I traced the bcc code and found that the LLVM IR code was actually generated. bcc supposed to convert the IR code into BPF bytecodes but there was no BPF bytecode generated. According to the MCJIT document(*), the code generation happens in finalizeObject()(**) but bcc got nothing after finalizeObject(). However, I found bcc never invoked MCJIT::finalizeObject because it uses the OrcMCJITReplacement. After removing setUseOrcMCJITReplacement(true) from bpf_module.cc(***), the BPF bytecode was generated now. The line of code was there since 2015 and never caused any problem before. I also tested bcc 0.4.0 with llvm 5.0 in a Gentoo system, and it worked without any modification. I guess something was wrong in OrcMCJITReplacement in our llvm4. (*) https://llvm.org/docs/MCJITDesignAndImplementation.html (**) https://github.com/iovisor/bcc/blob/v0.4.0/src/cc/bpf_module.cc#L611 (***) https://github.com/iovisor/bcc/blob/v0.4.0/src/cc/bpf_module.cc#L598