996                         break;
 997
 998                 case EVENT_OP:
 999                         op_type = process_op(token, &btype, &ctype, &etype);
1000
1001                         /* All expect a left arg except for NOT */
1002                         switch (op_type) {
1003                         case OP_BOOL:
1004                                 /* Logic ops need a left expression */
1005                                 if (!current_exp && !current_op)
1006                                         goto fail_print;
1007                                 /* fall through */
1008                         case OP_NOT:
1009                                 /* logic only processes ops and exp */
1010                                 if (left_item)
1011                                         goto fail_print;
1012                                 break;
1013                         case OP_EXP:
1014                         case OP_CMP:
1015                                 if (!left_item)
1016                                         goto fail_print;
1017                                 break;
1018                         case OP_NONE:
1019                                 show_error(error_str,
1020                                            "Unknown op token %s", token);
1021                                 goto fail;
1022                         }
1023
1024                         ret = 0;
1025                         switch (op_type) {
1026                         case OP_BOOL:
1027                                 arg = create_arg_op(btype);
1028                                 if (current_op)
1029                                         ret = add_left(arg, current_op);
1030                                 else
1031                                         ret = add_left(arg, current_exp);
1032                                 current_op = arg;
1033                                 current_exp = NULL;
1034                                 break;
1035
1036                         case OP_NOT:
1037                                 arg = create_arg_op(btype);
1038                                 if (current_op)
1039                                         ret = add_right(current_op, arg, error_str);
1040                                 if (ret < 0)
1041                                         goto fail;
1042                                 current_exp = arg;
1043                                 ret = process_filter(event, &arg, error_str, 1);
1044                                 if (ret < 0)
1045                                         goto fail;
1046                                 ret = add_right(current_exp, arg, error_str);
1047                                 if (ret < 0)
1048                                         goto fail;
1049                                 break;
1050
1051                         case OP_EXP:
1052                         case OP_CMP:
1053                                 if (op_type == OP_EXP)
1054                                         arg = create_arg_exp(etype);
1055                                 else
1056                                         arg = create_arg_cmp(ctype);
1057
1058                                 if (current_op)
1059                                         ret = add_right(current_op, arg, error_str);
1060                                 if (ret < 0)
1061                                         goto fail;
1062                                 ret = add_left(arg, left_item);
1063                                 if (ret < 0) {
1064                                         arg = NULL;
1065                                         goto fail_print;
1066                                 }
1067                                 current_exp = arg;
1068                                 break;
1069                         default:
1070                                 break;
1071                         }
1072                         arg = NULL;
1073                         if (ret < 0)
1074                                 goto fail_print;
1075                         break;
1076                 case EVENT_NONE:
1077                         break;
1078                 default:
1079                         goto fail_print;
1080                 }
1081         } while (type != EVENT_NONE);
1082
1083         if (!current_op && !current_exp)
1084                 goto fail_print;
1085
1086         if (!current_op)
1087                 current_op = current_exp;
1088
1089         current_op = collapse_tree(current_op);
1090
1091         *parg = current_op;
1092
1093         return 0;
1094
1095  fail_print:
1096         show_error(error_str, "Syntax error");
1097  fail:
1098         free_arg(current_op);
1099         free_arg(current_exp);
1100         free_arg(arg);
1101         free(token);
1102         return -1;
1103 }
1104
1105 static int
1106 process_event(struct event_format *event, const char *filter_str,
1107               struct filter_arg **parg, char **error_str)
1108 {
1109         int ret;
1110
1111         pevent_buffer_init(filter_str, strlen(filter_str));
1112
1113         ret = process_filter(event, parg, error_str, 0);
1114         if (ret == 1) {
1115                 show_error(error_str,
1116                            "Unbalanced number of ')'");
1117                 return -1;
1118         }
1119         if (ret < 0)
1120                 return ret;
1121
1122         /* If parg is NULL, then make it into FALSE */
1123         if (!*parg) {
1124                 *parg = allocate_arg();
1125                 (*parg)->type = FILTER_ARG_BOOLEAN;
1126                 (*parg)->boolean.value = FILTER_FALSE;
1127         }
1128
1129         return 0;
1130 }
1131
1132 static int filter_event(struct event_filter *filter,
1133                         struct event_format *event,
1134                         const char *filter_str, char **error_str)
1135 {
1136         struct filter_type *filter_type;
1137         struct filter_arg *arg;
1138         int ret;
1139
1140         if (filter_str) {
1141                 ret = process_event(event, filter_str, &arg, error_str);
1142                 if (ret < 0)
1143                         return ret;
1144
1145         } else {
1146                 /* just add a TRUE arg */
1147                 arg = allocate_arg();
1148                 arg->type = FILTER_ARG_BOOLEAN;
1149                 arg->boolean.value = FILTER_TRUE;
1150         }
1151
1152         filter_type = add_filter_type(filter, event->id);
1153         if (filter_type->filter)
1154                 free_arg(filter_type->filter);
1155         filter_type->filter = arg;
1156
1157         return 0;
1158 }
1159
1160 /**
1161  * pevent_filter_add_filter_str - add a new filter
1162  * @filter: the event filter to add to
1163  * @filter_str: the filter string that contains the filter
1164  * @error_str: string containing reason for failed filter
1165  *
1166  * Returns 0 if the filter was successfully added
1167  *   -1 if there was an error.
1168  *
1169  * On error, if @error_str points to a string pointer,
1170  * it is set to the reason that the filter failed.
1171  * This string must be freed with "free".
1172  */
1173 int pevent_filter_add_filter_str(struct event_filter *filter,
1174                                  const char *filter_str,
1175                                  char **error_str)
1176 {
1177         struct pevent *pevent = filter->pevent;
1178         struct event_list *event;
1179         struct event_list *events = NULL;
1180         const char *filter_start;
1181         const char *next_event;
1182         char *this_event;
1183         char *event_name = NULL;
1184         char *sys_name = NULL;
1185         char *sp;
1186         int rtn = 0;
1187         int len;
1188         int ret;
1189
1190         /* clear buffer to reset show error */
1191         pevent_buffer_init("", 0);
1192
1193         if (error_str)
1194                 *error_str = NULL;
1195
1196         filter_start = strchr(filter_str, ':');
1197         if (filter_start)
1198                 len = filter_start - filter_str;
1199         else
1200                 len = strlen(filter_str);
1201
1202
1203         do {
1204                 next_event = strchr(filter_str, ',');
1205                 if (next_event &&
1206                     (!filter_start || next_event < filter_start))
1207                         len = next_event - filter_str;
1208                 else if (filter_start)
1209                         len = filter_start - filter_str;
1210                 else
1211                         len = strlen(filter_str);
1212
1213                 this_event = malloc_or_die(len + 1);
1214                 memcpy(this_event, filter_str, len);
1215                 this_event[len] = 0;
1216
1217                 if (next_event)
1218                         next_event++;
1219
1220                 filter_str = next_event;
1221
1222                 sys_name = strtok_r(this_event, "/", &sp);
1223                 event_name = strtok_r(NULL, "/", &sp);
1224
1225                 if (!sys_name) {
1226                         show_error(error_str, "No filter found");
1227                         /* This can only happen when events is NULL, but still */
1228                         free_events(events);
1229                         free(this_event);
1230                         return -1;
1231                 }
1232
1233                 /* Find this event */
1234                 ret = find_event(pevent, &events, strim(sys_name), strim(event_name));
1235                 if (ret < 0) {
1236                         if (event_name)
1237                                 show_error(error_str,
1238                                            "No event found under '%s.%s'",
1239                                            sys_name, event_name);
1240                         else
1241                                 show_error(error_str,
1242                                            "No event found under '%s'",
1243                                            sys_name);
1244                         free_events(events);
1245                         free(this_event);
1246                         return -1;
1247                 }
1248                 free(this_event);
1249         } while (filter_str);
1250
1251         /* Skip the ':' */
1252         if (filter_start)
1253                 filter_start++;
1254
1255         /* filter starts here */
1256         for (event = events; event; event = event->next) {
1257                 ret = filter_event(filter, event->event, filter_start,
1258                                    error_str);
1259                 /* Failures are returned if a parse error happened */
1260                 if (ret < 0)
1261                         rtn = ret;
1262
1263                 if (ret >= 0 && pevent->test_filters) {
1264                         char *test;
1265                         test = pevent_filter_make_string(filter, event->event->id);
1266                         printf(" '%s: %s'\n", event->event->name, test);
1267                         free(test);
1268                 }
1269         }
1270
1271         free_events(events);
1272
1273         if (rtn >= 0 && pevent->test_filters)
1274                 exit(0);
1275
1276         return rtn;
1277 }
1278
1279 static void free_filter_type(struct filter_type *filter_type)
1280 {
1281         free_arg(filter_type->filter);
1282 }
1283
1284 /**
1285  * pevent_filter_remove_event - remove a filter for an event
1286  * @filter: the event filter to remove from
1287  * @event_id: the event to remove a filter for
1288  *
1289  * Removes the filter saved for an event defined by @event_id
1290  * from the @filter.
1291  *
1292  * Returns 1: if an event was removed
1293  *   0: if the event was not found
1294  */
1295 int pevent_filter_remove_event(struct event_filter *filter,
1296                                int event_id)
1297 {
1298         struct filter_type *filter_type;
1299         unsigned long len;
1300
1301         if (!filter->filters)
1302                 return 0;
1303
1304         filter_type = find_filter_type(filter, event_id);
1305
1306         if (!filter_type)
1307                 return 0;
1308
1309         free_filter_type(filter_type);
1310
1311         /* The filter_type points into the event_filters array */
1312         len = (unsigned long)(filter->event_filters + filter->filters) -
1313                 (unsigned long)(filter_type + 1);
1314
1315         memmove(filter_type, filter_type + 1, len);
1316         filter->filters--;
1317
1318         memset(&filter->event_filters[filter->filters], 0,
1319                sizeof(*filter_type));
1320
1321         return 1;
1322 }
1323
1324 /**
1325  * pevent_filter_reset - clear all filters in a filter
1326  * @filter: the event filter to reset
1327  *
1328  * Removes all filters from a filter and resets it.
1329  */
1330 void pevent_filter_reset(struct event_filter *filter)
1331 {
1332         int i;
1333
1334         for (i = 0; i < filter->filters; i++)
1335                 free_filter_type(&filter->event_filters[i]);
1336
1337         free(filter->event_filters);
1338         filter->filters = 0;
1339         filter->event_filters = NULL;
1340 }
1341
1342 void pevent_filter_free(struct event_filter *filter)
1343 {
1344         pevent_unref(filter->pevent);
1345
1346         pevent_filter_reset(filter);
1347
1348         free(filter);
1349 }
1350
1351 static char *arg_to_str(struct event_filter *filter, struct filter_arg *arg);
1352
1353 static int copy_filter_type(struct event_filter *filter,
1354                              struct event_filter *source,
1355                              struct filter_type *filter_type)
1356 {
1357         struct filter_arg *arg;
1358         struct event_format *event;
1359         const char *sys;
1360         const char *name;
1361         char *str;
1362
1363         /* Can't assume that the pevent's are the same */
1364         sys = filter_type->event->system;
1365         name = filter_type->event->name;
1366         event = pevent_find_event_by_name(filter->pevent, sys, name);
1367         if (!event)
1368                 return -1;
1369
1370         str = arg_to_str(source, filter_type->filter);
1371         if (!str)
1372                 return -1;
1373
1374         if (strcmp(str, "TRUE") == 0 || strcmp(str, "FALSE") == 0) {
1375                 /* Add trivial event */
1376                 arg = allocate_arg();
1377                 arg->type = FILTER_ARG_BOOLEAN;
1378                 if (strcmp(str, "TRUE") == 0)
1379                         arg->boolean.value = 1;
1380                 else
1381                         arg->boolean.value = 0;
1382
1383                 filter_type = add_filter_type(filter, event->id);
1384                 filter_type->filter = arg;
1385
1386                 free(str);
1387                 return 0;
1388         }
1389
1390         filter_event(filter, event, str, NULL);
1391         free(str);
1392
1393         return 0;
1394 }
1395
1396 /**
1397  * pevent_filter_copy - copy a filter using another filter
1398  * @dest - the filter to copy to
1399  * @source - the filter to copy from
1400  *
1401  * Returns 0 on success and -1 if not all filters were copied
1402  */
1403 int pevent_filter_copy(struct event_filter *dest, struct event_filter *source)
1404 {
1405         int ret = 0;
1406         int i;
1407
1408         pevent_filter_reset(dest);
1409
1410         for (i = 0; i < source->filters; i++) {
1411                 if (copy_filter_type(dest, source, &source->event_filters[i]))
1412                         ret = -1;
1413         }
1414         return ret;
1415 }
1416
1417
1418 /**
1419  * pevent_update_trivial - update the trivial filters with the given filter
1420  * @dest - the filter to update
1421  * @source - the filter as the source of the update
1422  * @type - the type of trivial filter to update.
1423  *
1424  * Scan dest for trivial events matching @type to replace with the source.
1425  *
1426  * Returns 0 on success and -1 if there was a problem updating, but
1427  *   events may have still been updated on error.
1428  */
1429 int pevent_update_trivial(struct event_filter *dest, struct event_filter *source,
1430                           enum filter_trivial_type type)
1431 {
1432         struct pevent *src_pevent;
1433         struct pevent *dest_pevent;
1434         struct event_format *event;
1435         struct filter_type *filter_type;
1436         struct filter_arg *arg;
1437         char *str;
1438         int i;
1439
1440         src_pevent = source->pevent;
1441         dest_pevent = dest->pevent;
1442
1443         /* Do nothing if either of the filters has nothing to filter */
1444         if (!dest->filters || !source->filters)
1445                 return 0;
1446
1447         for (i = 0; i < dest->filters; i++) {
1448                 filter_type = &dest->event_filters[i];
1449                 arg = filter_type->filter;
1450                 if (arg->type != FILTER_ARG_BOOLEAN)
1451                         continue;
1452                 if ((arg->boolean.value && type == FILTER_TRIVIAL_FALSE) ||
1453                     (!arg->boolean.value && type == FILTER_TRIVIAL_TRUE))
1454                         continue;
1455
1456                 event = filter_type->event;
1457
1458                 if (src_pevent != dest_pevent) {
1459                         /* do a look up */
1460                         event = pevent_find_event_by_name(src_pevent,
1461                                                           event->system,
1462                                                           event->name);
1463                         if (!event)
1464                                 return -1;
1465                 }
1466
1467                 str = pevent_filter_make_string(source, event->id);
1468                 if (!str)
1469                         continue;
1470
1471                 /* Don't bother if the filter is trivial too */
1472                 if (strcmp(str, "TRUE") != 0 && strcmp(str, "FALSE") != 0)
1473                         filter_event(dest, event, str, NULL);
1474                 free(str);
1475         }
1476         return 0;
1477 }
1478
1479 /**
1480  * pevent_filter_clear_trivial - clear TRUE and FALSE filters
1481  * @filter: the filter to remove trivial filters from
1482  * @type: remove only true, false, or both
1483  *
1484  * Removes filters that only contain a TRUE or FALES boolean arg.
1485  */
1486 void pevent_filter_clear_trivial(struct event_filter *filter,
1487                                  enum filter_trivial_type type)
1488 {
1489         struct filter_type *filter_type;
1490         int count = 0;
1491         int *ids = NULL;
1492         int i;
1493
1494         if (!filter->filters)
1495                 return;
1496
1497         /*
1498          * Two steps, first get all ids with trivial filters.
1499          *  then remove those ids.
1500          */
1501         for (i = 0; i < filter->filters; i++) {
1502                 filter_type = &filter->event_filters[i];
1503                 if (filter_type->filter->type != FILTER_ARG_BOOLEAN)
1504                         continue;
1505                 switch (type) {
1506                 case FILTER_TRIVIAL_FALSE:
1507                         if (filter_type->filter->boolean.value)
1508                                 continue;
1509                 case FILTER_TRIVIAL_TRUE:
1510                         if (!filter_type->filter->boolean.value)
1511                                 continue;
1512                 default:
1513                         break;
1514                 }
1515
1516                 ids = realloc(ids, sizeof(*ids) * (count + 1));
1517                 if (!ids)
1518                         die("Can't allocate ids");
1519                 ids[count++] = filter_type->event_id;
1520         }
1521
1522         if (!count)
1523                 return;
1524
1525         for (i = 0; i < count; i++)
1526                 pevent_filter_remove_event(filter, ids[i]);
1527
1528         free(ids);
1529 }
1530
1531 /**
1532  * pevent_filter_event_has_trivial - return true event contains trivial filter
1533  * @filter: the filter with the information
1534  * @event_id: the id of the event to test
1535  * @type: trivial type to test for (TRUE, FALSE, EITHER)
1536  *
1537  * Returns 1 if the event contains a matching trivial type
1538  *  otherwise 0.
1539  */
1540 int pevent_filter_event_has_trivial(struct event_filter *filter,
1541                                     int event_id,
1542                                     enum filter_trivial_type type)
1543 {
1544         struct filter_type *filter_type;
1545
1546         if (!filter->filters)
1547                 return 0;
1548
1549         filter_type = find_filter_type(filter, event_id);
1550
1551         if (!filter_type)
1552                 return 0;
1553
1554         if (filter_type->filter->type != FILTER_ARG_BOOLEAN)
1555                 return 0;
1556
1557         switch (type) {
1558         case FILTER_TRIVIAL_FALSE:
1559                 return !filter_type->filter->boolean.value;
1560
1561         case FILTER_TRIVIAL_TRUE:
1562                 return filter_type->filter->boolean.value;
1563         default:
1564                 return 1;
1565         }
1566 }
1567
1568 static int test_filter(struct event_format *event,
1569                        struct filter_arg *arg, struct pevent_record *record);
1570
1571 static const char *
1572 get_comm(struct event_format *event, struct pevent_record *record)
1573 {
1574         const char *comm;
1575         int pid;
1576
1577         pid = pevent_data_pid(event->pevent, record);
1578         comm = pevent_data_comm_from_pid(event->pevent, pid);
1579         return comm;
1580 }
1581
1582 static unsigned long long
1583 get_value(struct event_format *event,
1584           struct format_field *field, struct pevent_record *record)
1585 {
1586         unsigned long long val;
1587
1588         /* Handle our dummy "comm" field */
1589         if (field == &comm) {
1590                 const char *name;
1591
1592                 name = get_comm(event, record);
1593                 return (unsigned long)name;
1594         }
1595
1596         pevent_read_number_field(field, record->data, &val);
1597
1598         if (!(field->flags & FIELD_IS_SIGNED))
1599                 return val;
1600
1601         switch (field->size) {
1602         case 1:
1603                 return (char)val;
1604         case 2:
1605                 return (short)val;
1606         case 4:
1607                 return (int)val;
1608         case 8:
1609                 return (long long)val;
1610         }
1611         return val;
1612 }
1613
1614 static unsigned long long
1615 get_arg_value(struct event_format *event, struct filter_arg *arg, struct pevent_record *record);
1616
1617 static unsigned long long
1618 get_exp_value(struct event_format *event, struct filter_arg *arg, struct pevent_record *record)
1619 {
1620         unsigned long long lval, rval;
1621
1622         lval = get_arg_value(event, arg->exp.left, record);
1623         rval = get_arg_value(event, arg->exp.right, record);
1624
1625         switch (arg->exp.type) {
1626         case FILTER_EXP_ADD:
1627                 return lval + rval;
1628
1629         case FILTER_EXP_SUB:
1630                 return lval - rval;
1631
1632         case FILTER_EXP_MUL:
1633                 return lval * rval;
1634
1635         case FILTER_EXP_DIV:
1636                 return lval / rval;
1637
1638         case FILTER_EXP_MOD:
1639                 return lval % rval;
1640
1641         case FILTER_EXP_RSHIFT:
1642                 return lval >> rval;
1643
1644         case FILTER_EXP_LSHIFT:
1645                 return lval << rval;
1646
1647         case FILTER_EXP_AND:
1648                 return lval & rval;
1649
1650         case FILTER_EXP_OR:
1651                 return lval | rval;
1652
1653         case FILTER_EXP_XOR:
1654                 return lval ^ rval;
1655
1656         case FILTER_EXP_NOT:
1657         default:
1658                 die("error in exp");
1659         }
1660         return 0;
1661 }
1662
1663 static unsigned long long
1664 get_arg_value(struct event_format *event, struct filter_arg *arg, struct pevent_record *record)
1665 {
1666         switch (arg->type) {
1667         case FILTER_ARG_FIELD:
1668                 return get_value(event, arg->field.field, record);
1669
1670         case FILTER_ARG_VALUE:
1671                 if (arg->value.type != FILTER_NUMBER)
1672                         die("must have number field!");
1673                 return arg->value.val;
1674
1675         case FILTER_ARG_EXP:
1676                 return get_exp_value(event, arg, record);
1677
1678         default:
1679                 die("oops in filter");
1680         }
1681         return 0;
1682 }
1683
1684 static int test_num(struct event_format *event,
1685                     struct filter_arg *arg, struct pevent_record *record)
1686 {
1687         unsigned long long lval, rval;
1688
1689         lval = get_arg_value(event, arg->num.left, record);
1690         rval = get_arg_value(event, arg->num.right, record);
1691
1692         switch (arg->num.type) {
1693         case FILTER_CMP_EQ:
1694                 return lval == rval;
1695
1696         case FILTER_CMP_NE:
1697                 return lval != rval;
1698
1699         case FILTER_CMP_GT:
1700                 return lval > rval;
1701
1702         case FILTER_CMP_LT:
1703                 return lval < rval;
1704
1705         case FILTER_CMP_GE:
1706                 return lval >= rval;
1707
1708         case FILTER_CMP_LE:
1709                 return lval <= rval;
1710
1711         default:
1712                 /* ?? */
1713                 return 0;
1714         }
1715 }
1716
1717 static const char *get_field_str(struct filter_arg *arg, struct pevent_record *record)
1718 {
1719         struct event_format *event;
1720         struct pevent *pevent;
1721         unsigned long long addr;
1722         const char *val = NULL;
1723         char hex[64];
1724
1725         /* If the field is not a string convert it */
1726         if (arg->str.field->flags & FIELD_IS_STRING) {
1727                 val = record->data + arg->str.field->offset;
1728
1729                 /*
1730                  * We need to copy the data since we can't be sure the field
1731                  * is null terminated.
1732                  */
1733                 if (*(val + arg->str.field->size - 1)) {
1734                         /* copy it */
1735                         memcpy(arg->str.buffer, val, arg->str.field->size);
1736                         /* the buffer is already NULL terminated */
1737                         val = arg->str.buffer;
1738                 }
1739
1740         } else {
1741                 event = arg->str.field->event;
1742                 pevent = event->pevent;
1743                 addr = get_value(event, arg->str.field, record);
1744
1745                 if (arg->str.field->flags & (FIELD_IS_POINTER | FIELD_IS_LONG))
1746                         /* convert to a kernel symbol */
1747                         val = pevent_find_function(pevent, addr);
1748
1749                 if (val == NULL) {
1750                         /* just use the hex of the string name */
1751                         snprintf(hex, 64, "0x%llx", addr);
1752                         val = hex;
1753                 }
1754         }
1755
1756         return val;
1757 }
1758
1759 static int test_str(struct event_format *event,
1760                     struct filter_arg *arg, struct pevent_record *record)
1761 {
1762         const char *val;
1763
1764         if (arg->str.field == &comm)
1765                 val = get_comm(event, record);
1766         else
1767                 val = get_field_str(arg, record);
1768
1769         switch (arg->str.type) {
1770         case FILTER_CMP_MATCH:
1771                 return strcmp(val, arg->str.val) == 0;
1772
1773         case FILTER_CMP_NOT_MATCH:
1774                 return strcmp(val, arg->str.val) != 0;
1775
1776         case FILTER_CMP_REGEX:
1777                 /* Returns zero on match */
1778                 return !regexec(&arg->str.reg, val, 0, NULL, 0);
1779
1780         case FILTER_CMP_NOT_REGEX:
1781                 return regexec(&arg->str.reg, val, 0, NULL, 0);
1782
1783         default:
1784                 /* ?? */
1785                 return 0;
1786         }
1787 }
1788
1789 static int test_op(struct event_format *event,
1790                    struct filter_arg *arg, struct pevent_record *record)
1791 {
1792         switch (arg->op.type) {
1793         case FILTER_OP_AND:
1794                 return test_filter(event, arg->op.left, record) &&
1795                         test_filter(event, arg->op.right, record);
1796
1797         case FILTER_OP_OR:
1798                 return test_filter(event, arg->op.left, record) ||
1799                         test_filter(event, arg->op.right, record);
1800
1801         case FILTER_OP_NOT:
1802                 return !test_filter(event, arg->op.right, record);
1803
1804         default:
1805                 /* ?? */
1806                 return 0;
1807         }
1808 }
1809
1810 static int test_filter(struct event_format *event,
1811                        struct filter_arg *arg, struct pevent_record *record)
1812 {
1813         switch (arg->type) {
1814         case FILTER_ARG_BOOLEAN:
1815                 /* easy case */
1816                 return arg->boolean.value;
1817
1818         case FILTER_ARG_OP:
1819                 return test_op(event, arg, record);
1820
1821         case FILTER_ARG_NUM:
1822                 return test_num(event, arg, record);
1823
1824         case FILTER_ARG_STR:
1825                 return test_str(event, arg, record);
1826
1827         case FILTER_ARG_EXP:
1828         case FILTER_ARG_VALUE:
1829         case FILTER_ARG_FIELD:
1830                 /*
1831                  * Expressions, fields and values evaluate
1832                  * to true if they return non zero
1833                  */
1834                 return !!get_arg_value(event, arg, record);
1835
1836         default:
1837                 die("oops!");
1838                 /* ?? */
1839                 return 0;
1840         }
1841 }
1842
1843 /**
1844  * pevent_event_filtered - return true if event has filter
1845  * @filter: filter struct with filter information
1846  * @event_id: event id to test if filter exists
1847  *
1848  * Returns 1 if filter found for @event_id
1849  *   otherwise 0;
1850  */
1851 int pevent_event_filtered(struct event_filter *filter,
1852                           int event_id)
1853 {
1854         struct filter_type *filter_type;
1855
1856         if (!filter->filters)
1857                 return 0;
1858
1859         filter_type = find_filter_type(filter, event_id);
1860
1861         return filter_type ? 1 : 0;
1862 }
1863
1864 /**
1865  * pevent_filter_match - test if a record matches a filter
1866  * @filter: filter struct with filter information
1867  * @record: the record to test against the filter
1868  *
1869  * Returns:
1870  *  1 - filter found for event and @record matches
1871  *  0 - filter found for event and @record does not match
1872  * -1 - no filter found for @record's event
1873  * -2 - if no filters exist
1874  */
1875 int pevent_filter_match(struct event_filter *filter,
1876                         struct pevent_record *record)
1877 {
1878         struct pevent *pevent = filter->pevent;
1879         struct filter_type *filter_type;
1880         int event_id;
1881
1882         if (!filter->filters)
1883                 return FILTER_NONE;
1884
1885         event_id = pevent_data_type(pevent, record);
1886
1887         filter_type = find_filter_type(filter, event_id);
1888
1889         if (!filter_type)
1890                 return FILTER_NOEXIST;
1891
1892         return test_filter(filter_type->event, filter_type->filter, record) ?
1893                 FILTER_MATCH : FILTER_MISS;
1894 }
1895
1896 static char *op_to_str(struct event_filter *filter, struct filter_arg *arg)
1897 {
1898         char *str = NULL;
1899         char *left = NULL;
1900         char *right = NULL;
1901         char *op = NULL;
1902         int left_val = -1;
1903         int right_val = -1;
1904         int val;
1905         int len;
1906
1907         switch (arg->op.type) {
1908         case FILTER_OP_AND:
1909                 op = "&&";
1910                 /* fall through */
1911         case FILTER_OP_OR:
1912                 if (!op)
1913                         op = "||";
1914
1915                 left = arg_to_str(filter, arg->op.left);
1916                 right = arg_to_str(filter, arg->op.right);
1917                 if (!left || !right)
1918                         break;
1919
1920                 /* Try to consolidate boolean values */
1921                 if (strcmp(left, "TRUE") == 0)
1922                         left_val = 1;
1923                 else if (strcmp(left, "FALSE") == 0)
1924                         left_val = 0;
1925
1926                 if (strcmp(right, "TRUE") == 0)
1927                         right_val = 1;
1928                 else if (strcmp(right, "FALSE") == 0)
1929                         right_val = 0;
1930
1931                 if (left_val >= 0) {
1932                         if ((arg->op.type == FILTER_OP_AND && !left_val) ||
1933                             (arg->op.type == FILTER_OP_OR && left_val)) {
1934                                 /* Just return left value */
1935                                 str = left;
1936                                 left = NULL;
1937                                 break;
1938                         }
1939                         if (right_val >= 0) {
1940                                 /* just evaluate this. */
1941                                 val = 0;
1942                                 switch (arg->op.type) {
1943                                 case FILTER_OP_AND:
1944                                         val = left_val && right_val;
1945                                         break;
1946                                 case FILTER_OP_OR:
1947                                         val = left_val || right_val;
1948                                         break;
1949                                 default:
1950                                         break;
1951                                 }
1952                                 str = malloc_or_die(6);
1953                                 if (val)
1954                                         strcpy(str, "TRUE");
1955                                 else
1956                                         strcpy(str, "FALSE");
1957                                 break;
1958                         }
1959                 }
1960                 if (right_val >= 0) {
1961                         if ((arg->op.type == FILTER_OP_AND && !right_val) ||
1962                             (arg->op.type == FILTER_OP_OR && right_val)) {
1963                                 /* Just return right value */
1964                                 str = right;
1965                                 right = NULL;
1966                                 break;
1967                         }
1968                         /* The right value is meaningless */
1969                         str = left;
1970                         left = NULL;
1971                         break;
1972                 }
1973
1974                 len = strlen(left) + strlen(right) + strlen(op) + 10;
1975                 str = malloc_or_die(len);
1976                 snprintf(str, len, "(%s) %s (%s)",
1977                          left, op, right);
1978                 break;
1979
1980         case FILTER_OP_NOT:
1981                 op = "!";
1982                 right = arg_to_str(filter, arg->op.right);
1983                 if (!right)
1984                         break;
1985
1986                 /* See if we can consolidate */
1987                 if (strcmp(right, "TRUE") == 0)
1988                         right_val = 1;
1989                 else if (strcmp(right, "FALSE") == 0)
1990                         right_val = 0;
1991                 if (right_val >= 0) {
1992                         /* just return the opposite */
1993                         str = malloc_or_die(6);
1994                         if (right_val)
1995                                 strcpy(str, "FALSE");
1996                         else
1997                                 strcpy(str, "TRUE");
1998                         break;
1999                 }
2000                 len = strlen(right) + strlen(op) + 3;
2001                 str = malloc_or_die(len);
2002                 snprintf(str, len, "%s(%s)", op, right);
2003                 break;
2004
2005         default:
2006                 /* ?? */
2007                 break;
2008         }
2009         free(left);
2010         free(right);
2011         return str;
2012 }
2013
2014 static char *val_to_str(struct event_filter *filter, struct filter_arg *arg)
2015 {
2016         char *str;
2017
2018         str = malloc_or_die(30);
2019
2020         snprintf(str, 30, "%lld", arg->value.val);
2021
2022         return str;
2023 }
2024
2025 static char *field_to_str(struct event_filter *filter, struct filter_arg *arg)
2026 {
2027         return strdup(arg->field.field->name);
2028 }
2029
2030 static char *exp_to_str(struct event_filter *filter, struct filter_arg *arg)
2031 {
2032         char *lstr;
2033         char *rstr;
2034         char *op;
2035         char *str = NULL;
2036         int len;
2037
2038         lstr = arg_to_str(filter, arg->exp.left);
2039         rstr = arg_to_str(filter, arg->exp.right);
2040         if (!lstr || !rstr)
2041                 goto out;
2042
2043         switch (arg->exp.type) {
2044         case FILTER_EXP_ADD:
2045                 op = "+";
2046                 break;
2047         case FILTER_EXP_SUB:
2048                 op = "-";
2049                 break;
2050         case FILTER_EXP_MUL:
2051                 op = "*";
2052                 break;
2053         case FILTER_EXP_DIV:
2054                 op = "/";
2055                 break;
2056         case FILTER_EXP_MOD:
2057                 op = "%";
2058                 break;
2059         case FILTER_EXP_RSHIFT:
2060                 op = ">>";
2061                 break;
2062         case FILTER_EXP_LSHIFT:
2063                 op = "<<";
2064                 break;
2065         case FILTER_EXP_AND:
2066                 op = "&";
2067                 break;
2068         case FILTER_EXP_OR:
2069                 op = "|";
2070                 break;
2071         case FILTER_EXP_XOR:
2072                 op = "^";
2073                 break;
2074         default:
2075                 die("oops in exp");
2076         }
2077
2078         len = strlen(op) + strlen(lstr) + strlen(rstr) + 4;
2079         str = malloc_or_die(len);
2080         snprintf(str, len, "%s %s %s", lstr, op, rstr);
2081 out:
2082         free(lstr);
2083         free(rstr);
2084
2085         return str;
2086 }
2087
2088 static char *num_to_str(struct event_filter *filter, struct filter_arg *arg)
2089 {
2090         char *lstr;
2091         char *rstr;
2092         char *str = NULL;
2093         char *op = NULL;
2094         int len;
2095
2096         lstr = arg_to_str(filter, arg->num.left);
2097         rstr = arg_to_str(filter, arg->num.right);
2098         if (!lstr || !rstr)
2099                 goto out;
2100
2101         switch (arg->num.type) {
2102         case FILTER_CMP_EQ:
2103                 op = "==";
2104                 /* fall through */
2105         case FILTER_CMP_NE:
2106                 if (!op)
2107                         op = "!=";
2108                 /* fall through */
2109         case FILTER_CMP_GT:
2110                 if (!op)
2111                         op = ">";
2112                 /* fall through */
2113         case FILTER_CMP_LT:
2114                 if (!op)
2115                         op = "<";
2116                 /* fall through */
2117         case FILTER_CMP_GE:
2118                 if (!op)
2119                         op = ">=";
2120                 /* fall through */
2121         case FILTER_CMP_LE:
2122                 if (!op)
2123                         op = "<=";
2124
2125                 len = strlen(lstr) + strlen(op) + strlen(rstr) + 4;
2126                 str = malloc_or_die(len);
2127                 sprintf(str, "%s %s %s", lstr, op, rstr);
2128
2129                 break;
2130
2131         default:
2132                 /* ?? */
2133                 break;
2134         }
2135
2136 out:
2137         free(lstr);
2138         free(rstr);
2139         return str;
2140 }
2141
2142 static char *str_to_str(struct event_filter *filter, struct filter_arg *arg)
2143 {
2144         char *str = NULL;
2145         char *op = NULL;
2146         int len;
2147
2148         switch (arg->str.type) {
2149         case FILTER_CMP_MATCH:
2150                 op = "==";
2151                 /* fall through */
2152         case FILTER_CMP_NOT_MATCH:
2153                 if (!op)
2154                         op = "!=";
2155                 /* fall through */
2156         case FILTER_CMP_REGEX:
2157                 if (!op)
2158                         op = "=~";
2159                 /* fall through */
2160         case FILTER_CMP_NOT_REGEX:
2161                 if (!op)
2162                         op = "!~";
2163
2164                 len = strlen(arg->str.field->name) + strlen(op) +
2165                         strlen(arg->str.val) + 6;
2166                 str = malloc_or_die(len);
2167                 snprintf(str, len, "%s %s \"%s\"",
2168                          arg->str.field->name,
2169                          op, arg->str.val);
2170                 break;
2171
2172         default:
2173                 /* ?? */
2174                 break;
2175         }
2176         return str;
2177 }
2178
2179 static char *arg_to_str(struct event_filter *filter, struct filter_arg *arg)
2180 {
2181         char *str;
2182
2183         switch (arg->type) {
2184         case FILTER_ARG_BOOLEAN:
2185                 str = malloc_or_die(6);
2186                 if (arg->boolean.value)
2187                         strcpy(str, "TRUE");
2188                 else
2189                         strcpy(str, "FALSE");
2190                 return str;
2191
2192         case FILTER_ARG_OP:
2193                 return op_to_str(filter, arg);
2194
2195         case FILTER_ARG_NUM:
2196                 return num_to_str(filter, arg);
2197
2198         case FILTER_ARG_STR:
2199                 return str_to_str(filter, arg);
2200
2201         case FILTER_ARG_VALUE:
2202                 return val_to_str(filter, arg);
2203
2204         case FILTER_ARG_FIELD:
2205                 return field_to_str(filter, arg);
2206
2207         case FILTER_ARG_EXP:
2208                 return exp_to_str(filter, arg);
2209
2210         default:
2211                 /* ?? */
2212                 return NULL;
2213         }
2214
2215 }
2216
2217 /**
2218  * pevent_filter_make_string - return a string showing the filter
2219  * @filter: filter struct with filter information
2220  * @event_id: the event id to return the filter string with
2221  *
2222  * Returns a string that displays the filter contents.
2223  *  This string must be freed with free(str).
2224  *  NULL is returned if no filter is found.
2225  */
2226 char *
2227 pevent_filter_make_string(struct event_filter *filter, int event_id)
2228 {
2229         struct filter_type *filter_type;
2230
2231         if (!filter->filters)
2232                 return NULL;
2233
2234         filter_type = find_filter_type(filter, event_id);
2235
2236         if (!filter_type)
2237                 return NULL;
2238
2239         return arg_to_str(filter, filter_type->filter);
2240 }
2241
2242 /**
2243  * pevent_filter_compare - compare two filters and return if they are the same
2244  * @filter1: Filter to compare with @filter2
2245  * @filter2: Filter to compare with @filter1
2246  *
2247  * Returns:
2248  *  1 if the two filters hold the same content.
2249  *  0 if they do not.
2250  */
2251 int pevent_filter_compare(struct event_filter *filter1, struct event_filter *filter2)
2252 {
2253         struct filter_type *filter_type1;
2254         struct filter_type *filter_type2;
2255         char *str1, *str2;
2256         int result;
2257         int i;
2258
2259         /* Do the easy checks first */
2260         if (filter1->filters != filter2->filters)
2261                 return 0;
2262         if (!filter1->filters && !filter2->filters)
2263                 return 1;
2264
2265         /*
2266          * Now take a look at each of the events to see if they have the same
2267          * filters to them.
2268          */
2269         for (i = 0; i < filter1->filters; i++) {
2270                 filter_type1 = &filter1->event_filters[i];
2271                 filter_type2 = find_filter_type(filter2, filter_type1->event_id);
2272                 if (!filter_type2)
2273                         break;
2274                 if (filter_type1->filter->type != filter_type2->filter->type)
2275                         break;
2276                 switch (filter_type1->filter->type) {
2277                 case FILTER_TRIVIAL_FALSE:
2278                 case FILTER_TRIVIAL_TRUE:
2279                         /* trivial types just need the type compared */
2280                         continue;
2281                 default:
2282                         break;
2283                 }
2284                 /* The best way to compare complex filters is with strings */
2285                 str1 = arg_to_str(filter1, filter_type1->filter);
2286                 str2 = arg_to_str(filter2, filter_type2->filter);
2287                 if (str1 && str2)
2288                         result = strcmp(str1, str2) != 0;
2289                 else
2290                         /* bail out if allocation fails */
2291                         result = 1;
2292
2293                 free(str1);
2294                 free(str2);
2295                 if (result)
2296                         break;
2297         }
2298
2299         if (i < filter1->filters)
2300                 return 0;
2301         return 1;
2302 }
2303