Changes

fix compilation issues with latest llvm12 trunk

With latest llvm12 trunk, we got two compilation bugs.

Bug #1:
  /home/yhs/work/bcc/src/cc/frontends/clang/b_frontend_action.cc:
     In member function ‘void ebpf::BFrontendAction::DoMiscWorkAround()’:
  /home/yhs/work/bcc/src/cc/frontends/clang/b_frontend_action.cc:1706:31:
     error: ‘class clang::SourceManage’ has no member named ‘getBuffer’; did you mean ‘getBufferData’?
     rewriter_->getSourceMgr().getBuffer(rewriter_->getSourceMgr().getMainFileID())->getBufferSize(),
                               ^~~~~~~~~
                               getBufferData

  This is due to upstream change https://reviews.llvm.org/D89394.
  To fix, follow upstream examples in https://reviews.llvm.org/D89394.

Bug #2:
  /home/yhs/work/bcc/src/cc/bpf_module.cc: In member function ‘int ebpf::BPFModule::finalize()’:
  /home/yhs/work/bcc/src/cc/bpf_module.cc:470:11:
    error: ‘class llvm::EngineBuilder’ has no member named ‘setUseOrcMCJITReplacement’
   builder.setUseOrcMCJITReplacement(false);
           ^~~~~~~~~~~~~~~~~~~~~~~~~

  This is due to upstream
    https://github.com/llvm/llvm-project/commit/6154c4115cd4b78d0171892aac21e340e72e32bd

  It seems builder.setUseOrcMCJITReplacement() is not needed any more. So just remove it
  from bcc.

Signed-off-by: Yonghong Song <yhs@fb.com>

tools/offcputime: Fix python3 string output

When using non-folded output, some of the strings would
be printed as raw byte arrays on python3, like this:

    b'finish_task_switch'
    b'__schedule'
    b'schedule'
    b'worker_thread'
    b'kthread'
    b'ret_from_fork'
    -                kworker/u16:1 (22022)
        2267942

This commit updates the code to treat these as utf8 strings,
consistent with all the other strings printed from this tool.

add a C++ kfunc/kretfunc example

This patch added a kfunc/kretfunc C++ example to
show how the new trampoline based kprobe/kretprobe
can be used in C++ based applications.

Signed-off-by: Yonghong Song <yhs@fb.com>

Add PT_REGS_PARMx_SYSCALL helpers for all archs

Reduce code duplication, and add PT_REGS_SYSCALL_CTX

Drop ubuntu xenial from release process, it is EOL

Install python dependencies via pip

Add sk_lookup to kernel-versions.md

sk_lookup programs allow intercepting socket lookup per namespace.

Document XDP support for igb driver in Linux 5.10

tools/biolatpcts: Support measuring overall latencies between two events

* Interpret negative interval as infinite and output once as soon as init is
  complete to indicate readiness.

* Output on SIGUSR1.

* When exit is requested through SIGINT, TERM or HUP, output the latency
  distribution one more time before exiting.

Combined, this allows using biolatpcts to measure the overall latency
distribution between two events.

tools/biolatpcts: Add accumulative reporting on SIGUSR2

SIGUSR1's behavior is the same - print and start a new interval. SIGUSR2
triggers output without starting a new interval and can be used to monitor
progress without affecting the accumulation of data points.

Add build-from-source instructions for Arch Linux

doc: adjust bpf_ktime_get_ns() document description

Update the link and title of the linked blog post

The new link is also https.

4.18 - Pass map values to map helpers

Update kernel-versions.md

libbpf-tools: syscall_helpers: fix a warning

Fix the following warning when building libbpf-tools:

    syscall_helpers.c: In function ‘init_syscall_names’:
    syscall_helpers.c:63:2: warning: ignoring return value of ‘fgets’, declared with attribute warn_unused_result [-Wunused-result]
       63 |  fgets(buf, sizeof(buf), f);
          |  ^~~~~~~~~~~~~~~~~~~~~~~~~~

We're not interested in the return value of the first call to fgets, because we
want to skip the first line and in the case of error it will be caught by the
following call to fgets. A funny note is that we can't say just "(void) f()" to
suppress the warning, so I wrote it as "(void) !!f()", which works.

Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>

libbpf-tools: update README add a blog link

Signed-off-by: Wenbo Zhang <ethercflow@gmail.com>

bcc/libbpf-tools: Fix user probe read references of execsnoop

Signed-off-by: Kenta Tada <Kenta.Tada@sony.com>

tools/opensnoop: Use bpf_probe_read_user explicitly

The README file in this repo has some bad links - [404:NotFound]

The markup version of the readme that is displayed for the main page in this repo contains the following bad links:

Status code [404:NotFound] - Link: https://github.com/iovisor/bcc/blob/master/tools/swapin_example.txt
Status code [404:NotFound] - Link: https://github.com/iovisor/bcc/blob/master/tools/vfscount.c
Status code [404:NotFound] - Link: https://github.com/iovisor/bcc/blob/master/tools/vfsstat.c

@yonghong-song requested removing stale links. I was unable to find any actual matching files to link to so removed these.
However possible the vfsstat.c one could be re-adding pointing to "libbpf-tools/vfsstat.c" ??

Should resolve issue #3189

CMake: Refactor clang include/library paths