Use tempfile module to create a temp file

Fix some review input

Fix style check

Style

Style check

Remove builtin module from python test to run fedora ctest

Let the program calling bpf_prog_load to handle the log buffer

Check max instruction before the syscall. Fix other review comment

minor cleanup + process partial name matching

Signed-off-by: KarimAllah Ahmed <karim.allah.ahmed@gmail.com>

Signed-off-by: KarimAllah Ahmed <karim.allah.ahmed@gmail.com>

... since they are unused.
Signed-off-by: KarimAllah Ahmed <karim.allah.ahmed@gmail.com>

Prepare debian changelog for v0.2.0 tag

Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

examples: fix indentation in tracing/tcpv4connect

Python doesn't like mixing spaces and tabs.

fileslower: use de->d_name.name, add filtering

fix biosnoop after kernel change

offcputime improvements: use less RAM, add PID/TID support

Add perf_submit_skb

For BPF_PROG_TYPE_SCHED_CLS/ACT, the upstream kernel has recently added a
feature to efficiently output skb + meta data:
commit 555c8a8623a3 ("bpf: avoid stack copy and use skb ctx for event output")

This patch adds perf_submit_skb to BPF_PERF_OUTPUT macro.  It takes
an extra u32 argument.  perf_submit_skb will then be expanded to
bpf_perf_event_output properly to consider the newly added
u32 argument as the skb's len.

Other than the above described changes, perf_submit_skb is almost
a carbon copy of the perf_submit except the removal of the 'string name'
variable since I cannot find a specific use of it.

Note that the 3rd param type of bpf_perf_event_output has also been
changed from u32 to u64.

Added a sample program tc_perf_event.py.  Here is how the output
looks like:
[root@arch-fb-vm1 networking]# ./tc_perf_event.py
Try: "ping -6 ff02::1%me"

CPU SRC IP                           DST IP       Magic
0   fe80::982f:5dff:fec1:e52b        ff02::1      0xfaceb00c
0   fe80::982f:5dff:fec1:e52b        ff02::1      0xfaceb00c
0   fe80::982f:5dff:fec1:e52b        ff02::1      0xfaceb00c
1   fe80::982f:5dff:fec1:e52b        ff02::1      0xfaceb00c
1   fe80::982f:5dff:fec1:e52b        ff02::1      0xfaceb00c
1   fe80::982f:5dff:fec1:e52b        ff02::1      0xfaceb00c

Minor adjustments to the documentation

Fix a few typos
Add missing link
Reword update() description sentence

fix build with 4.0 llvm trunk

Signed-off-by: Alexei Starovoitov <ast@fb.com>

As reported in #664:
In cases where the AST contains a MemberExpr with an invalid opLoc,
rewrite will fail but prior to this change would segfault. Fail a little
more gracefully, even though the program will still be rejected.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Tool to sniff data contents before encrypted with OpenSSL

Now it also captures gnutls_record_send and gnutls_record_recv calls.
Added options to filter by pid or command name, or just one lib.

Add tool as talked in iovisor-dev 'BCC: bpf_probe_read read function arguments'

This reverts commit c6688dda4e856be43b8651afe92d7e32e63faea9.

killsnoop: use current time replace timestamp and default output

* debian packaging: Add missing Build-dependencies

* Add clang-format-3.7 to build-depends
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

* debian packaging: Build with -DBCC_KERNEL_HAS_SOURCE_DIR=1

This is required to use the distro-provided includes on Debian/Ubuntu

dcsnoop: use PERF_EVENT_OUTPUT

Add some explanation for functions in BPF program in Tutorial

This delete() is required because of a kernel bug:
https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=a6ed3ea65d9868fdf9eff84e6fe4f666b8d14b02

Signed-off-by: Omar Sandoval <osandov@fb.com>

fix build with llvm 4.0