llvm5.0: use input kind helper to avoid breakage

Move FileDesc to separated header file and install

Upstream llvm renamed an enum, so use a helper function that is
available in all versions to fix compatibility.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Use late-binding to finalize snprintf/sscanf

Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Fedora compile

The api should return 0, not the number of bytes successfully written
(which is what snprintf directly returns).
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Not all users require the snprintf/sscanf helpers, and in some types the
finalization can take a long time. Defer the finalization until the
first use. Wrap the invocation with a bound function such that the
BPFTable and other users don't need to keep an explicit BPFModule
reference. Use-after-free will be avoided by resetting the function to
an error-returning stub when/if the BPFModule is freed.
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Update compat header files and add bpf_probe_read_str

Also use it in the RecordMySQLQuery example and updated documentation

This commit updates the compat header files to 4.12-rc1

RFC: Improve mount namespace handling

This commit adds helper method in C API using `ProcMountNSGuard` to enter
and exit mount namespace, and use it in `libbpf.h`

This commit adds `ProcMountNS` and `ProcMountNSGuard`, that
automatically opens and closes FDs, and enters and exists mount
namespace on construction and destruction.

Improve perf map parsing logic

docs:  update feature list for 4.12

All of the features listed to be incluude in 4.12 landed in Linus' tree.
Update the table accordingly.

Fix computation of LUAJIT_INCLUDE_DIR

I don't think the current way cmake uses to locate the correct lua.h
works.  Entries like "include/foo.h" cause cmake to look for a file
like "/usr/include/include/foo.h".  I.e., the include/ prefix for
all the entries is wrong as is adding "include" at the end.

This patch removes the prefix.  With it bcc finally compiles on
Fedora.

If this change causes a problem there is something seriously wrong
with cmake.

Add documentation to guide future scripts to be Python3-ready

I cannot say that I understand the purpose behind the match_so_flags
function.  Is it supposed to be an exhaustive check?  Just a quick
check?  Is it always required to find the DSO which would be used
by the current process?  Should there be an overwrite?

In any case, the current way seems to be wholly inadequate.  It
somehow assumes a specific order of the DSO in the list read from
the ld.so cache.  That's fragile at best.

In the case of one of my machines, I run a x86-64 process and try
to find a symbol in libc.  The first DSO returned in the cache
matching "libc.so" is /libx32/libc.so.6 (i.e., the x32 version of
libc).  Using the file works but the DSO is not used.

I assume the idea behind the short form "c" for the module name
is to use the DSO of the same type as the running process.  As is
all platforms not matching the listed 64-bit platforms are blindly
accepted.

I suggest at the very least to check for the case of the non-64-bit
DSO in the cache to check that the running program is also 32-bit.
This patch does this.

In the longer run a more robust check should be implemented which
compares the current process' ELF header with that of the found DSO.
If this is the desired direction let me know and I'll come up with
a patch.

Some Linux distributions (at least Fedora and RHEL) do not provide
libluajit as an archive and instead only as a DSO.  Using the DSO
does not have any negative impact but the cmake script does not
check for the DSO files and instead fails to find luajit.

This simple change causes cmake to find the file as named in the
above distributions.  Maybe more change or a generalized method are
needed in future.  The prefered way to detect the DSO for Fedora/RHEL
would be to use pkgconfig but I don't propose to use it at this time.

docs: update features list (ThunderX support for XDP)

cc: Work around verifier error when reading USDT probe arguments

explicit the type of the nlattr
Signed-off-by: Arthur Gautier <baloo@gandi.net>

The code generated by the USDT helpers for reading probe arguments
occasionally caused a verifier error due to a construct similar to
the following:

```
switch (ctx->ip) {
case 0xaaaa: *dest = ctx->cx; break;
case 0xbbbb: *dest = ctx->dx; break;
}
```

This would generate an instruction sequence that attempts to access
ctx through an offset that is not statically known, which confuses
the verifier. This was reported in #751, #829, and #1133, and likely
seen by others as well.

The workaround, suggested by @yonghong-song, is to force memory
writes by using the volatile modifier, which precludes this specific
optimization.

Resolves #751, #829, #1133.

docs: update features list

Update of BPF features list, following the release of kernel 4.11.
New items include:

- Sparc eBPF JIT
- ixgbe support for XDP
- eBPF benchmarking facility
- new helpers `get_socket_*()`

Small improvements to symboling availiability

Currently we check if `ProcSyms` needs refresh for every symboling call.
However if the `ProcSyms` was loaded, but the Process terminated later,
we will see it as a "need refresh" and effectively clear the symbol
table and not able to resovle anything anymore.

This commit changes so that we only refresh when the PID still exists
(but differnt from what loaded).

Currently we think the Module's symbol table is not loaed as long as its
empty. But some times we were just not able to read the symbols from the
binary / perf map, or didn't get symbol from the read. This commit makes
so that we don't end up trying to do a read on each lookup.

Install sudo inside the debian build container