* Initial commit of nfsslower, tracking NFS4_READ, NFS4_WRITE and NFS4_OPEN

* Added in documentation, examples, support for csv and tracing for GETATTR

* Added in man pages, READM mods and example file, to comply with
https://github.com/samuelnair/bcc/blob/master/CONTRIBUTING-SCRIPTS.md

* Changes to address comments from @brendangregg and a small bug regarding
the output header not being printed when tracing all NFS operations

* Added nfsslower to the correct alphabetical postion

* Addressing Sasha's comments. I appreciate the thoroughness of the review

* Added test case for nfsslower and an extra function to check if the NFS kernel
module is loaded

* stackcount: add -K and -U

* stackcount: add -D for duration

* stackcount: add -f for folded output

Also added a warning if the length is exceeded

zfs tools fix for zpl_read/zpl_write removal

Performing the update before lookup incurs an extra spinlock in the
kernel, which hurts performance. Reorder the code and increment to 1.
The memset is there I believe due to some type mismatch warnings, so I'm
leaving as is rather than doing a direct assign to 1. The resulting code
is optimized away anyway.

Fixes: #1314
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

The bug does not show up in my previous test probably because
I did not clean up the build directory and did not have a clean cmake.

In gcc 4.8.5 environment where -no-pie is not supported,
a clean cmake will trigger the issue as subsequent other
cxx compile test will fail due to additional -no-pie flag.

The fix is to reset the CMAKE_REQUIRED_FLAGS to its previous value
after the specific test.
Signed-off-by: Yonghong Song <yhs@fb.com>

Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Allow building of JUST the libbpf library and related headers. No clang,
llvm, python, lua, etc. Not even tests :(
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Move the C++ api files under a new subdirectory.
Use CMAKE_DEPENDENT_OPTION to enforce sdt->cpp_api relationship.

Since linking .a into a .so can cause global symbols to be dropped, add
a helper file to force exported symbols to be retained (link_all.cc).
This problem doesn't exist for building the static cpp examples.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Move two usdt related files to a new subdirectory and link them into the
final product. Introduce a cmake option to disable that feature (turning
it off currently fails to compile).

Move some of the cmake flag computation into a helper cmake file and
include that rather than inlining it.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Certain versions of recent gcc (e.g., gcc 6.3.0 on ubuntu17.04)
has pie enabled by default at linker (collect2) stage.
The compilation flag "-no-pie" is available to negate
this linker option.

Add -no-pie to compilation flag only if it is available.
Earlier gcc compiler may not have this option but it does
not have linker pie on-by-default either.

Tested with ubuntu 17.04 and my local gcc 4.8.5 (not accepting -no-pie).
Signed-off-by: Yonghong Song <yhs@fb.com>

The bcc rewriter segfaults when it encounters an incomplete type
(missing declaration or declaration after use) in a map declaration.
This commit fixes it by first checking the type and returning an
error if it is incomplete.

The bcc rewriter segfaults when it encounters an incomplete type
(missing declaration or declaration after use) in a map declaration.

Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Signed-off-by: Brenden Blanco <bblanco@gmail.com>

At this time, a single helper can return a kernel pointer,
bpf_get_current_task.

Update obsolete file name bitesize -> bitehist

Format code of vfscount.py

Remove unnecessary bpf_probe_reads

When detaching a generic XDP program to an interface without native XDP
support, remove_xdp() showed the following message:

   bpf: nlmsg error Operation not supported

Add the flags parameter to notify the kernel that it's a generic XDP
program.

Some versions of GCC don't accept `-no-pie`. For instance, on a GCC 5 build I
have here:

```
$ gcc -no-pie
gcc: error: unrecognized command line option ‘-no-pie’
gcc: fatal error: no input files
```

5.4 from Xenial will take `-no-pie`, as will versions of 4, 6 and 7 that I
tried. The issue may be related to
https://www.mail-archive.com/gcc-patches@gcc.gnu.org/msg170818.html but I'm not
certain.

A workaround for this is to use `--no-pie`, which is accepted by all versions
of GCC 4, 5, 6 and 7 that I tried.

Update tutorial to change the file name.

* Fixed build for debian and ubuntu
* Bumped debian and ubuntu versions (fix some build-dependency issues)
* Make debian and ubuntu Dockerfiles use the same build script
* Build-dependencies now installing automatically via pbuilder

avoid large map memory allocation in userspace

In bcc, internal BPF_F_TABLE defines a structure to
contain all the table information for later easy
extraction. A global structure will be defined
with this type. Note that this structure will be
allocated by LLVM during compilation.

In the table structure, one of field is:
   _leaf_type data[_max_entries]

If the _leaf_type and _max_entries are big,
significant memory will be consumed. A big
_leaf_type size example is for BPF_STACK_TRACE map
with 127*8=1016 bytes. If max_entries is bigger
as well, significant amount of memory will be
consumed by LLVM.

This patch replaces
  _leaf_type data[_max_entries]
to
  unsigned ing max_entries

The detail of a test example can be found in issue #1291.
For the example in #1291, without this patch, for a
BPF_STACK_TRACE map with 1M entries, the RSS is roughly
3GB (roughly 3KB per entry). With this patch, it is 5.8MB.
Signed-off-by: Yonghong Song <yhs@fb.com>

Couple minor tools fixes

Signed-off-by: Gabriel Ganne <gabriel.ganne@enea.com>

This is a followup change for previous commit 0ba15075
(permit multiple pids attaching to the same probe).
That commit changes the event name for python uprobe API
in order to permit multiple processes attaching to the
same uprobe point. The C++ uprobe event name remains
unchanged and thus a descrepancy.

This patch add changes to C++ side and also make python uretprobe
having the same naming convention.

Originally I experimented to put the common code to generate
event names in libbpf.c. But doing this seems more klunky
than simplicity of C++ and Python. So I stick to the current
design.

No need to add pid to kprobe event names as kprobe bpf invocation
will ignore pid anyway.
Signed-off-by: Yonghong Song <yhs@fb.com>

Fixes: #1280
Signed-off-by: Brenden Blanco <bblanco@gmail.com>