Cooking into the eBPF verifier
Table of Contents
The goal
Rn, we gotta understand the working of the verifier and hopefully find errors.
bpf_check
This is the holy grail where it all starts.
bpf_verifier_envis similarly the holy grail struct where it all begins.bpf_featuresI still do not fully understand this enum, although I know it talks about readonly memory and bpf streams.kvzalloc_objthis is a kernel malloc variant that either allocates physically contiguous memory askmalloc, or then falls back tovmallocthat gives virtually contiguous memory. Thezalso zeros out stuff._objmeans type safe wrapper that auto-calculates the size.iarray_reallocis a genius move. It keeps in mind both the branches of an if condition and preallocates both the branches of this so no reallocation needs to be done.