Re: [PATCH 1/2] BCC: Python: Support 'fmod_ret' method for eBPF

[Gang Yan <yangang@kylinos.cn>]

On Mon, Apr 07, 2025 at 11:07:41AM +0200, Matthieu Baerts wrote:
Hi Matt,


> Hi Gang,
> 
> On 07/04/2025 04:37, Gang Yan wrote:
> > In kernel, there exists a lot of 'fmod_ret' functions, such as
> > 'update_socket_protocol'. But it cannot be attached in BCC-python
> > directly, so this patch provides an interface for Python to use
> > 'fmod_ret' attaching method.
> > 
> > Signed-off-by: Gang Yan <yangang@kylinos.cn>
> > ---
> >  src/python/bcc/__init__.py | 43 ++++++++++++++++++++++++++++++++++++++
> >  1 file changed, 43 insertions(+)
> > 
> > diff --git a/src/python/bcc/__init__.py b/src/python/bcc/__init__.py
> > index 8bc85516..96de3d40 100644
> > --- a/src/python/bcc/__init__.py
> > +++ b/src/python/bcc/__init__.py
> > @@ -461,6 +461,7 @@ class BPF(object):
> >          self.raw_tracepoint_fds = {}
> >          self.kfunc_entry_fds = {}
> >          self.kfunc_exit_fds = {}
> > +        self.fmod_ret_fds = {}
> >          self.lsm_fds = {}
> >          self.perf_buffers = {}
> >          self.open_perf_events = {}
> > @@ -1157,6 +1158,21 @@ class BPF(object):
> >              return True
> >          return False
> >  
> > +    @staticmethod
> > +    def support_fmod_ret():
> > +        if not BPF.support_kfunc():
> > +            return False
> > +
> > +        kernel_version = platform.release()
> > +        major, minor, _ = kernel_version.split(".")
> > +
> > +        if int(major) > 5:
> > +            return True
> > +        elif int(major) ==5 and int(minor) >= 6:
> 
> Was it not introduced in v5.7 instead of v5.6?
> 
>   return int(major) > 5 or (int(major) == 5 and int(minor) >= 7)
> 
I think v5.7 is right, the 5.6 is from the bcc repo:

bcc/example/cpp/KModRetExample.cc:
	 * Kfunc modify_ret support is only available at kernel version 5.6 and later.

Maybe this is also need to be fixed later?

> 
> https://lore.kernel.org/20200304191853.1529-1-kpsingh@chromium.org
> 
> 
> But also, it feels wrong to look at the kernel version, in case of
> backports, etc. Can you not look at something else? e.g. kallsyms?
>

Do you think we can do this after making a PR first?

> Cheers,
> Matt
> -- 
> Sponsored by the NGI0 Core fund.
> 
>