package ebpf

Get desktop application:
View/edit binary Protocol Buffers messages

This message should all fit in a single byte.

Used in: Instruction

• AluOperationCode operation_code = 1

  4 bits MSB

• SrcOperand source = 2

  1 bit

• InsClass instruction_class = 3

  3 bits LSB

Used in: AluOpcode

• AluAdd = 0

• AluSub = 16

• AluMul = 32

• AluDiv = 48

• AluOr = 64

• AluAnd = 80

• AluLsh = 96

• AluRsh = 112

• AluNeg = 128

• AluMod = 144

• AluXor = 160

• AluMov = 176

• AluArsh = 192

• AluEnd = 208

Used in: Instruction

(message has no fields)

Used in: Program

• repeated Instruction instructions = 1

• optional btf.FuncInfo func_info = 2

Used in: AluOpcode, JmpOpcode, MemOpcode

• InsClassLd = 0

• InsClassLdx = 1

• InsClassSt = 2

• InsClassStx = 3

• InsClassAlu = 4

• InsClassJmp = 5

• InsClassJmp32 = 6

• InsClassAlu64 = 7

Used in: Functions

• oneof opcode

  • AluOpcode alu_opcode = 1

  • JmpOpcode jmp_opcode = 2

  • MemOpcode mem_opcode = 3

• Reg dst_reg = 4

• Reg src_reg = 5

• int32 offset = 6

  The real data type of this is int16, protobuf doesn't have support for it.

• int32 immediate = 7

  int32 is the right value for the immediate.

• oneof pseudo_instruction

  Some instructions have a "Pseudo instruction" after them. This is to represent additional data.

  • Instruction PseudoValue = 8

  • Empty empty = 9

Used in: Instruction

• JmpOperationCode operation_code = 1

  4 bits MSB

• SrcOperand source = 2

  1 bit

• InsClass instruction_class = 3

  3 bits LSB

Used in: JmpOpcode

• JmpJA = 0

• JmpJEQ = 16

• JmpJGT = 32

• JmpJGE = 48

• JmpJSET = 64

• JmpJNE = 80

• JmpJSGT = 96

• JmpJSGE = 112

• JmpCALL = 128

• JmpExit = 144

• JmpJLT = 160

• JmpJLE = 176

• JmpJSLT = 192

• JmpJSLE = 208

Used in: Instruction

• StLdMode mode = 1

  3 bits MSB

• StLdSize size = 2

  2 bits

• InsClass instruction_class = 3

  3 bits LSB

Used in: program.Program

• bytes btf = 1

• repeated Functions functions = 2

Reg each value corresponds to an ebpf register.

Used in: Instruction

• R0 = 0

• R1 = 1

• R2 = 2

• R3 = 3

• R4 = 4

• R5 = 5

• R6 = 6

• R7 = 7

• R8 = 8

• R9 = 9

• R10 = 10

Used in: AluOpcode, JmpOpcode

• Immediate = 0

• RegSrc = 8

Used in: MemOpcode

• StLdModeIMM = 0

• StLdModeABS = 32

• StLdModeIND = 64

• StLdModeMEM = 96

• StLdModeATOMIC = 192

Used in: MemOpcode

• StLdSizeW = 0

• StLdSizeH = 8

• StLdSizeB = 16

• StLdSizeDW = 24