Documentation ¶
Overview ¶
Package ebpf implements an eBPF assembler, disassembler and virtual machine.
Index ¶
- Constants
- Variables
- func BuiltinProbeRead(r1, r2, r3, r4, r5 uint64) uint64
- func BuiltinStrcmp(r1, r2, r3, r4, r5 uint64) uint64
- func LoadELF(r io.ReaderAt) (map[string]Program, error)
- type ALU64OpConstant
- type ALU64OpRegister
- type ALUOp
- type ALUOpConstant
- type ALUOpRegister
- type ByteSwap
- type Call
- type Exit
- type Func
- type Instruction
- type Jump
- type JumpIf
- type JumpIfX
- type JumpTest
- type LoadAbsolute
- type LoadConstant
- type LoadIndirect
- type LoadRegister
- type Negate
- type Negate64
- type Opcode
- type Program
- type RawInstruction
- type Register
- type StoreImmediate
- type StoreRegister
- type Tracer
- type VM
Constants ¶
const ( PseudoMapFD = R1 // BPF_PSEUDO_MAP_FD PseudoMapValue = R2 // BPF_PSEUDO_MAP_VALUE PseudoCall = R1 // BPF_PSEUDO_CALL )
Pseudo registers used by 64bit loads and jumps
Variables ¶
Functions ¶
Types ¶
type ALU64OpConstant ¶
ALU64OpConstant executes Dst = Dst <Op> Value.
func (ALU64OpConstant) Assemble ¶
func (a ALU64OpConstant) Assemble() (RawInstruction, error)
Assemble implements the Instruction Assemble method.
func (ALU64OpConstant) CString ¶
func (a ALU64OpConstant) CString() string
func (ALU64OpConstant) String ¶
func (a ALU64OpConstant) String() string
type ALU64OpRegister ¶
ALU64OpRegister executes Dst = Dst <Op> Src.
func (ALU64OpRegister) Assemble ¶
func (a ALU64OpRegister) Assemble() (RawInstruction, error)
Assemble implements the Instruction Assemble method.
func (ALU64OpRegister) CString ¶
func (a ALU64OpRegister) CString() string
func (ALU64OpRegister) String ¶
func (a ALU64OpRegister) String() string
type ALUOpConstant ¶
ALUOpConstant executes Dst = Dst <Op> Value.
func (ALUOpConstant) Assemble ¶
func (a ALUOpConstant) Assemble() (RawInstruction, error)
Assemble implements the Instruction Assemble method.
func (ALUOpConstant) CString ¶
func (a ALUOpConstant) CString() string
func (ALUOpConstant) String ¶
func (a ALUOpConstant) String() string
type ALUOpRegister ¶
ALUOpRegister executes Dst = Dst <Op> Src.
func (ALUOpRegister) Assemble ¶
func (a ALUOpRegister) Assemble() (RawInstruction, error)
Assemble implements the Instruction Assemble method.
func (ALUOpRegister) CString ¶
func (a ALUOpRegister) CString() string
func (ALUOpRegister) String ¶
func (a ALUOpRegister) String() string
type ByteSwap ¶
func (ByteSwap) Assemble ¶
func (a ByteSwap) Assemble() (RawInstruction, error)
Assemble implements the Instruction Assemble method.
type Call ¶
type Call uint32
Call function.
const ( Unspec Call = iota MapLookupElem MapUpdateElem MapDeleteElem ProbeRead KtimeGetNs TracePrintk GetPrandomU32 GetSmpProcessorId SKBStoreBytes L3CsumReplace L4CsumReplace TailCall CloneRedirect GetCurrentPidTgid GetCurrentUidGid GetCurrentComm GetCgroupClassid SKBVlanPush SKBVlanPop SKBGetTunnelKey SKBSetTunnelKey PerfEventRead Redirect GetRouteRealm PerfEventOutput SKBLoadBytes GetStackid CsumDiff SKBGetTunnelOpt SKBSetTunnelOpt SKBChangeProto SKBChangeType SKBUnderCgroup GetHashRecalc GetCurrentTask ProbeWriteUser CurrentTaskUnderCgroup SKBChangeTail SKBPullData CsumUpdate SetHashInvalid GetNumaNodeId SKBChangeHead XDPAdjustHead ProbeReadStr GetSocketCookie GetSocketUid SetHash Setsockopt SKBAdjustRoom RedirectMap SkRedirectMap SockMapUpdate XDPAdjustMeta PerfEventReadValue PerfProgReadValue Getsockopt OverrideReturn SockOpsCbFlagsSet MsgRedirectMap MsgApplyBytes MsgCorkBytes MsgPullData Bind XDPAdjustTail SKBGetXfrmState GetStack SKBLoadBytesRelative FIBLookup SockHashUpdate MsgRedirectHash SkRedirectHash LwtPushEncap LwtSeg6StoreBytes LwtSeg6AdjustSrh LwtSeg6Action RcRepeat RcKeydown SKBCgroupId GetCurrentCgroupId GetLocalStorage SkSelectReuseport SKBAncestorCgroupId SkLookupTcp SkLookupUdp SkRelease MapPushElem MapPopElem MapPeekElem MsgPushData MsgPopData RcPointerRel SpinLock SpinUnlock SkFullsock TcpSock SKBEcnSetCe GetListenerSock SkcLookupTcp SysctlGetName SysctlGetCurrentValue SysctlGetNewValue SysctlSetNewValue Strtol Strtoul SkStorageGet SkStorageDelete SendSignal TCPGenSynCookie SKBOutput ProbeReadUser ProbeReadKernel ProbeReadUserStr ProbeReadKernelStr TCPSendACK SendSignalThread Jiffies64 )
func (Call) Assemble ¶
func (a Call) Assemble() (RawInstruction, error)
Assemble implements the Instruction Assemble method.
type Exit ¶
type Exit struct{}
Exit the eBPF program and return the value of R0.
func (Exit) Assemble ¶
func (a Exit) Assemble() (RawInstruction, error)
type Instruction ¶
type Instruction interface { // Assemble assembles the Instruction into a RawInstruction. Assemble() (RawInstruction, error) // String returns the assembly. String() string }
type Jump ¶
type Jump struct {
Offset uint16
}
Jump skips the following Skip instructions in the program.
func (Jump) Assemble ¶
func (a Jump) Assemble() (RawInstruction, error)
Assemble implements the Instruction Assemble method.
type JumpIf ¶
JumpIf performs a conditional jump.
func (JumpIf) Assemble ¶
func (a JumpIf) Assemble() (RawInstruction, error)
type JumpIfX ¶
func (JumpIfX) Assemble ¶
func (a JumpIfX) Assemble() (RawInstruction, error)
type JumpTest ¶
type JumpTest uint8
JumpTest is a comparison operator used in conditional jumps.
const ( JumpEqual JumpTest = iota // K == A JumpGreater // K > A JumpGreaterOrEqual // K >= A JumpSet // K & A JumpNotEqual // K != A JumpSignedGreater // K > A JumpSignedGreaterOrEqual // K >= A JumpLess // K < A JumpLessOrEqual // K <= A JumpSignedLess // K < A JumpSignedLessOrEqual // K <= A )
Supported operators for conditional jumps.
type LoadAbsolute ¶
type LoadAbsolute struct {
Dst, Src Register
Value uint64
Size uint8 // Size of the load value (in bytes).
}
func (LoadAbsolute) Assemble ¶
func (a LoadAbsolute) Assemble() (RawInstruction, error)
func (LoadAbsolute) String ¶
func (a LoadAbsolute) String() string
type LoadConstant ¶
func (LoadConstant) Assemble ¶
func (a LoadConstant) Assemble() (RawInstruction, error)
func (LoadConstant) String ¶
func (a LoadConstant) String() string
type LoadIndirect ¶
type LoadIndirect struct {
Dst, Src Register
Value uint64
Size uint8 // Size of the load value (in bytes).
}
func (LoadIndirect) Assemble ¶
func (a LoadIndirect) Assemble() (RawInstruction, error)
func (LoadIndirect) String ¶
func (a LoadIndirect) String() string
type LoadRegister ¶
type LoadRegister struct {
Dst, Src Register
Offset int16
Size uint8 // Size of the load value (in bytes).
}
func (LoadRegister) Assemble ¶
func (a LoadRegister) Assemble() (RawInstruction, error)
func (LoadRegister) String ¶
func (a LoadRegister) String() string
type Negate ¶
type Negate struct {
Dst Register
}
Negate executes Dst = !Dst.
func (Negate) Assemble ¶
func (a Negate) Assemble() (RawInstruction, error)
Assemble implements the Instruction Assemble method.
type Negate64 ¶
type Negate64 struct {
Dst Register
}
Negate64 executes Dst = !Dst.
func (Negate64) Assemble ¶
func (a Negate64) Assemble() (RawInstruction, error)
Assemble implements the Instruction Assemble method.
type Program ¶
type Program []Instruction
Program is a sequence of instructions.
func Disassemble ¶
Disassemble a slice of bytes containing an eBPF program.
func DisassembleReader ¶
DisassembleReader disassembles an eBPF program from reader using the default byte order.
func DisassembleReaderOrder ¶
DisassembleReaderOrder is like DisassembleReader with a custom byte order.
func (Program) Assemble ¶
func (p Program) Assemble() ([]RawInstruction, error)
type RawInstruction ¶
type RawInstruction struct { // Operation to execute. Op Opcode Dst, Src Register Offset int16 Immediate uint64 }
A RawInstruction is a raw BPF virtual machine instruction.
func (RawInstruction) Assemble ¶
func (ri RawInstruction) Assemble() (RawInstruction, error)
Assemble implements the Instruction Assemble method.
func (RawInstruction) Disassemble ¶
func (ri RawInstruction) Disassemble() Instruction
Disassemble parses ri into an Instruction and returns it. If ri is not recognized by this package, ri itself is returned.
func (RawInstruction) String ¶
func (ri RawInstruction) String() string
type StoreImmediate ¶
func (StoreImmediate) Assemble ¶
func (a StoreImmediate) Assemble() (RawInstruction, error)
func (StoreImmediate) String ¶
func (a StoreImmediate) String() string
type StoreRegister ¶
func (StoreRegister) Assemble ¶
func (a StoreRegister) Assemble() (RawInstruction, error)
func (StoreRegister) String ¶
func (a StoreRegister) String() string
type Tracer ¶
type Tracer interface { TraceStart() TracePre(instruction Instruction) TracePost(instruction Instruction) TraceEnded() }
Source Files ¶
Directories ¶
Path | Synopsis |
---|---|
cmd
|
|
ebpfasm
Command ebpfasm can assemble and disassemble eBPF programs.
|
Command ebpfasm can assemble and disassemble eBPF programs. |
ebpfrun
Command ebpfrun can evaluate eBPF programs in a (user space) virtual machine.
|
Command ebpfrun can evaluate eBPF programs in a (user space) virtual machine. |
internal
|
|
parser
Package parser contains the eBPF assembly parser and lexer.
|
Package parser contains the eBPF assembly parser and lexer. |