Finish man page update for b03d9eb2.

bpf_getsockopt in docs/kernel-versions.md

add a probe alias $task in trace.py

The $task refers to the current task. In my particular case, I need
to trace the number of users for file system associated with the current
task. With the probe alias $task, trace.py can easily trace this event

  ......
  trace.py -I 'linux/fs_struct.h' 'mntns_install "users = %d", $task->fs->users'
  PID     TID     COMM            FUNC             -
  176566  176566  python2.7       mntns_install    users = 2
  176566  176566  python2.7       mntns_install    users = 2
  ......

With $task probe alias, kernel tast_struct fields can be used in trace.py
filter or output easily even if they cannot be accessed through input
parameters.
Signed-off-by: Yonghong Song <yhs@fb.com>

use __builtin_memset instead of memset with frontend rewriter

fix flaky test py_test_usdt3

When kernel CONFIG_KASAN is enabled, the function memset becomes
a global function __memset. The bcc application with probe
rewrite will incur an error like:

  error: <unknown>:0:0: in function tracepoint__task__task_newtask i32
         (%struct.tracepoint__task__task_newtask*): A call to global function
         '__memset' is not supported. Only calls to predefined BPF helpers
         are allowed.

Replace memset function with clang __builtin_memset so that
the compiler is able to eventually optimize it away.
Signed-off-by: Yonghong Song <yhs@localhost.localdomain>

py_test_usdt3 has shown flakiness recently, and I actually reproduced
it on FC27. This patch increases the iteration number for
kprobe_poll and I ran the test for more than 20 times
without any failure.

Also fix a python3 compability issue. Open the file to write with
attribute "wb" instead of "w" since the text string is a byte array.
Signed-off-by: Yonghong Song <yhs@fb.com>

fix a race condition between perf_reader munmap and read

adding filtering example to trace.py help

Fix issue #1533.

Currently, there exist a race condition between perf_reader
buffer munmap and read if they are happening in two different
threads, crash is possible as in issue #1533.

          thread 1                    thread 2
          perf_reader_event_read      ...
                                      detach_probe
                                      munmap
          access ring buffer

detach_probe may happen as part of bpf object exit cleanup process
at which point thread 1 is still alive. In this case, accessing
ring buffer may cause segfault since the original mmap'ed memory
is not available any more.

It is hard to fix such races outside bcc since user
calls kprobe_poll which has valid BPF object when it is called,
but race happens inside the kprobe_poll.

This patch adds a state of the ring buffer and the read will
not happen once the state comes to the munmap.
Signed-off-by: Yonghong Song <yhs@fb.com>

Signed-off-by: Yonghong Song <yhs@fb.com>

Add a few trace.py examples in tutorial.md

Allow for sharing of python tools/ scripts

Use of this argparse constructor keyword is causing regression
test failures, and its use was nice-to-have - this means the -e
shorthand for --ebpf will be available iff its not been used in
another add_argument call.  Neither -e/--ebpf are advertised in
the usage message anyway.

Signed-off-by: Yonghong Song <yhs@fb.com>

Small fixes to some man pages for bcc tools

Fix folding option

Add bpf_override_return() helper definition

Adding minimum latency filter to tcpconnlat

Using the "folding" option produces an error.

/usr/share/bcc/tools/offwaketime -f 3 > out.stacks

Traceback (most recent call last):
  File "/usr/share/bcc/tools/offwaketime", line 305, in <module>
    print("%s %d" % (str.join(";", line), v.value))
TypeError: sequence item 0: expected str instance, bytes found

It seems that k.target and k.waker are always type = bytes.  This edit resolves this error.
Thank you for your time.

Use /proc/kallsyms for regex filtering

flag to print bpf program. Also fixed naming in tcpconnlat man page.

Added more examples in tcpconnlat_example.txt to show min duration
usage.

instead of /sys/kernel/debug/tracing/available_filter_functions.
available_filter_functions does not contain all tracable functions,
only those ftrace can use.

1. Adding `-m` and `-u` parameters for filtering tcp connects with greater the specified minimum latency.
2. Adding -v option to print out the bpf program. This is helpful for debugging and is a bit more consistent with some of the other bpf tools.

The latency check is only added if `-u` or `-m` have been set to greater than 0.

fix a trace_pipe output issue

For trace_pipe output, the /sys/kernel/debug/tracing/trace_pipe
output format looks like below for kernel 4.12 and earlier:
```
 <COMM>-<PID> [CPU] FLAGS TIMESTAMP: [SYMBOL]: USER_MESSAGES
```
where if an internal address is not able to be resolved to
a kernel symbol, `SYMBOL` will not be printed out at all.

kernel 4.13 and later will have format like:
```
 <COMM>-<PID> [CPU] FLAGS TIMESTAMP: [SYMBOL_OR_ADDR]: USER_MESSAGES
```
Basically, if an address is not able to resolved into a
kernel symbol, the address itself will be printed out.
The change was introduced by below commit:
```
commit feaf1283d11794b9d518fcfd54b6bf8bee1f0b4b
Author: Steven Rostedt (VMware) <rostedt@goodmis.org>
Date:   Thu Jun 22 17:04:55 2017 -0400

    tracing: Show address when function names are not found

    Currently, when a function is not found in kallsyms, instead of simply
    showing the function address, it shows nothing at all:

     # echo ':mod:kvm_intel' > /sys/kernel/tracing/set_ftrace_filter
     # echo function > /sys/kernel/tracing/set_ftrace_filter
     # qemu -enable-kvm /home/my-qemu-image
       <Ctrl-C>
     # rmmod kvm_intel
     # cat /sys/kernel/tracing/trace
     qemu-system-x86-2408  [001] d..2   135.013238:  <-kvm_arch_hardware_enable
     qemu-system-x86-2408  [001] ....   135.014574:  <-kvm_arch_vm_ioctl
     qemu-system-x86-2408  [001] ....   135.015420:  <-kvm_vm_ioctl_check_extension
     qemu-system-x86-2408  [001] ....   135.045411:  <-__do_cpuid_ent
     qemu-system-x86-2408  [001] ....   135.045412:  <-__do_cpuid_ent
     qemu-system-x86-2408  [001] ....   135.045412:  <-__do_cpuid_ent
     qemu-system-x86-2408  [001] ....   135.045412:  <-__do_cpuid_ent
     qemu-system-x86-2408  [001] ...1   135.045413:  <-__do_cpuid_ent
     qemu-system-x86-2408  [001] ....   135.045413:  <-__do_cpuid_ent

    When it should show:

     qemu-system-x86-2408  [001] d..2   135.013238: 0xffffffffa02a39f0 <-kvm_arch_hardware_enable
     qemu-system-x86-2408  [001] ....   135.014574: 0xffffffffa02a2ba0 <-kvm_arch_vm_ioctl
     qemu-system-x86-2408  [001] ....   135.015420: 0xffffffffa029e4e0 <-kvm_vm_ioctl_check_extension
     qemu-system-x86-2408  [001] ....   135.045411: 0xffffffffa02a1380 <-__do_cpuid_ent
     qemu-system-x86-2408  [001] ....   135.045412: 0xffffffffa029e160 <-__do_cpuid_ent
     qemu-system-x86-2408  [001] ....   135.045412: 0xffffffffa029e180 <-__do_cpuid_ent
     qemu-system-x86-2408  [001] ....   135.045412: 0xffffffffa029e520 <-__do_cpuid_ent
     qemu-system-x86-2408  [001] ...1   135.045413: 0xffffffffa02a13b0 <-__do_cpuid_ent
     qemu-system-x86-2408  [001] ....   135.045413: 0xffffffffa02a1380 <-__do_cpuid_ent

    instead.
```

This patch fixed the issue by parsing the trace_pipe output considering the
`SYMBOL_OR_ADDRESS` field may or may not be empty.
Signed-off-by: Yonghong Song <yhs@fb.com>

As discussed in https://github.com/iovisor/bcc/pull/1531
review comments.
Signed-off-by: Nathan Scott <nathans@redhat.com>

Several python tools allow their eBPF code to be printed to
stdout for debugging.  There are other projects that would
like to share these program definitions however, instead of
duplicating code.  Formalise an -e/--ebpf option, and start
using it in several tools (more to come).
Signed-off-by: Nathan Scott <nathans@redhat.com>