Migrated killsnoop to bpf_perf_event

syncsnoop migrated to use bpf_perf_events

Migrated filelife to bpf_perf_event

http_filter readme fixed

migration of statsnoop to use bpf_perf_event

Fix syntax error in bpf_get_prandom_u32

Fixes: #398
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Embed runtime header files in libbcc.so

To avoid installing header files needed by clang to disk
(/usr/share/bcc), embed the files as strings inside the library and feed
them to clang as memory buffers. The mechanism that we use to do this
retains all of the existing features, as in one can still do `#include
<bcc/helpers.h>`, even though it is redundant, and clang will pick up
the embedded file.

Fixes: #333
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Fix breakage in open_perf_buffer

The previous commit for splitting table.py into a separate file lost
some required imports. Add those back.

In addition, add a test for open_perf_buffer, and take out the
compile-time check in libbpf.c for this feature.

I couldn't think of a good way to fix the PERF_COUNT_SW_BPF_OUTPUT
literal, so for now left it as a comment. A #define wouldn't work since
the eventual value comes from an enum (no #ifndef/#define/#endif
pattern).

Fixes: #391 #363
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

Cleanup tables classes in bcc python module

Improve the indexing in the Array class to be more like native python
list/array types. No need to use `t[c_int(0)]`, instead `t[0]` is
sufficient, for instance.

Add tests for the above. Relies on a new bpf_module function for
exposing the max_entries property of a table in order to range-check the
indices.

In one case, array was using a struct key type.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

BPFTable contained all of the logic for multiple table types, which is
incorrect since a bpf table has either hash or array behavior.
Additionally, some methods on the classes aren't valid for some table
types. Create HashTable, Array, ProgArray, and PerfEventArray classes to
contain this behavior.

In future, the new Array class and its children should behave more like
an array than a dict as it currently does.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

The subclasses and some of the imports inside __init__.py were getting
overly large, so start to split some of the functionality into different
files.
Signed-off-by: Brenden Blanco <bblanco@plumgrid.com>

fix couple of minor typos

2 tools: btrfsdist, btrfsslower

inline C in /tools

3 tools: tcpretrans, zfsslower, zfsdist