Rebase bcc to version 0.36.1

Rebase bcc to the latest upstream version (RHEL-162981) and rebuild
with the LLVM 22 (RHEL-170955). The rebase fixes multiple issues:
- Fix filegone, kvmexit, netqtop and tcpconnect on s390x (RHEL-118750)
- Fix profile on s390x (RHEL-112865)
- Fix bpf-cpufreq (RHEL-78168)
- Fix bpf-syncsnoop (RHEL-78171)

Resolves: RHEL-162981
Resolves: RHEL-170955
Resolves: RHEL-118750
Resolves: RHEL-112865
Resolves: RHEL-78168
Resolves: RHEL-78171
Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
This commit is contained in:
Jerome Marchand 2026-05-21 10:10:46 +02:00
parent c79e89f739
commit 753319bc1a
12 changed files with 137 additions and 618 deletions

1
.gitignore vendored
View File

@ -22,3 +22,4 @@
/bcc-0.32.0.tar.gz
/bcc-0.34.0.tar.gz
/bcc-0.35.0.tar.gz
/bcc-0.36.1.tar.gz

View File

@ -1,50 +0,0 @@
From 9ed70cd8b423676d59f9eddcb0135fd1d19330eb Mon Sep 17 00:00:00 2001
From: yonghong-song <ys114321@gmail.com>
Date: Mon, 14 Jul 2025 20:21:59 -0700
Subject: [PATCH] Fix a build failure with clang21 (#5369)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The build error message:
src/cc/frontends/clang/loader.cc:400:73: error: no matching function for
call to clang::TextDiagnosticPrinter::TextDiagnosticPrinter(
llvm::raw_fd_ostream&, clang::DiagnosticOptions*)
400 | auto diag_client = new TextDiagnosticPrinter(llvm::errs(), &*diag_opts);
| ^
The llvm commit
https://github.com/llvm/llvm-project/pull/139584
caused the build failure.
Adjust the code properly and the error is fixed.
---
src/cc/frontends/clang/loader.cc | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/src/cc/frontends/clang/loader.cc b/src/cc/frontends/clang/loader.cc
index 07dc9d6a..6f8387aa 100644
--- a/src/cc/frontends/clang/loader.cc
+++ b/src/cc/frontends/clang/loader.cc
@@ -396,11 +396,19 @@ int ClangLoader::do_compile(
flags_cstr_rem.end());
// set up the error reporting class
+#if LLVM_VERSION_MAJOR >= 21
+ DiagnosticOptions diag_opts;
+ auto diag_client = new TextDiagnosticPrinter(llvm::errs(), diag_opts);
+
+ IntrusiveRefCntPtr<DiagnosticIDs> DiagID(new DiagnosticIDs());
+ DiagnosticsEngine diags(DiagID, diag_opts, diag_client);
+#else
IntrusiveRefCntPtr<DiagnosticOptions> diag_opts(new DiagnosticOptions());
auto diag_client = new TextDiagnosticPrinter(llvm::errs(), &*diag_opts);
IntrusiveRefCntPtr<DiagnosticIDs> DiagID(new DiagnosticIDs());
DiagnosticsEngine diags(DiagID, &*diag_opts, diag_client);
+#endif
// set up the command line argument wrapper
--
2.51.0

View File

@ -1,61 +0,0 @@
From 8a9da1d866dfb69ad1ca59bdc50a799ba2da3a0c Mon Sep 17 00:00:00 2001
From: Jerome Marchand <jmarchan@redhat.com>
Date: Thu, 24 Oct 2024 16:56:14 +0200
Subject: [PATCH] RHEL/Centos: tools: fix alignment in tp_args for bio tools
The padding in tp_args is wrong on RHEL 9 / c9s kernel because of the
kernel commit 6bc27040eb90 ("sched: Add support for lazy preemption")
which added a common field to tracepoints.
Now the dev field is at an offset of 12 bytes as shown by
block_io_start/done format file.
Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
---
tools/biolatency.py | 2 +-
tools/biosnoop.py | 2 +-
tools/biotop.py | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/tools/biolatency.py b/tools/biolatency.py
index 03b48a4c..ac150ea2 100755
--- a/tools/biolatency.py
+++ b/tools/biolatency.py
@@ -88,7 +88,7 @@ typedef struct ext_val {
} ext_val_t;
struct tp_args {
- u64 __unused__;
+ u32 __unused__[3];
dev_t dev;
sector_t sector;
unsigned int nr_sector;
diff --git a/tools/biosnoop.py b/tools/biosnoop.py
index f0fef98b..819e953f 100755
--- a/tools/biosnoop.py
+++ b/tools/biosnoop.py
@@ -66,7 +66,7 @@ struct val_t {
};
struct tp_args {
- u64 __unused__;
+ u32 __unused__[3];
dev_t dev;
sector_t sector;
unsigned int nr_sector;
diff --git a/tools/biotop.py b/tools/biotop.py
index 879c6b8f..4c3a1c9a 100755
--- a/tools/biotop.py
+++ b/tools/biotop.py
@@ -91,7 +91,7 @@ struct val_t {
};
struct tp_args {
- u64 __unused__;
+ u32 __unused__[3];
dev_t dev;
sector_t sector;
unsigned int nr_sector;
--
2.47.0

View File

@ -1,31 +0,0 @@
From efaf25163a59627776e7334b99f78b74c8979fef Mon Sep 17 00:00:00 2001
From: Jerome Marchand <jmarchan@redhat.com>
Date: Tue, 7 Oct 2025 15:32:36 +0200
Subject: [PATCH] libbpf-tools/javagc: Include usdt.bpf.h header
Include usdt.bpf.h header to javagc.bpf.c.
Fixes the following error:
libbpf: usdt: failed to find USDT support BPF maps, did you forget to include bpf/usdt.bpf.h?
attach usdt mem__pool__gc__begin failed: No such process
Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
---
libbpf-tools/javagc.bpf.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/libbpf-tools/javagc.bpf.c b/libbpf-tools/javagc.bpf.c
index 5bfe635c..35535d92 100644
--- a/libbpf-tools/javagc.bpf.c
+++ b/libbpf-tools/javagc.bpf.c
@@ -3,6 +3,7 @@
#include <vmlinux.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_core_read.h>
+#include <bpf/usdt.bpf.h>
#include "javagc.h"
struct {
--
2.51.0

View File

@ -1,274 +0,0 @@
From bf795413ca6c3ee09fb3fff118bec2e5a43d0acb Mon Sep 17 00:00:00 2001
From: Jerome Marchand <jmarchan@redhat.com>
Date: Sun, 13 Jul 2025 06:12:33 +0200
Subject: [PATCH] libbpf-tools/klockstat: Allows kprobe fallback to work with
lock debugging (#5359)
The klockstat tool fallback on kprobes when fentries are not
available, but the fallback doesn't work on debug kernel
(CONFIG_DEBUG_LOCK_ALLOC enabled).
Attach kprobes to the debug locking functions (*_nested) when they
exists as is done with the fentry code.
Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
---
libbpf-tools/klockstat.bpf.c | 195 +++++++++++++++++++++++++++++++++++
libbpf-tools/klockstat.c | 35 +++++++
2 files changed, 230 insertions(+)
diff --git a/libbpf-tools/klockstat.bpf.c b/libbpf-tools/klockstat.bpf.c
index c53cdcdb..b2a94354 100644
--- a/libbpf-tools/klockstat.bpf.c
+++ b/libbpf-tools/klockstat.bpf.c
@@ -832,6 +832,201 @@ int BPF_KPROBE(kprobe_up_write, struct rw_semaphore *lock)
return 0;
}
+/* CONFIG_DEBUG_LOCK_ALLOC is enabled */
+
+SEC("kprobe/mutex_lock_nested")
+int BPF_KPROBE(kprobe_mutex_lock_nested, struct mutex *lock)
+{
+ u32 tid = (u32)bpf_get_current_pid_tgid();
+
+ bpf_map_update_elem(&locks, &tid, &lock, BPF_ANY);
+ lock_contended(ctx, lock);
+ return 0;
+}
+
+SEC("kretprobe/mutex_lock_nested")
+int BPF_KRETPROBE(kprobe_mutex_lock_exit_nested, long ret)
+{
+ u32 tid = (u32)bpf_get_current_pid_tgid();
+ void **lock;
+
+ lock = bpf_map_lookup_elem(&locks, &tid);
+ if (!lock)
+ return 0;
+
+ bpf_map_delete_elem(&locks, &tid);
+ lock_acquired(*lock);
+ return 0;
+}
+
+SEC("kprobe/mutex_lock_interruptible_nested")
+int BPF_KPROBE(kprobe_mutex_lock_interruptible_nested, struct mutex *lock)
+{
+ u32 tid = (u32)bpf_get_current_pid_tgid();
+
+ bpf_map_update_elem(&locks, &tid, &lock, BPF_ANY);
+ lock_contended(ctx, lock);
+ return 0;
+}
+
+SEC("kretprobe/mutex_lock_interruptible_nested")
+int BPF_KRETPROBE(kprobe_mutex_lock_interruptible_exit_nested, long ret)
+{
+ u32 tid = (u32)bpf_get_current_pid_tgid();
+ void **lock;
+
+ lock = bpf_map_lookup_elem(&locks, &tid);
+ if (!lock)
+ return 0;
+
+ bpf_map_delete_elem(&locks, &tid);
+
+ if (ret)
+ lock_aborted(*lock);
+ else
+ lock_acquired(*lock);
+ return 0;
+}
+
+SEC("kprobe/mutex_lock_killable_nested")
+int BPF_KPROBE(kprobe_mutex_lock_killable_nested, struct mutex *lock)
+{
+ u32 tid = (u32)bpf_get_current_pid_tgid();
+
+ bpf_map_update_elem(&locks, &tid, &lock, BPF_ANY);
+ lock_contended(ctx, lock);
+ return 0;
+}
+
+SEC("kretprobe/mutex_lock_killable_nested")
+int BPF_KRETPROBE(kprobe_mutex_lock_killable_exit_nested, long ret)
+{
+ u32 tid = (u32)bpf_get_current_pid_tgid();
+ void **lock;
+
+ lock = bpf_map_lookup_elem(&locks, &tid);
+ if (!lock)
+ return 0;
+
+ bpf_map_delete_elem(&locks, &tid);
+
+ if (ret)
+ lock_aborted(*lock);
+ else
+ lock_acquired(*lock);
+ return 0;
+}
+
+SEC("kprobe/down_read_nested")
+int BPF_KPROBE(kprobe_down_read_nested, struct rw_semaphore *lock)
+{
+ u32 tid = (u32)bpf_get_current_pid_tgid();
+
+ bpf_map_update_elem(&locks, &tid, &lock, BPF_ANY);
+ lock_contended(ctx, lock);
+ return 0;
+}
+
+SEC("kretprobe/down_read_nested")
+int BPF_KRETPROBE(kprobe_down_read_exit_nested, long ret)
+{
+ u32 tid = (u32)bpf_get_current_pid_tgid();
+ void **lock;
+
+ lock = bpf_map_lookup_elem(&locks, &tid);
+ if (!lock)
+ return 0;
+
+ bpf_map_delete_elem(&locks, &tid);
+
+ lock_acquired(*lock);
+ return 0;
+}
+
+SEC("kprobe/down_read_killable_nested")
+int BPF_KPROBE(kprobe_down_read_killable_nested, struct rw_semaphore *lock)
+{
+ u32 tid = (u32)bpf_get_current_pid_tgid();
+
+ bpf_map_update_elem(&locks, &tid, &lock, BPF_ANY);
+ lock_contended(ctx, lock);
+ return 0;
+}
+
+SEC("kretprobe/down_read_killable_nested")
+int BPF_KRETPROBE(kprobe_down_read_killable_exit_nested, long ret)
+{
+ u32 tid = (u32)bpf_get_current_pid_tgid();
+ void **lock;
+
+ lock = bpf_map_lookup_elem(&locks, &tid);
+ if (!lock)
+ return 0;
+
+ bpf_map_delete_elem(&locks, &tid);
+
+ if (ret)
+ lock_aborted(*lock);
+ else
+ lock_acquired(*lock);
+ return 0;
+}
+
+SEC("kprobe/down_write_nested")
+int BPF_KPROBE(kprobe_down_write_nested, struct rw_semaphore *lock)
+{
+ u32 tid = (u32)bpf_get_current_pid_tgid();
+
+ bpf_map_update_elem(&locks, &tid, &lock, BPF_ANY);
+ lock_contended(ctx, lock);
+ return 0;
+}
+
+SEC("kretprobe/down_write_nested")
+int BPF_KRETPROBE(kprobe_down_write_exit_nested, long ret)
+{
+ u32 tid = (u32)bpf_get_current_pid_tgid();
+ void **lock;
+
+ lock = bpf_map_lookup_elem(&locks, &tid);
+ if (!lock)
+ return 0;
+
+ bpf_map_delete_elem(&locks, &tid);
+
+ lock_acquired(*lock);
+ return 0;
+}
+
+SEC("kprobe/down_write_killable_nested")
+int BPF_KPROBE(kprobe_down_write_killable_nested, struct rw_semaphore *lock)
+{
+ u32 tid = (u32)bpf_get_current_pid_tgid();
+
+ bpf_map_update_elem(&locks, &tid, &lock, BPF_ANY);
+ lock_contended(ctx, lock);
+ return 0;
+}
+
+SEC("kretprobe/down_write_killable_nested")
+int BPF_KRETPROBE(kprobe_down_write_killable_exit_nested, long ret)
+{
+ u32 tid = (u32)bpf_get_current_pid_tgid();
+ void **lock;
+
+ lock = bpf_map_lookup_elem(&locks, &tid);
+ if (!lock)
+ return 0;
+
+ bpf_map_delete_elem(&locks, &tid);
+
+ if (ret)
+ lock_aborted(*lock);
+ else
+ lock_acquired(*lock);
+ return 0;
+}
+
SEC("kprobe/rtnetlink_rcv_msg")
int BPF_KPROBE(kprobe_rtnetlink_rcv_msg, struct sk_buff *skb, struct nlmsghdr *nlh,
struct netlink_ext_ack *ext)
diff --git a/libbpf-tools/klockstat.c b/libbpf-tools/klockstat.c
index ab5ed908..c3c9be89 100644
--- a/libbpf-tools/klockstat.c
+++ b/libbpf-tools/klockstat.c
@@ -879,6 +879,41 @@ static void enable_kprobes(struct klockstat_bpf *obj)
bpf_program__set_autoload(obj->progs.netlink_dump_exit, false);
bpf_program__set_autoload(obj->progs.sock_do_ioctl, false);
bpf_program__set_autoload(obj->progs.sock_do_ioctl_exit, false);
+
+ /* CONFIG_DEBUG_LOCK_ALLOC is on */
+ if (kprobe_exists("mutex_lock_nested")) {
+ bpf_program__set_autoload(obj->progs.kprobe_mutex_lock, false);
+ bpf_program__set_autoload(obj->progs.kprobe_mutex_lock_exit, false);
+ bpf_program__set_autoload(obj->progs.kprobe_mutex_lock_interruptible, false);
+ bpf_program__set_autoload(obj->progs.kprobe_mutex_lock_interruptible_exit, false);
+ bpf_program__set_autoload(obj->progs.kprobe_mutex_lock_killable, false);
+ bpf_program__set_autoload(obj->progs.kprobe_mutex_lock_killable_exit, false);
+
+ bpf_program__set_autoload(obj->progs.kprobe_down_read, false);
+ bpf_program__set_autoload(obj->progs.kprobe_down_read_exit, false);
+ bpf_program__set_autoload(obj->progs.kprobe_down_read_killable, false);
+ bpf_program__set_autoload(obj->progs.kprobe_down_read_killable_exit, false);
+ bpf_program__set_autoload(obj->progs.kprobe_down_write, false);
+ bpf_program__set_autoload(obj->progs.kprobe_down_write_exit, false);
+ bpf_program__set_autoload(obj->progs.kprobe_down_write_killable, false);
+ bpf_program__set_autoload(obj->progs.kprobe_down_write_killable_exit, false);
+ } else {
+ bpf_program__set_autoload(obj->progs.kprobe_mutex_lock_nested, false);
+ bpf_program__set_autoload(obj->progs.kprobe_mutex_lock_exit_nested, false);
+ bpf_program__set_autoload(obj->progs.kprobe_mutex_lock_interruptible_nested, false);
+ bpf_program__set_autoload(obj->progs.kprobe_mutex_lock_interruptible_exit_nested, false);
+ bpf_program__set_autoload(obj->progs.kprobe_mutex_lock_killable_nested, false);
+ bpf_program__set_autoload(obj->progs.kprobe_mutex_lock_killable_exit_nested, false);
+
+ bpf_program__set_autoload(obj->progs.kprobe_down_read_nested, false);
+ bpf_program__set_autoload(obj->progs.kprobe_down_read_exit_nested, false);
+ bpf_program__set_autoload(obj->progs.kprobe_down_read_killable_nested, false);
+ bpf_program__set_autoload(obj->progs.kprobe_down_read_killable_exit_nested, false);
+ bpf_program__set_autoload(obj->progs.kprobe_down_write_nested, false);
+ bpf_program__set_autoload(obj->progs.kprobe_down_write_exit_nested, false);
+ bpf_program__set_autoload(obj->progs.kprobe_down_write_killable_nested, false);
+ bpf_program__set_autoload(obj->progs.kprobe_down_write_killable_exit_nested, false);
+ }
}
static void disable_nldump_ioctl_probes(struct klockstat_bpf *obj)
--
2.50.0

View File

@ -1,49 +0,0 @@
From f372342fd4c1cd0c121500301833177fd6fb45ac Mon Sep 17 00:00:00 2001
From: Jerome Marchand <jmarchan@redhat.com>
Date: Fri, 18 Jul 2025 14:15:46 +0200
Subject: [PATCH] libbpf-tools/klockstat: Disable *_nested kprobes in the
fentry code
Commit 789e923f ("libbpf-tools/klockstat: Allows kprobe fallback to
work with lock debugging (#5359)") add new kprobes to be enabled on
debug kernel and disabled on normal kernel. But it forgot to disable
them in the fentry code, along with other kprobes.
Disable *_nested kprobes in the fentry code.
Fixes: 789e923f ("libbpf-tools/klockstat: Allows kprobe fallback to work with lock debugging (#5359)")
Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
---
libbpf-tools/klockstat.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/libbpf-tools/klockstat.c b/libbpf-tools/klockstat.c
index c3c9be89..59be05ac 100644
--- a/libbpf-tools/klockstat.c
+++ b/libbpf-tools/klockstat.c
@@ -804,6 +804,22 @@ static void enable_fentry(struct klockstat_bpf *obj)
bpf_program__set_autoload(obj->progs.kprobe_down_write_killable_exit, false);
bpf_program__set_autoload(obj->progs.kprobe_up_write, false);
+ bpf_program__set_autoload(obj->progs.kprobe_mutex_lock_nested, false);
+ bpf_program__set_autoload(obj->progs.kprobe_mutex_lock_exit_nested, false);
+ bpf_program__set_autoload(obj->progs.kprobe_mutex_lock_interruptible_nested, false);
+ bpf_program__set_autoload(obj->progs.kprobe_mutex_lock_interruptible_exit_nested, false);
+ bpf_program__set_autoload(obj->progs.kprobe_mutex_lock_killable_nested, false);
+ bpf_program__set_autoload(obj->progs.kprobe_mutex_lock_killable_exit_nested, false);
+
+ bpf_program__set_autoload(obj->progs.kprobe_down_read_nested, false);
+ bpf_program__set_autoload(obj->progs.kprobe_down_read_exit_nested, false);
+ bpf_program__set_autoload(obj->progs.kprobe_down_read_killable_nested, false);
+ bpf_program__set_autoload(obj->progs.kprobe_down_read_killable_exit_nested, false);
+ bpf_program__set_autoload(obj->progs.kprobe_down_write_nested, false);
+ bpf_program__set_autoload(obj->progs.kprobe_down_write_exit_nested, false);
+ bpf_program__set_autoload(obj->progs.kprobe_down_write_killable_nested, false);
+ bpf_program__set_autoload(obj->progs.kprobe_down_write_killable_exit_nested, false);
+
bpf_program__set_autoload(obj->progs.kprobe_rtnetlink_rcv_msg, false);
bpf_program__set_autoload(obj->progs.kprobe_rtnetlink_rcv_msg_exit, false);
bpf_program__set_autoload(obj->progs.kprobe_netlink_dump, false);
--
2.50.1

View File

@ -1,79 +0,0 @@
From 40fcbbe153114450ab631be8cefa998bba13ddd9 Mon Sep 17 00:00:00 2001
From: Rong Tao <rongtao@cestc.cn>
Date: Sun, 13 Jul 2025 12:26:14 +0800
Subject: [PATCH] libbpf-tools: ksnoop: Fix two invalid access to map value
(#5361)
On fedora42, llvm 20.1.7, kernel 6.15.4-200.fc42.x86_64 has two verifier
errors. Test with command:
$ sudo ./ksnoop trace do_sys_openat2
1st:
; last_stack_depth = stack_depth - 1; @ ksnoop.bpf.c:102
108: (bc) w3 = w6 ; frame1: R3_w=scalar(id=5,smin=smin32=0,smax=umax=smax32=umax32=14,var_off=(0x0; 0xf)) R6=scalar(id=5,smin=smin32=0,smax=umax=smax32=umax32=14,var_off=(0x0; 0xf))
109: (04) w3 += -1 ; frame1: R3_w=scalar(smin=0,smax=umax=0xffffffff,smin32=-1,smax32=13,var_off=(0x0; 0xffffffff))
110: (bc) w4 = w3 ; frame1: R3_w=scalar(id=6,smin=0,smax=umax=0xffffffff,smin32=-1,smax32=13,var_off=(0x0; 0xffffffff)) R4_w=scalar(id=6,smin=0,smax=umax=0xffffffff,smin32=-1,smax32=13,var_off=(0x0; 0xffffffff))
111: (54) w4 &= 255 ; frame1: R4_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff))
112: (b7) r7 = 0 ; frame1: R7=0
; if (last_stack_depth >= 0 && @ ksnoop.bpf.c:104
113: (26) if w4 > 0xf goto pc+5 ; frame1: R4=scalar(smin=smin32=0,smax=umax=smax32=umax32=15,var_off=(0x0; 0xf))
; last_ip = func_stack->ips[last_stack_depth]; @ ksnoop.bpf.c:106
114: (57) r3 &= 255 ; frame1: R3_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff))
115: (67) r3 <<= 3 ; frame1: R3_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=2040,var_off=(0x0; 0x7f8))
116: (bf) r4 = r2 ; frame1: R2=map_value(map=ksnoop_func_sta,ks=8,vs=144) R4_w=map_value(map=ksnoop_func_sta,ks=8,vs=144)
117: (0f) r4 += r3 ; frame1: R3_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=2040,var_off=(0x0; 0x7f8)) R4_w=map_value(map=ksnoop_func_sta,ks=8,vs=144,smin=smin32=0,smax=umax=smax32=umax32=2040,var_off=(0x0; 0x7f8))
118: (79) r7 = *(u64 *)(r4 +8)
invalid access to map value, value_size=144 off=2048 size=8
The last_stack_depth use 'w4 > 0xf' check boundary, but 'r3 &= 255'
is beyond 0xf (0~15).
2nd:
; trace_len = sizeof(*trace) + trace->buf_len - MAX_TRACE_BUF; @ ksnoop.bpf.c:222
502: (04) w5 += 4008 ; frame1: R5_w=scalar(smin=umin=smin32=umin32=4009,smax=umax=smax32=umax32=0x10fa7,var_off=(0x0; 0x1ffff))
503: (bc) w2 = w5 ; frame1: R2_w=scalar(id=27,smin=umin=smin32=umin32=4009,smax=umax=smax32=umax32=0x10fa7,var_off=(0x0; 0x1ffff)) R5_w=scalar(id=27,smin=umin=smin32=umin32=4009,smax=umax=smax32=umax32=0x10fa7,var_off=(0x0; 0x1ffff))
504: (54) w2 &= 65535 ; frame1: R2_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=0xffff,var_off=(0x0; 0xffff))
; if (trace_len <= sizeof(*trace)) @ ksnoop.bpf.c:224
505: (26) if w2 > 0x3fa8 goto pc+7 ; frame1: R2_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=16296,var_off=(0x0; 0x3fff))
506: (57) r5 &= 65535 ; frame1: R5_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=0xffff,var_off=(0x0; 0xffff))
507: (18) r2 = 0xffff8ec554700c00 ; frame1: R2_w=map_ptr(map=ksnoop_perf_map,ks=4,vs=4)
509: (18) r3 = 0xffffffff ; frame1: R3_w=0xffffffff
511: (bf) r4 = r9 ; frame1: R4_w=map_value(map=ksnoop_func_map,ks=8,vs=16296) R9=map_value(map=ksnoop_func_map,ks=8,vs=16296)
512: (85) call bpf_perf_event_output#25
invalid access to map value, value_size=16296 off=0 size=65535
Just fix it with size type 'u64' instead of 'u32', see:
long bpf_perf_event_output(void *ctx, struct bpf_map *map, u64 flags, void *data, u64 size)
Signed-off-by: Rong Tao <rongtao@cestc.cn>
---
libbpf-tools/ksnoop.bpf.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/libbpf-tools/ksnoop.bpf.c b/libbpf-tools/ksnoop.bpf.c
index f07ff561..15aa7d75 100644
--- a/libbpf-tools/ksnoop.bpf.c
+++ b/libbpf-tools/ksnoop.bpf.c
@@ -103,7 +103,8 @@ static struct trace *get_trace(struct pt_regs *ctx, bool entry)
/* get address of last function we called */
if (last_stack_depth >= 0 &&
last_stack_depth < FUNC_MAX_STACK_DEPTH)
- last_ip = func_stack->ips[last_stack_depth];
+ bpf_probe_read_kernel(&last_ip, sizeof(last_ip),
+ &func_stack->ips[last_stack_depth]);
/* push ip onto stack. return will pop it. */
func_stack->ips[stack_depth] = ip;
/* mask used in case bounds checks are optimized out */
@@ -202,7 +203,7 @@ static struct trace *get_trace(struct pt_regs *ctx, bool entry)
static void output_trace(struct pt_regs *ctx, struct trace *trace)
{
- __u16 trace_len;
+ __u64 trace_len;
if (trace->buf_len == 0)
goto skip;
--
2.51.0

View File

@ -1,64 +0,0 @@
From 377b19d669154e48e7278d9f5fe3afbf1f9c078b Mon Sep 17 00:00:00 2001
From: Francois Lesueur <11961066+flesueur@users.noreply.github.com>
Date: Wed, 6 Aug 2025 06:11:02 +0200
Subject: [PATCH] tools/tcpconnect: fix iov field for DNS with Linux>=6.4
(#5382)
Tcpconnect with DNS (-d flag) does not work with Linux>=6.4. The kernel representation of struct iov_iter changed in 6.4.
This PR adapts the iov field depending on the structure. It also removes inet_sk() which did not work on a recent kernel (6.6).
---
tools/tcpconnect.py | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/tools/tcpconnect.py b/tools/tcpconnect.py
index a38bad8d..dc35cb28 100755
--- a/tools/tcpconnect.py
+++ b/tools/tcpconnect.py
@@ -276,7 +276,7 @@ int trace_udp_recvmsg(struct pt_regs *ctx)
{
__u64 pid_tgid = bpf_get_current_pid_tgid();
struct sock *sk = (struct sock *)PT_REGS_PARM1(ctx);
- struct inet_sock *is = inet_sk(sk);
+ struct inet_sock *is = (struct inet_sock *)sk;
// only grab port 53 packets, 13568 is ntohs(53)
if (is->inet_dport == 13568) {
@@ -303,7 +303,7 @@ int trace_udp_ret_recvmsg(struct pt_regs *ctx)
goto delete_and_return;
size_t buflen = (size_t)copied;
- if (buflen > msghdr->msg_iter.iov->iov_len)
+ if (buflen > msghdr->msg_iter.IOV_FIELD->iov_len)
goto delete_and_return;
if (buflen > MAX_PKT)
@@ -313,7 +313,7 @@ int trace_udp_ret_recvmsg(struct pt_regs *ctx)
if (!data) // this should never happen, just making the verifier happy
return 0;
- void *iovbase = msghdr->msg_iter.iov->iov_base;
+ void *iovbase = msghdr->msg_iter.IOV_FIELD->iov_base;
bpf_probe_read(data->pkt, buflen, iovbase);
dns_events.perf_submit(ctx, data, buflen);
@@ -386,10 +386,14 @@ bpf_text = bpf_text.replace('FILTER_FAMILY', '')
bpf_text = bpf_text.replace('FILTER_UID', '')
if args.dns:
- if BPF.kernel_struct_has_field(b'iov_iter', b'iter_type') == 1:
+ if BPF.kernel_struct_has_field(b'iov_iter', b'type') == 1:
+ dns_bpf_text = dns_bpf_text.replace('TYPE_FIELD', 'type')
+ else:
dns_bpf_text = dns_bpf_text.replace('TYPE_FIELD', 'iter_type')
+ if BPF.kernel_struct_has_field(b'iov_iter', b'iov') == 1:
+ dns_bpf_text = dns_bpf_text.replace('IOV_FIELD', 'iov')
else:
- dns_bpf_text = dns_bpf_text.replace('TYPE_FIELD', 'type')
+ dns_bpf_text = dns_bpf_text.replace('IOV_FIELD', '__iov')
bpf_text += dns_bpf_text
if debug or args.ebpf:
--
2.51.0

View File

@ -0,0 +1,63 @@
From 962768cfcfe9410a2a3328c3d50b599b3fd718a0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Holger=20Hoffst=C3=A4tte?= <holger@applied-asynchrony.com>
Date: Mon, 2 Mar 2026 10:03:15 +0100
Subject: [PATCH 1/2] Fix build with LLVM-22
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
LLVM-22 changed the signatures of various createDiagnostics() calls [1].
Introduce a new version macro guard and adapt the code to the changed API.
Fixes #5483
[1] https://github.com/llvm/llvm-project/commit/30633f30894129919050f24fdd1f8f6bc46beae0
Signed-off-by: Holger Hoffstätte <holger@applied-asynchrony.com>
---
src/cc/frontends/clang/loader.cc | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/src/cc/frontends/clang/loader.cc b/src/cc/frontends/clang/loader.cc
index 6f8387aa..1f706344 100644
--- a/src/cc/frontends/clang/loader.cc
+++ b/src/cc/frontends/clang/loader.cc
@@ -464,7 +464,10 @@ int ClangLoader::do_compile(
}
invocation0.getFrontendOpts().DisableFree = false;
-#if LLVM_VERSION_MAJOR >= 20
+#if LLVM_VERSION_MAJOR >= 22
+ compiler0.setVirtualFileSystem(llvm::vfs::getRealFileSystem());
+ compiler0.createDiagnostics(new IgnoringDiagConsumer());
+#elif LLVM_VERSION_MAJOR >= 20
compiler0.createDiagnostics(*llvm::vfs::getRealFileSystem(), new IgnoringDiagConsumer());
#else
compiler0.createDiagnostics(new IgnoringDiagConsumer());
@@ -487,7 +490,10 @@ int ClangLoader::do_compile(
add_main_input(invocation1, main_path, &*out_buf);
invocation1.getFrontendOpts().DisableFree = false;
-#if LLVM_VERSION_MAJOR >= 20
+#if LLVM_VERSION_MAJOR >= 22
+ compiler1.setVirtualFileSystem(llvm::vfs::getRealFileSystem());
+ compiler1.createDiagnostics();
+#elif LLVM_VERSION_MAJOR >= 20
compiler1.createDiagnostics(*llvm::vfs::getRealFileSystem());
#else
compiler1.createDiagnostics();
@@ -517,7 +523,10 @@ int ClangLoader::do_compile(
invocation2.getCodeGenOpts().setInlining(CodeGenOptions::NormalInlining);
// suppress warnings in the 2nd pass, but bail out on errors (our fault)
invocation2.getDiagnosticOpts().IgnoreWarnings = true;
-#if LLVM_VERSION_MAJOR >= 20
+#if LLVM_VERSION_MAJOR >= 22
+ compiler2.setVirtualFileSystem(llvm::vfs::getRealFileSystem());
+ compiler2.createDiagnostics();
+#elif LLVM_VERSION_MAJOR >= 20
compiler2.createDiagnostics(*llvm::vfs::getRealFileSystem());
#else
compiler2.createDiagnostics();
--
2.54.0

View File

@ -0,0 +1,59 @@
From 7aecc13fe74d6a2e1ad07422e25b76e61169a822 Mon Sep 17 00:00:00 2001
From: Avinesh Kumar <avinesh.kumar@suse.com>
Date: Fri, 6 Mar 2026 16:00:01 +0100
Subject: [PATCH 2/2] clang: Add microsoft extensions build flags
Starting in Linux 6.19, `struct ns_common` fields were moved into an
anonymous nested forward declaration (`struct ns_tree;`) within a
union.[1]
This causes Clang to throw a `[-Wmissing-declarations]` warning and
fail with missing member errors.
This affects tools pulling in `<linux/pid_namespace.h>` directly or
transitively (e.g. filetop, runqlat)
Errors encountered:
include/linux/ns/ns_common_types.h:117:3: warning: declaration does not declare anything [-Wmissing-declarations]
117 | struct ns_tree;
| ^~~~~~~~~~~~~~
In file included from /virtual/main.c:5:
In file included from include/linux/pid_namespace.h:11:
include/linux/ns_common.h:25:23: error: no member named 'ns_id' in 'struct ns_common'
25 | VFS_WARN_ON_ONCE(ns->ns_id == 0);
| ~~ ^
include/linux/ns_common.h:26:13: error: no member named 'ns_id' in 'struct ns_common'
26 | return ns->ns_id <= NS_LAST_INIT_ID;
| ~~ ^
include/linux/ns_common.h:60:26: error: no member named '__ns_ref_active' in 'struct ns_common'
60 | return atomic_read(&ns->__ns_ref_active);
This patch fixes the issue globally by turning on microsoft extensions
flags. These flags have already been in the linux kernel. [2]
[1] https://github.com/torvalds/linux/commit/a657bc8a75cf40c3d0814fe6488ba4af56528f42
[2] https://github.com/torvalds/linux/commit/c4781dc3d1cf0e017e1f290607ddc56cfe187afc
Signed-off-by: Avinesh Kumar <avinesh.kumar@suse.com>
Fixes: #5488
---
src/cc/frontends/clang/kbuild_helper.cc | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/cc/frontends/clang/kbuild_helper.cc b/src/cc/frontends/clang/kbuild_helper.cc
index 4f09a398..b5d6a55e 100644
--- a/src/cc/frontends/clang/kbuild_helper.cc
+++ b/src/cc/frontends/clang/kbuild_helper.cc
@@ -137,6 +137,10 @@ int KBuildHelper::get_flags(const char *uname_machine, vector<string> *cflags) {
cflags->push_back("-Wno-pointer-sign");
cflags->push_back("-fno-stack-protector");
+ // Align with Linux kernel's -fms-extensions flags adopted since v6.19
+ cflags->push_back("-fms-extensions");
+ cflags->push_back("-Wno-microsoft-anon-tag");
+
/*
* kernel is usually build with gcc and the kernel devel header
* reflects that fact. However we build with clang and this must be
--
2.54.0

View File

@ -24,19 +24,14 @@
Name: bcc
Version: 0.35.0
Release: 2%{?dist}
Version: 0.36.1
Release: 1%{?dist}
Summary: BPF Compiler Collection (BCC)
License: ASL 2.0
URL: https://github.com/iovisor/bcc
Source0: %{url}/archive/v%{version}/%{name}-%{version}.tar.gz
Patch0: %%{name}-%%{version}-RHEL-Centos-tools-fix-alignment-in-tp_args-for-bio-t.patch
Patch1: %%{name}-%%{version}-libbpf-tools-klockstat-Allows-kprobe-fallback-to-wor.patch
Patch2: %%{name}-%%{version}-libbpf-tools-klockstat-Disable-_nested-kprobes-in-th.patch
Patch3: %%{name}-%%{version}-Fix-a-build-failure-with-clang21-5369.patch
Patch4: %%{name}-%%{version}-libbpf-tools-ksnoop-Fix-two-invalid-access-to-map-va.patch
Patch5: %%{name}-%%{version}-libbpf-tools-javagc-Include-usdt.bpf.h-header.patch
Patch6: %%{name}-%%{version}-tools-tcpconnect-fix-iov-field-for-DNS-with-Linux-6..patch
Patch0: %%{name}-%%{version}-Fix-build-with-LLVM-22.patch
Patch1: %%{name}-%%{version}-clang-Add-microsoft-extensions-build-flags.patch
# Arches will be included as upstream support is added and dependencies are
# satisfied in the respective arches
@ -275,6 +270,15 @@ cp -a libbpf-tools/tmp-install/bin/* %{buildroot}/%{_sbindir}/
%endif
%changelog
* Wed May 20 2026 Jerome Marchand <jmarchan@redhat.com> - 0.36.1-1
- Rebase to version 0.36.1 (RHEL-162981)
- Rebuild with LLVM 22 (RHEL-170955)
- Got rid of the RHEL only bio tool fix thanks to comnmit 36305815
- Fix filegone, kvmexit, netqtop and tcpconnect on s390x (RHEL-118750)
- Fix profile on s390x (RHEL-112865)
- Fix bpf-cpufreq (RHEL-78168)
- Fix bpf-syncsnoop (RHEL-78171)
* Mon Dec 01 2025 Jerome Marchand <jmarchan@redhat.com> - 0.35.0-2
- Rebuild with LLVM 21 (RHEL-108343)

View File

@ -1 +1 @@
SHA512 (bcc-0.35.0.tar.gz) = 23cc1413fef785165fe9fd29a242fb13e4e56da7d63699dbed3d6d12902a1de392b412cb0e5754eff5aeecf0a023568d593c9f4cb5bca7a88013aadfaef4fa3d
SHA512 (bcc-0.36.1.tar.gz) = bada939f35deb806989a6f8b04943aecde472a4a85cd781861c67051a75fd197988090e67f5f937080b8d47643bc209cf7e83fbd6d811d727484d03f7be92092