offcputime -f: don't miss backtrace bounds

See #559

Merge pull request #560 from evverx/clarify-offcputime

Update manpage for offcputime

Merge pull request #554 from evverx/fix-p-option

Fix tools[/old]/offcputime -p PID

Update manpage for offcputime

Closes #558

Fix tools[/old]/offcputime -p PID

We should extract pid before THREAD_FILTER

Merge pull request #555 from markdrayton/execsnoop

execsnoop: use BPF_PERF_OUTPUT, add PPID

execsnoop: show PPID in output

execsnoop: use BPF_PERF_OUTPUT instead of trace pipe

Merge pull request #557 from ryanmiao/mypr

set use_errno to True for libbcc.so

Merge pull request #544 from abirchall/abirchall_release

Add user space stack traces to offcputime

set use_errno to True for libbcc.so

Currently, errno could not be accessed by libbcc.py, like:
```
binding socket to 'eth0'
cannot create raw socket: Operation not permitted
Traceback (most recent call last):
  File "/home/ryan/Software/bcc/examples/networking/http_filter/http-parse-simple.py", line 73, in <module>
    BPF.attach_raw_socket(function_http_filter, interface)
  File "/usr/lib/python2.7/site-packages/bcc/__init__.py", line 330, in attach_raw_socket
    raise Exception("Failed to open raw device %s: %s" % (dev, errstr))
Exception: Failed to open raw device eth0: Success
```
The exception prints the errno as `Success`, instead of `EPERM`.

This patch would fix this problem.

Signed-off-by: Jincheng Miao <jincheng.miao@gmail.com>

Merge pull request #552 from evverx/install-tools-old

Install tools/old

Point people to tools/old

Install tools/old too

Merge pull request #551 from vmg/vmg/lua-para

lua: Allow LuaJIT parameterized types in `open_perf_buffer`

lua: Allow LuaJIT parameterized types in `open_perf_buffer`

Merge pull request #550 from markdrayton/trace-fields

Use BPF_PERF_OUTPUT for fileslower and stacksnoop

Use BPF_PERF_OUTPUT for fileslower and stacksnoop

Update documentation and man page for offcputime

Add user space stack traces to offcputime

Summary:
* generalize `KernelSymbolCache` into `SymbolCache` which supports user/kernel space symbols
* create `BPF.sym()` for resolving user/kernel space symbols
* `_ksym_cache` => `_sym_caches` and create `BPF._sym_cache()` to leverage the symbol caches
* update `tools/offcputime.py` to print user space stack traces

Test Plan:
```
dev[bcc](abirchall_next): ~/bcc_run_tool.sh offcputime -U -k -f 1
ERROR: Displaying user stacks for kernel threads doesn't make sense.
devbig680[bcc](abirchall_next): ~/bcc_run_tool.sh offcputime -K -f 1 | grep python2 | head -n 1
python2.7;system_call_fastpath;sys_futex;do_futex;futex_wait;futex_wait_queue_me;schedule 19
dev[bcc](abirchall_next): ~/bcc_run_tool.sh offcputime -U -f 1 | grep python2 | head -n 1
python2.7;clone;start_thread;t_bootstrap;PyEval_CallObjectWithKeywords;PyObject_Call;instancemethod_call;PyObject_Call;function_call;PyEval_EvalCodeEx;PyEval_EvalFrameEx;PyObject_Call;function_call;PyEval_EvalCodeEx;PyEval_EvalFrameEx;time_sleep;PyEval_RestoreThread 5
devbig680[bcc](abirchall_next): ~/bcc_run_tool.sh offcputime -f 1 | grep python2 | head -n 1
python2.7;system_call_fastpath;sys_futex;do_futex;futex_wait;futex_wait_queue_me;schedule;[unknown];__libc_start_main;Py_Main;RunModule;PyObject_Call;function_call;PyEval_EvalCodeEx;PyEval_EvalFrameEx;PyEval_EvalFrameEx;PyEval_EvalCodeEx;PyEval_EvalFrameEx;lock_PyThread_acquire_lock;PyEval_RestoreThread 39
```

Merge pull request #535 from MQasimSarfraz/patch-1

Updated monitor.c to take care of host byte order

Merge pull request #546 from iamkafai/master

Fix a few fd leaks

This diff fixes a few fd leaks after reading files under
/sys/kernel/debug/tracing.

Removing htons in tunnel.py for consistency.

Merge pull request #543 from abirchall/abirchall_release

add --kernel-threads-only to tools/offcputime

add --kernel-threads-only to tools/offcputime

Summary:
Adds `--kernel-threads-only` arg
The kernel-threads-only arg is exclusive with pid/user-threads-only via `parser.add_mutually_exclusive_group`.
The output message now indicates what we are tracing (pid/user threads/kernel threads/all threads).
Removed the --verbose arg (unused).

Test Plan:
Run with combinations of the args; validate output looks sane:

// test mutually exclusive group
```
devbig680[bcc](abirchall_dev): ~/bcc_run_tool.sh offcputime -k -u 1
[Running] /data/users/abirchall/bcc/tools/offcputime.py -k -u 1
usage: offcputime.py [-h] [-p PID | -k | -u] [-v] [-f] [duration]
offcputime.py: error: argument -u/--user-threads-only: not allowed with argument -k/--kernel-threads-only
```

// kernel threads only
```
devbig680[bcc](abirchall_dev): ~/bcc_run_tool.sh offcputime -f -k 1
[Running] /data/users/abirchall/bcc/tools/offcputime.py -f -k 1
swapper/21;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 11
swapper/16;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 19
swapper/22;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 20
swapper/31;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 20
swapper/23;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 67
swapper/25;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 74
...
```
`~/bcc_run_tool.sh offcputime -f --kernel-threads-only 1`

// user threads only
`~/bcc_run_tool.sh offcputime -f --user-threads-only 1`
`~/bcc_run_tool.sh offcputime -f -u 1`

// specific pid
`~/bcc_run_tool.sh offcputime -f -p $(pidof hphpi) 1`
```
devbig680[bcc](abirchall_dev): ~/bcc_run_tool.sh offcputime --pid $(pidof mcrouter) 10 | head
[Running] /data/users/abirchall/bcc/tools/offcputime.py --pid 95929 10
Tracing off-CPU time (us) of PID 95929 by kernel stack for 10 secs.
```

Note that this last case (specific PID) doesn't appear to be working; I can debug that in a follow up commit.

Merge pull request #533 from abirchall/abirchall_dev

handle ENOMEM in tools/offcputime

move ENOMEM comment; create --stack-storage-size arg; misc cleanup

Summary:
* move ENOMEM comment from tools/offcputime.py to src/cc/export/helpers.h
* create --stack-storage-size arg to allow the user to set the stack storage size
    * requires a positive_nonzero_int type checking function for argparse
* clean up the rest of the args a bit
    * use parser.add_mutually_exclusive_group instead of manually handling the
      mutual exclusion
    * use positive_nonzero_int for duration arg
    * use positive_int for pid arg
* only print a warning about increasing the storage size if at least one of the
  get_stackid errors was a -ENOMEM
* remove the debug param (we can add this manually when testing)
* fix a bug where all processes are traced when specifying pid of 0

Test Plan:
```
devbig680[bcc](no branch, rebasing abirchall_dev): ~/bcc_run_tool.sh offcputime --help
[Running] /data/users/abirchall/bcc/tools/offcputime.py --help
usage: offcputime.py [-h] [-u | -p PID] [-v] [-f]
                     [--stack-storage-size STACK_STORAGE_SIZE]
                     [duration]

Summarize off-CPU time by kernel stack trace

positional arguments:
  duration              duration of trace, in seconds

optional arguments:
  -h, --help            show this help message and exit
  -u, --useronly        user threads only (no kernel threads)
  -p PID, --pid PID     trace this PID only
  -v, --verbose         show raw addresses
  -f, --folded          output folded format
  --stack-storage-size STACK_STORAGE_SIZE
                        the number of unique stack traces that can be stored
                        and displayed

examples:
    ./offcputime             # trace off-CPU stack time until Ctrl-C
    ./offcputime 5           # trace for 5 seconds only
    ./offcputime -f 5        # 5 seconds, and output in folded format
    ./offcputime -u          # don't include kernel threads (user only)
    ./offcputime -p 185      # trace fo PID 185 only
devbig680[bcc](no branch, rebasing abirchall_dev): ~/bcc_run_tool.sh offcputime -f 0
[Running] /data/users/abirchall/bcc/tools/offcputime.py -f 0
usage: offcputime.py [-h] [-u | -p PID] [-v] [-f]
                     [--stack-storage-size STACK_STORAGE_SIZE]
                     [duration]
offcputime.py: error: argument duration: must be positive and nonzero
devbig680[bcc](no branch, rebasing abirchall_dev): ~/bcc_run_tool.sh offcputime -f -1
[Running] /data/users/abirchall/bcc/tools/offcputime.py -f -1
usage: offcputime.py [-h] [-u | -p PID] [-v] [-f]
                     [--stack-storage-size STACK_STORAGE_SIZE]
                     [duration]
offcputime.py: error: argument duration: must be positive and nonzero
devbig680[bcc](no branch, rebasing abirchall_dev): ~/bcc_run_tool.sh offcputime --stack-storage-size 0 -f 1
[Running] /data/users/abirchall/bcc/tools/offcputime.py --stack-storage-size 0 -f 1
usage: offcputime.py [-h] [-u | -p PID] [-v] [-f]
                     [--stack-storage-size STACK_STORAGE_SIZE]
                     [duration]
offcputime.py: error: argument --stack-storage-size: must be positive and nonzero
devbig680[bcc](no branch, rebasing abirchall_dev): ~/bcc_run_tool.sh offcputime --stack-storage-size 1 -f 1
[Running] /data/users/abirchall/bcc/tools/offcputime.py --stack-storage-size 1 -f 1
swapper/27;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 7
swapper/29;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 102
swapper/25;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 113
swapper/26;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 138
swapper/28;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 164
swapper/30;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 177
swapper/24;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 980
swapper/31;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 1556
swapper/1;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 2038
swapper/3;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 2190
swapper/2;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 2235
swapper/15;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 2260
swapper/13;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 2450
swapper/6;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 2646
swapper/12;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 2675
swapper/11;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 2769
swapper/8;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 2885
swapper/4;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 3134
swapper/10;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 3416
swapper/14;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 3702
swapper/7;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 4343
swapper/9;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 5397
swapper/5;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 6836
swapper/17;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 13792
swapper/19;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 14488
swapper/22;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 15298
swapper/18;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 15735
swapper/20;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 17333
swapper/16;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 17645
swapper/23;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 17681
swapper/21;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 18607
WARNING: 92 stack traces could not be displayed. Consider increasing --stack-storage-size.

handle ENOMEM in tools/offcputime

Summary:
BPF_STACK_TRACE(_name, _size) will allocate space for _size stack traces
(see https://github.com/torvalds/linux/blob/master/kernel/bpf/stackmap.c#L30-L50).

If we've already used all of this space, subsequent calls to bpf_get_stackid()
will return -ENOMEM (see https://github.com/torvalds/linux/blob/master/kernel/bpf/stackmap.c#L173-L176).

This causes our BPF bytecode to store this value in key_t.stack_id and
subsequently causes our python application to crash due to a KeyError when
invoking stack_traces.walk(k.stack_id).

Let's avoid calling stack_traces.walk(k.stack_id) with back stackid's

Test Plan:
Run offcputime.py in an extreme case; with space for only a single stack trace
```
devbig680[bcc](tools): sed_in_file 's/BPF_STACK_TRACE(stack_traces, 1024)/BPF_STACK_TRACE(stack_traces, 1)/' tools/offcputime.py && \
> ~/bcc_run_tool.sh offcputime -f 5; \
> git reset --hard HEAD
swapper/30;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 496
swapper/26;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 553
swapper/28;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 604
swapper/31;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 692
swapper/23;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 713
swapper/18;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 919
swapper/16;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 1051
swapper/20;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 1056
swapper/21;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 1585
swapper/24;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 1597
swapper/27;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 1610
swapper/17;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 1674
swapper/22;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 2390
swapper/25;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 2574
swapper/19;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 2589
swapper/29;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 8428
swapper/8;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 15272
swapper/15;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 15591
swapper/11;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 17934
swapper/9;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 18100
swapper/14;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 18266
swapper/10;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 20124
swapper/12;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 20887
swapper/13;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 23453
swapper/3;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 27296
swapper/5;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 29094
swapper/6;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 29799
swapper/7;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 31522
swapper/1;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 32269
swapper/4;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 35585
swapper/2;start_secondary;cpu_startup_entry;schedule_preempt_disabled;schedule 37627
WARNING: 249 stack traces could not be displayed. Consider increasing stack trace storage size.
HEAD is now at d3365e9 [RFC] handle ENOMEM in tools/offcputime`
```

Merge pull request #542 from mbertrone/master

http_filter fixes

invalid access fixed. parameter for specify the interface added

Merge branch 'master' into patch-1

Avoid byte swap for vxlan port

Signed-off-by: MQasimSarfraz <qasims@example.com>

Merge pull request #539 from markdrayton/lua-tools

Lua ports of biosnoop and stacksnoop

Lua ports of biosnoop and stacksnoop

Merge pull request #541 from zaafar/master

updated cmake system to include lua and new networking example

Updated the cmake file system to include lua and new networking tools.

Merge pull request #536 from valkum/master

Add new example with test case for for unroll, as requested.

Merge pull request #538 from iovisor/luajit_header_revert

Revert "Force lua main.c to include luajit headers"

Revert "Force lua main.c to include luajit headers"

This reverts commit c21b9c036cba26e2927fbb5e46985faa73ef743e.

Instead, use `LUAJIT_DIR=/usr/include/luajit-2.0 cmake ..` or similar as
required.

Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Missed this one by extracting this from my actual program.

Add dns_matching example with test case for for unroll, as requested at iovisor-dev@lists.iovisor.org

Merge pull request #531 from kivikakk/lua-install-docs

Lua installation instructions.

Lua installation instructions.

Merge pull request #518 from vmg/vmg/lua-usdt-2

[RFC] New USDT API

cc: Use `unique_ptr` instead of `shared_ptr`

cc: Style fixes

cc: Better memory handling for USDT probes

usdt: Implement `bpf_usdt_readarg` as frontend action

cc: Style fixes

lua: Fix tests

lua: Implement "Hello world" USDT example

lua: Implement an USDT helper

cc: Wrap the USDT probe context in a C API

cc: Implement `bcc_resolve_global_addr` helper

Merge pull request #530 from iovisor/bblanco_dev

Add check for number of arguments

Fixup tplist and argdist for python3 compat

sys.exc_value and sys.exc_type should come from sys.exc_info()

Convert (decode) char* return values from C functions to a native python
str.

Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Add check for number of arguments

There are two problems here:
 1. bcc is leaving the extra function parameters in the prototype, when
 these really just serve as an annotation on the method being traced.
 They aren't really passed into the function. LLVM lowering phase later
 errors out on such functions.
 2. bcc doesn't limit the size of the argument list, when currently it
 just supports up to the number of arguments held in registers (6).

Fix 1. by rewriting the arguments out of the prototype and into the
preamble where they are currently being initialized.
Fix 2. by enforcing the limit and returning a more meaningful error
message.

Added a test case.

Extra fix included for string type on python3.

Fixes: #497
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Merge pull request #529 from rnav/ptregs_helpers_v2

Introduce helpers to access pt_regs in an arch-independent manner

cc: introduce helpers to access pt_regs in an arch-independent manner

Convert some of the examples and tools to use the new helpers.

Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>

Merge pull request #528 from iovisor/bblanco_dev

fix llvm 3.9 build

fix llvm 3.9 build

Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Merge pull request #524 from iovisor/luajit_header

Force lua main.c to include luajit headers

Force lua main.c to include luajit headers

On my system, when both lua and luajit are installed, multiple headers
exist in /usr/include. However, my lua installation is 5.3, which has
some api-breaking changes, which means that the standard lua.h must not
be included.

Simply force lua.h to come from luajit-2.0 directory.

Merge pull request #523 from iovisor/bblanco_dev

Make style-check test non-blocking

Make style-check test non-blocking

Since the codebase is as of yet inconsistent, disable per-commit style
check enforcement.

This should be turned back on once the codebase style is consistent.

Merge pull request #521 from iovisor/bblanco_dev

Adjust pid filtering/display in runqlat

Adjust pid filtering/display in runqlat

The filtering and display of pids in the runqlat tool was not correct.
Internally, the kernel keeps pid and tgid, which correspond to thread-id
and user process-id, respectively. The runqlat tool was filtering and
displaying pid instead of tgid.

Change -P and -p options to filter by tgid, and add a new option to give
a breakdown by pid (thread-id).

Update the docs with the -L option.

Merge pull request #519 from iovisor/bblanco_dev

Fixes for clang frontend bugs and misc

Merge branch 'master' into bblanco_dev

Merge pull request #520 from rnav/powerpc-support-v2

Powerpc support v2

tests: fix a few tests to use the right register on powerpc

Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>

tests: only test arch-specific symbols

__per_cpu_start has a different address on each architecture. Instead,
use a arch-unique symbol for the test.

Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>

cc: add powerpc support

Basic support for building on powerpc. Tested on ppc64le.

Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>

Fix errors on python3

Use local key/leaf definition instead of bpf_tunnel_key

Even after fixing the nested union issue in the preceding commits, this
example was failing. The reason was that the kernel was filling in all
bits of the bpf_tunnel_key, which in recent kernels includes non-zero
fields such as ttl. That non-zero field would break the lookup in the
tunkey2if table, which was populated assuming all extra bytes would be
zero.

Fix it by defining a simpler key structure, and copy the required fields
out from the local variable.

Fixes: #510

Add clang support for nested struct/union as key field

Clang was up until now not able to parse nested structs or unions as a
field in the table key or leaf. Add support in the library side, as well
as python support for the exported json description.

Add a test for broken nested union clang parsing

Avoid a warning in bpf_module.cc

The variable inside the if statement was unused, unliked the blocks
above and below it. Use the isa<> check instead.

skip include of kernel bpf.h in test, forward declare instead

Merge pull request #517 from vmg/vmg/clang-diag

cc/clang: Use positional arguments for diagnostic messages

Merge pull request #515 from vmg/vmg/static-lua

Lua tooling improvements

cc/clang: Use positional arguments for diagnostic messages

lua: Proper style for main.c

lua: Do not try to detach buffers as kprobes

table.py: Call `__delitem__ when deleting an item :)

lua: Fix regeneration of `bcc.lua`

bcc-lua: Build as a C executable

lua: Make all probes executable

lua: build as a standalone tool with static libbcc

Merge pull request #514 from mcaleavya/master

updated opensnoop to use bpf_perf_output

updated opensnoop to use bpf_perf_output

Merge pull request #498 from vmg/vmg/usdt

[WIP] Native implementation for USDT probes

cc: Finish USDT implementation

cc: Implement symbol resolution for USDT

cc: Split bcc_syms.cc into a C++ header file

cc: Allow callback cancellation on bcc_procutils

cc: Add missing include

usdt: Implement probe resolution [WIP]

usdt: Implement `assign_to_local`