menglongdong
commented
2 months ago 建议使用docker来进行编译哈。目前到现在的版本，很多写法已经和具体的clang版本产生了耦合，不是使用nettrace-build容器编译的话，低版本内核可能出现BPF加载的问题。
Closed skrkacha closed 1 month ago
menglongdong
commented
2 months ago 建议使用docker来进行编译哈。目前到现在的版本，很多写法已经和具体的clang版本产生了耦合，不是使用nettrace-build容器编译的话，低版本内核可能出现BPF加载的问题。
运行环境： Ubuntu 20.04.6 LTS 5.4.0-147-generic x86_64
在nettrace目录下执行make all报错： make -C src all make[1]: Entering directory '/mnt/disk/w50011487/workspace_crb/nettrace-master/src' python3 gen_trace.py > trace_group.c python3 gen_trace.py probe > progs/kprobe_trace.h ln -s ../shared/bpf/vmlinux.h kheaders.h clang -O2 -c -S -Wall -fno-asynchronous-unwind-tables \ -Wno-incompatible-pointer-types-discards-qualifiers \ progs/kprobe.c -emit-llvm -Wno-unknown-attributes -I./ -I/mnt/disk/w50011487/workspace_crb/nettrace-master/shared/bpf/ -g -DF_STACK_TRACE -Wno-unused-function -Wno-compare-distinct-pointer-types -Wuninitialized -DTARGET_ARCH_x86 -DBPF_NO_PRESERVE_ACCESS_INDEX -target bpf -Xclang \ -disable-llvm-passes -o - | \ opt -O2 -mtriple=bpf-pc-linux | \ llvm-dis | \ llc -march=bpf -filetype=obj -o progs/kprobe.o In file included from progs/kprobe.c:8: /mnt/disk/w50011487/workspace_crb/nettrace-master/shared/bpf/skb_parse.h:425:7: error: use of unknown builtin 'builtin_preserve_type_info' [-Wimplicit-function-declaration] if (bpf_core_type_exists(struct tcp_sock)) { ^ /usr/include/bpf/bpf_core_read.h:155:2: note: expanded from macro 'bpf_core_type_exists' builtin_preserve_type_info((typeof(type) )0, BPF_TYPE_EXISTS) ^ /mnt/disk/w50011487/workspace_crb/nettrace-master/shared/bpf/skb_parse.h:425:7: note: did you mean 'builtin_preserve_field_info'? /usr/include/bpf/bpf_core_read.h:155:2: note: expanded from macro 'bpf_core_type_exists' builtin_preserve_type_info((typeof(type) )0, BPF_TYPE_EXISTS) ^ /mnt/disk/w50011487/workspace_crb/nettrace-master/shared/bpf/skb_parse.h:409:6: note: 'builtin_preserve_field_info' declared here if (bpf_core_field_size(sk->sk_protocol) == 2) ^ /usr/include/bpf/bpf_core_read.h:127:2: note: expanded from macro 'bpf_core_field_size' builtin_preserve_field_info(field, BPF_FIELD_BYTE_SIZE) ^ In file included from progs/kprobe.c:8: /mnt/disk/w50011487/workspace_crb/nettrace-master/shared/bpf/skb_parse.h:453:7: error: use of unknown builtin 'builtin_preserve_type_info' [-Wimplicit-function-declaration] if (!bpf_core_type_exists(struct inet_connection_sock)) ^ /usr/include/bpf/bpf_core_read.h:155:2: note: expanded from macro 'bpf_core_type_exists' __builtin_preserve_type_info((typeof(type) )0, BPF_TYPE_EXISTS) ^ In file included from progs/kprobe.c:8: /mnt/disk/w50011487/workspace_crb/nettrace-master/shared/bpf/skb_parse.h:459:3: warning: implicit declaration of function 'bpf_core_field_offset' is invalid in C99 [-Wimplicit-function-declaration] bpf_core_field_offset(struct inet_connection_sock, ^ /mnt/disk/w50011487/workspace_crb/nettrace-master/shared/bpf/skb_parse.h:459:25: error: expected expression bpf_core_field_offset(struct inet_connection_sock, ^ /mnt/disk/w50011487/workspace_crb/nettrace-master/shared/bpf/skb_parse.h:460:4: error: use of undeclared identifier 'icsk_retransmits' icsk_retransmits) - ^ /mnt/disk/w50011487/workspace_crb/nettrace-master/shared/bpf/skb_parse.h:425:7: warning: indirection of non-volatile null pointer will be deleted, not trap [-Wnull-dereference] if (bpf_core_type_exists(struct tcp_sock)) { ^
~~~~~~~~ /usr/include/bpf/bpf_core_read.h:155:31: note: expanded from macro 'bpf_core_type_exists' builtin_preserve_type_info((typeof(type) )0, BPF_TYPE_EXISTS) ^~~~~~ /mnt/disk/w50011487/workspace_crb/nettrace-master/shared/bpf/skb_parse.h:425:7: note: consider using builtin_trap() or qualifying pointer with 'volatile' /usr/include/bpf/bpf_core_read.h:155:31: note: expanded from macro 'bpf_core_type_exists' builtin_preserve_type_info((typeof(type) )0, BPF_TYPE_EXISTS) ^ In file included from progs/kprobe.c:8: /mnt/disk/w50011487/workspace_crb/nettrace-master/shared/bpf/skb_parse.h:453:7: warning: indirection of non-volatile null pointer will be deleted, not trap [-Wnull-dereference] if (!bpf_core_type_exists(struct inet_connection_sock)) ^~~~~~~~~~~~~ /usr/include/bpf/bpf_core_read.h:155:31: note: expanded from macro 'bpf_core_type_exists' builtin_preserve_type_info((typeof(type) )0, BPF_TYPE_EXISTS) ^~~~~~ /mnt/disk/w50011487/workspace_crb/nettrace-master/shared/bpf/skb_parse.h:453:7: note: consider using builtin_trap() or qualifying pointer with 'volatile' /usr/include/bpf/bpf_core_read.h:155:31: note: expanded from macro 'bpf_core_type_exists' builtin_preserve_type_info((typeof(type) )0, BPF_TYPE_EXISTS) ^ In file included from progs/kprobe.c:8: /mnt/disk/w50011487/workspace_crb/nettrace-master/shared/bpf/skb_parse.h:532:7: error: use of unknown builtin 'builtin_preserve_type_info' [-Wimplicit-function-declaration] if (bpf_core_type_exists(struct tcp_sock)) { ^ /usr/include/bpf/bpf_core_read.h:155:2: note: expanded from macro 'bpf_core_type_exists' builtin_preserve_type_info((typeof(type) )0, BPF_TYPE_EXISTS) ^ In file included from progs/kprobe.c:8: /mnt/disk/w50011487/workspace_crb/nettrace-master/shared/bpf/skb_parse.h:532:7: warning: indirection of non-volatile null pointer will be deleted, not trap [-Wnull-dereference] if (bpf_core_type_exists(struct tcp_sock)) { ^~~~~~~~~ /usr/include/bpf/bpf_core_read.h:155:31: note: expanded from macro 'bpf_core_type_exists' builtin_preserve_type_info((typeof(type) )0, BPF_TYPE_EXISTS) ^~~~~~ /mnt/disk/w50011487/workspace_crb/nettrace-master/shared/bpf/skb_parse.h:532:7: note: consider using builtin_trap() or qualifying pointer with 'volatile' /usr/include/bpf/bpf_core_read.h:155:31: note: expanded from macro 'bpf_core_type_exists' builtin_preserve_type_info((typeof(type) )0, BPF_TYPE_EXISTS) ^ In file included from progs/kprobe.c:94: progs/core.c:495:6: error: use of unknown builtin '__builtin_preserve_type_info' [-Wimplicit-function-declaration] if (bpf_core_type_exists(enum skb_drop_reason)) { ^ /usr/include/bpf/bpf_core_read.h:155:2: note: expanded from macro 'bpf_core_type_exists' __builtin_preserve_type_info((typeof(type) )0, BPF_TYPE_EXISTS) ^ In file included from progs/kprobe.c:94: progs/core.c:496:63: error: too many arguments provided to function-like macro invocation if (bpf_core_field_exists(struct trace_event_raw_kfree_skb, rx_sk)) ^ /usr/include/bpf/bpf_core_read.h:119:9: note: macro 'bpf_core_field_exists' defined heredefine bpf_core_field_exists(field) \
In file included from progs/kprobe.c:94: progs/core.c:496:7: error: use of undeclared identifier 'bpf_core_field_exists' if (bpf_core_field_exists(struct trace_event_raw_kfree_skb, rx_sk)) ^ progs/core.c:495:6: warning: indirection of non-volatile null pointer will be deleted, not trap [-Wnull-dereference] if (bpf_core_type_exists(enum skb_drop_reason)) { ^
~~~~~~~~~ /usr/include/bpf/bpf_core_read.h:155:31: note: expanded from macro 'bpf_core_type_exists' builtin_preserve_type_info((typeof(type) )0, BPF_TYPE_EXISTS) ^~~~~~ progs/core.c:495:6: note: consider using builtin_trap() or qualifying pointer with 'volatile' /usr/include/bpf/bpf_core_read.h:155:31: note: expanded from macro 'bpf_core_type_exists' builtin_preserve_type_info((typeof(type) )0, BPF_TYPE_EXISTS) ^ In file included from progs/kprobe.c:94: progs/core.c:527:6: error: use of unknown builtin 'builtin_preserve_type_info' [-Wimplicit-function-declaration] if (bpf_core_type_exists(struct xt_table)) ^ /usr/include/bpf/bpf_core_read.h:155:2: note: expanded from macro 'bpf_core_type_exists' builtin_preserve_type_info((typeof(type) )0, BPF_TYPE_EXISTS) ^ In file included from progs/kprobe.c:94: progs/core.c:527:6: warning: indirection of non-volatile null pointer will be deleted, not trap [-Wnull-dereference] if (bpf_core_type_exists(struct xt_table)) ^~~~~~~~~ /usr/include/bpf/bpf_core_read.h:155:31: note: expanded from macro 'bpf_core_type_exists' builtin_preserve_type_info((typeof(type) )0, BPF_TYPE_EXISTS) ^~~~~~ progs/core.c:527:6: note: consider using builtin_trap() or qualifying pointer with 'volatile' /usr/include/bpf/bpf_core_read.h:155:31: note: expanded from macro 'bpf_core_type_exists' builtin_preserve_type_info((typeof(type) )0, BPF_TYPE_EXISTS) ^ In file included from progs/kprobe.c:94: progs/core.c:686:6: error: use of unknown builtin 'builtin_preserve_type_info' [-Wimplicit-function-declaration] if (bpf_core_type_exists(struct nft_chain)) { ^ /usr/include/bpf/bpf_core_read.h:155:2: note: expanded from macro 'bpf_core_type_exists' builtin_preserve_type_info((typeof(type) )0, BPF_TYPE_EXISTS) ^ In file included from progs/kprobe.c:94: progs/core.c:686:6: warning: indirection of non-volatile null pointer will be deleted, not trap [-Wnull-dereference] if (bpf_core_type_exists(struct nft_chain)) { ^~~~~~~~~~ /usr/include/bpf/bpf_core_read.h:155:31: note: expanded from macro 'bpf_core_type_exists' __builtin_preserve_type_info((typeof(type) )0, BPF_TYPE_EXISTS) ^~~~~~ progs/core.c:686:6: note: consider using builtin_trap() or qualifying pointer with 'volatile' /usr/include/bpf/bpf_core_read.h:155:31: note: expanded from macro 'bpf_core_type_exists' builtin_preserve_type_info((typeof(type) )0, BPF_TYPE_EXISTS) ^ 7 warnings and 10 errors generated. make[1]: [../common.mk:106: progs/kprobe.o] Error 1 make[1]: Leaving directory '/mnt/disk/w50011487/workspace_crb/nettrace-master/src' make: [Makefile:24: all] Error 2