Go bindings for creating BPF programs.
Go C Shell
Switch branches/tags
Nothing to show
Clone or download
schu Merge pull request #135 from Stantheman/master
Fix incompatible types in bpf_attach_perf_event
Latest commit 790ac90 Jul 16, 2018



Build Status GoDoc

This repository provides go bindings for the bcc framework as well as low-level routines to load and use eBPF programs from .elf files.

gobpf is in early stage, but usable. Input and contributions are very much welcome.

We recommend to vendor gobpf and pin its version as the API probably undergoes change during development.


eBPF requires a recent Linux kernel. A good feature list can be found here: https://github.com/iovisor/bcc/blob/master/docs/kernel-versions.md


Install the latest released version of libbcc (either by package or source).


Building ELF object files

To build ELF object files for usage with the elf package, you must use distinct sections (SEC("...")). Currently supported are:

  • kprobe/...
  • cgroup/skb
  • cgroup/sock
  • maps/...
  • socket...
  • tracepoint...

Map definitions must correspond to bpf_map_def from elf.go Otherwise you will encounter an error like only one map with size 280 bytes allowed per section (check bpf_map_def).

The Cilium BPF docs contain helpful info for using clang/LLVM to compile programs into elf object files: https://cilium.readthedocs.io/en/latest/bpf/#llvm

See tests/dummy.c for a minimal dummy and https://github.com/weaveworks/tcptracer-bpf for a real world example.


Example code can be found in the examples/ directory, e.g.

sudo -E go run examples/bcc/perf/perf.go


The semaphore.sh script can be used to run the tests in rkt stage1-kvm containers on different kernel versions. To run all tests on the host system, use go test as follows:

go test -tags integration -v ./...