@@ -8,6 +8,15 @@ eBPF Instruction Set
8
8
The eBPF instruction set consists of eleven 64 bit registers, a program counter,
9
9
and 512 bytes of stack space.
10
10
11
+ Versions
12
+ ========
13
+
14
+ The current Instruction Set Architecture (ISA) version, sometimes referred to in other documents
15
+ as a "CPU" version, is 3. This document also covers older versions of the ISA.
16
+
17
+ *Clang implementation note *: Clang can select the eBPF ISA version using
18
+ `-mcpu=v2 ` for example to select version 2.
19
+
11
20
Registers and calling convention
12
21
================================
13
22
@@ -98,18 +107,20 @@ The encoding of the 'opcode' field varies and can be determined from
98
107
the three least significant bits (LSB) of the 'opcode' field which holds
99
108
the "instruction class", as follows:
100
109
101
- ========= ===== =============================== =================
102
- class value description reference
103
- ========= ===== =============================== =================
104
- BPF_LD 0x00 non-standard load operations `Load and store instructions `_
105
- BPF_LDX 0x01 load into register operations `Load and store instructions `_
106
- BPF_ST 0x02 store from immediate operations `Load and store instructions `_
107
- BPF_STX 0x03 store from register operations `Load and store instructions `_
108
- BPF_ALU 0x04 32-bit arithmetic operations `Arithmetic and jump instructions `_
109
- BPF_JMP 0x05 64-bit jump operations `Arithmetic and jump instructions `_
110
- BPF_JMP32 0x06 32-bit jump operations `Arithmetic and jump instructions `_
111
- BPF_ALU64 0x07 64-bit arithmetic operations `Arithmetic and jump instructions `_
112
- ========= ===== =============================== =================
110
+ ========= ===== =============================== ======= =================
111
+ class value description version reference
112
+ ========= ===== =============================== ======= =================
113
+ BPF_LD 0x00 non-standard load operations 1 `Load and store instructions `_
114
+ BPF_LDX 0x01 load into register operations 1 `Load and store instructions `_
115
+ BPF_ST 0x02 store from immediate operations 1 `Load and store instructions `_
116
+ BPF_STX 0x03 store from register operations 1 `Load and store instructions `_
117
+ BPF_ALU 0x04 32-bit arithmetic operations 3 `Arithmetic and jump instructions `_
118
+ BPF_JMP 0x05 64-bit jump operations 1 `Arithmetic and jump instructions `_
119
+ BPF_JMP32 0x06 32-bit jump operations 3 `Arithmetic and jump instructions `_
120
+ BPF_ALU64 0x07 64-bit arithmetic operations 1 `Arithmetic and jump instructions `_
121
+ ========= ===== =============================== ======= =================
122
+
123
+ where 'version' indicates the first ISA version in which support for the value was mandatory.
113
124
114
125
Arithmetic and jump instructions
115
126
================================
@@ -145,6 +156,14 @@ Arithmetic instructions
145
156
Instruction class ``BPF_ALU `` uses 32-bit wide operands (zeroing the upper 32 bits
146
157
of the destination register) while ``BPF_ALU64 `` uses 64-bit wide operands for
147
158
otherwise identical operations.
159
+
160
+ Support for ``BPF_ALU `` is required in ISA version 3, and optional in earlier
161
+ versions.
162
+
163
+ *Clang implementation note *:
164
+ For ISA versions prior to 3, Clang v7.0 and later can enable ``BPF_ALU `` support with
165
+ ``-Xclang -target-feature -Xclang +alu32 ``.
166
+
148
167
The 4-bit 'code' field encodes the operation as follows:
149
168
150
169
======== ===== =================================================
@@ -240,26 +259,32 @@ Jump instructions
240
259
241
260
Instruction class ``BPF_JMP32 `` uses 32-bit wide operands while ``BPF_JMP `` uses 64-bit wide operands for
242
261
otherwise identical operations.
262
+
263
+ Support for ``BPF_JMP32 `` is required in ISA version 3, and optional in earlier
264
+ versions.
265
+
243
266
The 4-bit 'code' field encodes the operation as below, where PC is the program counter:
244
267
245
- ======== ===== ============================ ============
246
- code value description notes
247
- ======== ===== ============================ ============
248
- BPF_JA 0x00 PC += offset BPF_JMP only
249
- BPF_JEQ 0x10 PC += offset if dst == src
250
- BPF_JGT 0x20 PC += offset if dst > src unsigned
251
- BPF_JGE 0x30 PC += offset if dst >= src unsigned
252
- BPF_JSET 0x40 PC += offset if dst & src
253
- BPF_JNE 0x50 PC += offset if dst != src
254
- BPF_JSGT 0x60 PC += offset if dst > src signed
255
- BPF_JSGE 0x70 PC += offset if dst >= src signed
256
- BPF_CALL 0x80 call function imm see `Helper functions `_
257
- BPF_EXIT 0x90 function / program return BPF_JMP only
258
- BPF_JLT 0xa0 PC += offset if dst < src unsigned
259
- BPF_JLE 0xb0 PC += offset if dst <= src unsigned
260
- BPF_JSLT 0xc0 PC += offset if dst < src signed
261
- BPF_JSLE 0xd0 PC += offset if dst <= src signed
262
- ======== ===== ============================ ============
268
+ ======== ===== ============================ ======= ============
269
+ code value description version notes
270
+ ======== ===== ============================ ======= ============
271
+ BPF_JA 0x00 PC += offset 1 BPF_JMP only
272
+ BPF_JEQ 0x10 PC += offset if dst == src 1
273
+ BPF_JGT 0x20 PC += offset if dst > src 1 unsigned
274
+ BPF_JGE 0x30 PC += offset if dst >= src 1 unsigned
275
+ BPF_JSET 0x40 PC += offset if dst & src 1
276
+ BPF_JNE 0x50 PC += offset if dst != src 1
277
+ BPF_JSGT 0x60 PC += offset if dst > src 1 signed
278
+ BPF_JSGE 0x70 PC += offset if dst >= src 1 signed
279
+ BPF_CALL 0x80 call function imm 1 see `Helper functions `_
280
+ BPF_EXIT 0x90 function / program return 1 BPF_JMP only
281
+ BPF_JLT 0xa0 PC += offset if dst < src 2 unsigned
282
+ BPF_JLE 0xb0 PC += offset if dst <= src 2 unsigned
283
+ BPF_JSLT 0xc0 PC += offset if dst < src 2 signed
284
+ BPF_JSLE 0xd0 PC += offset if dst <= src 2 signed
285
+ ======== ===== ============================ ======= ============
286
+
287
+ where 'version' indicates the first ISA version in which the value was supported.
263
288
264
289
The eBPF verifier is responsible for verifying that the
265
290
eBPF program stores the return value into register R0 before doing a
@@ -366,7 +391,7 @@ arithmetic operations in the 'imm' field to encode the atomic operation:
366
391
BPF_XOR 0xa0 atomic xor v3
367
392
======== ===== =========== =======
368
393
369
- ** TODO **: Confirm the versions above. And add a section introducing the version concept .
394
+ where 'version' indicates the first ISA version in which the value was supported .
370
395
371
396
``BPF_ATOMIC | BPF_W | BPF_STX `` with 'imm' = BPF_ADD means::
372
397
@@ -454,9 +479,6 @@ These instructions have an implicit program exit condition as well. If an
454
479
eBPF program attempts access data beyond the packet boundary, the
455
480
program execution must be gracefully aborted.
456
481
457
- **TODO **: Is the verifier required to allow such programs, or is it free to
458
- reject them?
459
-
460
482
``BPF_ABS | BPF_W | BPF_LD `` means::
461
483
462
484
R0 = ntohl(*(uint32_t *) (R6->data + imm))
0 commit comments