failed to build for android

[slowpy]

I build for android platform ,failed ,log bellow
kprobe.bpf.c:11:5: error: no member named 'uregs' in 'struct pt_regs'
int BPF_KPROBE(do_unlinkat, int dfd, struct filename *name)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/bpf/bpf_tracing.h:815:20: note: expanded from macro 'BPF_KPROBE'
return ____##name(___bpf_kprobe_args(args));
^~~~~~~~~~~~~~~~~~~~~~~~
build/bpf/bpf_tracing.h:795:41: note: expanded from macro '___bpf_kprobe_args'
#define ___bpf_kprobe_args(args...) ___bpf_apply(___bpf_kprobe_args, ___bpf_narg(args))(args)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/bpf/bpf_helpers.h:184:29: note: expanded from macro '___bpf_apply'
#define ___bpf_apply(fn, n) ___bpf_concat(fn, n)
^
note: (skipping 3 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all)
build/bpf/bpf_tracing.h:787:72: note: expanded from macro '___bpf_kprobe_args1'
#define ___bpf_kprobe_args1(x) ___bpf_kprobe_args0(), (void *)PT_REGS_PARM1(ctx)
^~~~~~~~~~~~~~~~~~
build/bpf/bpf_tracing.h:483:46: note: expanded from macro 'PT_REGS_PARM1'
#define PT_REGS_PARM1(x) (__PT_REGS_CAST(x)->__PT_PARM1_REG)

build/bpf/bpf_tracing.h:198:24: note: expanded from macro '__PT_PARM1_REG'
#define __PT_PARM1_REG uregs[0]
^
kprobe.bpf.c:11:5: error: no member named 'uregs' in 'struct pt_regs'
int BPF_KPROBE(do_unlinkat, int dfd, struct filename *name)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/bpf/bpf_tracing.h:815:20: note: expanded from macro 'BPF_KPROBE'
return ____##name(___bpf_kprobe_args(args));
^~~~~~~~~~~~~~~~~~~~~~~~
build/bpf/bpf_tracing.h:795:41: note: expanded from macro '___bpf_kprobe_args'
#define ___bpf_kprobe_args(args...) ___bpf_apply(___bpf_kprobe_args, ___bpf_narg(args))(args)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/bpf/bpf_helpers.h:184:29: note: expanded from macro '___bpf_apply'
#define ___bpf_apply(fn, n) ___bpf_concat(fn, n)
^
note: (skipping 2 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all)
build/bpf/bpf_tracing.h:788:76: note: expanded from macro '___bpf_kprobe_args2'
#define ___bpf_kprobe_args2(x, args...) ___bpf_kprobe_args1(args), (void *)PT_REGS_PARM2(ctx)
^~~~~~~~~~~~~~~~~~
build/bpf/bpf_tracing.h:484:46: note: expanded from macro 'PT_REGS_PARM2'
#define PT_REGS_PARM2(x) (__PT_REGS_CAST(x)->__PT_PARM2_REG)
~~~~~~~~~~~~~~~~~ ^
build/bpf/bpf_tracing.h:199:24: note: expanded from macro '__PT_PARM2_REG'
#define __PT_PARM2_REG uregs[1]
^
kprobe.bpf.c:23:5: error: no member named 'uregs' in 'struct pt_regs'
int BPF_KRETPROBE(do_unlinkat_exit, long ret)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/bpf/bpf_tracing.h:839:20: note: expanded from macro 'BPF_KRETPROBE'
return ____##name(___bpf_kretprobe_args(args));
^~~~~~~~~~~~~~~~~~~~~~~~~~~
build/bpf/bpf_tracing.h:823:40: note: expanded from macro '___bpf_kretprobe_args'
#define ___bpf_kretprobe_args(args...) ___bpf_apply(___bpf_kretprobe_args, ___bpf_narg(args))(args)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/bpf/bpf_helpers.h:184:29: note: expanded from macro '___bpf_apply'
#define ___bpf_apply(fn, n) ___bpf_concat(fn, n)
^
note: (skipping 2 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all)
build/bpf/bpf_tracing.h:822:74: note: expanded from macro '___bpf_kretprobe_args1'
#define ___bpf_kretprobe_args1(x) ___bpf_kretprobe_args0(), (void *)PT_REGS_RC(ctx)
^~~~~~~~~~~~~~~
build/bpf/bpf_tracing.h:493:43: note: expanded from macro 'PT_REGS_RC'
#define PT_REGS_RC(x) (__PT_REGS_CAST(x)->__PT_RC_REG)
~~~~~~~~~~~~~~~~~ ^
build/bpf/bpf_tracing.h:212:21: note: expanded from macro '__PT_RC_REG'
#define __PT_RC_REG uregs[0]
^
3 errors generated.

[slowpy]

I try to force arm64,got failed too.
--- a/examples/c/xmake.lua
+++ b/examples/c/xmake.lua
@@ -14,6 +14,7 @@ option("require-bpftool", {showmenu = true, default = false, description = "R
add_requires("elfutils", "zlib")
if is_plat("android") then
add_requires("ndk >=22.x", "argp-standalone")

add_defines("__TARGET_ARCH_arm64")
set_toolchains("@ndk", {sdkver = "23"})
else
kprobe.bpf.c:11:5: error: incomplete definition of type 'struct user_pt_regs'
int BPF_KPROBE(do_unlinkat, int dfd, struct filename *name)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/bpf/bpf_tracing.h:815:20: note: expanded from macro 'BPF_KPROBE'
return ____##name(___bpf_kprobe_args(args));
^~~~~~~~~~~~~~~~~~~~~~~~
build/bpf/bpf_tracing.h:795:41: note: expanded from macro '___bpf_kprobe_args'
#define ___bpf_kprobe_args(args...) ___bpf_apply(___bpf_kprobe_args, ___bpf_narg(args))(args)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/bpf/bpf_helpers.h:184:29: note: expanded from macro '___bpf_apply'
#define ___bpf_apply(fn, n) ___bpf_concat(fn, n)
^
note: (skipping 2 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all)
build/bpf/bpf_tracing.h:788:41: note: expanded from macro '___bpf_kprobe_args2'
#define ___bpf_kprobe_args2(x, args...) ___bpf_kprobe_args1(args), (void *)PT_REGS_PARM2(ctx)
^~~~~~~~~~~~~~~~~~~~~~~~~
build/bpf/bpf_tracing.h:787:72: note: expanded from macro '___bpf_kprobe_args1'
#define ___bpf_kprobe_args1(x) ___bpf_kprobe_args0(), (void *)PT_REGS_PARM1(ctx)
^~~~~~~~~~~~~~~~~~
build/bpf/bpf_tracing.h:483:44: note: expanded from macro 'PT_REGS_PARM1'
#define PT_REGS_PARM1(x) (__PT_REGS_CAST(x)->__PT_PARM1_REG)

kprobe.bpf.c:11:5: note: forward declaration of 'struct user_pt_regs'
build/bpf/bpf_tracing.h:815:20: note: expanded from macro 'BPF_KPROBE'
return ____##name(___bpf_kprobe_args(args));
^
build/bpf/bpf_tracing.h:795:41: note: expanded from macro '___bpf_kprobe_args'
#define ___bpf_kprobe_args(args...) ___bpf_apply(___bpf_kprobe_args, ___bpf_narg(args))(args)
^
build/bpf/bpf_helpers.h:184:29: note: expanded from macro '___bpf_apply'
#define ___bpf_apply(fn, n) ___bpf_concat(fn, n)
^
note: (skipping 3 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all)
build/bpf/bpf_tracing.h:787:72: note: expanded from macro '___bpf_kprobe_args1'
#define ___bpf_kprobe_args1(x) ___bpf_kprobe_args0(), (void *)PT_REGS_PARM1(ctx)
^
build/bpf/bpf_tracing.h:483:27: note: expanded from macro 'PT_REGS_PARM1'
#define PT_REGS_PARM1(x) (__PT_REGS_CAST(x)->__PT_PARM1_REG)
^
build/bpf/bpf_tracing.h:227:42: note: expanded from macro '__PT_REGS_CAST'
#define __PT_REGS_CAST(x) ((const struct user_pt_regs *)(x))
^
kprobe.bpf.c:11:5: error: incomplete definition of type 'struct user_pt_regs'
int BPF_KPROBE(do_unlinkat, int dfd, struct filename *name)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/bpf/bpf_tracing.h:815:20: note: expanded from macro 'BPF_KPROBE'
return ____##name(___bpf_kprobe_args(args));
^~~~~~~~~~~~~~~~~~~~~~~~
build/bpf/bpf_tracing.h:795:41: note: expanded from macro '___bpf_kprobe_args'
#define ___bpf_kprobe_args(args...) ___bpf_apply(___bpf_kprobe_args, ___bpf_narg(args))(args)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/bpf/bpf_helpers.h:184:29: note: expanded from macro '___bpf_apply'
#define ___bpf_apply(fn, n) ___bpf_concat(fn, n)
^
note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all)
:20:1: note: expanded from here
___bpf_kprobe_args2
^
build/bpf/bpf_tracing.h:788:76: note: expanded from macro '___bpf_kprobe_args2'
#define ___bpf_kprobe_args2(x, args...) ___bpf_kprobe_args1(args), (void *)PT_REGS_PARM2(ctx)
^~~~~~~~~~~~~~~~~~
build/bpf/bpf_tracing.h:484:44: note: expanded from macro 'PT_REGS_PARM2'
#define PT_REGS_PARM2(x) (__PT_REGS_CAST(x)->__PT_PARM2_REG)
~~~~~~~~~~~~~~~~~^
kprobe.bpf.c:11:5: note: forward declaration of 'struct user_pt_regs'
build/bpf/bpf_tracing.h:815:20: note: expanded from macro 'BPF_KPROBE'
return ____##name(___bpf_kprobe_args(args));
^
build/bpf/bpf_tracing.h:795:41: note: expanded from macro '___bpf_kprobe_args'
#define ___bpf_kprobe_args(args...) ___bpf_apply(___bpf_kprobe_args, ___bpf_narg(args))(args)
^
build/bpf/bpf_helpers.h:184:29: note: expanded from macro '___bpf_apply'
#define ___bpf_apply(fn, n) ___bpf_concat(fn, n)
^
note: (skipping 3 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all)
build/bpf/bpf_tracing.h:787:72: note: expanded from macro '___bpf_kprobe_args1'
#define ___bpf_kprobe_args1(x) ___bpf_kprobe_args0(), (void *)PT_REGS_PARM1(ctx)
^
build/bpf/bpf_tracing.h:483:27: note: expanded from macro 'PT_REGS_PARM1'
#define PT_REGS_PARM1(x) (__PT_REGS_CAST(x)->__PT_PARM1_REG)
^
build/bpf/bpf_tracing.h:227:42: note: expanded from macro '__PT_REGS_CAST'
#define __PT_REGS_CAST(x) ((const struct user_pt_regs *)(x))
^
kprobe.bpf.c:23:5: error: incomplete definition of type 'struct user_pt_regs'
int BPF_KRETPROBE(do_unlinkat_exit, long ret)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/bpf/bpf_tracing.h:839:20: note: expanded from macro 'BPF_KRETPROBE'
return ____##name(___bpf_kretprobe_args(args));
^~~~~~~~~~~~~~~~~~~~~~~~~~~
build/bpf/bpf_tracing.h:823:40: note: expanded from macro '___bpf_kretprobe_args'
#define ___bpf_kretprobe_args(args...) ___bpf_apply(___bpf_kretprobe_args, ___bpf_narg(args))(args)
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/bpf/bpf_helpers.h:184:29: note: expanded from macro '___bpf_apply'
#define ___bpf_apply(fn, n) ___bpf_concat(fn, n)
^
note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all)
:39:1: note: expanded from here
___bpf_kretprobe_args1
^
build/bpf/bpf_tracing.h:822:74: note: expanded from macro '___bpf_kretprobe_args1'
#define ___bpf_kretprobe_args1(x) ___bpf_kretprobe_args0(), (void *)PT_REGS_RC(ctx)
^~~~~~~~~~~~~~~
build/bpf/bpf_tracing.h:493:41: note: expanded from macro 'PT_REGS_RC'
#define PT_REGS_RC(x) (__PT_REGS_CAST(x)->__PT_RC_REG)
~~~~~~~~~~~~~~~~~^
kprobe.bpf.c:23:5: note: forward declaration of 'struct user_pt_regs'
build/bpf/bpf_tracing.h:839:20: note: expanded from macro 'BPF_KRETPROBE'
return ____##name(___bpf_kretprobe_args(args));
^
build/bpf/bpf_tracing.h:823:40: note: expanded from macro '___bpf_kretprobe_args'
#define ___bpf_kretprobe_args(args...) ___bpf_apply(___bpf_kretprobe_args, ___bpf_narg(args))(args)
^
build/bpf/bpf_helpers.h:184:29: note: expanded from macro '___bpf_apply'
#define ___bpf_apply(fn, n) ___bpf_concat(fn, n)
^
note: (skipping 2 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all)
build/bpf/bpf_tracing.h:822:74: note: expanded from macro '___bpf_kretprobe_args1'
#define ___bpf_kretprobe_args1(x) ___bpf_kretprobe_args0(), (void *)PT_REGS_RC(ctx)
^
build/bpf/bpf_tracing.h:493:24: note: expanded from macro 'PT_REGS_RC'
#define PT_REGS_RC(x) (__PT_REGS_CAST(x)->__PT_RC_REG)
^
build/bpf/bpf_tracing.h:227:42: note: expanded from macro '__PT_REGS_CAST'
#define __PT_REGS_CAST(x) ((const struct user_pt_regs *)(x))
^
3 errors generated.

[anakryiko]

Are you sure you are including either vmlinux.h or linux/ptrace.h in your BPF code where you are including bpf/bpf_tracing.h? bpf_tracing.h assumes that struct pt_regs/struct user_pt_regs is included by the user code

[slowpy]

After adopting your opinion, both versions of kprobe can be compiled normally, but neither can run. Do you have any relevant knowledge about this?Thanks a lot
my kernel is 64bit,user space is 32bit.

1.the error of runing 32bit verison kprobe
failed to resolve CO-RE relocation <byte_off> [2] struct pt_regs.uregs[1] (0:0:1 @ offset 8)
processed 1 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

2.the error of 64bit verison kprobe
/system/bin/sh: /data/kprobe: No such file or directory

file /data/kprobe
/data/kprobe: ELF shared object, 64-bit LSB arm64, dynamic (/system/bin/linker64), for Android 23, built by NDK r22 (7026061), stripped
my system surely not include linker64

[chenhengqi]

• The first issue might be related to this commit 2baa3f9
• static build by running EXTRA_LDFLAGS=-static make -j

[chenhengqi]

Two ways to fix the issue:

diff --git a/examples/c/uprobe.bpf.c b/examples/c/uprobe.bpf.c
index c5c9ba0..e508314 100644
--- a/examples/c/uprobe.bpf.c
+++ b/examples/c/uprobe.bpf.c
@@ -1,7 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
 /* Copyright (c) 2020 Facebook */
-#include <linux/bpf.h>
-#include <linux/ptrace.h>
+#include <vmlinux.h>
 #include <bpf/bpf_helpers.h>
 #include <bpf/bpf_tracing.h>

Or:

ln -s /usr/include/aarch64-linux-gnu/asm /usr/include/asm

[slowpy]

ln -s /usr/include/aarch64-linux-gnu/asm /usr/include/asm
yeah it woks ,

Thanks a lot @chenhengqi