Signed-off-by: Hengqi Chen <chenhengqi@outlook.com>

This brings in KERNEL_VERSION macro fix, among few other recent features.

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>

Do not rely on up-to-date UAPI headers on the system. Instead use the most
recent ones that are used for libbpf's own build.

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>

Now that libbpf defines NULL in bpf_helpers.h, there is no need for tools to
re-define NULL.

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>

Update libbpf to the latest upstream commit.

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>

Signed-off-by: Wenbo Zhang <ethercflow@gmail.com>

Signed-off-by: Wenbo Zhang <ethercflow@gmail.com>

The lookup_fast function can be rename lookup_fast.constprop.x by gcc
constant propagation optimization and that breaks dcstat and
dcsnoop. Let's look for both name using a regular expression.

In order to fix the following errors when running bpf program
on the MIPS Loongson64 platform, add some basic support, with
this patch, running hello_world.py can get the expected result.

 root@linux:/home/loongson/bcc# python examples/hello_world.py
 In file included from <built-in>:3:
 In file included from /virtual/include/bcc/helpers.h:51:
 In file included from include/uapi/linux/if_packet.h:5:
 arch/mips/include/uapi/asm/byteorder.h:17:3: error: "MIPS, but neither __MIPSEB__, nor __MIPSEL__???"
 # error "MIPS, but neither __MIPSEB__, nor __MIPSEL__???"
   ^
 In file included from <built-in>:3:
 In file included from /virtual/include/bcc/helpers.h:53:
 In file included from include/linux/log2.h:12:
 In file included from include/linux/bitops.h:32:
 In file included from arch/mips/include/asm/bitops.h:19:
 In file included from arch/mips/include/asm/barrier.h:11:
 arch/mips/include/asm/addrspace.h:13:10: fatal error: 'spaces.h' file not found
 #include <spaces.h>
         ^~~~~~~~~~
 2 errors generated.
 Traceback (most recent call last):
   File "examples/hello_world.py", line 12, in <module>
     BPF(text='int kprobe__sys_clone(void *ctx) { bpf_trace_printk("Hello, World!\\n"); return 0; }').trace_print()
   File "/usr/lib/python2.7/site-packages/bcc/__init__.py", line 364, in __init__
     raise Exception("Failed to compile BPF module %s" % (src_file or "<text>"))
 Exception: Failed to compile BPF module <text>

 root@linux:/home/loongson/bcc# python examples/hello_world.py
 In file included from <built-in>:3:
 In file included from /virtual/include/bcc/helpers.h:53:
 In file included from include/linux/log2.h:12:
 In file included from include/linux/bitops.h:32:
 arch/mips/include/asm/bitops.h:101:3: error: invalid output constraint '+ZC' in asm
                 __bit_op(*m, __INS "%0, %3, %2, 1", "i"(bit), "r"(~0));
                 ^
 arch/mips/include/asm/bitops.h:40:19: note: expanded from macro '__bit_op'
         : "=&r"(__temp), "+" GCC_OFF_SMALL_ASM()(mem)           \
                          ^
 [...]
 arch/mips/include/asm/atomic.h:154:1: error: invalid output constraint '+ZC' in asm
 arch/mips/include/asm/atomic.h:151:2: note: expanded from macro 'ATOMIC_OPS'
         ATOMIC_FETCH_OP(pfx, op, type, c_op, asm_op, ll, sc)
         ^
 arch/mips/include/asm/atomic.h:141:4: note: expanded from macro 'ATOMIC_FETCH_OP'
           "+" GCC_OFF_SMALL_ASM() (v->counter)                          \
           ^
 fatal error: too many errors emitted, stopping now [-ferror-limit=]
 20 errors generated.
 Traceback (most recent call last):
   File "examples/hello_world.py", line 12, in <module>
     BPF(text='int kprobe__sys_clone(void *ctx) { bpf_trace_printk("Hello, World!\\n"); return 0; }').trace_print()
   File "/usr/lib/python2.7/site-packages/bcc/__init__.py", line 364, in __init__
     raise Exception("Failed to compile BPF module %s" % (src_file or "<text>"))
 Exception: Failed to compile BPF module <text>

Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>

  * Support for kernel up to 5.11
  * allow BCC as a cmake subproject
  * add LPORT support in tcpconnlat and tcpconnect
  * added bpf_map_lookup_and_delete_batch support
  * new tools: virtiostat
  * new libbpf-tools: cpufreq, funclatency, cachestat
  * add install target to libbpf-tools
  * a few lua fixes
  * doc update and bug fixes

Signed-off-by: Yonghong Song <yhs@fb.com>

sync with latest libbpf with top commit:
  092a60685625 Makefile: fix install flags order

Signed-off-by: Yonghong Song <yhs@fb.com>

The recent linux distros already support PIE so it shouldn't be a
problem to remove "-no-pie". To avoid issue#782, we make "-no-pie"
optional and enable it by default. For the distro with PIE luajit,
just add the following build option:

   -DENABLE_NO_PIE=OFF

Then, bcc-lua will be built with PIE support.

Signed-off-by: Gary Lin <glin@suse.com>

Signed-off-by: Mariusz Barczak <mariusz.barczak@intel.com>

Signed-off-by: Wenbo Zhang <ethercflow@gmail.com>

Signed-off-by: Hengqi Chen <chenhengqi@outlook.com>

libbcc.so is actually installed to /usr/lib64 instead of
/usr/local/lib in my computer system:

$ find /usr -name libbcc.so
/usr/lib64/libbcc.so

And also we can find out bcc-python:

$ find /usr/lib -name bcc
/usr/lib/python2.7/site-packages/bcc

It is better to use one line command to export environment
variable LD_LIBRARY_PATH and PYTHONPATH.

Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>

Signed-off-by: Wenbo Zhang <ethercflow@gmail.com>

Fix all the found instances of declaring loop variable inside for() construct,
which is not supported in C89 standard, which is what libbpf-tools are trying
to adhere to, both in user-space and BPF source code. It actually causes
compilation errors on some versions of GCC, as reported by customers in
private conversations.

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>

Add device driver/name filter for virtiostat.

Suggested by Yonghong, also use bpf_probe_read_kernel_str to copy
string from kernel.

Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>

When buildiing kernel with GCC10 [2] in Debian on an Arm64 machine, it was
found the new "inter-procedural optimization improvements" [1] makes symbol
name 'finish_task_switch' changed to 'finish_task_switch.isra.0'.

Details:
The results, when built with gcc 9.3:
nm ../linux.buildout/kernel/sched/core.o | grep finish_task_switch
0000000000001288 t finish_task_switch

However, when built with gcc 10.2:
nm ../linux.buildout/kernel/sched/core.o | grep finish_task_switch
00000000000012d0 t finish_task_switch.isra.0

The same symbols (with xxx.isra.0 or without, respectively of course) also
appear in final file 'System.map' and in '/proc/kallsyms' when booting. This
negatively impact the tracing tools commonly used in kernel debugging, such
as bcc tools offcputime and runqlat. They hardcode 'finish_task_switch'
(without the .isra.0 suffix) into their scripts.

This patch fix the issue by changing the hardcoded 'finish_task_switch' string
to a python regular expression pattern who can match both the traditional form
'finish_task_switch' and the new gcc10 form 'finish_task_switch.isra.0'
(with single digit at the end). attach_kprobe()'s input parameter 'event_re'
is used for this type of pattern matching.

[1] https://gcc.gnu.org/gcc-10/changes.html


[2] ARCH=arm64 make Image

Signed-off-by: Guodong Xu <guodong.xu@linaro.org>

The adress of struct sock, which are used as the map key, are often
reused. When it happens random duration appears in the MS field for
new connections (CLOSE->SYN_SENT and LISTEN->SYN_RECV
transitions). Let's forget about the socket when the connection is
closed.

Signed-off-by: Wenbo Zhang <ethercflow@gmail.com>

Signed-off-by: yeya24 <yb532204897@gmail.com>

add option to include 'LPORT' in tcpconnect otuput and
update man page for tcpconnect and add examples

Otherwise the `make` fails with lack of `FlexLexer.h` error.

On my ARM64 kernel 5.4 case

Symbol:
ffffffc0100820b8 T __irqentry_text_end
ffffffc0100820b8 T __irqentry_text_start

It will ignore all functions after __irqentry_text_start until __irqentry_text_end.
But this case __irqentry_text_end is before __irqentry_text_start.
So the problem happens.

Signed-off-by: Edward Wu <edwardwu@realtek.com>

This is a port of BCC's funclatency.  Usage:

---------
Time functions and print latency as a histogram

Usage: funclatency [-h] [-m|-u] [-p PID] [-d DURATION] [ -i INTERVAL ]
                   [-T] FUNCTION
       Choices for FUNCTION: FUNCTION         (kprobe)
                             LIBRARY:FUNCTION (uprobe a library in -p PID)
                             :FUNCTION        (uprobe the binary of -p PID)

  -m, --milliseconds         Output in milliseconds
  -u, --microseconds         Output in microseconds
  -p, --pid=PID              Process ID to trace
  -d, --duration=DURATION    Duration to trace
  -i, --interval=INTERVAL    Summary interval in seconds
  -T, --timestamp            Print timestamp

  -?, --help                 Give this help list
      --usage                Give a short usage message
  -V, --version              Print program version

Mandatory or optional arguments to long options are also mandatory or optional
for any corresponding short options.

Examples:
  ./funclatency do_sys_open         # time the do_sys_open() kernel function
  ./funclatency -m do_nanosleep     # time do_nanosleep(), in milliseconds
  ./funclatency -u vfs_read         # time vfs_read(), in microseconds
  ./funclatency -p 181 vfs_read     # time process 181 only
  ./funclatency -p 181 c:read       # time the read() C library function
  ./funclatency -p 181 :foo         # time foo() from pid 181's userspace
  ./funclatency -i 2 -d 10 vfs_read # output every 2 seconds, for 10s
  ./funclatency -mTi 5 vfs_read     # output every 5 seconds, with timestamps

---------

It supports kprobes and has limited support for uprobes.  Currently, you
cannot uprobe a library unless you provide a PID.  It does not support
wildcard patterns.

Some of the functions for uprobes are useful for other programs, so I
put those in uprobe_helpers.{c,h}.

Signed-off-by: Barret Rhoden <brho@google.com>

Upstream (llvm13) patch
  https://reviews.llvm.org/D97223


changed function signature for CreateAtomicRMW().
The error message:
  /home/yhs/work/bcc/src/cc/frontends/b/codegen_llvm.cc:
     In member function ‘ebpf::StatusTuple ebpf::cc::CodegenLLVM
        ::emit_atomic_add(ebpf::cc::MethodCallExprNode*)’:
  /home/yhs/work/bcc/src/cc/frontends/b/codegen_llvm.cc:720:75:
     error: no matching function for call to
        ‘llvm::IRBuilder<>::CreateAtomicRMW(llvm::AtomicRMWInst::BinOp,
         llvm::Value*&, llvm::Value*&, llvm:: AtomicOrdering)’
       AtomicRMWInst::Add, lhs, rhs, AtomicOrdering::SequentiallyConsistent);
                                                                           ^
  In file included from /home/yhs/work/bcc/src/cc/frontends/b/codegen_llvm.cc:31:
  /home/yhs/work/llvm-project/llvm/build/install/include/llvm/IR/IRBuilder.h:1721:18:
      note: candidate:
  ‘llvm::AtomicRMWInst* llvm::IRBuilderBase::CreateAtomicRMW(llvm::AtomicRMWInst::BinOp,
      llvm::Value*, llvm::Value*, llvm::MaybeAlign, llvm::AtomicOrdering,
      llvm::SyncScope::ID)’
   AtomicRMWInst *CreateAtomicRMW(AtomicRMWInst::BinOp Op, Value *Ptr,
                  ^~~~~~~~~~~~~~~
  /home/yhs/work/llvm-project/llvm/build/install/include/llvm/IR/IRBuilder.h:1721:18: note:
  candidate expects 6 arguments, 4 provided

Fixed the issue with correct arguments.

Signed-off-by: Yonghong Song <yhs@fb.com>

Commit 95c9229e replaced the
blk_account_io_completion kprobe with blk_account_io_done. Unfortunately
the req->__data_len field is 0 in blk_account_io_done, therefore we need
to save the __data_len field in blk_start_request

Resolves #3099

Signed-off-by: Wenbo Zhang <ethercflow@gmail.com>

The current install steps for Debian from source is out of date,
use the distribution name sid instead of jessie, stretch, buster
due to the latter always change, update and simplify the install
steps like other distributions which is clear and always right.

Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>

Systemtap defines argument size as either 1, 2, 4, or 8 bytes
signed or unsigned. Thus the constant variable should be stored in
a long long instead of an int to ensure at least 8 bytes size.