offcputime improvements: use less RAM, add PID/TID support

Add perf_submit_skb

For BPF_PROG_TYPE_SCHED_CLS/ACT, the upstream kernel has recently added a
feature to efficiently output skb + meta data:
commit 555c8a8623a3 ("bpf: avoid stack copy and use skb ctx for event output")

This patch adds perf_submit_skb to BPF_PERF_OUTPUT macro.  It takes
an extra u32 argument.  perf_submit_skb will then be expanded to
bpf_perf_event_output properly to consider the newly added
u32 argument as the skb's len.

Other than the above described changes, perf_submit_skb is almost
a carbon copy of the perf_submit except the removal of the 'string name'
variable since I cannot find a specific use of it.

Note that the 3rd param type of bpf_perf_event_output has also been
changed from u32 to u64.

Added a sample program tc_perf_event.py.  Here is how the output
looks like:
[root@arch-fb-vm1 networking]# ./tc_perf_event.py
Try: "ping -6 ff02::1%me"

CPU SRC IP                           DST IP       Magic
0   fe80::982f:5dff:fec1:e52b        ff02::1      0xfaceb00c
0   fe80::982f:5dff:fec1:e52b        ff02::1      0xfaceb00c
0   fe80::982f:5dff:fec1:e52b        ff02::1      0xfaceb00c
1   fe80::982f:5dff:fec1:e52b        ff02::1      0xfaceb00c
1   fe80::982f:5dff:fec1:e52b        ff02::1      0xfaceb00c
1   fe80::982f:5dff:fec1:e52b        ff02::1      0xfaceb00c

Minor adjustments to the documentation

Fix a few typos
Add missing link
Reword update() description sentence

fix build with 4.0 llvm trunk

Signed-off-by: Alexei Starovoitov <ast@fb.com>

As reported in #664:
In cases where the AST contains a MemberExpr with an invalid opLoc,
rewrite will fail but prior to this change would segfault. Fail a little
more gracefully, even though the program will still be rejected.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Tool to sniff data contents before encrypted with OpenSSL

Now it also captures gnutls_record_send and gnutls_record_recv calls.
Added options to filter by pid or command name, or just one lib.

Add tool as talked in iovisor-dev 'BCC: bpf_probe_read read function arguments'

This reverts commit c6688dda4e856be43b8651afe92d7e32e63faea9.

killsnoop: use current time replace timestamp and default output

* debian packaging: Add missing Build-dependencies

* Add clang-format-3.7 to build-depends
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

* debian packaging: Build with -DBCC_KERNEL_HAS_SOURCE_DIR=1

This is required to use the distro-provided includes on Debian/Ubuntu

dcsnoop: use PERF_EVENT_OUTPUT

Add some explanation for functions in BPF program in Tutorial

This delete() is required because of a kernel bug:
https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=a6ed3ea65d9868fdf9eff84e6fe4f666b8d14b02

Signed-off-by: Omar Sandoval <osandov@fb.com>

fix build with llvm 4.0

Signed-off-by: Alexei Starovoitov <ast@fb.com>

Based on the bug report in
https://bugs.gentoo.org/show_bug.cgi?id=582770, mixing static+non-static
libstdc++ can lead to crashes. Disable such combinations. Choosing to
leave out the llvm check, since in practice clang is less likely to be
provided statically, so the check should cover both cases.

Fixes: #633
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Update readme with dns name and https for repo server

We enabled dns for the repo and builtbot, and then turned on letsencrypt
for those as well. Yay, now we look slightly more official.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

* add open_perf_event api for reading perf counters

Though the rewriter table method existed, we were not yet opening up the
perf counter in the proper way for it to be read.

Introduce a c function to enable attaching perf counters to cpu-indexed
table slots. The python side opens, assigns, then immediately closes the
fd. Only the kernel keeps a reference, so closing the table or deleting
the entry will be sufficient to free up the fd when finished.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

* Skip perf array hw counter test if unsupported

Hardware counters are not available in all places (some VM
environments), so gracefully skip on the particular error condition.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

* MySQL USDT example and tool

* add nodejs example output

* add reference to mysqld example

tutorial: add missing return in hello_world example

Fix typo in the reference guide

Recent USDT change removed `procstat.py`, which the `argdist` and `trace` tools are still referencing. This diff moves the only method (`which`) they are using into the `BPF` class.

Also, make `BPF.find_library` not to call `decode()` on `None`.