@@ -430,14 +430,54 @@ and loaded back to ``R0``.
-----------------------------
Instructions with the ``BPF_IMM`` 'mode' modifier use the wide instruction
-encoding for an extra imm64 value.
+encoding defined in `Instruction encoding`_, and use the 'src' field of the
+basic instruction to hold an opcode subtype.
+
+The following instructions are defined, and use additional concepts defined below:
+
+========================= ====== === ===================================== =========== ==============
+opcode construction opcode src pseudocode imm type dst type
+========================= ====== === ===================================== =========== ==============
+BPF_IMM | BPF_DW | BPF_LD 0x18 0x0 dst = imm64 integer integer
+BPF_IMM | BPF_DW | BPF_LD 0x18 0x1 dst = map_by_fd(imm) map fd map
+BPF_IMM | BPF_DW | BPF_LD 0x18 0x2 dst = mva(map_by_fd(imm)) + next_imm map fd data pointer
+BPF_IMM | BPF_DW | BPF_LD 0x18 0x3 dst = variable_addr(imm) variable id data pointer
+BPF_IMM | BPF_DW | BPF_LD 0x18 0x4 dst = code_addr(imm) integer code pointer
+BPF_IMM | BPF_DW | BPF_LD 0x18 0x5 dst = map_by_idx(imm) map index map
+BPF_IMM | BPF_DW | BPF_LD 0x18 0x6 dst = mva(map_by_idx(imm)) + next_imm map index data pointer
+========================= ====== === ===================================== =========== ==============
-There is currently only one such instruction.
+where
+
+* map_by_fd(fd) means to convert a 32-bit POSIX file descriptor into an address of a map object (see `Map objects`_)
+* map_by_index(index) means to convert a 32-bit index into an address of a map object
+* mva(map) gets the address of the first value in a given map object
+* variable_addr(id) gets the address of a variable (see `Variables`_) with a given id
+* code_addr(offset) gets the address of the instruction at a specified relative offset in units of 64-bit blocks
+* the 'imm type' can be used by disassemblers for display
+* the 'dst type' can be used for verification and JIT compilation purposes
+
+Map objects
+~~~~~~~~~~~
+
+Maps are shared memory regions accessible by eBPF programs on some platforms, where we use the term "map object"
+to refer to an object containing the data and metadata (e.g., size) about the memory region.
+A map can have various semantics as defined in a separate document, and may or may not have a single
+contiguous memory region, but the 'mva(map)' is currently only defined for maps that do have a single
+contiguous memory region. Support for maps is optional.
-``BPF_LD | BPF_DW | BPF_IMM`` means::
+Each map object can have a POSIX file descriptor (fd) if supported by the platform,
+where 'map_by_fd(fd)' means to get the map with the specified file descriptor.
+Each eBPF program can also be defined to use a set of maps associated with the program
+at load time, and 'map_by_index(index)' means to get the map with the given index in the set
+associated with the eBPF program containing the instruction.
- dst = imm64
+Variables
+~~~~~~~~~
+Variables are memory regions, identified by integer ids, accessible by eBPF programs on
+some platforms. The 'variable_addr(id)' operation means to get the address of the memory region
+identified by the given id. Support for such variables is optional.
Legacy BPF Packet access instructions
-------------------------------------
@@ -465,6 +505,12 @@ opcode src imm description referenc
0x16 0x0 any if (uint32_t)dst == imm goto +offset `Jump instructions`_
0x17 0x0 any dst -= imm `Arithmetic instructions`_
0x18 0x0 any dst = imm64 `64-bit immediate instructions`_
+0x18 0x1 any dst = map_by_fd(imm) `64-bit immediate instructions`_
+0x18 0x2 any dst = mva(map_by_fd(imm)) + next_imm `64-bit immediate instructions`_
+0x18 0x3 any dst = variable_addr(imm) `64-bit immediate instructions`_
+0x18 0x4 any dst = code_addr(imm) `64-bit immediate instructions`_
+0x18 0x5 any dst = map_by_idx(imm) `64-bit immediate instructions`_
+0x18 0x6 any dst = mva(map_by_idx(imm)) + next_imm `64-bit immediate instructions`_
0x1c any 0x00 dst = (uint32_t)(dst - src) `Arithmetic instructions`_
0x1d any 0x00 if dst == src goto +offset `Jump instructions`_
0x1e any 0x00 if (uint32_t)dst == (uint32_t)src goto +offset `Jump instructions`_
@@ -24,6 +24,16 @@ Byte swap instructions
``BPF_FROM_LE`` and ``BPF_FROM_BE`` exist as aliases for ``BPF_TO_LE`` and ``BPF_TO_BE`` respectively.
+Map objects
+===========
+
+Linux only supports the 'mva(map)' operation on array maps with a single element.
+
+Variables
+=========
+
+Linux uses BTF ids to identify variables.
+
Legacy BPF Packet access instructions
=====================================