cilium/ebpf v0.20.0 on GitHub

Performance Improvements

btf: Memory-map vmlinux BTF when possible instead of copying to heap (saves several megabytes)
btf: Decode BTF from byte slices instead of io.Reader for better performance
btf: Cache BTF during fixups and target search to avoid loading each blob multiple times
linker: Resolve kernel symbols in a single pass instead of individually
prog: Speed up opening pinned programs by using minimal program info
map: Avoid allocations during PerCPUMap batch lookups (76% faster, 99% fewer allocations)

New Features

btf: Added LoadSplitSpec function for easier use of split-BTF files
btf: Accept empty string tables in BTF data
link: Added Detach() method for explicitly detaching links
map: Preliminary support for arena maps
map: Parse and expose map_extra field in MapSpec (enables bloom filter configuration)
prog: Allow explicit ifindex specification when loading programs
prog: Support getting context output from syscall programs
prog: Allow passing extra targets for CO-RE relocations via ExtraRelocationTargets
bpf2go: Allow multiple commands in BPF2GO_CC environment variable (e.g., ccache clang)
tracefs: Allow hyphens in tracepoint group names
kallsyms: Return ErrRestrictedKernel when reading zero addresses due to kernel.kptr_restrict
info: Return ErrRestrictedKernel when program info is restricted by kernel security settings
prog: Tolerate ErrRestrictedKernel during ksym resolution unless ksyms are required

Bugfixes

ringbuf: Fixed panic when reading after close
btf: Fixed race condition when loading cached kernel/module specs
ringbuf: Fixed 32-bit compatibility by using uintptr for positions
memory: Set cleanup on *Memory instead of **Memory to fix resource leak
link: Fixed concurrent cleanup ordering for perf events and tracefs events

Windows Support Improvements

ringbuf: Added Windows support for ring buffer operations
windows: Fixed compatibility with recent eBPF for Windows changes (XDP_TEST removal, SAMPLE program type)
windows: Enabled Hyper-V support in test VMs
program: Added workaround for eBPF for Windows rejecting empty ContextOut

Breaking Changes

ProgramOptions.KernelModuleTypes removed

The KernelModuleTypes field in ProgramOptions has been removed. In 99% of cases this field should not be necessary anymore. Module BTF should be merged into the vmlinux BTF, as tools like btfhub do.

For advanced use cases that still require passing additional BTF specs for CO-RE relocations, use the new ExtraRelocationTargets field:

Before:

opts := &ebpf.ProgramOptions{
    KernelModuleTypes: map[string]*btf.Spec{
        "module1": moduleSpec1,
    },
}

After:

// Merge module BTF into vmlinux BTF (recommended)
// Or for advanced cases:
opts := &ebpf.ProgramOptions{
    ExtraRelocationTargets: []*btf.Spec{
        moduleSpec1,
    },
}

btf.Cache fields unexported

The KernelTypes, ModuleTypes, and LoadedModules fields in btf.Cache have been unexported. These fields were internal implementation details and should not have been accessed directly. Users should continue using btf.NewCache() to create cache instances - no code changes are needed if you weren't directly accessing these fields.

cache := btf.NewCache()
cache.KernelTypes = mySpec  // This will no longer compile

What's Changed

windows: allow using Hyper-V in VM by @lmb in #1816
build(deps): bump the docs group in /docs with 3 updates by @dependabot[bot] in #1817
feat : Add LoadSplitSpec function by @tdaudi in #1819
collection: drop unnecessary kallsyms module lookup by @lmb in #1821
prog: get context out from syscall program by @mejedi in #1803
prog: speed up opening pinned Programs by @aibor in #1822
linker: resolve ksyms in one go by @lmb in #1824
ci: add a Results step to work around GH protection rules by @lmb in #1825
ci: work around arm64 hang by @lmb in #1827
map: avoid allocations during PerCPUMap batch lookups by @aibor in #1823
readme: clarify arch support by @lmb in #1836
bpf2go: Allow multiple commands inside BPF2GO_CC by @jrife in #1829
program: Allow passing extra targets for CO-RE relocations by @mauriciovasquezbernal in #1814
ci: remove 4.14 and 4.19 and add 6.12 by @lmb in #1838
btf: mmap vmlinux if possible by @lmb in #1812
btf: don't try to load strings when file is empty by @therealak12 in #1837
build(deps): bump the docs group in /docs with 2 updates by @dependabot[bot] in #1840
ringbuf: Use uintptr for positions for 32-bit compatibility by @joshuamcbeth in #1843
link: add Detach() by @florianl in #1830
btf: fix race when loading cached kernel (module)? spec by @paulcacheux in #1848
go 1.24 by @lmb in #1850
ringbuf: Windows support by @lmb in #1849
ringbuf: fix read after close panic by @RonFed in #1859
link: allow '-' in tracepoint group names by @AryanBakliwal in #1855
Convert uses of runtime.SetFinalizer to runtime.AddCleanup by @lmb in #1851
prog: Allow explicit ifindex specification by @twaapo in #1842
map: add MapSpec.MapExtra field by @NoNickeD in #1856
memory: set cleanup on *Memory instead of **Memory by @ti-mo in #1863
all: use testing.B.Loop() by @lmb in #1864
program: use cached BTF for fixups and target search by @lmb in #1865
build(deps): bump the docs group in /docs with 2 updates by @dependabot[bot] in #1870
build(deps): bump actions/github-script from 7 to 8 by @dependabot[bot] in #1872
build(deps): bump actions/setup-go from 5 to 6 by @dependabot[bot] in #1874
build(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in #1871
build(deps): bump actions/setup-python from 5 to 6 by @dependabot[bot] in #1873
*: use go tool instead of go run in go:generate statements by @ti-mo in #1875
Return ErrRestrictedKernel when kernel pointers are restricted using sysctls by @dylandreimerink in #1858
windows: fix CI issues by @lmb in #1879
add StructOpsMap support by @shun159 in #1845
docs: document how to build parts of efW by @lmb in #1877
struct_ops: skip copy for zeroed nested structs and fail on non-zeroed by @shun159 in #1883

New Contributors

@tdaudi made their first contribution in #1819
@therealak12 made their first contribution in #1837
@joshuamcbeth made their first contribution in #1843
@AryanBakliwal made their first contribution in #1855
@twaapo made their first contribution in #1842
@NoNickeD made their first contribution in #1856

Full Changelog: v0.19.0...v0.20.0