Skip to content

Instantly share code, notes, and snippets.

@bjackman
Last active June 1, 2021 20:15
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save bjackman/00fdad2d5dfff601c1918bc29b16e778 to your computer and use it in GitHub Desktop.
Save bjackman/00fdad2d5dfff601c1918bc29b16e778 to your computer and use it in GitHub Desktop.
A visualisation of eBPF opcodes

This table visualises the space of eBPF opcodes. It was generated by this hack

The *s represent opcodes that are exposed but not actually used, or used internally but not exposed

Note that there are gaps, but no empty columns.

There's also a prettier version here

|  0x00           |  0x01           |  0x02           |  0x03           |  0x04           |  0x05           |  0x06           |  0x07           |
------------------------------------------------------------------------------------------------------------------------------------------------------
|                 |                 |                 |                 | ALU_ADD_K       | JMP_JA          |                 | ALU64_ADD_K     | 0x00
|                 |                 |                 |                 | ALU_ADD_X       |                 |                 | ALU64_ADD_X     | 0x08
|                 |                 |                 |                 | ALU_SUB_K       | JMP_JEQ_K       | JMP32_JEQ_K     | ALU64_SUB_K     | 0x10
| LD_IMM_DW       |                 |                 |                 | ALU_SUB_X       | JMP_JEQ_X       | JMP32_JEQ_X     | ALU64_SUB_X     | 0x18
| LD_ABS_W*       | LDX_PROBE_MEM_W*|                 |                 | ALU_MUL_K       | JMP_JGT_K       | JMP32_JGT_K     | ALU64_MUL_K     | 0x20
| LD_ABS_H*       | LDX_PROBE_MEM_H*|                 |                 | ALU_MUL_X       | JMP_JGT_X       | JMP32_JGT_X     | ALU64_MUL_X     | 0x28
| LD_ABS_B*       | LDX_PROBE_MEM_B*|                 |                 | ALU_DIV_K       | JMP_JGE_K       | JMP32_JGE_K     | ALU64_DIV_K     | 0x30
|                 | LDX_PROBE_MEM_DW|                 |                 | ALU_DIV_X       | JMP_JGE_X       | JMP32_JGE_X     | ALU64_DIV_X     | 0x38
| LD_IND_W*       |                 |                 |                 | ALU_OR_K        | JMP_JSET_K      | JMP32_JSET_K    | ALU64_OR_K      | 0x40
| LD_IND_H*       |                 |                 |                 | ALU_OR_X        | JMP_JSET_X      | JMP32_JSET_X    | ALU64_OR_X      | 0x48
| LD_IND_B*       |                 |                 |                 | ALU_AND_K       | JMP_JNE_K       | JMP32_JNE_K     | ALU64_AND_K     | 0x50
|                 |                 |                 |                 | ALU_AND_X       | JMP_JNE_X       | JMP32_JNE_X     | ALU64_AND_X     | 0x58
|                 | LDX_MEM_W       | ST_MEM_W        | STX_MEM_W       | ALU_LSH_K       | JMP_JSGT_K      | JMP32_JSGT_K    | ALU64_LSH_K     | 0x60
|                 | LDX_MEM_H       | ST_MEM_H        | STX_MEM_H       | ALU_LSH_X       | JMP_JSGT_X      | JMP32_JSGT_X    | ALU64_LSH_X     | 0x68
|                 | LDX_MEM_B       | ST_MEM_B        | STX_MEM_B       | ALU_RSH_K       | JMP_JSGE_K      | JMP32_JSGE_K    | ALU64_RSH_K     | 0x70
|                 | LDX_MEM_DW      | ST_MEM_DW       | STX_MEM_DW      | ALU_RSH_X       | JMP_JSGE_X      | JMP32_JSGE_X    | ALU64_RSH_X     | 0x78
|                 |                 |                 |                 | ALU_NEG         | JMP_CALL        |                 | ALU64_NEG       | 0x80
|                 |                 |                 |                 |                 |                 |                 |                 | 0x88
|                 |                 |                 |                 | ALU_MOD_K       | JMP_EXIT        |                 | ALU64_MOD_K     | 0x90
|                 |                 |                 |                 | ALU_MOD_X       |                 |                 | ALU64_MOD_X     | 0x98
|                 |                 |                 |                 | ALU_XOR_K       | JMP_JLT_K       | JMP32_JLT_K     | ALU64_XOR_K     | 0xa0
|                 |                 |                 |                 | ALU_XOR_X       | JMP_JLT_X       | JMP32_JLT_X     | ALU64_XOR_X     | 0xa8
|                 |                 |                 |                 | ALU_MOV_K       | JMP_JLE_K       | JMP32_JLE_K     | ALU64_MOV_K     | 0xb0
|                 |                 |                 |                 | ALU_MOV_X       | JMP_JLE_X       | JMP32_JLE_X     | ALU64_MOV_X     | 0xb8
|                 |                 |                 | STX_XADD_W      | ALU_ARSH_K      | JMP_JSLT_K      | JMP32_JSLT_K    | ALU64_ARSH_K    | 0xc0
|                 |                 |                 |                 | ALU_ARSH_X      | JMP_JSLT_X      | JMP32_JSLT_X    | ALU64_ARSH_X    | 0xc8
|                 |                 |                 |                 | ALU_END_TO_LE   | JMP_JSLE_K      | JMP32_JSLE_K    |                 | 0xd0
|                 |                 |                 | STX_XADD_DW     | ALU_END_TO_BE   | JMP_JSLE_X      | JMP32_JSLE_X    |                 | 0xd8
|                 |                 |                 |                 |                 | JMP_CALL_ARGS*  |                 |                 | 0xe0
|                 |                 |                 |                 |                 |                 |                 |                 | 0xe8
|                 |                 |                 |                 |                 | JMP_TAIL_CALL*  |                 |                 | 0xf0
|                 |                 |                 |                 |                 |                 |                 |                 | 0xf8
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment