Now it also captures gnutls_record_send and gnutls_record_recv calls.
Added options to filter by pid or command name, or just one lib.

Add tool as talked in iovisor-dev 'BCC: bpf_probe_read read function arguments'

This reverts commit c6688dda4e856be43b8651afe92d7e32e63faea9.

killsnoop: use current time replace timestamp and default output

* debian packaging: Add missing Build-dependencies

* Add clang-format-3.7 to build-depends
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

* debian packaging: Build with -DBCC_KERNEL_HAS_SOURCE_DIR=1

This is required to use the distro-provided includes on Debian/Ubuntu

dcsnoop: use PERF_EVENT_OUTPUT

Add some explanation for functions in BPF program in Tutorial

This delete() is required because of a kernel bug:
https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=a6ed3ea65d9868fdf9eff84e6fe4f666b8d14b02

Signed-off-by: Omar Sandoval <osandov@fb.com>

fix build with llvm 4.0

Signed-off-by: Alexei Starovoitov <ast@fb.com>

Based on the bug report in
https://bugs.gentoo.org/show_bug.cgi?id=582770, mixing static+non-static
libstdc++ can lead to crashes. Disable such combinations. Choosing to
leave out the llvm check, since in practice clang is less likely to be
provided statically, so the check should cover both cases.

Fixes: #633
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Update readme with dns name and https for repo server

We enabled dns for the repo and builtbot, and then turned on letsencrypt
for those as well. Yay, now we look slightly more official.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

* add open_perf_event api for reading perf counters

Though the rewriter table method existed, we were not yet opening up the
perf counter in the proper way for it to be read.

Introduce a c function to enable attaching perf counters to cpu-indexed
table slots. The python side opens, assigns, then immediately closes the
fd. Only the kernel keeps a reference, so closing the table or deleting
the entry will be sufficient to free up the fd when finished.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

* Skip perf array hw counter test if unsupported

Hardware counters are not available in all places (some VM
environments), so gracefully skip on the particular error condition.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

* MySQL USDT example and tool

* add nodejs example output

* add reference to mysqld example

tutorial: add missing return in hello_world example

Fix typo in the reference guide

Recent USDT change removed `procstat.py`, which the `argdist` and `trace` tools are still referencing. This diff moves the only method (`which`) they are using into the `BPF` class.

Also, make `BPF.find_library` not to call `decode()` on `None`.

Added a field `demangle_name` in the `bcc_symbol` struct. Calculate its value whenever possible. For C++ programs, this would make outputted stack traces look nicer.
Example: http://pastebin.com/LqT0nP67

The current logic was only initializing page accesses, mark dirty.. at
the beginning of the method, preventing counters to be ever reset for
each PIDs.

Piggyback https://github.com/iovisor/bcc/pull/615#discussion_r71056842

Tested by running both tools manually.

fix reference_guide.md bpf_get_current_comm search

Add xdp_drop_count example

Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

This adds the xdp drop count example relicensed under ASL2, along with
some minor modifications to print pkt/s.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Added XDP support to BCC

Concretely, it adds two functions to bcc, namely:
`attach_xdp` and `remove_xdp`
which allows to attach an XDP program to a device (given via its name, e.g., en0) (in the future this might change to a specific queue on a device once the kernel offers this interface)
and `remove_xdp` removes a XDP program from a device. Please note that there can currently be only one program attached to the device and attaching another program replaces the previous.

One example is available to test XDP, in networking/xdp which drops all packets an counts for which protocol a packet was dropped (this is taken from the kernel xdp1 example). Please note that you cannot use the network headers defined in <bcc/proto.h> as they cause llvm/clang to generate instructions not available on XDP layer. On XDP layer you do not have an skb yet, so you are operating on the bare packet data.

XDP support is currently limited to only some network adapters, there is the `mlx4` and there is also a patch available for the `e1000` driver.

Probe registration fixes