1 @c Copyright (C) 2019-2025 Free Software Foundation, Inc.
2 @c This is part of the GAS manual.
3 @c For copying conditions, see the file as.texinfo.
8 @chapter BPF Dependent Features
12 @node Machine Dependencies
13 @chapter BPF Dependent Features
18 * BPF Options:: BPF specific command-line options.
19 * BPF Special Characters:: Comments and statements.
20 * BPF Registers:: Register names.
21 * BPF Directives:: Machine directives.
22 * BPF Instructions:: Machine instructions.
27 @cindex BPF options (none)
28 @cindex options for BPF (none)
33 @cindex @option{-EB} command-line option, BPF
35 This option specifies that the assembler should emit big-endian eBPF.
37 @cindex @option{-EL} command-line option, BPF
39 This option specifies that the assembler should emit little-endian
42 @cindex @option{-mdialect} command-line options, BPF
43 @item -mdialect=@var{dialect}
44 This option specifies the assembly language dialect to recognize while
45 assembling. The assembler supports @option{normal} and
48 @cindex @option{-misa-spec} command-line options, BPF
49 @item -misa-spec=@var{spec}
50 This option specifies the version of the BPF instruction set to use
51 when assembling. The BPF ISA versions supported are @option{v1} @option{v2}, @option{v3} and @option{v4}.
53 The value @option{xbpf} can be specified to recognize extra
54 instructions that are used by GCC for testing purposes. But beware
55 this is not valid BPF.
57 @cindex @option{-mno-relax} command-line options, BPF
59 This option tells the assembler to not relax instructions.
62 Note that if no endianness option is specified in the command line,
63 the host endianness is used.
66 @node BPF Special Characters
67 @section BPF Special Characters
69 @cindex line comment character, BPF
70 @cindex BPF line comment character
71 The presence of a @samp{#} or @samp{//} anywhere on a line indicates
72 the start of a comment that extends to the end of the line.
74 @cindex block comments, BPF
75 @cindex BPF block comments
76 The presence of the @samp{/*} sequence indicates the beginning of a
77 block (multi-line) comment, whose contents span until the next
78 @samp{*/} sequence. It is not possible to nest block comments.
80 @cindex statement separator, BPF
81 Statements and assembly directives are separated by newlines and
85 @section BPF Registers
87 @cindex BPF register names
88 @cindex register names, BPF
89 The eBPF processor provides ten general-purpose 64-bit registers,
90 which are read-write, and a read-only frame pointer register:
97 General-purpose registers.
100 Read-only frame pointer register.
103 All BPF registers are 64-bit long. However, in the Pseudo-C syntax
104 registers can be referred using different names, which actually
105 reflect the kind of instruction they appear on:
112 General-purpose register in an instruction that operates on its value
113 as if it was a 64-bit value.
115 General-purpose register in an instruction that operates on its value
116 as if it was a 32-bit value.
118 Read-only frame pointer register.
122 Note that in the Pseudo-C syntax register names are not preceded by
123 @code{%} characters. A consequence of that is that in contexts like
124 instruction operands, where both register names and expressions
125 involving symbols are expected, there is no way to disambiguate
126 between them. In order to keep things simple, this assembler does not
127 allow to refer to symbols whose names collide with register names in
128 instruction operands.
131 @section BPF Directives
133 @cindex machine directives, BPF
135 The BPF version of @code{@value{AS}} supports the following additional
139 @cindex @code{half} directive, BPF
141 The @code{.half} directive produces a 16 bit value.
143 @cindex @code{word} directive, BPF
145 The @code{.word} directive produces a 32 bit value.
147 @cindex @code{dword} directive, BPF
149 The @code{.dword} directive produces a 64 bit value.
152 @node BPF Instructions
153 @section BPF Instructions
156 @cindex opcodes for BPF
157 In the instruction descriptions below the following field descriptors
162 Destination general-purpose register whose role is to be the
163 destination of an operation.
165 Source general-purpose register whose role is to be the source of an
168 16-bit signed PC-relative offset, measured in number of 64-bit words,
171 32-bit signed PC-relative offset, measured in number of 64-bit words,
174 Signed 16-bit immediate representing an offset in bytes.
176 Signed 16-bit immediate representing a displacement to a target,
177 measured in number of 64-bit words @emph{minus one}.
179 Signed 32-bit immediate representing a displacement to a target,
180 measured in number of 64-bit words @emph{minus one}.
182 Signed 32-bit immediate.
184 Signed 64-bit immediate.
188 Note that the assembler allows to express the value for an immediate
189 using any numerical literal whose two's complement encoding fits in
190 the immediate field. For example, @code{-2}, @code{0xfffffffe} and
191 @code{4294967294} all denote the same encoded 32-bit immediate, whose
192 value may be then interpreted by different instructions as either as a
193 negative or a positive number.
195 @subsection Arithmetic instructions
197 The destination register in these instructions act like an
200 Note that in pseudoc syntax these instructions should use @code{r}
208 64-bit arithmetic addition.
214 64-bit arithmetic subtraction.
220 64-bit arithmetic multiplication.
226 64-bit arithmetic integer division.
232 64-bit integer remainder.
238 64-bit bit-wise ``and'' operation.
244 64-bit bit-wise ``or'' operation.
250 64-bit bit-wise exclusive-or operation.
256 64-bit left shift, by @code{rs} or @code{imm32} bits.
262 64-bit right logical shift, by @code{rs} or @code{imm32} bits.
265 @itemx arsh rd, imm32
268 64-bit right arithmetic shift, by @code{rs} or @code{imm32} bits.
272 64-bit arithmetic negation.
278 Move the 64-bit value of @code{rs} in @code{rd}, or load @code{imm32}
283 Move the sign-extended 8-bit value in @code{rs} to @code{rd}.
285 @item movs rd, rs, 16
287 Move the sign-extended 16-bit value in @code{rs} to @code{rd}.
289 @item movs rd, rs, 32
291 Move the sign-extended 32-bit value in @code{rs} to @code{rd}.
294 @subsection 32-bit arithmetic instructions
296 The destination register in these instructions act as an accumulator.
298 Note that in pseudoc syntax these instructions should use @code{w}
299 registers. It is not allowed to mix @code{w} and @code{r} registers
300 in the same instruction.
304 @itemx add32 rd, imm32
307 32-bit arithmetic addition.
310 @itemx sub32 rd, imm32
313 32-bit arithmetic subtraction.
316 @itemx mul32 rd, imm32
319 32-bit arithmetic multiplication.
322 @itemx div32 rd, imm32
325 32-bit arithmetic integer division.
328 @itemx mod32 rd, imm32
331 32-bit integer remainder.
334 @itemx and32 rd, imm32
337 32-bit bit-wise ``and'' operation.
340 @itemx or32 rd, imm32
343 32-bit bit-wise ``or'' operation.
346 @itemx xor32 rd, imm32
349 32-bit bit-wise exclusive-or operation.
352 @itemx lsh32 rd, imm32
355 32-bit left shift, by @code{rs} or @code{imm32} bits.
358 @itemx rsh32 rd, imm32
361 32-bit right logical shift, by @code{rs} or @code{imm32} bits.
364 @itemx arsh32 rd, imm32
367 32-bit right arithmetic shift, by @code{rs} or @code{imm32} bits.
371 32-bit arithmetic negation.
374 @itemx mov32 rd, imm32
377 Move the 32-bit value of @code{rs} in @code{rd}, or load @code{imm32}
380 @item mov32s rd, rs, 8
382 Move the sign-extended 8-bit value in @code{rs} to @code{rd}.
384 @item mov32s rd, rs, 16
386 Move the sign-extended 16-bit value in @code{rs} to @code{rd}.
388 @item mov32s rd, rs, 32
390 Move the sign-extended 32-bit value in @code{rs} to @code{rd}.
393 @subsection Endianness conversion instructions
402 Convert the 16-bit, 32-bit or 64-bit value in @code{rd} to
403 little-endian and store it back in @code{rd}.
410 Convert the 16-bit, 32-bit or 64-bit value in @code{rd} to big-endian
411 and store it back in @code{rd}.
414 @subsection Byte swap instructions
418 @itemx rd = bswap16 rd
419 Swap the least-significant 16-bit word in @code{rd} with the
420 most-significant 16-bit word.
423 @itemx rd = bswap32 rd
424 Swap the least-significant 32-bit word in @code{rd} with the
425 most-significant 32-bit word.
428 @itemx rd = bswap64 rd
429 Swap the least-significant 64-bit word in @code{rd} with the
430 most-significant 64-bit word.
434 @subsection 64-bit load and pseudo maps
439 Load the given signed 64-bit immediate to the destination register
443 @subsection Load instructions for socket filters
445 The following instructions are intended to be used in socket filters,
446 and are therefore not general-purpose: they make assumptions on the
447 contents of several registers. See the file
448 @file{Documentation/networking/filter.txt} in the Linux kernel source
449 tree for more information.
455 @itemx r0 = *(u32 *) skb[imm32]
456 Absolute 32-bit load.
459 @itemx r0 = *(u16 *) skb[imm32]
460 Absolute 16-bit load.
463 @itemx r0 = *(u8 *) skb[imm32]
470 @item ldindw rs, imm32
471 @itemx r0 = *(u32 *) skb[rs + imm32]
472 Indirect 32-bit load.
474 @item ldindh rs, imm32
475 @itemx r0 = *(u16 *) skb[rs + imm32]
476 Indirect 16-bit load.
478 @item ldindb %s, imm32
479 @itemx r0 = *(u8 *) skb[rs + imm32]
483 @subsection Generic load/store instructions
485 General-purpose load and store instructions are provided for several
488 Load to register instructions:
491 @item ldxdw rd, [rs + offset16]
492 @itemx rd = *(u64 *) (rs + offset16)
495 @item ldxw rd, [rs + offset16]
496 @itemx rd = *(u32 *) (rs + offset16)
499 @item ldxh rd, [rs + offset16]
500 @itemx rd = *(u16 *) (rs + offset16)
503 @item ldxb rd, [rs + offset16]
504 @itemx rd = *(u8 *) (rs + offset16)
508 Signed load to register instructions:
511 @item ldxsdw rd, [rs + offset16]
512 @itemx rd = *(s64 *) (rs + offset16)
513 Generic 64-bit signed load.
515 @item ldxsw rd, [rs + offset16]
516 @itemx rd = *(s32 *) (rs + offset16)
517 Generic 32-bit signed load.
519 @item ldxsh rd, [rs + offset16]
520 @itemx rd = *(s16 *) (rs + offset16)
521 Generic 16-bit signed load.
523 @item ldxsb rd, [rs + offset16]
524 @itemx rd = *(s8 *) (rs + offset16)
525 Generic 8-bit signed load.
528 Store from register instructions:
531 @item stxdw [rd + offset16], %s
532 @itemx *(u64 *) (rd + offset16)
533 Generic 64-bit store.
535 @item stxw [rd + offset16], %s
536 @itemx *(u32 *) (rd + offset16)
537 Generic 32-bit store.
539 @item stxh [rd + offset16], %s
540 @itemx *(u16 *) (rd + offset16)
541 Generic 16-bit store.
543 @item stxb [rd + offset16], %s
544 @itemx *(u8 *) (rd + offset16)
548 Store from immediates instructions:
551 @item stdw [rd + offset16], imm32
552 @itemx *(u64 *) (rd + offset16) = imm32
553 Store immediate as 64-bit.
555 @item stw [rd + offset16], imm32
556 @itemx *(u32 *) (rd + offset16) = imm32
557 Store immediate as 32-bit.
559 @item sth [rd + offset16], imm32
560 @itemx *(u16 *) (rd + offset16) = imm32
561 Store immediate as 16-bit.
563 @item stb [rd + offset16], imm32
564 @itemx *(u8 *) (rd + offset16) = imm32
565 Store immediate as 8-bit.
568 @subsection Jump instructions
570 eBPF provides the following compare-and-jump instructions, which
571 compare the values of the two given registers, or the values of a
572 register and an immediate, and perform a branch in case the comparison
582 Jump-always, long range.
584 @item jeq rd, rs, disp16
585 @itemx jeq rd, imm32, disp16
586 @itemx if rd == rs goto disp16
587 @itemx if rd == imm32 goto disp16
588 Jump if equal, unsigned.
590 @item jgt rd, rs, disp16
591 @itemx jgt rd, imm32, disp16
592 @itemx if rd > rs goto disp16
593 @itemx if rd > imm32 goto disp16
594 Jump if greater, unsigned.
596 @item jge rd, rs, disp16
597 @itemx jge rd, imm32, disp16
598 @itemx if rd >= rs goto disp16
599 @itemx if rd >= imm32 goto disp16
600 Jump if greater or equal.
602 @item jlt rd, rs, disp16
603 @itemx jlt rd, imm32, disp16
604 @itemx if rd < rs goto disp16
605 @itemx if rd < imm32 goto disp16
608 @item jle rd , rs, disp16
609 @itemx jle rd, imm32, disp16
610 @itemx if rd <= rs goto disp16
611 @itemx if rd <= imm32 goto disp16
612 Jump if lesser or equal.
614 @item jset rd, rs, disp16
615 @itemx jset rd, imm32, disp16
616 @itemx if rd & rs goto disp16
617 @itemx if rd & imm32 goto disp16
618 Jump if signed equal.
620 @item jne rd, rs, disp16
621 @itemx jne rd, imm32, disp16
622 @itemx if rd != rs goto disp16
623 @itemx if rd != imm32 goto disp16
626 @item jsgt rd, rs, disp16
627 @itemx jsgt rd, imm32, disp16
628 @itemx if rd s> rs goto disp16
629 @itemx if rd s> imm32 goto disp16
630 Jump if signed greater.
632 @item jsge rd, rs, disp16
633 @itemx jsge rd, imm32, disp16
634 @itemx if rd s>= rd goto disp16
635 @itemx if rd s>= imm32 goto disp16
636 Jump if signed greater or equal.
638 @item jslt rd, rs, disp16
639 @itemx jslt rd, imm32, disp16
640 @itemx if rd s< rs goto disp16
641 @itemx if rd s< imm32 goto disp16
642 Jump if signed lesser.
644 @item jsle rd, rs, disp16
645 @itemx jsle rd, imm32, disp16
646 @itemx if rd s<= rs goto disp16
647 @itemx if rd s<= imm32 goto disp16
648 Jump if signed lesser or equal.
651 A call instruction is provided in order to perform calls to other eBPF
652 functions, or to external kernel helpers:
657 Jump and link to the offset @emph{disp32}, or to the kernel helper
658 function identified by @emph{imm32}.
665 Terminate the eBPF program.
668 @subsection 32-bit jump instructions
670 eBPF provides the following compare-and-jump instructions, which
671 compare the 32-bit values of the two given registers, or the values of
672 a register and an immediate, and perform a branch in case the
673 comparison holds true.
675 These instructions are only available in BPF v3 or later.
678 @item jeq32 rd, rs, disp16
679 @itemx jeq32 rd, imm32, disp16
680 @itemx if rd == rs goto disp16
681 @itemx if rd == imm32 goto disp16
682 Jump if equal, unsigned.
684 @item jgt32 rd, rs, disp16
685 @itemx jgt32 rd, imm32, disp16
686 @itemx if rd > rs goto disp16
687 @itemx if rd > imm32 goto disp16
688 Jump if greater, unsigned.
690 @item jge32 rd, rs, disp16
691 @itemx jge32 rd, imm32, disp16
692 @itemx if rd >= rs goto disp16
693 @itemx if rd >= imm32 goto disp16
694 Jump if greater or equal.
696 @item jlt32 rd, rs, disp16
697 @itemx jlt32 rd, imm32, disp16
698 @itemx if rd < rs goto disp16
699 @itemx if rd < imm32 goto disp16
702 @item jle32 rd , rs, disp16
703 @itemx jle32 rd, imm32, disp16
704 @itemx if rd <= rs goto disp16
705 @itemx if rd <= imm32 goto disp16
706 Jump if lesser or equal.
708 @item jset32 rd, rs, disp16
709 @itemx jset32 rd, imm32, disp16
710 @itemx if rd & rs goto disp16
711 @itemx if rd & imm32 goto disp16
712 Jump if signed equal.
714 @item jne32 rd, rs, disp16
715 @itemx jne32 rd, imm32, disp16
716 @itemx if rd != rs goto disp16
717 @itemx if rd != imm32 goto disp16
720 @item jsgt32 rd, rs, disp16
721 @itemx jsgt32 rd, imm32, disp16
722 @itemx if rd s> rs goto disp16
723 @itemx if rd s> imm32 goto disp16
724 Jump if signed greater.
726 @item jsge32 rd, rs, disp16
727 @itemx jsge32 rd, imm32, disp16
728 @itemx if rd s>= rd goto disp16
729 @itemx if rd s>= imm32 goto disp16
730 Jump if signed greater or equal.
732 @item jslt32 rd, rs, disp16
733 @itemx jslt32 rd, imm32, disp16
734 @itemx if rd s< rs goto disp16
735 @itemx if rd s< imm32 goto disp16
736 Jump if signed lesser.
738 @item jsle32 rd, rs, disp16
739 @itemx jsle32 rd, imm32, disp16
740 @itemx if rd s<= rs goto disp16
741 @itemx if rd s<= imm32 goto disp16
742 Jump if signed lesser or equal.
745 @subsection Atomic instructions
747 Atomic exchange instructions are provided in two flavors: one for
748 compare-and-swap, one for unconditional exchange.
751 @item acmp [rd + offset16], rs
752 @itemx r0 = cmpxchg_64 (rd + offset16, r0, rs)
753 Atomic compare-and-swap. Compares value in @code{r0} to value
754 addressed by @code{rd + offset16}. On match, the value addressed by
755 @code{rd + offset16} is replaced with the value in @code{rs}.
756 Regardless, the value that was at @code{rd + offset16} is
757 zero-extended and loaded into @code{r0}.
759 @item axchg [rd + offset16], rs
760 @itemx rs = xchg_64 (rd + offset16, rs)
761 Atomic exchange. Atomically exchanges the value in @code{rs} with
762 the value addressed by @code{rd + offset16}.
766 The following instructions provide atomic arithmetic operations.
769 @item aadd [rd + offset16], rs
770 @itemx lock *(u64 *)(rd + offset16) = rs
771 Atomic add instruction.
773 @item aor [rd + offset16], rs
774 @itemx lock *(u64 *) (rd + offset16) |= rs
775 Atomic or instruction.
777 @item aand [rd + offset16], rs
778 @itemx lock *(u64 *) (rd + offset16) &= rs
779 Atomic and instruction.
781 @item axor [rd + offset16], rs
782 @itemx lock *(u64 *) (rd + offset16) ^= rs
783 Atomic xor instruction.
787 The following variants perform fetching before the atomic operation.
790 @item afadd [rd + offset16], rs
791 @itemx rs = atomic_fetch_add ((u64 *)(rd + offset16), rs)
792 Atomic fetch-and-add instruction.
794 @item afor [rd + offset16], rs
795 @itemx rs = atomic_fetch_or ((u64 *)(rd + offset16), rs)
796 Atomic fetch-and-or instruction.
798 @item afand [rd + offset16], rs
799 @itemx rs = atomic_fetch_and ((u64 *)(rd + offset16), rs)
800 Atomic fetch-and-and instruction.
802 @item afxor [rd + offset16], rs
803 @itemx rs = atomic_fetch_xor ((u64 *)(rd + offset16), rs)
804 Atomic fetch-and-or instruction.
807 The above instructions were introduced in the V3 of the BPF
808 instruction set. The following instruction is supported for backwards
812 @item xadddw [rd + offset16], rs
813 Alias to @code{aadd}.
816 @subsection 32-bit atomic instructions
818 32-bit atomic exchange instructions are provided in two flavors: one
819 for compare-and-swap, one for unconditional exchange.
822 @item acmp32 [rd + offset16], rs
823 @itemx w0 = cmpxchg32_32 (rd + offset16, w0, ws)
824 Atomic compare-and-swap. Compares value in @code{w0} to value
825 addressed by @code{rd + offset16}. On match, the value addressed by
826 @code{rd + offset16} is replaced with the value in @code{ws}.
827 Regardless, the value that was at @code{rd + offset16} is
828 zero-extended and loaded into @code{w0}.
830 @item axchg [rd + offset16], rs
831 @itemx ws = xchg32_32 (rd + offset16, ws)
832 Atomic exchange. Atomically exchanges the value in @code{ws} with
833 the value addressed by @code{rd + offset16}.
837 The following instructions provide 32-bit atomic arithmetic operations.
840 @item aadd32 [rd + offset16], rs
841 @itemx lock *(u32 *)(rd + offset16) = rs
842 Atomic add instruction.
844 @item aor32 [rd + offset16], rs
845 @itemx lock *(u32 *) (rd + offset16) |= rs
846 Atomic or instruction.
848 @item aand32 [rd + offset16], rs
849 @itemx lock *(u32 *) (rd + offset16) &= rs
850 Atomic and instruction.
852 @item axor32 [rd + offset16], rs
853 @itemx lock *(u32 *) (rd + offset16) ^= rs
854 Atomic xor instruction
858 The following variants perform fetching before the atomic operation.
861 @item afadd32 [dr + offset16], rs
862 @itemx ws = atomic_fetch_add ((u32 *)(rd + offset16), ws)
863 Atomic fetch-and-add instruction.
865 @item afor32 [dr + offset16], rs
866 @itemx ws = atomic_fetch_or ((u32 *)(rd + offset16), ws)
867 Atomic fetch-and-or instruction.
869 @item afand32 [dr + offset16], rs
870 @itemx ws = atomic_fetch_and ((u32 *)(rd + offset16), ws)
871 Atomic fetch-and-and instruction.
873 @item afxor32 [dr + offset16], rs
874 @itemx ws = atomic_fetch_xor ((u32 *)(rd + offset16), ws)
875 Atomic fetch-and-or instruction
878 The above instructions were introduced in the V3 of the BPF
879 instruction set. The following instruction is supported for backwards
883 @item xaddw [rd + offset16], rs
884 Alias to @code{aadd32}.