introduce new BPF APIs to get kernel syscall entry func name/prefix

As described in issue #1695, on 4.17 for syscalls on x86,
both sys_<fnname> and SyS_<fnname> are gone, the replacements
are __ia32_sys_sync and __x64_sys_sync.
The commit in Linus tree:
https://github.com/torvalds/linux/commit/d5a00528b58cdb2c71206e18bd021e34c4eab878

This patch introduced two APIs for python BPF object.
The API get_syscall_prefix() returns the prefix "sys_"/"__x64_sys_".
The API get_syscall_fnname(name) returns kernel function name for the syscall,
e.g., on x64, get_syscall_fnname("clone") will return "sys_clone" if kernel
has it, otherwise, "__x64_sys_clone".
get_syscall_prefix() is mostly useful for the regex func specifier of
attach_kprobe().

This patch only fixed the code using python API on examples and tests directory.

TOTO: python on tools directory, C++ and lua
Signed-off-by: Yonghong Song <yhs@fb.com>

print out more useful attach_kprobe failure information

As stated in issue #1695, the following commit
https://github.com/torvalds/linux/commit/5c8dad48e4f53d6fd0a7e4f95d7c1c983374de88
removed corresponding dmesg when attach_kprobe failed, and
userspace needs to print out proper error messages.
Signed-off-by: Yonghong Song <yhs@fb.com>

Add -c option for profile.py

Fix offwaketime PID / TGID handling

Refactor offcputime stack id error handling

Use better kprobes for runqlat.py

Fix probe name encoding in Python 3

fix profile.py with latest net-next

fixing bpflist

when you have lots of shortlived progs, there is posibillity of
race condition during proc scanning. you could get pid of this
shortlived prog, but when you will start to read it's fd/ dir
it will fail, as prog would be already terminated

The profile.py tries to validate whether the "ip" from the
context register is a kernel ip address or not by comparing
"ip" to the kernel PAGE_OFFSET.

On non-x86_64 architectures, PAGE_OFFSET can be directly used.
On x86_64 architecture, things become more complex.
With 4.17 (latest linus tree), __PAGE_OFFSET_BASE is gone
and replaced with __PAGE_OFFSET_BASE_L5 and __PAGE_OFFSET_BASE_L4
for 5 and 4 level page table respectively.
Running profile.py will have the following error:
    /virtual/main.c:41:18: error: use of undeclared identifier '__PAGE_OFFSET_BASE'
            if (ip > __PAGE_OFFSET_BASE) {
                     ^
    1 error generated.

So, for 4.17, __PAGE_OFFSET_BASE_{L4, L5} should be used.
For 4.16 and some old kernels (e.g., 4.11), which I did not
check earlier one, __PAGE_OFFSET_BASE should be used.
For even older kernels like 4.6, PAGE_OFFSET should be used.
Signed-off-by: Yonghong Song <yhs@fb.com>

fix python3 py_test_histogram failure

QoL improvements for inject

With python3 (specifically 3.6.3), py_test_histogram failed with:
  Traceback (most recent call last):
  File "./test_histogram.py", line 106, in test_multiple_key
    bucket_sort_fn=bucket_sort)
  File "/usr/lib/python3.6/site-packages/bcc/table.py", line 318, in print_log2_hist
    buckets = bucket_sort_fn(buckets)
  File "./test_histogram.py", line 98, in bucket_sort
    buckets.sort()
  AttributeError: 'dict_keys' object has no attribute 'sort'

The reason is for a dictionary tmp, tmp.keys() returns an object
of keys (a list) instead of the list itself for python3.
Using list(tmp.keys()) seems working for both python2 and python3.
Signed-off-by: Yonghong Song <yhs@fb.com>

fix test_libbcc failure with 4.15.

The test sleeps one second and expects the perf counter to
be one second or more. But in reality (probably esp. in VM
which I conducted my experiments), I mostly saw counters
between 0.9s - 1s and occasionally 0.8s - 0.9s.

So be a little bit conservative here when checking the
result.
Signed-off-by: Yonghong Song <yhs@fb.com>

filetop: probe vfs_read and vfs_write instead to fix inlining issue

Filetop was originally designed to probe __vfs_read and __vfs_write,
which are called by vfs_read and vfs_write, respectively. However,
__vfs_read and __vfs_write are at times inlined, leading to these
particular functions never actually being called. Since these functions
are never called, the probes are never hit, and so filetop ends up
registering zero READs and WRITEs.

This patch fixes the issue by attaching the probes to vfs_read and
vfs_write instead, which are guaranteed to be called during file reads
and writes.
Signed-off-by: Jazel Canseco <jcanseco@google.com>

Improve clear table API in C++

Add features/docs for inject (4.17)

bcc/syms: Fix shared library symbol lookup

Shared library addresses needed to be mapped what the address is expected in the
symbol table. The address offset of the running shared library may be different from
the one in the SO binary file. So we have to map it correctly in order for symbol
look up to work.

Often the address and file offset are the same so it works, however in Android this
is not the case a lot of times. Fix the issue by adjusting the offset with the
file offset from the ELF.

Test: stackcount 'sys_futex' -v

Before patch:
  ffffff800814bc14 sys_futex
  775d8e0db0       syscall
  775e149fe8       [unknown]
  775e14a598       [unknown]
  775e16a9e4       android::Parcel::validateReadData(unsigned long) const
  775e05d738       android::Thread::_threadLoop(void*)
  775d942470       __pthread_start(void*)
  775d8e54f8       __start_thread
    Binder:13353_5 [13353]

After patch:
  ffffff800814bc14 sys_futex
  78ba2e1db0       syscall
  78b97d4fe8       android::IPCThreadState::getAndExecuteCommand()
  78b97d5598       android::IPCThreadState::joinThreadPool(bool)
  78b97f59e4       [unknown]
  78b8dda738       android::Thread::_threadLoop(void*)
  78ba4ffbd0       android::AndroidRuntime::javaThreadShell(void*)
  78ba343470       __pthread_start(void*)
  78ba2e64f8       __start_thread
    Binder:14001_8 [14001]

Matches Perf output:
        ffffff800814bc14 sys_futex ([kernel.kallsyms])
                   1edb0 syscall (/system/lib64/libc.so)
                   45fe8 android::IPCThreadState::getAndExecuteCommand (/system/lib64/libbinder.so)
                   46598 android::IPCThreadState::joinThreadPool (/system/lib64/libbinder.so)
                   669e4 [unknown] (/system/lib64/libbinder.so)
                   10738 android::Thread::_threadLoop (/system/lib64/libutils.so)
                   7ebd0 android::AndroidRuntime::javaThreadShell (/system/lib64/libandroid_runtime.so)
                   80470 __pthread_start (/system/lib64/libc.so)
                   234f8 __start_thread (/system/lib64/libc.so)

Fixes: https://github.com/iovisor/bcc/issues/1628Signed-off-by: Joel Fernandes <joelaf@google.com>
Signed-off-by: Joel Fernandes <joel@linuxinternals.org>

Added -q option to execsnoop to quote individual arguments. 

moved quoting below argument pattern match, so that the pattern match happens on the unquoted argument