v0.6.1

Breaking changes

• None

Features

• link.Raw{At,De}tachProgram now wraps and returns the underlying error returned by the kernel. Note: this is not an API contract, so use at your own discretion. This was added temporarily for kernel feature detection purposes, and a proper feature detection API will replace this in the near future.
• link.K(ret)probe now automatically prefixes the given symbol with the conventional prefix for syscall wrappers (e.g. __x64_ when running on amd64)

Examples

• The kprobe example now hooks the sys_execve syscall wrapper by its common name rather than the x64 variant

Contributors

Aleksa Sarai
Lorenz Bauer
Nikolay Nikolaev
Robin Gögge

Thank you for your work!

CO-RE support

The library now supports most kinds of CO-RE relocations!

Breaking changes

• None

Features

• CO-RE relocations make writing portable kprobes a lot easier. We now have support for a good chunk of them.
• kretprobes are a little more robust to kernel ABI changes.
• uprobes and uretprobes are now supported.
• ProgramOptions has a TargetBTF member which allows specifying a custom target. Use this to support distro kernels that don't have built in BTF.
• raw_tp and tp_btf sections are now recognised.
• compatibility with libbpf has increased.
• PerfEventArray should now be useable without having to change PerfEventArray.MaxEntries.

Examples

• The uprobe example uses the new API in link.

Contributors

Gilberto Bertin
Lorenz Bauer
Mattia
Mattia Meleleo
nevermosby
Timo Beckers

Thank you for your work!

K(ret)probe and Tracepoint support

This release brings support for attaching to k(ret)probes and tracepoints out of the box!
See the kprobe and tracepoint examples.

Breaking changes

• All LoadPinned*() functions now take LoadPinOptions to control loader behaviour.
  Simply pass nil to load with default options.
  • LoadPinnedMap()
  • LoadPinnedProgram()
  • LoadPinnedCgroup()
  • LoadPinnedIter()
  • LoadPinnedRawLink()
  • LoadPinnedNetNs()

Bug fixes

• Program.IsPinned() now behaves correctly on maps loaded from bpffs
• Map.Pin() no longer clobbers the destination file if it already exists

Features

• Attaching to k(ret)probes and tracepoints can now be done with link.Kprobe(), link.Kretprobe() and link.Tracepoint()
• Programs of type Kprobe automatically get their KernelVersion fields populated by detecting the kernel version at runtime
• MapOptions now contains a LoadPinOptions
• ProgSpec now contains a Flags field, adding support for BPF_F_SLEEPABLE
• Made BTF map loader more flexible by looping over Vars in a BTF data section
• Pinned Maps and Programs can now be loaded from bpffs in read-or write-only mode
• Added golangci-lint project configuration, running in CI

Examples

• kprobe and tracepoint examples updated to use the new link.Kprobe() and link.Tracepoint() API
• There is now an example for how to attach eBPF programs to uprobes

Contributors

Aditi Ghag
Florian Lehner
Lorenz Bauer
Mattia Meleleo
Mikko Ylinen
Timo Beckers
Vlad Ungureanu

Thank you for your work!

v0.4.0

Breaking changes

• Map.Pin and Program.Pin only allow pinning to a single location on a BPFFS,
  repeated calls will move the pinned object rather than create additional pins.
  Clone the map or program if you need to pin to multiple paths.
• The API of bpf2go generated programs has changed.

Bug fixes

• bpf2go now passes -O2 and -mcpu=v1 to clang by default which means that
  programs should load out of the box.
• Fix iterating an empty sockmap.
• .data..percpu sections present in newer kernel BTF are now handled correctly.
• Non-static constants work now thanks to more robust ELF relocation handling.
• Various fixes to feature probes

Features

• Map and Program have gained Unpin which removes a previous Pin.
• BTF-style map definitions can now declare nested maps.
• EnableStats allows collecting global run time stats for Programs.
• Some Maps can now be modified using the Batch* methods.
• Programs now have a Tag function which allows calculating the kernel "tag"
  of a program.
• There is now a folder with examples

Contributors

• Aditi Ghag
• Bryce Kahle
• Dmitry Savintsev
• Florian Lehner
• Iacopo Rozzo
• Kornilios Kourtis
• Lorenz Bauer
• Mattia Meleleo
• Mikko Ylinen
• Nate Sweet
• Takeru Hayasaka
• Timo Beckers
• Tobias Klauser
• Tom Payne

Thank you for your work!

Add MapInfo and ProgramInfo

Allow accessing map and program metadata. This also removes the confusing MapABI and ProgramABI, which have been deprecated.

Users of MapABI and ProgramABI can migrate to the Type(), etc. getters on Map and Program directly.

Support LSM hook and add network namespace link

The library now understands lsm/ sections. There is a new link.NetNsLink which allows attaching sk_lookup and flow_dissector programs.

Some bugfixes in btf.

Deprecate MapABI and ProgramABI

This release deprecates MapABI and ProgramABI in favour of straight up getters on Map and Program.