Changes

Summary

  1. tools: fix runqslower warning (details)
  2. Error in time comparison (details)
  3. sync to latest libbpf repo (details)
  4. Use device+inode to identify matching files; prepend /proc/pid/root to (details)
  5. Lazily symbolize regular ELF binaries (details)
  6. Lazify ProcSyms::find_name (details)
  7. Make bcc_elf_symbol_str support debuginfo (details)
  8. Thread through debugfile flag (details)
  9. Enter mount namespace before trying to open binary (details)
  10. Address code review (details)
  11. Add tests (details)
  12. Fix designated initializers (details)
  13. Rebase and remove mount guards (details)
  14. tools/inject: Update documentation (details)
  15. fix various compilation warnings (details)
  16. fix asm_volatile_goto issue again (details)
  17. Travis CI: Lint for Python syntax errors and undefined names (details)
  18. Identity is not the same thing as equality in Python (details)
  19. Add missing colon (:) (details)
  20. Force a retest (details)
  21. This retest should work (details)
  22. Undefined name: signal_ignore --> signal.SIG_IGN (details)
  23. Undefined name: Don't forget "self" in "self.b" (details)
  24. Undefined name: "headerInstance" --> "p4header" (details)
  25. Undefined name: "SocketConfig" -> "TargetConfig" (details)
  26. Undefined name: from compilationException import CompilationException (details)
  27. from __future__ import print_function (details)
  28. Old style exceptions --> new style for Python 3 (details)
  29. Old style exceptions --> new style for Python 3 (details)
  30. Use feature detection instead of version detection (details)
  31. long was removed in Python 3 (details)
  32. Remove allow_failures on python: 3.7 tests (details)
  33. Swap test order (details)
  34. Move language: generic (details)
  35. Try under language: python (details)
  36. Echo (details)
  37. Comment out the set -euo pipefail (details)
  38. Update .travis.yml (details)
  39. Upgrade from pep8 --> pycodestyle (details)
  40. Four parallel test runs (details)
  41. Update lua Quickstart for Ubuntu 18.04 LTS (details)
  42. Filter out non-bash COMMs (details)
  43. Use bpf_prog_load function from ljsyscall module in LuaJIT compiler (details)
  44. Report proper module on kernel backtrace (details)
  45. sync with latest libbpf (details)
  46. tools: fix printb usage in solisten (details)
  47. Turn on lazy symbolize by default (details)
  48. tools/tcpconnect: add option -c to count connects (details)
  49. sync to latest libbpf (details)
  50. CMake: Allow to disable building man pages (details)
  51. tools: fix vfscount output when no duration is specified (details)
  52. Support perf's symfs mechanism for debuginfo lookup. (details)
  53. man: fixes some man pages (details)
  54. offwaketime: Fix incorrect target and waker PIDs (details)
  55. Don't prepend /proc/PID/root to user-supplied USDT binary paths starting with /proc already (details)
  56. Update reference_guide.md (details)
  57. Update mysqld_query.py (details)
  58. Make number of stack traces configurable from command line in example… (#2500) (details)
  59. tcptop: Fix incorrect pid filter (details)
  60. Support for hardware offload (#2502) (details)
  61. support gcc 8's cold subfunctions (details)
  62. stackcount: fix TypeError (#2514) (details)
  63. Fixes #2518 -- weird behaviour of lookup_or_init (#2520) (details)
  64. FAQ: fix error message (details)
  65. INSTALL.md: add install instructions for Fedora 30+ (#2524) (details)
  66. Fix BPF_PERCPU_ARRAY description (#2527) (details)
  67. fix compilation errors with clang CreateFromArgs() change (#2528) (details)
  68. cmakefile change to require c++14 (#2529) (details)
  69. Fix a file descriptor leak when module is deleted (#2530) (details)
  70. FAQ: Add Q&A about kernel lockdown (#2532) (details)
  71. Add sampe code for cgoup test (#2522) (details)
  72. INSTALL.md: Fedora 30: note about kernel lockdown (#2536) (details)
  73. sync to latest libbpf (#2540) (details)
  74. debian changelog for v0.11.0 tag (#2541) (details)
  75. sync with latest libbpf repo (#2545) (details)
  76. Redefine asm_inline for Linux 5.4+, Fixes #2546 (#2547) (details)
  77. Fix Erroneous "gethostlatency" Comments (#2549) (details)
  78. Changed Link to HTTPS (#2551) (details)
  79. Mod: the 'min_us' is in us, mot ms (details)
  80. Mod: fix two errors in examples (details)
  81. man: add missing -c option to tcpretrans synopsis (details)
  82. Fix a typo, tracepint -> tracepoint (#2559) (details)
  83. document the release info related to libbpf submodule (#2561) (details)
  84. assign offset properly for btf DataSec (#2560) (details)
  85. support cgroup level tracing in trace.py (#2562) (details)
  86. man: COMM describes the process name, not the parent process name (#2563) (details)
  87. cpudist: create sufficiently large hash table to avoid missing tasks (details)
  88. fix compilation errors with latest llvm trunk (#2575) (details)
  89. sync with latest libbpf (#2576) (details)
  90. introduce map.lookup_or_try_init() (#2577) (details)
  91. remove the warning for map.lookup_or_init() (#2581) (details)
  92. fix typos in tutorial.md (#2584) (details)
  93. Support attaching uprobe to offset (#2585) (details)
  94. tools/tcpretrans: add tracepoint support (#2574) (details)
  95. Add libbcc-no-libbpf.so library (details)
  96. Link test_libbcc directly with libbcc.so (details)
  97. Add test_libbcc_no_libbpf test (details)
  98. Add a supplementary explanation to function `get_syscall_fnname` (#2593) (details)
  99. sync with latest libbpf (#2594) (details)
  100. add BPF::init_usdt function to init a single USDT so folks can handle partial init failure of list of USDTs. (details)
  101. add tool: compactsnoop (details)
  102. docs/reference_guide.md: update doc (details)
  103. docs: update XDP driver list (details)
  104. fix a bug in mountsnoop.py with 4.17+ kernels (details)
  105. Include stddef.h for size_t in bcc_elf.h (details)
  106. Add lockstat tool (details)
  107. make TRY2 macro work outside of ebpf namespace (#2604) (details)
  108. Make StatusTuple code and msg methods const (#2603) (details)
  109. update INSTALL.md for new llvm source compilation (details)
  110. tools/runqslower.py: Fix raw tracepoint code (details)
  111. docs: update helper functions of BPF_PROG_TYPE_SOCKET_FILTER (details)
  112. Add map-in-map support (details)
  113. Do not traverse attributes during JSON generation (Fixes #2605) (details)
  114. do not use BPF_F_REUSE_STACKID incorrectly (details)
  115. fix bug for lockstat.py #347 (#2618) (details)
  116. Support a BPF program larger than BPF_MAXINSNS (details)
  117. Use integer types for enums in JSON (Fixes #2615) (details)
  118. Use libbpf-static instead of libbpf-debugsource for CMAKE_USE_LIBBPF_PACKAGE (details)
  119. man: fix the field of filetop (details)
  120. man: fix the explanation of filename (details)
  121. Correction to Usage text. (details)
  122. man: fix a reference to runqlat in runqslower man page (details)
  123. rename tool lockstat.py to klockstat.py (details)
  124. remove inproper usage of BPF_F_REUSE_STACKID in examples (details)
  125. tools/trace.py: add process name filtering (details)
  126. tools/trace.py: add msg filter of event (details)
  127. fix a compilation error with latest llvm 10 (details)
  128. sync with latest libbpf (details)
  129. debian changelog for v0.12.0 tag (details)
  130. Fix s390 kprobes support (details)
  131. fix -h output for --sort option (details)
  132. Improve wording on how latency is measured (details)
  133. klockstat: fix caller filter (details)
  134. Remove kretprobe__ prefix from program names (details)
  135. tools: cgroup filtering in execsnoop/opensnoop (details)
  136. sync with latest libbpf (details)
  137. tools/trace.py: flush stdout for each event (details)
  138. change version.cmake to check all tags (details)
  139. man: fix required kernel version in man pages (details)
  140. fix libbpf_uapi path typo (details)
  141. Package static archives, closes #1938 (details)
  142. fix test_map_in_map.cc compilation error (details)
  143. sanitize btf VAR and DATASEC types (details)
  144. tools/runqslower.py: Option for --pid or --tid (#2635) (details)
  145. support BPF_MAP_TYPE_SK_STORAGE map (details)
  146. tools/offcputime.py: Redundatn arg check (details)
  147. Links to 3 articles on Linux tracing using bcc (details)
  148. rewriter: Fix tracking of pointers with several indirections (details)
  149. Add Ubuntu Eon incompatibility note (details)
  150. Ubuntu Eon build dependencies and version numbers (details)
  151. avoid complex expression in struct member initializer (details)
  152. Fix a bunch of typos (#2693) (details)
  153. update usage of MCInstPrinter printInst() for llvm10 (#2696) (details)
  154. docs: add BPF trampoline to the kernel features (details)
  155. Secure Boot:  physical keypress to disable lockdown (details)
  156. sanitize BTF_KIND_FUNC (details)
  157. sync with latest libbpf repo (details)
  158. Fix CentOS 6 support. (details)
  159. bpflist: list only real bpf objects (details)
  160. bpflist: use smarter print format (details)
  161. fix llvm compilation error (details)
  162. docs: Remove a redundant space (details)
  163. sync with latest libbpf repo (details)
  164. Remove  from list of AUR packages (details)
  165. Initial support for using github actions (details)
  166. Debug with tmate (details)
Commit bac633a6bb60b6b8542348ea3f61c367eae14f7c by jmarchan
tools: fix runqslower warning

The state member of task_struct is volatile and it's use as the last
parameter of bpf_probe_read (const void *) triggers the following
clang warning (LLVM 8):

/virtual/main.c:56:42: warning: passing 'volatile long *' to parameter of type 'const void *' discards qualifiers [-Wincompatible-pointer-types-discards-qualifiers]
    bpf_probe_read(&state, sizeof(long), &prev->state);
                                         ^~~~~~~~~~~~
1 warning generated.
Tracing run queue latency higher than 10000 us
TIME     COMM             PID           LAT(us)

An explicit cast fixes the warning.
The file was modifiedtools/runqslower.py (diff)
Commit f84acf9e5cbbea3f60f06a29dd189530e5052a47 by yonghong-song
Error in time comparison

Datetime comparisons requires the use of timedelta.
The file was modifiedtools/btrfsslower.py (diff)
Commit 06e30cca8342aed6a1cd83de65d17945499ab6bb by yonghong-song
sync to latest libbpf repo

sync with latest libbpf repo

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedsrc/cc/libbpf (diff)
The file was modifiedintrospection/bps.c (diff)
The file was modifiedsrc/cc/compat/linux/virtual_bpf.h (diff)
Commit 01ee0b61a854e06cb62272ddfbb4eeaf16e9ad7c by yonghong-song
Use device+inode to identify matching files; prepend /proc/pid/root to
paths for usdt.
The file was modifiedsrc/cc/bcc_elf.c (diff)
The file was modifiedsrc/cc/bcc_syms.cc (diff)
The file was removedsrc/cc/ns_guard.h
The file was modifiedsrc/cc/api/BPF.h (diff)
The file was modifiedtests/cc/test_c_api.cc (diff)
The file was modifiedsrc/cc/bcc_syms.h (diff)
The file was modifiedtests/cc/CMakeLists.txt (diff)
The file was modifiedsrc/cc/syms.h (diff)
The file was modifiedsrc/cc/usdt.h (diff)
The file was modifiedsrc/cc/usdt/usdt.cc (diff)
The file was addedtests/cc/usdt_test_lib.c
The file was modifiedtests/cc/test_usdt_probes.cc (diff)
The file was modifiedsrc/cc/libbpf.c (diff)
The file was modifiedsrc/cc/CMakeLists.txt (diff)
The file was removedsrc/cc/ns_guard.cc
The file was modifiedexamples/cpp/pyperf/PyPerfUtil.cc (diff)
The file was modifiedsrc/cc/api/BPF.cc (diff)
The file was addedtests/cc/dummy_proc_map.txt
The file was modifiedsrc/cc/bcc_proc.c (diff)
The file was modifiedsrc/cc/bcc_proc.h (diff)
Commit d42fcc8eabfe2197cb2aba67113e839240d4b9a5 by yonghong-song
Lazily symbolize regular ELF binaries

This patch adds a new API to bcc_elf.h, bcc_elf_foreach_sym_lazy. This
helper avoids storing symbol names in string format, as for large
binaries this data can get quite large.

Instead we store the location in the ELF binary where we can later find
the string. Later on, we can load these strings on demand and cache them
in case they're accessed again.

This patch also makes lazy resolution the default for regular ELF
binaries, where regular means not perfmap or VDSO.
The file was modifiedsrc/cc/bcc_elf.h (diff)
The file was modifiedsrc/cc/bcc_elf.c (diff)
The file was modifiedsrc/cc/syms.h (diff)
The file was modifiedsrc/cc/bcc_syms.cc (diff)
Commit 24496c7760f0fb6f7a0510b8087f7d4a1ad79d9c by yonghong-song
Lazify ProcSyms::find_name

It's pretty much strictly better to walk all the symbol names on demand
to find a symbol rather than storing it all in memory beforehand.
The file was modifiedsrc/cc/bcc_syms.cc (diff)
Commit 0ca7917cdea01421b5c7f54e399ddb511e664f4e by yonghong-song
Make bcc_elf_symbol_str support debuginfo
The file was modifiedsrc/cc/bcc_elf.c (diff)
Commit 1772fd163c04436871c2439e48d57b7308c589d5 by yonghong-song
Thread through debugfile flag

So we don't have to guess and check when reading symbols. Sometimes if
the elf sections are laid out just right you can "guess" the wrong
string.
The file was modifiedsrc/cc/bcc_syms.cc (diff)
The file was modifiedsrc/cc/bcc_elf.c (diff)
The file was modifiedsrc/cc/syms.h (diff)
The file was modifiedsrc/cc/bcc_elf.h (diff)
Commit 6f693f59a178b9e7286bc05568ffdb396fedbb52 by yonghong-song
Enter mount namespace before trying to open binary
The file was modifiedsrc/cc/bcc_syms.cc (diff)
The file was modifiedsrc/cc/syms.h (diff)
The file was modifiedsrc/cc/bcc_syms.cc (diff)
The file was modifiedsrc/cc/bcc_elf.c (diff)
The file was modifiedsrc/cc/bcc_syms.h (diff)
The file was modifiedtests/cc/test_c_api.cc (diff)
Commit d413c95ce4476b18a179c541795a1248491a9584 by yonghong-song
Fix designated initializers
The file was modifiedsrc/cc/api/BPFTable.cc (diff)
The file was modifiedsrc/lua/bcc/libbcc.lua (diff)
The file was modifiedsrc/cc/bcc_syms.cc (diff)
The file was modifiedsrc/cc/usdt/usdt_args.cc (diff)
The file was modifiedexamples/cpp/pyperf/PyPerfUtil.cc (diff)
Commit 86633c44c9b1c0f6be21fc17658c3bd23da3d2c5 by yonghong-song
Rebase and remove mount guards
The file was modifiedsrc/cc/bcc_syms.cc (diff)
Commit 5933839d154dc8efa02cd567ce93f36eb2a9cb71 by yonghong-song
tools/inject: Update documentation
The file was modifiedman/man8/inject.8 (diff)
The file was modifiedtools/inject_example.txt (diff)
Commit 10dae9eac33287c1df9e6645933b608c2d2c5640 by yonghong-song
fix various compilation warnings

The following compilation warnings are fix:
...
/home/yhs/work/bcc/src/cc/libbpf.c:548:12: warning: comparison of distinct pointer types ('typeof (name_len - name_offset) *' (aka 'unsigned long *')
      and 'typeof (16U - 1) *' (aka 'unsigned int *')) [-Wcompare-distinct-pointer-types]
           min(name_len - name_offset, BPF_OBJ_NAME_LEN - 1));
           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/yhs/work/bcc/src/cc/libbpf/include/linux/kernel.h:28:17: note: expanded from macro 'min'
        (void) (&_min1 == &_min2);
...
/home/yhs/work/bcc/src/cc/bcc_syms.h:71:34: warning: declaration of 'struct mod_info' will not be visible outside of this function [-Wvisibility]
int _bcc_syms_find_module(struct mod_info *info, int enter_ns, void *p);
...
/home/yhs/work/bcc/src/cc/usdt/usdt.cc:486:14: warning: unused variable 'pid' [-Wunused-variable]
        auto pid = ctx->pid();
             ^
...

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedsrc/cc/libbpf.c (diff)
The file was modifiedsrc/cc/bcc_syms.h (diff)
The file was modifiedsrc/cc/usdt/usdt.cc (diff)
Commit a74c0429396f3180ba5b20f4a4eefc233b681cb4 by yonghong-song
fix asm_volatile_goto issue again

In src/cc/export/helpers.h, we tried to
define asm_volatile_goto to something else
if it is defined through uapi bpf.h.
  #ifdef asm_volatile_goto
  #undef asm_volatile_goto
  #define asm_volatile_goto(x...) asm volatile("invalid use of asm_volatile_goto")
  #endif

It is possible that due to different kernel configurations,
asm_volatile_goto may not be defined after uapi bpf.h.
To prevent compilation errors, let us unconditionally
define asm_volatile_goto here.

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedsrc/cc/export/helpers.h (diff)
Commit 60944a486a619556b64b7d385fe67e7be9d32fdf by yonghong-song
Travis CI: Lint for Python syntax errors and undefined names
The file was modified.travis.yml (diff)
Commit f84e55c51acb3e063b62ddcd39738ef8fa1b56e0 by yonghong-song
Identity is not the same thing as equality in Python
The file was modifiedsrc/python/bcc/table.py (diff)
The file was modified.travis.yml (diff)
The file was modified.travis.yml (diff)
The file was modified.travis.yml (diff)
Commit fae282cba4f98138e31ad650d5bd149fbfc10414 by yonghong-song
Undefined name: signal_ignore --> signal.SIG_IGN
The file was modifiedexamples/tracing/stack_buildid_example.py (diff)
Commit 37ac181e56fefe02ccc500d3512dda0a7536bbdd by yonghong-song
Undefined name: Don't forget "self" in "self.b"
The file was modifiedtests/python/test_probe_count.py (diff)
Commit 64ea990fef6a9a290c2aaa34386906b2335bf51e by yonghong-song
Undefined name: "headerInstance" --> "p4header"
The file was modifiedsrc/cc/frontends/p4/compiler/ebpfDeparser.py (diff)
Commit 887ff829e6add0e25944d9fb1c8716a1c1aabbdf by yonghong-song
Undefined name: "SocketConfig" -> "TargetConfig"
The file was modifiedsrc/cc/frontends/p4/compiler/target.py (diff)
Commit 317fe14378a3bd9836be6ef5618595dc4dd0f19a by yonghong-song
Undefined name: from compilationException import CompilationException
The file was modifiedsrc/cc/frontends/p4/compiler/ebpfDeparser.py (diff)
Commit e52c41fecbcd0e750e08c494c35aa4fc4bc2c145 by yonghong-song
from __future__ import print_function
The file was modifiedsrc/cc/frontends/p4/test/endToEndTest.py (diff)
Commit 3e69639a89134575abda3696b41f6ac0d5e4887e by yonghong-song
Old style exceptions --> new style for Python 3
The file was modifiedsrc/cc/frontends/p4/compiler/p4toEbpf.py (diff)
Commit bfdb8171e91b0fdd583d42cc3b2788529af8383c by yonghong-song
Old style exceptions --> new style for Python 3
The file was modifiedsrc/cc/frontends/p4/compiler/ebpfStructType.py (diff)
Commit 2a2661c6a7fdc0ac72e7674ef108efb88cbff847 by yonghong-song
Use feature detection instead of version detection

https://docs.python.org/3/howto/pyporting.html#use-feature-detection-instead-of-version-detection
The file was modifiedsrc/python/bcc/__init__.py (diff)
Commit d2cd9d0a1be162ac3cfe28066e5c398ef296d3d4 by yonghong-song
long was removed in Python 3
The file was modifiedtests/python/test_lru.py (diff)
Commit 5c2b514227fe212c72afd8d6f5f584bd8658bc01 by yonghong-song
Remove allow_failures on python: 3.7 tests
The file was modified.travis.yml (diff)
The file was modified.travis.yml (diff)
The file was modified.travis.yml (diff)
Commit 6034b818a6f0d1d65292b9e6a146574ee55d83d4 by yonghong-song
Try under language: python
The file was modified.travis.yml (diff)
The file was modified.travis.yml (diff)
Commit f1c7b8effb7f805c032515657fe5426654930ac4 by yonghong-song
Comment out the set -euo pipefail
The file was modified.travis.yml (diff)
The file was modified.travis.yml (diff)
Commit 45fd2f727864c6690def73046ce4e102d77ca6e1 by yonghong-song
Upgrade from pep8 --> pycodestyle
The file was modifiedscripts/py-style-check.sh (diff)
The file was modified.travis.yml (diff)
Commit fb99f2fdc033be84ec0921d9ddd38058a7ecf83b by yonghong-song
Update lua Quickstart for Ubuntu 18.04 LTS
The file was modifiedsrc/lua/README.md (diff)
Commit 4995db078b7c7f25a38c6bf5e628221e97709759 by yonghong-song
Filter out non-bash COMMs

Prevents the output of non-bash readlines when bash is dynamically
linked. Refs #1851.
The file was modifiedtools/bashreadline.py (diff)
Commit 36219753ee17fc0af37c20828eef02520e1602dc by yonghong-song
Use bpf_prog_load function from ljsyscall module in LuaJIT compiler

At various points in the compiler code, an attempt to load the BPF
program is made. In order to do this, a bpf() syscall needs to happen
with BPF_PROG_LOAD as the first argument (Consult the bpf man page,
under the 'eBPF programs' section). The module ljsyscall does
this via the bpf_prog_load function.

At the time of writing, this function is declared in the file:

syscall/linux/syscalls.lua

In the repo:

https://github.com/justincormack/ljsyscall.git
The file was modifiedsrc/lua/bpf/bpf.lua (diff)
Commit 50aeaed4d101f22027eaf07186418ec8dcbab019 by yonghong-song
Report proper module on kernel backtrace

Raghavendra Rao reported that memleak does not display
proper name of the related kernel module, but just the
"kernel" string, like here for xfs module functions:

  131072 bytes in 4 allocations from stack
          ..
          bvec_alloc+0x92 [kernel]
          bio_alloc_bioset+0x13f [kernel]
          xfs_add_to_ioend+0x2df [kernel]
          xfs_do_writepage+0x148 [kernel]
          write_cache_pages+0x171 [kernel]
          xfs_vm_writepages+0x59 [kernel]
          do_writepages+0x43 [kernel]
          ...

The kernel resolver code is parsing /proc/kallsyms, which
already has the module information in.

This patch is adding support to parse the module info
from /proc/kallsyms and initialize the module with
proper value.

Above memleak backtrace now looks like:

  131072 bytes in 4 allocations from stack

          bvec_alloc+0x92 [kernel]
          bio_alloc_bioset+0x13f [kernel]
          xfs_add_to_ioend+0x2df [xfs]
          xfs_do_writepage+0x148 [xfs]
          write_cache_pages+0x171 [kernel]
          xfs_vm_writepages+0x59 [xfs]
          do_writepages+0x43 [kernel]
          ...

Reported-by: Raghavendra Rao <ragrao@redhat.com>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
The file was modifiedtests/cc/test_c_api.cc (diff)
The file was modifiedsrc/cc/bcc_proc.c (diff)
The file was modifiedsrc/cc/bcc_proc.h (diff)
The file was modifiedsrc/cc/bcc_syms.cc (diff)
The file was modifiedsrc/cc/syms.h (diff)
Commit 1a47a9a5085188398dd5a03f5d3c438c1ddb0af5 by yonghong-song
sync with latest libbpf

sync with latest libbpf (v0.0.4 tag)

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedsrc/cc/libbpf (diff)
Commit 6af649a9a1939b9bbda7f410dd115c06f89dcf14 by yonghong-song
tools: fix printb usage in solisten

Since its conversion to printb, solisten has suffers from yet another python2/3 bytes/str issue:

Traceback (most recent call last):
  File "_ctypes/callbacks.c", line 234, in 'calling callback function'
  File "/usr/lib/python3.6/site-packages/bcc/table.py", line 581, in raw_cb_
    callback(cpu, data, size)
  File "/usr/share/bcc/tools/solisten", line 176, in print_event
    event.lport, address,
TypeError: %b requires a bytes-like object, or an object that implements __bytes__, not 'str'

This patch fix the issue on python3. The tools still works on python2.
The file was modifiedtools/solisten.py (diff)
Commit 237a4b46567c75834476beadfb76b7c5d5b97877 by yonghong-song
Turn on lazy symbolize by default

This turns on lazy symbolization by default. Symbol names will be
resolved the first time they're requested and then cached for future
access. This can reduce bcc memory usage by quite a bit in certain
workloads.
The file was modifiedsrc/cc/api/BPFTable.cc (diff)
The file was modifiedexamples/cpp/pyperf/PyPerfUtil.cc (diff)
The file was modifiedsrc/cc/usdt/usdt_args.cc (diff)
The file was modifiedsrc/cc/bcc_syms.cc (diff)
Commit 9518a5b74105a16f5c3ad3d7e0f717b153965f6e by yonghong-song
tools/tcpconnect: add option -c to count connects

Add -c to count all active connections per dest ip/port so we can
easily spot the heavy outbound connection attempts.

    # ./tcpconnect.py -c
    Tracing connect ... Hit Ctrl-C to end
    ^C
    LADDR                 RADDR                    RPORT              CONNECTS
    192.168.10.50         172.217.21.194           443                70
    192.168.10.50         172.213.11.195           443                34
    192.168.10.50         172.212.22.194           443                21
    [...]
The file was modifiedman/man8/tcpconnect.8 (diff)
The file was modifiedtools/tcpconnect_example.txt (diff)
The file was modifiedtools/tcpconnect.py (diff)
Commit 56ba6fde05240e220b359d8e03ec7f97893440ee by yonghong-song
sync to latest libbpf

The latest libbpf includes a few bug fixes since last time update.

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedsrc/cc/libbpf (diff)
Commit 910ddaf1dbc25e1ba1006e7bdf8390042c717732 by yonghong-song
CMake: Allow to disable building man pages

Avoid building man pages when it's not necessary
(i.e when building for an embedded system).

Signed-off-by: Romain Naour <romain.naour@gmail.com>
The file was modifiedCMakeLists.txt (diff)
Commit 0206fc4e3568eab6cacfc1d5916258a9ba764f5d by yonghong-song
tools: fix vfscount output when no duration is specified

Since commit a2e71a9eb71a ("vfscount.py: add args time (#2344)"),
vfscount does not show any output when it is interrupted by a key
press, which is the only way out when no time limit is specified. I
assume the exit() that has been added in the keyboard interrupt
handler is there so that no output is displayed when the program has
been interrupted early when a time limit has been specified. But since
the tool still invite the user to use Ctrl-C to end the tracing in
that case, it seems more consistent to show an output in that case
too.

This patch removes the exit() and the tools always show a result at
the end. It also adds the duration argument to the synopsis and the
option section in the man page.
The file was modifiedman/man8/vfscount.8 (diff)
The file was modifiedtools/vfscount.py (diff)
Commit 68b8d3017c296d3c266e540f27ea5cf04c6c0f72 by yonghong-song
Support perf's symfs mechanism for debuginfo lookup.

Symfs is a file path prefix that needs to be prepended to full path of a library
to compute location of corresponding debuginfo. It will allow bcc users to
provide debug symbols if only they can write to at least one directory. Nothing
else needs to be assumed regarding the system bcc runs on.

My intention is to make debuginfo lookup work on Android in one form or another.
None of the gdb rules works out of the box:
- native libraries are often managed by Android apps themselves and uncompressed
  by apps into private directories. Sideloading debuginfo into those directories
  might be not feasible. What's more it's desirable to remove data like
  debuglink from release builds of mobile apps. At the same time those builds
  are the most interesting ones to investigate with bcc.
- there is no /usr directory on Android, so there is no /usr/lib/debug/. It
  could be created with some effort, but symfs is much more convenient and
  already used when profiling with simpleperf (fork of perf for Android).
The file was modifiedsrc/cc/bcc_elf.c (diff)
Commit 33c9c571057b75ec979cc74121a0d3cb3a19be1b by jmarchan
man: fixes some man pages

In the man pages of tcplife and tcpstates, the name of the field for
the remote port and address (DPORT, DADDR) differs from the tool
itself (RPORT, RADDR). This patch fix the man pages.

The man page of tcpdrop mentions options that do not exists. This
patch fix that. It also fix the comment at the head of the code that
too mentions inexistents options.

The man pages for solisten and sofdsnoop are missing. This patch adds
them.

The deadlock_detector tools has been rename simply deadlock, but its
manpage is still named deadlock_detector although its content has been
updated. This patch rename the manpage.
The file was addedman/man8/solisten.8
The file was modifiedtools/sofdsnoop_example.txt (diff)
The file was modifiedman/man8/tcpdrop.8 (diff)
The file was modifiedman/man8/tcpstates.8 (diff)
The file was modifiedtools/tcpdrop.py (diff)
The file was addedman/man8/deadlock.8
The file was removedman/man8/deadlock_detector.8
The file was modifiedtools/sofdsnoop.py (diff)
The file was modifiedman/man8/tcplife.8 (diff)
The file was modifiedtools/solisten.py (diff)
The file was addedman/man8/sofdsnoop.8
Commit 89bb40a3d0773e4ea8bdebcf685d100d1ad102dd by yonghong-song
offwaketime: Fix incorrect target and waker PIDs

offwaketime reports target and waker PIDs inversely.
This patch fixes this issue.

Signed-off-by: Yohei Ueda <yohei@jp.ibm.com>
The file was modifiedtools/offwaketime.py (diff)
Commit 5ce16e478a98442b7687e9f5139c1cdb27051ce6 by yonghong-song
Don't prepend /proc/PID/root to user-supplied USDT binary paths starting with /proc already
The file was modifiedsrc/cc/usdt/usdt.cc (diff)
Commit e102514589bfb2519dcd9345fd30868956f85275 by noreply
Update reference_guide.md

I think it should be attach_uretprobe rather than attach_uprobe.
The file was modifieddocs/reference_guide.md (diff)
Commit 2479fbf1d3bc62a3170b2b289a49fb19972078c3 by yonghong-song
Update mysqld_query.py

store the query in query[128] and printk("%s\n",query) instead of printk("%s\n",addr)
The file was modifiedexamples/tracing/mysqld_query.py (diff)
Commit 270d54ae18c589b352dad71f465cf7d439275e24 by yonghong-song
Make number of stack traces configurable from command line in example… (#2500)

Make number of stack traces configurable from command line in examples/tracing/mallocstacks.py
The file was modifiedexamples/tracing/mallocstacks.py (diff)
Commit 496a2b17627918c7b836e3b5eff175002efc9263 by yonghong-song
tcptop: Fix incorrect pid filter

Fix incorrect pid filter in tcptop
The file was modifiedtools/tcptop.py (diff)
Commit d147588ebe35b7cd2b4d253a7da18bef253ea78d by yonghong-song
Support for hardware offload (#2502)

Support for hardware offload
Update XDP example to support HW offload

Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>
The file was modifiedsrc/python/bcc/libbcc.py (diff)
The file was modifiedexamples/networking/xdp/xdp_drop_count.py (diff)
The file was modifiedsrc/python/bcc/__init__.py (diff)
The file was modifiedtests/cc/test_static.c (diff)
The file was modifiedsrc/cc/bcc_common.cc (diff)
The file was modifiedsrc/cc/bcc_common.h (diff)
The file was modifiedsrc/cc/bpf_module.h (diff)
The file was modifiedsrc/cc/bpf_module.cc (diff)
Commit 44454d948b9fa4e0587fad7478b9383d51501c41 by michal.wesolowski
support gcc 8's cold subfunctions
The file was modifiedsrc/python/bcc/__init__.py (diff)
Commit c99c7c4063213f4bb6e8347f9b4d36ed316aa8c9 by yonghong-song
stackcount: fix TypeError (#2514)

fix type error in stackcount.py
The file was modifiedtools/stackcount.py (diff)
Commit ba64f031f2435aad5a85f8f37dbbe2a982cbbe6b by yonghong-song
Fixes #2518 -- weird behaviour of lookup_or_init (#2520)

* Allow lookup_or_init to return NULL (rather than just returning from the current function)
* Fixed a couple of bad edits found when running tests. Also fixed a bug in the
test runner. Also fixed a bug in libbcc where the python signature did not match
the actual implementation.
The file was modifiedtools/filetop.py (diff)
The file was modifiedtools/biotop.py (diff)
The file was modifiedtools/old/softirqs.py (diff)
The file was modifiedtools/syscount.py (diff)
The file was modifiedsrc/python/bcc/libbcc.py (diff)
The file was modifiedtests/wrapper.sh.in (diff)
The file was modifiedtests/python/test_trace_maxactive.py (diff)
The file was modifiedtests/python/test_trace2.py (diff)
The file was modifiedtools/lib/ucalls.py (diff)
The file was modifiedexamples/networking/distributed_bridge/tunnel.c (diff)
The file was modifieddocs/reference_guide.md (diff)
The file was modifiedtests/cc/test_bpf_table.cc (diff)
The file was modifiedexamples/cpp/LLCStat.cc (diff)
The file was modifiedtests/python/test_license.py (diff)
The file was modifiedtests/python/test_percpu.py (diff)
The file was modifiedexamples/lua/offcputime.lua (diff)
The file was modifiedexamples/tracing/task_switch.c (diff)
The file was modifiedtests/python/test_trace4.py (diff)
The file was modifiedtools/old/offcputime.py (diff)
The file was modifiedtools/lib/uobjnew.py (diff)
The file was modifiedtools/old/stackcount.py (diff)
The file was modifiedtests/python/test_clang.py (diff)
The file was modifiedexamples/networking/vlan_learning/vlan_learning.c (diff)
The file was modifiedexamples/tracing/strlen_count.py (diff)
The file was modifiedtools/slabratetop.py (diff)
The file was modifiedtests/python/test_trace3.c (diff)
The file was modifiedtests/python/test_stat1.c (diff)
The file was modifiedtests/python/test_tracepoint.py (diff)
The file was modifiedtests/python/test_trace2.c (diff)
The file was modifiedexamples/networking/tunnel_monitor/monitor.c (diff)
The file was modifiedtools/lib/uflow.py (diff)
The file was modifiedexamples/cpp/TCPSendStack.cc (diff)
The file was modifieddocs/tutorial_bcc_python_developer.md (diff)
The file was modifiedtools/old/wakeuptime.py (diff)
The file was modifiedtools/old/profile.py (diff)
The file was modifiedexamples/lua/task_switch.lua (diff)
The file was modifiedexamples/cpp/UseExternalMap.cc (diff)
The file was modifiedexamples/tracing/mallocstacks.py (diff)
The file was modifiedtools/lib/ustat.py (diff)
The file was modifiedsrc/cc/frontends/clang/b_frontend_action.cc (diff)
The file was modifiedtests/lua/test_clang.lua (diff)
The file was modifiedtests/python/test_lru.py (diff)
The file was modifiedtools/old/offwaketime.py (diff)
Commit 84d9798aec01bc8486f3fc88afcbe37988e3ee58 by noreply
FAQ: fix error message

The package is called bcc, and not bpf:

    from bcc import BPF

If that is not available the error message reads

    ModuleNotFoundError: No module named 'bcc'

and not `No module named 'bpf'`
The file was modifiedFAQ.txt (diff)
Commit f8c5654c01f7705017e8b7becee8907d949eb13c by yonghong-song
INSTALL.md: add install instructions for Fedora 30+ (#2524)

add install instructions for Fedora 30+
The file was modifiedINSTALL.md (diff)
Commit 867c3e3f7cdbba014605cee1f994ea3d2a1e3d50 by yonghong-song
Fix BPF_PERCPU_ARRAY description (#2527)

Fixed the BPF_PERCPU_ARRAY description in reference_guide.md to include information about maximum element size. This is in regards to #2519 .
The file was modifieddocs/reference_guide.md (diff)
Commit c02e5eb13d154661af39a27f202ee64ad6be63a1 by noreply
fix compilation errors with clang CreateFromArgs() change (#2528)

Upstream change https://reviews.llvm.org/D66797 (in llvm 10)
changed signature of CreateFromArgs(). Compiled with latest upstream,
we will have compilation error like:
    /home/yhs/work/bcc/src/cc/frontends/clang/loader.cc:343:57:
    error: ‘cargs’ was not declared in this scope; did you mean ‘ccargs’?
      343 |   if (!CompilerInvocation::CreateFromArgs( invocation0, cargs.  diags))
          |                                                         ^~~~~
          |                                                         ccargs

Adjust bcc codes to use the new func signature.

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedsrc/cc/frontends/clang/loader.cc (diff)
Commit 903513e454c9847370f7e54797ff29f12e1de4d9 by noreply
cmakefile change to require c++14 (#2529)

The latest llvm trunk (llvm 10) built require c++14.
Built with gcc and llvm 10 headers, the following
error will show up:
  ...
  /home/yhs/work/llvm-project/llvm/build/install/include/llvm/Support/RWMutex.h:
      At global scope:
  /home/yhs/work/llvm-project/llvm/build/install/include/llvm/Support/RWMutex.h:101:8:
      error: ‘shared_t$
  med_mutex’ in namespace ‘std’ does not name a type
     std::shared_timed_mutex impl;
  ...
  /home/yhs/work/llvm-project/llvm/build/install/include/llvm/Support/TrailingObjects.h:252:19:
      error: ‘is_final’ is not a member of ‘std’
       static_assert(std::is_final<BaseTy>(), "BaseTy must be final.");
  ...

std::shared_timed_mutex and std::is_final etc. are all c++14 features.
Most compilers should already support c++14. Let us require it in
Makefile now.

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedCMakeLists.txt (diff)
Commit 115b959d866159eecd09ca703197c809aa19ceda by noreply
Fix a file descriptor leak when module is deleted (#2530)

Fix issue #989

When module is cleaned up, let us also close all bpf program
file descriptors to avoid fd leaking.

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedsrc/python/bcc/__init__.py (diff)
Commit ac29d09a10b80c26fa1e5f8351e2dec29cfd4b9a by yonghong-song
FAQ: Add Q&A about kernel lockdown (#2532)

add kernel lockdown and solution to turn it off.
The file was modifiedFAQ.txt (diff)
Commit c00d10d4552f647491395e326d2e4400f3a0b6c5 by yonghong-song
Add sampe code for cgoup test (#2522)

How to run this test:
0. Make sure you have cgroup2 mounted:
  $ mount -t cgroup2
  cgroup on /sys/fs/cgroup/unified type cgroup2 (rw,nosuid,nodev,noexec,relatime)
1. Create a test cgroup in cgroup2 fs:
  $ sudo mkdir /sys/fs/cgroup/unified/test
2. Run this program in a bash:
  $ sudo CGroupTest /sys/fs/cgroup/unified/test
3. In another bash window, do the following:
  $ echo $$ > /sys/fs/cgroup/unified/test/cgroup.procs
  $ run some other commands
4. You should be able to see lots of prints like:
  'file ... was opened!'
The file was modifiedexamples/cpp/CMakeLists.txt (diff)
The file was addedexamples/cpp/CGroupTest.cc
Commit 4c2cb869dc559af2bbd92dafbf769412e638093b by yonghong-song
INSTALL.md: Fedora 30: note about kernel lockdown (#2536)

Add a note about the kernel lockdown challenge
to the "Fedora 30 and newer" section.

Motivation: Fedora 30 users are likely to follow
the instructions in the "Fedora 30 and newer"
section of INSTALL.md. They will run into the
kernel lockdown challenge.
The file was modifiedINSTALL.md (diff)
Commit eb018cf9e5df30c9748e4b31a33f0934a47cca6b by noreply
sync to latest libbpf (#2540)

sync to latest libpf with tag v0.0.5.

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedintrospection/bps.c (diff)
The file was modifiedsrc/cc/compat/linux/virtual_bpf.h (diff)
The file was modifieddocs/kernel-versions.md (diff)
The file was modifiedsrc/cc/libbpf (diff)
The file was modifiedsrc/cc/libbpf.c (diff)
The file was modifiedsrc/cc/export/helpers.h (diff)
Commit 0fa419a64e71984d42f107c210d3d3f0cc82d59a by noreply
debian changelog for v0.11.0 tag (#2541)

the main changes from v0.10.0 to v0.11.0 tag:
  * Support for kernel up to 5.3
  * Corresponding libbpf submodule release is v0.0.5
  * Fix USDT issue with multi-threaded applications
  * Fixed the early return behavior of lookup_or_init
  * Support for nic hardware offload
  * Fixed and Enabled Travis CI
  * A lot of tools change with added new options, etc.

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifieddebian/changelog (diff)
Commit 76f31edfdbac03b02a4fc0bcd07fcd25c6dd5d03 by noreply
sync with latest libbpf repo (#2545)

libbpf repo has a big sync from kernel side.
Let us bring in to ensure bcc working fine and
indeed it works fine.

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedsrc/cc/compat/linux/virtual_bpf.h (diff)
The file was modifiedsrc/cc/libbpf (diff)
Commit 2d1497cde1cc9835f759a707b42dea83bee378b8 by yonghong-song
Redefine asm_inline for Linux 5.4+, Fixes #2546 (#2547)

Here's the upstream commit that introduced `asm_inline`:

* https://github.com/torvalds/linux/commit/eb111869301e15b737315a46c913ae82bd19eb9d

Without this patch BCC fails with the following:

```
$ sudo /usr/share/bcc/tools/opensnoop
In file included from /virtual/main.c:2:
In file included from include/uapi/linux/ptrace.h:142:
In file included from ./arch/x86/include/asm/ptrace.h:5:
./arch/x86/include/asm/segment.h:254:2: error: expected '(' after 'asm'
        alternative_io ("lsl %[seg],%[p]",
        ^
./arch/x86/include/asm/alternative.h:240:2: note: expanded from macro 'alternative_io'
        asm_inline volatile (ALTERNATIVE(oldinstr, newinstr, feature)   \
        ^
include/linux/compiler_types.h:210:24: note: expanded from macro 'asm_inline'
                       ^
```
The file was modifiedsrc/cc/export/helpers.h (diff)
Commit 6b989dba8dbd8db6bb7a2f75810f2b979d58a955 by yonghong-song
Fix Erroneous "gethostlatency" Comments (#2549)

* Fix erroneous comment in gethostlatency.py
* Fix erroneous comment in gethostlatency_example
The file was modifiedtools/gethostlatency.py (diff)
The file was modifiedtools/gethostlatency_example.txt (diff)
Commit 183be9a470035f1916349a29f31070400e9d3a70 by yonghong-song
Changed Link to HTTPS (#2551)

Changed Link to HTTPS
The file was modifiedREADME.md (diff)
Commit 56aa780c3fc0149df400e90007b5ba5b9608182a by 591596081
Mod: the 'min_us' is in us, mot ms
The file was modifiedtools/runqslower_example.txt (diff)
Commit e3668b991dd4147437bcb11400020b3e4f4cbe7d by 591596081
Mod: fix two errors in examples
The file was modifiedtools/drsnoop_example.txt (diff)
Commit 930846dc2c49281c693c2e39a0a2d21c650c61de by jmarchan
man: add missing -c option to tcpretrans synopsis
The file was modifiedman/man8/tcpretrans.8 (diff)
Commit 54aa25763e87cd0c4e0298bcfca0094df87d2be7 by yonghong-song
Fix a typo, tracepint -> tracepoint (#2559)

Fix a typo, tracepint -> tracepoint
The file was modifiedsrc/python/bcc/__init__.py (diff)
Commit 708f786e3784dc32570a079f2ed74c35731664ea by noreply
document the release info related to libbpf submodule (#2561)

Fix issue #2261.
In INSTALL.md document that source code with libbpf submodule
will be released as well for each bcc release in the future.

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedINSTALL.md (diff)
Commit f04c6de5bfaa9137be09af0e6aaad040936bb148 by noreply
assign offset properly for btf DataSec (#2560)

The following test case failed:
  -bash-4.4$ cat test.py
  #!/usr/bin/python
  from bcc import BPF
  prog="""
  BPF_ARRAY(array1, u64, 1);
  BPF_ARRAY(array2, u64, 1);
  """
  b=BPF(text=prog, debug=0x20)
  -bash-4.4$ sudo ./test.py
  libbpf: Error loading BTF: Invalid argument(22)
  libbpf: magic: 0xeb9f
  version: 1
  flags: 0x0
  hdr_len: 24
  ...
  [57] DATASEC array size=176 vlen=2
           type_id=47 offset=0 size=88
           type_id=49 offset=0 size=88 Invalid offset

  Loading .BTF section failed
  -bash-4.4$

The reason is the data offset in DataSec VarInfo
(e.g., type_id=47 offset=0 size=88) always have
offset=0 since JIT won't do a final relocation
for the record. Assign offset properly
in bcc_btf before loading btf to the kernel.
With this patch, test case can load btf properly.
  -bash-4.4$ cat test.py
  #!/usr/bin/python
  from bcc import BPF
  prog="""
  BPF_ARRAY(array1, u64, 1);
  BPF_ARRAY(array2, u64, 1);
  """
  b=BPF(text=prog, debug=0x20)
  -bash-4.4$ sudo ./test.py
  -bash-4.4$

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedsrc/cc/bcc_btf.cc (diff)
Commit c2a530b3adf91e5fe5886277e0f2abed4a77b8ea by noreply
support cgroup level tracing in trace.py (#2562)

This patch added cgroup based filtering in trace.py.

If a cgroup path is specified by the user, one cgroup
array map will be added to the program:
  BPF_CGROUP_ARRAY(__cgroup, 1);

Each probe will have a filter like below:
  if (__cgroup.check_current_task(0) <= 0) { return 0; }
to filter out any events not happening in the cgroup
hierarchy as specified by the user.

The trace.py updated the `__cgroup` map with user provided
cgroup path information before attaching bpf functions
to events for probe function(s).

An example like below:
  $ trace.py -v -c /sys/fs/cgroup/system.slice/workload.service \
    '__x64_sys_nanosleep' '__x64_sys_clone'
     PID     TID     COMM            FUNC
     3191578 3191583 BaseAgentEvents __x64_sys_nanosleep
     3191578 3191579 FutureTimekeepr __x64_sys_clone
     3191578 3191583 BaseAgentEvents __x64_sys_nanosleep
     3191578 3191583 BaseAgentEvents __x64_sys_nanosleep
since workload.service only contains one process 3191578.

Going up the hierarchy to system.slice will have more processes
and hence more results:
  $ trace.py -v -c /sys/fs/cgroup/system.slice \
    '__x64_sys_nanosleep' '__x64_sys_clone'
     PID     TID     COMM            FUNC
     591542  591677  dynoScribe      __x64_sys_nanosleep
     591610  591613  mcreplay2       __x64_sys_nanosleep
     553252  553252  sleeperagent    __x64_sys_nanosleep
     591610  591613  mcreplay2       __x64_sys_nanosleep
     553252  553252  sleeperagent    __x64_sys_nanosleep

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedtools/trace.py (diff)
The file was modifiedman/man8/trace.8 (diff)
The file was modifiedtools/trace_example.txt (diff)
Commit 93479699176c613e2caa0bd6c8b731d0b7257746 by yonghong-song
man: COMM describes the process name, not the parent process name (#2563)

For shmsnoop, COMM describes the process name, not the parent process name.
The file was modifiedman/man8/shmsnoop.8 (diff)
Commit 9b433f20ea0b5832c151e577268df66046c4bfe1 by tdecacqu
cpudist: create sufficiently large hash table to avoid missing tasks

This change fixes the cpudist tool to avoid issue when too many tasks
are running.

Fixes #2567 -- cpudist stop working when there are too many fork
The file was modifiedtools/cpudist.py (diff)
Commit 2dad4759a850bac6a0e3e1dd5fe35fc4c29419f0 by noreply
fix compilation errors with latest llvm trunk (#2575)

llvm commit https://reviews.llvm.org/D66795
changed the signature of function createMCAsmInfo().
  -  MCAsmInfo *createMCAsmInfo(const MCRegisterInfo &MRI,
  -                             StringRef TheTriple) const {
  +  MCAsmInfo *createMCAsmInfo(const MCRegisterInfo &MRI, StringRef TheTriple,
  +                             const MCTargetOptions &Options) const {

Did similar adjustment in bcc to ensure compilation success.

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedsrc/cc/bcc_debug.cc (diff)
Commit eb1a2f64a47030728ac8e190adf1fe27466dda7a by noreply
sync with latest libbpf (#2576)

This should fix the ARM build issue reported
in issue #83.

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedsrc/cc/libbpf (diff)
Commit 82f4302a651a6b46b0b090733d34af8201ecacb5 by noreply
introduce map.lookup_or_try_init() (#2577)

Previously, map.lookup_or_init() may cause unexpected
return from the function when lookup finds no element and
init failed e.g. due to unlikely racy update or
sometimes hash table full.
This has caught surprise from many users. So, the commit
  https://github.com/iovisor/bcc/commit/ba64f031f2435aad5a85f8f37dbbe2a982cbbe6b
attempts to remove the early return in map.lookup_or_init().
But then since NULL pointer could be returned,
user will need to change their bpf program to check return value,
otherwise, verifier will reject the program.

As described in the above, such an API behavior change may cause
verifier failure and reject previously loadable bpf programs.
bcc should try to maintain API stability, esp. to avoid subtle
API behavior change.

This patch propose to restore the behavior of map.lookup_or_init()
and introduce a new one map.lookup_or_try_init(), which will
avoid unexpected return. The name is suggested by Alexei
to reflect that init may fail. map.lookup_or_try_init() will be formally
documented and used in bcc. A warning will be generated if
map.lookup_or_init() is used. Documentation will make it clear
that map.lookup_or_try_init() is preferred over map.lookup_or_init().

```
-bash-4.4$ sudo ./syscount.py
/virtual/main.c:71:11: warning: lookup_or_init() may return from the function, use loopup_or_try_init() instead.
    val = data.lookup_or_init(&key, &zero);
          ^
1 warning generated.
Tracing syscalls, printing top 10... Ctrl+C to quit.
...
```

All uses in examples and tools are converted to use
lookup_or_try_init(). Most tests are converted to use
lookup_or_try_init() too except test_trace_maxactive.py
and test_tracepoint.py to test lookup_or_init()
functionality.
The file was modifieddocs/tutorial_bcc_python_developer.md (diff)
The file was modifieddocs/reference_guide.md (diff)
The file was modifiedtests/cc/test_bpf_table.cc (diff)
The file was modifiedtools/filetop.py (diff)
The file was modifiedexamples/usdt_sample/scripts/lat_avg.py (diff)
The file was modifiedtests/python/test_trace2.py (diff)
The file was modifiedtools/slabratetop.py (diff)
The file was modifiedexamples/networking/vlan_learning/vlan_learning.c (diff)
The file was modifiedexamples/networking/tunnel_monitor/monitor.c (diff)
The file was modifiedtests/python/test_trace_maxactive.py (diff)
The file was modifiedexamples/cpp/TCPSendStack.cc (diff)
The file was modifiedtests/python/test_trace3.c (diff)
The file was modifiedtests/lua/test_clang.lua (diff)
The file was modifiedtests/python/test_tracepoint.py (diff)
The file was modifiedtools/syscount.py (diff)
The file was modifiedtools/deadlock.c (diff)
The file was modifiedexamples/tracing/mallocstacks.py (diff)
The file was modifiedexamples/cpp/UseExternalMap.cc (diff)
The file was modifiedtests/python/test_license.py (diff)
The file was modifiedtools/lib/ucalls.py (diff)
The file was modifiedexamples/tracing/task_switch.c (diff)
The file was modifiedsrc/cc/export/helpers.h (diff)
The file was modifiedexamples/lua/task_switch.lua (diff)
The file was modifiedexamples/cpp/LLCStat.cc (diff)
The file was modifiedexamples/tracing/strlen_count.py (diff)
The file was modifiedsrc/cc/frontends/clang/b_frontend_action.cc (diff)
The file was modifiedexamples/lua/offcputime.lua (diff)
The file was modifiedexamples/networking/http_filter/http-parse-complete.c (diff)
The file was modifiedtests/python/test_clang.py (diff)
The file was modifiedexamples/networking/distributed_bridge/tunnel.c (diff)
The file was modifiedtests/python/test_trace2.c (diff)
The file was modifiedtools/lib/uobjnew.py (diff)
The file was modifiedtests/python/test_trace4.py (diff)
The file was modifiedtools/biotop.py (diff)
The file was modifiedtests/python/test_percpu.py (diff)
The file was modifiedtests/python/test_stat1.c (diff)
The file was modifiedtests/python/test_lru.py (diff)
The file was modifiedtools/lib/uflow.py (diff)
The file was modifiedtools/lib/ustat.py (diff)
Commit 58ff1b3647024bad1da4d20e9d0e99afa61fde51 by noreply
remove the warning for map.lookup_or_init() (#2581)

Commit 82f4302a651a ("introduce map.lookup_or_try_init()")
introduced new API map.lookup_or_try_init(). A compile time
warning is introduced if old map.lookup_or_init() is used
to discourage the usage.

The API is still supported and documentation already
recommends using the new one. So let us drop the
warning.

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedsrc/cc/frontends/clang/b_frontend_action.cc (diff)
Commit 77fe428579b27773f9bdc2cb2a880b1c2d274b67 by yonghong-song
fix typos in tutorial.md (#2584)

fix typos in tutorial.md
The file was modifieddocs/tutorial.md (diff)
Commit 0429040559f9f324b0e1d3ed78b26e678499887f by yonghong-song
Support attaching uprobe to offset (#2585)

* Support attaching uprobe to offset
* C++ API support of attaching uprobe to offset
* Update document of attach_uprobe()
   The document is taken from src/python/bcc/__init__.py:attach_upobe()
The file was modifiedsrc/lua/bcc/sym.lua (diff)
The file was modifiedsrc/python/bcc/__init__.py (diff)
The file was modifiedsrc/cc/api/BPF.cc (diff)
The file was modifiedsrc/cc/api/BPF.h (diff)
The file was modifiedsrc/lua/bcc/bpf.lua (diff)
The file was modifieddocs/reference_guide.md (diff)
Commit 9cede20f9ff19784bba4ef5473b396fa58b5302c by yonghong-song
tools/tcpretrans: add tracepoint support (#2574)

If tracepoint tcp:tcp_retransmit_skb exists (kernel version >= 4.15)
we use tracepoint instead of kprobe for efficiency.

Co-authored-by: Runlong Lin <linrunlong@bytedance.com>
The file was modifiedtools/tcpretrans.py (diff)
Commit d4b3bf03d9c67324ff85f9d3c74b201b7e427615 by jolsa
Add libbcc-no-libbpf.so library

Which links libbpf.so dynamicaly, instead of its current
static inclusion in libbcc.so.

The compilation needs to define CMAKE_USE_LIBBPF_PACKAGE
variable to enable search for libbpf package. If the package
is found it is used to build all the bcc libs.

The libbcc.so and libbcc_bpf.so (and their static versions)
remain the same.

The new library libbcc-no-libbpf.so is built from all libcc.so
sources including libbpf_bcc.so's sources: libbpf.c perf_reader.c
and dynamically linked to libbpf.so library.

With libbcc-no-libbpf.so symbols are versioned, so there's
no chance of being mixed:

Symbols exported from libbpf.so:

  $ objdump -T /usr/lib64/libbpf.so | grep bpf_map_lookup_elem
  0000000000006df0 g    DF .text  000000000000006e  LIBBPF_0.0.1 bpf_map_lookup_elem
  0000000000006e60 g    DF .text  0000000000000076  LIBBPF_0.0.2 bpf_map_lookup_elem_flags

Symbol needed by libbcc-no-libbpf.so:

  $ objdump -T /opt/bcc/lib64/libbcc-no-libbpf.so | grep bpf_map_lookup_elem
  0000000000000000      DF *UND*  0000000000000000  LIBBPF_0.0.1 bpf_map_lookup_elem

Symbols exported by current libbcc.so:

  $ objdump -T /opt/bcc/lib64/libbcc.so | grep bpf_map_lookup_elem
  00000000023ad843 g    DF .text  0000000000000082  Base        bpf_map_lookup_elem_flags
  00000000023ad7d3 g    DF .text  0000000000000070  Base        bpf_map_lookup_elem

Besides that it's better to share common source of libbpf code,
it also prevents issues when having application that links to
libbpf and libbcc, where you could end up conflicting functions
and segfaults if those 2 libbpf libs are not on the same version.

All installed libraries now:

  total 259096
  lrwxrwxrwx. 1 root root        15 Nov  8 15:24 libbcc_bpf.so -> libbcc_bpf.so.0
  lrwxrwxrwx. 1 root root        20 Nov  8 15:24 libbcc_bpf.so.0 -> libbcc_bpf.so.0.11.0
  -rwxr-xr-x. 1 root root    453416 Nov 11 17:03 libbcc_bpf.so.0.11.0
  lrwxrwxrwx. 1 root root        21 Nov  8 15:24 libbcc-no-libbpf.so -> libbcc-no-libbpf.so.0
  lrwxrwxrwx. 1 root root        26 Nov  8 15:24 libbcc-no-libbpf.so.0 -> libbcc-no-libbpf.so.0.11.0
  -rwxr-xr-x. 1 root root 132276312 Nov 11 17:04 libbcc-no-libbpf.so.0.11.0
  lrwxrwxrwx. 1 root root        11 Nov  8 15:24 libbcc.so -> libbcc.so.0
  lrwxrwxrwx. 1 root root        16 Nov  8 15:24 libbcc.so.0 -> libbcc.so.0.11.0
  -rwxr-xr-x. 1 root root 132579280 Nov 11 17:04 libbcc.so.0.11.0
  drwxr-xr-x. 2 root root        23 Nov 11 21:49 pkgconfig

Signed-off-by: Jiri Olsa jolsa@kernel.org
The file was modifiedsrc/cc/CMakeLists.txt (diff)
The file was modifiedCMakeLists.txt (diff)
The file was addedcmake/FindLibBpf.cmake
Commit 19c625e65f6726913ef435b1882d50da49bf43e0 by jolsa
Link test_libbcc directly with libbcc.so

Linking with bcc-shared will use all the libraries in bcc-shared
which compose libbcc, instead of libbcc.so dynamic link.

Signed-off-by: Jiri Olsa jolsa@kernel.org
The file was modifiedtests/cc/CMakeLists.txt (diff)
Commit 7ec8bde336af400fc691dba864b62e5733e82bb3 by jolsa
Add test_libbcc_no_libbpf test

It's the same code as for test_libbcc test,
but linked with libbcc-no-libbpf.so library.

Added LIBBCC_NAME macro to be used in dynamic loader
test where we need to provide the library name.

Signed-off-by: Jiri Olsa jolsa@kernel.org
The file was modifiedtests/cc/CMakeLists.txt (diff)
The file was modifiedtests/cc/test_c_api.cc (diff)
Commit a6f658dfd3a74ce770f62972d16cda1fd8db35d9 by yonghong-song
Add a supplementary explanation to function `get_syscall_fnname` (#2593)

* add a supplementary explanation to function `get_syscall_fnname`.
* fix the contents
The file was modifieddocs/reference_guide.md (diff)
Commit 992e482b5d06c58888b3821a96a41e48aff678d0 by noreply
sync with latest libbpf (#2594)

The following helpers are sync'ed into bcc and will
be available in linux 5.5.
  bpf_probe_read_kernel
  bpf_probe_read_kernel_str
  bpf_probe_read_user
  bpf_probe_read_user_str

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifieddocs/kernel-versions.md (diff)
The file was modifiedsrc/cc/libbpf.c (diff)
The file was modifiedsrc/cc/export/helpers.h (diff)
The file was modifiedsrc/cc/libbpf (diff)
The file was modifiedintrospection/bps.c (diff)
The file was modifiedsrc/cc/compat/linux/virtual_bpf.h (diff)
Commit ccf8261e89eede7b6c9c949c1913610fe1bd9a5c by yonghong-song
add BPF::init_usdt function to init a single USDT so folks can handle partial init failure of list of USDTs.

modify BPF::init so that failure doesn't leave the BPF object in a broken state such that subsequent inits will also fail
The file was modifiedsrc/cc/api/BPF.cc (diff)
The file was modifiedtests/cc/test_usdt_probes.cc (diff)
The file was modifieddocs/reference_guide.md (diff)
The file was modifiedsrc/cc/api/BPF.h (diff)
Commit 15fbd7cd24e37bfda80326ecdb713be3cc063641 by Zwb
add tool: compactsnoop
The file was modifiedsnapcraft/snapcraft.yaml (diff)
The file was addedman/man8/compactsnoop.8
The file was addedtools/compactsnoop_example.txt
The file was addedtools/compactsnoop.py
The file was modifiedREADME.md (diff)
The file was addedtools/old/compactsnoop.py
The file was modifiedtests/python/test_tools_smoke.py (diff)
Commit 10c1a8303aba778707cd6875d2de1dd7e0a4eda3 by yonghong-song
docs/reference_guide.md: update doc

virtual_bpf.h instead of bpf.h
src/cc/compat/linux/bpf.h -> src/cc/compat/linux/virtual_bpf.h
The file was modifieddocs/reference_guide.md (diff)
Commit 98b8d0c833b51ca595b257d2c1afd3a6c53c4437 by yonghong-song
docs: update XDP driver list

There are a few more drivers supporting XDP now.

Signed-off-by: Gary Lin <glin@suse.com>
The file was modifieddocs/kernel-versions.md (diff)
Commit 6ee245bd9d2d548bb82437a7a32740e7570737b8 by yonghong-song
fix a bug in mountsnoop.py with 4.17+ kernels

in 4.17+ kernels, syscall parameters are wrapped in the first
parammeter in pt_regs. So put the 5th parameter in the
syscall__ parameter list so it can be handled properly
by the rewriter.

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedtools/mountsnoop.py (diff)
Commit b8ab98b272bc205108d777eb311610b22f1af133 by yonghong-song
Include stddef.h for size_t in bcc_elf.h

Signed-off-by: Masanori Misono <m.misono760@gmail.com>
The file was modifiedsrc/cc/bcc_elf.h (diff)
Commit ac00ac5d7fec86524ff815360d0cda2ec583cf24 by yonghong-song
Add lockstat tool

Adding lockstat tool to trace kernel mutex lock events and
display locks statistics and displays following data:

                                  Caller   Avg Spin  Count   Max spin Total spin
                      psi_avgs_work+0x2e       3675      5       5468      18379
                     flush_to_ldisc+0x22       2833      2       4210       5667
                       n_tty_write+0x30c       3914      1       3914       3914
                               isig+0x5d       2390      1       2390       2390
                   tty_buffer_flush+0x2a       1604      1       1604       1604
                      commit_echoes+0x22       1400      1       1400       1400
          n_tty_receive_buf_common+0x3b9       1399      1       1399       1399

                                  Caller   Avg Hold  Count   Max hold Total hold
                     flush_to_ldisc+0x22      42558      2      76135      85116
                      psi_avgs_work+0x2e      14821      5      20446      74106
          n_tty_receive_buf_common+0x3b9      12300      1      12300      12300
                       n_tty_write+0x30c      10712      1      10712      10712
                               isig+0x5d       3362      1       3362       3362
                   tty_buffer_flush+0x2a       3078      1       3078       3078
                      commit_echoes+0x22       3017      1       3017       3017

Every caller to using kernel's mutex is displayed on every line.

First portion of lines show the lock acquiring data, showing the amount
of time it took to acquired given lock.

  'Caller'       - symbol acquiring the mutex
  'Average Spin' - average time to acquire the mutex
  'Count'        - number of times mutex was acquired
  'Max spin'     - maximum time to acquire the mutex
  'Total spin'   - total time spent in acquiring the mutex

Second portion of lines show the lock holding data, showing the amount
of time it took to hold given lock.

  'Caller'       - symbol holding the mutex
  'Average Hold' - average time mutex was held
  'Count'        - number of times mutex was held
  'Max hold'     - maximum time mutex was held
  'Total hold'   - total time spent in holding the mutex

This works by tracing mutex_lock/unlock kprobes, udating the lock stats
in maps and processing them in the python part.

Examples:
    lockstats                           # trace system wide
    lockstats -d 5                      # trace for 5 seconds only
    lockstats -i 5                      # display stats every 5 seconds
    lockstats -p 123                    # trace locks for PID 123
    lockstats -t 321                    # trace locks for PID 321
    lockstats -c pipe_                  # display stats only for lock callers with 'pipe_' substring
    lockstats -S acq_count              # sort lock acquired results on acquired count
    lockstats -S hld_total              # sort lock held results on total held time
    lockstats -S acq_count,hld_total    # combination of above
    lockstats -n 3                      # display 3 locks
    lockstats -s 3                      # display 3 levels of stack

Signed-off-by: Jiri Olsa <jolsa@kernel.org>
The file was modifiedtests/python/test_tools_smoke.py (diff)
The file was addedtools/lockstat_example.txt
The file was modifiedtools/offwaketime.py (diff)
The file was modifiedREADME.md (diff)
The file was modifiedsnapcraft/snapcraft.yaml (diff)
The file was addedtools/lockstat.py
The file was addedman/man8/lockstat.8
Commit f0f19dbcc34f6246e75094457a268b35dea79149 by yonghong-song
make TRY2 macro work outside of ebpf namespace (#2604)

make TRY2 macro work outside of ebpf namespace
The file was modifiedsrc/cc/bcc_exception.h (diff)
Commit 3032347541d8b121598e220ec782aceb642ebf55 by yonghong-song
Make StatusTuple code and msg methods const (#2603)

I ran into this while trying to write a method that takes a const StatusTuple reference, these methods should be marked const. I also fixed an unnecessary string copy in msg.
The file was modifiedsrc/cc/bcc_exception.h (diff)
Commit f68d818085c2c26a88606d4976474a08cfe7c9ee by yonghong-song
update INSTALL.md for new llvm source compilation

clang/llvm has moved from old svn with git mirror to
github based source control. The new github address is
  https://github.com/llvm/llvm-project
which includes clang, llvm and other related projects.

This patch updated instruction how to build clang/llvm library
with new llvm-project setup.

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedINSTALL.md (diff)
Commit 65885f34d5ea1acb6a014615f1eea08fc6c5514d by yonghong-song
tools/runqslower.py: Fix raw tracepoint code

Closes: #2588

It is was observed that many unrelated process names
were reported for the same pid.

The cause of the bug was the use of bpf_get_current_comm()
which operates on the current process which might already be
different than the 'next' task we captured.
The fix is to use bpf_probe_read_str() instead.

Also removing dead code related to tgid extraction which is not
used at all.
The file was modifiedtools/runqslower.py (diff)
Commit 0272a3d5f3bc87e63aefe1078349be79c5afc651 by yonghong-song
docs: update helper functions of BPF_PROG_TYPE_SOCKET_FILTER

Signed-off-by: Masanori Misono <m.misono760@gmail.com>
The file was modifieddocs/kernel-versions.md (diff)
Commit 149c1c8857652997622fc2a30747a60e0c9c17dc by yonghong-song
Add map-in-map support

Add BPF_MAP_TYPE_HASH_OF_MAPS and BPF_MAP_TYPE_HASH_OF_MAPS
supports in bcc. Two new constructs below are introduced
to bpf program:
  BPF_HASH_OF_MAPS(map_name, "inner_map_name", max_entries)
  BPF_ARRAY_OF_MAPS(map_name, "inner_map_name", max_entries)
In the above, "inner_map_name" is for metadata purpose and there
must be a map defined in bpf program with map name "inner_map_name".

Both python and C++ APIs are added.

For python, a new Table API get_fd() is introduced to get
the fd of a map so that the fd can be used by a map-in-map
do update. The get_fd() is already exposed as API function
in C++. For C++, without get_fd(), we will need to
templatize basic functions like update_value etc, which
I feed too heavy weight. Because of C++ using get_fd()
mechanism, so I exposed similar API on python side
for parity reason.

For map-in-map, the inner map lookup/update/delete won't have
explicit map names. Considering map-in-map is not
used very frequently, I feel looking primitive
bpf_map_{lookup,update,delete}_elem() probably okay,
so I did not create any new bcc specific
constructs for this purpose.

Added both C++ and python test cases to show how to
use the above two new map type in bcc.

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedsrc/cc/api/BPF.cc (diff)
The file was modifiedsrc/cc/api/BPFTable.h (diff)
The file was addedtests/python/test_map_in_map.py
The file was modifiedsrc/cc/frontends/clang/b_frontend_action.h (diff)
The file was modifiedsrc/cc/frontends/clang/b_frontend_action.cc (diff)
The file was modifiedsrc/cc/bpf_module.cc (diff)
The file was modifiedsrc/cc/bpf_module.h (diff)
The file was addedtests/cc/test_map_in_map.cc
The file was modifieddocs/reference_guide.md (diff)
The file was modifiedsrc/python/bcc/table.py (diff)
The file was modifiedsrc/cc/api/BPF.h (diff)
The file was modifiedsrc/cc/export/helpers.h (diff)
The file was modifiedsrc/cc/table_storage.h (diff)
The file was modifiedsrc/cc/api/BPFTable.cc (diff)
The file was modifiedtests/cc/CMakeLists.txt (diff)
Commit a1a04f49ac736bc0ddd341258b8a56f2a25d30c5 by yonghong-song
Do not traverse attributes during JSON generation (Fixes #2605)

Previously, __attribute__((aligned(sizeof(...)))) would cause the type
inside sizeof() to be appended after the JSON type information for the
struct in some clang versions, generating invalid JSON. Inhibit
attribute traversal, since we only want to visit the fields.
The file was modifiedsrc/cc/json_map_decl_visitor.cc (diff)
Commit 90f2086c8dd073792b0be382944440e3d0f1977f by yonghong-song
do not use BPF_F_REUSE_STACKID incorrectly

Do not use BPF_F_REUSE_STACKID if the stack id is used
together with process specific info like
pid/tgid/comm. Using BPF_F_REUSE_STACKID may cause
stack id pointing to a different stack later on.

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedtools/memleak.py (diff)
The file was modifiedtools/stackcount.py (diff)
The file was modifiedtools/deadlock.c (diff)
The file was modifiedtools/stacksnoop.lua (diff)
The file was modifiedtools/old/profile.py (diff)
The file was modifiedtools/wakeuptime.py (diff)
The file was modifiedtools/trace.py (diff)
Commit ea8bbbf942a1a4275d434c62db7adc6136fc72f4 by yonghong-song
fix bug for lockstat.py #347 (#2618)

fix bug for lockstat.py with map keys in stack instead of map value in
order to run in older kernels.
The file was modifiedtools/lockstat.py (diff)
Commit feadea6d789f54e304e9c2f570ed87299e6f4e5e by yonghong-song
Support a BPF program larger than BPF_MAXINSNS

A privileged user can load bpf program whose size is at most
BPF_COMPLEXITY_LIMIT_INSNS (which is larger than BPF_MAXINSNS) in Linux 5.3
(https://github.com/torvalds/linux/commit/c04c0d2b968ac45d6ef020316808ef6c82325a82).
Currently, however, `bcc_prog_load_xattr()` return error if  a bpf
program size is larger than BPF_MAXINSNS before loading the program. To
cope with this, change the function so that first trying to load a bpf
program and print an error message if bpf_program_load_xattr() fails
with -E2BIG.  This strategy is the same as libbpf's `load_program`
(https://github.com/libbpf/libbpf/blob/9ef191ea7dca6815e75dab341f2f7a346d979c66/src/libbpf.c#L3792)
The Error message should use BPF_COMPLEXITY_LIMIT_INSNS when
appropriate, but it is not defined in uapi headers yet.

Signed-off-by: Masanori Misono <m.misono760@gmail.com>
The file was modifiedsrc/cc/libbpf.c (diff)
Commit 556d9ec9ca0c142d38b08c5d93420ab06df4e6e0 by yonghong-song
Use integer types for enums in JSON (Fixes #2615)

The JSON generated for enums wasn't being handled, and caused
exceptions. Since the enum values aren't needed (and would've been
useless without the associated numerical values, anyway), just use the
matching integer type instead.
The file was modifiedtests/python/test_clang.py (diff)
The file was modifiedsrc/cc/json_map_decl_visitor.cc (diff)
Commit e09116d3e777782cfdf1a129f8ca8f2981505fb2 by yonghong-song
Use libbpf-static instead of libbpf-debugsource for CMAKE_USE_LIBBPF_PACKAGE

Currently when building with CMAKE_USE_LIBBPF_PACKAGE we assume
that 'source' package is available to build libbcc_bpf libraries.

However It turned on that using debugsource (in Fedora) package is
not suitable or even possible, so we are switching to use the
libbpf-static package instead.

Adding libbpf-static package detection and removing source
package detection.

Using ar to extract objects from archive and linking them
with both libbcc_bpf.so and libbcc_bpf.a.

Using always uapi headers from the latest libbpf Github repo,
because there are not packaged, but they are backwards compatible,
so it's no problem to have older libbpf package with newer
uapi headers.

Signed-off-by: Jiri Olsa <jolsa@kernel.org>
The file was modifiedcmake/FindLibBpf.cmake (diff)
The file was modifiedsrc/cc/CMakeLists.txt (diff)
Commit 744b644e0d2677e0ffc774d8fefe63715670c455 by yonghong-song
man: fix the field of filetop

In the man pages of filetop, the field of FILE is missing

Signed-off-by: Kenta Tada <Kenta.Tada@sony.com>
The file was modifiedman/man8/filetop.8 (diff)
Commit 0bca64555ab30b37d23f6898f2eec4528d4d4ec7 by yonghong-song
man: fix the explanation of filename

Below filenames currently come from dentry->d_name.name
* btrfsslower
* ext4slower
* fileslower
* nfsslower
* xfsslower
* zfsslower

Signed-off-by: Kenta Tada <Kenta.Tada@sony.com>
The file was modifiedman/man8/xfsslower.8 (diff)
The file was modifiedman/man8/ext4slower.8 (diff)
The file was modifiedman/man8/nfsslower.8 (diff)
The file was modifiedman/man8/fileslower.8 (diff)
The file was modifiedman/man8/btrfsslower.8 (diff)
The file was modifiedman/man8/zfsslower.8 (diff)
Commit 1f7b6cd3fdaec9a49b3534539044f31f6694ebe9 by yonghong-song
Correction to Usage text.
The file was modifiedtools/mysqld_qslower.py (diff)
Commit b040635d86fa7eba195ec3f43f91a6f72806fb05 by yonghong-song
man: fix a reference to runqlat in runqslower man page

The runqslower man page obviously derived from the man page of
runqlat. It seems that a reference to runqlat in the NAME section has
been overlooked.
The file was modifiedman/man8/runqslower.8 (diff)
Commit 71f9c2a7469cc73bdba4b3b9f49991930ac572f9 by yonghong-song
rename tool lockstat.py to klockstat.py

The current lockstat.py is tracing three kernel functions
  mutex_lock_enter(), mutex_unlock_enter(), mutex_lock_return()
for kernel locking statistics.

There are some other efforts trying to get user lock stats by
tracing e.g. pthread locking primitives. For example,
Sasha Goldshtein's linux-tracing-workshop
   https://github.com/goldshtn/linux-tracing-workshop
is referenced in bcc/docs/tutorial_bcc_python_developer.md.
It has a tool called lockstat.py which traces pthread_mutex_init
to collect some lock statistics for userspace locks.

In bcc, in the past, we also had an effort to gather userspace
lock statistics with the same name lockstat.py.
   https://github.com/iovisor/bcc/pull/1268

In the future, bcc could have a lockstat tool tracing userspace
locks. So let us rename the current lockstat.py to klockstat.py
to clearly express its scope.
The file was removedtools/lockstat.py
The file was addedtools/klockstat.py
The file was modifiedREADME.md (diff)
The file was modifiedsnapcraft/snapcraft.yaml (diff)
The file was modifiedtests/python/test_tools_smoke.py (diff)
The file was addedtools/klockstat_example.txt
The file was removedman/man8/lockstat.8
The file was removedtools/lockstat_example.txt
The file was addedman/man8/klockstat.8
Commit e7ddcbcc5e939ac91e16b42fca303c31816590a5 by yonghong-song
remove inproper usage of BPF_F_REUSE_STACKID in examples

When the application bundles stack id with process specific
info (like pid, comm, etc.), BPF_F_REUSE_STACKID should not
be used as it may associate wrong stack with processes.

This patch corrected several such uses in examples/
directory.

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedexamples/tracing/stacksnoop.py (diff)
The file was modifiedexamples/lua/memleak.lua (diff)
The file was modifiedexamples/lua/offcputime.lua (diff)
The file was modifiedexamples/tracing/mallocstacks.py (diff)
Commit 9ce7b7e9ff3c8f00950f15ed0f0c73b6fa4e1dcd by yonghong-song
tools/trace.py: add process name filtering

porting from opensnoop

Signed-off-by: tty5 <tty.fqq@gmail.com>
The file was modifiedman/man8/trace.8 (diff)
The file was modifiedtools/trace_example.txt (diff)
The file was modifiedtools/trace.py (diff)
Commit 5cf529eeb448fa5422f305727ee4be7d01ebf391 by yonghong-song
tools/trace.py: add msg filter of event

In the normal develop, will produce many event on the same tracepoint,
like do_sys_open, a executable program will open many files but
developer only has interesting on the specific file. So this filter
will
help developer to get their interesting msg

Signed-off-by: tty5 <tty.fqq@gmail.com>
The file was modifiedman/man8/trace.8 (diff)
The file was modifiedtools/trace_example.txt (diff)
The file was modifiedtools/trace.py (diff)
Commit f9f1050f0d61e56ed43df0f1338a30389bfcc2ba by yonghong-song
fix a compilation error with latest llvm 10

Two issues:
First, the recent llvm commit "[Alignment][NFC] CreateMemSet use MaybeAlign"
(https://reviews.llvm.org/D71213) changed IR/IRBuilder.h
CreateMemSet() signature which caused the following compilation error:
  [ 16%] Building CXX object src/cc/frontends/b/CMakeFiles/b_frontend.dir/codegen_llvm.cc.o
  /home/yhs/work/bcc/src/cc/frontends/b/codegen_llvm.cc: In member function
  ‘virtual ebpf::StatusTuple ebpf::cc::CodegenLLVM::visit_table_index_expr_node(ebpf::cc::TableIndexExprNode*)’:
  /home/yhs/work/bcc/src/cc/frontends/b/codegen_llvm.cc:824:96: error: no matching function for call to
  ‘llvm::IRBuilder<>::CreateMemSet(llvm::Value*&, llvm::ConstantInt*, llvm::ConstantInt*, int)’
       B.CreateMemSet(leaf_ptr, B.getInt8(0), B.getInt64(n->table_->leaf_id()->bit_width_ >> 3), 1);
                                                                                                ^
  ....
  /home/yhs/work/llvm-project/llvm/build/install/include/llvm/IR/IRBuilder.h:460:13: note: candidate:
  llvm::CallInst* llvm::IRBuilderBase::CreateMemSet(llvm::Value*, llvm::Value*, llvm::Value*,
  llvm::MaybeAlign, bool, llvm::MDNode*, llvm::MDNode*, llvm::MDNode*)
     CallInst *CreateMemSet(Value *Ptr, Value *Val, Value *Size, MaybeAlign Align,
               ^~~~~~~~~~~~
  /home/yhs/work/llvm-project/llvm/build/install/include/llvm/IR/IRBuilder.h:460:13: note:
  no known conversion for argument 4 from ‘int’ to ‘llvm::MaybeAlign’

Second, the commit "[OpenMP][NFCI] Introduce llvm/IR/OpenMPConstants.h"
(https://reviews.llvm.org/D69853) introduced a new library "FrontendOpenMP"
which is used by clang Parser, and caused the following errors:
  [ 99%] Building CXX object tests/cc/CMakeFiles/test_libbcc.dir/test_hash_table.cc.o
  /home/yhs/work/llvm-project/llvm/build/install/lib/libclangParse.a(ParseOpenMP.cpp.o): In function
  `clang::Parser::ParseOpenMPDeclareReductionDirective(clang::AccessSpecifier)':
  ParseOpenMP.cpp:(.text._ZN5clang6Parser36ParseOpenMPDeclareReductionDirectiveENS_15AccessSpecifierE+0x86):
  undefined reference to `llvm::omp::getOpenMPDirectiveName(llvm::omp::Directive)'

This patch fixed both issues and bcc can compile with latest llvm 10.
The file was modifiedcmake/clang_libs.cmake (diff)
The file was modifiedsrc/cc/frontends/b/codegen_llvm.cc (diff)
Commit e6bd4edc389aa7876ba89dae48eb27d4e59687a2 by yonghong-song
sync with latest libbpf

sync with latest upstream libbpf version 0.0.6.
The file was modifiedsrc/cc/libbpf (diff)
The file was modifiedintrospection/CMakeLists.txt (diff)
The file was modifiedsrc/cc/compat/linux/virtual_bpf.h (diff)
Commit 368a5b0714961953f3e3f61607fa16cb71449c1b by yonghong-song
debian changelog for v0.12.0 tag

the main changes from v0.11.0 to v0.12.0 tag:
  * Support for kernel up to 5.4
  * klockstat tool to track kernel mutex lock statistics
  * cmake option CMAKE_USE_LIBBPF_PACKAGE to build a bcc shared library
    linking with distro libbpf_static.a
  * new map.lookup_or_try_init() API to remove hidden return in
    map.lookup_or_init()
  * BPF_ARRAY_OF_MAPS and BPF_HASH_OF_MAPS support
  * support symbol offset for uprobe in both C++ and python API,
    kprobe already has the support
  * bug fixes for trace.py, tcpretrans.py, runqslower.py, etc.

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifieddebian/changelog (diff)
Commit 2283996f0acd80c304541540570825da7fae77d9 by yonghong-song
Fix s390 kprobes support

Ever since Linux kernel commit aa0d6e70d, kprobes on s390 could no longer
be found due to a change in symbol names.
Symptom:
  $ ./tools/execsnoop.py
  cannot attach kprobe, probe entry may not exist
  [...]

Signed-off-by: Stefan Raspl <raspl@linux.ibm.com>
The file was modifiedsrc/python/bcc/__init__.py (diff)
Commit 3106a82f2cbce9be7c31da44cd173c2ac88c7e21 by yonghong-song
fix -h output for --sort option

This fixes a regression from c2b371d56b8bbaf9c7d01b88830193ecd1ee4e12 where the author forgot to update the help output.
The file was modifiedtools/filetop.py (diff)
Commit 05a09ea981cc5ed5021b194c3b2e2ea32c55e4b5 by yonghong-song
Improve wording on how latency is measured
The file was modifiedman/man8/biolatency.8 (diff)
Commit c71394a9b6a5f6e98aef854ca5aa018a4ed733bf by yonghong-song
klockstat: fix caller filter

- args.caller needs to be bytes not string
- clarify man page a bit
The file was modifiedman/man8/klockstat.8 (diff)
The file was modifiedtools/klockstat.py (diff)
Commit 0aca2c71c9b9e6b3d3335b6df288ad01a09c3ed6 by yonghong-song
Remove kretprobe__ prefix from program names

Such prefixes are currently removed for kprobes, tracepoints, and raw
tracepoints, but not for kretprobes.  This commit removes it for
kretprobe as well, for consistency.

Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>
The file was modifiedsrc/cc/libbpf.c (diff)
Commit b2aa29fa3269ec54b2c4d95a55559deb4c32b7b6 by yonghong-song
tools: cgroup filtering in execsnoop/opensnoop

Add a new option --cgroupmap in execsnoop and opensnoop to only display
results from processes that belong to one of the cgroups whose id,
returned by bpf_get_current_cgroup_id(), is in a pinned BPF hash map.

Examples of commands:
    # opensnoop --cgroupmap /sys/fs/bpf/test01
    # execsnoop --cgroupmap /sys/fs/bpf/test01

Cgroup ids can be discovered in userspace by the system call
name_to_handle_at(); an example of C program doing that is available in
examples/cgroupid/cgroupid.c.

More complete documentation is added in docs/filtering_by_cgroups.md

The documentation is independent from Kubernetes. However, my goal is to
use this feature in Kubernetes: I am preparing to use this in Inspektor
Gadget to select specific Kubernetes pods, depending on a Kubernetes
label selector. Kubernetes pods matching the label selector can come and
go during the execution of the bcc tools; Inspektor Gadget is updating
the BPF hash map used by the bcc tools accordingly.
The file was modified.gitignore (diff)
The file was addeddocs/filtering_by_cgroups.md
The file was modifiedtools/opensnoop.py (diff)
The file was modifiedtools/opensnoop_example.txt (diff)
The file was addedexamples/cgroupid/Makefile
The file was modifiedtools/execsnoop_example.txt (diff)
The file was addedexamples/cgroupid/Dockerfile
The file was addedexamples/cgroupid/cgroupid.c
The file was modifiedtools/execsnoop.py (diff)
Commit 8174c0ae5541d4c9b2b3a4d407d7ea527946b641 by yonghong-song
sync with latest libbpf

also add dependency of zlib in a couple of places
as libbpf starts to use zlib directly.

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedintrospection/CMakeLists.txt (diff)
The file was modifiedsrc/cc/CMakeLists.txt (diff)
The file was modifiedsrc/cc/libbpf (diff)
Commit 8bb4e473bac87e65c9aaa51c9e90e2f98bb25acc by yonghong-song
tools/trace.py: flush stdout for each event
The file was modifiedtools/trace.py (diff)
Commit 977a7e3a568c4c929fabeb4a025528d9b6f1e84c by yonghong-song
change version.cmake to check all tags

Fix issue #2666

Currently, in master where latest tag is v0.12.0,
the build still says is it v0.11.0.

  [ben@centos bcc]$ cd build/
  [ben@centos build]$ cmake .. -DCMAKE_INSTALL_PREFIX=/usr
  -- Latest recognized Git tag is v0.11.0

The reason is the git_describe by default only checks
annotated tag while tag v0.12.0 is tagged through
github release process which just tags whatever the
top of the master.

Making git_describe to check all tags fixed the issue.

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedcmake/version.cmake (diff)
Commit 4f0a887a1530c716190454b824a7f003fde8b9e8 by yonghong-song
man: fix required kernel version in man pages

Several man pages state that Linux 4.5 is required because the tool
relies on the bpf_perf_event_output helper.  However,
bpf_perf_event_output was introduced in Linux 4.4.

In addition, mountsnoop requires Linux 4.8 because it now uses
the bpf_get_current_task helper.

Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>
The file was modifiedman/man8/bashreadline.8 (diff)
The file was modifiedman/man8/killsnoop.8 (diff)
The file was modifiedman/man8/statsnoop.8 (diff)
The file was modifiedman/man8/biosnoop.8 (diff)
The file was modifiedman/man8/syncsnoop.8 (diff)
The file was modifiedman/man8/drsnoop.8 (diff)
The file was modifiedman/man8/opensnoop.8 (diff)
The file was modifiedman/man8/gethostlatency.8 (diff)
The file was modifiedman/man8/mountsnoop.8 (diff)
The file was modifiedman/man8/filelife.8 (diff)
Commit df591fb5970392359b860945b754d6c7cfce1d2e by Caspar Zhang
fix libbpf_uapi path typo

A typo occured in libbpf_uapi path from src/cc/CMakeLists.txt which
made compat linux uapi headers failed to copy.

Signed-off-by: Caspar Zhang <caspar@linux.alibaba.com>
The file was modifiedsrc/cc/CMakeLists.txt (diff)
Commit dc336aa42dee99e3b38b8c760c39cc8fafe9deca by yonghong-song
Package static archives, closes #1938

This should help embed libbcc into bpftrace:

* https://github.com/iovisor/bpftrace/issues/342

As well as other tools like ebpf_exporter, so that there is no longer
a requirement to have a particular version libbcc installed.
The file was modifiedsrc/cc/CMakeLists.txt (diff)
Commit 5098c9dd2538d6256a10f1a67a36ebc867549e7f by yonghong-song
fix test_map_in_map.cc compilation error

fix issue #2679 where test_map_in_map.cc has a
compilation error on ppc64le due to conflicting
type __u64. Let us just remove the typedef.

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedtests/cc/test_map_in_map.cc (diff)
Commit e47f9d0294a23fe125e577a5649c936ea7d6f814 by yonghong-song
sanitize btf VAR and DATASEC types

bcc does not use these types yet. Let us sanitize them
with int/void-pointer types so old kernels can continue
to work with latest llvm compiler.

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedsrc/cc/bcc_btf.cc (diff)
Commit db8264413135c808bd5d530537e9cccabf6186a3 by yonghong-song
tools/runqslower.py: Option for --pid or --tid (#2635)

* tools/runqslower.py: Option for --pid or --tid

Closes: #2607

Option for --pid or --tid tracing.
Enable group leader level tracing.
* --pid <pid>:
    will trace every task that has <pid> as group leader.
    Meaning it will trace the parent and its direct children.
* --tid <tid>:
    will trace the given thread
* Reporting TID instead of PID in the report column.
* Update the example file to reflect the TID/PID change
The file was modifiedman/man8/runqslower.8 (diff)
The file was modifiedtools/runqslower.py (diff)
The file was modifiedtools/runqslower_example.txt (diff)
Commit c6b287ca4ca30de94d1082ebed0a7330796b717a by yonghong-song
support BPF_MAP_TYPE_SK_STORAGE map

kernel sk local storage is introduced at 5.2.
  https://github.com/torvalds/linux/commit/6ac99e8f23d4b10258406ca0dd7bffca5f31da9d
this patch supports BPF_MAP_TYPE_SK_STORAGE in bcc.
tested C++ user space APIs and loading of the bpf programs
using helpers map.sk_storage_get() and map.sk_storage_delete().

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedsrc/cc/export/helpers.h (diff)
The file was modifiedsrc/cc/api/BPFTable.h (diff)
The file was addedtests/cc/test_sk_storage.cc
The file was modifiedsrc/cc/api/BPF.h (diff)
The file was modifiedtests/cc/CMakeLists.txt (diff)
The file was modifiedsrc/cc/frontends/clang/b_frontend_action.cc (diff)
Commit 909ada95ce59530cb205a96413167bb0c5074739 by yonghong-song
tools/offcputime.py: Redundatn arg check

pid/tid is already set to be mutually exclusive in
python's arg parser so no need for this check manually.
The file was modifiedtools/offcputime.py (diff)
Commit d79628569b039f3efe8bdb09505005bb388b4eb7 by yonghong-song
Links to 3 articles on Linux tracing using bcc
The file was modifiedLINKS.md (diff)
Commit 1a780e97ff6678583c5398230c579cc81cfbf2bb by yonghong-song
rewriter: Fix tracking of pointers with several indirections

The rewriter tracks, with nb_derefs, the number of indirections of
external pointers, to rewrite only the appropriate dereference into a call
to bpf_probe_read.

In ProbeChecker, however, nb_derefs has a different meaning: it counts
the number of dereferences encountered.  This difference resulted in an
error when ProbeChecker is traversing the right-hand side of an
assignment.  This commit fixes the error and adds tests for the two
cases of assignments: when the right-hand side is an external pointer
with several indirection levels and when it is a call to a function
returning an external pointer with several indirection levels.

This commit also changes ProbeSetter and assignsExtPtr to count
dereferences instead of addrof in an effort to use nb_derefs more
consistently across the code to mean "number of dereferences needed to get
to the external pointer".

Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>
The file was modifiedtests/python/test_clang.py (diff)
The file was modifiedsrc/cc/frontends/clang/b_frontend_action.cc (diff)
Commit 1b2be41a090cb66e049911de47ea02b78bf85caf by yonghong-song
Add Ubuntu Eon incompatibility note

Packages are currently broken on Ubuntu Eon. See #2676 and #2678.
The file was modifiedINSTALL.md (diff)
Commit 590ac9dcb67aff673b38855b76eaf45b5269fd41 by yonghong-song
Ubuntu Eon build dependencies and version numbers

- Add updated list of dependencies to build on Ubuntu Eon (19.10)
- Add Ubuntu version numbers for increased clarity
- Capitalize release names to match official branding
The file was modifiedINSTALL.md (diff)
Commit c707a55ef164f9072688fd4cf9e7ca7ac20b8fc4 by yonghong-song
avoid complex expression in struct member initializer

Some old compiler may complain about this. Let us only use simple expression.

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedsrc/cc/api/BPFTable.cc (diff)
Commit c14d02a521cdeddc54a1189cd66a90cbd632a9a5 by yonghong-song
Fix a bunch of typos (#2693)

fix a bunch of types in man pages, docs, tools, tests, src and examples.
The file was modifiedsrc/cc/frontends/b/parser.yy (diff)
The file was modifiedtools/offwaketime.py (diff)
The file was modifiedsrc/cc/frontends/b/codegen_llvm.cc (diff)
The file was modifiedtools/offcputime.py (diff)
The file was modifiedsrc/cc/frontends/p4/compiler/ebpfTable.py (diff)
The file was modifiedexamples/cpp/TCPSendStack.cc (diff)
The file was modifiedtools/tcplife_example.txt (diff)
The file was modifiedtools/cachetop.py (diff)
The file was modifieddocs/reference_guide.md (diff)
The file was modifiedsrc/cc/api/BPF.cc (diff)
The file was modifiedsrc/cc/libbpf.c (diff)
The file was modifiedtools/tcpstates.py (diff)
The file was modifiedexamples/tracing/dddos.py (diff)
The file was modifiedtools/reset-trace_example.txt (diff)
The file was modifiedtests/cc/test_perf_event.cc (diff)
The file was modifiedman/man8/criticalstat.8 (diff)
The file was modifiedsrc/cc/bcc_elf.h (diff)
The file was modifiedsrc/cc/libbpf.h (diff)
The file was modifiedexamples/networking/http_filter/http-parse-complete.c (diff)
The file was modifiedman/man8/filetop.8 (diff)
The file was modifiedtools/tcplife.lua (diff)
The file was modifiedtools/capable.py (diff)
The file was modifiedman/man8/runqlen.8 (diff)
The file was modifiedtools/compactsnoop_example.txt (diff)
The file was modifiedtools/nfsslower.py (diff)
The file was modifiedtools/criticalstat_example.txt (diff)
The file was modifiedtests/lua/luaunit.lua (diff)
The file was modifiedtools/tcptracer_example.txt (diff)
The file was modifiedtools/klockstat.py (diff)
The file was modifiedtools/solisten_example.txt (diff)
The file was modifiedtools/inject.py (diff)
The file was modifiedtools/tcplife.py (diff)
The file was modifiedman/man8/compactsnoop.8 (diff)
The file was modifiedman/man8/dbslower.8 (diff)
The file was modifiedtools/compactsnoop.py (diff)
The file was modifiedtools/reset-trace.sh (diff)
The file was modifiedtools/tcpaccept.py (diff)
The file was modifiedtests/python/include/folly/tracing/StaticTracepoint-ELF.h (diff)
The file was modifiedexamples/networking/http_filter/http-parse-complete.py (diff)
The file was modifiedtools/tcpstates_example.txt (diff)
The file was modifiedsrc/cc/export/helpers.h (diff)
The file was modifiedtools/runqlen_example.txt (diff)
The file was modifiedtools/profile.py (diff)
The file was modifiedtools/tcpsubnet_example.txt (diff)
The file was modifiedtools/old/profile.py (diff)
Commit 9c32c359637df243269ae871f50a6837aee0ceb0 by noreply
update usage of MCInstPrinter printInst() for llvm10 (#2696)

The file was modifiedsrc/cc/bcc_debug.cc (diff)
Commit 03e0d26483e6165227b1150a0418664e8bbcdb80 by yonghong-song
docs: add BPF trampoline to the kernel features

Signed-off-by: Gary Lin <glin@suse.com>
The file was modifieddocs/kernel-versions.md (diff)
Commit 18e0991f7057922b4735de013e1dc06f6260f8f3 by yonghong-song
Secure Boot:  physical keypress to disable lockdown

Ubuntu 19.10 with secure boot enabled doesn't allow the kernel lockdown to be lifted by echo, even from root:
```
# echo 1 > /proc/sys/kernel/sysrq
# echo x > /proc/sysrq-trigger
```
dmesg says:
```
This sysrq operation is disabled from userspace.
```

I pressed Alt-PrtScr-x and that worked:
```
sysrq: Disabling Secure Boot restrictions
Lifting lockdown
```

I can now run eBPF tools, such as execsnoop-bpfcc.
The file was modifiedFAQ.txt (diff)
Commit 670aad2e7fd9e8f21db56ee188cbb4ab010f91c0 by yonghong-song
sanitize BTF_KIND_FUNC

The llvm patch https://reviews.llvm.org/D71638 extends
BTF_KIND_FUNC to include scope of the function,
static, global and extern, with btf_type->info vlen
encoding since vlen is always 0 before the extension.

This patch did the sanitization so that the
bcc with latest llvm can still work on older kernels.

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedsrc/cc/bcc_btf.h (diff)
The file was modifiedsrc/cc/bcc_btf.cc (diff)
Commit 071eef6b1571f23be6f0fc03787523cb06b70659 by yonghong-song
sync with latest libbpf repo

sync with latest libbpf repo upto the following commit:
  https://github.com/libbpf/libbpf/commit/868739519894fbf2cdb81f1f9222f1b665670096

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifieddocs/kernel-versions.md (diff)
The file was modifiedsrc/cc/compat/linux/virtual_bpf.h (diff)
The file was modifiedintrospection/bps.c (diff)
The file was modifiedsrc/cc/libbpf (diff)
The file was modifiedsrc/cc/libbpf.c (diff)
Commit bbafe998921792839d5c09f76705dd30849140ba by yonghong-song
Fix CentOS 6 support.

CentOS 6 support was added in #1504 and inadvertently reverted in #1763
leading to builds failing due to undefined reference to "clock_gettime".

To re-add support for building on CentOS 6 and keep binary size down,
only add librt to the list of target_link_libraries to allow
"clock_gettime" to be resolved.
The file was modifiedintrospection/CMakeLists.txt (diff)
Commit 304d95cf48c256cbf5bb27d68193db4f01afb9e8 by yonghong-song
bpflist: list only real bpf objects

The regular expression '.*bpf-(\\w+)' used to grep for bpf objects would also
list regular files. For example, a process like `vim /tmp/bpf-woo` would be
listed in the output and the type of the BPF object will be 'woo'. Fix this
by correcting the regular expression.

Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>
The file was modifiedtools/bpflist.py (diff)
Commit 90937ce0237f72ccf18142296a6d5c97cc823791 by yonghong-song
bpflist: use smarter print format

BPF object type can be wider than 8 characters, e.g., for the "raw-tracepoint"
type.  Compute the printing format automatically based on the maximum length of
BPF objects to be listed.

Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>
The file was modifiedtools/bpflist.py (diff)
Commit 4f0c29ea2c072c29e9ed064a1494f333e2378cf3 by yonghong-song
fix llvm compilation error

The following changes from llvm 10
  https://github.com/llvm/llvm-project/commit/6fdd6a7b3f696972edc244488f59532d05136a27#diff-37c83c70858df19cb097e36b13b7c112
changed MCDisassembler::getInstruction() signature.
Do the corresponding change in bcc_debug.cc to fix the issue.

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifiedsrc/cc/bcc_debug.cc (diff)
Commit efbed3b678c4ab2e32b41978fc9e4a2c758bce5e by yonghong-song
docs: Remove a redundant space

Signed-off-by: Masanori Misono <m.misono760@gmail.com>
The file was modifieddocs/kernel-versions.md (diff)
Commit dce8e9daf59f44dec4e3500d39a82a8ce59e43ba by yonghong-song
sync with latest libbpf repo

sync libbpf submodule upto the following commit:
    commit 033ad7ee78e8f266fdd27ee2675090ccf4402f3f
    Author: Andrii Nakryiko <andriin@fb.com>
    Date:   Fri Jan 17 16:22:23 2020 -0800

        sync: latest libbpf changes from kernel

Signed-off-by: Yonghong Song <yhs@fb.com>
The file was modifieddocs/kernel-versions.md (diff)
The file was modifiedsrc/cc/libbpf.c (diff)
The file was modifiedsrc/cc/compat/linux/virtual_bpf.h (diff)
The file was modifiedsrc/cc/libbpf (diff)
Commit da59f37f14320c0a20300f2c516336ae9ebe8a30 by yonghong-song
Remove  from list of AUR packages
The file was modifiedINSTALL.md (diff)
Commit 201928af91840304bb8d79383dd98cef140587b2 by Dale Hamel
Initial support for using github actions

This uses Github's new Actions framework to build and test bcc
The file was modifiedtests/cc/test_c_api.cc (diff)
The file was added.github/workflows/bcc-test.yml
The file was modifiedtests/cc/test_usdt_probes.cc (diff)
The file was addedDockerfile.tests
The file was modified.github/workflows/bcc-test.yml (diff)