Disassembly support for Extended BPF by Jagath-P · Pull Request #6204 · rizinorg/rizin

Jagath-P · 2026-04-10T17:14:58Z

Your checklist for this pull request

I've read the guidelines for contributing to this repository.
I made sure to follow the project's coding style.
I've documented every RZ_API function and struct this PR changes.
I've added tests that prove my changes are effective (required for changes to RZ_API).
I've updated the Rizin book with the relevant information (if needed).
I've used AI tools to generate fully or partially these code changes and I'm sure the changes are not copyrighted by somebody else.

Detailed description

I have used AI for doing some repeated stuff like writing all instructions op types, I have manually checked each instruction after the use.
...

Test plan

...

Closing issues

closes ebpf part of #4757

...

notxvilka

Please rebase on top of the latest dev

codecov · 2026-04-26T13:32:39Z

Codecov Report

❌ Patch coverage is 57.85953% with 126 lines in your changes missing coverage. Please review.
✅ Project coverage is 49.91%. Comparing base (5fa8210) to head (72ead9b).
⚠️ Report is 4 commits behind head on dev.

Files with missing lines	Patch %	Lines
librz/arch/p/analysis/analysis_bpf_cs.c	58.51%	90 Missing and 22 partials ⚠️
librz/arch/p/asm/asm_bpf_cs.c	51.72%	8 Missing and 6 partials ⚠️

Additional details and impacted files

Files with missing lines	Coverage Δ
librz/arch/p/asm/asm_bpf_cs.c	`51.72% <51.72%> (ø)`
librz/arch/p/analysis/analysis_bpf_cs.c	`58.51% <58.51%> (ø)`

... and 15 files with indirect coverage changes

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 5fa8210...72ead9b. Read the comment docs.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Jagath-P · 2026-05-02T14:00:26Z

I will be back to this PR after 4 days, need to finish up my semester exams

notxvilka · 2026-05-23T18:59:30Z

@Jagath-P please rebase again and resolve the conflicts

Rot127

Please increase test coverage to cover at lease:

all operand types
all jumps and calls. They are too important to not be tested.

Rot127 · 2026-06-02T19:07:20Z

+	case BPF_INS_JSGE:
+	case BPF_INS_JSLT:
+	case BPF_INS_JSLE:
+		if (insn->detail->bpf.op_count > 2) {


wargio · 2026-06-03T12:36:58Z

this needs to be tested against cs4-5

Jagath-P · 2026-06-03T17:04:28Z

this needs to be tested against cs4-5

BPF doesn't exist in capstone v4 , It was introduced only from v5, Hence in meson.build file declared bpf plugins under capstone version >4 . Also I have added multiple checks in analysis_bpf_cs.c file for capstone v6 specific instructions

I have taken https://github.com/capstone-engine/capstone/blob/next/include/capstone/bpf.h as reference, and I took into account bpf.h file of next, v5,v6

even though how do i test locally using capstone past versions ? should i update my subprojects?

notxvilka · 2026-06-05T18:17:06Z

this needs to be tested against cs4-5

BPF doesn't exist in capstone v4 , It was introduced only from v5, Hence in meson.build file declared bpf plugins under capstone version >4 . Also I have added multiple checks in analysis_bpf_cs.c file for capstone v6 specific instructions

I have taken https://github.com/capstone-engine/capstone/blob/next/include/capstone/bpf.h as reference, and I took into account bpf.h file of next, v5,v6

even though how do i test locally using capstone past versions ? should i update my subprojects?

See how it's done in our CI workflow: .github/workflows/ci.yml

notxvilka · 2026-06-13T07:16:56Z

@Jagath-P please address the feedback so that this could land for the upcoming 0.9.0 release

Jagath-P · 2026-06-13T16:28:01Z

@Jagath-P please address the feedback so that this could land for the upcoming 0.9.0 release

Yeah was busy in other works, will finish the work soon

Jagath-P · 2026-06-18T09:37:57Z

I have gated the bpf plugin currently to capstone next only . As CS_API_MAJOR is 6 in both released v6 and next — version numbers alone cannot distinguish them. Latest BPF instructions (SDIV, SMOD, MOVSB, JLT32etc.) (present in the Linux Kernel 7.1.0 BPF ISA specification doc) are not present in any released Capstone version yet.
Support for already existing capstone v5,v6 can be added once Capstone cuts a release with full BPF ISA support.

Jagath-P · 2026-06-29T08:28:19Z

@notxvilka @wargio @Rot127 can any of you review this once again

Rot127

As CS_API_MAJOR is 6 in both released v6 and next

Please rebase. With the latest capstone there is the CS_VERSION_PRE_RELEASE you can use.

@Jagath-P It seems like the capstone v4/v5 workflows don't run properly if I push it to upstream/
Please address the comments here and then reopen the PR with a capstone- prefix in the branch name.

Rot127 · 2026-07-01T17:18:32Z

+	cs_free(insn, n);
+	return op->size;
+}
+RzAnalysisPlugin rz_analysis_plugin_bpf_cs = {


newline missing

Rot127 · 2026-07-01T17:18:59Z

+	.name = "bpf",
+	.desc = "Extended BPF analysis plugin",
+	.license = "LGPL3",
+	.arch = "bpf",


Add your authorship

notxvilka · 2026-07-13T15:45:12Z

Superseded by #6611

Jagath-P requested review from Rot127, b1llow, kazarmy, notxvilka, ret2libc, thestr4ng3r and wargio as code owners April 10, 2026 17:15

github-actions Bot added rz-test RzAnalysis labels Apr 10, 2026

Jagath-P mentioned this pull request Apr 10, 2026

Add eBPF binary rizinorg/rizin-testbins#276

Merged

Jagath-P force-pushed the ebpf_disassembly branch from 78acef3 to 068b958 Compare April 11, 2026 17:16

notxvilka requested changes Apr 26, 2026

View reviewed changes

notxvilka added this to the 0.9.0 milestone Apr 26, 2026

Jagath-P force-pushed the ebpf_disassembly branch from 068b958 to 1104c78 Compare April 26, 2026 11:40

Jagath-P requested a review from notxvilka April 26, 2026 12:23

wargio reviewed Apr 26, 2026

View reviewed changes

Comment thread librz/arch/p/asm/asm_bpf_cs.c Outdated

notxvilka added the waiting-for-author Used to mark PRs where more work is needed label May 2, 2026

Jagath-P force-pushed the ebpf_disassembly branch from 228e3ae to cbde434 Compare May 11, 2026 06:50

Jagath-P requested a review from wargio May 11, 2026 10:14

Jagath-P force-pushed the ebpf_disassembly branch 2 times, most recently from a9381bd to b7b2fed Compare May 25, 2026 08:05

notxvilka approved these changes May 25, 2026

View reviewed changes

Comment thread librz/arch/p/analysis/analysis_bpf_cs.c Outdated

Comment thread librz/arch/p/asm/asm_bpf_cs.c Outdated

Jagath-P force-pushed the ebpf_disassembly branch from b7b2fed to dafe935 Compare May 25, 2026 10:14

Rot127 requested changes Jun 2, 2026

View reviewed changes

Rot127 marked this pull request as draft June 14, 2026 17:06

Jagath-P force-pushed the ebpf_disassembly branch from dafe935 to 0d71459 Compare June 18, 2026 09:12

Jagath-P requested review from Rot127 and notxvilka June 18, 2026 11:43

Jagath-P force-pushed the ebpf_disassembly branch 2 times, most recently from aceb55e to cb18ba8 Compare June 19, 2026 06:38

notxvilka modified the milestones: 0.9.0, 1.0.0 Jun 21, 2026

Jagath-P added 13 commits June 29, 2026 11:10

Added disassembly and analysis support for eBPF

414f6fc

Added tests for disassembly and analysis

56b7a25

Fixed ci error

0fb1e2a

Made few extra changes

eb282c0

Made minor change

544a901

Fixed minor error in register profile

97ec3ba

Fixed minor errors and improved disassembly and analysis plugins

d95b99b

Improved test coverage

b88eda4

Resolved merge conflict

6225598

Fix email formatting

ae20a35

Fix instruction leaks,warns wherever needed

b6b813b

Gate ebpf plugin to capstone-next, fix analysis bugs

3eff5ae

Increase test coverage for jumps and call instructions

72ead9b

Jagath-P force-pushed the ebpf_disassembly branch from cb18ba8 to 72ead9b Compare June 29, 2026 06:21

Jagath-P marked this pull request as ready for review June 29, 2026 08:20

Rot127 requested changes Jul 1, 2026

View reviewed changes

notxvilka closed this Jul 13, 2026

Uh oh!

Uh oh!

Conversation

Jagath-P commented Apr 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

notxvilka left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

codecov Bot commented Apr 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Jagath-P commented May 2, 2026

Uh oh!

notxvilka commented May 23, 2026

Uh oh!

Uh oh!

Uh oh!

Rot127 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Rot127 Jun 2, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wargio commented Jun 3, 2026

Uh oh!

Jagath-P commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

notxvilka commented Jun 5, 2026

Uh oh!

notxvilka commented Jun 13, 2026

Uh oh!

Jagath-P commented Jun 13, 2026

Uh oh!

Jagath-P commented Jun 18, 2026

Uh oh!

Jagath-P commented Jun 29, 2026

Uh oh!

Rot127 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Rot127 Jul 1, 2026

Choose a reason for hiding this comment

Uh oh!

Rot127 Jul 1, 2026

Choose a reason for hiding this comment

Uh oh!

notxvilka commented Jul 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Jagath-P commented Apr 10, 2026 •

edited

Loading

codecov Bot commented Apr 26, 2026 •

edited

Loading

Jagath-P commented Jun 3, 2026 •

edited

Loading

Rot127 left a comment •

edited

Loading