Conform to bytes encoding for some portion of the tools/tests, such that
smoke tests pass on python3. More conversions are surely required.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Move bcc internals to sanitize all arguments as bytes instead of str
type. For now, disable warnings or actual assertion, to be turned on
incrementally.

Introduce some helpers for managing bytes/unicode objects in a way that
bridges the gap from python2 to 3.

1. Add printb() helper for writing bytes output directly to stdout. This
avoids complaints from print() in python3, which expects a unicode
str(). Since python 3.5, `b"" % bytes()` style format strings should
work and we can write tools with common code, once we convert format
strings to bytes.
http://legacy.python.org/dev/peps/pep-0461/

2. Add a class for wrapping command line arguments that are intended for
comparing to debugged memory, for instance running process COMM or
kernel pathname data. The approach takes some of the discussion from
http://legacy.python.org/dev/peps/pep-0383/ into account, though
unfortunately the python2-future implementation of "surrogateescape" is
buggy, therefore this iteration is partial.

The object instance should only ever be coerced into a bytes object.
This silently invokes encode(sys.getfilesystemencoding()), which if it
fails implies that the tool was passed junk characters on the command
line. Thereafter the tool should implement only bytes-bytes comparisons
(for instance re.search(b"", b"")) and bytes stdout printing (see
printb).

3. Add an _assert_is_bytes helper to check for improper usage of str
objects in python arguments. The behavior of the assertion can be
tweaked by changing the bcc.utils._strict_bytes bool.

Going forward, one should never invoke decode() on a bpf data stream,
e.g. the result of a table lookup or perf ring output. Leave that data
in the native bytes() representation.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Updated the FAQ with the error produced if python[2-3]-bcc isn't inst…

Document bpf_tail_call()

Signed-off-by: Gary Lin <glin@suse.com>

Define a new macro to make it easier to declare a program array.
Also replace BPF_TABLE("prog") in examples and tests with
BPF_PROG_ARRAY.
Signed-off-by: Gary Lin <glin@suse.com>

Fix missing include

tcptracer: Fix argparse is not defined error

Fixes compile with libc++ on linux:

```
In file included from ../tests/cc/test_array_table.cc:17:
In file included from ../src/cc/api/BPF.h:24:
../src/cc/api/BPFTable.h:118:71: error: use of undeclared identifier 'errno'
      return StatusTuple(-1, "Error getting value: %s", std::strerror(errno));
```

Add missing includes to fix build against libc++

argparse is imported as ap, using argparse explicitly results in a name
not defined error.
Signed-off-by: Gal Pressman <galp@mellanox.com>

continue adding --ebpf option to the python tools/ scripts

Fixes this compile error:

```
../src/cc/frontends/clang/kbuild_helper.h:40:64: error: use of undeclared identifier 'errno'
      fprintf(stderr, "chdir(%s): %s\n", dst.c_str(), strerror(errno));
```

This fixes the compile with `-stdlib=libc++`. Without this header the build fails with:

```
../src/cc/ns_guard.cc:75:30: error: use of undeclared identifier 'CLONE_NEWNS'
```

Found by yonghong-song while reviewing PR #1570.
Signed-off-by: Nathan Scott <nathans@redhat.com>

opensnoop: -d option for duration

Small fixes

Signed-off-by: Song Liu <songliubraving@fb.com>

The semicolon is usually added when the macro is used. Update both the
macro definition and all uses.
Signed-off-by: Song Liu <songliubraving@fb.com>

Several python tools allow their eBPF code to be printed to
stdout for debugging.  There are other projects that would
like to share these program definitions however, instead of
duplicating code.  We previously agreed on an --ebpf option
and we now continue adding it to more tools.
Signed-off-by: Nathan Scott <nathans@redhat.com>

Add option to print virtual address to trace.py

Miscellaneous BCC patches

doc: bpf_get_current_task helper

__delitem__ has some code duplication for the common case. The common
case is to call the low-level bpf_delete_elem function.  Refactor the
code a bit for this case. It avoids duplication of code and will also
make the communication with BPFd simpler as well.

Test: Ran test_tools_smoke tests with all tests passing except for
test_shared_table.py which fails for me with or without this patch.
(Filing separate issue for that).
Signed-off-by: Joel Fernandes <joelaf@google.com>

fix map a type parsing issue for export/extern types

Update man page for funccount

cc: missing bpf helpers in export/helpers.h

Fix issue #1562.

Currently, bcc allows a map defined in one module and
used in the same or a different module. At tests/python directory,
test_clang.py and test_shared_table.py have such an example.
  ...
  b1 = BPF(text="""BPF_TABLE_PUBLIC("hash", int, int, table1, 10);""")
  b2 = BPF(text="""BPF_TABLE("extern", int, int, table1, 10);""")
  t = b2["table"]
  ...

With current implementation, the map key/value types are parsed
twice, resulting a type "int int" instead of "int". When type
is retrieved through `t = b2["table"]`, python decoding error
will appear.

The issue is fixed by preventing the second map key/value type
parsing if the map is `extern`. Also add `t = b2["table"]`
so the issue will be triggered if bcc clang frontend fix is not there.
Signed-off-by: Yonghong Song <yhs@fb.com>

cc: error hint for 'invalid func'

Systems such as Android mostly use openat which makes us miss all
attempts to open. Instead use do_sys_open for the kprobe hook where
all the open calls finally end up, so that we don't miss anything.
Signed-off-by: Joel Fernandes <joelaf@google.com>

libclang does use functions from libbcc so it does depend on it.
When defining new symbols in bpf_common.cc, linker errors appear
when the same symbols are used in libclang. This is because of
incorrect linker dependency, this patch fixes the issue by making
sure the dependency is correctly tracked.
Signed-off-by: Joel Fernandes <joelaf@google.com>

Finish man page update for b03d9eb2.

bpf_getsockopt in docs/kernel-versions.md