bcc: Use bpf_probe_read_user in tools and provide backward compatibility

Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>

This is essential for architecture which do have overlapping address space.
- bpf_probe_read_kernel() shall be used for reading data from kernel space
to the bpf vm.
- bpf_probe_read_user() shall be used for reading data from user space
  to the bpf vm.

Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>

1. Commit fa697140f9a2 ("syscalls/x86: Use 'struct pt_regs' based
   syscall calling convention for 64-bit syscalls") changed the raw
   parameter passed to the syscall entry function from a list of
   parameters supplied in user space to a single `pt_regs *` parameter
   (ARCH_HAS_SYSCALL_WRAPPER)

2. But ARCH_HAS_SYSCALL_WRAPPER in s390 is not used for that purpose.
   See commit a18f03cd89e9 ("s390: autogenerate compat syscall
   wrappers")

3. Use direct parameter assignment assumption for s390 syscall probe
   instead.

Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>

s390 has overlapping address space for user and kernel. Hence separation of
bpf_probe_read_user and bpf_probe_read_kernel is essential. Commit 6ae08ae3dea2
("bpf: Add probe_read_{user, kernel} and probe_read_{user, kernel}_str
helpers") introduced these changes into the kernel. However, bcc tools does not
respect it.

As a workaround, perform the following:
1. Use bpf_probe_read_user() explicitly in the bcc tools.
2. When kernel version < 5.5, perform the checks if the
   bpf_probe_read_user kernel helper is present in the backported kernel
   as well. If not found, then fallback from bpf_probe_read_user to
   bpf_probe_read.

Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com>

Earlier, it was assumed that ELF ABI v2 is used only on
little-endian powerpc64 environments but it seems this
ABI can be used independently of endianness.

It is expected that any C preprocessor that conforms to
the ELF ABI v2 specification must predefine the _CALL_ELF
macro and set its value to 2.

Instead of looking at __BYTE_ORDER__ to determine whether
to use the Local Entry Point (LEP) of symbols, one should
look at the _CALL_ELF macro instead as this is ABI-related.

Similarly, _CALL_ELF should be used only for determining
the ABI version and not the endianness.

Reported-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Fixes: bbd4180c ("Fix uprobes on powerpc64")
Fixes: 10869523 ("clang: Add support to build eBPF for user specified ARCH")
Acked-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Sandipan Das <sandipan@linux.ibm.com>

added changelog for release v0.14.0

sync to libbpf v0.0.8. Add newer helpers to
helpers.h, libbpf.c error reporting and docs.

The llvm CreateCall used in bcc is deprecated in llvm 11:
  https://reviews.llvm.org/D76269
The llvm CreateMemCpy is changed in llvm 11 as well:
  https://reviews.llvm.org/D71473

This caused bcc compilation error.

  /home/yhs/work/bcc/src/cc/frontends/b/codegen_llvm.cc: In member function
     ‘ebpf::StatusTuple ebpf::cc::CodegenLLVM::emit_log(ebpf::cc::Method CallExprNode*)’:
  /home/yhs/work/bcc/src/cc/frontends/b/codegen_llvm.cc:691:39: error: no matching function for call to
     ‘llvm::IRBuilder<>::CreateCall(llvm::Value*&, std::vector<llvm::Value*, std::allocator<llvm::Value*> >&)’
     expr_ = B.CreateCall(printk_fn, args);
                                       ^
  ...

  /home/yhs/work/bcc/src/cc/frontends/b/codegen_llvm.cc: In member function
     ‘virtual ebpf::StatusTuple ebpf::cc::CodegenLLVM::visit_string_exp_node(ebpf::cc::StringExprNode*)’:
  /home/yhs/work/bcc/src/cc/frontends/b/codegen_llvm.cc:440:55: error: no matching function for call to
     ‘llvm::IRBuilder<>::CreateMemCpy(llvm:Value*&, int, llvm::Value*&, int, std::__cxx11::basic_string<char>::size_type)’
   B.CreateMemCpy(ptr, 1, global, 1, n->val_.size() + 1);
                                                       ^
  ...

This patch fixed the compilation issue.

 add bcc/bcc_version.h to install

Added kernel recompile guidance for  libbpf CO-RE

Expand io_latencies example to iolatpcts tool

some distros already packaging clang 10 (checked fedora and arch) no longer
ship all the individual libclang*.so component libraries.
Instead, clang from 9.0 onwards provides a new lib, libclang-cpp.so, which
includes everything we need.

Tell cmake to use it if the individual libraries are no longer found.
(Build-wise, if both are present it is more efficient to use the individual
components so keep these first)

This is simplified version of tools/biolatpcts.py and demonstrates how to
obtain and calculate latency percentiles.

MAJ:MIN is cumbersome. Update it to accept DEVNAME and /dev/DEVNAME too.

* Multiple arguments parsing conflicts with positional argument and can become
  confusing. Use a single comma separated list instead.

* Instead of converting to floats while parsing arguments, keep the strings
  verbatim and use them when outputting results. This allows matching the same
  target percentile string in the output and is helpful when it's consumed by
  other programs.

Nothing in the script requires python3.

Update pid filter;  u32 pid = bpf_get_current_pid_tgid() >> 32;

This adds flexible low overhead latency percentile monitoring for block
devices which can be useful in understanding and debugging IO related
issues.

Signed-off-by: Tejun Heo <tj@kernel.org>

Quoting https://refspecs.linuxbase.org/elf/elf.pdf:
```
Symbol table entries for different object file types have slightly different
interpretations for the st_value member.
- In relocatable files, st_value holds alignment constraints for a symbol
whose section index is SHN_COMMON.
- In relocatable files, st_value holds a section offset for a defined symbol.
That is, st_value is an offset from the beginning of the section that st_shndx
identifies.
- In executable and shared object files, st_value holds a virtual address. To
make these files' symbols more useful for the dynamic linker, the section offset
(file interpretation) gives way to a virtual address (memory interpretation) for
which the section number is irrelevant.
```

This is a problem in practice as well. I run into this while tracing shared
libraries on Android with bpftrace. Some of them have text sections mmapped
at different offset than file offset which results in probes being placed
at wrong offsets.

To fix the issue (https://github.com/iovisor/bcc/issues/2827)
which exposed a problem with aarch64 frontend and bpf backend
regarding __int128 type, the following llvm patch
   https://reviews.llvm.org/D76587


landed to explicitly support i128 type in bpf layout spec.

Adjust the layout string in bpf_module JIT compilation
accordingly.

Signed-off-by: Yonghong Song <yhs@fb.com>

test_lpm_trie.py has been in the repo for quite some time,
but is not included in the unit test.

The issue https://github.com/iovisor/bcc/issues/2860


exposed an issue involved in using together with BTF,
which requires the key type to be a structure.

Let add it as a unit test so we can be sure
lpm_trie map is supported properly by bcc.

Signed-off-by: Yonghong Song <yhs@fb.com>

This adds a kprobe / kretprobe for chasing down slow netfilter hooks.
Since, often, the slowest hooks are on connection initialization and
teardown, it is bucketed by TCP flags. (rather than dive deep in to
conntrack)

Signed-off-by: Casey Callendrello <cdc@redhat.com>

* add BPF::enable_usdt_all() to enable all the USDT
* add detach_usdt_all() to detach all the USDTs

 * allow passing 0 as valid uid
 * fix type for targ_uid
 * improve uid validation (uid >= 4294967295 now invalid)

Signed-off-by: Jean-Philippe Menil <jpmenil@gmail.com>

On Android there is no standalone rt library and relevant symbols are provided
by libc (bionic).

Signed-off-by: Wenbo Zhang <ethercflow@gmail.com>

9d7feeed ("tools: add option --unique to capable.py") introduced a
compilation error when the --unique flag is passed.

Signed-off-by: Mauricio Vásquez <mauricio@kinvolk.io>

currently with ascending sort the useful information
is commonly beyond the bottom of the terminal window
and it is necessary to reverse the sort manually every execution.

Signed-off-by: Mark Kogan <mkogan@redhat.com>

Fixes the following error on aarch64:

bpf: Failed to load program: Permission denied
; struct sock *sk = ctx->regs[0]; int copied = ctx->regs[1];
0: (79) r8 = *(u64 *)(r1 +8)
...
; struct ipv6_key_t ipv6_key = {.pid = pid};
79: (63) *(u32 *)(r10 -48) = r7
; struct ipv6_key_t ipv6_key = {.pid = pid};
80: (7b) *(u64 *)(r10 +8) = r9
invalid stack off=8 size=8
processed 96 insns (limit 1000000) max_states_per_insn 0 total_states 7 peak_states 7 mark_read 4

Commit c347fe6c ("Support kfunc in opensnoop.py") introduces an
alternative probe on do_sys_open() with kfuncs instead of kprobes. This
new implementation is used if the kernel supports it. But it removed the
--cgroupmap filter added in commit b2aa29fa ("tools: cgroup
filtering in execsnoop/opensnoop").

This patch adds the --cgroupmap filter in the kfunc implementation.