@@ -109,9 +109,9 @@ basic instruction pseudo instruction
109109
110110Thus the 64-bit immediate value is constructed as follows:
111111
112- imm64 = imm + (imm_high << 32);
112+ imm64 = imm + (next_imm << 32)
113113
114- where 'imm_high ' refers to the imm value of the pseudo instruction
114+ where 'next_imm ' refers to the imm value of the pseudo instruction
115115following the basic instruction.
116116
117117In the remainder of this document 'src' and 'dst' refer to the values of the source
@@ -217,7 +217,7 @@ Examples:
217217
218218``BPF_ADD | BPF_X | BPF_ALU `` (0x0c) means::
219219
220- dst = (uint32_t) (dst + src);
220+ dst = (uint32_t) (dst + src)
221221
222222where '(uint32_t)' indicates truncation to 32 bits.
223223
@@ -487,14 +487,62 @@ and loaded back to ``R0``.
487487-----------------------------
488488
489489Instructions with the ``BPF_IMM `` 'mode' modifier use the wide instruction
490- encoding defined in `Instruction encoding `_.
490+ encoding defined in `Instruction encoding `_, and use the 'src' field of the
491+ basic instruction to hold an opcode subtype.
492+
493+ The following instructions are defined, and use additional concepts defined below:
494+
495+ ========================= ====== ==== ===================================== =========== ==============
496+ opcode construction opcode src pseudocode imm type dst type
497+ ========================= ====== ==== ===================================== =========== ==============
498+ BPF_IMM | BPF_DW | BPF_LD 0x18 0x00 dst = imm64 integer integer
499+ BPF_IMM | BPF_DW | BPF_LD 0x18 0x01 dst = map_by_fd(imm) map fd map
500+ BPF_IMM | BPF_DW | BPF_LD 0x18 0x02 dst = mva(map_by_fd(imm)) + next_imm map fd data pointer
501+ BPF_IMM | BPF_DW | BPF_LD 0x18 0x03 dst = variable_addr(imm) variable id data pointer
502+ BPF_IMM | BPF_DW | BPF_LD 0x18 0x04 dst = code_addr(imm) integer code pointer
503+ BPF_IMM | BPF_DW | BPF_LD 0x18 0x05 dst = mva(map_by_idx(imm)) map index map
504+ BPF_IMM | BPF_DW | BPF_LD 0x18 0x06 dst = mva(map_by_idx(imm)) + next_imm map index data pointer
505+ ========================= ====== ==== ===================================== =========== ==============
491506
492- There is currently only one such instruction.
507+ where
508+
509+ * map_by_fd(fd) means to convert a 32-bit POSIX file descriptor into an address of a map object
510+ * map_by_index(index) means to convert a 32-bit index into an address of a map object
511+ * mva(map) gets the address of the memory region expressed by a given map object
512+ * variable_addr(id) gets the address of a variable with a given id
513+ * code_addr(offset) gets the address of the instruction at a specified relative offset in units of 64-bit blocks
514+ * the 'imm type' can be used by disassemblers for display
515+ * the 'dst type' can be used for verification and JIT compilation purposes
516+
517+ Map objects
518+ ~~~~~~~~~~~
519+
520+ Maps are shared memory regions accessible by eBPF programs, where we use the term "map object"
521+ to refer to an object containing the data and metadata (e.g., size) about the memory region.
522+ A map can have various semantics as defined in a separate document, and may or may not have a single
523+ contiguous memory region, but the 'mva(map)' is currently only defined for maps that do have a single
524+ contiguous memory region.
525+
526+ **Note **
527+
528+ *Linux implementation *: Linux only supports the 'mva(map)' operation on array maps with a single element.
529+
530+ Each map object can have a POSIX file descriptor (fd) if supported by the platform,
531+ where 'map_by_fd(fd)' means to get the map with the specified file descriptor.
532+ Each eBPF program can also be defined to use a set of maps associated with the program
533+ at load time, and 'map_by_index(index)' means to get the map with the given index in the set
534+ associated with the eBPF program containing the instruction.
493535
494- ``BPF_IMM | BPF_DW | BPF_LD `` (0x18) means::
536+ Variables
537+ ~~~~~~~~~
495538
496- dst = imm64
539+ Variables are memory regions, identified by integer ids, accessible by eBPF programs on
540+ some platforms. The 'variable_addr(id)' operation means to get the address of the memory region
541+ identified by the given id.
542+
543+ **Note **
497544
545+ *Linux implementation *: Linux uses BTF ids to identify variables.
498546
499547Legacy BPF Packet access instructions
500548-------------------------------------
@@ -526,6 +574,12 @@ opcode imm src description referen
5265740x16 any 0x00 if (uint32_t)dst == imm goto +offset `Jump instructions `_
5275750x17 any 0x00 dst -= imm `Arithmetic instructions `_
5285760x18 0x00 0x00 dst = imm64 `64-bit immediate instructions `_
577+ 0x18 0x00 0x01 dst = map_by_fd(imm) `64-bit immediate instructions `_
578+ 0x18 0x00 0x02 dst = mva(map_by_fd(imm)) + next_imm `64-bit immediate instructions `_
579+ 0x18 0x00 0x03 dst = variable_addr(imm) `64-bit immediate instructions `_
580+ 0x18 0x00 0x04 dst = code_addr(imm) `64-bit immediate instructions `_
581+ 0x18 0x00 0x05 dst = mva(map_by_idx(imm)) `64-bit immediate instructions `_
582+ 0x18 0x00 0x06 dst = mva(map_by_idx(imm)) + next_imm `64-bit immediate instructions `_
5295830x1c 0x00 any dst = (uint32_t)(dst - src) `Arithmetic instructions `_
5305840x1d 0x00 any if dst == src goto +offset `Jump instructions `_
5315850x1e 0x00 any if (uint32_t)dst == (uint32_t)src goto +offset `Jump instructions `_
0 commit comments