Fix all the found instances of declaring loop variable inside for() construct,
which is not supported in C89 standard, which is what libbpf-tools are trying
to adhere to, both in user-space and BPF source code. It actually causes
compilation errors on some versions of GCC, as reported by customers in
private conversations.

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>

Add device driver/name filter for virtiostat.

Suggested by Yonghong, also use bpf_probe_read_kernel_str to copy
string from kernel.

Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>

When buildiing kernel with GCC10 [2] in Debian on an Arm64 machine, it was
found the new "inter-procedural optimization improvements" [1] makes symbol
name 'finish_task_switch' changed to 'finish_task_switch.isra.0'.

Details:
The results, when built with gcc 9.3:
nm ../linux.buildout/kernel/sched/core.o | grep finish_task_switch
0000000000001288 t finish_task_switch

However, when built with gcc 10.2:
nm ../linux.buildout/kernel/sched/core.o | grep finish_task_switch
00000000000012d0 t finish_task_switch.isra.0

The same symbols (with xxx.isra.0 or without, respectively of course) also
appear in final file 'System.map' and in '/proc/kallsyms' when booting. This
negatively impact the tracing tools commonly used in kernel debugging, such
as bcc tools offcputime and runqlat. They hardcode 'finish_task_switch'
(without the .isra.0 suffix) into their scripts.

This patch fix the issue by changing the hardcoded 'finish_task_switch' string
to a python regular expression pattern who can match both the traditional form
'finish_task_switch' and the new gcc10 form 'finish_task_switch.isra.0'
(with single digit at the end). attach_kprobe()'s input parameter 'event_re'
is used for this type of pattern matching.

[1] https://gcc.gnu.org/gcc-10/changes.html


[2] ARCH=arm64 make Image

Signed-off-by: Guodong Xu <guodong.xu@linaro.org>

The adress of struct sock, which are used as the map key, are often
reused. When it happens random duration appears in the MS field for
new connections (CLOSE->SYN_SENT and LISTEN->SYN_RECV
transitions). Let's forget about the socket when the connection is
closed.

Signed-off-by: Wenbo Zhang <ethercflow@gmail.com>

Signed-off-by: yeya24 <yb532204897@gmail.com>

add option to include 'LPORT' in tcpconnect otuput and
update man page for tcpconnect and add examples

Otherwise the `make` fails with lack of `FlexLexer.h` error.

On my ARM64 kernel 5.4 case

Symbol:
ffffffc0100820b8 T __irqentry_text_end
ffffffc0100820b8 T __irqentry_text_start

It will ignore all functions after __irqentry_text_start until __irqentry_text_end.
But this case __irqentry_text_end is before __irqentry_text_start.
So the problem happens.

Signed-off-by: Edward Wu <edwardwu@realtek.com>

This is a port of BCC's funclatency.  Usage:

---------
Time functions and print latency as a histogram

Usage: funclatency [-h] [-m|-u] [-p PID] [-d DURATION] [ -i INTERVAL ]
                   [-T] FUNCTION
       Choices for FUNCTION: FUNCTION         (kprobe)
                             LIBRARY:FUNCTION (uprobe a library in -p PID)
                             :FUNCTION        (uprobe the binary of -p PID)

  -m, --milliseconds         Output in milliseconds
  -u, --microseconds         Output in microseconds
  -p, --pid=PID              Process ID to trace
  -d, --duration=DURATION    Duration to trace
  -i, --interval=INTERVAL    Summary interval in seconds
  -T, --timestamp            Print timestamp

  -?, --help                 Give this help list
      --usage                Give a short usage message
  -V, --version              Print program version

Mandatory or optional arguments to long options are also mandatory or optional
for any corresponding short options.

Examples:
  ./funclatency do_sys_open         # time the do_sys_open() kernel function
  ./funclatency -m do_nanosleep     # time do_nanosleep(), in milliseconds
  ./funclatency -u vfs_read         # time vfs_read(), in microseconds
  ./funclatency -p 181 vfs_read     # time process 181 only
  ./funclatency -p 181 c:read       # time the read() C library function
  ./funclatency -p 181 :foo         # time foo() from pid 181's userspace
  ./funclatency -i 2 -d 10 vfs_read # output every 2 seconds, for 10s
  ./funclatency -mTi 5 vfs_read     # output every 5 seconds, with timestamps

---------

It supports kprobes and has limited support for uprobes.  Currently, you
cannot uprobe a library unless you provide a PID.  It does not support
wildcard patterns.

Some of the functions for uprobes are useful for other programs, so I
put those in uprobe_helpers.{c,h}.

Signed-off-by: Barret Rhoden <brho@google.com>

Upstream (llvm13) patch
  https://reviews.llvm.org/D97223


changed function signature for CreateAtomicRMW().
The error message:
  /home/yhs/work/bcc/src/cc/frontends/b/codegen_llvm.cc:
     In member function ‘ebpf::StatusTuple ebpf::cc::CodegenLLVM
        ::emit_atomic_add(ebpf::cc::MethodCallExprNode*)’:
  /home/yhs/work/bcc/src/cc/frontends/b/codegen_llvm.cc:720:75:
     error: no matching function for call to
        ‘llvm::IRBuilder<>::CreateAtomicRMW(llvm::AtomicRMWInst::BinOp,
         llvm::Value*&, llvm::Value*&, llvm:: AtomicOrdering)’
       AtomicRMWInst::Add, lhs, rhs, AtomicOrdering::SequentiallyConsistent);
                                                                           ^
  In file included from /home/yhs/work/bcc/src/cc/frontends/b/codegen_llvm.cc:31:
  /home/yhs/work/llvm-project/llvm/build/install/include/llvm/IR/IRBuilder.h:1721:18:
      note: candidate:
  ‘llvm::AtomicRMWInst* llvm::IRBuilderBase::CreateAtomicRMW(llvm::AtomicRMWInst::BinOp,
      llvm::Value*, llvm::Value*, llvm::MaybeAlign, llvm::AtomicOrdering,
      llvm::SyncScope::ID)’
   AtomicRMWInst *CreateAtomicRMW(AtomicRMWInst::BinOp Op, Value *Ptr,
                  ^~~~~~~~~~~~~~~
  /home/yhs/work/llvm-project/llvm/build/install/include/llvm/IR/IRBuilder.h:1721:18: note:
  candidate expects 6 arguments, 4 provided

Fixed the issue with correct arguments.

Signed-off-by: Yonghong Song <yhs@fb.com>

Commit 95c9229e replaced the
blk_account_io_completion kprobe with blk_account_io_done. Unfortunately
the req->__data_len field is 0 in blk_account_io_done, therefore we need
to save the __data_len field in blk_start_request

Resolves #3099

Signed-off-by: Wenbo Zhang <ethercflow@gmail.com>

The current install steps for Debian from source is out of date,
use the distribution name sid instead of jessie, stretch, buster
due to the latter always change, update and simplify the install
steps like other distributions which is clear and always right.

Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>

Systemtap defines argument size as either 1, 2, 4, or 8 bytes
signed or unsigned. Thus the constant variable should be stored in
a long long instead of an int to ensure at least 8 bytes size.

It's required by BCC. Opted to make it built-in rather than a module in the snippet.

For usdt with semaphore, user needs to provide pid in order
to create a usdt since enabling semaphore requires write to
virtual memory of the user process.

For attachment to corresponding usdt uprobe, we can pass
valid pid to perf_event_open() syscall so usdt is only
triggered for this process, or pass pid -1 permits usdt is
to triggered for all processes.

There are use cases for usdt to be triggered for other
processes than just one process. For example, for python
usdt function__entry/function__return, users may want to
trace usdt of a particular python process and all its
children processes.

C++ already has API to permit ignoring pid during attachment.
   attach_usdt(const USDT& usdt, pid_t pid = -1)
This patch added similar functionality to python with an
additional parameter to BPF constructor to indicate whether
attach_usdt can ignore pid or not.

Signed-off-by: Yonghong Song <yhs@fb.com>

* add bpf_map_lookup_and_delete_batch in bcc
* add test_map_batch_ops.py to test batch lookup and delete on map
* add items_lookup_and_delete_batch() in the reference guide

Add a new tool virtiostat to trace VIRTIO devices IO statistics.

Although we have already had iostat(to show block device statistics),
iftop(to show network device statistics), other devices of VIRTIO
family(Ex, console, balloon, GPU and so on) also need tools for each
type. virtiostat works in virtio lower layer, and it could trace all
the devices.

Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>

Commit 12107c69 ("use correct arch register for the
4th param of x86_64 syscalls") tries to use proper syscall
specific registers on x86_64 as its 4th param for syscall
is different from non-syscall. Unfortunately, the
implementation also uses syscall arch. register
for non-syscall kernel functions, which is incorrect.

This patch fixed the issue by using syscall arch
registers only for syscalls.

Reported-by: zhenwei pi <pizhenwei@bytedance.com>
Fixes: 12107c69 ("use correct arch register for the 4th param of x86_64 syscalls")
Signed-off-by: Yonghong Song <yhs@fb.com>

slabtoprate fails on 5.10 kernels because of a missing kasan_reset_tag
declaration. We need to include the kasan header file.

Fixes the following error:
In file included from /virtual/main.c:12:
include/linux/slub_def.h:181:27: warning: implicit declaration of function 'kasan_reset_tag' is invalid in C99 [-Wimplicit-function-declaration]
        return reciprocal_divide(kasan_reset_tag(obj) - addr,
                                 ^
include/linux/slub_def.h:181:48: error: invalid operands to binary expression ('int' and 'void *')
        return reciprocal_divide(kasan_reset_tag(obj) - addr,
                                 ~~~~~~~~~~~~~~~~~~~~ ^ ~~~~
1 warning and 1 error generated.
Traceback (most recent call last):
  File "/usr/share/bcc/tools/slabratetop", line 115, in <module>
    b = BPF(text=bpf_text)
  File "/usr/lib/python3.9/site-packages/bcc/__init__.py", line 364, in __init__
    raise Exception("Failed to compile BPF module %s" % (src_file or "<text>"))
Exception: Failed to compile BPF module <text>

it was something like: "Unable to enable USDT %sprovider:probe from binary  PID 1234 for
probe handle_probe"

that kernel bug is fixed in 4.8-rc3 and what broke there is fixed in 4.8.10
according to https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.10

Add vmlinux.h for arm64 (aarch64) and powerpc (ppc64le) architectures.
Makefile already normalizes aarch64 -> arm64 and ppc64le -> powerpc, so no
adjustments are necessary.

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>

Move vmlinux.h header into a per-architecture subdirectory to allow
architecture-specific builds of libbpf-tools.

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>

Signed-off-by: Wenbo Zhang <ethercflow@gmail.com>

Signed-off-by: Wenbo Zhang <ethercflow@gmail.com>

Signed-off-by: Wenbo Zhang <ethercflow@gmail.com>

Meet the following compiler error:
/mnt/trace-tools/eBPF/bcc/src/cc/frontends/clang/b_frontend_action.cc:
In member function bool
ebpf::BTypeVisitor::VisitVarDecl(clang::VarDecl*):]
/mnt/trace-tools/eBPF/bcc/src/cc/frontends/clang/b_frontend_action.cc:1449:18:
error: BPF_MAP_TYPE_RINGBUF was not declared in this scope; did you mean
BPF_MAP_TYPE_QUEUE?
1449 | map_type = BPF_MAP_TYPE_RINGBUF; | ^~~~~~~~~~~~~~~~~~~~ |
     BPF_MAP_TYPE_QUEUE
make[2]: ***  [src/cc/frontends/clang/CMakeFiles/clang_frontend.dir/build.make:95:
rc/cc/frontends/clang/CMakeFiles/clang_frontend.dir/b_frontend_action.cc.o] Error 1
make[1]: *** [CMakeFiles/Makefile2:1065: src/cc/frontends/clang/CMakeFiles/clang_frontend.dir/all] Error 2
make: *** [Makefile:160: all] Error 2

This because, submodule libbpf can't sync when do cmake.
So enlarger the sync contion: only submodule is clean, we do sync
submodle when do cmake.

Signed-off-by: Jianpeng Ma <jianpeng.ma@intel.com>

We plan to put those tools in separate rpm,
so we need a way to install them.

Adding install target with standard DESTDIR
and prefix make variables.

Signed-off-by: Jiri Olsa <jolsa@kernel.org>

wakeuptime currently uses kprobes to trace schedule(). Switch to using
tracepoints if available.

Also, in some builds, try_to_wake_up() may get optimized away causing
the script to fail altogether.

With this switch, we however see stack trace entries related to BPF too
in the end for each trace. While correct, it takes up screen real estate
for each backtrace.

    target:          InputThread
    ffffffffaf000107 secondary_startup_64_no_verify
    ffffffffb12495f1 start_kernel
    ffffffffaf10e609 cpu_startup_entry
    ffffffffaf10e40b do_idle
    ffffffffaf946849 cpuidle_enter
    ffffffffaf946577 cpuidle_enter_state
    ffffffffafc00d02 asm_sysvec_apic_timer_interrupt
    ffffffffafbbbc86 sysvec_apic_timer_interrupt
    ffffffffaf0dcc32 irq_exit_rcu
    ffffffffaf02bc47 do_softirq_own_stack
    ffffffffafc01112 asm_call_irq_on_stack
    ffffffffafe000ca __softirqentry_text_start
    ffffffffaf163a66 run_timer_softirq
    ffffffffaf1639df __run_timers.part.0
    ffffffffaf162f09 call_timer_fn
    ffffffffaf8c46c3 input_repeat_key
    ffffffffaf8c318e input_pass_values.part.0
    ffffffffaf8c2085 input_to_handler
    ffffffffaf8c9e81 evdev_events
    ffffffffaf124a1c __wake_up_common_lock
    ffffffffaf1248b0 __wake_up_common
    ffffffffaf375e49 ep_poll_callback
    ffffffffaf124a1c __wake_up_common_lock
    ffffffffaf1248b0 __wake_up_common
    ffffffffaf375e0d ep_poll_callback
    ffffffffaf124a1c __wake_up_common_lock
    ffffffffaf1248b0 __wake_up_common
    ffffffffaf124681 autoremove_wake_function
    ffffffffaf108e57 try_to_wake_up
    ffffffffaf107dcc ttwu_do_wakeup
    ffffffffaf1f48a2 bpf_trace_run1
    ffffffffc16879d3 ftrace_trampoline
    ffffffffaf1f51c9 bpf_get_stackid_raw_tp
    waker:           swapper/0
        169325

Fix the test_libbcc/test_libbcc_no_libbpf testcase failure when the kernel version is lower than 4.20

[root@openEuler bcc]# cd src/lua/
[root@openEuler lua]# ./bcc-lua ../../../examples/lua/offcputime.lua -d 1 >/dev/null 2>/dev/null
[root@openEuler lua]# ./bcc-lua ../../../examples/lua/offcputime.lua -d 1
./bcc-lua: cannot open ../../../examples/lua/offcputime.lua: No such file or directory
stack traceback:
        [C]: in function 'dofile'
        bcc.lua:6338: in function <bcc.lua:6288>
        [C]: at 0x557532f676b0
[root@openEuler lua]#