Releases: libbpf/libbpf
libbpf v1.4.2
libbpf v1.4.2
Another struct_ops-focused bug fix release. It addresses a few more corner cases when dealing with SEC("struct_ops")
programs.
It also improves error messaging around common use case of declaring struct_ops BPF program and not referencing it from SEC(".struct_ops")
variable (backed by struct_ops BPF map).
This release should improve overall experience of using BPF struct_ops functionality.
Full Changelog: v1.4.1...v1.4.2
libbpf v1.4.1
libbpf v1.4.1
Bug fix release fixing logic around determining whether to autoload SEC("struct_ops")
programs in cases when old kernel doesn't support some optional callbacks and user reset them to NULL from BPF skeleton.
Full Changelog: v1.4.0...v1.4.1
libbpf v0.8.3
Single fix (#795) on top of v0.8.1, fixing the name of bpf_program__pin_instance()
API call,
previously erroneously specified as bpf_object__pin_instance()
in the code.
Note that we skip v0.8.2, as its Github release tagging was broken.
Note, this API is gone in v1.0+.
Full Changelog: v0.8.1...v0.8.3
libbpf v1.4.0
libbpf v1.4.0
User space-side features and APIs
- support for BPF token throughout low-level and high-level APIs (see also
LIBBPF_BPF_TOKEN_PATH
envvar); - a bunch of struct_ops functionality added, mostly around handling multi-kernel compatibility using BPF CO-RE principles and approaches:
- support struct_ops defined in kernel modules;
- support "flavor" suffixes (
___smth
) for struct_ops types, allowing to define two incompatible definitions for the same target struct_ops kernel type; - support disabling/enabling auto-creation of struct_ops variables (maps):
SEC("?.struct_ops")
andSEC("?.struct_ops.link")
are now supported, default to not auto-create struct_ops map;bpf_map__set_autocreate()
is now honored for struct_ops maps;
- disabling auto-creation of struct_ops variable (map) disables auto-loading of related BPF programs (unless they are shared between multiple struct_ops), which means that disabling struct_ops map creation behaves naturally w.r.t. related BPF programs and doesn't require explicitly disabling them from auto-loading;
- support struct_ops "shadow type" through BPF skeleton, allowing to set/adjust custom data fields and also set/reset/change specific BPF programs implementing struct_ops' callbacks;
- BPF arena map support;
- BPF cookie support for raw tracepoint BPF programs in attach APIs;
- helpful error messages added to libbpf logs when attempting to use
struct bpf_program
orstruct bpf_map
instances there were not loaded or created, respectively; SEC("sk_skb/verdict")
support;
BPF-side features and APIs
- support global subprog argument tagging:
__arg_ctx
,__arg_nonnull
,__arg_nullable
,__arg_trusted
, and__arg_arena
annotations added;- for kprobe/uprobe, and perf_event BPF program types, support fallback logic making
__arg_ctx
work on older kernels that don't yet support__arg_ctx
(i.e.,arg:ctx
decl tag) annotation natively;
bpf_core_cast()
macro added, improving ergonomics ofbpf_rdonly_cast()
BPF helper;- support
__arena
tagged global variables, which are automatically put into BPF arena map; __long()
macro added for specifying 64-bit values when declaring BTF-defined maps;- better GCC-BPF support in BPF CO-RE macros in
bpf_core_read.h
header;
Bug fixes
- fix
faccessat()
internal usage, breaking Android versions of libbpf; - use
OPTS_SET()
inbpf_xdp_query()
for better backward/forward compatibility; - fix inner map's
max_entries
setting logic; btf_ext__raw_data()
andbtf__new_split()
APIs are added back, they were "lost" during libbpf v1.0 release process;- ignore DWARF sections in BPF linker sanity checks, improving handling of some corner cases;
- fix potential NULL dereference when handling corrupted ELF files.
Full Changelog: v1.3.0...v1.4.0
libbpf v1.3.0
libbpf v1.3.0
User space-side features and APIs
- support for
netfilter
programs is added:SEC("netfilter")
is now available- API function
bpf_program__attach_netfilter()
is now available
- support for
tcx
BPF programs is added:- the following new SEC definitions are now available:
SEC("tc/egress")
SEC("tc/ingress")
SEC("tcx/egress")
SEC("tcx/ingress")
- the following SEC definitions are now considered legacy:
SEC("tc")
SEC("action")
SEC("classifier")
- functions
bpf_prog_attach_opts()
andbpf_prog_query_opts()
are extended to work withtcx
programs, plus two new API functions are added:bpf_prog_detach_opts()
bpf_program__attach_tcx()
- the following new SEC definitions are now available:
- support for multi-uprobe programs is added:
- the following new SEC definitions are now available:
SEC("uprobe.multi")
SEC("uprobe.multi.s")
SEC("uretprobe.multi")
SEC("uretprobe.multi.s")
- plus a new API function:
bpf_program__attach_uprobe_multi()
- the following new SEC definitions are now available:
- support for section
SEC("usdt.s")
is added for sleepableusdt
programs; - support for Unix domain socket cgroup BPF programs is added the following new SEC definitions are now available:
SEC("cgroup/connect_unix")
SEC("cgroup/sendmsg_unix")
SEC("cgroup/recvmsg_unix")
SEC("cgroup/getpeername_unix")
SEC("cgroup/getsockname_unix")
- new
LIBBPF_OPTS_RESET()
utility macro; - new
bpf_object__unpin()
function to complement existingbpf_object__pin()
; - new API functions for work with ring buffers:
ring_buffer__ring()
ring__producer_pos()
ring__consumer_pos()
ring__avail_data_size()
ring__size()
ring__map_fd()
ring__consume()
path_fd
support forbpf_obj_pin()
andbpf_obj_get()
;- uprobe SEC matcher extended to allow golang symbols;
- uprobe support for symbols versioning;
bpf_map__set_value_size()
can now be used to resize memory mapped region for memory mapped maps;struct bpf_xdp_query_opts
extended withxdp_zc_max_segs
output field;- basic BTF sanity check pass added to reject bogus BTF.
BPF-side features and APIs
- triple-underscore flavors for kfunc relocation: like with CO-RE structs
___.*
suffix is ignored when kfunc relocations are resolved; __percpu_kptr
macro definition inbpf_helpers.h
;- support for exception callbacks, use
__attribute__(btf_decl_tag("exception_callback:<func_name>"))
to specify exception callback for a program;
Bug fixes
- fix for btf_dump__dump_type_data() when type contains bitfields;
- fix for correct work of offsetof() and container_of() macro with CO-RE;
- no longer attempt to load modules BTF when resolving CO-RE relocations if CAP_SYS_ADMIN are absent;
- regex based function search for "kprobe.multi/" programs no longer attempts to trace functions that cannot be traced;
- bpf_program__set_type() no longer resets sec_def if it is set to a custom fallback SEC handler;
- fix for memory leak possible after bpf_program__set_attach_target() call;
libbpf v1.2.2
Bug fix release
Two bug fixes:
- Fix a regression in
perf
tool caused by libbpf resetting its custom catch-allSEC()
handler on explicitbpf_program__set_type()
call. Given customSEC()
handlers is a rarely used pretty esoteric feature of libbpf, most users should not be affected. - Fix possible double-free in USDT-related libbpf code, which happens when libbpf runs out of space in
__bpf_usdt_specs
map due to having too many unique USDT specs. Running out of space can be mitigated by bumping upBPF_USDT_MAX_SPEC_CNT
define before includingbpf/usdt.bpf.h
header in BPF-side code. This will prevent the double-free as a side effect (and will make it possible to successfully attach all requested USDTs), which is a recommended work-around for libbpf versions prior to v1.2.2.
libbpf v1.2
User space-side features and APIs:
- completely overhauled "Libbpf overview" landing documentation page;
- support attaching to uprobes/uretprobes to functions defined in Android APK archives;
- support for BPF link-based
struct_ops
programs:SEC(".struct_ops.link")
annotations;bpf_map__attach_struct_ops()
attach API;bpf_link__update_map()
link update API;
- support sleepable
SEC("struct_ops.s")
programs; - improved thread-safety of libbpf print callbacks and
libbpf_set_print()
; - improve handling and reporting of missing BPF kfuncs;
bpf_{btf,link,map,prog}_get_info_by_fd()
APIs;bpf_xdp_query_opts()
supports fetching XDP/XSK supported features;perf_buffer__new()
allows customizing notification/sampling period now;- BPF verifier logging improvements:
- pass-through BPF verifier log level and flags to kernel as is;
- support
log_true_size
for getting required log buffer size to fit BPF verifier log completely;
- allow precise control over kprobe/uprobe attach mode: legacy, perf-based, link-based.
BPF-side features and APIs;
- support for BPF open-coded iterators:
bpf_for()
,bpf_repeat()
,bpf_for_each()
; bpf_ksym_exists()
macro to check existence of ksyms/kfuncs and kconfig values;BPF_UPROBE()
andBPF_URETPROBE()
macros;BPF_KPROBE()
andBPF_UPROBE()
macros allow fetching up to 8 passed in registers arguments, depending on architecture support;BPF_KSYSCALL()
supports fetching all 6 syscall arguments now;- LoongArch support in bpf_tracing.h;
- USDT support for 32-bit ARM architecture.
Bug fixes
- fix legacy kprobe events names sanitization;
- fix clobbering errno in some cases;
- fix BPF map's
BPF_F_MMAPABLE
flag sanitization; - fix BPF-side USDT support code on s390x architecture;
- fix
BPF_PROBE_READ{_STR}_INTO()
on s390x architecture; - fix kernel version setting for Debian kernels;
- fix netlink protocol handling in some cases;
- improve robustness of attaching to legacy kprobes and uprobes;
- fix double-free during static linking empty ELF sections;
- a bunch of other small fixes here and there.
Full Changelog: v1.1.0...v1.2.0
libbpf v1.1
User space-side features and APIs:
- user-space ring buffer (
BPF_MAP_TYPE_USER_RINGBUF
) support; - new documentation page listing all recognized
SEC()
definitions; - BTF dedup improvements:
- unambiguous fwd declaration resolution for structs and unions;
- better handling of some corner cases with identical structs and arrays;
- mixed enum and enum64 forward declaration resolution logic;
bpf_{link,btf,pro,mapg}_get_fd_by_id_opts()
andbpf_get_fd_by_id_opts()
APIs;- libbpf supports loading raw BTF for BPF CO-RE from known search paths;
- support for new cgroup local storage (
BPF_MAP_TYPE_CGRP_STORAGE
); - libbpf will only add
BPF_F_MMAPABLE
flag for data maps with global (i.e., non-static) vars; - latest Linux UAPI headers with lots of changes synced into include/uapi/linux.
BPF-side features and APIs;
BPF_PROG2()
macro added that supports struct-by-value arguments;- new BPF helpers:
bpf_user_ringbuf_drain()
;cgrp_storage_get()
andcgrp_storage_delete()
.
Bug fixes
- BTF-to-C converter fixes:
- better handling of padding corner cases;
btf__align_of()
determines packed structs better now;- improved handling of enums of non-standard sizes;
- USDT spec parsing improvements;
- overflow handling fixes for ringbufs;
- Makefile fixes to support cross-compilation for 32-bit targets;
- fix crash if
SEC("freplace")
programs don't haveattach_prog_fd
set; - better handling of file existence checks when running as non-root with enhanced capabilities;
- a bunch of small fixes:
- ELF handling improvements;
- fix memory leak in USDT argument parsing logic;
- fix NULL dereferences in few corner cases;
- improved netlink attribute iteration handling.
Full Changelog: v1.0.1...v1.1.0
libbpf v1.0.1
Fixing few issues that were reported since v1.0 release:
- fix inadvertently changed
struct bpf_object_open_opts
memory layout; - fix btf.h header relying on
struct enum64
type defined in kernel UAPI headers; - fix NULL pointer exception in API btf_dump__dump_type_data;
- remove
struct btf_map_def
accidentally left in bpf_helpers.h header.
Also libbpf will attempt to load vmlinux BTF from well known locations both ELF file (.BTF section) or as raw BTF binary data.
Full Changelog: v1.0.0...v1.0.1
libbpf v1.0
Libbpf 1.0 is here!
User-space-side features and APIs:
- All deprecated APIs and features removed!
- support for syscall-specific kprobe/kretprobe (
SEC("ksyscall/<syscall_name>")
andSEC("kretsyscall/<syscall_name>")
); - support for sleepable uprobe BPF programs (
SEC("uprobe.s")
); - support for per-cgroup LSM BPF programs (
SEC("lsm_cgroup")
); - support for new BPF CO-RE relocation
TYPE_MATCHES
; bpf_prog_load()
andbpf_map_create()
are now smarter about handling program and map name on old kernels (it will be ignored if kernel doesn't support names);BTF_KIND_ENUM64
support;- increase tracing attachment (kprobe/uprobe/tracepoint) robustness by using tracefs or debugfs, whichever is mounted;
- new APIs for converting BPF enums to their string representation:
libbpf_bpf_prog_type_str()
;libbpf_bpf_map_type_str()
;libbpf_bpf_link_type_str()
;libbpf_bpf_attach_type_str()
;
bpf_program__set_autoattach()
andbpf_program__autoattach()
to allow opting out from auto-attaching of BPF program by BPF skeleton;perf_buffer__buffer()
API to give access to underlying per-CPU buffer for BPF ringbuf;bpf_obj_get_opts()
API for more flexible fetching of BPF kernel objects' information.
BPF-side features and APIs;
bpf_core_type_matches()
helper macro to emitTYPE_MATCHES
CO-RE relocations;- USDT support now doesn't rely on BPF CO-RE;
- new and improved
BPF_KSYSCALL()
macro for tracing syscalls, which abstracts away a lot of kernel- and architecture-specific differences; - new BPF helpers:
bpf_skc_to_mptcp_sock()
;bpf_dynptr_from_mem()
;bpf_ringbuf_reserve_dynptr()
,bpf_ringbuf_submit_dynptr()
,bpf_ringbuf_discard_dynptr()
;bpf_dynptr_read()
,bpf_dynptr_write()
;bpf_dynptr_data()
;bpf_tcp_raw_gen_syncookie_ipv4()
,bpf_tcp_raw_gen_syncookie_ipv6()
,bpf_tcp_raw_check_syncookie_ipv4()
,bpf_tcp_raw_check_syncookie_ipv6()
;bpf_ktime_get_tai_ns()
.
Bug fixes
- fix power-of-2 check when adjusting BPF ringbuf map size;
- improve robustness of pointer size determination in BTF processing;
- symbol offset calculation logic fixes for uprobes and USDTs;
- fixes for clean up of legacy kprobe/uprobe attachments on partial failures;
- fix register definition for riscv architecture;
- improve robustness of reused map name handling.
Full Changelog: v0.8.0...v1.0.0