wip: BTF + core targets

[fntlnz]

One of the biggest struggle for sysdig's users is that they have to have kernel headers

• libbpf cmake module
• port the probe.o target to libbpf
• btf target
• core target, Done but needs some refinements to work
• fixes for incompatible registers (superseedes fix(driver/bpf): bpf_addr_to_kernel takes an unsigned length (less than BPF_MAX_VAR_SIZE) #1730 , fix(driver/bpf): bpf_parse_readv_writev_bufs avoid overflow while reading readv/writev iovec struct #1733 and fix(driver/bpf): fixup_evt_arg_len check that argument number does not exceed max args number. #1731)
• made a clang format based on https://github.com/draios/sysdig/blob/dev/coding_conventions.md because I can't anymore
• check that this still works on older kernels 4.18, 4.19 - I already tested and it does, but want to do more extensive testing
• BTF does not port kernel defines to vmlinux.h we need to copy and maintain in sync the ones we want for the different architectures. The ones we copied don't change very often. This is the recommended way now.
• Optional: make a small testing framework for the fillers based on the generated loader (now commented in makefile)
• Use the generated loader from bpftool instead of our own (feasible, worth?)
  • even if using the generated loader is not worth we probably want to consider replacing our raw usage of the bpf syscall and let libbpf handle that

What does this mean?

We will have three different ways to compile our BPF probe.

make bpf

This is the usual bpf probe we are all used to, but now uses libbpf instead of our old definitions taken from the kernel.

This target still depends on the kernel headers.

make bpf-btf

This is our bpf probe but compiled for including the BPF type format.

This target does not depend on kernel headers. It is likely that probes compiled with this target
will be compatible across kernels on the same version but with different patches.

This is the recommended target for > 5.8 kernels

make bpf-btf-core

This is the same as make bpf-btf but the generated probe will also be using CO-RE

This target does not depend on kernel headers, compiled probes are compile once run everywhere.

It's unlikely that our probe will be 100% working with this target in most cases.

Using this target is not recommended yet because our probe and the kernel require more work for it to be compatible but it's good to have the scaffolding done.

Signed-off-by: Lorenzo Fontana lo@linux.com

[fntlnz]

I'm closing this. Will reopen against https://github.com/falcosecurity/libs/