Download Latest Version v0.19.0 source code.zip (2.4 MB)
Email in envelope

Get an email when there's a new version of eBPF

Home / v0.18.0
Name Modified Size InfoDownloads / Week
Parent folder
README.md 2025-04-02 6.9 kB
v0.18.0 source code.tar.gz 2025-04-02 2.1 MB
v0.18.0 source code.zip 2025-04-02 2.4 MB
Totals: 3 Items   4.5 MB 0

Initial Windows Support

This release adds support for eBPF on Windows through the eBPF for Windows runtime. Users must run a recent build of the main branch of eBPF for Windows, version 0.20.0 is not supported.

See the documentation and how to contribute to the Windows port.

Supported: * Basic map and program operations * Support for program loading, including native images (.sys files) * Pin operations use Windows-specific global object table instead of bpffs * Support for retrieving program/attach type from GUID

Not supported: * Feature tests * BTF * bpf2go * perf * ringbuf * rlimit * pin * Reading Windows ELFs

The Windows port is still very new and won't be as performant or stable as the Linux part of the code base. There is also no guarantee of stability at the moment.

Build System Improvements

  • Mounting GOCACHE and GOMODCACHE into containers for faster rebuilds with Podman
  • Added -verbose flag to bpf2go and gentypes tools
  • Verbosity defaults to Make's V= environment variable

Documentation

  • Added Windows user-facing documentation
  • Added instructions for working on the Windows port

Bugfixes

  • prog: Fixed program loading loop that would run forever if log size was over kernel maximum
  • prog: Added limits to program load retry attempts
  • collection: Fixed missing Map.Close in collectionLoader.loadMap
  • memory: Fixed off-by-one error in bounds check that prevented accessing the last byte of memory segments
  • map, program: Names passed to kernel are now automatically sanitized

Breaking Changes

ebpf: - Unexported SanitizeName function. Map and program names are now automatically sanitized. - The ELF reader now always allows dots in names but will strip them if necessary when making syscalls. This will break users with pinned objects that have dots in their names on kernels which don't support dots.

What's Changed

New Contributors

Full Changelog: https://github.com/cilium/ebpf/compare/v0.17.3...v0.18.0

Source: README.md, updated 2025-04-02