With having in mind that softirq processing is happeing in
ksoftirqd/<cpu> context, which is associated with a specific cpu over
the whole dynamic life time of a system, focussing on CPus as the
dissector appears more sensical.

Quite helpful is this alternative angle of view on the softirqs
processing especially for surveilling the effectiveness of net stack
tunings, as this is highly dynamic depending on the actual net stack
configuration, e.g. scaling or steering.
Signed-off-by: Matthias Tafelmeier <matthias.tafelmeier@gmx.net>

With local LLVM (4.0ish), inline strings in this test case would
segfault. Fix the crash by constructing explicitly on the stack.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Possibly due to local LLVM differences, this change was needed for
sslsniff code to pass the verifier.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

On my system, the manually unrolled stack walker fails the verifier, due
to what seems to me like an incorrect return statement. Setting bp = 0
has no effect, seems that the intent was to return 0 instead.

Not sure why others haven't hit this, but the fix contained here seems
reasonable.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Disable non-static function calls

Compiled BPF programs must consist of a single contiguous code block,
meaning trying to call other function entry points (besides the
kernel-defined helpers) is not possible. The bcc frontend didn't
explicitly prohibit this, even though the program would fail to
compile/load. Add an explicit check and error message.

Fixes: #653
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Minor sorting of the yaml tool list and sync it to the latest
updates in tools
Signed-off-by: Colin Ian King <colin.king@canonical.com>

Printing the BPF program after loading it means that if there is a
load error, the program isn't printed, which sort of defeats the
purpose of the whole thing.

* adding args matching option

* fixing typos

* fixing merge artefacts

* [execsnoop]: adding documentation on -l in man

* [execsnoop][man]: fixing typo in commands name

Add a link to the proposed generic XDP feature to the list of XDP features.

Use normal inlining in clang loader

Display pid namespace in summary histogram using a new `--pidnss` option.

used the CheckCXXCompilerFlag module of Cmake to check the compiler whether or not supporting c++11. (#1116)

bcc: add __attribute__((always_inline)) to helper functions

When using Clang 3.9(compiled by GCC 6.x), bcc will used -isystem,
because the GCC_VERSION(get the version of the Clang) is less 6.0.
And then the compiler will compile failed.

In bcc, ProgArray.__delitem__ defaults to ArrayBase.__delitem__
which uses the bpf_update_elem helper to clear the item (override
with a null value). However, eBPF doesn't offer a bpf_update_elem
helper for prog arrays.

This pull request overrides __delitem__ in ProgArray to use the
bpf_delete_item helper.

On some distributions, the debuglink section in the binary will
not have a .debug file extension. As a result, we will try to look
for the debuginfo file in the binary itself, immediately find it,
and abort looking for any other alternatives. This is not good,
because the binary might contain stripped or partial symbols,
which precludes certain tools from realizing their full potential.

Fix by checking that the debuginfo file we're trying to use is
not the same as the binary file. In any case, if external debuginfo
can't be found, we will fall back to the symbols in the original
binary file, if present, so this should not regress any existing
scenario.

Fixed SEGFAULT due to perf buffer overflow if lost_cb unset

When setting a lost_cb, the reference to the ctypes function is not retained like the regular callback,
this leads to a SEGFAULT if the gc kills the lost_fn if a lost event occurs afterwards

This fixes a SEGFAULT in the underlying libbcc when no lost_cb is set.
This occurs when the perf buffer is full and the lost_cb is called.
libbcc expects a NULL pointer as lost_cb to trigger its internal lost message.
This fixes the bug by providing an appropriate NULL pointer when lost_cb is unset.

This commit migrates softirqs to use kernel tracepoints instead of
kprobes. Because tracepoints only provide the vector number and not
the function name, we use a conversion table, which is borrowed from
kernel/softirq.c, to translate the vector number to a display name.
This table is expected to be fairly stable. Notably, new names have
not been added since approximately 2009, and the last rename (without
adding or removing a name) was in 2014.

Resolves #1031.

Fix compiler warning on redefined Macro

Miscellaneous style and code layout improvements

README.md: fix broken link to stacksnoop examples

Updates to Lua/BPF code generator

the BPF maps and pointers were previously
implicitly dereferenced whenever an operation
on them required a value and not a pointer.
the upside is that accessing map element data
didn’t require an explicit operation, the downside
is that it wasn’t possible to get the value
explicitly.

this makes it possible to dereference any pointer
and materialize the value in the register as long
as it’s shorter than register width using `ptr[0]`
element access operator.

the DW LD_ABS|IND is prohibited, so it is
implemented as a double W load with shift.
this is slow as it also has to undo the ntohl
semantics of W loads, but makes dissection of
64bit fields with absolute addressing possible