Use LLVM_VERSION_MAJOR checks to make codegen tests work on LLVM 5, 6 and 7.

The 'bpftrace -l' command (without any search expression) should also
list the tracepoints, in the same way of 'bpftrace -l '*''.

Fix random small typos and mistakes in man pages

Fix possible crash on exit due to wrong vector size (#201)

Document unroll

Add fedora package install instructions to INSTALL.md

On method BPFtrace::find_empty_key() size of 'value' vector (value_size)
must be multiplied by ncpus_ when map.type_.type == Type::lhist
otherwise bpf syscall (BPF_MAP_LOOKUP_ELEM) will write out of bounds
thus corrupting the heap.

Fixes: https://github.com/iovisor/bpftrace/issues/251

Support for split LLVM libs

Support for split LLVM libs is added since Gentoo does not distribute a
combined LLVM library.

fix map keying with 1 or 2 byte integers (#232)

User-space stacks are quite special in regards to aggregation (and
comparison) between processes. To a first approximation, each pid has a
different memory mapping and thus pointers should not be compared or
aggregated between pids[*]. With ASLR this becomes even more fun, and
thus it is necessary to do usym()-style packing of the stackid for
ustack (since bpf_get_stackid will give you a hash of the pointers --
even in the ustack case).

However, the kernel address space is the same regardless of current->pid
-- and in many cases you want to aggregate between different processes
(and if not, you can always do the packing yourself with @[tid,stack]).

So, we only apply the packing when dealing with ustack. sym() already
does the right thing.

[*] This is more than slightly untrue -- really this depends on
    current->mm and ideally we would aggregate ustack on current->mm.
    Unfortunately this is not a luxury we have at the moment.
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>

Fix USAGE message (issue 191)

- Stop warning about '-h'
- Sort options alphabetically
- Cosmetic changes

Fix 'lhist() 0 entry has 0M' (issue 63)

opensnoop to trace openat

rename name builtin to probe

Use env to find bpftrace

Fixlets

Ensure no garbage in struct sigaction.
Valgrind was complaining:

==21435== Syscall param rt_sigaction(act->sa_mask) points to uninitialised byte(s)
==21435==    at 0x95ED000: __libc_sigaction (in /usr/lib64/libc-2.27.so)
==21435==    by 0x594E99: main
==21435==  Address 0x1ffefff8e8 is on thread 1's stack
==21435==  in frame #0, created by __libc_sigaction (???:)

Valgrind was complaining:

==8428== 32,816 bytes in 1 blocks are definitely lost in loss record 983 of 985
==8428==    at 0x4C2EDA7: malloc (vg_replace_malloc.c:299)
==8428==    by 0x96779A5: __alloc_dir (in /usr/lib64/libc-2.27.so)
==8428==    by 0x9677AAC: opendir_tail (in /usr/lib64/libc-2.27.so)
==8428==    by 0x59EC50: bpftrace::list_dir(...)
==8428==    by 0x59ED5F: bpftrace::list_probes(...)
==8428==    by 0x594993: main

cppcheck was complaining:

[attached_probe.cpp:206]: (warning) %d in format string (no. 1) requires 'int *' but the argument type is 'unsigned int *'.
[attached_probe.cpp:206]: (warning) %d in format string (no. 2) requires 'int *' but the argument type is 'unsigned int *'.
[attached_probe.cpp:206]: (warning) %d in format string (no. 3) requires 'int *' but the argument type is 'unsigned int *'.

While at it, check uname() and sscanf() return values to avoid garbage.