histogram: support sorting bucket before dumping table

Improve trace.py formatting and printing options

add a test case for bucket_sort_fn and show its
use scenario as well

add examples for including additional header files

Update for new bpf_perf_{event|prog}_read_value helpers

Clean-up unused parameter in tracing APIs

cmake3 on Ubuntu Trusty

- Set `inherit = 1` only for per-task perf event. Inspired from change
  https://github.com/torvalds/linux/commit/81b9cf8028a17bdbdaa0da80b735b32150d4e89e
- Kernel now support more events (see #1448). Also it's checked in
  `bpf_attach_perf_event` already. Remove the check from C++ API

Add C++ helper to clear BPF tables

Fix issue #1478
Two tools, trace.py and argdist.py, and their corresponding
example files were changed.
Fixed a minor typo in one of trace.py error messages.
Signed-off-by: Yonghong Song <yhs@fb.com>

add padding to the end of structure

execsnoop: fix the prototype for kprobe__sys_execve

provide padded structure for table_{key|leaf}_desc API

Commit 538a84e1 ("provide padded structure for
table_{key|leaf}_desc API") added explicit padding, if needed,
before every structure member.

This is not enough as if an array of elements are returned
from C++ to python side, the size of structure must be correct.

This patch also adds padding after the last structure field
to make structure size in python side consistent with C++
side. With this patch, I experimented with the pull request
for tcpretrans.py by Matthias Tafelmeier, the type
  struct ipv6_flow_key_t {
      unsigned __int128 saddr;
      unsigned __int128 daddr;
      u64 lport;
      u64 dport;
  }
can be replaced with
  struct ipv6_flow_key_t {
      unsigned __int128 saddr;
      unsigned __int128 daddr;
      u16 lport;
      u16 dport;
  }
where the original type of lport/dport is u16.
Some other ipv6 related data structures can also be simplified.
Signed-off-by: Yonghong Song <yhs@fb.com>

When there are multiple fields in the secondary key of a histogram
(e.g. output the bio latency for each combination of disk and blk cgroup),
if the buckets are not sorted before the iteration, the output order
of tables often does not meet our expectations.

So provide a way to sort them.

For sys_execve() the type of filename parameter should be
"const char __user *" instead of "struct filename *".

The fix doesn't imply any functional change.

Do not print to stderr if user specified log buffer

This patch intends to fix issue #606.

Currently, the key/value type information is passed from
C++ to Python through a JSON interface. The JSON is
constructed by traversing the struct/field's through clang
AST interface. Once Python gets the JSON, it will
reconstruct the C structure through ctype module.

There are two known issues where Python reconstructed
C structure may not be the same as the original C structure:
  . if user explicitly use "__attribute__ ((align))" to alter
    field alignment and such information is not passed to
    Python.
  . the "__int128" type is a u64[2] array in python.
    So in C, __int128 needs to align on 16 bytes boundary, and
    in Python, it aligns with 8 bytes boundary.

To solve this issue, this patch provided the structure
with added padding fields to Python. For example,
  struct {
    char a;
    __int128 b;
  };
Python will receive
  struct {
    char a;
    char __pad_1[15];
    __int128 b;
  };
Signed-off-by: Yonghong Song <yhs@fb.com>

sync compat headers with latest net-next

The same header is in torvalds/linux 4.15 rc2.
Signed-off-by: Yonghong Song <yhs@fb.com>

Update INSTALL instructions for binary packages

The old link to netperf is dead, but a copy exists in the iovisor repo
(for the buildbots to use).
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

* Update the instructions to reflect recent package availability
  * Nightly/stable packages for Ubuntu Xenial+Artful
  * Nightly/stable packages for Fedora 26+27
  * Remove references to Trusty as those are no longer being built
  * Remove references to Fedora 24 as those are no longer being built
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Use ctypes.byref() instead of ctypes.pointer() in cases where we do not
need the actual pointer object itself as it is much lighter.

python: make _decode_table_types aware of __int128

Do not keep Loader instances around

Fix 'test_libbcc' from failing in certain scenarios