eBPF Files

Initial Windows Support

This release adds support for eBPF on Windows through the eBPF for Windows runtime. Users must run a recent build of the main branch of eBPF for Windows, version 0.20.0 is not supported.

See the documentation and how to contribute to the Windows port.

Supported: * Basic map and program operations * Support for program loading, including native images (.sys files) * Pin operations use Windows-specific global object table instead of bpffs * Support for retrieving program/attach type from GUID

Not supported: * Feature tests * BTF * bpf2go * perf * ringbuf * rlimit * pin * Reading Windows ELFs

The Windows port is still very new and won't be as performant or stable as the Linux part of the code base. There is also no guarantee of stability at the moment.

Build System Improvements

• Mounting GOCACHE and GOMODCACHE into containers for faster rebuilds with Podman
• Added -verbose flag to bpf2go and gentypes tools
• Verbosity defaults to Make's V= environment variable

Documentation

• Added Windows user-facing documentation
• Added instructions for working on the Windows port

Bugfixes

• prog: Fixed program loading loop that would run forever if log size was over kernel maximum
• prog: Added limits to program load retry attempts
• collection: Fixed missing Map.Close in collectionLoader.loadMap
• memory: Fixed off-by-one error in bounds check that prevented accessing the last byte of memory segments
• map, program: Names passed to kernel are now automatically sanitized

Breaking Changes

ebpf: - Unexported SanitizeName function. Map and program names are now automatically sanitized. - The ELF reader now always allows dots in names but will strip them if necessary when making syscalls. This will break users with pinned objects that have dots in their names on kernels which don't support dots.

What's Changed

• windows: testutils changes by @lmb in https://github.com/cilium/ebpf/pull/1666
• go 1.23 by @lmb in https://github.com/cilium/ebpf/pull/1676
• ebpf: implement PossibleCPU on Windows by @lmb in https://github.com/cilium/ebpf/pull/1677
• sys: hint that structs require host layout by @lmb in https://github.com/cilium/ebpf/pull/1681
• info: don't check Runtime in TestStats on arm64 by @lmb in https://github.com/cilium/ebpf/pull/1684
• btf: use iterators by @lmb in https://github.com/cilium/ebpf/pull/1682
• all: force consistent line endings by @lmb in https://github.com/cilium/ebpf/pull/1687
• sys: add windows support by @lmb in https://github.com/cilium/ebpf/pull/1685
• memory: fix off-by-one in bounds check by @ti-mo in https://github.com/cilium/ebpf/pull/1694
• btf: disable handle API on windows by @lmb in https://github.com/cilium/ebpf/pull/1678
• CI: remove 4.9 by @lmb in https://github.com/cilium/ebpf/pull/1698
• internal/testutils: make TempBPFFS portable by @lmb in https://github.com/cilium/ebpf/pull/1688
• sys: add type safe Pointer wrapper by @lmb in https://github.com/cilium/ebpf/pull/1670
• fix CI failures on main by @lmb in https://github.com/cilium/ebpf/pull/1701
• link: don't use version comparison in tests by @lmb in https://github.com/cilium/ebpf/pull/1700
• ci: bump gotestsum to v1.12.0 by @paulcacheux in https://github.com/cilium/ebpf/pull/1667
• Remove myself from CODEOWNERS by @mejedi in https://github.com/cilium/ebpf/pull/1703
• ci: speed up test of bpf2go by @lmb in https://github.com/cilium/ebpf/pull/1707
• ebpf: clean up tests by @lmb in https://github.com/cilium/ebpf/pull/1702
• build(deps): bump golangci/golangci-lint-action from 6.3.0 to 6.5.0 by @dependabot in https://github.com/cilium/ebpf/pull/1705
• all: encode platform in type constants by @lmb in https://github.com/cilium/ebpf/pull/1689
• build(deps): bump mkdocs-material from 9.6.1 to 9.6.6 in /docs in the docs group by @dependabot in https://github.com/cilium/ebpf/pull/1706
• windows: more test / testutils fixups by @lmb in https://github.com/cilium/ebpf/pull/1708
• windows: even more test fixes by @lmb in https://github.com/cilium/ebpf/pull/1709
• ebpf: add Windows support by @lmb in https://github.com/cilium/ebpf/pull/1710
• map: fix problematic error returns by @cuishuang in https://github.com/cilium/ebpf/pull/1715
• efw: configure CRT error reporting by @lmb in https://github.com/cilium/ebpf/pull/1716
• ebpf: support native images on Windows by @lmb in https://github.com/cilium/ebpf/pull/1711
• build(deps): bump jinja2 from 3.1.5 to 3.1.6 in /docs by @dependabot in https://github.com/cilium/ebpf/pull/1717
• examples: update map definition to use new format by @florianl in https://github.com/cilium/ebpf/pull/1719
• collection: don't copy Maps and Programs twice by @lmb in https://github.com/cilium/ebpf/pull/1722
• prog: avoid verifier loop of death by @ti-mo in https://github.com/cilium/ebpf/pull/1693
• features: return ErrNotSupportedOnOS on windows by @lmb in https://github.com/cilium/ebpf/pull/1723
• ebpf: replace binary.Read with binary.Decode in sysenc.Unmarshal by @kolesnikovae in https://github.com/cilium/ebpf/pull/1713
• link: minimal windows support by @lmb in https://github.com/cilium/ebpf/pull/1718
• docs: add instructions for working on the Windows port by @lmb in https://github.com/cilium/ebpf/pull/1727
• windows: update native image testdata by @lmb in https://github.com/cilium/ebpf/pull/1730
• windows: improve dev VM script by @lmb in https://github.com/cilium/ebpf/pull/1731
• build(deps): bump golang.org/x/net from 0.33.0 to 0.36.0 by @dependabot in https://github.com/cilium/ebpf/pull/1724
• Add new ≥ 5.11 map/prog types to feature matrix by @tklauser in https://github.com/cilium/ebpf/pull/1728
• ebpf: allow retrieving program / attach type from GUID by @lmb in https://github.com/cilium/ebpf/pull/1733
• elf: do not remove dots from names by @lmb in https://github.com/cilium/ebpf/pull/1680
• build(deps): bump the docs group in /docs with 3 updates by @dependabot in https://github.com/cilium/ebpf/pull/1740
• docs: add user facing documentation for Windows by @lmb in https://github.com/cilium/ebpf/pull/1735
• ci: reduce bpf2go and gentypes verbosity, mount gomodcache when using podman by @ti-mo in https://github.com/cilium/ebpf/pull/1634
• map, program: always sanitize names passed to the kernel by @lmb in https://github.com/cilium/ebpf/pull/1737
• build(deps): bump golangci/golangci-lint-action from 6.5.0 to 7.0.0 by @dependabot in https://github.com/cilium/ebpf/pull/1739

New Contributors

• @kolesnikovae made their first contribution in https://github.com/cilium/ebpf/pull/1713

Full Changelog: https://github.com/cilium/ebpf/compare/v0.17.3...v0.18.0