https://github.com/grantseltzer/bpf-cookie-examples

https://github.com/grantseltzer/bpf-cookie-examples

Last synced: about 2 months ago
JSON representation

• Host: GitHub
• URL: https://github.com/grantseltzer/bpf-cookie-examples
• Owner: grantseltzer
• Created: 2023-08-04T13:27:55.000Z (over 1 year ago)
• Default Branch: main
• Last Pushed: 2024-05-10T15:49:33.000Z (8 months ago)
• Last Synced: 2024-05-10T16:55:05.263Z (8 months ago)
• Language: C
• Size: 6.06 MB
• Stars: 0
• Watchers: 2
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
# BPF Stack VM (BSV)

Attempts to solve the problem of in-kernel filtering (instead of taking lots of data back up to user space)

HOWEVER, because of the bpf instruction limit, this doesn't work that well, can only get around 10 instructions before either hitting the instruction limit or stack size.

Stack based vm, needs instructions for:

- reading from specific registers

- reading from specific offsets on program's stack

- Dereference addresses

- append to an array

- reading values from bpf maps

- writing to bpf maps

## Instructions

| Mnemonic | Description | Num Arguments | Example |

| - | - | - | - |

| RR | Read from register | 1 | `RR 0` - Read 8 byte value from register 0 and push onto stack

| RS | Read from stack | 2  | `RS 8 4` - Read from offset 8 off the program stack a value of size 4 and push onto stack

| DE | Dereference the address on the stack and push the 8 byte value onto the stack | 0 | `DE`

| AA | Append 8 bytes into array | 0 | `AA` - pop 8 byte value, write to the array

## Example

Tracing function `test_combined_uint64(x uint64)`. uint64 is loaded in register 0. No returns, just have to retrieve this one value 

Instructions:

```

RR 0

AA

```