parse-events: Add event filtering on event fields

Add the ability to filter on event fields. This patch implements
the filter on trace-cmd report.

 Using the following:

  trace-cmd report -F 'sched.sched_switch:next_prio < 100 ||
    (prev_comm != "swapper" && next_comm != "swapper")'

Will return a report where prios are under 100 (Real-time)
and does not include any context switch with the swapper task.

Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

6 files changed, 1068 insertions, 17 deletions

diff --git a/Makefile b/Makefile
index 3596d1e..20e7af2 100644
--- a/Makefile
+++ b/Makefile
@@ -149,7 +149,7 @@ TRACE_VIEW_MAIN_OBJS = trace-view-main.o $(TRACE_VIEW_OBJS)
 TRACE_GRAPH_MAIN_OBJS = trace-graph-main.o $(TRACE_GRAPH_OBJS)
 KERNEL_SHARK_OBJS = $(TRACE_VIEW_OBJS) $(TRACE_GRAPH_OBJS) kernel-shark.o
 
-PEVENT_LIB_OBJS = parse-events.o trace-seq.o
+PEVENT_LIB_OBJS = parse-events.o trace-seq.o parse-filter.o
 TCMD_LIB_OBJS = $(PEVENT_LIB_OBJS) trace-util.o trace-input.o trace-ftrace.o \
                         trace-output.o trace-record.o
 
diff --git a/parse-events.c b/parse-events.c
index 1592fa3..b29a8d5 100644
--- a/parse-events.c
+++ b/parse-events.c
@@ -44,6 +44,19 @@ static void init_input_buf(const char *buf, unsigned long long size)
         input_buf_ptr = 0;
 }
 
+/**
+ * pevent_buffer_init - init buffer for parsing
+ * @buf: buffer to parse
+ * @size: the size of the buffer
+ *
+ * For use with pevent_read_token(), this initializes the internal
+ * buffer that pevent_read_token() will parse.
+ */
+void pevent_buffer_init(const char *buf, unsigned long long size)
+{
+        init_input_buf(buf, size);
+}
+
 void breakpoint(void)
 {
         static int x;
@@ -551,18 +564,6 @@ static struct event_format *alloc_event(void)
         return event;
 }
 
-enum event_type {
-        EVENT_ERROR,
-        EVENT_NONE,
-        EVENT_SPACE,
-        EVENT_NEWLINE,
-        EVENT_OP,
-        EVENT_DELIM,
-        EVENT_ITEM,
-        EVENT_DQUOTE,
-        EVENT_SQUOTE,
-};
-
 static void add_event(struct pevent *pevent, struct event_format *event)
 {
         int i;
@@ -914,6 +915,29 @@ static enum event_type read_token(char **tok)
         return EVENT_NONE;
 }
 
+/**
+ * pevent_read_token - access to utilites to use the pevent parser
+ * @tok: The token to return
+ *
+ * This will parse tokens from the string given by
+ * pevent_init_data().
+ *
+ * Returns the token type.
+ */
+enum event_type pevent_read_token(char **tok)
+{
+        return read_token(tok);
+}
+
+/**
+ * pevent_free_token - free a token returned by pevent_read_token
+ * @token: the token to free
+ */
+void pevent_free_token(char *token)
+{
+        free_token(token);
+}
+
 /* no newline */
 static enum event_type read_token_item(char **tok)
 {
diff --git a/parse-events.h b/parse-events.h
index 879da4c..cc5af58 100644
--- a/parse-events.h
+++ b/parse-events.h
@@ -110,7 +110,7 @@ enum format_flags {
 
 struct format_field {
         struct format_field     *next;
-        struct event_format             *event;
+        struct event_format     *event;
         char                    *type;
         char                    *name;
         int                     offset;
@@ -240,6 +240,18 @@ enum event_sort_type {
         EVENT_SORT_SYSTEM,
 };
 
+enum event_type {
+        EVENT_ERROR,
+        EVENT_NONE,
+        EVENT_SPACE,
+        EVENT_NEWLINE,
+        EVENT_OP,
+        EVENT_DELIM,
+        EVENT_ITEM,
+        EVENT_DQUOTE,
+        EVENT_SQUOTE,
+};
+
 struct cmdline;
 struct cmdline_list;
 struct func_map;
@@ -469,9 +481,111 @@ void pevent_free(struct pevent *pevent);
 void pevent_ref(struct pevent *pevent);
 void pevent_unref(struct pevent *pevent);
 
+/* access to the internal parser */
+void pevent_buffer_init(const char *buf, unsigned long long size);
+enum event_type pevent_read_token(char **tok);
+void pevent_free_token(char *token);
+
 /* for debugging */
 void pevent_print_funcs(struct pevent *pevent);
 void pevent_print_printk(struct pevent *pevent);
 
+/* ----------------------- filtering ----------------------- */
+
+enum filter_boolean_type {
+        FILTER_FALSE,
+        FILTER_TRUE,
+};
+
+enum filter_op_type {
+        FILTER_OP_AND = 1,
+        FILTER_OP_OR,
+        FILTER_OP_NOT,
+};
+
+enum filter_cmp_type {
+        FILTER_CMP_NONE,
+        FILTER_CMP_EQ,
+        FILTER_CMP_NE,
+        FILTER_CMP_GT,
+        FILTER_CMP_LT,
+        FILTER_CMP_GE,
+        FILTER_CMP_LE,
+        FILTER_CMP_MATCH,
+        FILTER_CMP_NOT_MATCH,
+        FILTER_CMP_CONTAIN,
+        FILTER_CMP_NOT_CONTAIN,
+};
+
+enum filter_arg_type {
+        FILTER_ARG_NONE,
+        FILTER_ARG_BOOLEAN,
+        FILTER_ARG_OP,
+        FILTER_ARG_NUM,
+        FILTER_ARG_STR,
+};
+
+struct fliter_arg;
+
+struct filter_arg_boolean {
+        enum filter_boolean_type        value;
+};
+
+struct filter_arg_op {
+        enum filter_op_type     type;
+        struct filter_arg       *left;
+        struct filter_arg       *right;
+};
+
+struct filter_arg_num {
+        enum filter_cmp_type    type;
+        struct format_field     *field;
+        unsigned long long      val;
+};
+
+struct filter_arg_str {
+        enum filter_cmp_type    type;
+        struct format_field     *field;
+        char                    *val;
+};
+
+struct filter_arg {
+        enum filter_arg_type    type;
+        union {
+                struct filter_arg_boolean       bool;
+                struct filter_arg_op            op;
+                struct filter_arg_num           num;
+                struct filter_arg_str           str;
+        };
+};
+
+struct filter_type {
+        int                     event_id;
+        struct event_format     *event;
+        struct filter_arg       *filter;
+};
+
+struct event_filter {
+        struct pevent           *pevent;
+        int                     filters;
+        struct filter_type      *event_filters;
+};
+
+struct event_filter *pevent_filter_alloc(struct pevent *pevent);
+
+#define FILTER_NONE             -2
+#define FILTER_NOEXIST          -1
+#define FILTER_MISS             0
+#define FILTER_MATCH            1
+
+int pevent_filter_add_filter_str(struct event_filter *filter,
+                                 const char *filter_str,
+                                 char **error_str);
+
+
+int pevent_filter_match(struct event_filter *filter,
+                        struct record *record);
+
+void pevent_filter_free(struct event_filter *filter);
 
 #endif /* _PARSE_EVENTS_H */
diff --git a/parse-filter.c b/parse-filter.c
new file mode 100644
index 0000000..156b7e9
--- /dev/null
+++ b/parse-filter.c
@@ -0,0 +1,847 @@
+/*
+ * Copyright (C) 2010 Red Hat Inc, Steven Rostedt <srostedt@redhat.com>
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation;
+ * version 2.1 of the License (not later!)
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdarg.h>
+#include <ctype.h>
+#include <errno.h>
+
+#include "parse-events.h"
+
+struct event_list {
+        struct event_list       *next;
+        struct event_format     *event;
+};
+
+#define MAX_ERR_STR_SIZE 256
+
+static void show_error(char **error_str, const char *fmt, ...)
+{
+        va_list ap;
+
+        if (!error_str)
+                return;
+
+        *error_str = malloc_or_die(MAX_ERR_STR_SIZE);
+
+        va_start(ap, fmt);
+        vsnprintf(*error_str, MAX_ERR_STR_SIZE, fmt, ap);
+        va_end(ap);
+}
+
+static void free_token(char *token)
+{
+        pevent_free_token(token);
+}
+
+static enum event_type read_token(char **tok)
+{
+        enum event_type type;
+        char *token = NULL;
+
+        do {
+                free_token(token);
+                type = pevent_read_token(&token);
+        } while (type == EVENT_NEWLINE || type == EVENT_SPACE);
+
+        *tok = token;
+        return type;
+}
+
+static int filter_cmp(const void *a, const void *b)
+{
+        const struct filter_type *ea = a;
+        const struct filter_type *eb = b;
+
+        if (ea->event_id < eb->event_id)
+                return -1;
+
+        if (ea->event_id > eb->event_id)
+                return 1;
+
+        return 0;
+}
+
+static struct filter_type *
+find_filter_type(struct event_filter *filter, int id)
+{
+        struct filter_type *filter_type;
+        struct filter_type key;
+
+        key.event_id = id;
+
+        filter_type = bsearch(&key, filter->event_filters,
+                              filter->filters,
+                              sizeof(*filter->event_filters),
+                              filter_cmp);
+
+        return filter_type;
+}
+
+static struct filter_type *
+add_filter_type(struct event_filter *filter, int id)
+{
+        struct filter_type *filter_type;
+        int i;
+
+        filter_type = find_filter_type(filter, id);
+        if (filter_type)
+                return filter_type;
+
+        if (!filter->filters)
+                filter->event_filters =
+                        malloc_or_die(sizeof(*filter->event_filters));
+        else {
+                filter->event_filters =
+                        realloc(filter->event_filters,
+                                sizeof(*filter->event_filters) *
+                                (filter->filters + 1));
+                if (!filter->event_filters)
+                        die("Could not allocate filter");
+        }
+
+        for (i = 0; i < filter->filters; i++) {
+                if (filter->event_filters[i].event_id > id)
+                        break;
+        }
+
+        if (i < filter->filters)
+                memmove(&filter->event_filters[i+1],
+                        &filter->event_filters[i],
+                        sizeof(*filter->event_filters) *
+                        (filter->filters - i));
+
+        filter_type = &filter->event_filters[i];
+        filter_type->event_id = id;
+        filter_type->event = pevent_find_event(filter->pevent, id);
+        filter_type->filter = NULL;
+
+        filter->filters++;
+
+        return filter_type;
+}
+
+/**
+ * pevent_filter_alloc - create a new event filter
+ * @pevent: The pevent that this filter is associated with
+ */
+struct event_filter *pevent_filter_alloc(struct pevent *pevent)
+{
+        struct event_filter *filter;
+
+        filter = malloc_or_die(sizeof(*filter));
+        memset(filter, 0, sizeof(*filter));
+        filter->pevent = pevent;
+        pevent_ref(pevent);
+
+        return filter;
+}
+
+static struct filter_arg *allocate_arg(void)
+{
+        struct filter_arg *arg;
+
+        arg = malloc_or_die(sizeof(*arg));
+        memset(arg, 0, sizeof(*arg));
+
+        return arg;
+}
+
+static void free_arg(struct filter_arg *arg)
+{
+        if (!arg)
+                return;
+
+        switch (arg->type) {
+        case FILTER_ARG_NONE:
+        case FILTER_ARG_BOOLEAN:
+        case FILTER_ARG_NUM:
+                break;
+
+        case FILTER_ARG_STR:
+                free(arg->str.val);
+                break;
+
+        case FILTER_ARG_OP:
+                free_arg(arg->op.left);
+                free_arg(arg->op.right);
+        default:
+                break;
+        }
+
+        free(arg);
+}
+
+static int
+find_event(struct pevent *pevent, struct event_list **events,
+           char *sys_name, char *event_name)
+{
+        struct event_format *event;
+        struct event_list *list;
+
+        event = pevent_find_event_by_name(pevent, sys_name, event_name);
+        if (!event)
+                return -1;
+
+        list = malloc_or_die(sizeof(*list));
+        list->next = *events;
+        *events = list;
+        list->event = event;
+
+        return 0;
+}
+
+static void free_events(struct event_list *events)
+{
+        struct event_list *event;
+
+        while (events) {
+                event = events;
+                events = events->next;
+                free(event);
+        }
+}
+
+static int process_valid_field(struct filter_arg *arg,
+                               struct format_field *field,
+                               enum filter_cmp_type op_type,
+                               enum event_type type,
+                               char *val,
+                               char **error_str)
+{
+        switch (type) {
+
+        case EVENT_SQUOTE:
+                /* treat this as a character if string is of length 1? */
+                if (strlen(val) == 1)
+                        goto as_int;
+                /* fall through */
+
+        case EVENT_DQUOTE:
+                /* right now only allow match */
+                switch (op_type) {
+                case FILTER_CMP_EQ:
+                        op_type = FILTER_CMP_MATCH;
+                        break;
+                case FILTER_CMP_NE:
+                        op_type = FILTER_CMP_NOT_MATCH;
+                        break;
+
+                default:
+                        show_error(error_str,
+                                   "Op not allowed with string");
+                        return -1;
+                }
+                arg->type = FILTER_ARG_STR;
+                arg->str.field = field;
+                arg->str.type = op_type;
+                arg->str.val = strdup(val);
+                if (!arg->str.val)
+                        die("Can't allocate arg value");
+                break;
+        case EVENT_ITEM:
+ as_int:
+                arg->type = FILTER_ARG_NUM;
+                arg->num.field = field;
+                arg->num.type = op_type;
+                arg->num.val = strtoll(val, NULL, 0);
+                break;
+
+        default:
+                /* Can't happen */
+                return -1;
+        }
+
+        return 0;
+}
+
+static enum event_type
+process_filter(struct event_format *event, struct filter_arg **parg,
+               char **tok, char **error_str, int cont);
+
+static enum event_type
+process_paren(struct event_format *event, struct filter_arg **parg,
+              char **tok, char **error_str, int cont);
+
+static enum event_type
+process_not(struct event_format *event, struct filter_arg **parg,
+            char **tok, char **error_str, int cont);
+
+static enum event_type
+process_token(struct event_format *event, struct filter_arg **parg,
+              char **tok, char **error_str, int cont)
+{
+        enum event_type type;
+        char *token;
+
+        *tok = NULL;
+        *parg = NULL;
+
+        type = read_token(&token);
+
+        if (type == EVENT_ITEM) {
+                type = process_filter(event, parg, &token, error_str, cont);
+
+        } else if (type == EVENT_DELIM && strcmp(token, "(") == 0) {
+                free_token(token);
+                type = process_paren(event, parg, &token, error_str, cont);
+
+        } else if (type == EVENT_OP && strcmp(token, "!") == 0) {
+                type = process_not(event, parg, &token, error_str, cont);
+        }
+
+        if (type == EVENT_ERROR) {
+                free_token(token);
+                free_arg(*parg);
+                *parg = NULL;
+                return EVENT_ERROR;
+        }
+
+        *tok = token;
+        return type;
+}
+
+static enum event_type
+process_op(struct event_format *event, struct filter_arg *larg,
+           struct filter_arg **parg, char **tok, char **error_str)
+{
+        enum event_type type;
+        struct filter_arg *arg;
+
+        arg = allocate_arg();
+        arg->type = FILTER_ARG_OP;
+        arg->op.left = larg;
+
+        /* Can only be called with '&&' or '||' */
+        arg->op.type = strcmp(*tok, "&&") == 0 ?
+                FILTER_OP_AND : FILTER_OP_OR;
+
+        free_token(*tok);
+
+        type = process_token(event, &arg->op.right, tok, error_str, 1);
+        if (type == EVENT_ERROR)
+                free_arg(arg);
+
+        *parg = arg;
+
+        return type;
+}
+
+static enum event_type
+process_filter(struct event_format *event, struct filter_arg **parg,
+               char **tok, char **error_str, int cont)
+{
+        struct format_field *field;
+        enum filter_cmp_type etype;
+        struct filter_arg *arg;
+        enum event_type type;
+        char *field_name;
+        char *token;
+        char *op;
+        int ret;
+
+        *parg = NULL;
+
+        field_name = *tok;
+        *tok = NULL;
+
+        type = read_token(&token);
+        if (type != EVENT_OP) {
+                if (type == EVENT_NONE)
+                        show_error(error_str,
+                                   "Expected OP but found end of filter after %s",
+                                   field_name);
+                else
+                        show_error(error_str,
+                                   "Expected OP but found %s after %s",
+                                   token, field_name);
+                free_token(field_name);
+                free_token(token);
+                return EVENT_ERROR;
+        }
+
+        if (strcmp(token, "==") == 0) {
+                etype = FILTER_CMP_EQ;
+        } else if (strcmp(token, "!=") == 0) {
+                etype = FILTER_CMP_NE;
+        } else if (strcmp(token, "<") == 0) {
+                etype = FILTER_CMP_LT;
+        } else if (strcmp(token, ">") == 0) {
+                etype = FILTER_CMP_GT;
+        } else if (strcmp(token, "<=") == 0) {
+                etype = FILTER_CMP_LE;
+        } else if (strcmp(token, ">=") == 0) {
+                etype = FILTER_CMP_GE;
+        } else {
+                show_error(error_str,
+                           "Unknown op '%s' after '%s'",
+                           token, field_name);
+                free_token(field_name);
+                free_token(token);
+                return EVENT_ERROR;
+        }
+        op = token;
+
+        type = read_token(&token);
+        if (type != EVENT_ITEM && type != EVENT_SQUOTE && type != EVENT_DQUOTE) {
+                show_error(error_str,
+                           "Expected an item after '%s %s' instead of %s",
+                           field_name, op, token);
+                free_token(field_name);
+                free_token(op);
+                free_token(token);
+                return EVENT_ERROR;
+        }
+        free_token(op);
+
+        field = pevent_find_field(event, field_name);
+        free_token(field_name);
+
+        arg = allocate_arg();
+
+        if (field) {
+                ret = process_valid_field(arg, field, etype, type, token, error_str);
+                if (ret < 0) {
+                        free_arg(arg);
+                        return EVENT_ERROR;
+                }
+        } else {
+                /*
+                 * When an event does not contain a field in the
+                 * filter, just make it false.
+                 */
+                arg->type = FILTER_ARG_BOOLEAN;
+                arg->bool.value = FILTER_FALSE;
+        }
+
+        free_token(token);
+
+        type = read_token(tok);
+
+        if (cont && type == EVENT_OP &&
+            (strcmp(*tok, "&&") == 0 || strcmp(*tok, "||") == 0)) {
+                /* continue */;
+                type = process_op(event, arg, parg, tok, error_str);
+        } else
+                *parg = arg;
+
+        return type;
+}
+
+static enum event_type
+process_paren(struct event_format *event, struct filter_arg **parg,
+              char **tok, char **error_str, int cont)
+{
+        struct filter_arg *arg;
+        enum event_type type;
+
+        *parg = NULL;
+
+        type = process_token(event, &arg, tok, error_str, 1);
+        if (type == EVENT_ERROR) {
+                free_arg(arg);
+                return type;
+        }
+        if (type != EVENT_DELIM || strcmp(*tok, ")") != 0) {
+                if (*tok)
+                        show_error(error_str,
+                                   "Expected ')' but found %s", *tok);
+                else
+                        show_error(error_str,
+                                   "Unexpected end of filter; Expected ')'");
+                free_token(*tok);
+                *tok = NULL;
+                free_arg(arg);
+                return EVENT_ERROR;
+        }
+        free_token(*tok);
+
+        type = read_token(tok);
+
+        if (cont && type == EVENT_OP &&
+            (strcmp(*tok, "&&") == 0 || strcmp(*tok, "||") == 0)) {
+                /* continue */;
+                type = process_op(event, arg, parg, tok, error_str);
+        } else
+                *parg = arg;
+
+        return type;
+}
+
+static enum event_type
+process_not(struct event_format *event, struct filter_arg **parg,
+            char **tok, char **error_str, int cont)
+{
+        struct filter_arg *arg;
+        enum event_type type;
+
+        arg = allocate_arg();
+        arg->type = FILTER_ARG_OP;
+        arg->op.type = FILTER_OP_NOT;
+
+        arg->op.left = NULL;
+        type = process_token(event, &arg->op.right, tok, error_str, 0);
+        if (type == EVENT_ERROR) {
+                free_arg(arg);
+                *parg = NULL;
+                free_token(*tok);
+                *tok = NULL;
+                return EVENT_ERROR;
+        }
+
+        if (cont && type == EVENT_OP &&
+            (strcmp(*tok, "&&") == 0 || strcmp(*tok, "||") == 0)) {
+                /* continue */;
+                type = process_op(event, arg, parg, tok, error_str);
+        } else
+                *parg = arg;
+
+        return type;
+}
+
+static int filter_event(struct event_filter *filter,
+                        struct event_format *event,
+                        const char *filter_str, char **error_str)
+{
+        struct filter_type *filter_type;
+        enum event_type type;
+        struct filter_arg *arg;
+        char *token;
+
+        pevent_buffer_init(filter_str, strlen(filter_str));
+
+        type = process_token(event, &arg, &token, error_str, 1);
+
+        if (type == EVENT_ERROR)
+                return -1;
+
+        if (type != EVENT_NONE) {
+                show_error(error_str,
+                           "Expected end where %s was found",
+                           token);
+                free_token(token);
+                free_arg(arg);
+                return -1;
+        }
+
+        filter_type = add_filter_type(filter, event->id);
+        if (filter_type->filter)
+                free_arg(filter_type->filter);
+        filter_type->filter = arg;
+
+        return 0;
+}
+
+/**
+ * pevent_filter_add_filter_str - add a new filter
+ * @filter: the event filter to add to
+ * @filter_str: the filter string that contains the filter
+ * @error_str: string containing reason for failed filter
+ *
+ * Returns 0 if the filter was successfully added
+ *   -1 if there was an error.
+ *
+ * On error, if @error_str points to a string pointer,
+ * it is set to the reason that the filter failed.
+ * This string must be freed with "free".
+ */
+int pevent_filter_add_filter_str(struct event_filter *filter,
+                                 const char *filter_str,
+                                 char **error_str)
+{
+        struct pevent *pevent = filter->pevent;
+        struct event_list *event;
+        struct event_list *events = NULL;
+        enum event_type type;
+        const char *filter_start;
+        char *event_name = NULL;
+        char *sys_name = NULL;
+        char *token;
+        int rtn = 0;
+        int ret;
+
+        if (error_str)
+                *error_str = NULL;
+
+        filter_start = strchr(filter_str, ':');
+        if (!filter_start) {
+                show_error(error_str, "No filter found");
+                return -1;
+        }
+
+        pevent_buffer_init(filter_str, filter_start - filter_str);
+
+ again:
+        type = read_token(&token);
+        if (type != EVENT_ITEM) {
+                show_error(error_str, "Expected an event name but got %s",
+                           token);
+                free_token(token);
+                return -1;
+        }
+
+        sys_name = token;
+        type = read_token(&token);
+        if (type == EVENT_OP && strcmp(token, ".") == 0) {
+                /* this is of "system.event" format */
+                free_token(token);
+                type = read_token(&token);
+                if (type != EVENT_ITEM) {
+                        if (token)
+                                show_error(error_str,
+                                           "Expected an event after '%s.' and before %s",
+                                           sys_name, token);
+                        else
+                                show_error(error_str,
+                                           "Expected an event after '%s.'",
+                                           sys_name);
+                        goto out_err;
+                }
+                event_name = token;
+                type = read_token(&token);
+        } else
+                event_name = NULL;
+
+        /* Find this event */
+        ret = find_event(pevent, &events, sys_name, event_name);
+        if (ret < 0) {
+                if (event_name)
+                        show_error(error_str,
+                                   "No event found under '%s.%s'",
+                                   sys_name, event_name);
+                else
+                        show_error(error_str,
+                                   "No event found under '%s'",
+                                   sys_name);
+                goto out_err;
+        }
+
+        free_token(sys_name);
+        free_token(event_name);
+        sys_name = NULL;
+        event_name = NULL;
+
+        if (type == EVENT_DELIM && strcmp(token, ",")) {
+                /* This filter is for more than one event */
+                free_token(token);
+                goto again;
+        }
+
+        /* this should be the end of parsing events */
+        if (type != EVENT_NONE) {
+                free_events(events);
+                show_error(error_str,
+                           "expected ':' after %s", token);
+                free_token(token);
+                return -1;
+        }
+
+        /* filter starts here */
+        for (event = events; event; event = event->next) {
+                ret = filter_event(filter, event->event, filter_start + 1,
+                                   error_str);
+                /* Failures are returned if a parse error happened */
+                if (ret < 0)
+                        rtn = ret;
+        }
+
+        free_events(events);
+
+        return rtn;
+
+ out_err:
+        free_token(event_name);
+        free_token(sys_name);
+        free_token(token);
+        free_events(events);
+        return -1;
+}
+
+static void free_filter_type(struct filter_type *filter_type)
+{
+        free_arg(filter_type->filter);
+}
+
+void pevent_filter_free(struct event_filter *filter)
+{
+        int i;
+
+        pevent_unref(filter->pevent);
+
+        for (i = 0; i < filter->filters; i++)
+                free_filter_type(&filter->event_filters[i]);
+
+        free(filter);
+}
+
+static int test_filter(struct event_format *event,
+                       struct filter_arg *arg, struct record *record);
+
+static unsigned long long
+get_value(struct format_field *field, struct record *record)
+{
+        unsigned long long val;
+
+        pevent_read_number_field(field, record->data, &val);
+
+        if (!(field->flags & FIELD_IS_SIGNED))
+                return val;
+
+        switch (field->size) {
+        case 1:
+                return (char)val;
+        case 2:
+                return (short)val;
+        case 4:
+                return (int)val;
+        case 8:
+                return (long long)val;
+        }
+        return val;
+}
+
+static int test_num(struct event_format *event,
+                    struct filter_arg *arg, struct record *record)
+{
+        unsigned long long val;
+
+        val = get_value(arg->num.field, record);
+
+        switch (arg->num.type) {
+        case FILTER_CMP_EQ:
+                return val == arg->num.val;
+
+        case FILTER_CMP_NE:
+                return val != arg->num.val;
+
+        case FILTER_CMP_GT:
+                return val > arg->num.val;
+
+        case FILTER_CMP_LT:
+                return val < arg->num.val;
+
+        case FILTER_CMP_GE:
+                return val >= arg->num.val;
+
+        case FILTER_CMP_LE:
+                return val <= arg->num.val;
+
+        default:
+                /* ?? */
+                return 0;
+        }
+}
+
+static int test_str(struct event_format *event,
+                    struct filter_arg *arg, struct record *record)
+{
+        const char *val = record->data + arg->str.field->offset;
+
+        switch (arg->str.type) {
+        case FILTER_CMP_MATCH:
+                return strncmp(val, arg->str.val, arg->str.field->size) == 0;
+
+        case FILTER_CMP_NOT_MATCH:
+                return strncmp(val, arg->str.val, arg->str.field->size) != 0;
+
+        default:
+                /* ?? */
+                return 0;
+        }
+}
+
+static int test_op(struct event_format *event,
+                   struct filter_arg *arg, struct record *record)
+{
+        switch (arg->op.type) {
+        case FILTER_OP_AND:
+                return test_filter(event, arg->op.left, record) &&
+                        test_filter(event, arg->op.right, record);
+
+        case FILTER_OP_OR:
+                return test_filter(event, arg->op.left, record) ||
+                        test_filter(event, arg->op.right, record);
+
+        case FILTER_OP_NOT:
+                return !test_filter(event, arg->op.right, record);
+
+        default:
+                /* ?? */
+                return 0;
+        }
+}
+
+static int test_filter(struct event_format *event,
+                       struct filter_arg *arg, struct record *record)
+{
+        switch (arg->type) {
+        case FILTER_ARG_BOOLEAN:
+                /* easy case */
+                return arg->bool.value;
+
+        case FILTER_ARG_OP:
+                return test_op(event, arg, record);
+
+        case FILTER_ARG_NUM:
+                return test_num(event, arg, record);
+
+        case FILTER_ARG_STR:
+                return test_str(event, arg, record);
+
+        default:
+                /* ?? */
+                return 0;
+        }
+}
+
+/**
+ * pevent_filter_match - test if a record matches a filter
+ * @filter: filter struct with filter information
+ * @record: the record to test against the filter
+ *
+ * Returns:
+ *  1 - filter found for event and @record matches
+ *  0 - filter found for event and @record does not match
+ * -1 - no filter found for @record's event
+ * -2 - if no filters exist
+ */
+int pevent_filter_match(struct event_filter *filter,
+                        struct record *record)
+{
+        struct pevent *pevent = filter->pevent;
+        struct filter_type *filter_type;
+        int event_id;
+
+        if (!filter->filters)
+                return FILTER_NONE;
+
+        event_id = pevent_data_type(pevent, record);
+
+        filter_type = find_filter_type(filter, event_id);
+
+        if (!filter_type)
+                return FILTER_NOEXIST;
+
+        return test_filter(filter_type->event, filter_type->filter, record) ?
+                FILTER_MATCH : FILTER_MISS;
+}
+
diff --git a/trace-cmd.c b/trace-cmd.c
index d866d8f..a50773e 100644
--- a/trace-cmd.c
+++ b/trace-cmd.c
@@ -1035,12 +1035,13 @@ void usage(char **argv)
                "          Disables the tracer (may reset trace file)\n"
                "          Used in conjunction with start\n"
                "\n"
-               " %s report [-i file] [--cpu cpu] [-e][-f][-l][-P][-E]\n"
+               " %s report [-i file] [--cpu cpu] [-e][-f][-l][-P][-E][-F filter]\n"
                "          -i input file [default trace.dat]\n"
                "          -e show file endianess\n"
                "          -f show function list\n"
                "          -P show printk list\n"
                "          -E show event files stored\n"
+               "          -F filter to filter output on\n"
                "          -l show latency format (default with latency tracers)\n"
                "\n"
                " %s split [options] -o file [start [end]]\n"
diff --git a/trace-read.c b/trace-read.c
index 8768f11..c05fc5d 100644
--- a/trace-read.c
+++ b/trace-read.c
@@ -38,6 +38,14 @@
 
 #include "trace-local.h"
 
+static struct filter {
+        struct filter           *next;
+        const char              *filter;
+} *filter_strings;
+static struct filter **filter_next = &filter_strings;
+
+static struct event_filter *event_filters;
+
 static unsigned int page_size;
 static int input_fd;
 const char *input_file = "trace.dat";
@@ -189,12 +197,58 @@ static void test_save(struct record *record, int cpu)
 }
 #endif
 
+static void add_filter(const char *filter)
+{
+        struct filter *ftr;
+
+        ftr = malloc_or_die(sizeof(*ftr));
+        ftr->filter = filter;
+        ftr->next = NULL;
+
+        /* must maintain order of command line */
+        *filter_next = ftr;
+        filter_next = &ftr->next;
+}
+
+static void process_filters(struct tracecmd_input *handle)
+{
+        struct pevent *pevent;
+        struct filter *filter;
+        char *errstr;
+        int ret;
+
+        pevent = tracecmd_get_pevent(handle);
+        event_filters = pevent_filter_alloc(pevent);
+
+        while (filter_strings) {
+                filter = filter_strings;
+                filter_strings = filter->next;
+                ret = pevent_filter_add_filter_str(event_filters,
+                                                   filter->filter,
+                                                   &errstr);
+                if (ret < 0)
+                        die("Error filtering: %s\n   %s",
+                            filter->filter, errstr);
+                free(errstr);
+                free(filter);
+        }
+}
+
+static int filter_record(struct tracecmd_input *handle,
+                         struct record *record)
+{
+        return 0;
+}
+
 static void show_data(struct tracecmd_input *handle,
                       struct record *record, int cpu)
 {
         struct pevent *pevent;
         struct trace_seq s;
 
+        if (filter_record(handle, record))
+                return;
+
         pevent = tracecmd_get_pevent(handle);
 
         test_save(record, cpu);
@@ -241,6 +295,8 @@ static void read_data_info(struct tracecmd_input *handle)
                 return;
         }
 
+        process_filters(handle);
+
         do {
                 next = -1;
                 ts = 0;
@@ -251,7 +307,13 @@ static void read_data_info(struct tracecmd_input *handle)
                         record = tracecmd_read_next_data(handle, &cpu);
 
                 if (record) {
-                        show_data(handle, record, next);
+                        ret = pevent_filter_match(event_filters, record);
+                        switch (ret) {
+                        case FILTER_NONE:
+                        case FILTER_MATCH:
+                                show_data(handle, record, next);
+                                break;
+                        }
                         free_record(record);
                 }
         } while (record);
@@ -296,7 +358,7 @@ void trace_report (int argc, char **argv)
                         {NULL, 0, NULL, 0}
                 };
 
-                c = getopt_long (argc-1, argv+1, "+hi:fepPlE",
+                c = getopt_long (argc-1, argv+1, "+hi:fepPlEF:",
                         long_options, &option_index);
                 if (c == -1)
                         break;
@@ -307,6 +369,9 @@ void trace_report (int argc, char **argv)
                 case 'i':
                         input_file = optarg;
                         break;
+                case 'F':
+                        add_filter(optarg);
+                        break;
                 case 'f':
                         show_funcs = 1;
                         break;