From fc1301094e65f0cfe2d22db76ffd88fb3a534305 Mon Sep 17 00:00:00 2001 From: yunwei37 <1067852565@qq.com> Date: Sun, 7 May 2023 01:25:01 +0800 Subject: [PATCH] add bootstrap files --- .gitignore | 13 ++ blazesym | 2 +- src/11-bootstrap/Makefile | 141 +++++++++++++++++++ src/11-bootstrap/README.md | 17 ++- src/11-bootstrap/bootstrap.bpf.c | 224 +++++++++++++++---------------- src/11-bootstrap/bootstrap.c | 173 ++++++++++++++++++++++++ src/11-bootstrap/bootstrap.h | 38 +++--- src/12-profile/Makefile | 3 + src/12-profile/README.md | 2 +- 9 files changed, 479 insertions(+), 134 deletions(-) create mode 100644 src/11-bootstrap/Makefile create mode 100644 src/11-bootstrap/bootstrap.c diff --git a/.gitignore b/.gitignore index 9483019..e9fd62d 100644 --- a/.gitignore +++ b/.gitignore @@ -51,3 +51,16 @@ book Module.symvers Mkfile.old dkms.conf + +.output +src/11-bootstrap/bootstrap +/minimal +/minimal_legacy +/uprobe +/kprobe +/fentry +src/12-profile/profile +/usdt +/sockfilter +/tc +/ksyscall diff --git a/blazesym b/blazesym index 35abf6e..c57e6d6 160000 --- a/blazesym +++ b/blazesym @@ -1 +1 @@ -Subproject commit 35abf6e1cd6a035f7b476eeb8fb5cd49af31cd9b +Subproject commit c57e6d623b88340d500e2ab0b2700ec9e9d4f398 diff --git a/src/11-bootstrap/Makefile b/src/11-bootstrap/Makefile new file mode 100644 index 0000000..fa2df33 --- /dev/null +++ b/src/11-bootstrap/Makefile @@ -0,0 +1,141 @@ +# SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) +OUTPUT := .output +CLANG ?= clang +LIBBPF_SRC := $(abspath ../../libbpf/src) +BPFTOOL_SRC := $(abspath ../../bpftool/src) +LIBBPF_OBJ := $(abspath $(OUTPUT)/libbpf.a) +BPFTOOL_OUTPUT ?= $(abspath $(OUTPUT)/bpftool) +BPFTOOL ?= $(BPFTOOL_OUTPUT)/bootstrap/bpftool +LIBBLAZESYM_SRC := $(abspath ../../blazesym/) +LIBBLAZESYM_OBJ := $(abspath $(OUTPUT)/libblazesym.a) +LIBBLAZESYM_HEADER := $(abspath $(OUTPUT)/blazesym.h) +ARCH ?= $(shell uname -m | sed 's/x86_64/x86/' \ + | sed 's/arm.*/arm/' \ + | sed 's/aarch64/arm64/' \ + | sed 's/ppc64le/powerpc/' \ + | sed 's/mips.*/mips/' \ + | sed 's/riscv64/riscv/' \ + | sed 's/loongarch64/loongarch/') +VMLINUX := ../../vmlinux/$(ARCH)/vmlinux.h +# Use our own libbpf API headers and Linux UAPI headers distributed with +# libbpf to avoid dependency on system-wide headers, which could be missing or +# outdated +INCLUDES := -I$(OUTPUT) -I../../libbpf/include/uapi -I$(dir $(VMLINUX)) +CFLAGS := -g -Wall +ALL_LDFLAGS := $(LDFLAGS) $(EXTRA_LDFLAGS) + +APPS = # minimal minimal_legacy bootstrap uprobe kprobe fentry usdt sockfilter tc ksyscall + +CARGO ?= $(shell which cargo) +ifeq ($(strip $(CARGO)),) +BZS_APPS := +else +BZS_APPS := profile +APPS += $(BZS_APPS) +# Required by libblazesym +ALL_LDFLAGS += -lrt -ldl -lpthread -lm +endif + +# Get Clang's default includes on this system. We'll explicitly add these dirs +# to the includes list when compiling with `-target bpf` because otherwise some +# architecture-specific dirs will be "missing" on some architectures/distros - +# headers such as asm/types.h, asm/byteorder.h, asm/socket.h, asm/sockios.h, +# sys/cdefs.h etc. might be missing. +# +# Use '-idirafter': Don't interfere with include mechanics except where the +# build would have failed anyways. +CLANG_BPF_SYS_INCLUDES ?= $(shell $(CLANG) -v -E - &1 \ + | sed -n '/<...> search starts here:/,/End of search list./{ s| \(/.*\)|-idirafter \1|p }') + +ifeq ($(V),1) + Q = + msg = +else + Q = @ + msg = @printf ' %-8s %s%s\n' \ + "$(1)" \ + "$(patsubst $(abspath $(OUTPUT))/%,%,$(2))" \ + "$(if $(3), $(3))"; + MAKEFLAGS += --no-print-directory +endif + +define allow-override + $(if $(or $(findstring environment,$(origin $(1))),\ + $(findstring command line,$(origin $(1)))),,\ + $(eval $(1) = $(2))) +endef + +$(call allow-override,CC,$(CROSS_COMPILE)cc) +$(call allow-override,LD,$(CROSS_COMPILE)ld) + +.PHONY: all +all: $(APPS) + +.PHONY: clean +clean: + $(call msg,CLEAN) + $(Q)rm -rf $(OUTPUT) $(APPS) + +$(OUTPUT) $(OUTPUT)/libbpf $(BPFTOOL_OUTPUT): + $(call msg,MKDIR,$@) + $(Q)mkdir -p $@ + +# Build libbpf +$(LIBBPF_OBJ): $(wildcard $(LIBBPF_SRC)/*.[ch] $(LIBBPF_SRC)/Makefile) | $(OUTPUT)/libbpf + $(call msg,LIB,$@) + $(Q)$(MAKE) -C $(LIBBPF_SRC) BUILD_STATIC_ONLY=1 \ + OBJDIR=$(dir $@)/libbpf DESTDIR=$(dir $@) \ + INCLUDEDIR= LIBDIR= UAPIDIR= \ + install + +# Build bpftool +$(BPFTOOL): | $(BPFTOOL_OUTPUT) + $(call msg,BPFTOOL,$@) + $(Q)$(MAKE) ARCH= CROSS_COMPILE= OUTPUT=$(BPFTOOL_OUTPUT)/ -C $(BPFTOOL_SRC) bootstrap + + +$(LIBBLAZESYM_SRC)/target/release/libblazesym.a:: + $(Q)cd $(LIBBLAZESYM_SRC) && $(CARGO) build --features=cheader,dont-generate-test-files --release + +$(LIBBLAZESYM_OBJ): $(LIBBLAZESYM_SRC)/target/release/libblazesym.a | $(OUTPUT) + $(call msg,LIB, $@) + $(Q)cp $(LIBBLAZESYM_SRC)/target/release/libblazesym.a $@ + +$(LIBBLAZESYM_HEADER): $(LIBBLAZESYM_SRC)/target/release/libblazesym.a | $(OUTPUT) + $(call msg,LIB,$@) + $(Q)cp $(LIBBLAZESYM_SRC)/target/release/blazesym.h $@ + +# Build BPF code +$(OUTPUT)/%.bpf.o: %.bpf.c $(LIBBPF_OBJ) $(wildcard %.h) $(VMLINUX) | $(OUTPUT) $(BPFTOOL) + $(call msg,BPF,$@) + $(Q)$(CLANG) -g -O2 -target bpf -D__TARGET_ARCH_$(ARCH) \ + $(INCLUDES) $(CLANG_BPF_SYS_INCLUDES) \ + -c $(filter %.c,$^) -o $(patsubst %.bpf.o,%.tmp.bpf.o,$@) + $(Q)$(BPFTOOL) gen object $@ $(patsubst %.bpf.o,%.tmp.bpf.o,$@) + +# Generate BPF skeletons +$(OUTPUT)/%.skel.h: $(OUTPUT)/%.bpf.o | $(OUTPUT) $(BPFTOOL) + $(call msg,GEN-SKEL,$@) + $(Q)$(BPFTOOL) gen skeleton $< > $@ + +# Build user-space code +$(patsubst %,$(OUTPUT)/%.o,$(APPS)): %.o: %.skel.h + +$(OUTPUT)/%.o: %.c $(wildcard %.h) | $(OUTPUT) + $(call msg,CC,$@) + $(Q)$(CC) $(CFLAGS) $(INCLUDES) -c $(filter %.c,$^) -o $@ + +$(patsubst %,$(OUTPUT)/%.o,$(BZS_APPS)): $(LIBBLAZESYM_HEADER) + +$(BZS_APPS): $(LIBBLAZESYM_OBJ) + +# Build application binary +$(APPS): %: $(OUTPUT)/%.o $(LIBBPF_OBJ) | $(OUTPUT) + $(call msg,BINARY,$@) + $(Q)$(CC) $(CFLAGS) $^ $(ALL_LDFLAGS) -lelf -lz -o $@ + +# delete failed targets +.DELETE_ON_ERROR: + +# keep intermediate (.skel.h, .bpf.o, etc) targets +.SECONDARY: diff --git a/src/11-bootstrap/README.md b/src/11-bootstrap/README.md index fc48985..cbad360 100644 --- a/src/11-bootstrap/README.md +++ b/src/11-bootstrap/README.md @@ -151,6 +151,22 @@ int handle_exit(struct trace_event_raw_sched_process_template* ctx) 最后，主函数调用bpf_ringbuf_poll来轮询BPF ringbuf，并在接收到新的事件时处理该事件。这个函数会持续运行，直到全局标志exiting被设置为true，此时它会清理资源并退出。 +## Install Dependencies + +You will need `clang`, `libelf` and `zlib` to build the examples, package names may vary across distros. + +On Ubuntu/Debian, you need: +```shell +$ apt install clang libelf1 libelf-dev zlib1g-dev +``` + +On CentOS/Fedora, you need: + +```shell +$ dnf install clang elfutils-libelf elfutils-libelf-devel zlib-devel +``` + +## 编译运行 编译运行上述代码： @@ -162,7 +178,6 @@ $ sudo ecli run package.json Runing eBPF program... ``` - ## 总结 这是一个使用BPF的C程序，用于跟踪进程的启动和退出事件，并显示有关这些事件的信息。它通过使用argp API来解析命令行参数，并使用BPF地图存储进程的信息，包括进程的PID和执行文件的文件名。程序还使用了SEC函数来附加BPF程序，以监视进程的执行和退出事件。最后，程序在终端中打印出启动和退出的进程信息。 diff --git a/src/11-bootstrap/bootstrap.bpf.c b/src/11-bootstrap/bootstrap.bpf.c index d0860c0..54e33e7 100644 --- a/src/11-bootstrap/bootstrap.bpf.c +++ b/src/11-bootstrap/bootstrap.bpf.c @@ -1,112 +1,112 @@ -// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause -/* Copyright (c) 2020 Facebook */ -#include "vmlinux.h" -#include -#include -#include -#include "bootstrap.h" - -char LICENSE[] SEC("license") = "Dual BSD/GPL"; - -struct { - __uint(type, BPF_MAP_TYPE_HASH); - __uint(max_entries, 8192); - __type(key, pid_t); - __type(value, u64); -} exec_start SEC(".maps"); - -struct { - __uint(type, BPF_MAP_TYPE_RINGBUF); - __uint(max_entries, 256 * 1024); -} rb SEC(".maps"); - -const volatile unsigned long long min_duration_ns = 0; - -SEC("tp/sched/sched_process_exec") -int handle_exec(struct trace_event_raw_sched_process_exec *ctx) -{ - struct task_struct *task; - unsigned fname_off; - struct event *e; - pid_t pid; - u64 ts; - - /* remember time exec() was executed for this PID */ - pid = bpf_get_current_pid_tgid() >> 32; - ts = bpf_ktime_get_ns(); - bpf_map_update_elem(&exec_start, &pid, &ts, BPF_ANY); - - /* don't emit exec events when minimum duration is specified */ - if (min_duration_ns) - return 0; - - /* reserve sample from BPF ringbuf */ - e = bpf_ringbuf_reserve(&rb, sizeof(*e), 0); - if (!e) - return 0; - - /* fill out the sample with data */ - task = (struct task_struct *)bpf_get_current_task(); - - e->exit_event = false; - e->pid = pid; - e->ppid = BPF_CORE_READ(task, real_parent, tgid); - bpf_get_current_comm(&e->comm, sizeof(e->comm)); - - fname_off = ctx->__data_loc_filename & 0xFFFF; - bpf_probe_read_str(&e->filename, sizeof(e->filename), (void *)ctx + fname_off); - - /* successfully submit it to user-space for post-processing */ - bpf_ringbuf_submit(e, 0); - return 0; -} - -SEC("tp/sched/sched_process_exit") -int handle_exit(struct trace_event_raw_sched_process_template* ctx) -{ - struct task_struct *task; - struct event *e; - pid_t pid, tid; - u64 id, ts, *start_ts, duration_ns = 0; - - /* get PID and TID of exiting thread/process */ - id = bpf_get_current_pid_tgid(); - pid = id >> 32; - tid = (u32)id; - - /* ignore thread exits */ - if (pid != tid) - return 0; - - /* if we recorded start of the process, calculate lifetime duration */ - start_ts = bpf_map_lookup_elem(&exec_start, &pid); - if (start_ts) - duration_ns = bpf_ktime_get_ns() - *start_ts; - else if (min_duration_ns) - return 0; - bpf_map_delete_elem(&exec_start, &pid); - - /* if process didn't live long enough, return early */ - if (min_duration_ns && duration_ns < min_duration_ns) - return 0; - - /* reserve sample from BPF ringbuf */ - e = bpf_ringbuf_reserve(&rb, sizeof(*e), 0); - if (!e) - return 0; - - /* fill out the sample with data */ - task = (struct task_struct *)bpf_get_current_task(); - - e->exit_event = true; - e->duration_ns = duration_ns; - e->pid = pid; - e->ppid = BPF_CORE_READ(task, real_parent, tgid); - e->exit_code = (BPF_CORE_READ(task, exit_code) >> 8) & 0xff; - bpf_get_current_comm(&e->comm, sizeof(e->comm)); - - /* send data to user-space for post-processing */ - bpf_ringbuf_submit(e, 0); - return 0; -} - +// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause +/* Copyright (c) 2020 Facebook */ +#include "vmlinux.h" +#include +#include +#include +#include "bootstrap.h" + +char LICENSE[] SEC("license") = "Dual BSD/GPL"; + +struct { + __uint(type, BPF_MAP_TYPE_HASH); + __uint(max_entries, 8192); + __type(key, pid_t); + __type(value, u64); +} exec_start SEC(".maps"); + +struct { + __uint(type, BPF_MAP_TYPE_RINGBUF); + __uint(max_entries, 256 * 1024); +} rb SEC(".maps"); + +const volatile unsigned long long min_duration_ns = 0; + +SEC("tp/sched/sched_process_exec") +int handle_exec(struct trace_event_raw_sched_process_exec *ctx) +{ + struct task_struct *task; + unsigned fname_off; + struct event *e; + pid_t pid; + u64 ts; + + /* remember time exec() was executed for this PID */ + pid = bpf_get_current_pid_tgid() >> 32; + ts = bpf_ktime_get_ns(); + bpf_map_update_elem(&exec_start, &pid, &ts, BPF_ANY); + + /* don't emit exec events when minimum duration is specified */ + if (min_duration_ns) + return 0; + + /* reserve sample from BPF ringbuf */ + e = bpf_ringbuf_reserve(&rb, sizeof(*e), 0); + if (!e) + return 0; + + /* fill out the sample with data */ + task = (struct task_struct *)bpf_get_current_task(); + + e->exit_event = false; + e->pid = pid; + e->ppid = BPF_CORE_READ(task, real_parent, tgid); + bpf_get_current_comm(&e->comm, sizeof(e->comm)); + + fname_off = ctx->__data_loc_filename & 0xFFFF; + bpf_probe_read_str(&e->filename, sizeof(e->filename), (void *)ctx + fname_off); + + /* successfully submit it to user-space for post-processing */ + bpf_ringbuf_submit(e, 0); + return 0; +} + +SEC("tp/sched/sched_process_exit") +int handle_exit(struct trace_event_raw_sched_process_template* ctx) +{ + struct task_struct *task; + struct event *e; + pid_t pid, tid; + u64 id, ts, *start_ts, duration_ns = 0; + + /* get PID and TID of exiting thread/process */ + id = bpf_get_current_pid_tgid(); + pid = id >> 32; + tid = (u32)id; + + /* ignore thread exits */ + if (pid != tid) + return 0; + + /* if we recorded start of the process, calculate lifetime duration */ + start_ts = bpf_map_lookup_elem(&exec_start, &pid); + if (start_ts) + duration_ns = bpf_ktime_get_ns() - *start_ts; + else if (min_duration_ns) + return 0; + bpf_map_delete_elem(&exec_start, &pid); + + /* if process didn't live long enough, return early */ + if (min_duration_ns && duration_ns < min_duration_ns) + return 0; + + /* reserve sample from BPF ringbuf */ + e = bpf_ringbuf_reserve(&rb, sizeof(*e), 0); + if (!e) + return 0; + + /* fill out the sample with data */ + task = (struct task_struct *)bpf_get_current_task(); + + e->exit_event = true; + e->duration_ns = duration_ns; + e->pid = pid; + e->ppid = BPF_CORE_READ(task, real_parent, tgid); + e->exit_code = (BPF_CORE_READ(task, exit_code) >> 8) & 0xff; + bpf_get_current_comm(&e->comm, sizeof(e->comm)); + + /* send data to user-space for post-processing */ + bpf_ringbuf_submit(e, 0); + return 0; +} + diff --git a/src/11-bootstrap/bootstrap.c b/src/11-bootstrap/bootstrap.c new file mode 100644 index 0000000..f023df6a --- /dev/null +++ b/src/11-bootstrap/bootstrap.c @@ -0,0 +1,173 @@ +// SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) +/* Copyright (c) 2020 Facebook */ +#include +#include +#include +#include +#include +#include +#include "bootstrap.h" +#include "bootstrap.skel.h" + +static struct env { + bool verbose; + long min_duration_ms; +} env; + +const char *argp_program_version = "bootstrap 0.0"; +const char *argp_program_bug_address = ""; +const char argp_program_doc[] = +"BPF bootstrap demo application.\n" +"\n" +"It traces process start and exits and shows associated \n" +"information (filename, process duration, PID and PPID, etc).\n" +"\n" +"USAGE: ./bootstrap [-d ] [-v]\n"; + +static const struct argp_option opts[] = { + { "verbose", 'v', NULL, 0, "Verbose debug output" }, + { "duration", 'd', "DURATION-MS", 0, "Minimum process duration (ms) to report" }, + {}, +}; + +static error_t parse_arg(int key, char *arg, struct argp_state *state) +{ + switch (key) { + case 'v': + env.verbose = true; + break; + case 'd': + errno = 0; + env.min_duration_ms = strtol(arg, NULL, 10); + if (errno || env.min_duration_ms <= 0) { + fprintf(stderr, "Invalid duration: %s\n", arg); + argp_usage(state); + } + break; + case ARGP_KEY_ARG: + argp_usage(state); + break; + default: + return ARGP_ERR_UNKNOWN; + } + return 0; +} + +static const struct argp argp = { + .options = opts, + .parser = parse_arg, + .doc = argp_program_doc, +}; + +static int libbpf_print_fn(enum libbpf_print_level level, const char *format, va_list args) +{ + if (level == LIBBPF_DEBUG && !env.verbose) + return 0; + return vfprintf(stderr, format, args); +} + +static volatile bool exiting = false; + +static void sig_handler(int sig) +{ + exiting = true; +} + +static int handle_event(void *ctx, void *data, size_t data_sz) +{ + const struct event *e = data; + struct tm *tm; + char ts[32]; + time_t t; + + time(&t); + tm = localtime(&t); + strftime(ts, sizeof(ts), "%H:%M:%S", tm); + + if (e->exit_event) { + printf("%-8s %-5s %-16s %-7d %-7d [%u]", + ts, "EXIT", e->comm, e->pid, e->ppid, e->exit_code); + if (e->duration_ns) + printf(" (%llums)", e->duration_ns / 1000000); + printf("\n"); + } else { + printf("%-8s %-5s %-16s %-7d %-7d %s\n", + ts, "EXEC", e->comm, e->pid, e->ppid, e->filename); + } + + return 0; +} + +int main(int argc, char **argv) +{ + struct ring_buffer *rb = NULL; + struct bootstrap_bpf *skel; + int err; + + /* Parse command line arguments */ + err = argp_parse(&argp, argc, argv, 0, NULL, NULL); + if (err) + return err; + + /* Set up libbpf errors and debug info callback */ + libbpf_set_print(libbpf_print_fn); + + /* Cleaner handling of Ctrl-C */ + signal(SIGINT, sig_handler); + signal(SIGTERM, sig_handler); + + /* Load and verify BPF application */ + skel = bootstrap_bpf__open(); + if (!skel) { + fprintf(stderr, "Failed to open and load BPF skeleton\n"); + return 1; + } + + /* Parameterize BPF code with minimum duration parameter */ + skel->rodata->min_duration_ns = env.min_duration_ms * 1000000ULL; + + /* Load & verify BPF programs */ + err = bootstrap_bpf__load(skel); + if (err) { + fprintf(stderr, "Failed to load and verify BPF skeleton\n"); + goto cleanup; + } + + /* Attach tracepoints */ + err = bootstrap_bpf__attach(skel); + if (err) { + fprintf(stderr, "Failed to attach BPF skeleton\n"); + goto cleanup; + } + + /* Set up ring buffer polling */ + rb = ring_buffer__new(bpf_map__fd(skel->maps.rb), handle_event, NULL, NULL); + if (!rb) { + err = -1; + fprintf(stderr, "Failed to create ring buffer\n"); + goto cleanup; + } + + /* Process events */ + printf("%-8s %-5s %-16s %-7s %-7s %s\n", + "TIME", "EVENT", "COMM", "PID", "PPID", "FILENAME/EXIT CODE"); + while (!exiting) { + err = ring_buffer__poll(rb, 100 /* timeout, ms */); + /* Ctrl-C will cause -EINTR */ + if (err == -EINTR) { + err = 0; + break; + } + if (err < 0) { + printf("Error polling perf buffer: %d\n", err); + break; + } + } + +cleanup: + /* Clean up */ + ring_buffer__free(rb); + bootstrap_bpf__destroy(skel); + + return err < 0 ? -err : 0; +} diff --git a/src/11-bootstrap/bootstrap.h b/src/11-bootstrap/bootstrap.h index b49e022..34e765a 100644 --- a/src/11-bootstrap/bootstrap.h +++ b/src/11-bootstrap/bootstrap.h @@ -1,19 +1,19 @@ -/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */ -/* Copyright (c) 2020 Facebook */ -#ifndef __BOOTSTRAP_H -#define __BOOTSTRAP_H - -#define TASK_COMM_LEN 16 -#define MAX_FILENAME_LEN 127 - -struct event { - int pid; - int ppid; - unsigned exit_code; - unsigned long long duration_ns; - char comm[TASK_COMM_LEN]; - char filename[MAX_FILENAME_LEN]; - bool exit_event; -}; - -#endif /* __BOOTSTRAP_H */ +/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */ +/* Copyright (c) 2020 Facebook */ +#ifndef __BOOTSTRAP_H +#define __BOOTSTRAP_H + +#define TASK_COMM_LEN 16 +#define MAX_FILENAME_LEN 127 + +struct event { + int pid; + int ppid; + unsigned exit_code; + unsigned long long duration_ns; + char comm[TASK_COMM_LEN]; + char filename[MAX_FILENAME_LEN]; + bool exit_event; +}; + +#endif /* __BOOTSTRAP_H */ diff --git a/src/12-profile/Makefile b/src/12-profile/Makefile index 601d82e..fa2df33 100644 --- a/src/12-profile/Makefile +++ b/src/12-profile/Makefile @@ -6,6 +6,9 @@ BPFTOOL_SRC := $(abspath ../../bpftool/src) LIBBPF_OBJ := $(abspath $(OUTPUT)/libbpf.a) BPFTOOL_OUTPUT ?= $(abspath $(OUTPUT)/bpftool) BPFTOOL ?= $(BPFTOOL_OUTPUT)/bootstrap/bpftool +LIBBLAZESYM_SRC := $(abspath ../../blazesym/) +LIBBLAZESYM_OBJ := $(abspath $(OUTPUT)/libblazesym.a) +LIBBLAZESYM_HEADER := $(abspath $(OUTPUT)/blazesym.h) ARCH ?= $(shell uname -m | sed 's/x86_64/x86/' \ | sed 's/arm.*/arm/' \ | sed 's/aarch64/arm64/' \ diff --git a/src/12-profile/README.md b/src/12-profile/README.md index 4147cd6..aef12de 100644 --- a/src/12-profile/README.md +++ b/src/12-profile/README.md @@ -1,4 +1,4 @@ -# eBPF 入门实践教程：编写 eBPF 程序 profile 进行性能分析 +# eBPF 入门实践教程：使用 eBPF 程序 profile 进行性能分析 ## 背景