Feature: Support libbpf-style BPF C code

[nascentcore-eng]

Right now starship only support BCC style C code. BCC style C code has one major limitations:

1. It requires C header on the host environment to build

From the perspective of making portable BPF code, BCC and libbpf actually are two different approaches to this same problem, i.e.:

1. BCC builds bpf binary code on the host where code will be deployed, so that the code is guaranteed to work on the host
2. libbpf works by compiling the runtime-detectable type information with the binary code, so that the binary code can combine with the BTF information on the host to correctly produce the actually working code.

1 question is how can libbpf handles changes in the kernel data structure where new fields are added into the struct For example, let's say on kernel v0.10, int val was added to _kernel_structure

struct _kernel_structure {
  int val;
}

If we compile with libbpf against v0.10, what happens when we deploy the resultant ebpf binary code on v0.9 kernel?

The goal of this issue is to implement the support for libbpf-style bpf C code, or libbpf binary object file.

[ArthurChiao]

1 question is how can libbpf handles changes in the kernel data structure where new fields are added into the struct For example, let's say on kernel v0.10, int val was added to _kernel_structure

http://arthurchiao.art/blog/bpf-portability-and-co-re-zh/ , or the original blog:

https://facebookmicrosites.github.io/bpf/blog/2020/02/19/bpf-portability-and-co-re.html

[oojimmy]

https://github.com/aquasecurity/libbpfgo

Edit by @yaxiong-zhao 2023-02-20: This is a golang biding of libbpf

[nascentcore-eng]

@ArthurChiao Have done a thorough investigation on the format of clang-compiled bpf object file, and how to use cilium/ebpf to parse and operate the object file (open perf buffer, bpf map, load program, and attach probes etc.) The sample code is in experimental/cilium-ebpf

The result shows that:

• BPF object file includes all key information to perform bpf operations (data structure size, bpf objects, attachment targets etc)
• Other than missing the type information of the perf buffer output, the existing information is enough for us to dynamically deploy everything in a bpf object file, and fetch data from the perf buffer.

Our next step, is to prototyping an API based on the sample code in https://github.com/tricorder-observability/starship/tree/main/experimental/cilium-ebpf @yaxiong-zhao @ArthurChiao will discuss about this later.

[nascentcore-eng]

Experimental code: https://github.com/tricorder-observability/starship/tree/main/experimental/cilium-ebpf

Doc: https://tricorder.feishu.cn/wiki/wikcn5AbIPQt3bkpQYMOcv3Kudb