add execsnoop-kernel which need to be built in kernel tree

execsnoop-libbpf/readme.md

@@ -1,11 +1,21 @@
 
-## Depency
-- libbpf
-  - /usr/lib/libbpf.a
-  - some head file
-- bpf
-  - `/usr/bin/bpftool` to generate skeleton and dump btf
+## Resource
 
-## Refer
+- [libbpf](https://github.com/libbpf/libbpf)
+- [libbpf-tools](https://github.com/iovisor/bcc/tree/master/libbpf-tools) examples use libbpf
+- [bpftool](https://www.archlinux.org/packages/community/x86_64/bpf/) to generate skeleton and dump btf
 
-- https://facebookmicrosites.github.io/bpf/blog/2020/02/19/bpf-portability-and-co-re.html
+## Prons
+
+- BPF CO-RE (Compile Once – Run Everywhere)
+- small memory usage
+
+## Cons
+
+- `vmlinux.h`does not contain `#define` etc. And often causes confilct with other headers to cause redifinition error
+- comment in code for different types is gone
+- need kernel built with `CONFIG_DEBUG_INFO_BTF=y`, while ubuntu 20.04 still not
+
+## Build
+
+- see *makefile*