bpftool v7.1
New features
- Add support for disassembling JIT-compiled programs with the LLVM library (instead of libbfd), and switch to LLVM by default. Disassembling with libbfd is still supported as a fallback if the LLVM library is not present when building bpftool. This is to help with packaging, and in response to several API changes from libbfd that we've had to handle.
- Add an
autoattach
feature tobpftool prog (load|loadall)
, to tell bpftool to attach as BPF links some tracing programs immediately after loading them, using the information found in the ELF object file, provided this information is sufficient. - Add support for cgroup local storage, and user ring buffer maps.
- Show parameters of BPF task iterators (
tid
,pid
) when listing them. - Support dumping more information for cgroup iterator links, such as the cgroup ID and the order for walking the cgroup hierarchy.
- Add
boostrap
feature to version output, to tell if thebpftool
binary is a “bootstrap” version (limited in features, used as an intermediary build step for compiling BPF skeletons used by bpftool) or not. - Set binary name in interactive help output to
bpftool
instead ofargv[0]
, for more consistency accross installations (and with other tools like iproute2). - Add a Dockerfile to the current repository to easily run bpftool from a Docker image.
Bug fixes
- When displaying a cgroup tree, with some programs from a sub-cgroup overriding those of a parent cgroup, remove attach flags for those effective sub-cgroup programs, given that these flags do not make sense in that case (they only do for the programs attached to the parent cgroup) .
- Fix a null pointer dereferencing when attempting to pin a BPF object without providing a file name.
- Fix a wrong type cast in the code in charge of dumping BTF objects.
- Fix some error messages that would produce
unknown error
s, when we do in fact know the nature of the error. - Fix a typo in an error message of the disassembler for JIT-compiled programs.
- Fix display of libbfd-related features as detected by the Makefiles of the mirror repository, at build time.
Other internal changes
- Turn asserts in the disassembler for JIT-compiled programs into error handling, for consistency with the rest of the code.
- Enable verbose builds in CI.
- Add CI linters for the synchronisation script and the Dockerfile, clean up issues reported by the linters.
- Add a
README.md
file underscripts/
to explain howsync-kernel.sh
works.
Known bugs
- Some features requiring the use of “skeletons” (
feature-clang-bpf-co-re
compilation option) require kernel 5.15 or more recent, withCONFIG_PERF_EVENTS
set, to compile bpftool (#17). - Command
bpftool cgroup tree
may be broken when running with kernels under v6.1 (#41).
Full Changelog: v7.0.0...v7.1.0.