Expand description
Primitives for the eBPF instruction set. See kernel docs for the canonical details
The exports here should allow for the creation of simple eBPF programs that can be loaded into the kernel. The functions provide a convenient away to create valid instructions.
The exported functions currently return the underlying libbpf_sys’s bpf_insn binding
so loading the program through other libbpf_sys functions should work.
In the future, we should provide convenient functions to encapsulate this.
§Instruction set (ISA) versions
Not all of the instructions currently available were released at the same time. Instructions (mostly for jump ops) have been added over time, resulting in different versions of the eBPF instruction set. We will denote if an operation is part of the v2 or v3 instruction set.
For more info, see BPF Design Q&A and Paul Chaignon’s blog post
§Example
As an example use case of the primitives here, for feature detection we can run a small eBPF program that determines if bounded loops (introduced in the v5.3 kernel) are supported:
use bpf_rs::insns::*;
// Inspired by bpftool's feature probing
let bounded_loops_insns = vec![
mov64_imm(Register::R0, 10),
alu64_imm(AluOp::SUB, Register::R0, 1),
jmp_imm(JmpOp::JNE, Register::R0, 0, -2),
exit(),
];
// Returns true if program was successfully loaded into the kernel
let bounded_loops_supported: bool = load_insns(bounded_loops_insns);