Assemble converts insts into raw instructions suitable for loading into a BPF virtual machine.

Disassemble attempts to parse raw back into Instructions.

NewVM returns a new VM using the input BPF program.

ALU binary operation types.

ALU binary operation types.

ALU binary operation types.

ALU binary operation types.

ALU binary operation types.

ALU binary operation types.

ALU binary operation types.

ALU binary operation types.

ALU binary operation types.

ALU binary operation types.

ExtCPUID returns the ID of the CPU processing the current packet.

ExtInterfaceIndex returns the index of the interface on which the packet was received.

ExtLen returns the length of the packet.

ExtLinkLayerType returns the packet's hardware address type (e.g.

ExtMark returns the packet's mark value.

ExtNetlinkAttr returns the netlink attribute of type X at offset A.

ExtNetlinkAttrNested returns the nested netlink attribute of type X at offset A.

ExtPayloadOffset returns the offset of the packet payload, or the first protocol header that the kernel does not know how to parse.

ExtProto returns the packet's L3 protocol type.

ExtQueue returns the packet's assigned hardware queue.

ExtRand returns a uniformly random uint32.

ExtRXHash returns the packets receive hash.

ExtType returns the packet's type (skb->pkt_type in the kernel) TODO: better documentation.

ExtVLANProto returns 0x8100 if the frame has a VLAN header, 0x88a8 if the frame has a "Q-in-Q" double VLAN header, or some other value if no VLAN information is present.

ExtVLANTag returns the packet's VLAN tag.

ExtVLANTagPresent returns non-zero if the packet has a VLAN tag.

K & A == 0.

K & A != 0.

K == A.

K >= A.

K > A.

K <= A.

K < A.

K != A.

RegA is the accumulator register.

RegX is the indirection register, used by LoadIndirect operations.

ALUOpConstant executes A = A <Op> Val.

ALUOpX executes A = A <Op> X.

Jump skips the following Skip instructions in the program.

JumpIf skips the following Skip instructions in the program if A <Cond> Val is true.

LoadAbsolute loads packet[Off:Off+Size] as an integer value into register A.

LoadConstant loads Val into register Dst.

LoadExtension invokes a linux-specific extension and stores the result in register A.

LoadIndirect loads packet[X+Off:X+Off+Size] as an integer value into register A.

LoadMemShift multiplies the first 4 bits of the byte at packet[Off] by 4 and stores the result in register X.

LoadScratch loads scratch[N] into register Dst.

NegateA executes A = -A.

A RawInstruction is a raw BPF virtual machine instruction.

RetA exits the BPF program, returning the value of register A.

RetConstant exits the BPF program, returning a constant value.

StoreScratch stores register Src into scratch[N].

TAX copies the value of register A to register X.

TXA copies the value of register X to register A.

A VM is an emulated BPF virtual machine.

An Instruction is one instruction executed by the BPF virtual machine.

A Setter is a type which can attach a compiled BPF filter to itself.

An ALUOp is an arithmetic or logic operation.

An Extension is a function call provided by the kernel that performs advanced operations that are expensive or impossible within the BPF virtual machine.

A JumpTest is a comparison operator used in conditional jumps.

A Register is a register of the BPF virtual machine.