You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Falco 0.43.0 deprecated the legacy eBPF probe, and the support will
be removed soon in the next libs release. Drop any reference to it and
any CI tests testing it.
BREAKING CHANGE: drop all code related to legacy BPF probe
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
To access up-to-date status reports on Falco drivers kernel testing, please visit this [page](https://falcosecurity.github.io/libs/). It provides a list of supported syscalls as well as the [report](https://falcosecurity.github.io/libs/report/).
@@ -109,7 +109,6 @@ For your convenience, we have included the instructions for building the `libs`
109
109
The project utilizes the `cmake` build system, and the key `make` targets are as follows:
110
110
111
111
*`driver` -> build the kmod
112
-
*`bpf` -> build the legacy `ebpf` probe
113
112
*`scap` -> build libscap (`modern_ebpf` driver will be bundled into `scap` if enabled)
114
113
*`sinsp` -> build libsinsp (depends upon `scap` target)
115
114
*`scap-open` -> build a small example binary for `libscap` to test the drivers (dependent on `scap`)
@@ -154,19 +153,6 @@ make driver
154
153
ls -l driver/src/scap.ko;
155
154
```
156
155
157
-
### Build driver - eBPF probe
158
-
159
-
To build the eBPF probe, you need `clang` and `llvm` packages and you also need your kernel headers installed. Check out Falco's [official documentation](https://falco.org/docs/install-operate/source/).
160
-
161
-
```bash
162
-
cmake -DBUILD_BPF=ON ../;
163
-
make bpf
164
-
# Verify the eBPF bytecode file was created, uses `.o` extension.
165
-
ls -l driver/bpf/probe.o;
166
-
```
167
-
168
-
>__WARNING__: **clang-7** is the oldest supported version to build our BPF probe.
169
-
170
156
### Build driver - modern eBPF probe
171
157
172
158
To build the modern eBPF probe, further prerequisites are necessary:
@@ -191,9 +177,7 @@ To build the modern eBPF probe, further prerequisites are necessary:
191
177
192
178
> __NOTE:__ These are not the requirements to use the modern BPF probe, but rather for building it from source.
193
179
194
-
Regarding the previously discussed legacy eBPF driver, it generates kernel-specific bytecode (`driver/bpf/probe.o`) tailored to your machine's kernel release (`uname -r`). The location of the bytecode file can then be passed as an argument for testing with the `scap-open` and `sinsp-example` binaries.
195
-
196
-
However, the modern eBPF driver build process doesn't require kernel headers, and it isn't tied to your kernel release. This is enabled by the CO-RE (Compile Once - Run Everywhere) feature of the modern eBPF driver.
180
+
The modern eBPF driver build process doesn't require kernel headers, and it isn't tied to your kernel release. This is enabled by the CO-RE (Compile Once - Run Everywhere) feature of the modern eBPF driver.
197
181
198
182
CO-RE allows the driver to work on kernels with backported BTF (BPF Type Format) support or kernel versions >= 5.8. The way the driver interprets kernel data structures without direct knowledge of the running kernel is not magic — it leverages predefined type information and BTF-based relocations. We maintain a [vmlinux.h](driver/modern_bpf/definitions/vmlinux.h) file containing essential kernel data structure definitions, allowing the eBPF program to reference fields dynamically. Additionally, for cases where macros or functions from system headers are required, we redefine them in [struct_flavors.h](driver/modern_bpf/definitions/struct_flavors.h). Combined with CO-RE (Compile Once, Run Everywhere), this enables the driver to remain portable across different kernel versions.
199
183
@@ -243,7 +227,7 @@ This repository includes convenient test example binaries for both `scap` and `s
243
227
244
228
When developing new features, you would run either one depending on what you're working on, in order to test and validate your changes.
245
229
246
-
> __NOTE:__ When you're working on driver development, it can be quite useful to make use of the kernel's built-in `printk` functionality. However, for the traditional bpf driver, you'll need to uncomment a line in the [bpf Makefile](driver/bpf/Makefile) first and use a dedicated build flag `BPF_DEBUG`. For modern eBPF, use the build flag `MODERN_BPF_DEBUG_MODE`. Any logs generated by `bpf_printk()` will be written to `/sys/kernel/debug/tracing/trace_pipe`. Just make sure you have the right permissions set up for this.
230
+
> __NOTE:__ When you're working on driver development, it can be quite useful to make use of the kernel's built-in `printk` functionality. For modern eBPF, use the build flag `MODERN_BPF_DEBUG_MODE`. Any logs generated by `bpf_printk()` will be written to `/sys/kernel/debug/tracing/trace_pipe`. Just make sure you have the right permissions set up for this.
247
231
248
232
Here's an example of a `cmake` command that will enable everything you need for all tests and components. By default, the following flags are disabled, with the exception of `USE_BUNDLED_DEPS` and `CREATE_TEST_TARGETS` (they are enabled by default).
0 commit comments