fix #1921

For newer kernels, bcc tries to fd based kuprobe
attachment. In fd based kprobe attachment,
  config1: for symbol
  config2: for symbol offset

In python API attach_kretprobe, the offset value
is not set in lib.bpf_attach_kprobe and hence it
will be a random value and eventually causing
kretprobe attachment failure.

This is not an issue for old debugfs based attachment
as the offset will not be used if it is a retprobe.
Signed-off-by: Yonghong Song <yhs@fb.com>

Add name to program too large error message

llcstat: print a nicer error message when hardware events are missing

* Adding Fedora 28 to the list of fedora versions

Looking at the repo location, Fedora 28 appears to be supported as well.  Fixing the documentation to include this.

* Update INSTALL.md

* python3: check ksymname calls with _assert_is_bytes

Fixes a bytes/string concatenation error when get/fix_syscall_fnname is
called from a python3 system.

* python3: use env python invocation in tools

In order to facilitate testing, but not necessarily as an example of
good practice, I am changing the invocation of the test tools to use
`/usr/bin/env python`, so that we can control which python (2 vs 3)
gets invoked for the test. On the buildbots, I plan to add an optional
`ln -s /usr/bin/python3 /usr/local/bin/python` on systems that have
python3-bcc package built. This way, we get more test coverage. Having a
cmake mechanism to enable both python2 and python3 testing could be a
further enhancement.

* tools/memleak: add an explicit stdout.flush to print loop

The stdout flush behavior seems to have changed in python3, breaking one
of the tests. I think it makes sense to flush stdout at the end of each
timed interval loop anyway, so adding that to the tool itself.

* tests: add b'' strings and fix dangling handles

Add b'' strings in a few places in the test tools, and fix one dangling
process handle in the memleak test tool runner.

* Fix multiple memory access errors

Fixes a buffer overflow in get_pid_exe(), a use-after-free error in
bcc_usdt_get_probe_argctype() and a possible NULL pointer dereference
in find_debug_via_debuglink().

* Fix multiple ressource leaks

Leaked file descriptors in bpf_attach_uprobe() and verify_checksum().
Memory leaks in  Parser::func_add() and bcc_procutils_language().

* fixup! Fix multiple ressource leaks

* Documentation: Added table for program type and its helper functions

* updated the Program type table to follow the same Markdown format as other tables

* Fixed typos

* fixed typos and added new helper functions

Hardware events such as CACHE_MISSES and CACHE_REFERENCES are usually
not available on virtual machine. Print a more useful message when
this happen.

* sslsniff: add NSS support

* sslsniff: update documentation

Fix issue #1910

Otherwise, we will have a type mismatch like below:
  [root@aborniakFC tools]# ./ttysnoop 1
  Traceback (most recent call last):
  File "./ttysnoop", line 102, in <module>
  b = BPF(text=bpf_text)
  File "/usr/lib/python3.6/site-packages/bcc/__init__.py", line 337, in __init__
  self._trace_autoload()
  File "/usr/lib/python3.6/site-packages/bcc/__init__.py", line 1030, in _trace_autoload
  event=self.fix_syscall_fnname(func_name[8:]),
  File "/usr/lib/python3.6/site-packages/bcc/__init__.py", line 569, in fix_syscall_fnname
  if name.startswith(prefix):
  TypeError: startswith first arg must be bytes or a tuple of bytes, not str
  [root@aborniakFC tools]#
Signed-off-by: Yonghong Song <yhs@fb.com>

cmake3 was throwing an error that the package did not exist. cmake exists and the build was successful using it.

* Replace boilerplate for increment with a call to `increment`

from new tooling. Found cases to replace using `ripgrep`[1]:
```
$ rg '\(\*\w+\)\s*\+\+' -l | grep tools | grep -v old
```

[1]: https://github.com/BurntSushi/ripgrep

* Replace boilerplate for bigger than 1 increments with the new
`increment` call

from new tooling. Found cases to replace using `ripgrep`[1]:
```
$ rg '\(\*\w+\)\s*\+=' -l | grep tools | grep -v old
```

[1]: https://github.com/BurntSushi/ripgrep

* Update examples indicating the alternative increment call for hash tables

Add instructions for installing on Amazon Linux from source

* [trace.py]: allow to use STRCMP helper with binary values

Summary:
sometimes in probe you want to compare char* w/ some predefined value
which is not a string. e.g. setsockopt syscall has signature like this:
sys_setsockopt(int fd, int level, int optname, char* optval, int optlen)
and if you want to catch where/who is setting up specific value you are
forced to compare optval against some predefined array. it's not
possible today w/ trace.py and in this diff i'm adding such ability

Test Plan:
as example: we want to catch setsockopt when someone is setting up
IP_TOS equal to 108
trace.py 'sys_setsockopt(int fd, int level, int optname, char* optval,
int optlen)(level==0 && optname == 1 && STRCMP("{0x6C,0x00, 0x00,
0x00}", optval))' -U -M 1 --bin_cmp -v

without this new modifier:
static inline bool streq_0(char const *ignored, uintptr_t str) {
        char needle[] = "{0x6C,0x00, 0x00, 0x00}";
        char haystack[sizeof(needle)];
        bpf_probe_read(&haystack, sizeof(haystack), (void *)str);
        for (int i = 0; i < sizeof(needle) - 1; ++i) {
                if (needle[i] != haystack[i]) {
                        return false;
                }
        }
        return true;
}

// see needle is qouted above

with:

tatic inline bool streq_0(char const *ignored, uintptr_t str) {
        char needle[] = {0x6C,0x00, 0x00, 0x00};
        char haystack[sizeof(needle)];
        bpf_probe_read(&haystack, sizeof(haystack), (void *)str);
        for (int i = 0; i < sizeof(needle) - 1; ++i) {
                if (needle[i] != haystack[i]) {
                        return false;
                }
        }
        return true;
}

...
PID     TID     COMM            FUNC             -
1855611 1863183 worker          sys_setsockopt   found

* adding example of --bin_cmp flag usage

* Allow arbitrary hashtable increments. Fixes #1742

Right now incrementing some datastructure's values like maps or histograms can
be done with some boilerplate[1] or with `increment` which increments a value
by 1.

This patch allows a second optional parameter to use as the increment.

- [1]:
```
u64 zero = 0, *val;
val = map.lookup_or_init(&key, &zero);
(*val) += inc;
```

Notes:
- Some lines in the documentation where changed because of trailing spaces
deletion
- The test is quite simple right now
- Will update the tools to use `increment` in another PR

* CR changes

BCC currently requires exactly matching headers. Sometimes this is quite
inconvenient especially if the kernel version is only very slightly
different such as updates in a stable kernel. This patch gives the user
the flexibility to override the the LINUX_VERSION_CODE provided in the
linux kernel headers, so that the eBPF program may load. We also print a
message when this is done, so that the user is warned about the override
happening and that results may be unpredictable.

Also updated the docs.
Signed-off-by: Joel Fernandes <joel@joelfernandes.org>

BPF_MAP_TYPE_LPM_TRIE supports element deletion since kernel commit
e454cf595853 ("bpf: Implement map_delete_elem for BPF_MAP_TYPE_LPM_TRIE")
which is available in 4.15 kernels onwards.
Signed-off-by: Eyal Birger <eyal.birger@gmail.com>

* tools: use printb for more python3 compat

Switch to printb in killsnoop and wakeuptime

* tests: use subproceess sleep to trigger test

In some python implementations, time.sleep uses select instead of
nanosleep and hence won't trigger the bpf kprobe.

* tools: remove explicit python3 shebang

Use an ambiguous python invocation in the shebang line. Instead, rely on
packaging stage to mangle the line to specify a python version.

* cmake: add ENABLE_LLVM_SHARED option

This adds an option to specify that only the dynamic libraries should be
used to link bcc. This is most likely to be used in systems that don't
build/provide the llvm-static and clang-static package options
(fedora-based).

* rpm: enable llvm_shared and python3 build options

Enable rpm packaging with two new features:
 - shared-only packaging (no static linking)
 - python3
To enable these build features (off by default), run:
 RPM_WITH_OPTS="--with llvm_shared --with python3" ./scripts/build-rpm.sh

* rpm: protect python3-bcc package declaration

Don't define python3-bcc if --with python3 isn't explicitly specified.

* specs: only build python3 if requested

* man: compress man pages

* specs: enable python3 by default in fc28+/rh8+

- Enable llvm_shared and python3 --with options by default in new fedora
- Fix string quoting
- Update spec changelog

add usdt calls to libbcc static library

This fix adds additional accounting logic to the http_filter examples ("simple"
and "complete") that make sure to shift the pointer for the IP body/payload to
the correct offset before accessing TCP header fields. This is done by taking
into account the IP header length field. Previously, the IP header length field
was used, but it was done later in processing, after TCP header values were
extracted using the size of the BCC `proto.h` `struct ip_t` a static offset.

Prior to this, it was possible to evade HTTP detection by injecting IP options
data into the IP header that would spoof parts of the TCP header and shift the
real one down, as done in the scapy snippet below:

```Python
IP(
  dst=target[0],
  options=struct.pack(">BBHHHB",130,11,8080,0,0,0),
)/TCP(
  ...
)
```

Prevents the following error when tracing a java program that contains
non-ascii method name:

Traceback (most recent call last):
  File "/usr/share/bcc/tools/lib/ucalls", line 305, in <module>
    data = get_data()   # [(function, (num calls, latency in ns))]
  File "/usr/share/bcc/tools/lib/ucalls", line 266, in get_data
    bpf["counts"].items()))
  File "/usr/share/bcc/tools/lib/ucalls", line 264, in <lambda>
    kv[0].method.decode(),
UnicodeDecodeError: 'ascii' codec can't decode byte 0xc4 in position 11: ordinal not in range(128)
Signed-off-by: Jerome Marchand <jmarchan@redhat.com>

* [profile.py]: adding support to collect profile only from specified CPU

Summary:
sometime it is usefull to collect stack only from single cpu
for example you have single core saturated while others dont and you
want to know whats going on there. in this diff i'm adding this ability
(network related code could be example of when single core is saturated
as usually you have 1 to 1 mappng between rx queue and cpu)

example of generated code w/ CPU specified:

./tools/profile.py -C 14 2 --ebpf
Sampling at 49 Hertz of all threads by user + kernel stack for 2 secs.

struct key_t {
    u32 pid;
    u64 kernel_ip;
    u64 kernel_ret_ip;
    int user_stack_id;
    int kernel_stack_id;
    char name[TASK_COMM_LEN];
};
BPF_HASH(counts, struct key_t);
BPF_STACK_TRACE(stack_traces, 16384);

// This code gets a bit complex. Probably not suitable for casual hacking.

int do_perf_event(struct bpf_perf_event_data *ctx) {

    if (bpf_get_smp_processor_id() != 14)
        return 0;

    u32 pid = bpf_get_current_pid_tgid() >> 32;
...

and w/o

./tools/profile.py  2 --ebpf
Sampling at 49 Hertz of all threads by user + kernel stack for 2 secs.

struct key_t {
    u32 pid;
    u64 kernel_ip;
    u64 kernel_ret_ip;
    int user_stack_id;
    int kernel_stack_id;
    char name[TASK_COMM_LEN];
};
BPF_HASH(counts, struct key_t);
BPF_STACK_TRACE(stack_traces, 16384);

// This code gets a bit complex. Probably not suitable for casual hacking.

int do_perf_event(struct bpf_perf_event_data *ctx) {

    u32 pid = bpf_get_current_pid_tgid() >> 32;
    if (!(1))
        return 0;
...

* addressing comments

* adding change in man

[tools/execsnoop] Try to get parent PID from current task's real parent.

tcptop: fix display of received bytes, reduce syscalls (fixes #1871)

bpf_get_current_task is only available in 4.8 and above.
Signed-off-by: David Calavera <david.calavera@gmail.com>

the keys variable was a reference to ipv4_recv_bytes, and after merging
the keys of ipv4_send_bytes the original ipv4_recv_bytes BPF table also
contained all keys, therefore the `if k in ipv4_recv_bytes` check a few
lines below always evaluates to true

with this commit all BPF tables are copied to userspace as dicts once
(to reduce the number of syscalls) and the keys are merged in a new dict

Signed-off-by: David Calavera <david.calavera@gmail.com>

fix get_table_offline for percpu hash table

Signed-off-by: David Calavera <david.calavera@gmail.com>

Fallback to read the PPid from /proc if the real parent's TGID is 0.
Signed-off-by: David Calavera <david.calavera@gmail.com>

Use get_value() instead of lookup() as the value as in the case of
percpu tables the ValueType is an std::vector that has to be resized
before performing the lookup function.

Add also some testing for it.

Solves https://github.com/iovisor/bcc/issues/1860Signed-off-by: Mauricio Vasquez B <mauricio.vasquez@polito.it>

debian: add llvm6.0 as possible dependency

Mention perf as universal counting tool in llcstat

Improve Python autoload syscall name handling

Added new footer.h header where BPF_LICENSE is set if not defined

Rewrite array accesses

Fix license recognition on GitHub.com

In recent Ubuntu, llvm 6 is available. Use that as control file
dependency option.

Closes #1757.