When running bcc tool execsnoop ([1]) which is built with latest llvm,
I hit the following error:
$ sudo ./execsnoop.py /virtual/main.c:99:157: error: expected ')' data.ppid = ({ typeof(pid_t) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)&({ typeof(struct task_struct btf_type_tag(rcu)*) _val; __builtin_memset(&_val, 0, sizeof(_val)); ^ bpf_probe_read(&_val, sizeof(_val), (void *)&task->real_parent); _val; })->tgid); _val; });
The failure reason is due to that the bcc rewriter printed type like
struct task_struct btf_type_tag(rcu)*
where the compiler cannot recognize what 'btf_type_tag(rcu)' is.
The above type is printed in [2] by UnaryOperator->getType().getAsString() (from clang)
in function ProbeVisitor::VisitUnaryOperator.
The original source type looks like ([3])
struct task_struct { ... struct task_struct __rcu *real_parent; ... } where '__rcu' is a macro expanding to '__attribute__((btf_type_tag("rcu")))'.
Let us print btf_type_tag properly in clang so bcc tools and broader type printing
will work properly.
With this patch, the above rewrited source code looks like
data.ppid = ({ typeof(pid_t) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)&({ typeof(struct task_struct __attribute__((btf_type_tag("rcu")))*) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)&task->real_parent); _val; })->tgid); _val; });
and execsnoop.py tool can run properly.
[1] https://github.com/iovisor/bcc/blob/master/tools/exitsnoop.py [2] https://github.com/iovisor/bcc/blob/master/src/cc/frontends/clang/b_frontend_action.cc [3] https://github.com/torvalds/linux/blob/master/include/linux/sched.h