Skip to content

Conversation

red-hat-konflux[bot]
Copy link

@red-hat-konflux red-hat-konflux bot commented Sep 7, 2025

This PR contains the following updates:

Package Change Age Confidence
github.com/cilium/ebpf v0.16.0 -> v0.19.0 age confidence

Warning

Some dependencies could not be looked up. Check the warning logs for more information.


Release Notes

cilium/ebpf (github.com/cilium/ebpf)

v0.19.0

Compare Source

Major Performance Improvements

This release includes significant performance optimizations across multiple areas:

  • Lazy BTF Decoding: BTF types are now decoded on-demand rather than all upfront, dramatically reducing memory usage and load times
  • Faster Object Opening: Opening Maps and Programs from fd/id/pin is significantly faster through minimal info retrieval
  • Improved Statistics Access: New Program.Stats() method allows querying runtime statistics without fetching full ProgramInfo

CO-RE Improvements

  • Full Kernel Module Support: CO-RE relocations now work against all kernel modules, not just vmlinux

Build System and Toolchain Updates

  • LLVM Toolchain: Updated to support LLVM 14, 17, and 20 (dropped LLVM 11 support)

Enhanced Map Support

  • BTF Declaration Tags: Added MapSpec.Tags field for reading btf_decl_tag attributes set on maps
  • Better Error Handling: Improved BPF_F_NO_PREALLOC hints and warnings for map types that require this flag

Assembly and Instruction Handling

  • Atomic Operations: Complete support for all atomic operations beyond just atomic add

Memory and Variable Access

  • New Accessors: Added accessor methods for values represented by Variable and Memory types

Windows Support Improvements

  • Path Canonicalization: Fixed pin path handling to work with eBPF for Windows path canonicalization rules

Bug Fixes

  • Map Batch Operations: Fixed value unmarshaling for partial batch operations in BatchLookup and BatchLookupDelete (#​1741)
  • Assembly Validation: Return InvalidOpCode for StoreImm with DWord size (#​1767)
  • Builtin Function Calls: Allow negative constants for builtin function calls (#​1797)
  • CO-RE Module Types: Perform CO-RE against all kernel module types (#​1511)
  • Pin API: Made WalkDir harder to misuse and added Windows support (#​1652)
  • Struct Layout: Emit structs.HostLayout in GoFormatter (#​1686)

Compatibility Notes

  • Minimum eBPF for Windows: Now requires eBPF for Windows 0.21.0 or later
  • LLVM 11 Dropped: No longer supports LLVM 11 (required for declaration tag support)

What's Changed

New Contributors

Full Changelog: cilium/ebpf@v0.18.0...v0.19.0

v0.18.0

Compare Source

Initial Windows Support

This release adds support for eBPF on Windows through the eBPF for Windows runtime. Users must run a recent build of the main branch of eBPF for Windows, version 0.20.0 is not supported.

See the documentation and how to contribute to the Windows port.

Supported:

  • Basic map and program operations
  • Support for program loading, including native images (.sys files)
  • Pin operations use Windows-specific global object table instead of bpffs
  • Support for retrieving program/attach type from GUID

Not supported:

  • Feature tests
  • BTF
  • bpf2go
  • perf
  • ringbuf
  • rlimit
  • pin
  • Reading Windows ELFs

The Windows port is still very new and won't be as performant or stable as the Linux part of the code base. There is also no guarantee of stability at the moment.

Build System Improvements

  • Mounting GOCACHE and GOMODCACHE into containers for faster rebuilds with Podman
  • Added -verbose flag to bpf2go and gentypes tools
  • Verbosity defaults to Make's V= environment variable

Documentation

  • Added Windows user-facing documentation
  • Added instructions for working on the Windows port

Bugfixes

  • prog: Fixed program loading loop that would run forever if log size was over kernel maximum
  • prog: Added limits to program load retry attempts
  • collection: Fixed missing Map.Close in collectionLoader.loadMap
  • memory: Fixed off-by-one error in bounds check that prevented accessing the last byte of memory segments
  • map, program: Names passed to kernel are now automatically sanitized

Breaking Changes

ebpf:

  • Unexported SanitizeName function. Map and program names are now automatically sanitized.
  • The ELF reader now always allows dots in names but will strip them if necessary when making syscalls. This will break users with pinned objects that have dots in their names on kernels which don't support dots.

What's Changed

New Contributors

Full Changelog: cilium/ebpf@v0.17.3...v0.18.0

v0.17.3

Compare Source

Fixes for a data race in btf.Spec.Copy (thanks @​paulcacheux) and a buffer overflow when running 32-bit user space on a 64-bit kernel (thanks @​kolyshkin).

What's Changed

Full Changelog: cilium/ebpf@v0.17.2...v0.17.3

v0.17.2

Compare Source

Another minor release to ship some bug fixes, notably for attaching bpf programs to symbols in kernel modules, and for reusing data sections across multiple Collections.

All users are encouraged to upgrade!

Features

Bug Fixes

  • prog: fix tautological AttachTo condition in ProgramSpec.kernelModule by @​brycekahle in #​1640
  • map: check MapReplacements compatibility after applying BPF_F_MMAPABLE by @​ti-mo in #​1655

Other Changes

Thanks to all who contributed and reported issues!

Full Changelog: cilium/ebpf@v0.17.1...v0.17.2

v0.17.1: Hotfix: don't retry endlessly on verifier errors on kernels <6.4

Compare Source

During the prior removal of ProgramOptions.LogSize in v0.16, the tests weren't updated to exercise the retry logic. With the last-minute addition of ProgramOptions.LogSizeStart, a bug was introduced that would cause program loads to retry indefinitely without ever growing the buffer in case of a verifier error on kernels before 6.4. This is now fixed, and the tests were updated to exercise the retry logic.

  • prog: fix shadowing log size variable in verifier log retry loop by @​ti-mo in #​1635

v0.17.0: Global Variables, Decl Tags, and package pin

Compare Source

Note: the hotfix release 0.17.1 is out. Users are highly encouraged to upgrade.

As we close the door on the year 2024, we're also wrapping up the ebpf-go v0.17 development cycle. This release represents a large body of work and is our largest feature release since BTF.

Users are, as always, highly encouraged to upgrade, and we're looking forward to hearing your feedback on the new Global Variables API. We've been putting this interface trough its paces internally, along with a few eager community members, and we're ready to let the wider community make use of it.

This release also marks the end of our Go 1.21 support; Go 1.22 is required going forward.

Breaking Changes

Before we get to the fun stuff, we need to call out a few breaking changes:

  • Global variables with a static qualifier can no longer be rewritten using CollectionSpec.RewriteConstants()! See the section on global variables under major features below.

  • program: remove LogSize and VerifierError.Truncated by @​lmb in #​1526

  • prog: add ProgramOptions.LogSizeStart to obtain full log after verifier bug by @​ti-mo in #​1630

    The ProgramOptions.LogSize field was deprecated and a no-op since 0.16 and has now been removed completely. In its place, a new field was added to obtain full verifier logs when the verifier hits an internal bug. The ProgramOptions.LogSizeStart field controls the starting size of the log buffer. Use this if you have a good understanding of the log size you're expecting, or if you're trying to pull out the full log when the verifier hits an internal bug. The error string now also contains some hints about what happened and how to handle this situation.

  • map: remove MapSpec.Freeze field by @​ti-mo in #​1558

  • elf_reader: don't use BPF_F_RDONLY_PROG flag to trigger map freezing by @​ti-mo in #​1568

    The Freeze field was ambiguous from the start, and has been a source of subtle bugs over the years. Automatic map freezing is now done based solely on map name (.(ro)data prefix). If you were manually setting this flag, consider using a conventional map name instead.

  • info: expose ksym info and func info by ProgramInfo by @​Asphaltt in #​1576

  • info: expose more prog jited info by @​Asphaltt in #​1598

    Some ext_info types in package btf were redefined to enable pulling raw func and line infos out of Program.Info(). These were all types without methods and all unexported fields, but calling them out regardless in case someone's doing unintended advanced things with BTF.

  • kallsyms: change Modules caching strategy, cache address lookups by @​ti-mo in #​1590

    Users attaching bpf programs to kernel symbols should see a marked decrease in allocations made in the library during program creation in the general case. Only used entries are now cached, making kallsyms lookups on subsequent program loads free. In the pathological case (new kernel symbols on every load), scanning is repeated, resulting in more CPU time being used instead of holding on to all kallsyms symbols indefinitely. ProgramSpec.KernelModule() was unexported until further notice.

    Also, bpf2go users should now be able to generate Go bindings as unprivileged users once again. Oops!

Major Features

Easy global variables: introducing ebpf.VariableSpec and ebpf.Variable
  • CollectionSpec: add new Variables field to interact with constants and global variables by @​ti-mo in #​1564
  • Collection: add Variables field to interact with global variables by @​ti-mo in #​1572
  • bpf2go: generate assignment structs and Go types for Variables and VariableSpecs by @​smagnani96 in #​1610

This has been a frequent ask in the community for years, so we finally bit the bullet and committed to an API to interact with global bpf variables through CollectionSpec.Variables and CollectionSpec.Variables. We've published a small guide over on ebpf-go.dev/concepts/global-variables that details how to use them, so we're not going to reiterate here.

See the documentation on the use of the static qualifier! These are no longer considered global variables, and can't be modified at runtime.

bpf2go now also generates objects to be used with CollectionSpec.Assign and .LoadAndAssign(), and also emits Go type declarations for C types used as bpf C variables. Our test coverage was somewhat lacking for the latter, please drop something on the issue tracker if you're noticing surprising bpf2go output.

Note that it's currently not possible to manually create a VariableSpec and wire it up to a CollectionSpec, so if you were previously relying on e.g. manually assembling a CollectionSpec and using RewriteConstants() in tests, this will no longer work. This may land as the API crystallizes and we settle on a good mechanism to enable this. Please reach out on the Cilium Slack if you'd like to see this happen.

Tags!

As you'll notice, the btf.Struct, btf.Union, btf.Member, btf.Typedef, btf.Func and btf.Var have gained a new field: Tags! Set one or more tags on these objects from bpf C using __attribute__((btf_decl_tag("mytag"))) and
you'll find Tags being populated in Go.

There's also the btf.Func.ParamTags field that holds tags declared on individual function parameters. These are part of the Func since they appear only in the function prototype, not in the parameter type itself, since those can appear in many different types. (it does get confusing!)

Also, an honorable mention to btf.TypeTag, which has now been exported. This allows tagging pointers with an arbitrary string value and is mainly used by the Linux verifier to tag kernel pointers, see the __kptr and __kptr_ref macros in Linux' bpf_helpers.h.

Pins!
  • pin: new package for loading bpf pins and walking bpffs directories by @​ti-mo in #​1626

We've added a new root-level package pin, which currently features the Load() and WalkDir() functions. Since all LoadPinned* functions in the library now check for the underlying object's type, we've repurposed the machinery to allow loading an opaque pin and returning a Go object of the right type.WalkDir does what it says on the tin, it walks bpffs directories and invokes a callback that received the loaded object. Super convenient!

Minor Features

We've also added a handful of minor features during this release:

Other Changes

Last but not least, there's bugfixes, CI changes and some internal refactoring that happened to eventually make ebpf-go work with ebpf-for-windows. See individual PRs for more context. Stay tuned!

New Contributors

Full Changelog: cilium/ebpf@v0.16.0...v0.17.0


Configuration

📅 Schedule: Branch creation - "after 5am on sunday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

This PR has been generated by MintMaker (powered by Renovate Bot).

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants