Always autoload k[ret]probe__ prefixed functions

This will shorten some examples, no longer requiring them to call
attach_kprobe.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Improve coverage for kprobe event_re

This makes the attachment of kprobes to arbitrary events more robust.

Issue 1: Functions with '.' characters should not have similarly named
 probes.
Issue 2: Functions in the blacklist should not be attached to.
Issue 3: Some functions matched by regex cannot actually be attached to,
 despite not being in the blacklist...possibly the blacklist is outdated?
 Instead, warn instead of error during bulk regex attach.
Issue 4: Attaching to large numbers of kprobes gets to be very slow. For
 now, leave this unresolved. For reasonably sized regexes, startup times
 may be acceptable, and shutdown times are actually the worse part. To
 speed up shutdown, one could add the following after the last
 attach_kprobe to disable auto-cleanup:
  ```
  from bcc import open_kprobes
  open_kprobes = {}
  ```
 Then, once the program is exited, one must manually
  echo "" > kprobe_events

Some numbers:
attaching to event_re='tcp_*': 2 sec startup, 15 sec shutdown
attaching to event_re='b*': 10 sec startup, 75 sec shutdown
attaching to event_re='*': unknown (>20 min) startup, unknown shutdown
The slowdowns appear to be exponential, doubtful that '*' will ever
complete.

Fixes: #199
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Autoload kprobes for all types of trace_* functions

Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

The previous patch #195 for autoloading of kprobes only did it for
trace_print. Turn this feature on for all trace_* functions. This
requires that these functions are also no longer staticmethods.

Enable the feature in examples/disksnoop.py
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Fix breakage in bpf_probe_read from #196

Argument needs to be cast to u64, otherwise it is adding a whole pointer
stride.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Add debug and fix the inline replace of kprobe args

The way in which args 1+ were being replaced in the C file was
fragile. Instead, assign the registers from ptregs into the function
arguments as the first statement(s) in the body of the function.
e.g.:
int sys_clone(struct ptregs *ctx, struct request *req) {
  // do something with req
}
becomes:
int sys_clone(struct ptregs *ctx, struct request *req) {
  req = ctx->di;
  // do something with req

Fixes: #192
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

* Many times it is useful to print out the C file after the
  BFrontendAction has run.
  e.g.: BPF("file.c", debug=0x4)
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Change auto-loading behavior of trace_print

Since kprobe functions will have a different prototype than the kernel
symbols they are attaching to, require that the user prefix the trace
function with a kprobe__ name to denote intent. kretprobe__ prefix is
also supported.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

* As @brendangregg pointed out, users will probably assume that
  handily-named C functions that can be auto-loaded will be all the
  time, rather than just in the singleton case. This is pretty easy to
  implement, so changing the behavior.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Support automatic kprobe event detection in common case

* In the simple case, a user only creates 1 C function to be used with
  kprobes. Detect this common case and don't require the user to repeat
  themselves by passing the fn_name to attach_kprobe().
  e.g.: BPF(text='int sys_clone(void *ctx) {/*do stuff*/}').trace_print()
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Suppress None return when trace_pipe drops lines

* When a "CPU: X Lost N events" line came on the trace_pipe,
  trace_fields would return None and cause exceptions in callers that do
  (a, b, ...) = b.trace_fields() type of calls. Instead, keep reading
  from trace_pipe when such messages come.

Fixes: #187
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Add BPF_HASH macro with variadic arguments

print_log2_hist() for #143

* Per suggestion in #149
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

* Usage: BPF_HASH(tablename, key_type=u64, leaf_type=u64)
  2nd and 3rd arguments are optional in the C++ default argument style

Fixes: #135
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Shorten trace_readline_fields to trace_fields

* Per suggestion in #149
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

simplify code using new features

Reorganize cmake, some cleanups and test fixes.

* After a kernel update, the binary of schedule function changed offset,
  and the attachment point updated. Since this is just a test case, pick
  a different function to test.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

* The c++ exception code was unused, now it is just c macro style
  "exceptions"
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Update README.md and INSTALL.md, specfile dependencies

Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

* These files are required to build the test rpm
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

* Add some runtime dependencies in INSTALL.md
* make and gcc are required at runtime, so add them to libbcc Requires:
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>