diff --git a/SOURCES/bcc-0.25.0-Fix-compilation-error-when-built-with-llvm17.patch b/SOURCES/bcc-0.25.0-Fix-compilation-error-when-built-with-llvm17.patch new file mode 100644 index 0000000..e0107f7 --- /dev/null +++ b/SOURCES/bcc-0.25.0-Fix-compilation-error-when-built-with-llvm17.patch @@ -0,0 +1,48 @@ +From 30e77ce4e5ae11e29b023d9dcd7f6dd70cae73fa Mon Sep 17 00:00:00 2001 +From: Yonghong Song +Date: Sun, 26 Mar 2023 13:10:49 -0700 +Subject: [PATCH 3/3] Fix compilation error when built with llvm17 + +With llvm17, building bcc hits the following compilation errors: + ... + /home/yhs/work/bcc/src/cc/bpf_module.cc:21:10: fatal error: llvm-c/Transforms/IPO.h: No such file or directory + 21 | #include + | ^~~~~~~~~~~~~~~~~~~~~~~~~ + /home/yhs/work/bcc/src/cc/bpf_module.cc:48:10: fatal error: llvm/Transforms/IPO/PassManagerBuilder.h: No such file or directory + 48 | #include + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +The above two files are removed by https://reviews.llvm.org/D144970 and https://reviews.llvm.org/D145835 + +Signed-off-by: Yonghong Song +--- + src/cc/bpf_module.cc | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/cc/bpf_module.cc b/src/cc/bpf_module.cc +index 0f4a4f58..29868134 100644 +--- a/src/cc/bpf_module.cc ++++ b/src/cc/bpf_module.cc +@@ -17,7 +17,9 @@ + + #include + #include ++#if LLVM_MAJOR_VERSION <= 16 + #include ++#endif + #include + #include + #if LLVM_MAJOR_VERSION >= 16 +@@ -43,7 +45,9 @@ + #include + #include + #include ++#if LLVM_MAJOR_VERSION <= 16 + #include ++#endif + #include + #include + #include +-- +2.41.0 + diff --git a/SOURCES/bcc-0.25.0-tools-tcpstates-fix-IPv6-journal.patch b/SOURCES/bcc-0.25.0-tools-tcpstates-fix-IPv6-journal.patch new file mode 100644 index 0000000..18f7aba --- /dev/null +++ b/SOURCES/bcc-0.25.0-tools-tcpstates-fix-IPv6-journal.patch @@ -0,0 +1,156 @@ +From e1f462c14bc8f22f579d5594b61a89d41d10a022 Mon Sep 17 00:00:00 2001 +From: Jerome Marchand +Date: Wed, 1 Feb 2023 17:30:03 +0100 +Subject: [PATCH 2/3] tools/tcpstates: fix IPv6 journal + +When logging ipv6 state change, journal_fields tries to pack +event.addr and event.daddr, which is not an integer in this, to +present a bytes-like object to socket.inet_ntop. This can be fixed by +having a similar type for [sd]addr for IPv4 and IPv6. Making both an +array of u32 solves the issue by presenting a bytes-like object +directly to inet_ntop, without the need for the struct packing stage. + +Also now, the similar behavior, makes it easier to factor code for +IPv4 and IPv6. + +It solves the following error: +/usr/share/bcc/tools/tcpstates -Y +SKADDR C-PID C-COMM LADDR LPORT RADDR RPORT OLDSTATE -> NEWSTATE MS +ffff8b2e83e56180 0 swapper/9 :: 22 :: 0 LISTEN -> SYN_RECV 0.000 +Exception ignored on calling ctypes callback function: .raw_cb_ at 0x7f894c8d7f70> +Traceback (most recent call last): + File "/usr/lib/python3.9/site-packages/bcc/table.py", line 982, in raw_cb_ + callback(cpu, data, size) + File "/usr/share/bcc/tools/tcpstates", line 419, in print_ipv6_event + journal.send(**journal_fields(event, AF_INET6)) + File "/usr/share/bcc/tools/tcpstates", line 348, in journal_fields + 'OBJECT_' + addr_pfx + '_SOURCE_ADDRESS': inet_ntop(addr_family, pack("I", event.saddr)), +struct.error: required argument is not an integer +ffff8b2e83e56180 0 swapper/9 2620:52:0:2580:5054:ff:fe6b:6f1f 22 2620:52:0:2b11:2f5e:407d:b35d:4663 60396 SYN_RECV -> ESTABLISHED 0.010 +Exception ignored on calling ctypes callback function: .raw_cb_ at 0x7f894c8d7f70> +Traceback (most recent call last): + File "/usr/lib/python3.9/site-packages/bcc/table.py", line 982, in raw_cb_ + callback(cpu, data, size) + File "/usr/share/bcc/tools/tcpstates", line 419, in print_ipv6_event + journal.send(**journal_fields(event, AF_INET6)) + File "/usr/share/bcc/tools/tcpstates", line 348, in journal_fields + 'OBJECT_' + addr_pfx + '_SOURCE_ADDRESS': inet_ntop(addr_family, pack("I", event.saddr)), +struct.error: required argument is not an integer + +Signed-off-by: Jerome Marchand +--- + tools/tcpstates.py | 55 +++++++++++++++++----------------------------- + 1 file changed, 20 insertions(+), 35 deletions(-) + +diff --git a/tools/tcpstates.py b/tools/tcpstates.py +index d9d6e4c7..0507cc10 100755 +--- a/tools/tcpstates.py ++++ b/tools/tcpstates.py +@@ -19,7 +19,6 @@ from __future__ import print_function + from bcc import BPF + import argparse + from socket import inet_ntop, AF_INET, AF_INET6 +-from struct import pack + from time import strftime, time + from os import getuid + +@@ -78,8 +77,8 @@ BPF_HASH(last, struct sock *, u64); + struct ipv4_data_t { + u64 ts_us; + u64 skaddr; +- u32 saddr; +- u32 daddr; ++ u32 saddr[1]; ++ u32 daddr[1]; + u64 span_us; + u32 pid; + u16 lport; +@@ -93,8 +92,8 @@ BPF_PERF_OUTPUT(ipv4_events); + struct ipv6_data_t { + u64 ts_us; + u64 skaddr; +- unsigned __int128 saddr; +- unsigned __int128 daddr; ++ u32 saddr[4]; ++ u32 daddr[4]; + u64 span_us; + u32 pid; + u16 lport; +@@ -350,9 +349,9 @@ format_string = ("%-16x %-5d %-10.10s %s%-15s %-5d %-15s %-5d %-11s " + + 'OBJECT_PID': str(event.pid), + 'OBJECT_COMM': event.task.decode('utf-8', 'replace'), + # Custom fields, aka "stuff we sort of made up". +- 'OBJECT_' + addr_pfx + '_SOURCE_ADDRESS': inet_ntop(addr_family, pack("I", event.saddr)), ++ 'OBJECT_' + addr_pfx + '_SOURCE_ADDRESS': inet_ntop(addr_family, event.saddr), + 'OBJECT_TCP_SOURCE_PORT': str(event.lport), +- 'OBJECT_' + addr_pfx + '_DESTINATION_ADDRESS': inet_ntop(addr_family, pack("I", event.daddr)), ++ 'OBJECT_' + addr_pfx + '_DESTINATION_ADDRESS': inet_ntop(addr_family, event.daddr), + 'OBJECT_TCP_DESTINATION_PORT': str(event.dport), + 'OBJECT_TCP_OLD_STATE': tcpstate2str(event.oldstate), + 'OBJECT_TCP_NEW_STATE': tcpstate2str(event.newstate), +@@ -373,8 +372,7 @@ format_string = ("%-16x %-5d %-10.10s %s%-15s %-5d %-15s %-5d %-11s " + + return fields + + # process event +-def print_ipv4_event(cpu, data, size): +- event = b["ipv4_events"].event(data) ++def print_event(event, addr_family): + global start_ts + if args.time: + if args.csv: +@@ -389,39 +387,26 @@ format_string = ("%-16x %-5d %-10.10s %s%-15s %-5d %-15s %-5d %-11s " + + print("%.6f," % delta_s, end="") + else: + print("%-9.6f " % delta_s, end="") ++ if addr_family == AF_INET: ++ version = "4" ++ else: ++ version = "6" + print(format_string % (event.skaddr, event.pid, event.task.decode('utf-8', 'replace'), +- "4" if args.wide or args.csv else "", +- inet_ntop(AF_INET, pack("I", event.saddr)), event.lport, +- inet_ntop(AF_INET, pack("I", event.daddr)), event.dport, ++ version if args.wide or args.csv else "", ++ inet_ntop(addr_family, event.saddr), event.lport, ++ inet_ntop(addr_family, event.daddr), event.dport, + tcpstate2str(event.oldstate), tcpstate2str(event.newstate), + float(event.span_us) / 1000)) + if args.journal: +- journal.send(**journal_fields(event, AF_INET)) ++ journal.send(**journal_fields(event, addr_family)) ++ ++def print_ipv4_event(cpu, data, size): ++ event = b["ipv4_events"].event(data) ++ print_event(event, AF_INET) + + def print_ipv6_event(cpu, data, size): + event = b["ipv6_events"].event(data) +- global start_ts +- if args.time: +- if args.csv: +- print("%s," % strftime("%H:%M:%S"), end="") +- else: +- print("%-8s " % strftime("%H:%M:%S"), end="") +- if args.timestamp: +- if start_ts == 0: +- start_ts = event.ts_us +- delta_s = (float(event.ts_us) - start_ts) / 1000000 +- if args.csv: +- print("%.6f," % delta_s, end="") +- else: +- print("%-9.6f " % delta_s, end="") +- print(format_string % (event.skaddr, event.pid, event.task.decode('utf-8', 'replace'), +- "6" if args.wide or args.csv else "", +- inet_ntop(AF_INET6, event.saddr), event.lport, +- inet_ntop(AF_INET6, event.daddr), event.dport, +- tcpstate2str(event.oldstate), tcpstate2str(event.newstate), +- float(event.span_us) / 1000)) +- if args.journal: +- journal.send(**journal_fields(event, AF_INET6)) ++ print_event(event, AF_INET6) + + # initialize BPF + b = BPF(text=bpf_text) +-- +2.41.0 + diff --git a/SOURCES/bcc-0.25.0-tools-tcpstates-fix-context-ptr-modified-error.patch b/SOURCES/bcc-0.25.0-tools-tcpstates-fix-context-ptr-modified-error.patch new file mode 100644 index 0000000..7c1149e --- /dev/null +++ b/SOURCES/bcc-0.25.0-tools-tcpstates-fix-context-ptr-modified-error.patch @@ -0,0 +1,144 @@ +From 28bf4c3eb6949722d3d7af912f6802e282e51e90 Mon Sep 17 00:00:00 2001 +From: hejun01 +Date: Thu, 29 Jun 2023 20:24:07 +0800 +Subject: [PATCH 1/3] tools/tcpstates: fix context ptr modified error + +Introduce local variable tcp_new_state, +to avoid llvm optimization of args->newstate, +which will cause context ptr args modified. +spilt event.ports to lport and dport. +switch type of TCP state from unsigned int to int. +--- + tools/tcpstates.py | 47 +++++++++++++++++++++++++--------------------- + 1 file changed, 26 insertions(+), 21 deletions(-) + +diff --git a/tools/tcpstates.py b/tools/tcpstates.py +index 1fa2c26a..d9d6e4c7 100755 +--- a/tools/tcpstates.py ++++ b/tools/tcpstates.py +@@ -82,9 +82,10 @@ struct ipv4_data_t { + u32 daddr; + u64 span_us; + u32 pid; +- u32 ports; +- u32 oldstate; +- u32 newstate; ++ u16 lport; ++ u16 dport; ++ int oldstate; ++ int newstate; + char task[TASK_COMM_LEN]; + }; + BPF_PERF_OUTPUT(ipv4_events); +@@ -96,9 +97,10 @@ struct ipv6_data_t { + unsigned __int128 daddr; + u64 span_us; + u32 pid; +- u32 ports; +- u32 oldstate; +- u32 newstate; ++ u16 lport; ++ u16 dport; ++ int oldstate; ++ int newstate; + char task[TASK_COMM_LEN]; + }; + BPF_PERF_OUTPUT(ipv6_events); +@@ -132,6 +134,9 @@ TRACEPOINT_PROBE(sock, inet_sock_set_state) + u16 family = args->family; + FILTER_FAMILY + ++ // workaround to avoid llvm optimization which will cause context ptr args modified ++ int tcp_newstate = args->newstate; ++ + if (args->family == AF_INET) { + struct ipv4_data_t data4 = { + .span_us = delta_us, +@@ -141,8 +146,8 @@ TRACEPOINT_PROBE(sock, inet_sock_set_state) + data4.ts_us = bpf_ktime_get_ns() / 1000; + __builtin_memcpy(&data4.saddr, args->saddr, sizeof(data4.saddr)); + __builtin_memcpy(&data4.daddr, args->daddr, sizeof(data4.daddr)); +- // a workaround until data4 compiles with separate lport/dport +- data4.ports = dport + ((0ULL + lport) << 16); ++ data4.lport = lport; ++ data4.dport = dport; + data4.pid = pid; + + bpf_get_current_comm(&data4.task, sizeof(data4.task)); +@@ -157,14 +162,14 @@ TRACEPOINT_PROBE(sock, inet_sock_set_state) + data6.ts_us = bpf_ktime_get_ns() / 1000; + __builtin_memcpy(&data6.saddr, args->saddr_v6, sizeof(data6.saddr)); + __builtin_memcpy(&data6.daddr, args->daddr_v6, sizeof(data6.daddr)); +- // a workaround until data6 compiles with separate lport/dport +- data6.ports = dport + ((0ULL + lport) << 16); ++ data6.lport = lport; ++ data6.dport = dport; + data6.pid = pid; + bpf_get_current_comm(&data6.task, sizeof(data6.task)); + ipv6_events.perf_submit(args, &data6, sizeof(data6)); + } + +- if (args->newstate == TCP_CLOSE) { ++ if (tcp_newstate == TCP_CLOSE) { + last.delete(&sk); + } else { + u64 ts = bpf_ktime_get_ns(); +@@ -210,8 +215,8 @@ int kprobe__tcp_set_state(struct pt_regs *ctx, struct sock *sk, int state) + data4.ts_us = bpf_ktime_get_ns() / 1000; + data4.saddr = sk->__sk_common.skc_rcv_saddr; + data4.daddr = sk->__sk_common.skc_daddr; +- // a workaround until data4 compiles with separate lport/dport +- data4.ports = dport + ((0ULL + lport) << 16); ++ data4.lport = lport; ++ data4.dport = dport; + data4.pid = pid; + + bpf_get_current_comm(&data4.task, sizeof(data4.task)); +@@ -228,8 +233,8 @@ int kprobe__tcp_set_state(struct pt_regs *ctx, struct sock *sk, int state) + sk->__sk_common.skc_v6_rcv_saddr.in6_u.u6_addr32); + bpf_probe_read_kernel(&data6.daddr, sizeof(data6.daddr), + sk->__sk_common.skc_v6_daddr.in6_u.u6_addr32); +- // a workaround until data6 compiles with separate lport/dport +- data6.ports = dport + ((0ULL + lport) << 16); ++ data6.lport = lport; ++ data6.dport = dport; + data6.pid = pid; + bpf_get_current_comm(&data6.task, sizeof(data6.task)); + ipv6_events.perf_submit(ctx, &data6, sizeof(data6)); +@@ -346,9 +351,9 @@ format_string = ("%-16x %-5d %-10.10s %s%-15s %-5d %-15s %-5d %-11s " + + 'OBJECT_COMM': event.task.decode('utf-8', 'replace'), + # Custom fields, aka "stuff we sort of made up". + 'OBJECT_' + addr_pfx + '_SOURCE_ADDRESS': inet_ntop(addr_family, pack("I", event.saddr)), +- 'OBJECT_TCP_SOURCE_PORT': str(event.ports >> 16), ++ 'OBJECT_TCP_SOURCE_PORT': str(event.lport), + 'OBJECT_' + addr_pfx + '_DESTINATION_ADDRESS': inet_ntop(addr_family, pack("I", event.daddr)), +- 'OBJECT_TCP_DESTINATION_PORT': str(event.ports & 0xffff), ++ 'OBJECT_TCP_DESTINATION_PORT': str(event.dport), + 'OBJECT_TCP_OLD_STATE': tcpstate2str(event.oldstate), + 'OBJECT_TCP_NEW_STATE': tcpstate2str(event.newstate), + 'OBJECT_TCP_SPAN_TIME': str(event.span_us) +@@ -386,8 +391,8 @@ format_string = ("%-16x %-5d %-10.10s %s%-15s %-5d %-15s %-5d %-11s " + + print("%-9.6f " % delta_s, end="") + print(format_string % (event.skaddr, event.pid, event.task.decode('utf-8', 'replace'), + "4" if args.wide or args.csv else "", +- inet_ntop(AF_INET, pack("I", event.saddr)), event.ports >> 16, +- inet_ntop(AF_INET, pack("I", event.daddr)), event.ports & 0xffff, ++ inet_ntop(AF_INET, pack("I", event.saddr)), event.lport, ++ inet_ntop(AF_INET, pack("I", event.daddr)), event.dport, + tcpstate2str(event.oldstate), tcpstate2str(event.newstate), + float(event.span_us) / 1000)) + if args.journal: +@@ -411,8 +416,8 @@ format_string = ("%-16x %-5d %-10.10s %s%-15s %-5d %-15s %-5d %-11s " + + print("%-9.6f " % delta_s, end="") + print(format_string % (event.skaddr, event.pid, event.task.decode('utf-8', 'replace'), + "6" if args.wide or args.csv else "", +- inet_ntop(AF_INET6, event.saddr), event.ports >> 16, +- inet_ntop(AF_INET6, event.daddr), event.ports & 0xffff, ++ inet_ntop(AF_INET6, event.saddr), event.lport, ++ inet_ntop(AF_INET6, event.daddr), event.dport, + tcpstate2str(event.oldstate), tcpstate2str(event.newstate), + float(event.span_us) / 1000)) + if args.journal: +-- +2.41.0 + diff --git a/SPECS/bcc.spec b/SPECS/bcc.spec index 3cd4c71..71768c8 100644 --- a/SPECS/bcc.spec +++ b/SPECS/bcc.spec @@ -9,7 +9,7 @@ Name: bcc Version: 0.25.0 -Release: 5%{?dist} +Release: 7%{?dist} Summary: BPF Compiler Collection (BCC) License: ASL 2.0 URL: https://github.com/iovisor/bcc @@ -26,6 +26,10 @@ Patch8: %{name}-%{version}-tools-compactsnoop.py-Fix-raw_tracepoint-Inva Patch9: %{name}-%{version}-Revert-tools-Fix-bindsnoop-for-kernel-v5.6.patch Patch10: %{name}-%{version}-tools-nfsslower.py-Fix-uninitialized-struct-pad-erro.patch Patch11: %{name}-%{version}-Fix-a-llvm-compilation-error.patch +Patch12: %{name}-%{version}-Fix-compilation-error-when-built-with-llvm17.patch +Patch13: %{name}-%{version}-tools-tcpstates-fix-context-ptr-modified-error.patch +Patch14: %{name}-%{version}-tools-tcpstates-fix-IPv6-journal.patch + # Arches will be included as upstream support is added and dependencies are # satisfied in the respective arches @@ -223,6 +227,13 @@ done %changelog +* Wed Nov 08 2023 Jerome Marchand - 0.25.0-7 +- Fix repo URL in tests.yml + +* Wed Nov 01 2023 Jerome Marchand - 0.25.0-6 +- Rebuild on LLVM 17 (RHEL-10689) +- Fix IPv6 for tcpstates (RHEL-8522) + * Mon Jun 12 2023 Jerome Marchand - 0.25.0-5 - Fix LLVM 16 build