Force udst ctx->#reg load to be volatile

Add linux/sched.h to list of libbpf.c includes

This should hopefully fix compile errors on some ubuntu systems.

Also, reorders the includes according to clang-format
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Break the c++ dependency in libbpf.c, and turn it into a separate lib
from cmake point of view.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

This moves ProcMountNS[Guard] classes to a separate header file and
implementation. The goal will be to use these more directly in libbpf.c
without creating a circular dependency.
Removed the friend class statements and exposed a few public getters instead.
Slightly changed the implementation in ProcMountNS constructor to avoid
a few error cases and the use of snprintf.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

This is related to issue #1133. Compiler sometimes
generates code patterns likes:
     r1 = ctx + 96
     goto next
   here:
     r1 = ctx + 48
   next:
     r3 = load (r1 + 0)
Verifier will fail for such cases as r1 is marked
as "unknown" at the time of load.

The previous workaround is to add volatile attribute
to the store like
   *(volatile u64 *)&dest = ctx->bx
The hope is to force ctx related load in-place since
its value is needed for store.

Unfortunately, this does not always work and compiler
still has freedom to merge different ctx loads at the
same time honoring the volatile &dest. In USDT generated
code, different branches of &dest are the same.

This patch directly make ctx->bx itself as a volatile load:
  *(volatile u64 *)&ctx->bx
This seems working as compiler stops playing around
the address pointing to a volatile data.
Signed-off-by: Yonghong Song <yhs@fb.com>

funclatency/sslsniff: fix the TypeError when enabling pid filter on u…

Fix usage of CMAKE_BUILD_TYPE setting

Use BPF_F_CURRENT_CPU in perf_submit when possible

Improve perf event clean up

Add bpf_close_perf_event_fd helper that first disables, then closes a
perf event fd. Use it in Python and C++ API for detach perf event

Support symbol option in C++ API stack table

attach_uprobe() and attach_uretprobe() expect the type of pid argument
is "int" instead of "str". Fix it by specifying the type of the "-p"/"--pid"
option as "int", and updating the format string of args.pid accordingly.

Fixes: d73c58f0

Add support for generic XDP mode

Reused some of the code and command-line format from kernel XDP samples.

$ sudo ./xdp_drop_count.py -S enp1s0
Printing drops per IP protocol-number, hit CTRL+C to stop
17: 36616 pkt/s
17: 19720757 pkt/s
17: 19685768 pkt/s
17: 19643601 pkt/s
17: 19694537 pkt/s
[...]
$ sudo ./xdp_drop_count.py enp1s0
Printing drops per IP protocol-number, hit CTRL+C to stop
17: 7029 pkt/s
17: 29996706 pkt/s
17: 30048705 pkt/s
17: 30261417 pkt/s
17: 30291967 pkt/s
[...]

Throughput difference is expected since generic XDP takes more
instructions per packet than optimized XDP.

v2: switch __u32 to uint32_t in bpf_attach_xdp
Signed-off-by: Andy Gospodarek <gospo@broadcom.com>

Fix bcc_resolve_symname memory leak in C++ API

Unify Perf Event related Enums and checks

Minor fixes for example and compiler warning

Add ability for users to control symboling behavior

As the symbol type check now controled by the specified
`bcc_symbol_option` and handled in lower level, there is not need to
pass the type flag to the callback anymore.

This commit makes `ProcSyms` constructor takes a `bcc_symbol_option`,
and pass it down to underlying calls to control symboling behavior.
If `nullptr` is passed, `ProcSyms` will use default setting, which is
to use debug file, verify debug file checksum, and only load function symbols.

This commit also makes `bcc_symcache_new` take a `bcc_symbol_option`
parameter and pass it to the underlying `ProcSyms` constructor.

This commit makes `bcc_resolve_symname` to take an `bcc_symbol_option`
parameter, and pass it to underlying calls to control symboling behavior.
When `NULL` is passed, it will fallback to default which is current
behavior that uses debug file, verify debug file CRC, and check all
types of symbols.

This commit also removes the unneccesary intermediate
`bcc_find_symbol_addr`.

Added documentation for usage of the API, updated most call sites to use
default with `NULL`, and fixed some memory leaks at call sites.

`bcc_resolve_symname` should free `sym->module` on error. Also remove
unused `sym_search_t`

This commit changes `bcc_foreach_symbol` to use the new `bcc_symbol_option` to
control it only wants function symbols. Also renamed it to
bcc_foreach_function_symbol and added comments for better information.

This commit maintained current behavior of the function to prefer use
debug file and check debug file CRC. We could add option to configure
that behavior in the future if needed.

This commit adds a `bcc_symbol_option` to configure various symboling
behaviors. Currently added options for reading debug file, and what type
of symbols are wanted.

This commit also makes bcc_elf_foreach_sym take a `bcc_symbol_option`
parameter and repect the specified configurations.

The build type was set to Release in the top level cmake file.
This was a rather confusing behaviour, as one would expect to
be able to easily debug the code after using `cmake -DCMAKE_BUILD_TYPE=Debug`.

Use new Kernel functionality to get first key of map