feat(ebpf):[WIP] add eBPF support (#948)

* feat(kprobe): Add basic kprobe support for x86_64

* feat: add ebpf support (#912)

- 实现bpf()一部分命令，包括几种基本map，相关的helper函数
- 实现部分perf相关的数据结构
- 暂时为文件实现简单mmap
- 实现一个使用kprobe统计syscall 调用次数的ebpf程序

对eBPF支持程度(基本)：

- 简单的eBPF程序(没有指定特殊的Map)
- 使用内核已经实现的Map的eBPF程序
- 可以和kprobe配合使用
- 内核Map相关的接口定义已经实现，添加新的Map较为简单

不支持的功能:
- 区分不同的eBPF程序类型(Network/Cgroup)并限定可调用的helper函数集
- 与内核其它跟踪机制配合(tracepoint)
- 其它helper和Map


todo

- [ ]  修改mmap，需要讨论，因为这个和块缓存层相关
- [x]  添加文档
- [x]  修复可能的错误
- [x] 增加rbpf版本信息

* feat: add /sys/devices/system/cpu/possible file

* feat: add /sys/devices/system/cpu/online

kernel/crates/rbpf/examples/load_elf.rs

@@ -0,0 +1,115 @@
+// SPDX-License-Identifier: (Apache-2.0 OR MIT)
+// Copyright 2016 6WIND S.A. <quentin.monnet@6wind.com>
+
+#![allow(clippy::unreadable_literal)]
+
+extern crate elf;
+use std::path::PathBuf;
+
+extern crate rbpf;
+use rbpf::helpers;
+
+// The following example uses an ELF file that has been compiled from the C program available in
+// `load_elf__block_a_port.c` in the same directory.
+//
+// It was compiled with the following command:
+//
+// ```bash
+// clang -O2 -emit-llvm -c load_elf__block_a_port.c -o - | \
+//     llc -march=bpf -filetype=obj -o load_elf__block_a_port.o
+// ```
+//
+// Once compiled, this program can be injected into Linux kernel, with tc for instance. Sadly, we
+// need to bring some modifications to the generated bytecode in order to run it: the three
+// instructions with opcode 0x61 load data from a packet area as 4-byte words, where we need to
+// load it as 8-bytes double words (0x79). The kernel does the same kind of translation before
+// running the program, but rbpf does not implement this.
+//
+// In addition, the offset at which the pointer to the packet data is stored must be changed: since
+// we use 8 bytes instead of 4 for the start and end addresses of the data packet, we cannot use
+// the offsets produced by clang (0x4c and 0x50), the addresses would overlap. Instead we can use,
+// for example, 0x40 and 0x50.
+//
+// These change were applied with the following script:
+//
+// ```bash
+// xxd load_elf__block_a_port.o | sed '
+//     s/6112 5000 0000 0000/7912 5000 0000 0000/ ;
+//     s/6111 4c00 0000 0000/7911 4000 0000 0000/ ;
+//     s/6111 2200 0000 0000/7911 2200 0000 0000/' | xxd -r > load_elf__block_a_port.tmp
+
+// mv load_elf__block_a_port.tmp load_elf__block_a_port.o
+// ```
+//
+// The eBPF program was placed into the `.classifier` ELF section (see C code above), which means
+// that you can retrieve the raw bytecode with `readelf -x .classifier load_elf__block_a_port.o` or
+// with `objdump -s -j .classifier load_elf__block_a_port.o`.
+//
+// Once the bytecode has been edited, we can load the bytecode directly from the ELF object file.
+
+fn main() {
+    let filename = "examples/load_elf__block_a_port.elf";
+
+    let path = PathBuf::from(filename);
+    let file = match elf::File::open_path(path) {
+        Ok(f) => f,
+        Err(e) => panic!("Error: {:?}", e),
+    };
+
+    let text_scn = match file.get_section(".classifier") {
+        Some(s) => s,
+        None => panic!("Failed to look up .classifier section"),
+    };
+
+    let prog = &text_scn.data;
+
+    let packet1 = &mut [
+        0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x08,
+        0x00, // ethertype
+        0x45, 0x00, 0x00, 0x3b, // start ip_hdr
+        0xa6, 0xab, 0x40, 0x00, 0x40, 0x06, 0x96, 0x0f, 0x7f, 0x00, 0x00, 0x01, 0x7f, 0x00, 0x00,
+        0x01,
+        // Program matches the next two bytes: 0x9999 returns 0xffffffff, else return 0.
+        0x99, 0x99, 0xc6, 0xcc, // start tcp_hdr
+        0xd1, 0xe5, 0xc4, 0x9d, 0xd4, 0x30, 0xb5, 0xd2, 0x80, 0x18, 0x01, 0x56, 0xfe, 0x2f, 0x00,
+        0x00, 0x01, 0x01, 0x08, 0x0a, // start data
+        0x00, 0x23, 0x75, 0x89, 0x00, 0x23, 0x63, 0x2d, 0x71, 0x64, 0x66, 0x73, 0x64, 0x66, 0x0au8,
+    ];
+
+    let packet2 = &mut [
+        0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x08,
+        0x00, // ethertype
+        0x45, 0x00, 0x00, 0x3b, // start ip_hdr
+        0xa6, 0xab, 0x40, 0x00, 0x40, 0x06, 0x96, 0x0f, 0x7f, 0x00, 0x00, 0x01, 0x7f, 0x00, 0x00,
+        0x01,
+        // Program matches the next two bytes: 0x9999 returns 0xffffffff, else return 0.
+        0x98, 0x76, 0xc6, 0xcc, // start tcp_hdr
+        0xd1, 0xe5, 0xc4, 0x9d, 0xd4, 0x30, 0xb5, 0xd2, 0x80, 0x18, 0x01, 0x56, 0xfe, 0x2f, 0x00,
+        0x00, 0x01, 0x01, 0x08, 0x0a, // start data
+        0x00, 0x23, 0x75, 0x89, 0x00, 0x23, 0x63, 0x2d, 0x71, 0x64, 0x66, 0x73, 0x64, 0x66, 0x0au8,
+    ];
+
+    let mut vm = rbpf::EbpfVmFixedMbuff::new(Some(prog), 0x40, 0x50).unwrap();
+    vm.register_helper(helpers::BPF_TRACE_PRINTK_IDX, helpers::bpf_trace_printf)
+        .unwrap();
+
+    let res = vm.execute_program(packet1).unwrap();
+    println!("Packet #1, program returned: {res:?} ({res:#x})");
+    assert_eq!(res, 0xffffffff);
+
+    #[cfg(not(windows))]
+    {
+        vm.jit_compile().unwrap();
+
+        let res = unsafe { vm.execute_program_jit(packet2).unwrap() };
+        println!("Packet #2, program returned: {res:?} ({res:#x})");
+        assert_eq!(res, 0);
+    }
+
+    #[cfg(windows)]
+    {
+        let res = vm.execute_program(packet2).unwrap();
+        println!("Packet #2, program returned: {:?} ({:#x})", res, res);
+        assert_eq!(res, 0);
+    }
+}