§`trace` now allows uprobes and kprobes to have function signatures,
which means function parameters can be named and typed, rather than
relying on the positional arg1, arg2, etc. arguments. This also
enables structure field access, which is impossible with the unnamed
arguments due to rewriter limitations.

The example requested by @brendangregg, which now works, is the
following:

§Â```
PID    TID    COMM         FUNC             -
777    785    automount    SyS_nanosleep    sleep for 500000000 ns
777    785    automount    SyS_nanosleep    sleep for 500000000 ns
777    785    automount    SyS_nanosleep    sleep for 500000000 ns
777    785    automount    SyS_nanosleep    sleep for 500000000 ns
^C
```

Use targeted process to resolve library names

fix iteration over CPUs

Since kernel version 4.9.0 BPF stopped working in a KVM guest.
The problem are calls to perf_event_open with CPU identifiers which do
not exist (ENODEV). The root cause for this is that the current code
assumes ascending numbered CPUs. However, this is not always the case
(e.g. CPU hotplugging).

This patch introduces the get_online_cpus() and get_possible_cpus()
helper functions and uses the appropriate function for iterations over
CPUs. The BPF_MAP_TYPE_PERF_EVENT_ARRAY map contains now an entry for
each possible CPU instead of for each online CPU.

Fixes: #893
Signed-off-by: Andreas Gerstmayr <andreas.gerstmayr@catalysts.cc>

argdist, trace: Support non-C identifier names

We need the PID when detaching uprobes to resolve library names
to the same path as when attaching

To resolve library names, bcc_procutils_which_so leverages mapped
libraries of the targeted process, if one is given. Uses the kernel's
/proc/$pid/maps

When argdist or trace face a function that has characters
in its name that are not valid in C identifier, they now
replace these characters with an underscore (`_`) when
generating function names and structure names to include
in the BPF program. As a result, it is now possible to
trace functions that have these identifiers in their names,
such as Golang functions like `fmt.Println`.

add some error hints

profile: increase unique stack default to 10k

trace: allow tracing of functions containing a dot (golang)

statsnoop: refactor

gethostlatency: remove unused code

add a few funccount examples

snapcraft: add cpuunclaimed to snapcraft wrapper rules

Add missing helper prototypes

Fixes bio{snoop,top} on 4.10

Signed-off-by: Mauricio Vasquez B <mauricio.vasquez@polito.it>

This commit fixes #888.  The 2 scripts run the same check, and now run
basically the same code to do it.

Tested on 4.10-rc2.

Add -fno-stack-protector to CFLAGS

When compiling ebpf programs on Alpine Linux the compiler throws the following
error:

LLVM ERROR: Cannot select: 0x56049b79dcb0: ch,glue = BPFISD::CALL 0x56049a93ad60, TargetExternalSymbol:i64'__stack_chk_fail'
  0x56049b391500: i64 = TargetExternalSymbol'__stack_chk_fail'
    In function: waker

Disabling the stack protector explicitly with '-fno-stack-protector'
fixes this error.

clang version 3.8.1 (tags/RELEASE_381/final)
Target: x86_64-alpine-linux-musl
Thread model: posix
InstalledDir: /usr/bin
Signed-off-by: Rolf Neugebauer <rolf.neugebauer@docker.com>

add missing inclusion guards in bcc/proto.h

Fixes for LLVM 4.0 and python3

Avoid conflicting [no]inline attributes in function annotation. This was
probably always there but now 4.0 is treating this as an error.
Also, explicitly inline several functions in helpers.h.

Turn off unwind tables in the flags passed to clang. This was generating
calls to the elf relocator, which doesn't work for the BPF target. It is
unclear which change in LLVM 4.0 altered this behavior.

On python3, handle byte strings in the usual way for supporting
backwards compatibility.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

fix stupid typo in wrapper: ttysnop -> ttysnoop
Signed-off-by: Colin Ian King <colin.king@canonical.com>

Signed-off-by: Colin Ian King <colin.king@canonical.com>

Update [virtual_]bpf.h to 4.10

Signed-off-by: Mauricio Vasquez B <mauricio.vasquez@polito.it>

Only the virtual_bpf.h should point to the installed kernel headers.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

As is occassionally necessary, we need to update the compat header
files for new kernels. This picks up the bpf.h from 4.10rc1.

Fixes: #877
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Fix variable names in exceptions