Fix 'too few arguements' compile error when NO_LIBELF
userspace: add options to print sdt notes and symbols from DSO.

Examples:
./ktap -F ./ktap # print symbols
./ktap -M ./ktap # print sdt markers

Don't available without libelf.

Signed-off-by: Azat Khuzhin <a3at.mail@gmail.com>
Fix the bug on parsing lines in KALLSYMS

'\t' and ' ' can both be used to delimit words in lines of the file
/proc/kallsyms, so strtok should take both as the delimiter parameter.

There is the '\t' between iter->name and iter->module_name
that may cause the error.

When iter->modele_name[0], the parser takes '%s\t[%s]' as the third
token, and treats it as function name, which may lead to unmatch.
fix find DSO load address

DSO load address could be 0x0, so we cannot use 0x0 address
as error return.

Signed-off-by: Jovi Zhangwei <jovi.zhangwei@gmail.com>
add samples script glibc_trace.kp and glibc_sdt.kp

scripts/userspace/glibc_trace.kp: trace all functions in glibc
scripts/userspace/glibc_sdt.kp:   trace all static markers in glibc

Signed-off-by: Jovi Zhangwei <jovi.zhangwei@gmail.com>
add sample script syscalls/syslatl.kp and syscalls/syslist.kp

scripts/syscalls/syslatl.kp: syscall latency linear aggregation
scripts/syscalls/syslist.kp: syscall latency as a list with counts

Both of these two scripts was created by Brendan Gregg.

Some basic ktap examples wroten by Brendan Gregg:
	http://www.brendangregg.com/ktap.html

Signed-off-by: Jovi Zhangwei <jovi.zhangwei@gmail.com>
add uid() built-in function

Similar usage as pid() and tid().

Signed-off-by: Jovi Zhangwei <jovi.zhangwei@gmail.com>
add -q (quiet) command option

Now if ktap wait user press Control+C to stop tracing,
then ktap will print a default message:
	Tracing... Ctrl-C to end.

If user don't want this message, then user can give -q
option, this quiet option is useful for some cases like
need to parse ktap execution output(flame graph).

Signed-off-by: Jovi Zhangwei <jovi.zhangwei@gmail.com>
use symbol annotation for `argname` keyword

Using below ktap one-liner:
ktap -e 's = {}; trace probe:vfs_read,probe:vfs_write { s[argname] += 1 } trace_end { histogram(s) }'

Before:
                          value ------------- Distribution ------------- count
                             kp0 |@@@@@@@@@@@@@@@@@@@@@@@@@@@@@          71
                             kp1 |@@@@@@@@@                              24

After:

                          value ------------- Distribution ------------- count
                        vfs_read |@@@@@@@@@@@@@@@@@@@@@@                 4
                       vfs_write |@@@@@@@@@@@@@@@@                       3

Users may like those keys to be "vfs_read", "vfs_write", and not "kp0", "kp1".

This issue was reported by Brendan Gregg.

Now the `argname` represent the event_name in debugfs.
tracepoint:	/sys/kernel/debug/tracing/$subsystem/$event_name
kprobe:		/sys/kernel/debug/tracing/ktap_kprobes_$pid/$event_name
kretprobe:	/sys/kernel/debug/tracing/ktap_kprobes_$pid/ret_$event_name
uprobe:		/sys/kernel/debug/tracing/ktap_uprobes_$pid/$event_name
uretprobe:	/sys/kernel/debug/tracing/ktap_uprobes_$pid/ret_$event_name

For example:
./ktap -e 's = {}; trace probe:vfs_read,probe:vfs_write, probe:vfs_read%return, probe:vfs_write%return{ s[argname] += 1 } trace_end { histogram(s) }'

Tracing... Ctrl-C to end.
^C
                          value ------------- Distribution ------------- count
                        vfs_read |@@@@@@@@@@@@@@@@@@                     276
                    ret_vfs_read |@@@@@@@@@@@@@@@@@@                     275
                   ret_vfs_write |                                       14
                       vfs_write |                                       12

Signed-off-by: Jovi Zhangwei <jovi.zhangwei@gmail.com>
check event id file exist before write to u(k)probes_event file

A bug was found when execute glibc_trace.kp, that bug was
introduced by last commit.

There have some symbols mapping to same event name(eg, glibc functions)
because of debugfs naming rule issue, so the next event
may overwrite the previous event, cause register previous event
failure.

So if many events mapping to same symbol name, then share
same event id.

(todo: every symbol have its own event id)

Signed-off-by: Jovi Zhangwei <jovi.zhangwei@gmail.com>
add sample script: scripts/userspace/glibc_func_hist.kp

This script output all glibc functions in histogram style.

[root@localhost ktap]# ./ktap scripts/userspace/glibc_func_hist.kp
Tracing... Ctrl-C to end.
^C
                          value ------------- Distribution ------------- count
                   _IO_sputbackc |                                       1536
                  __strncmp_sse2 |                                       1522
                    __GI_strncmp |                                       1522
                     __GI_memcpy |                                       1446
                   __memcpy_sse2 |                                       1446
        _dl_mcount_wrapper_check |                                       1433
   __GI__dl_mcount_wrapper_check |                                       1433
 __gconv_transform_utf8_internal |                                       1429
                       __mbrtowc |                                       1425
                        mbrtoc32 |                                       1425
                  __GI___mbrtowc |                                       1425
                         mbrtowc |                                       1425
                    __GI_mbrtowc |                                       1425
                         strtouq |                                       1274
                        strtoull |                                       1274
                         strtoul |                                       1274
          __ctype_get_mb_cur_max |                                       984
         ____strtoull_l_internal |                                       970
     __GI_____strtoul_l_internal |                                       970
              __GI__IO_sputbackc |                                       960
                             ... |

Signed-off-by: Jovi Zhangwei <jovi.zhangwei@gmail.com>
update testcase

- add -q option to silence some testcae
- update kprobe.kp testcase

Signed-off-by: Jovi Zhangwei <jovi.zhangwei@gmail.com>
test: sleep for 1 second before killing deadloop

Sometimes, pkill get run first before ktap and return 1, which
leaves the deadloop running forever.

Signed-off-by: Qingping Hou <qingping.hou@gmail.com>
use POSIX syntax for shell function definition in run_test

Signed-off-by: Qingping Hou <qingping.hou@gmail.com>
support kprobe wildcards

Example:

[root@localhost linux]#./ktap -e 'trace probe:vfs* { print(argevent) }'

[root@localhost linux]# cat /sys/kernel/debug/tracing/kprobe_events
p:ktap_kprobes_3035/vfs_truncate vfs_truncate
p:ktap_kprobes_3035/vfs_setpos vfs_setpos
p:ktap_kprobes_3035/vfs_llseek vfs_llseek
p:ktap_kprobes_3035/vfs_read vfs_read
p:ktap_kprobes_3035/vfs_write vfs_write
p:ktap_kprobes_3035/vfs_readv vfs_readv
p:ktap_kprobes_3035/vfs_writev vfs_writev
p:ktap_kprobes_3035/vfs_getattr_nosec vfs_getattr_nosec
p:ktap_kprobes_3035/vfs_getattr vfs_getattr
p:ktap_kprobes_3035/vfs_fstat vfs_fstat
p:ktap_kprobes_3035/vfs_fstatat vfs_fstatat
p:ktap_kprobes_3035/vfs_stat vfs_stat
p:ktap_kprobes_3035/vfs_lstat vfs_lstat
p:ktap_kprobes_3035/vfs_readlink vfs_readlink
p:ktap_kprobes_3035/vfs_path_lookup vfs_path_lookup
p:ktap_kprobes_3035/vfs_rmdir vfs_rmdir
p:ktap_kprobes_3035/vfs_unlink vfs_unlink
p:ktap_kprobes_3035/vfs_rename vfs_rename
p:ktap_kprobes_3035/vfs_symlink vfs_symlink
p:ktap_kprobes_3035/vfs_create vfs_create
p:ktap_kprobes_3035/vfs_mknod vfs_mknod
p:ktap_kprobes_3035/vfs_mkdir vfs_mkdir
...

In implementation, ktap find matched symbol from /proc/kallsyms.

This improvement was requested by Brendan Gregg.

Signed-off-by: Jovi Zhangwei <jovi.zhangwei@gmail.com>
add kprobe/uprobe wildcards example into tutorial

Signed-off-by: Jovi Zhangwei <jovi.zhangwei@gmail.com>
add arg offset notes into ktap tutorial

Requested by Brendan Gregg.

Signed-off-by: Jovi Zhangwei <jovi.zhangwei@gmail.com>
update tutorial for pandoc markdown format convent

Signed-off-by: Jovi Zhangwei <jovi.zhangwei@gmail.com>
add sample script scripts/syscalls/opensnoop.kp

This script is contributed by Brendan Gregg.
	http://www.brendangregg.com/ktap/opensnoop.kp

opensnoop.kp: trace open() syscalls and print basic details.
Useful for debugging as it can quickly show which data files,
log files, and config files are in use by an application.

Example:
[root@localhost ktap]# ./ktap -q scripts/syscalls/opensnoop.kp
    UID    PID COMM          FD ERR PATH
      0  11491 ktap           5   0 /sys/kernel/debug/ktap/trace_pipe_11490
      0    994 sendmail       6   0 /proc/loadavg
      0    598 irqbalance     3   0 /proc/interrupts
      0    598 irqbalance     3   0 /proc/stat
      0    598 irqbalance     3   0 /proc/irq/9/smp_affinity
      0    598 irqbalance     3   0 /proc/irq/72/smp_affinity
      0    598 irqbalance     3   0 /proc/irq/73/smp_affinity
      0    598 irqbalance     3   0 /proc/irq/17/smp_affinity
      0    598 irqbalance     3   0 /proc/irq/40/smp_affinity

[root@localhost ktap]# ./ktap -q scripts/syscalls/opensnoop.kp -- ls > /dev/null
    UID    PID COMM          FD ERR PATH
      0  11502 ls             5   0 /etc/ld.so.cache
      0  11502 ls             5   0 /lib64/libselinux.so.1
      0  11502 ls             5   0 /lib64/librt.so.1
      0  11502 ls             5   0 /lib64/libcap.so.2
      0  11502 ls             5   0 /lib64/libacl.so.1
      0  11502 ls             5   0 /lib64/libc.so.6
      0  11502 ls             5   0 /lib64/libpcre.so.1
      0  11502 ls             5   0 /lib64/libdl.so.2
      0  11502 ls             5   0 /lib64/libpthread.so.0
      0  11502 ls             5   0 /lib64/libattr.so.1
      0  11502 ls             5   0

Signed-off-by: Jovi Zhangwei <jovi.zhangwei@gmail.com>
fix cannot read kernel symbol in modules

Reported by Qingping.

Also add testcase in case corrupt it again in future.

Signed-off-by: Jovi Zhangwei <jovi.zhangwei@gmail.com>