------------------------------------------------------------------- Wed Oct 30 15:59:44 UTC 2024 - Fredrik Lönnegren - update to 1.5.0: * libbpf can now open (but not load!) BPF objects of non-native endianness, enabling cross-architecture support for BPF skeleton generation and BPF object introspection * BPF skeleton will now auto-attach SEC(".struct_ops") maps as part of __attach() call * BPF kprobe session programs support (SEC("kprobe.session")) * allow specifying kernel module name for fentry/fexit BPF programs (SEC(fentry/module:function) * libbpf recognizes LIBBPF_LOG_LEVEL environment variable, which can be used to set default log verboseness * BPF ringbuf APIs that limit maximum number of consumed records at a time (ring_buffer__consume_n(), ring__consume_n()) * distilled BTF support (btf__distill_base(), btf__relocate()) * BPF link-based attachment of BPF_PROG_TYPE_SOCKMAP programs (bpf_program__attach_sockmap()) * bpf_object__token_fd() API to fetch BPF token FD of a BPF object, if any * fixes for fetching syscall arguments on arm64, s390x, risc-v architectures * better GCC-BPF source code compatibility * __bpf_fastcall support for a few BPF helpers * __uptr annotation definition added to bpf/bpf_helpers.h API header * fixes and improvements around handling missing and nulled out struct_ops programs * fixed mmap()-ing logic for global data, fixing interop between generic bpf_object__open() APIs and BPF subskeletons * BPF skeleton backwards compatibility handling fixes * handle LTO-produced *.llvm. symbols better * feature detection fixes in the presence of BPF token inside user namespace * older kernels have broken PID filtering logic for multi-uprobes, libbpf now detects this and avoids the use of multi-uprobes for USDTs * fix accidental drop of FD_CLOEXEC flag during BPF map reuse * few BTF dumper formatting fixes * a few more small fixes all around. ------------------------------------------------------------------- Wed Oct 30 15:29:42 UTC 2024 - Fredrik Lönnegren - update to 1.4.7: * fix interop issues between generic bpf_object__open() APIs and BPF subskeleton w.r.t. global data handling * speed up BTF sanity checks by skipping already validated base BTF * fix legacy treatment of non-SEC()-annotated subprogram as entry BPF program in some cases ------------------------------------------------------------------- Wed Sep 4 08:44:47 UTC 2024 - Fredrik Lönnegren - update to 1.4.6: * BPF skeleton forward compatibility fix (f6f2402); * BTF endianness inheritance bug fix (fe28fae). ------------------------------------------------------------------- Thu Jul 18 15:56:27 UTC 2024 - Dirk Müller - update to 1.4.5: * Another small bug fix release backporting https://github.com/ libbpf/libbpf/commit/d9f9fd5b22223ae69c62e083da6093d95a0db799 which works around kernel-side bug with USDT PID filtering on kernels that support multi-uprobe (but have broken PID filtering). ------------------------------------------------------------------- Tue Jun 4 06:10:48 UTC 2024 - Shung-Hsi Yu - update to 1.4.3: * Fix libbpf unintentionally dropping FD_CLOEXEC flag when (internally) duping FDs ------------------------------------------------------------------- Sat May 11 07:03:51 UTC 2024 - Fredrik Lönnegren - update to 1.4.2: * Another struct_ops-focused bug fix release. It addresses a few more corner cases when dealing with SEC("struct_ops") programs. * It also improves error messaging around common use case of declaring struct_ops BPF program and not referencing it from SEC(".struct_ops") variable (backed by struct_ops BPF map). * This release should improve overall experience of using BPF struct_ops functionality. ------------------------------------------------------------------- Thu May 2 08:19:03 UTC 2024 - Fredrik Lönnegren - update to 1.4.1: * Bug fix release fixing logic around determining whether to autoload SEC("struct_ops") programs in cases when old kernel doesn't support some optional callbacks and user reset them to NULL from BPF skeleton. ------------------------------------------------------------------- Wed Apr 3 10:50:11 UTC 2024 - Shung-Hsi Yu - update to 1.4.0: * support for BPF token throughout low-level and high-level APIs (see also LIBBPF_BPF_TOKEN_PATH envvar) * struct_ops functionality around handling multi-kernel compatibility using BPF CO-RE principles and approaches * BPF arena map support * support __arena tagged global variables, which are automatically put into BPF arena map * BPF cookie support for raw tracepoint BPF programs in attach APIs loaded or created, respectively * add SEC("sk_skb/verdict") support * support global subprog argument tagging for for kprobe/uprobe, and perf_event BPF program with newly added __arg_ctx, __arg_nonnull, __arg_nullable, __arg_trusted, and __arg_arena annotations * add bpf_core_cast() macro, improving ergonomics of bpf_rdonly_cast() BPF helper * __long() macro added for specifying 64-bit values when declaring BTF-defined maps * better GCC-BPF support in BPF CO-RE macros in bpf_core_read.h header * show specific error messages when attempting to use struct bpf_program/bpf_map instances there were not loaded or created * fix inner map's max_entries setting logic * btf_ext__raw_data() and btf__new_split() APIs are added back * ignore DWARF sections in BPF linker sanity checks, improving handling of some corner cases * fix potential NULL dereference when handling corrupted ELF files. ------------------------------------------------------------------- Sat Nov 25 09:45:41 UTC 2023 - Dirk Müller - update to 1.3.0: * support for `netfilter` programs is added `SEC("netfilter")` is now available * API function `bpf_program__attach_netfilter()` is now available * support for `tcx` BPF programs is added: * the following new SEC definitions are now available: SEC("tc/egress"), SEC("tc/ingress"), SEC("tcx/egress"), SEC("tcx/ingress") * the following SEC definitions are now considered legacy: SEC("tc"), SEC("action"), SEC("classifier") * functions `bpf_prog_attach_opts()` and `bpf_prog_query_opts()` are extended to work with `tcx` programs, plus two new API functions are added: * the following new SEC definitions are now available: SEC("uprobe.multi"), SEC("uprobe.multi.s"), SEC("uretprobe.multi"), SEC("uretprobe.multi.s") * support for section `SEC("usdt.s")` is added for sleepable `usdt` programs; * support for Unix domain socket cgroup BPF programs is added the following new SEC definitions are now available: SEC("cgroup/connect_unix"),SEC("cgroup/sendmsg_unix"), SEC("cgroup/recvmsg_unix"), SEC("cgroup/getpeername_unix"), SEC("cgroup/getsockname_unix") * new `LIBBPF_OPTS_RESET()` utility macro; * new `bpf_object__unpin()` function to complement existing `bpf_object__pin()`; * new API functions for work with ring buffers * uprobe SEC matcher extended to allow golang symbols; * uprobe support for symbols versioning; * `bpf_map__set_value_size()` can now be used to resize memory mapped region for memory mapped maps; * `struct bpf_xdp_query_opts` extended with `xdp_zc_max_segs` output field; * basic BTF sanity check pass added to reject bogus BTF. * fix for btf_dump__dump_type_data() when type contains bitfields; * fix for correct work of offsetof() and container_of() macro with CO-RE; * no longer attempt to load modules BTF when resolving CO-RE relocations if CAP_SYS_ADMIN are absent; * regex based function search for "kprobe.multi/" programs no longer attempts to trace functions that cannot be traced; * bpf_program__set_type() no longer resets sec_def if it is set to a custom fallback SEC handler; * fix for memory leak possible after bpf_program__set_attach_target() call; ------------------------------------------------------------------- Fri Jul 14 05:04:50 UTC 2023 - Shung-Hsi Yu - update to v1.2.2: * fix a regression in perf tool caused by libbpf resetting its custom catch-all SEC() handler on explicit bpf_program__set_type() call * fix possible double-free in USDT-related libbpf code, which happens when libbpf runs out of space in __bpf_usdt_specs map due to having too many unique USDT specs ------------------------------------------------------------------- Tue May 2 08:03:30 UTC 2023 - Dirk Müller - update to 1.2.0: * completely overhauled "Libbpf overview" landing documentation page; * support for BPF link-based `struct_ops` programs: * `SEC(".struct_ops.link")` annotations; * `bpf_map__attach_struct_ops()` attach API; * `bpf_link__update_map()` link update API; * support sleepable `SEC("struct_ops.s")` programs * improved thread-safety of libbpf print callbacks and `libbpf_set_print()` * improve handling and reporting of missing BPF kfuncs * `bpf_{btf,link,map,prog}_get_info_by_fd()` APIs * `bpf_xdp_query_opts()` supports fetching XDP/XSK supported features; * `perf_buffer__new()` allows customizing notification/sampling period now; * BPF verifier logging improvements: * pass-through BPF verifier log level and flags to kernel as is * support `log_true_size` for getting required log buffer size to fit BPF verifier log completely; * allow precise control over kprobe/uprobe attach mode: legacy, perf-based, link-based. * fix legacy kprobe events names sanitization; * fix clobbering errno in some cases; * fix BPF map's `BPF_F_MMAPABLE` flag sanitization; * fix BPF-side USDT support code on s390x architecture; * fix `BPF_PROBE_READ{_STR}_INTO()` on s390x architecture; * fix kernel version setting for Debian kernels; * fix netlink protocol handling in some cases; * improve robustness of attaching to legacy kprobes and uprobes; * fix double-free during static linking empty ELF sections; * a bunch of other small fixes here and there. ------------------------------------------------------------------- Thu Jan 5 07:02:19 UTC 2023 - Shung-Hsi Yu - Remove requirement of linux-glibc-devel >= 5.16 for devel package ------------------------------------------------------------------- Thu Dec 22 07:08:39 UTC 2022 - Dirk Müller - update to v1.1.0: User space-side features and APIs: * user-space ring buffer (BPF_MAP_TYPE_USER_RINGBUF) support; * new documentation page listing all recognized SEC() definitions; * BTF dedup improvements: * unambiguous fwd declaration resolution for structs and unions; * better handling of some corner cases with identical structs and arrays; * mixed enum and enum64 forward declaration resolution logic; * bpf_{link,btf,pro,mapg}_get_fd_by_id_opts() and bpf_get_fd_by_id_opts() APIs; * libbpf supports loading raw BTF for BPF CO-RE from known search paths; * support for new cgroup local storage (BPF_MAP_TYPE_CGRP_STORAGE); * libbpf will only add BPF_F_MMAPABLE flag for data maps with global (i.e., non-static) vars; * latest Linux UAPI headers with lots of changes synced into include/uapi/linux. BPF-side features and APIs; * BPF_PROG2() macro added that supports struct-by-value arguments; * new BPF helpers: * bpf_user_ringbuf_drain(); * cgrp_storage_get() and cgrp_storage_delete(). Bug fixes * better handling of padding corner cases; * btf__align_of() determines packed structs better now; * improved handling of enums of non-standard sizes; * USDT spec parsing improvements; * overflow handling fixes for ringbufs; * Makefile fixes to support cross-compilation for 32-bit targets; * fix crash if SEC("freplace") programs don't have attach_prog_fd set; * better handling of file existence checks when running as non-root with enhanced capabilities; * a bunch of small fixes: * ELF handling improvements; * fix memory leak in USDT argument parsing logic; * fix NULL dereferences in few corner cases; * improved netlink attribute iteration handling. - drop libbpf-Use-elf_getshdrnum-instead-of-e_shnum.patch, libbpf-Fix-use-after-free-in-btf_dump_name_dups.patch, libbpf-Fix-memory-leak-in-parse_usdt_arg.patch libbpf-Fix-null-pointer-dereference-in-find_prog_by_.patch (upstream) ------------------------------------------------------------------- Tue Nov 8 06:03:55 UTC 2022 - Shung-Hsi Yu - Fix out-of-bound heap write (boo#1194248 boo#1194249 CVE-2021-45940 CVE-2021-45941) + libbpf-Use-elf_getshdrnum-instead-of-e_shnum.patch - Fix use-after-free in btf_dump_name_dups (boo#1204391 CVE-2022-3534) + libbpf-Fix-use-after-free-in-btf_dump_name_dups.patch - Fix memory leak in parse_usdt_arg() (boo#1204393 CVE-2022-3533) + libbpf-Fix-memory-leak-in-parse_usdt_arg.patch - Fix null pointer dereference in find_prog_by_sec_insn() (boo#1204502 CVE-2022-3606) + libbpf-Fix-null-pointer-dereference-in-find_prog_by_.patch ------------------------------------------------------------------- Tue Oct 4 17:22:08 UTC 2022 - Dirk Müller - update to 1.0.1: * fix inadvertently changed struct bpf_object_open_opts memory layout; * fix btf.h header relying on struct enum64 type defined in kernel UAPI headers; * fix NULL pointer exception in API btf_dump__dump_type_data; * remove struct btf_map_def accidentally left in bpf_helpers.h header. * All deprecated APIs and features removed! * support for syscall-specific kprobe/kretprobe (SEC("ksyscall/") and SEC("kretsyscall/")); * support for sleepable uprobe BPF programs (SEC("uprobe.s")); * support for per-cgroup LSM BPF programs (SEC("lsm_cgroup")); * support for new BPF CO-RE relocation TYPE_MATCHES; * bpf_prog_load() and bpf_map_create() are now smarter about handling program and map name on old kernels (it will be ignored if kernel doesn't support names); * BTF_KIND_ENUM64 support; * increase tracing attachment (kprobe/uprobe/tracepoint) robustness by using tracefs or debugfs, whichever is mounted; * new APIs for converting BPF enums to their string representation: * libbpf_bpf_prog_type_str(); * libbpf_bpf_map_type_str(); * libbpf_bpf_link_type_str(); * libbpf_bpf_attach_type_str(); * bpf_program__set_autoattach() and bpf_program__autoattach() to allow opting out from auto-attaching of BPF program by BPF skeleton; * perf_buffer__buffer() API to give access to underlying per-CPU buffer for BPF ringbuf; * bpf_obj_get_opts() API for more flexible fetching of BPF kernel objects' information. - see https://github.com/libbpf/libbpf/releases/tag/v1.0.0 for detailed changelog ------------------------------------------------------------------- Wed Aug 3 13:55:13 UTC 2022 - Callum Farmer - Update to release 0.8.1: * make shared xsk creation network namespace aware ------------------------------------------------------------------- Thu May 19 03:00:36 UTC 2022 - Shung-Hsi Yu - Update to release 0.8.0 * New features and APIs: - support auto-resolution of binaries and shared libraries from PATH, if necessary; - support attaching by function names (only by IP was supported before); - support attaching to USDTs (SEC("usdt/...") and bpf_program__attach_usdt()) with initially supported architectures: x86-64 (amd64); x86 (i386); s390x; ARM64 (aarch64); RISC V (riscv); - improved BPF verifier log reporting for CO-RE relocation failures (no more obscure "invalid func unknown#195896080" errors); - auto-adjust BPF ringbuf size according to host kernel's page size requirements; - high-level BPF map APIs: bpf_map__lookup_elem(), bpf_map__update_elem(), etc that validate key/value buffer sizes; - bpf_link_create() can create all bpf_link-based (including raw_tp, fentry/fexit, etc), falling back to bpf_raw_tracepoint_open() on old kernels transparently; - support opting out from auto-loading BPF programs declaratively with SEC("?..."); - support opting out from auto-creation of declarative BPF maps with bpf_map__set_autocreate(); - support multi-kprobes (SEC("kprobe.multi/...") and bpf_program__attach_kprobe_multi_opts()); - support target-less SEC() programs (e.g., SEC("kprobe"), SEC("tp"), etc); - support BPF sub-skeletons for "incomplete" BPF object files (requires matching bpftool to generate .subskel.h); - BPF cookie support for fentry/fexit/fmod_ret BPF programs (bpf_program__attach_trace_opts()); - support for custom SEC() handlers (libbpf_register_prog_handler()). * BPF-side API - BPF-side USDT APIs. See new usdt.bpf.h header: * BPF_USDT() program wrapper macro; bpf_usdt_arg(), bpf_usdt_arg_cnt(), * bpf_usdt_cookie() helpers; - new bpf_core_field_offset() CO-RE helper and support bpf_core_field_size(type, field) forms; - barrier() and barrier_var() macros for improving BPF code generation; - __kptr and __kptr_ref tags added; - ARC architecture support in bpf_tracing.h header; - new BPF helpers: * bpf_skb_set_tstamp(); * bpf_ima_file_hash(); * bpf_kptr_xchg(); * bpf_map_lookup_percpu_elem(). * Bug fixes - netlink bug fixes; - libbpf.pc fixes to support patch releases properly; - BPF_MAP_TYPE_PERF_EVENT_ARRAY map auto-pinning fix; - minor CO-RE fixes and improvements for some corner cases; - various other small fixes and improvements. ------------------------------------------------------------------- Thu Mar 10 18:28:17 UTC 2022 - Jeff Mahoney - Enable building and packaging of static library. Explicitly enable fat LTO objects. ------------------------------------------------------------------- Mon Mar 7 11:52:14 UTC 2022 - Jan Engelhardt - Python is not used during build; remove it and help break a cycle. ------------------------------------------------------------------- Fri Mar 4 10:18:54 UTC 2022 - Jan Engelhardt - Update to release 0.7.0 * legacy BPF map definitions (using struct bpf_map_def) are deprecated when LIBBPF_STRICT_MAP_DEFINITIONS is passed to libbpf_set_strict_mode(). Please use BTF-defined map definitions. * ability to control and capture BPF verifier log output on per-object and per-program level * CO-RE support and other improvements for "light skeleton" * improved compilation when system BTF UAPI headers are outdated ------------------------------------------------------------------- Sat Dec 11 10:37:27 UTC 2021 - Jan Engelhardt - Update to release 0.6.1 * Introduce legacy kprobe events support * Add legacy uprobe attaching support * Support uniform BTF-defined key/value specification across all BPF maps * Support kernel module function calls * Support detecting and attaching of writable tracepoint program * Add bloom filter map implementation * Add typeless and weak ksym support to gen_loader * Add RISC-V (RV64) support to bpf_tracing.h * Deprecate AF_XDP support * Support BTF_KIND_TYPE_TAG ------------------------------------------------------------------- Mon Sep 27 11:02:49 UTC 2021 - Shung-Hsi Yu - Update to 0.5.0: + New features and user-space APIs: - libbpf_set_strict_mode() allowing to opt-in into backwards incompatible libbpf-1.0 changes. See "Libbpf: the road to 1.0" and "Libbpf 1.0 migration guide" for more details. - streamlined error reporting for low-level APIs, high-level error-returning APIs, and pointer-returning APIs (as a libbpf-1.0 opt-in); - "Light" BPF skeleton support; - BPF_PROG_TYPE_SYSCALL support; - BPF perf link support for kprobe, uprobe, tracepoint, and perf_event BPF programs; - BPF cookie support for kprobe, uprobe, tracepoint, and perf_event BPF programs through bpf_program__attach_[ku]probe_opts() APIs; - allow to specify ref_ctr_off for USDT semaphores through bpf_program__attach_uprobe_opts() API; - btf_custom_path support in bpf_object_open_opts, allowing to specify custom BTF for CO-RE relocations; - sk_reuseport/migrate program type support; - btf_dump__dump_type_data() API, allowing to dump binary data according to BTF type description; - btf__load_into_kernel() and btf__load_from_kernel_by_id(), and split BTF variants of them; - btf__load_vmlinux_btf() and btf__load_module_btf() APIs; - bpf_map__initial_value() API to get initial value of mmap-ed BPF maps; - bpf_map_lookup_and_delete_elem_flags() API. + BPF-side APIs and features: - support for weak typed __ksym externs; - BPF timer helpers: bpf_timer_init(), bpf_timer_set_callback(), bpf_timer_start(), bpf_timer_cancel(); - bpf_get_attach_cookie() helper to get BPF cookie from BPF program side; - bpf_get_func_ip() helper; - bpf_sys_bpf() helper; - bpf_task_pt_regs() helper; - bpf_btf_find_by_name_kind() helper; - usability improvements for bpf_tracing.h when target architecture is missing. + Bug fixes and compatibility improvements: - improve BPF support detection on old Red Hat kernels with backported BPF patches; - improvements for LTO builds with GCC 10+; - pass NLM_F_EXCL when creating TC qdisc; - better support of BPF map reuse on old kernels; - fix the bug resulting in sometimes closing FD 0, which wasn't created and owned by libbpf itself. - Remove patches merged upstream + libdir.patch + libbpf-Fix-build-with-latest-gcc-binutils-with-LTO.patch ------------------------------------------------------------------- Fri Aug 27 06:20:53 UTC 2021 - Michal Suchanek - Fix LTO build (bsc#1188749). + libbpf-Fix-build-with-latest-gcc-binutils-with-LTO.patch ------------------------------------------------------------------- Fri Aug 20 08:47:47 UTC 2021 - Michal Suchanek - Depend on new enough Linux headers. ------------------------------------------------------------------- Mon Aug 2 11:00:28 UTC 2021 - Callum Farmer - Create libbpf0-32bit needed by libdwarves1-32bit ------------------------------------------------------------------- Sat Jul 17 15:38:52 UTC 2021 - Michal Suchanek - libbpf is now a separate project, stop building from the kernel (bsc#1188419 jsc#SLE-17288 jsc#SLE-18805). - Fix LIBSUBDIR + libdir.patch ------------------------------------------------------------------- Mon Jun 8 23:52:39 UTC 2020 - Michał Rostecki - Add python3 as a build dependency. ------------------------------------------------------------------- Sun Feb 2 19:50:55 UTC 2020 - Michał Rostecki - Build libbpf from kernel sources, not from github sources, for consistency with bpftool package. ------------------------------------------------------------------- Tue Jan 7 14:36:44 UTC 2020 - Tomáš Chvátal - Reflect SUSE CFLAGS - Do not bother with obscpio if we are fetching direct releases - Remove patch 0001-makefile-Fix-install-target.patch seems to build/install without it just fine - Update to 0.0.6: + New features - new extensible bpf_object__open_{file,mem} APIs and DECLARE_LIBBPF_OPTS() macro to go with them - bpf_helpers.h, bpf_endian.h, and bpf_tracing.h are now distributed with libbpf - BPF CO-RE: added field size, field existence, and bitfield relocation support - BPF CO-RE: BPF_CORE_READ(), bpf_core_field_exists(), bpf_core_field_size() and other BPF CO-RE related helpers available through bpf_core_read.h header - bpf_object__open() API now auto-detects program type from its section name - BPF_PROG_TRACING programs support (incuding BTF-typed raw tracepoints, fentry/fexit programs) - mmap() support for BPF global variables - declarative map pinning support added - probe_read_{user,kernel}[_str]() BPF helpers added - bpf_get_link_xdp_info() function to get more XDP information added - a bunch of other AF_XDP changes + Usability improvements - no need for int version SEC('version') = 1; anymore - raw_tp/tp and uprobe/uretprobe section prefixes added - new bpf_program__get_{type,expected_attach_type} getters - preserve error code on program load failure + Fixes - btf_dump padding handling - bpf_object__name() returning name, not path - ELF section handling off-by-one bug fix - mem leak/double free fix in BPF program relocation code ------------------------------------------------------------------- Tue Oct 1 09:15:18 UTC 2019 - Michał Rostecki - Initial release