Documentation/bpf/classic_vs_extended.rst

6 eBPF is designed to be JITed with one to one mapping, which can also open up
17   the number of args from eBPF program to in-kernel function is restricted
18   to 5 and one register is used to accept return value from an in-kernel
31   necessary across calls. Note that there is only one eBPF program (== one
47   Operation is 64-bit, because on 64-bit architectures, pointers are also
50   ABI, thus, there won't be able to use a direct eBPF register to HW register
52   register in and out of the function, which is complex, bug prone and slow.
53   Another reason is the use of atomic 64-bit counters.
76   is preserved across the call.
103   If f2 is JITed and the pointer stored to ``_f2``. The calls f1 -> f2 -> f3 and
107   For practical reasons all eBPF programs have only one argument 'ctx' which is
153     push %rbp
177   Which is in this example equivalent in C to::
186   registers and place their return value into ``%rax`` which is R0 in eBPF.
191   For example the following program is invalid::
199   An in-kernel verifier.rst is used to validate eBPF programs.
201 Also in the new design, eBPF is limited to 4096 insns, which means that any
206 The input context pointer for invoking the interpreter function is generic,
207 its content is defined by a specific use case. For seccomp register R1 points
210 A program, that is translated internally consists of the following elements::
218 eBPF is a general purpose RISC instruction set. Not every register and
222 is not used by socket filters either, but more complex filters may be running
234 is deterministic and the kernel can easily prove that. The safety of the program
243 eBPF is reusing most of the opcode encoding from classic to simplify conversion
246 For arithmetic and jump instructions the 8-bit 'code' field is divided into three
255 Three LSB bits store instruction class which is one of:
289 If BPF_CLASS(code) == BPF_ALU or BPF_ALU64 [ in eBPF ], BPF_OP(code) is one of::
306 If BPF_CLASS(code) == BPF_JMP or BPF_JMP32 [ in eBPF ], BPF_OP(code) is one of::
329 Classic BPF is using BPF_MISC class to represent A = X and X = A moves.
330 eBPF is using BPF_MOV | BPF_X | BPF_ALU code instead. Since there are no
331 BPF_MISC operations in eBPF, the class 7 is used as BPF_ALU64 to mean
338 and perform function exit. eBPF is modeled to match CPU, so BPF_JMP | BPF_EXIT
340 value into register R0 before doing a BPF_EXIT. Class 6 in eBPF is used as
344 For load and store instructions the 8-bit 'code' field is divided as::
352 Size modifier is one of ...
368 Mode modifier is one of::