clang 3.7.0 is known to be buggy, and we recommend that people use
3.7.1. Update install instructions to point to 3.7.1.

Compiling BCC on Fedora requires elfutils-libelf-devel. Add this
package to the install instructions for Fedora.

Do not throw exception on ipv6 packets in tcpretrans

* kernel version guide

* update

Fix nits for /tmp/perf-pid.map support

Add support for reading symbols from /tmp/perf-pid.map

fix install instruction to mention llvm >= 3.7.1

Signed-off-by: Alexei Starovoitov <ast@fb.com>

This adds basic support for /tmp/perf-pid.map. To cope with processes in
containers, it supports:

* mapping from BCC's PID namespace to the target process's PID namespace
  using /proc/pid/status
* resolving a target process's root filesystem using /proc/pid/root

Check for NULL result from bpf_attach_kprobe

The check for NULL in the return value from C functions was comparing to
None incorrectly, causing an error check to pass improperly. Simply
check the truthiness of the return instead seems to be more resilient.

Add a test as well.

Fixes: #568
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

libbpf.c: Prepend BPF syscall error to log_bug when debug is enabled.

When BPF syscall fails and DEBUG_FLAG has been provided to a Python
caller script, the BPF error string would be printed only if log_buf had
not been filled by the kernel. This commit removes this requirement,
printing the error string even if log_buf is not empty.
Signed-off-by: Quentin Monnet <quentin.monnet@6wind.com>

Commit 759029fe provided an option to
store the output from BPF syscall into a buffer (and not to print it
systematically to standard output) on program load in libbpf.c.

But doing so, it only stores the content of attr.log_buf, while the
error string--resulting from a failed BPF syscall--is no more displayed
when the DEBUG_BPF flag is used in the Python script responsible for
converting and injecting the code.

This commit proposes a fix for this bug by printing the error message
(associated to the return value from the syscall) from the Python
caller, when all the following conditions are met:

- the syscall fails,
- the DEBUG_BPF flag has been provided, and
- log_buf is empty (has not been filled by kernel).

Note: when DEBUG_BPF is not provided, the error string is printed in the
C wrapper in libbpf.c (bpf_prog_load) anyway.

Fixes: 759029fe ("Add option for custom log string to bpf_prog_load")
Signed-off-by: Quentin Monnet <quentin.monnet@6wind.com>

Change kernel/user stacks order

Closes #559

see #559

offcputime -f: don't miss backtrace bounds

See #559

Update manpage for offcputime

Fix tools[/old]/offcputime -p PID

Closes #558

We should extract pid before THREAD_FILTER

execsnoop: use BPF_PERF_OUTPUT, add PPID

set use_errno to True for libbcc.so

Add user space stack traces to offcputime

Currently, errno could not be accessed by libbcc.py, like:
```
binding socket to 'eth0'
cannot create raw socket: Operation not permitted
Traceback (most recent call last):
  File "/home/ryan/Software/bcc/examples/networking/http_filter/http-parse-simple.py", line 73, in <module>
    BPF.attach_raw_socket(function_http_filter, interface)
  File "/usr/lib/python2.7/site-packages/bcc/__init__.py", line 330, in attach_raw_socket
    raise Exception("Failed to open raw device %s: %s" % (dev, errstr))
Exception: Failed to open raw device eth0: Success
```
The exception prints the errno as `Success`, instead of `EPERM`.

This patch would fix this problem.
Signed-off-by: Jincheng Miao <jincheng.miao@gmail.com>

Install tools/old

lua: Allow LuaJIT parameterized types in `open_perf_buffer`

Use BPF_PERF_OUTPUT for fileslower and stacksnoop