Sync with latest libbpf repo. The sync'ed top libbpf repo
commit is:
  67a4b1464349 ci: remove subprogs from 5.5 whitelist

Signed-off-by: Yonghong Song <yhs@fb.com>

As reported in #3913, vfs_fsync is never triggered when fsync is called.
Use vfscount can reveal that:

    sudo python3 ./vfscount.py
    Tracing... Ctrl-C to end.
    ^C
    ADDR             FUNC                          COUNT
    ffffffff8ad23621 b'vfs_writev'                     2
    ffffffff8ad29df1 b'vfs_getattr_nosec'             55
    ffffffff8ad20401 b'vfs_open'                      58
    ffffffff8ad2a7b1 b'vfs_statx'                     91
    ffffffff8ad641d1 b'vfs_fsync_range'             1802
    ffffffff8ad22111 b'vfs_read'                    1900
    ffffffff8ad22551 b'vfs_write'                   3752

Let's use vfs_fsync_range instead to trace fsync operations.

Closes #3913.

Signed-off-by: Hengqi Chen <chenhengqi@outlook.com>

libbpf-tools: convert BCC tcpsynbl to BPF CO-RE version

usdt: support xmm registers as args for x64

Support for using xmm registers for USDT args was added to systemtap in
early 2021 (commit 04c99d0d0267f574fa60044c96933b0dd3846aa1 added xmm0-7
and eaa15b047688175a94e3ae796529785a3a0af208 added xmm8-15). As a result
these registers are showing up in probe descriptors on Fedora.

pthread_start probe description on Ubuntu 20.04:
```
  stapsdt              0x00000052       NT_STAPSDT (SystemTap probe descriptors)
    Provider: libpthread
    Name: pthread_start
    Location: 0x00000000000095e9, Base: 0x000000000001922c, Semaphore: 0x0000000000000000
    Arguments: 8@%rax 8@1600(%rax) 8@1608(%rax)
```

And in the Fedora test container:
```

```
  stapsdt              0x00000053       NT_STAPSDT (SystemTap probe descriptors)
    Provider: libpthread
    Name: pthread_start
    Location: 0x0000000000009280, Base: 0x0000000000016cbc, Semaphore: 0x0000000000000000
    Arguments: 8@%xmm0 8@1600(%rax) 8@1608(%rax)
```

bcc doesn't recognize these registers so it's unable to generate code to fetch arguments which use these registers for storage. Add support for XMM0-15

.

This should fix `lib/uthreads.py` test, which uses `pthread_start` and therefore fails to generate program on Fedora.

Signed-off-by: Dave Marchevsky <davemarchevsky@fb.com>

commit 531b698c ("libbpf-tools: Enable compilation warnings for
BPF programs") applies CFLAGS to all targets. However, some of the c
flags typically used by distribution are not available to the bpf
target. Add a new BPFCFLAGS macro to take care of that.

Fixes the following compilation error on fedora:

  BPF      bashreadline.bpf.o
clang-13: warning: optimization flag '-ffat-lto-objects' is not supported [-Wignored-optimization-argument]
clang-13: warning: argument unused during compilation: '-specs=/usr/lib/rpm/redhat/redhat-hardened-cc1' [-Wunused-command-line-argument]
clang-13: warning: argument unused during compilation: '-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1' [-Wunused-command-line-argument]
clang-13: warning: argument unused during compilation: '-fstack-clash-protection' [-Wunused-command-line-argument]
error: option 'cf-protection=return' cannot be specified on this target
error: option 'cf-protection=branch' cannot be specified on this target
2 errors generated.

btf__get_map_kv_tids() is deprecated and causes annoying compilation warnings.
Reimplement it in BCC.

Signed-off-by: Hengqi Chen <chenhengqi@outlook.com>

llvm upstream patch https://reviews.llvm.org/D118652


did some header file cleanup and this breaks bcc with llvm15
with the following compilation error:

  /.../src/cc/bpf_module.cc: In member function ‘void ebpf::BPFModule::dump_ir(llvm::Module&)’:
  /.../src/cc/bpf_module.cc:231:39: error: no matching function for call to ‘llvm::legacy::PassManager::add(llvm::Module Pass*)’
   PM.add(createPrintModulePass(errs()));
                                       ^
  In file included from /.../src/cc/bpf_module.cc:25:
  /.../include/llvm/IR/LegacyPassManager.h:58:8: note: candidate: ‘virtual void llvm::legacy::PassManager::add(llvm::Pass*)’
     void add(Pass *P) override;
          ^~~
  /.../include/llvm/IR/LegacyPassManager.h:58:8: note:   no known conversion for argument 1 from ‘llvm::ModulePass*’ to ‘llvm::Pass*’

Adding the include path "llvm/Pass.h" in bpf_module.cc fixed the issue.

Signed-off-by: Yonghong Song <yhs@fb.com>

The tool cachestat is broken on kernel 5.15 due to kernel function
renaming. Fix the tool by detecting symbol existence. See #3687 and
 #3692.

Signed-off-by: Hengqi Chen <chenhengqi@outlook.com>

During 5.17 dev cycle, the kernel dropped request->rq_disk. It can now be
accessed through request->q->disk. Fix the python ones in tools/. There are
more usages in other places which need to be fixed too.

Signed-off-by: Tejun Heo <tj@kernel.org>

Tested seem to work.

When CONFIG_DEBUG_LOCK_ALLOC is set ([0]), mutex_lock, mutex_lock_interruptible
and mutex_lock_killable become macro defines and gone from ksyms. Let's use
the *_nested functions as tracing targets instead.

  [0]: https://github.com/torvalds/linux/blob/df0cc57e057f18e44dac8e6c18aba47ab53202f9/include/linux/mutex.h#L177-L209



Signed-off-by: Hengqi Chen <chenhengqi@outlook.com>

When use -O -C for count run queue occupancy for each CPU separately,
the first cpu statistics are correct; however, the data used by the
subsequent cpus are on top of the accumulation of the previous cpu data,
but not really separate-CPU statistics.

This is because the variables used for calculation are defined outside
the calculation loop body, resulting in the value of each variable being
accumulated on the basis of the previous calculation.

So put them into the loop body  to fix it.

Signed-off-by: Hailong Liu <liuhailong@linux.alibaba.com>

When DEBUG_LOCK_ALLOC is set, mutex_lock is changed to
mutex_lock_nested, which means that attaching the kprobe statically to
mutex_lock won't work for all kernel configurations.

This change detects the available kprobe functions exposed by the kernel
and ensures that the kprobe is attached correctly.

Fixes #3882

Add -v(--verbose) and -h option to oomkill to display libbpf log.

Signed-off-by: Eunseon Lee <es.lee@lge.com>

Add -v(--verbose) option to klockstat to display libbpf log

Signed-off-by: Eunseon Lee <es.lee@lge.com>

Kernel commit 24b83deb29b ("block: move struct request to blk-mq.h")
and be6bfe36db17 ("block: inline hot paths of blk_account_io_*()")
introduce changes which break disksnoop.

Like #3748 and #3877 but for disksnoop, this commit fixes those issues.

Closes #3825.

Signed-off-by: Hengqi Chen <chenhengqi@outlook.com>

Decode symname for exception message and add module to the exception message

Kernel commit 24b83deb29b ("block: move struct request to blk-mq.h")
has moved struct request  from blkdev.h to blk-mq.h. It results in
several bio tools to fail with errors of the following type:

error: incomplete definition of type 'struct request'

Since blk-mq.h had always included blkdev.h. it is safe to simply
replace the inclusion of blkdev.h by blk-mq-h. It works on both older
and newer kernel.

Fixes: #3869

Signed-off-by: Jerome Marchand <jmarchan@redhat.com>

libbpf-tools/opensnoop: remove unused variable and macro

libbpf-tools: Use __u16 for bindsnoop protocol.

libbpf-tools: remove redundant slash

bcc internals: Keep track of BPF progs using function instead of section

Since the dir function returns a path which ends with a trailing slash,
there is no need to add it again.

Signed-off-by: Yuntao Wang <ytcoode@gmail.com>

The kernel uses u16 for sk_protocol [1] and multipath TCP connection protocol
has value 262 [2]

Signed-off-by: Francis Laniel <flaniel@linux.microsoft.com>

---
[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/net/sock.h?h=v5.16#n481
[2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/uapi/linux/in.h?h=v5.16#n81

The variable min_us and macro TASK_RUNNING are not used, remove them.

Signed-off-by: Yuntao Wang <ytcoode@gmail.com>

Commit bf9765145b85 ("sock: Make sk_protocol a 16-bit value") reorganizes
the layout of struct sock and make sk_protocol a field of u16. This makes
the bindsnoop print `UNKN` for its `PROT` field.

See ([0]) and ([1]) for more details.

  [0]: #3845
  [1]: https://github.com/torvalds/linux/commit/bf9765145b85



Signed-off-by: Hengqi Chen <chenhengqi@outlook.com>