Skip to content
Go bindings for creating BPF programs.
Go C Shell
Branch: master
Clone or download
schu Merge pull request #192 from sfluor/sami/fix-version-retrieving-debian
fix: Debian version regex can fail on some debian versions if the commit sha is appended to the version
Latest commit e72091e Dec 19, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
Documentation Documentation: introduce a document about object pinning Sep 1, 2017
bcc bcc: update bpf_module_create_c_from_string for bcc 0.11.0 (fixes #202) Oct 17, 2019
elf Merge pull request #192 from sfluor/sami/fix-version-retrieving-debian Dec 19, 2019
examples bcc: update bpf_attach_kprobe with new param maxactive Mar 11, 2019
LICENSE-bpf.txt Add licensing information for kernel header Aug 22, 2018
bpf.go Add elf support Dec 20, 2016
bpf_test.go elf: XDP tests Nov 13, 2019


Build Status GoDoc

This repository provides go bindings for the bcc framework as well as low-level routines to load and use eBPF programs from .elf files.

gobpf is at an early stage but is usable nonetheless. Input and contributions are very welcome.

We recommend vendoring gobpf and pinning its version as the API is likely to change during development.


eBPF requires a recent Linux kernel. A good feature list can be found here:

Install the latest released version of libbcc (either using a package manager or by building from source).

Building ELF Object Files

To build ELF object files for use with the elf package, you must use specific sections (SEC("...")). The following are currently supported:

  • kprobe/...
  • cgroup/skb
  • cgroup/sock
  • maps/...
  • socket...
  • tracepoint...
  • uprobe/...
  • uretprobe/...
  • xdp/...

Map definitions must correspond to bpf_map_def from the elf package. Otherwise, you will encounter an error like only one map with size 280 bytes allowed per section (check bpf_map_def).

The Cilium BPF docs contain helpful info for using clang/LLVM to compile programs into elf object files:

See tests/dummy.c for a minimal dummy and for a real world example.


Sample code can be found in the examples/ directory. Examples can be run as follows:

sudo -E go run examples/bcc/perf/perf.go


The script can be used to run the tests in rkt stage1-kvm containers on different kernel versions. To run all tests on the host system, use go test as follows:

go test -tags integration -v ./...
You can’t perform that action at this time.