ucalls: convert bytes to str

Fix incorrect lost_cb type in Python

Fix and improvement for perf_reader's lost_cb

Handle unknown user in cachetop

tcpretrans: extend for sum up

histogram: support sorting bucket before dumping table

Improve trace.py formatting and printing options

add a test case for bucket_sort_fn and show its
use scenario as well

add examples for including additional header files

Update for new bpf_perf_{event|prog}_read_value helpers

Clean-up unused parameter in tracing APIs

cmake3 on Ubuntu Trusty

- Set `inherit = 1` only for per-task perf event. Inspired from change
  https://github.com/torvalds/linux/commit/81b9cf8028a17bdbdaa0da80b735b32150d4e89e
- Kernel now support more events (see #1448). Also it's checked in
  `bpf_attach_perf_event` already. Remove the check from C++ API

This fixes the following error with python3

Tracing calls in process 2577 (language: python)... Ctrl-C to quit.
^C
Traceback (most recent call last):
  File "/usr/share/bcc/tools/lib/ucalls", line 303, in <module>
    data = get_data()   # [(function, (num calls, latency in ns))]
  File "/usr/share/bcc/tools/lib/ucalls", line 264, in get_data
    bpf["counts"].items()))
  File "/usr/share/bcc/tools/lib/ucalls", line 262, in <lambda>
    data = list(map(lambda kv: (kv[0].clazz + "." + kv[0].method,
TypeError: can't concat str to bytes
Signed-off-by: Rafael Fonseca <r4f4rfs@gmail.com>

Add C++ helper to clear BPF tables

Feature to quickly discern heavily retransmitting flows and
therefore spotting culprit network paths.
Signed-off-by: Matthias Tafelmeier <matthias.tafelmeier@gmx.net>

Fix issue #1478
Two tools, trace.py and argdist.py, and their corresponding
example files were changed.
Fixed a minor typo in one of trace.py error messages.
Signed-off-by: Yonghong Song <yhs@fb.com>

add padding to the end of structure

execsnoop: fix the prototype for kprobe__sys_execve

provide padded structure for table_{key|leaf}_desc API

Commit 538a84e1 ("provide padded structure for
table_{key|leaf}_desc API") added explicit padding, if needed,
before every structure member.

This is not enough as if an array of elements are returned
from C++ to python side, the size of structure must be correct.

This patch also adds padding after the last structure field
to make structure size in python side consistent with C++
side. With this patch, I experimented with the pull request
for tcpretrans.py by Matthias Tafelmeier, the type
  struct ipv6_flow_key_t {
      unsigned __int128 saddr;
      unsigned __int128 daddr;
      u64 lport;
      u64 dport;
  }
can be replaced with
  struct ipv6_flow_key_t {
      unsigned __int128 saddr;
      unsigned __int128 daddr;
      u16 lport;
      u16 dport;
  }
where the original type of lport/dport is u16.
Some other ipv6 related data structures can also be simplified.
Signed-off-by: Yonghong Song <yhs@fb.com>

When there are multiple fields in the secondary key of a histogram
(e.g. output the bio latency for each combination of disk and blk cgroup),
if the buckets are not sorted before the iteration, the output order
of tables often does not meet our expectations.

So provide a way to sort them.

For sys_execve() the type of filename parameter should be
"const char __user *" instead of "struct filename *".

The fix doesn't imply any functional change.

Do not print to stderr if user specified log buffer