eBPF 完全入门指南.pdf(万字长文) - 知乎 (zhihu.com)https://zhuanlan.zhihu.com/p/492185920
一、安装依赖
# apt-get update
# apt-get install -y bison build-essential cmake flex git libedit-dev pkg-config libmnl-dev python zlib1g-dev libssl-dev libelf-dev libcap-dev libfl-dev llvm clang pkg-config gcc-multilib luajit libluajit-5.1-dev libncurses5-dev libclang-dev clang-tools
二、安装内核源码
# uname -r
5.4.0-196-generic
# apt-cache search linux-source
# apt-get install linux-source-5.4.0
三、编译samples/bpf
# tar -jxvf linux-source-5.4.0.tar.bz2
# cd linux-source-5.4.0
# cp -v /boot/config-$(uname -r) .config
# make oldconfig
# make modules_prepare
# make headers_install
# make scripts # 可选
# make M=samples/bpf # 如果配置出错,可以使用 make oldconfig && make prepare 修复
make -C /usr/src/linux-source-5.4.0/linux-source-5.4.0/samples/bpf/../../tools/lib/bpf/ RM='rm -rf' LDFLAGS= srctree=/usr/src/linux-source-5.4.0/linux-source-5.4.0/samples/bpf/../../ O=
Warning: Kernel ABI header at 'tools/include/uapi/linux/netlink.h' differs from latest version at 'include/uapi/linux/netlink.h'
Warning: Kernel ABI header at 'tools/include/uapi/linux/if_link.h' differs from latest version at 'include/uapi/linux/if_link.h'
WARNING: Symbol version dump ./Module.symvers
is missing; modules will have no dependencies and modversions.
Building modules, stage 2.
MODPOST 0 modules
编译成功后,可以在 samples/bpf 目录下看到一系列的目标文件和二进制文件。
四、hello_world
samples/bpf 目录下,内核空间程序以 _kern.c 结尾,用户空间程序以 _user.c 结尾,
可在samples/bpf目录添加自己的hello_kern.c和hello_user.c,并修改samples/bpf/Makefile,
tprogs-y += hello
hello-objs := hello_user.o $(TRACE_HELPERS)
always-y += hello_kern.o
# make M=samples/bpf
make -C /usr/src/linux-source-5.4.0/linux-source-5.4.0/samples/bpf/../../tools/lib/bpf/ RM='rm -rf' LDFLAGS= srctree=/usr/src/linux-source-5.4.0/linux-source-5.4.0/samples/bpf/../../ O=
Warning: Kernel ABI header at 'tools/include/uapi/linux/netlink.h' differs from latest version at 'include/uapi/linux/netlink.h'
Warning: Kernel ABI header at 'tools/include/uapi/linux/if_link.h' differs from latest version at 'include/uapi/linux/if_link.h'
HOSTCC samples/bpf/hello_user.o
HOSTLD samples/bpf/hello
CLANG-bpf samples/bpf/hello_kern.o
WARNING: Symbol version dump ./Module.symvers
is missing; modules will have no dependencies and modversions.
Building modules, stage 2.
MODPOST 0 modules
# samples/bpf/hello
The kernel didn't load BPF program
# strace samples/bpf/hello
execve("samples/bpf/hello", ["samples/bpf/hello"], 0x7ffc9bd4c770 /* 24 vars */) = 0
...
openat(AT_FDCWD, "hello_kern.o", O_RDONLY) = -1 ENOENT (No such file or directory)
...
# cd samples/bpf
# ./hello
<...>-33177 [000] .... 22887.611008: 0: Hello BPF from houmin!