Document bpf_tail_call()

Signed-off-by: Gary Lin <glin@suse.com>

Define a new macro to make it easier to declare a program array.
Also replace BPF_TABLE("prog") in examples and tests with
BPF_PROG_ARRAY.
Signed-off-by: Gary Lin <glin@suse.com>

Fix missing include

tcptracer: Fix argparse is not defined error

Fixes compile with libc++ on linux:

```
In file included from ../tests/cc/test_array_table.cc:17:
In file included from ../src/cc/api/BPF.h:24:
../src/cc/api/BPFTable.h:118:71: error: use of undeclared identifier 'errno'
      return StatusTuple(-1, "Error getting value: %s", std::strerror(errno));
```

Add missing includes to fix build against libc++

argparse is imported as ap, using argparse explicitly results in a name
not defined error.
Signed-off-by: Gal Pressman <galp@mellanox.com>

continue adding --ebpf option to the python tools/ scripts

Fixes this compile error:

```
../src/cc/frontends/clang/kbuild_helper.h:40:64: error: use of undeclared identifier 'errno'
      fprintf(stderr, "chdir(%s): %s\n", dst.c_str(), strerror(errno));
```

This fixes the compile with `-stdlib=libc++`. Without this header the build fails with:

```
../src/cc/ns_guard.cc:75:30: error: use of undeclared identifier 'CLONE_NEWNS'
```

Found by yonghong-song while reviewing PR #1570.
Signed-off-by: Nathan Scott <nathans@redhat.com>

opensnoop: -d option for duration

Small fixes

Signed-off-by: Song Liu <songliubraving@fb.com>

The semicolon is usually added when the macro is used. Update both the
macro definition and all uses.
Signed-off-by: Song Liu <songliubraving@fb.com>

Several python tools allow their eBPF code to be printed to
stdout for debugging.  There are other projects that would
like to share these program definitions however, instead of
duplicating code.  We previously agreed on an --ebpf option
and we now continue adding it to more tools.
Signed-off-by: Nathan Scott <nathans@redhat.com>

Add option to print virtual address to trace.py

Miscellaneous BCC patches

doc: bpf_get_current_task helper

__delitem__ has some code duplication for the common case. The common
case is to call the low-level bpf_delete_elem function.  Refactor the
code a bit for this case. It avoids duplication of code and will also
make the communication with BPFd simpler as well.

Test: Ran test_tools_smoke tests with all tests passing except for
test_shared_table.py which fails for me with or without this patch.
(Filing separate issue for that).
Signed-off-by: Joel Fernandes <joelaf@google.com>

fix map a type parsing issue for export/extern types

Update man page for funccount

cc: missing bpf helpers in export/helpers.h

Fix issue #1562.

Currently, bcc allows a map defined in one module and
used in the same or a different module. At tests/python directory,
test_clang.py and test_shared_table.py have such an example.
  ...
  b1 = BPF(text="""BPF_TABLE_PUBLIC("hash", int, int, table1, 10);""")
  b2 = BPF(text="""BPF_TABLE("extern", int, int, table1, 10);""")
  t = b2["table"]
  ...

With current implementation, the map key/value types are parsed
twice, resulting a type "int int" instead of "int". When type
is retrieved through `t = b2["table"]`, python decoding error
will appear.

The issue is fixed by preventing the second map key/value type
parsing if the map is `extern`. Also add `t = b2["table"]`
so the issue will be triggered if bcc clang frontend fix is not there.
Signed-off-by: Yonghong Song <yhs@fb.com>

cc: error hint for 'invalid func'

Systems such as Android mostly use openat which makes us miss all
attempts to open. Instead use do_sys_open for the kprobe hook where
all the open calls finally end up, so that we don't miss anything.
Signed-off-by: Joel Fernandes <joelaf@google.com>

libclang does use functions from libbcc so it does depend on it.
When defining new symbols in bpf_common.cc, linker errors appear
when the same symbols are used in libclang. This is because of
incorrect linker dependency, this patch fixes the issue by making
sure the dependency is correctly tracked.
Signed-off-by: Joel Fernandes <joelaf@google.com>

Finish man page update for b03d9eb2.

bpf_getsockopt in docs/kernel-versions.md

add a probe alias $task in trace.py

The $task refers to the current task. In my particular case, I need
to trace the number of users for file system associated with the current
task. With the probe alias $task, trace.py can easily trace this event

  ......
  trace.py -I 'linux/fs_struct.h' 'mntns_install "users = %d", $task->fs->users'
  PID     TID     COMM            FUNC             -
  176566  176566  python2.7       mntns_install    users = 2
  176566  176566  python2.7       mntns_install    users = 2
  ......

With $task probe alias, kernel tast_struct fields can be used in trace.py
filter or output easily even if they cannot be accessed through input
parameters.
Signed-off-by: Yonghong Song <yhs@fb.com>

use __builtin_memset instead of memset with frontend rewriter

fix flaky test py_test_usdt3