ebpf-digest

cilium/ebpf Support for __ksym and __kfunc

release ·

Breaking changes

This release requires at least Go 1.19.

github.com/cilium/ebpf/btf:

github.com/cilium/ebpf/link:

Fixes

Work around the kernel rejecting some Datasec

The kernel erroneously rejects Datasec where a Typedef, Volatile, Const, Restrict or typeTag follows a Pointer, Struct, Union or Array. There is now a workaround in place, see https://github.com/cilium/ebpf/pull/954.

Marshaling Map keys and values is more efficient

The marshaling code in the library now uses sync.Pool to re-use bytes.Buffer, which makes common map operations cheaper, see https://github.com/cilium/ebpf/pull/1053.

CO-RE relocations are a lot more efficient

The CO-RE code now does much less copying of BTF types, which makes CO-RE relocation a lot faster, especially against large types such as sk_buff. See https://github.com/cilium/ebpf/pull/1084.

Additions

__ksym (kfunc) support

It’s now possible to use new-style BPF helpers aka kfunc with the library. Going forward, all new BPF ‘helper’ functionality in the kernel will be exposed as kfuncs, and new helpers won’t be added. See https://github.com/cilium/ebpf/pull/966 and https://github.com/cilium/ebpf/pull/996.

__kconfig support

Tracing programs often need to vary their behaviour based on kernel configuration, such as CONFIG_HZ. Such references to __kconfig variables are now automatically populated from a variety of sources such as /proc/config.gz. Note that if you run your application implementing ebpf-go in a container, it will need access to the host’s /boot on some distributions that don’t ship /proc/config(.gz). (notably, Debian-based distros)

As a special mention, the LINUX_HAS_SYSCALL_WRAPPER kconfig is also supported. This allows writing portable kprobes using the BPF_KSYSCALL macro from bpf_tracing.h.

See https://github.com/cilium/ebpf/pull/951, https://github.com/cilium/ebpf/pull/960 and https://github.com/cilium/ebpf/pull/995.

Overwritable perf buffer support

The perf reader now allows creating “overwritable” perf buffers, which always contain the most recent events in case the buffer ever gets full. This is in contrast to regular perf buffers which drop recent events if there is no more space. This is useful to implement “flight recorder” type functionality for events sourced from BPF.

See https://github.com/cilium/ebpf/pull/953.

btf.Builder

Constructing custom BTF type blobs is now possible through the new btf.Builder type. Call btf.NewBuilder() to obtain one, Builder.Add(t btf.Type) to add any types you need, followed by btf.NewHandle(b btf.Builder) to load the types into the kernel. Builder also has a Marshal() method for serializing the type collection into the canonical BTF format so it can be stored for later use.

What’s Changed

New Contributors

Full Changelog: https://github.com/cilium/ebpf/compare/v0.10.0...v0.11.0

View source