A thorough introduction to eBPF

Posted Dec 13, 2017 16:16 UTC (Wed) by bfields (subscriber, #19510)
Parent article: A thorough introduction to eBPF

"However, all of the sample code suffers from one major drawback: you need to compile your eBPF program from within the kernel source tree. Luckily, the BCC project was created to solve this problem. It includes a complete toolchain for writing eBPF programs and loading them without linking against the kernel source tree."

Is this true? Last I tried to use bcc on a test machine, I got something like:

$ /usr/share/bcc/tools/stackcount ...
chdir(/lib/modules/4.15.0-rc1-29619/build): No such file or directory
Failed to compile BPF module

until I'd copied my build tree to my test machine and pointed that symlink at it.

A thorough introduction to eBPF

Posted Dec 18, 2017 18:37 UTC (Mon) by Manozco (subscriber, #100165) [Link] (1 responses)

On Ubuntu at least, I just need the headers package (otherwise I have the same error than you)

A thorough introduction to eBPF

Posted Dec 19, 2017 16:03 UTC (Tue) by bfields (subscriber, #19510) [Link]

Thanks, that's interesting. Looking at the bcc documentation on the Ubuntu package database.... It looks like the headers package you need on Ubuntu is linux-headers-$(uname -r), which contains the entire kernel source tree, and is specific to the running kernel.