Changes

tools: fix runqslower warning

The state member of task_struct is volatile and it's use as the last
parameter of bpf_probe_read (const void *) triggers the following
clang warning (LLVM 8):

/virtual/main.c:56:42: warning: passing 'volatile long *' to parameter of type 'const void *' discards qualifiers [-Wincompatible-pointer-types-discards-qualifiers]
    bpf_probe_read(&state, sizeof(long), &prev->state);
                                         ^~~~~~~~~~~~
1 warning generated.
Tracing run queue latency higher than 10000 us
TIME     COMM             PID           LAT(us)

An explicit cast fixes the warning.

Error in time comparison

Datetime comparisons requires the use of timedelta.

sync to latest libbpf repo

sync with latest libbpf repo

Signed-off-by: Yonghong Song <yhs@fb.com>

Use device+inode to identify matching files; prepend /proc/pid/root to
paths for usdt.

Lazily symbolize regular ELF binaries

This patch adds a new API to bcc_elf.h, bcc_elf_foreach_sym_lazy. This
helper avoids storing symbol names in string format, as for large
binaries this data can get quite large.

Instead we store the location in the ELF binary where we can later find
the string. Later on, we can load these strings on demand and cache them
in case they're accessed again.

This patch also makes lazy resolution the default for regular ELF
binaries, where regular means not perfmap or VDSO.

Lazify ProcSyms::find_name

It's pretty much strictly better to walk all the symbol names on demand
to find a symbol rather than storing it all in memory beforehand.

Make bcc_elf_symbol_str support debuginfo

Thread through debugfile flag

So we don't have to guess and check when reading symbols. Sometimes if
the elf sections are laid out just right you can "guess" the wrong
string.

Enter mount namespace before trying to open binary

Address code review

Add tests

Fix designated initializers

Rebase and remove mount guards

tools/inject: Update documentation

fix various compilation warnings

The following compilation warnings are fix:
...
/home/yhs/work/bcc/src/cc/libbpf.c:548:12: warning: comparison of distinct pointer types ('typeof (name_len - name_offset) *' (aka 'unsigned long *')
      and 'typeof (16U - 1) *' (aka 'unsigned int *')) [-Wcompare-distinct-pointer-types]
           min(name_len - name_offset, BPF_OBJ_NAME_LEN - 1));
           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/yhs/work/bcc/src/cc/libbpf/include/linux/kernel.h:28:17: note: expanded from macro 'min'
        (void) (&_min1 == &_min2);
...
/home/yhs/work/bcc/src/cc/bcc_syms.h:71:34: warning: declaration of 'struct mod_info' will not be visible outside of this function [-Wvisibility]
int _bcc_syms_find_module(struct mod_info *info, int enter_ns, void *p);
...
/home/yhs/work/bcc/src/cc/usdt/usdt.cc:486:14: warning: unused variable 'pid' [-Wunused-variable]
        auto pid = ctx->pid();
             ^
...

Signed-off-by: Yonghong Song <yhs@fb.com>

fix asm_volatile_goto issue again

In src/cc/export/helpers.h, we tried to
define asm_volatile_goto to something else
if it is defined through uapi bpf.h.
  #ifdef asm_volatile_goto
  #undef asm_volatile_goto
  #define asm_volatile_goto(x...) asm volatile("invalid use of asm_volatile_goto")
  #endif

It is possible that due to different kernel configurations,
asm_volatile_goto may not be defined after uapi bpf.h.
To prevent compilation errors, let us unconditionally
define asm_volatile_goto here.

Signed-off-by: Yonghong Song <yhs@fb.com>

Travis CI: Lint for Python syntax errors and undefined names

Identity is not the same thing as equality in Python

Add missing colon (:)

Force a retest

This retest should work

Undefined name: signal_ignore --> signal.SIG_IGN

Undefined name: Don't forget "self" in "self.b"

Undefined name: "headerInstance" --> "p4header"

Undefined name: "SocketConfig" -> "TargetConfig"

Undefined name: from compilationException import CompilationException

from __future__ import print_function

Old style exceptions --> new style for Python 3

Old style exceptions --> new style for Python 3

Use feature detection instead of version detection

https://docs.python.org/3/howto/pyporting.html#use-feature-detection-instead-of-version-detection

long was removed in Python 3

Remove allow_failures on python: 3.7 tests

Swap test order

Move language: generic

Try under language: python

Echo

Comment out the set -euo pipefail

Update .travis.yml

Upgrade from pep8 --> pycodestyle

Four parallel test runs

Update lua Quickstart for Ubuntu 18.04 LTS

Filter out non-bash COMMs

Prevents the output of non-bash readlines when bash is dynamically
linked. Refs #1851.

Use bpf_prog_load function from ljsyscall module in LuaJIT compiler

At various points in the compiler code, an attempt to load the BPF
program is made. In order to do this, a bpf() syscall needs to happen
with BPF_PROG_LOAD as the first argument (Consult the bpf man page,
under the 'eBPF programs' section). The module ljsyscall does
this via the bpf_prog_load function.

At the time of writing, this function is declared in the file:

syscall/linux/syscalls.lua

In the repo:

https://github.com/justincormack/ljsyscall.git

Report proper module on kernel backtrace

Raghavendra Rao reported that memleak does not display
proper name of the related kernel module, but just the
"kernel" string, like here for xfs module functions:

  131072 bytes in 4 allocations from stack
          ..
          bvec_alloc+0x92 [kernel]
          bio_alloc_bioset+0x13f [kernel]
          xfs_add_to_ioend+0x2df [kernel]
          xfs_do_writepage+0x148 [kernel]
          write_cache_pages+0x171 [kernel]
          xfs_vm_writepages+0x59 [kernel]
          do_writepages+0x43 [kernel]
          ...

The kernel resolver code is parsing /proc/kallsyms, which
already has the module information in.

This patch is adding support to parse the module info
from /proc/kallsyms and initialize the module with
proper value.

Above memleak backtrace now looks like:

  131072 bytes in 4 allocations from stack

          bvec_alloc+0x92 [kernel]
          bio_alloc_bioset+0x13f [kernel]
          xfs_add_to_ioend+0x2df [xfs]
          xfs_do_writepage+0x148 [xfs]
          write_cache_pages+0x171 [kernel]
          xfs_vm_writepages+0x59 [xfs]
          do_writepages+0x43 [kernel]
          ...

Reported-by: Raghavendra Rao <ragrao@redhat.com>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>

sync with latest libbpf

sync with latest libbpf (v0.0.4 tag)

Signed-off-by: Yonghong Song <yhs@fb.com>

tools: fix printb usage in solisten

Since its conversion to printb, solisten has suffers from yet another python2/3 bytes/str issue:

Traceback (most recent call last):
  File "_ctypes/callbacks.c", line 234, in 'calling callback function'
  File "/usr/lib/python3.6/site-packages/bcc/table.py", line 581, in raw_cb_
    callback(cpu, data, size)
  File "/usr/share/bcc/tools/solisten", line 176, in print_event
    event.lport, address,
TypeError: %b requires a bytes-like object, or an object that implements __bytes__, not 'str'

This patch fix the issue on python3. The tools still works on python2.

Turn on lazy symbolize by default

This turns on lazy symbolization by default. Symbol names will be
resolved the first time they're requested and then cached for future
access. This can reduce bcc memory usage by quite a bit in certain
workloads.

tools/tcpconnect: add option -c to count connects

Add -c to count all active connections per dest ip/port so we can
easily spot the heavy outbound connection attempts.

    # ./tcpconnect.py -c
    Tracing connect ... Hit Ctrl-C to end
    ^C
    LADDR                 RADDR                    RPORT              CONNECTS
    192.168.10.50         172.217.21.194           443                70
    192.168.10.50         172.213.11.195           443                34
    192.168.10.50         172.212.22.194           443                21
    [...]

sync to latest libbpf

The latest libbpf includes a few bug fixes since last time update.

Signed-off-by: Yonghong Song <yhs@fb.com>

CMake: Allow to disable building man pages

Avoid building man pages when it's not necessary
(i.e when building for an embedded system).

Signed-off-by: Romain Naour <romain.naour@gmail.com>

tools: fix vfscount output when no duration is specified

Since commit a2e71a9eb71a ("vfscount.py: add args time (#2344)"),
vfscount does not show any output when it is interrupted by a key
press, which is the only way out when no time limit is specified. I
assume the exit() that has been added in the keyboard interrupt
handler is there so that no output is displayed when the program has
been interrupted early when a time limit has been specified. But since
the tool still invite the user to use Ctrl-C to end the tracing in
that case, it seems more consistent to show an output in that case
too.

This patch removes the exit() and the tools always show a result at
the end. It also adds the duration argument to the synopsis and the
option section in the man page.

Support perf's symfs mechanism for debuginfo lookup.

Symfs is a file path prefix that needs to be prepended to full path of a library
to compute location of corresponding debuginfo. It will allow bcc users to
provide debug symbols if only they can write to at least one directory. Nothing
else needs to be assumed regarding the system bcc runs on.

My intention is to make debuginfo lookup work on Android in one form or another.
None of the gdb rules works out of the box:
- native libraries are often managed by Android apps themselves and uncompressed
  by apps into private directories. Sideloading debuginfo into those directories
  might be not feasible. What's more it's desirable to remove data like
  debuglink from release builds of mobile apps. At the same time those builds
  are the most interesting ones to investigate with bcc.
- there is no /usr directory on Android, so there is no /usr/lib/debug/. It
  could be created with some effort, but symfs is much more convenient and
  already used when profiling with simpleperf (fork of perf for Android).

man: fixes some man pages

In the man pages of tcplife and tcpstates, the name of the field for
the remote port and address (DPORT, DADDR) differs from the tool
itself (RPORT, RADDR). This patch fix the man pages.

The man page of tcpdrop mentions options that do not exists. This
patch fix that. It also fix the comment at the head of the code that
too mentions inexistents options.

The man pages for solisten and sofdsnoop are missing. This patch adds
them.

The deadlock_detector tools has been rename simply deadlock, but its
manpage is still named deadlock_detector although its content has been
updated. This patch rename the manpage.

offwaketime: Fix incorrect target and waker PIDs

offwaketime reports target and waker PIDs inversely.
This patch fixes this issue.

Signed-off-by: Yohei Ueda <yohei@jp.ibm.com>

Don't prepend /proc/PID/root to user-supplied USDT binary paths starting with /proc already

Update reference_guide.md

I think it should be attach_uretprobe rather than attach_uprobe.

Update mysqld_query.py

store the query in query[128] and printk("%s\n",query) instead of printk("%s\n",addr)

Make number of stack traces configurable from command line in example… (#2500)

Make number of stack traces configurable from command line in examples/tracing/mallocstacks.py

tcptop: Fix incorrect pid filter

Fix incorrect pid filter in tcptop

Support for hardware offload (#2502)

 Support for hardware offload
 Update XDP example to support HW offload

Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>

support gcc 8's cold subfunctions

stackcount: fix TypeError (#2514)

fix type error in stackcount.py

Fixes #2518 -- weird behaviour of lookup_or_init (#2520)

* Allow lookup_or_init to return NULL (rather than just returning from the current function)
* Fixed a couple of bad edits found when running tests. Also fixed a bug in the
test runner. Also fixed a bug in libbcc where the python signature did not match
the actual implementation.

FAQ: fix error message

The package is called bcc, and not bpf:

    from bcc import BPF

If that is not available the error message reads

    ModuleNotFoundError: No module named 'bcc'

and not `No module named 'bpf'`

INSTALL.md: add install instructions for Fedora 30+ (#2524)

add install instructions for Fedora 30+

Fix BPF_PERCPU_ARRAY description (#2527)

Fixed the BPF_PERCPU_ARRAY description in reference_guide.md to include information about maximum element size. This is in regards to #2519 .

fix compilation errors with clang CreateFromArgs() change (#2528)

Upstream change https://reviews.llvm.org/D66797 (in llvm 10)
changed signature of CreateFromArgs(). Compiled with latest upstream,
we will have compilation error like:
    /home/yhs/work/bcc/src/cc/frontends/clang/loader.cc:343:57:
    error: ‘cargs’ was not declared in this scope; did you mean ‘ccargs’?
      343 |   if (!CompilerInvocation::CreateFromArgs( invocation0, cargs.  diags))
          |                                                         ^~~~~
          |                                                         ccargs

Adjust bcc codes to use the new func signature.

Signed-off-by: Yonghong Song <yhs@fb.com>

cmakefile change to require c++14 (#2529)

The latest llvm trunk (llvm 10) built require c++14.
Built with gcc and llvm 10 headers, the following
error will show up:
  ...
  /home/yhs/work/llvm-project/llvm/build/install/include/llvm/Support/RWMutex.h:
      At global scope:
  /home/yhs/work/llvm-project/llvm/build/install/include/llvm/Support/RWMutex.h:101:8:
      error: ‘shared_t$
  med_mutex’ in namespace ‘std’ does not name a type
     std::shared_timed_mutex impl;
  ...
  /home/yhs/work/llvm-project/llvm/build/install/include/llvm/Support/TrailingObjects.h:252:19:
      error: ‘is_final’ is not a member of ‘std’
       static_assert(std::is_final<BaseTy>(), "BaseTy must be final.");
  ...

std::shared_timed_mutex and std::is_final etc. are all c++14 features.
Most compilers should already support c++14. Let us require it in
Makefile now.

Signed-off-by: Yonghong Song <yhs@fb.com>

Fix a file descriptor leak when module is deleted (#2530)

Fix issue #989

When module is cleaned up, let us also close all bpf program
file descriptors to avoid fd leaking.

Signed-off-by: Yonghong Song <yhs@fb.com>

FAQ: Add Q&A about kernel lockdown (#2532)

add kernel lockdown and solution to turn it off.

Add sampe code for cgoup test (#2522)

How to run this test:
0. Make sure you have cgroup2 mounted:
  $ mount -t cgroup2
  cgroup on /sys/fs/cgroup/unified type cgroup2 (rw,nosuid,nodev,noexec,relatime)
1. Create a test cgroup in cgroup2 fs:
  $ sudo mkdir /sys/fs/cgroup/unified/test
2. Run this program in a bash:
  $ sudo CGroupTest /sys/fs/cgroup/unified/test
3. In another bash window, do the following:
  $ echo $$ > /sys/fs/cgroup/unified/test/cgroup.procs
  $ run some other commands
4. You should be able to see lots of prints like:
  'file ... was opened!'

INSTALL.md: Fedora 30: note about kernel lockdown (#2536)

Add a note about the kernel lockdown challenge
to the "Fedora 30 and newer" section.

Motivation: Fedora 30 users are likely to follow
the instructions in the "Fedora 30 and newer"
section of INSTALL.md. They will run into the
kernel lockdown challenge.

sync to latest libbpf (#2540)

sync to latest libpf with tag v0.0.5.

Signed-off-by: Yonghong Song <yhs@fb.com>

debian changelog for v0.11.0 tag (#2541)

the main changes from v0.10.0 to v0.11.0 tag:
  * Support for kernel up to 5.3
  * Corresponding libbpf submodule release is v0.0.5
  * Fix USDT issue with multi-threaded applications
  * Fixed the early return behavior of lookup_or_init
  * Support for nic hardware offload
  * Fixed and Enabled Travis CI
  * A lot of tools change with added new options, etc.

Signed-off-by: Yonghong Song <yhs@fb.com>

sync with latest libbpf repo (#2545)

libbpf repo has a big sync from kernel side.
Let us bring in to ensure bcc working fine and
indeed it works fine.

Signed-off-by: Yonghong Song <yhs@fb.com>

Redefine asm_inline for Linux 5.4+, Fixes #2546 (#2547)

Here's the upstream commit that introduced `asm_inline`:

* https://github.com/torvalds/linux/commit/eb111869301e15b737315a46c913ae82bd19eb9d

Without this patch BCC fails with the following:

```
$ sudo /usr/share/bcc/tools/opensnoop
In file included from /virtual/main.c:2:
In file included from include/uapi/linux/ptrace.h:142:
In file included from ./arch/x86/include/asm/ptrace.h:5:
./arch/x86/include/asm/segment.h:254:2: error: expected '(' after 'asm'
        alternative_io ("lsl %[seg],%[p]",
        ^
./arch/x86/include/asm/alternative.h:240:2: note: expanded from macro 'alternative_io'
        asm_inline volatile (ALTERNATIVE(oldinstr, newinstr, feature)   \
        ^
include/linux/compiler_types.h:210:24: note: expanded from macro 'asm_inline'
                       ^
```

Fix Erroneous "gethostlatency" Comments (#2549)

* Fix erroneous comment in gethostlatency.py
* Fix erroneous comment in gethostlatency_example

Changed Link to HTTPS (#2551)

Changed Link to HTTPS

Mod: the 'min_us' is in us, mot ms

Mod: fix two errors in examples

man: add missing -c option to tcpretrans synopsis

Fix a typo, tracepint -> tracepoint (#2559)

Fix a typo, tracepint -> tracepoint

document the release info related to libbpf submodule (#2561)

Fix issue #2261.
In INSTALL.md document that source code with libbpf submodule
will be released as well for each bcc release in the future.

Signed-off-by: Yonghong Song <yhs@fb.com>

assign offset properly for btf DataSec (#2560)

The following test case failed:
  -bash-4.4$ cat test.py
  #!/usr/bin/python
  from bcc import BPF
  prog="""
  BPF_ARRAY(array1, u64, 1);
  BPF_ARRAY(array2, u64, 1);
  """
  b=BPF(text=prog, debug=0x20)
  -bash-4.4$ sudo ./test.py
  libbpf: Error loading BTF: Invalid argument(22)
  libbpf: magic: 0xeb9f
  version: 1
  flags: 0x0
  hdr_len: 24
  ...
  [57] DATASEC array size=176 vlen=2
           type_id=47 offset=0 size=88
           type_id=49 offset=0 size=88 Invalid offset

  Loading .BTF section failed
  -bash-4.4$

The reason is the data offset in DataSec VarInfo
(e.g., type_id=47 offset=0 size=88) always have
offset=0 since JIT won't do a final relocation
for the record. Assign offset properly
in bcc_btf before loading btf to the kernel.
With this patch, test case can load btf properly.
  -bash-4.4$ cat test.py
  #!/usr/bin/python
  from bcc import BPF
  prog="""
  BPF_ARRAY(array1, u64, 1);
  BPF_ARRAY(array2, u64, 1);
  """
  b=BPF(text=prog, debug=0x20)
  -bash-4.4$ sudo ./test.py
  -bash-4.4$

Signed-off-by: Yonghong Song <yhs@fb.com>

support cgroup level tracing in trace.py (#2562)

This patch added cgroup based filtering in trace.py.

If a cgroup path is specified by the user, one cgroup
array map will be added to the program:
  BPF_CGROUP_ARRAY(__cgroup, 1);

Each probe will have a filter like below:
  if (__cgroup.check_current_task(0) <= 0) { return 0; }
to filter out any events not happening in the cgroup
hierarchy as specified by the user.

The trace.py updated the `__cgroup` map with user provided
cgroup path information before attaching bpf functions
to events for probe function(s).

An example like below:
  $ trace.py -v -c /sys/fs/cgroup/system.slice/workload.service \
    '__x64_sys_nanosleep' '__x64_sys_clone'
     PID     TID     COMM            FUNC
     3191578 3191583 BaseAgentEvents __x64_sys_nanosleep
     3191578 3191579 FutureTimekeepr __x64_sys_clone
     3191578 3191583 BaseAgentEvents __x64_sys_nanosleep
     3191578 3191583 BaseAgentEvents __x64_sys_nanosleep
since workload.service only contains one process 3191578.

Going up the hierarchy to system.slice will have more processes
and hence more results:
  $ trace.py -v -c /sys/fs/cgroup/system.slice \
    '__x64_sys_nanosleep' '__x64_sys_clone'
     PID     TID     COMM            FUNC
     591542  591677  dynoScribe      __x64_sys_nanosleep
     591610  591613  mcreplay2       __x64_sys_nanosleep
     553252  553252  sleeperagent    __x64_sys_nanosleep
     591610  591613  mcreplay2       __x64_sys_nanosleep
     553252  553252  sleeperagent    __x64_sys_nanosleep

Signed-off-by: Yonghong Song <yhs@fb.com>

man: COMM describes the process name, not the parent process name (#2563)

For shmsnoop, COMM describes the process name, not the parent process name.

cpudist: create sufficiently large hash table to avoid missing tasks

This change fixes the cpudist tool to avoid issue when too many tasks
are running.

Fixes #2567 -- cpudist stop working when there are too many fork

fix compilation errors with latest llvm trunk (#2575)

llvm commit https://reviews.llvm.org/D66795
changed the signature of function createMCAsmInfo().
  -  MCAsmInfo *createMCAsmInfo(const MCRegisterInfo &MRI,
  -                             StringRef TheTriple) const {
  +  MCAsmInfo *createMCAsmInfo(const MCRegisterInfo &MRI, StringRef TheTriple,
  +                             const MCTargetOptions &Options) const {

Did similar adjustment in bcc to ensure compilation success.

Signed-off-by: Yonghong Song <yhs@fb.com>

sync with latest libbpf (#2576)

This should fix the ARM build issue reported
in issue #83.

Signed-off-by: Yonghong Song <yhs@fb.com>

introduce map.lookup_or_try_init() (#2577)

Previously, map.lookup_or_init() may cause unexpected
return from the function when lookup finds no element and
init failed e.g. due to unlikely racy update or
sometimes hash table full.
This has caught surprise from many users. So, the commit
  https://github.com/iovisor/bcc/commit/ba64f031f2435aad5a85f8f37dbbe2a982cbbe6b
attempts to remove the early return in map.lookup_or_init().
But then since NULL pointer could be returned,
user will need to change their bpf program to check return value,
otherwise, verifier will reject the program.

As described in the above, such an API behavior change may cause
verifier failure and reject previously loadable bpf programs.
bcc should try to maintain API stability, esp. to avoid subtle
API behavior change.

This patch propose to restore the behavior of map.lookup_or_init()
and introduce a new one map.lookup_or_try_init(), which will
avoid unexpected return. The name is suggested by Alexei
to reflect that init may fail. map.lookup_or_try_init() will be formally
documented and used in bcc. A warning will be generated if
map.lookup_or_init() is used. Documentation will make it clear
that map.lookup_or_try_init() is preferred over map.lookup_or_init().

```
-bash-4.4$ sudo ./syscount.py
/virtual/main.c:71:11: warning: lookup_or_init() may return from the function, use loopup_or_try_init() instead.
    val = data.lookup_or_init(&key, &zero);
          ^
1 warning generated.
Tracing syscalls, printing top 10... Ctrl+C to quit.
...
```

All uses in examples and tools are converted to use
lookup_or_try_init(). Most tests are converted to use
lookup_or_try_init() too except test_trace_maxactive.py
and test_tracepoint.py to test lookup_or_init()
functionality.

remove the warning for map.lookup_or_init() (#2581)

Commit 82f4302a651a ("introduce map.lookup_or_try_init()")
introduced new API map.lookup_or_try_init(). A compile time
warning is introduced if old map.lookup_or_init() is used
to discourage the usage.

The API is still supported and documentation already
recommends using the new one. So let us drop the
warning.

Signed-off-by: Yonghong Song <yhs@fb.com>

fix typos in tutorial.md (#2584)

fix typos in tutorial.md

Support attaching uprobe to offset (#2585)

* Support attaching uprobe to offset
* C++ API support of attaching uprobe to offset
* Update document of attach_uprobe()
   The document is taken from src/python/bcc/__init__.py:attach_upobe()

tools/tcpretrans: add tracepoint support (#2574)

If tracepoint tcp:tcp_retransmit_skb exists (kernel version >= 4.15)
we use tracepoint instead of kprobe for efficiency.

Co-authored-by: Runlong Lin <linrunlong@bytedance.com>

Add libbcc-no-libbpf.so library

Which links libbpf.so dynamicaly, instead of its current
static inclusion in libbcc.so.

The compilation needs to define CMAKE_USE_LIBBPF_PACKAGE
variable to enable search for libbpf package. If the package
is found it is used to build all the bcc libs.

The libbcc.so and libbcc_bpf.so (and their static versions)
remain the same.

The new library libbcc-no-libbpf.so is built from all libcc.so
sources including libbpf_bcc.so's sources: libbpf.c perf_reader.c
and dynamically linked to libbpf.so library.

With libbcc-no-libbpf.so symbols are versioned, so there's
no chance of being mixed:

Symbols exported from libbpf.so:

  $ objdump -T /usr/lib64/libbpf.so | grep bpf_map_lookup_elem
  0000000000006df0 g    DF .text  000000000000006e  LIBBPF_0.0.1 bpf_map_lookup_elem
  0000000000006e60 g    DF .text  0000000000000076  LIBBPF_0.0.2 bpf_map_lookup_elem_flags

Symbol needed by libbcc-no-libbpf.so:

  $ objdump -T /opt/bcc/lib64/libbcc-no-libbpf.so | grep bpf_map_lookup_elem
  0000000000000000      DF *UND*  0000000000000000  LIBBPF_0.0.1 bpf_map_lookup_elem

Symbols exported by current libbcc.so:

  $ objdump -T /opt/bcc/lib64/libbcc.so | grep bpf_map_lookup_elem
  00000000023ad843 g    DF .text  0000000000000082  Base        bpf_map_lookup_elem_flags
  00000000023ad7d3 g    DF .text  0000000000000070  Base        bpf_map_lookup_elem

Besides that it's better to share common source of libbpf code,
it also prevents issues when having application that links to
libbpf and libbcc, where you could end up conflicting functions
and segfaults if those 2 libbpf libs are not on the same version.

All installed libraries now:

  total 259096
  lrwxrwxrwx. 1 root root        15 Nov  8 15:24 libbcc_bpf.so -> libbcc_bpf.so.0
  lrwxrwxrwx. 1 root root        20 Nov  8 15:24 libbcc_bpf.so.0 -> libbcc_bpf.so.0.11.0
  -rwxr-xr-x. 1 root root    453416 Nov 11 17:03 libbcc_bpf.so.0.11.0
  lrwxrwxrwx. 1 root root        21 Nov  8 15:24 libbcc-no-libbpf.so -> libbcc-no-libbpf.so.0
  lrwxrwxrwx. 1 root root        26 Nov  8 15:24 libbcc-no-libbpf.so.0 -> libbcc-no-libbpf.so.0.11.0
  -rwxr-xr-x. 1 root root 132276312 Nov 11 17:04 libbcc-no-libbpf.so.0.11.0
  lrwxrwxrwx. 1 root root        11 Nov  8 15:24 libbcc.so -> libbcc.so.0
  lrwxrwxrwx. 1 root root        16 Nov  8 15:24 libbcc.so.0 -> libbcc.so.0.11.0
  -rwxr-xr-x. 1 root root 132579280 Nov 11 17:04 libbcc.so.0.11.0
  drwxr-xr-x. 2 root root        23 Nov 11 21:49 pkgconfig

Signed-off-by: Jiri Olsa jolsa@kernel.org

Link test_libbcc directly with libbcc.so

Linking with bcc-shared will use all the libraries in bcc-shared
which compose libbcc, instead of libbcc.so dynamic link.

Signed-off-by: Jiri Olsa jolsa@kernel.org

Add test_libbcc_no_libbpf test

It's the same code as for test_libbcc test,
but linked with libbcc-no-libbpf.so library.

Added LIBBCC_NAME macro to be used in dynamic loader
test where we need to provide the library name.

Signed-off-by: Jiri Olsa jolsa@kernel.org

Add a supplementary explanation to function `get_syscall_fnname` (#2593)

* add a supplementary explanation to function `get_syscall_fnname`.
* fix the contents

sync with latest libbpf (#2594)

The following helpers are sync'ed into bcc and will
be available in linux 5.5.
  bpf_probe_read_kernel
  bpf_probe_read_kernel_str
  bpf_probe_read_user
  bpf_probe_read_user_str

Signed-off-by: Yonghong Song <yhs@fb.com>

add BPF::init_usdt function to init a single USDT so folks can handle partial init failure of list of USDTs.

modify BPF::init so that failure doesn't leave the BPF object in a broken state such that subsequent inits will also fail

add tool: compactsnoop

docs/reference_guide.md: update doc

virtual_bpf.h instead of bpf.h
src/cc/compat/linux/bpf.h -> src/cc/compat/linux/virtual_bpf.h

docs: update XDP driver list

There are a few more drivers supporting XDP now.

Signed-off-by: Gary Lin <glin@suse.com>

fix a bug in mountsnoop.py with 4.17+ kernels

in 4.17+ kernels, syscall parameters are wrapped in the first
parammeter in pt_regs. So put the 5th parameter in the
syscall__ parameter list so it can be handled properly
by the rewriter.

Signed-off-by: Yonghong Song <yhs@fb.com>

Include stddef.h for size_t in bcc_elf.h

Signed-off-by: Masanori Misono <m.misono760@gmail.com>

Add lockstat tool

Adding lockstat tool to trace kernel mutex lock events and
display locks statistics and displays following data:

                                  Caller   Avg Spin  Count   Max spin Total spin
                      psi_avgs_work+0x2e       3675      5       5468      18379
                     flush_to_ldisc+0x22       2833      2       4210       5667
                       n_tty_write+0x30c       3914      1       3914       3914
                               isig+0x5d       2390      1       2390       2390
                   tty_buffer_flush+0x2a       1604      1       1604       1604
                      commit_echoes+0x22       1400      1       1400       1400
          n_tty_receive_buf_common+0x3b9       1399      1       1399       1399

                                  Caller   Avg Hold  Count   Max hold Total hold
                     flush_to_ldisc+0x22      42558      2      76135      85116
                      psi_avgs_work+0x2e      14821      5      20446      74106
          n_tty_receive_buf_common+0x3b9      12300      1      12300      12300
                       n_tty_write+0x30c      10712      1      10712      10712
                               isig+0x5d       3362      1       3362       3362
                   tty_buffer_flush+0x2a       3078      1       3078       3078
                      commit_echoes+0x22       3017      1       3017       3017

Every caller to using kernel's mutex is displayed on every line.

First portion of lines show the lock acquiring data, showing the amount
of time it took to acquired given lock.

  'Caller'       - symbol acquiring the mutex
  'Average Spin' - average time to acquire the mutex
  'Count'        - number of times mutex was acquired
  'Max spin'     - maximum time to acquire the mutex
  'Total spin'   - total time spent in acquiring the mutex

Second portion of lines show the lock holding data, showing the amount
of time it took to hold given lock.

  'Caller'       - symbol holding the mutex
  'Average Hold' - average time mutex was held
  'Count'        - number of times mutex was held
  'Max hold'     - maximum time mutex was held
  'Total hold'   - total time spent in holding the mutex

This works by tracing mutex_lock/unlock kprobes, udating the lock stats
in maps and processing them in the python part.

Examples:
    lockstats                           # trace system wide
    lockstats -d 5                      # trace for 5 seconds only
    lockstats -i 5                      # display stats every 5 seconds
    lockstats -p 123                    # trace locks for PID 123
    lockstats -t 321                    # trace locks for PID 321
    lockstats -c pipe_                  # display stats only for lock callers with 'pipe_' substring
    lockstats -S acq_count              # sort lock acquired results on acquired count
    lockstats -S hld_total              # sort lock held results on total held time
    lockstats -S acq_count,hld_total    # combination of above
    lockstats -n 3                      # display 3 locks
    lockstats -s 3                      # display 3 levels of stack

Signed-off-by: Jiri Olsa <jolsa@kernel.org>

make TRY2 macro work outside of ebpf namespace (#2604)

make TRY2 macro work outside of ebpf namespace

Make StatusTuple code and msg methods const (#2603)

I ran into this while trying to write a method that takes a const StatusTuple reference, these methods should be marked const. I also fixed an unnecessary string copy in msg.

update INSTALL.md for new llvm source compilation

clang/llvm has moved from old svn with git mirror to
github based source control. The new github address is
  https://github.com/llvm/llvm-project
which includes clang, llvm and other related projects.

This patch updated instruction how to build clang/llvm library
with new llvm-project setup.

Signed-off-by: Yonghong Song <yhs@fb.com>

tools/runqslower.py: Fix raw tracepoint code

Closes: #2588

It is was observed that many unrelated process names
were reported for the same pid.

The cause of the bug was the use of bpf_get_current_comm()
which operates on the current process which might already be
different than the 'next' task we captured.
The fix is to use bpf_probe_read_str() instead.

Also removing dead code related to tgid extraction which is not
used at all.

docs: update helper functions of BPF_PROG_TYPE_SOCKET_FILTER

Signed-off-by: Masanori Misono <m.misono760@gmail.com>

Add map-in-map support

Add BPF_MAP_TYPE_HASH_OF_MAPS and BPF_MAP_TYPE_HASH_OF_MAPS
supports in bcc. Two new constructs below are introduced
to bpf program:
  BPF_HASH_OF_MAPS(map_name, "inner_map_name", max_entries)
  BPF_ARRAY_OF_MAPS(map_name, "inner_map_name", max_entries)
In the above, "inner_map_name" is for metadata purpose and there
must be a map defined in bpf program with map name "inner_map_name".

Both python and C++ APIs are added.

For python, a new Table API get_fd() is introduced to get
the fd of a map so that the fd can be used by a map-in-map
do update. The get_fd() is already exposed as API function
in C++. For C++, without get_fd(), we will need to
templatize basic functions like update_value etc, which
I feed too heavy weight. Because of C++ using get_fd()
mechanism, so I exposed similar API on python side
for parity reason.

For map-in-map, the inner map lookup/update/delete won't have
explicit map names. Considering map-in-map is not
used very frequently, I feel looking primitive
bpf_map_{lookup,update,delete}_elem() probably okay,
so I did not create any new bcc specific
constructs for this purpose.

Added both C++ and python test cases to show how to
use the above two new map type in bcc.

Signed-off-by: Yonghong Song <yhs@fb.com>

Do not traverse attributes during JSON generation (Fixes #2605)

Previously, __attribute__((aligned(sizeof(...)))) would cause the type
inside sizeof() to be appended after the JSON type information for the
struct in some clang versions, generating invalid JSON. Inhibit
attribute traversal, since we only want to visit the fields.

do not use BPF_F_REUSE_STACKID incorrectly

Do not use BPF_F_REUSE_STACKID if the stack id is used
together with process specific info like
pid/tgid/comm. Using BPF_F_REUSE_STACKID may cause
stack id pointing to a different stack later on.

Signed-off-by: Yonghong Song <yhs@fb.com>

fix bug for lockstat.py #347 (#2618)

fix bug for lockstat.py with map keys in stack instead of map value in
order to run in older kernels.

Support a BPF program larger than BPF_MAXINSNS

A privileged user can load bpf program whose size is at most
BPF_COMPLEXITY_LIMIT_INSNS (which is larger than BPF_MAXINSNS) in Linux 5.3
(https://github.com/torvalds/linux/commit/c04c0d2b968ac45d6ef020316808ef6c82325a82).
Currently, however, `bcc_prog_load_xattr()` return error if  a bpf
program size is larger than BPF_MAXINSNS before loading the program. To
cope with this, change the function so that first trying to load a bpf
program and print an error message if bpf_program_load_xattr() fails
with -E2BIG.  This strategy is the same as libbpf's `load_program`
(https://github.com/libbpf/libbpf/blob/9ef191ea7dca6815e75dab341f2f7a346d979c66/src/libbpf.c#L3792)
The Error message should use BPF_COMPLEXITY_LIMIT_INSNS when
appropriate, but it is not defined in uapi headers yet.

Signed-off-by: Masanori Misono <m.misono760@gmail.com>

Use integer types for enums in JSON (Fixes #2615)

The JSON generated for enums wasn't being handled, and caused
exceptions. Since the enum values aren't needed (and would've been
useless without the associated numerical values, anyway), just use the
matching integer type instead.

Use libbpf-static instead of libbpf-debugsource for CMAKE_USE_LIBBPF_PACKAGE

Currently when building with CMAKE_USE_LIBBPF_PACKAGE we assume
that 'source' package is available to build libbcc_bpf libraries.

However It turned on that using debugsource (in Fedora) package is
not suitable or even possible, so we are switching to use the
libbpf-static package instead.

Adding libbpf-static package detection and removing source
package detection.

Using ar to extract objects from archive and linking them
with both libbcc_bpf.so and libbcc_bpf.a.

Using always uapi headers from the latest libbpf Github repo,
because there are not packaged, but they are backwards compatible,
so it's no problem to have older libbpf package with newer
uapi headers.

Signed-off-by: Jiri Olsa <jolsa@kernel.org>

man: fix the field of filetop

In the man pages of filetop, the field of FILE is missing

Signed-off-by: Kenta Tada <Kenta.Tada@sony.com>

man: fix the explanation of filename

Below filenames currently come from dentry->d_name.name
* btrfsslower
* ext4slower
* fileslower
* nfsslower
* xfsslower
* zfsslower

Signed-off-by: Kenta Tada <Kenta.Tada@sony.com>

Correction to Usage text.

man: fix a reference to runqlat in runqslower man page

The runqslower man page obviously derived from the man page of
runqlat. It seems that a reference to runqlat in the NAME section has
been overlooked.

rename tool lockstat.py to klockstat.py

The current lockstat.py is tracing three kernel functions
  mutex_lock_enter(), mutex_unlock_enter(), mutex_lock_return()
for kernel locking statistics.

There are some other efforts trying to get user lock stats by
tracing e.g. pthread locking primitives. For example,
Sasha Goldshtein's linux-tracing-workshop
   https://github.com/goldshtn/linux-tracing-workshop
is referenced in bcc/docs/tutorial_bcc_python_developer.md.
It has a tool called lockstat.py which traces pthread_mutex_init
to collect some lock statistics for userspace locks.

In bcc, in the past, we also had an effort to gather userspace
lock statistics with the same name lockstat.py.
   https://github.com/iovisor/bcc/pull/1268

In the future, bcc could have a lockstat tool tracing userspace
locks. So let us rename the current lockstat.py to klockstat.py
to clearly express its scope.

remove inproper usage of BPF_F_REUSE_STACKID in examples

When the application bundles stack id with process specific
info (like pid, comm, etc.), BPF_F_REUSE_STACKID should not
be used as it may associate wrong stack with processes.

This patch corrected several such uses in examples/
directory.

Signed-off-by: Yonghong Song <yhs@fb.com>

tools/trace.py: add process name filtering

porting from opensnoop

Signed-off-by: tty5 <tty.fqq@gmail.com>

tools/trace.py: add msg filter of event

In the normal develop, will produce many event on the same tracepoint,
like do_sys_open, a executable program will open many files but
developer only has interesting on the specific file. So this filter
will
help developer to get their interesting msg

Signed-off-by: tty5 <tty.fqq@gmail.com>

fix a compilation error with latest llvm 10

Two issues:
First, the recent llvm commit "[Alignment][NFC] CreateMemSet use MaybeAlign"
(https://reviews.llvm.org/D71213) changed IR/IRBuilder.h
CreateMemSet() signature which caused the following compilation error:
  [ 16%] Building CXX object src/cc/frontends/b/CMakeFiles/b_frontend.dir/codegen_llvm.cc.o
  /home/yhs/work/bcc/src/cc/frontends/b/codegen_llvm.cc: In member function
  ‘virtual ebpf::StatusTuple ebpf::cc::CodegenLLVM::visit_table_index_expr_node(ebpf::cc::TableIndexExprNode*)’:
  /home/yhs/work/bcc/src/cc/frontends/b/codegen_llvm.cc:824:96: error: no matching function for call to
  ‘llvm::IRBuilder<>::CreateMemSet(llvm::Value*&, llvm::ConstantInt*, llvm::ConstantInt*, int)’
       B.CreateMemSet(leaf_ptr, B.getInt8(0), B.getInt64(n->table_->leaf_id()->bit_width_ >> 3), 1);
                                                                                                ^
  ....
  /home/yhs/work/llvm-project/llvm/build/install/include/llvm/IR/IRBuilder.h:460:13: note: candidate:
  llvm::CallInst* llvm::IRBuilderBase::CreateMemSet(llvm::Value*, llvm::Value*, llvm::Value*,
  llvm::MaybeAlign, bool, llvm::MDNode*, llvm::MDNode*, llvm::MDNode*)
     CallInst *CreateMemSet(Value *Ptr, Value *Val, Value *Size, MaybeAlign Align,
               ^~~~~~~~~~~~
  /home/yhs/work/llvm-project/llvm/build/install/include/llvm/IR/IRBuilder.h:460:13: note:
  no known conversion for argument 4 from ‘int’ to ‘llvm::MaybeAlign’

Second, the commit "[OpenMP][NFCI] Introduce llvm/IR/OpenMPConstants.h"
(https://reviews.llvm.org/D69853) introduced a new library "FrontendOpenMP"
which is used by clang Parser, and caused the following errors:
  [ 99%] Building CXX object tests/cc/CMakeFiles/test_libbcc.dir/test_hash_table.cc.o
  /home/yhs/work/llvm-project/llvm/build/install/lib/libclangParse.a(ParseOpenMP.cpp.o): In function
  `clang::Parser::ParseOpenMPDeclareReductionDirective(clang::AccessSpecifier)':
  ParseOpenMP.cpp:(.text._ZN5clang6Parser36ParseOpenMPDeclareReductionDirectiveENS_15AccessSpecifierE+0x86):
  undefined reference to `llvm::omp::getOpenMPDirectiveName(llvm::omp::Directive)'

This patch fixed both issues and bcc can compile with latest llvm 10.

sync with latest libbpf

sync with latest upstream libbpf version 0.0.6.

debian changelog for v0.12.0 tag

the main changes from v0.11.0 to v0.12.0 tag:
  * Support for kernel up to 5.4
  * klockstat tool to track kernel mutex lock statistics
  * cmake option CMAKE_USE_LIBBPF_PACKAGE to build a bcc shared library
    linking with distro libbpf_static.a
  * new map.lookup_or_try_init() API to remove hidden return in
    map.lookup_or_init()
  * BPF_ARRAY_OF_MAPS and BPF_HASH_OF_MAPS support
  * support symbol offset for uprobe in both C++ and python API,
    kprobe already has the support
  * bug fixes for trace.py, tcpretrans.py, runqslower.py, etc.

Signed-off-by: Yonghong Song <yhs@fb.com>

Fix s390 kprobes support

Ever since Linux kernel commit aa0d6e70d, kprobes on s390 could no longer
be found due to a change in symbol names.
Symptom:
  $ ./tools/execsnoop.py
  cannot attach kprobe, probe entry may not exist
  [...]

Signed-off-by: Stefan Raspl <raspl@linux.ibm.com>

fix -h output for --sort option

This fixes a regression from c2b371d56b8bbaf9c7d01b88830193ecd1ee4e12 where the author forgot to update the help output.

Improve wording on how latency is measured

klockstat: fix caller filter

- args.caller needs to be bytes not string
- clarify man page a bit

Remove kretprobe__ prefix from program names

Such prefixes are currently removed for kprobes, tracepoints, and raw
tracepoints, but not for kretprobes.  This commit removes it for
kretprobe as well, for consistency.

Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>

tools: cgroup filtering in execsnoop/opensnoop

Add a new option --cgroupmap in execsnoop and opensnoop to only display
results from processes that belong to one of the cgroups whose id,
returned by bpf_get_current_cgroup_id(), is in a pinned BPF hash map.

Examples of commands:
    # opensnoop --cgroupmap /sys/fs/bpf/test01
    # execsnoop --cgroupmap /sys/fs/bpf/test01

Cgroup ids can be discovered in userspace by the system call
name_to_handle_at(); an example of C program doing that is available in
examples/cgroupid/cgroupid.c.

More complete documentation is added in docs/filtering_by_cgroups.md

The documentation is independent from Kubernetes. However, my goal is to
use this feature in Kubernetes: I am preparing to use this in Inspektor
Gadget to select specific Kubernetes pods, depending on a Kubernetes
label selector. Kubernetes pods matching the label selector can come and
go during the execution of the bcc tools; Inspektor Gadget is updating
the BPF hash map used by the bcc tools accordingly.

sync with latest libbpf

also add dependency of zlib in a couple of places
as libbpf starts to use zlib directly.

Signed-off-by: Yonghong Song <yhs@fb.com>

tools/trace.py: flush stdout for each event

change version.cmake to check all tags

Fix issue #2666

Currently, in master where latest tag is v0.12.0,
the build still says is it v0.11.0.

  [ben@centos bcc]$ cd build/
  [ben@centos build]$ cmake .. -DCMAKE_INSTALL_PREFIX=/usr
  -- Latest recognized Git tag is v0.11.0

The reason is the git_describe by default only checks
annotated tag while tag v0.12.0 is tagged through
github release process which just tags whatever the
top of the master.

Making git_describe to check all tags fixed the issue.

Signed-off-by: Yonghong Song <yhs@fb.com>

man: fix required kernel version in man pages

Several man pages state that Linux 4.5 is required because the tool
relies on the bpf_perf_event_output helper.  However,
bpf_perf_event_output was introduced in Linux 4.4.

In addition, mountsnoop requires Linux 4.8 because it now uses
the bpf_get_current_task helper.

Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>

fix libbpf_uapi path typo

A typo occured in libbpf_uapi path from src/cc/CMakeLists.txt which
made compat linux uapi headers failed to copy.

Signed-off-by: Caspar Zhang <caspar@linux.alibaba.com>

Package static archives, closes #1938

This should help embed libbcc into bpftrace:

* https://github.com/iovisor/bpftrace/issues/342

As well as other tools like ebpf_exporter, so that there is no longer
a requirement to have a particular version libbcc installed.

fix test_map_in_map.cc compilation error

fix issue #2679 where test_map_in_map.cc has a
compilation error on ppc64le due to conflicting
type __u64. Let us just remove the typedef.

Signed-off-by: Yonghong Song <yhs@fb.com>

sanitize btf VAR and DATASEC types

bcc does not use these types yet. Let us sanitize them
with int/void-pointer types so old kernels can continue
to work with latest llvm compiler.

Signed-off-by: Yonghong Song <yhs@fb.com>

tools/runqslower.py: Option for --pid or --tid (#2635)

* tools/runqslower.py: Option for --pid or --tid

Closes: #2607

Option for --pid or --tid tracing.
Enable group leader level tracing.
* --pid <pid>:
    will trace every task that has <pid> as group leader.
    Meaning it will trace the parent and its direct children.
* --tid <tid>:
    will trace the given thread
* Reporting TID instead of PID in the report column.
* Update the example file to reflect the TID/PID change

support BPF_MAP_TYPE_SK_STORAGE map

kernel sk local storage is introduced at 5.2.
  https://github.com/torvalds/linux/commit/6ac99e8f23d4b10258406ca0dd7bffca5f31da9d
this patch supports BPF_MAP_TYPE_SK_STORAGE in bcc.
tested C++ user space APIs and loading of the bpf programs
using helpers map.sk_storage_get() and map.sk_storage_delete().

Signed-off-by: Yonghong Song <yhs@fb.com>

tools/offcputime.py: Redundatn arg check

pid/tid is already set to be mutually exclusive in
python's arg parser so no need for this check manually.

Links to 3 articles on Linux tracing using bcc

rewriter: Fix tracking of pointers with several indirections

The rewriter tracks, with nb_derefs, the number of indirections of
external pointers, to rewrite only the appropriate dereference into a call
to bpf_probe_read.

In ProbeChecker, however, nb_derefs has a different meaning: it counts
the number of dereferences encountered.  This difference resulted in an
error when ProbeChecker is traversing the right-hand side of an
assignment.  This commit fixes the error and adds tests for the two
cases of assignments: when the right-hand side is an external pointer
with several indirection levels and when it is a call to a function
returning an external pointer with several indirection levels.

This commit also changes ProbeSetter and assignsExtPtr to count
dereferences instead of addrof in an effort to use nb_derefs more
consistently across the code to mean "number of dereferences needed to get
to the external pointer".

Signed-off-by: Paul Chaignon <paul.chaignon@orange.com>

Add Ubuntu Eon incompatibility note

Packages are currently broken on Ubuntu Eon. See #2676 and #2678.

Ubuntu Eon build dependencies and version numbers

- Add updated list of dependencies to build on Ubuntu Eon (19.10)
- Add Ubuntu version numbers for increased clarity
- Capitalize release names to match official branding

avoid complex expression in struct member initializer

Some old compiler may complain about this. Let us only use simple expression.

Signed-off-by: Yonghong Song <yhs@fb.com>

Fix a bunch of typos (#2693)

fix a bunch of types in man pages, docs, tools, tests, src and examples.

update usage of MCInstPrinter printInst() for llvm10 (#2696)

docs: add BPF trampoline to the kernel features

Signed-off-by: Gary Lin <glin@suse.com>

Secure Boot:  physical keypress to disable lockdown

Ubuntu 19.10 with secure boot enabled doesn't allow the kernel lockdown to be lifted by echo, even from root:
```
# echo 1 > /proc/sys/kernel/sysrq
# echo x > /proc/sysrq-trigger
```
dmesg says:
```
This sysrq operation is disabled from userspace.
```

I pressed Alt-PrtScr-x and that worked:
```
sysrq: Disabling Secure Boot restrictions
Lifting lockdown
```

I can now run eBPF tools, such as execsnoop-bpfcc.

sanitize BTF_KIND_FUNC

The llvm patch https://reviews.llvm.org/D71638 extends
BTF_KIND_FUNC to include scope of the function,
static, global and extern, with btf_type->info vlen
encoding since vlen is always 0 before the extension.

This patch did the sanitization so that the
bcc with latest llvm can still work on older kernels.

Signed-off-by: Yonghong Song <yhs@fb.com>

sync with latest libbpf repo

sync with latest libbpf repo upto the following commit:
  https://github.com/libbpf/libbpf/commit/868739519894fbf2cdb81f1f9222f1b665670096

Signed-off-by: Yonghong Song <yhs@fb.com>

Fix CentOS 6 support.

CentOS 6 support was added in #1504 and inadvertently reverted in #1763
leading to builds failing due to undefined reference to "clock_gettime".

To re-add support for building on CentOS 6 and keep binary size down,
only add librt to the list of target_link_libraries to allow
"clock_gettime" to be resolved.

bpflist: list only real bpf objects

The regular expression '.*bpf-(\\w+)' used to grep for bpf objects would also
list regular files. For example, a process like `vim /tmp/bpf-woo` would be
listed in the output and the type of the BPF object will be 'woo'. Fix this
by correcting the regular expression.

Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>

bpflist: use smarter print format

BPF object type can be wider than 8 characters, e.g., for the "raw-tracepoint"
type.  Compute the printing format automatically based on the maximum length of
BPF objects to be listed.

Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>

fix llvm compilation error

The following changes from llvm 10
  https://github.com/llvm/llvm-project/commit/6fdd6a7b3f696972edc244488f59532d05136a27#diff-37c83c70858df19cb097e36b13b7c112
changed MCDisassembler::getInstruction() signature.
Do the corresponding change in bcc_debug.cc to fix the issue.

Signed-off-by: Yonghong Song <yhs@fb.com>

docs: Remove a redundant space

Signed-off-by: Masanori Misono <m.misono760@gmail.com>

sync with latest libbpf repo

sync libbpf submodule upto the following commit:
    commit 033ad7ee78e8f266fdd27ee2675090ccf4402f3f
    Author: Andrii Nakryiko <andriin@fb.com>
    Date:   Fri Jan 17 16:22:23 2020 -0800

        sync: latest libbpf changes from kernel

Signed-off-by: Yonghong Song <yhs@fb.com>

Remove  from list of AUR packages

Initial support for using github actions

This uses Github's new Actions framework to build and test bcc

Debug with tmate