You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
Michael Schubert 9287508f53
Merge pull request #280 from kinvolk/schu/readme-add-github-actions-ci-badge
2 weeks ago
.github/workflows Run integration tests through GitHub actions 3 weeks ago
Documentation Documentation: introduce a document about object pinning 4 years ago
bcc Use exact width integer as second argument type to lostCallback. Fix #272. 1 month ago
elf Merge pull request #248 from kinvolk/mauricio/fix-closing-tracepoint-programs 9 months ago
examples add lost events channel 1 year ago
pkg Fix bpf_attr initialization 1 year ago
tests Fix compilation in older kernels 10 months ago
CONTRIBUTING.md Add CONTRIBUTING.md 9 months ago
COPYRIGHT.txt Basic PerfMap implementation 4 years ago
LICENSE-bpf.txt Add licensing information for kernel header 3 years ago
LICENSE.txt Add initial port of bpf module impl from iomodules/hover 4 years ago
README.md README: add GitHub actions CI badge 2 weeks ago
bpf.go Add elf support 4 years ago
bpf_test.go Fix compilation in older kernels 10 months ago
go.mod Add go.mod file 3 weeks ago

README.md

gobpf

GoDoc CI

This repository provides go bindings for the bcc framework as well as low-level routines to load and use eBPF programs from .elf files.

Input and contributions are very welcome.

We recommend vendoring gobpf and pinning its version as the API is regularly changing following bcc and Linux updates and releases.

Requirements

eBPF requires a recent Linux kernel. A good feature list can be found here: https://github.com/iovisor/bcc/blob/master/docs/kernel-versions.md

github.com/iovisor/gobpf/bcc

Install the latest released version of libbcc (either using a package manager or by building from source).

github.com/iovisor/gobpf/elf

Building ELF Object Files

To build ELF object files for use with the elf package, you must use specific sections (SEC("...")). The following are currently supported:

  • kprobe/...
  • cgroup/skb
  • cgroup/sock
  • maps/...
  • socket...
  • tracepoint...
  • uprobe/...
  • uretprobe/...
  • xdp/...

Map definitions must correspond to bpf_map_def from the elf package. Otherwise, you will encounter an error like only one map with size 280 bytes allowed per section (check bpf_map_def).

The Cilium BPF docs contain helpful info for using clang/LLVM to compile programs into elf object files: https://cilium.readthedocs.io/en/latest/bpf/#llvm

See tests/dummy.c for a minimal dummy and https://github.com/weaveworks/tcptracer-bpf for a real world example.

Examples

Sample code can be found in the examples/ directory. Examples can be run as follows:

sudo -E go run examples/bcc/perf/perf.go

Tests

go test -tags integration -v ./...