1*aee1720eSDavid Vernet.. contents:: 2*aee1720eSDavid Vernet.. sectnum:: 3*aee1720eSDavid Vernet 4*aee1720eSDavid Vernet========================== 5*aee1720eSDavid VernetLinux implementation notes 6*aee1720eSDavid Vernet========================== 7*aee1720eSDavid Vernet 8*aee1720eSDavid VernetThis document provides more details specific to the Linux kernel implementation of the eBPF instruction set. 9*aee1720eSDavid Vernet 10*aee1720eSDavid VernetByte swap instructions 11*aee1720eSDavid Vernet====================== 12*aee1720eSDavid Vernet 13*aee1720eSDavid Vernet``BPF_FROM_LE`` and ``BPF_FROM_BE`` exist as aliases for ``BPF_TO_LE`` and ``BPF_TO_BE`` respectively. 14*aee1720eSDavid Vernet 15*aee1720eSDavid VernetJump instructions 16*aee1720eSDavid Vernet================= 17*aee1720eSDavid Vernet 18*aee1720eSDavid Vernet``BPF_CALL | BPF_X | BPF_JMP`` (0x8d), where the helper function 19*aee1720eSDavid Vernetinteger would be read from a specified register, is not currently supported 20*aee1720eSDavid Vernetby the verifier. Any programs with this instruction will fail to load 21*aee1720eSDavid Vernetuntil such support is added. 22*aee1720eSDavid Vernet 23*aee1720eSDavid VernetMaps 24*aee1720eSDavid Vernet==== 25*aee1720eSDavid Vernet 26*aee1720eSDavid VernetLinux only supports the 'map_val(map)' operation on array maps with a single element. 27*aee1720eSDavid Vernet 28*aee1720eSDavid VernetLinux uses an fd_array to store maps associated with a BPF program. Thus, 29*aee1720eSDavid Vernetmap_by_idx(imm) uses the fd at that index in the array. 30*aee1720eSDavid Vernet 31*aee1720eSDavid VernetVariables 32*aee1720eSDavid Vernet========= 33*aee1720eSDavid Vernet 34*aee1720eSDavid VernetThe following 64-bit immediate instruction specifies that a variable address, 35*aee1720eSDavid Vernetwhich corresponds to some integer stored in the 'imm' field, should be loaded: 36*aee1720eSDavid Vernet 37*aee1720eSDavid Vernet========================= ====== === ========================================= =========== ============== 38*aee1720eSDavid Vernetopcode construction opcode src pseudocode imm type dst type 39*aee1720eSDavid Vernet========================= ====== === ========================================= =========== ============== 40*aee1720eSDavid VernetBPF_IMM | BPF_DW | BPF_LD 0x18 0x3 dst = var_addr(imm) variable id data pointer 41*aee1720eSDavid Vernet========================= ====== === ========================================= =========== ============== 42*aee1720eSDavid Vernet 43*aee1720eSDavid VernetOn Linux, this integer is a BTF ID. 44*aee1720eSDavid Vernet 45*aee1720eSDavid VernetLegacy BPF Packet access instructions 46*aee1720eSDavid Vernet===================================== 47*aee1720eSDavid Vernet 48*aee1720eSDavid VernetAs mentioned in the `ISA standard documentation 49*aee1720eSDavid Vernet<instruction-set.html#legacy-bpf-packet-access-instructions>`_, 50*aee1720eSDavid VernetLinux has special eBPF instructions for access to packet data that have been 51*aee1720eSDavid Vernetcarried over from classic BPF to retain the performance of legacy socket 52*aee1720eSDavid Vernetfilters running in the eBPF interpreter. 53*aee1720eSDavid Vernet 54*aee1720eSDavid VernetThe instructions come in two forms: ``BPF_ABS | <size> | BPF_LD`` and 55*aee1720eSDavid Vernet``BPF_IND | <size> | BPF_LD``. 56*aee1720eSDavid Vernet 57*aee1720eSDavid VernetThese instructions are used to access packet data and can only be used when 58*aee1720eSDavid Vernetthe program context is a pointer to a networking packet. ``BPF_ABS`` 59*aee1720eSDavid Vernetaccesses packet data at an absolute offset specified by the immediate data 60*aee1720eSDavid Vernetand ``BPF_IND`` access packet data at an offset that includes the value of 61*aee1720eSDavid Verneta register in addition to the immediate data. 62*aee1720eSDavid Vernet 63*aee1720eSDavid VernetThese instructions have seven implicit operands: 64*aee1720eSDavid Vernet 65*aee1720eSDavid Vernet* Register R6 is an implicit input that must contain a pointer to a 66*aee1720eSDavid Vernet struct sk_buff. 67*aee1720eSDavid Vernet* Register R0 is an implicit output which contains the data fetched from 68*aee1720eSDavid Vernet the packet. 69*aee1720eSDavid Vernet* Registers R1-R5 are scratch registers that are clobbered by the 70*aee1720eSDavid Vernet instruction. 71*aee1720eSDavid Vernet 72*aee1720eSDavid VernetThese instructions have an implicit program exit condition as well. If an 73*aee1720eSDavid VerneteBPF program attempts access data beyond the packet boundary, the 74*aee1720eSDavid Vernetprogram execution will be aborted. 75*aee1720eSDavid Vernet 76*aee1720eSDavid Vernet``BPF_ABS | BPF_W | BPF_LD`` (0x20) means:: 77*aee1720eSDavid Vernet 78*aee1720eSDavid Vernet R0 = ntohl(*(u32 *) ((struct sk_buff *) R6->data + imm)) 79*aee1720eSDavid Vernet 80*aee1720eSDavid Vernetwhere ``ntohl()`` converts a 32-bit value from network byte order to host byte order. 81*aee1720eSDavid Vernet 82*aee1720eSDavid Vernet``BPF_IND | BPF_W | BPF_LD`` (0x40) means:: 83*aee1720eSDavid Vernet 84*aee1720eSDavid Vernet R0 = ntohl(*(u32 *) ((struct sk_buff *) R6->data + src + imm)) 85