The manual walking for kernel stacks in the eBPF code has been replaced
with a `BPF_STACK_TRACE` table; the stack ID is now stored as an integer
in the main key.

Thanks to the `StackTrace.walk` iterator, the printing code can also be
significantly simplified for both folded and full stack modes.

Instead of manually walking the (kernel) stack inside the eBPF code,
create a `BPF_STACK_TRACE` table and store the stack IDs in the alloc
info struct.

This greatly simplifies the leak detection code: instead of storing the
full stack trace as a string to de-duplicate the allocation point for
the different allocations, we can store the `stack_id`. Since we're
creating stack IDs with `BPF_F_REUSE_STACKID`, the kernel will take care
of deduplication for us.

Additionally, the `StackDecoder` class has been specialized into a
`UStackDecoder` and `KStackDecoder` (for userland and kernel stacks,
respectively). This lets us pass the decode class directly to
`stack_traces.walk()` to automate symbol resolution.

A new class, `Allocation` has been created to encapsulate what
previously was a 2-element tuple of `(count, size)`. This

Better stack walking APIs

This simple example script traces all calls to `malloc` in a process and
prints the callsite using the new `BPF_STACK_TRACE` table API.

The StackWalker iterator lets us call `stack_trace.walk(id)` to iterate
through the addresses in any given stack. The constructor of this
iterator takes an optional `resolver` to convert the addresses in the
iterator into symbols (or to format them according to the users' needs).

Allowing more natural syntax for tracepoints with no "tp" struct prefix

add tcpv4listen.py tracing example, with comments

Fix error handling when attaching {u,k}{,ret}probes

Moved user symbol decoding from memleak into bcc module

tracepoint support for argdist and trace, and new tplist tool

Fix llvm shared build

Trim the llvm libs to the direct requirements only and use
llvm_expand_dependencies to discover all dependencies.

fix -p

Fix python3 incompatibilities

Syntax and dict usages fixups in dcstat.py and memleak.py

Fixes: #433, #434
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Enable python3 compatible strings in biosnoop

Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Add option to change kernel build search paths

Include all of the paths in the build/ directory when kernel headers are
split.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Some linux distributions structure the /lib/modules directories
differently, causing complexities. Add cmake overrides to be able to
compile different behavior.

If your distro sets up `/lib/modules/$(uname -r)/{source,build}` with
header files split between the two (debian does this), then add
-DBCC_KERNEL_HAS_SOURCE_DIR=1 to the cmake command line.

If your distro just has something other than build/, but things are
still in one subdirectory, then add -DBCC_KERNEL_MODULES_SUFFIX=foo to
the cmake command line.

Also, fix one implicit declaration warning introduced by the new
bpf_get_stackid() helper.

Fixes: #397
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

[RFC] Basic implementation of stacktrace table

Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

This is the initial implementation of bpf_get_stackid with python
helpers. This doesn't expose the different methods of calling
(kernel/user, fast, or reuse).
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Fix stacksnoop PID filter

The function FILTER is injected into (trace_stack()) returns void, not int.

Move cc/*py tests to python subdir and introduce c standalone test binary

This creates a new static library target for bcc. Add one trivial c test
case that links against it.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

They didn't quite make sense where they were. At one point 'cc' meant
compiler, and yes they were testing the compiler. Now lets use the
convention that different tests/ subdirectories test different bindings
(c, python, other).
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Update headers with 4.5+ features

Pull in bpf.h from upstream, and update helpers accordingly.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>