This should depend on python-bcc, which itself depends on libbcc.

Fixes: #291
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Add bcc-tools package

Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Ticket: #291
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Fixup broken symlink tests/cc/simulation.py

Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

added P4 deparser synthesis

Updates to INSTALL.md for readability and ease of use

Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

A stable 4.3 kernel is available, suggest users use that version
instead.

Move LLVM build instructions to the end, prefer that they pull llvm
binaries instead.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Fix unary operator handling of probe reads with parens

Testing for bpf_probe_read should not include parenethes when walking
the tree, since the inner operation will have already been rewritten.

Fixes: #289
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Edit README, link path of some example files

As some example files were reorganized into subdirecotries, some
pathes in README bring connection on 404. So it have to be new pathes.

Fixes #285 - build process assumes git use

Add bpf() syscall feature check and readme update

Fixes: #283
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Add perf_output support for high rate events

Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Incoporating feedback from bgregg:
Make per-cpu nature of output buffer be hidden and implicit. As such,
incoporate some rewriting into the definition of the PERF_OUTPUT.
Create two different macros to distinguish the perf_array (hardware
counters) from the perf_output (ring buffer) use cases.

Also, rename perf_output to perf_submit.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

This adds support for the bpf_perf_event_output command. This is
intended for per-process events from bpf to userspace at high rate. The
events from the bpf program can be completely customized.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Reorganize examples into subdirectories

Examples directory has been growing, so add a bit of organization.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Bump ulimit for locked memory in test wrapper

This follows from a change in upstream kernel for counting bpf maps
against the locked memory limit.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Python: fix detach_kprobe()

As open_kprobes contains not fd but pointer to struct perf_reader,
it should call lib.perf_reader_free() instead of os.close()

perf_reader: allow more than one reader to poll

When more than one events are used with attach_kprobe, the
perf_reader_poll() will segfault by buffer overflow like below.

*** buffer overflow detected ***: python terminated
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x7338f)[0x7fcc971fb38f]
/lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x5c)[0x7fcc97292c9c]
/lib/x86_64-linux-gnu/libc.so.6(+0x109b60)[0x7fcc97291b60]
/lib/x86_64-linux-gnu/libc.so.6(+0x10ac04)[0x7fcc97292c04]
/usr/lib/x86_64-linux-gnu/libbcc.so(perf_reader_poll+0x42)[0x7fcc93969cc2]
/usr/lib/x86_64-linux-gnu/libffi.so.6(ffi_call_unix64+0x4c)[0x7fcc95c2badc]
/usr/lib/x86_64-linux-gnu/libffi.so.6(ffi_call+0x1fc)[0x7fcc95c2b40c]
/usr/lib/python2.7/lib-dynload/_ctypes.x86_64-linux-gnu.so(_ctypes_callproc+0x48e)[0x7fcc95e425fe]
/usr/lib/python2.7/lib-dynload/_ctypes.x86_64-linux-gnu.so(+0x15f9e)[0x7fcc95e43f9e]
python(PyEval_EvalFrameEx+0x965)[0x499be5]
python(PyEval_EvalCodeEx+0x2ac)[0x4a090c]
python(PyEval_EvalFrameEx+0x7d2)[0x499a52]
python[0x4a1634]
python(PyRun_FileExFlags+0x92)[0x44e4a5]
python(PyRun_SimpleFileExFlags+0x2ee)[0x44ec9f]
python(Py_Main+0xb5e)[0x44f904]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5)[0x7fcc971a9ec5]
python[0x578c4e]

softirq and hardirq

tcpconnect for IPv4 and IPv6, and make tcpv4connect a trimmed example