1/*
   2 * Copyright (C) 2010 Red Hat Inc, Steven Rostedt <srostedt@redhat.com>
   3 *
   4 * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   5 * This program is free software; you can redistribute it and/or
   6 * modify it under the terms of the GNU Lesser General Public
   7 * License as published by the Free Software Foundation;
   8 * version 2.1 of the License (not later!)
   9 *
  10 * This program is distributed in the hope that it will be useful,
  11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 * GNU Lesser General Public License for more details.
  14 *
  15 * You should have received a copy of the GNU Lesser General Public
  16 * License along with this program; if not, write to the Free Software
  17 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  18 *
  19 * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  20 */
  21#include <stdio.h>
  22#include <stdlib.h>
  23#include <string.h>
  24#include <stdarg.h>
  25#include <errno.h>
  26#include <sys/types.h>
  27
  28#include "event-parse.h"
 
  29#include "event-utils.h"
  30
  31#define COMM "COMM"
 
  32
  33static struct format_field comm = {
  34	.name = "COMM",
  35};
  36
 
 
 
 
  37struct event_list {
  38	struct event_list	*next;
  39	struct event_format	*event;
  40};
  41
  42#define MAX_ERR_STR_SIZE 256
  43
  44static void show_error(char **error_str, const char *fmt, ...)
  45{
  46	unsigned long long index;
  47	const char *input;
  48	char *error;
  49	va_list ap;
  50	int len;
  51	int i;
  52
  53	if (!error_str)
  54		return;
  55
  56	input = pevent_get_input_buf();
  57	index = pevent_get_input_buf_ptr();
  58	len = input ? strlen(input) : 0;
  59
  60	error = malloc_or_die(MAX_ERR_STR_SIZE + (len*2) + 3);
  61
  62	if (len) {
  63		strcpy(error, input);
  64		error[len] = '\n';
  65		for (i = 1; i < len && i < index; i++)
  66			error[len+i] = ' ';
  67		error[len + i] = '^';
  68		error[len + i + 1] = '\n';
  69		len += i+2;
  70	}
  71
  72	va_start(ap, fmt);
  73	vsnprintf(error + len, MAX_ERR_STR_SIZE, fmt, ap);
  74	va_end(ap);
  75
  76	*error_str = error;
  77}
  78
  79static void free_token(char *token)
  80{
  81	pevent_free_token(token);
  82}
  83
  84static enum event_type read_token(char **tok)
  85{
  86	enum event_type type;
  87	char *token = NULL;
  88
  89	do {
  90		free_token(token);
  91		type = pevent_read_token(&token);
  92	} while (type == EVENT_NEWLINE || type == EVENT_SPACE);
  93
  94	/* If token is = or ! check to see if the next char is ~ */
  95	if (token &&
  96	    (strcmp(token, "=") == 0 || strcmp(token, "!") == 0) &&
  97	    pevent_peek_char() == '~') {
  98		/* append it */
  99		*tok = malloc(3);
 
 
 
 
 100		sprintf(*tok, "%c%c", *token, '~');
 101		free_token(token);
 102		/* Now remove the '~' from the buffer */
 103		pevent_read_token(&token);
 104		free_token(token);
 105	} else
 106		*tok = token;
 107
 108	return type;
 109}
 110
 111static int filter_cmp(const void *a, const void *b)
 112{
 113	const struct filter_type *ea = a;
 114	const struct filter_type *eb = b;
 115
 116	if (ea->event_id < eb->event_id)
 117		return -1;
 118
 119	if (ea->event_id > eb->event_id)
 120		return 1;
 121
 122	return 0;
 123}
 124
 125static struct filter_type *
 126find_filter_type(struct event_filter *filter, int id)
 127{
 128	struct filter_type *filter_type;
 129	struct filter_type key;
 130
 131	key.event_id = id;
 132
 133	filter_type = bsearch(&key, filter->event_filters,
 134			      filter->filters,
 135			      sizeof(*filter->event_filters),
 136			      filter_cmp);
 137
 138	return filter_type;
 139}
 140
 141static struct filter_type *
 142add_filter_type(struct event_filter *filter, int id)
 143{
 144	struct filter_type *filter_type;
 145	int i;
 146
 147	filter_type = find_filter_type(filter, id);
 148	if (filter_type)
 149		return filter_type;
 150
 151	if (!filter->filters)
 152		filter->event_filters =
 153			malloc_or_die(sizeof(*filter->event_filters));
 154	else {
 155		filter->event_filters =
 156			realloc(filter->event_filters,
 157				sizeof(*filter->event_filters) *
 158				(filter->filters + 1));
 159		if (!filter->event_filters)
 160			die("Could not allocate filter");
 161	}
 162
 163	for (i = 0; i < filter->filters; i++) {
 164		if (filter->event_filters[i].event_id > id)
 165			break;
 166	}
 167
 168	if (i < filter->filters)
 169		memmove(&filter->event_filters[i+1],
 170			&filter->event_filters[i],
 171			sizeof(*filter->event_filters) *
 172			(filter->filters - i));
 173
 174	filter_type = &filter->event_filters[i];
 175	filter_type->event_id = id;
 176	filter_type->event = pevent_find_event(filter->pevent, id);
 177	filter_type->filter = NULL;
 178
 179	filter->filters++;
 180
 181	return filter_type;
 182}
 183
 184/**
 185 * pevent_filter_alloc - create a new event filter
 186 * @pevent: The pevent that this filter is associated with
 187 */
 188struct event_filter *pevent_filter_alloc(struct pevent *pevent)
 189{
 190	struct event_filter *filter;
 
 
 
 
 191
 192	filter = malloc_or_die(sizeof(*filter));
 193	memset(filter, 0, sizeof(*filter));
 194	filter->pevent = pevent;
 195	pevent_ref(pevent);
 196
 197	return filter;
 198}
 199
 200static struct filter_arg *allocate_arg(void)
 201{
 202	struct filter_arg *arg;
 203
 204	arg = malloc_or_die(sizeof(*arg));
 205	memset(arg, 0, sizeof(*arg));
 206
 207	return arg;
 208}
 209
 210static void free_arg(struct filter_arg *arg)
 211{
 212	if (!arg)
 213		return;
 214
 215	switch (arg->type) {
 216	case FILTER_ARG_NONE:
 217	case FILTER_ARG_BOOLEAN:
 218	case FILTER_ARG_NUM:
 
 
 
 
 
 
 
 
 
 219		break;
 220
 221	case FILTER_ARG_STR:
 222		free(arg->str.val);
 223		regfree(&arg->str.reg);
 224		free(arg->str.buffer);
 225		break;
 226
 227	case FILTER_ARG_OP:
 
 
 
 
 
 
 228		free_arg(arg->op.left);
 229		free_arg(arg->op.right);
 230	default:
 231		break;
 232	}
 233
 234	free(arg);
 235}
 236
 237static void add_event(struct event_list **events,
 238		      struct event_format *event)
 239{
 240	struct event_list *list;
 241
 242	list = malloc_or_die(sizeof(*list));
 
 
 
 243	list->next = *events;
 244	*events = list;
 245	list->event = event;
 
 246}
 247
 248static int event_match(struct event_format *event,
 249		       regex_t *sreg, regex_t *ereg)
 250{
 251	if (sreg) {
 252		return !regexec(sreg, event->system, 0, NULL, 0) &&
 253			!regexec(ereg, event->name, 0, NULL, 0);
 254	}
 255
 256	return !regexec(ereg, event->system, 0, NULL, 0) ||
 257		!regexec(ereg, event->name, 0, NULL, 0);
 258}
 259
 260static int
 261find_event(struct pevent *pevent, struct event_list **events,
 262	   char *sys_name, char *event_name)
 263{
 264	struct event_format *event;
 265	regex_t ereg;
 266	regex_t sreg;
 267	int match = 0;
 
 268	char *reg;
 269	int ret;
 270	int i;
 271
 272	if (!event_name) {
 273		/* if no name is given, then swap sys and name */
 274		event_name = sys_name;
 275		sys_name = NULL;
 276	}
 277
 278	reg = malloc_or_die(strlen(event_name) + 3);
 279	sprintf(reg, "^%s$", event_name);
 
 280
 281	ret = regcomp(&ereg, reg, REG_ICASE|REG_NOSUB);
 282	free(reg);
 283
 284	if (ret)
 285		return -1;
 286
 287	if (sys_name) {
 288		reg = malloc_or_die(strlen(sys_name) + 3);
 289		sprintf(reg, "^%s$", sys_name);
 
 
 
 
 290		ret = regcomp(&sreg, reg, REG_ICASE|REG_NOSUB);
 291		free(reg);
 292		if (ret) {
 293			regfree(&ereg);
 294			return -1;
 295		}
 296	}
 297
 298	for (i = 0; i < pevent->nr_events; i++) {
 299		event = pevent->events[i];
 300		if (event_match(event, sys_name ? &sreg : NULL, &ereg)) {
 301			match = 1;
 302			add_event(events, event);
 
 
 
 303		}
 304	}
 305
 306	regfree(&ereg);
 307	if (sys_name)
 308		regfree(&sreg);
 309
 310	if (!match)
 311		return -1;
 
 
 312
 313	return 0;
 314}
 315
 316static void free_events(struct event_list *events)
 317{
 318	struct event_list *event;
 319
 320	while (events) {
 321		event = events;
 322		events = events->next;
 323		free(event);
 324	}
 325}
 326
 327static struct filter_arg *
 328create_arg_item(struct event_format *event, const char *token,
 329		enum event_type type, char **error_str)
 330{
 331	struct format_field *field;
 332	struct filter_arg *arg;
 333
 334	arg = allocate_arg();
 
 
 
 
 335
 336	switch (type) {
 337
 338	case EVENT_SQUOTE:
 339	case EVENT_DQUOTE:
 340		arg->type = FILTER_ARG_VALUE;
 341		arg->value.type =
 342			type == EVENT_DQUOTE ? FILTER_STRING : FILTER_CHAR;
 343		arg->value.str = strdup(token);
 344		if (!arg->value.str)
 345			die("malloc string");
 
 
 
 346		break;
 347	case EVENT_ITEM:
 348		/* if it is a number, then convert it */
 349		if (isdigit(token[0])) {
 350			arg->type = FILTER_ARG_VALUE;
 351			arg->value.type = FILTER_NUMBER;
 352			arg->value.val = strtoull(token, NULL, 0);
 353			break;
 354		}
 355		/* Consider this a field */
 356		field = pevent_find_any_field(event, token);
 357		if (!field) {
 358			if (strcmp(token, COMM) != 0) {
 
 
 
 
 
 359				/* not a field, Make it false */
 360				arg->type = FILTER_ARG_BOOLEAN;
 361				arg->boolean.value = FILTER_FALSE;
 362				break;
 363			}
 364			/* If token is 'COMM' then it is special */
 365			field = &comm;
 366		}
 367		arg->type = FILTER_ARG_FIELD;
 368		arg->field.field = field;
 369		break;
 370	default:
 371		free_arg(arg);
 372		show_error(error_str, "expected a value but found %s",
 373			   token);
 374		return NULL;
 375	}
 376	return arg;
 
 377}
 378
 379static struct filter_arg *
 380create_arg_op(enum filter_op_type btype)
 381{
 382	struct filter_arg *arg;
 383
 384	arg = allocate_arg();
 385	arg->type = FILTER_ARG_OP;
 
 
 
 386	arg->op.type = btype;
 387
 388	return arg;
 389}
 390
 391static struct filter_arg *
 392create_arg_exp(enum filter_exp_type etype)
 393{
 394	struct filter_arg *arg;
 395
 396	arg = allocate_arg();
 397	arg->type = FILTER_ARG_EXP;
 398	arg->op.type = etype;
 
 
 
 399
 400	return arg;
 401}
 402
 403static struct filter_arg *
 404create_arg_cmp(enum filter_exp_type etype)
 405{
 406	struct filter_arg *arg;
 407
 408	arg = allocate_arg();
 
 
 
 409	/* Use NUM and change if necessary */
 410	arg->type = FILTER_ARG_NUM;
 411	arg->op.type = etype;
 412
 413	return arg;
 414}
 415
 416static int add_right(struct filter_arg *op, struct filter_arg *arg,
 417		     char **error_str)
 418{
 419	struct filter_arg *left;
 420	char *str;
 421	int op_type;
 422	int ret;
 423
 424	switch (op->type) {
 425	case FILTER_ARG_EXP:
 426		if (op->exp.right)
 427			goto out_fail;
 428		op->exp.right = arg;
 429		break;
 430
 431	case FILTER_ARG_OP:
 432		if (op->op.right)
 433			goto out_fail;
 434		op->op.right = arg;
 435		break;
 436
 437	case FILTER_ARG_NUM:
 438		if (op->op.right)
 439			goto out_fail;
 440		/*
 441		 * The arg must be num, str, or field
 442		 */
 443		switch (arg->type) {
 444		case FILTER_ARG_VALUE:
 445		case FILTER_ARG_FIELD:
 446			break;
 447		default:
 448			show_error(error_str,
 449				   "Illegal rvalue");
 450			return -1;
 451		}
 452
 453		/*
 454		 * Depending on the type, we may need to
 455		 * convert this to a string or regex.
 456		 */
 457		switch (arg->value.type) {
 458		case FILTER_CHAR:
 459			/*
 460			 * A char should be converted to number if
 461			 * the string is 1 byte, and the compare
 462			 * is not a REGEX.
 463			 */
 464			if (strlen(arg->value.str) == 1 &&
 465			    op->num.type != FILTER_CMP_REGEX &&
 466			    op->num.type != FILTER_CMP_NOT_REGEX) {
 467				arg->value.type = FILTER_NUMBER;
 468				goto do_int;
 469			}
 470			/* fall through */
 471		case FILTER_STRING:
 472
 473			/* convert op to a string arg */
 474			op_type = op->num.type;
 475			left = op->num.left;
 476			str = arg->value.str;
 477
 478			/* reset the op for the new field */
 479			memset(op, 0, sizeof(*op));
 480
 481			/*
 482			 * If left arg was a field not found then
 483			 * NULL the entire op.
 484			 */
 485			if (left->type == FILTER_ARG_BOOLEAN) {
 486				free_arg(left);
 487				free_arg(arg);
 488				op->type = FILTER_ARG_BOOLEAN;
 489				op->boolean.value = FILTER_FALSE;
 490				break;
 491			}
 492
 493			/* Left arg must be a field */
 494			if (left->type != FILTER_ARG_FIELD) {
 495				show_error(error_str,
 496					   "Illegal lvalue for string comparison");
 497				return -1;
 498			}
 499
 500			/* Make sure this is a valid string compare */
 501			switch (op_type) {
 502			case FILTER_CMP_EQ:
 503				op_type = FILTER_CMP_MATCH;
 504				break;
 505			case FILTER_CMP_NE:
 506				op_type = FILTER_CMP_NOT_MATCH;
 507				break;
 508
 509			case FILTER_CMP_REGEX:
 510			case FILTER_CMP_NOT_REGEX:
 511				ret = regcomp(&op->str.reg, str, REG_ICASE|REG_NOSUB);
 512				if (ret) {
 513					show_error(error_str,
 514						   "RegEx '%s' did not compute",
 515						   str);
 516					return -1;
 517				}
 518				break;
 519			default:
 520				show_error(error_str,
 521					   "Illegal comparison for string");
 522				return -1;
 523			}
 524
 525			op->type = FILTER_ARG_STR;
 526			op->str.type = op_type;
 527			op->str.field = left->field.field;
 528			op->str.val = strdup(str);
 529			if (!op->str.val)
 530				die("malloc string");
 
 
 531			/*
 532			 * Need a buffer to copy data for tests
 533			 */
 534			op->str.buffer = malloc_or_die(op->str.field->size + 1);
 
 
 
 
 535			/* Null terminate this buffer */
 536			op->str.buffer[op->str.field->size] = 0;
 537
 538			/* We no longer have left or right args */
 539			free_arg(arg);
 540			free_arg(left);
 541
 542			break;
 543
 544		case FILTER_NUMBER:
 545
 546 do_int:
 547			switch (op->num.type) {
 548			case FILTER_CMP_REGEX:
 549			case FILTER_CMP_NOT_REGEX:
 550				show_error(error_str,
 551					   "Op not allowed with integers");
 552				return -1;
 553
 554			default:
 555				break;
 556			}
 557
 558			/* numeric compare */
 559			op->num.right = arg;
 560			break;
 561		default:
 562			goto out_fail;
 563		}
 564		break;
 565	default:
 566		goto out_fail;
 567	}
 568
 569	return 0;
 570
 571 out_fail:
 572	show_error(error_str,
 573		   "Syntax error");
 574	return -1;
 575}
 576
 577static struct filter_arg *
 578rotate_op_right(struct filter_arg *a, struct filter_arg *b)
 579{
 580	struct filter_arg *arg;
 581
 582	arg = a->op.right;
 583	a->op.right = b;
 584	return arg;
 585}
 586
 587static int add_left(struct filter_arg *op, struct filter_arg *arg)
 588{
 589	switch (op->type) {
 590	case FILTER_ARG_EXP:
 591		if (arg->type == FILTER_ARG_OP)
 592			arg = rotate_op_right(arg, op);
 593		op->exp.left = arg;
 594		break;
 595
 596	case FILTER_ARG_OP:
 597		op->op.left = arg;
 598		break;
 599	case FILTER_ARG_NUM:
 600		if (arg->type == FILTER_ARG_OP)
 601			arg = rotate_op_right(arg, op);
 602
 603		/* left arg of compares must be a field */
 604		if (arg->type != FILTER_ARG_FIELD &&
 605		    arg->type != FILTER_ARG_BOOLEAN)
 606			return -1;
 607		op->num.left = arg;
 608		break;
 609	default:
 610		return -1;
 611	}
 612	return 0;
 613}
 614
 615enum op_type {
 616	OP_NONE,
 617	OP_BOOL,
 618	OP_NOT,
 619	OP_EXP,
 620	OP_CMP,
 621};
 622
 623static enum op_type process_op(const char *token,
 624			       enum filter_op_type *btype,
 625			       enum filter_cmp_type *ctype,
 626			       enum filter_exp_type *etype)
 627{
 628	*btype = FILTER_OP_NOT;
 629	*etype = FILTER_EXP_NONE;
 630	*ctype = FILTER_CMP_NONE;
 631
 632	if (strcmp(token, "&&") == 0)
 633		*btype = FILTER_OP_AND;
 634	else if (strcmp(token, "||") == 0)
 635		*btype = FILTER_OP_OR;
 636	else if (strcmp(token, "!") == 0)
 637		return OP_NOT;
 638
 639	if (*btype != FILTER_OP_NOT)
 640		return OP_BOOL;
 641
 642	/* Check for value expressions */
 643	if (strcmp(token, "+") == 0) {
 644		*etype = FILTER_EXP_ADD;
 645	} else if (strcmp(token, "-") == 0) {
 646		*etype = FILTER_EXP_SUB;
 647	} else if (strcmp(token, "*") == 0) {
 648		*etype = FILTER_EXP_MUL;
 649	} else if (strcmp(token, "/") == 0) {
 650		*etype = FILTER_EXP_DIV;
 651	} else if (strcmp(token, "%") == 0) {
 652		*etype = FILTER_EXP_MOD;
 653	} else if (strcmp(token, ">>") == 0) {
 654		*etype = FILTER_EXP_RSHIFT;
 655	} else if (strcmp(token, "<<") == 0) {
 656		*etype = FILTER_EXP_LSHIFT;
 657	} else if (strcmp(token, "&") == 0) {
 658		*etype = FILTER_EXP_AND;
 659	} else if (strcmp(token, "|") == 0) {
 660		*etype = FILTER_EXP_OR;
 661	} else if (strcmp(token, "^") == 0) {
 662		*etype = FILTER_EXP_XOR;
 663	} else if (strcmp(token, "~") == 0)
 664		*etype = FILTER_EXP_NOT;
 665
 666	if (*etype != FILTER_EXP_NONE)
 667		return OP_EXP;
 668
 669	/* Check for compares */
 670	if (strcmp(token, "==") == 0)
 671		*ctype = FILTER_CMP_EQ;
 672	else if (strcmp(token, "!=") == 0)
 673		*ctype = FILTER_CMP_NE;
 674	else if (strcmp(token, "<") == 0)
 675		*ctype = FILTER_CMP_LT;
 676	else if (strcmp(token, ">") == 0)
 677		*ctype = FILTER_CMP_GT;
 678	else if (strcmp(token, "<=") == 0)
 679		*ctype = FILTER_CMP_LE;
 680	else if (strcmp(token, ">=") == 0)
 681		*ctype = FILTER_CMP_GE;
 682	else if (strcmp(token, "=~") == 0)
 683		*ctype = FILTER_CMP_REGEX;
 684	else if (strcmp(token, "!~") == 0)
 685		*ctype = FILTER_CMP_NOT_REGEX;
 686	else
 687		return OP_NONE;
 688
 689	return OP_CMP;
 690}
 691
 692static int check_op_done(struct filter_arg *arg)
 693{
 694	switch (arg->type) {
 695	case FILTER_ARG_EXP:
 696		return arg->exp.right != NULL;
 697
 698	case FILTER_ARG_OP:
 699		return arg->op.right != NULL;
 700
 701	case FILTER_ARG_NUM:
 702		return arg->num.right != NULL;
 703
 704	case FILTER_ARG_STR:
 705		/* A string conversion is always done */
 706		return 1;
 707
 708	case FILTER_ARG_BOOLEAN:
 709		/* field not found, is ok */
 710		return 1;
 711
 712	default:
 713		return 0;
 714	}
 715}
 716
 717enum filter_vals {
 718	FILTER_VAL_NORM,
 719	FILTER_VAL_FALSE,
 720	FILTER_VAL_TRUE,
 721};
 722
 723void reparent_op_arg(struct filter_arg *parent, struct filter_arg *old_child,
 724		  struct filter_arg *arg)
 725{
 726	struct filter_arg *other_child;
 727	struct filter_arg **ptr;
 728
 729	if (parent->type != FILTER_ARG_OP &&
 730	    arg->type != FILTER_ARG_OP)
 731		die("can not reparent other than OP");
 
 
 
 732
 733	/* Get the sibling */
 734	if (old_child->op.right == arg) {
 735		ptr = &old_child->op.right;
 736		other_child = old_child->op.left;
 737	} else if (old_child->op.left == arg) {
 738		ptr = &old_child->op.left;
 739		other_child = old_child->op.right;
 740	} else
 741		die("Error in reparent op, find other child");
 
 
 742
 743	/* Detach arg from old_child */
 744	*ptr = NULL;
 745
 746	/* Check for root */
 747	if (parent == old_child) {
 748		free_arg(other_child);
 749		*parent = *arg;
 750		/* Free arg without recussion */
 751		free(arg);
 752		return;
 753	}
 754
 755	if (parent->op.right == old_child)
 756		ptr = &parent->op.right;
 757	else if (parent->op.left == old_child)
 758		ptr = &parent->op.left;
 759	else
 760		die("Error in reparent op");
 
 
 
 761	*ptr = arg;
 762
 763	free_arg(old_child);
 
 764}
 765
 766enum filter_vals test_arg(struct filter_arg *parent, struct filter_arg *arg)
 
 
 767{
 768	enum filter_vals lval, rval;
 769
 770	switch (arg->type) {
 771
 772		/* bad case */
 773	case FILTER_ARG_BOOLEAN:
 774		return FILTER_VAL_FALSE + arg->boolean.value;
 775
 776		/* good cases: */
 777	case FILTER_ARG_STR:
 778	case FILTER_ARG_VALUE:
 779	case FILTER_ARG_FIELD:
 780		return FILTER_VAL_NORM;
 781
 782	case FILTER_ARG_EXP:
 783		lval = test_arg(arg, arg->exp.left);
 784		if (lval != FILTER_VAL_NORM)
 785			return lval;
 786		rval = test_arg(arg, arg->exp.right);
 787		if (rval != FILTER_VAL_NORM)
 788			return rval;
 789		return FILTER_VAL_NORM;
 790
 791	case FILTER_ARG_NUM:
 792		lval = test_arg(arg, arg->num.left);
 793		if (lval != FILTER_VAL_NORM)
 794			return lval;
 795		rval = test_arg(arg, arg->num.right);
 796		if (rval != FILTER_VAL_NORM)
 797			return rval;
 798		return FILTER_VAL_NORM;
 799
 800	case FILTER_ARG_OP:
 801		if (arg->op.type != FILTER_OP_NOT) {
 802			lval = test_arg(arg, arg->op.left);
 803			switch (lval) {
 804			case FILTER_VAL_NORM:
 805				break;
 806			case FILTER_VAL_TRUE:
 807				if (arg->op.type == FILTER_OP_OR)
 808					return FILTER_VAL_TRUE;
 809				rval = test_arg(arg, arg->op.right);
 810				if (rval != FILTER_VAL_NORM)
 811					return rval;
 812
 813				reparent_op_arg(parent, arg, arg->op.right);
 814				return FILTER_VAL_NORM;
 815
 816			case FILTER_VAL_FALSE:
 817				if (arg->op.type == FILTER_OP_AND)
 818					return FILTER_VAL_FALSE;
 819				rval = test_arg(arg, arg->op.right);
 820				if (rval != FILTER_VAL_NORM)
 821					return rval;
 822
 823				reparent_op_arg(parent, arg, arg->op.right);
 824				return FILTER_VAL_NORM;
 
 
 
 825			}
 826		}
 827
 828		rval = test_arg(arg, arg->op.right);
 829		switch (rval) {
 830		case FILTER_VAL_NORM:
 
 831			break;
 
 832		case FILTER_VAL_TRUE:
 833			if (arg->op.type == FILTER_OP_OR)
 834				return FILTER_VAL_TRUE;
 835			if (arg->op.type == FILTER_OP_NOT)
 836				return FILTER_VAL_FALSE;
 837
 838			reparent_op_arg(parent, arg, arg->op.left);
 839			return FILTER_VAL_NORM;
 840
 841		case FILTER_VAL_FALSE:
 842			if (arg->op.type == FILTER_OP_AND)
 843				return FILTER_VAL_FALSE;
 844			if (arg->op.type == FILTER_OP_NOT)
 845				return FILTER_VAL_TRUE;
 846
 847			reparent_op_arg(parent, arg, arg->op.left);
 848			return FILTER_VAL_NORM;
 849		}
 850
 851		return FILTER_VAL_NORM;
 852	default:
 853		die("bad arg in filter tree");
 
 854	}
 855	return FILTER_VAL_NORM;
 856}
 857
 858/* Remove any unknown event fields */
 859static struct filter_arg *collapse_tree(struct filter_arg *arg)
 
 860{
 861	enum filter_vals ret;
 862
 863	ret = test_arg(arg, arg);
 864	switch (ret) {
 865	case FILTER_VAL_NORM:
 866		return arg;
 867
 868	case FILTER_VAL_TRUE:
 869	case FILTER_VAL_FALSE:
 870		free_arg(arg);
 871		arg = allocate_arg();
 872		arg->type = FILTER_ARG_BOOLEAN;
 873		arg->boolean.value = ret == FILTER_VAL_TRUE;
 
 
 
 
 
 
 
 
 
 
 
 
 874	}
 875
 876	return arg;
 
 877}
 878
 879static int
 880process_filter(struct event_format *event, struct filter_arg **parg,
 881	       char **error_str, int not)
 882{
 883	enum event_type type;
 884	char *token = NULL;
 885	struct filter_arg *current_op = NULL;
 886	struct filter_arg *current_exp = NULL;
 887	struct filter_arg *left_item = NULL;
 888	struct filter_arg *arg = NULL;
 889	enum op_type op_type;
 890	enum filter_op_type btype;
 891	enum filter_exp_type etype;
 892	enum filter_cmp_type ctype;
 893	int ret;
 894
 895	*parg = NULL;
 896
 897	do {
 898		free(token);
 899		type = read_token(&token);
 900		switch (type) {
 901		case EVENT_SQUOTE:
 902		case EVENT_DQUOTE:
 903		case EVENT_ITEM:
 904			arg = create_arg_item(event, token, type, error_str);
 905			if (!arg)
 906				goto fail;
 907			if (!left_item)
 908				left_item = arg;
 909			else if (current_exp) {
 910				ret = add_right(current_exp, arg, error_str);
 911				if (ret < 0)
 912					goto fail;
 913				left_item = NULL;
 914				/* Not's only one one expression */
 915				if (not) {
 916					arg = NULL;
 917					if (current_op)
 918						goto fail_print;
 919					free(token);
 920					*parg = current_exp;
 921					return 0;
 922				}
 923			} else
 924				goto fail_print;
 925			arg = NULL;
 926			break;
 927
 928		case EVENT_DELIM:
 929			if (*token == ',') {
 930				show_error(error_str,
 931					   "Illegal token ','");
 932				goto fail;
 933			}
 934
 935			if (*token == '(') {
 936				if (left_item) {
 937					show_error(error_str,
 938						   "Open paren can not come after item");
 
 939					goto fail;
 940				}
 941				if (current_exp) {
 942					show_error(error_str,
 943						   "Open paren can not come after expression");
 
 944					goto fail;
 945				}
 946
 947				ret = process_filter(event, &arg, error_str, 0);
 948				if (ret != 1) {
 949					if (ret == 0)
 950						show_error(error_str,
 951							   "Unbalanced number of '('");
 
 
 952					goto fail;
 953				}
 954				ret = 0;
 955
 956				/* A not wants just one expression */
 957				if (not) {
 958					if (current_op)
 959						goto fail_print;
 960					*parg = arg;
 961					return 0;
 962				}
 963
 964				if (current_op)
 965					ret = add_right(current_op, arg, error_str);
 966				else
 967					current_exp = arg;
 968
 969				if (ret < 0)
 970					goto fail;
 971
 972			} else { /* ')' */
 973				if (!current_op && !current_exp)
 974					goto fail_print;
 975
 976				/* Make sure everything is finished at this level */
 977				if (current_exp && !check_op_done(current_exp))
 978					goto fail_print;
 979				if (current_op && !check_op_done(current_op))
 980					goto fail_print;
 981
 982				if (current_op)
 983					*parg = current_op;
 984				else
 985					*parg = current_exp;
 986				return 1;
 
 987			}
 988			break;
 989
 990		case EVENT_OP:
 991			op_type = process_op(token, &btype, &ctype, &etype);
 992
 993			/* All expect a left arg except for NOT */
 994			switch (op_type) {
 995			case OP_BOOL:
 996				/* Logic ops need a left expression */
 997				if (!current_exp && !current_op)
 998					goto fail_print;
 999				/* fall through */
1000			case OP_NOT:
1001				/* logic only processes ops and exp */
1002				if (left_item)
1003					goto fail_print;
1004				break;
1005			case OP_EXP:
1006			case OP_CMP:
1007				if (!left_item)
1008					goto fail_print;
1009				break;
1010			case OP_NONE:
1011				show_error(error_str,
1012					   "Unknown op token %s", token);
 
1013				goto fail;
1014			}
1015
1016			ret = 0;
1017			switch (op_type) {
1018			case OP_BOOL:
1019				arg = create_arg_op(btype);
 
 
1020				if (current_op)
1021					ret = add_left(arg, current_op);
1022				else
1023					ret = add_left(arg, current_exp);
1024				current_op = arg;
1025				current_exp = NULL;
1026				break;
1027
1028			case OP_NOT:
1029				arg = create_arg_op(btype);
 
 
1030				if (current_op)
1031					ret = add_right(current_op, arg, error_str);
1032				if (ret < 0)
1033					goto fail;
1034				current_exp = arg;
1035				ret = process_filter(event, &arg, error_str, 1);
1036				if (ret < 0)
1037					goto fail;
1038				ret = add_right(current_exp, arg, error_str);
1039				if (ret < 0)
1040					goto fail;
1041				break;
1042
1043			case OP_EXP:
1044			case OP_CMP:
1045				if (op_type == OP_EXP)
1046					arg = create_arg_exp(etype);
1047				else
1048					arg = create_arg_cmp(ctype);
 
 
1049
1050				if (current_op)
1051					ret = add_right(current_op, arg, error_str);
1052				if (ret < 0)
1053					goto fail;
1054				ret = add_left(arg, left_item);
1055				if (ret < 0) {
1056					arg = NULL;
1057					goto fail_print;
1058				}
1059				current_exp = arg;
1060				break;
1061			default:
1062				break;
1063			}
1064			arg = NULL;
1065			if (ret < 0)
1066				goto fail_print;
1067			break;
1068		case EVENT_NONE:
1069			break;
 
 
1070		default:
1071			goto fail_print;
1072		}
1073	} while (type != EVENT_NONE);
1074
1075	if (!current_op && !current_exp)
1076		goto fail_print;
1077
1078	if (!current_op)
1079		current_op = current_exp;
1080
1081	current_op = collapse_tree(current_op);
1082
1083	*parg = current_op;
 
 
1084
 
1085	return 0;
1086
1087 fail_print:
 
 
 
 
1088	show_error(error_str, "Syntax error");
 
1089 fail:
1090	free_arg(current_op);
1091	free_arg(current_exp);
1092	free_arg(arg);
1093	free(token);
1094	return -1;
1095}
1096
1097static int
1098process_event(struct event_format *event, const char *filter_str,
1099	      struct filter_arg **parg, char **error_str)
1100{
1101	int ret;
1102
1103	pevent_buffer_init(filter_str, strlen(filter_str));
1104
1105	ret = process_filter(event, parg, error_str, 0);
1106	if (ret == 1) {
1107		show_error(error_str,
1108			   "Unbalanced number of ')'");
1109		return -1;
1110	}
1111	if (ret < 0)
1112		return ret;
1113
1114	/* If parg is NULL, then make it into FALSE */
1115	if (!*parg) {
1116		*parg = allocate_arg();
1117		(*parg)->type = FILTER_ARG_BOOLEAN;
1118		(*parg)->boolean.value = FILTER_FALSE;
 
 
 
1119	}
1120
1121	return 0;
1122}
1123
1124static int filter_event(struct event_filter *filter,
1125			struct event_format *event,
1126			const char *filter_str, char **error_str)
1127{
1128	struct filter_type *filter_type;
1129	struct filter_arg *arg;
1130	int ret;
1131
1132	if (filter_str) {
1133		ret = process_event(event, filter_str, &arg, error_str);
1134		if (ret < 0)
1135			return ret;
1136
1137	} else {
1138		/* just add a TRUE arg */
1139		arg = allocate_arg();
1140		arg->type = FILTER_ARG_BOOLEAN;
1141		arg->boolean.value = FILTER_TRUE;
 
 
 
1142	}
1143
1144	filter_type = add_filter_type(filter, event->id);
 
 
 
1145	if (filter_type->filter)
1146		free_arg(filter_type->filter);
1147	filter_type->filter = arg;
1148
1149	return 0;
1150}
1151
 
 
 
 
 
 
 
1152/**
1153 * pevent_filter_add_filter_str - add a new filter
1154 * @filter: the event filter to add to
1155 * @filter_str: the filter string that contains the filter
1156 * @error_str: string containing reason for failed filter
1157 *
1158 * Returns 0 if the filter was successfully added
1159 *   -1 if there was an error.
1160 *
1161 * On error, if @error_str points to a string pointer,
1162 * it is set to the reason that the filter failed.
1163 * This string must be freed with "free".
1164 */
1165int pevent_filter_add_filter_str(struct event_filter *filter,
1166				 const char *filter_str,
1167				 char **error_str)
1168{
1169	struct pevent *pevent = filter->pevent;
1170	struct event_list *event;
1171	struct event_list *events = NULL;
1172	const char *filter_start;
1173	const char *next_event;
1174	char *this_event;
1175	char *event_name = NULL;
1176	char *sys_name = NULL;
1177	char *sp;
1178	int rtn = 0;
1179	int len;
1180	int ret;
1181
1182	/* clear buffer to reset show error */
1183	pevent_buffer_init("", 0);
1184
1185	if (error_str)
1186		*error_str = NULL;
1187
1188	filter_start = strchr(filter_str, ':');
1189	if (filter_start)
1190		len = filter_start - filter_str;
1191	else
1192		len = strlen(filter_str);
1193
1194
1195	do {
1196		next_event = strchr(filter_str, ',');
1197		if (next_event &&
1198		    (!filter_start || next_event < filter_start))
1199			len = next_event - filter_str;
1200		else if (filter_start)
1201			len = filter_start - filter_str;
1202		else
1203			len = strlen(filter_str);
1204
1205		this_event = malloc_or_die(len + 1);
 
 
 
 
 
1206		memcpy(this_event, filter_str, len);
1207		this_event[len] = 0;
1208
1209		if (next_event)
1210			next_event++;
1211
1212		filter_str = next_event;
1213
1214		sys_name = strtok_r(this_event, "/", &sp);
1215		event_name = strtok_r(NULL, "/", &sp);
1216
1217		if (!sys_name) {
1218			show_error(error_str, "No filter found");
1219			/* This can only happen when events is NULL, but still */
1220			free_events(events);
1221			free(this_event);
1222			return -1;
1223		}
1224
1225		/* Find this event */
1226		ret = find_event(pevent, &events, strim(sys_name), strim(event_name));
1227		if (ret < 0) {
1228			if (event_name)
1229				show_error(error_str,
1230					   "No event found under '%s.%s'",
1231					   sys_name, event_name);
1232			else
1233				show_error(error_str,
1234					   "No event found under '%s'",
1235					   sys_name);
1236			free_events(events);
1237			free(this_event);
1238			return -1;
1239		}
1240		free(this_event);
1241	} while (filter_str);
1242
1243	/* Skip the ':' */
1244	if (filter_start)
1245		filter_start++;
1246
1247	/* filter starts here */
1248	for (event = events; event; event = event->next) {
1249		ret = filter_event(filter, event->event, filter_start,
1250				   error_str);
1251		/* Failures are returned if a parse error happened */
1252		if (ret < 0)
1253			rtn = ret;
1254
1255		if (ret >= 0 && pevent->test_filters) {
1256			char *test;
1257			test = pevent_filter_make_string(filter, event->event->id);
1258			printf(" '%s: %s'\n", event->event->name, test);
1259			free(test);
 
 
1260		}
1261	}
1262
1263	free_events(events);
1264
1265	if (rtn >= 0 && pevent->test_filters)
1266		exit(0);
1267
1268	return rtn;
1269}
1270
1271static void free_filter_type(struct filter_type *filter_type)
1272{
1273	free_arg(filter_type->filter);
1274}
1275
1276/**
1277 * pevent_filter_remove_event - remove a filter for an event
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1278 * @filter: the event filter to remove from
1279 * @event_id: the event to remove a filter for
1280 *
1281 * Removes the filter saved for an event defined by @event_id
1282 * from the @filter.
1283 *
1284 * Returns 1: if an event was removed
1285 *   0: if the event was not found
1286 */
1287int pevent_filter_remove_event(struct event_filter *filter,
1288			       int event_id)
1289{
1290	struct filter_type *filter_type;
1291	unsigned long len;
1292
1293	if (!filter->filters)
1294		return 0;
1295
1296	filter_type = find_filter_type(filter, event_id);
1297
1298	if (!filter_type)
1299		return 0;
1300
1301	free_filter_type(filter_type);
1302
1303	/* The filter_type points into the event_filters array */
1304	len = (unsigned long)(filter->event_filters + filter->filters) -
1305		(unsigned long)(filter_type + 1);
1306
1307	memmove(filter_type, filter_type + 1, len);
1308	filter->filters--;
1309
1310	memset(&filter->event_filters[filter->filters], 0,
1311	       sizeof(*filter_type));
1312
1313	return 1;
1314}
1315
1316/**
1317 * pevent_filter_reset - clear all filters in a filter
1318 * @filter: the event filter to reset
1319 *
1320 * Removes all filters from a filter and resets it.
1321 */
1322void pevent_filter_reset(struct event_filter *filter)
1323{
1324	int i;
1325
1326	for (i = 0; i < filter->filters; i++)
1327		free_filter_type(&filter->event_filters[i]);
1328
1329	free(filter->event_filters);
1330	filter->filters = 0;
1331	filter->event_filters = NULL;
1332}
1333
1334void pevent_filter_free(struct event_filter *filter)
1335{
1336	pevent_unref(filter->pevent);
1337
1338	pevent_filter_reset(filter);
1339
1340	free(filter);
1341}
1342
1343static char *arg_to_str(struct event_filter *filter, struct filter_arg *arg);
1344
1345static int copy_filter_type(struct event_filter *filter,
1346			     struct event_filter *source,
1347			     struct filter_type *filter_type)
1348{
1349	struct filter_arg *arg;
1350	struct event_format *event;
1351	const char *sys;
1352	const char *name;
1353	char *str;
1354
1355	/* Can't assume that the pevent's are the same */
1356	sys = filter_type->event->system;
1357	name = filter_type->event->name;
1358	event = pevent_find_event_by_name(filter->pevent, sys, name);
1359	if (!event)
1360		return -1;
1361
1362	str = arg_to_str(source, filter_type->filter);
1363	if (!str)
1364		return -1;
1365
1366	if (strcmp(str, "TRUE") == 0 || strcmp(str, "FALSE") == 0) {
1367		/* Add trivial event */
1368		arg = allocate_arg();
1369		arg->type = FILTER_ARG_BOOLEAN;
 
 
 
1370		if (strcmp(str, "TRUE") == 0)
1371			arg->boolean.value = 1;
1372		else
1373			arg->boolean.value = 0;
1374
1375		filter_type = add_filter_type(filter, event->id);
 
 
 
1376		filter_type->filter = arg;
1377
1378		free(str);
1379		return 0;
1380	}
1381
1382	filter_event(filter, event, str, NULL);
1383	free(str);
1384
1385	return 0;
1386}
1387
1388/**
1389 * pevent_filter_copy - copy a filter using another filter
1390 * @dest - the filter to copy to
1391 * @source - the filter to copy from
1392 *
1393 * Returns 0 on success and -1 if not all filters were copied
1394 */
1395int pevent_filter_copy(struct event_filter *dest, struct event_filter *source)
1396{
1397	int ret = 0;
1398	int i;
1399
1400	pevent_filter_reset(dest);
1401
1402	for (i = 0; i < source->filters; i++) {
1403		if (copy_filter_type(dest, source, &source->event_filters[i]))
1404			ret = -1;
1405	}
1406	return ret;
1407}
1408
1409
1410/**
1411 * pevent_update_trivial - update the trivial filters with the given filter
1412 * @dest - the filter to update
1413 * @source - the filter as the source of the update
1414 * @type - the type of trivial filter to update.
1415 *
1416 * Scan dest for trivial events matching @type to replace with the source.
1417 *
1418 * Returns 0 on success and -1 if there was a problem updating, but
1419 *   events may have still been updated on error.
1420 */
1421int pevent_update_trivial(struct event_filter *dest, struct event_filter *source,
1422			  enum filter_trivial_type type)
1423{
1424	struct pevent *src_pevent;
1425	struct pevent *dest_pevent;
1426	struct event_format *event;
1427	struct filter_type *filter_type;
1428	struct filter_arg *arg;
1429	char *str;
1430	int i;
1431
1432	src_pevent = source->pevent;
1433	dest_pevent = dest->pevent;
1434
1435	/* Do nothing if either of the filters has nothing to filter */
1436	if (!dest->filters || !source->filters)
1437		return 0;
1438
1439	for (i = 0; i < dest->filters; i++) {
1440		filter_type = &dest->event_filters[i];
1441		arg = filter_type->filter;
1442		if (arg->type != FILTER_ARG_BOOLEAN)
1443			continue;
1444		if ((arg->boolean.value && type == FILTER_TRIVIAL_FALSE) ||
1445		    (!arg->boolean.value && type == FILTER_TRIVIAL_TRUE))
1446			continue;
1447
1448		event = filter_type->event;
1449
1450		if (src_pevent != dest_pevent) {
1451			/* do a look up */
1452			event = pevent_find_event_by_name(src_pevent,
1453							  event->system,
1454							  event->name);
1455			if (!event)
1456				return -1;
1457		}
1458
1459		str = pevent_filter_make_string(source, event->id);
1460		if (!str)
1461			continue;
1462
1463		/* Don't bother if the filter is trivial too */
1464		if (strcmp(str, "TRUE") != 0 && strcmp(str, "FALSE") != 0)
1465			filter_event(dest, event, str, NULL);
1466		free(str);
1467	}
1468	return 0;
1469}
1470
1471/**
1472 * pevent_filter_clear_trivial - clear TRUE and FALSE filters
1473 * @filter: the filter to remove trivial filters from
1474 * @type: remove only true, false, or both
1475 *
1476 * Removes filters that only contain a TRUE or FALES boolean arg.
1477 */
1478void pevent_filter_clear_trivial(struct event_filter *filter,
1479				 enum filter_trivial_type type)
1480{
1481	struct filter_type *filter_type;
1482	int count = 0;
1483	int *ids;
1484	int i;
1485
1486	if (!filter->filters)
1487		return;
1488
1489	/*
1490	 * Two steps, first get all ids with trivial filters.
1491	 *  then remove those ids.
1492	 */
1493	for (i = 0; i < filter->filters; i++) {
1494		filter_type = &filter->event_filters[i];
1495		if (filter_type->filter->type != FILTER_ARG_BOOLEAN)
1496			continue;
1497		switch (type) {
1498		case FILTER_TRIVIAL_FALSE:
1499			if (filter_type->filter->boolean.value)
1500				continue;
1501		case FILTER_TRIVIAL_TRUE:
1502			if (!filter_type->filter->boolean.value)
1503				continue;
1504		default:
1505			break;
1506		}
1507		if (count)
1508			ids = realloc(ids, sizeof(*ids) * (count + 1));
1509		else
1510			ids = malloc(sizeof(*ids));
1511		if (!ids)
1512			die("Can't allocate ids");
1513		ids[count++] = filter_type->event_id;
1514	}
1515
1516	if (!count)
1517		return;
1518
1519	for (i = 0; i < count; i++)
1520		pevent_filter_remove_event(filter, ids[i]);
1521
1522	free(ids);
1523}
1524
1525/**
1526 * pevent_filter_event_has_trivial - return true event contains trivial filter
1527 * @filter: the filter with the information
1528 * @event_id: the id of the event to test
1529 * @type: trivial type to test for (TRUE, FALSE, EITHER)
1530 *
1531 * Returns 1 if the event contains a matching trivial type
1532 *  otherwise 0.
1533 */
1534int pevent_filter_event_has_trivial(struct event_filter *filter,
1535				    int event_id,
1536				    enum filter_trivial_type type)
1537{
1538	struct filter_type *filter_type;
1539
1540	if (!filter->filters)
1541		return 0;
1542
1543	filter_type = find_filter_type(filter, event_id);
1544
1545	if (!filter_type)
1546		return 0;
1547
1548	if (filter_type->filter->type != FILTER_ARG_BOOLEAN)
1549		return 0;
1550
1551	switch (type) {
1552	case FILTER_TRIVIAL_FALSE:
1553		return !filter_type->filter->boolean.value;
1554
1555	case FILTER_TRIVIAL_TRUE:
1556		return filter_type->filter->boolean.value;
1557	default:
1558		return 1;
1559	}
1560}
1561
1562static int test_filter(struct event_format *event,
1563		       struct filter_arg *arg, struct pevent_record *record);
1564
1565static const char *
1566get_comm(struct event_format *event, struct pevent_record *record)
1567{
1568	const char *comm;
1569	int pid;
1570
1571	pid = pevent_data_pid(event->pevent, record);
1572	comm = pevent_data_comm_from_pid(event->pevent, pid);
1573	return comm;
1574}
1575
1576static unsigned long long
1577get_value(struct event_format *event,
1578	  struct format_field *field, struct pevent_record *record)
1579{
1580	unsigned long long val;
1581
1582	/* Handle our dummy "comm" field */
1583	if (field == &comm) {
1584		const char *name;
1585
1586		name = get_comm(event, record);
1587		return (unsigned long)name;
1588	}
1589
1590	pevent_read_number_field(field, record->data, &val);
 
 
1591
1592	if (!(field->flags & FIELD_IS_SIGNED))
 
 
1593		return val;
1594
1595	switch (field->size) {
1596	case 1:
1597		return (char)val;
1598	case 2:
1599		return (short)val;
1600	case 4:
1601		return (int)val;
1602	case 8:
1603		return (long long)val;
1604	}
1605	return val;
1606}
1607
1608static unsigned long long
1609get_arg_value(struct event_format *event, struct filter_arg *arg, struct pevent_record *record);
 
1610
1611static unsigned long long
1612get_exp_value(struct event_format *event, struct filter_arg *arg, struct pevent_record *record)
 
1613{
1614	unsigned long long lval, rval;
1615
1616	lval = get_arg_value(event, arg->exp.left, record);
1617	rval = get_arg_value(event, arg->exp.right, record);
 
 
 
 
 
 
 
1618
1619	switch (arg->exp.type) {
1620	case FILTER_EXP_ADD:
1621		return lval + rval;
1622
1623	case FILTER_EXP_SUB:
1624		return lval - rval;
1625
1626	case FILTER_EXP_MUL:
1627		return lval * rval;
1628
1629	case FILTER_EXP_DIV:
1630		return lval / rval;
1631
1632	case FILTER_EXP_MOD:
1633		return lval % rval;
1634
1635	case FILTER_EXP_RSHIFT:
1636		return lval >> rval;
1637
1638	case FILTER_EXP_LSHIFT:
1639		return lval << rval;
1640
1641	case FILTER_EXP_AND:
1642		return lval & rval;
1643
1644	case FILTER_EXP_OR:
1645		return lval | rval;
1646
1647	case FILTER_EXP_XOR:
1648		return lval ^ rval;
1649
1650	case FILTER_EXP_NOT:
1651	default:
1652		die("error in exp");
 
1653	}
1654	return 0;
1655}
1656
1657static unsigned long long
1658get_arg_value(struct event_format *event, struct filter_arg *arg, struct pevent_record *record)
 
1659{
1660	switch (arg->type) {
1661	case FILTER_ARG_FIELD:
1662		return get_value(event, arg->field.field, record);
1663
1664	case FILTER_ARG_VALUE:
1665		if (arg->value.type != FILTER_NUMBER)
1666			die("must have number field!");
 
 
1667		return arg->value.val;
1668
1669	case FILTER_ARG_EXP:
1670		return get_exp_value(event, arg, record);
1671
1672	default:
1673		die("oops in filter");
 
1674	}
1675	return 0;
1676}
1677
1678static int test_num(struct event_format *event,
1679		    struct filter_arg *arg, struct pevent_record *record)
1680{
1681	unsigned long long lval, rval;
1682
1683	lval = get_arg_value(event, arg->num.left, record);
1684	rval = get_arg_value(event, arg->num.right, record);
 
 
 
 
 
 
 
1685
1686	switch (arg->num.type) {
1687	case FILTER_CMP_EQ:
1688		return lval == rval;
1689
1690	case FILTER_CMP_NE:
1691		return lval != rval;
1692
1693	case FILTER_CMP_GT:
1694		return lval > rval;
1695
1696	case FILTER_CMP_LT:
1697		return lval < rval;
1698
1699	case FILTER_CMP_GE:
1700		return lval >= rval;
1701
1702	case FILTER_CMP_LE:
1703		return lval <= rval;
1704
1705	default:
1706		/* ?? */
 
1707		return 0;
1708	}
1709}
1710
1711static const char *get_field_str(struct filter_arg *arg, struct pevent_record *record)
1712{
1713	const char *val = record->data + arg->str.field->offset;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1714
1715	/*
1716	 * We need to copy the data since we can't be sure the field
1717	 * is null terminated.
1718	 */
1719	if (*(val + arg->str.field->size - 1)) {
1720		/* copy it */
1721		memcpy(arg->str.buffer, val, arg->str.field->size);
1722		/* the buffer is already NULL terminated */
1723		val = arg->str.buffer;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1724	}
 
1725	return val;
1726}
1727
1728static int test_str(struct event_format *event,
1729		    struct filter_arg *arg, struct pevent_record *record)
1730{
1731	const char *val;
1732
1733	if (arg->str.field == &comm)
1734		val = get_comm(event, record);
1735	else
1736		val = get_field_str(arg, record);
1737
1738	switch (arg->str.type) {
1739	case FILTER_CMP_MATCH:
1740		return strcmp(val, arg->str.val) == 0;
1741
1742	case FILTER_CMP_NOT_MATCH:
1743		return strcmp(val, arg->str.val) != 0;
1744
1745	case FILTER_CMP_REGEX:
1746		/* Returns zero on match */
1747		return !regexec(&arg->str.reg, val, 0, NULL, 0);
1748
1749	case FILTER_CMP_NOT_REGEX:
1750		return regexec(&arg->str.reg, val, 0, NULL, 0);
1751
1752	default:
1753		/* ?? */
 
1754		return 0;
1755	}
1756}
1757
1758static int test_op(struct event_format *event,
1759		   struct filter_arg *arg, struct pevent_record *record)
1760{
1761	switch (arg->op.type) {
1762	case FILTER_OP_AND:
1763		return test_filter(event, arg->op.left, record) &&
1764			test_filter(event, arg->op.right, record);
1765
1766	case FILTER_OP_OR:
1767		return test_filter(event, arg->op.left, record) ||
1768			test_filter(event, arg->op.right, record);
1769
1770	case FILTER_OP_NOT:
1771		return !test_filter(event, arg->op.right, record);
1772
1773	default:
1774		/* ?? */
 
1775		return 0;
1776	}
1777}
1778
1779static int test_filter(struct event_format *event,
1780		       struct filter_arg *arg, struct pevent_record *record)
1781{
 
 
 
 
 
 
 
1782	switch (arg->type) {
1783	case FILTER_ARG_BOOLEAN:
1784		/* easy case */
1785		return arg->boolean.value;
1786
1787	case FILTER_ARG_OP:
1788		return test_op(event, arg, record);
1789
1790	case FILTER_ARG_NUM:
1791		return test_num(event, arg, record);
1792
1793	case FILTER_ARG_STR:
1794		return test_str(event, arg, record);
1795
1796	case FILTER_ARG_EXP:
1797	case FILTER_ARG_VALUE:
1798	case FILTER_ARG_FIELD:
1799		/*
1800		 * Expressions, fields and values evaluate
1801		 * to true if they return non zero
1802		 */
1803		return !!get_arg_value(event, arg, record);
1804
1805	default:
1806		die("oops!");
1807		/* ?? */
1808		return 0;
1809	}
1810}
1811
1812/**
1813 * pevent_event_filtered - return true if event has filter
1814 * @filter: filter struct with filter information
1815 * @event_id: event id to test if filter exists
1816 *
1817 * Returns 1 if filter found for @event_id
1818 *   otherwise 0;
1819 */
1820int pevent_event_filtered(struct event_filter *filter,
1821			  int event_id)
1822{
1823	struct filter_type *filter_type;
1824
1825	if (!filter->filters)
1826		return 0;
1827
1828	filter_type = find_filter_type(filter, event_id);
1829
1830	return filter_type ? 1 : 0;
1831}
1832
1833/**
1834 * pevent_filter_match - test if a record matches a filter
1835 * @filter: filter struct with filter information
1836 * @record: the record to test against the filter
1837 *
1838 * Returns:
1839 *  1 - filter found for event and @record matches
1840 *  0 - filter found for event and @record does not match
1841 * -1 - no filter found for @record's event
1842 * -2 - if no filters exist
 
1843 */
1844int pevent_filter_match(struct event_filter *filter,
1845			struct pevent_record *record)
1846{
1847	struct pevent *pevent = filter->pevent;
1848	struct filter_type *filter_type;
1849	int event_id;
 
 
 
 
1850
1851	if (!filter->filters)
1852		return FILTER_NONE;
1853
1854	event_id = pevent_data_type(pevent, record);
1855
1856	filter_type = find_filter_type(filter, event_id);
1857
1858	if (!filter_type)
1859		return FILTER_NOEXIST;
 
 
 
 
1860
1861	return test_filter(filter_type->event, filter_type->filter, record) ?
1862		FILTER_MATCH : FILTER_MISS;
1863}
1864
1865static char *op_to_str(struct event_filter *filter, struct filter_arg *arg)
1866{
1867	char *str = NULL;
1868	char *left = NULL;
1869	char *right = NULL;
1870	char *op = NULL;
1871	int left_val = -1;
1872	int right_val = -1;
1873	int val;
1874	int len;
1875
1876	switch (arg->op.type) {
1877	case FILTER_OP_AND:
1878		op = "&&";
1879		/* fall through */
1880	case FILTER_OP_OR:
1881		if (!op)
1882			op = "||";
1883
1884		left = arg_to_str(filter, arg->op.left);
1885		right = arg_to_str(filter, arg->op.right);
1886		if (!left || !right)
1887			break;
1888
1889		/* Try to consolidate boolean values */
1890		if (strcmp(left, "TRUE") == 0)
1891			left_val = 1;
1892		else if (strcmp(left, "FALSE") == 0)
1893			left_val = 0;
1894
1895		if (strcmp(right, "TRUE") == 0)
1896			right_val = 1;
1897		else if (strcmp(right, "FALSE") == 0)
1898			right_val = 0;
1899
1900		if (left_val >= 0) {
1901			if ((arg->op.type == FILTER_OP_AND && !left_val) ||
1902			    (arg->op.type == FILTER_OP_OR && left_val)) {
1903				/* Just return left value */
1904				str = left;
1905				left = NULL;
1906				break;
1907			}
1908			if (right_val >= 0) {
1909				/* just evaluate this. */
1910				val = 0;
1911				switch (arg->op.type) {
1912				case FILTER_OP_AND:
1913					val = left_val && right_val;
1914					break;
1915				case FILTER_OP_OR:
1916					val = left_val || right_val;
1917					break;
1918				default:
1919					break;
1920				}
1921				str = malloc_or_die(6);
1922				if (val)
1923					strcpy(str, "TRUE");
1924				else
1925					strcpy(str, "FALSE");
1926				break;
1927			}
1928		}
1929		if (right_val >= 0) {
1930			if ((arg->op.type == FILTER_OP_AND && !right_val) ||
1931			    (arg->op.type == FILTER_OP_OR && right_val)) {
1932				/* Just return right value */
1933				str = right;
1934				right = NULL;
1935				break;
1936			}
1937			/* The right value is meaningless */
1938			str = left;
1939			left = NULL;
1940			break;
1941		}
1942
1943		len = strlen(left) + strlen(right) + strlen(op) + 10;
1944		str = malloc_or_die(len);
1945		snprintf(str, len, "(%s) %s (%s)",
1946			 left, op, right);
1947		break;
1948
1949	case FILTER_OP_NOT:
1950		op = "!";
1951		right = arg_to_str(filter, arg->op.right);
1952		if (!right)
1953			break;
1954
1955		/* See if we can consolidate */
1956		if (strcmp(right, "TRUE") == 0)
1957			right_val = 1;
1958		else if (strcmp(right, "FALSE") == 0)
1959			right_val = 0;
1960		if (right_val >= 0) {
1961			/* just return the opposite */
1962			str = malloc_or_die(6);
1963			if (right_val)
1964				strcpy(str, "FALSE");
1965			else
1966				strcpy(str, "TRUE");
1967			break;
1968		}
1969		len = strlen(right) + strlen(op) + 3;
1970		str = malloc_or_die(len);
1971		snprintf(str, len, "%s(%s)", op, right);
1972		break;
1973
1974	default:
1975		/* ?? */
1976		break;
1977	}
1978	free(left);
1979	free(right);
1980	return str;
1981}
1982
1983static char *val_to_str(struct event_filter *filter, struct filter_arg *arg)
1984{
1985	char *str;
1986
1987	str = malloc_or_die(30);
1988
1989	snprintf(str, 30, "%lld", arg->value.val);
1990
1991	return str;
1992}
1993
1994static char *field_to_str(struct event_filter *filter, struct filter_arg *arg)
1995{
1996	return strdup(arg->field.field->name);
1997}
1998
1999static char *exp_to_str(struct event_filter *filter, struct filter_arg *arg)
2000{
2001	char *lstr;
2002	char *rstr;
2003	char *op;
2004	char *str;
2005	int len;
2006
2007	lstr = arg_to_str(filter, arg->exp.left);
2008	rstr = arg_to_str(filter, arg->exp.right);
 
 
2009
2010	switch (arg->exp.type) {
2011	case FILTER_EXP_ADD:
2012		op = "+";
2013		break;
2014	case FILTER_EXP_SUB:
2015		op = "-";
2016		break;
2017	case FILTER_EXP_MUL:
2018		op = "*";
2019		break;
2020	case FILTER_EXP_DIV:
2021		op = "/";
2022		break;
2023	case FILTER_EXP_MOD:
2024		op = "%";
2025		break;
2026	case FILTER_EXP_RSHIFT:
2027		op = ">>";
2028		break;
2029	case FILTER_EXP_LSHIFT:
2030		op = "<<";
2031		break;
2032	case FILTER_EXP_AND:
2033		op = "&";
2034		break;
2035	case FILTER_EXP_OR:
2036		op = "|";
2037		break;
2038	case FILTER_EXP_XOR:
2039		op = "^";
2040		break;
2041	default:
2042		die("oops in exp");
 
2043	}
2044
2045	len = strlen(op) + strlen(lstr) + strlen(rstr) + 4;
2046	str = malloc_or_die(len);
2047	snprintf(str, len, "%s %s %s", lstr, op, rstr);
2048	free(lstr);
2049	free(rstr);
2050
2051	return str;
2052}
2053
2054static char *num_to_str(struct event_filter *filter, struct filter_arg *arg)
2055{
2056	char *lstr;
2057	char *rstr;
2058	char *str = NULL;
2059	char *op = NULL;
2060	int len;
2061
2062	lstr = arg_to_str(filter, arg->num.left);
2063	rstr = arg_to_str(filter, arg->num.right);
 
 
2064
2065	switch (arg->num.type) {
2066	case FILTER_CMP_EQ:
2067		op = "==";
2068		/* fall through */
2069	case FILTER_CMP_NE:
2070		if (!op)
2071			op = "!=";
2072		/* fall through */
2073	case FILTER_CMP_GT:
2074		if (!op)
2075			op = ">";
2076		/* fall through */
2077	case FILTER_CMP_LT:
2078		if (!op)
2079			op = "<";
2080		/* fall through */
2081	case FILTER_CMP_GE:
2082		if (!op)
2083			op = ">=";
2084		/* fall through */
2085	case FILTER_CMP_LE:
2086		if (!op)
2087			op = "<=";
2088
2089		len = strlen(lstr) + strlen(op) + strlen(rstr) + 4;
2090		str = malloc_or_die(len);
2091		sprintf(str, "%s %s %s", lstr, op, rstr);
2092
2093		break;
2094
2095	default:
2096		/* ?? */
2097		break;
2098	}
2099
 
2100	free(lstr);
2101	free(rstr);
2102	return str;
2103}
2104
2105static char *str_to_str(struct event_filter *filter, struct filter_arg *arg)
2106{
2107	char *str = NULL;
2108	char *op = NULL;
2109	int len;
2110
2111	switch (arg->str.type) {
2112	case FILTER_CMP_MATCH:
2113		op = "==";
2114		/* fall through */
2115	case FILTER_CMP_NOT_MATCH:
2116		if (!op)
2117			op = "!=";
2118		/* fall through */
2119	case FILTER_CMP_REGEX:
2120		if (!op)
2121			op = "=~";
2122		/* fall through */
2123	case FILTER_CMP_NOT_REGEX:
2124		if (!op)
2125			op = "!~";
2126
2127		len = strlen(arg->str.field->name) + strlen(op) +
2128			strlen(arg->str.val) + 6;
2129		str = malloc_or_die(len);
2130		snprintf(str, len, "%s %s \"%s\"",
2131			 arg->str.field->name,
2132			 op, arg->str.val);
2133		break;
2134
2135	default:
2136		/* ?? */
2137		break;
2138	}
2139	return str;
2140}
2141
2142static char *arg_to_str(struct event_filter *filter, struct filter_arg *arg)
2143{
2144	char *str;
2145
2146	switch (arg->type) {
2147	case FILTER_ARG_BOOLEAN:
2148		str = malloc_or_die(6);
2149		if (arg->boolean.value)
2150			strcpy(str, "TRUE");
2151		else
2152			strcpy(str, "FALSE");
2153		return str;
2154
2155	case FILTER_ARG_OP:
2156		return op_to_str(filter, arg);
2157
2158	case FILTER_ARG_NUM:
2159		return num_to_str(filter, arg);
2160
2161	case FILTER_ARG_STR:
2162		return str_to_str(filter, arg);
2163
2164	case FILTER_ARG_VALUE:
2165		return val_to_str(filter, arg);
2166
2167	case FILTER_ARG_FIELD:
2168		return field_to_str(filter, arg);
2169
2170	case FILTER_ARG_EXP:
2171		return exp_to_str(filter, arg);
2172
2173	default:
2174		/* ?? */
2175		return NULL;
2176	}
2177
2178}
2179
2180/**
2181 * pevent_filter_make_string - return a string showing the filter
2182 * @filter: filter struct with filter information
2183 * @event_id: the event id to return the filter string with
2184 *
2185 * Returns a string that displays the filter contents.
2186 *  This string must be freed with free(str).
2187 *  NULL is returned if no filter is found.
2188 */
2189char *
2190pevent_filter_make_string(struct event_filter *filter, int event_id)
2191{
2192	struct filter_type *filter_type;
2193
2194	if (!filter->filters)
2195		return NULL;
2196
2197	filter_type = find_filter_type(filter, event_id);
2198
2199	if (!filter_type)
2200		return NULL;
2201
2202	return arg_to_str(filter, filter_type->filter);
2203}
2204
2205/**
2206 * pevent_filter_compare - compare two filters and return if they are the same
2207 * @filter1: Filter to compare with @filter2
2208 * @filter2: Filter to compare with @filter1
2209 *
2210 * Returns:
2211 *  1 if the two filters hold the same content.
2212 *  0 if they do not.
2213 */
2214int pevent_filter_compare(struct event_filter *filter1, struct event_filter *filter2)
2215{
2216	struct filter_type *filter_type1;
2217	struct filter_type *filter_type2;
2218	char *str1, *str2;
2219	int result;
2220	int i;
2221
2222	/* Do the easy checks first */
2223	if (filter1->filters != filter2->filters)
2224		return 0;
2225	if (!filter1->filters && !filter2->filters)
2226		return 1;
2227
2228	/*
2229	 * Now take a look at each of the events to see if they have the same
2230	 * filters to them.
2231	 */
2232	for (i = 0; i < filter1->filters; i++) {
2233		filter_type1 = &filter1->event_filters[i];
2234		filter_type2 = find_filter_type(filter2, filter_type1->event_id);
2235		if (!filter_type2)
2236			break;
2237		if (filter_type1->filter->type != filter_type2->filter->type)
2238			break;
2239		switch (filter_type1->filter->type) {
2240		case FILTER_TRIVIAL_FALSE:
2241		case FILTER_TRIVIAL_TRUE:
2242			/* trivial types just need the type compared */
2243			continue;
2244		default:
2245			break;
2246		}
2247		/* The best way to compare complex filters is with strings */
2248		str1 = arg_to_str(filter1, filter_type1->filter);
2249		str2 = arg_to_str(filter2, filter_type2->filter);
2250		result = strcmp(str1, str2) != 0;
 
 
 
 
 
2251		free(str1);
2252		free(str2);
2253		if (result)
2254			break;
2255	}
2256
2257	if (i < filter1->filters)
2258		return 0;
2259	return 1;
2260}
2261