Changes

Fix ELF ABI and endianness checks for powerpc64

Earlier, it was assumed that ELF ABI v2 is used only on
little-endian powerpc64 environments but it seems this
ABI can be used independently of endianness.

It is expected that any C preprocessor that conforms to
the ELF ABI v2 specification must predefine the _CALL_ELF
macro and set its value to 2.

Instead of looking at __BYTE_ORDER__ to determine whether
to use the Local Entry Point (LEP) of symbols, one should
look at the _CALL_ELF macro instead as this is ABI-related.

Similarly, _CALL_ELF should be used only for determining
the ABI version and not the endianness.

Reported-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Fixes: bbd4180c ("Fix uprobes on powerpc64")
Fixes: 10869523 ("clang: Add support to build eBPF for user specified ARCH")
Acked-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Sandipan Das <sandipan@linux.ibm.com>

bcc: Use bpf_probe_read_user in tools and provide backward compatibility

s390 has overlapping address space for user and kernel. Hence separation of
bpf_probe_read_user and bpf_probe_read_kernel is essential. Commit 6ae08ae3dea2
("bpf: Add probe_read_{user, kernel} and probe_read_{user, kernel}_str
helpers") introduced these changes into the kernel. However, bcc tools does not
respect it.

As a workaround, perform the following:
1. Use bpf_probe_read_user() explicitly in the bcc tools.
2. When kernel version < 5.5, perform the checks if the
   bpf_probe_read_user kernel helper is present in the backported kernel
   as well. If not found, then fallback from bpf_probe_read_user to
   bpf_probe_read.

Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>

bcc: Use direct parameter assignment for syscall probe s390.

1. Commit fa697140f9a2 ("syscalls/x86: Use 'struct pt_regs' based
   syscall calling convention for 64-bit syscalls") changed the raw
   parameter passed to the syscall entry function from a list of
   parameters supplied in user space to a single `pt_regs *` parameter
   (ARCH_HAS_SYSCALL_WRAPPER)

2. But ARCH_HAS_SYSCALL_WRAPPER in s390 is not used for that purpose.
   See commit a18f03cd89e9 ("s390: autogenerate compat syscall
   wrappers")

3. Use direct parameter assignment assumption for s390 syscall probe
   instead.

Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>

bcc/tools: Introduce bpf_probe_read_user to the tools.

This is essential for architecture which do have overlapping address space.
- bpf_probe_read_kernel() shall be used for reading data from kernel space
to the bpf vm.
- bpf_probe_read_user() shall be used for reading data from user space
  to the bpf vm.

Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>

bcc/docs: Add bpf_probe_read_user to docs and tutorials

Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>

bcc/utils: Avoid code duplication of __generate_streq_function

bcc tools like trace.py and argdist.py uses _generate_streq_function()
functions to convert char * read to bpf_probe_read/bpf_probe_read_user.
Refactor it and move the common functionality to utils.py.

Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>

bcc: Add __user attribute to support bpf_probe_read_user in argdist

argdist traces probe functions and its parameter values.

Add functionality to convert:
- All userspace probes char * read to bpf_probe_read_user()
- Syscall/kprobes char* params with __user attribute to bpf_probe_read_user()

Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>

bcc: Support bpf_probe_read_user in trace.py

Arguments of a probe point can be either user pointer or kernel
pointer.

Previously:
- tools/trace.py 'do_sys_open "%s", arg2'
  When reading arg2 as char *, it would resolve to bpf_probe_read.

Now:
- tools/trace.py 'do_sys_open "%s", arg2@user'
  - When reading arg2 as char *, it is resolved to bpf_probe_read_user.
- tools/trace.py 'do_sys_open (STRCMP("test.txt", arg2@user)) "%s", arg2'
  - For arg2 char * read, bpf_probe_read_user is utilized

To distinguish this, add arg@user.
- All userspace probes char *read converted to bpf_probe_read_user
- Syscall/kprobes with arg[1-6]@user attribute are converted to
  bpf_probe_read_user.

Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>

bcc/libbpf: Fix bpf_has_kernel_btf return status

bool returns True for negative integers. Hence bcc tools
tries to switch to kfunc instead of kprobes, even when the
btf data is not found.

For libbpf_find_vmlinux_btf_id, When err <= 0 , btf is not found.

Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>

Add perf event data collection example for an userspace application (#2888)

* Add perf event data collection example for an userspace application
* Add comments for potential issues in perf_event example

Update INSTALL.md

USDT: make path failure message more explicit

Make it clear which file the USDT runtime files to find and suggest a
fix.

add nfs v3 support to nfsdist.py (#2902)

add nfs v3 support to nfsdist.py

Co-authored-by: sabbene <sabbene@sabbene.nvidia.com>

Bug #2907 - Fix argdist filtering option for USDT probes

add -fPIC to compile examples/cpp and tests/cc

I use clang-8.0.1 and gcc-8.3.1 to compile bcc-0.8.1,
without -fPIC, will get errors like this:
/usr/bin/ld: CMakeFiles/test_libbcc.dir/test_libbcc.cc.o: relocation
R_X86_64_32S against symbol `_ZTVN5Catch21LegacyReporterAdapterE' can
not be used when making a PIE object; recompile with -fPIC
/usr/bin/ld: CMakeFiles/test_libbcc.dir/test_c_api.cc.o: relocation
R_X86_64_32 against `.rodata.str1.1' can not be used when making a PIE
object; recompile with -fPIC
/usr/bin/ld: CMakeFiles/CGroupTest.dir/CGroupTest.cc.o: relocation
R_X86_64_32 against `.rodata.str1.8' can not be used when making a PIE
object; recompile with -fPIC

Signed-off-by: Chunmei Xu <xuchunmei@linux.alibaba.com>

libbpf-tools: convert BCC vfsstat to BPF CO-RE version

Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>

Fix github actions tests

Github actions are failing because the docker image used for testing is based
in Ubuntu 19.04 that is EOL now. This commit downgrades the version used for
testing to 18.04 that is LTS. It also installs the "util-linux" package that
includes the "unshare" command.

Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>

tools/dirtop: Adding dirtop utility (#2819)

This tools is about reporting IOs per directory.
That's a clone of filetop but works in a different way :
- user specify a set of globs to select a list of directories to watch
- dirtop extracts the inode_id of the selected directories
- the bpf program receives the list of top directories to consider
- when vfs_{read|write} occurs, the bpf program check
  if one of the parents is part of the list we search for
- if it matches, the io is accounted

On the python side, the program will reconcilate IOs per directory and print stats.

While filetop list the programs and filename, dirtop only list the directory name.

A typical usages looks like :

	[root@host]: dirtop.py -d '/hdfs/uuid/*/yarn'
	14:56:33 loadavg: 52.21 48.81 37.78 53/2721 28720

	READS  WRITES R_Kb     W_Kb     PATH
	36821  7632   238219   149183   /hdfs/uuid/d04fccd8-bc72-4ed9-bda4-c5b6893f1405/yarn
	20823  2      196290   3        /hdfs/uuid/b94cbf3f-76b1-4ced-9043-02d450b9887c/yarn
	16059  12064  109748   85778    /hdfs/uuid/250b21c8-1714-45fe-8c08-d45d0271c6bd/yarn
	14128  20360  106287   81440    /hdfs/uuid/4a833770-767e-43b3-b696-dc98901bce26/yarn
	15883  4991   86014    82075    /hdfs/uuid/0cc3683f-4800-4c73-8075-8d77dc7cf116/yarn
	11182  4485   28834    116917   /hdfs/uuid/7d512fe7-b20d-464c-a75a-dbf8b687ee1c/yarn
	11848  7810   103139   31240    /hdfs/uuid/2c6a7223-cb18-4916-a1b6-8cd02bda1d31/yarn
	10418  1272   114842   18       /hdfs/uuid/76dc0b77-e2fd-4476-818f-2b5c3c452396/yarn
	10066  6630   93969    20218    /hdfs/uuid/c11da291-28de-4a77-873e-44bb452d238b/yarn
	13648  15453  39450    53744    /hdfs/uuid/99c178d5-a209-4af2-8467-7382c7f03c1b/yarn
	9509   2049   31363    48219    /hdfs/uuid/a78f846a-58c4-4d10-a9f5-42f16a6134a0/yarn
	8112   2178   13765    63479    /hdfs/uuid/bf829d08-1455-45b8-81fa-05c3303e8c45/yarn
	4327   0      37544    0        /hdfs/uuid/fada8004-53ff-48df-9396-165d8e42925b/yarn
	2238   2742   72       50       /hdfs/uuid/b3b2a2ed-f6c1-4641-86bf-2989dd932411/yarn
	3716   0      47       0        /hdfs/uuid/8138a53b-b942-44d3-82df-51575f1a3901/yarn

Signed-off-by: Erwan Velu <e.velu@criteo.com>

Co-authored-by: Erwan Velu <e.velu@criteo.com>

libbpf-tools: add CO-RE execsnoop

sync with latest libbpf

Sync with latest libbpf repo. Update virtual_bpf.h,
helpers.h, docs, etc.

Signed-off-by: Yonghong Song <yhs@fb.com>

Fix KFUNC_PROBE return value

The KFUNC_PROBE macro is using "void" as return type, this is causing problems
in some tools that have a filtering enable that returns 0.

Reproducer: (Notice that it requires BTF support)

```
$ python opensnoop.py --pid 5
/virtual/main.c:33:21: error: void function '____kretfunc__do_sys_open' should not return a value [-Wreturn-type]
    if (pid != 5) { return 0; }
                    ^      ~
1 error generated.
...
```

Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>

libbcc-py: Fix libbpf types

1ad2656a1d9c ("Add support_kfunc function to BPF object") added new functions
to libbcc-py but didn't set the restype and argstypes for those. It's causing
the `bpf_has_kernel_btf` function to return True in systems without support
for BTF, making tools like opensnoop, klockstat and any other using kfuncs
unusable in those systems.

The following Python script reproduces the problem:

```
from bcc import BPF
print(BPF.support_kfunc())
```

Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>

bcc/tools: fix typo in help message

tools: add filtering by mount namespace

In previous patches, I added the option --cgroupmap to filter events
belonging to a set of cgroup-v2. Although this approach works fine with
systemd services and containers when cgroup-v2 is enabled, it does not
work with containers when only cgroup-v1 is enabled because
bpf_get_current_cgroup_id() only works with cgroup-v2. It also requires
Linux 4.18 to get this bpf helper function.

This patch adds an additional way to filter by containers, using mount
namespaces.

Note that this does not help with systemd services since they normally
don't create a new mount namespace (unless you set some options like
'ReadOnlyPaths=', see "man 5 systemd.exec").

My goal with this patch is to filter Kubernetes pods, even on
distributions with an older kernel (<4.18) or without cgroup-v2 enabled.

- This is only implemented for tools that already support filtering by
  cgroup id (bindsnoop, capable, execsnoop, profile, tcpaccept, tcpconnect,
  tcptop and tcptracer).

- I picked the mount namespace because the other namespaces could be
  disabled in Kubernetes (e.g. HostNetwork, HostPID, HostIPC).

It can be tested by following the example in docs/special_filtering added
in this commit, to avoid compiling locally the following command can be used

```
sudo bpftool map create /sys/fs/bpf/mnt_ns_set type hash key 8 value 4 \
  entries 128 name mnt_ns_set flags 0
docker run -ti --rm --privileged \
  -v /usr/src:/usr/src -v /lib/modules:/lib/modules \
  -v /sys/fs/bpf:/sys/fs/bpf --pid=host kinvolk/bcc:alban-containers-filters \
  /usr/share/bcc/tools/execsnoop --mntnsmap /sys/fs/bpf/mnt_ns_set

```

Co-authored-by: Alban Crequy <alban@kinvolk.io>
Co-authored-by: Mauricio Vásquez <mauricio@kinvolk.io>

Spelling

(as title)

tool: trace process termination by default

`sched_process_exit` tracepoint is called when thread terminates.
So exitsnoop shows line per each thread termination if the process
is multi-thread process. This is not useful when people wants to
know why process terminates, not thread.

So this changes exitsnoop default behavior which traces process termination
instead of thread termination. And add `--per-thread` option which behaves
as original exitsnoop implementation.

bcc: Error out when bpf_probe_read_user is not present

1. For architecture with overlapping address space, error out when
   bpf_probe_read_user is not available.
2. For arch with non overlapping address space, if bpf_probe_read_user
   is not available bpf_probe_read_user is implicitly converted to
   bpf_probe_read.
3. Use bpf_probe_read_kernel instead of bpf_probe_read. When
   bpf_probe_read_kernel is not available, fallback to bpf_probe_read.
   If bpf_probe_read is not available, then bcc would fail anyways.
4. See kernel commit 0ebeea8ca8a4 ("bpf: Restrict bpf_probe_read{,
   str}() only to archs where they work")

Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>

bcc/tools: Replace bpf_probe_read with bpf_probe_read_kernel

It is recommended to use bpf_probe_read_kernel_{str} in the bpf tools.
See kernel commit 0ebeea8ca8a4 ("bpf: Restrict bpf_probe_read{, str}()
only to archs where they work")

Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>

bcc: Fix user space probe reads with bpf_probe_read_user

User space probe reads should be performed using bpf_probe_read_user.
Fix this in remaining places.

Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>

bcc/libbpf-tools: Replace bpf_probe_read with bpf_probe_read_kernel.

As kernel commit b8ebce86ffe6 ("libbpf: Provide CO-RE variants of
PT_REGS macros") is introduced after bpf_probe_read_kernel changes, it
is safe to use bpf_probe_read_kernel directly

Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>

bcc/libbpf-tools: Fix user probe read references

Replace bpf_probe_read_str with bpf_probe_read_user_str.

Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>

bcc/docs: Replace bpf_probe_read with bpf_probe_read_kernel

Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>

bcc: Check probe read availabilty and use macros

When bpf_probe_read_kernel is not available, then macros are defined at
the prologue to replace bpf_probe_read_kernel to bpf_prob_read. This
resolves the problem of test_probe_read3 failure in test_clang.py for
 #2919

Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>

bcc: Remove bpf_probe_read_user availability checks on compile time

If wrong kernel-headers are installed, then this can provide false
result for probe read selection. Instead look for only kallsyms.

Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>

fix: avoid -Wsign-compare warnings

Add arg for filtering on signal

Update man page and example file

Fix example indent

Make examples consistent

return failure if rewriter cannot rewrite properly

Fix issue #537.

The bcc rewriter does not have enough information to do
proper rewriting from:
  #define PKT_LEN_ADD 1
  ip->tlen += PKT_LEN_ADD;
to
  bpf_dins_pkt(skb, (u64)ip+2, 0, 16, PKT_LEN_ADD);

So instead of generate incorrect code
which caused compilation error. Let return an error
earlier with helper comments so users know what to do.
With this patch, we will have
 /virtual/main.c:20:17: error: cannot have macro at the end of expresssion,
 workaround: put perentheses around macro "(MARCO)"
    ip->tlen += PKT_LEN_ADD;
                ^

Allow to specify kernel include dirs

It's sometimes convenient to use other kernel headers,
now it's possible possible with new KERNEL_INCLUDE_DIRS
build variable, like:

  $ cd <kernel-dir>
  $ make INSTALL_HDR_PATH=/tmp/headers headers_install
  $ cd <bcc-dir>
  $ cmake -DKERNEL_INCLUDE_DIRS=/tmp/headers/include/ ...

Signed-off-by: Jiri Olsa <jolsa@kernel.org>

Adding support to load lsm programs

Adding the 'lsm__' prefix check for loaded program
and set BPF_LSM_MAC as expected_attach_type if the
program name matches.

This way we can load LSM programs via bcc interface.

The program attach can be done by existing kfunc API:
  bpf_attach_kfunc
  bpf_detach_kfunc

It will be used in upcomming bpftrace change that
adds lsm probes.

Signed-off-by: Jiri Olsa <jolsa@kernel.org>

Make reading blacklist from debugfs optional

With lockdown enabled one sees the following:

```
$ sudo /usr/share/bcc/tools/funccount -Ti 1 run_timer_softirq
[Errno 1] Operation not permitted: '/sys/kernel/debug/tracing/../kprobes/blacklist'
```

Which is accompanied by the following in `dmesg`:

```
[Fri May 29 22:12:47 2020] Lockdown: funccount: debugfs access is restricted; see man kernel_lockdown.7
```

Since blacklist is not a required feature, let's make
reading from it optional, so that bcc can work out of the box.

offwaketime: Add support for --state (#2940)

Since offwaketime is really an amalgamation of offcputime and wakeuptime
there is no reason why it shouldn't support the --state argument of the
former.

Co-authored-by: Nikolay Borisov <nborisov@suse.com>

libbpf-tools: convert BCC syscount to BPF CO-RE version

Add a new libbpf-based tool, syscount, and add some helpers which may be used
by other tools. Namely,

  * syscall_helpers.{c,h}: convert system call numbers to names
  * errno_helpers.{c,h}: convert errno names to numbers

The helpers contain pre-generated tables for x86_64 (which will be outdated at
some point, so require to be updated on demand), but for other architectures
require additional tools: syscall helpers require the ausyscall(1) tool, and
errno helpers require errno(1) utility from the moreutils package. So, if you
run on non-x86_64, then either install these tools, or use numeric values.

If possible, use bpf_map_lookup_and_delete_batch function to read and reset
values in the data map.  This is a raceless way to obtain all values.  If the
function is not available, e.g., for old kernels, then fall back to the old
version which can loose some syscalls (happened between reading values and
resetting them).

Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>

tools: Add funcinterval bcc tool.

Time interval between the same function as a histogram.
Referenced from funclatency.

libbpf-tools: add CO-RE cpudist

Signed-off-by: Wenbo Zhang <ethercflow@gmail.com>

silence a python travis-ci warning

The travis-ci flags a python warning:

  $ flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
  ./tools/biolatpcts.py:123:5: F821 undefined name 'die'
      die()
      ^
  1     F821 undefined name 'die'

Let us fix it with proper error message and then exit().

Signed-off-by: Yonghong Song <yhs@fb.com>

Docker: add kmod dependency to docker container

modprobe and rmmod are used to load the kheaders module as a last option
when kernel headers are not found. The modprobe command is missing in the
docker image and scroipts are failing:

$ /usr/share/bcc/tools/execsnoop --mntnsmap /sys/fs/bpf/mnt_ns_set
sh: 1: modprobe: not found
Unable to find kernel headers. Try rebuilding kernel with CONFIG_IKHEADERS=m (module)
...

Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>

turn off x86 jump table optimization during jit compilation

jump table optimization tries to optimize switch statements
into an array access. But such optimization will place certain
information, acted as the array, in the read-only section.
Currently, bcc does not support read-only section, so
jump table optimized code will fail during kernel verification.
This is what happened to biolatpcts.py in my environment with
latest llvm.

  -bash-4.4$ sudo ./biolatpcts.py console
  bpf: Failed to load program: Invalid argument
  unknown opcode 60
  processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

  HINT: The 'unknown opcode' can happen if you reference a global or static variable,
  or data in read-only section. For example, 'char *p = "hello"' will result in p
  referencing a read-only section, and 'char p[] = "hello"' will have "hello" stored on the stack.

This patch disabled jump table optimization on x64. The jump table
optimization is guarded for llvm version 4 and above.
We can disable jump table on other architectures if needed.
A test case, developed based biolatpcts.py tool, is added
to ensure it pass the verifier.

Signed-off-by: Yonghong Song <yhs@fb.com>

Fix runqslower to indicate that the latency param is in microseconds.

usdt: Add helpers to set semaphore values

While debugging a high memory consumption issue in bpftrace, I noticed
that a USDT::Context object can take ~10M per instance [0]. Along with
the new --usdt-file-activation feature in bpftrace
( https://github.com/iovisor/bpftrace/pull/1317 ), bpftrace can
potentially hold onto many dozens of USDT:Context instances, causing
memory issues.

While reducing the amount of memory USDT::Context uses is one option,
we can potentially side step it by allowing the usdt semaphore count to
be set independently. Before, the only way to increment the count (by 1)
is to call bcc_usdt_enable*(). bcc_usdt_enable*() has checks that limit
it to a single increment per context. The only way to decrement the
count is by calling bcc_usdt_close() which naturally only allows for
one decrement.

With independent semaphore helpers, we can avoid holding onto a
USDT::Context instance for the lifetime of the tracing session. We can
simply:

1. create a USDT::Context
2. increment the semaphore count for the probe we care about
3. destroy the USDT::Context
4. repeat 1-3 for all probes we want to attach to
5. do our tracing
6. create a USDT::Context for the probe we care about
7. decrement the semaphore count
8. destroy the USDT::Context
9. repeat 6-8 for all the probes we're attached to

This approach also has the benefit of 1 USDT::Context instance being
alive at a time which can help keep memory high watermark low.

[0]: Through gdb single stepping and /proc/pid/status. Exact process is
not described here b/c memory usage probably varies based on tracee
binary.

usdt: Have Context::addsem_probe() nop if pid not specified

This makes bcc_usdt_addsem*() more consistent with the bcc_usdt_enable*()
interface where if a USDT::Context was not constructed with a pid the
semaphore enablement nops.

Add support for multiple PID/TID for offwaketime (#2951)

Instead of filtering on a single process allow up to 5 pid/tgid to be
used for filtering. The limit of 5 is arbitrary and can be increased
should the need arise. Also remove unnecessary thread_context variable.

Co-authored-by: Nikolay Borisov <nborisov@suse.com>

fix: encode path to bytes in python3

tools/opensnoop: Fix compilation problem

Fix stupid bug introduced by myself.

Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>

libbpf-tools: refactor, move public methods to trace_helpers.c

Signed-off-by: Wenbo Zhang <ethercflow@gmail.com>

deadlock: print a more explicit message when pthread_mutex_unlock can't be attached

Most likely, this happen because of a missing --binary argument. Let's
be friendly to our user and print a more useful messsage.

man: remove non-existent -x argument from tcpconnect man page

There's no -x option in tcpconnect. I don't know how it get into the
man page sysnopsis, but it doesn't belong there.

loader: suggest to install the right kernel devel package

Unfortunately, some package dependency system do not allow to make
sure that the kernel development package installed is the same version
as the running kernel. When this happen, the loader, unable to find
the kernel header, will suggest to rebuild the kernel with
CONFIG_IKHEADERS. For most users, this is probably not an option, but
installing the kernel development package corresponding to the running
kernel version is.

tools: fix a python 3 map issue in dbstat and dbslower

In python 3, map returns an iterator and not a list anymore. This
patch cast the map into a list. It fixes the following error:

$ /usr/share/bcc/tools/dbstat mysql
Traceback (most recent call last):
  File "/usr/share/bcc/tools/dbstat", line 95, in <module>
    bpf = BPF(text=program, usdt_contexts=usdts)
  File "/usr/lib/python3.6/site-packages/bcc/__init__.py", line 339, in __init__
    ctx_array = (ct.c_void_p * len(usdt_contexts))()
TypeError: object of type 'map' has no len()

Fix typos in kretfunc documentation

Fixes an incorrect link to kretfunc documentation section and fixes example to use proper macro

Explicitly use NULL macro in pointer value check (#2965)

 Explicitly use NULL macro in pointer value check
 also updated the tutorial

dbstat: fix overflowing timestamp

The current default value of interval (99999999999) in dbstat is too
high to be used in the sleep() function in python 3. I couldn't find a
authoritative source on the issue, but it seems the max value is
2^63/10^9 (9223372036). Anyway, 99999999 is the de facto standard for
a very big number here, so just use that. It's over 3 years, that
should be enough.

For consistency, I also change a couple of value in klockstat even
though they didn't overflow.

It fixes the following error:
$ dbstat mysql
Tracing database queries for pids  slower than 0 ms...
Traceback (most recent call last):
  File "./dbstat", line 112, in <module>
    sleep(args.interval)
OverflowError: timestamp too large to convert to C _PyTime_t

Add install steps for Alpine Linux

sync with latest libbpf repo

sync with latest libbpf repo, added newer ringbuf_*
helper functions and new csum_level() helper.

Signed-off-by: Yonghong Song <yhs@fb.com>

Add KBUILD_MODNAME flag to default cflags

Delete existing kbuild_modname definitions

sync with libbpf v0.0.9

sync with libbpf version 0.0.9.

Signed-off-by: Yonghong Song <yhs@fb.com>

[BPFTable] clear_table_non_atomic: Remove duplicate macro

Signed-off-by: Gaurav Singh <gaurav1086@gmail.com>

fix LSM_PROBE return value

Fix issue #2976.
The LSM_PROBE program return value is fixed with value 0.
This is not correct. The return value is meaningful for
LSM_PROBE programs. Return proper value provided by the
bpf program itself.

Signed-off-by: Yonghong Song <yhs@fb.com>

API improvements for BPF LSM programs (#2979)

* Enhanced support for LSM programs
- added explicit libbcc support for LSM programs
- added bcc helpers to attach LSM programs
- added bcc helper to indicate kernel support for LSM programs
- added LSM programs to __trace_autoload hook
- removed (now) unnecessary load_func from LSM unit test
- Remove detach_kfunc

Signed-off-by: William Findlay <william@williamfindlay.com>

Add LSM probe documentation (#2980)

 Add LSM documentation
 Add minimum kernel version requirements

prepare for release v0.15.0

added changelog for release v0.15.0

Signed-off-by: Yonghong Song <yhs@fb.com>

libbpf-tools: remove unnecessary header include from syscount.bpf.c

It causes build failure on my system due to trying to include GCC-specific
header. It doesn't seem to be necessary, though, so remove it.

Signed-off-by: Andrii Nakryiko <andriin@fb.com>

Add missing LSM cleanup hook

bpf: use bpf_probe_read in implicitly generated kernel mem read

Currently, bcc rewriter uses bpf_probe_read_kernel() for implicitly specified
kernel memory read. This is not totally correct. Some user memory in kernel
data structure may be accessed. bpf_probe_read_kernel() may fail with
later kernels. Let us revert back to old bpf_probe_read().

Fix kernel version for ringbuf and add ringbuf to maps table

libbpf-tools: add CO-RE bitesize

Signed-off-by: Wenbo Zhang <ethercflow@gmail.com>

tools/profile: fix suggestion about when to increase stack-storage-size

When we do stack traces via stackmaps, hash collisions (-EEXIST) may indicate
that the map size is too small. Not -ENOMEM.

Fix KFUNC_PROBE calls in vfs_stat.py by adding a return value (#2990)

 Fix KFUNC_PROBE calls in vfs_stat.py by adding a return value of 0

Ringbuf Support for Python API (#2989)

This pull request contains an implementation for ringbuf support in bcc's Python API.

Fixes #2985.
 
More specifically, the following are added:
    - ringbuf helpers from libbpf API to libbcc
    - a new RingBuf class to represent the ringbuf map
    - BPF_RINGBUF_OUTPUT macro for BPF programs
    - tests
    - detailed documentation and examples

Introducing Queue/Stack helpers and clang frontend

This commit aims to introduce helpers to declare Queue/Stack maps. I have supported also
the creation of shared/public/pinned ones, as for the "traditional" tables.
In clang frontend I have added both declaration of maps type/queue, type/stack and all the operations
supported so far by these new maps (push/pop/peek).

Possible declarations introduced:

* BPF_QUEUESTACK(<"queue"/"stack">, <name>, <leaf_type>, <max_entries>, <flags>)
* BPF_QUEUESTACK_SHARED(...)
* BPF_QUEUESTACK_PINNED(...)
* BPF_QUEUESTACK_PUBLIC(...)
* BPF_QUEUE(<name>, <leaf_type>, <max_entries>)
* BPF_QUEUE(<name>, <leaf_type>, <max_entries>, <flags>)
* BPF_STACK(<name>, <leaf_type>, <max_entries>)
* BPF_STACK(<name>, <leaf_type>, <max_entries>, <flags>)

Signed-off-by: Simone Magnani <simonemagnani.96@gmail.com>
Co-authored-by: Sebastiano Miano <sebastiano.miano@polito.it>

add BPFQueueStackTable and tests

This commit aims to introduce a new abstraction for these new map types: BPFQueueStackTableBase.
As all the allowed operation on these map types are different from the
"traditional" ones, I thought to introduce a new abstraction, following the
already used programming style (template classes and utility func).
Moreover, I had to update libbpf.h/c to insert the new bpf_map_lookup_and_delete_elem(),
used when calling "pop()"

Signed-off-by: Simone Magnani <simonemagnani.96@gmail.com>

sync with latest libbpf repo

sync with latest libbpf repository

valloc and pvalloc is deprecated in bionic on Android

memleak -p PID will failed on Android
https://android.googlesource.com/platform/bionic/+/master/libc/bionic/malloc_common.cpp#196

Fix symfs symbol resolution

Paths that are passed to find_debug_via_symfs often start with /proc/PID/root/
prefix which is followed by actual path. This breaks symfs symbol resoultion.
Symfs directory usually does not contain proc subdirectory and subdirectories
for each pid.

Here are examples of stack traces I got when tracing dlopen on Android before:
```
7acc558ef8 dlopen+0 (/system/lib64/libdl.so)
7a2222f988 EglThreadState::GetProcAddress(char const*)+64 (/vendor/lib64/egl/libGLESv2_adreno.so)
7ac8e3ecbc eglGetProcAddress+540 (/system/lib64/libEGL.so)
7acb824a58 GrGLMakeAssembledGLESInterface(void*, void (* ()(void, char const*))())+8136 (/system/lib64/libhwui.so)
7acb83a9b0 GrGLCreateNativeInterface()+48 (/system/lib64/libhwui.so)
7acb63443c 0x7acb63443c ([unknown])
7acb9cd33c 0x7acb9cd33c ([unknown])
7acb9cdd70 0x7acb9cdd70 ([unknown])
7acb9c7f20 0x7acb9c7f20 ([unknown])
7acb9cbcc8 0x7acb9cbcc8 ([unknown])
7acb98348c 0x7acb98348c ([unknown])
7acb65da30 0x7acb65da30 ([unknown])
7aca096b84 android::Thread::_threadLoop(void*)+284 (/system/lib64/libutils.so)
7acc2c6288 __pthread_start(void*)+40 (/system/lib64/libc.so)
7acc266500 __start_thread+72 (/system/lib64/libc.so)
```

and after:
```
7acc558ef8 dlopen+0 (/system/lib64/libdl.so)
7a23a2d988 EglThreadState::GetProcAddress(char const*)+64 (/vendor/lib64/egl/libGLESv2_adreno.so)
7ac8e3ecbc eglGetProcAddress+540 (/system/lib64/libEGL.so)
7acb824a58 0x7acb824a58 ([unknown])
7acb83a9b0 GrGLCreateNativeInterface()+48 (/system/lib64/libhwui.so)
7acb63443c android::uirenderer::debug::GlesDriver::getSkiaInterface()+20 (/system/lib64/libhwui.so)
7acb9cd33c android::uirenderer::renderthread::EglManager::initialize()+700 (/system/lib64/libhwui.so)
7acb9cdd70 android::uirenderer::renderthread::EglManager::createSurface(ANativeWindow*, bool)+48 (/system/lib64/libhwui.so)
7acb9c7f20 android::uirenderer::skiapipeline::SkiaOpenGLPipeline::setSurface(android::Surface*, android::uirenderer::renderthread::SwapBehavior, android::uirenderer::renderthread::ColorMode)+88 (/system/lib64/libhwui.so)
7acb9cbcc8 android::uirenderer::renderthread::CanvasContext::setSurface(android::sp<android::Surface>&&)+88 (/system/lib64/libhwui.so)
7acb98348c android::uirenderer::WorkQueue::process()+172 (/system/lib64/libhwui.so)
7acb65da30 0x7acb65da30 ([unknown])
7aca096b84 android::Thread::_threadLoop(void*)+284 (/system/lib64/libutils.so)
7acc2c6288 __pthread_start(void*)+40 (/system/lib64/libc.so)
7acc266500 __start_thread+72 (/system/lib64/libc.so)
```

docs: Add BPF LSM hook to kernel features

Signed-off-by: Gary Lin <glin@suse.com>

docs: Update XDP driver support list

Signed-off-by: Gary Lin <glin@suse.com>

docs: add RISC-V to the JIT support list

Signed-off-by: Gary Lin <glin@suse.com>

add the option --hexdump to sslsniff to allow sniffing of binary protocols inside TLS/SSL connections

fix examples in sslsniff.py

reformat code, add new option to manpage and usage in sslsniff_example.txt

example block of --hexdump in sslsniff_example.txt

docs: fix Ubuntu Eoan spelling

Signed-off-by: Lorenzo Fontana <fontanalorenz@gmail.com>

Replace kprobe function "blk_account_io_completion" to "blk_account_io_done" for kernel version >= 5.8.0

The kernel function "blk_account_io_completion" is not available anymore as attach point of Kprobe as of kernel version 5.8.0. Therefore, after discussions, we decided to use function "blk_account_io_done" instead in every kprobe attachment to "blk_account_io_completion".

memleak: Add workaround to alleviate misjudgments when free is missing

Profiling in memory part is hard to be accurate because of BPF infrastructure.
memleak keeps misjudging memory leak on the complicated environment which has
the action of free in hard/soft irq.

For example, in my misjudged case:

640 bytes in 10 allocations from stack
--
__kmalloc+0x178 [kernel]
__kmalloc+0x178 [kernel]
xhci_urb_enqueue+0x140 [kernel]
usb_hcd_submit_urb+0x5e0 [kernel]

This result looks like kernel doesn't free urb_priv. However, it's not true.
The reason for this leak is because xhci hw irq interrupts during the BPF program.
BPF program is not finished on that CPU, and xhci_irq() will call xhci_urb_free_priv()
before the end. But the kernel doesn't permit this isr to go into BPF program again.
Because BPF infrastructure(trace_call_bpf) denied this action.
So we miss this free action and cause memory leak misjudgment.

Side-effect:
- Increase overhead for each memory allocation.
- A higher chance to be interrupted at the allocation part causes ignore more allocations.

This workaround doesn't solve all misjudgments, the improvement in BPF infrastructure
is the only solution.

sync with latest libbpf

sync with latest libbpf repo

Signed-off-by: Yonghong Song <yhs@fb.com>

libbpf-tools: add header to store BPF-side map helpers

Add a new header kern_map_helpers.h to store BPF-size map helpers
which may be used from different programs. On the moment it contains
the bpf_map_lookup_or_try_init helper.

Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>

libbpf-tools: fix an error message

A wrong argument (-errno) was passed to strerror, fix it.

Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>

libbpf-tools: convert BCC tcpconnect to BPF CO-RE version

Add a new libbpf-based tool, tcpconnect, and add some helpers which may
be used by other tools. Namely, user_map_helpers.{c,h} files implement
a function dump_hash() which uses map_batch_lookup (if possible) to read
entire hash maps to user space.

The tcpconnect acts as the original BCC tool except that --cgroupmap and
--mntnsmap options are not implemented, yet.

Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>

Add .lazy_symbolize field to bcc_symbol_option and add ignored fields to perf_event_attr

Add Python API and documentation for Queue/Stack Tables (#3013)

* Add QueueStack Python API
* Add tests for QueueStack Python API
* Add documentation for QueueStack

use bpf_probe_read_kernel for implicit kernel mem read on s390

Commit f579bf8d60c8 ("bpf: use bpf_probe_read in implicitly
generated kernel mem read") unconditionally use bpf_probe_read()
for implicit kernel memory read in bpf programs.

This won't work for s390 with recent kernels since s390 has
overlap user/kernel addresses and bpf_probe_read() is not
available any more.

This patch partially reverted Commit f579bf8d60c8 such
that for s390, bpf_probe_read_kernel() will be used
while other architectures bpf_probe_read() is used.

Signed-off-by: Yonghong Song <yhs@fb.com>

fix cc queue/stack test kernel version

This commit fixes the Kernel version check in test_queuestack_table.cc .
The correct one, as discussed in #3013, is 4.20 (not 5.0).

Signed-off-by: Simone Magnani <simonemagnani.96@gmail.com>

fix debug file lookup in bcc_elf_symbol_str

Logic for looking up debug file in bcc_elf_symbol_str and foreach_sym_core
differ. This commit factors out relevant code from foreach_sym_core and reuses
it in bcc_elf_symbol_str.

update reference_guide for implicit kmem access rewriting

Update the reference_guide to spell out for implicit
kernel memory access, when rewriter uses bpf_probe_read()
(for non-s390) and when using bpf_probe_read_kernel()
(for s390).

Signed-off-by: Yonghong Song <yhs@fb.com>

libbpf-tools: add CO-RE biolatency

Signed-off-by: Wenbo Zhang <ethercflow@gmail.com>