ebpf-apps

eBPF sample apps based on BCC, libbpf and various language bindings.

Contents

• bcc-apps: eBPF samples with BCC.
  • bcc-apps/c: BCC samples with C binding.
  • bcc-apps/cpp: BCC samples with C++ binding.
  • bcc-apps/python: BCC samples with Python binding.
• bpf-apps: eBPF samples with libbpf and CO-RE.
• bpftrace: eBPF samples with bpftrace.
• go: eBPF samples with Go bindings.
• kernel: eBPF samples built with kernel source.
• rust: eBPF samples with Rust bindings.
• tools: Tools for eBPF (e.g. bpftool and faddr2line).
• chatgpt: generating eBPF programs with ChatGPT.

Pre-requisites

BCC

BCC and its development libraries should be installed.

Install from packages

Please follow INSTALL.md to see the detailed guides. For example, on Ubuntu or RHEL:

# Ubuntu
sudo apt-get install bpfcc-tools libbpfcc-dev linux-headers-$(uname -r)

# RHEL
sudo yum install bcc-tools bcc-devel

Install from source

Please follow INSTALL.md to see the detailed guides. For example, on Ubuntu 20.04+:

sudo apt install -y bison build-essential cmake flex git libedit-dev llvm-dev libclang-dev python zlib1g-dev libelf-dev libfl-dev python3-distutils

git clone https://github.com/iovisor/bcc.git
mkdir bcc/build; cd bcc/build
cmake ..
make
sudo make install
cmake -DPYTHON_CMD=python3 .. # build python3 binding
pushd src/python/
make
sudo make install
popd

libbpf with CO-RE

To use BTF and CO-RE, CONFIG_DEBUG_INFO_BTF=y and CONFIG_DEBUG_INFO_BTF_MODULES=y need to be enabled. If you don't want to rebuild the kernel, the following distos have enabled those options by default:

• Ubuntu 20.10+
• Fedora 31+
• RHEL 8.2+
• Debian 11+

And to build bpf applications, the following development tools should also be installed:

# Ubuntu
sudo apt-get install -y make clang llvm libelf-dev linux-tools-$(uname -r)

# RHEL
sudo yum install -y make clang llvm elfutils-libelf-devel bpftool

Useful Links

• 极客时间专栏《eBPF 核心技术与实战》
• eBPF.io
• Linux kernel BPF samples
• BPF and XDP Reference Guide
• XDP Hands-On Tutorial