1/*
   2 * Copyright (C) 2010 Red Hat Inc, Steven Rostedt <srostedt@redhat.com>
   3 *
   4 * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   5 * This program is free software; you can redistribute it and/or
   6 * modify it under the terms of the GNU Lesser General Public
   7 * License as published by the Free Software Foundation;
   8 * version 2.1 of the License (not later!)
   9 *
  10 * This program is distributed in the hope that it will be useful,
  11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 * GNU Lesser General Public License for more details.
  14 *
  15 * You should have received a copy of the GNU Lesser General Public
  16 * License along with this program; if not,  see <http://www.gnu.org/licenses>
  17 *
  18 * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  19 */
  20#include <stdio.h>
  21#include <stdlib.h>
  22#include <string.h>
  23#include <stdarg.h>
  24#include <errno.h>
  25#include <sys/types.h>
  26
  27#include "event-parse.h"
  28#include "event-utils.h"
  29
  30#define COMM "COMM"
 
  31
  32static struct format_field comm = {
  33	.name = "COMM",
  34};
  35
 
 
 
 
  36struct event_list {
  37	struct event_list	*next;
  38	struct event_format	*event;
  39};
  40
  41static void show_error(char *error_buf, const char *fmt, ...)
  42{
  43	unsigned long long index;
  44	const char *input;
  45	va_list ap;
  46	int len;
  47	int i;
  48
  49	input = pevent_get_input_buf();
  50	index = pevent_get_input_buf_ptr();
  51	len = input ? strlen(input) : 0;
  52
  53	if (len) {
  54		strcpy(error_buf, input);
  55		error_buf[len] = '\n';
  56		for (i = 1; i < len && i < index; i++)
  57			error_buf[len+i] = ' ';
  58		error_buf[len + i] = '^';
  59		error_buf[len + i + 1] = '\n';
  60		len += i+2;
  61	}
  62
  63	va_start(ap, fmt);
  64	vsnprintf(error_buf + len, PEVENT_FILTER_ERROR_BUFSZ - len, fmt, ap);
  65	va_end(ap);
  66}
  67
  68static void free_token(char *token)
  69{
  70	pevent_free_token(token);
  71}
  72
  73static enum event_type read_token(char **tok)
  74{
  75	enum event_type type;
  76	char *token = NULL;
  77
  78	do {
  79		free_token(token);
  80		type = pevent_read_token(&token);
  81	} while (type == EVENT_NEWLINE || type == EVENT_SPACE);
  82
  83	/* If token is = or ! check to see if the next char is ~ */
  84	if (token &&
  85	    (strcmp(token, "=") == 0 || strcmp(token, "!") == 0) &&
  86	    pevent_peek_char() == '~') {
  87		/* append it */
  88		*tok = malloc(3);
  89		if (*tok == NULL) {
  90			free_token(token);
  91			return EVENT_ERROR;
  92		}
  93		sprintf(*tok, "%c%c", *token, '~');
  94		free_token(token);
  95		/* Now remove the '~' from the buffer */
  96		pevent_read_token(&token);
  97		free_token(token);
  98	} else
  99		*tok = token;
 100
 101	return type;
 102}
 103
 104static int filter_cmp(const void *a, const void *b)
 105{
 106	const struct filter_type *ea = a;
 107	const struct filter_type *eb = b;
 108
 109	if (ea->event_id < eb->event_id)
 110		return -1;
 111
 112	if (ea->event_id > eb->event_id)
 113		return 1;
 114
 115	return 0;
 116}
 117
 118static struct filter_type *
 119find_filter_type(struct event_filter *filter, int id)
 120{
 121	struct filter_type *filter_type;
 122	struct filter_type key;
 123
 124	key.event_id = id;
 125
 126	filter_type = bsearch(&key, filter->event_filters,
 127			      filter->filters,
 128			      sizeof(*filter->event_filters),
 129			      filter_cmp);
 130
 131	return filter_type;
 132}
 133
 134static struct filter_type *
 135add_filter_type(struct event_filter *filter, int id)
 136{
 137	struct filter_type *filter_type;
 138	int i;
 139
 140	filter_type = find_filter_type(filter, id);
 141	if (filter_type)
 142		return filter_type;
 143
 144	filter_type = realloc(filter->event_filters,
 145			      sizeof(*filter->event_filters) *
 146			      (filter->filters + 1));
 147	if (!filter_type)
 148		return NULL;
 149
 150	filter->event_filters = filter_type;
 151
 152	for (i = 0; i < filter->filters; i++) {
 153		if (filter->event_filters[i].event_id > id)
 154			break;
 155	}
 156
 157	if (i < filter->filters)
 158		memmove(&filter->event_filters[i+1],
 159			&filter->event_filters[i],
 160			sizeof(*filter->event_filters) *
 161			(filter->filters - i));
 162
 163	filter_type = &filter->event_filters[i];
 164	filter_type->event_id = id;
 165	filter_type->event = pevent_find_event(filter->pevent, id);
 166	filter_type->filter = NULL;
 167
 168	filter->filters++;
 169
 170	return filter_type;
 171}
 172
 173/**
 174 * pevent_filter_alloc - create a new event filter
 175 * @pevent: The pevent that this filter is associated with
 176 */
 177struct event_filter *pevent_filter_alloc(struct pevent *pevent)
 178{
 179	struct event_filter *filter;
 180
 181	filter = malloc(sizeof(*filter));
 182	if (filter == NULL)
 183		return NULL;
 184
 185	memset(filter, 0, sizeof(*filter));
 186	filter->pevent = pevent;
 187	pevent_ref(pevent);
 188
 189	return filter;
 190}
 191
 192static struct filter_arg *allocate_arg(void)
 193{
 194	return calloc(1, sizeof(struct filter_arg));
 195}
 196
 197static void free_arg(struct filter_arg *arg)
 198{
 199	if (!arg)
 200		return;
 201
 202	switch (arg->type) {
 203	case FILTER_ARG_NONE:
 204	case FILTER_ARG_BOOLEAN:
 205		break;
 206
 207	case FILTER_ARG_NUM:
 208		free_arg(arg->num.left);
 209		free_arg(arg->num.right);
 210		break;
 211
 212	case FILTER_ARG_EXP:
 213		free_arg(arg->exp.left);
 214		free_arg(arg->exp.right);
 215		break;
 216
 217	case FILTER_ARG_STR:
 218		free(arg->str.val);
 219		regfree(&arg->str.reg);
 220		free(arg->str.buffer);
 221		break;
 222
 223	case FILTER_ARG_VALUE:
 224		if (arg->value.type == FILTER_STRING ||
 225		    arg->value.type == FILTER_CHAR)
 226			free(arg->value.str);
 227		break;
 228
 229	case FILTER_ARG_OP:
 230		free_arg(arg->op.left);
 231		free_arg(arg->op.right);
 232	default:
 233		break;
 234	}
 235
 236	free(arg);
 237}
 238
 239static int add_event(struct event_list **events,
 240		      struct event_format *event)
 241{
 242	struct event_list *list;
 243
 244	list = malloc(sizeof(*list));
 245	if (list == NULL)
 246		return -1;
 247
 248	list->next = *events;
 249	*events = list;
 250	list->event = event;
 251	return 0;
 252}
 253
 254static int event_match(struct event_format *event,
 255		       regex_t *sreg, regex_t *ereg)
 256{
 257	if (sreg) {
 258		return !regexec(sreg, event->system, 0, NULL, 0) &&
 259			!regexec(ereg, event->name, 0, NULL, 0);
 260	}
 261
 262	return !regexec(ereg, event->system, 0, NULL, 0) ||
 263		!regexec(ereg, event->name, 0, NULL, 0);
 264}
 265
 266static enum pevent_errno
 267find_event(struct pevent *pevent, struct event_list **events,
 268	   char *sys_name, char *event_name)
 269{
 270	struct event_format *event;
 271	regex_t ereg;
 272	regex_t sreg;
 273	int match = 0;
 274	int fail = 0;
 275	char *reg;
 276	int ret;
 277	int i;
 278
 279	if (!event_name) {
 280		/* if no name is given, then swap sys and name */
 281		event_name = sys_name;
 282		sys_name = NULL;
 283	}
 284
 285	reg = malloc(strlen(event_name) + 3);
 286	if (reg == NULL)
 287		return PEVENT_ERRNO__MEM_ALLOC_FAILED;
 288
 289	sprintf(reg, "^%s$", event_name);
 290
 291	ret = regcomp(&ereg, reg, REG_ICASE|REG_NOSUB);
 292	free(reg);
 293
 294	if (ret)
 295		return PEVENT_ERRNO__INVALID_EVENT_NAME;
 296
 297	if (sys_name) {
 298		reg = malloc(strlen(sys_name) + 3);
 299		if (reg == NULL) {
 300			regfree(&ereg);
 301			return PEVENT_ERRNO__MEM_ALLOC_FAILED;
 302		}
 303
 304		sprintf(reg, "^%s$", sys_name);
 305		ret = regcomp(&sreg, reg, REG_ICASE|REG_NOSUB);
 306		free(reg);
 307		if (ret) {
 308			regfree(&ereg);
 309			return PEVENT_ERRNO__INVALID_EVENT_NAME;
 310		}
 311	}
 312
 313	for (i = 0; i < pevent->nr_events; i++) {
 314		event = pevent->events[i];
 315		if (event_match(event, sys_name ? &sreg : NULL, &ereg)) {
 316			match = 1;
 317			if (add_event(events, event) < 0) {
 318				fail = 1;
 319				break;
 320			}
 321		}
 322	}
 323
 324	regfree(&ereg);
 325	if (sys_name)
 326		regfree(&sreg);
 327
 328	if (!match)
 329		return PEVENT_ERRNO__EVENT_NOT_FOUND;
 330	if (fail)
 331		return PEVENT_ERRNO__MEM_ALLOC_FAILED;
 332
 333	return 0;
 334}
 335
 336static void free_events(struct event_list *events)
 337{
 338	struct event_list *event;
 339
 340	while (events) {
 341		event = events;
 342		events = events->next;
 343		free(event);
 344	}
 345}
 346
 347static enum pevent_errno
 348create_arg_item(struct event_format *event, const char *token,
 349		enum event_type type, struct filter_arg **parg, char *error_str)
 350{
 351	struct format_field *field;
 352	struct filter_arg *arg;
 353
 354	arg = allocate_arg();
 355	if (arg == NULL) {
 356		show_error(error_str, "failed to allocate filter arg");
 357		return PEVENT_ERRNO__MEM_ALLOC_FAILED;
 358	}
 359
 360	switch (type) {
 361
 362	case EVENT_SQUOTE:
 363	case EVENT_DQUOTE:
 364		arg->type = FILTER_ARG_VALUE;
 365		arg->value.type =
 366			type == EVENT_DQUOTE ? FILTER_STRING : FILTER_CHAR;
 367		arg->value.str = strdup(token);
 368		if (!arg->value.str) {
 369			free_arg(arg);
 370			show_error(error_str, "failed to allocate string filter arg");
 371			return PEVENT_ERRNO__MEM_ALLOC_FAILED;
 372		}
 373		break;
 374	case EVENT_ITEM:
 375		/* if it is a number, then convert it */
 376		if (isdigit(token[0])) {
 377			arg->type = FILTER_ARG_VALUE;
 378			arg->value.type = FILTER_NUMBER;
 379			arg->value.val = strtoull(token, NULL, 0);
 380			break;
 381		}
 382		/* Consider this a field */
 383		field = pevent_find_any_field(event, token);
 384		if (!field) {
 385			if (strcmp(token, COMM) != 0) {
 
 
 
 
 
 386				/* not a field, Make it false */
 387				arg->type = FILTER_ARG_BOOLEAN;
 388				arg->boolean.value = FILTER_FALSE;
 389				break;
 390			}
 391			/* If token is 'COMM' then it is special */
 392			field = &comm;
 393		}
 394		arg->type = FILTER_ARG_FIELD;
 395		arg->field.field = field;
 396		break;
 397	default:
 398		free_arg(arg);
 399		show_error(error_str, "expected a value but found %s", token);
 400		return PEVENT_ERRNO__UNEXPECTED_TYPE;
 401	}
 402	*parg = arg;
 403	return 0;
 404}
 405
 406static struct filter_arg *
 407create_arg_op(enum filter_op_type btype)
 408{
 409	struct filter_arg *arg;
 410
 411	arg = allocate_arg();
 412	if (!arg)
 413		return NULL;
 414
 415	arg->type = FILTER_ARG_OP;
 416	arg->op.type = btype;
 417
 418	return arg;
 419}
 420
 421static struct filter_arg *
 422create_arg_exp(enum filter_exp_type etype)
 423{
 424	struct filter_arg *arg;
 425
 426	arg = allocate_arg();
 427	if (!arg)
 428		return NULL;
 429
 430	arg->type = FILTER_ARG_EXP;
 431	arg->op.type = etype;
 432
 433	return arg;
 434}
 435
 436static struct filter_arg *
 437create_arg_cmp(enum filter_exp_type etype)
 438{
 439	struct filter_arg *arg;
 440
 441	arg = allocate_arg();
 442	if (!arg)
 443		return NULL;
 444
 445	/* Use NUM and change if necessary */
 446	arg->type = FILTER_ARG_NUM;
 447	arg->op.type = etype;
 448
 449	return arg;
 450}
 451
 452static enum pevent_errno
 453add_right(struct filter_arg *op, struct filter_arg *arg, char *error_str)
 454{
 455	struct filter_arg *left;
 456	char *str;
 457	int op_type;
 458	int ret;
 459
 460	switch (op->type) {
 461	case FILTER_ARG_EXP:
 462		if (op->exp.right)
 463			goto out_fail;
 464		op->exp.right = arg;
 465		break;
 466
 467	case FILTER_ARG_OP:
 468		if (op->op.right)
 469			goto out_fail;
 470		op->op.right = arg;
 471		break;
 472
 473	case FILTER_ARG_NUM:
 474		if (op->op.right)
 475			goto out_fail;
 476		/*
 477		 * The arg must be num, str, or field
 478		 */
 479		switch (arg->type) {
 480		case FILTER_ARG_VALUE:
 481		case FILTER_ARG_FIELD:
 482			break;
 483		default:
 484			show_error(error_str, "Illegal rvalue");
 485			return PEVENT_ERRNO__ILLEGAL_RVALUE;
 486		}
 487
 488		/*
 489		 * Depending on the type, we may need to
 490		 * convert this to a string or regex.
 491		 */
 492		switch (arg->value.type) {
 493		case FILTER_CHAR:
 494			/*
 495			 * A char should be converted to number if
 496			 * the string is 1 byte, and the compare
 497			 * is not a REGEX.
 498			 */
 499			if (strlen(arg->value.str) == 1 &&
 500			    op->num.type != FILTER_CMP_REGEX &&
 501			    op->num.type != FILTER_CMP_NOT_REGEX) {
 502				arg->value.type = FILTER_NUMBER;
 503				goto do_int;
 504			}
 505			/* fall through */
 506		case FILTER_STRING:
 507
 508			/* convert op to a string arg */
 509			op_type = op->num.type;
 510			left = op->num.left;
 511			str = arg->value.str;
 512
 513			/* reset the op for the new field */
 514			memset(op, 0, sizeof(*op));
 515
 516			/*
 517			 * If left arg was a field not found then
 518			 * NULL the entire op.
 519			 */
 520			if (left->type == FILTER_ARG_BOOLEAN) {
 521				free_arg(left);
 522				free_arg(arg);
 523				op->type = FILTER_ARG_BOOLEAN;
 524				op->boolean.value = FILTER_FALSE;
 525				break;
 526			}
 527
 528			/* Left arg must be a field */
 529			if (left->type != FILTER_ARG_FIELD) {
 530				show_error(error_str,
 531					   "Illegal lvalue for string comparison");
 532				return PEVENT_ERRNO__ILLEGAL_LVALUE;
 533			}
 534
 535			/* Make sure this is a valid string compare */
 536			switch (op_type) {
 537			case FILTER_CMP_EQ:
 538				op_type = FILTER_CMP_MATCH;
 539				break;
 540			case FILTER_CMP_NE:
 541				op_type = FILTER_CMP_NOT_MATCH;
 542				break;
 543
 544			case FILTER_CMP_REGEX:
 545			case FILTER_CMP_NOT_REGEX:
 546				ret = regcomp(&op->str.reg, str, REG_ICASE|REG_NOSUB);
 547				if (ret) {
 548					show_error(error_str,
 549						   "RegEx '%s' did not compute",
 550						   str);
 551					return PEVENT_ERRNO__INVALID_REGEX;
 552				}
 553				break;
 554			default:
 555				show_error(error_str,
 556					   "Illegal comparison for string");
 557				return PEVENT_ERRNO__ILLEGAL_STRING_CMP;
 558			}
 559
 560			op->type = FILTER_ARG_STR;
 561			op->str.type = op_type;
 562			op->str.field = left->field.field;
 563			op->str.val = strdup(str);
 564			if (!op->str.val) {
 565				show_error(error_str, "Failed to allocate string filter");
 566				return PEVENT_ERRNO__MEM_ALLOC_FAILED;
 567			}
 568			/*
 569			 * Need a buffer to copy data for tests
 570			 */
 571			op->str.buffer = malloc(op->str.field->size + 1);
 572			if (!op->str.buffer) {
 573				show_error(error_str, "Failed to allocate string filter");
 574				return PEVENT_ERRNO__MEM_ALLOC_FAILED;
 575			}
 576			/* Null terminate this buffer */
 577			op->str.buffer[op->str.field->size] = 0;
 578
 579			/* We no longer have left or right args */
 580			free_arg(arg);
 581			free_arg(left);
 582
 583			break;
 584
 585		case FILTER_NUMBER:
 586
 587 do_int:
 588			switch (op->num.type) {
 589			case FILTER_CMP_REGEX:
 590			case FILTER_CMP_NOT_REGEX:
 591				show_error(error_str,
 592					   "Op not allowed with integers");
 593				return PEVENT_ERRNO__ILLEGAL_INTEGER_CMP;
 594
 595			default:
 596				break;
 597			}
 598
 599			/* numeric compare */
 600			op->num.right = arg;
 601			break;
 602		default:
 603			goto out_fail;
 604		}
 605		break;
 606	default:
 607		goto out_fail;
 608	}
 609
 610	return 0;
 611
 612 out_fail:
 613	show_error(error_str, "Syntax error");
 614	return PEVENT_ERRNO__SYNTAX_ERROR;
 615}
 616
 617static struct filter_arg *
 618rotate_op_right(struct filter_arg *a, struct filter_arg *b)
 619{
 620	struct filter_arg *arg;
 621
 622	arg = a->op.right;
 623	a->op.right = b;
 624	return arg;
 625}
 626
 627static enum pevent_errno add_left(struct filter_arg *op, struct filter_arg *arg)
 628{
 629	switch (op->type) {
 630	case FILTER_ARG_EXP:
 631		if (arg->type == FILTER_ARG_OP)
 632			arg = rotate_op_right(arg, op);
 633		op->exp.left = arg;
 634		break;
 635
 636	case FILTER_ARG_OP:
 637		op->op.left = arg;
 638		break;
 639	case FILTER_ARG_NUM:
 640		if (arg->type == FILTER_ARG_OP)
 641			arg = rotate_op_right(arg, op);
 642
 643		/* left arg of compares must be a field */
 644		if (arg->type != FILTER_ARG_FIELD &&
 645		    arg->type != FILTER_ARG_BOOLEAN)
 646			return PEVENT_ERRNO__INVALID_ARG_TYPE;
 647		op->num.left = arg;
 648		break;
 649	default:
 650		return PEVENT_ERRNO__INVALID_ARG_TYPE;
 651	}
 652	return 0;
 653}
 654
 655enum op_type {
 656	OP_NONE,
 657	OP_BOOL,
 658	OP_NOT,
 659	OP_EXP,
 660	OP_CMP,
 661};
 662
 663static enum op_type process_op(const char *token,
 664			       enum filter_op_type *btype,
 665			       enum filter_cmp_type *ctype,
 666			       enum filter_exp_type *etype)
 667{
 668	*btype = FILTER_OP_NOT;
 669	*etype = FILTER_EXP_NONE;
 670	*ctype = FILTER_CMP_NONE;
 671
 672	if (strcmp(token, "&&") == 0)
 673		*btype = FILTER_OP_AND;
 674	else if (strcmp(token, "||") == 0)
 675		*btype = FILTER_OP_OR;
 676	else if (strcmp(token, "!") == 0)
 677		return OP_NOT;
 678
 679	if (*btype != FILTER_OP_NOT)
 680		return OP_BOOL;
 681
 682	/* Check for value expressions */
 683	if (strcmp(token, "+") == 0) {
 684		*etype = FILTER_EXP_ADD;
 685	} else if (strcmp(token, "-") == 0) {
 686		*etype = FILTER_EXP_SUB;
 687	} else if (strcmp(token, "*") == 0) {
 688		*etype = FILTER_EXP_MUL;
 689	} else if (strcmp(token, "/") == 0) {
 690		*etype = FILTER_EXP_DIV;
 691	} else if (strcmp(token, "%") == 0) {
 692		*etype = FILTER_EXP_MOD;
 693	} else if (strcmp(token, ">>") == 0) {
 694		*etype = FILTER_EXP_RSHIFT;
 695	} else if (strcmp(token, "<<") == 0) {
 696		*etype = FILTER_EXP_LSHIFT;
 697	} else if (strcmp(token, "&") == 0) {
 698		*etype = FILTER_EXP_AND;
 699	} else if (strcmp(token, "|") == 0) {
 700		*etype = FILTER_EXP_OR;
 701	} else if (strcmp(token, "^") == 0) {
 702		*etype = FILTER_EXP_XOR;
 703	} else if (strcmp(token, "~") == 0)
 704		*etype = FILTER_EXP_NOT;
 705
 706	if (*etype != FILTER_EXP_NONE)
 707		return OP_EXP;
 708
 709	/* Check for compares */
 710	if (strcmp(token, "==") == 0)
 711		*ctype = FILTER_CMP_EQ;
 712	else if (strcmp(token, "!=") == 0)
 713		*ctype = FILTER_CMP_NE;
 714	else if (strcmp(token, "<") == 0)
 715		*ctype = FILTER_CMP_LT;
 716	else if (strcmp(token, ">") == 0)
 717		*ctype = FILTER_CMP_GT;
 718	else if (strcmp(token, "<=") == 0)
 719		*ctype = FILTER_CMP_LE;
 720	else if (strcmp(token, ">=") == 0)
 721		*ctype = FILTER_CMP_GE;
 722	else if (strcmp(token, "=~") == 0)
 723		*ctype = FILTER_CMP_REGEX;
 724	else if (strcmp(token, "!~") == 0)
 725		*ctype = FILTER_CMP_NOT_REGEX;
 726	else
 727		return OP_NONE;
 728
 729	return OP_CMP;
 730}
 731
 732static int check_op_done(struct filter_arg *arg)
 733{
 734	switch (arg->type) {
 735	case FILTER_ARG_EXP:
 736		return arg->exp.right != NULL;
 737
 738	case FILTER_ARG_OP:
 739		return arg->op.right != NULL;
 740
 741	case FILTER_ARG_NUM:
 742		return arg->num.right != NULL;
 743
 744	case FILTER_ARG_STR:
 745		/* A string conversion is always done */
 746		return 1;
 747
 748	case FILTER_ARG_BOOLEAN:
 749		/* field not found, is ok */
 750		return 1;
 751
 752	default:
 753		return 0;
 754	}
 755}
 756
 757enum filter_vals {
 758	FILTER_VAL_NORM,
 759	FILTER_VAL_FALSE,
 760	FILTER_VAL_TRUE,
 761};
 762
 763static enum pevent_errno
 764reparent_op_arg(struct filter_arg *parent, struct filter_arg *old_child,
 765		struct filter_arg *arg, char *error_str)
 766{
 767	struct filter_arg *other_child;
 768	struct filter_arg **ptr;
 769
 770	if (parent->type != FILTER_ARG_OP &&
 771	    arg->type != FILTER_ARG_OP) {
 772		show_error(error_str, "can not reparent other than OP");
 773		return PEVENT_ERRNO__REPARENT_NOT_OP;
 774	}
 775
 776	/* Get the sibling */
 777	if (old_child->op.right == arg) {
 778		ptr = &old_child->op.right;
 779		other_child = old_child->op.left;
 780	} else if (old_child->op.left == arg) {
 781		ptr = &old_child->op.left;
 782		other_child = old_child->op.right;
 783	} else {
 784		show_error(error_str, "Error in reparent op, find other child");
 785		return PEVENT_ERRNO__REPARENT_FAILED;
 786	}
 787
 788	/* Detach arg from old_child */
 789	*ptr = NULL;
 790
 791	/* Check for root */
 792	if (parent == old_child) {
 793		free_arg(other_child);
 794		*parent = *arg;
 795		/* Free arg without recussion */
 796		free(arg);
 797		return 0;
 798	}
 799
 800	if (parent->op.right == old_child)
 801		ptr = &parent->op.right;
 802	else if (parent->op.left == old_child)
 803		ptr = &parent->op.left;
 804	else {
 805		show_error(error_str, "Error in reparent op");
 806		return PEVENT_ERRNO__REPARENT_FAILED;
 807	}
 808
 809	*ptr = arg;
 810
 811	free_arg(old_child);
 812	return 0;
 813}
 814
 815/* Returns either filter_vals (success) or pevent_errno (failfure) */
 816static int test_arg(struct filter_arg *parent, struct filter_arg *arg,
 817		    char *error_str)
 818{
 819	int lval, rval;
 820
 821	switch (arg->type) {
 822
 823		/* bad case */
 824	case FILTER_ARG_BOOLEAN:
 825		return FILTER_VAL_FALSE + arg->boolean.value;
 826
 827		/* good cases: */
 828	case FILTER_ARG_STR:
 829	case FILTER_ARG_VALUE:
 830	case FILTER_ARG_FIELD:
 831		return FILTER_VAL_NORM;
 832
 833	case FILTER_ARG_EXP:
 834		lval = test_arg(arg, arg->exp.left, error_str);
 835		if (lval != FILTER_VAL_NORM)
 836			return lval;
 837		rval = test_arg(arg, arg->exp.right, error_str);
 838		if (rval != FILTER_VAL_NORM)
 839			return rval;
 840		return FILTER_VAL_NORM;
 841
 842	case FILTER_ARG_NUM:
 843		lval = test_arg(arg, arg->num.left, error_str);
 844		if (lval != FILTER_VAL_NORM)
 845			return lval;
 846		rval = test_arg(arg, arg->num.right, error_str);
 847		if (rval != FILTER_VAL_NORM)
 848			return rval;
 849		return FILTER_VAL_NORM;
 850
 851	case FILTER_ARG_OP:
 852		if (arg->op.type != FILTER_OP_NOT) {
 853			lval = test_arg(arg, arg->op.left, error_str);
 854			switch (lval) {
 855			case FILTER_VAL_NORM:
 856				break;
 857			case FILTER_VAL_TRUE:
 858				if (arg->op.type == FILTER_OP_OR)
 859					return FILTER_VAL_TRUE;
 860				rval = test_arg(arg, arg->op.right, error_str);
 861				if (rval != FILTER_VAL_NORM)
 862					return rval;
 863
 864				return reparent_op_arg(parent, arg, arg->op.right,
 865						       error_str);
 866
 867			case FILTER_VAL_FALSE:
 868				if (arg->op.type == FILTER_OP_AND)
 869					return FILTER_VAL_FALSE;
 870				rval = test_arg(arg, arg->op.right, error_str);
 871				if (rval != FILTER_VAL_NORM)
 872					return rval;
 873
 874				return reparent_op_arg(parent, arg, arg->op.right,
 875						       error_str);
 876
 877			default:
 878				return lval;
 879			}
 880		}
 881
 882		rval = test_arg(arg, arg->op.right, error_str);
 883		switch (rval) {
 884		case FILTER_VAL_NORM:
 885		default:
 886			break;
 887
 888		case FILTER_VAL_TRUE:
 889			if (arg->op.type == FILTER_OP_OR)
 890				return FILTER_VAL_TRUE;
 891			if (arg->op.type == FILTER_OP_NOT)
 892				return FILTER_VAL_FALSE;
 893
 894			return reparent_op_arg(parent, arg, arg->op.left,
 895					       error_str);
 896
 897		case FILTER_VAL_FALSE:
 898			if (arg->op.type == FILTER_OP_AND)
 899				return FILTER_VAL_FALSE;
 900			if (arg->op.type == FILTER_OP_NOT)
 901				return FILTER_VAL_TRUE;
 902
 903			return reparent_op_arg(parent, arg, arg->op.left,
 904					       error_str);
 905		}
 906
 907		return rval;
 908	default:
 909		show_error(error_str, "bad arg in filter tree");
 910		return PEVENT_ERRNO__BAD_FILTER_ARG;
 911	}
 912	return FILTER_VAL_NORM;
 913}
 914
 915/* Remove any unknown event fields */
 916static int collapse_tree(struct filter_arg *arg,
 917			 struct filter_arg **arg_collapsed, char *error_str)
 918{
 919	int ret;
 920
 921	ret = test_arg(arg, arg, error_str);
 922	switch (ret) {
 923	case FILTER_VAL_NORM:
 924		break;
 925
 926	case FILTER_VAL_TRUE:
 927	case FILTER_VAL_FALSE:
 928		free_arg(arg);
 929		arg = allocate_arg();
 930		if (arg) {
 931			arg->type = FILTER_ARG_BOOLEAN;
 932			arg->boolean.value = ret == FILTER_VAL_TRUE;
 933		} else {
 934			show_error(error_str, "Failed to allocate filter arg");
 935			ret = PEVENT_ERRNO__MEM_ALLOC_FAILED;
 936		}
 937		break;
 938
 939	default:
 940		/* test_arg() already set the error_str */
 941		free_arg(arg);
 942		arg = NULL;
 943		break;
 944	}
 945
 946	*arg_collapsed = arg;
 947	return ret;
 948}
 949
 950static enum pevent_errno
 951process_filter(struct event_format *event, struct filter_arg **parg,
 952	       char *error_str, int not)
 953{
 954	enum event_type type;
 955	char *token = NULL;
 956	struct filter_arg *current_op = NULL;
 957	struct filter_arg *current_exp = NULL;
 958	struct filter_arg *left_item = NULL;
 959	struct filter_arg *arg = NULL;
 960	enum op_type op_type;
 961	enum filter_op_type btype;
 962	enum filter_exp_type etype;
 963	enum filter_cmp_type ctype;
 964	enum pevent_errno ret;
 965
 966	*parg = NULL;
 967
 968	do {
 969		free(token);
 970		type = read_token(&token);
 971		switch (type) {
 972		case EVENT_SQUOTE:
 973		case EVENT_DQUOTE:
 974		case EVENT_ITEM:
 975			ret = create_arg_item(event, token, type, &arg, error_str);
 976			if (ret < 0)
 977				goto fail;
 978			if (!left_item)
 979				left_item = arg;
 980			else if (current_exp) {
 981				ret = add_right(current_exp, arg, error_str);
 982				if (ret < 0)
 983					goto fail;
 984				left_item = NULL;
 985				/* Not's only one one expression */
 986				if (not) {
 987					arg = NULL;
 988					if (current_op)
 989						goto fail_syntax;
 990					free(token);
 991					*parg = current_exp;
 992					return 0;
 993				}
 994			} else
 995				goto fail_syntax;
 996			arg = NULL;
 997			break;
 998
 999		case EVENT_DELIM:
1000			if (*token == ',') {
1001				show_error(error_str, "Illegal token ','");
1002				ret = PEVENT_ERRNO__ILLEGAL_TOKEN;
1003				goto fail;
1004			}
1005
1006			if (*token == '(') {
1007				if (left_item) {
1008					show_error(error_str,
1009						   "Open paren can not come after item");
1010					ret = PEVENT_ERRNO__INVALID_PAREN;
1011					goto fail;
1012				}
1013				if (current_exp) {
1014					show_error(error_str,
1015						   "Open paren can not come after expression");
1016					ret = PEVENT_ERRNO__INVALID_PAREN;
1017					goto fail;
1018				}
1019
1020				ret = process_filter(event, &arg, error_str, 0);
1021				if (ret != PEVENT_ERRNO__UNBALANCED_PAREN) {
1022					if (ret == 0) {
1023						show_error(error_str,
1024							   "Unbalanced number of '('");
1025						ret = PEVENT_ERRNO__UNBALANCED_PAREN;
1026					}
1027					goto fail;
1028				}
1029				ret = 0;
1030
1031				/* A not wants just one expression */
1032				if (not) {
1033					if (current_op)
1034						goto fail_syntax;
1035					*parg = arg;
1036					return 0;
1037				}
1038
1039				if (current_op)
1040					ret = add_right(current_op, arg, error_str);
1041				else
1042					current_exp = arg;
1043
1044				if (ret < 0)
1045					goto fail;
1046
1047			} else { /* ')' */
1048				if (!current_op && !current_exp)
1049					goto fail_syntax;
1050
1051				/* Make sure everything is finished at this level */
1052				if (current_exp && !check_op_done(current_exp))
1053					goto fail_syntax;
1054				if (current_op && !check_op_done(current_op))
1055					goto fail_syntax;
1056
1057				if (current_op)
1058					*parg = current_op;
1059				else
1060					*parg = current_exp;
 
1061				return PEVENT_ERRNO__UNBALANCED_PAREN;
1062			}
1063			break;
1064
1065		case EVENT_OP:
1066			op_type = process_op(token, &btype, &ctype, &etype);
1067
1068			/* All expect a left arg except for NOT */
1069			switch (op_type) {
1070			case OP_BOOL:
1071				/* Logic ops need a left expression */
1072				if (!current_exp && !current_op)
1073					goto fail_syntax;
1074				/* fall through */
1075			case OP_NOT:
1076				/* logic only processes ops and exp */
1077				if (left_item)
1078					goto fail_syntax;
1079				break;
1080			case OP_EXP:
1081			case OP_CMP:
1082				if (!left_item)
1083					goto fail_syntax;
1084				break;
1085			case OP_NONE:
1086				show_error(error_str,
1087					   "Unknown op token %s", token);
1088				ret = PEVENT_ERRNO__UNKNOWN_TOKEN;
1089				goto fail;
1090			}
1091
1092			ret = 0;
1093			switch (op_type) {
1094			case OP_BOOL:
1095				arg = create_arg_op(btype);
1096				if (arg == NULL)
1097					goto fail_alloc;
1098				if (current_op)
1099					ret = add_left(arg, current_op);
1100				else
1101					ret = add_left(arg, current_exp);
1102				current_op = arg;
1103				current_exp = NULL;
1104				break;
1105
1106			case OP_NOT:
1107				arg = create_arg_op(btype);
1108				if (arg == NULL)
1109					goto fail_alloc;
1110				if (current_op)
1111					ret = add_right(current_op, arg, error_str);
1112				if (ret < 0)
1113					goto fail;
1114				current_exp = arg;
1115				ret = process_filter(event, &arg, error_str, 1);
1116				if (ret < 0)
1117					goto fail;
1118				ret = add_right(current_exp, arg, error_str);
1119				if (ret < 0)
1120					goto fail;
1121				break;
1122
1123			case OP_EXP:
1124			case OP_CMP:
1125				if (op_type == OP_EXP)
1126					arg = create_arg_exp(etype);
1127				else
1128					arg = create_arg_cmp(ctype);
1129				if (arg == NULL)
1130					goto fail_alloc;
1131
1132				if (current_op)
1133					ret = add_right(current_op, arg, error_str);
1134				if (ret < 0)
1135					goto fail;
1136				ret = add_left(arg, left_item);
1137				if (ret < 0) {
1138					arg = NULL;
1139					goto fail_syntax;
1140				}
1141				current_exp = arg;
1142				break;
1143			default:
1144				break;
1145			}
1146			arg = NULL;
1147			if (ret < 0)
1148				goto fail_syntax;
1149			break;
1150		case EVENT_NONE:
1151			break;
1152		case EVENT_ERROR:
1153			goto fail_alloc;
1154		default:
1155			goto fail_syntax;
1156		}
1157	} while (type != EVENT_NONE);
1158
1159	if (!current_op && !current_exp)
1160		goto fail_syntax;
1161
1162	if (!current_op)
1163		current_op = current_exp;
1164
1165	ret = collapse_tree(current_op, parg, error_str);
 
 
1166	if (ret < 0)
1167		goto fail;
1168
1169	*parg = current_op;
1170
1171	return 0;
1172
1173 fail_alloc:
1174	show_error(error_str, "failed to allocate filter arg");
1175	ret = PEVENT_ERRNO__MEM_ALLOC_FAILED;
1176	goto fail;
1177 fail_syntax:
1178	show_error(error_str, "Syntax error");
1179	ret = PEVENT_ERRNO__SYNTAX_ERROR;
1180 fail:
1181	free_arg(current_op);
1182	free_arg(current_exp);
1183	free_arg(arg);
1184	free(token);
1185	return ret;
1186}
1187
1188static enum pevent_errno
1189process_event(struct event_format *event, const char *filter_str,
1190	      struct filter_arg **parg, char *error_str)
1191{
1192	int ret;
1193
1194	pevent_buffer_init(filter_str, strlen(filter_str));
1195
1196	ret = process_filter(event, parg, error_str, 0);
1197	if (ret < 0)
1198		return ret;
1199
1200	/* If parg is NULL, then make it into FALSE */
1201	if (!*parg) {
1202		*parg = allocate_arg();
1203		if (*parg == NULL)
1204			return PEVENT_ERRNO__MEM_ALLOC_FAILED;
1205
1206		(*parg)->type = FILTER_ARG_BOOLEAN;
1207		(*parg)->boolean.value = FILTER_FALSE;
1208	}
1209
1210	return 0;
1211}
1212
1213static enum pevent_errno
1214filter_event(struct event_filter *filter, struct event_format *event,
1215	     const char *filter_str, char *error_str)
1216{
1217	struct filter_type *filter_type;
1218	struct filter_arg *arg;
1219	enum pevent_errno ret;
1220
1221	if (filter_str) {
1222		ret = process_event(event, filter_str, &arg, error_str);
1223		if (ret < 0)
1224			return ret;
1225
1226	} else {
1227		/* just add a TRUE arg */
1228		arg = allocate_arg();
1229		if (arg == NULL)
1230			return PEVENT_ERRNO__MEM_ALLOC_FAILED;
1231
1232		arg->type = FILTER_ARG_BOOLEAN;
1233		arg->boolean.value = FILTER_TRUE;
1234	}
1235
1236	filter_type = add_filter_type(filter, event->id);
1237	if (filter_type == NULL)
1238		return PEVENT_ERRNO__MEM_ALLOC_FAILED;
1239
1240	if (filter_type->filter)
1241		free_arg(filter_type->filter);
1242	filter_type->filter = arg;
1243
1244	return 0;
1245}
1246
1247static void filter_init_error_buf(struct event_filter *filter)
1248{
1249	/* clear buffer to reset show error */
1250	pevent_buffer_init("", 0);
1251	filter->error_buffer[0] = '\0';
1252}
1253
1254/**
1255 * pevent_filter_add_filter_str - add a new filter
1256 * @filter: the event filter to add to
1257 * @filter_str: the filter string that contains the filter
1258 *
1259 * Returns 0 if the filter was successfully added or a
1260 * negative error code.  Use pevent_filter_strerror() to see
1261 * actual error message in case of error.
1262 */
1263enum pevent_errno pevent_filter_add_filter_str(struct event_filter *filter,
1264					       const char *filter_str)
1265{
1266	struct pevent *pevent = filter->pevent;
1267	struct event_list *event;
1268	struct event_list *events = NULL;
1269	const char *filter_start;
1270	const char *next_event;
1271	char *this_event;
1272	char *event_name = NULL;
1273	char *sys_name = NULL;
1274	char *sp;
1275	enum pevent_errno rtn = 0; /* PEVENT_ERRNO__SUCCESS */
1276	int len;
1277	int ret;
1278
1279	filter_init_error_buf(filter);
1280
1281	filter_start = strchr(filter_str, ':');
1282	if (filter_start)
1283		len = filter_start - filter_str;
1284	else
1285		len = strlen(filter_str);
1286
1287	do {
1288		next_event = strchr(filter_str, ',');
1289		if (next_event &&
1290		    (!filter_start || next_event < filter_start))
1291			len = next_event - filter_str;
1292		else if (filter_start)
1293			len = filter_start - filter_str;
1294		else
1295			len = strlen(filter_str);
1296
1297		this_event = malloc(len + 1);
1298		if (this_event == NULL) {
1299			/* This can only happen when events is NULL, but still */
1300			free_events(events);
1301			return PEVENT_ERRNO__MEM_ALLOC_FAILED;
1302		}
1303		memcpy(this_event, filter_str, len);
1304		this_event[len] = 0;
1305
1306		if (next_event)
1307			next_event++;
1308
1309		filter_str = next_event;
1310
1311		sys_name = strtok_r(this_event, "/", &sp);
1312		event_name = strtok_r(NULL, "/", &sp);
1313
1314		if (!sys_name) {
1315			/* This can only happen when events is NULL, but still */
1316			free_events(events);
1317			free(this_event);
1318			return PEVENT_ERRNO__FILTER_NOT_FOUND;
1319		}
1320
1321		/* Find this event */
1322		ret = find_event(pevent, &events, strim(sys_name), strim(event_name));
1323		if (ret < 0) {
1324			free_events(events);
1325			free(this_event);
1326			return ret;
1327		}
1328		free(this_event);
1329	} while (filter_str);
1330
1331	/* Skip the ':' */
1332	if (filter_start)
1333		filter_start++;
1334
1335	/* filter starts here */
1336	for (event = events; event; event = event->next) {
1337		ret = filter_event(filter, event->event, filter_start,
1338				   filter->error_buffer);
1339		/* Failures are returned if a parse error happened */
1340		if (ret < 0)
1341			rtn = ret;
1342
1343		if (ret >= 0 && pevent->test_filters) {
1344			char *test;
1345			test = pevent_filter_make_string(filter, event->event->id);
1346			if (test) {
1347				printf(" '%s: %s'\n", event->event->name, test);
1348				free(test);
1349			}
1350		}
1351	}
1352
1353	free_events(events);
1354
1355	if (rtn >= 0 && pevent->test_filters)
1356		exit(0);
1357
1358	return rtn;
1359}
1360
1361static void free_filter_type(struct filter_type *filter_type)
1362{
1363	free_arg(filter_type->filter);
1364}
1365
1366/**
1367 * pevent_filter_strerror - fill error message in a buffer
1368 * @filter: the event filter contains error
1369 * @err: the error code
1370 * @buf: the buffer to be filled in
1371 * @buflen: the size of the buffer
1372 *
1373 * Returns 0 if message was filled successfully, -1 if error
1374 */
1375int pevent_filter_strerror(struct event_filter *filter, enum pevent_errno err,
1376			   char *buf, size_t buflen)
1377{
1378	if (err <= __PEVENT_ERRNO__START || err >= __PEVENT_ERRNO__END)
1379		return -1;
1380
1381	if (strlen(filter->error_buffer) > 0) {
1382		size_t len = snprintf(buf, buflen, "%s", filter->error_buffer);
1383
1384		if (len > buflen)
1385			return -1;
1386		return 0;
1387	}
1388
1389	return pevent_strerror(filter->pevent, err, buf, buflen);
1390}
1391
1392/**
1393 * pevent_filter_remove_event - remove a filter for an event
1394 * @filter: the event filter to remove from
1395 * @event_id: the event to remove a filter for
1396 *
1397 * Removes the filter saved for an event defined by @event_id
1398 * from the @filter.
1399 *
1400 * Returns 1: if an event was removed
1401 *   0: if the event was not found
1402 */
1403int pevent_filter_remove_event(struct event_filter *filter,
1404			       int event_id)
1405{
1406	struct filter_type *filter_type;
1407	unsigned long len;
1408
1409	if (!filter->filters)
1410		return 0;
1411
1412	filter_type = find_filter_type(filter, event_id);
1413
1414	if (!filter_type)
1415		return 0;
1416
1417	free_filter_type(filter_type);
1418
1419	/* The filter_type points into the event_filters array */
1420	len = (unsigned long)(filter->event_filters + filter->filters) -
1421		(unsigned long)(filter_type + 1);
1422
1423	memmove(filter_type, filter_type + 1, len);
1424	filter->filters--;
1425
1426	memset(&filter->event_filters[filter->filters], 0,
1427	       sizeof(*filter_type));
1428
1429	return 1;
1430}
1431
1432/**
1433 * pevent_filter_reset - clear all filters in a filter
1434 * @filter: the event filter to reset
1435 *
1436 * Removes all filters from a filter and resets it.
1437 */
1438void pevent_filter_reset(struct event_filter *filter)
1439{
1440	int i;
1441
1442	for (i = 0; i < filter->filters; i++)
1443		free_filter_type(&filter->event_filters[i]);
1444
1445	free(filter->event_filters);
1446	filter->filters = 0;
1447	filter->event_filters = NULL;
1448}
1449
1450void pevent_filter_free(struct event_filter *filter)
1451{
1452	pevent_unref(filter->pevent);
1453
1454	pevent_filter_reset(filter);
1455
1456	free(filter);
1457}
1458
1459static char *arg_to_str(struct event_filter *filter, struct filter_arg *arg);
1460
1461static int copy_filter_type(struct event_filter *filter,
1462			     struct event_filter *source,
1463			     struct filter_type *filter_type)
1464{
1465	struct filter_arg *arg;
1466	struct event_format *event;
1467	const char *sys;
1468	const char *name;
1469	char *str;
1470
1471	/* Can't assume that the pevent's are the same */
1472	sys = filter_type->event->system;
1473	name = filter_type->event->name;
1474	event = pevent_find_event_by_name(filter->pevent, sys, name);
1475	if (!event)
1476		return -1;
1477
1478	str = arg_to_str(source, filter_type->filter);
1479	if (!str)
1480		return -1;
1481
1482	if (strcmp(str, "TRUE") == 0 || strcmp(str, "FALSE") == 0) {
1483		/* Add trivial event */
1484		arg = allocate_arg();
1485		if (arg == NULL)
1486			return -1;
1487
1488		arg->type = FILTER_ARG_BOOLEAN;
1489		if (strcmp(str, "TRUE") == 0)
1490			arg->boolean.value = 1;
1491		else
1492			arg->boolean.value = 0;
1493
1494		filter_type = add_filter_type(filter, event->id);
1495		if (filter_type == NULL)
1496			return -1;
1497
1498		filter_type->filter = arg;
1499
1500		free(str);
1501		return 0;
1502	}
1503
1504	filter_event(filter, event, str, NULL);
1505	free(str);
1506
1507	return 0;
1508}
1509
1510/**
1511 * pevent_filter_copy - copy a filter using another filter
1512 * @dest - the filter to copy to
1513 * @source - the filter to copy from
1514 *
1515 * Returns 0 on success and -1 if not all filters were copied
1516 */
1517int pevent_filter_copy(struct event_filter *dest, struct event_filter *source)
1518{
1519	int ret = 0;
1520	int i;
1521
1522	pevent_filter_reset(dest);
1523
1524	for (i = 0; i < source->filters; i++) {
1525		if (copy_filter_type(dest, source, &source->event_filters[i]))
1526			ret = -1;
1527	}
1528	return ret;
1529}
1530
1531
1532/**
1533 * pevent_update_trivial - update the trivial filters with the given filter
1534 * @dest - the filter to update
1535 * @source - the filter as the source of the update
1536 * @type - the type of trivial filter to update.
1537 *
1538 * Scan dest for trivial events matching @type to replace with the source.
1539 *
1540 * Returns 0 on success and -1 if there was a problem updating, but
1541 *   events may have still been updated on error.
1542 */
1543int pevent_update_trivial(struct event_filter *dest, struct event_filter *source,
1544			  enum filter_trivial_type type)
1545{
1546	struct pevent *src_pevent;
1547	struct pevent *dest_pevent;
1548	struct event_format *event;
1549	struct filter_type *filter_type;
1550	struct filter_arg *arg;
1551	char *str;
1552	int i;
1553
1554	src_pevent = source->pevent;
1555	dest_pevent = dest->pevent;
1556
1557	/* Do nothing if either of the filters has nothing to filter */
1558	if (!dest->filters || !source->filters)
1559		return 0;
1560
1561	for (i = 0; i < dest->filters; i++) {
1562		filter_type = &dest->event_filters[i];
1563		arg = filter_type->filter;
1564		if (arg->type != FILTER_ARG_BOOLEAN)
1565			continue;
1566		if ((arg->boolean.value && type == FILTER_TRIVIAL_FALSE) ||
1567		    (!arg->boolean.value && type == FILTER_TRIVIAL_TRUE))
1568			continue;
1569
1570		event = filter_type->event;
1571
1572		if (src_pevent != dest_pevent) {
1573			/* do a look up */
1574			event = pevent_find_event_by_name(src_pevent,
1575							  event->system,
1576							  event->name);
1577			if (!event)
1578				return -1;
1579		}
1580
1581		str = pevent_filter_make_string(source, event->id);
1582		if (!str)
1583			continue;
1584
1585		/* Don't bother if the filter is trivial too */
1586		if (strcmp(str, "TRUE") != 0 && strcmp(str, "FALSE") != 0)
1587			filter_event(dest, event, str, NULL);
1588		free(str);
1589	}
1590	return 0;
1591}
1592
1593/**
1594 * pevent_filter_clear_trivial - clear TRUE and FALSE filters
1595 * @filter: the filter to remove trivial filters from
1596 * @type: remove only true, false, or both
1597 *
1598 * Removes filters that only contain a TRUE or FALES boolean arg.
1599 *
1600 * Returns 0 on success and -1 if there was a problem.
1601 */
1602int pevent_filter_clear_trivial(struct event_filter *filter,
1603				 enum filter_trivial_type type)
1604{
1605	struct filter_type *filter_type;
1606	int count = 0;
1607	int *ids = NULL;
1608	int i;
1609
1610	if (!filter->filters)
1611		return 0;
1612
1613	/*
1614	 * Two steps, first get all ids with trivial filters.
1615	 *  then remove those ids.
1616	 */
1617	for (i = 0; i < filter->filters; i++) {
1618		int *new_ids;
1619
1620		filter_type = &filter->event_filters[i];
1621		if (filter_type->filter->type != FILTER_ARG_BOOLEAN)
1622			continue;
1623		switch (type) {
1624		case FILTER_TRIVIAL_FALSE:
1625			if (filter_type->filter->boolean.value)
1626				continue;
 
1627		case FILTER_TRIVIAL_TRUE:
1628			if (!filter_type->filter->boolean.value)
1629				continue;
1630		default:
1631			break;
1632		}
1633
1634		new_ids = realloc(ids, sizeof(*ids) * (count + 1));
1635		if (!new_ids) {
1636			free(ids);
1637			return -1;
1638		}
1639
1640		ids = new_ids;
1641		ids[count++] = filter_type->event_id;
1642	}
1643
1644	if (!count)
1645		return 0;
1646
1647	for (i = 0; i < count; i++)
1648		pevent_filter_remove_event(filter, ids[i]);
1649
1650	free(ids);
1651	return 0;
1652}
1653
1654/**
1655 * pevent_filter_event_has_trivial - return true event contains trivial filter
1656 * @filter: the filter with the information
1657 * @event_id: the id of the event to test
1658 * @type: trivial type to test for (TRUE, FALSE, EITHER)
1659 *
1660 * Returns 1 if the event contains a matching trivial type
1661 *  otherwise 0.
1662 */
1663int pevent_filter_event_has_trivial(struct event_filter *filter,
1664				    int event_id,
1665				    enum filter_trivial_type type)
1666{
1667	struct filter_type *filter_type;
1668
1669	if (!filter->filters)
1670		return 0;
1671
1672	filter_type = find_filter_type(filter, event_id);
1673
1674	if (!filter_type)
1675		return 0;
1676
1677	if (filter_type->filter->type != FILTER_ARG_BOOLEAN)
1678		return 0;
1679
1680	switch (type) {
1681	case FILTER_TRIVIAL_FALSE:
1682		return !filter_type->filter->boolean.value;
1683
1684	case FILTER_TRIVIAL_TRUE:
1685		return filter_type->filter->boolean.value;
1686	default:
1687		return 1;
1688	}
1689}
1690
1691static int test_filter(struct event_format *event, struct filter_arg *arg,
1692		       struct pevent_record *record, enum pevent_errno *err);
1693
1694static const char *
1695get_comm(struct event_format *event, struct pevent_record *record)
1696{
1697	const char *comm;
1698	int pid;
1699
1700	pid = pevent_data_pid(event->pevent, record);
1701	comm = pevent_data_comm_from_pid(event->pevent, pid);
1702	return comm;
1703}
1704
1705static unsigned long long
1706get_value(struct event_format *event,
1707	  struct format_field *field, struct pevent_record *record)
1708{
1709	unsigned long long val;
1710
1711	/* Handle our dummy "comm" field */
1712	if (field == &comm) {
1713		const char *name;
1714
1715		name = get_comm(event, record);
1716		return (unsigned long)name;
1717	}
1718
 
 
 
 
1719	pevent_read_number_field(field, record->data, &val);
1720
1721	if (!(field->flags & FIELD_IS_SIGNED))
1722		return val;
1723
1724	switch (field->size) {
1725	case 1:
1726		return (char)val;
1727	case 2:
1728		return (short)val;
1729	case 4:
1730		return (int)val;
1731	case 8:
1732		return (long long)val;
1733	}
1734	return val;
1735}
1736
1737static unsigned long long
1738get_arg_value(struct event_format *event, struct filter_arg *arg,
1739	      struct pevent_record *record, enum pevent_errno *err);
1740
1741static unsigned long long
1742get_exp_value(struct event_format *event, struct filter_arg *arg,
1743	      struct pevent_record *record, enum pevent_errno *err)
1744{
1745	unsigned long long lval, rval;
1746
1747	lval = get_arg_value(event, arg->exp.left, record, err);
1748	rval = get_arg_value(event, arg->exp.right, record, err);
1749
1750	if (*err) {
1751		/*
1752		 * There was an error, no need to process anymore.
1753		 */
1754		return 0;
1755	}
1756
1757	switch (arg->exp.type) {
1758	case FILTER_EXP_ADD:
1759		return lval + rval;
1760
1761	case FILTER_EXP_SUB:
1762		return lval - rval;
1763
1764	case FILTER_EXP_MUL:
1765		return lval * rval;
1766
1767	case FILTER_EXP_DIV:
1768		return lval / rval;
1769
1770	case FILTER_EXP_MOD:
1771		return lval % rval;
1772
1773	case FILTER_EXP_RSHIFT:
1774		return lval >> rval;
1775
1776	case FILTER_EXP_LSHIFT:
1777		return lval << rval;
1778
1779	case FILTER_EXP_AND:
1780		return lval & rval;
1781
1782	case FILTER_EXP_OR:
1783		return lval | rval;
1784
1785	case FILTER_EXP_XOR:
1786		return lval ^ rval;
1787
1788	case FILTER_EXP_NOT:
1789	default:
1790		if (!*err)
1791			*err = PEVENT_ERRNO__INVALID_EXP_TYPE;
1792	}
1793	return 0;
1794}
1795
1796static unsigned long long
1797get_arg_value(struct event_format *event, struct filter_arg *arg,
1798	      struct pevent_record *record, enum pevent_errno *err)
1799{
1800	switch (arg->type) {
1801	case FILTER_ARG_FIELD:
1802		return get_value(event, arg->field.field, record);
1803
1804	case FILTER_ARG_VALUE:
1805		if (arg->value.type != FILTER_NUMBER) {
1806			if (!*err)
1807				*err = PEVENT_ERRNO__NOT_A_NUMBER;
1808		}
1809		return arg->value.val;
1810
1811	case FILTER_ARG_EXP:
1812		return get_exp_value(event, arg, record, err);
1813
1814	default:
1815		if (!*err)
1816			*err = PEVENT_ERRNO__INVALID_ARG_TYPE;
1817	}
1818	return 0;
1819}
1820
1821static int test_num(struct event_format *event, struct filter_arg *arg,
1822		    struct pevent_record *record, enum pevent_errno *err)
1823{
1824	unsigned long long lval, rval;
1825
1826	lval = get_arg_value(event, arg->num.left, record, err);
1827	rval = get_arg_value(event, arg->num.right, record, err);
1828
1829	if (*err) {
1830		/*
1831		 * There was an error, no need to process anymore.
1832		 */
1833		return 0;
1834	}
1835
1836	switch (arg->num.type) {
1837	case FILTER_CMP_EQ:
1838		return lval == rval;
1839
1840	case FILTER_CMP_NE:
1841		return lval != rval;
1842
1843	case FILTER_CMP_GT:
1844		return lval > rval;
1845
1846	case FILTER_CMP_LT:
1847		return lval < rval;
1848
1849	case FILTER_CMP_GE:
1850		return lval >= rval;
1851
1852	case FILTER_CMP_LE:
1853		return lval <= rval;
1854
1855	default:
1856		if (!*err)
1857			*err = PEVENT_ERRNO__ILLEGAL_INTEGER_CMP;
1858		return 0;
1859	}
1860}
1861
1862static const char *get_field_str(struct filter_arg *arg, struct pevent_record *record)
1863{
1864	struct event_format *event;
1865	struct pevent *pevent;
1866	unsigned long long addr;
1867	const char *val = NULL;
 
1868	char hex[64];
1869
1870	/* If the field is not a string convert it */
1871	if (arg->str.field->flags & FIELD_IS_STRING) {
1872		val = record->data + arg->str.field->offset;
 
 
 
 
 
 
 
1873
1874		/*
1875		 * We need to copy the data since we can't be sure the field
1876		 * is null terminated.
1877		 */
1878		if (*(val + arg->str.field->size - 1)) {
1879			/* copy it */
1880			memcpy(arg->str.buffer, val, arg->str.field->size);
1881			/* the buffer is already NULL terminated */
1882			val = arg->str.buffer;
1883		}
1884
1885	} else {
1886		event = arg->str.field->event;
1887		pevent = event->pevent;
1888		addr = get_value(event, arg->str.field, record);
1889
1890		if (arg->str.field->flags & (FIELD_IS_POINTER | FIELD_IS_LONG))
1891			/* convert to a kernel symbol */
1892			val = pevent_find_function(pevent, addr);
1893
1894		if (val == NULL) {
1895			/* just use the hex of the string name */
1896			snprintf(hex, 64, "0x%llx", addr);
1897			val = hex;
1898		}
1899	}
1900
1901	return val;
1902}
1903
1904static int test_str(struct event_format *event, struct filter_arg *arg,
1905		    struct pevent_record *record, enum pevent_errno *err)
1906{
1907	const char *val;
1908
1909	if (arg->str.field == &comm)
1910		val = get_comm(event, record);
1911	else
1912		val = get_field_str(arg, record);
1913
1914	switch (arg->str.type) {
1915	case FILTER_CMP_MATCH:
1916		return strcmp(val, arg->str.val) == 0;
1917
1918	case FILTER_CMP_NOT_MATCH:
1919		return strcmp(val, arg->str.val) != 0;
1920
1921	case FILTER_CMP_REGEX:
1922		/* Returns zero on match */
1923		return !regexec(&arg->str.reg, val, 0, NULL, 0);
1924
1925	case FILTER_CMP_NOT_REGEX:
1926		return regexec(&arg->str.reg, val, 0, NULL, 0);
1927
1928	default:
1929		if (!*err)
1930			*err = PEVENT_ERRNO__ILLEGAL_STRING_CMP;
1931		return 0;
1932	}
1933}
1934
1935static int test_op(struct event_format *event, struct filter_arg *arg,
1936		   struct pevent_record *record, enum pevent_errno *err)
1937{
1938	switch (arg->op.type) {
1939	case FILTER_OP_AND:
1940		return test_filter(event, arg->op.left, record, err) &&
1941			test_filter(event, arg->op.right, record, err);
1942
1943	case FILTER_OP_OR:
1944		return test_filter(event, arg->op.left, record, err) ||
1945			test_filter(event, arg->op.right, record, err);
1946
1947	case FILTER_OP_NOT:
1948		return !test_filter(event, arg->op.right, record, err);
1949
1950	default:
1951		if (!*err)
1952			*err = PEVENT_ERRNO__INVALID_OP_TYPE;
1953		return 0;
1954	}
1955}
1956
1957static int test_filter(struct event_format *event, struct filter_arg *arg,
1958		       struct pevent_record *record, enum pevent_errno *err)
1959{
1960	if (*err) {
1961		/*
1962		 * There was an error, no need to process anymore.
1963		 */
1964		return 0;
1965	}
1966
1967	switch (arg->type) {
1968	case FILTER_ARG_BOOLEAN:
1969		/* easy case */
1970		return arg->boolean.value;
1971
1972	case FILTER_ARG_OP:
1973		return test_op(event, arg, record, err);
1974
1975	case FILTER_ARG_NUM:
1976		return test_num(event, arg, record, err);
1977
1978	case FILTER_ARG_STR:
1979		return test_str(event, arg, record, err);
1980
1981	case FILTER_ARG_EXP:
1982	case FILTER_ARG_VALUE:
1983	case FILTER_ARG_FIELD:
1984		/*
1985		 * Expressions, fields and values evaluate
1986		 * to true if they return non zero
1987		 */
1988		return !!get_arg_value(event, arg, record, err);
1989
1990	default:
1991		if (!*err)
1992			*err = PEVENT_ERRNO__INVALID_ARG_TYPE;
1993		return 0;
1994	}
1995}
1996
1997/**
1998 * pevent_event_filtered - return true if event has filter
1999 * @filter: filter struct with filter information
2000 * @event_id: event id to test if filter exists
2001 *
2002 * Returns 1 if filter found for @event_id
2003 *   otherwise 0;
2004 */
2005int pevent_event_filtered(struct event_filter *filter, int event_id)
2006{
2007	struct filter_type *filter_type;
2008
2009	if (!filter->filters)
2010		return 0;
2011
2012	filter_type = find_filter_type(filter, event_id);
2013
2014	return filter_type ? 1 : 0;
2015}
2016
2017/**
2018 * pevent_filter_match - test if a record matches a filter
2019 * @filter: filter struct with filter information
2020 * @record: the record to test against the filter
2021 *
2022 * Returns: match result or error code (prefixed with PEVENT_ERRNO__)
2023 * FILTER_MATCH - filter found for event and @record matches
2024 * FILTER_MISS  - filter found for event and @record does not match
2025 * FILTER_NOT_FOUND - no filter found for @record's event
2026 * NO_FILTER - if no filters exist
2027 * otherwise - error occurred during test
2028 */
2029enum pevent_errno pevent_filter_match(struct event_filter *filter,
2030				      struct pevent_record *record)
2031{
2032	struct pevent *pevent = filter->pevent;
2033	struct filter_type *filter_type;
2034	int event_id;
2035	int ret;
2036	enum pevent_errno err = 0;
2037
2038	filter_init_error_buf(filter);
2039
2040	if (!filter->filters)
2041		return PEVENT_ERRNO__NO_FILTER;
2042
2043	event_id = pevent_data_type(pevent, record);
2044
2045	filter_type = find_filter_type(filter, event_id);
2046	if (!filter_type)
2047		return PEVENT_ERRNO__FILTER_NOT_FOUND;
2048
2049	ret = test_filter(filter_type->event, filter_type->filter, record, &err);
2050	if (err)
2051		return err;
2052
2053	return ret ? PEVENT_ERRNO__FILTER_MATCH : PEVENT_ERRNO__FILTER_MISS;
2054}
2055
2056static char *op_to_str(struct event_filter *filter, struct filter_arg *arg)
2057{
2058	char *str = NULL;
2059	char *left = NULL;
2060	char *right = NULL;
2061	char *op = NULL;
2062	int left_val = -1;
2063	int right_val = -1;
2064	int val;
2065
2066	switch (arg->op.type) {
2067	case FILTER_OP_AND:
2068		op = "&&";
2069		/* fall through */
2070	case FILTER_OP_OR:
2071		if (!op)
2072			op = "||";
2073
2074		left = arg_to_str(filter, arg->op.left);
2075		right = arg_to_str(filter, arg->op.right);
2076		if (!left || !right)
2077			break;
2078
2079		/* Try to consolidate boolean values */
2080		if (strcmp(left, "TRUE") == 0)
2081			left_val = 1;
2082		else if (strcmp(left, "FALSE") == 0)
2083			left_val = 0;
2084
2085		if (strcmp(right, "TRUE") == 0)
2086			right_val = 1;
2087		else if (strcmp(right, "FALSE") == 0)
2088			right_val = 0;
2089
2090		if (left_val >= 0) {
2091			if ((arg->op.type == FILTER_OP_AND && !left_val) ||
2092			    (arg->op.type == FILTER_OP_OR && left_val)) {
2093				/* Just return left value */
2094				str = left;
2095				left = NULL;
2096				break;
2097			}
2098			if (right_val >= 0) {
2099				/* just evaluate this. */
2100				val = 0;
2101				switch (arg->op.type) {
2102				case FILTER_OP_AND:
2103					val = left_val && right_val;
2104					break;
2105				case FILTER_OP_OR:
2106					val = left_val || right_val;
2107					break;
2108				default:
2109					break;
2110				}
2111				asprintf(&str, val ? "TRUE" : "FALSE");
2112				break;
2113			}
2114		}
2115		if (right_val >= 0) {
2116			if ((arg->op.type == FILTER_OP_AND && !right_val) ||
2117			    (arg->op.type == FILTER_OP_OR && right_val)) {
2118				/* Just return right value */
2119				str = right;
2120				right = NULL;
2121				break;
2122			}
2123			/* The right value is meaningless */
2124			str = left;
2125			left = NULL;
2126			break;
2127		}
2128
2129		asprintf(&str, "(%s) %s (%s)", left, op, right);
2130		break;
2131
2132	case FILTER_OP_NOT:
2133		op = "!";
2134		right = arg_to_str(filter, arg->op.right);
2135		if (!right)
2136			break;
2137
2138		/* See if we can consolidate */
2139		if (strcmp(right, "TRUE") == 0)
2140			right_val = 1;
2141		else if (strcmp(right, "FALSE") == 0)
2142			right_val = 0;
2143		if (right_val >= 0) {
2144			/* just return the opposite */
2145			asprintf(&str, right_val ? "FALSE" : "TRUE");
2146			break;
2147		}
2148		asprintf(&str, "%s(%s)", op, right);
2149		break;
2150
2151	default:
2152		/* ?? */
2153		break;
2154	}
2155	free(left);
2156	free(right);
2157	return str;
2158}
2159
2160static char *val_to_str(struct event_filter *filter, struct filter_arg *arg)
2161{
2162	char *str = NULL;
2163
2164	asprintf(&str, "%lld", arg->value.val);
2165
2166	return str;
2167}
2168
2169static char *field_to_str(struct event_filter *filter, struct filter_arg *arg)
2170{
2171	return strdup(arg->field.field->name);
2172}
2173
2174static char *exp_to_str(struct event_filter *filter, struct filter_arg *arg)
2175{
2176	char *lstr;
2177	char *rstr;
2178	char *op;
2179	char *str = NULL;
2180
2181	lstr = arg_to_str(filter, arg->exp.left);
2182	rstr = arg_to_str(filter, arg->exp.right);
2183	if (!lstr || !rstr)
2184		goto out;
2185
2186	switch (arg->exp.type) {
2187	case FILTER_EXP_ADD:
2188		op = "+";
2189		break;
2190	case FILTER_EXP_SUB:
2191		op = "-";
2192		break;
2193	case FILTER_EXP_MUL:
2194		op = "*";
2195		break;
2196	case FILTER_EXP_DIV:
2197		op = "/";
2198		break;
2199	case FILTER_EXP_MOD:
2200		op = "%";
2201		break;
2202	case FILTER_EXP_RSHIFT:
2203		op = ">>";
2204		break;
2205	case FILTER_EXP_LSHIFT:
2206		op = "<<";
2207		break;
2208	case FILTER_EXP_AND:
2209		op = "&";
2210		break;
2211	case FILTER_EXP_OR:
2212		op = "|";
2213		break;
2214	case FILTER_EXP_XOR:
2215		op = "^";
2216		break;
2217	default:
2218		op = "[ERROR IN EXPRESSION TYPE]";
2219		break;
2220	}
2221
2222	asprintf(&str, "%s %s %s", lstr, op, rstr);
2223out:
2224	free(lstr);
2225	free(rstr);
2226
2227	return str;
2228}
2229
2230static char *num_to_str(struct event_filter *filter, struct filter_arg *arg)
2231{
2232	char *lstr;
2233	char *rstr;
2234	char *str = NULL;
2235	char *op = NULL;
2236
2237	lstr = arg_to_str(filter, arg->num.left);
2238	rstr = arg_to_str(filter, arg->num.right);
2239	if (!lstr || !rstr)
2240		goto out;
2241
2242	switch (arg->num.type) {
2243	case FILTER_CMP_EQ:
2244		op = "==";
2245		/* fall through */
2246	case FILTER_CMP_NE:
2247		if (!op)
2248			op = "!=";
2249		/* fall through */
2250	case FILTER_CMP_GT:
2251		if (!op)
2252			op = ">";
2253		/* fall through */
2254	case FILTER_CMP_LT:
2255		if (!op)
2256			op = "<";
2257		/* fall through */
2258	case FILTER_CMP_GE:
2259		if (!op)
2260			op = ">=";
2261		/* fall through */
2262	case FILTER_CMP_LE:
2263		if (!op)
2264			op = "<=";
2265
2266		asprintf(&str, "%s %s %s", lstr, op, rstr);
2267		break;
2268
2269	default:
2270		/* ?? */
2271		break;
2272	}
2273
2274out:
2275	free(lstr);
2276	free(rstr);
2277	return str;
2278}
2279
2280static char *str_to_str(struct event_filter *filter, struct filter_arg *arg)
2281{
2282	char *str = NULL;
2283	char *op = NULL;
2284
2285	switch (arg->str.type) {
2286	case FILTER_CMP_MATCH:
2287		op = "==";
2288		/* fall through */
2289	case FILTER_CMP_NOT_MATCH:
2290		if (!op)
2291			op = "!=";
2292		/* fall through */
2293	case FILTER_CMP_REGEX:
2294		if (!op)
2295			op = "=~";
2296		/* fall through */
2297	case FILTER_CMP_NOT_REGEX:
2298		if (!op)
2299			op = "!~";
2300
2301		asprintf(&str, "%s %s \"%s\"",
2302			 arg->str.field->name, op, arg->str.val);
2303		break;
2304
2305	default:
2306		/* ?? */
2307		break;
2308	}
2309	return str;
2310}
2311
2312static char *arg_to_str(struct event_filter *filter, struct filter_arg *arg)
2313{
2314	char *str = NULL;
2315
2316	switch (arg->type) {
2317	case FILTER_ARG_BOOLEAN:
2318		asprintf(&str, arg->boolean.value ? "TRUE" : "FALSE");
2319		return str;
2320
2321	case FILTER_ARG_OP:
2322		return op_to_str(filter, arg);
2323
2324	case FILTER_ARG_NUM:
2325		return num_to_str(filter, arg);
2326
2327	case FILTER_ARG_STR:
2328		return str_to_str(filter, arg);
2329
2330	case FILTER_ARG_VALUE:
2331		return val_to_str(filter, arg);
2332
2333	case FILTER_ARG_FIELD:
2334		return field_to_str(filter, arg);
2335
2336	case FILTER_ARG_EXP:
2337		return exp_to_str(filter, arg);
2338
2339	default:
2340		/* ?? */
2341		return NULL;
2342	}
2343
2344}
2345
2346/**
2347 * pevent_filter_make_string - return a string showing the filter
2348 * @filter: filter struct with filter information
2349 * @event_id: the event id to return the filter string with
2350 *
2351 * Returns a string that displays the filter contents.
2352 *  This string must be freed with free(str).
2353 *  NULL is returned if no filter is found or allocation failed.
2354 */
2355char *
2356pevent_filter_make_string(struct event_filter *filter, int event_id)
2357{
2358	struct filter_type *filter_type;
2359
2360	if (!filter->filters)
2361		return NULL;
2362
2363	filter_type = find_filter_type(filter, event_id);
2364
2365	if (!filter_type)
2366		return NULL;
2367
2368	return arg_to_str(filter, filter_type->filter);
2369}
2370
2371/**
2372 * pevent_filter_compare - compare two filters and return if they are the same
2373 * @filter1: Filter to compare with @filter2
2374 * @filter2: Filter to compare with @filter1
2375 *
2376 * Returns:
2377 *  1 if the two filters hold the same content.
2378 *  0 if they do not.
2379 */
2380int pevent_filter_compare(struct event_filter *filter1, struct event_filter *filter2)
2381{
2382	struct filter_type *filter_type1;
2383	struct filter_type *filter_type2;
2384	char *str1, *str2;
2385	int result;
2386	int i;
2387
2388	/* Do the easy checks first */
2389	if (filter1->filters != filter2->filters)
2390		return 0;
2391	if (!filter1->filters && !filter2->filters)
2392		return 1;
2393
2394	/*
2395	 * Now take a look at each of the events to see if they have the same
2396	 * filters to them.
2397	 */
2398	for (i = 0; i < filter1->filters; i++) {
2399		filter_type1 = &filter1->event_filters[i];
2400		filter_type2 = find_filter_type(filter2, filter_type1->event_id);
2401		if (!filter_type2)
2402			break;
2403		if (filter_type1->filter->type != filter_type2->filter->type)
2404			break;
2405		switch (filter_type1->filter->type) {
2406		case FILTER_TRIVIAL_FALSE:
2407		case FILTER_TRIVIAL_TRUE:
2408			/* trivial types just need the type compared */
2409			continue;
2410		default:
2411			break;
2412		}
2413		/* The best way to compare complex filters is with strings */
2414		str1 = arg_to_str(filter1, filter_type1->filter);
2415		str2 = arg_to_str(filter2, filter_type2->filter);
2416		if (str1 && str2)
2417			result = strcmp(str1, str2) != 0;
2418		else
2419			/* bail out if allocation fails */
2420			result = 1;
2421
2422		free(str1);
2423		free(str2);
2424		if (result)
2425			break;
2426	}
2427
2428	if (i < filter1->filters)
2429		return 0;
2430	return 1;
2431}
2432