Release highlights

• Addition of macros allowing code reuse (unstable).
• Support for named parameters of bpftrace scripts.
• New map function tseries for printing time series graph showing how a value evolved over time (unstable).
• Map declarations allowing to specify map type (e.g. array, LRU hash, etc.) and other properties (unstable).
• Range based for loops.
• Boolean literals (true and false).
• Array access with non-constant index.

For more details on these features, including examples how to use them, refer to the Release Notes.

Full changelog

Breaking Changes

• Drop majority of DWARF support. Only uprobe argument parsing remains.
  • #3921
  • #3950
• Removed config option 'symbol_source' - it no longer has any effect
  • #3925
• Rawtracepoints now require kernel BTF
  • #3944
• Ustack and kstack symbols are automatically enhanced with debug info if available
  • #3999
• Error by default if any probe fails to attach
  • #4097
• Require BPF_MAP_TYPE_RINGBUF to be available
  • #3974
• Require kernel uprobe ref counting to be available for USDTs with semaphores
  • #4199
• strcontains and has_key now return boolean values instead of 1 and 0
  • #4280
• JSON serialization for unsupported and unknown types (e.g. float) may now use null now rather than the empty string
  • #4302
• Text mode now emits all non-script generated output (e.g., errors, attached notifications) to stderr instead of stdout
  • #4504

Added

• Add ncpus builtin to get the number of CPUs.
  • #4105
• Use blazesym for user space address symbolization
  • #3884
• Add simple block expressions
  • #3780
• Add map declaration syntax (behind an "unstable" config flag)
  • #3863
• Add license config to specify BPF license
  • #3905
• Rawtracepoints can now use args builtin and list params
  • #3918
• Add ability to specify rawtracepoint modules
  • #3944
• Add 'show_debug_info' config for blazesym
  • #3999

Changed

• kprobe: support verbose mode listing
  • #4362
• -p CLI flag now applies to all probes (except BEGIN/END)
  • #3800
• Introduce automatic session probes
  • #3772
• Positional params can be used in any part of a probe string
  • #3956
• Add signed type checking for map assignments
  • #4132
• Add signed type checking for map keys
  • #4136
• delete now returns 1 if successful, 0 if not
  • #4186
• if delete fails it will only print a warning if return value is not handled
  • #4186

Fixed

• Fix build failures due to missing location.hh
  • #3987
• Fix 32-bit build failures due to missing cast
  • #4006
• Don't crash if kernel isn't built with PID namespaces
  • #3976
• Allow sized_type idents to be used for field access
  • #4064
• Fix per-cpu map update warning
  • #4047
• Fix probe firing order for fexit and software
  • #4113
• Fix type mismatch error for map assignments
  • #4130
• Parse BTF for implicit kernel modules in kprobe/kretprobe
  • #4137

Tools

• opensnoop.bt: support openat2 syscall
  • #4310
• killsnoop.bt: display signal name instead of value
  • #4234
• killsnoop.bt: support tkill() and tgkill()
  • #4190
• Remove tools example usage txt files and move info to comments
  • #4187
• Fix biosnoop.bt to print comm from block_io_start probe
  • #4013