Compile performs validation and optimization on a sequence of BPF instructions before wrapping them in a Program.

Decode translates a single BPF instruction into text format.

DecodeInstructions translates an array of BPF instructions into text format.

DecodeProgram translates a compiled BPF program into text format.

Exec executes a BPF program over the given input and returns its return value.

Jump returns an Instruction representing a BPF jump instruction.

NewProgramBuilder creates a new ProgramBuilder instance.

Optimize losslessly optimizes a BPF program.

Stmt returns an Instruction representing a BPF non-jump instruction.

mode 9.

data in input at byte offset K (mode 1).

Arithmetic instructions, stored in bits 4-7.

arithmetic.

Parts of a linux.BPFInstruction.OpCode.

8 bits.

A / src.

DivisionByZero indicates that a program contains, or executed, a division or modulo by zero.

16 bits.

immediate value K (mode 4).

data in input at byte offset X+K (mode 2).

InvalidEndOfProgram indicates that the last instruction of a program is not a return.

InvalidInstructionCount indicates that a program has zero instructions or more than MaxInstructions instructions.

InvalidJumpTarget indicates that a program contains a jump whose target is outside of the program's bounds.

InvalidLoad indicates that a program executed an invalid load of input data.

InvalidOpcode indicates that a program contains an instruction with an invalid opcode.

InvalidRegister indicates that a program contains a load from, or store to, a non-existent M register (index >= ScratchMemRegisters).

unconditional (uses K for jump offset).

if A == src.

if A >= src.

if A > src.

jump.

if (A & src) != 0.

Types of jump that an instruction may use.

Types of jump that an instruction may use.

Types of jump that an instruction may use.

still mode 4.

load into A.

load into X.

length of the input in bytes ("BPF extension len").

A << src.

MaxInstructions is the maximum number of instructions in a BPF program, and is equal to Linux's BPF_MAXINSNS.

M[K] (mode 3).

Parts of a linux.BPFInstruction.OpCode.

A % src.

4 * lower nibble of input at byte offset K (mode 5).

Parts of a linux.BPFInstruction.OpCode.

-A (src ignored).

Parts of a linux.BPFInstruction.OpCode.

return.

A >> src.

ScratchMemRegisters is the number of M registers in a BPF virtual machine, and is equal to Linux's BPF_MEMWORDS.

store from A.

store from X.

A - src.

A = X.

X = A.

32 bits.

mode 0.

Parts of a linux.BPFInstruction.OpCode.

Error is an error encountered while compiling or executing a BPF program.

FragmentOutcomes represents the set of outcomes that a ProgramFragment execution may result into.

InputBytes implements the Input interface by providing access to a byte slice.

JumpOffset is a possible jump offset that an instruction may jump to.

Program is a BPF program that has been validated for consistency.

ProgramBuilder assists with building a BPF program with jump labels that are resolved to their proper offsets.

ProgramFragment is a set of not-compiled instructions that were added to a ProgramBuilder from the moment the `Record` function was called on it.

Input represents a source of input data for a BPF program.

Instruction is a type alias for linux.BPFInstruction.

JumpType is the type of jump target that an instruction may use.