HostTo converts from host to another endianness.

LoadAbs emits `r0 = ntoh(*(size *)(((sk_buff *)R6)->data + offset))`.

LoadAbsOp returns the OpCode for loading a value of given size from an sk_buff.

LoadImm emits `dst = (size)value`.

LoadImmOp returns the OpCode to load an immediate of given size.

LoadInd emits `dst = ntoh(*(size *)(((sk_buff *)R6)->data + src + offset))`.

LoadIndOp returns the OpCode for loading a value of given size from an sk_buff.

LoadMapPtr stores a pointer to a map in dst.

LoadMem emits `dst = *(size *)(src + offset)`.

LoadMemOp returns the OpCode to load a value of given size from memory.

Return emits an exit instruction.

StoreImm emits `*(size *)(dst + offset) = value`.

StoreImmOp returns the OpCode for storing an immediate of given size in memory.

StoreMem emits `*(size *)(dst + offset) = src`.

StoreMemOp returns the OpCode for storing a register of given size in memory.

XAdd atomically adds src to *dst.

XAddOp returns the OpCode to atomically add a register to a value in memory.

AbsMode - immediate value + offset.

Add - addition.

ALU64Class arithmetic in 64 bit mode.

ALUClass arithmetic operators.

And - bitwise and.

ArSh - arithmatic shift.

Convert to big endian.

Byte - byte; 8 bits.

Call builtin or user defined function from imm.

CloneRedirect - int bpf_clone_redirect(skb, ifindex, flags) redirect to another netdev @skb: pointer to skb @ifindex: ifindex of the net device @flags: bit 0 - if set, redirect to ingress instead of egress other bits - reserved Return: 0 on success or negative error.

CsumDiff - s64 bpf_csum_diff(from, from_size, to, to_size, seed) calculate csum diff @from: raw from buffer @from_size: length of from buffer @to: raw to buffer @to_size: length of to buffer @seed: optional seed Return: csum result or negative error code.

CSUMReplaceL3 - l3_csum_replace(skb, offset, from, to, flags) recompute IP checksum @skb: pointer to skb @offset: offset within packet where IP checksum is located @from: old value of header field @to: new value of header field @flags: bits 0-3 - size of header field other bits - reserved Return: 0 on success.

CSUMReplaceL4 - l4_csum_replace(skb, offset, from, to, flags) recompute TCP/UDP checksum @skb: pointer to skb @offset: offset within packet where TCP/UDP checksum is located @from: old value of header field @to: new value of header field @flags: bits 0-3 - size of header field bit 4 - is pseudo header other bits - reserved Return: 0 on success.

CSUMUpdate - s64 bpf_csum_update(skb, csum) Adds csum into skb->csum in case of CHECKSUM_COMPLETE.

CurrentTaskUnderCGroup - int bpf_current_task_under_cgroup(map, index) Check cgroup2 membership of current task @map: pointer to bpf_map in BPF_MAP_TYPE_CGROUP_ARRAY type @index: index of the cgroup in the bpf_map Return: == 0 current failed the cgroup2 descendant test == 1 current succeeded the cgroup2 descendant test < 0 error.

Div - division.

DWord - double word; 64 bits.

Exit ends execution, with value in r0.

GetCGroupClassID - u32 bpf_get_cgroup_classid(skb) retrieve a proc's classid @skb: pointer to skb Return: classid if != 0.

GetCurrentComm - int bpf_get_current_comm(char *buf, int size_of_buf) - stores current->comm into buf Return: 0 on success or negative error.

GetCurrentPIDTGID - u64 bpf_get_current_pid_tgid(void) Return: current->tgid << 32 | current->pid.

GetCurrentTask - u64 bpf_get_current_task(void) Returns current task_struct Return: current.

GetCurrentUIDGID - u64 bpf_get_current_uid_gid(void) Return: current_gid << 32 | current_uid.

GetHashRecalc - u32 bpf_get_hash_recalc(skb) Retrieve and possibly recalculate skb->hash.

GetNUMANodeID - int bpf_get_numa_node_id() Return: Id of current NUMA node.

GetPRandomu32 - u32 prandom_u32(void) Return: random value.

GetRouteRealm - u32 bpf_get_route_realm(skb) retrieve a dst's tclassid @skb: pointer to skb Return: realm if != 0.

GetSMPProcessorID - u32 raw_smp_processor_id(void) Return: SMP processor ID.

GetSocketCookie - u64 bpf_get_socket_cookie(skb) Get the cookie for the socket stored inside sk_buff.

GetSocketUID - u32 bpf_get_socket_uid(skb) Get the owner uid of the socket stored inside sk_buff.

GetStackID - int bpf_get_stackid(ctx, map, flags) walk user or kernel stack and return id @ctx: struct pt_regs* @map: pointer to stack_trace map @flags: bits 0-7 - numer of stack frames to skip bit 8 - collect user stack instead of kernel bit 9 - compare stacks by hash only bit 10 - if two different stacks hash into the same stackid discard old other bits - reserved Return: >= 0 stackid on success or negative error.

Half - half-word; 16 bits.

ImmMode - immediate value.

ImmSource src is from constant.

IndMode - indirect (imm+src).

InstructionSize is the size of a BPF instruction in bytes.

InvalidALUOp is returned by getters when invoked on non ALU OpCodes.

Endian flags.

InvalidJumpOp is returned by getters when invoked on non branch OpCodes.

InvalidMode is returned by getters when invoked on non load / store OpCodes.

InvalidOpCode is returned by setters on OpCode.

InvalidSize is returned by getters when invoked on non load / store OpCodes.

InvalidSource is returned by getters when invoked on non ALU / branch OpCodes.

Ja jumps by offset unconditionally.

JEq jumps by offset if r == imm.

JGE jumps by offset if r >= imm.

JGT jumps by offset if r > imm.

JLE jumps by offset if r <= imm.

JLT jumps by offset if r < imm.

JNE jumps by offset if r != imm.

JSet jumps by offset if r & imm.

JSGE jumps by offset if signed r >= signed imm.

JSGT jumps by offset if signed r > signed imm.

JSLE jumps by offset if signed r <= signed imm.

JSLT jumps by offset if signed r < signed imm.

JumpClass jump operators.

KtimeGetNS - u64 bpf_ktime_get_ns(void) Return: current ktime.

LdClass load memory.

LdXClass load memory from constant.

Convert to little endian.

LSh - bitwise shift left.

MapDeleteElement - int map_delete_elem(&map, &key) Return: 0 on success or negative error.

MapLookupElement - void *map_lookup_elem(&map, &key) Return: Map value or NULL.

MapUpdateElement - int map_update_elem(&map, &key, &value, flags) Return: 0 on success or negative error.

MemMode - load from memory.

Mod - modulo.

Mov - move value from one place to another.

Mul - multiplication.

Neg - sign/unsign signing bit.

Or - bitwise or.

PerfEventOutput - int bpf_perf_event_output(ctx, map, flags, data, size) output perf raw sample @ctx: struct pt_regs* @map: pointer to perf_event_array map @flags: index of event in the map or bitmask flags @data: data on stack to be output as raw data @size: size of data Return: 0 on success or negative error.

PerfEventRead - u64 bpf_perf_event_read(map, flags) read perf event counter value @map: pointer to perf_event_array map @flags: index of event in the map or bitmask flags Return: value of perf event counter read or error code.

ProbeRead - int bpf_probe_read(void *dst, int size, void *src) Return: 0 on success or negative error.

ProbeReadStr - int bpf_probe_read_str(void *dst, int size, const void *unsafe_ptr) Copy a NUL terminated string from unsafe address.

ProbeWriteUser - int bpf_probe_write_user(void *dst, void *src, int len) safely attempt to write to a location @dst: destination address in userspace @src: source address on stack @len: number of bytes to copy Return: 0 on success or negative error.

R0 contains return values.

Registers for function arguments.

Read-only frame pointer to access stack.

Registers for function arguments.

Registers for function arguments.

Registers for function arguments.

Registers for function arguments.

Callee saved registers preserved by function calls.

Callee saved registers preserved by function calls.

Callee saved registers preserved by function calls.

Callee saved registers preserved by function calls.

Redirect - int bpf_redirect(ifindex, flags) redirect to another netdev @ifindex: ifindex of the net device @flags: bit 0 - if set, redirect to ingress instead of egress other bits - reserved Return: TC_ACT_REDIRECT.

RegSource src is from register.

Read-only frame pointer to access stack.

RSh - bitwise shift right.

SetHash - u32 bpf_set_hash(skb, hash) Set full skb->hash.

SetHashInvalid - void bpf_set_hash_invalid(skb) Invalidate current skb->hash.

SetSockOpt - int bpf_setsockopt(bpf_socket, level, optname, optval, optlen) Calls setsockopt.

SKBAdjustRoom - int bpf_skb_adjust_room(skb, len_diff, mode, flags) Grow or shrink room in sk_buff.

SKBChangeHead - int bpf_skb_change_head() Grows headroom of skb and adjusts MAC header offset accordingly.

SKBChangeProto - int bpf_skb_change_proto(skb, proto, flags) Change protocol of the skb.

SKBChangeTail - int bpf_skb_change_tail(skb, len, flags) The helper will resize the skb to the given new size, to be used f.e.

SKBChangeType - int bpf_skb_change_type(skb, type) Change packet type of skb.

SKBGetTunnelKey - int bpf_skb_get_tunnel_key(skb, key, size, flags) retrieve or populate tunnel metadata @skb: pointer to skb @key: pointer to 'struct bpf_tunnel_key' @size: size of 'struct bpf_tunnel_key' @flags: room for future extensions Return: 0 on success or negative error.

SKBGetTunnelOpt - int bpf_skb_get_tunnel_opt(skb, opt, size) retrieve tunnel options metadata @skb: pointer to skb @opt: pointer to raw tunnel option data @size: size of @opt Return: option size.

SKBPullData - int bpf_skb_pull_data(skb, len) The helper will pull in non-linear data in case the skb is non-linear and not all of len are part of the linear section.

SKBSetTunnelKey - int bpf_skb_set_tunnel_key(skb, key, size, flags) retrieve or populate tunnel metadata @skb: pointer to skb @key: pointer to 'struct bpf_tunnel_key' @size: size of 'struct bpf_tunnel_key' @flags: room for future extensions Return: 0 on success or negative error.

SKBSetTunnelOpt - int bpf_skb_set_tunnel_opt(skb, opt, size) populate tunnel options metadata @skb: pointer to skb @opt: pointer to raw tunnel option data @size: size of @opt Return: 0 on success or negative error.

SKBStoreBytes - skb_store_bytes(skb, offset, from, len, flags) store bytes into packet @skb: pointer to skb @offset: offset within packet from skb->mac_header @from: pointer where to copy bytes from @len: number of bytes to store into packet @flags: bit 0 - if true, recompute skb->csum other bits - reserved Return: 0 on success.

SKBUnderCGroup - int bpf_skb_under_cgroup(skb, map, index) Check cgroup2 membership of skb @skb: pointer to skb @map: pointer to bpf_map in BPF_MAP_TYPE_CGROUP_ARRAY type @index: index of the cgroup in the bpf_map Return: == 0 skb failed the cgroup2 descendant test == 1 skb succeeded the cgroup2 descendant test < 0 error.

SKBVlanPop - int bpf_skb_vlan_pop(skb) Return: 0 on success or negative error.

SKBVlanPush - int bpf_skb_vlan_push(skb, vlan_proto, vlan_tci) Return: 0 on success or negative error.

StClass load register from memory.

StXClass load register from constant.

Sub - subtraction.

Swap - endian conversions.

TailCall - int bpf_tail_call(ctx, prog_array_map, index) jump into another BPF program @ctx: context pointer passed to next program @prog_array_map: pointer to map which type is BPF_MAP_TYPE_PROG_ARRAY @index: index inside array that selects specific program to run Return: 0 on success or negative error.

TracePrintk - int bpf_trace_printk(const char *fmt, int fmt_size, ...) Return: length of buffer written or negative error.

Word - word; 32 bits.

XAddMode - add atomically across processors.

XDPAdjustHead - int bpf_xdp_adjust_head(xdp_md, delta) Adjust the xdp_md.data by delta @xdp_md: pointer to xdp_md @delta: An positive/negative integer to be added to xdp_md.data Return: 0 on success or negative on error.

Xor - bitwise xor.

Instruction is a single eBPF instruction.

ALUOp are ALU / ALU64 operations msb lsb +----+-+---+ |OP |s|cls| +----+-+---+.

BuiltinFunc is a built-in eBPF function.

Class of operations msb lsb +---+--+---+ | ?? |CLS| +---+--+---+.

The Endianness of a byte swap instruction.

Instructions is an eBPF program.

JumpOp affect control flow.

Mode for load and store operations msb lsb +---+--+---+ |MDE|sz|cls| +---+--+---+.

OpCode is a packed eBPF opcode.

Register is the source or destination of most operations.

Size of load and store operations msb lsb +---+--+---+ |mde|SZ|cls| +---+--+---+.

Source of ALU / ALU64 / Branch operations msb lsb +----+-+---+ |op |S|cls| +----+-+---+.