Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

handle return value in kretprobe handler for tcpv4connect

Fix an uninitialized variable access in test_clang

Signed-off-by: Yonghong Song <yhs@plumgrid.com>

Signed-off-by: Yonghong Song <yhs@plumgrid.com>

Make KeyboardInterrupt catch more aggressive

Fixes: #186
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Fixes for table indexing and clear()

In the case that python process tries to clear() a table object while
the bpf program is still running and doing lookup_or_init, the python
clean() routine will race with the bpf program (and bpf will win in the
case of frequent kprobe hits) causing a hang. Instead, first get the
full list of keys and then delete them rather than rely on the default
popitem implementation.

Fixes: #233
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

In the case that 0-filled keys are valid in the table, the previous
algorithm did not properly iterate.

The API of the bpf_get_next_key routine is such that the iteration
over a map should start with an invalid key. When a 0 key is valid, this
causes iteration to start anywhere inside the hash table, skipping some
entries. So, add logic to the Iter object to test if the init key is
invalid. If otherwise, try a few alternatives until an invalid key is
found. If none found, raise an exception.

Also adds a test for indexing arrays from 0, which nows works with this
too.

Fixes: #260
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Don't treat fundamentally typed args as needing probe_read

The rewriter was aggressively parsing PoD types as requiring probe_read
and poisoning other decls when those arguments were used.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Mask function calls from influencing probe_read

Calls to functions were propagating the needs_probe state, causing map
values to require a probe_read improperly. Although there may be a use
case for this, generally it will not be needed and should be solved
differently.

Fixes: #256
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Add ability to consume perf events in python

Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

This adds the ability to consume perf events in libbpf/python using the
ring buffer. For now, this is the only way to get access to the function
call graph. Only kernel functions are supported.

It does this by introducing a new set of libbpf helper functions that
can open the perf fd, mmap it, and poll over the events as they are
submitted by the kernel. This allow for faster event processing than
trace_printks, but has not been tested.

The functionality is disabled by default, the user can enable it by
passing a non-empty cb parameter into the BPF constructor. That cb
function will be invoked for each event that is read from the buffer.
Buffers are per-fd, so each event is distinct as well as separated from
other processes that may be running simultaneously.

The initial test case uses this functionality to build a histogram of
events keyed by the callchain.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

tcpv4connect

Add custom formatter function to print_log2_hist

Fixes: #251
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

begin using new histogram breakdowns feature

use BPF_HISTOGRAM and num_open_kprobes

Helper to get open k[ret]probes. Fixes #236

Add BPF_HISTOGRAM type and print support

Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

This adds support for a specialized histogram type, which underneath
maps to an array or a hash table, depending on key type. With no
arguments, it takes on the type `u64 table[64];`. The other current
supported key type is `struct { int32|int64 bucket; int32|int64 slot }`.

To print these automatically, print_log2_hist is underneath split into
two types of printouts, one which prints the single histogram, and
another which prints a histogram for each unique `bucket` value.

See test_histogram.py for examples.

Fixes: #144
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Allows things like:
```c
int kprobe__foo(struct pt_regs *ctx, u64 *ptr) {
  bpf_trace_printk("%lx\n", *ptr);
```
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Initial implementation of P4->ebpf compiler.

Add contribution section