Event naming pattern changed to $(eventname)_bcc_$(pid)
Detect /sys/kernel/debug/tracing/instances in bpf_attach_probe,
if it exist, then will per-instance event, if failed the make global
event instance as same as before.

Fix python2/3 incompatible percpu helpers

Signed-off-by: Brenden Blanco <bblanco@gmail.com>

The kernel uses number of possible cpus to size the leaf, not the num of
online cpus. Fixup the python side appropriately.
Update: use num_possible_cpus() helper instead
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

The python3 version of the percpu helpers (average, sum, etc.) were
using a python2 function that has since moved to functools (reduce).

Worse, the test case for percpu functionality was not enabled in the
cmake file. Better turn that on and make it work.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

[tools][memleak.py] add parameter for specifying object to load malloc/free from

trace: Allow function signatures in uprobes and kprobes

trace, tplist, argdist: UDST probe miscellaneous fixes

§`trace` now allows uprobes and kprobes to have function signatures,
which means function parameters can be named and typed, rather than
relying on the positional arg1, arg2, etc. arguments. This also
enables structure field access, which is impossible with the unnamed
arguments due to rewriter limitations.

The example requested by @brendangregg, which now works, is the
following:

§Â```
PID    TID    COMM         FUNC             -
777    785    automount    SyS_nanosleep    sleep for 500000000 ns
777    785    automount    SyS_nanosleep    sleep for 500000000 ns
777    785    automount    SyS_nanosleep    sleep for 500000000 ns
777    785    automount    SyS_nanosleep    sleep for 500000000 ns
^C
```

`trace` would use the incorrect argument index for USDT probes when
filtering specifically, e.g. `trace u:lib:tp (arg1 != 0) ...` would
actually use the type of the 2nd argument, and not the 1st argument
for the type of the filter variable in the generated program. This
could cause compilation errors or subtle bugs where the data would
be either extended or contracted to fit the wrong argument's type.

Additionally, `trace` would use the pid (thread id, `-L`) filter
with the `attach_uprobe` API, which expects a tgid (process id).
As a result, incorrect filtering would happen.

Oftentimes we want to use the STRCMP helper to compare strings that
are not null-terminated, e.g. in USDT probes this often happens.
Ignore the null terminator (i.e. loop until the last character
excluding the null terminator).

The `trace` and `argdist` tools expect location and argument indices
to start at 1 -- the first argument is arg1, and so on. The `tplist`
tool now prints UDST argument indices (and location indices, for
consistency) as 1-based as well.

Use targeted process to resolve library names

fix iteration over CPUs

Since kernel version 4.9.0 BPF stopped working in a KVM guest.
The problem are calls to perf_event_open with CPU identifiers which do
not exist (ENODEV). The root cause for this is that the current code
assumes ascending numbered CPUs. However, this is not always the case
(e.g. CPU hotplugging).

This patch introduces the get_online_cpus() and get_possible_cpus()
helper functions and uses the appropriate function for iterations over
CPUs. The BPF_MAP_TYPE_PERF_EVENT_ARRAY map contains now an entry for
each possible CPU instead of for each online CPU.

Fixes: #893
Signed-off-by: Andreas Gerstmayr <andreas.gerstmayr@catalysts.cc>

argdist, trace: Support non-C identifier names

We need the PID when detaching uprobes to resolve library names
to the same path as when attaching

To resolve library names, bcc_procutils_which_so leverages mapped
libraries of the targeted process, if one is given. Uses the kernel's
/proc/$pid/maps

When argdist or trace face a function that has characters
in its name that are not valid in C identifier, they now
replace these characters with an underscore (`_`) when
generating function names and structure names to include
in the BPF program. As a result, it is now possible to
trace functions that have these identifiers in their names,
such as Golang functions like `fmt.Println`.

add some error hints

profile: increase unique stack default to 10k

trace: allow tracing of functions containing a dot (golang)

statsnoop: refactor

gethostlatency: remove unused code

add a few funccount examples

snapcraft: add cpuunclaimed to snapcraft wrapper rules

Add missing helper prototypes

Fixes bio{snoop,top} on 4.10