Linux Kernel eBPF CO-RE

Directory structure

The respository has the following directory structure:

• artifacts: directory that will have the eBPF programs when the compilation process ends.
• includes: headers used to compile eBPF.plugin.
• includes/vmlinux.h: pinned x86_64 kernel type snapshot used by every CO-RE program. Its source and checksum are recorded in src/DEVELOPER.md. This compile-time snapshot does not replace the running kernel's BTF.
• kernel-collector: this is a submodule'd fork of netdata/libbpf.
• libbpf: this is a submodule'd fork of netdata/libbpf which is itself a fork of the official libbpf package, the user-space side of eBPF system calls.

Requirements

Packages

To compile the eBPF CO-RE, it will be necessary to have the following packages:

• libelf headers
• LLVM/Clang; this is because GCC prior to 10.0 cannot compile eBPF code.
• bpftool: used to generate source codes.
• Go: required if you want the default build to also generate src/tests/core_tester_go.

Initializing Submodules

libbpf directory is included as a git submodule and it is necessary to fetch contents with the git command below:

git submodule update --init --recursive