Concretely, it adds two functions to bcc, namely:
`attach_xdp` and `remove_xdp`
which allows to attach an XDP program to a device (given via its name, e.g., en0) (in the future this might change to a specific queue on a device once the kernel offers this interface)
and `remove_xdp` removes a XDP program from a device. Please note that there can currently be only one program attached to the device and attaching another program replaces the previous.

One example is available to test XDP, in networking/xdp which drops all packets an counts for which protocol a packet was dropped (this is taken from the kernel xdp1 example). Please note that you cannot use the network headers defined in <bcc/proto.h> as they cause llvm/clang to generate instructions not available on XDP layer. On XDP layer you do not have an skb yet, so you are operating on the bare packet data.

XDP support is currently limited to only some network adapters, there is the `mlx4` and there is also a patch available for the `e1000` driver.

Probe registration fixes

`open_kprobes` is a dict of open kprobes. Its keys are strings for normal
probes and a tuple for perf buffers. Normal probes need unregistering on script
exit; perf buffers do not. `cleanup` currently looks for string keys
(specifically type `str`) when working out what to unregister, which is a bit
brittle -- in Python2 strings can be both native `str` and `unicode`, depending
what exactly was passed to `attach-*/detach_*` and whether `from __future__
import unicode_literals` is used (e.g. #623).

This diff makes the API more relaxed by casting the probe name to `str` to
match the expectations of `cleanup`. This works in py2 (with and without
unicode_literals) and py3.

* rework `_get_kprobe_functions` to avoid unclosed blacklist warning
* rework `cleanup` to avoid changing size of dict while iterating
* make handling return of `bpf_function_name` work in py2 and py3

[cachetop] Display sorting field and order.

add a reference guide

tutorials: end-user, and python developer

This will make it easier to visualize what is the sorting field
and order

merge most .c and .py examples

[cachetop] top-like cachestat

* pass -fno-color-diagnostics to clang
* remove unicode import (#623)
* add time to cachetop output
* add keybindings to cachetop.8
* add cachetop links to README.md

make interval a positional parameter.

Alike cachestat.py but providing cache stats at the process level.

* Python USDT API

Code from @vmg

* Basic USDT example

* retire procstat.py

* improve/fix USDT exceptions

* Add profile: a CPU profiler

* move Perf to common class

Use errno symbols in offcputime.py

Fix probe detaching and auto-kprobes

* for #605, this diff moves probe storage from the BPF module to the BPF object,
  letting each instantiation clean up its own probes. A module-level counter
  for all open probes is provided for the quota check. It also adds a
  `cleanup()` function to force cleanup before the `atexit` handler runs.

* for #614, it removes the `len(open_kprobes) == 0` check that prevented more
  than one autoload probe working. It fixes the tests that this change breaks by
  calling the `cleanup()` function added.

Prior to this diff we used inconsistent types for keys in `open_kprobes`. The
results from the regex match (`attach_kprobe(event_re=..)`) and the automatic
`kprobe__` features were passed through `str.decode()`, yielding unicode keys,
but specific matches (i.e. from `attach_kprobe(event=..)`) were stored with
string keys passed down from the caller. Only probes under string keys were
released in `cleanup_kprobes`, leaving attached probes on program exit.

This diff makes all the keys regular strings. I erred on the side of using
regular strings over `str.decode()`ing them because a) this data isn't passed
outside of Python, b) it's more Python 3 compatible (there is no `.decode()` on
a regular string object in Python 3 so such a change would ultimately need
removing again).

I also cleaned up a few other things:

* removed the call to `awk` for getting probable functions

* removed the `isinstance` checks when cleaning uprobes/tracepoints -- we
  should only have string keys in these dicts

* made `num_open_kprobes` skip the perf_events buffers. People likely use this
  to check that the right number of probes have been placed so counting
  perf_events buffers doesn't make sense here

killsnoop: s/failed opens/failed kill syscalls/

fileslower: try probing vfs_write if __vfs_write is missing

Build debian packages in docker containers