Skip to main content

Build with eBPF Plug-in

The eBPF (extended Berkeley Packet Filter) plug-in provides an interface to execute eBPF programs in WasmEdge. It allows WasmEdge to execute eBPF code that is compiled into WebAssembly format. This guide will walk you through the steps to build WasmEdge with the eBPF plug-in.

Build the eBPF Plug-in​

Prerequisites​

Before building the eBPF plug-in, ensure that you have the following installed:

Build steps​

To build the eBPF plug-in, run the following commands at the root of the WasmEdge project:

cmake -DWASMEDGE_PLUGIN_WASM_BPF:BOOL=TRUE -B ./build -G "Unix Makefiles"
cmake --build ./build

Make sure to set WASMEDGE_PLUGIN_WASM_BPF to TRUE in the command line. This toggle controls the build of the wasm_bpf plug-in.

Use the eBPF Plug-in​

Download Examples​

You can download examples of wasm-bpf programs from here:

wget https://eunomia-bpf.github.io/wasm-bpf/examples/runqlat/runqlat.wasm

Build Examples​

You can also build examples of wasm-bpf programs from the wasm-bpf repository:

  1. Install the wasi-sdk if you don't have it:

    wget https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-17/wasi-sdk-17.0-linux.tar.gz
    tar -zxf wasi-sdk-17.0-linux.tar.gz
    sudo mkdir -p /opt/wasi-sdk/ && sudo mv wasi-sdk-17.0/* /opt/wasi-sdk/

  2. Build the examples:

    git clone https://github.com/eunomia-bpf/wasm-bpf
    cd wasm-bpf/examples
    git submodule update --init --recursive

  3. For example, to build the execve example:

cd execve && make

The available examples are:

bootstrap  execve  go-execve  go-lsm  lsm   opensnoop runqlat  rust-bootstrap  sockfilter  sockops

Run Examples​

After building, you can find the plug-in at ./build/plugins/wasm_bpf/libwasmedgePluginWasmBpf.so and the WasmEdge CLI tool at ./build/tools/wasmedge/wasmedge.

To run the examples, set WASMEDGE_PLUGIN_PATH=./build/plugins/wasm_bpf/ and run wasmedge:

WASMEDGE_PLUGIN_PATH=./build/plugins/wasm_bpf/ ./build/tools/wasmedge/wasmedge execve.wasm

Adjust WASMEDGE_PLUGIN_PATH according to your build directory of the plug-in.

Host Functions​

This plug-in adds six host functions that give your Wasm application access to eBPF. All of these functions are in the module wasm_bpf, if you loaded this plug-in:

/// lookup a bpf map fd by name.
i32 wasm_bpf_map_fd_by_name(u64 obj, u32 name);
/// detach and close a bpf program.
i32 wasm_close_bpf_object(u64 obj);
/// CO-RE load a bpf object into the kernel.
u64 wasm_load_bpf_object(u32 obj_buf, u32 obj_buf_sz);
/// attach a bpf program to a kernel hook.
i32 wasm_attach_bpf_program(u64 obj, u32 name,
                            u32 attach_target);
/// poll a bpf buffer, and call a wasm callback indicated by sample_func.
/// the first time to call this function will open and create a bpf buffer.
i32 wasm_bpf_buffer_poll(u64 program, i32 fd, u32 sample_func,
                         u32 ctx, u32 data, i32 max_size,
                         i32 timeout_ms);
/// lookup, update, delete, and get_next_key operations on a bpf map.
i32 wasm_bpf_map_operate(u64 fd, i32 cmd, u32 key, u32 value,
                         u32 next_key, u64 flags);

For more information, you can refer to the GitHub repository.