在内核源文件中编译eBPF C代码时出错

Question

我正在Linux内核树中编译Linux内核树程序，在运行命令sudo make headers_install && sudo make M=samples/bpf之后，错误显示为agian。事实上，我被困在这里很长时间了。第一次错误是我的ubuntu出了问题。所以我重新安装了它。但现在这个错误很奇怪。

skeleton/pid_iter.bpf.c:47:14: error: incomplete definition of type 'struct bpf_perf_link'
        perf_link = container_of(link, struct bpf_perf_link, link);
                    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_helpers.h:74:22: note: expanded from macro 'container_of'
                ((type *)(__mptr - offsetof(type, member)));    \
                                   ^~~~~~~~~~~~~~~~~~~~~~
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_helpers.h:68:60: note: expanded from macro 'offsetof'
#define offsetof(TYPE, MEMBER)  ((unsigned long)&((TYPE *)0)->MEMBER)
                                                 ~~~~~~~~~~~^
skeleton/pid_iter.bpf.c:44:9: note: forward declaration of 'struct bpf_perf_link'
        struct bpf_perf_link *perf_link;
               ^
skeleton/pid_iter.bpf.c:48:10: error: incomplete definition of type 'struct bpf_perf_link'
        event = BPF_CORE_READ(perf_link, perf_file, private_data);
                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:403:2: note: expanded from macro 'BPF_CORE_READ'
        ___type((src), a, ##__VA_ARGS__) __r;                               \
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:274:29: note: expanded from macro '___type'
#define ___type(...) typeof(___arrow(__VA_ARGS__))
                            ^~~~~~~~~~~~~~~~~~~~~
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:272:23: note: expanded from macro '___arrow'
#define ___arrow(...) ___apply(___arrow, ___narg(__VA_ARGS__))(__VA_ARGS__)
                      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all)
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:223:25: note: expanded from macro '___concat'
#define ___concat(a, b) a ## b
                        ^
<scratch space>:19:1: note: expanded from here
___arrow3
^
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:264:29: note: expanded from macro '___arrow3'
#define ___arrow3(a, b, c) a->b->c
                           ~^
skeleton/pid_iter.bpf.c:44:9: note: forward declaration of 'struct bpf_perf_link'
        struct bpf_perf_link *perf_link;
               ^
skeleton/pid_iter.bpf.c:48:10: error: incomplete definition of type 'struct bpf_perf_link'
        event = BPF_CORE_READ(perf_link, perf_file, private_data);
                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:404:2: note: expanded from macro 'BPF_CORE_READ'
        BPF_CORE_READ_INTO(&__r, (src), a, ##__VA_ARGS__);                  \
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:311:2: note: expanded from macro 'BPF_CORE_READ_INTO'
        ___core_read(bpf_core_read, bpf_core_read,                          \
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:302:2: note: expanded from macro '___core_read'
        ___apply(___core_read, ___empty(__VA_ARGS__))(fn, fn_ptr, dst,      \
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
note: (skipping 9 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all)
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:280:33: note: expanded from macro '___rd_first'
#define ___rd_first(fn, src, a) ___read(fn, &__t, ___type(src), src, a);
                                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:277:59: note: expanded from macro '___read'
        read_fn((void *)(dst), sizeof(*(dst)), &((src_type)(src))->accessor)
        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:206:79: note: expanded from macro 'bpf_core_read'
        bpf_probe_read_kernel(dst, sz, (const void *)__builtin_preserve_access_index(src))
                                                                                     ^~~
skeleton/pid_iter.bpf.c:44:9: note: forward declaration of 'struct bpf_perf_link'
        struct bpf_perf_link *perf_link;
               ^
skeleton/pid_iter.bpf.c:48:10: error: incomplete definition of type 'struct bpf_perf_link'
        event = BPF_CORE_READ(perf_link, perf_file, private_data);
                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:404:2: note: expanded from macro 'BPF_CORE_READ'
        BPF_CORE_READ_INTO(&__r, (src), a, ##__VA_ARGS__);                  \
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:311:2: note: expanded from macro 'BPF_CORE_READ_INTO'
        ___core_read(bpf_core_read, bpf_core_read,                          \
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:302:2: note: expanded from macro '___core_read'
        ___apply(___core_read, ___empty(__VA_ARGS__))(fn, fn_ptr, dst,      \
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
note: (skipping 9 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all)
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:263:26: note: expanded from macro '___arrow2'
#define ___arrow2(a, b) a->b
                         ^
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:277:44: note: expanded from macro '___read'
        read_fn((void *)(dst), sizeof(*(dst)), &((src_type)(src))->accessor)
        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:206:79: note: expanded from macro 'bpf_core_read'
        bpf_probe_read_kernel(dst, sz, (const void *)__builtin_preserve_access_index(src))
                                                                                     ^~~
skeleton/pid_iter.bpf.c:44:9: note: forward declaration of 'struct bpf_perf_link'
        struct bpf_perf_link *perf_link;
               ^
skeleton/pid_iter.bpf.c:48:8: warning: incompatible integer to pointer conversion assigning to 'struct perf_event *' from 'long' [-Wint-conversion]
        event = BPF_CORE_READ(perf_link, perf_file, private_data);
              ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
skeleton/pid_iter.bpf.c:49:30: error: no member named 'bpf_cookie' in 'struct perf_event'
        return BPF_CORE_READ(event, bpf_cookie);
               ~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:403:17: note: expanded from macro 'BPF_CORE_READ'
        ___type((src), a, ##__VA_ARGS__) __r;                               \
        ~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:274:38: note: expanded from macro '___type'
#define ___type(...) typeof(___arrow(__VA_ARGS__))
                            ~~~~~~~~~^~~~~~~~~~~~
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:272:64: note: expanded from macro '___arrow'
#define ___arrow(...) ___apply(___arrow, ___narg(__VA_ARGS__))(__VA_ARGS__)
                      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:263:28: note: expanded from macro '___arrow2'
#define ___arrow2(a, b) a->b
                        ~  ^
skeleton/pid_iter.bpf.c:49:30: error: no member named 'bpf_cookie' in 'struct perf_event'
        return BPF_CORE_READ(event, bpf_cookie);
               ~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:404:34: note: expanded from macro 'BPF_CORE_READ'
        BPF_CORE_READ_INTO(&__r, (src), a, ##__VA_ARGS__);                  \
        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:312:20: note: expanded from macro 'BPF_CORE_READ_INTO'
                     dst, (src), a, ##__VA_ARGS__)                          \
                     ~~~~~~~~~~~~^~~~~~~~~~~~~~~~~
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:303:18: note: expanded from macro '___core_read'
                                                      src, a, ##__VA_ARGS__)
                                                      ~~~~~^~~~~~~~~~~~~~~~~
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:296:38: note: expanded from macro '___core_read0'
        ___read(fn, dst, ___type(src), src, a);
        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:277:61: note: expanded from macro '___read'
        read_fn((void *)(dst), sizeof(*(dst)), &((src_type)(src))->accessor)
        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:206:79: note: expanded from macro 'bpf_core_read'
        bpf_probe_read_kernel(dst, sz, (const void *)__builtin_preserve_access_index(src))
                                                                                     ^~~
skeleton/pid_iter.bpf.c:49:9: error: returning 'void' from a function with incompatible result type '__u64' (aka 'unsigned long long')
        return BPF_CORE_READ(event, bpf_cookie);
               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_core_read.h:402:36: note: expanded from macro 'BPF_CORE_READ'
#define BPF_CORE_READ(src, a, ...) ({                                       \
                                   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
skeleton/pid_iter.bpf.c:90:36: error: use of undeclared identifier 'BPF_LINK_TYPE_PERF_EVENT'; did you mean 'BPF_PROG_TYPE_PERF_EVENT'?
                if (BPF_CORE_READ(link, type) == BPF_LINK_TYPE_PERF_EVENT) {
                                                 ^~~~~~~~~~~~~~~~~~~~~~~~
                                                 BPF_PROG_TYPE_PERF_EVENT
/home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/vmlinux.h:9615:2: note: 'BPF_PROG_TYPE_PERF_EVENT' declared here
        BPF_PROG_TYPE_PERF_EVENT = 7,
        ^
1 warning and 8 errors generated.
make[2]: *** [Makefile:182: /home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/pid_iter.bpf.o] Error 1
make[1]: *** [samples/bpf/Makefile:296: /home/liusy/Downloads/linux-5.18/samples/bpf/bpftool/bpftool] Error 2

我找了很长时间的解决办法。我找到了这个https://www.spinics.net/lists/kernel/msg4322624.html。但我无法从中得到解决办法。有什么帮助吗？

Answer 1

错误是在bpftool中，因为最近有人在工具用来收集进程PID的骨架中引入了一个struct bpf_perf_link。

要无错误地编译，您需要一个最近的内核来定义struct bpf_perf_link (它是5.15+)，并使用选项CONFIG_PERF_EVENTS编译，就像您在找到的消息中提到的那样。

或者，有一个补丁是上游提交的，但到本文编写时还没有被合并:它在骨架中添加了一个结构体的本地定义，如果存在的话，这个定义会被内核BTF的定义覆盖。你可以在这里找到这块地 (这是对您发现的讨论的后续)，并将其应用于bpftool。这应该可以修复错误。

Answer 2

这是对尼古拉斯问题的回答：

./include/linux/piler.h:248:10:致命错误：‘asm/rwince.h’文件未找到

(我需要有50个名誉在@Nicholas下面发表评论)

在我的例子中，当我试图编写一个简单的eBPF程序时，我也遇到了同样的问题。解决方案是修改Makefile：

linuxbuildhdrs ?= /lib/modules/`uname -r`/build
linuxhdrs ?= /lib/modules/`uname -r`/source
LINUXINCLUDE =  -I$(linuxhdrs)/include \
                -I$(linuxhdrs)/include/uapi \
                -I$(linuxhdrs)/include/generated \
                -I$(linuxhdrs)/include/generated/uapi \
                -I$(linuxhdrs)/arch/x86/include \
                -I$(linuxhdrs)/arch/x86/include/uapi \
                -I$(linuxhdrs)/arch/x86/include/generated \
                -I$(linuxhdrs)/arch/x86/include/generated/uapi\
                -I$(linuxbuildhdrs)/include \
                -I$(linuxbuildhdrs)/arch/x86/include/generated

如果您的代码必须包括linux/kconfig.h，请记住在包含其他头文件之前包含它。