It helps to decode an address family in Go frontend
generated by bpf2go tool, here is an example
https://github.com/marselester/libbpf-tools/blob/master/cmd/tcpconnect/main.go

Signed-off-by: Hengqi Chen <chenhengqi@outlook.com>

Signed-off-by: Hengqi Chen <chenhengqi@outlook.com>

Signed-off-by: Hengqi Chen <chenhengqi@outlook.com>

Signed-off-by: Hengqi Chen <chenhengqi@outlook.com>

Add LIBBPF_OBJ dependence to `%.o'.

When libbpf-tools built in parallel (with `make -j`) sometimes
`map_helpers.o' is built before `libbpf.a' causing build error:

  $ make -j8 -C libbpf-tools BPFTOOL=/usr/sbin/bpftool
  ...
  make: Entering directory '/usr/src/RPM/BUILD/bcc-0.19.0/libbpf-tools'
    CC       map_helpers.o
  In file included from map_helpers.c:7:
  ./map_helpers.h:6:10: fatal error: 'bpf/bpf.h' file not found
	   ^~~~~~~~~~~
  1 error generated.
  ...
  make: Leaving directory '/usr/src/RPM/BUILD/bcc-0.19.0/libbpf-tools'
    INSTALL  bpf.h libbpf.h btf.h xsk.h libbpf_util.h bpf_helpers.h bpf_helper_defs.h bpf_tracing.h bpf_endian.h bpf_core_read.h libbpf_common.h
  ...
    INSTALL  libbpf.a
  error: Bad exit status from /usr/src/tmp/rpm-tmp.63536 (%build)

Fixes: #3412
Signed-off-by: Vitaly Chikunov <vt@altlinux.org>

aarch64 has no open syscall, do not attempt to trace it.

Fixes #3344.

Signed-off-by: Hengqi Chen <chenhengqi@outlook.com>

Signed-off-by: chenhengqi <chenhengqi@outlook.com>

Signed-off-by: AnyISalIn <anyisalin@gmail.com>

On Fedora builds we can check the version number and add
build and runtime dependencies to debuginfod for all
currently supported releases (>= 32). Note that the buildbot
only has Fedora 25-28 so it will not try to build libbcc
with debuginfod support as the required packages are not
available on these releases.

For .deb packages there is no easy way to add dependencies
dynamically, so we do not add dependencies to libdebuginfod
there for now. For documentation purposes, however, let's
add a comment indicating which changes are required for
libdebuginfod support for downstream maintainers.

Signed-off-by: Andreas Ziegler <andreas.ziegler@fau.de>

This change adds debuginfod as a new source for debug
information. By using libdebuginfod we can query a server
for a file containing debug information for a given ELF
binary. The environment variable DEBUGINFOD_URLS has to
be defined to an URL for a debuginfod server providing
debug information files for your distribution or the
federating server provided by the elfutils project:

For example, to use the Fedora server, you would need:
$ export DEBUGINFOD_URLS="https://debuginfod.fedoraproject.org/"

Or for the elfutils server which federates to servers for
openSUSE, Void Linux, Debian and Fedora, among others:
$ export DEBUGINFOD_URLS="https://debuginfod.elfutils.org/

"

Calls to the debuginfod_find_debuginfo function from
libdebuginfod will fail if the environment variable is not
set, otherwise the library will attempt to download debug
information for a build ID extracted from the binary in
question and store it in a local cache directory.

Fixes iovisor/bpftrace#1774

Signed-off-by: Andreas Ziegler <andreas.ziegler@fau.de>

Signed-off-by: Hengqi Chen <chenhengqi@outlook.com>

  * Support for kernel up to 5.12
  * Some basic support for MIPS
  * added bpf_map_lookup_batch and bpf_map_delete_batch support
  * tools/funclatency.py support nested or recursive functions
  * tools/biolatency.py can optionally print out average/total value
  * fix possible marco HAVE_BUILTIN_BSWAP redefine warning for kernel >= 5.10.
  * new tools: virtiostat
  * new libbpf-tools: ext4dist
  * doc update and bug fixes

Signed-off-by: Yonghong Song <yhs@fb.com>

MCContext and InitMCObjectFileInfo name/signatures
are changed due to upstream patch
  https://reviews.llvm.org/D101462


Adjust related codes in bcc_debug.cc properly to resolve
the compilation error for llvm13.

Signed-off-by: Yonghong Song <yhs@fb.com>

sync submodule libbpf repo to the following commit:
  c5389a965bc3 sync: latest libbpf changes from kernel

Signed-off-by: Yonghong Song <yhs@fb.com>

Use fentry like vfsstat.py when it is available.

Signed-off-by: Kenta Tada <Kenta.Tada@sony.com>

The intent of #3391 was to have `bpf_workaround.h` included after
`bpf.h` when compiling bcc headers. However, that PR only added the file
to the `headers_` map of files that can be included. To actually
include, need to adjust compiler input flags as well.

Fixes: d089013e ("Move HAVE_BUILTIN_BSWAP includes to separate header")

Signed-off-by: Wenbo Zhang <ethercflow@gmail.com>

As reported in #3366, on newer kernels bcc complains about macro
redefinition when compiling bpf programs:

```
include/linux/compiler-clang.h:46:9: warning: '__HAVE_BUILTIN_BSWAP64__' macro redefined [-Wmacro-redefined]
\#define __HAVE_BUILTIN_BSWAP64__
        ^
<command line>:5:9: note: previous definition is here
\#define __HAVE_BUILTIN_BSWAP64__ 1
```

Since these macros are passed in as `-D` cflags, they appear first
before any \#define statements in code. Since an [upstream kernel
patch](https://lore.kernel.org/linux-csky/20210226161151.2629097-1-arnd@kernel.org/)
added these defines in a kernel header, we see the warning.

This patch moves these definitions to a separate 'virtual' header that's included
after virtual_bpf.h and adds an ifndef guard. As a result, newer kernels
with the patch will not trigger the warning, while older kernels will
not lose the definition.

This should be safe based on my digging - some existing bcc programs use
`__builtin_bswap` methods, but without checking HAVE_BUILTIN_BSWAP.
Macros that may be conditionally defined based on HAVE_BUILTIN_BSWAP,
like those in `bpf_endian.h`, aren't. If a similar macro or struct def
in virtual_bpf.h - or any header it pulls in - changes depending on
HAVE_BUILTIN_BSWAP this could cause problems on older kernels, but I
don't believe that this is the case, or will be based on how
infrequently the defines are checked.

Support create a new map and pin it if the pinned file is not available.

Co-authored-by: chenyue.zhou <chenyue.zhou@upai.com>

This reverts commit cda7acdb.

This will tigger ugly compilation macro redefined warnings:
  $ sudo ./biolatency.py
  In file included from /virtual/main.c:3:
  In file included from include/linux/blkdev.h:5:
  In file included from include/linux/sched.h:12:
  In file included from arch/x86/include/asm/current.h:6:
  In file included from arch/x86/include/asm/percpu.h:45:
  include/linux/kernel.h:992:9: warning: 'container_of' macro redefined [-Wmacro-redefined]
  #define container_of(ptr, type, member) ({                              \
          ^
  /virtual/include/bcc/helpers.h:48:9: note: previous definition is here
  #define container_of(ptr, type, member)                         \
          ^
  1 warning generated.
  Tracing block device I/O... Hit Ctrl-C to end.
Revert now and let us design how to support it better. For example, may
create a different header file to put common kernel macros there to be
used by the program.

Signed-off-by: Yonghong Song <yhs@fb.com>

This commit enhances the items_delete_batch() function by accepting a ct.Array instead of a Python list.
This way, the array does not need to be re-created, allowing to directly perform the requested operation.

Signed-off-by: Simone Magnani <simonemagnani.96@gmail.com>

This commit aims at introducing items_update_batch, batch operation to update multiple key-value pairs at the same time.
Doc has been updated accordingly, and a test is provided.

Signed-off-by: Simone Magnani <simonemagnani.96@gmail.com>

This commit introduces the self.max_entries attribute both into Queue/Stack maps and to all those whwqo extend TableBase

Signed-off-by: Simone Magnani <simonemagnani.96@gmail.com>

This commit introduces the possibility to iterate over all elements of a Queue/Stack.
To avoid infinite loop, a maximum of MAX_ENTRIES pop() are performed

Signed-off-by: Simone Magnani <simonemagnani.96@gmail.com>

Sometimes log2 range is not enough for throughput tuning.
Especially a little difference in performance downgrade.

Also, this extension uses two bpf helper bpf_map_lookup_elem().
It's a cost on embedded system, therefore it's better to be an option.

Signed-off-by: Edward Wu <edwardwu@realtek.com>

Since commit 75f20a15 ("Use string type for comparison to PATH
elements"), src_file isn't working anymore. Somehow, two wrongs
(ArgString __str__() returning a bytes object and joining a bytes and
what was supposed to be a string) did make a right.

It fixes the following error in netqtop and deadlock:
Traceback (most recent call last):
  File "/usr/share/bcc/tools/netqtop", line 207, in <module>
    b = BPF(src_file = EBPF_FILE)
  File "/usr/lib/python3.6/site-packages/bcc/__init__.py", line 335, in __init__
    src_file = BPF._find_file(src_file)
  File "/usr/lib/python3.6/site-packages/bcc/__init__.py", line 255, in _find_file
    t = b"/".join([os.path.abspath(os.path.dirname(argv0.__str__())), filename])
TypeError: sequence item 0: expected a bytes-like object, str found

BUG:
funclatency memcpy -i 2
     nsecs               : count     distribution
         0 -> 1          : 0        |                                        |
         2 -> 3          : 0        |                                        |
         4 -> 7          : 0        |                                        |
         8 -> 15         : 0        |                                        |
        16 -> 31         : 0        |                                        |
        32 -> 63         : 0        |                                        |
        64 -> 127        : 0        |                                        |
       128 -> 255        : 0        |                                        |
       256 -> 511        : 0        |                                        |
       512 -> 1023       : 0        |                                        |
      1024 -> 2047       : 0        |                                        |
      2048 -> 4095       : 28       |************                            |
      4096 -> 8191       : 92       |****************************************|

avg = 4265 nsecs, total: 9413985 nsecs, count: 2207

     nsecs               : count     distribution
         0 -> 1          : 0        |                                        |
         2 -> 3          : 0        |                                        |
         4 -> 7          : 0        |                                        |
         8 -> 15         : 0        |                                        |
        16 -> 31         : 0        |                                        |
        32 -> 63         : 0        |                                        |
        64 -> 127        : 0        |                                        |
       128 -> 255        : 0        |                                        |
       256 -> 511        : 0        |                                        |
       512 -> 1023       : 0        |                                        |
      1024 -> 2047       : 0        |                                        |
      2048 -> 4095       : 38       |******                                  |
      4096 -> 8191       : 248      |****************************************|

avg = 4304 nsecs, total: 11066321 nsecs, count: 2571

After long-run, you can see the count above is totally wrong.

Also, display together before together clearing is important for better accuracy.

Signed-off-by: Edward Wu <edwardwu@realtek.com>

This is useful when BPFStackTable is used by a long running program to
limit the memory usage, by removing the cached symbols of an exited
process.

These are two common kernel macros to manipulate data
structures. Let us add them to helpers.h so bpf program
can use them.

Signed-off-by: Yonghong Song <yhs@fb.com>

 . add bpf_map_lookup_batch and bpf_map_delete_batch in bcc
 . add test_map_batch_ops.py to test batch lookup and delete on map
 . add items_lookup_batch() and items_delete_batch() in the reference guide
 . add keys as an optional argument to items_delete_batch

* Fix the check of the existence of module BTFs
* Initialize the global variable

Signed-off-by: Kenta Tada <Kenta.Tada@sony.com>

Signed-off-by: Wenbo Zhang <ethercflow@gmail.com>