Skip to content

BPF instruction set

Alex Petrov edited this page Oct 23, 2024 · 1 revision

Arithmetic Instructions:

ADD: Adds two values.
SUB: Subtracts one value from another.
MUL: Multiplies two values.
DIV: Divides one value by another.
NEG: Negates a value.
AND: Performs a bitwise AND operation.
OR: Performs a bitwise OR operation.
XOR: Performs a bitwise XOR operation.
LSH: Left-shifts a value.
RSH: Right-shifts a value.

Load and Store Instructions:

LDX: Loads a value from memory into a register.
STX: Stores a value from a register into memory.
LDH: Loads a half-word (16 bits) from memory.
LDW: Loads a word (32 bits) from memory.
LDH_IMM: Loads a half-word immediate value.
LDW_IMM: Loads a word immediate value.

Control Flow Instructions:

JMP: Unconditional jump to a specified address.
JEQ: Jump if equal.
JNE: Jump if not equal.
JGT: Jump if greater than.
JGE: Jump if greater than or equal to.
JLT: Jump if less than.
JLE: Jump if less than or equal to.
CALL: Calls a subroutine.
RET: Returns from a subroutine.

Miscellaneous Instructions:

EXIT: Terminates the BPF program.
NOP: No operation.

BPF Helper Functions:

bpf_skb_load_bytes: Loads data from a network packet.
bpf_skb_store_bytes: Stores data into a network packet.
bpf_skb_get_tokens: Gets tokens from a network packet.
bpf_skb_under_skb: Gets the outer packet from a nested packet.
bpf_trace_printk: Prints a message to the kernel log.