@@ -27,10 +27,10 @@ all of which are 64-bits wide.
2727
2828The eBPF calling convention is defined as:
2929
30- * R0: return value from function calls, and exit value for eBPF programs
31- * R1 - R5: arguments for function calls
32- * R6 - R9: callee saved registers that function calls will preserve
33- * R10: read-only frame pointer to access stack
30+ * R0: return value from function calls, and exit value for eBPF programs
31+ * R1 - R5: arguments for function calls
32+ * R6 - R9: callee saved registers that function calls will preserve
33+ * R10: read-only frame pointer to access stack
3434
3535Registers R0 - R5 are scratch registers, meaning the BPF program needs to either
3636spill them to the BPF stack or move them to callee saved registers if these
@@ -63,17 +63,17 @@ An eBPF program is a sequence of instructions.
6363
6464eBPF has two instruction encodings:
6565
66- * the basic instruction encoding, which uses 64 bits to encode an instruction
67- * the wide instruction encoding, which appends a second 64-bit immediate (i.e.,
68- constant) value after the basic instruction for a total of 128 bits.
66+ * the basic instruction encoding, which uses 64 bits to encode an instruction
67+ * the wide instruction encoding, which appends a second 64-bit immediate (i.e.,
68+ constant) value after the basic instruction for a total of 128 bits.
6969
7070The basic instruction encoding is as follows:
7171
72- ============= ======= =============== ==================== ============
73- 32 bits (MSB) 16 bits 4 bits 4 bits 8 bits (LSB)
74- ============= ======= =============== ==================== ============
75- imm offset src dst opcode
76- ============= ======= =============== ==================== ============
72+ ============= ======= =============== ==================== ============
73+ 32 bits (MSB) 16 bits 4 bits 4 bits 8 bits (LSB)
74+ ============= ======= =============== ==================== ============
75+ imm offset src dst opcode
76+ ============= ======= =============== ==================== ============
7777
7878imm
7979 integer immediate value
@@ -97,11 +97,11 @@ As discussed below in `64-bit immediate instructions`_, some basic
9797instructions denote that a 64-bit immediate value follows. Thus
9898the wide instruction encoding is as follows:
9999
100- ================= =============
101- 64 bits (MSB) 64 bits (LSB)
102- ================= =============
103- basic instruction imm64
104- ================= =============
100+ ================= =============
101+ 64 bits (MSB) 64 bits (LSB)
102+ ================= =============
103+ basic instruction imm64
104+ ================= =============
105105
106106where MSB and LSB mean the most significant bits and least significant bits, respectively.
107107
@@ -115,18 +115,18 @@ The encoding of the 'opcode' field varies and can be determined from
115115the three least significant bits (LSB) of the 'opcode' field which holds
116116the "instruction class", as follows:
117117
118- ========= ===== =============================== ======= =================
119- class value description version reference
120- ========= ===== =============================== ======= =================
121- BPF_LD 0x00 non-standard load operations 1 `Load and store instructions `_
122- BPF_LDX 0x01 load into register operations 1 `Load and store instructions `_
123- BPF_ST 0x02 store from immediate operations 1 `Load and store instructions `_
124- BPF_STX 0x03 store from register operations 1 `Load and store instructions `_
125- BPF_ALU 0x04 32-bit arithmetic operations 3 `Arithmetic and jump instructions `_
126- BPF_JMP 0x05 64-bit jump operations 1 `Arithmetic and jump instructions `_
127- BPF_JMP32 0x06 32-bit jump operations 3 `Arithmetic and jump instructions `_
128- BPF_ALU64 0x07 64-bit arithmetic operations 1 `Arithmetic and jump instructions `_
129- ========= ===== =============================== ======= =================
118+ ========= ===== =============================== ======= =================
119+ class value description version reference
120+ ========= ===== =============================== ======= =================
121+ BPF_LD 0x00 non-standard load operations 1 `Load and store instructions `_
122+ BPF_LDX 0x01 load into register operations 1 `Load and store instructions `_
123+ BPF_ST 0x02 store from immediate operations 1 `Load and store instructions `_
124+ BPF_STX 0x03 store from register operations 1 `Load and store instructions `_
125+ BPF_ALU 0x04 32-bit arithmetic operations 3 `Arithmetic and jump instructions `_
126+ BPF_JMP 0x05 64-bit jump operations 1 `Arithmetic and jump instructions `_
127+ BPF_JMP32 0x06 32-bit jump operations 3 `Arithmetic and jump instructions `_
128+ BPF_ALU64 0x07 64-bit arithmetic operations 1 `Arithmetic and jump instructions `_
129+ ========= ===== =============================== ======= =================
130130
131131where 'version' indicates the first ISA version in which support for the value was mandatory.
132132
@@ -136,11 +136,11 @@ Arithmetic and jump instructions
136136For arithmetic and jump instructions (``BPF_ALU ``, ``BPF_ALU64 ``, ``BPF_JMP `` and
137137``BPF_JMP32 ``), the 8-bit 'opcode' field is divided into three parts:
138138
139- ============== ====== =================
140- 4 bits (MSB) 1 bit 3 bits (LSB)
141- ============== ====== =================
142- code source instruction class
143- ============== ====== =================
139+ ============== ====== =================
140+ 4 bits (MSB) 1 bit 3 bits (LSB)
141+ ============== ====== =================
142+ code source instruction class
143+ ============== ====== =================
144144
145145code
146146 the operation code, whose meaning varies by instruction class
@@ -176,24 +176,24 @@ versions.
176176
177177The 4-bit 'code' field encodes the operation as follows:
178178
179- ======== ===== =================================================
180- code value description
181- ======== ===== =================================================
182- BPF_ADD 0x00 dst += src
183- BPF_SUB 0x10 dst -= src
184- BPF_MUL 0x20 dst \* = src
185- BPF_DIV 0x30 dst /= src
186- BPF_OR 0x40 dst \| = src
187- BPF_AND 0x50 dst &= src
188- BPF_LSH 0x60 dst <<= src
189- BPF_RSH 0x70 dst >>= src
190- BPF_NEG 0x80 dst = ~src
191- BPF_MOD 0x90 dst %= src
192- BPF_XOR 0xa0 dst ^= src
193- BPF_MOV 0xb0 dst = src
194- BPF_ARSH 0xc0 sign extending shift right
195- BPF_END 0xd0 byte swap operations (see `Byte swap instructions `_ below)
196- ======== ===== =================================================
179+ ======== ===== =================================================
180+ code value description
181+ ======== ===== =================================================
182+ BPF_ADD 0x00 dst += src
183+ BPF_SUB 0x10 dst -= src
184+ BPF_MUL 0x20 dst \* = src
185+ BPF_DIV 0x30 dst /= src
186+ BPF_OR 0x40 dst \| = src
187+ BPF_AND 0x50 dst &= src
188+ BPF_LSH 0x60 dst <<= src
189+ BPF_RSH 0x70 dst >>= src
190+ BPF_NEG 0x80 dst = ~src
191+ BPF_MOD 0x90 dst %= src
192+ BPF_XOR 0xa0 dst ^= src
193+ BPF_MOV 0xb0 dst = src
194+ BPF_ARSH 0xc0 sign extending shift right
195+ BPF_END 0xd0 byte swap operations (see `Byte swap instructions `_ below)
196+ ======== ===== =================================================
197197
198198Underflow and overflow are allowed during arithmetic operations,
199199meaning the 64-bit or 32-bit value will wrap.
@@ -242,12 +242,12 @@ Byte swap instructions use non-default semantics of the 1-bit 'source' field in
242242the 'opcode' field. Instead of indicating the source operator, it is instead
243243used to select what byte order the operation converts from or to:
244244
245- ========= ===== =================================================
246- source value description
247- ========= ===== =================================================
248- BPF_TO_LE 0x00 convert between host byte order and little endian
249- BPF_TO_BE 0x08 convert between host byte order and big endian
250- ========= ===== =================================================
245+ ========= ===== =================================================
246+ source value description
247+ ========= ===== =================================================
248+ BPF_TO_LE 0x00 convert between host byte order and little endian
249+ BPF_TO_BE 0x08 convert between host byte order and big endian
250+ ========= ===== =================================================
251251
252252 **Note **
253253
@@ -259,21 +259,22 @@ The 'imm' field encodes the width of the swap operations. The following widths
259259are supported: 16, 32 and 64. The following table summarizes the resulting
260260possibilities:
261261
262- ============================= ========= === ======== ==================
263- opcode construction opcode imm mnemonic pseudocode
264- ============================= ========= === ======== ==================
265- BPF_END | BPF_TO_LE | BPF_ALU 0xd4 16 le16 dst dst = htole16(dst)
266- BPF_END | BPF_TO_LE | BPF_ALU 0xd4 32 le32 dst dst = htole32(dst)
267- BPF_END | BPF_TO_LE | BPF_ALU 0xd4 64 le64 dst dst = htole64(dst)
268- BPF_END | BPF_TO_BE | BPF_ALU 0xdc 16 be16 dst dst = htobe16(dst)
269- BPF_END | BPF_TO_BE | BPF_ALU 0xdc 32 be32 dst dst = htobe32(dst)
270- BPF_END | BPF_TO_BE | BPF_ALU 0xdc 64 be64 dst dst = htobe64(dst)
271- ============================= ========= === ======== ==================
262+ ============================= ========= === ======== ==================
263+ opcode construction opcode imm mnemonic pseudocode
264+ ============================= ========= === ======== ==================
265+ BPF_END | BPF_TO_LE | BPF_ALU 0xd4 16 le16 dst dst = htole16(dst)
266+ BPF_END | BPF_TO_LE | BPF_ALU 0xd4 32 le32 dst dst = htole32(dst)
267+ BPF_END | BPF_TO_LE | BPF_ALU 0xd4 64 le64 dst dst = htole64(dst)
268+ BPF_END | BPF_TO_BE | BPF_ALU 0xdc 16 be16 dst dst = htobe16(dst)
269+ BPF_END | BPF_TO_BE | BPF_ALU 0xdc 32 be32 dst dst = htobe32(dst)
270+ BPF_END | BPF_TO_BE | BPF_ALU 0xdc 64 be64 dst dst = htobe64(dst)
271+ ============================= ========= === ======== ==================
272272
273273where
274- * mnenomic indicates a short form that might be displayed by some tools such as disassemblers
275- * 'htoleNN()' indicates converting a NN-bit value from host byte order to little-endian byte order
276- * 'htobeNN()' indicates converting a NN-bit value from host byte order to big-endian byte order
274+
275+ * mnenomic indicates a short form that might be displayed by some tools such as disassemblers
276+ * 'htoleNN()' indicates converting a NN-bit value from host byte order to little-endian byte order
277+ * 'htobeNN()' indicates converting a NN-bit value from host byte order to big-endian byte order
277278
278279Jump instructions
279280-----------------
@@ -286,24 +287,24 @@ versions.
286287
287288The 4-bit 'code' field encodes the operation as below, where PC is the program counter:
288289
289- ======== ===== ============================ ======= ============
290- code value description version notes
291- ======== ===== ============================ ======= ============
292- BPF_JA 0x00 PC += offset 1 BPF_JMP only
293- BPF_JEQ 0x10 PC += offset if dst == src 1
294- BPF_JGT 0x20 PC += offset if dst > src 1 unsigned
295- BPF_JGE 0x30 PC += offset if dst >= src 1 unsigned
296- BPF_JSET 0x40 PC += offset if dst & src 1
297- BPF_JNE 0x50 PC += offset if dst != src 1
298- BPF_JSGT 0x60 PC += offset if dst > src 1 signed
299- BPF_JSGE 0x70 PC += offset if dst >= src 1 signed
300- BPF_CALL 0x80 call function imm 1 see `Helper functions `_
301- BPF_EXIT 0x90 function / program return 1 BPF_JMP only
302- BPF_JLT 0xa0 PC += offset if dst < src 2 unsigned
303- BPF_JLE 0xb0 PC += offset if dst <= src 2 unsigned
304- BPF_JSLT 0xc0 PC += offset if dst < src 2 signed
305- BPF_JSLE 0xd0 PC += offset if dst <= src 2 signed
306- ======== ===== ============================ ======= ============
290+ ======== ===== ============================ ======= ============
291+ code value description version notes
292+ ======== ===== ============================ ======= ============
293+ BPF_JA 0x00 PC += offset 1 BPF_JMP only
294+ BPF_JEQ 0x10 PC += offset if dst == src 1
295+ BPF_JGT 0x20 PC += offset if dst > src 1 unsigned
296+ BPF_JGE 0x30 PC += offset if dst >= src 1 unsigned
297+ BPF_JSET 0x40 PC += offset if dst & src 1
298+ BPF_JNE 0x50 PC += offset if dst != src 1
299+ BPF_JSGT 0x60 PC += offset if dst > src 1 signed
300+ BPF_JSGE 0x70 PC += offset if dst >= src 1 signed
301+ BPF_CALL 0x80 call function imm 1 see `Helper functions `_
302+ BPF_EXIT 0x90 function / program return 1 BPF_JMP only
303+ BPF_JLT 0xa0 PC += offset if dst < src 2 unsigned
304+ BPF_JLE 0xb0 PC += offset if dst <= src 2 unsigned
305+ BPF_JSLT 0xc0 PC += offset if dst < src 2 signed
306+ BPF_JSLE 0xd0 PC += offset if dst <= src 2 signed
307+ ======== ===== ============================ ======= ============
307308
308309where 'version' indicates the first ISA version in which the value was supported.
309310
@@ -330,11 +331,11 @@ Load and store instructions
330331For load and store instructions (``BPF_LD ``, ``BPF_LDX ``, ``BPF_ST ``, and ``BPF_STX ``), the
3313328-bit 'opcode' field is divided as:
332333
333- ============ ====== =================
334- 3 bits (MSB) 2 bits 3 bits (LSB)
335- ============ ====== =================
336- mode size instruction class
337- ============ ====== =================
334+ ============ ====== =================
335+ 3 bits (MSB) 2 bits 3 bits (LSB)
336+ ============ ====== =================
337+ mode size instruction class
338+ ============ ====== =================
338339
339340mode
340341 one of:
@@ -370,22 +371,22 @@ Regular load and store operations
370371The ``BPF_MEM `` mode modifier is used to encode regular load and store
371372instructions that transfer data between a register and memory.
372373
373- ============================= ========= ==================================
374- opcode construction opcode pseudocode
375- ============================= ========= ==================================
376- BPF_MEM | BPF_B | BPF_LDX 0x71 dst = *(uint8_t *) (src + offset)
377- BPF_MEM | BPF_H | BPF_LDX 0x69 dst = *(uint16_t *) (src + offset)
378- BPF_MEM | BPF_W | BPF_LDX 0x61 dst = *(uint32_t *) (src + offset)
379- BPF_MEM | BPF_DW | BPF_LDX 0x79 dst = *(uint64_t *) (src + offset)
380- BPF_MEM | BPF_B | BPF_ST 0x72 *(uint8_t *) (dst + offset) = imm
381- BPF_MEM | BPF_H | BPF_ST 0x6a *(uint16_t *) (dst + offset) = imm
382- BPF_MEM | BPF_W | BPF_ST 0x62 *(uint32_t *) (dst + offset) = imm
383- BPF_MEM | BPF_DW | BPF_ST 0x7a *(uint64_t *) (dst + offset) = imm
384- BPF_MEM | BPF_B | BPF_STX 0x73 *(uint8_t *) (dst + offset) = src
385- BPF_MEM | BPF_H | BPF_STX 0x6b *(uint16_t *) (dst + offset) = src
386- BPF_MEM | BPF_W | BPF_STX 0x63 *(uint32_t *) (dst + offset) = src
387- BPF_MEM | BPF_DW | BPF_STX 0x7b *(uint64_t *) (dst + offset) = src
388- ============================= ========= ==================================
374+ ============================= ========= ==================================
375+ opcode construction opcode pseudocode
376+ ============================= ========= ==================================
377+ BPF_MEM | BPF_B | BPF_LDX 0x71 dst = *(uint8_t *) (src + offset)
378+ BPF_MEM | BPF_H | BPF_LDX 0x69 dst = *(uint16_t *) (src + offset)
379+ BPF_MEM | BPF_W | BPF_LDX 0x61 dst = *(uint32_t *) (src + offset)
380+ BPF_MEM | BPF_DW | BPF_LDX 0x79 dst = *(uint64_t *) (src + offset)
381+ BPF_MEM | BPF_B | BPF_ST 0x72 *(uint8_t *) (dst + offset) = imm
382+ BPF_MEM | BPF_H | BPF_ST 0x6a *(uint16_t *) (dst + offset) = imm
383+ BPF_MEM | BPF_W | BPF_ST 0x62 *(uint32_t *) (dst + offset) = imm
384+ BPF_MEM | BPF_DW | BPF_ST 0x7a *(uint64_t *) (dst + offset) = imm
385+ BPF_MEM | BPF_B | BPF_STX 0x73 *(uint8_t *) (dst + offset) = src
386+ BPF_MEM | BPF_H | BPF_STX 0x6b *(uint16_t *) (dst + offset) = src
387+ BPF_MEM | BPF_W | BPF_STX 0x63 *(uint32_t *) (dst + offset) = src
388+ BPF_MEM | BPF_DW | BPF_STX 0x7b *(uint64_t *) (dst + offset) = src
389+ ============================= ========= ==================================
389390
390391Atomic operations
391392-----------------
@@ -397,8 +398,8 @@ by other eBPF programs or means outside of this specification.
397398All atomic operations supported by eBPF are encoded as store operations
398399that use the ``BPF_ATOMIC `` mode modifier as follows:
399400
400- * ``BPF_ATOMIC | BPF_W | BPF_STX `` (0xc3) for 32-bit operations
401- * ``BPF_ATOMIC | BPF_DW | BPF_STX `` (0xdb) for 64-bit operations
401+ * ``BPF_ATOMIC | BPF_W | BPF_STX `` (0xc3) for 32-bit operations
402+ * ``BPF_ATOMIC | BPF_DW | BPF_STX `` (0xdb) for 64-bit operations
402403
403404Note that 8-bit (``BPF_B ``) and 16-bit (``BPF_H ``) wide atomic operations are not supported,
404405nor is ``BPF_ATOMIC | <size> | BPF_ST ``.
@@ -407,14 +408,14 @@ The 'imm' field is used to encode the actual atomic operation.
407408Simple atomic operation use a subset of the values defined to encode
408409arithmetic operations in the 'imm' field to encode the atomic operation:
409410
410- ======== ===== =========== =======
411- imm value description version
412- ======== ===== =========== =======
413- BPF_ADD 0x00 atomic add 1
414- BPF_OR 0x40 atomic or 3
415- BPF_AND 0x50 atomic and 3
416- BPF_XOR 0xa0 atomic xor 3
417- ======== ===== =========== =======
411+ ======== ===== =========== =======
412+ imm value description version
413+ ======== ===== =========== =======
414+ BPF_ADD 0x00 atomic add 1
415+ BPF_OR 0x40 atomic or 3
416+ BPF_AND 0x50 atomic and 3
417+ BPF_XOR 0xa0 atomic xor 3
418+ ======== ===== =========== =======
418419
419420where 'version' indicates the first ISA version in which the value was supported.
420421
@@ -432,13 +433,13 @@ for ``BPF_ATOMIC | BPF_ADD``.
432433In addition to the simple atomic operations above, there also is a modifier and
433434two complex atomic operations:
434435
435- =========== ================ =========================== =======
436- imm value description version
437- =========== ================ =========================== =======
438- BPF_FETCH 0x01 modifier: return old value 3
439- BPF_XCHG 0xe0 | BPF_FETCH atomic exchange 3
440- BPF_CMPXCHG 0xf0 | BPF_FETCH atomic compare and exchange 3
441- =========== ================ =========================== =======
436+ =========== ================ =========================== =======
437+ imm value description version
438+ =========== ================ =========================== =======
439+ BPF_FETCH 0x01 modifier: return old value 3
440+ BPF_XCHG 0xe0 | BPF_FETCH atomic exchange 3
441+ BPF_CMPXCHG 0xf0 | BPF_FETCH atomic compare and exchange 3
442+ =========== ================ =========================== =======
442443
443444The ``BPF_FETCH `` modifier is optional for simple atomic operations, and
444445always set for the complex atomic operations. If the ``BPF_FETCH `` flag
@@ -494,12 +495,12 @@ a register in addition to the immediate data.
494495
495496These instructions have seven implicit operands:
496497
497- * Register R6 is an implicit input that must contain a pointer to a
498- context structure with a packet data pointer.
499- * Register R0 is an implicit output which contains the data fetched from
500- the packet.
501- * Registers R1-R5 are scratch registers that are clobbered by the
502- instruction.
498+ * Register R6 is an implicit input that must contain a pointer to a
499+ context structure with a packet data pointer.
500+ * Register R0 is an implicit output which contains the data fetched from
501+ the packet.
502+ * Registers R1-R5 are scratch registers that are clobbered by the
503+ instruction.
503504
504505 **Note **
505506
0 commit comments