Signed-off-by: Hengqi Chen <chenhengqi@outlook.com>

libbcc.so is actually installed to /usr/lib64 instead of
/usr/local/lib in my computer system:

$ find /usr -name libbcc.so
/usr/lib64/libbcc.so

And also we can find out bcc-python:

$ find /usr/lib -name bcc
/usr/lib/python2.7/site-packages/bcc

It is better to use one line command to export environment
variable LD_LIBRARY_PATH and PYTHONPATH.

Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>

Signed-off-by: Wenbo Zhang <ethercflow@gmail.com>

Fix all the found instances of declaring loop variable inside for() construct,
which is not supported in C89 standard, which is what libbpf-tools are trying
to adhere to, both in user-space and BPF source code. It actually causes
compilation errors on some versions of GCC, as reported by customers in
private conversations.

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>

Add device driver/name filter for virtiostat.

Suggested by Yonghong, also use bpf_probe_read_kernel_str to copy
string from kernel.

Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>

When buildiing kernel with GCC10 [2] in Debian on an Arm64 machine, it was
found the new "inter-procedural optimization improvements" [1] makes symbol
name 'finish_task_switch' changed to 'finish_task_switch.isra.0'.

Details:
The results, when built with gcc 9.3:
nm ../linux.buildout/kernel/sched/core.o | grep finish_task_switch
0000000000001288 t finish_task_switch

However, when built with gcc 10.2:
nm ../linux.buildout/kernel/sched/core.o | grep finish_task_switch
00000000000012d0 t finish_task_switch.isra.0

The same symbols (with xxx.isra.0 or without, respectively of course) also
appear in final file 'System.map' and in '/proc/kallsyms' when booting. This
negatively impact the tracing tools commonly used in kernel debugging, such
as bcc tools offcputime and runqlat. They hardcode 'finish_task_switch'
(without the .isra.0 suffix) into their scripts.

This patch fix the issue by changing the hardcoded 'finish_task_switch' string
to a python regular expression pattern who can match both the traditional form
'finish_task_switch' and the new gcc10 form 'finish_task_switch.isra.0'
(with single digit at the end). attach_kprobe()'s input parameter 'event_re'
is used for this type of pattern matching.

[1] https://gcc.gnu.org/gcc-10/changes.html


[2] ARCH=arm64 make Image

Signed-off-by: Guodong Xu <guodong.xu@linaro.org>

The adress of struct sock, which are used as the map key, are often
reused. When it happens random duration appears in the MS field for
new connections (CLOSE->SYN_SENT and LISTEN->SYN_RECV
transitions). Let's forget about the socket when the connection is
closed.

Signed-off-by: Wenbo Zhang <ethercflow@gmail.com>

Signed-off-by: yeya24 <yb532204897@gmail.com>

add option to include 'LPORT' in tcpconnect otuput and
update man page for tcpconnect and add examples

Otherwise the `make` fails with lack of `FlexLexer.h` error.

On my ARM64 kernel 5.4 case

Symbol:
ffffffc0100820b8 T __irqentry_text_end
ffffffc0100820b8 T __irqentry_text_start

It will ignore all functions after __irqentry_text_start until __irqentry_text_end.
But this case __irqentry_text_end is before __irqentry_text_start.
So the problem happens.

Signed-off-by: Edward Wu <edwardwu@realtek.com>

This is a port of BCC's funclatency.  Usage:

---------
Time functions and print latency as a histogram

Usage: funclatency [-h] [-m|-u] [-p PID] [-d DURATION] [ -i INTERVAL ]
                   [-T] FUNCTION
       Choices for FUNCTION: FUNCTION         (kprobe)
                             LIBRARY:FUNCTION (uprobe a library in -p PID)
                             :FUNCTION        (uprobe the binary of -p PID)

  -m, --milliseconds         Output in milliseconds
  -u, --microseconds         Output in microseconds
  -p, --pid=PID              Process ID to trace
  -d, --duration=DURATION    Duration to trace
  -i, --interval=INTERVAL    Summary interval in seconds
  -T, --timestamp            Print timestamp

  -?, --help                 Give this help list
      --usage                Give a short usage message
  -V, --version              Print program version

Mandatory or optional arguments to long options are also mandatory or optional
for any corresponding short options.

Examples:
  ./funclatency do_sys_open         # time the do_sys_open() kernel function
  ./funclatency -m do_nanosleep     # time do_nanosleep(), in milliseconds
  ./funclatency -u vfs_read         # time vfs_read(), in microseconds
  ./funclatency -p 181 vfs_read     # time process 181 only
  ./funclatency -p 181 c:read       # time the read() C library function
  ./funclatency -p 181 :foo         # time foo() from pid 181's userspace
  ./funclatency -i 2 -d 10 vfs_read # output every 2 seconds, for 10s
  ./funclatency -mTi 5 vfs_read     # output every 5 seconds, with timestamps

---------

It supports kprobes and has limited support for uprobes.  Currently, you
cannot uprobe a library unless you provide a PID.  It does not support
wildcard patterns.

Some of the functions for uprobes are useful for other programs, so I
put those in uprobe_helpers.{c,h}.

Signed-off-by: Barret Rhoden <brho@google.com>

Upstream (llvm13) patch
  https://reviews.llvm.org/D97223


changed function signature for CreateAtomicRMW().
The error message:
  /home/yhs/work/bcc/src/cc/frontends/b/codegen_llvm.cc:
     In member function ‘ebpf::StatusTuple ebpf::cc::CodegenLLVM
        ::emit_atomic_add(ebpf::cc::MethodCallExprNode*)’:
  /home/yhs/work/bcc/src/cc/frontends/b/codegen_llvm.cc:720:75:
     error: no matching function for call to
        ‘llvm::IRBuilder<>::CreateAtomicRMW(llvm::AtomicRMWInst::BinOp,
         llvm::Value*&, llvm::Value*&, llvm:: AtomicOrdering)’
       AtomicRMWInst::Add, lhs, rhs, AtomicOrdering::SequentiallyConsistent);
                                                                           ^
  In file included from /home/yhs/work/bcc/src/cc/frontends/b/codegen_llvm.cc:31:
  /home/yhs/work/llvm-project/llvm/build/install/include/llvm/IR/IRBuilder.h:1721:18:
      note: candidate:
  ‘llvm::AtomicRMWInst* llvm::IRBuilderBase::CreateAtomicRMW(llvm::AtomicRMWInst::BinOp,
      llvm::Value*, llvm::Value*, llvm::MaybeAlign, llvm::AtomicOrdering,
      llvm::SyncScope::ID)’
   AtomicRMWInst *CreateAtomicRMW(AtomicRMWInst::BinOp Op, Value *Ptr,
                  ^~~~~~~~~~~~~~~
  /home/yhs/work/llvm-project/llvm/build/install/include/llvm/IR/IRBuilder.h:1721:18: note:
  candidate expects 6 arguments, 4 provided

Fixed the issue with correct arguments.

Signed-off-by: Yonghong Song <yhs@fb.com>

Commit 95c9229e replaced the
blk_account_io_completion kprobe with blk_account_io_done. Unfortunately
the req->__data_len field is 0 in blk_account_io_done, therefore we need
to save the __data_len field in blk_start_request

Resolves #3099

Signed-off-by: Wenbo Zhang <ethercflow@gmail.com>

The current install steps for Debian from source is out of date,
use the distribution name sid instead of jessie, stretch, buster
due to the latter always change, update and simplify the install
steps like other distributions which is clear and always right.

Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>

Systemtap defines argument size as either 1, 2, 4, or 8 bytes
signed or unsigned. Thus the constant variable should be stored in
a long long instead of an int to ensure at least 8 bytes size.

It's required by BCC. Opted to make it built-in rather than a module in the snippet.

For usdt with semaphore, user needs to provide pid in order
to create a usdt since enabling semaphore requires write to
virtual memory of the user process.

For attachment to corresponding usdt uprobe, we can pass
valid pid to perf_event_open() syscall so usdt is only
triggered for this process, or pass pid -1 permits usdt is
to triggered for all processes.

There are use cases for usdt to be triggered for other
processes than just one process. For example, for python
usdt function__entry/function__return, users may want to
trace usdt of a particular python process and all its
children processes.

C++ already has API to permit ignoring pid during attachment.
   attach_usdt(const USDT& usdt, pid_t pid = -1)
This patch added similar functionality to python with an
additional parameter to BPF constructor to indicate whether
attach_usdt can ignore pid or not.

Signed-off-by: Yonghong Song <yhs@fb.com>

* add bpf_map_lookup_and_delete_batch in bcc
* add test_map_batch_ops.py to test batch lookup and delete on map
* add items_lookup_and_delete_batch() in the reference guide

Add a new tool virtiostat to trace VIRTIO devices IO statistics.

Although we have already had iostat(to show block device statistics),
iftop(to show network device statistics), other devices of VIRTIO
family(Ex, console, balloon, GPU and so on) also need tools for each
type. virtiostat works in virtio lower layer, and it could trace all
the devices.

Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>

Commit 12107c69 ("use correct arch register for the
4th param of x86_64 syscalls") tries to use proper syscall
specific registers on x86_64 as its 4th param for syscall
is different from non-syscall. Unfortunately, the
implementation also uses syscall arch. register
for non-syscall kernel functions, which is incorrect.

This patch fixed the issue by using syscall arch
registers only for syscalls.

Reported-by: zhenwei pi <pizhenwei@bytedance.com>
Fixes: 12107c69 ("use correct arch register for the 4th param of x86_64 syscalls")
Signed-off-by: Yonghong Song <yhs@fb.com>

slabtoprate fails on 5.10 kernels because of a missing kasan_reset_tag
declaration. We need to include the kasan header file.

Fixes the following error:
In file included from /virtual/main.c:12:
include/linux/slub_def.h:181:27: warning: implicit declaration of function 'kasan_reset_tag' is invalid in C99 [-Wimplicit-function-declaration]
        return reciprocal_divide(kasan_reset_tag(obj) - addr,
                                 ^
include/linux/slub_def.h:181:48: error: invalid operands to binary expression ('int' and 'void *')
        return reciprocal_divide(kasan_reset_tag(obj) - addr,
                                 ~~~~~~~~~~~~~~~~~~~~ ^ ~~~~
1 warning and 1 error generated.
Traceback (most recent call last):
  File "/usr/share/bcc/tools/slabratetop", line 115, in <module>
    b = BPF(text=bpf_text)
  File "/usr/lib/python3.9/site-packages/bcc/__init__.py", line 364, in __init__
    raise Exception("Failed to compile BPF module %s" % (src_file or "<text>"))
Exception: Failed to compile BPF module <text>

it was something like: "Unable to enable USDT %sprovider:probe from binary  PID 1234 for
probe handle_probe"

that kernel bug is fixed in 4.8-rc3 and what broke there is fixed in 4.8.10
according to https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.10

Add vmlinux.h for arm64 (aarch64) and powerpc (ppc64le) architectures.
Makefile already normalizes aarch64 -> arm64 and ppc64le -> powerpc, so no
adjustments are necessary.

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>

Move vmlinux.h header into a per-architecture subdirectory to allow
architecture-specific builds of libbpf-tools.

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>

Signed-off-by: Wenbo Zhang <ethercflow@gmail.com>

Signed-off-by: Wenbo Zhang <ethercflow@gmail.com>

Signed-off-by: Wenbo Zhang <ethercflow@gmail.com>

Meet the following compiler error:
/mnt/trace-tools/eBPF/bcc/src/cc/frontends/clang/b_frontend_action.cc:
In member function bool
ebpf::BTypeVisitor::VisitVarDecl(clang::VarDecl*):]
/mnt/trace-tools/eBPF/bcc/src/cc/frontends/clang/b_frontend_action.cc:1449:18:
error: BPF_MAP_TYPE_RINGBUF was not declared in this scope; did you mean
BPF_MAP_TYPE_QUEUE?
1449 | map_type = BPF_MAP_TYPE_RINGBUF; | ^~~~~~~~~~~~~~~~~~~~ |
     BPF_MAP_TYPE_QUEUE
make[2]: ***  [src/cc/frontends/clang/CMakeFiles/clang_frontend.dir/build.make:95:
rc/cc/frontends/clang/CMakeFiles/clang_frontend.dir/b_frontend_action.cc.o] Error 1
make[1]: *** [CMakeFiles/Makefile2:1065: src/cc/frontends/clang/CMakeFiles/clang_frontend.dir/all] Error 2
make: *** [Makefile:160: all] Error 2

This because, submodule libbpf can't sync when do cmake.
So enlarger the sync contion: only submodule is clean, we do sync
submodle when do cmake.

Signed-off-by: Jianpeng Ma <jianpeng.ma@intel.com>

We plan to put those tools in separate rpm,
so we need a way to install them.

Adding install target with standard DESTDIR
and prefix make variables.

Signed-off-by: Jiri Olsa <jolsa@kernel.org>