Skip to content
Go bindings for creating BPF programs.
Go C Shell
Branch: master
Clone or download
schu Merge pull request #192 from sfluor/sami/fix-version-retrieving-debian
fix: Debian version regex can fail on some debian versions if the commit sha is appended to the version
Latest commit e72091e Dec 19, 2019
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
Documentation Documentation: introduce a document about object pinning Sep 1, 2017
bcc bcc: update bpf_module_create_c_from_string for bcc 0.11.0 (fixes #202) Oct 17, 2019
elf Merge pull request #192 from sfluor/sami/fix-version-retrieving-debian Dec 19, 2019
examples bcc: update bpf_attach_kprobe with new param maxactive Mar 11, 2019
pkg
tests
COPYRIGHT.txt
LICENSE-bpf.txt Add licensing information for kernel header Aug 22, 2018
LICENSE.txt
README.md
bpf.go Add elf support Dec 20, 2016
bpf_test.go elf: XDP tests Nov 13, 2019
semaphore.sh

README.md

gobpf

Build Status GoDoc

This repository provides go bindings for the bcc framework as well as low-level routines to load and use eBPF programs from .elf files.

gobpf is at an early stage but is usable nonetheless. Input and contributions are very welcome.

We recommend vendoring gobpf and pinning its version as the API is likely to change during development.

Requirements

eBPF requires a recent Linux kernel. A good feature list can be found here: https://github.com/iovisor/bcc/blob/master/docs/kernel-versions.md

github.com/iovisor/gobpf/bcc

Install the latest released version of libbcc (either using a package manager or by building from source).

github.com/iovisor/gobpf/elf

Building ELF Object Files

To build ELF object files for use with the elf package, you must use specific sections (SEC("...")). The following are currently supported:

  • kprobe/...
  • cgroup/skb
  • cgroup/sock
  • maps/...
  • socket...
  • tracepoint...
  • uprobe/...
  • uretprobe/...
  • xdp/...

Map definitions must correspond to bpf_map_def from the elf package. Otherwise, you will encounter an error like only one map with size 280 bytes allowed per section (check bpf_map_def).

The Cilium BPF docs contain helpful info for using clang/LLVM to compile programs into elf object files: https://cilium.readthedocs.io/en/latest/bpf/#llvm

See tests/dummy.c for a minimal dummy and https://github.com/weaveworks/tcptracer-bpf for a real world example.

Examples

Sample code can be found in the examples/ directory. Examples can be run as follows:

sudo -E go run examples/bcc/perf/perf.go

Tests

The semaphore.sh script can be used to run the tests in rkt stage1-kvm containers on different kernel versions. To run all tests on the host system, use go test as follows:

go test -tags integration -v ./...
You can’t perform that action at this time.