add examples for including additional header files

Update for new bpf_perf_{event|prog}_read_value helpers

Clean-up unused parameter in tracing APIs

cmake3 on Ubuntu Trusty

- Set `inherit = 1` only for per-task perf event. Inspired from change
  https://github.com/torvalds/linux/commit/81b9cf8028a17bdbdaa0da80b735b32150d4e89e
- Kernel now support more events (see #1448). Also it's checked in
  `bpf_attach_perf_event` already. Remove the check from C++ API

Add C++ helper to clear BPF tables

Fix issue #1478
Two tools, trace.py and argdist.py, and their corresponding
example files were changed.
Fixed a minor typo in one of trace.py error messages.
Signed-off-by: Yonghong Song <yhs@fb.com>

add padding to the end of structure

execsnoop: fix the prototype for kprobe__sys_execve

provide padded structure for table_{key|leaf}_desc API

Commit 538a84e1 ("provide padded structure for
table_{key|leaf}_desc API") added explicit padding, if needed,
before every structure member.

This is not enough as if an array of elements are returned
from C++ to python side, the size of structure must be correct.

This patch also adds padding after the last structure field
to make structure size in python side consistent with C++
side. With this patch, I experimented with the pull request
for tcpretrans.py by Matthias Tafelmeier, the type
  struct ipv6_flow_key_t {
      unsigned __int128 saddr;
      unsigned __int128 daddr;
      u64 lport;
      u64 dport;
  }
can be replaced with
  struct ipv6_flow_key_t {
      unsigned __int128 saddr;
      unsigned __int128 daddr;
      u16 lport;
      u16 dport;
  }
where the original type of lport/dport is u16.
Some other ipv6 related data structures can also be simplified.
Signed-off-by: Yonghong Song <yhs@fb.com>

For sys_execve() the type of filename parameter should be
"const char __user *" instead of "struct filename *".

The fix doesn't imply any functional change.

Do not print to stderr if user specified log buffer

This patch intends to fix issue #606.

Currently, the key/value type information is passed from
C++ to Python through a JSON interface. The JSON is
constructed by traversing the struct/field's through clang
AST interface. Once Python gets the JSON, it will
reconstruct the C structure through ctype module.

There are two known issues where Python reconstructed
C structure may not be the same as the original C structure:
  . if user explicitly use "__attribute__ ((align))" to alter
    field alignment and such information is not passed to
    Python.
  . the "__int128" type is a u64[2] array in python.
    So in C, __int128 needs to align on 16 bytes boundary, and
    in Python, it aligns with 8 bytes boundary.

To solve this issue, this patch provided the structure
with added padding fields to Python. For example,
  struct {
    char a;
    __int128 b;
  };
Python will receive
  struct {
    char a;
    char __pad_1[15];
    __int128 b;
  };
Signed-off-by: Yonghong Song <yhs@fb.com>

sync compat headers with latest net-next

The same header is in torvalds/linux 4.15 rc2.
Signed-off-by: Yonghong Song <yhs@fb.com>

Update INSTALL instructions for binary packages

The old link to netperf is dead, but a copy exists in the iovisor repo
(for the buildbots to use).
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

* Update the instructions to reflect recent package availability
  * Nightly/stable packages for Ubuntu Xenial+Artful
  * Nightly/stable packages for Fedora 26+27
  * Remove references to Trusty as those are no longer being built
  * Remove references to Fedora 24 as those are no longer being built
Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Signed-off-by: Brenden Blanco <bblanco@gmail.com>

Use ctypes.byref() instead of ctypes.pointer() in cases where we do not
need the actual pointer object itself as it is much lighter.

python: make _decode_table_types aware of __int128

Do not keep Loader instances around

Fix 'test_libbcc' from failing in certain scenarios

man/bps: Add a man page for introspection/bps.c

There are no ctypes types ready for int128. However, recognizing this
type and representing it as an array is better than simply erroring out.

* Add mapping between (unsigned) __128 C types declaration and ctypes
  parsing
* Add simple test case in test_clang to recognisze and use such types
* Fixes deprecation warnings about self.assertEquals in 2 other test
  cases.

This patch adds a man page for bps.c and also introduces
bps in README.md
Signed-off-by: Martin KaFai Lau <kafai@fb.com>

libbpf: Enable the creation of unbound raw socket

force linking the whole api-static library into shared library