Module ebpf

This module contains all the definitions related to eBPF, and some functions permitting to manipulate eBPF instructions.

The number of bytes in an instruction, the maximum number of instructions in a program, and also all operation codes are defined here as constants.

The structure for an instruction used by this crate, as well as the function to extract it from a program, is also defined in the module.

To learn more about these instructions, see the Linux kernel documentation: https://www.kernel.org/doc/Documentation/networking/filter.txt, or for a shorter version of the list of the operation codes: https://github.com/iovisor/bpf-docs/blob/master/eBPF.md

Structs

Insn

An eBPF instruction.

Constants

ADD32_IMM

BPF opcode: add32 dst, imm /// dst += imm.

ADD32_REG

BPF opcode: add32 dst, src /// dst += src.

ADD64_IMM

BPF opcode: add64 dst, imm /// dst += imm.

ADD64_REG

BPF opcode: add64 dst, src /// dst += src.

AND32_IMM

BPF opcode: and32 dst, imm /// dst &= imm.

AND32_REG

BPF opcode: and32 dst, src /// dst &= src.

AND64_IMM

BPF opcode: and64 dst, imm /// dst &= imm.

AND64_REG

BPF opcode: and64 dst, src /// dst &= src.

ARSH32_IMM

BPF opcode: arsh32 dst, imm /// dst >>= imm (arithmetic).

ARSH32_REG

BPF opcode: arsh32 dst, src /// dst >>= src (arithmetic).

ARSH64_IMM

BPF opcode: arsh64 dst, imm /// dst >>= imm (arithmetic).

ARSH64_REG

BPF opcode: arsh64 dst, src /// dst >>= src (arithmetic).

BE

BPF opcode: be dst /// dst = htobe<imm>(dst), with imm in {16, 32, 64}.

BPF_1B

BPF size modifier: 1 byte.

BPF_2B

BPF size modifier: 2 bytes.

BPF_4B

BPF size modifier: 4 bytes.

BPF_8B

BPF size modifier: 8 bytes.

BPF_ABS

BPF mode modifier: absolute load.

BPF_ADD

BPF ALU/ALU64 operation code: addition.

BPF_ALU32_LOAD

BPF operation class: 32 bit arithmetic or load.

BPF_ALU64_STORE

BPF operation class: 64 bit arithmetic or store.

BPF_ALU_OP_MASK

Mask to extract the arithmetic operation code from an instruction operation code.

BPF_AND

BPF ALU/ALU64 operation code: and.

BPF_ARSH

BPF ALU/ALU64 operation code: sign extending right shift.

BPF_B

BPF size modifier: byte (1 byte).

BPF_CALL

BPF JMP operation code: syscall function call.

BPF_CLS_MASK

Mask to extract the operation class from an operation code.

BPF_DIV

BPF ALU/ALU64 operation code: division. [DEPRECATED]

BPF_DW

BPF size modifier: double word (8 bytes).

BPF_END

BPF ALU/ALU64 operation code: endianness conversion.

BPF_EXIT

BPF JMP operation code: return from program.

BPF_H

BPF size modifier: half-word (2 bytes).

BPF_HOR

BPF ALU/ALU64 operation code: high or.

BPF_IMM

BPF mode modifier: immediate value.

BPF_IND

BPF mode modifier: indirect load. [DEPRECATED]

BPF_JA

BPF JMP operation code: jump.

BPF_JEQ

BPF JMP operation code: jump if equal.

BPF_JGE

BPF JMP operation code: jump if greater or equal.

BPF_JGT

BPF JMP operation code: jump if greater than.

BPF_JLE

BPF JMP operation code: jump if lower or equal.

BPF_JLT

BPF JMP operation code: jump if lower than.

BPF_JMP

BPF operation class: control flow.

BPF_JNE

BPF JMP operation code: jump if not equal.

BPF_JSET

BPF JMP operation code: jump if src & reg.

BPF_JSGE

BPF JMP operation code: jump if greater or equal (signed).

BPF_JSGT

BPF JMP operation code: jump if greater than (signed).

BPF_JSLE

BPF JMP operation code: jump if lower or equal (signed).

BPF_JSLT

BPF JMP operation code: jump if lower than (signed).

BPF_K

BPF source operand modifier: 32-bit immediate value.

BPF_LD

BPF operation class: load from immediate. [DEPRECATED]

BPF_LDX

BPF operation class: load from register. [DEPRECATED]

BPF_LMUL

BPF PQR operation code: low multiplication.

BPF_LSH

BPF ALU/ALU64 operation code: left shift.

BPF_MEM

BPF mode modifier: load from / store to memory. [DEPRECATED]

BPF_MOD

BPF ALU/ALU64 operation code: modulus. [DEPRECATED]

BPF_MOV

BPF ALU/ALU64 operation code: move.

BPF_MUL

BPF ALU/ALU64 operation code: multiplication. [DEPRECATED]

BPF_NEG

BPF ALU/ALU64 operation code: negation. [DEPRECATED]

BPF_OR

BPF ALU/ALU64 operation code: or.

BPF_PQR

BPF operation class: product / quotient / remainder.

BPF_RSH

BPF ALU/ALU64 operation code: right shift.

BPF_SDIV

BPF PQR operation code: signed division quotient.

BPF_SHMUL

BPF PQR operation code: signed high multiplication.

BPF_SREM

BPF PQR operation code: signed division remainder.

BPF_ST

BPF operation class: store immediate. [DEPRECATED]

BPF_STX

BPF operation class: store value from register. [DEPRECATED]

BPF_SUB

BPF ALU/ALU64 operation code: subtraction.

BPF_SYSCALL

BPF JMP operation code: static syscall.

BPF_UDIV

BPF PQR operation code: unsigned division quotient.

BPF_UHMUL

BPF PQR operation code: unsigned high multiplication.

BPF_UREM

BPF PQR operation code: unsigned division remainder.

BPF_W

BPF size modifier: word (4 bytes).

BPF_X

BPF source operand modifier: src register.

BPF_XOR

BPF ALU/ALU64 operation code: exclusive or.

CALL_IMM

BPF opcode: call imm /// syscall function call to syscall with key imm.

CALL_REG

BPF opcode: tail call.

DIV32_IMM

BPF opcode: div32 dst, imm /// dst /= imm.

DIV32_REG

BPF opcode: div32 dst, src /// dst /= src.

DIV64_IMM

BPF opcode: div64 dst, imm /// dst /= imm.

DIV64_REG

BPF opcode: div64 dst, src /// dst /= src.

EF_SBPF_V2

Solana BPF version flag

EXIT

BPF opcode: exit /// return r0. /// Valid only until SBPFv3

FIRST_SCRATCH_REG

First scratch register

FRAME_PTR_REG

Frame pointer register

HOR64_IMM

BPF opcode: hor64 dst, imm /// dst |= imm << 32.

HOST_ALIGN

Alignment of the memory regions in host address space in bytes

INSN_SIZE

Size of an eBPF instructions, in bytes.

JA

BPF opcode: ja +off /// PC += off.

JEQ_IMM

BPF opcode: jeq dst, imm, +off /// PC += off if dst == imm.

JEQ_REG

BPF opcode: jeq dst, src, +off /// PC += off if dst == src.

JGE_IMM

BPF opcode: jge dst, imm, +off /// PC += off if dst >= imm.

JGE_REG

BPF opcode: jge dst, src, +off /// PC += off if dst >= src.

JGT_IMM

BPF opcode: jgt dst, imm, +off /// PC += off if dst > imm.

JGT_REG

BPF opcode: jgt dst, src, +off /// PC += off if dst > src.

JLE_IMM

BPF opcode: jle dst, imm, +off /// PC += off if dst <= imm.

JLE_REG

BPF opcode: jle dst, src, +off /// PC += off if dst <= src.

JLT_IMM

BPF opcode: jlt dst, imm, +off /// PC += off if dst < imm.

JLT_REG

BPF opcode: jlt dst, src, +off /// PC += off if dst < src.

JNE_IMM

BPF opcode: jne dst, imm, +off /// PC += off if dst != imm.

JNE_REG

BPF opcode: jne dst, src, +off /// PC += off if dst != src.

JSET_IMM

BPF opcode: jset dst, imm, +off /// PC += off if dst & imm.

JSET_REG

BPF opcode: jset dst, src, +off /// PC += off if dst & src.

JSGE_IMM

BPF opcode: jsge dst, imm, +off /// PC += off if dst >= imm (signed).

JSGE_REG

BPF opcode: jsge dst, src, +off /// PC += off if dst >= src (signed).

JSGT_IMM

BPF opcode: jsgt dst, imm, +off /// PC += off if dst > imm (signed).

JSGT_REG

BPF opcode: jsgt dst, src, +off /// PC += off if dst > src (signed).

JSLE_IMM

BPF opcode: jsle dst, imm, +off /// PC += off if dst <= imm (signed).

JSLE_REG

BPF opcode: jsle dst, src, +off /// PC += off if dst <= src (signed).

JSLT_IMM

BPF opcode: jslt dst, imm, +off /// PC += off if dst < imm (signed).

JSLT_REG

BPF opcode: jslt dst, src, +off /// PC += off if dst < src (signed).

LD_1B_REG

BPF opcode: ldxb dst, [src + off] /// dst = (src + off) as u8.

LD_2B_REG

BPF opcode: ldxh dst, [src + off] /// dst = (src + off) as u16.

LD_4B_REG

BPF opcode: ldxw dst, [src + off] /// dst = (src + off) as u32.

LD_8B_REG

BPF opcode: ldxdw dst, [src + off] /// dst = (src + off) as u64.

LD_B_REG

BPF opcode: ldxb dst, [src + off] /// dst = (src + off) as u8.

LD_DW_IMM

BPF opcode: lddw dst, imm /// dst = imm. [DEPRECATED]

LD_DW_REG

BPF opcode: ldxdw dst, [src + off] /// dst = (src + off) as u64.

LD_H_REG

BPF opcode: ldxh dst, [src + off] /// dst = (src + off) as u16.

LD_W_REG

BPF opcode: ldxw dst, [src + off] /// dst = (src + off) as u32.

LE

BPF opcode: le dst /// dst = htole<imm>(dst), with imm in {16, 32, 64}.

LMUL32_IMM

BPF opcode: lmul32 dst, imm /// dst *= (dst * imm) as u32.

LMUL32_REG

BPF opcode: lmul32 dst, src /// dst *= (dst * src) as u32.

LMUL64_IMM

BPF opcode: lmul64 dst, imm /// dst = (dst * imm) as u64.

LMUL64_REG

BPF opcode: lmul64 dst, src /// dst = (dst * src) as u64.

LSH32_IMM

BPF opcode: lsh32 dst, imm /// dst <<= imm.

LSH32_REG

BPF opcode: lsh32 dst, src /// dst <<= src.

LSH64_IMM

BPF opcode: lsh64 dst, imm /// dst <<= imm.

LSH64_REG

BPF opcode: lsh64 dst, src /// dst <<= src.

MM_BYTECODE_START

Virtual address of the bytecode region (in SBPFv3)

MM_HEAP_START

Virtual address of the heap region

MM_INPUT_START

Virtual address of the input region

MM_REGION_SIZE

Size (and alignment) of a memory region

MM_RODATA_START

Virtual address of the readonly data region (also contains the bytecode until SBPFv3)

MM_STACK_START

Virtual address of the stack region

MOD32_IMM

BPF opcode: mod32 dst, imm /// dst %= imm.

MOD32_REG

BPF opcode: mod32 dst, src /// dst %= src.

MOD64_IMM

BPF opcode: mod64 dst, imm /// dst %= imm.

MOD64_REG

BPF opcode: mod64 dst, src /// dst %= src.

MOV32_IMM

BPF opcode: mov32 dst, imm /// dst = imm.

MOV32_REG

BPF opcode: mov32 dst, src /// dst = src.

MOV64_IMM

BPF opcode: mov64 dst, imm /// dst = imm.

MOV64_REG

BPF opcode: mov64 dst, src /// dst = src.

MUL32_IMM

BPF opcode: mul32 dst, imm /// dst *= imm.

MUL32_REG

BPF opcode: mul32 dst, src /// dst *= src.

MUL64_IMM

BPF opcode: mul64 dst, imm /// dst *= imm.

MUL64_REG

BPF opcode: mul64 dst, src /// dst *= src.

NEG32

BPF opcode: neg32 dst /// dst = -dst.

NEG64

BPF opcode: neg64 dst /// dst = -dst.

OR32_IMM

BPF opcode: or32 dst, imm /// dst |= imm.

OR32_REG

BPF opcode: or32 dst, src /// dst |= src.

OR64_IMM

BPF opcode: or64 dst, imm /// dst |= imm.

OR64_REG

BPF opcode: or64 dst, src /// dst |= src.

PROG_MAX_INSNS

Maximum number of instructions in an eBPF program.

RETURN

BPF opcode: return /// return r0. /// Valid only since SBPFv3

RSH32_IMM

BPF opcode: rsh32 dst, imm /// dst >>= imm.

RSH32_REG

BPF opcode: rsh32 dst, src /// dst >>= src.

RSH64_IMM

BPF opcode: rsh64 dst, imm /// dst >>= imm.

RSH64_REG

BPF opcode: rsh64 dst, src /// dst >>= src.

SCRATCH_REGS

Number of scratch registers

SDIV32_IMM

BPF opcode: shmul32 dst, imm /// dst = (dst * imm) as i64. BPF opcode: shmul32 dst, src /// dst = (dst * src) as i64. BPF opcode: sdiv32 dst, imm /// dst /= imm.

SDIV32_REG

BPF opcode: sdiv32 dst, src /// dst /= src.

SDIV64_IMM

BPF opcode: sdiv64 dst, imm /// dst /= imm.

SDIV64_REG

BPF opcode: sdiv64 dst, src /// dst /= src.

SHMUL64_IMM

BPF opcode: shmul64 dst, imm /// dst = (dst * imm) >> 64.

SHMUL64_REG

BPF opcode: shmul64 dst, src /// dst = (dst * src) >> 64.

SREM32_IMM

BPF opcode: srem32 dst, imm /// dst %= imm.

SREM32_REG

BPF opcode: srem32 dst, src /// dst %= src.

SREM64_IMM

BPF opcode: srem64 dst, imm /// dst %= imm.

SREM64_REG

BPF opcode: srem64 dst, src /// dst %= src.

ST_1B_IMM

BPF opcode: stb [dst + off], imm /// (dst + offset) as u8 = imm.

ST_1B_REG

BPF opcode: stxb [dst + off], src /// (dst + offset) as u8 = src.

ST_2B_IMM

BPF opcode: sth [dst + off], imm /// (dst + offset) as u16 = imm.

ST_2B_REG

BPF opcode: stxh [dst + off], src /// (dst + offset) as u16 = src.

ST_4B_IMM

BPF opcode: stw [dst + off], imm /// (dst + offset) as u32 = imm.

ST_4B_REG

BPF opcode: stxw [dst + off], src /// (dst + offset) as u32 = src.

ST_8B_IMM

BPF opcode: stdw [dst + off], imm /// (dst + offset) as u64 = imm.

ST_8B_REG

BPF opcode: stxdw [dst + off], src /// (dst + offset) as u64 = src.

ST_B_IMM

BPF opcode: stb [dst + off], imm /// (dst + offset) as u8 = imm.

ST_B_REG

BPF opcode: stxb [dst + off], src /// (dst + offset) as u8 = src.

ST_DW_IMM

BPF opcode: stdw [dst + off], imm /// (dst + offset) as u64 = imm.

ST_DW_REG

BPF opcode: stxdw [dst + off], src /// (dst + offset) as u64 = src.

ST_H_IMM

BPF opcode: sth [dst + off], imm /// (dst + offset) as u16 = imm.

ST_H_REG

BPF opcode: stxh [dst + off], src /// (dst + offset) as u16 = src.

ST_W_IMM

BPF opcode: stw [dst + off], imm /// (dst + offset) as u32 = imm.

ST_W_REG

BPF opcode: stxw [dst + off], src /// (dst + offset) as u32 = src.

SUB32_IMM

BPF opcode: sub32 dst, imm /// dst = imm - dst.

SUB32_REG

BPF opcode: sub32 dst, src /// dst -= src.

SUB64_IMM

BPF opcode: sub64 dst, imm /// dst -= imm.

SUB64_REG

BPF opcode: sub64 dst, src /// dst -= src.

SYSCALL

BPF opcode: syscall /// syscall imm. /// Valid only since SBPFv3

UDIV32_IMM

BPF opcode: uhmul32 dst, imm /// dst = (dst * imm) as u64. BPF opcode: uhmul32 dst, src /// dst = (dst * src) as u64. BPF opcode: udiv32 dst, imm /// dst /= imm.

UDIV32_REG

BPF opcode: udiv32 dst, src /// dst /= src.

UDIV64_IMM

BPF opcode: udiv64 dst, imm /// dst /= imm.

UDIV64_REG

BPF opcode: udiv64 dst, src /// dst /= src.

UHMUL64_IMM

BPF opcode: uhmul64 dst, imm /// dst = (dst * imm) >> 64.

UHMUL64_REG

BPF opcode: uhmul64 dst, src /// dst = (dst * src) >> 64.

UREM32_IMM

BPF opcode: urem32 dst, imm /// dst %= imm.

UREM32_REG

BPF opcode: urem32 dst, src /// dst %= src.

UREM64_IMM

BPF opcode: urem64 dst, imm /// dst %= imm.

UREM64_REG

BPF opcode: urem64 dst, src /// dst %= src.

VIRTUAL_ADDRESS_BITS

Upper half of a pointer is the region index, lower half the virtual address inside that region.

XOR32_IMM

BPF opcode: xor32 dst, imm /// dst ^= imm.

XOR32_REG

BPF opcode: xor32 dst, src /// dst ^= src.

XOR64_IMM

BPF opcode: xor64 dst, imm /// dst ^= imm.

XOR64_REG

BPF opcode: xor64 dst, src /// dst ^= src.

Functions

augment_lddw_unchecked

Merge the two halves of a LD_DW_IMM instruction

get_insn

Get the instruction at idx of an eBPF program. idx is the index (number) of the instruction (not a byte offset). The first instruction has index 0.

get_insn_unchecked

Same as get_insn except not checked

hash_symbol_name

Hash a symbol name