78 lines
2.9 KiB
Markdown
78 lines
2.9 KiB
Markdown
# eBPF
|
|
|
|
[](https://pkg.go.dev/github.com/cilium/ebpf)
|
|
|
|
|
|
|
|
eBPF is a pure Go library that provides utilities for loading, compiling, and
|
|
debugging eBPF programs. It has minimal external dependencies and is intended to
|
|
be used in long running processes.
|
|
|
|
The library is maintained by [Cloudflare](https://www.cloudflare.com) and
|
|
[Cilium](https://www.cilium.io).
|
|
|
|
See [ebpf.io](https://ebpf.io) for other projects from the eBPF ecosystem.
|
|
|
|
## Getting Started
|
|
|
|
A small collection of Go and eBPF programs that serve as examples for building
|
|
your own tools can be found under [examples/](examples/).
|
|
|
|
Contributions are highly encouraged, as they highlight certain use cases of
|
|
eBPF and the library, and help shape the future of the project.
|
|
|
|
## Getting Help
|
|
|
|
Please
|
|
[join](https://ebpf.io/slack) the
|
|
[#ebpf-go](https://cilium.slack.com/messages/ebpf-go) channel on Slack if you
|
|
have questions regarding the library.
|
|
|
|
## Packages
|
|
|
|
This library includes the following packages:
|
|
|
|
* [asm](https://pkg.go.dev/github.com/cilium/ebpf/asm) contains a basic
|
|
assembler, allowing you to write eBPF assembly instructions directly
|
|
within your Go code. (You don't need to use this if you prefer to write your eBPF program in C.)
|
|
* [cmd/bpf2go](https://pkg.go.dev/github.com/cilium/ebpf/cmd/bpf2go) allows
|
|
compiling and embedding eBPF programs written in C within Go code. As well as
|
|
compiling the C code, it auto-generates Go code for loading and manipulating
|
|
the eBPF program and map objects.
|
|
* [link](https://pkg.go.dev/github.com/cilium/ebpf/link) allows attaching eBPF
|
|
to various hooks
|
|
* [perf](https://pkg.go.dev/github.com/cilium/ebpf/perf) allows reading from a
|
|
`PERF_EVENT_ARRAY`
|
|
* [ringbuf](https://pkg.go.dev/github.com/cilium/ebpf/ringbuf) allows reading from a
|
|
`BPF_MAP_TYPE_RINGBUF` map
|
|
* [features](https://pkg.go.dev/github.com/cilium/ebpf/features) implements the equivalent
|
|
of `bpftool feature probe` for discovering BPF-related kernel features using native Go.
|
|
* [rlimit](https://pkg.go.dev/github.com/cilium/ebpf/rlimit) provides a convenient API to lift
|
|
the `RLIMIT_MEMLOCK` constraint on kernels before 5.11.
|
|
|
|
## Requirements
|
|
|
|
* A version of Go that is [supported by
|
|
upstream](https://golang.org/doc/devel/release.html#policy)
|
|
* Linux >= 4.9. CI is run against kernel.org LTS releases. 4.4 should work but is
|
|
not tested against.
|
|
|
|
## Regenerating Testdata
|
|
|
|
Run `make` in the root of this repository to rebuild testdata in all
|
|
subpackages. This requires Docker, as it relies on a standardized build
|
|
environment to keep the build output stable.
|
|
|
|
It is possible to regenerate data using Podman by overriding the `CONTAINER_*`
|
|
variables: `CONTAINER_ENGINE=podman CONTAINER_RUN_ARGS= make`.
|
|
|
|
The toolchain image build files are kept in [testdata/docker/](testdata/docker/).
|
|
|
|
## License
|
|
|
|
MIT
|
|
|
|
### eBPF Gopher
|
|
|
|
The eBPF honeygopher is based on the Go gopher designed by Renee French.
|