These vmlinux.h files are manually generated using the following command:

bpftool btf dump file <path/to/vmlinux> format c > vmlinux.h

In the future, it would be good to create the infrastructure to periodically update this to a version with the latest tracking kernel.

These vmlinux.h files are used for bpf programs leveraging CO-RE to access internal kernel data structures. They do not need to track the target kernel perfectly, but if fields are added to an internal kernel data structure, they must be regenerated before these fields are used.

Similarly, the BPF programs which use vmlinux.h should be compiled against a vmlinux.h file which is generated from the vmlinux of the same architecture. On Android, this is not a problem for arm64 or x86_64 architectures, as the 64bit system userspace matches the 64bit kernel.

However, for 32 bit Android userspace, either arm or x86, we currently have no way to determine at build time if the kernel we will be running on will be 32bit or 64bit. For this reason, we default to 32bit userspace running on 64bit kernel, and therefore loading libbpf programs will be disabled at runtime for systems with 32bit kernels.