Single fix (https://github.com/libbpf/libbpf/pull/795) on top of v0.8.1, fixing the name of bpf_program__pin_instance() API call, previously erroneously specified as bpf_object__pin_instance() in the code.

Note that we skip v0.8.2, as its Github release tagging was broken.

Note, this API is gone in v1.0+.

Full Changelog: https://github.com/libbpf/libbpf/compare/v0.8.1...v0.8.3

UPDATE: this v0.8.2 release is screwed up and point to latest v1.4.0, please don't use it, v0.8.3 is the right now to package/use. Sorry for the confusion and wasted time!

Single fix (https://github.com/libbpf/libbpf/pull/795) on top of v0.8.1, fixing the name of bpf_program__pin_instance() API call, previously erroneously specified as bpf_object__pin_instance() in the code.

Note, this API is gone in v1.0+.

libbpf v1.4.0

User space-side features and APIs

• support for BPF token throughout low-level and high-level APIs (see also LIBBPF_BPF_TOKEN_PATH envvar);
• a bunch of struct_ops functionality added, mostly around handling multi-kernel compatibility using BPF CO-RE principles and approaches:
  • support struct_ops defined in kernel modules;
  • support "flavor" suffixes (___smth) for struct_ops types, allowing to define two incompatible definitions for the same target struct_ops kernel type;
  • support disabling/enabling auto-creation of struct_ops variables (maps):
    • SEC("?.struct_ops") and SEC("?.struct_ops.link") are now supported, default to not auto-create struct_ops map;
    • bpf_map__set_autocreate() is now honored for struct_ops maps;
  • disabling auto-creation of struct_ops variable (map) disables auto-loading of related BPF programs (unless they are shared between multiple struct_ops), which means that disabling struct_ops map creation behaves naturally w.r.t. related BPF programs and doesn't require explicitly disabling them from auto-loading;
  • support struct_ops "shadow type" through BPF skeleton, allowing to set/adjust custom data fields and also set/reset/change specific BPF programs implementing struct_ops' callbacks;
• BPF arena map support;
• BPF cookie support for raw tracepoint BPF programs in attach APIs;
• helpful error messages added to libbpf logs when attempting to use struct bpf_program or struct bpf_map instances there were not loaded or created, respectively;
• SEC("sk_skb/verdict") support;

BPF-side features and APIs

• support global subprog argument tagging:
  • __arg_ctx, __arg_nonnull, __arg_nullable, __arg_trusted, and __arg_arena annotations added;
  • for kprobe/uprobe, and perf_event BPF program types, support fallback logic making __arg_ctx work on older kernels that don't yet support __arg_ctx (i.e., arg:ctx decl tag) annotation natively;
• bpf_core_cast() macro added, improving ergonomics of bpf_rdonly_cast() BPF helper;
• support __arena tagged global variables, which are automatically put into BPF arena map;
• __long() macro added for specifying 64-bit values when declaring BTF-defined maps;
• better GCC-BPF support in BPF CO-RE macros in bpf_core_read.h header;

Bug fixes

• fix faccessat() internal usage, breaking Android versions of libbpf;
• use OPTS_SET() in bpf_xdp_query() for better backward/forward compatibility;
• fix inner map's max_entries setting logic;
• btf_ext__raw_data() and btf__new_split() APIs are added back, they were "lost" during libbpf v1.0 release process;
• ignore DWARF sections in BPF linker sanity checks, improving handling of some corner cases;
• fix potential NULL dereference when handling corrupted ELF files.

Full Changelog: https://github.com/libbpf/libbpf/compare/v1.3.0...v1.4.0

libbpf v1.3.0

User space-side features and APIs

• support for netfilter programs is added:
  • SEC("netfilter") is now available
  • API function bpf_program__attach_netfilter() is now available
• support for tcx BPF programs is added:
  • the following new SEC definitions are now available:
    • SEC("tc/egress")
    • SEC("tc/ingress")
    • SEC("tcx/egress")
    • SEC("tcx/ingress")
  • the following SEC definitions are now considered legacy:
    • SEC("tc")
    • SEC("action")
    • SEC("classifier")
  • functions bpf_prog_attach_opts() and bpf_prog_query_opts() are extended to work with tcx programs, plus two new API functions are added:
    • bpf_prog_detach_opts()
    • bpf_program__attach_tcx()
• support for multi-uprobe programs is added:
  • the following new SEC definitions are now available:
    • SEC("uprobe.multi")
    • SEC("uprobe.multi.s")
    • SEC("uretprobe.multi")
    • SEC("uretprobe.multi.s")
  • plus a new API function:
    • bpf_program__attach_uprobe_multi()
• support for section SEC("usdt.s") is added for sleepable usdt programs;
• support for Unix domain socket cgroup BPF programs is added the following new SEC definitions are now available:
  • SEC("cgroup/connect_unix")
  • SEC("cgroup/sendmsg_unix")
  • SEC("cgroup/recvmsg_unix")
  • SEC("cgroup/getpeername_unix")
  • SEC("cgroup/getsockname_unix")
• new LIBBPF_OPTS_RESET() utility macro;
• new bpf_object__unpin() function to complement existing bpf_object__pin();
• new API functions for work with ring buffers:
  • ring_buffer__ring()
  • ring__producer_pos()
  • ring__consumer_pos()
  • ring__avail_data_size()
  • ring__size()
  • ring__map_fd()
  • ring__consume()
• path_fd support for bpf_obj_pin() and bpf_obj_get();
• uprobe SEC matcher extended to allow golang symbols;
• uprobe support for symbols versioning;
• bpf_map__set_value_size() can now be used to resize memory mapped region for memory mapped maps;
• struct bpf_xdp_query_opts extended with xdp_zc_max_segs output field;
• basic BTF sanity check pass added to reject bogus BTF.

BPF-side features and APIs

• triple-underscore flavors for kfunc relocation: like with CO-RE structs ___.* suffix is ignored when kfunc relocations are resolved;
• __percpu_kptr macro definition in bpf_helpers.h;
• support for exception callbacks, use __attribute__(btf_decl_tag("exception_callback:<func_name>")) to specify exception callback for a program;

Bug fixes

• fix for btf_dump__dump_type_data() when type contains bitfields;
• fix for correct work of offsetof() and container_of() macro with CO-RE;
• no longer attempt to load modules BTF when resolving CO-RE relocations if CAP_SYS_ADMIN are absent;
• regex based function search for "kprobe.multi/" programs no longer attempts to trace functions that cannot be traced;
• bpf_program__set_type() no longer resets sec_def if it is set to a custom fallback SEC handler;
• fix for memory leak possible after bpf_program__set_attach_target() call;

Bug fix release

Two bug fixes:

• Fix a regression in perf tool caused by libbpf resetting its custom catch-all SEC() handler on explicit bpf_program__set_type() call. Given custom SEC() handlers is a rarely used pretty esoteric feature of libbpf, most users should not be affected.
• Fix possible double-free in USDT-related libbpf code, which happens when libbpf runs out of space in __bpf_usdt_specs map due to having too many unique USDT specs. Running out of space can be mitigated by bumping up BPF_USDT_MAX_SPEC_CNT define before including bpf/usdt.bpf.h header in BPF-side code. This will prevent the double-free as a side effect (and will make it possible to successfully attach all requested USDTs), which is a recommended work-around for libbpf versions prior to v1.2.2.

User space-side features and APIs:

• completely overhauled "Libbpf overview" landing documentation page;
• support attaching to uprobes/uretprobes to functions defined in Android APK archives;
• support for BPF link-based struct_ops programs:
  • SEC(".struct_ops.link") annotations;
  • bpf_map__attach_struct_ops() attach API;
  • bpf_link__update_map() link update API;
• support sleepable SEC("struct_ops.s") programs;
• improved thread-safety of libbpf print callbacks and libbpf_set_print();
• improve handling and reporting of missing BPF kfuncs;
• bpf_{btf,link,map,prog}_get_info_by_fd() APIs;
• bpf_xdp_query_opts() supports fetching XDP/XSK supported features;
• perf_buffer__new() allows customizing notification/sampling period now;
• BPF verifier logging improvements:
  • pass-through BPF verifier log level and flags to kernel as is;
  • support log_true_size for getting required log buffer size to fit BPF verifier log completely;
• allow precise control over kprobe/uprobe attach mode: legacy, perf-based, link-based.

BPF-side features and APIs;

• support for BPF open-coded iterators: bpf_for(), bpf_repeat(), bpf_for_each();
• bpf_ksym_exists() macro to check existence of ksyms/kfuncs and kconfig values;
• BPF_UPROBE() and BPF_URETPROBE() macros;
• BPF_KPROBE() and BPF_UPROBE() macros allow fetching up to 8 passed in registers arguments, depending on architecture support;
• BPF_KSYSCALL() supports fetching all 6 syscall arguments now;
• LoongArch support in bpf_tracing.h;
• USDT support for 32-bit ARM architecture.

Bug fixes

• fix legacy kprobe events names sanitization;
• fix clobbering errno in some cases;
• fix BPF map's BPF_F_MMAPABLE flag sanitization;
• fix BPF-side USDT support code on s390x architecture;
• fix BPF_PROBE_READ{_STR}_INTO() on s390x architecture;
• fix kernel version setting for Debian kernels;
• fix netlink protocol handling in some cases;
• improve robustness of attaching to legacy kprobes and uprobes;
• fix double-free during static linking empty ELF sections;
• a bunch of other small fixes here and there.

Full Changelog: https://github.com/libbpf/libbpf/compare/v1.1.0...v1.2.0

User space-side features and APIs:

• user-space ring buffer (BPF_MAP_TYPE_USER_RINGBUF) support;
• new documentation page listing all recognized SEC() definitions;
• BTF dedup improvements:
  • unambiguous fwd declaration resolution for structs and unions;
  • better handling of some corner cases with identical structs and arrays;
  • mixed enum and enum64 forward declaration resolution logic;
• bpf_{link,btf,pro,mapg}_get_fd_by_id_opts() and bpf_get_fd_by_id_opts() APIs;
• libbpf supports loading raw BTF for BPF CO-RE from known search paths;
• support for new cgroup local storage (BPF_MAP_TYPE_CGRP_STORAGE);
• libbpf will only add BPF_F_MMAPABLE flag for data maps with global (i.e., non-static) vars;
• latest Linux UAPI headers with lots of changes synced into include/uapi/linux.

BPF-side features and APIs;

• BPF_PROG2() macro added that supports struct-by-value arguments;
• new BPF helpers:
  • bpf_user_ringbuf_drain();
  • cgrp_storage_get() and cgrp_storage_delete().

Bug fixes

• BTF-to-C converter fixes:
  • better handling of padding corner cases;
  • btf__align_of() determines packed structs better now;
  • improved handling of enums of non-standard sizes;
• USDT spec parsing improvements;
• overflow handling fixes for ringbufs;
• Makefile fixes to support cross-compilation for 32-bit targets;
• fix crash if SEC("freplace") programs don't have attach_prog_fd set;
• better handling of file existence checks when running as non-root with enhanced capabilities;
• a bunch of small fixes:
  • ELF handling improvements;
  • fix memory leak in USDT argument parsing logic;
  • fix NULL dereferences in few corner cases;
  • improved netlink attribute iteration handling.

Full Changelog: https://github.com/libbpf/libbpf/compare/v1.0.1...v1.1.0

Fixing few issues that were reported since v1.0 release:

• fix inadvertently changed struct bpf_object_open_opts memory layout;
• fix btf.h header relying on struct enum64 type defined in kernel UAPI headers;
• fix NULL pointer exception in API btf_dump__dump_type_data;
• remove struct btf_map_def accidentally left in bpf_helpers.h header.

Also libbpf will attempt to load vmlinux BTF from well known locations both ELF file (.BTF section) or as raw BTF binary data.

Full Changelog: https://github.com/libbpf/libbpf/compare/v1.0.0...v1.0.1

Libbpf 1.0 is here!

User-space-side features and APIs:

• All deprecated APIs and features removed!
• support for syscall-specific kprobe/kretprobe (SEC("ksyscall/<syscall_name>") and SEC("kretsyscall/<syscall_name>"));
• support for sleepable uprobe BPF programs (SEC("uprobe.s"));
• support for per-cgroup LSM BPF programs (SEC("lsm_cgroup"));
• support for new BPF CO-RE relocation TYPE_MATCHES;
• bpf_prog_load() and bpf_map_create() are now smarter about handling program and map name on old kernels (it will be ignored if kernel doesn't support names);
• BTF_KIND_ENUM64 support;
• increase tracing attachment (kprobe/uprobe/tracepoint) robustness by using tracefs or debugfs, whichever is mounted;
• new APIs for converting BPF enums to their string representation:
  • libbpf_bpf_prog_type_str();
  • libbpf_bpf_map_type_str();
  • libbpf_bpf_link_type_str();
  • libbpf_bpf_attach_type_str();
• bpf_program__set_autoattach() and bpf_program__autoattach() to allow opting out from auto-attaching of BPF program by BPF skeleton;
• perf_buffer__buffer() API to give access to underlying per-CPU buffer for BPF ringbuf;
• bpf_obj_get_opts() API for more flexible fetching of BPF kernel objects' information.

BPF-side features and APIs;

• bpf_core_type_matches() helper macro to emit TYPE_MATCHES CO-RE relocations;
• USDT support now doesn't rely on BPF CO-RE;
• new and improved BPF_KSYSCALL() macro for tracing syscalls, which abstracts away a lot of kernel- and architecture-specific differences;
• new BPF helpers:
  • bpf_skc_to_mptcp_sock();
  • bpf_dynptr_from_mem();
  • bpf_ringbuf_reserve_dynptr(), bpf_ringbuf_submit_dynptr(), bpf_ringbuf_discard_dynptr();
  • bpf_dynptr_read(), bpf_dynptr_write();
  • bpf_dynptr_data();
  • bpf_tcp_raw_gen_syncookie_ipv4(), bpf_tcp_raw_gen_syncookie_ipv6(), bpf_tcp_raw_check_syncookie_ipv4(), bpf_tcp_raw_check_syncookie_ipv6();
  • bpf_ktime_get_tai_ns().

Bug fixes

• fix power-of-2 check when adjusting BPF ringbuf map size;
• improve robustness of pointer size determination in BTF processing;
• symbol offset calculation logic fixes for uprobes and USDTs;
• fixes for clean up of legacy kprobe/uprobe attachments on partial failures;
• fix register definition for riscv architecture;
• improve robustness of reused map name handling.

Full Changelog: https://github.com/libbpf/libbpf/compare/v0.8.0...v1.0.0

Single backported AF_XDP fix on top of v0.8.1: https://github.com/libbpf/libbpf/pull/533