bpftool v7.8

Breaking changes

• JSON output for bpftool cgroup show and bpftool cgroup tree: the attach_flags field is now an array of strings, instead of a single string. For example, "attach_flags": "multi" becomes "attach_flags": ["multi"], and programs attached without flags now report "attach_flags": [] instead of "attach_flags": "". Unknown flag bits are reported as an additional "unknown(<hex>)" element. (95a70c2)
• Light skeletons generated by bpftool now require libbpf v1.8 headers. The size of memory-mapped data maps is now computed at runtime from the page size of the host running the skeleton, rather than from the page size of the host where bpftool generated it (this fixes loading skeletons generated on 64K-page hosts and run on 4K-page hosts). As a result, the generated code passes the value size and number of entries to the skel_prep_map_data(), skel_free_map_data(), and related helpers from libbpf's skel_internal.h, whose signatures changed accordingly. Light skeletons generated with bpftool v7.8 are expected to fail to compile against an older skel_internal.h. (c2901ea)
• Program signatures now cover the loader metadata. When signing a light skeleton loader (bpftool gen skeleton -L -S ...), bpftool now signs the concatenation of the loader instructions and the metadata blob, instead of the instructions alone. This matches the new kernel-side verification at load time, introduced in Linux 7.3, which replaces the in-loader hash check. Signed loaders generated with bpftool v7.8 will not pass signature verification on older kernels, and conversely, signed loaders generated with older bpftool versions need to be regenerated for newer kernels. (10457cb)

New features

• Add support for the BPF_F_PREORDER cgroup attach flag: bpftool cgroup attach <cgroup> <attach_type> <prog> [multi | override] preorder requests ancestor-to-descendant execution for the program across the cgroup hierarchy. bpftool cgroup show and bpftool cgroup tree now display it instead of unknown(40), unknown(41), or unknown(42). Requires Linux 6.15 or newer. (95a70c2)
• Add a -w/--wait option to bpftool prog tracelog { stdout | stderr } PROG, to keep printing BPF streams output as the program produces it, until the program is unloaded or the user hits Ctrl+C. This relies on the new BPF_PROG_STREAM_OPEN command for the bpf() system call, introduced in Linux 7.4. Without the option, bpftool keeps dumping the buffered output and exiting, as before. (ac93739, 74e0a1d)
• Support reading from ring buffer maps (BPF_MAP_TYPE_RINGBUF) with bpftool map event_pipe, in plain or JSON output. Note that this consumes the records (advancing the shared consumer position), so the command should not run alongside other consumers of the same map. (50edea1)
• Support dumping new BTF location kinds (LOC_PARAM, LOC_PROTO, LOCSEC) used to describe inline sites of kernel functions, with bpftool btf dump. For LOCSEC entries, the function signature is displayed alongside the location of its parameters. (9ac6315, 3060662)
• Support multi-split BTF by accepting several -B/--base-btf options, from the root to the leaf. For example, to dump the inline information for the xfs module: bpftool btf dump -B /sys/kernel/btf/vmlinux -B /sys/kernel/btf/xfs file /sys/kernel/btf/xfs.inline. (60bc161, ee6150c)
• Support BTF objects with 24-bit vlen values, as allowed by the extended BTF UAPI. (cb38e42)
• Display information for tracing_multi links (bpftool link show), including attach type, BTF object ID, and the list of BTF IDs, addresses, cookies and function names for the attach points. (bed775a)
• Generate skeletons for global per-CPU data (variables in .percpu sections), with a dedicated <name>__percpu structure to set initial values before loading. (e34d1f2)
• Add support for ML-DSA keys for program signing, and raise the maximum signature size from 4 KiB to 16 KiB to accommodate ML-DSA-87 signatures. (ea79964)
• Improve bpftool prog profile: group selected events per CPU so that derived ratios use counters scheduled over the same intervals, scale counter values to account for PMU multiplexing, accept zero counter snapshots, and report the number of cycles per program run when cycles is selected. (847080b, beaaa1c, c7bb762)
• Print BPF_PROBE_ATOMIC instructions (atomics on arena pointers) as regular atomic instructions with a probe_ prefix when dumping translated programs, instead of BUG_XX. Also add support for the new callx instruction (indirect calls to BPF subprograms) in the disassembler. (09a041b, 8407ffa)
• Add documentation for the resizable hash map type (rhash) and for the fsession attach type. (f53b7c7, 36413e3)

Bug fixes

• Fix the display of CPU IDs reported for per-CPU map values on systems where the mask of possible CPUs is sparse (for example, 0,2-3): report the actual logical CPU IDs, instead of the index of the value in the buffer. There is no change on systems with contiguous CPU IDs. (722f3ae)
• Fix the logical CPU IDs used by bpftool prog profile on systems with a sparse possible CPU mask, which could miss valid CPUs and use incorrect keys for the perf event array. (d081f16)
• Fix decoding of instructions such as LSE atomics for aarch64 when dumping JIT-compiled programs, instead of producing incorrect or truncated output, by enabling all ISA extensions in the LLVM disassembler for aarch64. (3db713e)
• Fix light skeleton generation for programs with struct_ops maps, where a literal t was emitted instead of a tab character, breaking compilation of the generated skeleton. (bb09e43)
• Fix the sorted BTF dump in C format (the default), which would skip one type (typically an anonymous enum). (0669dd7)
• Set the BPF_F_XDP_DEV_BOUND_ONLY flag non-destructively when loading XDP programs with xdpmeta_dev, to avoid overwriting other program flags such as the XDP frags flag. (9b1d9fd, ce7f888)
• Skip programs or maps that disappear while bpftool looks them up by name, instead of aborting the whole command. (bac3d43)
• Fix several issues in batch mode: a double close() in bpftool map dump that left a stale errno, a spurious read error on the batch file caused by such stale errno values, and a bypass of the line length check for lines containing comments, which could cause the remainder of an overlong line to be executed as a separate command. (4970b01, 75698ca, fc2a7f5)
• Fix use-after-free or stale state for vmlinux BTF objects in batch mode after map and struct_ops commands, and fix a vmlinux BTF memory leak in bpftool cgroup show and bpftool cgroup tree. (eb6e296, 1c6cfef, a725e68)
• Use the error code returned by libbpf rather than errno when querying flow dissector programs in bpftool net, so that an intervening close() does not alter the handling of older kernels. (12f1365)
• Check the return value of EVP_Digest() when computing the hash for the exclusive map during program signing. (5898218)
• Reject invalid signed double-word load (LDSX) instructions in the disassembler, rather than reading past the end of the mnemonics table. (56c55a9)

Compared to tag v7.8.0, tag v7.8.1 adds a missing include definition that would prevent from building on aarch64. (3e1a35a)

Build changes

• Add SKIP_LLVM, SKIP_LIBBFD, and SKIP_CRYPTO build flags to explicitly build bpftool without the corresponding dependencies (even when available). Building with SKIP_LLVM=1 SKIP_LIBBFD=1 produces a bpftool without JIT disassembly support; building with SKIP_CRYPTO=1 removes the dependency on OpenSSL's libcrypto, at the cost of program signing support. (9ba0b4a)
• Pass the host flags to the bootstrap libbpf build, and avoid passing target flags from EXTRA_CFLAGS to the host compiler, to fix cross-compilation. A new HOST_EXTRACFLAGS variable can be used to pass additional flags to the host compiler. (bb7ac52, 7e2989c, 0374f48, 552fb97)
• Skip unnecessary feature tests when building the bootstrap version of bpftool. (82a843a)

Other internal changes

• Use libbpf's bpf_program__add_flags() helper. (ce7f888)
• Use the btf_vlen(), btf_kind(), btf_kflag() helpers consistently. (3bf2b37)
• Rework newline handling for printing instructions in the disassembler shared with the kernel; no change in output. Also, mask additional pseudo pointer values in the shared disassembler. (dc36211, ed500cb)
• Update UAPI headers, and the libbpf submodule to libbpf v1.8.0.

Known bugs

• Static builds on Ubuntu 24.04 relying on the libbfd-based disassembler may fail, because of missing linker flags to add the zstd and sframe libraries. Workarounds include using the LLVM-based disassembler instead, using no disassembler (for example, with the SKIP_LIBBFD=1 Makefile flag), or using libbfd < 2.40. (#73)

Full Changelog: v7.7.0...v7.8.1