Support Cgroup Array in BCC

document cflags argument to BPF()

Refactor profile.py stack id error handling

using get_syscall_fnname to get kprobe func name for tools

Refactor offwaketime stack id error handling

introduce new BPF APIs to get kernel syscall entry func name/prefix

Fixed tools which are attached to syscall entry functions
"sys_*". Instead, use get_syscall_fnname to get
proper names.
Signed-off-by: Yonghong Song <yhs@fb.com>

As described in issue #1695, on 4.17 for syscalls on x86,
both sys_<fnname> and SyS_<fnname> are gone, the replacements
are __ia32_sys_sync and __x64_sys_sync.
The commit in Linus tree:
https://github.com/torvalds/linux/commit/d5a00528b58cdb2c71206e18bd021e34c4eab878

This patch introduced two APIs for python BPF object.
The API get_syscall_prefix() returns the prefix "sys_"/"__x64_sys_".
The API get_syscall_fnname(name) returns kernel function name for the syscall,
e.g., on x64, get_syscall_fnname("clone") will return "sys_clone" if kernel
has it, otherwise, "__x64_sys_clone".
get_syscall_prefix() is mostly useful for the regex func specifier of
attach_kprobe().

This patch only fixed the code using python API on examples and tests directory.

TOTO: python on tools directory, C++ and lua
Signed-off-by: Yonghong Song <yhs@fb.com>

print out more useful attach_kprobe failure information

As stated in issue #1695, the following commit
https://github.com/torvalds/linux/commit/5c8dad48e4f53d6fd0a7e4f95d7c1c983374de88
removed corresponding dmesg when attach_kprobe failed, and
userspace needs to print out proper error messages.
Signed-off-by: Yonghong Song <yhs@fb.com>

Add -c option for profile.py

Fix offwaketime PID / TGID handling

Refactor offcputime stack id error handling

Use better kprobes for runqlat.py

Fix probe name encoding in Python 3

fix profile.py with latest net-next

fixing bpflist

when you have lots of shortlived progs, there is posibillity of
race condition during proc scanning. you could get pid of this
shortlived prog, but when you will start to read it's fd/ dir
it will fail, as prog would be already terminated

The profile.py tries to validate whether the "ip" from the
context register is a kernel ip address or not by comparing
"ip" to the kernel PAGE_OFFSET.

On non-x86_64 architectures, PAGE_OFFSET can be directly used.
On x86_64 architecture, things become more complex.
With 4.17 (latest linus tree), __PAGE_OFFSET_BASE is gone
and replaced with __PAGE_OFFSET_BASE_L5 and __PAGE_OFFSET_BASE_L4
for 5 and 4 level page table respectively.
Running profile.py will have the following error:
    /virtual/main.c:41:18: error: use of undeclared identifier '__PAGE_OFFSET_BASE'
            if (ip > __PAGE_OFFSET_BASE) {
                     ^
    1 error generated.

So, for 4.17, __PAGE_OFFSET_BASE_{L4, L5} should be used.
For 4.16 and some old kernels (e.g., 4.11), which I did not
check earlier one, __PAGE_OFFSET_BASE should be used.
For even older kernels like 4.6, PAGE_OFFSET should be used.
Signed-off-by: Yonghong Song <yhs@fb.com>

fix python3 py_test_histogram failure

QoL improvements for inject

With python3 (specifically 3.6.3), py_test_histogram failed with:
  Traceback (most recent call last):
  File "./test_histogram.py", line 106, in test_multiple_key
    bucket_sort_fn=bucket_sort)
  File "/usr/lib/python3.6/site-packages/bcc/table.py", line 318, in print_log2_hist
    buckets = bucket_sort_fn(buckets)
  File "./test_histogram.py", line 98, in bucket_sort
    buckets.sort()
  AttributeError: 'dict_keys' object has no attribute 'sort'

The reason is for a dictionary tmp, tmp.keys() returns an object
of keys (a list) instead of the list itself for python3.
Using list(tmp.keys()) seems working for both python2 and python3.
Signed-off-by: Yonghong Song <yhs@fb.com>

fix test_libbcc failure with 4.15.

The test sleeps one second and expects the perf counter to
be one second or more. But in reality (probably esp. in VM
which I conducted my experiments), I mostly saw counters
between 0.9s - 1s and occasionally 0.8s - 0.9s.

So be a little bit conservative here when checking the
result.
Signed-off-by: Yonghong Song <yhs@fb.com>

filetop: probe vfs_read and vfs_write instead to fix inlining issue

Filetop was originally designed to probe __vfs_read and __vfs_write,
which are called by vfs_read and vfs_write, respectively. However,
__vfs_read and __vfs_write are at times inlined, leading to these
particular functions never actually being called. Since these functions
are never called, the probes are never hit, and so filetop ends up
registering zero READs and WRITEs.

This patch fixes the issue by attaching the probes to vfs_read and
vfs_write instead, which are guaranteed to be called during file reads
and writes.
Signed-off-by: Jazel Canseco <jcanseco@google.com>