Documentation ¶
Overview ¶
Package ebpf contains all types and constants to decode, encode, and generate eBPF bytecode in go. This package is inspired by the classic bpf package https://pkg.go.dev/golang.org/x/net/bpf
Index ¶
- Constants
- Variables
- func Hton16(u int16) int16
- func Hton32(u int32) int32
- func Hton64(u int64) int64
- func HtonU16(i uint16) uint16
- func HtonU32(i uint32) uint32
- func HtonU64(i uint64) uint64
- func NewReg(src Register, dest Register) uint8
- func Ntoh16(u int16) int16
- func Ntoh32(u int32) int32
- func Ntoh64(u int64) int64
- func NtohU16(i uint16) uint16
- func NtohU32(i uint32) uint32
- func NtohU64(i uint64) uint64
- type ARSH32
- type ARSH32Register
- type ARSH64
- type ARSH64Register
- type Add32
- type Add32Register
- type Add64
- type Add64Register
- type And32
- type And32Register
- type And64
- type And64Register
- type AtomicAdd
- type AtomicAnd
- type AtomicCompareAndExchange
- type AtomicExchange
- type AtomicOr
- type AtomicSub
- type AtomicXor
- type CallBPF
- type CallHelper
- type Div32
- type Div32Register
- type Div64
- type Div64Register
- type End16ToBE
- type End16ToLE
- type End32ToBE
- type End32ToLE
- type End64ToBE
- type End64ToLE
- type Exit
- type Instruction
- type Jump
- type JumpAnd
- type JumpAnd32
- type JumpAndRegister
- type JumpAndRegister32
- type JumpEqual
- type JumpEqual32
- type JumpEqualRegister
- type JumpEqualRegister32
- type JumpGreaterThan
- type JumpGreaterThan32
- type JumpGreaterThanEqual
- type JumpGreaterThanEqual32
- type JumpGreaterThanEqualRegister
- type JumpGreaterThanEqualRegister32
- type JumpGreaterThanRegister
- type JumpGreaterThanRegister32
- type JumpNotEqual
- type JumpNotEqual32
- type JumpNotEqualRegister
- type JumpNotEqualRegister32
- type JumpSignedGreaterThan
- type JumpSignedGreaterThan32
- type JumpSignedGreaterThanOrEqual
- type JumpSignedGreaterThanOrEqual32
- type JumpSignedGreaterThanOrEqualRegister
- type JumpSignedGreaterThanOrEqualRegister32
- type JumpSignedGreaterThanRegister
- type JumpSignedGreaterThanRegister32
- type JumpSignedSmallerThan
- type JumpSignedSmallerThan32
- type JumpSignedSmallerThanOrEqual
- type JumpSignedSmallerThanOrEqual32
- type JumpSignedSmallerThanOrEqualRegister
- type JumpSignedSmallerThanOrEqualRegister32
- type JumpSignedSmallerThanRegister
- type JumpSignedSmallerThanRegister32
- type JumpSmallerThan
- type JumpSmallerThan32
- type JumpSmallerThanEqual
- type JumpSmallerThanEqual32
- type JumpSmallerThanEqualRegister
- type JumpSmallerThanEqualRegister32
- type JumpSmallerThanRegister
- type JumpSmallerThanRegister32
- type Jumper
- type LoadConstant64bit
- type LoadMemory
- type LoadSocketBuf
- type LoadSocketBufConstant
- type Lsh32
- type Lsh32Register
- type Lsh64
- type Lsh64Register
- type Mod32
- type Mod32Register
- type Mod64
- type Mod64Register
- type Mov32
- type Mov32Register
- type Mov64
- type Mov64Register
- type Mul32
- type Mul32Register
- type Mul64
- type Mul64Register
- type Neg32
- type Neg64
- type Nop
- type Or32
- type Or32Register
- type Or64
- type Or64Register
- type RawInstruction
- type Register
- type Rsh32
- type Rsh32Register
- type Rsh64
- type Rsh64Register
- type Size
- type StoreMemoryConstant
- type StoreMemoryRegister
- type Sub32
- type Sub32Register
- type Sub64
- type Sub64Register
- type Valuer
- type Xor32
- type Xor32Register
- type Xor64
- type Xor64Register
Constants ¶
const ( // BPF_IMM Load intermediate values into registers BPF_IMM uint8 = 0x00 // BPF_ABS Load values at intermediate offsets from the socketbuffer into memory BPF_ABS uint8 = 0x20 // BPF_IND Load values at variable offsets from the socketbuffer into memory BPF_IND uint8 = 0x40 // BPF_MEM Load values from memory into registers visa versa. BPF_MEM uint8 = 0x60 // BPF_LEN not used in eBPF, reserved BPF_LEN uint8 = 0x80 // BPF_MSH not used in eBPF, reserved BPF_MSH uint8 = 0xa0 // BPF_ATOMIC atomic operators (for multi processor synchronization) BPF_ATOMIC uint8 = 0xc0 )
const ( // BPF_LD is used for specialized load operations BPF_LD uint8 = iota // BPF_LDX is used for generic load operations BPF_LDX // BPF_ST is used for specialized store operations BPF_ST // BPF_STX is used for generic store operations BPF_STX // BPF_ALU is used for 32bit arithmatic operations BPF_ALU // BPF_JMP is used for 64bit branching operations BPF_JMP // BPF_JMP32 is used for 32bit branching operations BPF_JMP32 // BPF_ALU64 is used for 64bit arithmatic operations BPF_ALU64 )
const ( // BPF_K indicates that the source argument of an operation is an immediate value BPF_K uint8 = 0x00 // BPF_X indicates that the source argument of an operation is a register BPF_X uint8 = 0x08 )
const ( // BPF_ADD add two numbers BPF_ADD uint8 = 0x00 // BPF_SUB subtract two numbers BPF_SUB uint8 = 0x10 // BPF_MUL multiply two numbers BPF_MUL uint8 = 0x20 // BPF_DIV divide two numbers BPF_DIV uint8 = 0x30 // BPF_OR binary or two numbers BPF_OR uint8 = 0x40 // BPF_AND binary and two numbers BPF_AND uint8 = 0x50 // BPF_LSH left shift a number BPF_LSH uint8 = 0x60 // BPF_RSH right shift a number BPF_RSH uint8 = 0x70 // BPF_NEG negate/invert a number BPF_NEG uint8 = 0x80 // BPF_MOD get the modulo of two numbers BPF_MOD uint8 = 0x90 // BPF_XOR binary XOR two numbers BPF_XOR uint8 = 0xa0 // BPF_MOV move register into another register BPF_MOV uint8 = 0xb0 // BPF_ARSH Signed shift right BPF_ARSH uint8 = 0xc0 // BPF_END endianness conversion BPF_END uint8 = 0xd0 )
const ( // BPF_JA jump always BPF_JA uint8 = 0x00 // BPF_JEQ jump equal BPF_JEQ uint8 = 0x10 // BPF_JGT jump greater than BPF_JGT uint8 = 0x20 // BPF_JGE jump greater than or equal BPF_JGE uint8 = 0x30 // BPF_JSET jump if A & B == 0 BPF_JSET uint8 = 0x40 // BPF_JNE jump not equal BPF_JNE uint8 = 0x50 // BPF_JSGT jump signed greater than BPF_JSGT uint8 = 0x60 // BPF_JSGE jump signed greater than or equal BPF_JSGE uint8 = 0x70 // BPF_CALL call a helper function or BPF to BPF call BPF_CALL uint8 = 0x80 // BPF_EXIT exit the program BPF_EXIT uint8 = 0x90 // BPF_JLT jump less than BPF_JLT uint8 = 0xa0 // BPF_JLE jump less than equal BPF_JLE uint8 = 0xb0 // BPF_JSLT jump signed less than BPF_JSLT uint8 = 0xc0 // BPF_JSLE jump signed less then equal BPF_JSLE uint8 = 0xd0 )
const ( // BPF_FETCH not an opcode on its own, used to build others BPF_FETCH uint8 = 0x01 // BPF_XCHG atomic exchange BPF_XCHG uint8 = (0xe0 | BPF_FETCH) // BPF_CMPXCHG atomic compare-and-write BPF_CMPXCHG uint8 = (0xf0 | BPF_FETCH) )
const ( // BPF_TO_LE convert to little-endian BPF_TO_LE uint8 = 0x00 // BPF_TO_BE convert to big-endian BPF_TO_BE uint8 = 0x08 )
const ( // XDP_ABORTED exit program with an error XDP_ABORTED = 0 // XDP_DROP drop the packet XDP_DROP = 1 // XDP_PASS send packet to OS XDP_PASS = 2 // XDP_TX send packet to egress on same port XDP_TX = 3 // XDP_REDIRECT redirect to a different port, CPU or userspace XDP_REDIRECT = 4 )
const ( // BPF_PSEUDO_MAP_FD is used in the SRC register to mark the imm value as a map file descriptor // https://elixir.bootlin.com/linux/v5.12.4/source/include/uapi/linux/bpf.h#L376 BPF_PSEUDO_MAP_FD = 1 // BPF_PSEUDO_MAP_FD_VALUE is used in the SRC register to mark the imm value as a map value // https://elixir.bootlin.com/linux/v5.12.4/source/include/uapi/linux/bpf.h#L385 BPF_PSEUDO_MAP_FD_VALUE = 2 // BPF_PSEUDO_BTF_ID is used in the SRC register to mark the imm value as BTF ID // https://elixir.bootlin.com/linux/v5.12.4/source/include/uapi/linux/bpf.h#L376 BPF_PSEUDO_BTF_ID = 3 )
const ( // BPFInstSize is the size of a BPF VM instruction BPFInstSize = int(unsafe.Sizeof(RawInstruction{})) )
Variables ¶
var BPFHelperFuncNumToStr = map[int32]string{}/* 164 elements not displayed */
BPFHelperFuncNumToStr is a translation tables from the helper function ids/numbers to their string form. These are based on https://github.com/libbpf/libbpf/blob/master/src/bpf_helper_defs.h
Functions ¶
Types ¶
type ARSH32Register ¶
func (*ARSH32Register) Raw ¶
func (a *ARSH32Register) Raw() ([]RawInstruction, error)
func (*ARSH32Register) String ¶
func (a *ARSH32Register) String() string
type ARSH64Register ¶
func (*ARSH64Register) Raw ¶
func (a *ARSH64Register) Raw() ([]RawInstruction, error)
func (*ARSH64Register) String ¶
func (a *ARSH64Register) String() string
type Add32Register ¶
func (*Add32Register) Raw ¶
func (a *Add32Register) Raw() ([]RawInstruction, error)
func (*Add32Register) String ¶
func (a *Add32Register) String() string
type Add64Register ¶
func (*Add64Register) Raw ¶
func (a *Add64Register) Raw() ([]RawInstruction, error)
func (*Add64Register) String ¶
func (a *Add64Register) String() string
type And32Register ¶
func (*And32Register) Raw ¶
func (a *And32Register) Raw() ([]RawInstruction, error)
func (*And32Register) String ¶
func (a *And32Register) String() string
type And64Register ¶
func (*And64Register) Raw ¶
func (a *And64Register) Raw() ([]RawInstruction, error)
func (*And64Register) String ¶
func (a *And64Register) String() string
type AtomicCompareAndExchange ¶ added in v0.2.0
func (*AtomicCompareAndExchange) Raw ¶ added in v0.2.0
func (chg *AtomicCompareAndExchange) Raw() ([]RawInstruction, error)
func (*AtomicCompareAndExchange) String ¶ added in v0.2.0
func (chg *AtomicCompareAndExchange) String() string
type AtomicExchange ¶
func (*AtomicExchange) Raw ¶
func (chg *AtomicExchange) Raw() ([]RawInstruction, error)
func (*AtomicExchange) String ¶
func (chg *AtomicExchange) String() string
type AtomicSub ¶ added in v0.2.0
func (*AtomicSub) Raw ¶ added in v0.2.0
func (as *AtomicSub) Raw() ([]RawInstruction, error)
type CallBPF ¶
type CallBPF struct {
Offset int32
}
func (*CallBPF) Raw ¶
func (c *CallBPF) Raw() ([]RawInstruction, error)
func (*CallBPF) SetJumpTarget ¶ added in v0.2.0
type CallHelper ¶
type CallHelper struct {
Function int32
}
func (*CallHelper) Raw ¶
func (c *CallHelper) Raw() ([]RawInstruction, error)
func (*CallHelper) String ¶
func (c *CallHelper) String() string
type Div32Register ¶
func (*Div32Register) Raw ¶
func (a *Div32Register) Raw() ([]RawInstruction, error)
func (*Div32Register) String ¶
func (a *Div32Register) String() string
type Div64Register ¶
func (*Div64Register) Raw ¶
func (a *Div64Register) Raw() ([]RawInstruction, error)
func (*Div64Register) String ¶
func (a *Div64Register) String() string
type End16ToBE ¶ added in v0.2.0
type End16ToBE struct {
Dest Register
}
func (*End16ToBE) Raw ¶ added in v0.2.0
func (a *End16ToBE) Raw() ([]RawInstruction, error)
type End16ToLE ¶ added in v0.2.0
type End16ToLE struct {
Dest Register
}
func (*End16ToLE) Raw ¶ added in v0.2.0
func (a *End16ToLE) Raw() ([]RawInstruction, error)
type End32ToBE ¶
type End32ToBE struct {
Dest Register
}
func (*End32ToBE) Raw ¶
func (a *End32ToBE) Raw() ([]RawInstruction, error)
type End32ToLE ¶
type End32ToLE struct {
Dest Register
}
func (*End32ToLE) Raw ¶
func (a *End32ToLE) Raw() ([]RawInstruction, error)
type End64ToBE ¶
type End64ToBE struct {
Dest Register
}
func (*End64ToBE) Raw ¶
func (a *End64ToBE) Raw() ([]RawInstruction, error)
type End64ToLE ¶
type End64ToLE struct {
Dest Register
}
func (*End64ToLE) Raw ¶
func (a *End64ToLE) Raw() ([]RawInstruction, error)
type Instruction ¶
type Instruction interface { fmt.Stringer Raw() ([]RawInstruction, error) }
Instruction is any struct that can be turned into a list of raw instruction. It returns a list since the LD IMM 64bit consists of 2 actual eBPF "instructions"
func AssemblyToInstructions ¶ added in v0.2.0
func AssemblyToInstructions(filename string, reader io.Reader) ([]Instruction, error)
AssemblyToInstructions takes in a reader and the name of the file which is used in error messages. This function attempts to parse the contents of the file as a super set of clang/LLVM eBPF assembly code. Meaning that we support the output of clang with the -S option and some additional features since clang/LLVM doesn't generate or assemble all instructions in the eBPF specification.
func Decode ¶
func Decode(rawIns []RawInstruction) ([]Instruction, error)
Decode decodes a slice of raw instructions into interpreted instructions
type Jump ¶
type Jump struct {
Offset int16
}
func (*Jump) Raw ¶
func (a *Jump) Raw() ([]RawInstruction, error)
func (*Jump) SetJumpTarget ¶ added in v0.2.0
type JumpAnd ¶ added in v0.2.0
func (*JumpAnd) Raw ¶ added in v0.2.0
func (a *JumpAnd) Raw() ([]RawInstruction, error)
func (*JumpAnd) SetJumpTarget ¶ added in v0.2.0
type JumpAnd32 ¶ added in v0.2.0
func (*JumpAnd32) Raw ¶ added in v0.2.0
func (a *JumpAnd32) Raw() ([]RawInstruction, error)
func (*JumpAnd32) SetJumpTarget ¶ added in v0.2.0
type JumpAndRegister ¶ added in v0.2.0
func (*JumpAndRegister) Raw ¶ added in v0.2.0
func (a *JumpAndRegister) Raw() ([]RawInstruction, error)
func (*JumpAndRegister) SetJumpTarget ¶ added in v0.2.0
func (a *JumpAndRegister) SetJumpTarget(relAddr int16)
func (*JumpAndRegister) String ¶ added in v0.2.0
func (a *JumpAndRegister) String() string
type JumpAndRegister32 ¶ added in v0.2.0
func (*JumpAndRegister32) Raw ¶ added in v0.2.0
func (a *JumpAndRegister32) Raw() ([]RawInstruction, error)
func (*JumpAndRegister32) SetJumpTarget ¶ added in v0.2.0
func (a *JumpAndRegister32) SetJumpTarget(relAddr int16)
func (*JumpAndRegister32) String ¶ added in v0.2.0
func (a *JumpAndRegister32) String() string
type JumpEqual ¶
func (*JumpEqual) Raw ¶
func (a *JumpEqual) Raw() ([]RawInstruction, error)
func (*JumpEqual) SetJumpTarget ¶ added in v0.2.0
type JumpEqual32 ¶
func (*JumpEqual32) Raw ¶
func (a *JumpEqual32) Raw() ([]RawInstruction, error)
func (*JumpEqual32) SetJumpTarget ¶ added in v0.2.0
func (a *JumpEqual32) SetJumpTarget(relAddr int16)
func (*JumpEqual32) SetValue ¶ added in v0.2.0
func (a *JumpEqual32) SetValue(value int32)
func (*JumpEqual32) String ¶
func (a *JumpEqual32) String() string
type JumpEqualRegister ¶
func (*JumpEqualRegister) Raw ¶
func (a *JumpEqualRegister) Raw() ([]RawInstruction, error)
func (*JumpEqualRegister) SetJumpTarget ¶ added in v0.2.0
func (a *JumpEqualRegister) SetJumpTarget(relAddr int16)
func (*JumpEqualRegister) String ¶
func (a *JumpEqualRegister) String() string
type JumpEqualRegister32 ¶
func (*JumpEqualRegister32) Raw ¶
func (a *JumpEqualRegister32) Raw() ([]RawInstruction, error)
func (*JumpEqualRegister32) SetJumpTarget ¶ added in v0.2.0
func (a *JumpEqualRegister32) SetJumpTarget(relAddr int16)
func (*JumpEqualRegister32) String ¶
func (a *JumpEqualRegister32) String() string
type JumpGreaterThan ¶
func (*JumpGreaterThan) Raw ¶
func (a *JumpGreaterThan) Raw() ([]RawInstruction, error)
func (*JumpGreaterThan) SetJumpTarget ¶ added in v0.2.0
func (a *JumpGreaterThan) SetJumpTarget(relAddr int16)
func (*JumpGreaterThan) SetValue ¶ added in v0.2.0
func (a *JumpGreaterThan) SetValue(value int32)
func (*JumpGreaterThan) String ¶
func (a *JumpGreaterThan) String() string
type JumpGreaterThan32 ¶
func (*JumpGreaterThan32) Raw ¶
func (a *JumpGreaterThan32) Raw() ([]RawInstruction, error)
func (*JumpGreaterThan32) SetJumpTarget ¶ added in v0.2.0
func (a *JumpGreaterThan32) SetJumpTarget(relAddr int16)
func (*JumpGreaterThan32) SetValue ¶ added in v0.2.0
func (a *JumpGreaterThan32) SetValue(value int32)
func (*JumpGreaterThan32) String ¶
func (a *JumpGreaterThan32) String() string
type JumpGreaterThanEqual ¶
func (*JumpGreaterThanEqual) Raw ¶
func (a *JumpGreaterThanEqual) Raw() ([]RawInstruction, error)
func (*JumpGreaterThanEqual) SetJumpTarget ¶ added in v0.2.0
func (a *JumpGreaterThanEqual) SetJumpTarget(relAddr int16)
func (*JumpGreaterThanEqual) SetValue ¶ added in v0.2.0
func (a *JumpGreaterThanEqual) SetValue(value int32)
func (*JumpGreaterThanEqual) String ¶
func (a *JumpGreaterThanEqual) String() string
type JumpGreaterThanEqual32 ¶
func (*JumpGreaterThanEqual32) Raw ¶
func (a *JumpGreaterThanEqual32) Raw() ([]RawInstruction, error)
func (*JumpGreaterThanEqual32) SetJumpTarget ¶ added in v0.2.0
func (a *JumpGreaterThanEqual32) SetJumpTarget(relAddr int16)
func (*JumpGreaterThanEqual32) SetValue ¶ added in v0.2.0
func (a *JumpGreaterThanEqual32) SetValue(value int32)
func (*JumpGreaterThanEqual32) String ¶
func (a *JumpGreaterThanEqual32) String() string
type JumpGreaterThanEqualRegister ¶
func (*JumpGreaterThanEqualRegister) Raw ¶
func (a *JumpGreaterThanEqualRegister) Raw() ([]RawInstruction, error)
func (*JumpGreaterThanEqualRegister) SetJumpTarget ¶ added in v0.2.0
func (a *JumpGreaterThanEqualRegister) SetJumpTarget(relAddr int16)
func (*JumpGreaterThanEqualRegister) String ¶
func (a *JumpGreaterThanEqualRegister) String() string
type JumpGreaterThanEqualRegister32 ¶
func (*JumpGreaterThanEqualRegister32) Raw ¶
func (a *JumpGreaterThanEqualRegister32) Raw() ([]RawInstruction, error)
func (*JumpGreaterThanEqualRegister32) SetJumpTarget ¶ added in v0.2.0
func (a *JumpGreaterThanEqualRegister32) SetJumpTarget(relAddr int16)
func (*JumpGreaterThanEqualRegister32) String ¶
func (a *JumpGreaterThanEqualRegister32) String() string
type JumpGreaterThanRegister ¶
func (*JumpGreaterThanRegister) Raw ¶
func (a *JumpGreaterThanRegister) Raw() ([]RawInstruction, error)
func (*JumpGreaterThanRegister) SetJumpTarget ¶ added in v0.2.0
func (a *JumpGreaterThanRegister) SetJumpTarget(relAddr int16)
func (*JumpGreaterThanRegister) String ¶
func (a *JumpGreaterThanRegister) String() string
type JumpGreaterThanRegister32 ¶
func (*JumpGreaterThanRegister32) Raw ¶
func (a *JumpGreaterThanRegister32) Raw() ([]RawInstruction, error)
func (*JumpGreaterThanRegister32) SetJumpTarget ¶ added in v0.2.0
func (a *JumpGreaterThanRegister32) SetJumpTarget(relAddr int16)
func (*JumpGreaterThanRegister32) String ¶
func (a *JumpGreaterThanRegister32) String() string
type JumpNotEqual ¶ added in v0.2.0
func (*JumpNotEqual) Raw ¶ added in v0.2.0
func (a *JumpNotEqual) Raw() ([]RawInstruction, error)
func (*JumpNotEqual) SetJumpTarget ¶ added in v0.2.0
func (a *JumpNotEqual) SetJumpTarget(relAddr int16)
func (*JumpNotEqual) SetValue ¶ added in v0.2.0
func (a *JumpNotEqual) SetValue(value int32)
func (*JumpNotEqual) String ¶ added in v0.2.0
func (a *JumpNotEqual) String() string
type JumpNotEqual32 ¶ added in v0.2.0
func (*JumpNotEqual32) Raw ¶ added in v0.2.0
func (a *JumpNotEqual32) Raw() ([]RawInstruction, error)
func (*JumpNotEqual32) SetJumpTarget ¶ added in v0.2.0
func (a *JumpNotEqual32) SetJumpTarget(relAddr int16)
func (*JumpNotEqual32) SetValue ¶ added in v0.2.0
func (a *JumpNotEqual32) SetValue(value int32)
func (*JumpNotEqual32) String ¶ added in v0.2.0
func (a *JumpNotEqual32) String() string
type JumpNotEqualRegister ¶ added in v0.2.0
func (*JumpNotEqualRegister) Raw ¶ added in v0.2.0
func (a *JumpNotEqualRegister) Raw() ([]RawInstruction, error)
func (*JumpNotEqualRegister) SetJumpTarget ¶ added in v0.2.0
func (a *JumpNotEqualRegister) SetJumpTarget(relAddr int16)
func (*JumpNotEqualRegister) String ¶ added in v0.2.0
func (a *JumpNotEqualRegister) String() string
type JumpNotEqualRegister32 ¶ added in v0.2.0
func (*JumpNotEqualRegister32) Raw ¶ added in v0.2.0
func (a *JumpNotEqualRegister32) Raw() ([]RawInstruction, error)
func (*JumpNotEqualRegister32) SetJumpTarget ¶ added in v0.2.0
func (a *JumpNotEqualRegister32) SetJumpTarget(relAddr int16)
func (*JumpNotEqualRegister32) String ¶ added in v0.2.0
func (a *JumpNotEqualRegister32) String() string
type JumpSignedGreaterThan ¶
func (*JumpSignedGreaterThan) Raw ¶
func (a *JumpSignedGreaterThan) Raw() ([]RawInstruction, error)
func (*JumpSignedGreaterThan) SetJumpTarget ¶ added in v0.2.0
func (a *JumpSignedGreaterThan) SetJumpTarget(relAddr int16)
func (*JumpSignedGreaterThan) SetValue ¶ added in v0.2.0
func (a *JumpSignedGreaterThan) SetValue(value int32)
func (*JumpSignedGreaterThan) String ¶
func (a *JumpSignedGreaterThan) String() string
type JumpSignedGreaterThan32 ¶
func (*JumpSignedGreaterThan32) Raw ¶
func (a *JumpSignedGreaterThan32) Raw() ([]RawInstruction, error)
func (*JumpSignedGreaterThan32) SetJumpTarget ¶ added in v0.2.0
func (a *JumpSignedGreaterThan32) SetJumpTarget(relAddr int16)
func (*JumpSignedGreaterThan32) SetValue ¶ added in v0.2.0
func (a *JumpSignedGreaterThan32) SetValue(value int32)
func (*JumpSignedGreaterThan32) String ¶
func (a *JumpSignedGreaterThan32) String() string
type JumpSignedGreaterThanOrEqual ¶
func (*JumpSignedGreaterThanOrEqual) Raw ¶
func (a *JumpSignedGreaterThanOrEqual) Raw() ([]RawInstruction, error)
func (*JumpSignedGreaterThanOrEqual) SetJumpTarget ¶ added in v0.2.0
func (a *JumpSignedGreaterThanOrEqual) SetJumpTarget(relAddr int16)
func (*JumpSignedGreaterThanOrEqual) SetValue ¶ added in v0.2.0
func (a *JumpSignedGreaterThanOrEqual) SetValue(value int32)
func (*JumpSignedGreaterThanOrEqual) String ¶
func (a *JumpSignedGreaterThanOrEqual) String() string
type JumpSignedGreaterThanOrEqual32 ¶
func (*JumpSignedGreaterThanOrEqual32) Raw ¶
func (a *JumpSignedGreaterThanOrEqual32) Raw() ([]RawInstruction, error)
func (*JumpSignedGreaterThanOrEqual32) SetJumpTarget ¶ added in v0.2.0
func (a *JumpSignedGreaterThanOrEqual32) SetJumpTarget(relAddr int16)
func (*JumpSignedGreaterThanOrEqual32) SetValue ¶ added in v0.2.0
func (a *JumpSignedGreaterThanOrEqual32) SetValue(value int32)
func (*JumpSignedGreaterThanOrEqual32) String ¶
func (a *JumpSignedGreaterThanOrEqual32) String() string
type JumpSignedGreaterThanOrEqualRegister ¶
func (*JumpSignedGreaterThanOrEqualRegister) Raw ¶
func (a *JumpSignedGreaterThanOrEqualRegister) Raw() ([]RawInstruction, error)
func (*JumpSignedGreaterThanOrEqualRegister) SetJumpTarget ¶ added in v0.2.0
func (a *JumpSignedGreaterThanOrEqualRegister) SetJumpTarget(relAddr int16)
func (*JumpSignedGreaterThanOrEqualRegister) String ¶
func (a *JumpSignedGreaterThanOrEqualRegister) String() string
type JumpSignedGreaterThanOrEqualRegister32 ¶
func (*JumpSignedGreaterThanOrEqualRegister32) Raw ¶
func (a *JumpSignedGreaterThanOrEqualRegister32) Raw() ([]RawInstruction, error)
func (*JumpSignedGreaterThanOrEqualRegister32) SetJumpTarget ¶ added in v0.2.0
func (a *JumpSignedGreaterThanOrEqualRegister32) SetJumpTarget(relAddr int16)
func (*JumpSignedGreaterThanOrEqualRegister32) String ¶
func (a *JumpSignedGreaterThanOrEqualRegister32) String() string
type JumpSignedGreaterThanRegister ¶
func (*JumpSignedGreaterThanRegister) Raw ¶
func (a *JumpSignedGreaterThanRegister) Raw() ([]RawInstruction, error)
func (*JumpSignedGreaterThanRegister) SetJumpTarget ¶ added in v0.2.0
func (a *JumpSignedGreaterThanRegister) SetJumpTarget(relAddr int16)
func (*JumpSignedGreaterThanRegister) String ¶
func (a *JumpSignedGreaterThanRegister) String() string
type JumpSignedGreaterThanRegister32 ¶
func (*JumpSignedGreaterThanRegister32) Raw ¶
func (a *JumpSignedGreaterThanRegister32) Raw() ([]RawInstruction, error)
func (*JumpSignedGreaterThanRegister32) SetJumpTarget ¶ added in v0.2.0
func (a *JumpSignedGreaterThanRegister32) SetJumpTarget(relAddr int16)
func (*JumpSignedGreaterThanRegister32) String ¶
func (a *JumpSignedGreaterThanRegister32) String() string
type JumpSignedSmallerThan ¶
func (*JumpSignedSmallerThan) Raw ¶
func (a *JumpSignedSmallerThan) Raw() ([]RawInstruction, error)
func (*JumpSignedSmallerThan) SetJumpTarget ¶ added in v0.2.0
func (a *JumpSignedSmallerThan) SetJumpTarget(relAddr int16)
func (*JumpSignedSmallerThan) SetValue ¶ added in v0.2.0
func (a *JumpSignedSmallerThan) SetValue(value int32)
func (*JumpSignedSmallerThan) String ¶
func (a *JumpSignedSmallerThan) String() string
type JumpSignedSmallerThan32 ¶
func (*JumpSignedSmallerThan32) Raw ¶
func (a *JumpSignedSmallerThan32) Raw() ([]RawInstruction, error)
func (*JumpSignedSmallerThan32) SetJumpTarget ¶ added in v0.2.0
func (a *JumpSignedSmallerThan32) SetJumpTarget(relAddr int16)
func (*JumpSignedSmallerThan32) SetValue ¶ added in v0.2.0
func (a *JumpSignedSmallerThan32) SetValue(value int32)
func (*JumpSignedSmallerThan32) String ¶
func (a *JumpSignedSmallerThan32) String() string
type JumpSignedSmallerThanOrEqual ¶
func (*JumpSignedSmallerThanOrEqual) Raw ¶
func (a *JumpSignedSmallerThanOrEqual) Raw() ([]RawInstruction, error)
func (*JumpSignedSmallerThanOrEqual) SetJumpTarget ¶ added in v0.2.0
func (a *JumpSignedSmallerThanOrEqual) SetJumpTarget(relAddr int16)
func (*JumpSignedSmallerThanOrEqual) SetValue ¶ added in v0.2.0
func (a *JumpSignedSmallerThanOrEqual) SetValue(value int32)
func (*JumpSignedSmallerThanOrEqual) String ¶
func (a *JumpSignedSmallerThanOrEqual) String() string
type JumpSignedSmallerThanOrEqual32 ¶
func (*JumpSignedSmallerThanOrEqual32) Raw ¶
func (a *JumpSignedSmallerThanOrEqual32) Raw() ([]RawInstruction, error)
func (*JumpSignedSmallerThanOrEqual32) SetJumpTarget ¶ added in v0.2.0
func (a *JumpSignedSmallerThanOrEqual32) SetJumpTarget(relAddr int16)
func (*JumpSignedSmallerThanOrEqual32) SetValue ¶ added in v0.2.0
func (a *JumpSignedSmallerThanOrEqual32) SetValue(value int32)
func (*JumpSignedSmallerThanOrEqual32) String ¶
func (a *JumpSignedSmallerThanOrEqual32) String() string
type JumpSignedSmallerThanOrEqualRegister ¶
func (*JumpSignedSmallerThanOrEqualRegister) Raw ¶
func (a *JumpSignedSmallerThanOrEqualRegister) Raw() ([]RawInstruction, error)
func (*JumpSignedSmallerThanOrEqualRegister) SetJumpTarget ¶ added in v0.2.0
func (a *JumpSignedSmallerThanOrEqualRegister) SetJumpTarget(relAddr int16)
func (*JumpSignedSmallerThanOrEqualRegister) String ¶
func (a *JumpSignedSmallerThanOrEqualRegister) String() string
type JumpSignedSmallerThanOrEqualRegister32 ¶
func (*JumpSignedSmallerThanOrEqualRegister32) Raw ¶
func (a *JumpSignedSmallerThanOrEqualRegister32) Raw() ([]RawInstruction, error)
func (*JumpSignedSmallerThanOrEqualRegister32) SetJumpTarget ¶ added in v0.2.0
func (a *JumpSignedSmallerThanOrEqualRegister32) SetJumpTarget(relAddr int16)
func (*JumpSignedSmallerThanOrEqualRegister32) String ¶
func (a *JumpSignedSmallerThanOrEqualRegister32) String() string
type JumpSignedSmallerThanRegister ¶
func (*JumpSignedSmallerThanRegister) Raw ¶
func (a *JumpSignedSmallerThanRegister) Raw() ([]RawInstruction, error)
func (*JumpSignedSmallerThanRegister) SetJumpTarget ¶ added in v0.2.0
func (a *JumpSignedSmallerThanRegister) SetJumpTarget(relAddr int16)
func (*JumpSignedSmallerThanRegister) String ¶
func (a *JumpSignedSmallerThanRegister) String() string
type JumpSignedSmallerThanRegister32 ¶
func (*JumpSignedSmallerThanRegister32) Raw ¶
func (a *JumpSignedSmallerThanRegister32) Raw() ([]RawInstruction, error)
func (*JumpSignedSmallerThanRegister32) SetJumpTarget ¶ added in v0.2.0
func (a *JumpSignedSmallerThanRegister32) SetJumpTarget(relAddr int16)
func (*JumpSignedSmallerThanRegister32) String ¶
func (a *JumpSignedSmallerThanRegister32) String() string
type JumpSmallerThan ¶
func (*JumpSmallerThan) Raw ¶
func (a *JumpSmallerThan) Raw() ([]RawInstruction, error)
func (*JumpSmallerThan) SetJumpTarget ¶ added in v0.2.0
func (a *JumpSmallerThan) SetJumpTarget(relAddr int16)
func (*JumpSmallerThan) SetValue ¶ added in v0.2.0
func (a *JumpSmallerThan) SetValue(value int32)
func (*JumpSmallerThan) String ¶
func (a *JumpSmallerThan) String() string
type JumpSmallerThan32 ¶
func (*JumpSmallerThan32) Raw ¶
func (a *JumpSmallerThan32) Raw() ([]RawInstruction, error)
func (*JumpSmallerThan32) SetJumpTarget ¶ added in v0.2.0
func (a *JumpSmallerThan32) SetJumpTarget(relAddr int16)
func (*JumpSmallerThan32) SetValue ¶ added in v0.2.0
func (a *JumpSmallerThan32) SetValue(value int32)
func (*JumpSmallerThan32) String ¶
func (a *JumpSmallerThan32) String() string
type JumpSmallerThanEqual ¶
func (*JumpSmallerThanEqual) Raw ¶
func (a *JumpSmallerThanEqual) Raw() ([]RawInstruction, error)
func (*JumpSmallerThanEqual) SetJumpTarget ¶ added in v0.2.0
func (a *JumpSmallerThanEqual) SetJumpTarget(relAddr int16)
func (*JumpSmallerThanEqual) SetValue ¶ added in v0.2.0
func (a *JumpSmallerThanEqual) SetValue(value int32)
func (*JumpSmallerThanEqual) String ¶
func (a *JumpSmallerThanEqual) String() string
type JumpSmallerThanEqual32 ¶
func (*JumpSmallerThanEqual32) Raw ¶
func (a *JumpSmallerThanEqual32) Raw() ([]RawInstruction, error)
func (*JumpSmallerThanEqual32) SetJumpTarget ¶ added in v0.2.0
func (a *JumpSmallerThanEqual32) SetJumpTarget(relAddr int16)
func (*JumpSmallerThanEqual32) SetValue ¶ added in v0.2.0
func (a *JumpSmallerThanEqual32) SetValue(value int32)
func (*JumpSmallerThanEqual32) String ¶
func (a *JumpSmallerThanEqual32) String() string
type JumpSmallerThanEqualRegister ¶
func (*JumpSmallerThanEqualRegister) Raw ¶
func (a *JumpSmallerThanEqualRegister) Raw() ([]RawInstruction, error)
func (*JumpSmallerThanEqualRegister) SetJumpTarget ¶ added in v0.2.0
func (a *JumpSmallerThanEqualRegister) SetJumpTarget(relAddr int16)
func (*JumpSmallerThanEqualRegister) String ¶
func (a *JumpSmallerThanEqualRegister) String() string
type JumpSmallerThanEqualRegister32 ¶
func (*JumpSmallerThanEqualRegister32) Raw ¶
func (a *JumpSmallerThanEqualRegister32) Raw() ([]RawInstruction, error)
func (*JumpSmallerThanEqualRegister32) SetJumpTarget ¶ added in v0.2.0
func (a *JumpSmallerThanEqualRegister32) SetJumpTarget(relAddr int16)
func (*JumpSmallerThanEqualRegister32) String ¶
func (a *JumpSmallerThanEqualRegister32) String() string
type JumpSmallerThanRegister ¶
func (*JumpSmallerThanRegister) Raw ¶
func (a *JumpSmallerThanRegister) Raw() ([]RawInstruction, error)
func (*JumpSmallerThanRegister) SetJumpTarget ¶ added in v0.2.0
func (a *JumpSmallerThanRegister) SetJumpTarget(relAddr int16)
func (*JumpSmallerThanRegister) String ¶
func (a *JumpSmallerThanRegister) String() string
type JumpSmallerThanRegister32 ¶
func (*JumpSmallerThanRegister32) Raw ¶
func (a *JumpSmallerThanRegister32) Raw() ([]RawInstruction, error)
func (*JumpSmallerThanRegister32) SetJumpTarget ¶ added in v0.2.0
func (a *JumpSmallerThanRegister32) SetJumpTarget(relAddr int16)
func (*JumpSmallerThanRegister32) String ¶
func (a *JumpSmallerThanRegister32) String() string
type Jumper ¶ added in v0.2.0
type Jumper interface {
SetJumpTarget(relAddr int16)
}
Jumper is any instruction that can jump to another piece of code using an 16-bit address
type LoadConstant64bit ¶
func (*LoadConstant64bit) Raw ¶
func (lc *LoadConstant64bit) Raw() ([]RawInstruction, error)
func (*LoadConstant64bit) String ¶
func (lc *LoadConstant64bit) String() string
type LoadMemory ¶
func (*LoadMemory) Raw ¶
func (lm *LoadMemory) Raw() ([]RawInstruction, error)
func (*LoadMemory) String ¶
func (lm *LoadMemory) String() string
type LoadSocketBuf ¶
func (*LoadSocketBuf) Raw ¶
func (lm *LoadSocketBuf) Raw() ([]RawInstruction, error)
func (*LoadSocketBuf) String ¶
func (lm *LoadSocketBuf) String() string
type LoadSocketBufConstant ¶
func (*LoadSocketBufConstant) Raw ¶
func (lm *LoadSocketBufConstant) Raw() ([]RawInstruction, error)
func (*LoadSocketBufConstant) String ¶
func (lm *LoadSocketBufConstant) String() string
type Lsh32Register ¶
func (*Lsh32Register) Raw ¶
func (a *Lsh32Register) Raw() ([]RawInstruction, error)
func (*Lsh32Register) String ¶
func (a *Lsh32Register) String() string
type Lsh64Register ¶
func (*Lsh64Register) Raw ¶
func (a *Lsh64Register) Raw() ([]RawInstruction, error)
func (*Lsh64Register) String ¶
func (a *Lsh64Register) String() string
type Mod32Register ¶
func (*Mod32Register) Raw ¶
func (a *Mod32Register) Raw() ([]RawInstruction, error)
func (*Mod32Register) String ¶
func (a *Mod32Register) String() string
type Mod64Register ¶
func (*Mod64Register) Raw ¶
func (a *Mod64Register) Raw() ([]RawInstruction, error)
func (*Mod64Register) String ¶
func (a *Mod64Register) String() string
type Mov32Register ¶
func (*Mov32Register) Raw ¶
func (a *Mov32Register) Raw() ([]RawInstruction, error)
func (*Mov32Register) String ¶
func (a *Mov32Register) String() string
type Mov64Register ¶
func (*Mov64Register) Raw ¶
func (a *Mov64Register) Raw() ([]RawInstruction, error)
func (*Mov64Register) String ¶
func (a *Mov64Register) String() string
type Mul32Register ¶
func (*Mul32Register) Raw ¶
func (a *Mul32Register) Raw() ([]RawInstruction, error)
func (*Mul32Register) String ¶
func (a *Mul32Register) String() string
type Mul64Register ¶
func (*Mul64Register) Raw ¶
func (a *Mul64Register) Raw() ([]RawInstruction, error)
func (*Mul64Register) String ¶
func (a *Mul64Register) String() string
type Neg32 ¶
type Neg32 struct {
Dest Register
}
func (*Neg32) Raw ¶
func (a *Neg32) Raw() ([]RawInstruction, error)
type Neg64 ¶
type Neg64 struct {
Dest Register
}
func (*Neg64) Raw ¶
func (a *Neg64) Raw() ([]RawInstruction, error)
type Nop ¶
type Nop struct{}
Nop does not exist in the eBPF definition, it is a filler instruction this package adds to decoded programs so the index numbers of the slice stay the same as the index numbers of the raw instructions, even when the LoadConstant64bit op is used. This is to avoid confusion when looking at jump commands or calculating offsets for FD relocation.
func (*Nop) Raw ¶
func (n *Nop) Raw() ([]RawInstruction, error)
type Or32Register ¶
func (*Or32Register) Raw ¶
func (a *Or32Register) Raw() ([]RawInstruction, error)
func (*Or32Register) String ¶
func (a *Or32Register) String() string
type Or64Register ¶
func (*Or64Register) Raw ¶
func (a *Or64Register) Raw() ([]RawInstruction, error)
func (*Or64Register) String ¶
func (a *Or64Register) String() string
type RawInstruction ¶
type RawInstruction struct { // Operation to execute. Op uint8 // The operation register, split into source and destination register // The upper 4 bits are the destination register, the lower 4 bits the source Reg uint8 // Off int16 // Constant parameter. The meaning depends on the Op. Imm int32 }
A RawInstruction is a BPF virtual machine instruction.
func Encode ¶
func Encode(ins []Instruction) ([]RawInstruction, error)
Encode turns a slice of instructions into raw instructions
func MustEncode ¶
func MustEncode(raw []Instruction) []RawInstruction
MustEncode does the same as Encode but rather than returning an error it will panic
func (*RawInstruction) GetDestReg ¶
func (i *RawInstruction) GetDestReg() Register
func (*RawInstruction) GetSourceReg ¶
func (i *RawInstruction) GetSourceReg() Register
func (*RawInstruction) SetDestReg ¶
func (i *RawInstruction) SetDestReg(v Register)
func (*RawInstruction) SetSourceReg ¶
func (i *RawInstruction) SetSourceReg(v Register)
type Register ¶
type Register uint8
Register is a value used to indicate a source or destination register. Registers are used to pass arguments to variables and as scrach room for. See section 'BPF kernel internals' of https://www.kernel.org/doc/Documentation/networking/filter.rst
const ( // BPF_REG_0 aka R0 is the return value of the eBPF program, it is also used by helper functions and BPF to BPF // calls for return values. BPF_REG_0 Register = iota // BPF_REG_1 aka R1 is the first argument of a helper function or BPF to BPF call, it is set at the start of // a eBPF program to different values depending on the program type (typically a pointer to a struct). // After calling a helper function or BPF function one should assume the constents will be changed. BPF_REG_1 // BPF_REG_2 aka R2 is the second argument of a helper function or BPF to BPF call, it can be set at the start // of the program depending on the program type but is typically not used. // After calling a helper function or BPF function one should assume the constents will be changed. BPF_REG_2 // BPF_REG_3 aka R3 is the third argument of a helper function or BPF to BPF call, it can be set at the start // of the program depending on the program type but is typically not used. // After calling a helper function or BPF function one should assume the constents will be changed. BPF_REG_3 // BPF_REG_4 aka R4 is the forth argument of a helper function or BPF to BPF call, it can be set at the start // of the program depending on the program type but is typically not used. // After calling a helper function or BPF function one should assume the constents will be changed. BPF_REG_4 // BPF_REG_5 aka R5 is the fifth argument of a helper function or BPF to BPF call, it can be set at the start // of the program depending on the program type but is typically not used. // After calling a helper function or BPF function one should assume the constents will be changed. BPF_REG_5 // BPF_REG_6 aka R6 is a callee saved register for helper functions, meaning the contents will not be changed // by the helper function. BPF_REG_6 // BPF_REG_7 aka R7 is a callee saved register for helper functions, meaning the contents will not be changed // by the helper function. BPF_REG_7 // BPF_REG_8 aka R8 is a callee saved register for helper functions, meaning the contents will not be changed // by the helper function. BPF_REG_8 // BPF_REG_9 aka R9 is a callee saved register for helper functions, meaning the contents will not be changed // by the helper function. BPF_REG_9 // BPF_REG_10 aka R10 is a read-only register containing the frame pointer. It is a pointer to the start of // the stack data reserved for this program. Each program/bpf to bpf function has its own stack. BPF_REG_10 // BPF_REG_MAX is an invalid register, it is used for enumeration over registers. BPF_REG_MAX )
const PSEUDO_CALL Register = 0x01
PSEUDO_CALL If the source register is 1, it is not a call to a helper function but to another bpf function(bpf to bpf call).
type Rsh32Register ¶
func (*Rsh32Register) Raw ¶
func (a *Rsh32Register) Raw() ([]RawInstruction, error)
func (*Rsh32Register) String ¶
func (a *Rsh32Register) String() string
type Rsh64Register ¶
func (*Rsh64Register) Raw ¶
func (a *Rsh64Register) Raw() ([]RawInstruction, error)
func (*Rsh64Register) String ¶
func (a *Rsh64Register) String() string
type StoreMemoryConstant ¶
func (*StoreMemoryConstant) Raw ¶
func (sm *StoreMemoryConstant) Raw() ([]RawInstruction, error)
func (*StoreMemoryConstant) String ¶
func (sm *StoreMemoryConstant) String() string
type StoreMemoryRegister ¶
func (*StoreMemoryRegister) Raw ¶
func (sm *StoreMemoryRegister) Raw() ([]RawInstruction, error)
func (*StoreMemoryRegister) String ¶
func (sm *StoreMemoryRegister) String() string
type Sub32Register ¶
func (*Sub32Register) Raw ¶
func (a *Sub32Register) Raw() ([]RawInstruction, error)
func (*Sub32Register) String ¶
func (a *Sub32Register) String() string
type Sub64Register ¶
func (*Sub64Register) Raw ¶
func (a *Sub64Register) Raw() ([]RawInstruction, error)
func (*Sub64Register) String ¶
func (a *Sub64Register) String() string
type Valuer ¶ added in v0.2.0
type Valuer interface {
SetValue(value int32)
}
Valuer is any instruction for which a constant value can be set
type Xor32Register ¶
func (*Xor32Register) Raw ¶
func (a *Xor32Register) Raw() ([]RawInstruction, error)
func (*Xor32Register) String ¶
func (a *Xor32Register) String() string
type Xor64Register ¶
func (*Xor64Register) Raw ¶
func (a *Xor64Register) Raw() ([]RawInstruction, error)
func (*Xor64Register) String ¶
func (a *Xor64Register) String() string