主要参考文章:

• <运行第一个ebpf程序>> https://blog.csdn.net/sinat_38816924/article/details/115556650
• <<上手bpf>> https://blog.csdn.net/Longyu_wlz/article/details/109900096#t5

编译运行源码samples/bpf中的代码

https://blog.csdn.net/sinat_38816924/article/details/115556650

这个比较简单

1. 下载内核源码并解压
2. /bin/sh: scripts/mod/modpost: No such file or directory 遇到这种错误，需要make scripts
3. make M=samples/bpf 需要.config文件，需要保证这些项存在 https://github.com/iovisor/bpftrace/blob/master/INSTALL.md
4. 遇到错误libcrypt1.so.1 not found，执行如下代码（https://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1818037.html）

$ cd /tmp
$ apt -y download libcrypt1
$ dpkg-deb -x libcrypt1_1%3a4.4.25-2_amd64.deb  .
$ cp -av lib/x86_64-linux-gnu/* /lib/x86_64-linux-gnu/
$ apt -y --fix-broken install

5. 编译成功，可以执行samples/bpf中的可执行文件

编译运行自己开发的代码

https://blog.csdn.net/Longyu_wlz/article/details/109900096#t5

1. 下载linux source code，编译内核并升级

git clone https://github.com/torvalds/linux.git
cd linux/
git checkout -b v5.0 v5.0

配置文件

cp -a /boot/config-4.14.81.bm.15-amd64 ./.config

echo '
CONFIG_BPF=y
CONFIG_BPF_SYSCALL=y
CONFIG_BPF_JIT=y
CONFIG_HAVE_EBPF_JIT=y
CONFIG_BPF_EVENTS=y
CONFIG_FTRACE_SYSCALLS=y
CONFIG_FUNCTION_TRACER=y
CONFIG_HAVE_DYNAMIC_FTRACE=y
CONFIG_DYNAMIC_FTRACE=y
CONFIG_HAVE_KPROBES=y
CONFIG_KPROBES=y
CONFIG_KPROBE_EVENTS=y
CONFIG_ARCH_SUPPORTS_UPROBES=y
CONFIG_UPROBES=y
CONFIG_UPROBE_EVENTS=y
CONFIG_DEBUG_FS=y
CONFIG_DEBUG_INFO_BTF=y
' >> ./.config

需要添加sid源安装dwarves

apt install dwarves
make oldconfig
apt install libssl-dev
make
make modules_install
make install
reboot

此时:

uname -a
Linux n231-238-061 5.0.0 #1 SMP Mon Dec 13 05:38:52 UTC 2021 x86_64 GNU/Linux

2. 编译bpf helloworld

切换到https://github.com/bpftools/linux-observability-with-bpf的helloworld目录

sed -i 's;/kernel-src;/root/linux;' Makefile
make

有报错:

image.png
参考: http://www.helight.info/blog/2021/build-kernel-ebpf-sample/ 解决

cp /root/linux/include/uapi/linux/bpf.h /usr/include/linux/bpf.h

执行./monitor-exec，有报错

./monitor-exec: error while loading shared libraries: libbpf.so: cannot open shared object file: No such file or directory

解决方法

cd /root/linux/tools/lib/bpf/
make
make install

在 /etc/ld.so.conf 中添加 /usr/local/lib64这一行
运行 sudo ldconfig 重新生成动态库配置信息

~/linux/tools/lib/bpf# ldconfig -v 2>/dev/null | grep libbpf
    libbpf.so.0 -> libbpf.so.0.5.0
    libbpf.so -> libbpf.so

最终执行情况:

image.png

可能需要安装apt-get install gcc-multilib g++-multilib
https://github.com/sirfz/tesserocr/issues/130

安装bpftrace

1. debian 添加sid源 https://github.com/iovisor/bcc/blob/master/INSTALL.md#debian---source

deb http://deb.debian.org/debian sid main contrib non-free
deb-src http://deb.debian.org/debian sid main contrib non-free

2. apt install bpftrace https://github.com/iovisor/bpftrace/blob/master/INSTALL.md