eBPF Files

Major Performance Improvements

This release includes significant performance optimizations across multiple areas:

• Lazy BTF Decoding: BTF types are now decoded on-demand rather than all upfront, dramatically reducing memory usage and load times
• Faster Object Opening: Opening Maps and Programs from fd/id/pin is significantly faster through minimal info retrieval
• Improved Statistics Access: New Program.Stats() method allows querying runtime statistics without fetching full ProgramInfo

CO-RE Improvements

• Full Kernel Module Support: CO-RE relocations now work against all kernel modules, not just vmlinux

Build System and Toolchain Updates

• LLVM Toolchain: Updated to support LLVM 14, 17, and 20 (dropped LLVM 11 support)

Enhanced Map Support

• BTF Declaration Tags: Added MapSpec.Tags field for reading btf_decl_tag attributes set on maps
• Better Error Handling: Improved BPF_F_NO_PREALLOC hints and warnings for map types that require this flag

Assembly and Instruction Handling

• Atomic Operations: Complete support for all atomic operations beyond just atomic add

Memory and Variable Access

• New Accessors: Added accessor methods for values represented by Variable and Memory types

Windows Support Improvements

• Path Canonicalization: Fixed pin path handling to work with eBPF for Windows path canonicalization rules

Bug Fixes

• Map Batch Operations: Fixed value unmarshaling for partial batch operations in BatchLookup and BatchLookupDelete (#1741)
• Assembly Validation: Return InvalidOpCode for StoreImm with DWord size (#1767)
• Builtin Function Calls: Allow negative constants for builtin function calls (#1797)
• CO-RE Module Types: Perform CO-RE against all kernel module types (#1511)
• Pin API: Made WalkDir harder to misuse and added Windows support (#1652)
• Struct Layout: Emit structs.HostLayout in GoFormatter (#1686)

Compatibility Notes

• Minimum eBPF for Windows: Now requires eBPF for Windows 0.21.0 or later
• LLVM 11 Dropped: No longer supports LLVM 11 (required for declaration tag support)

What's Changed

• perf,ringbuf: switch Go build tag by @florianl in https://github.com/cilium/ebpf/pull/1752
• pin: make WalkDir harder to misuse and add Windows support by @lmb in https://github.com/cilium/ebpf/pull/1736
• examples: remove unnecessary -type flags to bpf2go invocations by @ti-mo in https://github.com/cilium/ebpf/pull/1754
• map: unmarshal values for partial batch by @aibor in https://github.com/cilium/ebpf/pull/1742
• build(deps): bump golang.org/x/net from 0.36.0 to 0.38.0 by @dependabot in https://github.com/cilium/ebpf/pull/1756
• all: require eFW 0.21.0 by @lmb in https://github.com/cilium/ebpf/pull/1759
• all: use binary.Append where appropriate by @lmb in https://github.com/cilium/ebpf/pull/1760
• btf: use append-style encoding when marshaling by @lmb in https://github.com/cilium/ebpf/pull/1761
• ci: ensure build works with GOARCH=wasm by @ti-mo in https://github.com/cilium/ebpf/pull/1757
• CI: test on latest ubuntu arm64 by @lmb in https://github.com/cilium/ebpf/pull/1766
• asm: Add handling for atomic operations by @dylandreimerink in https://github.com/cilium/ebpf/pull/1751
• CI: run tests with -race enabled by @lmb in https://github.com/cilium/ebpf/pull/1770
• btf: lazy decoding by @lmb in https://github.com/cilium/ebpf/pull/1763
• btf: lazy decoding of string table by @lmb in https://github.com/cilium/ebpf/pull/1772
• Typo: BenchmarkInspectorGadget -> BenchmarkInspektorGadget by @burak-ok in https://github.com/cilium/ebpf/pull/1773
• build(deps): bump the docs group in /docs with 3 updates by @dependabot in https://github.com/cilium/ebpf/pull/1771
• variable: return native Go pointers to bpf map memory by @ti-mo in https://github.com/cilium/ebpf/pull/1607
• map: reduce false positives of BPF_F_NO_PREALLOC hint on EINVAL by @ti-mo in https://github.com/cilium/ebpf/pull/1776
• ci: fix efW installation by @lmb in https://github.com/cilium/ebpf/pull/1777
• bpf2go, btf: emit structs.HostLayout in GoFormatter by @lmb in https://github.com/cilium/ebpf/pull/1769
• btf: fix Spec.Copy() for split BTF by @lmb in https://github.com/cilium/ebpf/pull/1775
• fix: return InvalidOpCode for StoreImm with DWord size by @Ghostbaby in https://github.com/cilium/ebpf/pull/1768
• info: add memlock field to ProgramInfo by @haozhangami in https://github.com/cilium/ebpf/pull/1764
• ci: use real staticcheck by @lmb in https://github.com/cilium/ebpf/pull/1779
• refactor: use the built-in max/min by @cuishuang in https://github.com/cilium/ebpf/pull/1780
• refactor: replace HasPrefix+TrimPrefix with CutPrefix by @carrychair in https://github.com/cilium/ebpf/pull/1784
• kfunc: poison all weak kfunc calls if the kernel lacks BTF by @bogushevich in https://github.com/cilium/ebpf/pull/1774
• btf: fix TestLoadKernelModuleSpec by @lmb in https://github.com/cilium/ebpf/pull/1787
• collection: share kernel BTF when loading a collection by @lmb in https://github.com/cilium/ebpf/pull/1778
• build(deps): bump the docs group in /docs with 2 updates by @dependabot in https://github.com/cilium/ebpf/pull/1790
• build(deps): bump golangci/golangci-lint-action from 7.0.0 to 8.0.0 by @dependabot in https://github.com/cilium/ebpf/pull/1789
• kallsyms: optimize things a bit by @lmb in https://github.com/cilium/ebpf/pull/1785
• ci: fetch efW binaries from completed workflows by @lmb in https://github.com/cilium/ebpf/pull/1793
• Optimize New{Map,Program}From{ID,FD} and LoadPinned{Map,Program} by @ti-mo in https://github.com/cilium/ebpf/pull/1791
• cmd/bpf2go: Use BPF2GO_CFLAGS instead of BPF2GO_FLAGS by @jrife in https://github.com/cilium/ebpf/pull/1796
• bpf2go: import package structs when all structs are typedefs by @RonFed in https://github.com/cilium/ebpf/pull/1798
• build(deps): bump requests from 2.32.3 to 2.32.4 in /docs by @dependabot in https://github.com/cilium/ebpf/pull/1799
• ci: upgrade LLVM to 20.1, drop LLVM 11 by @ti-mo in https://github.com/cilium/ebpf/pull/1800
• map: add MapSpec.Tags field for reading btf_decl_tag attributes set on maps by @ti-mo in https://github.com/cilium/ebpf/pull/1801
• build(deps): bump urllib3 from 2.4.0 to 2.5.0 in /docs by @dependabot in https://github.com/cilium/ebpf/pull/1805
• elf_reader: do not panic in loadMapsif ELF file has no BTF by @paulcacheux in https://github.com/cilium/ebpf/pull/1807
• program: perform CO-RE against all kmod by @lmb in https://github.com/cilium/ebpf/pull/1794
• asm: allow negative constants for builtin function calls by @lmb in https://github.com/cilium/ebpf/pull/1806
• btf: introduce caching string table to speed up ext info loading by @paulcacheux in https://github.com/cilium/ebpf/pull/1809
• linker: do not error out when there is nothing in /sys/kernel/btf by @paulcacheux in https://github.com/cilium/ebpf/pull/1813

New Contributors

• @burak-ok made their first contribution in https://github.com/cilium/ebpf/pull/1773
• @haozhangami made their first contribution in https://github.com/cilium/ebpf/pull/1764
• @carrychair made their first contribution in https://github.com/cilium/ebpf/pull/1784
• @bogushevich made their first contribution in https://github.com/cilium/ebpf/pull/1774
• @jrife made their first contribution in https://github.com/cilium/ebpf/pull/1796

Full Changelog: https://github.com/cilium/ebpf/compare/v0.18.0...v0.19.0