使用linux内核提供的c接口来加载bpf程序

有时候可能，你使用不了bcc等库。
这个时候就需要自己使用纯c来编译和load bpf程序，
在探索的过程中，遇到了各种文件找不到的情况。根据编译提示，最终在内核源码树中都找到了对应的文件和函数。所以，在自己使用纯c来加载bpf程序的时候，需要下载一份内核源码.以下为demo

#include <linux/bpf.h>
#define SEC(NAME) __attribute__((section(NAME), used))

static int (*bpf_trace_printk)(const char *fmt, int fmt_size,
                               ...) = (void *)BPF_FUNC_trace_printk;

SEC("tracepoint/syscalls/sys_enter_execve")
int bpf_prog(void *ctx) {
  char msg[] = "Hello, BPF World!";
  bpf_trace_printk(msg, sizeof(msg));
  return 0;
}

SEC("socket")
int socket_prog(struct __sk_buff *skb) {
  return 0;
}

char _license[] SEC("license") = "GPL";

loader.c

#include "bpf_load.h"
#include <stdio.h>

int main(int argc, char **argv)
{
  if (load_bpf_file("bpf_program.o") != 0)
  {
    printf("The kernel didn't load the BPF program\n");
    return -1;
  }

  read_trace_pipe();

  return 0;
}

Makefile

CLANG = clang
EXECABLE = bpfload

BPFLOADER_C = /usr/src/linux-source-4.15.0/linux-source-4.15.0/samples/bpf/bpf_load.c  #link load_bpf_file symbol
CCINCLUDE += -I/usr/src/linux-source-4.15.0/linux-source-4.15.0/samples/bpf # bpf_load.h
CCINCLUDE += -I/usr/src/linux-source-4.15.0/linux-source-4.15.0/tools/lib # bpf/bpf.h
CCINCLUDE += -I/usr/src/linux-source-4.15.0/linux-source-4.15.0/tools/perf # perf-sys.h
CCINCLUDE += -I/usr/src/linux-source-4.15.0/linux-source-4.15.0/tools/include # <linux/compiler.h>

# -lelf 会默认去找 ./usr/lib/x86_64-linux-gnu/libelf.so 
# -lbpf 会默认去找 ./lib/x86_64-linux-gnu/libbpf.so

all:
	# -I 指定的路径是因为bpf程序需要asm/types.h
	$(CLANG) -O2 -target bpf -c bpf_program.c  -I /usr/include/x86_64-linux-gnu/  -o bpf_program.o 
	$(CLANG) -o $(EXECABLE)  \
		$(CCINCLUDE)\
		-lelf \
		-lbpf \
		loader.c \
		$(BPFLOADER_C)

clean:
	rm -f *.o *.so $(EXECABLE)

make之后，直接执行./bpfload，在执行新的进程时会看到

        bash-4680  [001] .... 29701.949067: 0x00000001: Hello, BPF World!
            bash-4681  [003] .... 29702.996513: 0x00000001: Hello, BPF World!
            cron-4690  [003] .... 29995.076190: 0x00000001: Hello, BPF World!
              sh-4691  [000] .... 29995.077007: 0x00000001: Hello, BPF World!
      debian-sa1-4691  [000] .... 29995.077569: 0x00000001: Hello, BPF World!
             sa1-4691  [000] .... 29995.078165: 0x00000001: Hello, BPF World!
            cron-4695  [003] .... 30115.089880: 0x00000001: Hello, BPF World!
              sh-4696  [000] .... 30115.090561: 0x00000001: Hello, BPF World!