1.. contents::
2.. sectnum::
3
4==========================
5Linux implementation notes
6==========================
7
8This document provides more details specific to the Linux kernel implementation of the eBPF instruction set.
9
10Byte swap instructions
11======================
12
13``BPF_FROM_LE`` and ``BPF_FROM_BE`` exist as aliases for ``BPF_TO_LE`` and ``BPF_TO_BE`` respectively.
14
15Jump instructions
16=================
17
18``BPF_CALL | BPF_X | BPF_JMP`` (0x8d), where the helper function
19integer would be read from a specified register, is not currently supported
20by the verifier.  Any programs with this instruction will fail to load
21until such support is added.
22
23Legacy BPF Packet access instructions
24=====================================
25
26As mentioned in the `ISA standard documentation <instruction-set.rst#legacy-bpf-packet-access-instructions>`_,
27Linux has special eBPF instructions for access to packet data that have been
28carried over from classic BPF to retain the performance of legacy socket
29filters running in the eBPF interpreter.
30
31The instructions come in two forms: ``BPF_ABS | <size> | BPF_LD`` and
32``BPF_IND | <size> | BPF_LD``.
33
34These instructions are used to access packet data and can only be used when
35the program context is a pointer to a networking packet.  ``BPF_ABS``
36accesses packet data at an absolute offset specified by the immediate data
37and ``BPF_IND`` access packet data at an offset that includes the value of
38a register in addition to the immediate data.
39
40These instructions have seven implicit operands:
41
42* Register R6 is an implicit input that must contain a pointer to a
43  struct sk_buff.
44* Register R0 is an implicit output which contains the data fetched from
45  the packet.
46* Registers R1-R5 are scratch registers that are clobbered by the
47  instruction.
48
49These instructions have an implicit program exit condition as well. If an
50eBPF program attempts access data beyond the packet boundary, the
51program execution will be aborted.
52
53``BPF_ABS | BPF_W | BPF_LD`` (0x20) means::
54
55  R0 = ntohl(*(u32 *) ((struct sk_buff *) R6->data + imm))
56
57where ``ntohl()`` converts a 32-bit value from network byte order to host byte order.
58
59``BPF_IND | BPF_W | BPF_LD`` (0x40) means::
60
61  R0 = ntohl(*(u32 *) ((struct sk_buff *) R6->data + src + imm))
62