This commit adds helper method in C API using `ProcMountNSGuard` to enter
and exit mount namespace, and use it in `libbpf.h`

This commit adds `ProcMountNS` and `ProcMountNSGuard`, that
automatically opens and closes FDs, and enters and exists mount
namespace on construction and destruction.

Improve perf map parsing logic

docs:  update feature list for 4.12

All of the features listed to be incluude in 4.12 landed in Linus' tree.
Update the table accordingly.

Add documentation to guide future scripts to be Python3-ready

docs: update features list (ThunderX support for XDP)

cc: Work around verifier error when reading USDT probe arguments

explicit the type of the nlattr
Signed-off-by: Arthur Gautier <baloo@gandi.net>

The code generated by the USDT helpers for reading probe arguments
occasionally caused a verifier error due to a construct similar to
the following:

```
switch (ctx->ip) {
case 0xaaaa: *dest = ctx->cx; break;
case 0xbbbb: *dest = ctx->dx; break;
}
```

This would generate an instruction sequence that attempts to access
ctx through an offset that is not statically known, which confuses
the verifier. This was reported in #751, #829, and #1133, and likely
seen by others as well.

The workaround, suggested by @yonghong-song, is to force memory
writes by using the volatile modifier, which precludes this specific
optimization.

Resolves #751, #829, #1133.

docs: update features list

Update of BPF features list, following the release of kernel 4.11.
New items include:

- Sparc eBPF JIT
- ixgbe support for XDP
- eBPF benchmarking facility
- new helpers `get_socket_*()`

Small improvements to symboling availiability

Currently we check if `ProcSyms` needs refresh for every symboling call.
However if the `ProcSyms` was loaded, but the Process terminated later,
we will see it as a "need refresh" and effectively clear the symbol
table and not able to resovle anything anymore.

This commit changes so that we only refresh when the PID still exists
(but differnt from what loaded).

Currently we think the Module's symbol table is not loaed as long as its
empty. But some times we were just not able to read the symbols from the
binary / perf map, or didn't get symbol from the read. This commit makes
so that we don't end up trying to do a read on each lookup.

Install sudo inside the debian build container

frontend/b: fixes for LLVM 4.0 API change

Upstream LLVM added a new parameter to the AllocaInst constructor, which
breaks compilation. Fix it by using the IRBuilder method.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Add default -Wno-address-of-packed-membe to Clang loader

Use uintptr_t for addresses in C++ API

[RFC]: Extend table API with string support 

This commit exposes functions to convert between key and value from/to
strings, additionally it implements the BPFTable class that allows
accessing tables using strings.
Signed-off-by: Mauricio Vasquez B <mauricio.vasquez@polito.it>

With local LLVM (4.0ish), inline strings in this test case would
segfault. Fix the crash by constructing explicitly on the stack.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Possibly due to local LLVM differences, this change was needed for
sslsniff code to pass the verifier.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

On my system, the manually unrolled stack walker fails the verifier, due
to what seems to me like an incorrect return statement. Setting bp = 0
has no effect, seems that the intent was to return 0 instead.

Not sure why others haven't hit this, but the fix contained here seems
reasonable.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Disable non-static function calls

Compiled BPF programs must consist of a single contiguous code block,
meaning trying to call other function entry points (besides the
kernel-defined helpers) is not possible. The bcc frontend didn't
explicitly prohibit this, even though the program would fail to
compile/load. Add an explicit check and error message.

Fixes: #653
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Minor sorting of the yaml tool list and sync it to the latest
updates in tools
Signed-off-by: Colin Ian King <colin.king@canonical.com>

Printing the BPF program after loading it means that if there is a
load error, the program isn't printed, which sort of defeats the
purpose of the whole thing.