前言

$ cat /etc/os-release 
PRETTY_NAME="Ubuntu 24.04.2 LTS"$ uname -r
6.14.0-27-generic

一、apt安装

安装bpftool：

$ sudo apt install linux-tools-commonThe following NEW packages will be installed:linux-tools-commonGet:1 https://mirrors.aliyun.com/ubuntu noble-security/main amd64 linux-tools-common all 6.8.0-71.71 [738 kB]Preparing to unpack .../linux-tools-common_6.8.0-71.71_all.deb ...
Unpacking linux-tools-common (6.8.0-71.71) ...
Setting up linux-tools-common (6.8.0-71.71) ...
Processing triggers for man-db (2.12.0-4build2) ...

ubuntu24.04内核版本6.14.0-27，安装的是6.8.0-71，执行bpftool：

$ bpftool
WARNING: bpftool not found for kernel 6.14.0-27You may need to install the following packages for this specific kernel:linux-tools-6.14.0-27-genericlinux-cloud-tools-6.14.0-27-genericYou may also want to install one of the following packages to keep up to date:linux-tools-genericlinux-cloud-tools-generic

$ sudo apt install linux-tools-6.14.0-27-genericThe following additional packages will be installed:linux-hwe-6.14-tools-6.14.0-27
The following NEW packages will be installed:linux-hwe-6.14-tools-6.14.0-27 linux-tools-6.14.0-27-generic
0 upgraded, 2 newly installed, 0 to remove and 167 not upgraded.Get:1 https://mirrors.aliyun.com/ubuntu noble-security/main amd64 linux-hwe-6.14-tools-6.14.0-27 amd64 6.14.0-27.27~24.04.1 [1,158 kB]
Get:2 https://mirrors.aliyun.com/ubuntu noble-security/main amd64 linux-tools-6.14.0-27-generic amd64 6.14.0-27.27~24.04.1 [1,636 B]
Fetched 1,159 kB in 1s (1,747 kB/s)                       
Selecting previously unselected package linux-hwe-6.14-tools-6.14.0-27.
(Reading database ... 166326 files and directories currently installed.)
Preparing to unpack .../linux-hwe-6.14-tools-6.14.0-27_6.14.0-27.27~24.04.1_amd64.deb ...
Unpacking linux-hwe-6.14-tools-6.14.0-27 (6.14.0-27.27~24.04.1) ...
Selecting previously unselected package linux-tools-6.14.0-27-generic.
Preparing to unpack .../linux-tools-6.14.0-27-generic_6.14.0-27.27~24.04.1_amd64.deb ...
Unpacking linux-tools-6.14.0-27-generic (6.14.0-27.27~24.04.1) ...
Setting up linux-hwe-6.14-tools-6.14.0-27 (6.14.0-27.27~24.04.1) ...
Setting up linux-tools-6.14.0-27-generic (6.14.0-27.27~24.04.1) ..

如果是ubuntu20.04 或者 22.04等，执行到这一步就可安装成功。

$ bpftool
WARNING: bpftool not found for kernel 6.14.0-27You may need to install the following packages for this specific kernel:linux-tools-6.14.0-27-genericlinux-cloud-tools-6.14.0-27-genericYou may also want to install one of the following packages to keep up to date:linux-tools-genericlinux-cloud-tools-generic

$ whereis bpftool 
bpftool: /usr/sbin/bpftool

可以看到 Ubuntu 24.04.2 软件包里 没有对应的bpftool包 ，因此我们需要自己下载源码安装bpftool。

二、源码安装

第 1 步：更新包存储库。

sudo apt update
sudo apt upgrade

步骤 2. 安装依赖项。

sudo apt install -y git build-essential libelf-dev clang llvm

Step 3. 安装特定的内核版本的 linux-tools。

$ sudo apt install linux-tools-$(uname -r)The following additional packages will be installed:linux-hwe-6.14-tools-6.14.0-27 linux-tools-common
The following NEW packages will be installed:linux-hwe-6.14-tools-6.14.0-27 linux-tools-6.14.0-27-generic linux-tools-commonGet:1 https://mirrors.aliyun.com/ubuntu noble-security/main amd64 linux-tools-common all 6.8.0-71.71 [738 kB]
Get:2 https://mirrors.aliyun.com/ubuntu noble-security/main amd64 linux-hwe-6.14-tools-6.14.0-27 amd64 6.14.0-27.27~24.04.1 [1,158 kB]
Get:3 https://mirrors.aliyun.com/ubuntu noble-security/main amd64 linux-tools-6.14.0-27-generic amd64 6.14.0-27.27~24.04.1 [1,636 B]

步骤 4. 安装 Bpftool。
接下来，从 GitHub 克隆 bpftool 存储库：

git clone --recurse-submodules https://github.com/libbpf/bpftool.git

–recurse submoduls选项确保所有必要的子模块也被克隆。

转到 bpftool 源目录并构建该工具：

$ cd bpftool/src
$ make
...                        libbfd: [ OFF ]
...               clang-bpf-co-re: [ on  ]
...                          llvm: [ on  ]
...                        libcap: [ OFF ]
......
LINK     bpftool

构建过程完成后，安装 bpftool：

$ sudo make install
...                        libbfd: [ OFF ]
...               clang-bpf-co-re: [ on  ]
...                          llvm: [ on  ]
...                        libcap: [ OFF ]
INSTALL  bpftool

通过检查版本验证安装：

$ ./bpftool --version
bpftool v7.6.0
using libbpf v1.6
features: llvm, skeletons

要使 bpftool 在系统范围内可用，请创建符号链接：

$ sudo ln -s /usr/local/sbin/bpftool /usr/sbin/bpftool
ln: failed to create symbolic link '/usr/sbin/bpftool': File exists

这里注意在执行sudo apt install linux-tools-$(uname -r)，安装了linux-tools-common，也安装了bpftool，位置在/usr/sbin/bpftool，但是在ubuntu24.04，通过linux-tools-common安装的bpftool不可以用。

$ whereis bpftool
bpftool: /usr/sbin/bpftool

$ bpftool
WARNING: bpftool not found for kernel 6.14.0-27You may need to install the following packages for this specific kernel:linux-tools-6.14.0-27-genericlinux-cloud-tools-6.14.0-27-genericYou may also want to install one of the following packages to keep up to date:linux-tools-genericlinux-cloud-tools-generic

因此我们要卸载掉 linux-tools-common：

检查已安装的 linux-tools 相关包：

$ apt list --installed | grep linux-toolsWARNING: apt does not have a stable CLI interface. Use with caution in scripts.linux-tools-6.14.0-27-generic/noble-security,noble-updates,noble-updates,noble-security,now 6.14.0-27.27~24.04.1 amd64 [installed]
linux-tools-common/noble-security,noble-updates,noble-updates,noble-security,now 6.8.0-71.71 all [installed,automatic]

卸载：

$ sudo apt remove linux-tools-common
The following packages will be REMOVED:linux-hwe-6.14-tools-6.14.0-27 linux-tools-6.14.0-27-generic linux-tools-common

创建符号链接：

$ sudo ln -s /usr/local/sbin/bpftool /usr/sbin/bpftool
$ bpftool --version
bpftool v7.6.0
using libbpf v1.6
features: llvm, skeletons

三、生成vmlinux.h

对于支持 in-kernel BTF 的内核（5.2 开始，打开了特性 CONFIG_DEBUG_INFO_BIT），在 /sys/kernel/btf/vmlinux 输出BTF 的 raw data，可以使用 bpftool 工具从中提取出内核数据结构定义头文件, 包含全量的内核数据结构, 类型和函数前面,这样就不需要单独 include 内核的各头文件了。

$ cat /boot/config-6.14.0-27-generic | grep CONFIG_DEBUG_INFO
CONFIG_DEBUG_INFO=y
CONFIG_DEBUG_INFO_BTF=y

生成 vmlinux.h 文件的命令如下：

$ bpftool btf dump file /sys/kernel/btf/vmlinux format c > vmlinux.h

然后在 eBPF Kernel C 文件中只需要 include “vmlinux.h”，而不需要再单独 include 各内核头文件。

参考资料

https://idroot.us/install-bpftool-ubuntu-24-04/