@@ -27,10 +27,10 @@ all of which are 64-bits wide.
27
27
28
28
The eBPF calling convention is defined as:
29
29
30
- * R0: return value from function calls, and exit value for eBPF programs
31
- * R1 - R5: arguments for function calls
32
- * R6 - R9: callee saved registers that function calls will preserve
33
- * R10: read-only frame pointer to access stack
30
+ * R0: return value from function calls, and exit value for eBPF programs
31
+ * R1 - R5: arguments for function calls
32
+ * R6 - R9: callee saved registers that function calls will preserve
33
+ * R10: read-only frame pointer to access stack
34
34
35
35
Registers R0 - R5 are scratch registers, meaning the BPF program needs to either
36
36
spill them to the BPF stack or move them to callee saved registers if these
@@ -63,17 +63,17 @@ An eBPF program is a sequence of instructions.
63
63
64
64
eBPF has two instruction encodings:
65
65
66
- * the basic instruction encoding, which uses 64 bits to encode an instruction
67
- * the wide instruction encoding, which appends a second 64-bit immediate (i.e.,
68
- constant) value after the basic instruction for a total of 128 bits.
66
+ * the basic instruction encoding, which uses 64 bits to encode an instruction
67
+ * the wide instruction encoding, which appends a second 64-bit immediate (i.e.,
68
+ constant) value after the basic instruction for a total of 128 bits.
69
69
70
70
The basic instruction encoding is as follows:
71
71
72
- ============= ======= =============== ==================== ============
73
- 32 bits (MSB) 16 bits 4 bits 4 bits 8 bits (LSB)
74
- ============= ======= =============== ==================== ============
75
- imm offset src dst opcode
76
- ============= ======= =============== ==================== ============
72
+ ============= ======= =============== ==================== ============
73
+ 32 bits (MSB) 16 bits 4 bits 4 bits 8 bits (LSB)
74
+ ============= ======= =============== ==================== ============
75
+ imm offset src dst opcode
76
+ ============= ======= =============== ==================== ============
77
77
78
78
imm
79
79
integer immediate value
@@ -97,11 +97,11 @@ As discussed below in `64-bit immediate instructions`_, some basic
97
97
instructions denote that a 64-bit immediate value follows. Thus
98
98
the wide instruction encoding is as follows:
99
99
100
- ================= =============
101
- 64 bits (MSB) 64 bits (LSB)
102
- ================= =============
103
- basic instruction imm64
104
- ================= =============
100
+ ================= =============
101
+ 64 bits (MSB) 64 bits (LSB)
102
+ ================= =============
103
+ basic instruction imm64
104
+ ================= =============
105
105
106
106
where MSB and LSB mean the most significant bits and least significant bits, respectively.
107
107
@@ -115,18 +115,18 @@ The encoding of the 'opcode' field varies and can be determined from
115
115
the three least significant bits (LSB) of the 'opcode' field which holds
116
116
the "instruction class", as follows:
117
117
118
- ========= ===== =============================== ======= =================
119
- class value description version reference
120
- ========= ===== =============================== ======= =================
121
- BPF_LD 0x00 non-standard load operations 1 `Load and store instructions `_
122
- BPF_LDX 0x01 load into register operations 1 `Load and store instructions `_
123
- BPF_ST 0x02 store from immediate operations 1 `Load and store instructions `_
124
- BPF_STX 0x03 store from register operations 1 `Load and store instructions `_
125
- BPF_ALU 0x04 32-bit arithmetic operations 3 `Arithmetic and jump instructions `_
126
- BPF_JMP 0x05 64-bit jump operations 1 `Arithmetic and jump instructions `_
127
- BPF_JMP32 0x06 32-bit jump operations 3 `Arithmetic and jump instructions `_
128
- BPF_ALU64 0x07 64-bit arithmetic operations 1 `Arithmetic and jump instructions `_
129
- ========= ===== =============================== ======= =================
118
+ ========= ===== =============================== ======= =================
119
+ class value description version reference
120
+ ========= ===== =============================== ======= =================
121
+ BPF_LD 0x00 non-standard load operations 1 `Load and store instructions `_
122
+ BPF_LDX 0x01 load into register operations 1 `Load and store instructions `_
123
+ BPF_ST 0x02 store from immediate operations 1 `Load and store instructions `_
124
+ BPF_STX 0x03 store from register operations 1 `Load and store instructions `_
125
+ BPF_ALU 0x04 32-bit arithmetic operations 3 `Arithmetic and jump instructions `_
126
+ BPF_JMP 0x05 64-bit jump operations 1 `Arithmetic and jump instructions `_
127
+ BPF_JMP32 0x06 32-bit jump operations 3 `Arithmetic and jump instructions `_
128
+ BPF_ALU64 0x07 64-bit arithmetic operations 1 `Arithmetic and jump instructions `_
129
+ ========= ===== =============================== ======= =================
130
130
131
131
where 'version' indicates the first ISA version in which support for the value was mandatory.
132
132
@@ -136,11 +136,11 @@ Arithmetic and jump instructions
136
136
For arithmetic and jump instructions (``BPF_ALU ``, ``BPF_ALU64 ``, ``BPF_JMP `` and
137
137
``BPF_JMP32 ``), the 8-bit 'opcode' field is divided into three parts:
138
138
139
- ============== ====== =================
140
- 4 bits (MSB) 1 bit 3 bits (LSB)
141
- ============== ====== =================
142
- code source instruction class
143
- ============== ====== =================
139
+ ============== ====== =================
140
+ 4 bits (MSB) 1 bit 3 bits (LSB)
141
+ ============== ====== =================
142
+ code source instruction class
143
+ ============== ====== =================
144
144
145
145
code
146
146
the operation code, whose meaning varies by instruction class
@@ -176,24 +176,24 @@ versions.
176
176
177
177
The 4-bit 'code' field encodes the operation as follows:
178
178
179
- ======== ===== =================================================
180
- code value description
181
- ======== ===== =================================================
182
- BPF_ADD 0x00 dst += src
183
- BPF_SUB 0x10 dst -= src
184
- BPF_MUL 0x20 dst \* = src
185
- BPF_DIV 0x30 dst /= src
186
- BPF_OR 0x40 dst \| = src
187
- BPF_AND 0x50 dst &= src
188
- BPF_LSH 0x60 dst <<= src
189
- BPF_RSH 0x70 dst >>= src
190
- BPF_NEG 0x80 dst = ~src
191
- BPF_MOD 0x90 dst %= src
192
- BPF_XOR 0xa0 dst ^= src
193
- BPF_MOV 0xb0 dst = src
194
- BPF_ARSH 0xc0 sign extending shift right
195
- BPF_END 0xd0 byte swap operations (see `Byte swap instructions `_ below)
196
- ======== ===== =================================================
179
+ ======== ===== =================================================
180
+ code value description
181
+ ======== ===== =================================================
182
+ BPF_ADD 0x00 dst += src
183
+ BPF_SUB 0x10 dst -= src
184
+ BPF_MUL 0x20 dst \* = src
185
+ BPF_DIV 0x30 dst /= src
186
+ BPF_OR 0x40 dst \| = src
187
+ BPF_AND 0x50 dst &= src
188
+ BPF_LSH 0x60 dst <<= src
189
+ BPF_RSH 0x70 dst >>= src
190
+ BPF_NEG 0x80 dst = ~src
191
+ BPF_MOD 0x90 dst %= src
192
+ BPF_XOR 0xa0 dst ^= src
193
+ BPF_MOV 0xb0 dst = src
194
+ BPF_ARSH 0xc0 sign extending shift right
195
+ BPF_END 0xd0 byte swap operations (see `Byte swap instructions `_ below)
196
+ ======== ===== =================================================
197
197
198
198
Underflow and overflow are allowed during arithmetic operations,
199
199
meaning the 64-bit or 32-bit value will wrap.
@@ -242,12 +242,12 @@ Byte swap instructions use non-default semantics of the 1-bit 'source' field in
242
242
the 'opcode' field. Instead of indicating the source operator, it is instead
243
243
used to select what byte order the operation converts from or to:
244
244
245
- ========= ===== =================================================
246
- source value description
247
- ========= ===== =================================================
248
- BPF_TO_LE 0x00 convert between host byte order and little endian
249
- BPF_TO_BE 0x08 convert between host byte order and big endian
250
- ========= ===== =================================================
245
+ ========= ===== =================================================
246
+ source value description
247
+ ========= ===== =================================================
248
+ BPF_TO_LE 0x00 convert between host byte order and little endian
249
+ BPF_TO_BE 0x08 convert between host byte order and big endian
250
+ ========= ===== =================================================
251
251
252
252
**Note **
253
253
@@ -259,21 +259,22 @@ The 'imm' field encodes the width of the swap operations. The following widths
259
259
are supported: 16, 32 and 64. The following table summarizes the resulting
260
260
possibilities:
261
261
262
- ============================= ========= === ======== ==================
263
- opcode construction opcode imm mnemonic pseudocode
264
- ============================= ========= === ======== ==================
265
- BPF_END | BPF_TO_LE | BPF_ALU 0xd4 16 le16 dst dst = htole16(dst)
266
- BPF_END | BPF_TO_LE | BPF_ALU 0xd4 32 le32 dst dst = htole32(dst)
267
- BPF_END | BPF_TO_LE | BPF_ALU 0xd4 64 le64 dst dst = htole64(dst)
268
- BPF_END | BPF_TO_BE | BPF_ALU 0xdc 16 be16 dst dst = htobe16(dst)
269
- BPF_END | BPF_TO_BE | BPF_ALU 0xdc 32 be32 dst dst = htobe32(dst)
270
- BPF_END | BPF_TO_BE | BPF_ALU 0xdc 64 be64 dst dst = htobe64(dst)
271
- ============================= ========= === ======== ==================
262
+ ============================= ========= === ======== ==================
263
+ opcode construction opcode imm mnemonic pseudocode
264
+ ============================= ========= === ======== ==================
265
+ BPF_END | BPF_TO_LE | BPF_ALU 0xd4 16 le16 dst dst = htole16(dst)
266
+ BPF_END | BPF_TO_LE | BPF_ALU 0xd4 32 le32 dst dst = htole32(dst)
267
+ BPF_END | BPF_TO_LE | BPF_ALU 0xd4 64 le64 dst dst = htole64(dst)
268
+ BPF_END | BPF_TO_BE | BPF_ALU 0xdc 16 be16 dst dst = htobe16(dst)
269
+ BPF_END | BPF_TO_BE | BPF_ALU 0xdc 32 be32 dst dst = htobe32(dst)
270
+ BPF_END | BPF_TO_BE | BPF_ALU 0xdc 64 be64 dst dst = htobe64(dst)
271
+ ============================= ========= === ======== ==================
272
272
273
273
where
274
- * mnenomic indicates a short form that might be displayed by some tools such as disassemblers
275
- * 'htoleNN()' indicates converting a NN-bit value from host byte order to little-endian byte order
276
- * 'htobeNN()' indicates converting a NN-bit value from host byte order to big-endian byte order
274
+
275
+ * mnenomic indicates a short form that might be displayed by some tools such as disassemblers
276
+ * 'htoleNN()' indicates converting a NN-bit value from host byte order to little-endian byte order
277
+ * 'htobeNN()' indicates converting a NN-bit value from host byte order to big-endian byte order
277
278
278
279
Jump instructions
279
280
-----------------
@@ -286,24 +287,24 @@ versions.
286
287
287
288
The 4-bit 'code' field encodes the operation as below, where PC is the program counter:
288
289
289
- ======== ===== ============================ ======= ============
290
- code value description version notes
291
- ======== ===== ============================ ======= ============
292
- BPF_JA 0x00 PC += offset 1 BPF_JMP only
293
- BPF_JEQ 0x10 PC += offset if dst == src 1
294
- BPF_JGT 0x20 PC += offset if dst > src 1 unsigned
295
- BPF_JGE 0x30 PC += offset if dst >= src 1 unsigned
296
- BPF_JSET 0x40 PC += offset if dst & src 1
297
- BPF_JNE 0x50 PC += offset if dst != src 1
298
- BPF_JSGT 0x60 PC += offset if dst > src 1 signed
299
- BPF_JSGE 0x70 PC += offset if dst >= src 1 signed
300
- BPF_CALL 0x80 call function imm 1 see `Helper functions `_
301
- BPF_EXIT 0x90 function / program return 1 BPF_JMP only
302
- BPF_JLT 0xa0 PC += offset if dst < src 2 unsigned
303
- BPF_JLE 0xb0 PC += offset if dst <= src 2 unsigned
304
- BPF_JSLT 0xc0 PC += offset if dst < src 2 signed
305
- BPF_JSLE 0xd0 PC += offset if dst <= src 2 signed
306
- ======== ===== ============================ ======= ============
290
+ ======== ===== ============================ ======= ============
291
+ code value description version notes
292
+ ======== ===== ============================ ======= ============
293
+ BPF_JA 0x00 PC += offset 1 BPF_JMP only
294
+ BPF_JEQ 0x10 PC += offset if dst == src 1
295
+ BPF_JGT 0x20 PC += offset if dst > src 1 unsigned
296
+ BPF_JGE 0x30 PC += offset if dst >= src 1 unsigned
297
+ BPF_JSET 0x40 PC += offset if dst & src 1
298
+ BPF_JNE 0x50 PC += offset if dst != src 1
299
+ BPF_JSGT 0x60 PC += offset if dst > src 1 signed
300
+ BPF_JSGE 0x70 PC += offset if dst >= src 1 signed
301
+ BPF_CALL 0x80 call function imm 1 see `Helper functions `_
302
+ BPF_EXIT 0x90 function / program return 1 BPF_JMP only
303
+ BPF_JLT 0xa0 PC += offset if dst < src 2 unsigned
304
+ BPF_JLE 0xb0 PC += offset if dst <= src 2 unsigned
305
+ BPF_JSLT 0xc0 PC += offset if dst < src 2 signed
306
+ BPF_JSLE 0xd0 PC += offset if dst <= src 2 signed
307
+ ======== ===== ============================ ======= ============
307
308
308
309
where 'version' indicates the first ISA version in which the value was supported.
309
310
@@ -330,11 +331,11 @@ Load and store instructions
330
331
For load and store instructions (``BPF_LD ``, ``BPF_LDX ``, ``BPF_ST ``, and ``BPF_STX ``), the
331
332
8-bit 'opcode' field is divided as:
332
333
333
- ============ ====== =================
334
- 3 bits (MSB) 2 bits 3 bits (LSB)
335
- ============ ====== =================
336
- mode size instruction class
337
- ============ ====== =================
334
+ ============ ====== =================
335
+ 3 bits (MSB) 2 bits 3 bits (LSB)
336
+ ============ ====== =================
337
+ mode size instruction class
338
+ ============ ====== =================
338
339
339
340
mode
340
341
one of:
@@ -370,22 +371,22 @@ Regular load and store operations
370
371
The ``BPF_MEM `` mode modifier is used to encode regular load and store
371
372
instructions that transfer data between a register and memory.
372
373
373
- ============================= ========= ==================================
374
- opcode construction opcode pseudocode
375
- ============================= ========= ==================================
376
- BPF_MEM | BPF_B | BPF_LDX 0x71 dst = *(uint8_t *) (src + offset)
377
- BPF_MEM | BPF_H | BPF_LDX 0x69 dst = *(uint16_t *) (src + offset)
378
- BPF_MEM | BPF_W | BPF_LDX 0x61 dst = *(uint32_t *) (src + offset)
379
- BPF_MEM | BPF_DW | BPF_LDX 0x79 dst = *(uint64_t *) (src + offset)
380
- BPF_MEM | BPF_B | BPF_ST 0x72 *(uint8_t *) (dst + offset) = imm
381
- BPF_MEM | BPF_H | BPF_ST 0x6a *(uint16_t *) (dst + offset) = imm
382
- BPF_MEM | BPF_W | BPF_ST 0x62 *(uint32_t *) (dst + offset) = imm
383
- BPF_MEM | BPF_DW | BPF_ST 0x7a *(uint64_t *) (dst + offset) = imm
384
- BPF_MEM | BPF_B | BPF_STX 0x73 *(uint8_t *) (dst + offset) = src
385
- BPF_MEM | BPF_H | BPF_STX 0x6b *(uint16_t *) (dst + offset) = src
386
- BPF_MEM | BPF_W | BPF_STX 0x63 *(uint32_t *) (dst + offset) = src
387
- BPF_MEM | BPF_DW | BPF_STX 0x7b *(uint64_t *) (dst + offset) = src
388
- ============================= ========= ==================================
374
+ ============================= ========= ==================================
375
+ opcode construction opcode pseudocode
376
+ ============================= ========= ==================================
377
+ BPF_MEM | BPF_B | BPF_LDX 0x71 dst = *(uint8_t *) (src + offset)
378
+ BPF_MEM | BPF_H | BPF_LDX 0x69 dst = *(uint16_t *) (src + offset)
379
+ BPF_MEM | BPF_W | BPF_LDX 0x61 dst = *(uint32_t *) (src + offset)
380
+ BPF_MEM | BPF_DW | BPF_LDX 0x79 dst = *(uint64_t *) (src + offset)
381
+ BPF_MEM | BPF_B | BPF_ST 0x72 *(uint8_t *) (dst + offset) = imm
382
+ BPF_MEM | BPF_H | BPF_ST 0x6a *(uint16_t *) (dst + offset) = imm
383
+ BPF_MEM | BPF_W | BPF_ST 0x62 *(uint32_t *) (dst + offset) = imm
384
+ BPF_MEM | BPF_DW | BPF_ST 0x7a *(uint64_t *) (dst + offset) = imm
385
+ BPF_MEM | BPF_B | BPF_STX 0x73 *(uint8_t *) (dst + offset) = src
386
+ BPF_MEM | BPF_H | BPF_STX 0x6b *(uint16_t *) (dst + offset) = src
387
+ BPF_MEM | BPF_W | BPF_STX 0x63 *(uint32_t *) (dst + offset) = src
388
+ BPF_MEM | BPF_DW | BPF_STX 0x7b *(uint64_t *) (dst + offset) = src
389
+ ============================= ========= ==================================
389
390
390
391
Atomic operations
391
392
-----------------
@@ -397,8 +398,8 @@ by other eBPF programs or means outside of this specification.
397
398
All atomic operations supported by eBPF are encoded as store operations
398
399
that use the ``BPF_ATOMIC `` mode modifier as follows:
399
400
400
- * ``BPF_ATOMIC | BPF_W | BPF_STX `` (0xc3) for 32-bit operations
401
- * ``BPF_ATOMIC | BPF_DW | BPF_STX `` (0xdb) for 64-bit operations
401
+ * ``BPF_ATOMIC | BPF_W | BPF_STX `` (0xc3) for 32-bit operations
402
+ * ``BPF_ATOMIC | BPF_DW | BPF_STX `` (0xdb) for 64-bit operations
402
403
403
404
Note that 8-bit (``BPF_B ``) and 16-bit (``BPF_H ``) wide atomic operations are not supported,
404
405
nor is ``BPF_ATOMIC | <size> | BPF_ST ``.
@@ -407,14 +408,14 @@ The 'imm' field is used to encode the actual atomic operation.
407
408
Simple atomic operation use a subset of the values defined to encode
408
409
arithmetic operations in the 'imm' field to encode the atomic operation:
409
410
410
- ======== ===== =========== =======
411
- imm value description version
412
- ======== ===== =========== =======
413
- BPF_ADD 0x00 atomic add 1
414
- BPF_OR 0x40 atomic or 3
415
- BPF_AND 0x50 atomic and 3
416
- BPF_XOR 0xa0 atomic xor 3
417
- ======== ===== =========== =======
411
+ ======== ===== =========== =======
412
+ imm value description version
413
+ ======== ===== =========== =======
414
+ BPF_ADD 0x00 atomic add 1
415
+ BPF_OR 0x40 atomic or 3
416
+ BPF_AND 0x50 atomic and 3
417
+ BPF_XOR 0xa0 atomic xor 3
418
+ ======== ===== =========== =======
418
419
419
420
where 'version' indicates the first ISA version in which the value was supported.
420
421
@@ -432,13 +433,13 @@ for ``BPF_ATOMIC | BPF_ADD``.
432
433
In addition to the simple atomic operations above, there also is a modifier and
433
434
two complex atomic operations:
434
435
435
- =========== ================ =========================== =======
436
- imm value description version
437
- =========== ================ =========================== =======
438
- BPF_FETCH 0x01 modifier: return old value 3
439
- BPF_XCHG 0xe0 | BPF_FETCH atomic exchange 3
440
- BPF_CMPXCHG 0xf0 | BPF_FETCH atomic compare and exchange 3
441
- =========== ================ =========================== =======
436
+ =========== ================ =========================== =======
437
+ imm value description version
438
+ =========== ================ =========================== =======
439
+ BPF_FETCH 0x01 modifier: return old value 3
440
+ BPF_XCHG 0xe0 | BPF_FETCH atomic exchange 3
441
+ BPF_CMPXCHG 0xf0 | BPF_FETCH atomic compare and exchange 3
442
+ =========== ================ =========================== =======
442
443
443
444
The ``BPF_FETCH `` modifier is optional for simple atomic operations, and
444
445
always set for the complex atomic operations. If the ``BPF_FETCH `` flag
@@ -494,12 +495,12 @@ a register in addition to the immediate data.
494
495
495
496
These instructions have seven implicit operands:
496
497
497
- * Register R6 is an implicit input that must contain a pointer to a
498
- context structure with a packet data pointer.
499
- * Register R0 is an implicit output which contains the data fetched from
500
- the packet.
501
- * Registers R1-R5 are scratch registers that are clobbered by the
502
- instruction.
498
+ * Register R6 is an implicit input that must contain a pointer to a
499
+ context structure with a packet data pointer.
500
+ * Register R0 is an implicit output which contains the data fetched from
501
+ the packet.
502
+ * Registers R1-R5 are scratch registers that are clobbered by the
503
+ instruction.
503
504
504
505
**Note **
505
506
0 commit comments