RedBPF Toolchain

RedBPF operates using two distinct components:

• BPF Program: A single Rust function defined using redbpf-macros. It is attached to instrumentation points (e.g., kprobe, xdp, tracepoint) and executes in the kernel context. Because it runs in the kernel, it must use #![no_std] and #![no_main].
• BPF Maps: Used for communication between BPF programs and userspace programs. Common types include HashMap, Array, and PerfMap (used for delivering events to userspace).
• Userspace Program: A standard Rust program (using the redbpf crate) that loads BPF programs and maps into the kernel and communicates with them via maps.

Key Crates:

• redbpf-macros: Provides attribute macros (#[kprobe], #[map], program!) for defining BPF programs and maps.
• redbpf-probes: Provides the API for BPF programs executing in the kernel context.
• redbpf: Provides the API for userspace programs to load and interact with BPF programs.

Compiling BPF programs with RedBPF involves two different LLVM versions, and their relationship is critical to avoid errors:

1. LLVM (1): The version statically linked into cargo-bpf when it was built. This version is used to parse LLVM bitcode and convert it to BPF bytecode.
2. LLVM (2): The version linked to rustc (the version used by your Rust compiler). This version is used to emit LLVM bitcode from your Rust code.

Compatibility Rule: LLVM (1) must be greater than or equal to LLVM (2).

If LLVM (1) is older than LLVM (2), cargo-bpf may not be able to handle the bitcode emitted by the newer rustc. If LLVM (1) is newer than LLVM (2), it typically maintains backward compatibility for the intermediate representation.

RedBPF requires LLVM 13 to compile BPF bytecode. Additionally, you must have access to one of the following to generate Rust bindings for Linux kernel data structures:

1. Linux kernel headers
2. vmlinux (the Linux kernel image with a .BTF section)
3. Raw BTF data (e.g., from /sys/kernel/btf/vmlinux)

Ubuntu 20.04 LTS

# apt-get update \ 
  && apt-get -y install \ 
       wget \ 
       build-essential \ 
       software-properties-common \ 
       lsb-release \ 
       libelf-dev \ 
       linux-headers-generic \ 
       pkg-config \ 
  && wget https://apt.llvm.org/llvm.sh && chmod +x llvm.sh && ./llvm.sh 13 && rm -f ./llvm.sh
# llvm-config-13 --version | grep 13

Fedora 35

# dnf install -y \ 
    clang-13.0.0 \ 
\tllvm-13.0.0 \ 
\tllvm-libs-13.0.0 \ 
\tllvm-devel-13.0.0 \ 
\tllvm-static-13.0.0 \ 
\tkernel \ 
\tkernel-devel \ 
\telfutils-libelf-devel \ 
\tmake \ 
    pkg-config \ 
    zstd
# llvm-config --version | grep 13

Arch Linux

# pacman --noconfirm -Syu \ 
  && pacman -S --noconfirm \ 
       llvm \ 
       llvm-libs \ 
       libffi \ 
       clang \ 
       make \ 
       pkg-config \ 
       linux-headers \ 
       linux
# llvm-config --version | grep -q '^13'

When writing a BPF program in src/probes/<name>/main.rs, you must follow these requirements:

• Use #![no_std] and #![no_main].
• Use the program! macro to set the version and license (license must be GPL compatible).
• Use the #[map] attribute to define BPF maps.
• Use the #[kprobe] (or similar) attribute to define the entry point function.

Example structure:

#![no_std]
#![no_main]

use redbpf_probes::kprobe::prelude::*;

program!(0xFFFFFFFE, "GPL");

#[map]
static mut MY_MAP: PerfMap<MyStruct> = PerfMap::with_max_entries(1024);

#[kprobe]
fn my_kprobe_func(regs: Registers) {
    // Logic here
}

#![no_std]
#![no_main]

use redbpf_probes::kprobe::prelude::*;

program!(0xFFFFFFFE, "GPL");

#[map]
static mut OPEN_PATHS: PerfMap<OpenPath> = PerfMap::with_max_entries(1024);

#[kprobe]
fn do_sys_open(regs: Registers) {
    let mut path = OpenPath::default();
    unsafe {
        let filename = regs.parm2() as *const u8;
        if bpf_probe_read_user_str(
            path.filename.as_mut_ptr() as *mut _,
            path.filename.len() as u32,
            filename as *const _,
        ) <= 0
        {
            bpf_trace_printk(b"error on bpf_probe_read_user_str\0");
            return;
        }
        OPEN_PATHS.insert(regs.ctx, &path);
    }
}