User space-side features

• bpf_map__set_exclusive_program() and bpf_map__exclusive_program() APIs for exclusive map creation;
• bpf_program__assoc_struct_ops() and bpf_prog_assoc_struct_ops() APIs to associate a non-struct_ops BPF program with a struct_ops map;
• btf__permute() API to rearrange BTF types in-place according to a provided mapping;
• BTF type lookup optimization: binary search for btf__find_by_name() and btf__find_by_name_kind();
• btf__add_btf() now accepts split BTF sources;
• fsession support (SEC("fsession+") / SEC("fsession.s+"));
• BPF_F_CPU and BPF_F_ALL_CPUS flags support for per-CPU map operations;
• arena globals are moved to the end of the arena mmap region if kernel supports it;
• support for LLVM-generated indirect jump tables (BPF ISA v4) via .jumptables ELF section and BPF_MAP_TYPE_INSN_ARRAY maps;
• avoid expensive kallsyms parsing when kprobe.session target is an exact function match;
• new dont_enable option in struct bpf_perf_event_opts to suppress perf event auto-enablement;

BPF-side features

• USDT SIB (Scale-Index-Base) addressing support;
• dynptr helper signatures (bpf_dynptr_from_mem, bpf_dynptr_read, bpf_dynptr_write, bpf_dynptr_data) widened from 32-bit to 64-bit size/offset parameters;

Bug fixes

As usual, a number of bug fixes included, see full commit log for details.

Full Changelog: v1.6.0...v1.7.0

Two compilation warnings fixes to make libbpf build more GCC and C23 compatible.

Full Changelog: v1.6.2...v1.6.3

Bug fix release:

• add proper LIBBPF_API annotation to bpf_object__prepare() API, to make it usable in shared library mode;
• small fix up to better handle DEVMAP/DEVMAP_HASH maps.

Full Changelog: v1.6.1...v1.6.2

Bug fix release fixing a possible crash when handling BPF arena global variable relocations.

Full Changelog: v1.6.0...v1.6.1

libbpf v1.6.0

User space-side features

• add more control over BPF object lifetime with new preparation step (bpf_object__prepare() API);
• libbpf will report symbolic error code (e.g., "-EINVAL") in addition to human-readable error description;
• bpf_prog_stream_read() API;
• BPF token support when attaching BPF trampoline-based BPF programs in bpf_program__set_attach_target();
• BPF token support for BPF_BTF_GET_FD_BY_ID command;
• support multi-uprobe session (SEC("uprobe.session")) BPF programs;
• support unique_match option for multi-kprobe attachment;
• support creating and destroying qdisk with BPF_TC_QDISC flag;
• bpf_program__attach_cgroup_opts() which enables more precise cgroup-based attachment ordering;
• libbpf will automatically take advantage of memory-mappable kernel BTF (/sys/kernel/btf/vmlinux), if supported;
• emit_strings option for BTF dumper API, improving string-like data printing;
• add BPF program's func and line info accessors (bpf_program__{func,line}_info[_cnt]() APIs);
• BPF linker supports linking ELF object files coming from memory buffer and referenced by FD, in addition to file path-based APIs;
• small improvements to BTF dedup to handle rare quirky corner cases produces by some compilers;

BPF-side features

• likely() and unlikely() convenience macros;
• __arg_untrusted annotation for BPF global subprog arguments;
• bpf_stream_printk() macro for working with BPF streams;
• bpf_usdt_arg_size() API;

Bug fixes

As usual, a bunch of bug fixes were landed, see full commit log for details.

Full Changelog: v1.5.0...v1.6.0

Patch release with a single backported change that improves compatibility story of older versions of libbpf-cargo (Rust BPF skeleton generator) that didn't initialize struct bpf_map_skeleton's link pointer for STRUCT_OPS maps, leading to NULL pointer dereference inside libbpf's bpf_object__attach_skeleton() when libbpf-cargo is compiled and linked against libbpf v1.5, the version that introduced STRUCT_OPS map attachment support in BPF skeleton. If libbpf-cargo is either compiled against pre-v1.5 libbpf or linked at runtime (shared library scenario) against pre-v1.5 libbpf, there will be no issue.

The change relaxes libbpf's expectation of having non-NULL BPF link pointer for STRUCT_OPS maps inside the skeleton, which will accommodate BPF skeletons generated by older versions of libbpf-cargo and will skip attaching STRUCT_OPS (SEC(".struct_ops")) maps.

Full Changelog: v1.5.0...v1.5.1

Bug fix release:

• fix interop issues between generic bpf_object__open() APIs and BPF subskeleton w.r.t. global data handling;
• speed up BTF sanity checks by skipping already validated base BTF;
• fix legacy treatment of non-SEC()-annotated subprogram as entry BPF program in some cases;
• a few other smaller bugs and regressions, see changelog;

Full Changelog: v1.4.6...v1.4.7

Bug fix release:

• fix interop issues between generic bpf_object__open() APIs and BPF subskeleton w.r.t. global data handling;
• speed up BTF sanity checks by skipping already validated base BTF;
• fix legacy treatment of non-SEC()-annotated subprogram as entry BPF program in some cases;
• a few other smaller bugs and regressions, see changelog;

Full Changelog: v1.3.3...v1.3.4

User space-side features and APIs

• libbpf can now open (but not load!) BPF objects of non-native endianness, enabling cross-architecture support for BPF skeleton generation and BPF object introspection;
• BPF skeleton will now auto-attach SEC(".struct_ops") maps as part of <skeleton>__attach() call;
• BPF kprobe session programs support (SEC("kprobe.session"));
• allow specifying kernel module name for fentry/fexit BPF programs (SEC(fentry/module:function);
• libbpf recognizes LIBBPF_LOG_LEVEL environment variable, which can be used to set default log verboseness;
• BPF ringbuf APIs that limit maximum number of consumed records at a time (ring_buffer__consume_n(), ring__consume_n());
• distilled BTF support (btf__distill_base(), btf__relocate());
• BPF link-based attachment of BPF_PROG_TYPE_SOCKMAP programs (bpf_program__attach_sockmap());
• bpf_object__token_fd() API to fetch BPF token FD of a BPF object, if any;

BPF-side features and APIs

• fixes for fetching syscall arguments on arm64, s390x, risc-v architectures;
• better GCC-BPF source code compatibility;
• __bpf_fastcall support for a few BPF helpers;
• __uptr annotation definition added to bpf/bpf_helpers.h API header;

Bug fixes

• fixes and improvements around handling missing and nulled out struct_ops programs;
• fixed mmap()-ing logic for global data, fixing interop between generic bpf_object__open() APIs and BPF subskeletons;
• BPF skeleton backwards compatibility handling fixes;
• handle LTO-produced *.llvm.<hash> symbols better;
• feature detection fixes in the presence of BPF token inside user namespace;
• older kernels have broken PID filtering logic for multi-uprobes, libbpf now detects this and avoids the use of multi-uprobes for USDTs;
• fix accidental drop of FD_CLOEXEC flag during BPF map reuse;
• few BTF dumper formatting fixes;
• a few more small fixes all around.

Full Changelog: v1.4.0...v1.5.0

Bug fix release:

• BPF skeleton forward compatibility fix (f6f2402);
• BTF endianness inheritance bug fix (fe28fae).

Full Changelog: v1.4.5...v1.4.6