switch bcc to use single instance per bcc process, fixed issue #940

instance dir is bcc_pid, fixed issue #940

docs: fix "BPF attached to sockets" commit link

docs: keep track of when prealloc of map elements were introduced

Kernel v4.6-rc1~91^2~108^2~6
 commit 6c9059817432 ("bpf: pre-allocate hash map elements")

Introduced default preallocation of mem elements to solve a deadlock
(when kprobe'ing the memory allocator itself).

This change is also a performance enhancement.

The commit also introduced a map_flags on BPF_MAP_CREATE, which can disable
this preallocation again BPF_F_NO_PREALLOC.
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>

Allow RPMS to be built on ppc64 and aarch64 by making luajit optional

Not all architectures have luajit supported.  The bcc configure and
build were already was set up to make the luajit dependent parts
optional.  The bcc.spec now makes the luajit dependent parts optional
too allowing Fedora 25 builds on ppc64, ppc64le, and aarch64.  This
change has been tested and allows the resulting srpm to build on the
Fedora koji build system for the newly added architectures.
Signed-off-by: William Cohen <wcohen@redhat.com>

Support for __data_loc tracepoint fields

`__data_loc` fields are dynamically sized by the kernel at
runtime. The field data follows the tracepoint structure entry,
and needs to be extracted in a special way. The `__data_loc` field
itself is a 32-bit value that consists of two 16-bit parts: the
high 16 bits are the length of the data, and the low 16 bits are
the offset of the data from the beginning of the tracepoint
structure. From a cursory look, there are >200 tracepoints in
recent kernels that have this kind of field.

This patch fixes `tp_frontend_action.cc` to recognize and emit
`__data_loc` fields correctly, as 32-bit opaque fields. Then, it
introduces two helper macros:

`TP_DATA_LOC_READ(dst, field)` reads from `args->field` by finding
the right offset and length and emitting the `bpf_probe_read`
required to fetch the data. This will only work with new kernels.

`TP_DATA_LOC_READ_CONST(dst, field, length)` takes a user-specified
length rather than finding it from `args->field`. This will work
on older kernels, where the BPF verifier doesn't allow non-constant
sizes to be passed to `bpf_probe_read`.

Handling multiple concurrent probe users.

powerpc: update the build triplet

The more commonly used triplet on ppc64le happens to be
powerpc64le-unknown-linux-gnu. The existing one causes problems in
certain build environments. Change this.

While at it, also include support for building on big endian.
Reported-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>

using static buf size in libbpf.c. for uprobe, set buf size to PATH_MAX

    remove event_desc from front-end, handle it inside libbpf
    Event naming pattern changed to $(eventname)_bcc_$(pid)

Event naming pattern changed to $(eventname)_bcc_$(pid)
Detect /sys/kernel/debug/tracing/instances in bpf_attach_probe,
if it exist, then will per-instance event, if failed the make global
event instance as same as before.

argdist: Fix -p behavior to filter tgid and not pid

cpudist: remove unused Tracepoint import

argdist remained one of the last holdouts to use the `-p` switch
inconsistently with other tools, filtering for kernel pid (thread
id from user space perspective) and not kernel tgid (process id
from user space perspective). This is now fixed.

Additionally, minor nits around generating pid filters were fixed,
and a potential collision with user-provided argument names was
fixed too (in general, script-generated arguments/locals should
probably stick to reserved identifiers, such as `__whatever` rather
than `whatever`).

    remove event_desc from front-end, handle it inside libbpf
    Event naming pattern changed to $(eventname)_bcc_$(pid)

Event naming pattern changed to $(eventname)_bcc_$(pid)
Detect /sys/kernel/debug/tracing/instances in bpf_attach_probe,
if it exist, then will per-instance event, if failed the make global
event instance as same as before.

Fix python2/3 incompatible percpu helpers

Signed-off-by: Brenden Blanco <bblanco@gmail.com>

The kernel uses number of possible cpus to size the leaf, not the num of
online cpus. Fixup the python side appropriately.
Update: use num_possible_cpus() helper instead
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

The python3 version of the percpu helpers (average, sum, etc.) were
using a python2 function that has since moved to functools (reduce).

Worse, the test case for percpu functionality was not enabled in the
cmake file. Better turn that on and make it work.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

[tools][memleak.py] add parameter for specifying object to load malloc/free from