This release brings support for attaching to k(ret)probes and tracepoints out of the box! See the kprobe and tracepoint examples.

Breaking changes

• All LoadPinned*() functions now take LoadPinOptions to control loader behaviour. Simply pass nil to load with default options.
  • LoadPinnedMap()
  • LoadPinnedProgram()
  • LoadPinnedCgroup()
  • LoadPinnedIter()
  • LoadPinnedRawLink()
  • LoadPinnedNetNs()

Bug fixes

• Program.IsPinned() now behaves correctly on maps loaded from bpffs
• Map.Pin() no longer clobbers the destination file if it already exists

Features

• Attaching to k(ret)probes and tracepoints can now be done with link.Kprobe(), link.Kretprobe() and link.Tracepoint()
• Programs of type Kprobe automatically get their KernelVersion fields populated by detecting the kernel version at runtime
• MapOptions now contains a LoadPinOptions
• ProgSpec now contains a Flags field, adding support for BPF_F_SLEEPABLE
• Made BTF map loader more flexible by looping over Vars in a BTF data section
• Pinned Maps and Programs can now be loaded from bpffs in read-or write-only mode
• Added golangci-lint project configuration, running in CI

Examples

• kprobe and tracepoint examples updated to use the new link.Kprobe() and link.Tracepoint() API
• There is now an example for how to attach eBPF programs to uprobes

Contributors

Aditi Ghag Florian Lehner Lorenz Bauer Mattia Meleleo Mikko Ylinen Timo Beckers Vlad Ungureanu

Thank you for your work!