o This is caused by my ignorant error in previous usdt change.
  Obviously, I need to store into pointer address in order to
  propagate value back to caller.
o Thanks Tetsuo Handa pointing this out.
Signed-off-by: Yonghong Song <yhs@fb.com>

  o The sample application covers different aspects
    of usdt rewriter code generation:
    - const
    - *(ctx + offset)
    - use bpf_probe_read to get trace data
    - the switch in ctx->ip if the same probe
      is triggered in multiple .text locations.
  o folly (https://github.com/facebook/folly/) tracing
    header files are pulled into python test directory and
    used to produce USDT probes.
Signed-off-by: Yonghong Song <yhs@fb.com>

Force udst ctx->#reg load to be volatile

Add linux/sched.h to list of libbpf.c includes

This should hopefully fix compile errors on some ubuntu systems.

Also, reorders the includes according to clang-format
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Break the c++ dependency in libbpf.c, and turn it into a separate lib
from cmake point of view.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

This moves ProcMountNS[Guard] classes to a separate header file and
implementation. The goal will be to use these more directly in libbpf.c
without creating a circular dependency.
Removed the friend class statements and exposed a few public getters instead.
Slightly changed the implementation in ProcMountNS constructor to avoid
a few error cases and the use of snprintf.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

This is related to issue #1133. Compiler sometimes
generates code patterns likes:
     r1 = ctx + 96
     goto next
   here:
     r1 = ctx + 48
   next:
     r3 = load (r1 + 0)
Verifier will fail for such cases as r1 is marked
as "unknown" at the time of load.

The previous workaround is to add volatile attribute
to the store like
   *(volatile u64 *)&dest = ctx->bx
The hope is to force ctx related load in-place since
its value is needed for store.

Unfortunately, this does not always work and compiler
still has freedom to merge different ctx loads at the
same time honoring the volatile &dest. In USDT generated
code, different branches of &dest are the same.

This patch directly make ctx->bx itself as a volatile load:
  *(volatile u64 *)&ctx->bx
This seems working as compiler stops playing around
the address pointing to a volatile data.
Signed-off-by: Yonghong Song <yhs@fb.com>

funclatency/sslsniff: fix the TypeError when enabling pid filter on u…

Fix usage of CMAKE_BUILD_TYPE setting

Use BPF_F_CURRENT_CPU in perf_submit when possible

Improve perf event clean up

Add bpf_close_perf_event_fd helper that first disables, then closes a
perf event fd. Use it in Python and C++ API for detach perf event

Support symbol option in C++ API stack table

attach_uprobe() and attach_uretprobe() expect the type of pid argument
is "int" instead of "str". Fix it by specifying the type of the "-p"/"--pid"
option as "int", and updating the format string of args.pid accordingly.

Fixes: d73c58f0

Add support for generic XDP mode

Reused some of the code and command-line format from kernel XDP samples.

$ sudo ./xdp_drop_count.py -S enp1s0
Printing drops per IP protocol-number, hit CTRL+C to stop
17: 36616 pkt/s
17: 19720757 pkt/s
17: 19685768 pkt/s
17: 19643601 pkt/s
17: 19694537 pkt/s
[...]
$ sudo ./xdp_drop_count.py enp1s0
Printing drops per IP protocol-number, hit CTRL+C to stop
17: 7029 pkt/s
17: 29996706 pkt/s
17: 30048705 pkt/s
17: 30261417 pkt/s
17: 30291967 pkt/s
[...]

Throughput difference is expected since generic XDP takes more
instructions per packet than optimized XDP.

v2: switch __u32 to uint32_t in bpf_attach_xdp
Signed-off-by: Andy Gospodarek <gospo@broadcom.com>

Fix bcc_resolve_symname memory leak in C++ API

Unify Perf Event related Enums and checks

Minor fixes for example and compiler warning

Add ability for users to control symboling behavior

As the symbol type check now controled by the specified
`bcc_symbol_option` and handled in lower level, there is not need to
pass the type flag to the callback anymore.

This commit makes `ProcSyms` constructor takes a `bcc_symbol_option`,
and pass it down to underlying calls to control symboling behavior.
If `nullptr` is passed, `ProcSyms` will use default setting, which is
to use debug file, verify debug file checksum, and only load function symbols.

This commit also makes `bcc_symcache_new` take a `bcc_symbol_option`
parameter and pass it to the underlying `ProcSyms` constructor.

This commit makes `bcc_resolve_symname` to take an `bcc_symbol_option`
parameter, and pass it to underlying calls to control symboling behavior.
When `NULL` is passed, it will fallback to default which is current
behavior that uses debug file, verify debug file CRC, and check all
types of symbols.

This commit also removes the unneccesary intermediate
`bcc_find_symbol_addr`.

Added documentation for usage of the API, updated most call sites to use
default with `NULL`, and fixed some memory leaks at call sites.