Question : How does the cBPF to eBPF assembly work

[nitishm]

I am trying to understand how this works? Is there a write-up, document, external resource that I can refer that explains how the registers are used?

Also I am looking at XDPCAP code and trying to understand how it is different from the sample program provided in this repo?

[arthurfabre]

https://pkg.go.dev/github.com/cloudflare/cbpfc#EBPFOpts documents the registers cbpfc expects. The example program just picks some arbitrarily - it could be made to work with any of the registers. For example it sets R2 as the packet pointer:

PacketStart: asm.R2,

only because that's where it also puts the packet pointer:

// Packet start
asm.LoadMem(asm.R2, asm.R1, 0, asm.Word),

xdpcap is similar to the example, but it adds metrics (via a map) and copies matching packets to a perf buffer (so they can be read from userspace, and written to a pcap file).