ebpf环境搭建
2021-12-13 本文已影响0人
wangshanshi
主要参考文章:
- <运行第一个ebpf程序>> https://blog.csdn.net/sinat_38816924/article/details/115556650
- <<上手bpf>> https://blog.csdn.net/Longyu_wlz/article/details/109900096#t5
编译运行源码samples/bpf中的代码
https://blog.csdn.net/sinat_38816924/article/details/115556650
这个比较简单
- 下载内核源码并解压
-
/bin/sh: scripts/mod/modpost: No such file or directory遇到这种错误，需要make scripts -
make M=samples/bpf需要.config文件，需要保证这些项存在 https://github.com/iovisor/bpftrace/blob/master/INSTALL.md - 遇到错误
libcrypt1.so.1 not found，执行如下代码（https://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1818037.html）
$ cd /tmp
$ apt -y download libcrypt1
$ dpkg-deb -x libcrypt1_1%3a4.4.25-2_amd64.deb .
$ cp -av lib/x86_64-linux-gnu/* /lib/x86_64-linux-gnu/
$ apt -y --fix-broken install
- 编译成功，可以执行samples/bpf中的可执行文件
编译运行自己开发的代码
https://blog.csdn.net/Longyu_wlz/article/details/109900096#t5
1. 下载linux source code，编译内核并升级
git clone https://github.com/torvalds/linux.git
cd linux/
git checkout -b v5.0 v5.0
配置文件
cp -a /boot/config-4.14.81.bm.15-amd64 ./.config
echo '
CONFIG_BPF=y
CONFIG_BPF_SYSCALL=y
CONFIG_BPF_JIT=y
CONFIG_HAVE_EBPF_JIT=y
CONFIG_BPF_EVENTS=y
CONFIG_FTRACE_SYSCALLS=y
CONFIG_FUNCTION_TRACER=y
CONFIG_HAVE_DYNAMIC_FTRACE=y
CONFIG_DYNAMIC_FTRACE=y
CONFIG_HAVE_KPROBES=y
CONFIG_KPROBES=y
CONFIG_KPROBE_EVENTS=y
CONFIG_ARCH_SUPPORTS_UPROBES=y
CONFIG_UPROBES=y
CONFIG_UPROBE_EVENTS=y
CONFIG_DEBUG_FS=y
CONFIG_DEBUG_INFO_BTF=y
' >> ./.config
需要添加sid源安装dwarves
apt install dwarves
make oldconfig
apt install libssl-dev
make
make modules_install
make install
reboot
此时:
uname -a
Linux n231-238-061 5.0.0 #1 SMP Mon Dec 13 05:38:52 UTC 2021 x86_64 GNU/Linux
2. 编译bpf helloworld
切换到https://github.com/bpftools/linux-observability-with-bpf的helloworld目录
sed -i 's;/kernel-src;/root/linux;' Makefile
make
有报错:
image.png
参考: http://www.helight.info/blog/2021/build-kernel-ebpf-sample/ 解决
cp /root/linux/include/uapi/linux/bpf.h /usr/include/linux/bpf.h
执行./monitor-exec，有报错
./monitor-exec: error while loading shared libraries: libbpf.so: cannot open shared object file: No such file or directory
解决方法
cd /root/linux/tools/lib/bpf/
make
make install
在 /etc/ld.so.conf 中添加 /usr/local/lib64这一行
运行 sudo ldconfig 重新生成动态库配置信息
~/linux/tools/lib/bpf# ldconfig -v 2>/dev/null | grep libbpf
libbpf.so.0 -> libbpf.so.0.5.0
libbpf.so -> libbpf.so
最终执行情况:
image.png
可能需要安装apt-get install gcc-multilib g++-multilib
https://github.com/sirfz/tesserocr/issues/130
安装bpftrace
deb http://deb.debian.org/debian sid main contrib non-free
deb-src http://deb.debian.org/debian sid main contrib non-free
- apt install bpftrace https://github.com/iovisor/bpftrace/blob/master/INSTALL.md
