This adds support for a specialized histogram type, which underneath
maps to an array or a hash table, depending on key type. With no
arguments, it takes on the type `u64 table[64];`. The other current
supported key type is `struct { int32|int64 bucket; int32|int64 slot }`.

To print these automatically, print_log2_hist is underneath split into
two types of printouts, one which prints the single histogram, and
another which prints a histogram for each unique `bucket` value.

See test_histogram.py for examples.

Fixes: #144
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Allows things like:
```c
int kprobe__foo(struct pt_regs *ctx, u64 *ptr) {
  bpf_trace_printk("%lx\n", *ptr);
```
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Initial implementation of P4->ebpf compiler.

Add contribution section

Use GNUInstallDirs for LIBDIR variable

This should be supported in older versions of cmake, but haven't
explicitly tested those.

Fixes: #243
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

biolatency, funclatency, and bpf_log2l usage

add bpf_log2 functions

killsnoop and some minor fixes

opensnoop

Add a better test case for nested probe reads

Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Add support for static helper functions

This adds support for static helper functions that can be reused. It is
not necessary to include pt_regs in the helper functions, even though
external pointers may be dereferenced. Arguments in the helpers can also
be reordered.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

add biosnoop to README

biosnoop and disk updates

Fix probe reads on char[] types

It is easy enough to wrap the type in a typeof(), otherwise the rewriter
would need to do a deeper parsing of the type information to place it
properly next to the variable name.

Fixes: #219
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Translate multiple pointer dereference into bpr_probe_read

This commit adds support for multiple consecutive and nested pointer
dereference of function arguments that should be converted to
bpf_probe_read. The logic works by marking variables as needing a
probe_read if they come from the register argument, and then applying
this property transitively.

Supported syntax:
```
int trace_entry(struct pt_regs *ctx, struct file *file) {
    struct vfsmount *mnt = file->f_path.mnt;
    struct super_block *k = mnt->mnt_sb;
    const char *name = file->f_path.dentry->d_name.name;
```

Not supported: probe reads from map leaves, probe reads after explicit casts.

Fixes: #188
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>