2 * Copyright (C) 2010 Red Hat Inc, Steven Rostedt <srostedt@redhat.com>
4 * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
5 * This program is free software; you can redistribute it and/or
6 * modify it under the terms of the GNU Lesser General Public
7 * License as published by the Free Software Foundation;
8 * version 2.1 of the License (not later!)
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU Lesser General Public License for more details.
15 * You should have received a copy of the GNU Lesser General Public
16 * License along with this program; if not, see <http://www.gnu.org/licenses>
18 * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
25 #include <sys/types.h>
27 #include "event-parse.h"
28 #include "event-utils.h"
32 static struct format_field comm = {
37 struct event_list *next;
38 struct event_format *event;
41 static void show_error(char *error_buf, const char *fmt, ...)
43 unsigned long long index;
49 input = pevent_get_input_buf();
50 index = pevent_get_input_buf_ptr();
51 len = input ? strlen(input) : 0;
54 strcpy(error_buf, input);
55 error_buf[len] = '\n';
56 for (i = 1; i < len && i < index; i++)
57 error_buf[len+i] = ' ';
58 error_buf[len + i] = '^';
59 error_buf[len + i + 1] = '\n';
64 vsnprintf(error_buf + len, PEVENT_FILTER_ERROR_BUFSZ - len, fmt, ap);
68 static void free_token(char *token)
70 pevent_free_token(token);
73 static enum event_type read_token(char **tok)
80 type = pevent_read_token(&token);
81 } while (type == EVENT_NEWLINE || type == EVENT_SPACE);
83 /* If token is = or ! check to see if the next char is ~ */
85 (strcmp(token, "=") == 0 || strcmp(token, "!") == 0) &&
86 pevent_peek_char() == '~') {
93 sprintf(*tok, "%c%c", *token, '~');
95 /* Now remove the '~' from the buffer */
96 pevent_read_token(&token);
104 static int filter_cmp(const void *a, const void *b)
106 const struct filter_type *ea = a;
107 const struct filter_type *eb = b;
109 if (ea->event_id < eb->event_id)
112 if (ea->event_id > eb->event_id)
118 static struct filter_type *
119 find_filter_type(struct event_filter *filter, int id)
121 struct filter_type *filter_type;
122 struct filter_type key;
126 filter_type = bsearch(&key, filter->event_filters,
128 sizeof(*filter->event_filters),
134 static struct filter_type *
135 add_filter_type(struct event_filter *filter, int id)
137 struct filter_type *filter_type;
140 filter_type = find_filter_type(filter, id);
144 filter_type = realloc(filter->event_filters,
145 sizeof(*filter->event_filters) *
146 (filter->filters + 1));
150 filter->event_filters = filter_type;
152 for (i = 0; i < filter->filters; i++) {
153 if (filter->event_filters[i].event_id > id)
157 if (i < filter->filters)
158 memmove(&filter->event_filters[i+1],
159 &filter->event_filters[i],
160 sizeof(*filter->event_filters) *
161 (filter->filters - i));
163 filter_type = &filter->event_filters[i];
164 filter_type->event_id = id;
165 filter_type->event = pevent_find_event(filter->pevent, id);
166 filter_type->filter = NULL;
174 * pevent_filter_alloc - create a new event filter
175 * @pevent: The pevent that this filter is associated with
177 struct event_filter *pevent_filter_alloc(struct pevent *pevent)
179 struct event_filter *filter;
181 filter = malloc(sizeof(*filter));
185 memset(filter, 0, sizeof(*filter));
186 filter->pevent = pevent;
192 static struct filter_arg *allocate_arg(void)
194 return calloc(1, sizeof(struct filter_arg));
197 static void free_arg(struct filter_arg *arg)
203 case FILTER_ARG_NONE:
204 case FILTER_ARG_BOOLEAN:
208 free_arg(arg->num.left);
209 free_arg(arg->num.right);
213 free_arg(arg->exp.left);
214 free_arg(arg->exp.right);
219 regfree(&arg->str.reg);
220 free(arg->str.buffer);
223 case FILTER_ARG_VALUE:
224 if (arg->value.type == FILTER_STRING ||
225 arg->value.type == FILTER_CHAR)
226 free(arg->value.str);
230 free_arg(arg->op.left);
231 free_arg(arg->op.right);
239 static int add_event(struct event_list **events,
240 struct event_format *event)
242 struct event_list *list;
244 list = malloc(sizeof(*list));
248 list->next = *events;
254 static int event_match(struct event_format *event,
255 regex_t *sreg, regex_t *ereg)
258 return !regexec(sreg, event->system, 0, NULL, 0) &&
259 !regexec(ereg, event->name, 0, NULL, 0);
262 return !regexec(ereg, event->system, 0, NULL, 0) ||
263 !regexec(ereg, event->name, 0, NULL, 0);
266 static enum pevent_errno
267 find_event(struct pevent *pevent, struct event_list **events,
268 char *sys_name, char *event_name)
270 struct event_format *event;
280 /* if no name is given, then swap sys and name */
281 event_name = sys_name;
285 reg = malloc(strlen(event_name) + 3);
287 return PEVENT_ERRNO__MEM_ALLOC_FAILED;
289 sprintf(reg, "^%s$", event_name);
291 ret = regcomp(&ereg, reg, REG_ICASE|REG_NOSUB);
295 return PEVENT_ERRNO__INVALID_EVENT_NAME;
298 reg = malloc(strlen(sys_name) + 3);
301 return PEVENT_ERRNO__MEM_ALLOC_FAILED;
304 sprintf(reg, "^%s$", sys_name);
305 ret = regcomp(&sreg, reg, REG_ICASE|REG_NOSUB);
309 return PEVENT_ERRNO__INVALID_EVENT_NAME;
313 for (i = 0; i < pevent->nr_events; i++) {
314 event = pevent->events[i];
315 if (event_match(event, sys_name ? &sreg : NULL, &ereg)) {
317 if (add_event(events, event) < 0) {
329 return PEVENT_ERRNO__EVENT_NOT_FOUND;
331 return PEVENT_ERRNO__MEM_ALLOC_FAILED;
336 static void free_events(struct event_list *events)
338 struct event_list *event;
342 events = events->next;
347 static enum pevent_errno
348 create_arg_item(struct event_format *event, const char *token,
349 enum event_type type, struct filter_arg **parg, char *error_str)
351 struct format_field *field;
352 struct filter_arg *arg;
354 arg = allocate_arg();
356 show_error(error_str, "failed to allocate filter arg");
357 return PEVENT_ERRNO__MEM_ALLOC_FAILED;
364 arg->type = FILTER_ARG_VALUE;
366 type == EVENT_DQUOTE ? FILTER_STRING : FILTER_CHAR;
367 arg->value.str = strdup(token);
368 if (!arg->value.str) {
370 show_error(error_str, "failed to allocate string filter arg");
371 return PEVENT_ERRNO__MEM_ALLOC_FAILED;
375 /* if it is a number, then convert it */
376 if (isdigit(token[0])) {
377 arg->type = FILTER_ARG_VALUE;
378 arg->value.type = FILTER_NUMBER;
379 arg->value.val = strtoull(token, NULL, 0);
382 /* Consider this a field */
383 field = pevent_find_any_field(event, token);
385 if (strcmp(token, COMM) != 0) {
386 /* not a field, Make it false */
387 arg->type = FILTER_ARG_BOOLEAN;
388 arg->boolean.value = FILTER_FALSE;
391 /* If token is 'COMM' then it is special */
394 arg->type = FILTER_ARG_FIELD;
395 arg->field.field = field;
399 show_error(error_str, "expected a value but found %s", token);
400 return PEVENT_ERRNO__UNEXPECTED_TYPE;
406 static struct filter_arg *
407 create_arg_op(enum filter_op_type btype)
409 struct filter_arg *arg;
411 arg = allocate_arg();
415 arg->type = FILTER_ARG_OP;
416 arg->op.type = btype;
421 static struct filter_arg *
422 create_arg_exp(enum filter_exp_type etype)
424 struct filter_arg *arg;
426 arg = allocate_arg();
430 arg->type = FILTER_ARG_EXP;
431 arg->op.type = etype;
436 static struct filter_arg *
437 create_arg_cmp(enum filter_exp_type etype)
439 struct filter_arg *arg;
441 arg = allocate_arg();
445 /* Use NUM and change if necessary */
446 arg->type = FILTER_ARG_NUM;
447 arg->op.type = etype;
452 static enum pevent_errno
453 add_right(struct filter_arg *op, struct filter_arg *arg, char *error_str)
455 struct filter_arg *left;
477 * The arg must be num, str, or field
480 case FILTER_ARG_VALUE:
481 case FILTER_ARG_FIELD:
484 show_error(error_str, "Illegal rvalue");
485 return PEVENT_ERRNO__ILLEGAL_RVALUE;
489 * Depending on the type, we may need to
490 * convert this to a string or regex.
492 switch (arg->value.type) {
495 * A char should be converted to number if
496 * the string is 1 byte, and the compare
499 if (strlen(arg->value.str) == 1 &&
500 op->num.type != FILTER_CMP_REGEX &&
501 op->num.type != FILTER_CMP_NOT_REGEX) {
502 arg->value.type = FILTER_NUMBER;
508 /* convert op to a string arg */
509 op_type = op->num.type;
511 str = arg->value.str;
513 /* reset the op for the new field */
514 memset(op, 0, sizeof(*op));
517 * If left arg was a field not found then
518 * NULL the entire op.
520 if (left->type == FILTER_ARG_BOOLEAN) {
523 op->type = FILTER_ARG_BOOLEAN;
524 op->boolean.value = FILTER_FALSE;
528 /* Left arg must be a field */
529 if (left->type != FILTER_ARG_FIELD) {
530 show_error(error_str,
531 "Illegal lvalue for string comparison");
532 return PEVENT_ERRNO__ILLEGAL_LVALUE;
535 /* Make sure this is a valid string compare */
538 op_type = FILTER_CMP_MATCH;
541 op_type = FILTER_CMP_NOT_MATCH;
544 case FILTER_CMP_REGEX:
545 case FILTER_CMP_NOT_REGEX:
546 ret = regcomp(&op->str.reg, str, REG_ICASE|REG_NOSUB);
548 show_error(error_str,
549 "RegEx '%s' did not compute",
551 return PEVENT_ERRNO__INVALID_REGEX;
555 show_error(error_str,
556 "Illegal comparison for string");
557 return PEVENT_ERRNO__ILLEGAL_STRING_CMP;
560 op->type = FILTER_ARG_STR;
561 op->str.type = op_type;
562 op->str.field = left->field.field;
563 op->str.val = strdup(str);
565 show_error(error_str, "Failed to allocate string filter");
566 return PEVENT_ERRNO__MEM_ALLOC_FAILED;
569 * Need a buffer to copy data for tests
571 op->str.buffer = malloc(op->str.field->size + 1);
572 if (!op->str.buffer) {
573 show_error(error_str, "Failed to allocate string filter");
574 return PEVENT_ERRNO__MEM_ALLOC_FAILED;
576 /* Null terminate this buffer */
577 op->str.buffer[op->str.field->size] = 0;
579 /* We no longer have left or right args */
588 switch (op->num.type) {
589 case FILTER_CMP_REGEX:
590 case FILTER_CMP_NOT_REGEX:
591 show_error(error_str,
592 "Op not allowed with integers");
593 return PEVENT_ERRNO__ILLEGAL_INTEGER_CMP;
599 /* numeric compare */
613 show_error(error_str, "Syntax error");
614 return PEVENT_ERRNO__SYNTAX_ERROR;
617 static struct filter_arg *
618 rotate_op_right(struct filter_arg *a, struct filter_arg *b)
620 struct filter_arg *arg;
627 static enum pevent_errno add_left(struct filter_arg *op, struct filter_arg *arg)
631 if (arg->type == FILTER_ARG_OP)
632 arg = rotate_op_right(arg, op);
640 if (arg->type == FILTER_ARG_OP)
641 arg = rotate_op_right(arg, op);
643 /* left arg of compares must be a field */
644 if (arg->type != FILTER_ARG_FIELD &&
645 arg->type != FILTER_ARG_BOOLEAN)
646 return PEVENT_ERRNO__INVALID_ARG_TYPE;
650 return PEVENT_ERRNO__INVALID_ARG_TYPE;
663 static enum op_type process_op(const char *token,
664 enum filter_op_type *btype,
665 enum filter_cmp_type *ctype,
666 enum filter_exp_type *etype)
668 *btype = FILTER_OP_NOT;
669 *etype = FILTER_EXP_NONE;
670 *ctype = FILTER_CMP_NONE;
672 if (strcmp(token, "&&") == 0)
673 *btype = FILTER_OP_AND;
674 else if (strcmp(token, "||") == 0)
675 *btype = FILTER_OP_OR;
676 else if (strcmp(token, "!") == 0)
679 if (*btype != FILTER_OP_NOT)
682 /* Check for value expressions */
683 if (strcmp(token, "+") == 0) {
684 *etype = FILTER_EXP_ADD;
685 } else if (strcmp(token, "-") == 0) {
686 *etype = FILTER_EXP_SUB;
687 } else if (strcmp(token, "*") == 0) {
688 *etype = FILTER_EXP_MUL;
689 } else if (strcmp(token, "/") == 0) {
690 *etype = FILTER_EXP_DIV;
691 } else if (strcmp(token, "%") == 0) {
692 *etype = FILTER_EXP_MOD;
693 } else if (strcmp(token, ">>") == 0) {
694 *etype = FILTER_EXP_RSHIFT;
695 } else if (strcmp(token, "<<") == 0) {
696 *etype = FILTER_EXP_LSHIFT;
697 } else if (strcmp(token, "&") == 0) {
698 *etype = FILTER_EXP_AND;
699 } else if (strcmp(token, "|") == 0) {
700 *etype = FILTER_EXP_OR;
701 } else if (strcmp(token, "^") == 0) {
702 *etype = FILTER_EXP_XOR;
703 } else if (strcmp(token, "~") == 0)
704 *etype = FILTER_EXP_NOT;
706 if (*etype != FILTER_EXP_NONE)
709 /* Check for compares */
710 if (strcmp(token, "==") == 0)
711 *ctype = FILTER_CMP_EQ;
712 else if (strcmp(token, "!=") == 0)
713 *ctype = FILTER_CMP_NE;
714 else if (strcmp(token, "<") == 0)
715 *ctype = FILTER_CMP_LT;
716 else if (strcmp(token, ">") == 0)
717 *ctype = FILTER_CMP_GT;
718 else if (strcmp(token, "<=") == 0)
719 *ctype = FILTER_CMP_LE;
720 else if (strcmp(token, ">=") == 0)
721 *ctype = FILTER_CMP_GE;
722 else if (strcmp(token, "=~") == 0)
723 *ctype = FILTER_CMP_REGEX;
724 else if (strcmp(token, "!~") == 0)
725 *ctype = FILTER_CMP_NOT_REGEX;
732 static int check_op_done(struct filter_arg *arg)
736 return arg->exp.right != NULL;
739 return arg->op.right != NULL;
742 return arg->num.right != NULL;
745 /* A string conversion is always done */
748 case FILTER_ARG_BOOLEAN:
749 /* field not found, is ok */
763 static enum pevent_errno
764 reparent_op_arg(struct filter_arg *parent, struct filter_arg *old_child,
765 struct filter_arg *arg, char *error_str)
767 struct filter_arg *other_child;
768 struct filter_arg **ptr;
770 if (parent->type != FILTER_ARG_OP &&
771 arg->type != FILTER_ARG_OP) {
772 show_error(error_str, "can not reparent other than OP");
773 return PEVENT_ERRNO__REPARENT_NOT_OP;
776 /* Get the sibling */
777 if (old_child->op.right == arg) {
778 ptr = &old_child->op.right;
779 other_child = old_child->op.left;
780 } else if (old_child->op.left == arg) {
781 ptr = &old_child->op.left;
782 other_child = old_child->op.right;
784 show_error(error_str, "Error in reparent op, find other child");
785 return PEVENT_ERRNO__REPARENT_FAILED;
788 /* Detach arg from old_child */
792 if (parent == old_child) {
793 free_arg(other_child);
795 /* Free arg without recussion */
800 if (parent->op.right == old_child)
801 ptr = &parent->op.right;
802 else if (parent->op.left == old_child)
803 ptr = &parent->op.left;
805 show_error(error_str, "Error in reparent op");
806 return PEVENT_ERRNO__REPARENT_FAILED;
815 /* Returns either filter_vals (success) or pevent_errno (failfure) */
816 static int test_arg(struct filter_arg *parent, struct filter_arg *arg,
824 case FILTER_ARG_BOOLEAN:
825 return FILTER_VAL_FALSE + arg->boolean.value;
829 case FILTER_ARG_VALUE:
830 case FILTER_ARG_FIELD:
831 return FILTER_VAL_NORM;
834 lval = test_arg(arg, arg->exp.left, error_str);
835 if (lval != FILTER_VAL_NORM)
837 rval = test_arg(arg, arg->exp.right, error_str);
838 if (rval != FILTER_VAL_NORM)
840 return FILTER_VAL_NORM;
843 lval = test_arg(arg, arg->num.left, error_str);
844 if (lval != FILTER_VAL_NORM)
846 rval = test_arg(arg, arg->num.right, error_str);
847 if (rval != FILTER_VAL_NORM)
849 return FILTER_VAL_NORM;
852 if (arg->op.type != FILTER_OP_NOT) {
853 lval = test_arg(arg, arg->op.left, error_str);
855 case FILTER_VAL_NORM:
857 case FILTER_VAL_TRUE:
858 if (arg->op.type == FILTER_OP_OR)
859 return FILTER_VAL_TRUE;
860 rval = test_arg(arg, arg->op.right, error_str);
861 if (rval != FILTER_VAL_NORM)
864 return reparent_op_arg(parent, arg, arg->op.right,
867 case FILTER_VAL_FALSE:
868 if (arg->op.type == FILTER_OP_AND)
869 return FILTER_VAL_FALSE;
870 rval = test_arg(arg, arg->op.right, error_str);
871 if (rval != FILTER_VAL_NORM)
874 return reparent_op_arg(parent, arg, arg->op.right,
882 rval = test_arg(arg, arg->op.right, error_str);
884 case FILTER_VAL_NORM:
888 case FILTER_VAL_TRUE:
889 if (arg->op.type == FILTER_OP_OR)
890 return FILTER_VAL_TRUE;
891 if (arg->op.type == FILTER_OP_NOT)
892 return FILTER_VAL_FALSE;
894 return reparent_op_arg(parent, arg, arg->op.left,
897 case FILTER_VAL_FALSE:
898 if (arg->op.type == FILTER_OP_AND)
899 return FILTER_VAL_FALSE;
900 if (arg->op.type == FILTER_OP_NOT)
901 return FILTER_VAL_TRUE;
903 return reparent_op_arg(parent, arg, arg->op.left,
909 show_error(error_str, "bad arg in filter tree");
910 return PEVENT_ERRNO__BAD_FILTER_ARG;
912 return FILTER_VAL_NORM;
915 /* Remove any unknown event fields */
916 static int collapse_tree(struct filter_arg *arg,
917 struct filter_arg **arg_collapsed, char *error_str)
921 ret = test_arg(arg, arg, error_str);
923 case FILTER_VAL_NORM:
926 case FILTER_VAL_TRUE:
927 case FILTER_VAL_FALSE:
929 arg = allocate_arg();
931 arg->type = FILTER_ARG_BOOLEAN;
932 arg->boolean.value = ret == FILTER_VAL_TRUE;
934 show_error(error_str, "Failed to allocate filter arg");
935 ret = PEVENT_ERRNO__MEM_ALLOC_FAILED;
940 /* test_arg() already set the error_str */
946 *arg_collapsed = arg;
950 static enum pevent_errno
951 process_filter(struct event_format *event, struct filter_arg **parg,
952 char *error_str, int not)
954 enum event_type type;
956 struct filter_arg *current_op = NULL;
957 struct filter_arg *current_exp = NULL;
958 struct filter_arg *left_item = NULL;
959 struct filter_arg *arg = NULL;
960 enum op_type op_type;
961 enum filter_op_type btype;
962 enum filter_exp_type etype;
963 enum filter_cmp_type ctype;
964 enum pevent_errno ret;
970 type = read_token(&token);
975 ret = create_arg_item(event, token, type, &arg, error_str);
980 else if (current_exp) {
981 ret = add_right(current_exp, arg, error_str);
985 /* Not's only one one expression */
1000 if (*token == ',') {
1001 show_error(error_str, "Illegal token ','");
1002 ret = PEVENT_ERRNO__ILLEGAL_TOKEN;
1006 if (*token == '(') {
1008 show_error(error_str,
1009 "Open paren can not come after item");
1010 ret = PEVENT_ERRNO__INVALID_PAREN;
1014 show_error(error_str,
1015 "Open paren can not come after expression");
1016 ret = PEVENT_ERRNO__INVALID_PAREN;
1020 ret = process_filter(event, &arg, error_str, 0);
1021 if (ret != PEVENT_ERRNO__UNBALANCED_PAREN) {
1023 show_error(error_str,
1024 "Unbalanced number of '('");
1025 ret = PEVENT_ERRNO__UNBALANCED_PAREN;
1031 /* A not wants just one expression */
1040 ret = add_right(current_op, arg, error_str);
1048 if (!current_op && !current_exp)
1051 /* Make sure everything is finished at this level */
1052 if (current_exp && !check_op_done(current_exp))
1054 if (current_op && !check_op_done(current_op))
1060 *parg = current_exp;
1062 return PEVENT_ERRNO__UNBALANCED_PAREN;
1067 op_type = process_op(token, &btype, &ctype, &etype);
1069 /* All expect a left arg except for NOT */
1072 /* Logic ops need a left expression */
1073 if (!current_exp && !current_op)
1077 /* logic only processes ops and exp */
1087 show_error(error_str,
1088 "Unknown op token %s", token);
1089 ret = PEVENT_ERRNO__UNKNOWN_TOKEN;
1096 arg = create_arg_op(btype);
1100 ret = add_left(arg, current_op);
1102 ret = add_left(arg, current_exp);
1108 arg = create_arg_op(btype);
1112 ret = add_right(current_op, arg, error_str);
1116 ret = process_filter(event, &arg, error_str, 1);
1119 ret = add_right(current_exp, arg, error_str);
1126 if (op_type == OP_EXP)
1127 arg = create_arg_exp(etype);
1129 arg = create_arg_cmp(ctype);
1134 ret = add_right(current_op, arg, error_str);
1137 ret = add_left(arg, left_item);
1158 } while (type != EVENT_NONE);
1160 if (!current_op && !current_exp)
1164 current_op = current_exp;
1166 ret = collapse_tree(current_op, parg, error_str);
1176 show_error(error_str, "failed to allocate filter arg");
1177 ret = PEVENT_ERRNO__MEM_ALLOC_FAILED;
1180 show_error(error_str, "Syntax error");
1181 ret = PEVENT_ERRNO__SYNTAX_ERROR;
1183 free_arg(current_op);
1184 free_arg(current_exp);
1190 static enum pevent_errno
1191 process_event(struct event_format *event, const char *filter_str,
1192 struct filter_arg **parg, char *error_str)
1196 pevent_buffer_init(filter_str, strlen(filter_str));
1198 ret = process_filter(event, parg, error_str, 0);
1202 /* If parg is NULL, then make it into FALSE */
1204 *parg = allocate_arg();
1206 return PEVENT_ERRNO__MEM_ALLOC_FAILED;
1208 (*parg)->type = FILTER_ARG_BOOLEAN;
1209 (*parg)->boolean.value = FILTER_FALSE;
1215 static enum pevent_errno
1216 filter_event(struct event_filter *filter, struct event_format *event,
1217 const char *filter_str, char *error_str)
1219 struct filter_type *filter_type;
1220 struct filter_arg *arg;
1221 enum pevent_errno ret;
1224 ret = process_event(event, filter_str, &arg, error_str);
1229 /* just add a TRUE arg */
1230 arg = allocate_arg();
1232 return PEVENT_ERRNO__MEM_ALLOC_FAILED;
1234 arg->type = FILTER_ARG_BOOLEAN;
1235 arg->boolean.value = FILTER_TRUE;
1238 filter_type = add_filter_type(filter, event->id);
1239 if (filter_type == NULL)
1240 return PEVENT_ERRNO__MEM_ALLOC_FAILED;
1242 if (filter_type->filter)
1243 free_arg(filter_type->filter);
1244 filter_type->filter = arg;
1249 static void filter_init_error_buf(struct event_filter *filter)
1251 /* clear buffer to reset show error */
1252 pevent_buffer_init("", 0);
1253 filter->error_buffer[0] = '\0';
1257 * pevent_filter_add_filter_str - add a new filter
1258 * @filter: the event filter to add to
1259 * @filter_str: the filter string that contains the filter
1261 * Returns 0 if the filter was successfully added or a
1262 * negative error code. Use pevent_filter_strerror() to see
1263 * actual error message in case of error.
1265 enum pevent_errno pevent_filter_add_filter_str(struct event_filter *filter,
1266 const char *filter_str)
1268 struct pevent *pevent = filter->pevent;
1269 struct event_list *event;
1270 struct event_list *events = NULL;
1271 const char *filter_start;
1272 const char *next_event;
1274 char *event_name = NULL;
1275 char *sys_name = NULL;
1277 enum pevent_errno rtn = 0; /* PEVENT_ERRNO__SUCCESS */
1281 filter_init_error_buf(filter);
1283 filter_start = strchr(filter_str, ':');
1285 len = filter_start - filter_str;
1287 len = strlen(filter_str);
1290 next_event = strchr(filter_str, ',');
1292 (!filter_start || next_event < filter_start))
1293 len = next_event - filter_str;
1294 else if (filter_start)
1295 len = filter_start - filter_str;
1297 len = strlen(filter_str);
1299 this_event = malloc(len + 1);
1300 if (this_event == NULL) {
1301 /* This can only happen when events is NULL, but still */
1302 free_events(events);
1303 return PEVENT_ERRNO__MEM_ALLOC_FAILED;
1305 memcpy(this_event, filter_str, len);
1306 this_event[len] = 0;
1311 filter_str = next_event;
1313 sys_name = strtok_r(this_event, "/", &sp);
1314 event_name = strtok_r(NULL, "/", &sp);
1317 /* This can only happen when events is NULL, but still */
1318 free_events(events);
1320 return PEVENT_ERRNO__FILTER_NOT_FOUND;
1323 /* Find this event */
1324 ret = find_event(pevent, &events, strim(sys_name), strim(event_name));
1326 free_events(events);
1331 } while (filter_str);
1337 /* filter starts here */
1338 for (event = events; event; event = event->next) {
1339 ret = filter_event(filter, event->event, filter_start,
1340 filter->error_buffer);
1341 /* Failures are returned if a parse error happened */
1345 if (ret >= 0 && pevent->test_filters) {
1347 test = pevent_filter_make_string(filter, event->event->id);
1349 printf(" '%s: %s'\n", event->event->name, test);
1355 free_events(events);
1357 if (rtn >= 0 && pevent->test_filters)
1363 static void free_filter_type(struct filter_type *filter_type)
1365 free_arg(filter_type->filter);
1369 * pevent_filter_strerror - fill error message in a buffer
1370 * @filter: the event filter contains error
1371 * @err: the error code
1372 * @buf: the buffer to be filled in
1373 * @buflen: the size of the buffer
1375 * Returns 0 if message was filled successfully, -1 if error
1377 int pevent_filter_strerror(struct event_filter *filter, enum pevent_errno err,
1378 char *buf, size_t buflen)
1380 if (err <= __PEVENT_ERRNO__START || err >= __PEVENT_ERRNO__END)
1383 if (strlen(filter->error_buffer) > 0) {
1384 size_t len = snprintf(buf, buflen, "%s", filter->error_buffer);
1391 return pevent_strerror(filter->pevent, err, buf, buflen);
1395 * pevent_filter_remove_event - remove a filter for an event
1396 * @filter: the event filter to remove from
1397 * @event_id: the event to remove a filter for
1399 * Removes the filter saved for an event defined by @event_id
1402 * Returns 1: if an event was removed
1403 * 0: if the event was not found
1405 int pevent_filter_remove_event(struct event_filter *filter,
1408 struct filter_type *filter_type;
1411 if (!filter->filters)
1414 filter_type = find_filter_type(filter, event_id);
1419 free_filter_type(filter_type);
1421 /* The filter_type points into the event_filters array */
1422 len = (unsigned long)(filter->event_filters + filter->filters) -
1423 (unsigned long)(filter_type + 1);
1425 memmove(filter_type, filter_type + 1, len);
1428 memset(&filter->event_filters[filter->filters], 0,
1429 sizeof(*filter_type));
1435 * pevent_filter_reset - clear all filters in a filter
1436 * @filter: the event filter to reset
1438 * Removes all filters from a filter and resets it.
1440 void pevent_filter_reset(struct event_filter *filter)
1444 for (i = 0; i < filter->filters; i++)
1445 free_filter_type(&filter->event_filters[i]);
1447 free(filter->event_filters);
1448 filter->filters = 0;
1449 filter->event_filters = NULL;
1452 void pevent_filter_free(struct event_filter *filter)
1454 pevent_unref(filter->pevent);
1456 pevent_filter_reset(filter);
1461 static char *arg_to_str(struct event_filter *filter, struct filter_arg *arg);
1463 static int copy_filter_type(struct event_filter *filter,
1464 struct event_filter *source,
1465 struct filter_type *filter_type)
1467 struct filter_arg *arg;
1468 struct event_format *event;
1473 /* Can't assume that the pevent's are the same */
1474 sys = filter_type->event->system;
1475 name = filter_type->event->name;
1476 event = pevent_find_event_by_name(filter->pevent, sys, name);
1480 str = arg_to_str(source, filter_type->filter);
1484 if (strcmp(str, "TRUE") == 0 || strcmp(str, "FALSE") == 0) {
1485 /* Add trivial event */
1486 arg = allocate_arg();
1490 arg->type = FILTER_ARG_BOOLEAN;
1491 if (strcmp(str, "TRUE") == 0)
1492 arg->boolean.value = 1;
1494 arg->boolean.value = 0;
1496 filter_type = add_filter_type(filter, event->id);
1497 if (filter_type == NULL)
1500 filter_type->filter = arg;
1506 filter_event(filter, event, str, NULL);
1513 * pevent_filter_copy - copy a filter using another filter
1514 * @dest - the filter to copy to
1515 * @source - the filter to copy from
1517 * Returns 0 on success and -1 if not all filters were copied
1519 int pevent_filter_copy(struct event_filter *dest, struct event_filter *source)
1524 pevent_filter_reset(dest);
1526 for (i = 0; i < source->filters; i++) {
1527 if (copy_filter_type(dest, source, &source->event_filters[i]))
1535 * pevent_update_trivial - update the trivial filters with the given filter
1536 * @dest - the filter to update
1537 * @source - the filter as the source of the update
1538 * @type - the type of trivial filter to update.
1540 * Scan dest for trivial events matching @type to replace with the source.
1542 * Returns 0 on success and -1 if there was a problem updating, but
1543 * events may have still been updated on error.
1545 int pevent_update_trivial(struct event_filter *dest, struct event_filter *source,
1546 enum filter_trivial_type type)
1548 struct pevent *src_pevent;
1549 struct pevent *dest_pevent;
1550 struct event_format *event;
1551 struct filter_type *filter_type;
1552 struct filter_arg *arg;
1556 src_pevent = source->pevent;
1557 dest_pevent = dest->pevent;
1559 /* Do nothing if either of the filters has nothing to filter */
1560 if (!dest->filters || !source->filters)
1563 for (i = 0; i < dest->filters; i++) {
1564 filter_type = &dest->event_filters[i];
1565 arg = filter_type->filter;
1566 if (arg->type != FILTER_ARG_BOOLEAN)
1568 if ((arg->boolean.value && type == FILTER_TRIVIAL_FALSE) ||
1569 (!arg->boolean.value && type == FILTER_TRIVIAL_TRUE))
1572 event = filter_type->event;
1574 if (src_pevent != dest_pevent) {
1576 event = pevent_find_event_by_name(src_pevent,
1583 str = pevent_filter_make_string(source, event->id);
1587 /* Don't bother if the filter is trivial too */
1588 if (strcmp(str, "TRUE") != 0 && strcmp(str, "FALSE") != 0)
1589 filter_event(dest, event, str, NULL);
1596 * pevent_filter_clear_trivial - clear TRUE and FALSE filters
1597 * @filter: the filter to remove trivial filters from
1598 * @type: remove only true, false, or both
1600 * Removes filters that only contain a TRUE or FALES boolean arg.
1602 * Returns 0 on success and -1 if there was a problem.
1604 int pevent_filter_clear_trivial(struct event_filter *filter,
1605 enum filter_trivial_type type)
1607 struct filter_type *filter_type;
1612 if (!filter->filters)
1616 * Two steps, first get all ids with trivial filters.
1617 * then remove those ids.
1619 for (i = 0; i < filter->filters; i++) {
1622 filter_type = &filter->event_filters[i];
1623 if (filter_type->filter->type != FILTER_ARG_BOOLEAN)
1626 case FILTER_TRIVIAL_FALSE:
1627 if (filter_type->filter->boolean.value)
1629 case FILTER_TRIVIAL_TRUE:
1630 if (!filter_type->filter->boolean.value)
1636 new_ids = realloc(ids, sizeof(*ids) * (count + 1));
1643 ids[count++] = filter_type->event_id;
1649 for (i = 0; i < count; i++)
1650 pevent_filter_remove_event(filter, ids[i]);
1657 * pevent_filter_event_has_trivial - return true event contains trivial filter
1658 * @filter: the filter with the information
1659 * @event_id: the id of the event to test
1660 * @type: trivial type to test for (TRUE, FALSE, EITHER)
1662 * Returns 1 if the event contains a matching trivial type
1665 int pevent_filter_event_has_trivial(struct event_filter *filter,
1667 enum filter_trivial_type type)
1669 struct filter_type *filter_type;
1671 if (!filter->filters)
1674 filter_type = find_filter_type(filter, event_id);
1679 if (filter_type->filter->type != FILTER_ARG_BOOLEAN)
1683 case FILTER_TRIVIAL_FALSE:
1684 return !filter_type->filter->boolean.value;
1686 case FILTER_TRIVIAL_TRUE:
1687 return filter_type->filter->boolean.value;
1693 static int test_filter(struct event_format *event, struct filter_arg *arg,
1694 struct pevent_record *record, enum pevent_errno *err);
1697 get_comm(struct event_format *event, struct pevent_record *record)
1702 pid = pevent_data_pid(event->pevent, record);
1703 comm = pevent_data_comm_from_pid(event->pevent, pid);
1707 static unsigned long long
1708 get_value(struct event_format *event,
1709 struct format_field *field, struct pevent_record *record)
1711 unsigned long long val;
1713 /* Handle our dummy "comm" field */
1714 if (field == &comm) {
1717 name = get_comm(event, record);
1718 return (unsigned long)name;
1721 pevent_read_number_field(field, record->data, &val);
1723 if (!(field->flags & FIELD_IS_SIGNED))
1726 switch (field->size) {
1734 return (long long)val;
1739 static unsigned long long
1740 get_arg_value(struct event_format *event, struct filter_arg *arg,
1741 struct pevent_record *record, enum pevent_errno *err);
1743 static unsigned long long
1744 get_exp_value(struct event_format *event, struct filter_arg *arg,
1745 struct pevent_record *record, enum pevent_errno *err)
1747 unsigned long long lval, rval;
1749 lval = get_arg_value(event, arg->exp.left, record, err);
1750 rval = get_arg_value(event, arg->exp.right, record, err);
1754 * There was an error, no need to process anymore.
1759 switch (arg->exp.type) {
1760 case FILTER_EXP_ADD:
1763 case FILTER_EXP_SUB:
1766 case FILTER_EXP_MUL:
1769 case FILTER_EXP_DIV:
1772 case FILTER_EXP_MOD:
1775 case FILTER_EXP_RSHIFT:
1776 return lval >> rval;
1778 case FILTER_EXP_LSHIFT:
1779 return lval << rval;
1781 case FILTER_EXP_AND:
1787 case FILTER_EXP_XOR:
1790 case FILTER_EXP_NOT:
1793 *err = PEVENT_ERRNO__INVALID_EXP_TYPE;
1798 static unsigned long long
1799 get_arg_value(struct event_format *event, struct filter_arg *arg,
1800 struct pevent_record *record, enum pevent_errno *err)
1802 switch (arg->type) {
1803 case FILTER_ARG_FIELD:
1804 return get_value(event, arg->field.field, record);
1806 case FILTER_ARG_VALUE:
1807 if (arg->value.type != FILTER_NUMBER) {
1809 *err = PEVENT_ERRNO__NOT_A_NUMBER;
1811 return arg->value.val;
1813 case FILTER_ARG_EXP:
1814 return get_exp_value(event, arg, record, err);
1818 *err = PEVENT_ERRNO__INVALID_ARG_TYPE;
1823 static int test_num(struct event_format *event, struct filter_arg *arg,
1824 struct pevent_record *record, enum pevent_errno *err)
1826 unsigned long long lval, rval;
1828 lval = get_arg_value(event, arg->num.left, record, err);
1829 rval = get_arg_value(event, arg->num.right, record, err);
1833 * There was an error, no need to process anymore.
1838 switch (arg->num.type) {
1840 return lval == rval;
1843 return lval != rval;
1852 return lval >= rval;
1855 return lval <= rval;
1859 *err = PEVENT_ERRNO__ILLEGAL_INTEGER_CMP;
1864 static const char *get_field_str(struct filter_arg *arg, struct pevent_record *record)
1866 struct event_format *event;
1867 struct pevent *pevent;
1868 unsigned long long addr;
1869 const char *val = NULL;
1872 /* If the field is not a string convert it */
1873 if (arg->str.field->flags & FIELD_IS_STRING) {
1874 val = record->data + arg->str.field->offset;
1877 * We need to copy the data since we can't be sure the field
1878 * is null terminated.
1880 if (*(val + arg->str.field->size - 1)) {
1882 memcpy(arg->str.buffer, val, arg->str.field->size);
1883 /* the buffer is already NULL terminated */
1884 val = arg->str.buffer;
1888 event = arg->str.field->event;
1889 pevent = event->pevent;
1890 addr = get_value(event, arg->str.field, record);
1892 if (arg->str.field->flags & (FIELD_IS_POINTER | FIELD_IS_LONG))
1893 /* convert to a kernel symbol */
1894 val = pevent_find_function(pevent, addr);
1897 /* just use the hex of the string name */
1898 snprintf(hex, 64, "0x%llx", addr);
1906 static int test_str(struct event_format *event, struct filter_arg *arg,
1907 struct pevent_record *record, enum pevent_errno *err)
1911 if (arg->str.field == &comm)
1912 val = get_comm(event, record);
1914 val = get_field_str(arg, record);
1916 switch (arg->str.type) {
1917 case FILTER_CMP_MATCH:
1918 return strcmp(val, arg->str.val) == 0;
1920 case FILTER_CMP_NOT_MATCH:
1921 return strcmp(val, arg->str.val) != 0;
1923 case FILTER_CMP_REGEX:
1924 /* Returns zero on match */
1925 return !regexec(&arg->str.reg, val, 0, NULL, 0);
1927 case FILTER_CMP_NOT_REGEX:
1928 return regexec(&arg->str.reg, val, 0, NULL, 0);
1932 *err = PEVENT_ERRNO__ILLEGAL_STRING_CMP;
1937 static int test_op(struct event_format *event, struct filter_arg *arg,
1938 struct pevent_record *record, enum pevent_errno *err)
1940 switch (arg->op.type) {
1942 return test_filter(event, arg->op.left, record, err) &&
1943 test_filter(event, arg->op.right, record, err);
1946 return test_filter(event, arg->op.left, record, err) ||
1947 test_filter(event, arg->op.right, record, err);
1950 return !test_filter(event, arg->op.right, record, err);
1954 *err = PEVENT_ERRNO__INVALID_OP_TYPE;
1959 static int test_filter(struct event_format *event, struct filter_arg *arg,
1960 struct pevent_record *record, enum pevent_errno *err)
1964 * There was an error, no need to process anymore.
1969 switch (arg->type) {
1970 case FILTER_ARG_BOOLEAN:
1972 return arg->boolean.value;
1975 return test_op(event, arg, record, err);
1977 case FILTER_ARG_NUM:
1978 return test_num(event, arg, record, err);
1980 case FILTER_ARG_STR:
1981 return test_str(event, arg, record, err);
1983 case FILTER_ARG_EXP:
1984 case FILTER_ARG_VALUE:
1985 case FILTER_ARG_FIELD:
1987 * Expressions, fields and values evaluate
1988 * to true if they return non zero
1990 return !!get_arg_value(event, arg, record, err);
1994 *err = PEVENT_ERRNO__INVALID_ARG_TYPE;
2000 * pevent_event_filtered - return true if event has filter
2001 * @filter: filter struct with filter information
2002 * @event_id: event id to test if filter exists
2004 * Returns 1 if filter found for @event_id
2007 int pevent_event_filtered(struct event_filter *filter, int event_id)
2009 struct filter_type *filter_type;
2011 if (!filter->filters)
2014 filter_type = find_filter_type(filter, event_id);
2016 return filter_type ? 1 : 0;
2020 * pevent_filter_match - test if a record matches a filter
2021 * @filter: filter struct with filter information
2022 * @record: the record to test against the filter
2024 * Returns: match result or error code (prefixed with PEVENT_ERRNO__)
2025 * FILTER_MATCH - filter found for event and @record matches
2026 * FILTER_MISS - filter found for event and @record does not match
2027 * FILTER_NOT_FOUND - no filter found for @record's event
2028 * NO_FILTER - if no filters exist
2029 * otherwise - error occurred during test
2031 enum pevent_errno pevent_filter_match(struct event_filter *filter,
2032 struct pevent_record *record)
2034 struct pevent *pevent = filter->pevent;
2035 struct filter_type *filter_type;
2038 enum pevent_errno err = 0;
2040 filter_init_error_buf(filter);
2042 if (!filter->filters)
2043 return PEVENT_ERRNO__NO_FILTER;
2045 event_id = pevent_data_type(pevent, record);
2047 filter_type = find_filter_type(filter, event_id);
2049 return PEVENT_ERRNO__FILTER_NOT_FOUND;
2051 ret = test_filter(filter_type->event, filter_type->filter, record, &err);
2055 return ret ? PEVENT_ERRNO__FILTER_MATCH : PEVENT_ERRNO__FILTER_MISS;
2058 static char *op_to_str(struct event_filter *filter, struct filter_arg *arg)
2068 switch (arg->op.type) {
2076 left = arg_to_str(filter, arg->op.left);
2077 right = arg_to_str(filter, arg->op.right);
2078 if (!left || !right)
2081 /* Try to consolidate boolean values */
2082 if (strcmp(left, "TRUE") == 0)
2084 else if (strcmp(left, "FALSE") == 0)
2087 if (strcmp(right, "TRUE") == 0)
2089 else if (strcmp(right, "FALSE") == 0)
2092 if (left_val >= 0) {
2093 if ((arg->op.type == FILTER_OP_AND && !left_val) ||
2094 (arg->op.type == FILTER_OP_OR && left_val)) {
2095 /* Just return left value */
2100 if (right_val >= 0) {
2101 /* just evaluate this. */
2103 switch (arg->op.type) {
2105 val = left_val && right_val;
2108 val = left_val || right_val;
2113 asprintf(&str, val ? "TRUE" : "FALSE");
2117 if (right_val >= 0) {
2118 if ((arg->op.type == FILTER_OP_AND && !right_val) ||
2119 (arg->op.type == FILTER_OP_OR && right_val)) {
2120 /* Just return right value */
2125 /* The right value is meaningless */
2131 asprintf(&str, "(%s) %s (%s)", left, op, right);
2136 right = arg_to_str(filter, arg->op.right);
2140 /* See if we can consolidate */
2141 if (strcmp(right, "TRUE") == 0)
2143 else if (strcmp(right, "FALSE") == 0)
2145 if (right_val >= 0) {
2146 /* just return the opposite */
2147 asprintf(&str, right_val ? "FALSE" : "TRUE");
2150 asprintf(&str, "%s(%s)", op, right);
2162 static char *val_to_str(struct event_filter *filter, struct filter_arg *arg)
2166 asprintf(&str, "%lld", arg->value.val);
2171 static char *field_to_str(struct event_filter *filter, struct filter_arg *arg)
2173 return strdup(arg->field.field->name);
2176 static char *exp_to_str(struct event_filter *filter, struct filter_arg *arg)
2183 lstr = arg_to_str(filter, arg->exp.left);
2184 rstr = arg_to_str(filter, arg->exp.right);
2188 switch (arg->exp.type) {
2189 case FILTER_EXP_ADD:
2192 case FILTER_EXP_SUB:
2195 case FILTER_EXP_MUL:
2198 case FILTER_EXP_DIV:
2201 case FILTER_EXP_MOD:
2204 case FILTER_EXP_RSHIFT:
2207 case FILTER_EXP_LSHIFT:
2210 case FILTER_EXP_AND:
2216 case FILTER_EXP_XOR:
2220 op = "[ERROR IN EXPRESSION TYPE]";
2224 asprintf(&str, "%s %s %s", lstr, op, rstr);
2232 static char *num_to_str(struct event_filter *filter, struct filter_arg *arg)
2239 lstr = arg_to_str(filter, arg->num.left);
2240 rstr = arg_to_str(filter, arg->num.right);
2244 switch (arg->num.type) {
2268 asprintf(&str, "%s %s %s", lstr, op, rstr);
2282 static char *str_to_str(struct event_filter *filter, struct filter_arg *arg)
2287 switch (arg->str.type) {
2288 case FILTER_CMP_MATCH:
2291 case FILTER_CMP_NOT_MATCH:
2295 case FILTER_CMP_REGEX:
2299 case FILTER_CMP_NOT_REGEX:
2303 asprintf(&str, "%s %s \"%s\"",
2304 arg->str.field->name, op, arg->str.val);
2314 static char *arg_to_str(struct event_filter *filter, struct filter_arg *arg)
2318 switch (arg->type) {
2319 case FILTER_ARG_BOOLEAN:
2320 asprintf(&str, arg->boolean.value ? "TRUE" : "FALSE");
2324 return op_to_str(filter, arg);
2326 case FILTER_ARG_NUM:
2327 return num_to_str(filter, arg);
2329 case FILTER_ARG_STR:
2330 return str_to_str(filter, arg);
2332 case FILTER_ARG_VALUE:
2333 return val_to_str(filter, arg);
2335 case FILTER_ARG_FIELD:
2336 return field_to_str(filter, arg);
2338 case FILTER_ARG_EXP:
2339 return exp_to_str(filter, arg);
2349 * pevent_filter_make_string - return a string showing the filter
2350 * @filter: filter struct with filter information
2351 * @event_id: the event id to return the filter string with
2353 * Returns a string that displays the filter contents.
2354 * This string must be freed with free(str).
2355 * NULL is returned if no filter is found or allocation failed.
2358 pevent_filter_make_string(struct event_filter *filter, int event_id)
2360 struct filter_type *filter_type;
2362 if (!filter->filters)
2365 filter_type = find_filter_type(filter, event_id);
2370 return arg_to_str(filter, filter_type->filter);
2374 * pevent_filter_compare - compare two filters and return if they are the same
2375 * @filter1: Filter to compare with @filter2
2376 * @filter2: Filter to compare with @filter1
2379 * 1 if the two filters hold the same content.
2382 int pevent_filter_compare(struct event_filter *filter1, struct event_filter *filter2)
2384 struct filter_type *filter_type1;
2385 struct filter_type *filter_type2;
2390 /* Do the easy checks first */
2391 if (filter1->filters != filter2->filters)
2393 if (!filter1->filters && !filter2->filters)
2397 * Now take a look at each of the events to see if they have the same
2400 for (i = 0; i < filter1->filters; i++) {
2401 filter_type1 = &filter1->event_filters[i];
2402 filter_type2 = find_filter_type(filter2, filter_type1->event_id);
2405 if (filter_type1->filter->type != filter_type2->filter->type)
2407 switch (filter_type1->filter->type) {
2408 case FILTER_TRIVIAL_FALSE:
2409 case FILTER_TRIVIAL_TRUE:
2410 /* trivial types just need the type compared */
2415 /* The best way to compare complex filters is with strings */
2416 str1 = arg_to_str(filter1, filter_type1->filter);
2417 str2 = arg_to_str(filter2, filter_type2->filter);
2419 result = strcmp(str1, str2) != 0;
2421 /* bail out if allocation fails */
2430 if (i < filter1->filters)