M10F支持扩展卡吗_ibb与obb

int bpf(int cmd, union bpf_attr *attr, unsigned int size);

sudo apt-get install virtualbox vagrant
vagrant init ubuntu/impish64
vagrant up
vagrant ssh  # 连接到虚拟机
uanme -a
lsb_release -a

CONFIG_BPF=y
CONFIG_BPF_SYSCALL=y
# [optional, for tc filters]
CONFIG_NET_CLS_BPF=m
# [optional, for tc actions]
CONFIG_NET_ACT_BPF=m
CONFIG_BPF_JIT=y
# [for Linux kernel versions 4.1 through 4.6]
CONFIG_HAVE_BPF_JIT=y
# [for Linux kernel versions 4.7 and later]
CONFIG_HAVE_EBPF_JIT=y
# [optional, for kprobes]
CONFIG_BPF_EVENTS=y
# Need kernel headers through /sys/kernel/kheaders.tar.xz
CONFIG_IKHEADERS=y

# 第一种方式：包安装
sudo apt-get install bpfcc-tools linux-headers-$(uname -r)

# 第二种方式：源码安装（包括下面的安装和编译）
# Trusty (14.04 LTS) and older
VER=trusty
echo "deb http://llvm.org/apt/$VER/ llvm-toolchain-$VER-3.7 main deb-src http://llvm.org/apt/$VER/ llvm-toolchain-$VER-3.7 main" | \
sudo tee /etc/apt/sources.list.d/llvm.list
wget -O - http://llvm.org/apt/llvm-snapshot.gpg.key | sudo apt-key add -
sudo apt-get update
# For Bionic (18.04 LTS)
sudo apt-get -y install bison build-essential cmake flex git libedit-dev \
libllvm6.0 llvm-6.0-dev libclang-6.0-dev python zlib1g-dev libelf-dev libfl-dev python3-distutils
# For Eoan (19.10) or Focal (20.04.1 LTS)
sudo apt install -y bison build-essential cmake flex git libedit-dev \
libllvm7 llvm-7-dev libclang-7-dev python zlib1g-dev libelf-dev libfl-dev python3-distutils
# For Hirsute (21.04) or Impish (21.10)
sudo apt install -y bison build-essential cmake flex git libedit-dev libllvm11 llvm-11-dev libclang-11-dev python zlib1g-dev libelf-dev libfl-dev python3-distutils
# For other versions
sudo apt-get -y install bison build-essential cmake flex git libedit-dev \
libllvm3.7 llvm-3.7-dev libclang-3.7-dev python zlib1g-dev libelf-dev python3-distutils
# For Lua support
sudo apt-get -y install luajit luajit-5.1-dev

git clone https://github.com/iovisor/bcc.git
mkdir bcc/build; cd bcc/build
cmake ..   # 注意使用的llvm环境是哪一个
make
sudo make install
cmake -DPYTHON_CMD=python3 .. # build python3 binding 绑定到python3而不是python2
pushd src/python/
make
# 安装到/usr/lib/python3/dist-packages/下
sudo make install
popd				# 返回栈顶目录

sudo apt-get install -y bpftrace

#!/usr/bin/python
# Copyright (c) PLUMgrid, Inc.
# Licensed under the Apache License, Version 2.0 (the "License")
# run in project examples directory with:
# sudo ./hello_world.py"
# see trace_fields.py for a longer example
from bcc import BPF
# This may not work for 4.17 on x64, you need replace kprobe__sys_clone with kprobe____x64_sys_clone
BPF(text='int kprobe__sys_clone(void *ctx) { bpf_trace_printk("Hello, World!\\n"); return 0; }').trace_print()

#!/usr/bin/python3
from bcc import BPF
prog=''' int kprobe__sys_sync(void *ctx) { bpf_trace_printk("sys_sync() called\\n"); return 0; } '''
BPF(text=prog).trace_print()

#!/usr/bin/python3
from bcc import BPF
prog = ''' int hello(void *ctx) { bpf_trace_printk("hello world\\n"); return 0; } '''
b = BPF(text=prog)
# get_syscall_fnname: 根据输入的名称获取系统调用的全名, For example, given "clone" the helper would return "sys_clone" or "__x64_sys_clone".
b.attach_kprobe(event=b.get_syscall_fnname("clone"), fn_name="hello")
# header
print("%-18s %-16s %-6s %s" % ("TIME(s)", "COMM", "PID", "MESSAGE"))
# 循环获取输出
while(1):
try:
# 从 trace_pipe 返回一组固定的字段。与 trace_print() 类似
(task, pid, cpu, flags, timestamp, msg) =  b.trace_fields()
except ValueError:
continue
print("%-18.9f %-16s %-6d %s" % (timestamp, task, pid, msg))

#!/usr/bin/python3
from bcc import BPF
prog = ''' #include <uapi/linux/ptrace.h> // 创建一个Hash映射数据结构 BPF_HASH(last); int do_trace(struct pt_regs *ctx) { u64 ts, *tsp, delta, key = 0; // 读取当前hash中最新的数据 tsp = last.lookup(&key); // 判断是否需要计算时间差 if (tsp != NULL) { delta = bpf_ktime_get_ns() - *tsp; if (delta < 1000000000) { // 如果<1s,那么输出 bpf_trace_printk("%d\\n", delta / 1000000); } // 删除掉原本的最新数据 last.delete(&key); } // 更新hash,获取当前时间 ts = bpf_ktime_get_ns(); last.update(&key, &ts); return 0; } '''
b = BPF(text=prog)
b.attach_kprobe(event=b.get_syscall_fnname("sync"), fn_name="do_trace")
print("Tracing for quick sync's... Ctrl-C to end")
start = 0
while(1):
try:
(task, pid, cpu, flags, ts, msg) = b.trace_fields()
except ValueError:
continue
if start == 0 :
start = ts
ts = ts - start
print("At time %.2f s: multiple syncs detected, last %s ms ago" % (ts, msg))

#!/usr/bin/python3
from bcc import BPF
prog = ''' #include <uapi/linux/ptrace.h> // 创建一个array用于计数 BPF_ARRAY(counts, u64, 1); int do_sync(struct pt_regs *ctx) { u64 *now = 0; int index = 0; // +1 counts.increment(index); now = counts.lookup(&index); if (now != NULL) { bpf_trace_printk("%d\\n", *now); } return 0; } '''
b = BPF(text=prog)
b.attach_kprobe(event=b.get_syscall_fnname("sync"), fn_name="do_sync")
while(1):
try:
(task, pid, cpu, flags, ts, msg) = b.trace_fields()
except ValueError:
continue
print("At time %.2f s: count sync is %s\n" % (ts, msg))

# ./disksnoop.py
TIME(s)            T  BYTES    LAT(ms)
16458043.436012    W  4096        3.13
16458043.437326    W  4096        4.44
16458044.126545    R  4096       42.82
16458044.129872    R  4096        3.24
[...]

[...]
REQ_WRITE = 1		# from include/linux/blk_types.h
# load BPF program
b = BPF(text=""" #include <uapi/linux/ptrace.h> #include <linux/blkdev.h> BPF_HASH(start, struct request *); void trace_start(struct pt_regs *ctx, struct request *req) { // stash start timestamp by request ptr // 获取开始的时间 u64 ts = bpf_ktime_get_ns(); start.update(&req, &ts); } void trace_completion(struct pt_regs *ctx, struct request *req) { u64 *tsp, delta; // 获取之前的时间 tsp = start.lookup(&req); if (tsp != 0) { // 计算时间差值 delta = bpf_ktime_get_ns() - *tsp; bpf_trace_printk("%d %x %d\\n", req->__data_len, req->cmd_flags, delta / 1000); start.delete(&req); } } """)
# 分别对三个系统调用进行插桩
b.attach_kprobe(event="blk_start_request", fn_name="trace_start")
b.attach_kprobe(event="blk_mq_start_request", fn_name="trace_start")
b.attach_kprobe(event="blk_account_io_done", fn_name="trace_completion")
[...]

#!/usr/bin/python3
from multiprocessing import Event
from bcc import BPF
prog = ''' #include <linux/sched.h> // 自定义输出类型 struct data_t { u32 pid; u64 ts; char comm[TASK_COMM_LEN]; }; // 创建perf输出通道,名为event BPF_PERF_OUTPUT(events); int hello(struct pt_regs *ctx) { // 创建对象,借助辅助函数填充数据 struct data_t data = {}; data.pid = bpf_get_current_pid_tgid(); data.ts = bpf_ktime_get_ns(); bpf_get_current_comm(&data.comm, sizeof(data.comm)); // 发送到通道中(给用户态空间) events.perf_submit(ctx, &data, sizeof(data)); return 0; } '''
b = BPF(text=prog)
b.attach_kprobe(event=b.get_syscall_fnname("clone"), fn_name="hello")
# header
print("%-18s %-16s %-6s %s" % ("TIME(s)", "COMM", "PID", "MESSAGE"))
start = 0
# 该函数将处理从事件流中读取事件
def print_event(cpu, data, size):
global start 
# 将事件作为 Python 对象获取，从 C 声明中自动生成。
event = b["events"].event(data)
if start == 0:
start = event.ts
time_s = (float(event.ts - start)) / 1000000000
print("%-18.9f %-16s %-6d %s" % (time_s, event.comm, event.pid, "Hello, perf_output!"))
# 设置回调函数
b["events"].open_perf_buffer(print_event)
while 1:
# 阻塞等待事件
b.perf_buffer_poll()

#!/usr/bin/python3
from __future__ import print_function
from bcc import BPF
from time import sleep
prog = ''' #include <uapi/linux/ptrace.h> #include <linux/blkdev.h> BPF_HISTOGRAM(dist); int kprobe__blk_account_io_done(struct pt_regs *ctx, struct request *req) { dist.increment(bpf_log2l(req->__data_len / 1024)); return 0; } '''
b = BPF(text=prog)
# header
print("Tracing... Hit Ctrl-C to end.")
# trace until Ctrl-C
try:
sleep(999999)
except KeyboardInterrupt:
print()
# output
b["dist"].print_log2_hist("kbytes")

#!/usr/bin/python3
from bcc import BPF
from time import sleep
prog = ''' #include <uapi/linux/ptrace.h> #include <linux/blkdev.h> BPF_HISTOGRAM(dist); // 统计直方图 BPF_HASH(start, struct request *); // 记录延迟时间 void trace_start(struct pt_regs *ctx, struct request *req) { u64 ts = bpf_ktime_get_ns(); start.update(&req, &ts); } void trace_completion(struct pt_regs *ctx, struct request *req) { u64 *tsp, delta; tsp = start.lookup(&req); if (tsp != 0) { delta = bpf_ktime_get_ns() - *tsp; // 写入到直方图中 dist.increment(bpf_log2l(delta)); start.delete(&req); } } '''
b = BPF(text=prog)
if BPF.get_kprobe_functions(b'blk_start_request'):		# 这里先判断一下是否有此函数
b.attach_kprobe(event="blk_start_request", fn_name="trace_start")
b.attach_kprobe(event="blk_mq_start_request", fn_name="trace_start")
if BPF.get_kprobe_functions(b'__blk_account_io_done'):
b.attach_kprobe(event="__blk_account_io_done", fn_name="trace_completion")
else:
b.attach_kprobe(event="blk_account_io_done", fn_name="trace_completion")
# header
print("Tracing... Hit Ctrl-C to end.")
# trace until Ctrl-C
try:
sleep(999999)
except KeyboardInterrupt:
print()
# output
b["dist"].print_log2_hist("time")

from __future__ import print_function
from bcc import BPF
# load BPF program
b = BPF(text=""" TRACEPOINT_PROBE(random, urandom_read) { // args is from /sys/kernel/debug/tracing/events/random/urandom_read/format bpf_trace_printk("%d\\n", args->got_bits); return 0; } """)
# header
print("%-18s %-16s %-6s %s" % ("TIME(s)", "COMM", "PID", "GOTBITS"))
# format output
while 1:
try:
(task, pid, cpu, flags, ts, msg) = b.trace_fields()
except ValueError:
continue
print("%-18.9f %-16s %-6d %s" % (ts, task, pid, msg))

#!/usr/bin/python3
from __future__ import print_function
from bcc import BPF
from bcc.utils import printb
REQ_WRITE = 1       # from include/linux/blk_types.h
# load BPF program
b = BPF(text=''' #include <uapi/linux/ptrace.h> #include <linux/blk-mq.h> struct data_t { u64 len; // 大小 char rwbs[8]; // 类型 u64 ts; // 时间戳 }; BPF_HASH(start, u64, struct data_t); TRACEPOINT_PROBE(block, block_rq_issue) { u64 key = 0; struct data_t data = {}; data.ts = bpf_ktime_get_ns(); // args from /sys/kernel/debug/tracing/events/block/block_rq_issue/format bpf_probe_read(&data.rwbs, sizeof(data.rwbs), (void *)args->rwbs); data.len = args->bytes; // 更新存储 start.update(&key, &data); return 0; } TRACEPOINT_PROBE(block, block_rq_complete) { u64 delta, key = 0; struct data_t* datap; datap = start.lookup(&key); if (datap != NULL) { // 计算时间差 delta = bpf_ktime_get_ns() - datap->ts; bpf_trace_printk("%d %x %d\\n", datap->len, datap->rwbs, delta / 1000); start.delete(&key); } return 0; } ''')
# header
print("%-18s %-2s %-7s %8s" % ("TIME(s)", "T", "BYTES", "LAT(ms)"))
# format output
while 1:
try:
(task, pid, cpu, flags, ts, msg) = b.trace_fields()
(bytes_s, bflags_s, us_s) = msg.split()
if int(bflags_s, 16) & REQ_WRITE:
type_s = b"W"
elif bytes_s == "0":    # see blk_fill_rwbs() for logic
type_s = b"M"
else:
type_s = b"R"
ms = float(int(us_s, 10)) / 1000
printb(b"%-18.9f %-2s %-7s %8.2f" % (ts, type_s, bytes_s, ms))
except KeyboardInterrupt:
exit()

# ./strlen_count.py
Tracing strlen()... Hit Ctrl-C to end.
^C     COUNT STRING
1 " "
1 "/bin/ls"
1 "."
1 "cpudist.py.1"
1 ".bashrc"
1 "ls --color=auto"
1 "key_t"
[...]
10 "a7:~# "
10 "/root"
12 "LC_ALL"
12 "en_US.UTF-8"
13 "en_US.UTF-8"
20 "~"
70 "#%^,~:-=?+/}"
340 "\x01\x1b]0;root@bgregg-test: ~\x07\x02root@bgregg-test:~# "

from __future__ import print_function
from bcc import BPF
from time import sleep
# load BPF program
b = BPF(text=""" #include <uapi/linux/ptrace.h> struct key_t { char c[80]; }; BPF_HASH(counts, struct key_t); int count(struct pt_regs *ctx) { if (!PT_REGS_PARM1(ctx)) return 0; struct key_t key = {}; u64 zero = 0, *val; bpf_probe_read_user(&key.c, sizeof(key.c), (void *)PT_REGS_PARM1(ctx)); // could also use `counts.increment(key)` val = counts.lookup_or_try_init(&key, &zero); if (val) { (*val)++; } return 0; }; """)
b.attach_uprobe(name="c", sym="strlen", fn_name="count")
# header
print("Tracing strlen()... Hit Ctrl-C to end.")
# sleep until Ctrl-C
try:
sleep(99999999)
except KeyboardInterrupt:
pass
# print output
print("%10s %s" % ("COUNT", "STRING"))
counts = b.get_table("counts")
for k, v in sorted(counts.items(), key=lambda counts: counts[1].value):
print("%10d \"%s\"" % (v.value, k.c))

from __future__ import print_function
from bcc import BPF, USDT
import sys
if len(sys.argv) < 2:
print("USAGE: nodejs_http_server PID")
exit()
pid = sys.argv[1]
debug = 0
# load BPF program
bpf_text = """ #include <uapi/linux/ptrace.h> int do_trace(struct pt_regs *ctx) { uint64_t addr; char path[128]={0}; bpf_usdt_readarg(6, ctx, &addr); bpf_probe_read_user(&path, sizeof(path), (void *)addr); bpf_trace_printk("path:%s\\n", path); return 0; }; """
# enable USDT probe from given PID
u = USDT(pid=int(pid))
# 开启用户态跟踪点
u.enable_probe(probe="http__server__request", fn_name="do_trace")
if debug:
print(u.get_text())
print(bpf_text)
# initialize BPF
b = BPF(text=bpf_text, usdt_contexts=[u])

#include <uapi/linux/ptrace.h>
#include <linux/sched.h>
struct key_t { 

u32 prev_pid;
u32 curr_pid;
};
BPF_HASH(stats, struct key_t, u64, 1024);
int count_sched(struct pt_regs *ctx, struct task_struct *prev) { 

struct key_t key = { 
};
u64 zero = 0, *val;
key.curr_pid = bpf_get_current_pid_tgid();
key.prev_pid = prev->pid;		// 从之前的上下文中获取pid
// could also use `stats.increment(key);`
val = stats.lookup_or_try_init(&key, &zero);
if (val) { 

(*val)++;
}
return 0;
}

from bcc import BPF
from time import sleep
b = BPF(src_file="task_switch.c")
b.attach_kprobe(event_re="^finish_task_switch$|^finish_task_switch\.isra\.\d$", fn_name="count_sched")
# generate many schedule events
for i in range(0, 100): sleep(0.01)
for k, v in b["stats"].items():
print("task_switch[%5d->%5d]=%u" % (k.prev_pid, k.curr_pid, v.value))

int hello_world(void *ctx) 
{ 

bpf_trace_printk("Hello, World!\n");
return 0;
}

#!/usr/bin/python3
# 1) import bcc library
from bcc import BPF
# 2) load BPF program
b = BPF(src_file="hello.c")
# 3) attach kprobe
b.attach_kprobe(event="do_sys_openat2", fn_name="hello_world")
# 4) read and print /sys/kernel/debug/tracing/trace_pipe
b.trace_print()

// 包含头文件
#include <uapi/linux/openat2.h>
#include <linux/sched.h>
// 定义数据结构
struct data_t { 

u32 pid;
u64 ts;
char comm[TASK_COMM_LEN];
char fname[NAME_MAX];
};
// 定义性能事件映射map
BPF_PERF_OUTPUT(events);

// 定义kprobe处理函数
int hello_world(struct pt_regs *ctx, int dfd, const char __user * filename, struct open_how *how)
{ 

struct data_t data = { 
 };
// 获取PID和时间
data.pid = bpf_get_current_pid_tgid();
data.ts = bpf_ktime_get_ns();
// 获取进程名
if (bpf_get_current_comm(&data.comm, sizeof(data.comm)) == 0)
{ 

bpf_probe_read(&data.fname, sizeof(data.fname), (void *)filename);
}
// 提交性能事件
events.perf_submit(ctx, &data, sizeof(data));
return 0;
}

from bcc import BPF
# 1) load BPF program
b = BPF(src_file="trace-open.c")
b.attach_kprobe(event="do_sys_openat2", fn_name="hello_world")
# 2) print header
print("%-18s %-16s %-6s %-16s" % ("TIME(s)", "COMM", "PID", "FILE"))
# 3) define the callback for perf event
start = 0
def print_event(cpu, data, size):   # cpu, data, size 三个参数都是bbc框架默认使用的
global start
event = b["events"].event(data)
if start == 0:
start = event.ts
time_s = (float(event.ts - start)) / 1000000000
print("%-18.9f %-16s %-6d %-16s" % (time_s, event.comm, event.pid, event.fname))
# 4) loop with callback to print_event
# 定义一个events的Perf事件映射，然后循环读取
b["events"].open_perf_buffer(print_event)  # 传入回调函数jie
while 1:
try:
b.perf_buffer_poll()
except KeyboardInterrupt:
exit()

# 先搜索
sudo apt-cache search linux-source
linux-source - Linux kernel source with Ubuntu patches
linux-source-4.15.0 - Linux kernel source for version 4.15.0 with Ubuntu patches
linux-source-4.18.0 - Linux kernel source for version 4.18.0 with Ubuntu patches
linux-source-5.0.0 - Linux kernel source for version 5.0.0 with Ubuntu patches
linux-source-5.3.0 - Linux kernel source for version 5.3.0 with Ubuntu patches
# 再安装
sudo apt install linux-source-4.15.0
cd /usr/src/linux-source-4.15.0
sudo tar xjf linux-source-4.15.0.tar.bz2 
cd linux-source-4.15.0/

# 切换到内核源代码根目录
cd linux_sourcecode/
# 生成内核编译时需要的头文件
sudo make headers_install
# 可视化选择你想为内核添加的内核模块，最终生成保存了相关模块信息的.config文件，为执行后面的命令做准备
sudo make menuconfig
# 使用make命令编译samples/bpf/目录下所有bpf示例代码，注意需要加上最后的/符号
sudo make samples/bpf/ # or make M=samples/bpf

go get -u "github.com/iovisor/gobpf/bcc"
go get -u "github.com/iovisor/gobpf/pkg/tracepipe"

package main
import (
"bytes"
"encoding/binary"
"fmt"
bpf "github.com/iovisor/gobpf/bcc"
"os"
"os/signal"
)
const source string = ` #include <uapi/linux/ptrace.h> struct readline_event_t { u32 pid; char str[80]; } __attribute__((packed)); BPF_PERF_OUTPUT(readline_events); int get_return_value(struct pt_regs *ctx) { struct readline_event_t event = {}; u32 pid; if (!PT_REGS_RC(ctx)) return 0; pid = bpf_get_current_pid_tgid(); event.pid = pid; bpf_probe_read(&event.str, sizeof(event.str), (void *)PT_REGS_RC(ctx)); readline_events.perf_submit(ctx, &event, sizeof(event)); return 0; } `
type readlineEvent struct { 

Pid uint32   // 进程号
Str [80]byte // 命令内容
}
func main() { 

m := bpf.NewModule(source, []string{ 
})
defer m.Close()
readlineUretprobe, err := m.LoadUprobe("get_return_value")
if err != nil { 

fmt.Fprintf(os.Stderr, "Failed to load get_return_value: %s\n", err)
os.Exit(1)
}
// 埋点在/bin/bash上，最后一个参数是pid，-1表示所有进程
m.AttachUretprobe("/bin/bash", "readline", readlineUretprobe, -1)
if err != nil { 

fmt.Fprintf(os.Stderr, "Failed to attach return_value: %s\n", err)
os.Exit(1)
}
// 创建一个BPF table
table := bpf.NewTable(m.TableId("readline_events"), m)
// 接收数据的channel
channel := make(chan []byte)
// 使用table、channel初始化Perf Map
perfMap, err := bpf.InitPerfMap(table, channel, nil)
if err != nil { 

fmt.Fprintf(os.Stderr, "Failed to init perf map: %s\n", err)
os.Exit(1)
}
// 创建接收信号的channel
signalChan := make(chan os.Signal, 1)
signal.Notify(signalChan, os.Interrupt, os.Kill) // 接收这些信号
fmt.Printf("%10s\t%s\n", "PID", "COMMAND")
// 协程读取数据并输出
go func() { 

var event readlineEvent
for { 

data := <-channel
err := binary.Read(bytes.NewBuffer(data), binary.LittleEndian, &event)
if err != nil { 

fmt.Printf("failed to decode received data: %s\n", err)
continue
}
// Convert C string (null-terminated) to Go string
comm := string(event.Str[:bytes.IndexByte(event.Str[:], 0)])
fmt.Printf("%10d\t%s\n", event.Pid, comm)
}
}()
// Start to poll the perf map reader and send back event data
perfMap.Start()
<-signalChan
perfMap.Stop()
}

#!/usr/bin/bpftrace
kprobe:vfs_read
{ 

@start[tid] = nsecs;
}
kretprobe:vfs_read
/@start[tid]/
{ 

$duration_us = (nsecs - @start[tid]) / 1000;
@us = hist($duration_us);
delete(@start[tid]);
}

probes { 
 actions }
probes /filter/ { 
 actions }  # 防止可选的过滤表达式

sudo apt install libdebuginfod-dev    # 我尝试了并不能直接下载
sudo apt install libluajit-5.1-dev
sudo apt install arping netperf

# 采用源码安装方式
cd /usr/local
wget https://github.com/llvm/llvm-project/releases/download/llvmorg-13.0.0/llvm-project-13.0.0.src.tar.xz
tar xvf llvm-project-13.0.0.src.tar.xz
mv llvm-project-13.0.0.src/ llvm
cd llvm
mkdir build && cd build
# cmake生成编译信息
cmake -G "Unix Makefiles" -DLLVM_ENABLE_PROJECTS="clang;lldb" -DLLVM_TARGETS_TO_BUILD=X86 -DCMAKE_BUILD_TYPE="Release" -DLLVM_INCLUDE_TESTS=OFF -DCMAKE_INSTALL_PREFIX="/usr/local/llvm" ../llvm
# 编译
make     # 注意：这里会非常慢，耐心等待
# 安装
make install

wget https://apt.llvm.org/llvm.sh
chmod +x llvm.sh
# 后面的参数是版本号
sudo ./llvm.sh 11

wget https://github.com/iovisor/bcc/releases/download/v0.24.0/bcc-src-with-submodule.tar.gz
tar xvf bcc-src-with-submodule.tar.gz 
mkdir build && cd build
cmake ..
make
sudo make install
cmake -DPYTHON_CMD=python3 .. # build python3 binding
# 将目录添加到目录堆栈顶，简单理解就是进入这个目录，和popd一起使用
pushd src/python/   
make
# 安装到/usr/lib/python3/dist-packages/下
sudo make install
popd	# 返回栈顶目录

# 检查
ls -l `which python`
lrwxrwxrwx 1 lywh lywh 9 3月  28 14:28 /home/lywh/anaconda3/bin/python -> python3.9  # 不能用这个