5
5
BPF Instruction Set Architecture (ISA)
6
6
======================================
7
7
8
- This document specifies the BPF instruction set architecture (ISA).
8
+ eBPF (which is no longer an acronym for anything), also commonly
9
+ referred to as BPF, is a technology with origins in the Linux kernel
10
+ that can run untrusted programs in a privileged context such as an
11
+ operating system kernel. This document specifies the BPF instruction
12
+ set architecture (ISA).
9
13
10
14
Documentation conventions
11
15
=========================
@@ -43,7 +47,7 @@ a type's signedness (`S`) and bit width (`N`), respectively.
43
47
===== =========
44
48
45
49
For example, `u32 ` is a type whose valid values are all the 32-bit unsigned
46
- numbers and `s16 ` is a types whose valid values are all the 16-bit signed
50
+ numbers and `s16 ` is a type whose valid values are all the 16-bit signed
47
51
numbers.
48
52
49
53
Functions
@@ -108,7 +112,7 @@ conformance group means it must support all instructions in that conformance
108
112
group.
109
113
110
114
The use of named conformance groups enables interoperability between a runtime
111
- that executes instructions, and tools as such compilers that generate
115
+ that executes instructions, and tools such as compilers that generate
112
116
instructions for the runtime. Thus, capability discovery in terms of
113
117
conformance groups might be done manually by users or automatically by tools.
114
118
@@ -181,10 +185,13 @@ A basic instruction is encoded as follows::
181
185
(`64-bit immediate instructions `_ reuse this field for other purposes)
182
186
183
187
**dst_reg **
184
- destination register number (0-10)
188
+ destination register number (0-10), unless otherwise specified
189
+ (future instructions might reuse this field for other purposes)
185
190
186
191
**offset **
187
- signed integer offset used with pointer arithmetic
192
+ signed integer offset used with pointer arithmetic, except where
193
+ otherwise specified (some arithmetic instructions reuse this field
194
+ for other purposes)
188
195
189
196
**imm **
190
197
signed integer immediate value
@@ -228,10 +235,12 @@ This is depicted in the following figure::
228
235
operation to perform, encoded as explained above
229
236
230
237
**regs **
231
- The source and destination register numbers, encoded as explained above
238
+ The source and destination register numbers (unless otherwise
239
+ specified), encoded as explained above
232
240
233
241
**offset **
234
- signed integer offset used with pointer arithmetic
242
+ signed integer offset used with pointer arithmetic, unless
243
+ otherwise specified
235
244
236
245
**imm **
237
246
signed integer immediate value
@@ -342,8 +351,8 @@ where '(u32)' indicates that the upper 32 bits are zeroed.
342
351
343
352
dst = dst ^ imm
344
353
345
- Note that most instructions have instruction offset of 0. Only three instructions
346
- (``SDIV ``, ``SMOD ``, ``MOVSX ``) have a non-zero offset.
354
+ Note that most arithmetic instructions have ' offset' set to 0. Only three instructions
355
+ (``SDIV ``, ``SMOD ``, ``MOVSX ``) have a non-zero ' offset' .
347
356
348
357
Division, multiplication, and modulo operations for ``ALU `` are part
349
358
of the "divmul32" conformance group, and division, multiplication, and
@@ -365,15 +374,15 @@ Note that there are varying definitions of the signed modulo operation
365
374
when the dividend or divisor are negative, where implementations often
366
375
vary by language such that Python, Ruby, etc. differ from C, Go, Java,
367
376
etc. This specification requires that signed modulo use truncated division
368
- (where -13 % 3 == -1) as implemented in C, Go, etc.:
377
+ (where -13 % 3 == -1) as implemented in C, Go, etc.::
369
378
370
379
a % n = a - n * trunc(a / n)
371
380
372
381
The ``MOVSX `` instruction does a move operation with sign extension.
373
- ``{MOVSX, X, ALU} `` :term: `sign extends<Sign Extend> ` 8-bit and 16-bit operands into 32
374
- bit operands, and zeroes the remaining upper 32 bits.
382
+ ``{MOVSX, X, ALU} `` :term: `sign extends<Sign Extend> ` 8-bit and 16-bit operands into
383
+ 32- bit operands, and zeroes the remaining upper 32 bits.
375
384
``{MOVSX, X, ALU64} `` :term: `sign extends<Sign Extend> ` 8-bit, 16-bit, and 32-bit
376
- operands into 64 bit operands. Unlike other arithmetic instructions,
385
+ operands into 64- bit operands. Unlike other arithmetic instructions,
377
386
``MOVSX `` is only defined for register source operands (``X ``).
378
387
379
388
The ``NEG `` instruction is only defined when the source bit is clear
@@ -411,19 +420,19 @@ conformance group.
411
420
412
421
Examples:
413
422
414
- ``{END, TO_LE, ALU} `` with imm = 16/32/64 means::
423
+ ``{END, TO_LE, ALU} `` with ' imm' = 16/32/64 means::
415
424
416
425
dst = htole16(dst)
417
426
dst = htole32(dst)
418
427
dst = htole64(dst)
419
428
420
- ``{END, TO_BE, ALU} `` with imm = 16/32/64 means::
429
+ ``{END, TO_BE, ALU} `` with ' imm' = 16/32/64 means::
421
430
422
431
dst = htobe16(dst)
423
432
dst = htobe32(dst)
424
433
dst = htobe64(dst)
425
434
426
- ``{END, TO_LE, ALU64} `` with imm = 16/32/64 means::
435
+ ``{END, TO_LE, ALU64} `` with ' imm' = 16/32/64 means::
427
436
428
437
dst = bswap16(dst)
429
438
dst = bswap32(dst)
@@ -438,27 +447,33 @@ otherwise identical operations, and indicates the base64 conformance
438
447
group unless otherwise specified.
439
448
The 'code' field encodes the operation as below:
440
449
441
- ======== ===== ======= =============================== ===================================================
442
- code value src_reg description notes
443
- ======== ===== ======= =============================== ===================================================
444
- JA 0x0 0x0 PC += offset {JA, K, JMP} only
445
- JA 0x0 0x0 PC += imm {JA, K, JMP32} only
450
+ ======== ===== ======= ================================= ===================================================
451
+ code value src_reg description notes
452
+ ======== ===== ======= ================================= ===================================================
453
+ JA 0x0 0x0 PC += offset {JA, K, JMP} only
454
+ JA 0x0 0x0 PC += imm {JA, K, JMP32} only
446
455
JEQ 0x1 any PC += offset if dst == src
447
- JGT 0x2 any PC += offset if dst > src unsigned
448
- JGE 0x3 any PC += offset if dst >= src unsigned
456
+ JGT 0x2 any PC += offset if dst > src unsigned
457
+ JGE 0x3 any PC += offset if dst >= src unsigned
449
458
JSET 0x4 any PC += offset if dst & src
450
459
JNE 0x5 any PC += offset if dst != src
451
- JSGT 0x6 any PC += offset if dst > src signed
452
- JSGE 0x7 any PC += offset if dst >= src signed
453
- CALL 0x8 0x0 call helper function by address {CALL, K, JMP} only, see `Helper functions `_
454
- CALL 0x8 0x1 call PC += imm {CALL, K, JMP} only, see `Program-local functions `_
455
- CALL 0x8 0x2 call helper function by BTF ID {CALL, K, JMP} only, see `Helper functions `_
456
- EXIT 0x9 0x0 return {CALL, K, JMP} only
457
- JLT 0xa any PC += offset if dst < src unsigned
458
- JLE 0xb any PC += offset if dst <= src unsigned
459
- JSLT 0xc any PC += offset if dst < src signed
460
- JSLE 0xd any PC += offset if dst <= src signed
461
- ======== ===== ======= =============================== ===================================================
460
+ JSGT 0x6 any PC += offset if dst > src signed
461
+ JSGE 0x7 any PC += offset if dst >= src signed
462
+ CALL 0x8 0x0 call helper function by static ID {CALL, K, JMP} only, see `Helper functions `_
463
+ CALL 0x8 0x1 call PC += imm {CALL, K, JMP} only, see `Program-local functions `_
464
+ CALL 0x8 0x2 call helper function by BTF ID {CALL, K, JMP} only, see `Helper functions `_
465
+ EXIT 0x9 0x0 return {CALL, K, JMP} only
466
+ JLT 0xa any PC += offset if dst < src unsigned
467
+ JLE 0xb any PC += offset if dst <= src unsigned
468
+ JSLT 0xc any PC += offset if dst < src signed
469
+ JSLE 0xd any PC += offset if dst <= src signed
470
+ ======== ===== ======= ================================= ===================================================
471
+
472
+ where 'PC' denotes the program counter, and the offset to increment by
473
+ is in units of 64-bit instructions relative to the instruction following
474
+ the jump instruction. Thus 'PC += 1' skips execution of the next
475
+ instruction if it's a basic instruction or results in undefined behavior
476
+ if the next instruction is a 128-bit wide instruction.
462
477
463
478
The BPF program needs to store the return value into register R0 before doing an
464
479
``EXIT ``.
@@ -475,7 +490,7 @@ where 's>=' indicates a signed '>=' comparison.
475
490
476
491
gotol +imm
477
492
478
- where 'imm' means the branch offset comes from insn 'imm' field.
493
+ where 'imm' means the branch offset comes from the 'imm' field.
479
494
480
495
Note that there are two flavors of ``JA `` instructions. The
481
496
``JMP `` class permits a 16-bit jump offset specified by the 'offset'
@@ -493,26 +508,26 @@ Helper functions
493
508
Helper functions are a concept whereby BPF programs can call into a
494
509
set of function calls exposed by the underlying platform.
495
510
496
- Historically, each helper function was identified by an address
497
- encoded in the imm field. The available helper functions may differ
498
- for each program type, but address values are unique across all program types.
511
+ Historically, each helper function was identified by a static ID
512
+ encoded in the ' imm' field. The available helper functions may differ
513
+ for each program type, but static IDs are unique across all program types.
499
514
500
515
Platforms that support the BPF Type Format (BTF) support identifying
501
- a helper function by a BTF ID encoded in the imm field, where the BTF ID
516
+ a helper function by a BTF ID encoded in the ' imm' field, where the BTF ID
502
517
identifies the helper name and type.
503
518
504
519
Program-local functions
505
520
~~~~~~~~~~~~~~~~~~~~~~~
506
521
Program-local functions are functions exposed by the same BPF program as the
507
522
caller, and are referenced by offset from the call instruction, similar to
508
- ``JA ``. The offset is encoded in the imm field of the call instruction.
509
- A ``EXIT `` within the program-local function will return to the caller.
523
+ ``JA ``. The offset is encoded in the ' imm' field of the call instruction.
524
+ An ``EXIT `` within the program-local function will return to the caller.
510
525
511
526
Load and store instructions
512
527
===========================
513
528
514
529
For load and store instructions (``LD ``, ``LDX ``, ``ST ``, and ``STX ``), the
515
- 8-bit 'opcode' field is divided as::
530
+ 8-bit 'opcode' field is divided as follows ::
516
531
517
532
+-+-+-+-+-+-+-+-+
518
533
|mode |sz |class|
@@ -580,7 +595,7 @@ instructions that transfer data between a register and memory.
580
595
581
596
dst = *(signed size *) (src + offset)
582
597
583
- Where size is one of: ``B ``, ``H ``, or ``W ``, and
598
+ Where '< size>' is one of: ``B ``, ``H ``, or ``W ``, and
584
599
'signed size' is one of: s8, s16, or s32.
585
600
586
601
Atomic operations
@@ -662,11 +677,11 @@ src_reg pseudocode imm type dst type
662
677
======= ========================================= =========== ==============
663
678
0x0 dst = (next_imm << 32) | imm integer integer
664
679
0x1 dst = map_by_fd(imm) map fd map
665
- 0x2 dst = map_val(map_by_fd(imm)) + next_imm map fd data pointer
666
- 0x3 dst = var_addr(imm) variable id data pointer
667
- 0x4 dst = code_addr(imm) integer code pointer
680
+ 0x2 dst = map_val(map_by_fd(imm)) + next_imm map fd data address
681
+ 0x3 dst = var_addr(imm) variable id data address
682
+ 0x4 dst = code_addr(imm) integer code address
668
683
0x5 dst = map_by_idx(imm) map index map
669
- 0x6 dst = map_val(map_by_idx(imm)) + next_imm map index data pointer
684
+ 0x6 dst = map_val(map_by_idx(imm)) + next_imm map index data address
670
685
======= ========================================= =========== ==============
671
686
672
687
where
0 commit comments