Remove filter.txt and update references to the new RST files.
Filter) facility, with a focus on the extended BPF version (eBPF).
that goes into great technical depth about the BPF Architecture.
@@ -30,7 +36,6 @@  Two sets of Questions and Answers (Q&A) are maintained.
- Level Compressed Trie (LC-trie) notes: a structure for routing.
- FORE Systems PCA-200E/SBA-200E ATM NIC driver info.
-Linux Socket Filtering (LSF) is derived from the Berkeley Packet Filter.
-mean the very same mechanism of filtering in the Linux kernel.
-to the BSD bpf.4 manpage is very helpful in creating filters.
-SO_LOCK_FILTER option allows locking of the filter attached to a socket.
-assured that the filter will be kept until the socket is closed.
-displays what is being placed into this structure.
-such as team driver, PTP code, etc where BPF is being used.
-value to be used for a provided code.
-follow-up example) is being passed to the kernel through setsockopt(2).
-be dropped for this socket.
-integer value with 0 or 1.
-but can also be used on other socket families.
-you should stick to that. libpcap wraps its own layer around all that.
-access to BPF code as well.
-closely modelled after Steven McCanne's and Van Jacobson's BPF paper.
-ways depending on the given instruction in op.
-extensions are loaded into A.
-These extensions can also be prefixed with '#'.
-BPF code on the pcap's packets and to do BPF machine register dumps.
-sink as a second one, e.g. `./bpf_dbg test_in.txt test_out.txt`.
-support (follow-up example commands starting with '>' denote bpf_dbg shell).
-  Loads standard tcpdump pcap file.
-  the filter will generate. A limit of packets to traverse can be given.
-  Prints out BPF code disassembly.
-  Prints out C-style BPF code dump.
-  Prints currently set breakpoints.
-  offset. Thus, on each step invocation, above register dump is issued.
-toolchain for developing and testing the kernel's JIT compiler.
-an eBPF backend that performs almost as fast as natively compiled code.
-minimal performance overhead over two steps, that is, C -> eBPF -> native code.
-by using bpf_prog_create() for setting up the filter, resp.
-got from bpf_prog_create(), and 'ctx' the given context (e.g.
-before a conversion to the new layout is being done behind the scenes!
-JIT compilation from eBPF instruction set.
-  registers, and aarch64/sparcv9/mips64 have 11 or more callee saved registers.
-  and may let more complex programs to be interpreted.
-  call predefined in-kernel functions, though.
-  subregisters that zero-extend into 64-bit if they are being written to.
-  makes other JITs more difficult.
-  32-bit architectures run 64-bit internal BPF programs via interpreter.
-  native instruction set and let the rest be interpreted.
-  64-bit wide and we want to pass 64-bit values in/out of kernel functions.
-  register in and out of the function, which is complex, bug prone and slow.
-  Another reason is the use of atomic 64-bit counters.
-  "if (cond) jump_true; /* else fall-through */".
-  situations without performance penalty.
-  is preserved across the call.
-  be used to call into f2.
-  and rbx, r12 - r15 are callee saved.
-  registers and place their return value into '%rax' which is R0 in eBPF.
-  them across the calls as defined by calling convention.
-  After the call the registers R1-R5 contain junk values and cannot be read.
-  An in-kernel eBPF verifier is used to validate internal BPF programs.
-which helps to do one-to-one mapping between eBPF insn and x86 insn during JIT.
-to seccomp_data, for converted BPF filters R1 points to a skb.
-every instruction are used during translation from original BPF to new format.
-out of registers and would have to resort to spill/fill to stack.
-as described, it may be used as safe as the instruction set.
-the state change of registers and stack.
-... and four MSB bits store operation code.
-and eBPF. There are only two registers in classic BPF, so it means A += X.
-src_reg = (u32) src_reg ^ (u32) imm32 in eBPF.
-Classic BPF is using BPF_MISC class to represent A = X and X = A moves.
-instead. So BPF_ADD | BPF_X | BPF_ALU64 means 64-bit addition i.e.
-unused and reserved for future use.
-(BPF_IND | <size> | BPF_LD) which are used to access packet data.
-explicit inputs to these instructions.
-    and R1 - R5 were scratched.
-2 byte atomic increments are not supported.
-instruction that loads 64-bit immediate value into a dst_reg.
-32-bit immediate value into a register.
-The safety of the eBPF program is determined in two steps.
-First step does DAG check to disallow loops and other CFG validation.
-(though classic BPF checker allows them).
-Second step starts from the first insn and descends all possible paths.
-PTR_TO_CTX as well and can be used on the right hand side of expression.
-since addition of two valid pointers makes invalid pointer.
-will be rejected, since R2 is unreadable at the start of the program.
-R0 has a return type of the function.
-Since R6-R9 are callee saved, their state is preserved across the call.
-are PTR_TO_CTX, PTR_TO_MAP, PTR_TO_STACK. They are bounds and alignment checked.
-certain fields within ctx structure with specified size and alignment.
-the verifier will reject the program.
-so it will fail verification, since it's out of bounds.
-Classic BPF verifier does similar check with M[0-15] memory slots.
-and R10 - 4 is within stack bounds, there were no stores into that location.
-callee saved registers may not be enough for some programs.
-The eBPF verifier will check that registers match argument constraints.
-After the call register R0 will be set to return type of the function.
-whereas tracing filters may allow a completely different set.
-function is called with valid arguments.
-seccomp vs socket filters have different security restrictions for classic BPF.
-the range of possible values in each register and also in each stack slot.
-    PTR_TO_CTX          Pointer to bpf_context.
-                        on these pointers is forbidden.
-    PTR_TO_MAP_VALUE    Pointer to the value stored in a map element.
-                        which becomes a PTR_TO_MAP_VALUE when checked != NULL.
-                        Arithmetic on these pointers is forbidden.
-    PTR_TO_PACKET_END   skb->data + headlen; arithmetic forbidden.
-the range of possible values in the register.
-0x1ff), because of potential carries.
-is also > 4 and s< 8, since the bounds prevent crossing the sign boundary.
-below, for more on PTR_TO_PACKET ranges.
-checked and found to be non-NULL, all copies can become PTR_TO_MAP_VALUEs.
-data via skb->data and skb->data_end pointers.
-id=0 means that no additional variables were added to the register.
-off=0 means that no additional constants were added.
-r=14 is the range of safe access which means that bytes [R3, R3 + 14) are ok.
-'if (r3 + 8 > r1) goto err' at insn #18, the safe range is [R3, R3 + 8).
-available for direct packet access.
-through the pointer will give "invalid access to packet" error.
-versa) and adjust_scalar_min_max_vals() for operations on two scalars.
-maps can have different types: hash, array, bloom filter, radix-tree, etc.
-another NOT_INIT) is safe.  The implementation is in the function regsafe().
-registers it may hold).  They must all be safe for the branch to be pruned.
-This is implemented in states_equal().
-including timings in nsec can be found in the kernel log (dmesg).
@@ -1051,7 +1051,7 @@  for more information on hardware timestamps.
*    pretty print a C-like construct.
* into one in order to prevent parsing same headers multiple times.