New features
- Add new commands
bpftool tracelog <stdout|stderr> PROG
to print the BPF streams content of a given BPF program. (faad8ad) - Allow users to specify a custom path for BTF information when loading programs with bpftool. (6977b71)
- Add a
root_id
argument when dumping a BTF object, in order to have bpftool print a minimized dump (type and dependencies) of a specific type from the BTF object. (2c5b7fd) - Add probe for ISA v4 instruction set extensions. New BPF instructions include:
BPF_{SDIV,SMOD}
(signed div and mod),BPF_{LD,LDX,ST,STX,MOV}
(sign-extended load/store/move), 32-bitBPF_JA
(unconditional jump), target-independentBPF_ALU64 BSWAP
(byte-swapping 16/32/64). Availability is now probed as part ofbpftool feature probe
. (a5c0580) - Display additional information about BPF links, such as
ref_ctr_offset
for uprobe links, cookies forraw_tp
probes andtracing
probes. (1375884, c4c2dd0, 2406596) - Support "load-acquire" and "store-release" atomic instructions in the disassembler for translated programs. (452f644)
- Make bpftool request fewer permissions, via libbpf's options, when possible for map operations: use read-only access for operations that don't require write access (for example, map creation requires write access, map dump can work with read-only access). (224edf4)
Bug fixes
- Fix an error for
callq
addresses printed when dumping translated programs, which was due to a wrong program counter (PC) value when calling the disassembler. (e4fbb51) - Fix a potential NULL pointer dereferencing error when dumping programs when we fail to retrieve kernel symbols correctly. (4608b98)
- Fix a segfault when generating the control flow graph (CFG) with a building block containing a
BPF_CALL
as last instruction. (731868d) - Fix a regression for
bpftool cgroup tree
, potentially causing bpftool to complain about an invalid argument when it should just skip unsupported attach types that are not supported on older kernels. (ede6487) - Fix
bpftool cgroup show
to make it show only cgroup BPF programs. Some conflicting C union values would make it dump netkit programs if the netkit device has ifindex 3. (35cab59) - When dumping BTF objects, validate
root_type_ids
early. This prevents bpftool from doing a partial dump before doing an unclean exit. (a3150e1) - Set the error code when failing to open the object file for loading programs, rather than returning 0 as if the command had succeeded. (30e4f38)
- Fix a memory leak in the JSON writer, when printing bpftool's version. (f0358a7)
- Fix a memory leak due to a bad
realloc()
usage, when listing networking programs. (5380d18) - Add missing format argument to command description for
bpftool btf dump
in man page. (9e14c3b)
Other internal changes
- BPF map names can contain a maximum of 15 characters. When a user creates a map with bpftool and passes a name that is too long, the name gets truncated. This truncation was silent; now, bpftool prints a warning in this case. (60b1305)
- Avoid setting the
_GNU_SOURCE
macro multiple times in the Makefile when compiling with clang. (aa631ec) - Fix Makefile's linker flags to pass the zstd library when libelf requires it as a dependency. This fixed the linker flags for libelf in bpftool in the kernel repository. However, the corresponding probe in the mirror repository was only added in commit f964613, which is not included in v7.6.0. (67f1758)
- Compile bpftool with
-Wformat-signedness
to detect format errors. Several errors of this kind have been fixed, too. (4c56992, 02d3ecd, 4c363d6)
Known bugs
- Static builds on Ubuntu 24.04 may fail because of a missing linker flag to add the zstd library. Note: this is now fixed in the
main
branch. (#152) - Static builds on Ubuntu 24.04 relying on the libbfd-based disassembler may fail as well, because of missing linker flags to add the zstd and sframe libraries. Workarounds include using the LLVM-based disassembler instead, using no disassembler, using libbfd < 2.40, or manually overwriting all
LIBS
flags when building bpftool (it's ugly but it works). (#73)
Full Changelog: v7.5.0...v7.6.0