Fix probe reads on char[] types

It is easy enough to wrap the type in a typeof(), otherwise the rewriter
would need to do a deeper parsing of the type information to place it
properly next to the variable name.

Fixes: #219
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Translate multiple pointer dereference into bpr_probe_read

This commit adds support for multiple consecutive and nested pointer
dereference of function arguments that should be converted to
bpf_probe_read. The logic works by marking variables as needing a
probe_read if they come from the register argument, and then applying
this property transitively.

Supported syntax:
```
int trace_entry(struct pt_regs *ctx, struct file *file) {
    struct vfsmount *mnt = file->f_path.mnt;
    struct super_block *k = mnt->mnt_sb;
    const char *name = file->f_path.dentry->d_name.name;
```

Not supported: probe reads from map leaves, probe reads after explicit casts.

Fixes: #188
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

add ebpf method to retrieve bytecode

This is useful if you want to use bcc as a compiler without running the
program.

updated  mainline version to support bridge

Change test_xlate1 to use act_bpf instead of cls_bpf

Support for act_bpf is available for testing in
https://github.com/drzaeus77/pyroute2Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Don't include git tag in .so suffix

The git hash was being include in the shared library name. This leads to
polution of the /usr/lib directory. Instead, just use the latest tag in
the library suffix.

As a developer, you will need to clean up the /usr/lib/libbcc* files
whenever a new tag is created.

Fixes: #207
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

sync readme hello_world.py example with actual implementation

Signed-off-by: Yonghong Song <yhs@plumgrid.com>

Add clang command line invocation to debug=0x4

This adds the command line arguments of clang to debug flag 0x4 in the
clang frontend.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

some README rework

funccount and BPF_HASH updates

Always autoload k[ret]probe__ prefixed functions

This will shorten some examples, no longer requiring them to call
attach_kprobe.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Improve coverage for kprobe event_re

This version of the mainline kernel supports the bridge and vlan learning examples (i.e. the additional APIs). Will allow new users to run all examples provided.

This makes the attachment of kprobes to arbitrary events more robust.

Issue 1: Functions with '.' characters should not have similarly named
 probes.
Issue 2: Functions in the blacklist should not be attached to.
Issue 3: Some functions matched by regex cannot actually be attached to,
 despite not being in the blacklist...possibly the blacklist is outdated?
 Instead, warn instead of error during bulk regex attach.
Issue 4: Attaching to large numbers of kprobes gets to be very slow. For
 now, leave this unresolved. For reasonably sized regexes, startup times
 may be acceptable, and shutdown times are actually the worse part. To
 speed up shutdown, one could add the following after the last
 attach_kprobe to disable auto-cleanup:
  ```
  from bcc import open_kprobes
  open_kprobes = {}
  ```
 Then, once the program is exited, one must manually
  echo "" > kprobe_events

Some numbers:
attaching to event_re='tcp_*': 2 sec startup, 15 sec shutdown
attaching to event_re='b*': 10 sec startup, 75 sec shutdown
attaching to event_re='*': unknown (>20 min) startup, unknown shutdown
The slowdowns appear to be exponential, doubtful that '*' will ever
complete.

Fixes: #199
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Autoload kprobes for all types of trace_* functions

Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

The previous patch #195 for autoloading of kprobes only did it for
trace_print. Turn this feature on for all trace_* functions. This
requires that these functions are also no longer staticmethods.

Enable the feature in examples/disksnoop.py
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Fix breakage in bpf_probe_read from #196