declaring a map requires having a field named type

[dvc94ch]

This can not be accomplished when compiling from rust. type_ as emitted by bindgen or r#type generate wrong identifier names in the debug info making it impossible to get btf to acknowledge a type field. I'd suggest also accepting type_.

Ups wrong repo should be the libbpf one.

[danobi]

Gonna close this out b/c it's probably better asked on the bpf mailing lists.

But just out of curiosity, why are you bindgen'ing the .bpf.c code?

[dvc94ch]

But just out of curiosity, why are you bindgen'ing the .bpf.c code?

I'm not. Currently I'm using a patched cargo-bpf that emits debug info [0], at least until the rustc bpf target support is merged [1]. I'm currently working on my own bpf library that is going to work something like this:

let bpf = BpfBuilder::new(PROBE)?
    .attach_probe("tracepoint:raw_syscalls:sys_enter", "sys_enter")?
    .attach_probe("tracepoint:raw_syscalls:sys_exit", "sys_exit")?
    .attach_probe("profile:hz:99", "profile")?
    .load()?;

I'm still missing an understanding of how maps work in detail, I assumed libbpf-rs would handle it for me until I realized it does not.

So you used to be able to declare a map using the bpf_map_def struct but now it is inferred in a weird (for every language that isn't C) way [3].

• [0] cargo-bpf debug info. foniod/redbpf#125
• [1] BPF target support rust-lang/rust#79608
• [2] https://github.com/dvc94ch/rust-bpf
• [3] map support dvc94ch/cargo-trace#6

[dvc94ch]

Any suggestions on how to proceed? I guess I'll just not put maps in the .maps section and load them manually using the bpf(BPF_MAP_CREATE) syscall.

[anakryiko]

It's not clear. So how does your BPF code look like?

[dvc94ch]

It's a work in progress, I made my first experiments with redbpf and got something to work (counting syscalls). Here is the wip adaption to my own library [0]. Note that nothing actually works yet.

• [0] https://github.com/dvc94ch/rust-bpf/blob/master/examples/syscount/probe/src/main.rs

[anakryiko]

redbpf doesn use libbpf. Those BTF-based map definitions in SEC(".maps") is libbpf convention. Kernel itself just expects BTF FD and type IDs associated with key and value to get everything working.

On the other hand, libbpf does expect BPF code to be written in C and compiled with Clang. So if you want to go with Rust for BPF code, I don't think you can easily use libbpf.

[dvc94ch]

Yes I came to the same conclusion. I can still use libbpf-rs to bootstrap, it should work for parsing the elf file and loading bpf programs, but I'll need to implement my own map handling.

[dvc94ch]

libbpf-rs works for me now. apparently you can put maps in a maps section instead of a .maps section and it just works. the verifier seems mysterious sometimes, is there a good reference explaining what it verifies and how to make it happy?

[danobi]

the verifier seems mysterious sometimes, is there a good reference explaining what it verifies and how to make it happy?

Unfortunately, the only way is to read the source. Usually the function names will hint you in the right direction.