lizrice / learning-ebpf

Learning eBPF, published by O'Reilly - out now! Here's where you'll find a VM config for the examples, and more
https://www.amazon.com/Learning-eBPF-Programming-Observability-Networking/dp/1098135121
Apache License 2.0
1.19k stars 255 forks source link

chapter5 error: expected identifier #42

Closed endepointe closed 2 months ago

endepointe commented 2 months ago

I was able to compile chapter3 code and have verified that the kernel was compiled with btf.

When running chapter5 examples, I get the following error:

hello-buffer-config.bpf.c:27:31: error: expected identifier
int BPF_KPROBE_SYSCALL(hello, const char *pathname)
                              ^
hello-buffer-config.bpf.c:36:59: error: use of undeclared identifier 'pathname'
   bpf_probe_read_user_str(&data.path, sizeof(data.path), pathname);
                                                          ^
hello-buffer-config.bpf.c:45:26: error: use of undeclared identifier 'ctx'
   bpf_perf_event_output(ctx, &output, BPF_F_CURRENT_CPU, &data, sizeof(data));   
                         ^
3 errors generated.
make: *** [Makefile:15: hello-buffer-config.bpf.o] Error 1

Is there a missing section of the code or is the BPF_KPROBE_SYSCALL supposed to define the hello function?

Update

After building libbpf in the repo, the following error is generated with make:

hello-buffer-config.bpf.c:27:5: error: no member named 'di' in 'struct pt_regs'
int BPF_KPROBE_SYSCALL(hello, const char *pathname)
    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/include/bpf/bpf_tracing.h:561:28: note: expanded from macro 'BPF_KPROBE_SYSCALL'
#define BPF_KPROBE_SYSCALL BPF_KSYSCALL
                           ^
/usr/include/bpf/bpf_tracing.h:548:31: note: expanded from macro 'BPF_KSYSCALL'
                               ? (struct pt_regs *)PT_REGS_PARM1(ctx)       \
                                                   ^~~~~~~~~~~~~~~~~~
/usr/include/bpf/bpf_tracing.h:272:46: note: expanded from macro 'PT_REGS_PARM1'
#define PT_REGS_PARM1(x) (__PT_REGS_CAST(x)->__PT_PARM1_REG)
                          ~~~~~~~~~~~~~~~~~  ^
/usr/include/bpf/bpf_tracing.h:77:24: note: expanded from macro '__PT_PARM1_REG'
#define __PT_PARM1_REG di
endepointe commented 2 months ago

resolved with rubber duck I did a thing here: https://github.com/lizrice/learning-ebpf/issues/17