solisten: clean endian conversion hack

Minor endian and debug enhancement

argdist, trace, and tplist support for USDT probes

expose buitin byte swap methods

These tools now support USDT probes with the 'u:provider:probe' syntax.
Probes in a library or process can be listed with 'tplist -l LIB' or 'tplist -p PID'.
Probe arguments are also parsed and available in both argdist and trace as arg1,
arg2, etc., regardless of the probe attach location.

The same USDT probe can be used at multiple locations, which means the attach infra-
structure must probe all these locations. argdist and trace register thunk probes
at each location, which call a central probe function (which is static inline) with
the location id (__loc_id). The central probe function checks the location id to
determine how the arguments should be retrieved -- this is location-dependent.

Finally, some USDT probes must be enabled first by writing a value to a memory
location (this is called a "semaphore"). This value is per-process, so we require a
process id for this kind of probes.

Along with trace and argdist tool support, this commit also introduces new classes
in the bcc module: ProcStat handles pid-wrap detection, whereas USDTReader,
USDTProbe, USDTProbeLocation, and USDTArgument are the shared USDT-related
infrastructure that enables enumeration, attachment, and argument retrieval for
USDT probes.

Fixed bug around local assignment from char array

Stack Traces: TNG

The changes for this script are minimal: the inline C probe has been
_significantly_ simplified, and should now perform better since the
stack walk happens in native code inside the kernel thanks to the
BPF_STACK_TRACE table.

The output of the tool should be virtually identical, so the man page
and included examples have essentially no changes.

Instead of manually walking the stack and printing each frame to the
trace log, we can use a BPF_STACK_TRACE table to store the stack traces,
and print to the trace log their IDs every time they are traced.

The output of the tool has been slightly modified: we no longer prefix
each line of the stack trace with the timestamp and the other headers,
since the whole stack trace is fetched in one go from the table and the
information would be highly redundant.

The man page and the examples have been updated to reflect the new
output.

The offset is now returned after a `+` symbol, instead of directly
attached to the symbol name (which made reading the output very
confusing)

Before:
    tick_do_update_jiffies64a0

After:
    tick_do_update_jiffies64+0xa0

Better stack walking APIs

The manual walking for kernel stacks in the eBPF code has been replaced
with a `BPF_STACK_TRACE` table; the stack ID is now stored as an integer
in the main key.

Thanks to the `StackTrace.walk` iterator, the printing code can also be
significantly simplified for both folded and full stack modes.

Instead of manually walking the (kernel) stack inside the eBPF code,
create a `BPF_STACK_TRACE` table and store the stack IDs in the alloc
info struct.

This greatly simplifies the leak detection code: instead of storing the
full stack trace as a string to de-duplicate the allocation point for
the different allocations, we can store the `stack_id`. Since we're
creating stack IDs with `BPF_F_REUSE_STACKID`, the kernel will take care
of deduplication for us.

Additionally, the `StackDecoder` class has been specialized into a
`UStackDecoder` and `KStackDecoder` (for userland and kernel stacks,
respectively). This lets us pass the decode class directly to
`stack_traces.walk()` to automate symbol resolution.

A new class, `Allocation` has been created to encapsulate what
previously was a 2-element tuple of `(count, size)`. This

This simple example script traces all calls to `malloc` in a process and
prints the callsite using the new `BPF_STACK_TRACE` table API.

The StackWalker iterator lets us call `stack_trace.walk(id)` to iterate
through the addresses in any given stack. The constructor of this
iterator takes an optional `resolver` to convert the addresses in the
iterator into symbols (or to format them according to the users' needs).

Allowing more natural syntax for tracepoints with no "tp" struct prefix

add tcpv4listen.py tracing example, with comments

Fix error handling when attaching {u,k}{,ret}probes

Moved user symbol decoding from memleak into bcc module

tracepoint support for argdist and trace, and new tplist tool

Fix llvm shared build

Trim the llvm libs to the direct requirements only and use
llvm_expand_dependencies to discover all dependencies.

fix -p