BranchesTags

Latest commit

History

1,725 Commits

Folders and files

NameName
Last commit message
Last commit date
.github
.github
asm
asm
btf
btf
cmd/bpf2go
cmd/bpf2go
docs
docs
examples
examples
features
features
internal
internal
link
link
perf
perf
ringbuf
ringbuf
rlimit
rlimit
testdata
testdata
.clang-format
.clang-format
.gitattributes
.gitattributes
.gitignore
.gitignore
.golangci.yaml
.golangci.yaml
.vimto.toml
.vimto.toml
CODEOWNERS
CODEOWNERS
CODE_OF_CONDUCT.md
CODE_OF_CONDUCT.md
CONTRIBUTING.md
CONTRIBUTING.md
LICENSE
LICENSE
MAINTAINERS.md
MAINTAINERS.md
Makefile
Makefile
README.md
README.md
attachtype_string.go
attachtype_string.go
collection.go
collection.go
collection_test.go
collection_test.go
cpu.go
cpu.go
cpu_test.go
cpu_test.go
doc.go
doc.go
elf_reader.go
elf_reader.go
elf_reader_test.go
elf_reader_test.go
elf_sections.go
elf_sections.go
example_sock_elf_test.go
example_sock_elf_test.go
example_sock_extract_dist_test.go
example_sock_extract_dist_test.go
fuzz_test.go
fuzz_test.go
go.mod
go.mod
go.sum
go.sum
helpers_test.go
helpers_test.go
info.go
info.go
info_test.go
info_test.go
linker.go
linker.go
linker_test.go
linker_test.go
map.go
map.go
map_test.go
map_test.go
marshaler_example_test.go
marshaler_example_test.go
marshalers.go
marshalers.go
marshalers_test.go
marshalers_test.go
netlify.toml
netlify.toml
prog.go
prog.go
prog_test.go
prog_test.go
syscalls.go
syscalls.go
syscalls_test.go
syscalls_test.go
types.go
types.go
types_string.go
types_string.go

Repository files navigation

eBPF

PkgGoDev

HoneyGopher

ebpf-go is a pure Go library that provides utilities for loading, compiling, and debugging eBPF programs. It has minimal external dependencies and is intended to be used in long running processes.

See ebpf.io for complementary projects from the wider eBPF ecosystem.

Getting Started

Please take a look at our Getting Started guide.

Contributions are highly encouraged, as they highlight certain use cases of eBPF and the library, and help shape the future of the project.

Getting Help

The community actively monitors our GitHub Discussions page. Please search for existing threads before starting a new one. Refrain from opening issues on the bug tracker if you're just starting out or if you're not sure if something is a bug in the library code.

Alternatively, join the #ebpf-go channel on Slack if you have other questions regarding the project. Note that this channel is ephemeral and has its history erased past a certain point, which is less helpful for others running into the same problem later.

Packages

This library includes the following packages:

  • asm contains a basic assembler, allowing you to write eBPF assembly instructions directly within your Go code. (You don't need to use this if you prefer to write your eBPF program in C.)
  • cmd/bpf2go allows compiling and embedding eBPF programs written in C within Go code. As well as compiling the C code, it auto-generates Go code for loading and manipulating the eBPF program and map objects.
  • link allows attaching eBPF to various hooks
  • perf allows reading from a PERF_EVENT_ARRAY
  • ringbuf allows reading from a BPF_MAP_TYPE_RINGBUF map
  • features implements the equivalent of bpftool feature probe for discovering BPF-related kernel features using native Go.
  • rlimit provides a convenient API to lift the RLIMIT_MEMLOCK constraint on kernels before 5.11.
  • btf allows reading the BPF Type Format.

Requirements

  • A version of Go that is supported by upstream
  • CI is run against kernel.org LTS releases. >= 4.4 should work but EOL'ed versions are not supported.

License

MIT

eBPF Gopher

The eBPF honeygopher is based on the Go gopher designed by Renee French.

About

ebpf-go is a pure-Go library to read, modify and load eBPF programs and attach them to various hooks in the Linux kernel.

ebpf-go.dev

Resources

Readme
License

Code of conduct

Code of conduct

Contributing

Contributing
Activity
Custom properties

Stars

0 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases

Packages

Contributors

Languages

, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
BranchesTags
Latest commit
History
1,725 Commits
Folders and files
NameName
Last commit message
Last commit date
.github
.github
asm
asm
btf
btf
cmd/bpf2go
cmd/bpf2go
docs
docs
examples
examples
features
features
internal
internal
link
link
perf
perf
ringbuf
ringbuf
rlimit
rlimit
testdata
testdata
.clang-format
.clang-format
.gitattributes
.gitattributes
.gitignore
.gitignore
.golangci.yaml
.golangci.yaml
.vimto.toml
.vimto.toml
CODEOWNERS
CODEOWNERS
CODE_OF_CONDUCT.md
CODE_OF_CONDUCT.md
CONTRIBUTING.md
CONTRIBUTING.md
LICENSE
LICENSE
MAINTAINERS.md
MAINTAINERS.md
Makefile
Makefile
README.md
README.md
attachtype_string.go
attachtype_string.go
collection.go
collection.go
collection_test.go
collection_test.go
cpu.go
cpu.go
cpu_test.go
cpu_test.go
doc.go
doc.go
elf_reader.go
elf_reader.go
elf_reader_test.go
elf_reader_test.go
elf_sections.go
elf_sections.go
example_sock_elf_test.go
example_sock_elf_test.go
example_sock_extract_dist_test.go
example_sock_extract_dist_test.go
fuzz_test.go
fuzz_test.go
go.mod
go.mod
go.sum
go.sum
helpers_test.go
helpers_test.go
info.go
info.go
info_test.go
info_test.go
linker.go
linker.go
linker_test.go
linker_test.go
map.go
map.go
map_test.go
map_test.go
marshaler_example_test.go
marshaler_example_test.go
marshalers.go
marshalers.go
marshalers_test.go
marshalers_test.go
netlify.toml
netlify.toml
prog.go
prog.go
prog_test.go
prog_test.go
syscalls.go
syscalls.go
syscalls_test.go
syscalls_test.go
types.go
types.go
types_string.go
types_string.go
Repository files navigation
eBPF
PkgGoDev
HoneyGopher
ebpf-go is a pure Go library that provides utilities for loading, compiling, and
debugging eBPF programs. It has minimal external dependencies and is intended to
be used in long running processes.
See ebpf.io for complementary projects from the wider eBPF
ecosystem.
Getting Started
Please take a look at our Getting Started guide.
Contributions are highly encouraged, as they highlight certain use cases of
eBPF and the library, and help shape the future of the project.
Getting Help
The community actively monitors our GitHub Discussions page.
Please search for existing threads before starting a new one. Refrain from
opening issues on the bug tracker if you're just starting out or if you're not
sure if something is a bug in the library code.
Alternatively, join the
#ebpf-go channel on Slack if you
have other questions regarding the project. Note that this channel is ephemeral
and has its history erased past a certain point, which is less helpful for
others running into the same problem later.
Packages
This library includes the following packages:
  • asm contains a basic
assembler, allowing you to write eBPF assembly instructions directly
within your Go code. (You don't need to use this if you prefer to write your eBPF program in C.)
  • cmd/bpf2go allows
compiling and embedding eBPF programs written in C within Go code. As well as
compiling the C code, it auto-generates Go code for loading and manipulating
the eBPF program and map objects.
  • link allows attaching eBPF
to various hooks
  • perf allows reading from a
PERF_EVENT_ARRAY
  • ringbuf allows reading from a
BPF_MAP_TYPE_RINGBUF map
  • features implements the equivalent
of bpftool feature probe for discovering BPF-related kernel features using native Go.
  • rlimit provides a convenient API to lift
the RLIMIT_MEMLOCK constraint on kernels before 5.11.
  • btf allows reading the BPF Type Format.
Requirements
  • A version of Go that is supported by
upstream
  • CI is run against kernel.org LTS releases. >= 4.4 should work but EOL'ed versions
are not supported.
License
MIT
eBPF Gopher
The eBPF honeygopher is based on the Go gopher designed by Renee French.
About
ebpf-go is a pure-Go library to read, modify and load eBPF programs and attach them to various hooks in the Linux kernel.
ebpf-go.dev
Resources
Readme
License
Code of conduct
Code of conduct
Contributing
Contributing
Activity
Custom properties
Stars
0 stars
Watchers
0 watching
Forks
0 forks
Report repository
Releases
Packages
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
BranchesTags
Latest commit
History
1,725 Commits
Folders and files
NameName
Last commit message
Last commit date
.github
.github
asm
asm
btf
btf
cmd/bpf2go
cmd/bpf2go
docs
docs
examples
examples
features
features
internal
internal
link
link
perf
perf
ringbuf
ringbuf
rlimit
rlimit
testdata
testdata
.clang-format
.clang-format
.gitattributes
.gitattributes
.gitignore
.gitignore
.golangci.yaml
.golangci.yaml
.vimto.toml
.vimto.toml
CODEOWNERS
CODEOWNERS
CODE_OF_CONDUCT.md
CODE_OF_CONDUCT.md
CONTRIBUTING.md
CONTRIBUTING.md
LICENSE
LICENSE
MAINTAINERS.md
MAINTAINERS.md
Makefile
Makefile
README.md
README.md
attachtype_string.go
attachtype_string.go
collection.go
collection.go
collection_test.go
collection_test.go
cpu.go
cpu.go
cpu_test.go
cpu_test.go
doc.go
doc.go
elf_reader.go
elf_reader.go
elf_reader_test.go
elf_reader_test.go
elf_sections.go
elf_sections.go
example_sock_elf_test.go
example_sock_elf_test.go
example_sock_extract_dist_test.go
example_sock_extract_dist_test.go
fuzz_test.go
fuzz_test.go
go.mod
go.mod
go.sum
go.sum
helpers_test.go
helpers_test.go
info.go
info.go
info_test.go
info_test.go
linker.go
linker.go
linker_test.go
linker_test.go
map.go
map.go
map_test.go
map_test.go
marshaler_example_test.go
marshaler_example_test.go
marshalers.go
marshalers.go
marshalers_test.go
marshalers_test.go
netlify.toml
netlify.toml
prog.go
prog.go
prog_test.go
prog_test.go
syscalls.go
syscalls.go
syscalls_test.go
syscalls_test.go
types.go
types.go
types_string.go
types_string.go
Repository files navigation
eBPF
PkgGoDev
HoneyGopher
ebpf-go is a pure Go library that provides utilities for loading, compiling, and
debugging eBPF programs. It has minimal external dependencies and is intended to
be used in long running processes.
See ebpf.io for complementary projects from the wider eBPF
ecosystem.
Getting Started
Please take a look at our Getting Started guide.
Contributions are highly encouraged, as they highlight certain use cases of
eBPF and the library, and help shape the future of the project.
Getting Help
The community actively monitors our GitHub Discussions page.
Please search for existing threads before starting a new one. Refrain from
opening issues on the bug tracker if you're just starting out or if you're not
sure if something is a bug in the library code.
Alternatively, join the
#ebpf-go channel on Slack if you
have other questions regarding the project. Note that this channel is ephemeral
and has its history erased past a certain point, which is less helpful for
others running into the same problem later.
Packages
This library includes the following packages:
  • asm contains a basic
assembler, allowing you to write eBPF assembly instructions directly
within your Go code. (You don't need to use this if you prefer to write your eBPF program in C.)
  • cmd/bpf2go allows
compiling and embedding eBPF programs written in C within Go code. As well as
compiling the C code, it auto-generates Go code for loading and manipulating
the eBPF program and map objects.
  • link allows attaching eBPF
to various hooks
  • perf allows reading from a
PERF_EVENT_ARRAY
  • ringbuf allows reading from a
BPF_MAP_TYPE_RINGBUF map
  • features implements the equivalent
of bpftool feature probe for discovering BPF-related kernel features using native Go.
  • rlimit provides a convenient API to lift
the RLIMIT_MEMLOCK constraint on kernels before 5.11.
  • btf allows reading the BPF Type Format.
Requirements
  • A version of Go that is supported by
upstream
  • CI is run against kernel.org LTS releases. >= 4.4 should work but EOL'ed versions
are not supported.
License
MIT
eBPF Gopher
The eBPF honeygopher is based on the Go gopher designed by Renee French.
About
ebpf-go is a pure-Go library to read, modify and load eBPF programs and attach them to various hooks in the Linux kernel.
ebpf-go.dev
Resources
Readme
License
Code of conduct
Code of conduct
Contributing
Contributing
Activity
Custom properties
Stars
0 stars
Watchers
0 watching
Forks
0 forks
Report repository
Releases
Packages
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
BranchesTags
Latest commit
History
1,725 Commits
Folders and files
NameName
Last commit message
Last commit date
.github
.github
asm
asm
btf
btf
cmd/bpf2go
cmd/bpf2go
docs
docs
examples
examples
features
features
internal
internal
link
link
perf
perf
ringbuf
ringbuf
rlimit
rlimit
testdata
testdata
.clang-format
.clang-format
.gitattributes
.gitattributes
.gitignore
.gitignore
.golangci.yaml
.golangci.yaml
.vimto.toml
.vimto.toml
CODEOWNERS
CODEOWNERS
CODE_OF_CONDUCT.md
CODE_OF_CONDUCT.md
CONTRIBUTING.md
CONTRIBUTING.md
LICENSE
LICENSE
MAINTAINERS.md
MAINTAINERS.md
Makefile
Makefile
README.md
README.md
attachtype_string.go
attachtype_string.go
collection.go
collection.go
collection_test.go
collection_test.go
cpu.go
cpu.go
cpu_test.go
cpu_test.go
doc.go
doc.go
elf_reader.go
elf_reader.go
elf_reader_test.go
elf_reader_test.go
elf_sections.go
elf_sections.go
example_sock_elf_test.go
example_sock_elf_test.go
example_sock_extract_dist_test.go
example_sock_extract_dist_test.go
fuzz_test.go
fuzz_test.go
go.mod
go.mod
go.sum
go.sum
helpers_test.go
helpers_test.go
info.go
info.go
info_test.go
info_test.go
linker.go
linker.go
linker_test.go
linker_test.go
map.go
map.go
map_test.go
map_test.go
marshaler_example_test.go
marshaler_example_test.go
marshalers.go
marshalers.go
marshalers_test.go
marshalers_test.go
netlify.toml
netlify.toml
prog.go
prog.go
prog_test.go
prog_test.go
syscalls.go
syscalls.go
syscalls_test.go
syscalls_test.go
types.go
types.go
types_string.go
types_string.go
Repository files navigation
eBPF
PkgGoDev
HoneyGopher
ebpf-go is a pure Go library that provides utilities for loading, compiling, and
debugging eBPF programs. It has minimal external dependencies and is intended to
be used in long running processes.
See ebpf.io for complementary projects from the wider eBPF
ecosystem.
Getting Started
Please take a look at our Getting Started guide.
Contributions are highly encouraged, as they highlight certain use cases of
eBPF and the library, and help shape the future of the project.
Getting Help
The community actively monitors our GitHub Discussions page.
Please search for existing threads before starting a new one. Refrain from
opening issues on the bug tracker if you're just starting out or if you're not
sure if something is a bug in the library code.
Alternatively, join the
#ebpf-go channel on Slack if you
have other questions regarding the project. Note that this channel is ephemeral
and has its history erased past a certain point, which is less helpful for
others running into the same problem later.
Packages
This library includes the following packages:
  • asm contains a basic
assembler, allowing you to write eBPF assembly instructions directly
within your Go code. (You don't need to use this if you prefer to write your eBPF program in C.)
  • cmd/bpf2go allows
compiling and embedding eBPF programs written in C within Go code. As well as
compiling the C code, it auto-generates Go code for loading and manipulating
the eBPF program and map objects.
  • link allows attaching eBPF
to various hooks
  • perf allows reading from a
PERF_EVENT_ARRAY
  • ringbuf allows reading from a
BPF_MAP_TYPE_RINGBUF map
  • features implements the equivalent
of bpftool feature probe for discovering BPF-related kernel features using native Go.
  • rlimit provides a convenient API to lift
the RLIMIT_MEMLOCK constraint on kernels before 5.11.
  • btf allows reading the BPF Type Format.
Requirements
  • A version of Go that is supported by
upstream
  • CI is run against kernel.org LTS releases. >= 4.4 should work but EOL'ed versions
are not supported.
License
MIT
eBPF Gopher
The eBPF honeygopher is based on the Go gopher designed by Renee French.
About
ebpf-go is a pure-Go library to read, modify and load eBPF programs and attach them to various hooks in the Linux kernel.
ebpf-go.dev
Resources
Readme
License
Code of conduct
Code of conduct
Contributing
Contributing
Activity
Custom properties
Stars
0 stars
Watchers
0 watching
Forks
0 forks
Report repository
Releases
Packages
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
BranchesTags
Latest commit
History
1,725 Commits
Folders and files
NameName
Last commit message
Last commit date
.github
.github
asm
asm
btf
btf
cmd/bpf2go
cmd/bpf2go
docs
docs
examples
examples
features
features
internal
internal
link
link
perf
perf
ringbuf
ringbuf
rlimit
rlimit
testdata
testdata
.clang-format
.clang-format
.gitattributes
.gitattributes
.gitignore
.gitignore
.golangci.yaml
.golangci.yaml
.vimto.toml
.vimto.toml
CODEOWNERS
CODEOWNERS
CODE_OF_CONDUCT.md
CODE_OF_CONDUCT.md
CONTRIBUTING.md
CONTRIBUTING.md
LICENSE
LICENSE
MAINTAINERS.md
MAINTAINERS.md
Makefile
Makefile
README.md
README.md
attachtype_string.go
attachtype_string.go
collection.go
collection.go
collection_test.go
collection_test.go
cpu.go
cpu.go
cpu_test.go
cpu_test.go
doc.go
doc.go
elf_reader.go
elf_reader.go
elf_reader_test.go
elf_reader_test.go
elf_sections.go
elf_sections.go
example_sock_elf_test.go
example_sock_elf_test.go
example_sock_extract_dist_test.go
example_sock_extract_dist_test.go
fuzz_test.go
fuzz_test.go
go.mod
go.mod
go.sum
go.sum
helpers_test.go
helpers_test.go
info.go
info.go
info_test.go
info_test.go
linker.go
linker.go
linker_test.go
linker_test.go
map.go
map.go
map_test.go
map_test.go
marshaler_example_test.go
marshaler_example_test.go
marshalers.go
marshalers.go
marshalers_test.go
marshalers_test.go
netlify.toml
netlify.toml
prog.go
prog.go
prog_test.go
prog_test.go
syscalls.go
syscalls.go
syscalls_test.go
syscalls_test.go
types.go
types.go
types_string.go
types_string.go
Repository files navigation
eBPF
PkgGoDev
HoneyGopher
ebpf-go is a pure Go library that provides utilities for loading, compiling, and
debugging eBPF programs. It has minimal external dependencies and is intended to
be used in long running processes.
See ebpf.io for complementary projects from the wider eBPF
ecosystem.
Getting Started
Please take a look at our Getting Started guide.
Contributions are highly encouraged, as they highlight certain use cases of
eBPF and the library, and help shape the future of the project.
Getting Help
The community actively monitors our GitHub Discussions page.
Please search for existing threads before starting a new one. Refrain from
opening issues on the bug tracker if you're just starting out or if you're not
sure if something is a bug in the library code.
Alternatively, join the
#ebpf-go channel on Slack if you
have other questions regarding the project. Note that this channel is ephemeral
and has its history erased past a certain point, which is less helpful for
others running into the same problem later.
Packages
This library includes the following packages:
  • asm contains a basic
assembler, allowing you to write eBPF assembly instructions directly
within your Go code. (You don't need to use this if you prefer to write your eBPF program in C.)
  • cmd/bpf2go allows
compiling and embedding eBPF programs written in C within Go code. As well as
compiling the C code, it auto-generates Go code for loading and manipulating
the eBPF program and map objects.
  • link allows attaching eBPF
to various hooks
  • perf allows reading from a
PERF_EVENT_ARRAY
  • ringbuf allows reading from a
BPF_MAP_TYPE_RINGBUF map
  • features implements the equivalent
of bpftool feature probe for discovering BPF-related kernel features using native Go.
  • rlimit provides a convenient API to lift
the RLIMIT_MEMLOCK constraint on kernels before 5.11.
  • btf allows reading the BPF Type Format.
Requirements
  • A version of Go that is supported by
upstream
  • CI is run against kernel.org LTS releases. >= 4.4 should work but EOL'ed versions
are not supported.
License
MIT
eBPF Gopher
The eBPF honeygopher is based on the Go gopher designed by Renee French.
About
ebpf-go is a pure-Go library to read, modify and load eBPF programs and attach them to various hooks in the Linux kernel.
ebpf-go.dev
Resources
Readme
License
Code of conduct
Code of conduct
Contributing
Contributing
Activity
Custom properties
Stars
0 stars
Watchers
0 watching
Forks
0 forks
Report repository
Releases
Packages
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
BranchesTags
Latest commit
History
1,725 Commits
Folders and files
NameName
Last commit message
Last commit date
.github
.github
asm
asm
btf
btf
cmd/bpf2go
cmd/bpf2go
docs
docs
examples
examples
features
features
internal
internal
link
link
perf
perf
ringbuf
ringbuf
rlimit
rlimit
testdata
testdata
.clang-format
.clang-format
.gitattributes
.gitattributes
.gitignore
.gitignore
.golangci.yaml
.golangci.yaml
.vimto.toml
.vimto.toml
CODEOWNERS
CODEOWNERS
CODE_OF_CONDUCT.md
CODE_OF_CONDUCT.md
CONTRIBUTING.md
CONTRIBUTING.md
LICENSE
LICENSE
MAINTAINERS.md
MAINTAINERS.md
Makefile
Makefile
README.md
README.md
attachtype_string.go
attachtype_string.go
collection.go
collection.go
collection_test.go
collection_test.go
cpu.go
cpu.go
cpu_test.go
cpu_test.go
doc.go
doc.go
elf_reader.go
elf_reader.go
elf_reader_test.go
elf_reader_test.go
elf_sections.go
elf_sections.go
example_sock_elf_test.go
example_sock_elf_test.go
example_sock_extract_dist_test.go
example_sock_extract_dist_test.go
fuzz_test.go
fuzz_test.go
go.mod
go.mod
go.sum
go.sum
helpers_test.go
helpers_test.go
info.go
info.go
info_test.go
info_test.go
linker.go
linker.go
linker_test.go
linker_test.go
map.go
map.go
map_test.go
map_test.go
marshaler_example_test.go
marshaler_example_test.go
marshalers.go
marshalers.go
marshalers_test.go
marshalers_test.go
netlify.toml
netlify.toml
prog.go
prog.go
prog_test.go
prog_test.go
syscalls.go
syscalls.go
syscalls_test.go
syscalls_test.go
types.go
types.go
types_string.go
types_string.go
Repository files navigation
eBPF
PkgGoDev
HoneyGopher
ebpf-go is a pure Go library that provides utilities for loading, compiling, and
debugging eBPF programs. It has minimal external dependencies and is intended to
be used in long running processes.
See ebpf.io for complementary projects from the wider eBPF
ecosystem.
Getting Started
Please take a look at our Getting Started guide.
Contributions are highly encouraged, as they highlight certain use cases of
eBPF and the library, and help shape the future of the project.
Getting Help
The community actively monitors our GitHub Discussions page.
Please search for existing threads before starting a new one. Refrain from
opening issues on the bug tracker if you're just starting out or if you're not
sure if something is a bug in the library code.
Alternatively, join the
#ebpf-go channel on Slack if you
have other questions regarding the project. Note that this channel is ephemeral
and has its history erased past a certain point, which is less helpful for
others running into the same problem later.
Packages
This library includes the following packages:
  • asm contains a basic
assembler, allowing you to write eBPF assembly instructions directly
within your Go code. (You don't need to use this if you prefer to write your eBPF program in C.)
  • cmd/bpf2go allows
compiling and embedding eBPF programs written in C within Go code. As well as
compiling the C code, it auto-generates Go code for loading and manipulating
the eBPF program and map objects.
  • link allows attaching eBPF
to various hooks
  • perf allows reading from a
PERF_EVENT_ARRAY
  • ringbuf allows reading from a
BPF_MAP_TYPE_RINGBUF map
  • features implements the equivalent
of bpftool feature probe for discovering BPF-related kernel features using native Go.
  • rlimit provides a convenient API to lift
the RLIMIT_MEMLOCK constraint on kernels before 5.11.
  • btf allows reading the BPF Type Format.
Requirements
  • A version of Go that is supported by
upstream
  • CI is run against kernel.org LTS releases. >= 4.4 should work but EOL'ed versions
are not supported.
License
MIT
eBPF Gopher
The eBPF honeygopher is based on the Go gopher designed by Renee French.
About
ebpf-go is a pure-Go library to read, modify and load eBPF programs and attach them to various hooks in the Linux kernel.
ebpf-go.dev
Resources
Readme
License
Code of conduct
Code of conduct
Contributing
Contributing
Activity
Custom properties
Stars
0 stars
Watchers
0 watching
Forks
0 forks
Report repository
Releases
Packages
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
BranchesTags
Latest commit
History
1,725 Commits
Folders and files
NameName
Last commit message
Last commit date
.github
.github
asm
asm
btf
btf
cmd/bpf2go
cmd/bpf2go
docs
docs
examples
examples
features
features
internal
internal
link
link
perf
perf
ringbuf
ringbuf
rlimit
rlimit
testdata
testdata
.clang-format
.clang-format
.gitattributes
.gitattributes
.gitignore
.gitignore
.golangci.yaml
.golangci.yaml
.vimto.toml
.vimto.toml
CODEOWNERS
CODEOWNERS
CODE_OF_CONDUCT.md
CODE_OF_CONDUCT.md
CONTRIBUTING.md
CONTRIBUTING.md
LICENSE
LICENSE
MAINTAINERS.md
MAINTAINERS.md
Makefile
Makefile
README.md
README.md
attachtype_string.go
attachtype_string.go
collection.go
collection.go
collection_test.go
collection_test.go
cpu.go
cpu.go
cpu_test.go
cpu_test.go
doc.go
doc.go
elf_reader.go
elf_reader.go
elf_reader_test.go
elf_reader_test.go
elf_sections.go
elf_sections.go
example_sock_elf_test.go
example_sock_elf_test.go
example_sock_extract_dist_test.go
example_sock_extract_dist_test.go
fuzz_test.go
fuzz_test.go
go.mod
go.mod
go.sum
go.sum
helpers_test.go
helpers_test.go
info.go
info.go
info_test.go
info_test.go
linker.go
linker.go
linker_test.go
linker_test.go
map.go
map.go
map_test.go
map_test.go
marshaler_example_test.go
marshaler_example_test.go
marshalers.go
marshalers.go
marshalers_test.go
marshalers_test.go
netlify.toml
netlify.toml
prog.go
prog.go
prog_test.go
prog_test.go
syscalls.go
syscalls.go
syscalls_test.go
syscalls_test.go
types.go
types.go
types_string.go
types_string.go
Repository files navigation
eBPF
PkgGoDev
HoneyGopher
ebpf-go is a pure Go library that provides utilities for loading, compiling, and
debugging eBPF programs. It has minimal external dependencies and is intended to
be used in long running processes.
See ebpf.io for complementary projects from the wider eBPF
ecosystem.
Getting Started
Please take a look at our Getting Started guide.
Contributions are highly encouraged, as they highlight certain use cases of
eBPF and the library, and help shape the future of the project.
Getting Help
The community actively monitors our GitHub Discussions page.
Please search for existing threads before starting a new one. Refrain from
opening issues on the bug tracker if you're just starting out or if you're not
sure if something is a bug in the library code.
Alternatively, join the
#ebpf-go channel on Slack if you
have other questions regarding the project. Note that this channel is ephemeral
and has its history erased past a certain point, which is less helpful for
others running into the same problem later.
Packages
This library includes the following packages:
  • asm contains a basic
assembler, allowing you to write eBPF assembly instructions directly
within your Go code. (You don't need to use this if you prefer to write your eBPF program in C.)
  • cmd/bpf2go allows
compiling and embedding eBPF programs written in C within Go code. As well as
compiling the C code, it auto-generates Go code for loading and manipulating
the eBPF program and map objects.
  • link allows attaching eBPF
to various hooks
  • perf allows reading from a
PERF_EVENT_ARRAY
  • ringbuf allows reading from a
BPF_MAP_TYPE_RINGBUF map
  • features implements the equivalent
of bpftool feature probe for discovering BPF-related kernel features using native Go.
  • rlimit provides a convenient API to lift
the RLIMIT_MEMLOCK constraint on kernels before 5.11.
  • btf allows reading the BPF Type Format.
Requirements
  • A version of Go that is supported by
upstream
  • CI is run against kernel.org LTS releases. >= 4.4 should work but EOL'ed versions
are not supported.
License
MIT
eBPF Gopher
The eBPF honeygopher is based on the Go gopher designed by Renee French.
About
ebpf-go is a pure-Go library to read, modify and load eBPF programs and attach them to various hooks in the Linux kernel.
ebpf-go.dev
Resources
Readme
License
Code of conduct
Code of conduct
Contributing
Contributing
Activity
Custom properties
Stars
0 stars
Watchers
0 watching
Forks
0 forks
Report repository
Releases
Packages
Contributors
Languages

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
BranchesTags
Latest commit
History
1,725 Commits
Folders and files
NameName
Last commit message
Last commit date
.github
.github
asm
asm
btf
btf
cmd/bpf2go
cmd/bpf2go
docs
docs
examples
examples
features
features
internal
internal
link
link
perf
perf
ringbuf
ringbuf
rlimit
rlimit
testdata
testdata
.clang-format
.clang-format
.gitattributes
.gitattributes
.gitignore
.gitignore
.golangci.yaml
.golangci.yaml
.vimto.toml
.vimto.toml
CODEOWNERS
CODEOWNERS
CODE_OF_CONDUCT.md
CODE_OF_CONDUCT.md
CONTRIBUTING.md
CONTRIBUTING.md
LICENSE
LICENSE
MAINTAINERS.md
MAINTAINERS.md
Makefile
Makefile
README.md
README.md
attachtype_string.go
attachtype_string.go
collection.go
collection.go
collection_test.go
collection_test.go
cpu.go
cpu.go
cpu_test.go
cpu_test.go
doc.go
doc.go
elf_reader.go
elf_reader.go
elf_reader_test.go
elf_reader_test.go
elf_sections.go
elf_sections.go
example_sock_elf_test.go
example_sock_elf_test.go
example_sock_extract_dist_test.go
example_sock_extract_dist_test.go
fuzz_test.go
fuzz_test.go
go.mod
go.mod
go.sum
go.sum
helpers_test.go
helpers_test.go
info.go
info.go
info_test.go
info_test.go
linker.go
linker.go
linker_test.go
linker_test.go
map.go
map.go
map_test.go
map_test.go
marshaler_example_test.go
marshaler_example_test.go
marshalers.go
marshalers.go
marshalers_test.go
marshalers_test.go
netlify.toml
netlify.toml
prog.go
prog.go
prog_test.go
prog_test.go
syscalls.go
syscalls.go
syscalls_test.go
syscalls_test.go
types.go
types.go
types_string.go
types_string.go
Repository files navigation
eBPF
PkgGoDev
HoneyGopher
ebpf-go is a pure Go library that provides utilities for loading, compiling, and
debugging eBPF programs. It has minimal external dependencies and is intended to
be used in long running processes.
See ebpf.io for complementary projects from the wider eBPF
ecosystem.
Getting Started
Please take a look at our Getting Started guide.
Contributions are highly encouraged, as they highlight certain use cases of
eBPF and the library, and help shape the future of the project.
Getting Help
The community actively monitors our GitHub Discussions page.
Please search for existing threads before starting a new one. Refrain from
opening issues on the bug tracker if you're just starting out or if you're not
sure if something is a bug in the library code.
Alternatively, join the
#ebpf-go channel on Slack if you
have other questions regarding the project. Note that this channel is ephemeral
and has its history erased past a certain point, which is less helpful for
others running into the same problem later.
Packages
This library includes the following packages:
  • asm contains a basic
assembler, allowing you to write eBPF assembly instructions directly
within your Go code. (You don't need to use this if you prefer to write your eBPF program in C.)
  • cmd/bpf2go allows
compiling and embedding eBPF programs written in C within Go code. As well as
compiling the C code, it auto-generates Go code for loading and manipulating
the eBPF program and map objects.
  • link allows attaching eBPF
to various hooks
  • perf allows reading from a
PERF_EVENT_ARRAY
  • ringbuf allows reading from a
BPF_MAP_TYPE_RINGBUF map
  • features implements the equivalent
of bpftool feature probe for discovering BPF-related kernel features using native Go.
  • rlimit provides a convenient API to lift
the RLIMIT_MEMLOCK constraint on kernels before 5.11.
  • btf allows reading the BPF Type Format.
Requirements
  • A version of Go that is supported by
upstream
  • CI is run against kernel.org LTS releases. >= 4.4 should work but EOL'ed versions
are not supported.
License
MIT
eBPF Gopher
The eBPF honeygopher is based on the Go gopher designed by Renee French.
About
ebpf-go is a pure-Go library to read, modify and load eBPF programs and attach them to various hooks in the Linux kernel.
ebpf-go.dev
Resources
Readme
License
Code of conduct
Code of conduct
Contributing
Contributing
Activity
Custom properties
Stars
0 stars
Watchers
0 watching
Forks
0 forks
Report repository
Releases
Packages
Contributors
Languages