lizrice / learning-ebpf

Learning eBPF, published by O'Reilly - out now! Here's where you'll find a VM config for the examples, and more

Home Page:https://www.amazon.com/Learning-eBPF-Programming-Observability-Networking/dp/1098135121

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

an error was reported when executing the make command in Chapter 5

gongluck opened this issue · comments

I encountered a problem in the example in Chapter 5, and an error was reported when executing the make command:

# make
clang \
    -target bpf \
        -D __TARGET_ARCH_x86 \
    -Wall \
    -O2 -g -o hello-buffer-config.bpf.o -c hello-buffer-config.bpf.c
hello-buffer-config.bpf.c:27:31: error: expected identifier
int BPF_KPROBE_SYSCALL(hello, const char *pathname)
                              ^
hello-buffer-config.bpf.c:36:59: error: use of undeclared identifier 'pathname'
   bpf_probe_read_user_str(&data.path, sizeof(data.path), pathname);
                                                          ^
hello-buffer-config.bpf.c:45:26: error: use of undeclared identifier 'ctx'
   bpf_perf_event_output(ctx, &output, BPF_F_CURRENT_CPU, &data, sizeof(data));   
                         ^
3 errors generated.
make: *** [Makefile:15: hello-buffer-config.bpf.o] Error 1

#uname -a
Linux gongluck 5.15.0-60-generic #66-Ubuntu SMP Fri Jan 20 14:29:49 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

Can you help me please, thanks!

Same problem

The problems is that BPF_KPROBE_SYSCALL is not defined as the compiler can't find this definition. Most probably the libbpf-dev version is old and lack the new headers added last year that contain this define.

If you use a Debian based distribution like Ubuntu you can either install the experimental or unstable / sid version with
sudo apt install -t sid libbpf-dev or just build & install libbpf from sources.

Note that this repo has the libbpf repo as a submodule so you can simple git submodule update --init to bring the sources.