Add contribution section

Use GNUInstallDirs for LIBDIR variable

This should be supported in older versions of cmake, but haven't
explicitly tested those.

Fixes: #243
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

biolatency, funclatency, and bpf_log2l usage

add bpf_log2 functions

killsnoop and some minor fixes

opensnoop

Add a better test case for nested probe reads

Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Add support for static helper functions

This adds support for static helper functions that can be reused. It is
not necessary to include pt_regs in the helper functions, even though
external pointers may be dereferenced. Arguments in the helpers can also
be reordered.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

add biosnoop to README

biosnoop and disk updates

Fix probe reads on char[] types

It is easy enough to wrap the type in a typeof(), otherwise the rewriter
would need to do a deeper parsing of the type information to place it
properly next to the variable name.

Fixes: #219
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Translate multiple pointer dereference into bpr_probe_read

This commit adds support for multiple consecutive and nested pointer
dereference of function arguments that should be converted to
bpf_probe_read. The logic works by marking variables as needing a
probe_read if they come from the register argument, and then applying
this property transitively.

Supported syntax:
```
int trace_entry(struct pt_regs *ctx, struct file *file) {
    struct vfsmount *mnt = file->f_path.mnt;
    struct super_block *k = mnt->mnt_sb;
    const char *name = file->f_path.dentry->d_name.name;
```

Not supported: probe reads from map leaves, probe reads after explicit casts.

Fixes: #188
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

add ebpf method to retrieve bytecode