前言

$ cat /etc/os-release 
PRETTY_NAME="Ubuntu 24.04.2 LTS"$ uname -r
6.14.0-27-generic

一、apt安裝

安裝bpftool：

$ sudo apt install linux-tools-commonThe following NEW packages will be installed:linux-tools-commonGet:1 https://mirrors.aliyun.com/ubuntu noble-security/main amd64 linux-tools-common all 6.8.0-71.71 [738 kB]Preparing to unpack .../linux-tools-common_6.8.0-71.71_all.deb ...
Unpacking linux-tools-common (6.8.0-71.71) ...
Setting up linux-tools-common (6.8.0-71.71) ...
Processing triggers for man-db (2.12.0-4build2) ...

ubuntu24.04內核版本6.14.0-27，安裝的是6.8.0-71，執行bpftool：

$ bpftool
WARNING: bpftool not found for kernel 6.14.0-27You may need to install the following packages for this specific kernel:linux-tools-6.14.0-27-genericlinux-cloud-tools-6.14.0-27-genericYou may also want to install one of the following packages to keep up to date:linux-tools-genericlinux-cloud-tools-generic

$ sudo apt install linux-tools-6.14.0-27-genericThe following additional packages will be installed:linux-hwe-6.14-tools-6.14.0-27
The following NEW packages will be installed:linux-hwe-6.14-tools-6.14.0-27 linux-tools-6.14.0-27-generic
0 upgraded, 2 newly installed, 0 to remove and 167 not upgraded.Get:1 https://mirrors.aliyun.com/ubuntu noble-security/main amd64 linux-hwe-6.14-tools-6.14.0-27 amd64 6.14.0-27.27~24.04.1 [1,158 kB]
Get:2 https://mirrors.aliyun.com/ubuntu noble-security/main amd64 linux-tools-6.14.0-27-generic amd64 6.14.0-27.27~24.04.1 [1,636 B]
Fetched 1,159 kB in 1s (1,747 kB/s)                       
Selecting previously unselected package linux-hwe-6.14-tools-6.14.0-27.
(Reading database ... 166326 files and directories currently installed.)
Preparing to unpack .../linux-hwe-6.14-tools-6.14.0-27_6.14.0-27.27~24.04.1_amd64.deb ...
Unpacking linux-hwe-6.14-tools-6.14.0-27 (6.14.0-27.27~24.04.1) ...
Selecting previously unselected package linux-tools-6.14.0-27-generic.
Preparing to unpack .../linux-tools-6.14.0-27-generic_6.14.0-27.27~24.04.1_amd64.deb ...
Unpacking linux-tools-6.14.0-27-generic (6.14.0-27.27~24.04.1) ...
Setting up linux-hwe-6.14-tools-6.14.0-27 (6.14.0-27.27~24.04.1) ...
Setting up linux-tools-6.14.0-27-generic (6.14.0-27.27~24.04.1) ..

如果是ubuntu20.04 或者 22.04等，執行到這一步就可安裝成功。

$ bpftool
WARNING: bpftool not found for kernel 6.14.0-27You may need to install the following packages for this specific kernel:linux-tools-6.14.0-27-genericlinux-cloud-tools-6.14.0-27-genericYou may also want to install one of the following packages to keep up to date:linux-tools-genericlinux-cloud-tools-generic

$ whereis bpftool 
bpftool: /usr/sbin/bpftool

可以看到 Ubuntu 24.04.2 軟件包里 沒有對應的bpftool包 ，因此我們需要自己下載源碼安裝bpftool。

二、源碼安裝

第 1 步：更新包存儲庫。

sudo apt update
sudo apt upgrade

步驟 2. 安裝依賴項。

sudo apt install -y git build-essential libelf-dev clang llvm

Step 3. 安裝特定的內核版本的 linux-tools。

$ sudo apt install linux-tools-$(uname -r)The following additional packages will be installed:linux-hwe-6.14-tools-6.14.0-27 linux-tools-common
The following NEW packages will be installed:linux-hwe-6.14-tools-6.14.0-27 linux-tools-6.14.0-27-generic linux-tools-commonGet:1 https://mirrors.aliyun.com/ubuntu noble-security/main amd64 linux-tools-common all 6.8.0-71.71 [738 kB]
Get:2 https://mirrors.aliyun.com/ubuntu noble-security/main amd64 linux-hwe-6.14-tools-6.14.0-27 amd64 6.14.0-27.27~24.04.1 [1,158 kB]
Get:3 https://mirrors.aliyun.com/ubuntu noble-security/main amd64 linux-tools-6.14.0-27-generic amd64 6.14.0-27.27~24.04.1 [1,636 B]

步驟 4. 安裝 Bpftool。
接下來，從 GitHub 克隆 bpftool 存儲庫：

git clone --recurse-submodules https://github.com/libbpf/bpftool.git

–recurse submoduls選項確保所有必要的子模塊也被克隆。

轉到 bpftool 源目錄并構建該工具：

$ cd bpftool/src
$ make
...                        libbfd: [ OFF ]
...               clang-bpf-co-re: [ on  ]
...                          llvm: [ on  ]
...                        libcap: [ OFF ]
......
LINK     bpftool

構建過程完成后，安裝 bpftool：

$ sudo make install
...                        libbfd: [ OFF ]
...               clang-bpf-co-re: [ on  ]
...                          llvm: [ on  ]
...                        libcap: [ OFF ]
INSTALL  bpftool

通過檢查版本驗證安裝：

$ ./bpftool --version
bpftool v7.6.0
using libbpf v1.6
features: llvm, skeletons

要使 bpftool 在系統范圍內可用，請創建符號鏈接：

$ sudo ln -s /usr/local/sbin/bpftool /usr/sbin/bpftool
ln: failed to create symbolic link '/usr/sbin/bpftool': File exists

這里注意在執行sudo apt install linux-tools-$(uname -r)，安裝了linux-tools-common，也安裝了bpftool，位置在/usr/sbin/bpftool，但是在ubuntu24.04，通過linux-tools-common安裝的bpftool不可以用。

$ whereis bpftool
bpftool: /usr/sbin/bpftool

$ bpftool
WARNING: bpftool not found for kernel 6.14.0-27You may need to install the following packages for this specific kernel:linux-tools-6.14.0-27-genericlinux-cloud-tools-6.14.0-27-genericYou may also want to install one of the following packages to keep up to date:linux-tools-genericlinux-cloud-tools-generic

因此我們要卸載掉 linux-tools-common：

檢查已安裝的 linux-tools 相關包：

$ apt list --installed | grep linux-toolsWARNING: apt does not have a stable CLI interface. Use with caution in scripts.linux-tools-6.14.0-27-generic/noble-security,noble-updates,noble-updates,noble-security,now 6.14.0-27.27~24.04.1 amd64 [installed]
linux-tools-common/noble-security,noble-updates,noble-updates,noble-security,now 6.8.0-71.71 all [installed,automatic]

卸載：

$ sudo apt remove linux-tools-common
The following packages will be REMOVED:linux-hwe-6.14-tools-6.14.0-27 linux-tools-6.14.0-27-generic linux-tools-common

創建符號鏈接：

$ sudo ln -s /usr/local/sbin/bpftool /usr/sbin/bpftool
$ bpftool --version
bpftool v7.6.0
using libbpf v1.6
features: llvm, skeletons

三、生成vmlinux.h

對于支持 in-kernel BTF 的內核（5.2 開始，打開了特性 CONFIG_DEBUG_INFO_BIT），在 /sys/kernel/btf/vmlinux 輸出BTF 的 raw data，可以使用 bpftool 工具從中提取出內核數據結構定義頭文件, 包含全量的內核數據結構, 類型和函數前面,這樣就不需要單獨 include 內核的各頭文件了。

$ cat /boot/config-6.14.0-27-generic | grep CONFIG_DEBUG_INFO
CONFIG_DEBUG_INFO=y
CONFIG_DEBUG_INFO_BTF=y

生成 vmlinux.h 文件的命令如下：

$ bpftool btf dump file /sys/kernel/btf/vmlinux format c > vmlinux.h

然后在 eBPF Kernel C 文件中只需要 include “vmlinux.h”，而不需要再單獨 include 各內核頭文件。

參考資料

https://idroot.us/install-bpftool-ubuntu-24-04/