Chapter 5 - No member named 'di' in 'struct pt_regs'

[sherwoodzern]

I execute make and encounter the following error messages:

[opc@ebpf-testing chapter5]$ make
clang
-target bpf
-D __TARGET_ARCH_x86
-Wall
-O2 -g -o hello-buffer-config.bpf.o -c hello-buffer-config.bpf.c
hello-buffer-config.bpf.c:27:5: error: no member named 'di' in 'struct pt_regs'
int BPF_KPROBE_SYSCALL(hello, const char *pathname)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/include/bpf/bpf_tracing.h:561:28: note: expanded from macro 'BPF_KPROBE_SYSCALL'
#define BPF_KPROBE_SYSCALL BPF_KSYSCALL
^
/usr/include/bpf/bpf_tracing.h:548:31: note: expanded from macro 'BPF_KSYSCALL'
? (struct pt_regs *)PT_REGS_PARM1(ctx)
^~~~~~~~~~~~~~~~~~
/usr/include/bpf/bpf_tracing.h:272:46: note: expanded from macro 'PT_REGS_PARM1'
#define PT_REGS_PARM1(x) (__PT_REGS_CAST(x)->__PT_PARM1_REG)
~~~~~~~~~~~~~~~~~ ^
/usr/include/bpf/bpf_tracing.h:77:24: note: expanded from macro '__PT_PARM1_REG'
#define __PT_PARM1_REG di
^
hello-buffer-config.bpf.c:27:5: error: no member named 'di' in 'struct pt_regs'
int BPF_KPROBE_SYSCALL(hello, const char *pathname)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/include/bpf/bpf_tracing.h:561:28: note: expanded from macro 'BPF_KPROBE_SYSCALL'
#define BPF_KPROBE_SYSCALL BPF_KSYSCALL
^
/usr/include/bpf/bpf_tracing.h:553:21: note: expanded from macro 'BPF_KSYSCALL'
return ____##name(___bpf_syswrap_args(args));
^~~~~~~~~~~~~~~~~~~~~~~~~
/usr/include/bpf/bpf_tracing.h:514:42: note: expanded from macro '___bpf_syswrap_args'
#define ___bpf_syswrap_args(args...) ___bpf_apply(___bpf_syswrap_args, ___bpf_narg(args))(args)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
note: (skipping 8 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all)
/usr/include/bpf/bpf_core_read.h:314:38: note: expanded from macro '___type'
#define ___type(...) typeof(___arrow(VA_ARGS))
~~~~~~~~~^~~~~~~~~~~~
/usr/include/bpf/bpf_core_read.h:312:64: note: expanded from macro '___arrow'
#define ___arrow(...) ___apply(___arrow, ___narg(VA_ARGS))(VA_ARGS)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~
/usr/include/bpf/bpf_core_read.h:303:28: note: expanded from macro '___arrow2'
#define ___arrow2(a, b) a->b
~ ^
hello-buffer-config.bpf.c:27:5: error: no member named 'di' in 'struct pt_regs'
int BPF_KPROBE_SYSCALL(hello, const char *pathname)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/include/bpf/bpf_tracing.h:561:28: note: expanded from macro 'BPF_KPROBE_SYSCALL'
#define BPF_KPROBE_SYSCALL BPF_KSYSCALL
^
/usr/include/bpf/bpf_tracing.h:553:21: note: expanded from macro 'BPF_KSYSCALL'
return ____##name(___bpf_syswrap_args(args));
^~~~~~~~~~~~~~~~~~~~~~~~~
/usr/include/bpf/bpf_tracing.h:514:42: note: expanded from macro '___bpf_syswrap_args'
#define ___bpf_syswrap_args(args...) ___bpf_apply(___bpf_syswrap_args, ___bpf_narg(args))(args)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
note: (skipping 10 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all)
/usr/include/bpf/bpf_core_read.h:336:38: note: expanded from macro '___core_read0'
___read(fn, dst, ___type(src), src, a);
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~
/usr/include/bpf/bpf_core_read.h:317:61: note: expanded from macro '___read'
read_fn((void )(dst), sizeof((dst)), &((src_type)(src))->accessor)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~
/usr/include/bpf/bpf_core_read.h:246:79: note: expanded from macro 'bpf_core_read'
bpf_probe_read_kernel(dst, sz, (const void *)__builtin_preserve_access_index(src))
^~~
hello-buffer-config.bpf.c:27:5: error: operand of type 'void' where arithmetic or pointer type is required
int BPF_KPROBE_SYSCALL(hello, const char *pathname)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/include/bpf/bpf_tracing.h:561:28: note: expanded from macro 'BPF_KPROBE_SYSCALL'
#define BPF_KPROBE_SYSCALL BPF_KSYSCALL
^
/usr/include/bpf/bpf_tracing.h:553:21: note: expanded from macro 'BPF_KSYSCALL'
return ____##name(___bpf_syswrap_args(args));
^~~~~~~~~~~~~~~~~~~~~~~~~
/usr/include/bpf/bpf_tracing.h:514:42: note: expanded from macro '___bpf_syswrap_args'
#define ___bpf_syswrap_args(args...) ___bpf_apply(___bpf_syswrap_args, ___bpf_narg(args))(args)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
note: (skipping 4 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all)
/usr/include/bpf/bpf_tracing.h:324:39: note: expanded from macro 'PT_REGS_PARM1_CORE_SYSCALL'
#define PT_REGS_PARM1_CORE_SYSCALL(x) PT_REGS_PARM1_CORE(x)
^~~~~~~~~~~~~~~~~~~~~
/usr/include/bpf/bpf_tracing.h:283:31: note: expanded from macro 'PT_REGS_PARM1_CORE'
#define PT_REGS_PARM1_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM1_REG)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/include/bpf/bpf_core_read.h:442:36: note: expanded from macro 'BPF_CORE_READ'
#define BPF_CORE_READ(src, a, ...) ({
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
hello-buffer-config.bpf.c:27:5: error: no member named 'di' in 'struct pt_regs'
int BPF_KPROBE_SYSCALL(hello, const char *pathname)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/include/bpf/bpf_tracing.h:561:28: note: expanded from macro 'BPF_KPROBE_SYSCALL'
#define BPF_KPROBE_SYSCALL BPF_KSYSCALL
^
/usr/include/bpf/bpf_tracing.h:555:21: note: expanded from macro 'BPF_KSYSCALL'
return ____##name(___bpf_syscall_args(args));
^~~~~~~~~~~~~~~~~~~~~~~~~
/usr/include/bpf/bpf_tracing.h:505:42: note: expanded from macro '___bpf_syscall_args'
#define ___bpf_syscall_args(args...) ___bpf_apply(___bpf_syscall_args, ___bpf_narg(args))(args)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
note: (skipping 4 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all)
/usr/include/bpf/bpf_tracing.h:314:34: note: expanded from macro 'PT_REGS_PARM1_SYSCALL'
#define PT_REGS_PARM1_SYSCALL(x) PT_REGS_PARM1(x)
^~~~~~~~~~~~~~~~
/usr/include/bpf/bpf_tracing.h:272:46: note: expanded from macro 'PT_REGS_PARM1'
#define PT_REGS_PARM1(x) (__PT_REGS_CAST(x)->__PT_PARM1_REG)
~~~~~~~~~~~~~~~~~ ^
/usr/include/bpf/bpf_tracing.h:77:24: note: expanded from macro '__PT_PARM1_REG'
#define __PT_PARM1_REG di

I can only assume that there are different versions being used. It is obviously related to the macro call. Any assistance is appreciated.

[sherwoodzern]

I recreated the vmlinux.h file and the issue is resolved.

[thatsdone]

Hello @lizrice
I also got the same trouble.

I think it's better either of:

1. Delete or rename vmlinux.h
2. Make chapter5/Makefile clean target removing vmlinux.h

[wtyfpc]

bpftool btf dump file /sys/kernel/btf/vmlinux format c > vmlinux.h