Rebase bcc to version 0.35.0

Rebase to version 0.35.0 (RHEL-79001)
- Fix bpf-ksnoop (RHEL-96166)
- Fix bpf-javagc (RHEL-78173)

Resolves: RHEL-79001
Resolves: RHEL-96166
Resolves: RHEL-78173

Signed-off-by: Jerome Marchand <jmarchan@redhat.com>

.gitignore

@@ -21,3 +21,4 @@
 /bcc-0.30.0.tar.gz
 /bcc-0.32.0.tar.gz
 /bcc-0.34.0.tar.gz
+/bcc-0.35.0.tar.gz

bcc-0.34.0-tools-biosnoop-Fix-biosnoop-pattern-option-5304.patch

@@ -1,70 +0,0 @@
-From 06d96cee7d9f4d95025ac0988ac3b273ead0061e Mon Sep 17 00:00:00 2001
-From: Jerome Marchand <jmarchan@redhat.com>
-Date: Sun, 18 May 2025 01:12:30 +0200
-Subject: [PATCH] tools/biosnoop: Fix biosnoop pattern option (#5304)
-
-The code to support the block_io tracepoints failed to update some
-code that is used with the -P option. That code changed the second
-argument of __trace_req_completion from 'req' to 'key', but in the
-"#ifdef INCLUDE_PATTERN" block, the use of 'req' remained unchanged.
-Of course, 'key' should be use here too.
-
-Also remove the commented out line of code related to rq_disk.
-
-It fixes the following error:
-$ biosnoop -P
-/virtual/main.c:213:24: error: use of undeclared identifier 'req'
-  213 |         data.pattern = req->__sector == *sector ? SEQUENTIAL : RANDOM;
-      |                        ^
-/virtual/main.c:216:19: error: use of undeclared identifier 'req'
-  216 |     last_sector = req->__sector + data.len / 512;
-      |                   ^
-2 errors generated.
-Traceback (most recent call last):
-  File "/usr/share/bcc/tools/biosnoop", line 335, in <module>
-    b = BPF(text=bpf_text)
-  File "/usr/lib/python3.13/site-packages/bcc/__init__.py", line 505, in __init__
-    raise Exception("Failed to compile BPF module %s" % (src_file or "<text>"))
-Exception: Failed to compile BPF module <text>
-
-Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
----
- tools/biosnoop.py | 6 ++----
- 1 file changed, 2 insertions(+), 4 deletions(-)
-
-diff --git a/tools/biosnoop.py b/tools/biosnoop.py
-index 431cd4a2..045e1f9d 100755
---- a/tools/biosnoop.py
-+++ b/tools/biosnoop.py
-@@ -218,7 +218,6 @@ static int __trace_req_completion(void *ctx, struct hash_key key)
-     struct start_req_t *startp;
-     struct val_t *valp;
-     struct data_t data = {};
--    //struct gendisk *rq_disk;
-     u64 ts;
- 
-     // fetch timestamp and calculate delta
-@@ -228,7 +227,6 @@ static int __trace_req_completion(void *ctx, struct hash_key key)
-         return 0;
-     }
-     ts = bpf_ktime_get_ns();
--    //rq_disk = req->__RQ_DISK__;
-     data.delta = ts - startp->ts;
-     data.ts = ts / 1000;
-     data.qdelta = 0;
-@@ -260,10 +258,10 @@ static int __trace_req_completion(void *ctx, struct hash_key key)
- 
-     sector = last_sectors.lookup(&sector_key);
-     if (sector != 0) {
--        data.pattern = req->__sector == *sector ? SEQUENTIAL : RANDOM;
-+        data.pattern = key.sector == *sector ? SEQUENTIAL : RANDOM;
-     }
- 
--    last_sector = req->__sector + data.len / 512;
-+    last_sector = key.sector + data.len / 512;
-     last_sectors.update(&sector_key, &last_sector);
- #endif
- 
--- 
-2.49.0
-

bcc-0.35.0-Fix-a-build-failure-with-clang21-5369.patch

@@ -0,0 +1,50 @@
+From 9ed70cd8b423676d59f9eddcb0135fd1d19330eb Mon Sep 17 00:00:00 2001
+From: yonghong-song <ys114321@gmail.com>
+Date: Mon, 14 Jul 2025 20:21:59 -0700
+Subject: [PATCH] Fix a build failure with clang21 (#5369)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The build error message:
+  src/cc/frontends/clang/loader.cc:400:73: error: no matching function for
+   call to ‘clang::TextDiagnosticPrinter::TextDiagnosticPrinter(
+     llvm::raw_fd_ostream&, clang::DiagnosticOptions*)’
+  400 |   auto diag_client = new TextDiagnosticPrinter(llvm::errs(), &*diag_opts);
+      |                                                                         ^
+The llvm commit
+  https://github.com/llvm/llvm-project/pull/139584
+caused the build failure.
+
+Adjust the code properly and the error is fixed.
+---
+ src/cc/frontends/clang/loader.cc | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/src/cc/frontends/clang/loader.cc b/src/cc/frontends/clang/loader.cc
+index 07dc9d6a..6f8387aa 100644
+--- a/src/cc/frontends/clang/loader.cc
++++ b/src/cc/frontends/clang/loader.cc
+@@ -396,11 +396,19 @@ int ClangLoader::do_compile(
+                     flags_cstr_rem.end());
+ 
+   // set up the error reporting class
++#if LLVM_VERSION_MAJOR >= 21
++  DiagnosticOptions diag_opts;
++  auto diag_client = new TextDiagnosticPrinter(llvm::errs(), diag_opts);
++
++  IntrusiveRefCntPtr<DiagnosticIDs> DiagID(new DiagnosticIDs());
++  DiagnosticsEngine diags(DiagID, diag_opts, diag_client);
++#else
+   IntrusiveRefCntPtr<DiagnosticOptions> diag_opts(new DiagnosticOptions());
+   auto diag_client = new TextDiagnosticPrinter(llvm::errs(), &*diag_opts);
+ 
+   IntrusiveRefCntPtr<DiagnosticIDs> DiagID(new DiagnosticIDs());
+   DiagnosticsEngine diags(DiagID, &*diag_opts, diag_client);
++#endif
+ 
+   // set up the command line argument wrapper
+ 
+-- 
+2.51.0
+

bcc-0.35.0-libbpf-tools-javagc-Include-usdt.bpf.h-header.patch

@@ -0,0 +1,31 @@
+From efaf25163a59627776e7334b99f78b74c8979fef Mon Sep 17 00:00:00 2001
+From: Jerome Marchand <jmarchan@redhat.com>
+Date: Tue, 7 Oct 2025 15:32:36 +0200
+Subject: [PATCH] libbpf-tools/javagc: Include usdt.bpf.h header
+
+Include usdt.bpf.h header to javagc.bpf.c.
+
+Fixes the following error:
+libbpf: usdt: failed to find USDT support BPF maps, did you forget to include bpf/usdt.bpf.h?
+attach usdt mem__pool__gc__begin failed: No such process
+
+Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
+---
+ libbpf-tools/javagc.bpf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/libbpf-tools/javagc.bpf.c b/libbpf-tools/javagc.bpf.c
+index 5bfe635c..35535d92 100644
+--- a/libbpf-tools/javagc.bpf.c
++++ b/libbpf-tools/javagc.bpf.c
+@@ -3,6 +3,7 @@
+ #include <vmlinux.h>
+ #include <bpf/bpf_helpers.h>
+ #include <bpf/bpf_core_read.h>
++#include <bpf/usdt.bpf.h>
+ #include "javagc.h"
+ 
+ struct {
+-- 
+2.51.0
+

bcc-0.35.0-libbpf-tools-ksnoop-Fix-two-invalid-access-to-map-va.patch

@@ -0,0 +1,79 @@
+From 40fcbbe153114450ab631be8cefa998bba13ddd9 Mon Sep 17 00:00:00 2001
+From: Rong Tao <rongtao@cestc.cn>
+Date: Sun, 13 Jul 2025 12:26:14 +0800
+Subject: [PATCH] libbpf-tools: ksnoop: Fix two invalid access to map value
+ (#5361)
+
+On fedora42, llvm 20.1.7, kernel 6.15.4-200.fc42.x86_64 has two verifier
+errors. Test with command:
+
+    $ sudo ./ksnoop trace do_sys_openat2
+
+1st:
+    ; last_stack_depth = stack_depth - 1; @ ksnoop.bpf.c:102
+    108: (bc) w3 = w6                     ; frame1: R3_w=scalar(id=5,smin=smin32=0,smax=umax=smax32=umax32=14,var_off=(0x0; 0xf)) R6=scalar(id=5,smin=smin32=0,smax=umax=smax32=umax32=14,var_off=(0x0; 0xf))
+    109: (04) w3 += -1                    ; frame1: R3_w=scalar(smin=0,smax=umax=0xffffffff,smin32=-1,smax32=13,var_off=(0x0; 0xffffffff))
+    110: (bc) w4 = w3                     ; frame1: R3_w=scalar(id=6,smin=0,smax=umax=0xffffffff,smin32=-1,smax32=13,var_off=(0x0; 0xffffffff)) R4_w=scalar(id=6,smin=0,smax=umax=0xffffffff,smin32=-1,smax32=13,var_off=(0x0; 0xffffffff))
+    111: (54) w4 &= 255                   ; frame1: R4_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff))
+    112: (b7) r7 = 0                      ; frame1: R7=0
+    ; if (last_stack_depth >= 0 && @ ksnoop.bpf.c:104
+    113: (26) if w4 > 0xf goto pc+5       ; frame1: R4=scalar(smin=smin32=0,smax=umax=smax32=umax32=15,var_off=(0x0; 0xf))
+    ; last_ip = func_stack->ips[last_stack_depth]; @ ksnoop.bpf.c:106
+    114: (57) r3 &= 255                   ; frame1: R3_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff))
+    115: (67) r3 <<= 3                    ; frame1: R3_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=2040,var_off=(0x0; 0x7f8))
+    116: (bf) r4 = r2                     ; frame1: R2=map_value(map=ksnoop_func_sta,ks=8,vs=144) R4_w=map_value(map=ksnoop_func_sta,ks=8,vs=144)
+    117: (0f) r4 += r3                    ; frame1: R3_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=2040,var_off=(0x0; 0x7f8)) R4_w=map_value(map=ksnoop_func_sta,ks=8,vs=144,smin=smin32=0,smax=umax=smax32=umax32=2040,var_off=(0x0; 0x7f8))
+    118: (79) r7 = *(u64 *)(r4 +8)
+    invalid access to map value, value_size=144 off=2048 size=8
+
+    The last_stack_depth use 'w4 > 0xf' check boundary, but 'r3 &= 255'
+    is beyond 0xf (0~15).
+
+2nd:
+    ; trace_len = sizeof(*trace) + trace->buf_len - MAX_TRACE_BUF; @ ksnoop.bpf.c:222
+    502: (04) w5 += 4008                  ; frame1: R5_w=scalar(smin=umin=smin32=umin32=4009,smax=umax=smax32=umax32=0x10fa7,var_off=(0x0; 0x1ffff))
+    503: (bc) w2 = w5                     ; frame1: R2_w=scalar(id=27,smin=umin=smin32=umin32=4009,smax=umax=smax32=umax32=0x10fa7,var_off=(0x0; 0x1ffff)) R5_w=scalar(id=27,smin=umin=smin32=umin32=4009,smax=umax=smax32=umax32=0x10fa7,var_off=(0x0; 0x1ffff))
+    504: (54) w2 &= 65535                 ; frame1: R2_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=0xffff,var_off=(0x0; 0xffff))
+    ; if (trace_len <= sizeof(*trace)) @ ksnoop.bpf.c:224
+    505: (26) if w2 > 0x3fa8 goto pc+7    ; frame1: R2_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=16296,var_off=(0x0; 0x3fff))
+    506: (57) r5 &= 65535                 ; frame1: R5_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=0xffff,var_off=(0x0; 0xffff))
+    507: (18) r2 = 0xffff8ec554700c00     ; frame1: R2_w=map_ptr(map=ksnoop_perf_map,ks=4,vs=4)
+    509: (18) r3 = 0xffffffff             ; frame1: R3_w=0xffffffff
+    511: (bf) r4 = r9                     ; frame1: R4_w=map_value(map=ksnoop_func_map,ks=8,vs=16296) R9=map_value(map=ksnoop_func_map,ks=8,vs=16296)
+    512: (85) call bpf_perf_event_output#25
+    invalid access to map value, value_size=16296 off=0 size=65535
+
+    Just fix it with size type 'u64' instead of 'u32', see:
+    long bpf_perf_event_output(void *ctx, struct bpf_map *map, u64 flags, void *data, u64 size)
+
+Signed-off-by: Rong Tao <rongtao@cestc.cn>
+---
+ libbpf-tools/ksnoop.bpf.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/libbpf-tools/ksnoop.bpf.c b/libbpf-tools/ksnoop.bpf.c
+index f07ff561..15aa7d75 100644
+--- a/libbpf-tools/ksnoop.bpf.c
++++ b/libbpf-tools/ksnoop.bpf.c
+@@ -103,7 +103,8 @@ static struct trace *get_trace(struct pt_regs *ctx, bool entry)
+ 		/* get address of last function we called */
+ 		if (last_stack_depth >= 0 &&
+ 		    last_stack_depth < FUNC_MAX_STACK_DEPTH)
+-			last_ip = func_stack->ips[last_stack_depth];
++			bpf_probe_read_kernel(&last_ip, sizeof(last_ip),
++					      &func_stack->ips[last_stack_depth]);
+ 		/* push ip onto stack. return will pop it. */
+ 		func_stack->ips[stack_depth] = ip;
+ 		/* mask used in case bounds checks are optimized out */
+@@ -202,7 +203,7 @@ static struct trace *get_trace(struct pt_regs *ctx, bool entry)
+ 
+ static void output_trace(struct pt_regs *ctx, struct trace *trace)
+ {
+-	__u16 trace_len;
++	__u64 trace_len;
+ 
+ 	if (trace->buf_len == 0)
+ 		goto skip;
+-- 
+2.51.0
+

bcc-0.35.0-tools-tcpconnect-fix-iov-field-for-DNS-with-Linux-6..patch

@@ -0,0 +1,64 @@
+From 377b19d669154e48e7278d9f5fe3afbf1f9c078b Mon Sep 17 00:00:00 2001
+From: Francois Lesueur <11961066+flesueur@users.noreply.github.com>
+Date: Wed, 6 Aug 2025 06:11:02 +0200
+Subject: [PATCH] tools/tcpconnect: fix iov field for DNS with Linux>=6.4
+ (#5382)
+
+Tcpconnect with DNS (-d flag) does not work with Linux>=6.4. The kernel representation of struct iov_iter changed in 6.4.
+
+This PR adapts the iov field depending on the structure. It also removes inet_sk() which did not work on a recent kernel (6.6).
+---
+ tools/tcpconnect.py | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/tools/tcpconnect.py b/tools/tcpconnect.py
+index a38bad8d..dc35cb28 100755
+--- a/tools/tcpconnect.py
++++ b/tools/tcpconnect.py
+@@ -276,7 +276,7 @@ int trace_udp_recvmsg(struct pt_regs *ctx)
+ {
+     __u64 pid_tgid = bpf_get_current_pid_tgid();
+     struct sock *sk = (struct sock *)PT_REGS_PARM1(ctx);
+-    struct inet_sock *is = inet_sk(sk);
++    struct inet_sock *is = (struct inet_sock *)sk;
+ 
+     // only grab port 53 packets, 13568 is ntohs(53)
+     if (is->inet_dport == 13568) {
+@@ -303,7 +303,7 @@ int trace_udp_ret_recvmsg(struct pt_regs *ctx)
+         goto delete_and_return;
+     size_t buflen = (size_t)copied;
+ 
+-    if (buflen > msghdr->msg_iter.iov->iov_len)
++    if (buflen > msghdr->msg_iter.IOV_FIELD->iov_len)
+         goto delete_and_return;
+ 
+     if (buflen > MAX_PKT)
+@@ -313,7 +313,7 @@ int trace_udp_ret_recvmsg(struct pt_regs *ctx)
+     if (!data) // this should never happen, just making the verifier happy
+         return 0;
+ 
+-    void *iovbase = msghdr->msg_iter.iov->iov_base;
++    void *iovbase = msghdr->msg_iter.IOV_FIELD->iov_base;
+     bpf_probe_read(data->pkt, buflen, iovbase);
+     dns_events.perf_submit(ctx, data, buflen);
+ 
+@@ -386,10 +386,14 @@ bpf_text = bpf_text.replace('FILTER_FAMILY', '')
+ bpf_text = bpf_text.replace('FILTER_UID', '')
+ 
+ if args.dns:
+-    if BPF.kernel_struct_has_field(b'iov_iter', b'iter_type') == 1:
++    if BPF.kernel_struct_has_field(b'iov_iter', b'type') == 1:
++        dns_bpf_text = dns_bpf_text.replace('TYPE_FIELD', 'type')
++    else:
+         dns_bpf_text = dns_bpf_text.replace('TYPE_FIELD', 'iter_type')
++    if BPF.kernel_struct_has_field(b'iov_iter', b'iov') == 1:
++        dns_bpf_text = dns_bpf_text.replace('IOV_FIELD', 'iov')
+     else:
+-        dns_bpf_text = dns_bpf_text.replace('TYPE_FIELD', 'type')
++        dns_bpf_text = dns_bpf_text.replace('IOV_FIELD', '__iov')
+     bpf_text += dns_bpf_text
+ 
+ if debug or args.ebpf:
+-- 
+2.51.0
+

bcc.spec

@@ -24,16 +24,19 @@
 
 
 Name:           bcc
-Version:        0.34.0
-Release:        2%{?dist}
+Version:        0.35.0
+Release:        1%{?dist}
 Summary:        BPF Compiler Collection (BCC)
 License:        ASL 2.0
 URL:            https://github.com/iovisor/bcc
 Source0:        %{url}/archive/v%{version}/%{name}-%{version}.tar.gz
 Patch0:         %%{name}-%%{version}-RHEL-Centos-tools-fix-alignment-in-tp_args-for-bio-t.patch
-Patch1:         %%{name}-%%{version}-tools-biosnoop-Fix-biosnoop-pattern-option-5304.patch
-Patch2:         %%{name}-%%{version}-libbpf-tools-klockstat-Allows-kprobe-fallback-to-wor.patch
-Patch3:         %%{name}-%%{version}-libbpf-tools-klockstat-Disable-_nested-kprobes-in-th.patch
+Patch1:         %%{name}-%%{version}-libbpf-tools-klockstat-Allows-kprobe-fallback-to-wor.patch
+Patch2:         %%{name}-%%{version}-libbpf-tools-klockstat-Disable-_nested-kprobes-in-th.patch
+Patch3:         %%{name}-%%{version}-Fix-a-build-failure-with-clang21-5369.patch
+Patch4:         %%{name}-%%{version}-libbpf-tools-ksnoop-Fix-two-invalid-access-to-map-va.patch
+Patch5:         %%{name}-%%{version}-libbpf-tools-javagc-Include-usdt.bpf.h-header.patch
+Patch6:         %%{name}-%%{version}-tools-tcpconnect-fix-iov-field-for-DNS-with-Linux-6..patch
 
 # Arches will be included as upstream support is added and dependencies are
 # satisfied in the respective arches
@@ -272,6 +275,11 @@ cp -a libbpf-tools/tmp-install/bin/* %{buildroot}/%{_sbindir}/
 %endif
 
 %changelog
+* Thu Oct 16 2025 Jerome Marchand <jmarchan@redhat.com> - 0.35.0-1
+- Rebase to version 0.35.0 (RHEL-79001)
+- Fix bpf-ksnoop (RHEL-96166)
+- Fix bpf-javagc (RHEL-78173)
+
 * Mon Jul 21 2025 Jerome Marchand <jmarchan@redhat.com> - 0.34.0-2
 - Fix bpf-klockstat on aarch64 and ppc64le debug (RHEL-78619)
 - Remove macro in comment.

sources

@@ -1 +1 @@
-SHA512 (bcc-0.34.0.tar.gz) = 0bcc00f2f94d2b835a0e421a029d30030324a839070c14da7fe56cd11ce246b7655dae42facb802d79c40325d5b98d5648b34189026c98cdcc6a1f094f795391
+SHA512 (bcc-0.35.0.tar.gz) = 23cc1413fef785165fe9fd29a242fb13e4e56da7d63699dbed3d6d12902a1de392b412cb0e5754eff5aeecf0a023568d593c9f4cb5bca7a88013aadfaef4fa3d