* Allow argdist to enable USDT probes without a pid

The current code would only pass the pid to the USDT
class, thereby not allowing USDT probes to be enabled
from the binary path only. If the probe doesn't have
a semaphore, it can actually be enabled for all
processes in a uniform fashion -- which is now
supported.

* Reintroduce USDT support into tplist

To print USDT probe information, tplist needs an API
to return the probe data, including the number of
arguments and locations for each probe. This commit
introduces this API, called bcc_usdt_foreach, and
invokes it from the revised tplist implementation.

Although the result is not 100% identical to the
original tplist, which could also print the probe
argument information, this is not strictly required
for users of the argdist and trace tools, which is
why it was omitted for now.

* Fix trace.py tracepoint support

Somehow, the import of the Perf class was omitted
from tracepoint.py, which would cause failures when
trace enables kernel tracepoints.

* trace: Native bcc USDT support

trace now works again by using the new bcc USDT support
instead of the home-grown Python USDT parser. This
required an additional change in the BPF Python API
to allow multiple USDT context objects to be passed to
the constructor in order to support multiple USDT
probes in a single invocation of trace. Otherwise, the
USDT-related code in trace was greatly simplified, and
uses the `bpf_usdt_readarg` macros to obtain probe
argument values.

One minor inconvenience that was introduced in the bcc
USDT API is that USDT probes with multiple locations
that reside in a shared object *must* have a pid
specified to enable, even if they don't have an
associated semaphore. The reason is that the bcc USDT
code figures out which location invoked the probe by
inspecting `ctx->ip`, which, for shared objects, can
only be determined when the specific process context is
available to figure out where the shared object was
loaded. This limitation did not previously exist,
because instead of looking at `ctx->ip`, the Python
USDT reader generated separate code for each probe
location with an incrementing identifier. It's not a
very big deal because it only means that some probes
can't be enabled without specifying a process id, which
is almost always desired anyway for USDT probes.

argdist has not yet been retrofitted with support for
multiple USDT probes, and needs to be updated in a
separate commit.

* argdist: Support multiple USDT probes

argdist now supports multiple USDT probes, as it did
before the transition to the native bcc USDT support.
This requires aggregating the USDT objects from each
probe and passing them together to the BPF constructor
when the probes are initialized and attached.

Also add a more descriptive exception message to the
USDT class when it fails to enable a probe.

This is similar in spirit to what was done in PR #677 to fix the
problem reported in #609.

filelife.py is now converted to use the right struct field.
Signed-off-by: Marco Leogrande <marcol@plumgrid.com>

There are situations, specially when using non-folded mode, where we are
interested only in very high latencies that happen due to blocking.

While we can certainly filter out the very small ones out of the output, it is a
lot more convenient to do this from the tool itself, as it would be difficult
from an external filter to do this in one pass.

But if we are to discard unused measurements, we can do even better: we can
change the bpf code itself not to grab those traces, and gain a bit of
efficiency in scenarios in which we are only concerned about peak latencies.

This scheme can be easily extended to also allow a maximum cap in the latencies
we are interested in.

After this patch is applied, the options -m and -M can be used to set those
limits respectively.

Fixes: #588

[tcpconnect] filter traced connection based on destination ports

Test:
While running:
while [ 1 ]; do nc -w 1 100.127.0.1 80; nc -w 1 100.127.0.1 81; done

root@vagrant:/mnt/bcc# ./tools/tcpconnect.py
PID    COMM         IP SADDR            DADDR            DPORT
19978  nc           4  10.0.2.15        100.127.0.1      80
19979  nc           4  10.0.2.15        100.127.0.1      81
19980  nc           4  10.0.2.15        100.127.0.1      80
19981  nc           4  10.0.2.15        100.127.0.1      81
root@vagrant:/mnt/bcc# ./tools/tcpconnect.py  -P 80
PID    COMM         IP SADDR            DADDR            DPORT
19987  nc           4  10.0.2.15        100.127.0.1      80
19989  nc           4  10.0.2.15        100.127.0.1      80
19991  nc           4  10.0.2.15        100.127.0.1      80
19993  nc           4  10.0.2.15        100.127.0.1      80
19995  nc           4  10.0.2.15        100.127.0.1      80
root@vagrant:/mnt/bcc# ./tools/tcpconnect.py  -P 80,81
PID    COMM         IP SADDR            DADDR            DPORT
8725   nc           4  10.0.2.15        100.127.0.1      80
8726   nc           4  10.0.2.15        100.127.0.1      81
8727   nc           4  10.0.2.15        100.127.0.1      80
8728   nc           4  10.0.2.15        100.127.0.1      81
8729   nc           4  10.0.2.15        100.127.0.1      80

Fixes #681

* add new tool: capable

* refactor a little, remove extra bpf_get_current_pid_tgid()

Use tempfile module to create a temp file

Fix some review input

Fix style check

Style

Style check

Remove builtin module from python test to run fedora ctest

Let the program calling bpf_prog_load to handle the log buffer

Check max instruction before the syscall. Fix other review comment

minor cleanup + process partial name matching

Signed-off-by: KarimAllah Ahmed <karim.allah.ahmed@gmail.com>

Signed-off-by: KarimAllah Ahmed <karim.allah.ahmed@gmail.com>

... since they are unused.
Signed-off-by: KarimAllah Ahmed <karim.allah.ahmed@gmail.com>

Prepare debian changelog for v0.2.0 tag

Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

examples: fix indentation in tracing/tcpv4connect

Python doesn't like mixing spaces and tabs.

fileslower: use de->d_name.name, add filtering

fix biosnoop after kernel change

offcputime improvements: use less RAM, add PID/TID support

Add perf_submit_skb

For BPF_PROG_TYPE_SCHED_CLS/ACT, the upstream kernel has recently added a
feature to efficiently output skb + meta data:
commit 555c8a8623a3 ("bpf: avoid stack copy and use skb ctx for event output")

This patch adds perf_submit_skb to BPF_PERF_OUTPUT macro.  It takes
an extra u32 argument.  perf_submit_skb will then be expanded to
bpf_perf_event_output properly to consider the newly added
u32 argument as the skb's len.

Other than the above described changes, perf_submit_skb is almost
a carbon copy of the perf_submit except the removal of the 'string name'
variable since I cannot find a specific use of it.

Note that the 3rd param type of bpf_perf_event_output has also been
changed from u32 to u64.

Added a sample program tc_perf_event.py.  Here is how the output
looks like:
[root@arch-fb-vm1 networking]# ./tc_perf_event.py
Try: "ping -6 ff02::1%me"

CPU SRC IP                           DST IP       Magic
0   fe80::982f:5dff:fec1:e52b        ff02::1      0xfaceb00c
0   fe80::982f:5dff:fec1:e52b        ff02::1      0xfaceb00c
0   fe80::982f:5dff:fec1:e52b        ff02::1      0xfaceb00c
1   fe80::982f:5dff:fec1:e52b        ff02::1      0xfaceb00c
1   fe80::982f:5dff:fec1:e52b        ff02::1      0xfaceb00c
1   fe80::982f:5dff:fec1:e52b        ff02::1      0xfaceb00c

Minor adjustments to the documentation

Fix a few typos
Add missing link
Reword update() description sentence

fix build with 4.0 llvm trunk

Signed-off-by: Alexei Starovoitov <ast@fb.com>

As reported in #664:
In cases where the AST contains a MemberExpr with an invalid opLoc,
rewrite will fail but prior to this change would segfault. Fail a little
more gracefully, even though the program will still be rejected.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Tool to sniff data contents before encrypted with OpenSSL

Now it also captures gnutls_record_send and gnutls_record_recv calls.
Added options to filter by pid or command name, or just one lib.

Add tool as talked in iovisor-dev 'BCC: bpf_probe_read read function arguments'

This reverts commit c6688dda4e856be43b8651afe92d7e32e63faea9.

killsnoop: use current time replace timestamp and default output

* debian packaging: Add missing Build-dependencies

* Add clang-format-3.7 to build-depends
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

* debian packaging: Build with -DBCC_KERNEL_HAS_SOURCE_DIR=1

This is required to use the distro-provided includes on Debian/Ubuntu

dcsnoop: use PERF_EVENT_OUTPUT