[tools/execsnoop] Try to get parent PID from current task's real parent.

tcptop: fix display of received bytes, reduce syscalls (fixes #1871)

bpf_get_current_task is only available in 4.8 and above.
Signed-off-by: David Calavera <david.calavera@gmail.com>

the keys variable was a reference to ipv4_recv_bytes, and after merging
the keys of ipv4_send_bytes the original ipv4_recv_bytes BPF table also
contained all keys, therefore the `if k in ipv4_recv_bytes` check a few
lines below always evaluates to true

with this commit all BPF tables are copied to userspace as dicts once
(to reduce the number of syscalls) and the keys are merged in a new dict

Signed-off-by: David Calavera <david.calavera@gmail.com>

fix get_table_offline for percpu hash table

Signed-off-by: David Calavera <david.calavera@gmail.com>

Fallback to read the PPid from /proc if the real parent's TGID is 0.
Signed-off-by: David Calavera <david.calavera@gmail.com>

Use get_value() instead of lookup() as the value as in the case of
percpu tables the ValueType is an std::vector that has to be resized
before performing the lookup function.

Add also some testing for it.

Solves https://github.com/iovisor/bcc/issues/1860Signed-off-by: Mauricio Vasquez B <mauricio.vasquez@polito.it>

debian: add llvm6.0 as possible dependency

Mention perf as universal counting tool in llcstat

Improve Python autoload syscall name handling

Added new footer.h header where BPF_LICENSE is set if not defined

Rewrite array accesses

Fix license recognition on GitHub.com

In recent Ubuntu, llvm 6 is available. Use that as control file
dependency option.

Closes #1757.

tools: remove unnecessary calls to bpf_probe_read

The second file with the license information, COPYRIGHT.txt, contains
the same information as LICENSE.txt, expect for the license's text.
However, it prevents Licensee, the tool used by GitHub to detect
licenses, from working properly as it doesn't know which file to take
into account.

Most of these calls have been rendered useless by a9f96c02 ("Recognize
context member dereferences despite array accesses (#1828)").

Stops at any array accesses on external pointers and tries to rewrite
both the array access and the member dereference if any, in one shot.
With this commit, the following C code is rewritten properly into a
single bpf_probe_read call.

int test(struct pt_regs *ctx, const struct qstr *name) {
    return name->name[1];
}

Based on Yonghong Song's code.

switch some fields from u64 to their natural size u32/u16

Signed-off-by: Oriol Arcas <oriol@starflownetworks.com>

based on kernel version, different kernel functions are kprobed.

Ensure dnf point to correct  package name.

* Add interface to Probe's getargs call

This commit allows the Probe instance to generate argument for arbitary
probe function

* Refactor C++ USDT implementation

This commit makes C++ USDT implementation uses the common USDT::Context
and USDT::Probe logic

* Add test case for C++ USDT API

* Improve FollyRequestContextSwitch example

Fix issue #1853.

Commit 7c489469 ("adjust tracepoint field type
based on size") tried to fix the tracepoint format
descrepancy between declared type and actual size is 8.
The type has to be promoted to match the size.

The commit introduced a bug if the field is an array.
For exmaple, block:block_rq_complete tracepoint has
field rwbs:
  field:char rwbs[8];	offset:32;	size:8;	signed:1;

The current implementation will incorrectly translate it
into
  s64 rwbs[8];
since it considers the type is "char".

This patch fixed this issue by checking the field name
and if it is an array, rewriting will be skipped.
Signed-off-by: Yonghong Song <yhs@fb.com>

Leftover from #986.

* Strict version dependencies for debian packages, closes #1770

* Use correct description for libbcc-examples debian package

Fix issue #1845.

The verbose output of argdist.py is broken.
The bpf.open_uprobes/open_kprobes have been
replaced by bpf.uprobe_fds/kprobe_fds.

Fix the argdist.py and add "-v" to the argdist.py test
in test_tools_smoke.py.
Signed-off-by: Yonghong Song <yhs@fb.com>

Leftover from #986.

KeyboardInterrupt exception is not handled anymore. It will be
propagated and handled by the caller.

Signed-off-by: Oriol Arcas <oriol@starflownetworks.com>

Signed-off-by: Oriol Arcas <oriol@starflownetworks.com>

Signed-off-by: Oriol Arcas <oriol@starflownetworks.com>

implement tracepoint based probing for tcpaccept.py.

The helpers.h header specifies the BPF program license as 'GPL'.
However, other GPL-compatible licenses are possible (e.g., Dual BSD/GPL)
or even proprietary licenses (e.g., cachetop can run with a proprietary
license).

With this commit, the user can specify a BPF_LICENSE macro in the source
code:

  #define BPF_LICENSE Custom license

Note it supports multiple words and the absence of quotes. If the BPF
doesn't have a GPL-compatible license and it uses any GPL-only helpers,
the kernel will reject it with:

  cannot call GPL only function from proprietary program

If no license is specified, it will fall back to GPL (the current
behavior before this commit) so that the BCC tools and examples remain
usable.

Updated the documentation with BPF_LICENSE description, licensing error
description, and licenses for each helper.
Signed-off-by: Oriol Arcas <oriol@starflownetworks.com>