Ubuntu 20.04，内核源码方式编译bpf

eBPF 完全入门指南.pdf（万字长文） - 知乎 (zhihu.com)https://zhuanlan.zhihu.com/p/492185920

一、安装依赖

# apt-get update
# apt-get  install -y bison build-essential cmake flex git libedit-dev pkg-config libmnl-dev  python  zlib1g-dev libssl-dev libelf-dev libcap-dev libfl-dev llvm clang pkg-config  gcc-multilib luajit libluajit-5.1-dev libncurses5-dev libclang-dev clang-tools

二、安装内核源码

# uname -r
5.4.0-196-generic
# apt-cache search linux-source
# apt-get install linux-source-5.4.0

三、编译samples/bpf

# tar -jxvf linux-source-5.4.0.tar.bz2
# cd linux-source-5.4.0
# cp -v /boot/config-$(uname -r) .config
# make oldconfig 
# make modules_prepare
# make headers_install
# make scripts        # 可选
# make M=samples/bpf  # 如果配置出错，可以使用 make oldconfig && make prepare 修复
make -C /usr/src/linux-source-5.4.0/linux-source-5.4.0/samples/bpf/../../tools/lib/bpf/ RM='rm -rf' LDFLAGS= srctree=/usr/src/linux-source-5.4.0/linux-source-5.4.0/samples/bpf/../../ O=
Warning: Kernel ABI header at 'tools/include/uapi/linux/netlink.h' differs from latest version at 'include/uapi/linux/netlink.h'
Warning: Kernel ABI header at 'tools/include/uapi/linux/if_link.h' differs from latest version at 'include/uapi/linux/if_link.h'

  WARNING: Symbol version dump ./Module.symvers
           is missing; modules will have no dependencies and modversions.

  Building modules, stage 2.
  MODPOST 0 modules

编译成功后，可以在 samples/bpf 目录下看到一系列的目标文件和二进制文件。

四、hello_world

samples/bpf 目录下，内核空间程序以 _kern.c 结尾，用户空间程序以 _user.c 结尾，
可在samples/bpf目录添加自己的hello_kern.c和hello_user.c，并修改samples/bpf/Makefile，
tprogs-y += hello
hello-objs := hello_user.o $(TRACE_HELPERS)
always-y += hello_kern.o

# make M=samples/bpf
make -C /usr/src/linux-source-5.4.0/linux-source-5.4.0/samples/bpf/../../tools/lib/bpf/ RM='rm -rf' LDFLAGS= srctree=/usr/src/linux-source-5.4.0/linux-source-5.4.0/samples/bpf/../../ O=
Warning: Kernel ABI header at 'tools/include/uapi/linux/netlink.h' differs from latest version at 'include/uapi/linux/netlink.h'
Warning: Kernel ABI header at 'tools/include/uapi/linux/if_link.h' differs from latest version at 'include/uapi/linux/if_link.h'
  HOSTCC  samples/bpf/hello_user.o
  HOSTLD  samples/bpf/hello
  CLANG-bpf  samples/bpf/hello_kern.o

  WARNING: Symbol version dump ./Module.symvers
           is missing; modules will have no dependencies and modversions.

  Building modules, stage 2.
  MODPOST 0 modules
  
# samples/bpf/hello 
The kernel didn't load BPF program

# strace samples/bpf/hello 
execve("samples/bpf/hello", ["samples/bpf/hello"], 0x7ffc9bd4c770 /* 24 vars */) = 0
 ...
openat(AT_FDCWD, "hello_kern.o", O_RDONLY) = -1 ENOENT (No such file or directory)
 ...

# cd samples/bpf
# ./hello
           <...>-33177   [000] .... 22887.611008: 0: Hello BPF from houmin!