package ebpf

Get desktop application:
View/edit binary Protocol Buffers messages

This message should all fit in a single byte.

Used in: Instruction

• AluOperationCode operation_code = 1

  4 bits MSB

• SrcOperand source = 2

  1 bit

• InsClass instruction_class = 3

  3 bits LSB

Used in: AluOpcode

• AluAdd = 0

• AluSub = 16

• AluMul = 32

• AluDiv = 48

• AluOr = 64

• AluAnd = 80

• AluLsh = 96

• AluRsh = 112

• AluNeg = 128

• AluMod = 144

• AluXor = 160

• AluMov = 176

• AluArsh = 192

• AluEnd = 208

Used in: EbpfMap

• UNSPEC = 0

• HASH = 1

• ARRAY = 2

• PROG_ARRAY = 3

• PERF_EVENT_ARRAY = 4

• PERCPU_HASH = 5

• PERCPU_ARRAY = 6

• STACK_TRACE = 7

• CGROUP_ARRAY = 8

• LRU_HASH = 9

• LRU_PERCPU_HASH = 10

• LPM_TRIE = 11

• ARRAY_OF_MAPS = 12

• HASH_OF_MAPS = 13

• DEVMAP = 14

• SOCKMAP = 15

• CPUMAP = 16

• XSKMAP = 17

• SOCKHASH = 18

• CGROUP_STORAGE_DEPRECATED = 19

• CGROUP_STORAGE = 20

• REUSEPORT_SOCKARRAY = 21

• PERCPU_CGROUP_STORAGE_DEPRECATED = 22

• PERCPU_CGROUP_STORAGE = 23

• QUEUE = 24

• STACK = 25

• SK_STORAGE = 26

• DEVMAP_HASH = 27

• STRUCT_OPS = 28

• RINGBUF = 29

• INODE_STORAGE = 30

• TASK_STORAGE = 31

• BLOOM_FILTER = 32

• USER_RINGBUF = 33

• CGRP_STORAGE = 34

• ARENA = 35

Used in: Program, ebpf_fuzzer.EncodedProgram

• BpfMapType type = 1

• uint32 key_size = 2

• uint32 value_size = 3

• uint32 max_entries = 4

• repeated uint64 values = 5

Used in: Instruction

(message has no fields)

Used in: Program

• repeated Instruction instructions = 1

• optional btf.FuncInfo func_info = 2

Used in: AluOpcode, JmpOpcode, MemOpcode

• InsClassLd = 0

• InsClassLdx = 1

• InsClassSt = 2

• InsClassStx = 3

• InsClassAlu = 4

• InsClassJmp = 5

• InsClassJmp32 = 6

• InsClassAlu64 = 7

Used in: Functions

• oneof opcode

  • AluOpcode alu_opcode = 1

  • JmpOpcode jmp_opcode = 2

  • MemOpcode mem_opcode = 3

• Reg dst_reg = 4

• Reg src_reg = 5

• int32 offset = 6

  The real data type of this is int16, protobuf doesn't have support for it.

• int32 immediate = 7

  int32 is the right value for the immediate.

• oneof pseudo_instruction

  Some instructions have a "Pseudo instruction" after them. This is to represent additional data.

  • Instruction PseudoValue = 8

  • Empty empty = 9

Used in: Instruction

• JmpOperationCode operation_code = 1

  4 bits MSB

• SrcOperand source = 2

  1 bit

• InsClass instruction_class = 3

  3 bits LSB

Used in: JmpOpcode

• JmpJA = 0

• JmpJEQ = 16

• JmpJGT = 32

• JmpJGE = 48

• JmpJSET = 64

• JmpJNE = 80

• JmpJSGT = 96

• JmpJSGE = 112

• JmpCALL = 128

• JmpExit = 144

• JmpJLT = 160

• JmpJLE = 176

• JmpJSLT = 192

• JmpJSLE = 208

Used in: Instruction

• StLdMode mode = 1

  3 bits MSB

• StLdSize size = 2

  2 bits

• InsClass instruction_class = 3

  3 bits LSB

Used in: program.Program

• bytes btf = 1

• repeated Functions functions = 2

• repeated EbpfMap maps = 3

Reg each value corresponds to an ebpf register.

Used in: Instruction

• R0 = 0

• R1 = 1

• R2 = 2

• R3 = 3

• R4 = 4

• R5 = 5

• R6 = 6

• R7 = 7

• R8 = 8

• R9 = 9

• R10 = 10

Used in: AluOpcode, JmpOpcode

• Immediate = 0

• RegSrc = 8

Used in: MemOpcode

• StLdModeIMM = 0

• StLdModeABS = 32

• StLdModeIND = 64

• StLdModeMEM = 96

• StLdModeATOMIC = 192

Used in: MemOpcode

• StLdSizeW = 0

• StLdSizeH = 8

• StLdSizeB = 16

• StLdSizeDW = 24