Incompatability between libbpf and libbpfgo

[Hugo96870]

Hey!

I installed cilium and the go library

Now I'm trying to run the program but I'm getting incompatibility issues.

ebpf program

#include "vmlinux.h"
#include <bpf/bpf_helpers.h>

// Define a map to hold the count of bytes written
struct {
    __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
    __type(key, u32);
    __type(value, long);
    __uint(max_entries, 64);
} write_count SEC(".maps");

SEC("kprobe/sys_write")
int bpf_prog1(const struct pt_regs *ctx)
{
    u32 key = 0;
    long bytes_written;

    bpf_probe_read(&bytes_written, sizeof(bytes_written), (void *)ctx + 24);

    // Update the map with the count of bytes written
    bpf_map_update_elem(&write_count, &key, &bytes_written, BPF_ANY);

    return 0;
}

char LICENSE[] SEC("license") = "GPL";

Go loader:

package main

import (
    "fmt"
    "os"
    "os/signal"
    "syscall"
    "github.com/aquasecurity/tracee/libbpfgo"
)

func main() {
    // Load the BPF Object
    bpfModule, err := libbpfgo.NewModuleFromFile("write_trace.bpf.o")
    if err != nil {
        fmt.Fprintf(os.Stderr, "could not load bpf module: %v\n", err)
        os.Exit(1)
    }
    defer bpfModule.Close()

    // Load and attach tracepoint
    err = bpfModule.BPFLoadObject()
    if err != nil {
        fmt.Fprintf(os.Stderr, "could not load bpf object: %v\n", err)
        os.Exit(1)
    }

	prog, err := bpfModule.GetProgram("bpf_prog1")
	if err != nil {
		fmt.Fprintf(os.Stderr, "could not get BPF program: %v\n", err)
		os.Exit(1)
	}
	
	_, err = prog.AttachKprobe("sys_write")
	if err != nil {
		fmt.Fprintf(os.Stderr, "could not attach kprobe: %v\n", err)
		os.Exit(1)
	}

    // Setup ring buffer
    eventsMap, err := bpfModule.GetMap("events")
    if err != nil {
        fmt.Fprintf(os.Stderr, "could not find events map: %v\n", err)
        os.Exit(1)
    }

    ringBuffer, err := libbpfgo.NewRingBuffer(eventsMap, func(data []byte) {
        // Process each event
        fmt.Println("Event received")
        // Add your logic to process ring buffer events here
    })
    if err != nil {
        fmt.Fprintf(os.Stderr, "could not create ring buffer: %v\n", err)
        os.Exit(1)
    }
    ringBuffer.Start()
    defer ringBuffer.Stop()

    // Wait for the user to press Ctrl+C
    fmt.Println("Waiting for events... Press Ctrl+C to stop.")
    c := make(chan os.Signal, 1)
    signal.Notify(c, os.Interrupt, syscall.SIGTERM)
    <-c
    fmt.Println("Detaching and closing BPF program")
}

Error on command go build -o ./loader ./loader.go

# github.com/aquasecurity/tracee/libbpfgo

../../../go/pkg/mod/github.com/aquasecurity/tracee/[email protected]/libbpfgo.go:418:10: could not determine kind of name for C.bpf_map__resize

../../../go/pkg/mod/github.com/aquasecurity/tracee/[email protected]/libbpfgo.go:315:9: could not determine kind of name for C.bpf_object__open_buffer

../../../go/pkg/mod/github.com/aquasecurity/tracee/[email protected]/libbpfgo.go:636:9: could not determine kind of name for C.bpf_program__set_tracepoint

cgo: 

gcc errors for preamble:

../../../go/pkg/mod/github.com/aquasecurity/tracee/[email protected]/libbpfgo.go: In function 'init_perf_buf':

../../../go/pkg/mod/github.com/aquasecurity/tracee/[email protected]/libbpfgo.go:69:12: error: 'struct perf_buffer_opts' has no member named 'sample_cb'

   69 |     pb_opts.sample_cb = perfCallback;

      |            ^

../../../go/pkg/mod/github.com/aquasecurity/tracee/[email protected]/libbpfgo.go:70:12: error: 'struct perf_buffer_opts' has no member named 'lost_cb'

   70 |     pb_opts.lost_cb = perfLostCallback;

      |            ^

../../../go/pkg/mod/github.com/aquasecurity/tracee/[email protected]/libbpfgo.go:71:12: error: 'struct perf_buffer_opts' has no member named 'ctx'

   71 |     pb_opts.ctx = (void*)ctx;

      |            ^

../../../go/pkg/mod/github.com/aquasecurity/tracee/[email protected]/libbpfgo.go:72:10: error: too few arguments to function 'perf_buffer__new'

   72 |     pb = perf_buffer__new(map_fd, page_cnt, &pb_opts);

      |          ^~~~~~~~~~~~~~~~

In file included from ../../../go/pkg/mod/github.com/aquasecurity/tracee/[email protected]/libbpfgo.go:7:

/usr/include/bpf/libbpf.h:1499:1: note: declared here

 1499 | perf_buffer__new(int map_fd, size_t page_cnt,

From what I saw this seems like some incompatibility between versions, but I reinstalled both go and libbpf 3 times and it didn't work
Thanks!

[lmb]

The repo for libbpfgo is here: https://github.com/aquasecurity/libbpfgo