diff --git a/.bcc.metadata b/.bcc.metadata deleted file mode 100644 index 51078f8..0000000 --- a/.bcc.metadata +++ /dev/null @@ -1 +0,0 @@ -059187f62e915eb74ea7b18e19fcb185f9d18255 SOURCES/bcc-0.25.0.tar.gz diff --git a/SOURCES/bcc-0.25.0-Fix-a-llvm-compilation-error.patch b/SOURCES/bcc-0.25.0-Fix-a-llvm-compilation-error.patch new file mode 100644 index 0000000..566358d --- /dev/null +++ b/SOURCES/bcc-0.25.0-Fix-a-llvm-compilation-error.patch @@ -0,0 +1,43 @@ +From f04aaed5402f847ea0127de7ca573d39c57da891 Mon Sep 17 00:00:00 2001 +From: Yonghong Song +Date: Sat, 26 Nov 2022 17:41:33 -0800 +Subject: [PATCH] Fix a llvm compilation error +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +With latest llvm16, I got the following compilation error: + /.../src/cc/bpf_module.cc: In member function ‘void ebpf::BPFModule::dump_ir(llvm::Module&)’: + /.../src/cc/bpf_module.cc:259:15: error: ‘PrintModulePass’ was not declared in this scope + MPM.addPass(PrintModulePass(errs())); + ^~~~~~~~~~~~~~~ + ... + +The error is due to the llvm patch https://reviews.llvm.org/D138081. +Fix the issue by adjust corresponding header file locaiton +as in the above llvm patch. + +Signed-off-by: Yonghong Song +--- + src/cc/bpf_module.cc | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/cc/bpf_module.cc b/src/cc/bpf_module.cc +index 490fffe8..0f4a4f58 100644 +--- a/src/cc/bpf_module.cc ++++ b/src/cc/bpf_module.cc +@@ -20,7 +20,11 @@ + #include + #include + #include ++#if LLVM_MAJOR_VERSION >= 16 ++#include ++#else + #include ++#endif + #include + #include + +-- +2.40.1 + diff --git a/SOURCES/bcc-0.25.0-Fix-a-llvm-signed-division-error-for-compactsnoop-to.patch b/SOURCES/bcc-0.25.0-Fix-a-llvm-signed-division-error-for-compactsnoop-to.patch new file mode 100644 index 0000000..4de2868 --- /dev/null +++ b/SOURCES/bcc-0.25.0-Fix-a-llvm-signed-division-error-for-compactsnoop-to.patch @@ -0,0 +1,42 @@ +From 0d563f713780eb274ebf995660917482452c127e Mon Sep 17 00:00:00 2001 +From: Yonghong Song +Date: Fri, 26 Aug 2022 16:34:24 -0700 +Subject: [PATCH 1/2] Fix a llvm signed division error for compactsnoop tool + +Fix issue #4182. +llvm doesn't support signed division and an assertion error +will happen when the IR contains sdiv. The reason is +due to code + zone - zone_pgdat->node_zones +where zone and zone_pgdat->node_zones are pointers to +struct zone (with size 1664). So effectively the above +is equivalent to + ((void *)zone - (void *)zone_pgdat->node_zones)/sizeof(struct zone) +which is converted to sdiv insn. +llvm11 seems okay and I didn't investigate why. But llvm14 and +latest llvm16 failed with compiler fatal error. + +To fix the issue let us replace the above '(void *)' as +'(u64)' and then the udiv will be used for the division. + +Signed-off-by: Yonghong Song +--- + tools/compactsnoop.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/compactsnoop.py b/tools/compactsnoop.py +index 9daaf485..bf3c9b4b 100755 +--- a/tools/compactsnoop.py ++++ b/tools/compactsnoop.py +@@ -124,7 +124,7 @@ static inline int zone_idx_(struct zone *zone) + { + struct pglist_data *zone_pgdat = NULL; + bpf_probe_read_kernel(&zone_pgdat, sizeof(zone_pgdat), &zone->zone_pgdat); +- return zone - zone_pgdat->node_zones; ++ return ((u64)zone - (u64)zone_pgdat->node_zones)/sizeof(struct zone); + } + + #ifdef EXTNEDED_FIELDS +-- +2.39.2 + diff --git a/SOURCES/bcc-0.25.0-Fix-compilation-error-when-built-with-llvm17.patch b/SOURCES/bcc-0.25.0-Fix-compilation-error-when-built-with-llvm17.patch new file mode 100644 index 0000000..e0107f7 --- /dev/null +++ b/SOURCES/bcc-0.25.0-Fix-compilation-error-when-built-with-llvm17.patch @@ -0,0 +1,48 @@ +From 30e77ce4e5ae11e29b023d9dcd7f6dd70cae73fa Mon Sep 17 00:00:00 2001 +From: Yonghong Song +Date: Sun, 26 Mar 2023 13:10:49 -0700 +Subject: [PATCH 3/3] Fix compilation error when built with llvm17 + +With llvm17, building bcc hits the following compilation errors: + ... + /home/yhs/work/bcc/src/cc/bpf_module.cc:21:10: fatal error: llvm-c/Transforms/IPO.h: No such file or directory + 21 | #include + | ^~~~~~~~~~~~~~~~~~~~~~~~~ + /home/yhs/work/bcc/src/cc/bpf_module.cc:48:10: fatal error: llvm/Transforms/IPO/PassManagerBuilder.h: No such file or directory + 48 | #include + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +The above two files are removed by https://reviews.llvm.org/D144970 and https://reviews.llvm.org/D145835 + +Signed-off-by: Yonghong Song +--- + src/cc/bpf_module.cc | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/cc/bpf_module.cc b/src/cc/bpf_module.cc +index 0f4a4f58..29868134 100644 +--- a/src/cc/bpf_module.cc ++++ b/src/cc/bpf_module.cc +@@ -17,7 +17,9 @@ + + #include + #include ++#if LLVM_MAJOR_VERSION <= 16 + #include ++#endif + #include + #include + #if LLVM_MAJOR_VERSION >= 16 +@@ -43,7 +45,9 @@ + #include + #include + #include ++#if LLVM_MAJOR_VERSION <= 16 + #include ++#endif + #include + #include + #include +-- +2.41.0 + diff --git a/SOURCES/bcc-0.25.0-Revert-tools-Fix-bindsnoop-for-kernel-v5.6.patch b/SOURCES/bcc-0.25.0-Revert-tools-Fix-bindsnoop-for-kernel-v5.6.patch new file mode 100644 index 0000000..517e550 --- /dev/null +++ b/SOURCES/bcc-0.25.0-Revert-tools-Fix-bindsnoop-for-kernel-v5.6.patch @@ -0,0 +1,43 @@ +From 73b15c15bdf3327c86de524ded528c6c6061ff3d Mon Sep 17 00:00:00 2001 +From: Jerome Marchand +Date: Wed, 3 May 2023 16:16:52 +0200 +Subject: [PATCH] Revert "tools: Fix bindsnoop for kernel v5.6" + +This reverts commit f96fed0a3b9682ce52a35a02f72880395582d855. +--- + tools/bindsnoop.py | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/tools/bindsnoop.py b/tools/bindsnoop.py +index 07503352..ac3a8aa0 100755 +--- a/tools/bindsnoop.py ++++ b/tools/bindsnoop.py +@@ -27,7 +27,7 @@ + # 14-Feb-2020 Pavel Dubovitsky Created this. + + from __future__ import print_function, absolute_import, unicode_literals +-from bcc import BPF ++from bcc import BPF, DEBUG_SOURCE + from bcc.containers import filter_by_containers + from bcc.utils import printb + import argparse +@@ -243,14 +243,10 @@ static int bindsnoop_return(struct pt_regs *ctx, short ipver) + opts.fields.reuseport = bitfield >> 4 & 0x01; + + // workaround for reading the sk_protocol bitfield (from tcpaccept.py): +- u16 protocol; ++ u8 protocol; + int gso_max_segs_offset = offsetof(struct sock, sk_gso_max_segs); + int sk_lingertime_offset = offsetof(struct sock, sk_lingertime); +- +- // Since kernel v5.6 sk_protocol has its own u16 field +- if (sk_lingertime_offset - gso_max_segs_offset == 2) +- protocol = skp->sk_protocol; +- else if (sk_lingertime_offset - gso_max_segs_offset == 4) ++ if (sk_lingertime_offset - gso_max_segs_offset == 4) + // 4.10+ with little endian + #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ + protocol = *(u8 *)((u64)&skp->sk_gso_max_segs - 3); +-- +2.40.1 + diff --git a/SOURCES/bcc-0.25.0-tools-compactsnoop.py-Fix-raw_tracepoint-Invalid-arg.patch b/SOURCES/bcc-0.25.0-tools-compactsnoop.py-Fix-raw_tracepoint-Invalid-arg.patch new file mode 100644 index 0000000..c442033 --- /dev/null +++ b/SOURCES/bcc-0.25.0-tools-compactsnoop.py-Fix-raw_tracepoint-Invalid-arg.patch @@ -0,0 +1,71 @@ +From 2fd4457e52d56825e12a4037630aea3f82241a02 Mon Sep 17 00:00:00 2001 +From: Rong Tao +Date: Fri, 10 Feb 2023 23:28:55 +0800 +Subject: [PATCH 2/2] tools/compactsnoop.py: Fix raw_tracepoint Invalid + argument error + +kernel commit abd4349ff9b8("mm: compaction: cleanup the compaction trace +events") change the arguments of 'mm_compaction_begin' from (start_pfn, +migrate_pfn, free_pfn, end_pfn, sync) to (cc, start_pfn, end_pfn, sync), +and change the arguments of 'mm_compaction_end' from (start_pfn, +migrate_pfn, free_pfn, end_pfn, sync, ret) to (cc, start_pfn, end_pfn, +sync, ret). + +Replacing RAW_TRACEPOINT_PROBE with TRACEPOINT_PROBE solves this problem +and guarantees compatibility. + + $ sudo ./compactsnoop.py + bpf_attach_raw_tracepoint (mm_compaction_begin): Invalid argument + Traceback (most recent call last): + File "/home/sdb/Git/bcc/tools/./compactsnoop.py", line 292, in + b = BPF(text=bpf_text) + ^^^^^^^^^^^^^^^^^^ + File "/usr/lib/python3.11/site-packages/bcc/__init__.py", line 483, in __init__ + self._trace_autoload() + File "/usr/lib/python3.11/site-packages/bcc/__init__.py", line 1462, in _trace_autoload + self.attach_raw_tracepoint(tp=tp, fn_name=fn.name) + File "/usr/lib/python3.11/site-packages/bcc/__init__.py", line 1055, in attach_raw_tracepoint + raise Exception("Failed to attach BPF to raw tracepoint") + Exception: Failed to attach BPF to raw tracepoint + +Signed-off-by: Rong Tao +--- + tools/compactsnoop.py | 13 ++++--------- + 1 file changed, 4 insertions(+), 9 deletions(-) + +diff --git a/tools/compactsnoop.py b/tools/compactsnoop.py +index bf3c9b4b..e9baa9b4 100755 +--- a/tools/compactsnoop.py ++++ b/tools/compactsnoop.py +@@ -237,11 +237,9 @@ RAW_TRACEPOINT_PROBE(mm_compaction_suitable) + return 0; + } + +-RAW_TRACEPOINT_PROBE(mm_compaction_begin) ++TRACEPOINT_PROBE(compaction, mm_compaction_begin) + { +- // TP_PROTO(unsigned long zone_start, unsigned long migrate_pfn, +- // unsigned long free_pfn, unsigned long zone_end, bool sync) +- bool sync = (bool)ctx->args[4]; ++ bool sync = args->sync; + + u64 id = bpf_get_current_pid_tgid(); + struct val_t *valp = start.lookup(&id); +@@ -255,12 +253,9 @@ RAW_TRACEPOINT_PROBE(mm_compaction_begin) + return 0; + } + +-RAW_TRACEPOINT_PROBE(mm_compaction_end) ++TRACEPOINT_PROBE(compaction, mm_compaction_end) + { +- // TP_PROTO(unsigned long zone_start, unsigned long migrate_pfn, +- // unsigned long free_pfn, unsigned long zone_end, bool sync, +- // int status) +- submit_event(ctx, ctx->args[5]); ++ submit_event(args, args->status); + return 0; + } + """ +-- +2.39.2 + diff --git a/SOURCES/bcc-0.25.0-tools-nfsslower.py-Fix-uninitialized-struct-pad-erro.patch b/SOURCES/bcc-0.25.0-tools-nfsslower.py-Fix-uninitialized-struct-pad-erro.patch new file mode 100644 index 0000000..79b7594 --- /dev/null +++ b/SOURCES/bcc-0.25.0-tools-nfsslower.py-Fix-uninitialized-struct-pad-erro.patch @@ -0,0 +1,49 @@ +From 1d8419056e128ae49107d27e5f55d1bfa8134e3a Mon Sep 17 00:00:00 2001 +From: Rong Tao +Date: Fri, 10 Feb 2023 22:16:56 +0800 +Subject: [PATCH] tools/nfsslower.py: Fix uninitialized struct pad error + +The verifier is unhappy, if data struct _pad_ is not initialized, see [0][1]. + + $ sudo ./nfsslower.py + ... + ; bpf_perf_event_output(ctx, (void *)bpf_pseudo_fd(1, -2), CUR_CPU_IDENTIFIER, &data, sizeof(data)); + 83: (79) r1 = *(u64 *)(r10 -144) ; R1_w=ctx(off=0,imm=0) R10=fp0 + 84: (18) r3 = 0xffffffff ; R3_w=4294967295 + 86: (b7) r5 = 96 ; R5_w=96 + 87: (85) call bpf_perf_event_output#25 + invalid indirect read from stack R4 off -136+92 size 96 + processed 84 insns (limit 1000000) max_states_per_insn 0 total_states 4 peak_states 4 mark_read 4 + ... + raise Exception("Failed to load BPF program %s: %s" % + Exception: Failed to load BPF program b'raw_tracepoint__nfs_commit_done': Permission denied + +[0] https://github.com/iovisor/bcc/issues/2623 +[1] https://github.com/iovisor/bcc/pull/4453 + +Signed-off-by: Rong Tao +--- + tools/nfsslower.py | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/tools/nfsslower.py b/tools/nfsslower.py +index b5df8f19..c2c243b3 100755 +--- a/tools/nfsslower.py ++++ b/tools/nfsslower.py +@@ -179,8 +179,11 @@ static int trace_exit(struct pt_regs *ctx, int type) + + // populate output struct + u32 size = PT_REGS_RC(ctx); +- struct data_t data = {.type = type, .size = size, .delta_us = delta_us, +- .pid = pid}; ++ struct data_t data = {}; ++ data.type = type; ++ data.size = size; ++ data.delta_us = delta_us; ++ data.pid = pid; + data.ts_us = ts / 1000; + data.offset = valp->offset; + bpf_get_current_comm(&data.task, sizeof(data.task)); +-- +2.40.1 + diff --git a/SOURCES/bcc-0.25.0-tools-tcpstates-fix-IPv6-journal.patch b/SOURCES/bcc-0.25.0-tools-tcpstates-fix-IPv6-journal.patch new file mode 100644 index 0000000..18f7aba --- /dev/null +++ b/SOURCES/bcc-0.25.0-tools-tcpstates-fix-IPv6-journal.patch @@ -0,0 +1,156 @@ +From e1f462c14bc8f22f579d5594b61a89d41d10a022 Mon Sep 17 00:00:00 2001 +From: Jerome Marchand +Date: Wed, 1 Feb 2023 17:30:03 +0100 +Subject: [PATCH 2/3] tools/tcpstates: fix IPv6 journal + +When logging ipv6 state change, journal_fields tries to pack +event.addr and event.daddr, which is not an integer in this, to +present a bytes-like object to socket.inet_ntop. This can be fixed by +having a similar type for [sd]addr for IPv4 and IPv6. Making both an +array of u32 solves the issue by presenting a bytes-like object +directly to inet_ntop, without the need for the struct packing stage. + +Also now, the similar behavior, makes it easier to factor code for +IPv4 and IPv6. + +It solves the following error: +/usr/share/bcc/tools/tcpstates -Y +SKADDR C-PID C-COMM LADDR LPORT RADDR RPORT OLDSTATE -> NEWSTATE MS +ffff8b2e83e56180 0 swapper/9 :: 22 :: 0 LISTEN -> SYN_RECV 0.000 +Exception ignored on calling ctypes callback function: .raw_cb_ at 0x7f894c8d7f70> +Traceback (most recent call last): + File "/usr/lib/python3.9/site-packages/bcc/table.py", line 982, in raw_cb_ + callback(cpu, data, size) + File "/usr/share/bcc/tools/tcpstates", line 419, in print_ipv6_event + journal.send(**journal_fields(event, AF_INET6)) + File "/usr/share/bcc/tools/tcpstates", line 348, in journal_fields + 'OBJECT_' + addr_pfx + '_SOURCE_ADDRESS': inet_ntop(addr_family, pack("I", event.saddr)), +struct.error: required argument is not an integer +ffff8b2e83e56180 0 swapper/9 2620:52:0:2580:5054:ff:fe6b:6f1f 22 2620:52:0:2b11:2f5e:407d:b35d:4663 60396 SYN_RECV -> ESTABLISHED 0.010 +Exception ignored on calling ctypes callback function: .raw_cb_ at 0x7f894c8d7f70> +Traceback (most recent call last): + File "/usr/lib/python3.9/site-packages/bcc/table.py", line 982, in raw_cb_ + callback(cpu, data, size) + File "/usr/share/bcc/tools/tcpstates", line 419, in print_ipv6_event + journal.send(**journal_fields(event, AF_INET6)) + File "/usr/share/bcc/tools/tcpstates", line 348, in journal_fields + 'OBJECT_' + addr_pfx + '_SOURCE_ADDRESS': inet_ntop(addr_family, pack("I", event.saddr)), +struct.error: required argument is not an integer + +Signed-off-by: Jerome Marchand +--- + tools/tcpstates.py | 55 +++++++++++++++++----------------------------- + 1 file changed, 20 insertions(+), 35 deletions(-) + +diff --git a/tools/tcpstates.py b/tools/tcpstates.py +index d9d6e4c7..0507cc10 100755 +--- a/tools/tcpstates.py ++++ b/tools/tcpstates.py +@@ -19,7 +19,6 @@ from __future__ import print_function + from bcc import BPF + import argparse + from socket import inet_ntop, AF_INET, AF_INET6 +-from struct import pack + from time import strftime, time + from os import getuid + +@@ -78,8 +77,8 @@ BPF_HASH(last, struct sock *, u64); + struct ipv4_data_t { + u64 ts_us; + u64 skaddr; +- u32 saddr; +- u32 daddr; ++ u32 saddr[1]; ++ u32 daddr[1]; + u64 span_us; + u32 pid; + u16 lport; +@@ -93,8 +92,8 @@ BPF_PERF_OUTPUT(ipv4_events); + struct ipv6_data_t { + u64 ts_us; + u64 skaddr; +- unsigned __int128 saddr; +- unsigned __int128 daddr; ++ u32 saddr[4]; ++ u32 daddr[4]; + u64 span_us; + u32 pid; + u16 lport; +@@ -350,9 +349,9 @@ format_string = ("%-16x %-5d %-10.10s %s%-15s %-5d %-15s %-5d %-11s " + + 'OBJECT_PID': str(event.pid), + 'OBJECT_COMM': event.task.decode('utf-8', 'replace'), + # Custom fields, aka "stuff we sort of made up". +- 'OBJECT_' + addr_pfx + '_SOURCE_ADDRESS': inet_ntop(addr_family, pack("I", event.saddr)), ++ 'OBJECT_' + addr_pfx + '_SOURCE_ADDRESS': inet_ntop(addr_family, event.saddr), + 'OBJECT_TCP_SOURCE_PORT': str(event.lport), +- 'OBJECT_' + addr_pfx + '_DESTINATION_ADDRESS': inet_ntop(addr_family, pack("I", event.daddr)), ++ 'OBJECT_' + addr_pfx + '_DESTINATION_ADDRESS': inet_ntop(addr_family, event.daddr), + 'OBJECT_TCP_DESTINATION_PORT': str(event.dport), + 'OBJECT_TCP_OLD_STATE': tcpstate2str(event.oldstate), + 'OBJECT_TCP_NEW_STATE': tcpstate2str(event.newstate), +@@ -373,8 +372,7 @@ format_string = ("%-16x %-5d %-10.10s %s%-15s %-5d %-15s %-5d %-11s " + + return fields + + # process event +-def print_ipv4_event(cpu, data, size): +- event = b["ipv4_events"].event(data) ++def print_event(event, addr_family): + global start_ts + if args.time: + if args.csv: +@@ -389,39 +387,26 @@ format_string = ("%-16x %-5d %-10.10s %s%-15s %-5d %-15s %-5d %-11s " + + print("%.6f," % delta_s, end="") + else: + print("%-9.6f " % delta_s, end="") ++ if addr_family == AF_INET: ++ version = "4" ++ else: ++ version = "6" + print(format_string % (event.skaddr, event.pid, event.task.decode('utf-8', 'replace'), +- "4" if args.wide or args.csv else "", +- inet_ntop(AF_INET, pack("I", event.saddr)), event.lport, +- inet_ntop(AF_INET, pack("I", event.daddr)), event.dport, ++ version if args.wide or args.csv else "", ++ inet_ntop(addr_family, event.saddr), event.lport, ++ inet_ntop(addr_family, event.daddr), event.dport, + tcpstate2str(event.oldstate), tcpstate2str(event.newstate), + float(event.span_us) / 1000)) + if args.journal: +- journal.send(**journal_fields(event, AF_INET)) ++ journal.send(**journal_fields(event, addr_family)) ++ ++def print_ipv4_event(cpu, data, size): ++ event = b["ipv4_events"].event(data) ++ print_event(event, AF_INET) + + def print_ipv6_event(cpu, data, size): + event = b["ipv6_events"].event(data) +- global start_ts +- if args.time: +- if args.csv: +- print("%s," % strftime("%H:%M:%S"), end="") +- else: +- print("%-8s " % strftime("%H:%M:%S"), end="") +- if args.timestamp: +- if start_ts == 0: +- start_ts = event.ts_us +- delta_s = (float(event.ts_us) - start_ts) / 1000000 +- if args.csv: +- print("%.6f," % delta_s, end="") +- else: +- print("%-9.6f " % delta_s, end="") +- print(format_string % (event.skaddr, event.pid, event.task.decode('utf-8', 'replace'), +- "6" if args.wide or args.csv else "", +- inet_ntop(AF_INET6, event.saddr), event.lport, +- inet_ntop(AF_INET6, event.daddr), event.dport, +- tcpstate2str(event.oldstate), tcpstate2str(event.newstate), +- float(event.span_us) / 1000)) +- if args.journal: +- journal.send(**journal_fields(event, AF_INET6)) ++ print_event(event, AF_INET6) + + # initialize BPF + b = BPF(text=bpf_text) +-- +2.41.0 + diff --git a/SOURCES/bcc-0.25.0-tools-tcpstates-fix-context-ptr-modified-error.patch b/SOURCES/bcc-0.25.0-tools-tcpstates-fix-context-ptr-modified-error.patch new file mode 100644 index 0000000..7c1149e --- /dev/null +++ b/SOURCES/bcc-0.25.0-tools-tcpstates-fix-context-ptr-modified-error.patch @@ -0,0 +1,144 @@ +From 28bf4c3eb6949722d3d7af912f6802e282e51e90 Mon Sep 17 00:00:00 2001 +From: hejun01 +Date: Thu, 29 Jun 2023 20:24:07 +0800 +Subject: [PATCH 1/3] tools/tcpstates: fix context ptr modified error + +Introduce local variable tcp_new_state, +to avoid llvm optimization of args->newstate, +which will cause context ptr args modified. +spilt event.ports to lport and dport. +switch type of TCP state from unsigned int to int. +--- + tools/tcpstates.py | 47 +++++++++++++++++++++++++--------------------- + 1 file changed, 26 insertions(+), 21 deletions(-) + +diff --git a/tools/tcpstates.py b/tools/tcpstates.py +index 1fa2c26a..d9d6e4c7 100755 +--- a/tools/tcpstates.py ++++ b/tools/tcpstates.py +@@ -82,9 +82,10 @@ struct ipv4_data_t { + u32 daddr; + u64 span_us; + u32 pid; +- u32 ports; +- u32 oldstate; +- u32 newstate; ++ u16 lport; ++ u16 dport; ++ int oldstate; ++ int newstate; + char task[TASK_COMM_LEN]; + }; + BPF_PERF_OUTPUT(ipv4_events); +@@ -96,9 +97,10 @@ struct ipv6_data_t { + unsigned __int128 daddr; + u64 span_us; + u32 pid; +- u32 ports; +- u32 oldstate; +- u32 newstate; ++ u16 lport; ++ u16 dport; ++ int oldstate; ++ int newstate; + char task[TASK_COMM_LEN]; + }; + BPF_PERF_OUTPUT(ipv6_events); +@@ -132,6 +134,9 @@ TRACEPOINT_PROBE(sock, inet_sock_set_state) + u16 family = args->family; + FILTER_FAMILY + ++ // workaround to avoid llvm optimization which will cause context ptr args modified ++ int tcp_newstate = args->newstate; ++ + if (args->family == AF_INET) { + struct ipv4_data_t data4 = { + .span_us = delta_us, +@@ -141,8 +146,8 @@ TRACEPOINT_PROBE(sock, inet_sock_set_state) + data4.ts_us = bpf_ktime_get_ns() / 1000; + __builtin_memcpy(&data4.saddr, args->saddr, sizeof(data4.saddr)); + __builtin_memcpy(&data4.daddr, args->daddr, sizeof(data4.daddr)); +- // a workaround until data4 compiles with separate lport/dport +- data4.ports = dport + ((0ULL + lport) << 16); ++ data4.lport = lport; ++ data4.dport = dport; + data4.pid = pid; + + bpf_get_current_comm(&data4.task, sizeof(data4.task)); +@@ -157,14 +162,14 @@ TRACEPOINT_PROBE(sock, inet_sock_set_state) + data6.ts_us = bpf_ktime_get_ns() / 1000; + __builtin_memcpy(&data6.saddr, args->saddr_v6, sizeof(data6.saddr)); + __builtin_memcpy(&data6.daddr, args->daddr_v6, sizeof(data6.daddr)); +- // a workaround until data6 compiles with separate lport/dport +- data6.ports = dport + ((0ULL + lport) << 16); ++ data6.lport = lport; ++ data6.dport = dport; + data6.pid = pid; + bpf_get_current_comm(&data6.task, sizeof(data6.task)); + ipv6_events.perf_submit(args, &data6, sizeof(data6)); + } + +- if (args->newstate == TCP_CLOSE) { ++ if (tcp_newstate == TCP_CLOSE) { + last.delete(&sk); + } else { + u64 ts = bpf_ktime_get_ns(); +@@ -210,8 +215,8 @@ int kprobe__tcp_set_state(struct pt_regs *ctx, struct sock *sk, int state) + data4.ts_us = bpf_ktime_get_ns() / 1000; + data4.saddr = sk->__sk_common.skc_rcv_saddr; + data4.daddr = sk->__sk_common.skc_daddr; +- // a workaround until data4 compiles with separate lport/dport +- data4.ports = dport + ((0ULL + lport) << 16); ++ data4.lport = lport; ++ data4.dport = dport; + data4.pid = pid; + + bpf_get_current_comm(&data4.task, sizeof(data4.task)); +@@ -228,8 +233,8 @@ int kprobe__tcp_set_state(struct pt_regs *ctx, struct sock *sk, int state) + sk->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32); + bpf_probe_read_kernel(&data6.daddr, sizeof(data6.daddr), + sk->__sk_common.skc_v6_daddr.in6_u.u6_addr32); +- // a workaround until data6 compiles with separate lport/dport +- data6.ports = dport + ((0ULL + lport) << 16); ++ data6.lport = lport; ++ data6.dport = dport; + data6.pid = pid; + bpf_get_current_comm(&data6.task, sizeof(data6.task)); + ipv6_events.perf_submit(ctx, &data6, sizeof(data6)); +@@ -346,9 +351,9 @@ format_string = ("%-16x %-5d %-10.10s %s%-15s %-5d %-15s %-5d %-11s " + + 'OBJECT_COMM': event.task.decode('utf-8', 'replace'), + # Custom fields, aka "stuff we sort of made up". + 'OBJECT_' + addr_pfx + '_SOURCE_ADDRESS': inet_ntop(addr_family, pack("I", event.saddr)), +- 'OBJECT_TCP_SOURCE_PORT': str(event.ports >> 16), ++ 'OBJECT_TCP_SOURCE_PORT': str(event.lport), + 'OBJECT_' + addr_pfx + '_DESTINATION_ADDRESS': inet_ntop(addr_family, pack("I", event.daddr)), +- 'OBJECT_TCP_DESTINATION_PORT': str(event.ports & 0xffff), ++ 'OBJECT_TCP_DESTINATION_PORT': str(event.dport), + 'OBJECT_TCP_OLD_STATE': tcpstate2str(event.oldstate), + 'OBJECT_TCP_NEW_STATE': tcpstate2str(event.newstate), + 'OBJECT_TCP_SPAN_TIME': str(event.span_us) +@@ -386,8 +391,8 @@ format_string = ("%-16x %-5d %-10.10s %s%-15s %-5d %-15s %-5d %-11s " + + print("%-9.6f " % delta_s, end="") + print(format_string % (event.skaddr, event.pid, event.task.decode('utf-8', 'replace'), + "4" if args.wide or args.csv else "", +- inet_ntop(AF_INET, pack("I", event.saddr)), event.ports >> 16, +- inet_ntop(AF_INET, pack("I", event.daddr)), event.ports & 0xffff, ++ inet_ntop(AF_INET, pack("I", event.saddr)), event.lport, ++ inet_ntop(AF_INET, pack("I", event.daddr)), event.dport, + tcpstate2str(event.oldstate), tcpstate2str(event.newstate), + float(event.span_us) / 1000)) + if args.journal: +@@ -411,8 +416,8 @@ format_string = ("%-16x %-5d %-10.10s %s%-15s %-5d %-15s %-5d %-11s " + + print("%-9.6f " % delta_s, end="") + print(format_string % (event.skaddr, event.pid, event.task.decode('utf-8', 'replace'), + "6" if args.wide or args.csv else "", +- inet_ntop(AF_INET6, event.saddr), event.ports >> 16, +- inet_ntop(AF_INET6, event.daddr), event.ports & 0xffff, ++ inet_ntop(AF_INET6, event.saddr), event.lport, ++ inet_ntop(AF_INET6, event.daddr), event.dport, + tcpstate2str(event.oldstate), tcpstate2str(event.newstate), + float(event.span_us) / 1000)) + if args.journal: +-- +2.41.0 + diff --git a/SPECS/bcc.spec b/SPECS/bcc.spec index 7f3f43c..71768c8 100644 --- a/SPECS/bcc.spec +++ b/SPECS/bcc.spec @@ -9,7 +9,7 @@ Name: bcc Version: 0.25.0 -Release: 2%{?dist} +Release: 7%{?dist} Summary: BPF Compiler Collection (BCC) License: ASL 2.0 URL: https://github.com/iovisor/bcc @@ -21,6 +21,15 @@ Patch3: %{name}-%{version}-Fix-bpf_pseudo_fd-type-conversion-error.patch Patch4: %{name}-%{version}-Fix-clang-15-int-to-pointer-conversion-errors.patch Patch5: %{name}-%{version}-Revert-tools-tcpaccept-Fix-support-for-v5.6-kernels.patch Patch6: %{name}-%{version}-Fix-get_kprobe_functions.patch +Patch7: %{name}-%{version}-Fix-a-llvm-signed-division-error-for-compactsnoop-to.patch +Patch8: %{name}-%{version}-tools-compactsnoop.py-Fix-raw_tracepoint-Invalid-arg.patch +Patch9: %{name}-%{version}-Revert-tools-Fix-bindsnoop-for-kernel-v5.6.patch +Patch10: %{name}-%{version}-tools-nfsslower.py-Fix-uninitialized-struct-pad-erro.patch +Patch11: %{name}-%{version}-Fix-a-llvm-compilation-error.patch +Patch12: %{name}-%{version}-Fix-compilation-error-when-built-with-llvm17.patch +Patch13: %{name}-%{version}-tools-tcpstates-fix-context-ptr-modified-error.patch +Patch14: %{name}-%{version}-tools-tcpstates-fix-IPv6-journal.patch + # Arches will be included as upstream support is added and dependencies are # satisfied in the respective arches @@ -218,6 +227,31 @@ done %changelog +* Wed Nov 08 2023 Jerome Marchand - 0.25.0-7 +- Fix repo URL in tests.yml + +* Wed Nov 01 2023 Jerome Marchand - 0.25.0-6 +- Rebuild on LLVM 17 (RHEL-10689) +- Fix IPv6 for tcpstates (RHEL-8522) + +* Mon Jun 12 2023 Jerome Marchand - 0.25.0-5 +- Fix LLVM 16 build + +* Thu Jun 08 2023 Jerome Marchand - 0.25.0-4 +- Add missing patch. + +* Mon May 15 2023 Jerome Marchand - 0.25.0-3 +- Rebuild with llvm 16 (RHBZ#2192949) +- Fix compactsnoop (RHBZ#2042238) +- Fix bindsnoop (RHBZ#2155200) +- Fix nfsslower (RHBZ#2155163) + +* Fri Mar 03 2023 bstinson@redhat.com - 0.25.0-2.0.2 +- One final rebuild in CentOS Stream only + +* Wed Mar 01 2023 bstinson@redhat.com - 0.25.0-2.0.1 +- Rebuild in CentOS Stream only for library link issue + * Tue Jan 10 2023 Jerome Marchand - 0.25.0-2 - Fix tcpdrop tool