Extended Berkeley Packet Filter (eBPF) assembler and virtual machine
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 

80 lines
2.4 KiB

package ebpf
const (
opMaskClass = 0x07
opMaskSize = 0x18
opMaskMode = 0xe0
opMaskSource = 0x08
opMaskOperand = 0xf0
)
// Operand classes.
const (
opClassLoad Opcode = iota // 0x00
opClassLoadX // 0x01
opClassStore // 0x02
opClassStoreX // 0x03
opClassALU // 0x04
opClassJump // 0x05
_ // 0x06 (reserved for future use)
opClassALU64 // 0x07
)
// For load and store instructions:
// +------------+--------+------------+
// | 3 bits | 2 bits | 3 bits |
// | mode | size | insn class |
// +------------+--------+------------+
// (MSB) (LSB)
// Size modifiers.
const (
sizeWord Opcode = iota << 3 // 0x00
sizeHalfWord // 0x08
sizeByte // 0x10
sizeDoubleWord // 0x18
)
// Mode modifiers.
const (
modeImmediate Opcode = iota << 5 // 0x00
modeAbsolute // 0x20
modeIndirect // 0x40
modeMemory // 0x60
_ // 0x80
_ // 0xa0
modeExclusiveAdd // 0xc0
)
// For arithmetic (BPF_ALU/BPF_ALU64) and jump (BPF_JMP) instructions:
// +----------------+----+------------+
// | 4 bits |1 b.| 3 bits |
// | operation code | src| insn class |
// +----------------+----+------------+
// (MSB) (LSB)
// Source modifiers.
const (
aluSourceImmediate Opcode = iota << 3
aluSourceX
jumpSourceImmediate = aluSourceImmediate
jumpSourceX = aluSourceX
)
// Jumps
const (
jumpOp Opcode = iota << 4 // 0x00
jumpOpEqual // 0x10
jumpOpGreater // 0x20
jumpOpGreaterOrEqual // 0x30
jumpOpSet // 0x40
jumpOpNotEqual // 0x50
jumpOpSignedGreater // 0x60
jumpOpSignedGreaterOrEqual // 0x70
jumpOpCall // 0x80
jumpOpExit // 0x90
jumpOpLess // 0xa0
jumpOpLessOrEqual // 0xb0
jumpOpSignedLess // 0xc0
jumpOpSignedLessOrEqual // 0xd0
)