21 changed files with 3376 additions and 311 deletions
--- a/.bcc.metadata
+++ b/.bcc.metadata
@ -1 +1 @@
-26ec7f9fc22494b9b6f20cd38ca216edc130704e SOURCES/bcc-0.30.0.tar.gz
+059187f62e915eb74ea7b18e19fcb185f9d18255 SOURCES/bcc-0.25.0.tar.gz
--- a/.gitignore
+++ b/.gitignore
@ -1 +1 @@
-SOURCES/bcc-0.30.0.tar.gz
+SOURCES/bcc-0.25.0.tar.gz
--- a/SOURCES/bcc-0.25.0-Fix-a-llvm-compilation-error.patch
+++ b/SOURCES/bcc-0.25.0-Fix-a-llvm-compilation-error.patch
@ -0,0 +1,43 @@
 From f04aaed5402f847ea0127de7ca573d39c57da891 Mon Sep 17 00:00:00 2001
 From: Yonghong Song <yhs@fb.com>
 Date: Sat, 26 Nov 2022 17:41:33 -0800
 Subject: [PATCH] Fix a llvm compilation error
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 With latest llvm16, I got the following compilation error:
  /.../src/cc/bpf_module.cc: In member function ‘void ebpf::BPFModule::dump_ir(llvm::Module&)’:
  /.../src/cc/bpf_module.cc:259:15: error: ‘PrintModulePass’ was not declared in this scope
     MPM.addPass(PrintModulePass(errs()));
                 ^~~~~~~~~~~~~~~
  ...
 The error is due to the llvm patch https://reviews.llvm.org/D138081.
 Fix the issue by adjust corresponding header file locaiton
 as in the above llvm patch.
 Signed-off-by: Yonghong Song <yhs@fb.com>
 ---
 src/cc/bpf_module.cc | 4 ++++
 1 file changed, 4 insertions(+)
 diff --git a/src/cc/bpf_module.cc b/src/cc/bpf_module.cc
 index 490fffe8..0f4a4f58 100644
 --- a/src/cc/bpf_module.cc
 +++ b/src/cc/bpf_module.cc
@@ -20,7 +20,11 @@
 #include <llvm-c/Transforms/IPO.h>
 #include <llvm/ExecutionEngine/MCJIT.h>
 #include <llvm/ExecutionEngine/SectionMemoryManager.h>
 +#if LLVM_MAJOR_VERSION >= 16
 +#include <llvm/IRPrinter/IRPrintingPasses.h>
 +#else
 #include <llvm/IR/IRPrintingPasses.h>
 +#endif
 #include <llvm/IR/LLVMContext.h>
 #include <llvm/IR/Module.h>
 -- 
 2.40.1
--- a/SOURCES/bcc-0.25.0-Fix-a-llvm-signed-division-error-for-compactsnoop-to.patch
+++ b/SOURCES/bcc-0.25.0-Fix-a-llvm-signed-division-error-for-compactsnoop-to.patch
@ -0,0 +1,42 @@
 From 0d563f713780eb274ebf995660917482452c127e Mon Sep 17 00:00:00 2001
 From: Yonghong Song <yhs@fb.com>
 Date: Fri, 26 Aug 2022 16:34:24 -0700
 Subject: [PATCH 1/2] Fix a llvm signed division error for compactsnoop tool
 Fix issue #4182.
 llvm doesn't support signed division and an assertion error
 will happen when the IR contains sdiv. The reason is
 due to code
  zone - zone_pgdat->node_zones
 where zone and zone_pgdat->node_zones are pointers to
 struct zone (with size 1664). So effectively the above
 is equivalent to
  ((void *)zone - (void *)zone_pgdat->node_zones)/sizeof(struct zone)
 which is converted to sdiv insn.
 llvm11 seems okay and I didn't investigate why. But llvm14 and
 latest llvm16 failed with compiler fatal error.
 To fix the issue let us replace the above '(void *)' as
 '(u64)' and then the udiv will be used for the division.
 Signed-off-by: Yonghong Song <yhs@fb.com>
 ---
 tools/compactsnoop.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/tools/compactsnoop.py b/tools/compactsnoop.py
 index 9daaf485..bf3c9b4b 100755
 --- a/tools/compactsnoop.py
 +++ b/tools/compactsnoop.py
@@ -124,7 +124,7 @@ static inline int zone_idx_(struct zone *zone)
 {
     struct pglist_data *zone_pgdat = NULL;
     bpf_probe_read_kernel(&zone_pgdat, sizeof(zone_pgdat), &zone->zone_pgdat);
 -    return zone - zone_pgdat->node_zones;
 +    return ((u64)zone - (u64)zone_pgdat->node_zones)/sizeof(struct zone);
 }
 #ifdef EXTNEDED_FIELDS
 -- 
 2.39.2
--- a/SOURCES/bcc-0.25.0-Fix-bpf_pseudo_fd-type-conversion-error.patch
+++ b/SOURCES/bcc-0.25.0-Fix-bpf_pseudo_fd-type-conversion-error.patch
@ -0,0 +1,77 @@
 From 728005aac7c23590a406ac67235d915e416bff5d Mon Sep 17 00:00:00 2001
 From: Yonghong Song <yhs@fb.com>
 Date: Sat, 13 Aug 2022 17:50:07 -0700
 Subject: [PATCH 1/2] Fix bpf_pseudo_fd() type conversion error
 With llvm15 and llvm16, the following command line
  sudo ./trace.py 'smp_call_function_single "%K", arg1'
 will cause error:
  /virtual/main.c:60:36: error: incompatible integer to pointer conversion passing 'u64'
    (aka 'unsigned long long') to parameter of type 'void *' [-Wint-conversion]
        bpf_perf_event_output(ctx, bpf_pseudo_fd(1, -1), CUR_CPU_IDENTIFIER, &__data, sizeof(__data));
                                   ^~~~~~~~~~~~~~~~~~~~
  1 error generated.
  Failed to compile BPF module <text>
 In helpers.h, we have
  u64 bpf_pseudo_fd(u64, u64) asm("llvm.bpf.pseudo");
 Apparently, <= llvm14 can tolerate u64 -> 'void *' conversion, but
 llvm15 by default will cause an error.
 Let us explicitly convert bpf_pseudo_fd to 'void *' to avoid
 such errors.
 Signed-off-by: Yonghong Song <yhs@fb.com>
 ---
 src/cc/frontends/clang/b_frontend_action.cc | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)
 diff --git a/src/cc/frontends/clang/b_frontend_action.cc b/src/cc/frontends/clang/b_frontend_action.cc
 index a4e05b16..dbeba3e4 100644
 --- a/src/cc/frontends/clang/b_frontend_action.cc
 +++ b/src/cc/frontends/clang/b_frontend_action.cc
@@ -957,7 +957,7 @@ bool BTypeVisitor::VisitCallExpr(CallExpr *Call) {
           string arg0 = rewriter_.getRewrittenText(expansionRange(Call->getArg(0)->getSourceRange()));
           string args_other = rewriter_.getRewrittenText(expansionRange(SourceRange(GET_BEGINLOC(Call->getArg(1)),
                                                            GET_ENDLOC(Call->getArg(2)))));
 -          txt = "bpf_perf_event_output(" + arg0 + ", bpf_pseudo_fd(1, " + fd + ")";
 +          txt = "bpf_perf_event_output(" + arg0 + ", (void *)bpf_pseudo_fd(1, " + fd + ")";
           txt += ", CUR_CPU_IDENTIFIER, " + args_other + ")";
           // e.g.
@@ -986,7 +986,7 @@ bool BTypeVisitor::VisitCallExpr(CallExpr *Call) {
           string meta_len = rewriter_.getRewrittenText(expansionRange(Call->getArg(3)->getSourceRange()));
           txt = "bpf_perf_event_output(" +
             skb + ", " +
 -            "bpf_pseudo_fd(1, " + fd + "), " +
 +            "(void *)bpf_pseudo_fd(1, " + fd + "), " +
             "((__u64)" + skb_len + " << 32) | BPF_F_CURRENT_CPU, " +
             meta + ", " +
             meta_len + ");";
@@ -1006,12 +1006,12 @@ bool BTypeVisitor::VisitCallExpr(CallExpr *Call) {
           string keyp = rewriter_.getRewrittenText(expansionRange(Call->getArg(1)->getSourceRange()));
           string flag = rewriter_.getRewrittenText(expansionRange(Call->getArg(2)->getSourceRange()));
           txt = "bpf_" + string(memb_name) + "(" + ctx + ", " +
 -            "bpf_pseudo_fd(1, " + fd + "), " + keyp + ", " + flag + ");";
 +            "(void *)bpf_pseudo_fd(1, " + fd + "), " + keyp + ", " + flag + ");";
         } else if (memb_name == "ringbuf_output") {
           string name = string(Ref->getDecl()->getName());
           string args = rewriter_.getRewrittenText(expansionRange(SourceRange(GET_BEGINLOC(Call->getArg(0)),
                                                            GET_ENDLOC(Call->getArg(2)))));
 -          txt = "bpf_ringbuf_output(bpf_pseudo_fd(1, " + fd + ")";
 +          txt = "bpf_ringbuf_output((void *)bpf_pseudo_fd(1, " + fd + ")";
           txt += ", " + args + ")";
           // e.g.
@@ -1033,7 +1033,7 @@ bool BTypeVisitor::VisitCallExpr(CallExpr *Call) {
         } else if (memb_name == "ringbuf_reserve") {
           string name = string(Ref->getDecl()->getName());
           string arg0 = rewriter_.getRewrittenText(expansionRange(Call->getArg(0)->getSourceRange()));
 -          txt = "bpf_ringbuf_reserve(bpf_pseudo_fd(1, " + fd + ")";
 +          txt = "bpf_ringbuf_reserve((void *)bpf_pseudo_fd(1, " + fd + ")";
           txt += ", " + arg0 + ", 0)"; // Flags in reserve are meaningless
         } else if (memb_name == "ringbuf_discard") {
           string name = string(Ref->getDecl()->getName());
 -- 
 2.38.1
--- a/SOURCES/bcc-0.25.0-Fix-clang-15-int-to-pointer-conversion-errors.patch
+++ b/SOURCES/bcc-0.25.0-Fix-clang-15-int-to-pointer-conversion-errors.patch
@ -0,0 +1,96 @@
 From f5a6c22f613d0566ba542f38f349be379e3844e8 Mon Sep 17 00:00:00 2001
 From: Jerome Marchand <jmarchan@redhat.com>
 Date: Wed, 26 Oct 2022 14:41:54 +0200
 Subject: [PATCH 2/2] Fix clang 15 int to pointer conversion errors
 Since version 15, clang issues error for implicit conversion of
 integer to pointer. Several tools are broken. This patch add explicit
 pointer cast where needed.
 Fixes the following errors:
 /virtual/main.c:37:18: error: incompatible integer to pointer conversion initializing 'struct request *' with an expression of type 'unsigned long' [-Wint-conversion]
 struct request *req = ctx->di;
                 ^     ~~~~~~~
 /virtual/main.c:49:18: error: incompatible integer to pointer conversion initializing 'struct request *' with an expression of type 'unsigned long' [-Wint-conversion]
 struct request *req = ctx->di;
                 ^     ~~~~~~~
 2 errors generated.
 /virtual/main.c:73:19: error: incompatible integer to pointer conversion initializing 'struct pt_regs *' with an expression of type 'unsigned long' [-Wint-conversion]
 struct pt_regs * __ctx = ctx->di;
                  ^       ~~~~~~~
 /virtual/main.c:100:240: error: incompatible integer to pointer conversion passing 'u64' (aka 'unsigned long long') to parameter of type 'const void *' [-Wint-conversion]
    data.ppid = ({ typeof(pid_t) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&({ typeof(struct task_struct *) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&task->real_parent); _val; })->tgid); _val; });
                                                                                                                                                                                                                                               ^~~~~~~~~~~~~~~~~~~~~~~
 /virtual/main.c:100:118: error: incompatible integer to pointer conversion passing 'u64' (aka 'unsigned long long') to parameter of type 'const void *' [-Wint-conversion]
    data.ppid = ({ typeof(pid_t) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&({ typeof(struct task_struct *) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (u64)&task->real_parent); _val; })->tgid); _val; });
                                                                                                                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
 ---
 src/cc/frontends/clang/b_frontend_action.cc | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)
 diff --git a/src/cc/frontends/clang/b_frontend_action.cc b/src/cc/frontends/clang/b_frontend_action.cc
 index dbeba3e4..c0582464 100644
 --- a/src/cc/frontends/clang/b_frontend_action.cc
 +++ b/src/cc/frontends/clang/b_frontend_action.cc
@@ -517,9 +517,9 @@ bool ProbeVisitor::VisitUnaryOperator(UnaryOperator *E) {
   string pre, post;
   pre = "({ typeof(" + E->getType().getAsString() + ") _val; __builtin_memset(&_val, 0, sizeof(_val));";
   if (cannot_fall_back_safely)
 -    pre += " bpf_probe_read_kernel(&_val, sizeof(_val), (u64)";
 +    pre += " bpf_probe_read_kernel(&_val, sizeof(_val), (void *)";
   else
 -    pre += " bpf_probe_read(&_val, sizeof(_val), (u64)";
 +    pre += " bpf_probe_read(&_val, sizeof(_val), (void *)";
   post = "); _val; })";
   rewriter_.ReplaceText(expansionLoc(E->getOperatorLoc()), 1, pre);
   rewriter_.InsertTextAfterToken(expansionLoc(GET_ENDLOC(sub)), post);
@@ -581,9 +581,9 @@ bool ProbeVisitor::VisitMemberExpr(MemberExpr *E) {
   string pre, post;
   pre = "({ typeof(" + E->getType().getAsString() + ") _val; __builtin_memset(&_val, 0, sizeof(_val));";
   if (cannot_fall_back_safely)
 -    pre += " bpf_probe_read_kernel(&_val, sizeof(_val), (u64)&";
 +    pre += " bpf_probe_read_kernel(&_val, sizeof(_val), (void *)&";
   else
 -    pre += " bpf_probe_read(&_val, sizeof(_val), (u64)&";
 +    pre += " bpf_probe_read(&_val, sizeof(_val), (void *)&";
   post = rhs + "); _val; })";
   rewriter_.InsertText(expansionLoc(GET_BEGINLOC(E)), pre);
   rewriter_.ReplaceText(expansionRange(SourceRange(member, GET_ENDLOC(E))), post);
@@ -635,9 +635,9 @@ bool ProbeVisitor::VisitArraySubscriptExpr(ArraySubscriptExpr *E) {
   pre = "({ typeof(" + E->getType().getAsString() + ") _val; __builtin_memset(&_val, 0, sizeof(_val));";
   if (cannot_fall_back_safely)
 -    pre += " bpf_probe_read_kernel(&_val, sizeof(_val), (u64)((";
 +    pre += " bpf_probe_read_kernel(&_val, sizeof(_val), (void *)((";
   else
 -    pre += " bpf_probe_read(&_val, sizeof(_val), (u64)((";
 +    pre += " bpf_probe_read(&_val, sizeof(_val), (void *)((";
   if (isMemberDereference(base)) {
     pre += "&";
     // If the base of the array subscript is a member dereference, we'll rewrite
@@ -747,8 +747,8 @@ void BTypeVisitor::genParamDirectAssign(FunctionDecl *D, string& preamble,
       arg->addAttr(UnavailableAttr::CreateImplicit(C, "ptregs"));
       size_t d = idx - 1;
       const char *reg = calling_conv_regs[d];
 -      preamble += " " + text + " = " + fn_args_[0]->getName().str() + "->" +
 -                  string(reg) + ";";
 +      preamble += " " + text + " = (" + arg->getType().getAsString() + ")" +
 +                  fn_args_[0]->getName().str() + "->" + string(reg) + ";";
     }
   }
 }
@@ -762,7 +762,7 @@ void BTypeVisitor::genParamIndirectAssign(FunctionDecl *D, string& preamble,
     if (idx == 0) {
       new_ctx = "__" + arg->getName().str();
 -      preamble += " struct pt_regs * " + new_ctx + " = " +
 +      preamble += " struct pt_regs * " + new_ctx + " = (void *)" +
                   arg->getName().str() + "->" +
                   string(calling_conv_regs[0]) + ";";
     } else {
 -- 
 2.38.1
--- a/SOURCES/bcc-0.25.0-Fix-compilation-error-when-built-with-llvm17.patch
+++ b/SOURCES/bcc-0.25.0-Fix-compilation-error-when-built-with-llvm17.patch
@ -0,0 +1,48 @@
 From 30e77ce4e5ae11e29b023d9dcd7f6dd70cae73fa Mon Sep 17 00:00:00 2001
 From: Yonghong Song <yhs@fb.com>
 Date: Sun, 26 Mar 2023 13:10:49 -0700
 Subject: [PATCH 3/3] Fix compilation error when built with llvm17
 With llvm17, building bcc hits the following compilation errors:
  ...
  /home/yhs/work/bcc/src/cc/bpf_module.cc:21:10: fatal error: llvm-c/Transforms/IPO.h: No such file or directory
   21 | #include <llvm-c/Transforms/IPO.h>
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~
  /home/yhs/work/bcc/src/cc/bpf_module.cc:48:10: fatal error: llvm/Transforms/IPO/PassManagerBuilder.h: No such file or directory
   48 | #include <llvm/Transforms/IPO/PassManagerBuilder.h>
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 The above two files are removed by https://reviews.llvm.org/D144970 and https://reviews.llvm.org/D145835
 Signed-off-by: Yonghong Song <yhs@fb.com>
 ---
 src/cc/bpf_module.cc | 4 ++++
 1 file changed, 4 insertions(+)
 diff --git a/src/cc/bpf_module.cc b/src/cc/bpf_module.cc
 index 0f4a4f58..29868134 100644
 --- a/src/cc/bpf_module.cc
 +++ b/src/cc/bpf_module.cc
@@ -17,7 +17,9 @@
 #include <fcntl.h>
 #include <linux/bpf.h>
 +#if LLVM_MAJOR_VERSION <= 16
 #include <llvm-c/Transforms/IPO.h>
 +#endif
 #include <llvm/ExecutionEngine/MCJIT.h>
 #include <llvm/ExecutionEngine/SectionMemoryManager.h>
 #if LLVM_MAJOR_VERSION >= 16
@@ -43,7 +45,9 @@
 #include <llvm/Object/SymbolSize.h>
 #include <llvm/Support/TargetSelect.h>
 #include <llvm/Transforms/IPO.h>
 +#if LLVM_MAJOR_VERSION <= 16
 #include <llvm/Transforms/IPO/PassManagerBuilder.h>
 +#endif
 #include <net/if.h>
 #include <sys/stat.h>
 #include <unistd.h>
 -- 
 2.41.0
--- a/SOURCES/bcc-0.25.0-Fix-get_kprobe_functions.patch
+++ b/SOURCES/bcc-0.25.0-Fix-get_kprobe_functions.patch
@ -0,0 +1,30 @@
 From c27899b15bca6188d34c0b87b3389eeda2a90cb5 Mon Sep 17 00:00:00 2001
 From: Jerome Marchand <jmarchan@redhat.com>
 Date: Mon, 9 Jan 2023 18:17:20 +0100
 Subject: [PATCH] Fix get_kprobe_functions
 get_kprobe_functions will not only return a function that matches the
 regular expression, but also any function that starts with a
 substrings that matches it. This is obviously not the intended
 behavior.
 The issue is easily fixed by replacing re.match by re.fullmatch.
 ---
 src/python/bcc/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/src/python/bcc/__init__.py b/src/python/bcc/__init__.py
 index 7175b98e..970ddcc2 100644
 --- a/src/python/bcc/__init__.py
 +++ b/src/python/bcc/__init__.py
@@ -745,7 +745,7 @@ DEBUG_BTF = 0x20
                 # Exclude all gcc 8's extra .cold functions
                 elif re.match(b'^.*\.cold(\.\d+)?$', fn):
                     continue
 -                if (t.lower() in [b't', b'w']) and re.match(event_re, fn) \
 +                if (t.lower() in [b't', b'w']) and re.fullmatch(event_re, fn) \
                     and fn not in blacklist:
                     fns.append(fn)
         return set(fns)     # Some functions may appear more than once
 -- 
 2.38.1
--- a/SOURCES/bcc-0.25.0-Manpages-remove-unstable-statement.patch
+++ b/SOURCES/bcc-0.25.0-Manpages-remove-unstable-statement.patch
--- a/SOURCES/bcc-0.25.0-RHEL-libbpf-version-fixes.patch
+++ b/SOURCES/bcc-0.25.0-RHEL-libbpf-version-fixes.patch
@ -0,0 +1,684 @@
 From 66d9bffa99738bbed50b3d5b2d87990cdb5e4a58 Mon Sep 17 00:00:00 2001
 From: Jerome Marchand <jmarchan@redhat.com>
 Date: Mon, 28 Nov 2022 12:23:59 +0100
 Subject: [PATCH] RHEL: libbpf version fixes
 Revert "[bcc] stop using deprecated `bpf_load_program_attr`"
 Revert "backport `struct bpf_create_map_attr`"
 Revert "bcc: Replace deprecated libbpf API"
 Revert "bcc: Replace deprecated libbpf APIs" since the libbpf version
 provided in RHEL 8 doesn't provide the new APIs.
 Remove BPF_MAP_TYPE_BLOOM_FILTER from bps since the libbpf version in
 RHEL 8, doesn't provide bloom filter map.
 Rename btf__load_vmlinux_btf into libbpf_find_kernel_btf. The function
 has been renamed upstream for naming consistency, but RHEL 8 libbpf
 still uses the old name.
 Also use the older btf__get_nr_types() instead of btf__type_cnt() for
 the same reason.
 Add definition of struct bpf_core_relo.
 ---
 introspection/bps.c   |   1 -
 libbpf-tools/ksnoop.c |   4 +-
 src/cc/bcc_btf.cc     |  73 +++++++++++++++-
 src/cc/bpf_module.cc  |  38 ++++----
 src/cc/common.cc      |   4 +-
 src/cc/libbpf.c       | 196 +++++++++++++++---------------------------
 src/cc/libbpf.h       |  28 ++----
 7 files changed, 169 insertions(+), 175 deletions(-)
 diff --git a/introspection/bps.c b/introspection/bps.c
 index 232b23d4..6ec02e6c 100644
 --- a/introspection/bps.c
 +++ b/introspection/bps.c
@@ -80,7 +80,6 @@ static const char * const map_type_strings[] = {
   [BPF_MAP_TYPE_RINGBUF] = "ringbuf",
   [BPF_MAP_TYPE_INODE_STORAGE] = "inode_storage",
   [BPF_MAP_TYPE_TASK_STORAGE] = "task_storage",
 -  [BPF_MAP_TYPE_BLOOM_FILTER] = "bloom_filter",
 };
 #define ARRAY_SIZE(x) (sizeof(x) / sizeof(*(x)))
 diff --git a/libbpf-tools/ksnoop.c b/libbpf-tools/ksnoop.c
 index 87fe175c..960e901b 100644
 --- a/libbpf-tools/ksnoop.c
 +++ b/libbpf-tools/ksnoop.c
@@ -347,7 +347,7 @@ static struct btf *get_btf(const char *name)
 		name && strlen(name) > 0 ? name : "vmlinux");
 	if (!vmlinux_btf) {
 -		vmlinux_btf = btf__load_vmlinux_btf();
 +		vmlinux_btf = libbpf_find_kernel_btf();
 		if (!vmlinux_btf) {
 			err = -errno;
 			p_err("No BTF, cannot determine type info: %s", strerror(-err));
@@ -357,7 +357,7 @@ static struct btf *get_btf(const char *name)
 	if (!name || strlen(name) == 0)
 		return vmlinux_btf;
 -	mod_btf = btf__load_module_btf(name, vmlinux_btf);
 +	mod_btf = libbpf_find_kernel_btf(name, vmlinux_btf);
 	if (!mod_btf) {
 		err = -errno;
 		p_err("No BTF for module '%s': %s", name, strerror(-err));
 diff --git a/src/cc/bcc_btf.cc b/src/cc/bcc_btf.cc
 index be248612..74fc902c 100644
 --- a/src/cc/bcc_btf.cc
 +++ b/src/cc/bcc_btf.cc
@@ -170,6 +170,77 @@ static int btf_ext_setup_line_info(struct btf_ext *btf_ext)
         return btf_ext_setup_info(btf_ext, &param);
 }
 +/* bpf_core_relo_kind encodes which aspect of captured field/type/enum value
 + * has to be adjusted by relocations.
 + */
 +enum bpf_core_relo_kind {
 +	BPF_FIELD_BYTE_OFFSET = 0,	/* field byte offset */
 +	BPF_FIELD_BYTE_SIZE = 1,	/* field size in bytes */
 +	BPF_FIELD_EXISTS = 2,		/* field existence in target kernel */
 +	BPF_FIELD_SIGNED = 3,		/* field signedness (0 - unsigned, 1 - signed) */
 +	BPF_FIELD_LSHIFT_U64 = 4,	/* bitfield-specific left bitshift */
 +	BPF_FIELD_RSHIFT_U64 = 5,	/* bitfield-specific right bitshift */
 +	BPF_TYPE_ID_LOCAL = 6,		/* type ID in local BPF object */
 +	BPF_TYPE_ID_TARGET = 7,		/* type ID in target kernel */
 +	BPF_TYPE_EXISTS = 8,		/* type existence in target kernel */
 +	BPF_TYPE_SIZE = 9,		/* type size in bytes */
 +	BPF_ENUMVAL_EXISTS = 10,	/* enum value existence in target kernel */
 +	BPF_ENUMVAL_VALUE = 11,		/* enum value integer value */
 +};
 +
 +/* The minimum bpf_core_relo checked by the loader
 + *
 + * CO-RE relocation captures the following data:
 + * - insn_off - instruction offset (in bytes) within a BPF program that needs
 + *   its insn->imm field to be relocated with actual field info;
 + * - type_id - BTF type ID of the "root" (containing) entity of a relocatable
 + *   type or field;
 + * - access_str_off - offset into corresponding .BTF string section. String
 + *   interpretation depends on specific relocation kind:
 + *     - for field-based relocations, string encodes an accessed field using
 + *     a sequence of field and array indices, separated by colon (:). It's
 + *     conceptually very close to LLVM's getelementptr ([0]) instruction's
 + *     arguments for identifying offset to a field.
 + *     - for type-based relocations, strings is expected to be just "0";
 + *     - for enum value-based relocations, string contains an index of enum
 + *     value within its enum type;
 + *
 + * Example to provide a better feel.
 + *
 + *   struct sample {
 + *       int a;
 + *       struct {
 + *           int b[10];
 + *       };
 + *   };
 + *
 + *   struct sample *s = ...;
 + *   int x = &s->a;     // encoded as "0:0" (a is field #0)
 + *   int y = &s->b[5];  // encoded as "0:1:0:5" (anon struct is field #1, 
 + *                      // b is field #0 inside anon struct, accessing elem #5)
 + *   int z = &s[10]->b; // encoded as "10:1" (ptr is used as an array)
 + *
 + * type_id for all relocs in this example  will capture BTF type id of
 + * `struct sample`.
 + *
 + * Such relocation is emitted when using __builtin_preserve_access_index()
 + * Clang built-in, passing expression that captures field address, e.g.:
 + *
 + * bpf_probe_read(&dst, sizeof(dst),
 + *		  __builtin_preserve_access_index(&src->a.b.c));
 + *
 + * In this case Clang will emit field relocation recording necessary data to
 + * be able to find offset of embedded `a.b.c` field within `src` struct.
 + *
 + *   [0] https://llvm.org/docs/LangRef.html#getelementptr-instruction
 + */
 +struct bpf_core_relo {
 +	__u32   insn_off;
 +	__u32   type_id;
 +	__u32   access_str_off;
 +	enum bpf_core_relo_kind kind;
 +};
 +
 static int btf_ext_setup_core_relos(struct btf_ext *btf_ext)
 {
         struct btf_ext_sec_setup_param param = {
@@ -597,7 +668,7 @@ int BTF::load(uint8_t *btf_sec, uintptr_t btf_sec_size,
     return -1;
   }
 -  if (btf__load_into_kernel(btf)) {
 +  if (btf__load(btf)) {
     btf__free(btf);
     warning("Loading .BTF section failed\n");
     return -1;
 diff --git a/src/cc/bpf_module.cc b/src/cc/bpf_module.cc
 index 86f6a228..490fffe8 100644
 --- a/src/cc/bpf_module.cc
 +++ b/src/cc/bpf_module.cc
@@ -407,7 +407,7 @@ int BPFModule::create_maps(std::map<std::string, std::pair<int, int>> &map_tids,
     }
     if (pinned_id <= 0) {
 -      struct bcc_create_map_attr attr = {};
 +      struct bpf_create_map_attr attr = {};
       attr.map_type = (enum bpf_map_type)map_type;
       attr.name = map_name;
       attr.key_size = key_size;
@@ -982,22 +982,26 @@ int BPFModule::bcc_func_load(int prog_type, const char *name,
                 const char *license, unsigned kern_version,
                 int log_level, char *log_buf, unsigned log_buf_size,
                 const char *dev_name, unsigned flags, int expected_attach_type) {
 -  struct bpf_prog_load_opts opts = {};
 +  struct bpf_load_program_attr attr = {};
   unsigned func_info_cnt, line_info_cnt, finfo_rec_size, linfo_rec_size;
   void *func_info = NULL, *line_info = NULL;
   int ret;
 +  attr.prog_type = (enum bpf_prog_type)prog_type;
   if (expected_attach_type != -1) {
 -    opts.expected_attach_type = (enum bpf_attach_type)expected_attach_type;
 +    attr.expected_attach_type = (enum bpf_attach_type)expected_attach_type;
   }
 -  if (prog_type != BPF_PROG_TYPE_TRACING &&
 -      prog_type != BPF_PROG_TYPE_EXT) {
 -    opts.kern_version = kern_version;
 +  attr.name = name;
 +  attr.insns = insns;
 +  attr.license = license;
 +  if (attr.prog_type != BPF_PROG_TYPE_TRACING &&
 +      attr.prog_type != BPF_PROG_TYPE_EXT) {
 +    attr.kern_version = kern_version;
   }
 -  opts.prog_flags = flags;
 -  opts.log_level = log_level;
 +  attr.prog_flags = flags;
 +  attr.log_level = log_level;
   if (dev_name)
 -    opts.prog_ifindex = if_nametoindex(dev_name);
 +    attr.prog_ifindex = if_nametoindex(dev_name);
   if (btf_) {
     int btf_fd = btf_->get_fd();
@@ -1008,17 +1012,17 @@ int BPFModule::bcc_func_load(int prog_type, const char *name,
                              &finfo_rec_size, &line_info,
                              &line_info_cnt, &linfo_rec_size);
     if (!ret) {
 -      opts.prog_btf_fd = btf_fd;
 -      opts.func_info = func_info;
 -      opts.func_info_cnt = func_info_cnt;
 -      opts.func_info_rec_size = finfo_rec_size;
 -      opts.line_info = line_info;
 -      opts.line_info_cnt = line_info_cnt;
 -      opts.line_info_rec_size = linfo_rec_size;
 +      attr.prog_btf_fd = btf_fd;
 +      attr.func_info = func_info;
 +      attr.func_info_cnt = func_info_cnt;
 +      attr.func_info_rec_size = finfo_rec_size;
 +      attr.line_info = line_info;
 +      attr.line_info_cnt = line_info_cnt;
 +      attr.line_info_rec_size = linfo_rec_size;
     }
   }
 -  ret = bcc_prog_load_xattr((enum bpf_prog_type)prog_type, name, license, insns, &opts, prog_len, log_buf, log_buf_size, allow_rlimit_);
 +  ret = bcc_prog_load_xattr(&attr, prog_len, log_buf, log_buf_size, allow_rlimit_);
   if (btf_) {
     free(func_info);
     free(line_info);
 diff --git a/src/cc/common.cc b/src/cc/common.cc
 index 3143adb0..11970275 100644
 --- a/src/cc/common.cc
 +++ b/src/cc/common.cc
@@ -34,11 +34,11 @@ using std::experimental::optional;
 static optional<int32_t> get_enum_val_from_btf(const char *name) {
   optional<int32_t> val;
 -  auto btf = btf__load_vmlinux_btf();
 +  auto btf = libbpf_find_kernel_btf();
   if (libbpf_get_error(btf))
     return {};
 -  for (size_t i = 1; i < btf__type_cnt(btf); i++) {
 +  for (size_t i = 1; i <= btf__get_nr_types(btf); i++) {
     auto t = btf__type_by_id(btf, i);
     if (btf_kind(t) != BTF_KIND_ENUM)
       continue;
 diff --git a/src/cc/libbpf.c b/src/cc/libbpf.c
 index 0c09f9b3..7042c792 100644
 --- a/src/cc/libbpf.c
 +++ b/src/cc/libbpf.c
@@ -319,33 +319,14 @@ static uint64_t ptr_to_u64(void *ptr)
   return (uint64_t) (unsigned long) ptr;
 }
 -static int libbpf_bpf_map_create(struct bcc_create_map_attr *create_attr)
 -{
 -  LIBBPF_OPTS(bpf_map_create_opts, p);
 -
 -  p.map_flags = create_attr->map_flags;
 -  p.numa_node = create_attr->numa_node;
 -  p.btf_fd = create_attr->btf_fd;
 -  p.btf_key_type_id = create_attr->btf_key_type_id;
 -  p.btf_value_type_id = create_attr->btf_value_type_id;
 -  p.map_ifindex = create_attr->map_ifindex;
 -  if (create_attr->map_type == BPF_MAP_TYPE_STRUCT_OPS)
 -    p.btf_vmlinux_value_type_id = create_attr->btf_vmlinux_value_type_id;
 -  else
 -    p.inner_map_fd = create_attr->inner_map_fd;
 -
 -  return bpf_map_create(create_attr->map_type, create_attr->name, create_attr->key_size,
 -                        create_attr->value_size, create_attr->max_entries, &p);
 -}
 -
 -int bcc_create_map_xattr(struct bcc_create_map_attr *attr, bool allow_rlimit)
 +int bcc_create_map_xattr(struct bpf_create_map_attr *attr, bool allow_rlimit)
 {
   unsigned name_len = attr->name ? strlen(attr->name) : 0;
   char map_name[BPF_OBJ_NAME_LEN] = {};
   memcpy(map_name, attr->name, min(name_len, BPF_OBJ_NAME_LEN - 1));
   attr->name = map_name;
 -  int ret = libbpf_bpf_map_create(attr);
 +  int ret = bpf_create_map_xattr(attr);
   if (ret < 0 && errno == EPERM) {
     if (!allow_rlimit)
@@ -357,7 +338,7 @@ int bcc_create_map_xattr(struct bcc_create_map_attr *attr, bool allow_rlimit)
       rl.rlim_max = RLIM_INFINITY;
       rl.rlim_cur = rl.rlim_max;
       if (setrlimit(RLIMIT_MEMLOCK, &rl) == 0)
 -        ret = libbpf_bpf_map_create(attr);
 +        ret = bpf_create_map_xattr(attr);
     }
   }
@@ -367,12 +348,12 @@ int bcc_create_map_xattr(struct bcc_create_map_attr *attr, bool allow_rlimit)
     attr->btf_fd = 0;
     attr->btf_key_type_id = 0;
     attr->btf_value_type_id = 0;
 -    ret = libbpf_bpf_map_create(attr);
 +    ret = bpf_create_map_xattr(attr);
   }
   if (ret < 0 && name_len && (errno == E2BIG || errno == EINVAL)) {
     map_name[0] = '\0';
 -    ret = libbpf_bpf_map_create(attr);
 +    ret = bpf_create_map_xattr(attr);
   }
   if (ret < 0 && errno == EPERM) {
@@ -385,7 +366,7 @@ int bcc_create_map_xattr(struct bcc_create_map_attr *attr, bool allow_rlimit)
       rl.rlim_max = RLIM_INFINITY;
       rl.rlim_cur = rl.rlim_max;
       if (setrlimit(RLIMIT_MEMLOCK, &rl) == 0)
 -        ret = libbpf_bpf_map_create(attr);
 +        ret = bpf_create_map_xattr(attr);
     }
   }
   return ret;
@@ -395,7 +376,7 @@ int bcc_create_map(enum bpf_map_type map_type, const char *name,
                    int key_size, int value_size,
                    int max_entries, int map_flags)
 {
 -  struct bcc_create_map_attr attr = {};
 +  struct bpf_create_map_attr attr = {};
   attr.map_type = map_type;
   attr.name = name;
@@ -644,70 +625,24 @@ int bpf_prog_get_tag(int fd, unsigned long long *ptag)
   return -2;
 }
 -static int libbpf_bpf_prog_load(enum bpf_prog_type prog_type,
 -                                const char *prog_name, const char *license,
 -                                const struct bpf_insn *insns, size_t insn_cnt,
 -                                struct bpf_prog_load_opts *opts,
 -                                char *log_buf, size_t log_buf_sz)
 -{
 -
 -  LIBBPF_OPTS(bpf_prog_load_opts, p);
 -
 -  if (!opts || !log_buf != !log_buf_sz) {
 -    errno = EINVAL;
 -    return -EINVAL;
 -  }
 -
 -  p.expected_attach_type = opts->expected_attach_type;
 -  switch (prog_type) {
 -  case BPF_PROG_TYPE_STRUCT_OPS:
 -  case BPF_PROG_TYPE_LSM:
 -    p.attach_btf_id = opts->attach_btf_id;
 -    break;
 -  case BPF_PROG_TYPE_TRACING:
 -  case BPF_PROG_TYPE_EXT:
 -    p.attach_btf_id = opts->attach_btf_id;
 -    p.attach_prog_fd = opts->attach_prog_fd;
 -    break;
 -  default:
 -    p.prog_ifindex = opts->prog_ifindex;
 -    p.kern_version = opts->kern_version;
 -  }
 -  p.log_level = opts->log_level;
 -  p.log_buf = log_buf;
 -  p.log_size = log_buf_sz;
 -  p.prog_btf_fd = opts->prog_btf_fd;
 -  p.func_info_rec_size = opts->func_info_rec_size;
 -  p.func_info_cnt = opts->func_info_cnt;
 -  p.func_info = opts->func_info;
 -  p.line_info_rec_size = opts->line_info_rec_size;
 -  p.line_info_cnt = opts->line_info_cnt;
 -  p.line_info = opts->line_info;
 -  p.prog_flags = opts->prog_flags;
 -
 -  return bpf_prog_load(prog_type, prog_name, license,
 -                       insns, insn_cnt, &p);
 -}
 -
 -int bcc_prog_load_xattr(enum bpf_prog_type prog_type, const char *prog_name,
 -                        const char *license, const struct bpf_insn *insns,
 -                        struct bpf_prog_load_opts *opts, int prog_len,
 +int bcc_prog_load_xattr(struct bpf_load_program_attr *attr, int prog_len,
                         char *log_buf, unsigned log_buf_size, bool allow_rlimit)
 {
 -  unsigned name_len = prog_name ? strlen(prog_name) : 0;
 -  char *tmp_log_buf = NULL, *opts_log_buf = NULL;
 -  unsigned tmp_log_buf_size = 0, opts_log_buf_size = 0;
 +  unsigned name_len = attr->name ? strlen(attr->name) : 0;
 +  char *tmp_log_buf = NULL, *attr_log_buf = NULL;
 +  unsigned tmp_log_buf_size = 0, attr_log_buf_size = 0;
   int ret = 0, name_offset = 0, expected_attach_type = 0;
 -  char new_prog_name[BPF_OBJ_NAME_LEN] = {};
 +  char prog_name[BPF_OBJ_NAME_LEN] = {};
   unsigned insns_cnt = prog_len / sizeof(struct bpf_insn);
 +  attr->insns_cnt = insns_cnt;
 -  if (opts->log_level > 0) {
 +  if (attr->log_level > 0) {
     if (log_buf_size > 0) {
       // Use user-provided log buffer if available.
       log_buf[0] = 0;
 -      opts_log_buf = log_buf;
 -      opts_log_buf_size = log_buf_size;
 +      attr_log_buf = log_buf;
 +      attr_log_buf_size = log_buf_size;
     } else {
       // Create and use temporary log buffer if user didn't provide one.
       tmp_log_buf_size = LOG_BUF_SIZE;
@@ -715,82 +650,82 @@ int bcc_prog_load_xattr(enum bpf_prog_type prog_type, const char *prog_name,
       if (!tmp_log_buf) {
         fprintf(stderr, "bpf: Failed to allocate temporary log buffer: %s\n\n",
                 strerror(errno));
 -        opts->log_level = 0;
 +        attr->log_level = 0;
       } else {
         tmp_log_buf[0] = 0;
 -        opts_log_buf = tmp_log_buf;
 -        opts_log_buf_size = tmp_log_buf_size;
 +        attr_log_buf = tmp_log_buf;
 +        attr_log_buf_size = tmp_log_buf_size;
       }
     }
   }
 -
   if (name_len) {
 -    if (strncmp(prog_name, "kprobe__", 8) == 0)
 +    if (strncmp(attr->name, "kprobe__", 8) == 0)
       name_offset = 8;
 -    else if (strncmp(prog_name, "kretprobe__", 11) == 0)
 +    else if (strncmp(attr->name, "kretprobe__", 11) == 0)
       name_offset = 11;
 -    else if (strncmp(prog_name, "tracepoint__", 12) == 0)
 +    else if (strncmp(attr->name, "tracepoint__", 12) == 0)
       name_offset = 12;
 -    else if (strncmp(prog_name, "raw_tracepoint__", 16) == 0)
 +    else if (strncmp(attr->name, "raw_tracepoint__", 16) == 0)
       name_offset = 16;
 -    else if (strncmp(prog_name, "kfunc__", 7) == 0) {
 +    else if (strncmp(attr->name, "kfunc__", 7) == 0) {
       name_offset = 7;
       expected_attach_type = BPF_TRACE_FENTRY;
 -    } else if (strncmp(prog_name, "kmod_ret__", 10) == 0) {
 +    } else if (strncmp(attr->name, "kmod_ret__", 10) == 0) {
       name_offset = 10;
       expected_attach_type = BPF_MODIFY_RETURN;
 -    } else if (strncmp(prog_name, "kretfunc__", 10) == 0) {
 +    } else if (strncmp(attr->name, "kretfunc__", 10) == 0) {
       name_offset = 10;
       expected_attach_type = BPF_TRACE_FEXIT;
 -    } else if (strncmp(prog_name, "lsm__", 5) == 0) {
 +    } else if (strncmp(attr->name, "lsm__", 5) == 0) {
       name_offset = 5;
       expected_attach_type = BPF_LSM_MAC;
 -    } else if (strncmp(prog_name, "bpf_iter__", 10) == 0) {
 +    } else if (strncmp(attr->name, "bpf_iter__", 10) == 0) {
       name_offset = 10;
       expected_attach_type = BPF_TRACE_ITER;
     }
 -    if (prog_type == BPF_PROG_TYPE_TRACING ||
 -        prog_type == BPF_PROG_TYPE_LSM) {
 -      ret = libbpf_find_vmlinux_btf_id(prog_name + name_offset,
 +    if (attr->prog_type == BPF_PROG_TYPE_TRACING ||
 +        attr->prog_type == BPF_PROG_TYPE_LSM) {
 +      ret = libbpf_find_vmlinux_btf_id(attr->name + name_offset,
                                        expected_attach_type);
       if (ret == -EINVAL) {
         fprintf(stderr, "bpf: vmlinux BTF is not found\n");
         return ret;
       } else if (ret < 0) {
         fprintf(stderr, "bpf: %s is not found in vmlinux BTF\n",
 -                prog_name + name_offset);
 +                attr->name + name_offset);
         return ret;
       }
 -      opts->attach_btf_id = ret;
 -      opts->expected_attach_type = expected_attach_type;
 +      attr->attach_btf_id = ret;
 +      attr->expected_attach_type = expected_attach_type;
     }
 -    memcpy(new_prog_name, prog_name + name_offset,
 +    memcpy(prog_name, attr->name + name_offset,
            min(name_len - name_offset, BPF_OBJ_NAME_LEN - 1));
 +    attr->name = prog_name;
   }
 -  ret = libbpf_bpf_prog_load(prog_type, new_prog_name, license, insns, insns_cnt, opts, opts_log_buf, opts_log_buf_size);
 +  ret = bpf_load_program_xattr(attr, attr_log_buf, attr_log_buf_size);
   // func_info/line_info may not be supported in old kernels.
 -  if (ret < 0 && opts->func_info && errno == EINVAL) {
 -    opts->prog_btf_fd = 0;
 -    opts->func_info = NULL;
 -    opts->func_info_cnt = 0;
 -    opts->func_info_rec_size = 0;
 -    opts->line_info = NULL;
 -    opts->line_info_cnt = 0;
 -    opts->line_info_rec_size = 0;
 -    ret = libbpf_bpf_prog_load(prog_type, new_prog_name, license, insns, insns_cnt, opts, opts_log_buf, opts_log_buf_size);
 +  if (ret < 0 && attr->func_info && errno == EINVAL) {
 +    attr->prog_btf_fd = 0;
 +    attr->func_info = NULL;
 +    attr->func_info_cnt = 0;
 +    attr->func_info_rec_size = 0;
 +    attr->line_info = NULL;
 +    attr->line_info_cnt = 0;
 +    attr->line_info_rec_size = 0;
 +    ret = bpf_load_program_xattr(attr, attr_log_buf, attr_log_buf_size);
   }
   // BPF object name is not supported on older Kernels.
   // If we failed due to this, clear the name and try again.
   if (ret < 0 && name_len && (errno == E2BIG || errno == EINVAL)) {
 -    new_prog_name[0] = '\0';
 -    ret = libbpf_bpf_prog_load(prog_type, new_prog_name, license, insns, insns_cnt, opts, opts_log_buf, opts_log_buf_size);
 +    prog_name[0] = '\0';
 +    ret = bpf_load_program_xattr(attr, attr_log_buf, attr_log_buf_size);
   }
   if (ret < 0 && errno == EPERM) {
@@ -809,14 +744,14 @@ int bcc_prog_load_xattr(enum bpf_prog_type prog_type, const char *prog_name,
       rl.rlim_max = RLIM_INFINITY;
       rl.rlim_cur = rl.rlim_max;
       if (setrlimit(RLIMIT_MEMLOCK, &rl) == 0)
 -        ret = libbpf_bpf_prog_load(prog_type, new_prog_name, license, insns, insns_cnt, opts, opts_log_buf, opts_log_buf_size);
 +        ret = bpf_load_program_xattr(attr, attr_log_buf, attr_log_buf_size);
     }
   }
   if (ret < 0 && errno == E2BIG) {
     fprintf(stderr,
             "bpf: %s. Program %s too large (%u insns), at most %d insns\n\n",
 -            strerror(errno), new_prog_name, insns_cnt, BPF_MAXINSNS);
 +            strerror(errno), attr->name, insns_cnt, BPF_MAXINSNS);
     return -1;
   }
@@ -825,9 +760,9 @@ int bcc_prog_load_xattr(enum bpf_prog_type prog_type, const char *prog_name,
     // User has provided a log buffer.
     if (log_buf_size) {
       // If logging is not already enabled, enable it and do the syscall again.
 -      if (opts->log_level == 0) {
 -        opts->log_level = 1;
 -        ret = libbpf_bpf_prog_load(prog_type, new_prog_name, license, insns, insns_cnt, opts, log_buf, log_buf_size);
 +      if (attr->log_level == 0) {
 +        attr->log_level = 1;
 +        ret = bpf_load_program_xattr(attr, log_buf, log_buf_size);
       }
       // Print the log message and return.
       bpf_print_hints(ret, log_buf);
@@ -841,8 +776,8 @@ int bcc_prog_load_xattr(enum bpf_prog_type prog_type, const char *prog_name,
     if (tmp_log_buf)
       free(tmp_log_buf);
     tmp_log_buf_size = LOG_BUF_SIZE;
 -    if (opts->log_level == 0)
 -      opts->log_level = 1;
 +    if (attr->log_level == 0)
 +      attr->log_level = 1;
     for (;;) {
       tmp_log_buf = malloc(tmp_log_buf_size);
       if (!tmp_log_buf) {
@@ -851,7 +786,7 @@ int bcc_prog_load_xattr(enum bpf_prog_type prog_type, const char *prog_name,
         goto return_result;
       }
       tmp_log_buf[0] = 0;
 -      ret = libbpf_bpf_prog_load(prog_type, new_prog_name, license, insns, insns_cnt, opts, tmp_log_buf, tmp_log_buf_size);
 +      ret = bpf_load_program_xattr(attr, tmp_log_buf, tmp_log_buf_size);
       if (ret < 0 && errno == ENOSPC) {
         // Temporary buffer size is not enough. Double it and try again.
         free(tmp_log_buf);
@@ -865,7 +800,7 @@ int bcc_prog_load_xattr(enum bpf_prog_type prog_type, const char *prog_name,
   // Check if we should print the log message if log_level is not 0,
   // either specified by user or set due to error.
 -  if (opts->log_level > 0) {
 +  if (attr->log_level > 0) {
     // Don't print if user enabled logging and provided log buffer,
     // but there is no error.
     if (log_buf && ret < 0)
@@ -885,13 +820,16 @@ int bcc_prog_load(enum bpf_prog_type prog_type, const char *name,
                   const char *license, unsigned kern_version,
                   int log_level, char *log_buf, unsigned log_buf_size)
 {
 -  struct bpf_prog_load_opts opts = {};
 -
 +  struct bpf_load_program_attr attr = {};
 +  attr.prog_type = prog_type;
 +  attr.name = name;
 +  attr.insns = insns;
 +  attr.license = license;
   if (prog_type != BPF_PROG_TYPE_TRACING && prog_type != BPF_PROG_TYPE_EXT)
 -    opts.kern_version = kern_version;
 -  opts.log_level = log_level;
 -  return bcc_prog_load_xattr(prog_type, name, license, insns, &opts, prog_len, log_buf, log_buf_size, true);
 +    attr.kern_version = kern_version;
 +  attr.log_level = log_level;
 +  return bcc_prog_load_xattr(&attr, prog_len, log_buf, log_buf_size, true);
 }
 int bpf_open_raw_sock(const char *name)
@@ -1388,7 +1326,7 @@ int kernel_struct_has_field(const char *struct_name, const char *field_name)
   struct btf *btf;
   int i, ret, btf_id;
 -  btf = btf__load_vmlinux_btf();
 +  btf = libbpf_find_kernel_btf();
   ret = libbpf_get_error(btf);
   if (ret)
     return -1;
@@ -1565,7 +1503,7 @@ int bpf_attach_xdp(const char *dev_name, int progfd, uint32_t flags) {
     return -1;
   }
 -  ret = bpf_xdp_attach(ifindex, progfd, flags, NULL);
 +  ret = bpf_set_link_xdp_fd(ifindex, progfd, flags);
   if (ret) {
     libbpf_strerror(ret, err_buf, sizeof(err_buf));
     fprintf(stderr, "bpf: Attaching prog to %s: %s\n", dev_name, err_buf);
 diff --git a/src/cc/libbpf.h b/src/cc/libbpf.h
 index dd86f0a9..e001d740 100644
 --- a/src/cc/libbpf.h
 +++ b/src/cc/libbpf.h
@@ -27,25 +27,8 @@
 extern "C" {
 #endif
 -struct bcc_create_map_attr {
 -	const char *name;
 -	enum bpf_map_type map_type;
 -	__u32 map_flags;
 -	__u32 key_size;
 -	__u32 value_size;
 -	__u32 max_entries;
 -	__u32 numa_node;
 -	__u32 btf_fd;
 -	__u32 btf_key_type_id;
 -	__u32 btf_value_type_id;
 -	__u32 map_ifindex;
 -	union {
 -		__u32 inner_map_fd;
 -		__u32 btf_vmlinux_value_type_id;
 -	};
 -};
 -
 -struct bpf_prog_load_opts;
 +struct bpf_create_map_attr;
 +struct bpf_load_program_attr;
 enum bpf_probe_attach_type {
 	BPF_PROBE_ENTRY,
@@ -61,7 +44,7 @@ struct bcc_perf_buffer_opts {
 int bcc_create_map(enum bpf_map_type map_type, const char *name,
                    int key_size, int value_size, int max_entries,
                    int map_flags);
 -int bcc_create_map_xattr(struct bcc_create_map_attr *attr, bool allow_rlimit);
 +int bcc_create_map_xattr(struct bpf_create_map_attr *attr, bool allow_rlimit);
 int bpf_update_elem(int fd, void *key, void *value, unsigned long long flags);
 int bpf_lookup_elem(int fd, void *key, void *value);
 int bpf_delete_elem(int fd, void *key);
@@ -89,11 +72,10 @@ int bcc_prog_load(enum bpf_prog_type prog_type, const char *name,
                   const struct bpf_insn *insns, int prog_len,
                   const char *license, unsigned kern_version,
                   int log_level, char *log_buf, unsigned log_buf_size);
 -int bcc_prog_load_xattr(enum bpf_prog_type prog_type, const char *prog_name,
 -						const char *license, const struct bpf_insn *insns,
 -						struct bpf_prog_load_opts *opts,
 +int bcc_prog_load_xattr(struct bpf_load_program_attr *attr,
                         int prog_len, char *log_buf,
                         unsigned log_buf_size, bool allow_rlimit);
 +
 int bpf_attach_socket(int sockfd, int progfd);
 /* create RAW socket. If name is not NULL/a non-empty null-terminated string,
 -- 
 2.38.1
--- a/SOURCES/bcc-0.25.0-Revert-tools-Fix-bindsnoop-for-kernel-v5.6.patch
+++ b/SOURCES/bcc-0.25.0-Revert-tools-Fix-bindsnoop-for-kernel-v5.6.patch
@ -0,0 +1,43 @@
 From 73b15c15bdf3327c86de524ded528c6c6061ff3d Mon Sep 17 00:00:00 2001
 From: Jerome Marchand <jmarchan@redhat.com>
 Date: Wed, 3 May 2023 16:16:52 +0200
 Subject: [PATCH] Revert "tools: Fix bindsnoop for kernel v5.6"
 This reverts commit f96fed0a3b9682ce52a35a02f72880395582d855.
 ---
 tools/bindsnoop.py | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)
 diff --git a/tools/bindsnoop.py b/tools/bindsnoop.py
 index 07503352..ac3a8aa0 100755
 --- a/tools/bindsnoop.py
 +++ b/tools/bindsnoop.py
@@ -27,7 +27,7 @@
 # 14-Feb-2020   Pavel Dubovitsky   Created this.
 from __future__ import print_function, absolute_import, unicode_literals
 -from bcc import BPF
 +from bcc import BPF, DEBUG_SOURCE
 from bcc.containers import filter_by_containers
 from bcc.utils import printb
 import argparse
@@ -243,14 +243,10 @@ static int bindsnoop_return(struct pt_regs *ctx, short ipver)
     opts.fields.reuseport = bitfield >> 4 & 0x01;
     // workaround for reading the sk_protocol bitfield (from tcpaccept.py):
 -    u16 protocol;
 +    u8 protocol;
     int gso_max_segs_offset = offsetof(struct sock, sk_gso_max_segs);
     int sk_lingertime_offset = offsetof(struct sock, sk_lingertime);
 -
 -    // Since kernel v5.6 sk_protocol has its own u16 field
 -    if (sk_lingertime_offset - gso_max_segs_offset == 2)
 -        protocol = skp->sk_protocol;
 -    else if (sk_lingertime_offset - gso_max_segs_offset == 4)
 +    if (sk_lingertime_offset - gso_max_segs_offset == 4)
         // 4.10+ with little endian
 #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
         protocol = *(u8 *)((u64)&skp->sk_gso_max_segs - 3);
 -- 
 2.40.1
--- a/SOURCES/bcc-0.25.0-Revert-tools-tcpaccept-Fix-support-for-v5.6-kernels.patch
+++ b/SOURCES/bcc-0.25.0-Revert-tools-tcpaccept-Fix-support-for-v5.6-kernels.patch
@ -0,0 +1,42 @@
 From acee5d39d24b102e8ed09a242cb1c53246a1fb7f Mon Sep 17 00:00:00 2001
 From: Jerome Marchand <jmarchan@redhat.com>
 Date: Tue, 29 Nov 2022 15:33:49 +0100
 Subject: [PATCH] Revert "tools/tcpaccept: Fix support for v5.6+ kernels"
 This reverts commit 28955512d991ee3849c2a9accfc54bef9cd35f21.
 It breaks tcpaccept on RHEL 8 kernel.
 ---
 tools/tcpaccept.py | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)
 diff --git a/tools/tcpaccept.py b/tools/tcpaccept.py
 index b2ace4fa..d3e44143 100755
 --- a/tools/tcpaccept.py
 +++ b/tools/tcpaccept.py
@@ -116,7 +116,7 @@ int kretprobe__inet_csk_accept(struct pt_regs *ctx)
         return 0;
     // check this is TCP
 -    u16 protocol = 0;
 +    u8 protocol = 0;
     // workaround for reading the sk_protocol bitfield:
     // Following comments add by Joe Yin:
@@ -132,12 +132,7 @@ int kretprobe__inet_csk_accept(struct pt_regs *ctx)
     int gso_max_segs_offset = offsetof(struct sock, sk_gso_max_segs);
     int sk_lingertime_offset = offsetof(struct sock, sk_lingertime);
 -
 -    // Since kernel v5.6 sk_protocol is its own u16 field and gso_max_segs
 -    // precedes sk_lingertime.
 -    if (sk_lingertime_offset - gso_max_segs_offset == 2)
 -        protocol = newsk->sk_protocol;
 -    else if (sk_lingertime_offset - gso_max_segs_offset == 4)
 +    if (sk_lingertime_offset - gso_max_segs_offset == 4)
         // 4.10+ with little endian
 #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
         protocol = *(u8 *)((u64)&newsk->sk_gso_max_segs - 3);
 -- 
 2.38.1
--- a/SOURCES/bcc-0.25.0-clang-Fix-file_exists_and_ownedby-return-value-4935.patch
+++ b/SOURCES/bcc-0.25.0-clang-Fix-file_exists_and_ownedby-return-value-4935.patch
@ -0,0 +1,33 @@
 From 509b05f2790fd1f9e725e353521a5a555ca57aaf Mon Sep 17 00:00:00 2001
 From: Chunsheng Luo <48231204+luochenglcs@users.noreply.github.com>
 Date: Mon, 18 Mar 2024 00:09:21 +0800
 Subject: [PATCH] clang: Fix file_exists_and_ownedby return value (#4935)
 commit 008ea09 (clang: check header ownership) updates file_exists()
 to file_exists_and_ownedby(), add verifies onwer, but the return value
 is different from before, causing problems with the original code.
 Signed-off-by: Chunsheng Luo <luochunsheng@ustc.edu>
 Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
 ---
 src/cc/frontends/clang/kbuild_helper.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/src/cc/frontends/clang/kbuild_helper.cc b/src/cc/frontends/clang/kbuild_helper.cc
 index 1b291469..0387f872 100644
 --- a/src/cc/frontends/clang/kbuild_helper.cc
 +++ b/src/cc/frontends/clang/kbuild_helper.cc
@@ -143,8 +143,8 @@ int KBuildHelper::get_flags(const char *uname_machine, vector<string> *cflags) {
 static inline int file_exists_and_ownedby(const char *f, uid_t uid)
 {
   struct stat buffer;
 -  int ret;
 -  if ((ret = stat(f, &buffer)) == 0) {
 +  int ret = stat(f, &buffer) == 0;
 +  if (ret) {
     if (buffer.st_uid != uid) {
       std::cout << "ERROR: header file ownership unexpected: " << std::string(f) << "\n";
       return -1;
 -- 
 2.44.0
--- a/SOURCES/bcc-0.25.0-clang-check-header-ownership-4928.patch
+++ b/SOURCES/bcc-0.25.0-clang-check-header-ownership-4928.patch
@ -0,0 +1,68 @@
 From d6a5130c5f18499da26eef88f52da75c9e33d63d Mon Sep 17 00:00:00 2001
 From: Brendan Gregg <brendan@intel.com>
 Date: Thu, 7 Mar 2024 05:27:14 +1100
 Subject: [PATCH] clang: check header ownership (#4928)
 Example testing with a brendan-owned /tmp/kheaders file (note the "ERROR:" message):
 ~/bcc/build$ sudo /usr/share/bcc/tools/biosnoop
 ERROR: header file ownership unexpected: /tmp/kheaders-5.15.47-internal
 <built-in>:1:10: fatal error: './include/linux/kconfig.h' file not found
 #include "./include/linux/kconfig.h"
         ^~~~~~~~~~~~~~~~~~~~~~~~~~~
 1 error generated.
 Traceback (most recent call last):
  File "/usr/share/bcc/tools/biosnoop", line 335, in <module>
    b = BPF(text=bpf_text)
  File "/usr/lib/python3/dist-packages/bcc-0.1.5+6cd27218-py3.10.egg/bcc/__init__.py", line 479, in __init__
 Exception: Failed to compile BPF module <text>
 ~/bcc/build$ ls -lhd /tmp/kheaders-5.15.47-internal
 drwxrwxr-x 2 brendan dev 4.0K Mar  6 02:50 /tmp/kheaders-5.15.47-internal
 No error when chown'd back to root.
 ---
 src/cc/frontends/clang/kbuild_helper.cc | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)
 diff --git a/src/cc/frontends/clang/kbuild_helper.cc b/src/cc/frontends/clang/kbuild_helper.cc
 index 933aec8e..1b291469 100644
 --- a/src/cc/frontends/clang/kbuild_helper.cc
 +++ b/src/cc/frontends/clang/kbuild_helper.cc
@@ -140,15 +140,22 @@ int KBuildHelper::get_flags(const char *uname_machine, vector<string> *cflags) {
   return 0;
 }
 -static inline int file_exists(const char *f)
 +static inline int file_exists_and_ownedby(const char *f, uid_t uid)
 {
   struct stat buffer;
 -  return (stat(f, &buffer) == 0);
 +  int ret;
 +  if ((ret = stat(f, &buffer)) == 0) {
 +    if (buffer.st_uid != uid) {
 +      std::cout << "ERROR: header file ownership unexpected: " << std::string(f) << "\n";
 +      return -1;
 +    }
 +  }
 +  return ret;
 }
 static inline int proc_kheaders_exists(void)
 {
 -  return file_exists(PROC_KHEADERS_PATH);
 +  return file_exists_and_ownedby(PROC_KHEADERS_PATH, 0);
 }
 static inline int extract_kheaders(const std::string &dirpath,
@@ -214,7 +221,7 @@ int get_proc_kheaders(std::string &dirpath)
   snprintf(dirpath_tmp, 256, "/tmp/kheaders-%s", uname_data.release);
   dirpath = std::string(dirpath_tmp);
 -  if (file_exists(dirpath_tmp))
 +  if (file_exists_and_ownedby(dirpath_tmp, 0))
     return 0;
   // First time so extract it
 -- 
 2.43.2
--- a/SOURCES/bcc-0.25.0-clang-fail-when-the-kheaders-ownership-is-wrong-4928.patch
+++ b/SOURCES/bcc-0.25.0-clang-fail-when-the-kheaders-ownership-is-wrong-4928.patch
@ -1,4 +1,4 @@
-From 5bc97bbc50b1ccf0c63f320ee73a2c0abe84b596 Mon Sep 17 00:00:00 2001
+From 1d504ac46d2a0210813147b6a57d657b6c2a5d2e Mon Sep 17 00:00:00 2001
 From: Jerome Marchand <jmarchan@redhat.com>
 Date: Fri, 17 May 2024 15:36:07 +0200
 Subject: [PATCH] clang: fail when the kheaders ownership is wrong (#4928)
@ -21,7 +21,7 @@ Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
 1 file changed, 17 insertions(+), 5 deletions(-)
 diff --git a/src/cc/frontends/clang/kbuild_helper.cc b/src/cc/frontends/clang/kbuild_helper.cc
-index 9409e4cc..5d3ad9c2 100644
+index 0387f872..9dd3c3c8 100644
 --- a/src/cc/frontends/clang/kbuild_helper.cc
 +++ b/src/cc/frontends/clang/kbuild_helper.cc
@@ -140,20 +140,26 @@ int KBuildHelper::get_flags(const char *uname_machine, vector<string> *cflags) {
@ -54,8 +54,8 @@ index 9409e4cc..5d3ad9c2 100644
 {
   return file_exists_and_ownedby(PROC_KHEADERS_PATH, 0);
 }
-@@ -231,8 +237,14 @@ int get_proc_kheaders(std::string &dirpath)
+@@ -221,8 +227,14 @@ int get_proc_kheaders(std::string &dirpath)
-            uname_data.release);
+   snprintf(dirpath_tmp, 256, "/tmp/kheaders-%s", uname_data.release);
   dirpath = std::string(dirpath_tmp);
 -  if (file_exists_and_ownedby(dirpath_tmp, 0))
--- a/SOURCES/bcc-0.25.0-libbpf-Allow-kernel_struct_has_field-to-reach-field-.patch
+++ b/SOURCES/bcc-0.25.0-libbpf-Allow-kernel_struct_has_field-to-reach-field-.patch
@ -0,0 +1,75 @@
 From 16277e3910c9281d807fc6d3b4ce41c62d7d265e Mon Sep 17 00:00:00 2001
 From: Jerome Marchand <jmarchan@redhat.com>
 Date: Thu, 19 May 2022 16:37:40 +0200
 Subject: [PATCH 3/3] libbpf: Allow kernel_struct_has_field to reach field in
 unnamed struct or union
 Some fields can belong to unnamed struct or union (e.g. rcu and
 rcu_users fields of task_struct). In C, they are accessed as if their
 belong directly to the parent of the unnamed struct or union but this
 is not the case for BTF.
 When looking for a field, kernel_struct_has_field should also look
 reccursively into unnamed structs or unions. That allows code such as
 the following to work as expected:
 BPF.kernel_struct_has_field('task_struct', 'rcu')
 Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
 ---
 src/cc/libbpf.c | 28 ++++++++++++++++++----------
 1 file changed, 18 insertions(+), 10 deletions(-)
 diff --git a/src/cc/libbpf.c b/src/cc/libbpf.c
 index 5f7a3f68..bdfde1f5 100644
 --- a/src/cc/libbpf.c
 +++ b/src/cc/libbpf.c
@@ -1319,12 +1319,27 @@ bool bpf_has_kernel_btf(void)
   return true;
 }
 +static int find_member_by_name(struct btf *btf, const struct btf_type *btf_type, const char *field_name) {
 +  const struct btf_member *btf_member = btf_members(btf_type);
 +  int i;
 +
 +  for (i = 0; i < btf_vlen(btf_type); i++, btf_member++) {
 +    const char *name = btf__name_by_offset(btf, btf_member->name_off);
 +    if (!strcmp(name, field_name)) {
 +      return 1;
 +    } else if (name[0] == '\0') {
 +      if (find_member_by_name(btf, btf__type_by_id(btf, btf_member->type), field_name))
 +        return 1;
 +    }
 +  }
 +  return 0;
 +}
 +
 int kernel_struct_has_field(const char *struct_name, const char *field_name)
 {
   const struct btf_type *btf_type;
 -  const struct btf_member *btf_member;
   struct btf *btf;
 -  int i, ret, btf_id;
 +  int ret, btf_id;
   btf = libbpf_find_kernel_btf();
   ret = libbpf_get_error(btf);
@@ -1338,14 +1353,7 @@ int kernel_struct_has_field(const char *struct_name, const char *field_name)
   }
   btf_type = btf__type_by_id(btf, btf_id);
 -  btf_member = btf_members(btf_type);
 -  for (i = 0; i < btf_vlen(btf_type); i++, btf_member++) {
 -    if (!strcmp(btf__name_by_offset(btf, btf_member->name_off), field_name)) {
 -      ret = 1;
 -      goto cleanup;
 -    }
 -  }
 -  ret = 0;
 +  ret = find_member_by_name(btf, btf_type, field_name);
 cleanup:
   btf__free(btf);
 -- 
 2.38.1
--- a/SOURCES/bcc-0.25.0-tools-compactsnoop.py-Fix-raw_tracepoint-Invalid-arg.patch
+++ b/SOURCES/bcc-0.25.0-tools-compactsnoop.py-Fix-raw_tracepoint-Invalid-arg.patch
@ -0,0 +1,71 @@
 From 2fd4457e52d56825e12a4037630aea3f82241a02 Mon Sep 17 00:00:00 2001
 From: Rong Tao <rongtao@cestc.cn>
 Date: Fri, 10 Feb 2023 23:28:55 +0800
 Subject: [PATCH 2/2] tools/compactsnoop.py: Fix raw_tracepoint Invalid
 argument error
 kernel commit abd4349ff9b8("mm: compaction: cleanup the compaction trace
 events") change the arguments of 'mm_compaction_begin' from (start_pfn,
 migrate_pfn, free_pfn, end_pfn, sync) to (cc, start_pfn, end_pfn, sync),
 and change the arguments of 'mm_compaction_end' from (start_pfn,
 migrate_pfn, free_pfn, end_pfn, sync, ret) to (cc, start_pfn, end_pfn,
 sync, ret).
 Replacing RAW_TRACEPOINT_PROBE with TRACEPOINT_PROBE solves this problem
 and guarantees compatibility.
    $ sudo ./compactsnoop.py
    bpf_attach_raw_tracepoint (mm_compaction_begin): Invalid argument
    Traceback (most recent call last):
    File "/home/sdb/Git/bcc/tools/./compactsnoop.py", line 292, in <module>
    b = BPF(text=bpf_text)
        ^^^^^^^^^^^^^^^^^^
    File "/usr/lib/python3.11/site-packages/bcc/__init__.py", line 483, in __init__
    self._trace_autoload()
    File "/usr/lib/python3.11/site-packages/bcc/__init__.py", line 1462, in _trace_autoload
    self.attach_raw_tracepoint(tp=tp, fn_name=fn.name)
    File "/usr/lib/python3.11/site-packages/bcc/__init__.py", line 1055, in attach_raw_tracepoint
    raise Exception("Failed to attach BPF to raw tracepoint")
    Exception: Failed to attach BPF to raw tracepoint
 Signed-off-by: Rong Tao <rongtao@cestc.cn>
 ---
 tools/compactsnoop.py | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)
 diff --git a/tools/compactsnoop.py b/tools/compactsnoop.py
 index bf3c9b4b..e9baa9b4 100755
 --- a/tools/compactsnoop.py
 +++ b/tools/compactsnoop.py
@@ -237,11 +237,9 @@ RAW_TRACEPOINT_PROBE(mm_compaction_suitable)
     return 0;
 }
 -RAW_TRACEPOINT_PROBE(mm_compaction_begin)
 +TRACEPOINT_PROBE(compaction, mm_compaction_begin)
 {
 -    // TP_PROTO(unsigned long zone_start, unsigned long migrate_pfn,
 -    //          unsigned long free_pfn, unsigned long zone_end, bool sync)
 -    bool sync = (bool)ctx->args[4];
 +    bool sync = args->sync;
     u64 id = bpf_get_current_pid_tgid();
     struct val_t *valp = start.lookup(&id);
@@ -255,12 +253,9 @@ RAW_TRACEPOINT_PROBE(mm_compaction_begin)
     return 0;
 }
 -RAW_TRACEPOINT_PROBE(mm_compaction_end)
 +TRACEPOINT_PROBE(compaction, mm_compaction_end)
 {
 -    // TP_PROTO(unsigned long zone_start, unsigned long migrate_pfn,
 -    //          unsigned long free_pfn, unsigned long zone_end, bool sync,
 -    //          int status)
 -    submit_event(ctx, ctx->args[5]);
 +    submit_event(args, args->status);
     return 0;
 }
 """
 -- 
 2.39.2
--- a/SOURCES/bcc-0.25.0-tools-nfsslower.py-Fix-uninitialized-struct-pad-erro.patch
+++ b/SOURCES/bcc-0.25.0-tools-nfsslower.py-Fix-uninitialized-struct-pad-erro.patch
@ -0,0 +1,49 @@
 From 1d8419056e128ae49107d27e5f55d1bfa8134e3a Mon Sep 17 00:00:00 2001
 From: Rong Tao <rongtao@cestc.cn>
 Date: Fri, 10 Feb 2023 22:16:56 +0800
 Subject: [PATCH] tools/nfsslower.py: Fix uninitialized struct pad error
 The verifier is unhappy, if data struct _pad_ is not initialized, see [0][1].
    $ sudo ./nfsslower.py
    ...
    ; bpf_perf_event_output(ctx, (void *)bpf_pseudo_fd(1, -2), CUR_CPU_IDENTIFIER, &data, sizeof(data));
    83: (79) r1 = *(u64 *)(r10 -144)      ; R1_w=ctx(off=0,imm=0) R10=fp0
    84: (18) r3 = 0xffffffff              ; R3_w=4294967295
    86: (b7) r5 = 96                      ; R5_w=96
    87: (85) call bpf_perf_event_output#25
    invalid indirect read from stack R4 off -136+92 size 96
    processed 84 insns (limit 1000000) max_states_per_insn 0 total_states 4 peak_states 4 mark_read 4
    ...
    raise Exception("Failed to load BPF program %s: %s" %
    Exception: Failed to load BPF program b'raw_tracepoint__nfs_commit_done': Permission denied
 [0] https://github.com/iovisor/bcc/issues/2623
 [1] https://github.com/iovisor/bcc/pull/4453
 Signed-off-by: Rong Tao <rongtao@cestc.cn>
 ---
 tools/nfsslower.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)
 diff --git a/tools/nfsslower.py b/tools/nfsslower.py
 index b5df8f19..c2c243b3 100755
 --- a/tools/nfsslower.py
 +++ b/tools/nfsslower.py
@@ -179,8 +179,11 @@ static int trace_exit(struct pt_regs *ctx, int type)
     // populate output struct
     u32 size = PT_REGS_RC(ctx);
 -    struct data_t data = {.type = type, .size = size, .delta_us = delta_us,
 -        .pid = pid};
 +    struct data_t data = {};
 +    data.type = type;
 +    data.size = size;
 +    data.delta_us = delta_us;
 +    data.pid = pid;
     data.ts_us = ts / 1000;
     data.offset = valp->offset;
     bpf_get_current_comm(&data.task, sizeof(data.task));
 -- 
 2.40.1
--- a/SOURCES/bcc-0.25.0-tools-tcpstates-fix-IPv6-journal.patch
+++ b/SOURCES/bcc-0.25.0-tools-tcpstates-fix-IPv6-journal.patch
@ -0,0 +1,156 @@
 From e1f462c14bc8f22f579d5594b61a89d41d10a022 Mon Sep 17 00:00:00 2001
 From: Jerome Marchand <jmarchan@redhat.com>
 Date: Wed, 1 Feb 2023 17:30:03 +0100
 Subject: [PATCH 2/3] tools/tcpstates: fix IPv6 journal
 When logging ipv6 state change, journal_fields tries to pack
 event.addr and event.daddr, which is not an integer in this, to
 present a bytes-like object to socket.inet_ntop. This can be fixed by
 having a similar type for [sd]addr for IPv4 and IPv6. Making both an
 array of u32 solves the issue by presenting a bytes-like object
 directly to inet_ntop, without the need for the struct packing stage.
 Also  now, the similar behavior, makes it easier to factor code for
 IPv4 and IPv6.
 It solves the following error:
 /usr/share/bcc/tools/tcpstates  -Y
 SKADDR           C-PID C-COMM     LADDR           LPORT RADDR           RPORT OLDSTATE    -> NEWSTATE    MS
 ffff8b2e83e56180 0     swapper/9  ::              22    ::              0     LISTEN      -> SYN_RECV    0.000
 Exception ignored on calling ctypes callback function: <function PerfEventArray._open_perf_buffer.<locals>.raw_cb_ at 0x7f894c8d7f70>
 Traceback (most recent call last):
  File "/usr/lib/python3.9/site-packages/bcc/table.py", line 982, in raw_cb_
    callback(cpu, data, size)
  File "/usr/share/bcc/tools/tcpstates", line 419, in print_ipv6_event
    journal.send(**journal_fields(event, AF_INET6))
  File "/usr/share/bcc/tools/tcpstates", line 348, in journal_fields
    'OBJECT_' + addr_pfx + '_SOURCE_ADDRESS': inet_ntop(addr_family, pack("I", event.saddr)),
 struct.error: required argument is not an integer
 ffff8b2e83e56180 0     swapper/9  2620:52:0:2580:5054:ff:fe6b:6f1f 22    2620:52:0:2b11:2f5e:407d:b35d:4663 60396 SYN_RECV    -> ESTABLISHED 0.010
 Exception ignored on calling ctypes callback function: <function PerfEventArray._open_perf_buffer.<locals>.raw_cb_ at 0x7f894c8d7f70>
 Traceback (most recent call last):
  File "/usr/lib/python3.9/site-packages/bcc/table.py", line 982, in raw_cb_
    callback(cpu, data, size)
  File "/usr/share/bcc/tools/tcpstates", line 419, in print_ipv6_event
    journal.send(**journal_fields(event, AF_INET6))
  File "/usr/share/bcc/tools/tcpstates", line 348, in journal_fields
    'OBJECT_' + addr_pfx + '_SOURCE_ADDRESS': inet_ntop(addr_family, pack("I", event.saddr)),
 struct.error: required argument is not an integer
 Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
 ---
 tools/tcpstates.py | 55 +++++++++++++++++-----------------------------
 1 file changed, 20 insertions(+), 35 deletions(-)
 diff --git a/tools/tcpstates.py b/tools/tcpstates.py
 index d9d6e4c7..0507cc10 100755
 --- a/tools/tcpstates.py
 +++ b/tools/tcpstates.py
@@ -19,7 +19,6 @@ from __future__ import print_function
 from bcc import BPF
 import argparse
 from socket import inet_ntop, AF_INET, AF_INET6
 -from struct import pack
 from time import strftime, time
 from os import getuid
@@ -78,8 +77,8 @@ BPF_HASH(last, struct sock *, u64);
 struct ipv4_data_t {
     u64 ts_us;
     u64 skaddr;
 -    u32 saddr;
 -    u32 daddr;
 +    u32 saddr[1];
 +    u32 daddr[1];
     u64 span_us;
     u32 pid;
     u16 lport;
@@ -93,8 +92,8 @@ BPF_PERF_OUTPUT(ipv4_events);
 struct ipv6_data_t {
     u64 ts_us;
     u64 skaddr;
 -    unsigned __int128 saddr;
 -    unsigned __int128 daddr;
 +    u32 saddr[4];
 +    u32 daddr[4];
     u64 span_us;
     u32 pid;
     u16 lport;
@@ -350,9 +349,9 @@ format_string = ("%-16x %-5d %-10.10s %s%-15s %-5d %-15s %-5d %-11s " +
         'OBJECT_PID': str(event.pid),
         'OBJECT_COMM': event.task.decode('utf-8', 'replace'),
         # Custom fields, aka "stuff we sort of made up".
 -        'OBJECT_' + addr_pfx + '_SOURCE_ADDRESS': inet_ntop(addr_family, pack("I", event.saddr)),
 +        'OBJECT_' + addr_pfx + '_SOURCE_ADDRESS': inet_ntop(addr_family, event.saddr),
         'OBJECT_TCP_SOURCE_PORT': str(event.lport),
 -        'OBJECT_' + addr_pfx + '_DESTINATION_ADDRESS': inet_ntop(addr_family, pack("I", event.daddr)),
 +        'OBJECT_' + addr_pfx + '_DESTINATION_ADDRESS': inet_ntop(addr_family, event.daddr),
         'OBJECT_TCP_DESTINATION_PORT': str(event.dport),
         'OBJECT_TCP_OLD_STATE': tcpstate2str(event.oldstate),
         'OBJECT_TCP_NEW_STATE': tcpstate2str(event.newstate),
@@ -373,8 +372,7 @@ format_string = ("%-16x %-5d %-10.10s %s%-15s %-5d %-15s %-5d %-11s " +
     return fields
 # process event
 -def print_ipv4_event(cpu, data, size):
 -    event = b["ipv4_events"].event(data)
 +def print_event(event, addr_family):
     global start_ts
     if args.time:
         if args.csv:
@@ -389,39 +387,26 @@ format_string = ("%-16x %-5d %-10.10s %s%-15s %-5d %-15s %-5d %-11s " +
             print("%.6f," % delta_s, end="")
         else:
             print("%-9.6f " % delta_s, end="")
 +    if addr_family == AF_INET:
 +        version = "4"
 +    else:
 +        version = "6"
     print(format_string % (event.skaddr, event.pid, event.task.decode('utf-8', 'replace'),
 -        "4" if args.wide or args.csv else "",
 -        inet_ntop(AF_INET, pack("I", event.saddr)), event.lport,
 -        inet_ntop(AF_INET, pack("I", event.daddr)), event.dport,
 +        version if args.wide or args.csv else "",
 +        inet_ntop(addr_family, event.saddr), event.lport,
 +        inet_ntop(addr_family, event.daddr), event.dport,
         tcpstate2str(event.oldstate), tcpstate2str(event.newstate),
         float(event.span_us) / 1000))
     if args.journal:
 -        journal.send(**journal_fields(event, AF_INET))
 +        journal.send(**journal_fields(event, addr_family))
 +
 +def print_ipv4_event(cpu, data, size):
 +    event = b["ipv4_events"].event(data)
 +    print_event(event, AF_INET)
 def print_ipv6_event(cpu, data, size):
     event = b["ipv6_events"].event(data)
 -    global start_ts
 -    if args.time:
 -        if args.csv:
 -            print("%s," % strftime("%H:%M:%S"), end="")
 -        else:
 -            print("%-8s " % strftime("%H:%M:%S"), end="")
 -    if args.timestamp:
 -        if start_ts == 0:
 -            start_ts = event.ts_us
 -        delta_s = (float(event.ts_us) - start_ts) / 1000000
 -        if args.csv:
 -            print("%.6f," % delta_s, end="")
 -        else:
 -            print("%-9.6f " % delta_s, end="")
 -    print(format_string % (event.skaddr, event.pid, event.task.decode('utf-8', 'replace'),
 -        "6" if args.wide or args.csv else "",
 -        inet_ntop(AF_INET6, event.saddr), event.lport,
 -        inet_ntop(AF_INET6, event.daddr), event.dport,
 -        tcpstate2str(event.oldstate), tcpstate2str(event.newstate),
 -        float(event.span_us) / 1000))
 -    if args.journal:
 -        journal.send(**journal_fields(event, AF_INET6))
 +    print_event(event, AF_INET6)
 # initialize BPF
 b = BPF(text=bpf_text)
 -- 
 2.41.0
--- a/SOURCES/bcc-0.25.0-tools-tcpstates-fix-context-ptr-modified-error.patch
+++ b/SOURCES/bcc-0.25.0-tools-tcpstates-fix-context-ptr-modified-error.patch
@ -0,0 +1,144 @@
 From 28bf4c3eb6949722d3d7af912f6802e282e51e90 Mon Sep 17 00:00:00 2001
 From: hejun01 <hejun01@corp.netease.com>
 Date: Thu, 29 Jun 2023 20:24:07 +0800
 Subject: [PATCH 1/3] tools/tcpstates: fix context ptr modified error
 Introduce local variable tcp_new_state,
 to avoid llvm optimization of args->newstate,
 which will cause context ptr args modified.
 spilt event.ports to lport and dport.
 switch type of TCP state from unsigned int to int.
 ---
 tools/tcpstates.py | 47 +++++++++++++++++++++++++---------------------
 1 file changed, 26 insertions(+), 21 deletions(-)
 diff --git a/tools/tcpstates.py b/tools/tcpstates.py
 index 1fa2c26a..d9d6e4c7 100755
 --- a/tools/tcpstates.py
 +++ b/tools/tcpstates.py
@@ -82,9 +82,10 @@ struct ipv4_data_t {
     u32 daddr;
     u64 span_us;
     u32 pid;
 -    u32 ports;
 -    u32 oldstate;
 -    u32 newstate;
 +    u16 lport;
 +    u16 dport;
 +    int oldstate;
 +    int newstate;
     char task[TASK_COMM_LEN];
 };
 BPF_PERF_OUTPUT(ipv4_events);
@@ -96,9 +97,10 @@ struct ipv6_data_t {
     unsigned __int128 daddr;
     u64 span_us;
     u32 pid;
 -    u32 ports;
 -    u32 oldstate;
 -    u32 newstate;
 +    u16 lport;
 +    u16 dport;
 +    int oldstate;
 +    int newstate;
     char task[TASK_COMM_LEN];
 };
 BPF_PERF_OUTPUT(ipv6_events);
@@ -132,6 +134,9 @@ TRACEPOINT_PROBE(sock, inet_sock_set_state)
     u16 family = args->family;
     FILTER_FAMILY
 +    // workaround to avoid llvm optimization which will cause context ptr args modified
 +    int tcp_newstate = args->newstate;
 +
     if (args->family == AF_INET) {
         struct ipv4_data_t data4 = {
             .span_us = delta_us,
@@ -141,8 +146,8 @@ TRACEPOINT_PROBE(sock, inet_sock_set_state)
         data4.ts_us = bpf_ktime_get_ns() / 1000;
         __builtin_memcpy(&data4.saddr, args->saddr, sizeof(data4.saddr));
         __builtin_memcpy(&data4.daddr, args->daddr, sizeof(data4.daddr));
 -        // a workaround until data4 compiles with separate lport/dport
 -        data4.ports = dport + ((0ULL + lport) << 16);
 +        data4.lport = lport;
 +        data4.dport = dport;
         data4.pid = pid;
         bpf_get_current_comm(&data4.task, sizeof(data4.task));
@@ -157,14 +162,14 @@ TRACEPOINT_PROBE(sock, inet_sock_set_state)
         data6.ts_us = bpf_ktime_get_ns() / 1000;
         __builtin_memcpy(&data6.saddr, args->saddr_v6, sizeof(data6.saddr));
         __builtin_memcpy(&data6.daddr, args->daddr_v6, sizeof(data6.daddr));
 -        // a workaround until data6 compiles with separate lport/dport
 -        data6.ports = dport + ((0ULL + lport) << 16);
 +        data6.lport = lport;
 +        data6.dport = dport;
         data6.pid = pid;
         bpf_get_current_comm(&data6.task, sizeof(data6.task));
         ipv6_events.perf_submit(args, &data6, sizeof(data6));
     }
 -    if (args->newstate == TCP_CLOSE) {
 +    if (tcp_newstate == TCP_CLOSE) {
         last.delete(&sk);
     } else {
         u64 ts = bpf_ktime_get_ns();
@@ -210,8 +215,8 @@ int kprobe__tcp_set_state(struct pt_regs *ctx, struct sock *sk, int state)
         data4.ts_us = bpf_ktime_get_ns() / 1000;
         data4.saddr = sk->__sk_common.skc_rcv_saddr;
         data4.daddr = sk->__sk_common.skc_daddr;
 -        // a workaround until data4 compiles with separate lport/dport
 -        data4.ports = dport + ((0ULL + lport) << 16);
 +        data4.lport = lport;
 +        data4.dport = dport;
         data4.pid = pid;
         bpf_get_current_comm(&data4.task, sizeof(data4.task));
@@ -228,8 +233,8 @@ int kprobe__tcp_set_state(struct pt_regs *ctx, struct sock *sk, int state)
             sk->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32);
         bpf_probe_read_kernel(&data6.daddr, sizeof(data6.daddr),
             sk->__sk_common.skc_v6_daddr.in6_u.u6_addr32);
 -        // a workaround until data6 compiles with separate lport/dport
 -        data6.ports = dport + ((0ULL + lport) << 16);
 +        data6.lport = lport;
 +        data6.dport = dport;
         data6.pid = pid;
         bpf_get_current_comm(&data6.task, sizeof(data6.task));
         ipv6_events.perf_submit(ctx, &data6, sizeof(data6));
@@ -346,9 +351,9 @@ format_string = ("%-16x %-5d %-10.10s %s%-15s %-5d %-15s %-5d %-11s " +
         'OBJECT_COMM': event.task.decode('utf-8', 'replace'),
         # Custom fields, aka "stuff we sort of made up".
         'OBJECT_' + addr_pfx + '_SOURCE_ADDRESS': inet_ntop(addr_family, pack("I", event.saddr)),
 -        'OBJECT_TCP_SOURCE_PORT': str(event.ports >> 16),
 +        'OBJECT_TCP_SOURCE_PORT': str(event.lport),
         'OBJECT_' + addr_pfx + '_DESTINATION_ADDRESS': inet_ntop(addr_family, pack("I", event.daddr)),
 -        'OBJECT_TCP_DESTINATION_PORT': str(event.ports & 0xffff),
 +        'OBJECT_TCP_DESTINATION_PORT': str(event.dport),
         'OBJECT_TCP_OLD_STATE': tcpstate2str(event.oldstate),
         'OBJECT_TCP_NEW_STATE': tcpstate2str(event.newstate),
         'OBJECT_TCP_SPAN_TIME': str(event.span_us)
@@ -386,8 +391,8 @@ format_string = ("%-16x %-5d %-10.10s %s%-15s %-5d %-15s %-5d %-11s " +
             print("%-9.6f " % delta_s, end="")
     print(format_string % (event.skaddr, event.pid, event.task.decode('utf-8', 'replace'),
         "4" if args.wide or args.csv else "",
 -        inet_ntop(AF_INET, pack("I", event.saddr)), event.ports >> 16,
 -        inet_ntop(AF_INET, pack("I", event.daddr)), event.ports & 0xffff,
 +        inet_ntop(AF_INET, pack("I", event.saddr)), event.lport,
 +        inet_ntop(AF_INET, pack("I", event.daddr)), event.dport,
         tcpstate2str(event.oldstate), tcpstate2str(event.newstate),
         float(event.span_us) / 1000))
     if args.journal:
@@ -411,8 +416,8 @@ format_string = ("%-16x %-5d %-10.10s %s%-15s %-5d %-15s %-5d %-11s " +
             print("%-9.6f " % delta_s, end="")
     print(format_string % (event.skaddr, event.pid, event.task.decode('utf-8', 'replace'),
         "6" if args.wide or args.csv else "",
 -        inet_ntop(AF_INET6, event.saddr), event.ports >> 16,
 -        inet_ntop(AF_INET6, event.daddr), event.ports & 0xffff,
 +        inet_ntop(AF_INET6, event.saddr), event.lport,
 +        inet_ntop(AF_INET6, event.daddr), event.dport,
         tcpstate2str(event.oldstate), tcpstate2str(event.newstate),
         float(event.span_us) / 1000))
     if args.journal:
 -- 
 2.41.0
--- a/SPECS/bcc.spec
+++ b/SPECS/bcc.spec
@ -1,20 +1,5 @@
-# We don't want to bring luajit in RHEL
+# luajit is not available RHEL 8
 %if 0%{?rhel} > 0
 %bcond_with lua
 %else
 # luajit is not available for some architectures
 %ifarch ppc64 ppc64le s390x
 %bcond_with lua
 %else
 %bcond_without lua
 %endif
 %endif
 %ifarch x86_64 ppc64 ppc64le aarch64 s390x
 %bcond_without libbpf_tools
 %else
 %bcond_with libbpf_tools
 %endif
 %bcond_with llvm_static
@ -22,20 +7,35 @@
 %global with_llvm_shared 1
 %endif
 Name:           bcc
-Version:        0.30.0
+Version:        0.25.0
-Release:        6%{?dist}
+Release:        9%{?dist}
 Summary:        BPF Compiler Collection (BCC)
 License:        ASL 2.0
 URL:            https://github.com/iovisor/bcc
 Source0:        %{url}/archive/v%{version}/%{name}-%{version}.tar.gz
-Patch0:         %%{name}-%%{version}-clang-fail-when-the-kheaders-ownership-is-wrong-4928.patch
+Patch0:         %{name}-%{version}-Manpages-remove-unstable-statement.patch
-
+Patch1:         %{name}-%{version}-RHEL-libbpf-version-fixes.patch
 Patch2:         %{name}-%{version}-libbpf-Allow-kernel_struct_has_field-to-reach-field-.patch
 Patch3:         %{name}-%{version}-Fix-bpf_pseudo_fd-type-conversion-error.patch
 Patch4:         %{name}-%{version}-Fix-clang-15-int-to-pointer-conversion-errors.patch
 Patch5:         %{name}-%{version}-Revert-tools-tcpaccept-Fix-support-for-v5.6-kernels.patch
 Patch6:         %{name}-%{version}-Fix-get_kprobe_functions.patch
 Patch7:         %{name}-%{version}-Fix-a-llvm-signed-division-error-for-compactsnoop-to.patch
 Patch8:         %{name}-%{version}-tools-compactsnoop.py-Fix-raw_tracepoint-Invalid-arg.patch
 Patch9:         %{name}-%{version}-Revert-tools-Fix-bindsnoop-for-kernel-v5.6.patch
 Patch10:        %{name}-%{version}-tools-nfsslower.py-Fix-uninitialized-struct-pad-erro.patch
 Patch11:        %{name}-%{version}-Fix-a-llvm-compilation-error.patch
 Patch12:        %{name}-%{version}-Fix-compilation-error-when-built-with-llvm17.patch
 Patch13:        %{name}-%{version}-tools-tcpstates-fix-context-ptr-modified-error.patch
 Patch14:        %{name}-%{version}-tools-tcpstates-fix-IPv6-journal.patch
 Patch15:        %{name}-%{version}-clang-check-header-ownership-4928.patch
 Patch16:        %{name}-%{version}-clang-Fix-file_exists_and_ownedby-return-value-4935.patch
 Patch17:        %{name}-%{version}-clang-fail-when-the-kheaders-ownership-is-wrong-4928.patch
 # Arches will be included as upstream support is added and dependencies are
 # satisfied in the respective arches
-ExclusiveArch:  x86_64 %{power64} aarch64 s390x armv7hl
+ExcludeArch: i686
 BuildRequires:  bison
 BuildRequires:  cmake >= 2.8.7
@ -43,7 +43,6 @@ BuildRequires:  flex
 BuildRequires:  libxml2-devel
 BuildRequires:  python3-devel
 BuildRequires:  elfutils-libelf-devel
 BuildRequires:  elfutils-debuginfod-client-devel
 BuildRequires:  llvm-devel
 BuildRequires:  clang-devel
 %if %{with llvm_static}
@ -53,12 +52,11 @@ BuildRequires:  ncurses-devel
 %if %{with lua}
 BuildRequires:  pkgconfig(luajit)
 %endif
-BuildRequires:  libbpf-devel >= 2:0.8.0, libbpf-static >= 2:0.8.0
+BuildRequires:  libbpf-devel >= 0.5.0, libbpf-static >= 0.5.0
-Requires:       libbpf >= 2:0.8.0
+Requires:       libbpf >= 0.5.0
 Requires:       tar
 Recommends:     kernel-devel
 Recommends:     %{name}-tools = %{version}-%{release}
 %description
@ -74,7 +72,6 @@ performance analysis and network traffic control.
 %package devel
 Summary:        Shared library for BPF Compiler Collection (BCC)
 Requires:       %{name}%{?_isa} = %{version}-%{release}
 Suggests:       elfutils-debuginfod-client
 %description devel
 The %{name}-devel package contains libraries and header files for developing
@ -84,7 +81,9 @@ application that use BPF Compiler Collection (BCC).
 %package doc
 Summary:        Examples for BPF Compiler Collection (BCC)
 Recommends:     python3-%{name} = %{version}-%{release}
 %if %{with lua}
 Recommends:     %{name}-lua = %{version}-%{release}
 %endif
 BuildArch:      noarch
 %description doc
@ -93,8 +92,8 @@ Examples for BPF Compiler Collection (BCC)
 %package -n python3-%{name}
 Summary:        Python3 bindings for BPF Compiler Collection (BCC)
-Requires:       %{name} = %{version}-%{release}
+Requires:       %{name}%{?_isa} = %{version}-%{release}
-BuildArch:      noarch
+%{?python_provide:%python_provide python3-%{name}}
 %description -n python3-%{name}
 Python3 bindings for BPF Compiler Collection (BCC)
@ -115,65 +114,39 @@ Summary:        Command line tools for BPF Compiler Collection (BCC)
 Requires:       bcc = %{version}-%{release}
 Requires:       python3-%{name} = %{version}-%{release}
 Requires:       python3-netaddr
 %ifnarch s390x
 Requires:       python3-pyelftools
 %endif
 %description tools
 Command line tools for BPF Compiler Collection (BCC)
 %if %{with libbpf_tools}
 %package -n libbpf-tools
 Summary:        Command line libbpf tools for BPF Compiler Collection (BCC)
 BuildRequires:  bpftool
 %description -n libbpf-tools
 Command line libbpf tools for BPF Compiler Collection (BCC)
 %endif
 %prep
 %autosetup -p1
 %build
-%cmake -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+%cmake . \
-       -DREVISION_LAST=%{version} -DREVISION=%{version} -DPYTHON_CMD=python3 \
+        -DCMAKE_BUILD_TYPE=RelWithDebInfo \
-       -DCMAKE_USE_LIBBPF_PACKAGE:BOOL=TRUE \
+        -DREVISION_LAST=%{version} -DREVISION=%{version} -DPYTHON_CMD=python3 \
-       %{?with_llvm_shared:-DENABLE_LLVM_SHARED=1}
+        -DCMAKE_USE_LIBBPF_PACKAGE:BOOL=TRUE \
-%cmake_build
+        %{?with_llvm_shared:-DENABLE_LLVM_SHARED=1}
 %make_build
 # It was discussed and agreed to package libbpf-tools with
 # 'bpf-' prefix (https://github.com/iovisor/bcc/pull/3263)
 # Installing libbpf-tools binaries in temp directory and
 # renaming them in there and the install code will just
 # take them.
 %if %{with libbpf_tools}
 pushd libbpf-tools;
 make BPFTOOL=bpftool LIBBPF_OBJ=%{_libdir}/libbpf.a CFLAGS="%{optflags}" LDFLAGS="%{build_ldflags}"
 make DESTDIR=./tmp-install prefix= install
 (
    cd tmp-install/bin
    for file in *; do
        mv $file bpf-$file
    done
    # now fix the broken symlinks
    for file in `find . -type l`; do
        dest=$(readlink "$file")
        ln -s -f bpf-$dest $file
    done
 )
 popd
 %endif
 %install
-%cmake_install
+%make_install
 # Fix python shebangs
 # This messes the timestamp and rpmdiff complains about it
 # Let's set the all thing according to a reference file
 touch -r %{buildroot}%{_datadir}/%{name}/examples/hello_world.py %{_tmppath}/timestamp
 find %{buildroot}%{_datadir}/%{name}/{tools,examples} -type f -exec \
  sed -i -e '1s=^#!/usr/bin/python\([0-9.]\+\)\?$=#!%{__python3}=' \
         -e '1s=^#!/usr/bin/env python\([0-9.]\+\)\?$=#!%{__python3}=' \
         -e '1s=^#!/usr/bin/env bcc-lua$=#!/usr/bin/bcc-lua=' {} \;
 for i in `find %{buildroot}%{_datadir}/%{name}/examples/` ; do
    touch -h -r %{_tmppath}/timestamp $i
 done
 # Move man pages to the right location
 mkdir -p %{buildroot}%{_mandir}
 mv %{buildroot}%{_datadir}/%{name}/man/* %{buildroot}%{_mandir}/
@ -183,24 +156,16 @@ for i in `find %{buildroot}%{_mandir} -name "*.gz"`; do
  tname=$(basename $i)
  rename $tname %{name}-$tname $i
 done
-mkdir -p %{buildroot}%{_docdir}/%{name}
+# Fix the symlink too
-mv %{buildroot}%{_datadir}/%{name}/examples %{buildroot}%{_docdir}/%{name}/
+for i in `find %{buildroot}%{_mandir} -lname \*.gz` ; do
-
+    target=`readlink $i`;
-# Delete old tools we don't want to ship
+    ln -sf bcc-$target $i;
-rm -rf %{buildroot}%{_datadir}/%{name}/tools/old/
+done
 # We cannot run the test suit since it requires root and it makes changes to
 # the machine (e.g, IP address)
 #%check
 %if %{with libbpf_tools}
 mkdir -p %{buildroot}/%{_sbindir}
 # We cannot use `install` because some of the tools are symlinks and `install`
 # follows those. Since all the tools already have the correct permissions set,
 # we just need to copy them to the right place while preserving those
 cp -a libbpf-tools/tmp-install/bin/* %{buildroot}/%{_sbindir}/
 %endif
 %ldconfig_scriptlets
 %files
@ -221,29 +186,39 @@ cp -a libbpf-tools/tmp-install/bin/* %{buildroot}/%{_sbindir}/
 %{python3_sitelib}/%{name}*
 %files doc
-%dir %{_docdir}/%{name}
+# % dir % {_docdir}/% {name}
-%doc %{_docdir}/%{name}/examples/
+%doc %{_datadir}/%{name}/examples/
 %if %{without lua}
 %exclude %{_datadir}/%{name}/examples/lua
 %endif
 %files tools
 %dir %{_datadir}/%{name}
-%{_datadir}/%{name}/tools/
+%dir %{_datadir}/%{name}/tools
-%{_datadir}/%{name}/introspection/
+%dir %{_datadir}/%{name}/introspection
-%if 0%{?rhel} > 0
+%{_datadir}/%{name}/tools/*
-# inject relies on BPF_KPROBE_OVERRIDE which is not set on RHEL
+%{_datadir}/%{name}/introspection/*
 %exclude %{_datadir}/%{name}/tools/old/
 # inject relies on BPF_KPROBE_OVERRIDE which is not set on RHEL 8
 %exclude %{_datadir}/%{name}/tools/inject
 %exclude %{_datadir}/%{name}/tools/doc/inject_example.txt
 %exclude %{_mandir}/man8/bcc-inject.8.gz
-# Neither btrfs nor zfs are available on RHEL
+# Neither btrfs nor zfs are available on RHEL8
 %exclude %{_datadir}/%{name}/tools/btrfs*
 %exclude %{_datadir}/%{name}/tools/doc/btrfs*
 %exclude %{_mandir}/man8/bcc-btrfs*
 %exclude %{_datadir}/%{name}/tools/zfs*
 %exclude %{_datadir}/%{name}/tools/doc/zfs*
 %exclude %{_mandir}/man8/bcc-zfs*
-# criticalstat relies on CONFIG_PREEMPTIRQ_EVENTS which is disabled on RHEL
+# criticalstat relies on CONFIG_PREEMPTIRQ_EVENTS which is disabled on RHEL 8
 %exclude %{_datadir}/%{name}/tools/criticalstat
 %exclude %{_datadir}/%{name}/tools/doc/criticalstat_example.txt
 %exclude %{_mandir}/man8/bcc-criticalstat.8.gz
 # compactsnoop is only supported on x86_64
 %ifnarch x86_64
 %exclude %{_datadir}/%{name}/tools/compactsnoop
 %exclude %{_datadir}/%{name}/tools/doc/compactsnoop_example.txt
 %exclude %{_mandir}/man8/bcc-compactsnoop.8.gz
 %endif
 %{_mandir}/man8/*
@ -252,269 +227,178 @@ cp -a libbpf-tools/tmp-install/bin/* %{buildroot}/%{_sbindir}/
 %{_bindir}/bcc-lua
 %endif
 %if %{with libbpf_tools}
 %files -n libbpf-tools
 %ifarch s390x
 %exclude %{_sbindir}/bpf-numamove
 %endif
 # RHEL doesn't provide btrfs or f2fs
 %exclude %{_sbindir}/bpf-btrfs*
 %exclude %{_sbindir}/bpf-f2fs*
 %{_sbindir}/bpf-*
 %endif
 %changelog
-* Thu Jul 04 2024 Jerome Marchand <jmarchan@redhat.com> - 0.30.0-6
+* Tue May 28 2024 Jerome Marchand <jmarchan@redhat.com> - 0.25.0-9
- Rebuild with LLVM 18 (RHEL-28684)
+- Really prevent the loading of compromised headers (RHEL-28768, CVE-2024-2314)
-* Fri May 31 2024 Jerome Marchand <jmarchan@redhat.com> - 0.30.0-5
+* Tue Mar 12 2024 Jerome Marchand <jmarchan@redhat.com> - 0.25.0-8
- Drop python3-pyelftools dependency on s390x until it is available
+- Check header ownership (RHEL-28768)
-* Tue May 21 2024 Jerome Marchand <jmarchan@redhat.com> - 0.30.0-4
+* Wed Nov 08 2023 Jerome Marchand <jmarchan@redhat.com> - 0.25.0-7
- Exclude btrfs and f2fs libbpf tools (RHEL-36579)
+- Fix repo URL in tests.yml
-* Mon May 20 2024 Jerome Marchand <jmarchan@redhat.com> - 0.30.0-3
+* Wed Nov 01 2023 Jerome Marchand <jmarchan@redhat.com> - 0.25.0-6
- Really prevent the loading of compromised headers (RHEL-28769, CVE-2024-2314)
+- Rebuild on LLVM 17 (RHEL-10689)
- Add python3-pyelftools dependency (RHEL-36583)
+- Fix IPv6 for tcpstates (RHEL-8522)
-* Fri May 03 2024 Jerome Marchand <jmarchan@redhat.com> - 0.30.0-2
+* Mon Jun 12 2023 Jerome Marchand <jmarchan@redhat.com> - 0.25.0-5
- Rebuild (distrobaker didn't take last build)
+- Fix LLVM 16 build
-* Wed Apr 10 2024 Jerome Marchand <jmarchan@redhat.com> - 0.30.0-1
+* Thu Jun 08 2023 Jerome Marchand <jmarchan@redhat.com> - 0.25.0-4
- Rebase bcc to 0.30.0 (RHEL-29031)
+- Add missing patch.
 - Exclude bpf-numamove on s390x (RHEL-32327)
-* Wed Dec 13 2023 Jerome Marchand <jmarchan@redhat.com> - 0.28.0-5
+* Mon May 15 2023 Jerome Marchand <jmarchan@redhat.com> - 0.25.0-3
- Fix libbpf bio tools (RHEL-19368)
+- Rebuild with llvm 16 (RHBZ#2192949)
- Add S390x support to libbpf-tools (RHEL-16325)
+- Fix compactsnoop (RHBZ#2042238)
- Power enhancements(RHEL-11477)
+- Fix bindsnoop (RHBZ#2155200)
 - Fix nfsslower (RHBZ#2155163)
-* Tue Nov 21 2023 Jerome Marchand <jmarchan@redhat.com> - 0.28.0-4
+* Fri Mar 03 2023 bstinson@redhat.com - 0.25.0-2.0.2
- Rebuild with LLVM 17 in the side tag (RHEL-10591)
+- One final rebuild in CentOS Stream only
-* Tue Nov 21 2023 Jerome Marchand <jmarchan@redhat.com> - 0.28.0-3
+* Wed Mar 01 2023 bstinson@redhat.com - 0.25.0-2.0.1
- Rebuild with LLVM 17 (RHEL-10591)
+- Rebuild in CentOS Stream only for library link issue
-* Mon Nov 06 2023 Jerome Marchand <jmarchan@redhat.com> - 0.28.0-2
+* Tue Jan 10 2023 Jerome Marchand <jmarchan@redhat.com> - 0.25.0-2
- Fix trace tool (RHEL-8605)
+- Fix tcpdrop tool
-* Mon Oct 23 2023 Jerome Marchand <jmarchan@redhat.com> - 0.28.0-1
+* Wed Nov 30 2022 Jerome Marchand <jmarchan@redhat.com> - 0.25.0-1
- Rebase to v0.28.0 (RHEL-9976)
+- Rebase to bcc-0.25.0
- Rebuild with LLVM 17 (RHEL-10591)
+- Rebuild on LLVM 15
 - Fix bpf-biosnoop out of bound access (RHEL-8664)
 - Fix kvmexit missing VM exit reasons and statistics (RHEL-8702)
 - Fix multi-word array type handling (RHEL-8674)
 - Fix tcpstates -Y (RHEL-8490)
 - Fix bio tools (RHEL-8553)
-* Wed Aug 09 2023 Jerome Marchand <jmarchan@redhat.com> - 0.26.0-4
+* Thu Jun 23 2022 Jerome Marchand <jmarchan@redhat.com> - 0.24.0-2
- Fix tcpretrans (rhbz#2226967)
+- Rebuild on libbpf 0.5.0
-* Fri May 12 2023 Jerome Marchand <jmarchan@redhat.com> - 0.26.0-3
+* Thu Jun 09 2022 Jerome Marchand <jmarchan@redhat.com> - 0.24.0-1
- Rebuild with LLVM 16 (rhbz#2050112)
+- Rebase to bcc-0.24.0
- Fix compactsnoop (rhbz#2042236)
+- Rebuild on LLVM 14
 - Fix killsnoop documentation (rhbz#2075500)
 - Fix funcslower (rhbz#2075415)
 - Fix deadlock memory usage issue (rhbz#2050112)
 - Fix nfsslower (rhbz#2180934)
 - Use upstream fix for nfsslower unititialized struct issue
-* Wed Mar 15 2023 Jerome Marchand <jmarchan@redhat.com> - 0.26.0-2
+* Mon Dec 06 2021 Jerome Marchand <jmarchan@redhat.com> - 0.19.0-6
- Rebuild with the right rhel-target
+- Add excplicit requirement in bcc-tools for rpmdiff
-* Fri Mar 10 2023 Jerome Marchand <jmarchan@redhat.com> - 0.26.0-1
+* Tue Nov 23 2021 Jerome Marchand <jmarchan@redhat.com> - 0.19.0-5
- Rebase to v0.26.0
+- Handle the renaming of task_struct_>state field
 * Thu Jan 05 2023 Jerome Marchand <jmarchan@redhat.com> - 0.25.0-2
 - Rebuild for libbpf 1.0
 * Tue Dec 20 2022 Jerome Marchand <jmarchan@redhat.com> - 0.25.0-1
 - Rebase to v0.25.0
 - Misc documentation and man pages fixes
 * Tue Aug 23 2022 Jerome Marchand <jmarchan@redhat.com> - 0.24.1-4
 - Fix mdflush tool (rhbz#2108001)
 * Fri Jul 01 2022 Jerome Marchand <jmarchan@redhat.com> - 0.24.1-3
 - Rebuild for libbpf 0.6.0
 * Wed May 18 2022 Jerome Marchand <jmarchan@redhat.com> - 0.24.1-2
 - Rebuild (previous build failed with UNKNOWN_KOJI_ERROR)
 * Thu Mar 24 2022 Jerome Marchand <jmarchan@redhat.com> - 0.24.0-1
 - Rebase to v0.24.0
 - Fix cmake build
 * Fri Feb 25 2022 Jerome Marchand <jmarchan@redhat.com> - 0.20.0-10
 - Remove deprecated python_provides macro (needed for gating)
 * Thu Feb 24 2022 Jerome Marchand <jmarchan@redhat.com> - 0.20.0-9
 - Fix bio tools (rhbz#2039595)
 * Mon Nov 22 2021 Jerome Marchand <jmarchan@redhat.com> - 0.20.0-8
 - Rebuild for LLVM 13
-* Thu Oct 14 2021 Jerome Marchand <jmarchan@redhat.com> - 0.20.0-7
+* Fri Jul 02 2021 Jerome Marchand <jmarchan@redhat.com> - 0.19.0-4
 - Sync with latest libbpf (fixes BPF_F_BROADCAST breakages of rhbz#1992430)
 - Fix cpudist, mdflush, readahead and threadsnoop (rhbz#1992430)
 - Handle the renaming of task_struct_>state field
 - Drop tools that relies on features disabled on RHEL
 * Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 0.20.0-6
 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
  Related: rhbz#1991688
 * Tue Aug 03 2021 Jerome Marchand <jmarchan@redhat.com> - 0.20.0-5
 - Add gating
 * Mon Jul 26 2021 Jerome Marchand <jmarchan@redhat.com> - 0.20.0-4
 - Don't require bcc-tools by default (#1967550)
 - Add explicit bcc requirement to bcc-tools
 - Build bcc from standard sources
 - Don't require bcc-tools by default
-* Wed Jun 02 2021 Jerome Marchand <jmarchan@redhat.com> - 0.20.0-3
+* Wed Jun 09 2021 Jerome Marchand <jmarchan@redhat.com> - 0.19.0-3
- Don't ignore LDFLAGS for libbpf-tools
+- Rebuild on LLVM 12
-* Wed Jun 02 2021 Jerome Marchand <jmarchan@redhat.com> - 0.20.0-2
+* Fri Apr 30 2021 Jerome Marchand <jmarchan@redhat.com> - 0.19.0-2
- Don't override cflags for libbpf-tools
+- Fix BPF src_file.
-* Thu May 27 2021 Jerome Marchand <jmarchan@redhat.com> - 0.20.0-1
+* Tue Apr 27 2021 Jerome Marchand <jmarchan@redhat.com> - 0.19.0-1
- Rebase to bcc 0.20.0
+- Rebased to version 0.19.0
 - Remove hard dependency on kernel-devel
-* Thu May 13 2021 Tom Stellard <tstellar@redhat.com> - 0.18.0-6
+* Fri Jan 22 2021 Jerome Marchand <jmarchan@redhat.com> - 0.16.0-2
- Rebuild for LLVM 12
+- Build with libbpf package
 - spec file cleanups
-* Thu Apr 15 2021 Mohan Boddu <mboddu@redhat.com> - 0.18.0-5
+* Mon Oct 26 2020 Jerome Marchand <jmarchan@redhat.com> - 0.16.0-1
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
+- Rebase on bcc-0.16.0
 - Fix IPv6 ports
-* Thu Feb 18 2021 Jerome Marchand <jmarchan@redhat.com> - 0.18.0-4
+* Wed Sep 02 2020 Jerome Marchand <jmarchan@redhat.com> - 0.14.0-4
- Disable lua for RHEL
+- Fix KFUNC_PROBE return value
 - Forbid trampolines on unsupported arches
-* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 0.18.0-3
+* Tue Jul 21 2020 Jerome Marchand <jmarchan@redhat.com> - 0.14.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+- Add KBUILD_MODNAME flag to default cflags
-* Fri Jan 22 2021 Tom Stellard <tstellar@redhat.com> - 0.18.0-2
+* Thu Jun 11 2020 Jerome Marchand <jmarchan@redhat.com> - 0.14.0-2
- Rebuild for clang-11.1.0
+- Remove criticalstat manpage
 - Remove compactsnoop on non x86_64
 - Suggest to use --binary in deadlock
 - Remove non-existent argument from tcpconnect man page
 - Suggest to install the proper kernel-devel version
 - Fix dbstat and dbslower
-* Tue Jan  5 15:08:26 CET 2021 Rafael dos Santos <rdossant@redhat.com> - 0.18.0-1
+* Wed Apr 22 2020 Jerome Marchand <jmarchan@redhat.com> - 0.14.0-1
- Rebase to latest upstream (#1912875)
+- Rebase on bcc-0.14.0
-* Fri Oct 30 11:25:46 CET 2020 Rafael dos Santos <rdossant@redhat.com> - 0.17.0-1
+* Wed Dec 04 2019 Jerome Marchand <jmarchan@redhat.com> - 0.11.0-2
- Rebase to latest upstream (#1871417)
+- Add -c option ton the synopsis of tcpretrans manpage
-* Mon Oct 12 2020 Jerome Marchand <jmarchan@redhat.com> - 0.16.0.3
+* Tue Nov 26 2019 Jerome Marchand <jmarchan@redhat.com> - 0.11.0-1
- Rebuild for LLVM 11.0.0-rc6
+- Rebase to bcc-0.11.0
 - Reinstate the unstable comment patch that has been removed by mistake
-* Fri Aug 28 2020 Rafael dos Santos <rdossant@redhat.com> - 0.16.0-2
+* Thu Oct 17 2019 Jerome Marchand <jmarchan@redhat.com> - 0.10.0-1
- Enable build for armv7hl
+- Rebase to bcc-0.10.0
 - Drop criticalstat
 - Fix regression on vfscount and runqslower
 - Rebuild on LLVM 9
-* Sun Aug 23 2020 Rafael dos Santos <rdossant@redhat.com> - 0.16.0-1
+* Tue Aug 06 2019 Jerome Marchand <jmarchan@redhat.com> - 0.8.0-4
- Rebase to latest upstream (#1871417)
+- remove unstable statement from the man pages
-* Tue Aug 04 2020 Rafael dos Santos <rdossant@redhat.com> - 0.15.0-6
+* Wed Jul 03 2019 Jerome Marchand <jmarchan@redhat.com> - 0.8.0-3
- Fix build with cmake (#1863243)
+- fix b.support_raw_tracepoint
 - fix runqslower warning
-* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.15.0-5
+* Wed May 15 2019 Jerome Marchand <jmarchan@redhat.com> - 0.8.0-2
- Second attempt - Rebuilt for
+- Rebuild for llvm 8
  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.15.0-4
+* Thu Apr 11 2019 Jerome Marchand <jmarchan@redhat.com> - 0.8.0-1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+- Rebase on bcc-8.0.0
 - Replace the temporary s390x workaround by a proper fix
 - Remove the doc of excluded tool from the package
 - Fix print_log2_hist
 - Fix yet a few other python3 bytes vs strings issues
-* Thu Jul 09 2020 Tom Stellard <tstellar@redhat.com> - 0.15.0-3
+* Mon Mar 25 2019 Jerome Marchand <jmarchan@redhat.com> - 0.7.0-6
- Drop llvm-static dependency
+- Add CI gating
 - https://docs.fedoraproject.org/en-US/packaging-guidelines/#_statically_linking_executables
-* Thu Jul 02 2020 Rafael dos Santos <rdossant@redhat.com> - 0.15.0-2
+* Thu Dec 13 2018 Jerome Marchand <jmarchan@redhat.com> - 0.7.0-5
- Reinstate a function needed by bpftrace
+- Fix biolatency -D
 - Fix biotop manpage
 - Rebuild for LLVM 7.0.1 (from Tom Stellard)
-* Tue Jun 23 2020 Rafael dos Santos <rdossant@redhat.com> - 0.15.0-1
+* Mon Dec 10 2018 Jerome Marchand <jmarchan@redhat.com> - 0.7.0-4
- Rebase to latest upstream version (#1849239)
+- Fix bio* tools
-* Tue May 26 2020 Miro Hrončok <mhroncok@redhat.com> - 0.14.0-2
+* Mon Nov 05 2018 Jerome Marchand <jmarchan@redhat.com> - 0.7.0-3
- Rebuilt for Python 3.9
+- Fix multiple bytes/string encoding issues
 - Fix misc covscan warning
-* Tue Apr 21 2020 Rafael dos Santos <rdossant@redhat.com> - 0.14.0-1
+* Mon Oct 15 2018 Tom Stellard <tstellar@redhat.com> - 0.7.0-2
- Rebase to latest upstream version (#1826281)
+- Drop explicit dependency on clang-libs
-* Wed Feb 26 2020 Rafael dos Santos <rdossant@redhat.com> - 0.13.0-1
+* Fri Oct 12 2018 Jerome Marchand <jmarchan@redhat.com> - 0.7.0-1
- Rebase to latest upstream version (#1805072)
+- Rebase on bcc-7.0.0
 - Remove useless tools (zfs*, btrfs* and inject) 
-* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.12.0-3
+* Thu Sep 20 2018 Jerome Marchand <jmarchan@redhat.com> - 0.6.1-1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+- Rebase on bcc-0.6.1
-* Mon Jan 06 2020 Tom Stellard <tstellar@redhat.com> - 0.12.0-2
+* Thu Sep 20 2018 Jerome Marchand <jmarchan@redhat.com> - 0.6.0-6
- Link against libclang-cpp.so
+- llcstat: print a nicer error message on virtual machine
- https://fedoraproject.org/wiki/Changes/Stop-Shipping-Individual-Component-Libraries-In-clang-lib-Package
+- Add NSS support to sslsniff
 - Fixes miscellaneous error uncovered by covscan
-* Tue Dec 17 2019 Rafael dos Santos <rdossant@redhat.com> - 0.12.0-1
+* Wed Aug 08 2018 Tom Stellard <tstellar@redhat.com> - 0.6.0-5
- Rebase to latest upstream version (#1758417)
+- Use llvm-toolset-6.0 prefix for clang-libs dependency
-* Thu Dec 05 2019 Jiri Olsa <jolsa@redhat.com> - 0.11.0-2
+* Fri Aug 03 2018 Tom Stellard <tstellar@redhat.com> - 0.6.0-4
- Add libbpf support
+- Rebuld for llvm-toolset-6.0
-* Fri Oct 04 2019 Rafael dos Santos <rdossant@redhat.com> - 0.11.0-1
+* Wed Jul 18 2018 Jerome Marchand <jmarchan@redhat.com> - 0.6.0-3
- Rebase to latest upstream version (#1758417)
+ - Disable lua on all arches
-* Thu Oct 03 2019 Miro Hrončok <mhroncok@redhat.com> - 0.10.0-4
+* Tue Jun 26 2018 Jerome Marchand <jmarchan@redhat.com> - 0.6.0-2
- Rebuilt for Python 3.8.0rc1 (#1748018)
+- Add clang-libs requirement
 - Fix manpages symlinks
-* Mon Aug 19 2019 Miro Hrončok <mhroncok@redhat.com> - 0.10.0-3
+* Tue Jun 19 2018 Jerome Marchand <jmarchan@redhat.com> - 0.6.0-1
- Rebuilt for Python 3.8
+- Rebase on bcc-0.6.0
-* Wed Jul 24 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.10.0-2
+* Thu May 24 2018 Jerome Marchand <jmarchan@redhat.com> - 0.5.0-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+- Enables build on ppc64(le) and s390x arches
 * Wed May 29 2019 Rafael dos Santos <rdossant@redhat.com> - 0.10.0-1
 - Rebase to latest upstream version (#1714902)
 * Thu Apr 25 2019 Rafael dos Santos <rdossant@redhat.com> - 0.9.0-1
 - Rebase to latest upstream version (#1686626)
 - Rename libbpf header to libbcc_bpf
 * Mon Apr 22 2019 Neal Gompa <ngompa@datto.com> - 0.8.0-5
 - Make the Python 3 bindings package noarch
 - Small cleanups to the spec
 * Tue Mar 19 2019 Rafael dos Santos <rdossant@redhat.com> - 0.8.0-4
 - Add s390x support (#1679310)
 * Wed Feb 20 2019 Rafael dos Santos <rdossant@redhat.com> - 0.8.0-3
 - Add aarch64 support (#1679310)
 * Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.8.0-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
 * Thu Jan 17 2019 Rafael dos Santos <rdossant@redhat.com> - 0.8.0-1
 - Rebase to new released version
 * Thu Nov 01 2018 Rafael dos Santos <rdossant@redhat.com> - 0.7.0-4
 - Fix attaching to usdt probes (#1634684)
 * Mon Oct 22 2018 Rafael dos Santos <rdossant@redhat.com> - 0.7.0-3
 - Fix encoding of non-utf8 characters (#1516678)
 - Fix str-bytes conversion in killsnoop (#1637515)
 * Sat Oct 06 2018 Rafael dos Santos <rdossant@redhat.com> - 0.7.0-2
 - Fix str/bytes conversion in uflow (#1636293)
 * Tue Sep 25 2018 Rafael Fonseca <r4f4rfs@gmail.com> - 0.7.0-1
 - Rebase to new released version
 * Wed Aug 22 2018 Rafael Fonseca <r4f4rfs@gmail.com> - 0.6.1-2
 - Fix typo when mangling shebangs.
 * Thu Aug 16 2018 Rafael Fonseca <r4f4rfs@gmail.com> - 0.6.1-1
 - Rebase to new released version (#1609485)
 * Thu Jul 12 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.6.0-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
 * Tue Jun 19 2018 Miro Hrončok <mhroncok@redhat.com> - 0.6.0-2
 - Rebuilt for Python 3.7
 * Mon Jun 18 2018 Rafael dos Santos <rdossant@redhat.com> - 0.6.0-1
 - Rebase to new released version (#1591989)
 * Thu Apr 05 2018 Rafael Santos <rdossant@redhat.com> - 0.5.0-4
 - Resolves #1555627 - fix compilation error with latest llvm/clang
`@ -1 +1 @@`
	`26ec7f9fc22494b9b6f20cd38ca216edc130704e SOURCES/bcc-0.30.0.tar.gz`	`059187f62e915eb74ea7b18e19fcb185f9d18255 SOURCES/bcc-0.25.0.tar.gz`
		`@ -1 +1 @@`
			`SOURCES/bcc-0.30.0.tar.gz`				`SOURCES/bcc-0.25.0.tar.gz`