https://github.com/iovisor/gobpf

Go bindings for creating BPF programs.
https://github.com/iovisor/gobpf

Last synced: 4 days ago
JSON representation

Go bindings for creating BPF programs.

• Host: GitHub
• URL: https://github.com/iovisor/gobpf
• Owner: iovisor
• License: apache-2.0
• Created: 2016-11-18T18:27:13.000Z (about 8 years ago)
• Default Branch: master
• Last Pushed: 2023-08-31T05:47:21.000Z (over 1 year ago)
• Last Synced: 2025-01-21T16:04:49.285Z (11 days ago)
• Language: C
• Size: 503 KB
• Stars: 2,159
• Watchers: 55
• Forks: 314
• Open Issues: 85
• Metadata Files:
  • Readme: README.md
  • Contributing: CONTRIBUTING.md
  • License: LICENSE-bpf.txt

Awesome Lists containing this project

README

        
# gobpf

[![GoDoc](https://godoc.org/github.com/golang/gddo?status.svg)](http://godoc.org/github.com/iovisor/gobpf) [![CI](https://github.com/iovisor/gobpf/actions/workflows/ci.yml/badge.svg)](https://github.com/iovisor/gobpf/actions/workflows/ci.yml)

This repository provides go bindings for the [bcc framework](https://github.com/iovisor/bcc)

as well as low-level routines to load and use eBPF programs from .elf

files.

Input and contributions are very welcome.

We recommend vendoring gobpf and pinning its version as the API is regularly

changing following bcc and Linux updates and releases.

## Requirements

eBPF requires a recent Linux kernel. A good feature list can be found here:

https://github.com/iovisor/bcc/blob/master/docs/kernel-versions.md

### `github.com/iovisor/gobpf/bcc`

Install the latest released version of [libbcc](https://github.com/iovisor/bcc/blob/master/INSTALL.md)

(either using a package manager or by building from source).

### `github.com/iovisor/gobpf/elf`

#### Building ELF Object Files

To build ELF object files for use with the elf package, you must use specific

sections (`SEC("...")`). The following are currently supported:

* `kprobe/...`

* `cgroup/skb`

* `cgroup/sock`

* `maps/...`

* `socket...`

* `tracepoint...`

* `uprobe/...`

* `uretprobe/...`

* `xdp/...`

Map definitions must correspond to `bpf_map_def` from [the elf package](https://github.com/iovisor/gobpf/blob/master/elf/include/bpf_map.h).

Otherwise, you will encounter an error like `only one map with size 280 bytes allowed per section (check bpf_map_def)`.

The [Cilium](https://github.com/cilium/cilium) BPF docs contain helpful info

for using clang/LLVM to compile programs into elf object files:

https://cilium.readthedocs.io/en/latest/bpf/#llvm

See `tests/dummy.c` for a minimal dummy and https://github.com/weaveworks/tcptracer-bpf

for a real world example.

## Examples

Sample code can be found in the `examples/` directory. Examples can be run as

follows:

```

sudo -E go run examples/bcc/perf/perf.go

```

## Tests

```

go test -tags integration -v ./...

```