最快的ebpf开发环境搭建方式

环境搭建

启动容器

bash 复制代码
sudo docker run --rm -it --privileged \
  -v /lib/modules:/lib/modules:ro \
  -v /sys:/sys:ro \
  -v /usr/src:/usr/src:ro \
  alpine:3.12

安装依赖

bash 复制代码
sed -i 's/dl-cdn.alpinelinux.org/mirrors.tuna.tsinghua.edu.cn/g' /etc/apk/repositories

apk add bcc-tools bcc-doc

测试

hello.c

cpp 复制代码
int hello_world(void *ctx)
{
	bpf_trace_printk("Hello, World");
	return 0;
}

hello.py

python 复制代码
from bcc import BPF

b = BPF(src_file="hello.c")
b.attach_kprobe(event="do_sys_openat2", fn_name="hello_world")

b.trace_print()

执行,可看到打印出了hello world

bash 复制代码
/ # python3 hello.py 

In file included from <built-in>:2:
In file included from /virtual/include/bcc/bpf.h:12:
In file included from include/linux/types.h:6:
In file included from include/uapi/linux/types.h:14:
In file included from ./include/uapi/linux/posix_types.h:5:
In file included from include/linux/stddef.h:5:
In file included from include/uapi/linux/stddef.h:5:
In file included from include/linux/compiler_types.h:90:
include/linux/compiler-clang.h:41:9: warning: '__HAVE_BUILTIN_BSWAP32__' macro redefined [-Wmacro-redefined]
#define __HAVE_BUILTIN_BSWAP32__
        ^
<command line>:4:9: note: previous definition is here
#define __HAVE_BUILTIN_BSWAP32__ 1
        ^
In file included from <built-in>:2:
In file included from /virtual/include/bcc/bpf.h:12:
In file included from include/linux/types.h:6:
In file included from include/uapi/linux/types.h:14:
In file included from ./include/uapi/linux/posix_types.h:5:
In file included from include/linux/stddef.h:5:
In file included from include/uapi/linux/stddef.h:5:
In file included from include/linux/compiler_types.h:90:
include/linux/compiler-clang.h:42:9: warning: '__HAVE_BUILTIN_BSWAP64__' macro redefined [-Wmacro-redefined]
#define __HAVE_BUILTIN_BSWAP64__
        ^
<command line>:5:9: note: previous definition is here
#define __HAVE_BUILTIN_BSWAP64__ 1
        ^
In file included from <built-in>:2:
In file included from /virtual/include/bcc/bpf.h:12:
In file included from include/linux/types.h:6:
In file included from include/uapi/linux/types.h:14:
In file included from ./include/uapi/linux/posix_types.h:5:
In file included from include/linux/stddef.h:5:
In file included from include/uapi/linux/stddef.h:5:
In file included from include/linux/compiler_types.h:90:
include/linux/compiler-clang.h:43:9: warning: '__HAVE_BUILTIN_BSWAP16__' macro redefined [-Wmacro-redefined]
#define __HAVE_BUILTIN_BSWAP16__
        ^
<command line>:3:9: note: previous definition is here
#define __HAVE_BUILTIN_BSWAP16__ 1
        ^
3 warnings generated.
b'         python3-1056231 [005] d..31 1056012.574165: bpf_trace_printk: Hello, World'
b'         python3-1056231 [005] d..31 1056012.574277: bpf_trace_printk: Hello, World'
b'         python3-1056231 [005] d..31 1056012.574734: bpf_trace_printk: Hello, World'
b'           <...>-1059946 [006] d..31 1056300.636287: bpf_trace_printk: Hello, World'
b'           <...>-6346    [001] d..31 1056300.673240: bpf_trace_printk: Hello, World'
b'           <...>-6346    [001] d..31 1056300.673277: bpf_trace_printk: Hello, World'
b'           <...>-6346    [001] d..31 1056300.673287: bpf_trace_printk: Hello, World'
b'           <...>-6346    [001] d..31 1056300.673648: bpf_trace_printk: Hello, World'
b'           <...>-6346    [001] d..31 1056300.673666: bpf_trace_printk: Hello, World'
b'           <...>-6346    [001] d..31 1056300.673676: bpf_trace_printk: Hello, World'
b'           <...>-6346    [001] d..31 1056300.673685: bpf_trace_printk: Hello, World'
相关推荐
Aiden_SHU10 天前
linux上trace code的几种方法
linux·运维·服务器·ebpf
华为云开发者联盟1 个月前
内核级流量治理引擎Kmesh八大新特性解读
ebpf·服务网格·kmesh·sidecar
PerfMan2 个月前
基于eBPF的procstat软件追踪程序垃圾回收(GC)事件
linux·开发语言·gc·ebpf·垃圾回收·procstat
观测云2 个月前
观测云核心技术解密:eBPF Tracing 实现原理
网络·ebpf
私房菜2 个月前
Android 中ebpf 的集成和调试
android·ebpf·gpumem·tracepoint
luofengmacheng3 个月前
eBPF编程指南(一):eBPF初体验
ebpf
程序猿编码4 个月前
BPF过滤器在数据包嗅探和过滤中的应用(C/C++代码实现)
c语言·c++·网络协议·bpf·数据包
_hong7 个月前
【Learning eBPF-3】一个 eBPF 程序的深入剖析
linux·ebpf·kernel
_hong7 个月前
【Learning eBPF-2】eBPF 的“Hello world”
linux·ebpf
_hong7 个月前
【Learning eBPF-1】什么是 eBPF?为什么它很吊?
linux·ebpf