tcp* bpfcc programs fail to run, compile error

[Andreas Hasenack]

On jammy
bpfcc-tools 0.18.0+ds-2

# uname -a
Linux nsn7 5.15.0-25-generic #25-Ubuntu SMP Wed Mar 30 15:54:22 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

root@nsn7:~# tcpaccept-bpfcc
In file included from <built-in>:2:
In file included from /virtual/include/bcc/bpf.h:12:
In file included from include/linux/types.h:6:
In file included from include/uapi/linux/types.h:14:
In file included from include/uapi/linux/posix_types.h:5:
In file included from include/linux/stddef.h:5:
In file included from include/uapi/linux/stddef.h:2:
In file included from include/linux/compiler_types.h:80:
include/linux/compiler-clang.h:41:9: warning: '__HAVE_BUILTIN_BSWAP32__' macro redefined [-Wmacro-redefined]
#define __HAVE_BUILTIN_BSWAP32__
        ^
<command line>:4:9: note: previous definition is here
#define __HAVE_BUILTIN_BSWAP32__ 1
        ^
In file included from <built-in>:2:
In file included from /virtual/include/bcc/bpf.h:12:
In file included from include/linux/types.h:6:
In file included from include/uapi/linux/types.h:14:
In file included from include/uapi/linux/posix_types.h:5:
In file included from include/linux/stddef.h:5:
In file included from include/uapi/linux/stddef.h:2:
In file included from include/linux/compiler_types.h:80:
include/linux/compiler-clang.h:42:9: warning: '__HAVE_BUILTIN_BSWAP64__' macro redefined [-Wmacro-redefined]
#define __HAVE_BUILTIN_BSWAP64__
        ^
<command line>:5:9: note: previous definition is here
#define __HAVE_BUILTIN_BSWAP64__ 1
        ^
In file included from <built-in>:2:
In file included from /virtual/include/bcc/bpf.h:12:
In file included from include/linux/types.h:6:
In file included from include/uapi/linux/types.h:14:
In file included from include/uapi/linux/posix_types.h:5:
In file included from include/linux/stddef.h:5:
In file included from include/uapi/linux/stddef.h:2:
In file included from include/linux/compiler_types.h:80:
include/linux/compiler-clang.h:43:9: warning: '__HAVE_BUILTIN_BSWAP16__' macro redefined [-Wmacro-redefined]
#define __HAVE_BUILTIN_BSWAP16__
        ^
<command line>:3:9: note: previous definition is here
#define __HAVE_BUILTIN_BSWAP16__ 1
        ^
In file included from /virtual/main.c:15:
In file included from include/net/sock.h:46:
In file included from include/linux/netdevice.h:41:
In file included from include/net/netprio_cgroup.h:11:
In file included from include/linux/cgroup.h:28:
In file included from include/linux/cgroup-defs.h:22:
In file included from include/linux/bpf-cgroup.h:5:
include/linux/bpf.h:211:35: error: invalid application of 'sizeof' to an incomplete type 'struct bpf_timer'
                memset(dst + map->timer_off, 0, sizeof(struct bpf_timer));
                                                ^ ~~~~~~~~~~~~~~~~~~
include/linux/bpf.h:211:49: note: forward declaration of 'struct bpf_timer'
                memset(dst + map->timer_off, 0, sizeof(struct bpf_timer));
                                                              ^
include/linux/bpf.h:225:10: error: invalid application of 'sizeof' to an incomplete type 'struct bpf_timer'
                t_sz = sizeof(struct bpf_timer);
                       ^ ~~~~~~~~~~~~~~~~~~
include/linux/bpf.h:225:24: note: forward declaration of 'struct bpf_timer'
                t_sz = sizeof(struct bpf_timer);
                                     ^
In file included from /virtual/main.c:15:
In file included from include/net/sock.h:59:
include/linux/filter.h:1518:44: error: use of undeclared identifier 'BPF_F_BROADCAST'; did you mean 'IFF_BROADCAST'?
        if (unlikely(!ri->tgt_value) && !(flags & BPF_F_BROADCAST)) {
                                                  ^~~~~~~~~~~~~~~
                                                  IFF_BROADCAST
include/uapi/linux/if.h:86:2: note: 'IFF_BROADCAST' declared here
        IFF_BROADCAST = 1<<1, /* volatile */
        ^
In file included from /virtual/main.c:15:
In file included from include/net/sock.h:59:
include/linux/filter.h:1533:14: error: use of undeclared identifier 'BPF_F_BROADCAST'; did you mean 'IFF_BROADCAST'?
        if (flags & BPF_F_BROADCAST) {
                    ^~~~~~~~~~~~~~~
                    IFF_BROADCAST
include/uapi/linux/if.h:86:2: note: 'IFF_BROADCAST' declared here
        IFF_BROADCAST = 1<<1, /* volatile */
        ^
3 warnings and 4 errors generated.
Traceback (most recent call last):
  File "/usr/sbin/tcpaccept-bpfcc", line 240, in <module>
    b = BPF(text=bpf_text)
  File "/usr/lib/python3/dist-packages/bcc/__init__.py", line 364, in __init__
    raise Exception("Failed to compile BPF module %s" % (src_file or "<text>"))
Exception: Failed to compile BPF module <text>

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[megastallman (megastallman)]

Gyus, recently this bug was fixed in upstream. I've built version 0.25 and it works well.

If you want to build it manually - just build from sources with /usr or /usr/local prefix - https://github.com/iovisor/bcc/issues/3993 , or symlink python and native libs as I did.

[Junien F (axino)]

@ahasenack would the fixes described in https://github.com/Yelp/pidtree-bcc/pull/82 be accepted as a fix for this bug ?

The diff is basically https://pastebin.ubuntu.com/p/B9sFTVPxXd/

I've tried to include the headers where these macro/enums are defined, but for some reason that doesn't help. Adding them inline does help.

I don't think this ties the package to the kernel version more than it already is.

Another solution would be to backport a more recent version, but that would mean a whole lot more changes to SRU.

Thanks !

[Andreas Hasenack (ahasenack)]

> @ahasenack would the fixes described in https://github.com/Yelp/pidtree-bcc/pull/82 be accepted as a fix for this bug ?

I don't know. An SRU is more than just a patch.

Would that work with the release, and hwe kernels?

What are the risks? Is there any change in behavior? Is it needed for later ubuntu releases too, including devel? What's the root cause? And so on...

[Eric Edgar (rocketman110)]

bcc release v0.28.0 Latest
Support for kernel up to 6.3.

[Christian Ehrhardt  (paelzer)]

I can confirm this works well in noble with 0.29.1+ds-1ubuntu2

$ sudo tcpaccept-bpfcc
PID COMM IP RADDR RPORT LADDR LPORT
12488 sshd 6 ::ffff:10.3.134.1 38346 ::ffff:10.3.134.18 22