libs
libs copied to clipboard
[BUG] Compile modern_bpf error
Describe the bug make drivers_test
/home/yzw/rd/libs/driver/modern_bpf/helpers/extract/extract_from_kernel.h:648:49: error: member reference base type 'struct percpu_counter[4]' is not a structure or union
648 | BPF_CORE_READ_INTO(&swap_entries, mm, rss_stat.count[MM_SWAPENTS].counter);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~
The code files involved include : modern_bpf/programs/tail_called/events/syscall_dispatched_events/execve.bpf.c modern_bpf/programs/tail_called/events/syscall_dispatched_events/execveat.bpf.c modern_bpf/helpers/extract/extract_from_kernel.h
How to reproduce it First judge the kernel version, and then execute the corresponding operation. like this:
#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 3, 0)
instead of
if(bpf_core_field_exists(((struct kernel_cap_struct *)0)->cap)){...}
Expected behaviour
Screenshots
Environment
- Falco version:
- System info:
- Cloud provider or hardware configuration:
- OS:
- Kernel:
- Installation method:
Additional context
### Tasks
- [ ] https://github.com/falcosecurity/libs/pull/1654
### Tasks
- [ ] add ebpf support for loongarch64