An eBPF overview series from Collabora
Adrian Ratiu is posting a series of articles on the Collabora blog digging
into the kernel's eBPF subsystem. The first two parts are available now:
an
introduction and a
look at the virtual machine. "eBPF is a RISC register machine
with a total of 11 64-bit registers, a program counter and a 512 byte
fixed-size stack. 9 registers are general purpouse read-write, one is a
read-only stack pointer and the program counter is implicit, i.e. we can
only jump to a certain offset from it. The VM registers are always 64-bit
wide (even when running inside a 32-bit ARM processor kernel!) and support
32-bit subregister addressing if the most significant 32 bits are zeroed -
this will be very useful in part 4 when cross-compiling and running eBPF
programs on embedded devices."