tools/testing/selftests/bpf/test_verifier.c

   1 /*
   2  * Testsuite for eBPF verifier
   3  *
   4  * Copyright (c) 2014 PLUMgrid, http://plumgrid.com
   5  * Copyright (c) 2017 Facebook
   6  *
   7  * This program is free software; you can redistribute it and/or
   8  * modify it under the terms of version 2 of the GNU General Public
   9  * License as published by the Free Software Foundation.
  10  */
  11
  12 #include <endian.h>
  13 #include <asm/types.h>
  14 #include <linux/types.h>
  15 #include <stdint.h>
  16 #include <stdio.h>
  17 #include <stdlib.h>
  18 #include <unistd.h>
  19 #include <errno.h>
  20 #include <string.h>
  21 #include <stddef.h>
  22 #include <stdbool.h>
  23 #include <sched.h>
  24 #include <limits.h>
  25
  26 #include <sys/capability.h>
  27
  28 #include <linux/unistd.h>
  29 #include <linux/filter.h>
  30 #include <linux/bpf_perf_event.h>
  31 #include <linux/bpf.h>
  32 #include <linux/if_ether.h>
  33
  34 #include <bpf/bpf.h>
  35
  36 #ifdef HAVE_GENHDR
  37 # include "autoconf.h"
  38 #else
  39 # if defined(__i386) || defined(__x86_64) || defined(__s390x__) || defined(__aarch64__)
  40 #  define CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 1
  41 # endif
  42 #endif
  43 #include "bpf_rlimit.h"
  44 #include "../../../include/linux/filter.h"
  45
  46 #ifndef ARRAY_SIZE
  47 # define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
  48 #endif
  49
  50 #define MAX_INSNS       512
  51 #define MAX_FIXUPS      8
  52 #define MAX_NR_MAPS     4
  53 #define POINTER_VALUE   0xcafe4all
  54 #define TEST_DATA_LEN   64
  55
  56 #define F_NEEDS_EFFICIENT_UNALIGNED_ACCESS      (1 << 0)
  57 #define F_LOAD_WITH_STRICT_ALIGNMENT            (1 << 1)
  58
  59 #define UNPRIV_SYSCTL "kernel/unprivileged_bpf_disabled"
  60 static bool unpriv_disabled = false;
  61
  62 struct bpf_test {
  63         const char *descr;
  64         struct bpf_insn insns[MAX_INSNS];
  65         int fixup_map1[MAX_FIXUPS];
  66         int fixup_map2[MAX_FIXUPS];
  67         int fixup_prog[MAX_FIXUPS];
  68         int fixup_map_in_map[MAX_FIXUPS];
  69         const char *errstr;
  70         const char *errstr_unpriv;
  71         uint32_t retval;
  72         enum {
  73                 UNDEF,
  74                 ACCEPT,
  75                 REJECT
  76         } result, result_unpriv;
  77         enum bpf_prog_type prog_type;
  78         uint8_t flags;
  79 };
  80
  81 /* Note we want this to be 64 bit aligned so that the end of our array is
  82  * actually the end of the structure.
  83  */
  84 #define MAX_ENTRIES 11
  85
  86 struct test_val {
  87         unsigned int index;
  88         int foo[MAX_ENTRIES];
  89 };
  90
  91 static struct bpf_test tests[] = {
  92         {
  93                 "add+sub+mul",
  94                 .insns = {
  95                         BPF_MOV64_IMM(BPF_REG_1, 1),
  96                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 2),
  97                         BPF_MOV64_IMM(BPF_REG_2, 3),
  98                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_2),
  99                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -1),
 100                         BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 3),
 101                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
 102                         BPF_EXIT_INSN(),
 103                 },
 104                 .result = ACCEPT,
 105                 .retval = -3,
 106         },
 107         {
 108                 "DIV32 by 0, zero check 1",
 109                 .insns = {
 110                         BPF_MOV32_IMM(BPF_REG_0, 42),
 111                         BPF_MOV32_IMM(BPF_REG_1, 0),
 112                         BPF_MOV32_IMM(BPF_REG_2, 1),
 113                         BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
 114                         BPF_EXIT_INSN(),
 115                 },
 116                 .result = ACCEPT,
 117                 .retval = 42,
 118         },
 119         {
 120                 "DIV32 by 0, zero check 2",
 121                 .insns = {
 122                         BPF_MOV32_IMM(BPF_REG_0, 42),
 123                         BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
 124                         BPF_MOV32_IMM(BPF_REG_2, 1),
 125                         BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
 126                         BPF_EXIT_INSN(),
 127                 },
 128                 .result = ACCEPT,
 129                 .retval = 42,
 130         },
 131         {
 132                 "DIV64 by 0, zero check",
 133                 .insns = {
 134                         BPF_MOV32_IMM(BPF_REG_0, 42),
 135                         BPF_MOV32_IMM(BPF_REG_1, 0),
 136                         BPF_MOV32_IMM(BPF_REG_2, 1),
 137                         BPF_ALU64_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
 138                         BPF_EXIT_INSN(),
 139                 },
 140                 .result = ACCEPT,
 141                 .retval = 42,
 142         },
 143         {
 144                 "MOD32 by 0, zero check 1",
 145                 .insns = {
 146                         BPF_MOV32_IMM(BPF_REG_0, 42),
 147                         BPF_MOV32_IMM(BPF_REG_1, 0),
 148                         BPF_MOV32_IMM(BPF_REG_2, 1),
 149                         BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 150                         BPF_EXIT_INSN(),
 151                 },
 152                 .result = ACCEPT,
 153                 .retval = 42,
 154         },
 155         {
 156                 "MOD32 by 0, zero check 2",
 157                 .insns = {
 158                         BPF_MOV32_IMM(BPF_REG_0, 42),
 159                         BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
 160                         BPF_MOV32_IMM(BPF_REG_2, 1),
 161                         BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 162                         BPF_EXIT_INSN(),
 163                 },
 164                 .result = ACCEPT,
 165                 .retval = 42,
 166         },
 167         {
 168                 "MOD64 by 0, zero check",
 169                 .insns = {
 170                         BPF_MOV32_IMM(BPF_REG_0, 42),
 171                         BPF_MOV32_IMM(BPF_REG_1, 0),
 172                         BPF_MOV32_IMM(BPF_REG_2, 1),
 173                         BPF_ALU64_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 174                         BPF_EXIT_INSN(),
 175                 },
 176                 .result = ACCEPT,
 177                 .retval = 42,
 178         },
 179         {
 180                 "DIV32 by 0, zero check ok, cls",
 181                 .insns = {
 182                         BPF_MOV32_IMM(BPF_REG_0, 42),
 183                         BPF_MOV32_IMM(BPF_REG_1, 2),
 184                         BPF_MOV32_IMM(BPF_REG_2, 16),
 185                         BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
 186                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 187                         BPF_EXIT_INSN(),
 188                 },
 189                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 190                 .result = ACCEPT,
 191                 .retval = 8,
 192         },
 193         {
 194                 "DIV32 by 0, zero check 1, cls",
 195                 .insns = {
 196                         BPF_MOV32_IMM(BPF_REG_1, 0),
 197                         BPF_MOV32_IMM(BPF_REG_0, 1),
 198                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 199                         BPF_EXIT_INSN(),
 200                 },
 201                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 202                 .result = ACCEPT,
 203                 .retval = 0,
 204         },
 205         {
 206                 "DIV32 by 0, zero check 2, cls",
 207                 .insns = {
 208                         BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
 209                         BPF_MOV32_IMM(BPF_REG_0, 1),
 210                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 211                         BPF_EXIT_INSN(),
 212                 },
 213                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 214                 .result = ACCEPT,
 215                 .retval = 0,
 216         },
 217         {
 218                 "DIV64 by 0, zero check, cls",
 219                 .insns = {
 220                         BPF_MOV32_IMM(BPF_REG_1, 0),
 221                         BPF_MOV32_IMM(BPF_REG_0, 1),
 222                         BPF_ALU64_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 223                         BPF_EXIT_INSN(),
 224                 },
 225                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 226                 .result = ACCEPT,
 227                 .retval = 0,
 228         },
 229         {
 230                 "MOD32 by 0, zero check ok, cls",
 231                 .insns = {
 232                         BPF_MOV32_IMM(BPF_REG_0, 42),
 233                         BPF_MOV32_IMM(BPF_REG_1, 3),
 234                         BPF_MOV32_IMM(BPF_REG_2, 5),
 235                         BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 236                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 237                         BPF_EXIT_INSN(),
 238                 },
 239                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 240                 .result = ACCEPT,
 241                 .retval = 2,
 242         },
 243         {
 244                 "MOD32 by 0, zero check 1, cls",
 245                 .insns = {
 246                         BPF_MOV32_IMM(BPF_REG_1, 0),
 247                         BPF_MOV32_IMM(BPF_REG_0, 1),
 248                         BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 249                         BPF_EXIT_INSN(),
 250                 },
 251                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 252                 .result = ACCEPT,
 253                 .retval = 1,
 254         },
 255         {
 256                 "MOD32 by 0, zero check 2, cls",
 257                 .insns = {
 258                         BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
 259                         BPF_MOV32_IMM(BPF_REG_0, 1),
 260                         BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 261                         BPF_EXIT_INSN(),
 262                 },
 263                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 264                 .result = ACCEPT,
 265                 .retval = 1,
 266         },
 267         {
 268                 "MOD64 by 0, zero check 1, cls",
 269                 .insns = {
 270                         BPF_MOV32_IMM(BPF_REG_1, 0),
 271                         BPF_MOV32_IMM(BPF_REG_0, 2),
 272                         BPF_ALU64_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 273                         BPF_EXIT_INSN(),
 274                 },
 275                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 276                 .result = ACCEPT,
 277                 .retval = 2,
 278         },
 279         {
 280                 "MOD64 by 0, zero check 2, cls",
 281                 .insns = {
 282                         BPF_MOV32_IMM(BPF_REG_1, 0),
 283                         BPF_MOV32_IMM(BPF_REG_0, -1),
 284                         BPF_ALU64_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 285                         BPF_EXIT_INSN(),
 286                 },
 287                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 288                 .result = ACCEPT,
 289                 .retval = -1,
 290         },
 291         /* Just make sure that JITs used udiv/umod as otherwise we get
 292          * an exception from INT_MIN/-1 overflow similarly as with div
 293          * by zero.
 294          */
 295         {
 296                 "DIV32 overflow, check 1",
 297                 .insns = {
 298                         BPF_MOV32_IMM(BPF_REG_1, -1),
 299                         BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
 300                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 301                         BPF_EXIT_INSN(),
 302                 },
 303                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 304                 .result = ACCEPT,
 305                 .retval = 0,
 306         },
 307         {
 308                 "DIV32 overflow, check 2",
 309                 .insns = {
 310                         BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
 311                         BPF_ALU32_IMM(BPF_DIV, BPF_REG_0, -1),
 312                         BPF_EXIT_INSN(),
 313                 },
 314                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 315                 .result = ACCEPT,
 316                 .retval = 0,
 317         },
 318         {
 319                 "DIV64 overflow, check 1",
 320                 .insns = {
 321                         BPF_MOV64_IMM(BPF_REG_1, -1),
 322                         BPF_LD_IMM64(BPF_REG_0, LLONG_MIN),
 323                         BPF_ALU64_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 324                         BPF_EXIT_INSN(),
 325                 },
 326                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 327                 .result = ACCEPT,
 328                 .retval = 0,
 329         },
 330         {
 331                 "DIV64 overflow, check 2",
 332                 .insns = {
 333                         BPF_LD_IMM64(BPF_REG_0, LLONG_MIN),
 334                         BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, -1),
 335                         BPF_EXIT_INSN(),
 336                 },
 337                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 338                 .result = ACCEPT,
 339                 .retval = 0,
 340         },
 341         {
 342                 "MOD32 overflow, check 1",
 343                 .insns = {
 344                         BPF_MOV32_IMM(BPF_REG_1, -1),
 345                         BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
 346                         BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 347                         BPF_EXIT_INSN(),
 348                 },
 349                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 350                 .result = ACCEPT,
 351                 .retval = INT_MIN,
 352         },
 353         {
 354                 "MOD32 overflow, check 2",
 355                 .insns = {
 356                         BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
 357                         BPF_ALU32_IMM(BPF_MOD, BPF_REG_0, -1),
 358                         BPF_EXIT_INSN(),
 359                 },
 360                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 361                 .result = ACCEPT,
 362                 .retval = INT_MIN,
 363         },
 364         {
 365                 "MOD64 overflow, check 1",
 366                 .insns = {
 367                         BPF_MOV64_IMM(BPF_REG_1, -1),
 368                         BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
 369                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
 370                         BPF_ALU64_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 371                         BPF_MOV32_IMM(BPF_REG_0, 0),
 372                         BPF_JMP_REG(BPF_JNE, BPF_REG_3, BPF_REG_2, 1),
 373                         BPF_MOV32_IMM(BPF_REG_0, 1),
 374                         BPF_EXIT_INSN(),
 375                 },
 376                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 377                 .result = ACCEPT,
 378                 .retval = 1,
 379         },
 380         {
 381                 "MOD64 overflow, check 2",
 382                 .insns = {
 383                         BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
 384                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
 385                         BPF_ALU64_IMM(BPF_MOD, BPF_REG_2, -1),
 386                         BPF_MOV32_IMM(BPF_REG_0, 0),
 387                         BPF_JMP_REG(BPF_JNE, BPF_REG_3, BPF_REG_2, 1),
 388                         BPF_MOV32_IMM(BPF_REG_0, 1),
 389                         BPF_EXIT_INSN(),
 390                 },
 391                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 392                 .result = ACCEPT,
 393                 .retval = 1,
 394         },
 395         {
 396                 "xor32 zero extend check",
 397                 .insns = {
 398                         BPF_MOV32_IMM(BPF_REG_2, -1),
 399                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 32),
 400                         BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 0xffff),
 401                         BPF_ALU32_REG(BPF_XOR, BPF_REG_2, BPF_REG_2),
 402                         BPF_MOV32_IMM(BPF_REG_0, 2),
 403                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 1),
 404                         BPF_MOV32_IMM(BPF_REG_0, 1),
 405                         BPF_EXIT_INSN(),
 406                 },
 407                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 408                 .result = ACCEPT,
 409                 .retval = 1,
 410         },
 411         {
 412                 "empty prog",
 413                 .insns = {
 414                 },
 415                 .errstr = "unknown opcode 00",
 416                 .result = REJECT,
 417         },
 418         {
 419                 "only exit insn",
 420                 .insns = {
 421                         BPF_EXIT_INSN(),
 422                 },
 423                 .errstr = "R0 !read_ok",
 424                 .result = REJECT,
 425         },
 426         {
 427                 "unreachable",
 428                 .insns = {
 429                         BPF_EXIT_INSN(),
 430                         BPF_EXIT_INSN(),
 431                 },
 432                 .errstr = "unreachable",
 433                 .result = REJECT,
 434         },
 435         {
 436                 "unreachable2",
 437                 .insns = {
 438                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
 439                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
 440                         BPF_EXIT_INSN(),
 441                 },
 442                 .errstr = "unreachable",
 443                 .result = REJECT,
 444         },
 445         {
 446                 "out of range jump",
 447                 .insns = {
 448                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
 449                         BPF_EXIT_INSN(),
 450                 },
 451                 .errstr = "jump out of range",
 452                 .result = REJECT,
 453         },
 454         {
 455                 "out of range jump2",
 456                 .insns = {
 457                         BPF_JMP_IMM(BPF_JA, 0, 0, -2),
 458                         BPF_EXIT_INSN(),
 459                 },
 460                 .errstr = "jump out of range",
 461                 .result = REJECT,
 462         },
 463         {
 464                 "test1 ld_imm64",
 465                 .insns = {
 466                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 467                         BPF_LD_IMM64(BPF_REG_0, 0),
 468                         BPF_LD_IMM64(BPF_REG_0, 0),
 469                         BPF_LD_IMM64(BPF_REG_0, 1),
 470                         BPF_LD_IMM64(BPF_REG_0, 1),
 471                         BPF_MOV64_IMM(BPF_REG_0, 2),
 472                         BPF_EXIT_INSN(),
 473                 },
 474                 .errstr = "invalid BPF_LD_IMM insn",
 475                 .errstr_unpriv = "R1 pointer comparison",
 476                 .result = REJECT,
 477         },
 478         {
 479                 "test2 ld_imm64",
 480                 .insns = {
 481                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 482                         BPF_LD_IMM64(BPF_REG_0, 0),
 483                         BPF_LD_IMM64(BPF_REG_0, 0),
 484                         BPF_LD_IMM64(BPF_REG_0, 1),
 485                         BPF_LD_IMM64(BPF_REG_0, 1),
 486                         BPF_EXIT_INSN(),
 487                 },
 488                 .errstr = "invalid BPF_LD_IMM insn",
 489                 .errstr_unpriv = "R1 pointer comparison",
 490                 .result = REJECT,
 491         },
 492         {
 493                 "test3 ld_imm64",
 494                 .insns = {
 495                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 496                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 497                         BPF_LD_IMM64(BPF_REG_0, 0),
 498                         BPF_LD_IMM64(BPF_REG_0, 0),
 499                         BPF_LD_IMM64(BPF_REG_0, 1),
 500                         BPF_LD_IMM64(BPF_REG_0, 1),
 501                         BPF_EXIT_INSN(),
 502                 },
 503                 .errstr = "invalid bpf_ld_imm64 insn",
 504                 .result = REJECT,
 505         },
 506         {
 507                 "test4 ld_imm64",
 508                 .insns = {
 509                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 510                         BPF_EXIT_INSN(),
 511                 },
 512                 .errstr = "invalid bpf_ld_imm64 insn",
 513                 .result = REJECT,
 514         },
 515         {
 516                 "test5 ld_imm64",
 517                 .insns = {
 518                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 519                 },
 520                 .errstr = "invalid bpf_ld_imm64 insn",
 521                 .result = REJECT,
 522         },
 523         {
 524                 "test6 ld_imm64",
 525                 .insns = {
 526                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 527                         BPF_RAW_INSN(0, 0, 0, 0, 0),
 528                         BPF_EXIT_INSN(),
 529                 },
 530                 .result = ACCEPT,
 531         },
 532         {
 533                 "test7 ld_imm64",
 534                 .insns = {
 535                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 536                         BPF_RAW_INSN(0, 0, 0, 0, 1),
 537                         BPF_EXIT_INSN(),
 538                 },
 539                 .result = ACCEPT,
 540                 .retval = 1,
 541         },
 542         {
 543                 "test8 ld_imm64",
 544                 .insns = {
 545                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 1, 1),
 546                         BPF_RAW_INSN(0, 0, 0, 0, 1),
 547                         BPF_EXIT_INSN(),
 548                 },
 549                 .errstr = "uses reserved fields",
 550                 .result = REJECT,
 551         },
 552         {
 553                 "test9 ld_imm64",
 554                 .insns = {
 555                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 556                         BPF_RAW_INSN(0, 0, 0, 1, 1),
 557                         BPF_EXIT_INSN(),
 558                 },
 559                 .errstr = "invalid bpf_ld_imm64 insn",
 560                 .result = REJECT,
 561         },
 562         {
 563                 "test10 ld_imm64",
 564                 .insns = {
 565                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 566                         BPF_RAW_INSN(0, BPF_REG_1, 0, 0, 1),
 567                         BPF_EXIT_INSN(),
 568                 },
 569                 .errstr = "invalid bpf_ld_imm64 insn",
 570                 .result = REJECT,
 571         },
 572         {
 573                 "test11 ld_imm64",
 574                 .insns = {
 575                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 576                         BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
 577                         BPF_EXIT_INSN(),
 578                 },
 579                 .errstr = "invalid bpf_ld_imm64 insn",
 580                 .result = REJECT,
 581         },
 582         {
 583                 "test12 ld_imm64",
 584                 .insns = {
 585                         BPF_MOV64_IMM(BPF_REG_1, 0),
 586                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
 587                         BPF_RAW_INSN(0, 0, 0, 0, 1),
 588                         BPF_EXIT_INSN(),
 589                 },
 590                 .errstr = "not pointing to valid bpf_map",
 591                 .result = REJECT,
 592         },
 593         {
 594                 "test13 ld_imm64",
 595                 .insns = {
 596                         BPF_MOV64_IMM(BPF_REG_1, 0),
 597                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
 598                         BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
 599                         BPF_EXIT_INSN(),
 600                 },
 601                 .errstr = "invalid bpf_ld_imm64 insn",
 602                 .result = REJECT,
 603         },
 604         {
 605                 "arsh32 on imm",
 606                 .insns = {
 607                         BPF_MOV64_IMM(BPF_REG_0, 1),
 608                         BPF_ALU32_IMM(BPF_ARSH, BPF_REG_0, 5),
 609                         BPF_EXIT_INSN(),
 610                 },
 611                 .result = REJECT,
 612                 .errstr = "unknown opcode c4",
 613         },
 614         {
 615                 "arsh32 on reg",
 616                 .insns = {
 617                         BPF_MOV64_IMM(BPF_REG_0, 1),
 618                         BPF_MOV64_IMM(BPF_REG_1, 5),
 619                         BPF_ALU32_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),
 620                         BPF_EXIT_INSN(),
 621                 },
 622                 .result = REJECT,
 623                 .errstr = "unknown opcode cc",
 624         },
 625         {
 626                 "arsh64 on imm",
 627                 .insns = {
 628                         BPF_MOV64_IMM(BPF_REG_0, 1),
 629                         BPF_ALU64_IMM(BPF_ARSH, BPF_REG_0, 5),
 630                         BPF_EXIT_INSN(),
 631                 },
 632                 .result = ACCEPT,
 633         },
 634         {
 635                 "arsh64 on reg",
 636                 .insns = {
 637                         BPF_MOV64_IMM(BPF_REG_0, 1),
 638                         BPF_MOV64_IMM(BPF_REG_1, 5),
 639                         BPF_ALU64_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),
 640                         BPF_EXIT_INSN(),
 641                 },
 642                 .result = ACCEPT,
 643         },
 644         {
 645                 "no bpf_exit",
 646                 .insns = {
 647                         BPF_ALU64_REG(BPF_MOV, BPF_REG_0, BPF_REG_2),
 648                 },
 649                 .errstr = "not an exit",
 650                 .result = REJECT,
 651         },
 652         {
 653                 "loop (back-edge)",
 654                 .insns = {
 655                         BPF_JMP_IMM(BPF_JA, 0, 0, -1),
 656                         BPF_EXIT_INSN(),
 657                 },
 658                 .errstr = "back-edge",
 659                 .result = REJECT,
 660         },
 661         {
 662                 "loop2 (back-edge)",
 663                 .insns = {
 664                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
 665                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
 666                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
 667                         BPF_JMP_IMM(BPF_JA, 0, 0, -4),
 668                         BPF_EXIT_INSN(),
 669                 },
 670                 .errstr = "back-edge",
 671                 .result = REJECT,
 672         },
 673         {
 674                 "conditional loop",
 675                 .insns = {
 676                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
 677                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
 678                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
 679                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -3),
 680                         BPF_EXIT_INSN(),
 681                 },
 682                 .errstr = "back-edge",
 683                 .result = REJECT,
 684         },
 685         {
 686                 "read uninitialized register",
 687                 .insns = {
 688                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 689                         BPF_EXIT_INSN(),
 690                 },
 691                 .errstr = "R2 !read_ok",
 692                 .result = REJECT,
 693         },
 694         {
 695                 "read invalid register",
 696                 .insns = {
 697                         BPF_MOV64_REG(BPF_REG_0, -1),
 698                         BPF_EXIT_INSN(),
 699                 },
 700                 .errstr = "R15 is invalid",
 701                 .result = REJECT,
 702         },
 703         {
 704                 "program doesn't init R0 before exit",
 705                 .insns = {
 706                         BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_1),
 707                         BPF_EXIT_INSN(),
 708                 },
 709                 .errstr = "R0 !read_ok",
 710                 .result = REJECT,
 711         },
 712         {
 713                 "program doesn't init R0 before exit in all branches",
 714                 .insns = {
 715                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
 716                         BPF_MOV64_IMM(BPF_REG_0, 1),
 717                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
 718                         BPF_EXIT_INSN(),
 719                 },
 720                 .errstr = "R0 !read_ok",
 721                 .errstr_unpriv = "R1 pointer comparison",
 722                 .result = REJECT,
 723         },
 724         {
 725                 "stack out of bounds",
 726                 .insns = {
 727                         BPF_ST_MEM(BPF_DW, BPF_REG_10, 8, 0),
 728                         BPF_EXIT_INSN(),
 729                 },
 730                 .errstr = "invalid stack",
 731                 .result = REJECT,
 732         },
 733         {
 734                 "invalid call insn1",
 735                 .insns = {
 736                         BPF_RAW_INSN(BPF_JMP | BPF_CALL | BPF_X, 0, 0, 0, 0),
 737                         BPF_EXIT_INSN(),
 738                 },
 739                 .errstr = "unknown opcode 8d",
 740                 .result = REJECT,
 741         },
 742         {
 743                 "invalid call insn2",
 744                 .insns = {
 745                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 1, 0),
 746                         BPF_EXIT_INSN(),
 747                 },
 748                 .errstr = "BPF_CALL uses reserved",
 749                 .result = REJECT,
 750         },
 751         {
 752                 "invalid function call",
 753                 .insns = {
 754                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, 1234567),
 755                         BPF_EXIT_INSN(),
 756                 },
 757                 .errstr = "invalid func unknown#1234567",
 758                 .result = REJECT,
 759         },
 760         {
 761                 "uninitialized stack1",
 762                 .insns = {
 763                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 764                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 765                         BPF_LD_MAP_FD(BPF_REG_1, 0),
 766                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 767                                      BPF_FUNC_map_lookup_elem),
 768                         BPF_EXIT_INSN(),
 769                 },
 770                 .fixup_map1 = { 2 },
 771                 .errstr = "invalid indirect read from stack",
 772                 .result = REJECT,
 773         },
 774         {
 775                 "uninitialized stack2",
 776                 .insns = {
 777                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 778                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -8),
 779                         BPF_EXIT_INSN(),
 780                 },
 781                 .errstr = "invalid read from stack",
 782                 .result = REJECT,
 783         },
 784         {
 785                 "invalid fp arithmetic",
 786                 /* If this gets ever changed, make sure JITs can deal with it. */
 787                 .insns = {
 788                         BPF_MOV64_IMM(BPF_REG_0, 0),
 789                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
 790                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 8),
 791                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
 792                         BPF_EXIT_INSN(),
 793                 },
 794                 .errstr = "R1 subtraction from stack pointer",
 795                 .result = REJECT,
 796         },
 797         {
 798                 "non-invalid fp arithmetic",
 799                 .insns = {
 800                         BPF_MOV64_IMM(BPF_REG_0, 0),
 801                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
 802                         BPF_EXIT_INSN(),
 803                 },
 804                 .result = ACCEPT,
 805         },
 806         {
 807                 "invalid argument register",
 808                 .insns = {
 809                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 810                                      BPF_FUNC_get_cgroup_classid),
 811                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 812                                      BPF_FUNC_get_cgroup_classid),
 813                         BPF_EXIT_INSN(),
 814                 },
 815                 .errstr = "R1 !read_ok",
 816                 .result = REJECT,
 817                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 818         },
 819         {
 820                 "non-invalid argument register",
 821                 .insns = {
 822                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
 823                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 824                                      BPF_FUNC_get_cgroup_classid),
 825                         BPF_ALU64_REG(BPF_MOV, BPF_REG_1, BPF_REG_6),
 826                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 827                                      BPF_FUNC_get_cgroup_classid),
 828                         BPF_EXIT_INSN(),
 829                 },
 830                 .result = ACCEPT,
 831                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 832         },
 833         {
 834                 "check valid spill/fill",
 835                 .insns = {
 836                         /* spill R1(ctx) into stack */
 837                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
 838                         /* fill it back into R2 */
 839                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
 840                         /* should be able to access R0 = *(R2 + 8) */
 841                         /* BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 8), */
 842                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 843                         BPF_EXIT_INSN(),
 844                 },
 845                 .errstr_unpriv = "R0 leaks addr",
 846                 .result = ACCEPT,
 847                 .result_unpriv = REJECT,
 848                 .retval = POINTER_VALUE,
 849         },
 850         {
 851                 "check valid spill/fill, skb mark",
 852                 .insns = {
 853                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
 854                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
 855                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
 856                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
 857                                     offsetof(struct __sk_buff, mark)),
 858                         BPF_EXIT_INSN(),
 859                 },
 860                 .result = ACCEPT,
 861                 .result_unpriv = ACCEPT,
 862         },
 863         {
 864                 "check corrupted spill/fill",
 865                 .insns = {
 866                         /* spill R1(ctx) into stack */
 867                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
 868                         /* mess up with R1 pointer on stack */
 869                         BPF_ST_MEM(BPF_B, BPF_REG_10, -7, 0x23),
 870                         /* fill back into R0 should fail */
 871                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
 872                         BPF_EXIT_INSN(),
 873                 },
 874                 .errstr_unpriv = "attempt to corrupt spilled",
 875                 .errstr = "corrupted spill",
 876                 .result = REJECT,
 877         },
 878         {
 879                 "invalid src register in STX",
 880                 .insns = {
 881                         BPF_STX_MEM(BPF_B, BPF_REG_10, -1, -1),
 882                         BPF_EXIT_INSN(),
 883                 },
 884                 .errstr = "R15 is invalid",
 885                 .result = REJECT,
 886         },
 887         {
 888                 "invalid dst register in STX",
 889                 .insns = {
 890                         BPF_STX_MEM(BPF_B, 14, BPF_REG_10, -1),
 891                         BPF_EXIT_INSN(),
 892                 },
 893                 .errstr = "R14 is invalid",
 894                 .result = REJECT,
 895         },
 896         {
 897                 "invalid dst register in ST",
 898                 .insns = {
 899                         BPF_ST_MEM(BPF_B, 14, -1, -1),
 900                         BPF_EXIT_INSN(),
 901                 },
 902                 .errstr = "R14 is invalid",
 903                 .result = REJECT,
 904         },
 905         {
 906                 "invalid src register in LDX",
 907                 .insns = {
 908                         BPF_LDX_MEM(BPF_B, BPF_REG_0, 12, 0),
 909                         BPF_EXIT_INSN(),
 910                 },
 911                 .errstr = "R12 is invalid",
 912                 .result = REJECT,
 913         },
 914         {
 915                 "invalid dst register in LDX",
 916                 .insns = {
 917                         BPF_LDX_MEM(BPF_B, 11, BPF_REG_1, 0),
 918                         BPF_EXIT_INSN(),
 919                 },
 920                 .errstr = "R11 is invalid",
 921                 .result = REJECT,
 922         },
 923         {
 924                 "junk insn",
 925                 .insns = {
 926                         BPF_RAW_INSN(0, 0, 0, 0, 0),
 927                         BPF_EXIT_INSN(),
 928                 },
 929                 .errstr = "unknown opcode 00",
 930                 .result = REJECT,
 931         },
 932         {
 933                 "junk insn2",
 934                 .insns = {
 935                         BPF_RAW_INSN(1, 0, 0, 0, 0),
 936                         BPF_EXIT_INSN(),
 937                 },
 938                 .errstr = "BPF_LDX uses reserved fields",
 939                 .result = REJECT,
 940         },
 941         {
 942                 "junk insn3",
 943                 .insns = {
 944                         BPF_RAW_INSN(-1, 0, 0, 0, 0),
 945                         BPF_EXIT_INSN(),
 946                 },
 947                 .errstr = "unknown opcode ff",
 948                 .result = REJECT,
 949         },
 950         {
 951                 "junk insn4",
 952                 .insns = {
 953                         BPF_RAW_INSN(-1, -1, -1, -1, -1),
 954                         BPF_EXIT_INSN(),
 955                 },
 956                 .errstr = "unknown opcode ff",
 957                 .result = REJECT,
 958         },
 959         {
 960                 "junk insn5",
 961                 .insns = {
 962                         BPF_RAW_INSN(0x7f, -1, -1, -1, -1),
 963                         BPF_EXIT_INSN(),
 964                 },
 965                 .errstr = "BPF_ALU uses reserved fields",
 966                 .result = REJECT,
 967         },
 968         {
 969                 "misaligned read from stack",
 970                 .insns = {
 971                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 972                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -4),
 973                         BPF_EXIT_INSN(),
 974                 },
 975                 .errstr = "misaligned stack access",
 976                 .result = REJECT,
 977         },
 978         {
 979                 "invalid map_fd for function call",
 980                 .insns = {
 981                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 982                         BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_10),
 983                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 984                         BPF_LD_MAP_FD(BPF_REG_1, 0),
 985                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 986                                      BPF_FUNC_map_delete_elem),
 987                         BPF_EXIT_INSN(),
 988                 },
 989                 .errstr = "fd 0 is not pointing to valid bpf_map",
 990                 .result = REJECT,
 991         },
 992         {
 993                 "don't check return value before access",
 994                 .insns = {
 995                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 996                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 997                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 998                         BPF_LD_MAP_FD(BPF_REG_1, 0),
 999                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1000                                      BPF_FUNC_map_lookup_elem),
1001                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1002                         BPF_EXIT_INSN(),
1003                 },
1004                 .fixup_map1 = { 3 },
1005                 .errstr = "R0 invalid mem access 'map_value_or_null'",
1006                 .result = REJECT,
1007         },
1008         {
1009                 "access memory with incorrect alignment",
1010                 .insns = {
1011                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1012                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1013                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1014                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1015                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1016                                      BPF_FUNC_map_lookup_elem),
1017                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
1018                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 4, 0),
1019                         BPF_EXIT_INSN(),
1020                 },
1021                 .fixup_map1 = { 3 },
1022                 .errstr = "misaligned value access",
1023                 .result = REJECT,
1024                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1025         },
1026         {
1027                 "sometimes access memory with incorrect alignment",
1028                 .insns = {
1029                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1030                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1031                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1032                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1033                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1034                                      BPF_FUNC_map_lookup_elem),
1035                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
1036                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1037                         BPF_EXIT_INSN(),
1038                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 1),
1039                         BPF_EXIT_INSN(),
1040                 },
1041                 .fixup_map1 = { 3 },
1042                 .errstr = "R0 invalid mem access",
1043                 .errstr_unpriv = "R0 leaks addr",
1044                 .result = REJECT,
1045                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1046         },
1047         {
1048                 "jump test 1",
1049                 .insns = {
1050                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1051                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -8),
1052                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
1053                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
1054                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 1),
1055                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 1),
1056                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 1),
1057                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 2),
1058                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 1),
1059                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 3),
1060                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 1),
1061                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 4),
1062                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
1063                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 5),
1064                         BPF_MOV64_IMM(BPF_REG_0, 0),
1065                         BPF_EXIT_INSN(),
1066                 },
1067                 .errstr_unpriv = "R1 pointer comparison",
1068                 .result_unpriv = REJECT,
1069                 .result = ACCEPT,
1070         },
1071         {
1072                 "jump test 2",
1073                 .insns = {
1074                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1075                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
1076                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
1077                         BPF_JMP_IMM(BPF_JA, 0, 0, 14),
1078                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 2),
1079                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
1080                         BPF_JMP_IMM(BPF_JA, 0, 0, 11),
1081                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 2),
1082                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
1083                         BPF_JMP_IMM(BPF_JA, 0, 0, 8),
1084                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 2),
1085                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
1086                         BPF_JMP_IMM(BPF_JA, 0, 0, 5),
1087                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 2),
1088                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
1089                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1090                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
1091                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
1092                         BPF_MOV64_IMM(BPF_REG_0, 0),
1093                         BPF_EXIT_INSN(),
1094                 },
1095                 .errstr_unpriv = "R1 pointer comparison",
1096                 .result_unpriv = REJECT,
1097                 .result = ACCEPT,
1098         },
1099         {
1100                 "jump test 3",
1101                 .insns = {
1102                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1103                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
1104                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
1105                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1106                         BPF_JMP_IMM(BPF_JA, 0, 0, 19),
1107                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 3),
1108                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
1109                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1110                         BPF_JMP_IMM(BPF_JA, 0, 0, 15),
1111                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 3),
1112                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
1113                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -32),
1114                         BPF_JMP_IMM(BPF_JA, 0, 0, 11),
1115                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 3),
1116                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
1117                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -40),
1118                         BPF_JMP_IMM(BPF_JA, 0, 0, 7),
1119                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 3),
1120                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
1121                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -48),
1122                         BPF_JMP_IMM(BPF_JA, 0, 0, 3),
1123                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 0),
1124                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
1125                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -56),
1126                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1127                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1128                                      BPF_FUNC_map_delete_elem),
1129                         BPF_EXIT_INSN(),
1130                 },
1131                 .fixup_map1 = { 24 },
1132                 .errstr_unpriv = "R1 pointer comparison",
1133                 .result_unpriv = REJECT,
1134                 .result = ACCEPT,
1135                 .retval = -ENOENT,
1136         },
1137         {
1138                 "jump test 4",
1139                 .insns = {
1140                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1141                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1142                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1143                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1144                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1145                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1146                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1147                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1148                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1149                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1150                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1151                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1152                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1153                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1154                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1155                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1156                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1157                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1158                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1159                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1160                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1161                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1162                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1163                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1164                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1165                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1166                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1167                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1168                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1169                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1170                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1171                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1172                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1173                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1174                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1175                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1176                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1177                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1178                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1179                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1180                         BPF_MOV64_IMM(BPF_REG_0, 0),
1181                         BPF_EXIT_INSN(),
1182                 },
1183                 .errstr_unpriv = "R1 pointer comparison",
1184                 .result_unpriv = REJECT,
1185                 .result = ACCEPT,
1186         },
1187         {
1188                 "jump test 5",
1189                 .insns = {
1190                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1191                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
1192                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1193                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1194                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1195                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1196                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1197                         BPF_MOV64_IMM(BPF_REG_0, 0),
1198                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1199                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1200                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1201                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1202                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1203                         BPF_MOV64_IMM(BPF_REG_0, 0),
1204                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1205                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1206                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1207                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1208                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1209                         BPF_MOV64_IMM(BPF_REG_0, 0),
1210                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1211                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1212                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1213                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1214                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1215                         BPF_MOV64_IMM(BPF_REG_0, 0),
1216                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1217                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1218                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1219                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1220                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1221                         BPF_MOV64_IMM(BPF_REG_0, 0),
1222                         BPF_EXIT_INSN(),
1223                 },
1224                 .errstr_unpriv = "R1 pointer comparison",
1225                 .result_unpriv = REJECT,
1226                 .result = ACCEPT,
1227         },
1228         {
1229                 "access skb fields ok",
1230                 .insns = {
1231                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1232                                     offsetof(struct __sk_buff, len)),
1233                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1234                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1235                                     offsetof(struct __sk_buff, mark)),
1236                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1237                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1238                                     offsetof(struct __sk_buff, pkt_type)),
1239                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1240                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1241                                     offsetof(struct __sk_buff, queue_mapping)),
1242                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1243                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1244                                     offsetof(struct __sk_buff, protocol)),
1245                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1246                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1247                                     offsetof(struct __sk_buff, vlan_present)),
1248                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1249                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1250                                     offsetof(struct __sk_buff, vlan_tci)),
1251                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1252                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1253                                     offsetof(struct __sk_buff, napi_id)),
1254                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1255                         BPF_EXIT_INSN(),
1256                 },
1257                 .result = ACCEPT,
1258         },
1259         {
1260                 "access skb fields bad1",
1261                 .insns = {
1262                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -4),
1263                         BPF_EXIT_INSN(),
1264                 },
1265                 .errstr = "invalid bpf_context access",
1266                 .result = REJECT,
1267         },
1268         {
1269                 "access skb fields bad2",
1270                 .insns = {
1271                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 9),
1272                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1273                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1274                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1275                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1276                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1277                                      BPF_FUNC_map_lookup_elem),
1278                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
1279                         BPF_EXIT_INSN(),
1280                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
1281                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1282                                     offsetof(struct __sk_buff, pkt_type)),
1283                         BPF_EXIT_INSN(),
1284                 },
1285                 .fixup_map1 = { 4 },
1286                 .errstr = "different pointers",
1287                 .errstr_unpriv = "R1 pointer comparison",
1288                 .result = REJECT,
1289         },
1290         {
1291                 "access skb fields bad3",
1292                 .insns = {
1293                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1294                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1295                                     offsetof(struct __sk_buff, pkt_type)),
1296                         BPF_EXIT_INSN(),
1297                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1298                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1299                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1300                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1301                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1302                                      BPF_FUNC_map_lookup_elem),
1303                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
1304                         BPF_EXIT_INSN(),
1305                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
1306                         BPF_JMP_IMM(BPF_JA, 0, 0, -12),
1307                 },
1308                 .fixup_map1 = { 6 },
1309                 .errstr = "different pointers",
1310                 .errstr_unpriv = "R1 pointer comparison",
1311                 .result = REJECT,
1312         },
1313         {
1314                 "access skb fields bad4",
1315                 .insns = {
1316                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 3),
1317                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1318                                     offsetof(struct __sk_buff, len)),
1319                         BPF_MOV64_IMM(BPF_REG_0, 0),
1320                         BPF_EXIT_INSN(),
1321                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1322                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1323                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1324                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1325                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1326                                      BPF_FUNC_map_lookup_elem),
1327                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
1328                         BPF_EXIT_INSN(),
1329                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
1330                         BPF_JMP_IMM(BPF_JA, 0, 0, -13),
1331                 },
1332                 .fixup_map1 = { 7 },
1333                 .errstr = "different pointers",
1334                 .errstr_unpriv = "R1 pointer comparison",
1335                 .result = REJECT,
1336         },
1337         {
1338                 "invalid access __sk_buff family",
1339                 .insns = {
1340                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1341                                     offsetof(struct __sk_buff, family)),
1342                         BPF_EXIT_INSN(),
1343                 },
1344                 .errstr = "invalid bpf_context access",
1345                 .result = REJECT,
1346         },
1347         {
1348                 "invalid access __sk_buff remote_ip4",
1349                 .insns = {
1350                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1351                                     offsetof(struct __sk_buff, remote_ip4)),
1352                         BPF_EXIT_INSN(),
1353                 },
1354                 .errstr = "invalid bpf_context access",
1355                 .result = REJECT,
1356         },
1357         {
1358                 "invalid access __sk_buff local_ip4",
1359                 .insns = {
1360                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1361                                     offsetof(struct __sk_buff, local_ip4)),
1362                         BPF_EXIT_INSN(),
1363                 },
1364                 .errstr = "invalid bpf_context access",
1365                 .result = REJECT,
1366         },
1367         {
1368                 "invalid access __sk_buff remote_ip6",
1369                 .insns = {
1370                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1371                                     offsetof(struct __sk_buff, remote_ip6)),
1372                         BPF_EXIT_INSN(),
1373                 },
1374                 .errstr = "invalid bpf_context access",
1375                 .result = REJECT,
1376         },
1377         {
1378                 "invalid access __sk_buff local_ip6",
1379                 .insns = {
1380                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1381                                     offsetof(struct __sk_buff, local_ip6)),
1382                         BPF_EXIT_INSN(),
1383                 },
1384                 .errstr = "invalid bpf_context access",
1385                 .result = REJECT,
1386         },
1387         {
1388                 "invalid access __sk_buff remote_port",
1389                 .insns = {
1390                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1391                                     offsetof(struct __sk_buff, remote_port)),
1392                         BPF_EXIT_INSN(),
1393                 },
1394                 .errstr = "invalid bpf_context access",
1395                 .result = REJECT,
1396         },
1397         {
1398                 "invalid access __sk_buff remote_port",
1399                 .insns = {
1400                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1401                                     offsetof(struct __sk_buff, local_port)),
1402                         BPF_EXIT_INSN(),
1403                 },
1404                 .errstr = "invalid bpf_context access",
1405                 .result = REJECT,
1406         },
1407         {
1408                 "valid access __sk_buff family",
1409                 .insns = {
1410                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1411                                     offsetof(struct __sk_buff, family)),
1412                         BPF_EXIT_INSN(),
1413                 },
1414                 .result = ACCEPT,
1415                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1416         },
1417         {
1418                 "valid access __sk_buff remote_ip4",
1419                 .insns = {
1420                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1421                                     offsetof(struct __sk_buff, remote_ip4)),
1422                         BPF_EXIT_INSN(),
1423                 },
1424                 .result = ACCEPT,
1425                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1426         },
1427         {
1428                 "valid access __sk_buff local_ip4",
1429                 .insns = {
1430                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1431                                     offsetof(struct __sk_buff, local_ip4)),
1432                         BPF_EXIT_INSN(),
1433                 },
1434                 .result = ACCEPT,
1435                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1436         },
1437         {
1438                 "valid access __sk_buff remote_ip6",
1439                 .insns = {
1440                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1441                                     offsetof(struct __sk_buff, remote_ip6[0])),
1442                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1443                                     offsetof(struct __sk_buff, remote_ip6[1])),
1444                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1445                                     offsetof(struct __sk_buff, remote_ip6[2])),
1446                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1447                                     offsetof(struct __sk_buff, remote_ip6[3])),
1448                         BPF_EXIT_INSN(),
1449                 },
1450                 .result = ACCEPT,
1451                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1452         },
1453         {
1454                 "valid access __sk_buff local_ip6",
1455                 .insns = {
1456                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1457                                     offsetof(struct __sk_buff, local_ip6[0])),
1458                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1459                                     offsetof(struct __sk_buff, local_ip6[1])),
1460                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1461                                     offsetof(struct __sk_buff, local_ip6[2])),
1462                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1463                                     offsetof(struct __sk_buff, local_ip6[3])),
1464                         BPF_EXIT_INSN(),
1465                 },
1466                 .result = ACCEPT,
1467                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1468         },
1469         {
1470                 "valid access __sk_buff remote_port",
1471                 .insns = {
1472                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1473                                     offsetof(struct __sk_buff, remote_port)),
1474                         BPF_EXIT_INSN(),
1475                 },
1476                 .result = ACCEPT,
1477                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1478         },
1479         {
1480                 "valid access __sk_buff remote_port",
1481                 .insns = {
1482                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1483                                     offsetof(struct __sk_buff, local_port)),
1484                         BPF_EXIT_INSN(),
1485                 },
1486                 .result = ACCEPT,
1487                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1488         },
1489         {
1490                 "invalid access of tc_classid for SK_SKB",
1491                 .insns = {
1492                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1493                                     offsetof(struct __sk_buff, tc_classid)),
1494                         BPF_EXIT_INSN(),
1495                 },
1496                 .result = REJECT,
1497                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1498                 .errstr = "invalid bpf_context access",
1499         },
1500         {
1501                 "invalid access of skb->mark for SK_SKB",
1502                 .insns = {
1503                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1504                                     offsetof(struct __sk_buff, mark)),
1505                         BPF_EXIT_INSN(),
1506                 },
1507                 .result =  REJECT,
1508                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1509                 .errstr = "invalid bpf_context access",
1510         },
1511         {
1512                 "check skb->mark is not writeable by SK_SKB",
1513                 .insns = {
1514                         BPF_MOV64_IMM(BPF_REG_0, 0),
1515                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1516                                     offsetof(struct __sk_buff, mark)),
1517                         BPF_EXIT_INSN(),
1518                 },
1519                 .result =  REJECT,
1520                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1521                 .errstr = "invalid bpf_context access",
1522         },
1523         {
1524                 "check skb->tc_index is writeable by SK_SKB",
1525                 .insns = {
1526                         BPF_MOV64_IMM(BPF_REG_0, 0),
1527                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1528                                     offsetof(struct __sk_buff, tc_index)),
1529                         BPF_EXIT_INSN(),
1530                 },
1531                 .result = ACCEPT,
1532                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1533         },
1534         {
1535                 "check skb->priority is writeable by SK_SKB",
1536                 .insns = {
1537                         BPF_MOV64_IMM(BPF_REG_0, 0),
1538                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1539                                     offsetof(struct __sk_buff, priority)),
1540                         BPF_EXIT_INSN(),
1541                 },
1542                 .result = ACCEPT,
1543                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1544         },
1545         {
1546                 "direct packet read for SK_SKB",
1547                 .insns = {
1548                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1549                                     offsetof(struct __sk_buff, data)),
1550                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1551                                     offsetof(struct __sk_buff, data_end)),
1552                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1553                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1554                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1555                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
1556                         BPF_MOV64_IMM(BPF_REG_0, 0),
1557                         BPF_EXIT_INSN(),
1558                 },
1559                 .result = ACCEPT,
1560                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1561         },
1562         {
1563                 "direct packet write for SK_SKB",
1564                 .insns = {
1565                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1566                                     offsetof(struct __sk_buff, data)),
1567                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1568                                     offsetof(struct __sk_buff, data_end)),
1569                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1570                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1571                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1572                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
1573                         BPF_MOV64_IMM(BPF_REG_0, 0),
1574                         BPF_EXIT_INSN(),
1575                 },
1576                 .result = ACCEPT,
1577                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1578         },
1579         {
1580                 "overlapping checks for direct packet access SK_SKB",
1581                 .insns = {
1582                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1583                                     offsetof(struct __sk_buff, data)),
1584                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1585                                     offsetof(struct __sk_buff, data_end)),
1586                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1587                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1588                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
1589                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
1590                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
1591                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
1592                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
1593                         BPF_MOV64_IMM(BPF_REG_0, 0),
1594                         BPF_EXIT_INSN(),
1595                 },
1596                 .result = ACCEPT,
1597                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1598         },
1599         {
1600                 "direct packet read for SK_MSG",
1601                 .insns = {
1602                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
1603                                     offsetof(struct sk_msg_md, data)),
1604                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
1605                                     offsetof(struct sk_msg_md, data_end)),
1606                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1607                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1608                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1609                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
1610                         BPF_MOV64_IMM(BPF_REG_0, 0),
1611                         BPF_EXIT_INSN(),
1612                 },
1613                 .result = ACCEPT,
1614                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1615         },
1616         {
1617                 "direct packet write for SK_MSG",
1618                 .insns = {
1619                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
1620                                     offsetof(struct sk_msg_md, data)),
1621                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
1622                                     offsetof(struct sk_msg_md, data_end)),
1623                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1624                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1625                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1626                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
1627                         BPF_MOV64_IMM(BPF_REG_0, 0),
1628                         BPF_EXIT_INSN(),
1629                 },
1630                 .result = ACCEPT,
1631                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1632         },
1633         {
1634                 "overlapping checks for direct packet access SK_MSG",
1635                 .insns = {
1636                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
1637                                     offsetof(struct sk_msg_md, data)),
1638                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
1639                                     offsetof(struct sk_msg_md, data_end)),
1640                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1641                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1642                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
1643                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
1644                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
1645                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
1646                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
1647                         BPF_MOV64_IMM(BPF_REG_0, 0),
1648                         BPF_EXIT_INSN(),
1649                 },
1650                 .result = ACCEPT,
1651                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1652         },
1653         {
1654                 "check skb->mark is not writeable by sockets",
1655                 .insns = {
1656                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1657                                     offsetof(struct __sk_buff, mark)),
1658                         BPF_EXIT_INSN(),
1659                 },
1660                 .errstr = "invalid bpf_context access",
1661                 .errstr_unpriv = "R1 leaks addr",
1662                 .result = REJECT,
1663         },
1664         {
1665                 "check skb->tc_index is not writeable by sockets",
1666                 .insns = {
1667                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1668                                     offsetof(struct __sk_buff, tc_index)),
1669                         BPF_EXIT_INSN(),
1670                 },
1671                 .errstr = "invalid bpf_context access",
1672                 .errstr_unpriv = "R1 leaks addr",
1673                 .result = REJECT,
1674         },
1675         {
1676                 "check cb access: byte",
1677                 .insns = {
1678                         BPF_MOV64_IMM(BPF_REG_0, 0),
1679                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1680                                     offsetof(struct __sk_buff, cb[0])),
1681                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1682                                     offsetof(struct __sk_buff, cb[0]) + 1),
1683                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1684                                     offsetof(struct __sk_buff, cb[0]) + 2),
1685                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1686                                     offsetof(struct __sk_buff, cb[0]) + 3),
1687                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1688                                     offsetof(struct __sk_buff, cb[1])),
1689                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1690                                     offsetof(struct __sk_buff, cb[1]) + 1),
1691                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1692                                     offsetof(struct __sk_buff, cb[1]) + 2),
1693                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1694                                     offsetof(struct __sk_buff, cb[1]) + 3),
1695                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1696                                     offsetof(struct __sk_buff, cb[2])),
1697                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1698                                     offsetof(struct __sk_buff, cb[2]) + 1),
1699                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1700                                     offsetof(struct __sk_buff, cb[2]) + 2),
1701                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1702                                     offsetof(struct __sk_buff, cb[2]) + 3),
1703                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1704                                     offsetof(struct __sk_buff, cb[3])),
1705                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1706                                     offsetof(struct __sk_buff, cb[3]) + 1),
1707                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1708                                     offsetof(struct __sk_buff, cb[3]) + 2),
1709                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1710                                     offsetof(struct __sk_buff, cb[3]) + 3),
1711                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1712                                     offsetof(struct __sk_buff, cb[4])),
1713                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1714                                     offsetof(struct __sk_buff, cb[4]) + 1),
1715                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1716                                     offsetof(struct __sk_buff, cb[4]) + 2),
1717                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1718                                     offsetof(struct __sk_buff, cb[4]) + 3),
1719                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1720                                     offsetof(struct __sk_buff, cb[0])),
1721                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1722                                     offsetof(struct __sk_buff, cb[0]) + 1),
1723                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1724                                     offsetof(struct __sk_buff, cb[0]) + 2),
1725                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1726                                     offsetof(struct __sk_buff, cb[0]) + 3),
1727                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1728                                     offsetof(struct __sk_buff, cb[1])),
1729                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1730                                     offsetof(struct __sk_buff, cb[1]) + 1),
1731                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1732                                     offsetof(struct __sk_buff, cb[1]) + 2),
1733                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1734                                     offsetof(struct __sk_buff, cb[1]) + 3),
1735                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1736                                     offsetof(struct __sk_buff, cb[2])),
1737                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1738                                     offsetof(struct __sk_buff, cb[2]) + 1),
1739                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1740                                     offsetof(struct __sk_buff, cb[2]) + 2),
1741                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1742                                     offsetof(struct __sk_buff, cb[2]) + 3),
1743                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1744                                     offsetof(struct __sk_buff, cb[3])),
1745                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1746                                     offsetof(struct __sk_buff, cb[3]) + 1),
1747                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1748                                     offsetof(struct __sk_buff, cb[3]) + 2),
1749                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1750                                     offsetof(struct __sk_buff, cb[3]) + 3),
1751                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1752                                     offsetof(struct __sk_buff, cb[4])),
1753                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1754                                     offsetof(struct __sk_buff, cb[4]) + 1),
1755                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1756                                     offsetof(struct __sk_buff, cb[4]) + 2),
1757                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1758                                     offsetof(struct __sk_buff, cb[4]) + 3),
1759                         BPF_EXIT_INSN(),
1760                 },
1761                 .result = ACCEPT,
1762         },
1763         {
1764                 "__sk_buff->hash, offset 0, byte store not permitted",
1765                 .insns = {
1766                         BPF_MOV64_IMM(BPF_REG_0, 0),
1767                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1768                                     offsetof(struct __sk_buff, hash)),
1769                         BPF_EXIT_INSN(),
1770                 },
1771                 .errstr = "invalid bpf_context access",
1772                 .result = REJECT,
1773         },
1774         {
1775                 "__sk_buff->tc_index, offset 3, byte store not permitted",
1776                 .insns = {
1777                         BPF_MOV64_IMM(BPF_REG_0, 0),
1778                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1779                                     offsetof(struct __sk_buff, tc_index) + 3),
1780                         BPF_EXIT_INSN(),
1781                 },
1782                 .errstr = "invalid bpf_context access",
1783                 .result = REJECT,
1784         },
1785         {
1786                 "check skb->hash byte load permitted",
1787                 .insns = {
1788                         BPF_MOV64_IMM(BPF_REG_0, 0),
1789 #if __BYTE_ORDER == __LITTLE_ENDIAN
1790                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1791                                     offsetof(struct __sk_buff, hash)),
1792 #else
1793                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1794                                     offsetof(struct __sk_buff, hash) + 3),
1795 #endif
1796                         BPF_EXIT_INSN(),
1797                 },
1798                 .result = ACCEPT,
1799         },
1800         {
1801                 "check skb->hash byte load not permitted 1",
1802                 .insns = {
1803                         BPF_MOV64_IMM(BPF_REG_0, 0),
1804                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1805                                     offsetof(struct __sk_buff, hash) + 1),
1806                         BPF_EXIT_INSN(),
1807                 },
1808                 .errstr = "invalid bpf_context access",
1809                 .result = REJECT,
1810         },
1811         {
1812                 "check skb->hash byte load not permitted 2",
1813                 .insns = {
1814                         BPF_MOV64_IMM(BPF_REG_0, 0),
1815                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1816                                     offsetof(struct __sk_buff, hash) + 2),
1817                         BPF_EXIT_INSN(),
1818                 },
1819                 .errstr = "invalid bpf_context access",
1820                 .result = REJECT,
1821         },
1822         {
1823                 "check skb->hash byte load not permitted 3",
1824                 .insns = {
1825                         BPF_MOV64_IMM(BPF_REG_0, 0),
1826 #if __BYTE_ORDER == __LITTLE_ENDIAN
1827                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1828                                     offsetof(struct __sk_buff, hash) + 3),
1829 #else
1830                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1831                                     offsetof(struct __sk_buff, hash)),
1832 #endif
1833                         BPF_EXIT_INSN(),
1834                 },
1835                 .errstr = "invalid bpf_context access",
1836                 .result = REJECT,
1837         },
1838         {
1839                 "check cb access: byte, wrong type",
1840                 .insns = {
1841                         BPF_MOV64_IMM(BPF_REG_0, 0),
1842                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1843                                     offsetof(struct __sk_buff, cb[0])),
1844                         BPF_EXIT_INSN(),
1845                 },
1846                 .errstr = "invalid bpf_context access",
1847                 .result = REJECT,
1848                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
1849         },
1850         {
1851                 "check cb access: half",
1852                 .insns = {
1853                         BPF_MOV64_IMM(BPF_REG_0, 0),
1854                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1855                                     offsetof(struct __sk_buff, cb[0])),
1856                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1857                                     offsetof(struct __sk_buff, cb[0]) + 2),
1858                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1859                                     offsetof(struct __sk_buff, cb[1])),
1860                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1861                                     offsetof(struct __sk_buff, cb[1]) + 2),
1862                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1863                                     offsetof(struct __sk_buff, cb[2])),
1864                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1865                                     offsetof(struct __sk_buff, cb[2]) + 2),
1866                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1867                                     offsetof(struct __sk_buff, cb[3])),
1868                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1869                                     offsetof(struct __sk_buff, cb[3]) + 2),
1870                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1871                                     offsetof(struct __sk_buff, cb[4])),
1872                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1873                                     offsetof(struct __sk_buff, cb[4]) + 2),
1874                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1875                                     offsetof(struct __sk_buff, cb[0])),
1876                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1877                                     offsetof(struct __sk_buff, cb[0]) + 2),
1878                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1879                                     offsetof(struct __sk_buff, cb[1])),
1880                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1881                                     offsetof(struct __sk_buff, cb[1]) + 2),
1882                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1883                                     offsetof(struct __sk_buff, cb[2])),
1884                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1885                                     offsetof(struct __sk_buff, cb[2]) + 2),
1886                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1887                                     offsetof(struct __sk_buff, cb[3])),
1888                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1889                                     offsetof(struct __sk_buff, cb[3]) + 2),
1890                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1891                                     offsetof(struct __sk_buff, cb[4])),
1892                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1893                                     offsetof(struct __sk_buff, cb[4]) + 2),
1894                         BPF_EXIT_INSN(),
1895                 },
1896                 .result = ACCEPT,
1897         },
1898         {
1899                 "check cb access: half, unaligned",
1900                 .insns = {
1901                         BPF_MOV64_IMM(BPF_REG_0, 0),
1902                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1903                                     offsetof(struct __sk_buff, cb[0]) + 1),
1904                         BPF_EXIT_INSN(),
1905                 },
1906                 .errstr = "misaligned context access",
1907                 .result = REJECT,
1908                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1909         },
1910         {
1911                 "check __sk_buff->hash, offset 0, half store not permitted",
1912                 .insns = {
1913                         BPF_MOV64_IMM(BPF_REG_0, 0),
1914                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1915                                     offsetof(struct __sk_buff, hash)),
1916                         BPF_EXIT_INSN(),
1917                 },
1918                 .errstr = "invalid bpf_context access",
1919                 .result = REJECT,
1920         },
1921         {
1922                 "check __sk_buff->tc_index, offset 2, half store not permitted",
1923                 .insns = {
1924                         BPF_MOV64_IMM(BPF_REG_0, 0),
1925                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1926                                     offsetof(struct __sk_buff, tc_index) + 2),
1927                         BPF_EXIT_INSN(),
1928                 },
1929                 .errstr = "invalid bpf_context access",
1930                 .result = REJECT,
1931         },
1932         {
1933                 "check skb->hash half load permitted",
1934                 .insns = {
1935                         BPF_MOV64_IMM(BPF_REG_0, 0),
1936 #if __BYTE_ORDER == __LITTLE_ENDIAN
1937                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1938                                     offsetof(struct __sk_buff, hash)),
1939 #else
1940                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1941                                     offsetof(struct __sk_buff, hash) + 2),
1942 #endif
1943                         BPF_EXIT_INSN(),
1944                 },
1945                 .result = ACCEPT,
1946         },
1947         {
1948                 "check skb->hash half load not permitted",
1949                 .insns = {
1950                         BPF_MOV64_IMM(BPF_REG_0, 0),
1951 #if __BYTE_ORDER == __LITTLE_ENDIAN
1952                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1953                                     offsetof(struct __sk_buff, hash) + 2),
1954 #else
1955                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
1956                                     offsetof(struct __sk_buff, hash)),
1957 #endif
1958                         BPF_EXIT_INSN(),
1959                 },
1960                 .errstr = "invalid bpf_context access",
1961                 .result = REJECT,
1962         },
1963         {
1964                 "check cb access: half, wrong type",
1965                 .insns = {
1966                         BPF_MOV64_IMM(BPF_REG_0, 0),
1967                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
1968                                     offsetof(struct __sk_buff, cb[0])),
1969                         BPF_EXIT_INSN(),
1970                 },
1971                 .errstr = "invalid bpf_context access",
1972                 .result = REJECT,
1973                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
1974         },
1975         {
1976                 "check cb access: word",
1977                 .insns = {
1978                         BPF_MOV64_IMM(BPF_REG_0, 0),
1979                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1980                                     offsetof(struct __sk_buff, cb[0])),
1981                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1982                                     offsetof(struct __sk_buff, cb[1])),
1983                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1984                                     offsetof(struct __sk_buff, cb[2])),
1985                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1986                                     offsetof(struct __sk_buff, cb[3])),
1987                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1988                                     offsetof(struct __sk_buff, cb[4])),
1989                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1990                                     offsetof(struct __sk_buff, cb[0])),
1991                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1992                                     offsetof(struct __sk_buff, cb[1])),
1993                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1994                                     offsetof(struct __sk_buff, cb[2])),
1995                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1996                                     offsetof(struct __sk_buff, cb[3])),
1997                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1998                                     offsetof(struct __sk_buff, cb[4])),
1999                         BPF_EXIT_INSN(),
2000                 },
2001                 .result = ACCEPT,
2002         },
2003         {
2004                 "check cb access: word, unaligned 1",
2005                 .insns = {
2006                         BPF_MOV64_IMM(BPF_REG_0, 0),
2007                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2008                                     offsetof(struct __sk_buff, cb[0]) + 2),
2009                         BPF_EXIT_INSN(),
2010                 },
2011                 .errstr = "misaligned context access",
2012                 .result = REJECT,
2013                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2014         },
2015         {
2016                 "check cb access: word, unaligned 2",
2017                 .insns = {
2018                         BPF_MOV64_IMM(BPF_REG_0, 0),
2019                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2020                                     offsetof(struct __sk_buff, cb[4]) + 1),
2021                         BPF_EXIT_INSN(),
2022                 },
2023                 .errstr = "misaligned context access",
2024                 .result = REJECT,
2025                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2026         },
2027         {
2028                 "check cb access: word, unaligned 3",
2029                 .insns = {
2030                         BPF_MOV64_IMM(BPF_REG_0, 0),
2031                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2032                                     offsetof(struct __sk_buff, cb[4]) + 2),
2033                         BPF_EXIT_INSN(),
2034                 },
2035                 .errstr = "misaligned context access",
2036                 .result = REJECT,
2037                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2038         },
2039         {
2040                 "check cb access: word, unaligned 4",
2041                 .insns = {
2042                         BPF_MOV64_IMM(BPF_REG_0, 0),
2043                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2044                                     offsetof(struct __sk_buff, cb[4]) + 3),
2045                         BPF_EXIT_INSN(),
2046                 },
2047                 .errstr = "misaligned context access",
2048                 .result = REJECT,
2049                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2050         },
2051         {
2052                 "check cb access: double",
2053                 .insns = {
2054                         BPF_MOV64_IMM(BPF_REG_0, 0),
2055                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2056                                     offsetof(struct __sk_buff, cb[0])),
2057                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2058                                     offsetof(struct __sk_buff, cb[2])),
2059                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2060                                     offsetof(struct __sk_buff, cb[0])),
2061                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2062                                     offsetof(struct __sk_buff, cb[2])),
2063                         BPF_EXIT_INSN(),
2064                 },
2065                 .result = ACCEPT,
2066         },
2067         {
2068                 "check cb access: double, unaligned 1",
2069                 .insns = {
2070                         BPF_MOV64_IMM(BPF_REG_0, 0),
2071                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2072                                     offsetof(struct __sk_buff, cb[1])),
2073                         BPF_EXIT_INSN(),
2074                 },
2075                 .errstr = "misaligned context access",
2076                 .result = REJECT,
2077                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2078         },
2079         {
2080                 "check cb access: double, unaligned 2",
2081                 .insns = {
2082                         BPF_MOV64_IMM(BPF_REG_0, 0),
2083                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2084                                     offsetof(struct __sk_buff, cb[3])),
2085                         BPF_EXIT_INSN(),
2086                 },
2087                 .errstr = "misaligned context access",
2088                 .result = REJECT,
2089                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2090         },
2091         {
2092                 "check cb access: double, oob 1",
2093                 .insns = {
2094                         BPF_MOV64_IMM(BPF_REG_0, 0),
2095                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2096                                     offsetof(struct __sk_buff, cb[4])),
2097                         BPF_EXIT_INSN(),
2098                 },
2099                 .errstr = "invalid bpf_context access",
2100                 .result = REJECT,
2101         },
2102         {
2103                 "check cb access: double, oob 2",
2104                 .insns = {
2105                         BPF_MOV64_IMM(BPF_REG_0, 0),
2106                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2107                                     offsetof(struct __sk_buff, cb[4])),
2108                         BPF_EXIT_INSN(),
2109                 },
2110                 .errstr = "invalid bpf_context access",
2111                 .result = REJECT,
2112         },
2113         {
2114                 "check __sk_buff->ifindex dw store not permitted",
2115                 .insns = {
2116                         BPF_MOV64_IMM(BPF_REG_0, 0),
2117                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2118                                     offsetof(struct __sk_buff, ifindex)),
2119                         BPF_EXIT_INSN(),
2120                 },
2121                 .errstr = "invalid bpf_context access",
2122                 .result = REJECT,
2123         },
2124         {
2125                 "check __sk_buff->ifindex dw load not permitted",
2126                 .insns = {
2127                         BPF_MOV64_IMM(BPF_REG_0, 0),
2128                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2129                                     offsetof(struct __sk_buff, ifindex)),
2130                         BPF_EXIT_INSN(),
2131                 },
2132                 .errstr = "invalid bpf_context access",
2133                 .result = REJECT,
2134         },
2135         {
2136                 "check cb access: double, wrong type",
2137                 .insns = {
2138                         BPF_MOV64_IMM(BPF_REG_0, 0),
2139                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2140                                     offsetof(struct __sk_buff, cb[0])),
2141                         BPF_EXIT_INSN(),
2142                 },
2143                 .errstr = "invalid bpf_context access",
2144                 .result = REJECT,
2145                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
2146         },
2147         {
2148                 "check out of range skb->cb access",
2149                 .insns = {
2150                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2151                                     offsetof(struct __sk_buff, cb[0]) + 256),
2152                         BPF_EXIT_INSN(),
2153                 },
2154                 .errstr = "invalid bpf_context access",
2155                 .errstr_unpriv = "",
2156                 .result = REJECT,
2157                 .prog_type = BPF_PROG_TYPE_SCHED_ACT,
2158         },
2159         {
2160                 "write skb fields from socket prog",
2161                 .insns = {
2162                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2163                                     offsetof(struct __sk_buff, cb[4])),
2164                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
2165                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2166                                     offsetof(struct __sk_buff, mark)),
2167                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2168                                     offsetof(struct __sk_buff, tc_index)),
2169                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
2170                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
2171                                     offsetof(struct __sk_buff, cb[0])),
2172                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
2173                                     offsetof(struct __sk_buff, cb[2])),
2174                         BPF_EXIT_INSN(),
2175                 },
2176                 .result = ACCEPT,
2177                 .errstr_unpriv = "R1 leaks addr",
2178                 .result_unpriv = REJECT,
2179         },
2180         {
2181                 "write skb fields from tc_cls_act prog",
2182                 .insns = {
2183                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2184                                     offsetof(struct __sk_buff, cb[0])),
2185                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2186                                     offsetof(struct __sk_buff, mark)),
2187                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2188                                     offsetof(struct __sk_buff, tc_index)),
2189                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2190                                     offsetof(struct __sk_buff, tc_index)),
2191                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2192                                     offsetof(struct __sk_buff, cb[3])),
2193                         BPF_EXIT_INSN(),
2194                 },
2195                 .errstr_unpriv = "",
2196                 .result_unpriv = REJECT,
2197                 .result = ACCEPT,
2198                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2199         },
2200         {
2201                 "PTR_TO_STACK store/load",
2202                 .insns = {
2203                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2204                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
2205                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
2206                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
2207                         BPF_EXIT_INSN(),
2208                 },
2209                 .result = ACCEPT,
2210                 .retval = 0xfaceb00c,
2211         },
2212         {
2213                 "PTR_TO_STACK store/load - bad alignment on off",
2214                 .insns = {
2215                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2216                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
2217                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
2218                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
2219                         BPF_EXIT_INSN(),
2220                 },
2221                 .result = REJECT,
2222                 .errstr = "misaligned stack access off (0x0; 0x0)+-8+2 size 8",
2223         },
2224         {
2225                 "PTR_TO_STACK store/load - bad alignment on reg",
2226                 .insns = {
2227                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2228                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
2229                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
2230                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
2231                         BPF_EXIT_INSN(),
2232                 },
2233                 .result = REJECT,
2234                 .errstr = "misaligned stack access off (0x0; 0x0)+-10+8 size 8",
2235         },
2236         {
2237                 "PTR_TO_STACK store/load - out of bounds low",
2238                 .insns = {
2239                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2240                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -80000),
2241                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
2242                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
2243                         BPF_EXIT_INSN(),
2244                 },
2245                 .result = REJECT,
2246                 .errstr = "invalid stack off=-79992 size=8",
2247         },
2248         {
2249                 "PTR_TO_STACK store/load - out of bounds high",
2250                 .insns = {
2251                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2252                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
2253                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
2254                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
2255                         BPF_EXIT_INSN(),
2256                 },
2257                 .result = REJECT,
2258                 .errstr = "invalid stack off=0 size=8",
2259         },
2260         {
2261                 "unpriv: return pointer",
2262                 .insns = {
2263                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
2264                         BPF_EXIT_INSN(),
2265                 },
2266                 .result = ACCEPT,
2267                 .result_unpriv = REJECT,
2268                 .errstr_unpriv = "R0 leaks addr",
2269                 .retval = POINTER_VALUE,
2270         },
2271         {
2272                 "unpriv: add const to pointer",
2273                 .insns = {
2274                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
2275                         BPF_MOV64_IMM(BPF_REG_0, 0),
2276                         BPF_EXIT_INSN(),
2277                 },
2278                 .result = ACCEPT,
2279         },
2280         {
2281                 "unpriv: add pointer to pointer",
2282                 .insns = {
2283                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
2284                         BPF_MOV64_IMM(BPF_REG_0, 0),
2285                         BPF_EXIT_INSN(),
2286                 },
2287                 .result = REJECT,
2288                 .errstr = "R1 pointer += pointer",
2289         },
2290         {
2291                 "unpriv: neg pointer",
2292                 .insns = {
2293                         BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0),
2294                         BPF_MOV64_IMM(BPF_REG_0, 0),
2295                         BPF_EXIT_INSN(),
2296                 },
2297                 .result = ACCEPT,
2298                 .result_unpriv = REJECT,
2299                 .errstr_unpriv = "R1 pointer arithmetic",
2300         },
2301         {
2302                 "unpriv: cmp pointer with const",
2303                 .insns = {
2304                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
2305                         BPF_MOV64_IMM(BPF_REG_0, 0),
2306                         BPF_EXIT_INSN(),
2307                 },
2308                 .result = ACCEPT,
2309                 .result_unpriv = REJECT,
2310                 .errstr_unpriv = "R1 pointer comparison",
2311         },
2312         {
2313                 "unpriv: cmp pointer with pointer",
2314                 .insns = {
2315                         BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
2316                         BPF_MOV64_IMM(BPF_REG_0, 0),
2317                         BPF_EXIT_INSN(),
2318                 },
2319                 .result = ACCEPT,
2320                 .result_unpriv = REJECT,
2321                 .errstr_unpriv = "R10 pointer comparison",
2322         },
2323         {
2324                 "unpriv: check that printk is disallowed",
2325                 .insns = {
2326                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2327                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2328                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
2329                         BPF_MOV64_IMM(BPF_REG_2, 8),
2330                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
2331                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2332                                      BPF_FUNC_trace_printk),
2333                         BPF_MOV64_IMM(BPF_REG_0, 0),
2334                         BPF_EXIT_INSN(),
2335                 },
2336                 .errstr_unpriv = "unknown func bpf_trace_printk#6",
2337                 .result_unpriv = REJECT,
2338                 .result = ACCEPT,
2339         },
2340         {
2341                 "unpriv: pass pointer to helper function",
2342                 .insns = {
2343                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2344                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2345                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2346                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2347                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
2348                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2349                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2350                                      BPF_FUNC_map_update_elem),
2351                         BPF_MOV64_IMM(BPF_REG_0, 0),
2352                         BPF_EXIT_INSN(),
2353                 },
2354                 .fixup_map1 = { 3 },
2355                 .errstr_unpriv = "R4 leaks addr",
2356                 .result_unpriv = REJECT,
2357                 .result = ACCEPT,
2358         },
2359         {
2360                 "unpriv: indirectly pass pointer on stack to helper function",
2361                 .insns = {
2362                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2363                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2364                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2365                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2366                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2367                                      BPF_FUNC_map_lookup_elem),
2368                         BPF_MOV64_IMM(BPF_REG_0, 0),
2369                         BPF_EXIT_INSN(),
2370                 },
2371                 .fixup_map1 = { 3 },
2372                 .errstr = "invalid indirect read from stack off -8+0 size 8",
2373                 .result = REJECT,
2374         },
2375         {
2376                 "unpriv: mangle pointer on stack 1",
2377                 .insns = {
2378                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2379                         BPF_ST_MEM(BPF_W, BPF_REG_10, -8, 0),
2380                         BPF_MOV64_IMM(BPF_REG_0, 0),
2381                         BPF_EXIT_INSN(),
2382                 },
2383                 .errstr_unpriv = "attempt to corrupt spilled",
2384                 .result_unpriv = REJECT,
2385                 .result = ACCEPT,
2386         },
2387         {
2388                 "unpriv: mangle pointer on stack 2",
2389                 .insns = {
2390                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2391                         BPF_ST_MEM(BPF_B, BPF_REG_10, -1, 0),
2392                         BPF_MOV64_IMM(BPF_REG_0, 0),
2393                         BPF_EXIT_INSN(),
2394                 },
2395                 .errstr_unpriv = "attempt to corrupt spilled",
2396                 .result_unpriv = REJECT,
2397                 .result = ACCEPT,
2398         },
2399         {
2400                 "unpriv: read pointer from stack in small chunks",
2401                 .insns = {
2402                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2403                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -8),
2404                         BPF_MOV64_IMM(BPF_REG_0, 0),
2405                         BPF_EXIT_INSN(),
2406                 },
2407                 .errstr = "invalid size",
2408                 .result = REJECT,
2409         },
2410         {
2411                 "unpriv: write pointer into ctx",
2412                 .insns = {
2413                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
2414                         BPF_MOV64_IMM(BPF_REG_0, 0),
2415                         BPF_EXIT_INSN(),
2416                 },
2417                 .errstr_unpriv = "R1 leaks addr",
2418                 .result_unpriv = REJECT,
2419                 .errstr = "invalid bpf_context access",
2420                 .result = REJECT,
2421         },
2422         {
2423                 "unpriv: spill/fill of ctx",
2424                 .insns = {
2425                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2426                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2427                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2428                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2429                         BPF_MOV64_IMM(BPF_REG_0, 0),
2430                         BPF_EXIT_INSN(),
2431                 },
2432                 .result = ACCEPT,
2433         },
2434         {
2435                 "unpriv: spill/fill of ctx 2",
2436                 .insns = {
2437                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2438                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2439                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2440                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2441                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2442                                      BPF_FUNC_get_hash_recalc),
2443                         BPF_MOV64_IMM(BPF_REG_0, 0),
2444                         BPF_EXIT_INSN(),
2445                 },
2446                 .result = ACCEPT,
2447                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2448         },
2449         {
2450                 "unpriv: spill/fill of ctx 3",
2451                 .insns = {
2452                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2453                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2454                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2455                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
2456                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2457                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2458                                      BPF_FUNC_get_hash_recalc),
2459                         BPF_EXIT_INSN(),
2460                 },
2461                 .result = REJECT,
2462                 .errstr = "R1 type=fp expected=ctx",
2463                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2464         },
2465         {
2466                 "unpriv: spill/fill of ctx 4",
2467                 .insns = {
2468                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2469                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2470                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2471                         BPF_MOV64_IMM(BPF_REG_0, 1),
2472                         BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_10,
2473                                      BPF_REG_0, -8, 0),
2474                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2475                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2476                                      BPF_FUNC_get_hash_recalc),
2477                         BPF_EXIT_INSN(),
2478                 },
2479                 .result = REJECT,
2480                 .errstr = "R1 type=inv expected=ctx",
2481                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2482         },
2483         {
2484                 "unpriv: spill/fill of different pointers stx",
2485                 .insns = {
2486                         BPF_MOV64_IMM(BPF_REG_3, 42),
2487                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2488                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2489                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
2490                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2491                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
2492                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
2493                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
2494                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2495                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2496                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
2497                                     offsetof(struct __sk_buff, mark)),
2498                         BPF_MOV64_IMM(BPF_REG_0, 0),
2499                         BPF_EXIT_INSN(),
2500                 },
2501                 .result = REJECT,
2502                 .errstr = "same insn cannot be used with different pointers",
2503                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2504         },
2505         {
2506                 "unpriv: spill/fill of different pointers ldx",
2507                 .insns = {
2508                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2509                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2510                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
2511                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2512                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
2513                                       -(__s32)offsetof(struct bpf_perf_event_data,
2514                                                        sample_period) - 8),
2515                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
2516                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
2517                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2518                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2519                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1,
2520                                     offsetof(struct bpf_perf_event_data,
2521                                              sample_period)),
2522                         BPF_MOV64_IMM(BPF_REG_0, 0),
2523                         BPF_EXIT_INSN(),
2524                 },
2525                 .result = REJECT,
2526                 .errstr = "same insn cannot be used with different pointers",
2527                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
2528         },
2529         {
2530                 "unpriv: write pointer into map elem value",
2531                 .insns = {
2532                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2533                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2534                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2535                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2536                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2537                                      BPF_FUNC_map_lookup_elem),
2538                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
2539                         BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
2540                         BPF_EXIT_INSN(),
2541                 },
2542                 .fixup_map1 = { 3 },
2543                 .errstr_unpriv = "R0 leaks addr",
2544                 .result_unpriv = REJECT,
2545                 .result = ACCEPT,
2546         },
2547         {
2548                 "unpriv: partial copy of pointer",
2549                 .insns = {
2550                         BPF_MOV32_REG(BPF_REG_1, BPF_REG_10),
2551                         BPF_MOV64_IMM(BPF_REG_0, 0),
2552                         BPF_EXIT_INSN(),
2553                 },
2554                 .errstr_unpriv = "R10 partial copy",
2555                 .result_unpriv = REJECT,
2556                 .result = ACCEPT,
2557         },
2558         {
2559                 "unpriv: pass pointer to tail_call",
2560                 .insns = {
2561                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
2562                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2563                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2564                                      BPF_FUNC_tail_call),
2565                         BPF_MOV64_IMM(BPF_REG_0, 0),
2566                         BPF_EXIT_INSN(),
2567                 },
2568                 .fixup_prog = { 1 },
2569                 .errstr_unpriv = "R3 leaks addr into helper",
2570                 .result_unpriv = REJECT,
2571                 .result = ACCEPT,
2572         },
2573         {
2574                 "unpriv: cmp map pointer with zero",
2575                 .insns = {
2576                         BPF_MOV64_IMM(BPF_REG_1, 0),
2577                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2578                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
2579                         BPF_MOV64_IMM(BPF_REG_0, 0),
2580                         BPF_EXIT_INSN(),
2581                 },
2582                 .fixup_map1 = { 1 },
2583                 .errstr_unpriv = "R1 pointer comparison",
2584                 .result_unpriv = REJECT,
2585                 .result = ACCEPT,
2586         },
2587         {
2588                 "unpriv: write into frame pointer",
2589                 .insns = {
2590                         BPF_MOV64_REG(BPF_REG_10, BPF_REG_1),
2591                         BPF_MOV64_IMM(BPF_REG_0, 0),
2592                         BPF_EXIT_INSN(),
2593                 },
2594                 .errstr = "frame pointer is read only",
2595                 .result = REJECT,
2596         },
2597         {
2598                 "unpriv: spill/fill frame pointer",
2599                 .insns = {
2600                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2601                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2602                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
2603                         BPF_LDX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, 0),
2604                         BPF_MOV64_IMM(BPF_REG_0, 0),
2605                         BPF_EXIT_INSN(),
2606                 },
2607                 .errstr = "frame pointer is read only",
2608                 .result = REJECT,
2609         },
2610         {
2611                 "unpriv: cmp of frame pointer",
2612                 .insns = {
2613                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_10, 0, 0),
2614                         BPF_MOV64_IMM(BPF_REG_0, 0),
2615                         BPF_EXIT_INSN(),
2616                 },
2617                 .errstr_unpriv = "R10 pointer comparison",
2618                 .result_unpriv = REJECT,
2619                 .result = ACCEPT,
2620         },
2621         {
2622                 "unpriv: adding of fp",
2623                 .insns = {
2624                         BPF_MOV64_IMM(BPF_REG_0, 0),
2625                         BPF_MOV64_IMM(BPF_REG_1, 0),
2626                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
2627                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, -8),
2628                         BPF_EXIT_INSN(),
2629                 },
2630                 .result = ACCEPT,
2631         },
2632         {
2633                 "unpriv: cmp of stack pointer",
2634                 .insns = {
2635                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2636                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2637                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_2, 0, 0),
2638                         BPF_MOV64_IMM(BPF_REG_0, 0),
2639                         BPF_EXIT_INSN(),
2640                 },
2641                 .errstr_unpriv = "R2 pointer comparison",
2642                 .result_unpriv = REJECT,
2643                 .result = ACCEPT,
2644         },
2645         {
2646                 "runtime/jit: tail_call within bounds, prog once",
2647                 .insns = {
2648                         BPF_MOV64_IMM(BPF_REG_3, 0),
2649                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2650                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2651                                      BPF_FUNC_tail_call),
2652                         BPF_MOV64_IMM(BPF_REG_0, 1),
2653                         BPF_EXIT_INSN(),
2654                 },
2655                 .fixup_prog = { 1 },
2656                 .result = ACCEPT,
2657                 .retval = 42,
2658         },
2659         {
2660                 "runtime/jit: tail_call within bounds, prog loop",
2661                 .insns = {
2662                         BPF_MOV64_IMM(BPF_REG_3, 1),
2663                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2664                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2665                                      BPF_FUNC_tail_call),
2666                         BPF_MOV64_IMM(BPF_REG_0, 1),
2667                         BPF_EXIT_INSN(),
2668                 },
2669                 .fixup_prog = { 1 },
2670                 .result = ACCEPT,
2671                 .retval = 41,
2672         },
2673         {
2674                 "runtime/jit: tail_call within bounds, no prog",
2675                 .insns = {
2676                         BPF_MOV64_IMM(BPF_REG_3, 2),
2677                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2678                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2679                                      BPF_FUNC_tail_call),
2680                         BPF_MOV64_IMM(BPF_REG_0, 1),
2681                         BPF_EXIT_INSN(),
2682                 },
2683                 .fixup_prog = { 1 },
2684                 .result = ACCEPT,
2685                 .retval = 1,
2686         },
2687         {
2688                 "runtime/jit: tail_call out of bounds",
2689                 .insns = {
2690                         BPF_MOV64_IMM(BPF_REG_3, 256),
2691                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2692                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2693                                      BPF_FUNC_tail_call),
2694                         BPF_MOV64_IMM(BPF_REG_0, 2),
2695                         BPF_EXIT_INSN(),
2696                 },
2697                 .fixup_prog = { 1 },
2698                 .result = ACCEPT,
2699                 .retval = 2,
2700         },
2701         {
2702                 "runtime/jit: pass negative index to tail_call",
2703                 .insns = {
2704                         BPF_MOV64_IMM(BPF_REG_3, -1),
2705                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2706                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2707                                      BPF_FUNC_tail_call),
2708                         BPF_MOV64_IMM(BPF_REG_0, 2),
2709                         BPF_EXIT_INSN(),
2710                 },
2711                 .fixup_prog = { 1 },
2712                 .result = ACCEPT,
2713                 .retval = 2,
2714         },
2715         {
2716                 "runtime/jit: pass > 32bit index to tail_call",
2717                 .insns = {
2718                         BPF_LD_IMM64(BPF_REG_3, 0x100000000ULL),
2719                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2720                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2721                                      BPF_FUNC_tail_call),
2722                         BPF_MOV64_IMM(BPF_REG_0, 2),
2723                         BPF_EXIT_INSN(),
2724                 },
2725                 .fixup_prog = { 2 },
2726                 .result = ACCEPT,
2727                 .retval = 42,
2728         },
2729         {
2730                 "stack pointer arithmetic",
2731                 .insns = {
2732                         BPF_MOV64_IMM(BPF_REG_1, 4),
2733                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
2734                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
2735                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
2736                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
2737                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
2738                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_1),
2739                         BPF_ST_MEM(0, BPF_REG_2, 4, 0),
2740                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
2741                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
2742                         BPF_ST_MEM(0, BPF_REG_2, 4, 0),
2743                         BPF_MOV64_IMM(BPF_REG_0, 0),
2744                         BPF_EXIT_INSN(),
2745                 },
2746                 .result = ACCEPT,
2747         },
2748         {
2749                 "raw_stack: no skb_load_bytes",
2750                 .insns = {
2751                         BPF_MOV64_IMM(BPF_REG_2, 4),
2752                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2753                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2754                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2755                         BPF_MOV64_IMM(BPF_REG_4, 8),
2756                         /* Call to skb_load_bytes() omitted. */
2757                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2758                         BPF_EXIT_INSN(),
2759                 },
2760                 .result = REJECT,
2761                 .errstr = "invalid read from stack off -8+0 size 8",
2762                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2763         },
2764         {
2765                 "raw_stack: skb_load_bytes, negative len",
2766                 .insns = {
2767                         BPF_MOV64_IMM(BPF_REG_2, 4),
2768                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2769                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2770                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2771                         BPF_MOV64_IMM(BPF_REG_4, -8),
2772                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2773                                      BPF_FUNC_skb_load_bytes),
2774                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2775                         BPF_EXIT_INSN(),
2776                 },
2777                 .result = REJECT,
2778                 .errstr = "R4 min value is negative",
2779                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2780         },
2781         {
2782                 "raw_stack: skb_load_bytes, negative len 2",
2783                 .insns = {
2784                         BPF_MOV64_IMM(BPF_REG_2, 4),
2785                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2786                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2787                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2788                         BPF_MOV64_IMM(BPF_REG_4, ~0),
2789                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2790                                      BPF_FUNC_skb_load_bytes),
2791                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2792                         BPF_EXIT_INSN(),
2793                 },
2794                 .result = REJECT,
2795                 .errstr = "R4 min value is negative",
2796                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2797         },
2798         {
2799                 "raw_stack: skb_load_bytes, zero len",
2800                 .insns = {
2801                         BPF_MOV64_IMM(BPF_REG_2, 4),
2802                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2803                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2804                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2805                         BPF_MOV64_IMM(BPF_REG_4, 0),
2806                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2807                                      BPF_FUNC_skb_load_bytes),
2808                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2809                         BPF_EXIT_INSN(),
2810                 },
2811                 .result = REJECT,
2812                 .errstr = "invalid stack type R3",
2813                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2814         },
2815         {
2816                 "raw_stack: skb_load_bytes, no init",
2817                 .insns = {
2818                         BPF_MOV64_IMM(BPF_REG_2, 4),
2819                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2820                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2821                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2822                         BPF_MOV64_IMM(BPF_REG_4, 8),
2823                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2824                                      BPF_FUNC_skb_load_bytes),
2825                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2826                         BPF_EXIT_INSN(),
2827                 },
2828                 .result = ACCEPT,
2829                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2830         },
2831         {
2832                 "raw_stack: skb_load_bytes, init",
2833                 .insns = {
2834                         BPF_MOV64_IMM(BPF_REG_2, 4),
2835                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2836                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2837                         BPF_ST_MEM(BPF_DW, BPF_REG_6, 0, 0xcafe),
2838                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2839                         BPF_MOV64_IMM(BPF_REG_4, 8),
2840                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2841                                      BPF_FUNC_skb_load_bytes),
2842                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2843                         BPF_EXIT_INSN(),
2844                 },
2845                 .result = ACCEPT,
2846                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2847         },
2848         {
2849                 "raw_stack: skb_load_bytes, spilled regs around bounds",
2850                 .insns = {
2851                         BPF_MOV64_IMM(BPF_REG_2, 4),
2852                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2853                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
2854                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
2855                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
2856                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2857                         BPF_MOV64_IMM(BPF_REG_4, 8),
2858                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2859                                      BPF_FUNC_skb_load_bytes),
2860                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
2861                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
2862                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2863                                     offsetof(struct __sk_buff, mark)),
2864                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
2865                                     offsetof(struct __sk_buff, priority)),
2866                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
2867                         BPF_EXIT_INSN(),
2868                 },
2869                 .result = ACCEPT,
2870                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2871         },
2872         {
2873                 "raw_stack: skb_load_bytes, spilled regs corruption",
2874                 .insns = {
2875                         BPF_MOV64_IMM(BPF_REG_2, 4),
2876                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2877                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2878                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2879                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2880                         BPF_MOV64_IMM(BPF_REG_4, 8),
2881                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2882                                      BPF_FUNC_skb_load_bytes),
2883                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2884                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2885                                     offsetof(struct __sk_buff, mark)),
2886                         BPF_EXIT_INSN(),
2887                 },
2888                 .result = REJECT,
2889                 .errstr = "R0 invalid mem access 'inv'",
2890                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2891         },
2892         {
2893                 "raw_stack: skb_load_bytes, spilled regs corruption 2",
2894                 .insns = {
2895                         BPF_MOV64_IMM(BPF_REG_2, 4),
2896                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2897                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
2898                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
2899                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  0),
2900                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
2901                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2902                         BPF_MOV64_IMM(BPF_REG_4, 8),
2903                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2904                                      BPF_FUNC_skb_load_bytes),
2905                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
2906                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
2907                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6,  0),
2908                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2909                                     offsetof(struct __sk_buff, mark)),
2910                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
2911                                     offsetof(struct __sk_buff, priority)),
2912                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
2913                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_3,
2914                                     offsetof(struct __sk_buff, pkt_type)),
2915                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
2916                         BPF_EXIT_INSN(),
2917                 },
2918                 .result = REJECT,
2919                 .errstr = "R3 invalid mem access 'inv'",
2920                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2921         },
2922         {
2923                 "raw_stack: skb_load_bytes, spilled regs + data",
2924                 .insns = {
2925                         BPF_MOV64_IMM(BPF_REG_2, 4),
2926                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2927                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
2928                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
2929                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  0),
2930                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
2931                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2932                         BPF_MOV64_IMM(BPF_REG_4, 8),
2933                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2934                                      BPF_FUNC_skb_load_bytes),
2935                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
2936                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
2937                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6,  0),
2938                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
2939                                     offsetof(struct __sk_buff, mark)),
2940                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
2941                                     offsetof(struct __sk_buff, priority)),
2942                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
2943                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
2944                         BPF_EXIT_INSN(),
2945                 },
2946                 .result = ACCEPT,
2947                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2948         },
2949         {
2950                 "raw_stack: skb_load_bytes, invalid access 1",
2951                 .insns = {
2952                         BPF_MOV64_IMM(BPF_REG_2, 4),
2953                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2954                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -513),
2955                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2956                         BPF_MOV64_IMM(BPF_REG_4, 8),
2957                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2958                                      BPF_FUNC_skb_load_bytes),
2959                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2960                         BPF_EXIT_INSN(),
2961                 },
2962                 .result = REJECT,
2963                 .errstr = "invalid stack type R3 off=-513 access_size=8",
2964                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2965         },
2966         {
2967                 "raw_stack: skb_load_bytes, invalid access 2",
2968                 .insns = {
2969                         BPF_MOV64_IMM(BPF_REG_2, 4),
2970                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2971                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
2972                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2973                         BPF_MOV64_IMM(BPF_REG_4, 8),
2974                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2975                                      BPF_FUNC_skb_load_bytes),
2976                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2977                         BPF_EXIT_INSN(),
2978                 },
2979                 .result = REJECT,
2980                 .errstr = "invalid stack type R3 off=-1 access_size=8",
2981                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2982         },
2983         {
2984                 "raw_stack: skb_load_bytes, invalid access 3",
2985                 .insns = {
2986                         BPF_MOV64_IMM(BPF_REG_2, 4),
2987                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2988                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 0xffffffff),
2989                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2990                         BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
2991                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2992                                      BPF_FUNC_skb_load_bytes),
2993                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2994                         BPF_EXIT_INSN(),
2995                 },
2996                 .result = REJECT,
2997                 .errstr = "R4 min value is negative",
2998                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2999         },
3000         {
3001                 "raw_stack: skb_load_bytes, invalid access 4",
3002                 .insns = {
3003                         BPF_MOV64_IMM(BPF_REG_2, 4),
3004                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3005                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
3006                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3007                         BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
3008                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3009                                      BPF_FUNC_skb_load_bytes),
3010                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3011                         BPF_EXIT_INSN(),
3012                 },
3013                 .result = REJECT,
3014                 .errstr = "R4 unbounded memory access, use 'var &= const' or 'if (var < const)'",
3015                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3016         },
3017         {
3018                 "raw_stack: skb_load_bytes, invalid access 5",
3019                 .insns = {
3020                         BPF_MOV64_IMM(BPF_REG_2, 4),
3021                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3022                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
3023                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3024                         BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
3025                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3026                                      BPF_FUNC_skb_load_bytes),
3027                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3028                         BPF_EXIT_INSN(),
3029                 },
3030                 .result = REJECT,
3031                 .errstr = "R4 unbounded memory access, use 'var &= const' or 'if (var < const)'",
3032                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3033         },
3034         {
3035                 "raw_stack: skb_load_bytes, invalid access 6",
3036                 .insns = {
3037                         BPF_MOV64_IMM(BPF_REG_2, 4),
3038                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3039                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
3040                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3041                         BPF_MOV64_IMM(BPF_REG_4, 0),
3042                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3043                                      BPF_FUNC_skb_load_bytes),
3044                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3045                         BPF_EXIT_INSN(),
3046                 },
3047                 .result = REJECT,
3048                 .errstr = "invalid stack type R3 off=-512 access_size=0",
3049                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3050         },
3051         {
3052                 "raw_stack: skb_load_bytes, large access",
3053                 .insns = {
3054                         BPF_MOV64_IMM(BPF_REG_2, 4),
3055                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3056                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
3057                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3058                         BPF_MOV64_IMM(BPF_REG_4, 512),
3059                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3060                                      BPF_FUNC_skb_load_bytes),
3061                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3062                         BPF_EXIT_INSN(),
3063                 },
3064                 .result = ACCEPT,
3065                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3066         },
3067         {
3068                 "context stores via ST",
3069                 .insns = {
3070                         BPF_MOV64_IMM(BPF_REG_0, 0),
3071                         BPF_ST_MEM(BPF_DW, BPF_REG_1, offsetof(struct __sk_buff, mark), 0),
3072                         BPF_EXIT_INSN(),
3073                 },
3074                 .errstr = "BPF_ST stores into R1 context is not allowed",
3075                 .result = REJECT,
3076                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3077         },
3078         {
3079                 "context stores via XADD",
3080                 .insns = {
3081                         BPF_MOV64_IMM(BPF_REG_0, 0),
3082                         BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_W, BPF_REG_1,
3083                                      BPF_REG_0, offsetof(struct __sk_buff, mark), 0),
3084                         BPF_EXIT_INSN(),
3085                 },
3086                 .errstr = "BPF_XADD stores into R1 context is not allowed",
3087                 .result = REJECT,
3088                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3089         },
3090         {
3091                 "direct packet access: test1",
3092                 .insns = {
3093                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3094                                     offsetof(struct __sk_buff, data)),
3095                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3096                                     offsetof(struct __sk_buff, data_end)),
3097                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3098                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3099                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3100                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3101                         BPF_MOV64_IMM(BPF_REG_0, 0),
3102                         BPF_EXIT_INSN(),
3103                 },
3104                 .result = ACCEPT,
3105                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3106         },
3107         {
3108                 "direct packet access: test2",
3109                 .insns = {
3110                         BPF_MOV64_IMM(BPF_REG_0, 1),
3111                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
3112                                     offsetof(struct __sk_buff, data_end)),
3113                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3114                                     offsetof(struct __sk_buff, data)),
3115                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3116                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 14),
3117                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_4, 15),
3118                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 7),
3119                         BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_3, 12),
3120                         BPF_ALU64_IMM(BPF_MUL, BPF_REG_4, 14),
3121                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3122                                     offsetof(struct __sk_buff, data)),
3123                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_4),
3124                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3125                                     offsetof(struct __sk_buff, len)),
3126                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 49),
3127                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 49),
3128                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_2),
3129                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_3),
3130                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
3131                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
3132                                     offsetof(struct __sk_buff, data_end)),
3133                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
3134                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_3, 4),
3135                         BPF_MOV64_IMM(BPF_REG_0, 0),
3136                         BPF_EXIT_INSN(),
3137                 },
3138                 .result = ACCEPT,
3139                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3140         },
3141         {
3142                 "direct packet access: test3",
3143                 .insns = {
3144                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3145                                     offsetof(struct __sk_buff, data)),
3146                         BPF_MOV64_IMM(BPF_REG_0, 0),
3147                         BPF_EXIT_INSN(),
3148                 },
3149                 .errstr = "invalid bpf_context access off=76",
3150                 .result = REJECT,
3151                 .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
3152         },
3153         {
3154                 "direct packet access: test4 (write)",
3155                 .insns = {
3156                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3157                                     offsetof(struct __sk_buff, data)),
3158                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3159                                     offsetof(struct __sk_buff, data_end)),
3160                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3161                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3162                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3163                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3164                         BPF_MOV64_IMM(BPF_REG_0, 0),
3165                         BPF_EXIT_INSN(),
3166                 },
3167                 .result = ACCEPT,
3168                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3169         },
3170         {
3171                 "direct packet access: test5 (pkt_end >= reg, good access)",
3172                 .insns = {
3173                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3174                                     offsetof(struct __sk_buff, data)),
3175                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3176                                     offsetof(struct __sk_buff, data_end)),
3177                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3178                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3179                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
3180                         BPF_MOV64_IMM(BPF_REG_0, 1),
3181                         BPF_EXIT_INSN(),
3182                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3183                         BPF_MOV64_IMM(BPF_REG_0, 0),
3184                         BPF_EXIT_INSN(),
3185                 },
3186                 .result = ACCEPT,
3187                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3188         },
3189         {
3190                 "direct packet access: test6 (pkt_end >= reg, bad access)",
3191                 .insns = {
3192                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3193                                     offsetof(struct __sk_buff, data)),
3194                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3195                                     offsetof(struct __sk_buff, data_end)),
3196                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3197                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3198                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
3199                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3200                         BPF_MOV64_IMM(BPF_REG_0, 1),
3201                         BPF_EXIT_INSN(),
3202                         BPF_MOV64_IMM(BPF_REG_0, 0),
3203                         BPF_EXIT_INSN(),
3204                 },
3205                 .errstr = "invalid access to packet",
3206                 .result = REJECT,
3207                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3208         },
3209         {
3210                 "direct packet access: test7 (pkt_end >= reg, both accesses)",
3211                 .insns = {
3212                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3213                                     offsetof(struct __sk_buff, data)),
3214                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3215                                     offsetof(struct __sk_buff, data_end)),
3216                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3217                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3218                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
3219                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3220                         BPF_MOV64_IMM(BPF_REG_0, 1),
3221                         BPF_EXIT_INSN(),
3222                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3223                         BPF_MOV64_IMM(BPF_REG_0, 0),
3224                         BPF_EXIT_INSN(),
3225                 },
3226                 .errstr = "invalid access to packet",
3227                 .result = REJECT,
3228                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3229         },
3230         {
3231                 "direct packet access: test8 (double test, variant 1)",
3232                 .insns = {
3233                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3234                                     offsetof(struct __sk_buff, data)),
3235                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3236                                     offsetof(struct __sk_buff, data_end)),
3237                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3238                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3239                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 4),
3240                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3241                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3242                         BPF_MOV64_IMM(BPF_REG_0, 1),
3243                         BPF_EXIT_INSN(),
3244                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3245                         BPF_MOV64_IMM(BPF_REG_0, 0),
3246                         BPF_EXIT_INSN(),
3247                 },
3248                 .result = ACCEPT,
3249                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3250         },
3251         {
3252                 "direct packet access: test9 (double test, variant 2)",
3253                 .insns = {
3254                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3255                                     offsetof(struct __sk_buff, data)),
3256                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3257                                     offsetof(struct __sk_buff, data_end)),
3258                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3259                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3260                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
3261                         BPF_MOV64_IMM(BPF_REG_0, 1),
3262                         BPF_EXIT_INSN(),
3263                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3264                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3265                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3266                         BPF_MOV64_IMM(BPF_REG_0, 0),
3267                         BPF_EXIT_INSN(),
3268                 },
3269                 .result = ACCEPT,
3270                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3271         },
3272         {
3273                 "direct packet access: test10 (write invalid)",
3274                 .insns = {
3275                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3276                                     offsetof(struct __sk_buff, data)),
3277                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3278                                     offsetof(struct __sk_buff, data_end)),
3279                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3280                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3281                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
3282                         BPF_MOV64_IMM(BPF_REG_0, 0),
3283                         BPF_EXIT_INSN(),
3284                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3285                         BPF_MOV64_IMM(BPF_REG_0, 0),
3286                         BPF_EXIT_INSN(),
3287                 },
3288                 .errstr = "invalid access to packet",
3289                 .result = REJECT,
3290                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3291         },
3292         {
3293                 "direct packet access: test11 (shift, good access)",
3294                 .insns = {
3295                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3296                                     offsetof(struct __sk_buff, data)),
3297                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3298                                     offsetof(struct __sk_buff, data_end)),
3299                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3300                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3301                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
3302                         BPF_MOV64_IMM(BPF_REG_3, 144),
3303                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3304                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
3305                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 3),
3306                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3307                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3308                         BPF_MOV64_IMM(BPF_REG_0, 1),
3309                         BPF_EXIT_INSN(),
3310                         BPF_MOV64_IMM(BPF_REG_0, 0),
3311                         BPF_EXIT_INSN(),
3312                 },
3313                 .result = ACCEPT,
3314                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3315                 .retval = 1,
3316         },
3317         {
3318                 "direct packet access: test12 (and, good access)",
3319                 .insns = {
3320                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3321                                     offsetof(struct __sk_buff, data)),
3322                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3323                                     offsetof(struct __sk_buff, data_end)),
3324                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3325                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3326                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
3327                         BPF_MOV64_IMM(BPF_REG_3, 144),
3328                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3329                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
3330                         BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
3331                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3332                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3333                         BPF_MOV64_IMM(BPF_REG_0, 1),
3334                         BPF_EXIT_INSN(),
3335                         BPF_MOV64_IMM(BPF_REG_0, 0),
3336                         BPF_EXIT_INSN(),
3337                 },
3338                 .result = ACCEPT,
3339                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3340                 .retval = 1,
3341         },
3342         {
3343                 "direct packet access: test13 (branches, good access)",
3344                 .insns = {
3345                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3346                                     offsetof(struct __sk_buff, data)),
3347                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3348                                     offsetof(struct __sk_buff, data_end)),
3349                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3350                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3351                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 13),
3352                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3353                                     offsetof(struct __sk_buff, mark)),
3354                         BPF_MOV64_IMM(BPF_REG_4, 1),
3355                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_4, 2),
3356                         BPF_MOV64_IMM(BPF_REG_3, 14),
3357                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
3358                         BPF_MOV64_IMM(BPF_REG_3, 24),
3359                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3360                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
3361                         BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
3362                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3363                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3364                         BPF_MOV64_IMM(BPF_REG_0, 1),
3365                         BPF_EXIT_INSN(),
3366                         BPF_MOV64_IMM(BPF_REG_0, 0),
3367                         BPF_EXIT_INSN(),
3368                 },
3369                 .result = ACCEPT,
3370                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3371                 .retval = 1,
3372         },
3373         {
3374                 "direct packet access: test14 (pkt_ptr += 0, CONST_IMM, good access)",
3375                 .insns = {
3376                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3377                                     offsetof(struct __sk_buff, data)),
3378                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3379                                     offsetof(struct __sk_buff, data_end)),
3380                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3381                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3382                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),
3383                         BPF_MOV64_IMM(BPF_REG_5, 12),
3384                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 4),
3385                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3386                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3387                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6, 0),
3388                         BPF_MOV64_IMM(BPF_REG_0, 1),
3389                         BPF_EXIT_INSN(),
3390                         BPF_MOV64_IMM(BPF_REG_0, 0),
3391                         BPF_EXIT_INSN(),
3392                 },
3393                 .result = ACCEPT,
3394                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3395                 .retval = 1,
3396         },
3397         {
3398                 "direct packet access: test15 (spill with xadd)",
3399                 .insns = {
3400                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3401                                     offsetof(struct __sk_buff, data)),
3402                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3403                                     offsetof(struct __sk_buff, data_end)),
3404                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3405                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3406                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
3407                         BPF_MOV64_IMM(BPF_REG_5, 4096),
3408                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
3409                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
3410                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
3411                         BPF_STX_XADD(BPF_DW, BPF_REG_4, BPF_REG_5, 0),
3412                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
3413                         BPF_STX_MEM(BPF_W, BPF_REG_2, BPF_REG_5, 0),
3414                         BPF_MOV64_IMM(BPF_REG_0, 0),
3415                         BPF_EXIT_INSN(),
3416                 },
3417                 .errstr = "R2 invalid mem access 'inv'",
3418                 .result = REJECT,
3419                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3420         },
3421         {
3422                 "direct packet access: test16 (arith on data_end)",
3423                 .insns = {
3424                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3425                                     offsetof(struct __sk_buff, data)),
3426                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3427                                     offsetof(struct __sk_buff, data_end)),
3428                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3429                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3430                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 16),
3431                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3432                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3433                         BPF_MOV64_IMM(BPF_REG_0, 0),
3434                         BPF_EXIT_INSN(),
3435                 },
3436                 .errstr = "R3 pointer arithmetic on PTR_TO_PACKET_END",
3437                 .result = REJECT,
3438                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3439         },
3440         {
3441                 "direct packet access: test17 (pruning, alignment)",
3442                 .insns = {
3443                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3444                                     offsetof(struct __sk_buff, data)),
3445                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3446                                     offsetof(struct __sk_buff, data_end)),
3447                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3448                                     offsetof(struct __sk_buff, mark)),
3449                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3450                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 14),
3451                         BPF_JMP_IMM(BPF_JGT, BPF_REG_7, 1, 4),
3452                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3453                         BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, -4),
3454                         BPF_MOV64_IMM(BPF_REG_0, 0),
3455                         BPF_EXIT_INSN(),
3456                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
3457                         BPF_JMP_A(-6),
3458                 },
3459                 .errstr = "misaligned packet access off 2+(0x0; 0x0)+15+-4 size 4",
3460                 .result = REJECT,
3461                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3462                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
3463         },
3464         {
3465                 "direct packet access: test18 (imm += pkt_ptr, 1)",
3466                 .insns = {
3467                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3468                                     offsetof(struct __sk_buff, data)),
3469                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3470                                     offsetof(struct __sk_buff, data_end)),
3471                         BPF_MOV64_IMM(BPF_REG_0, 8),
3472                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3473                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3474                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3475                         BPF_MOV64_IMM(BPF_REG_0, 0),
3476                         BPF_EXIT_INSN(),
3477                 },
3478                 .result = ACCEPT,
3479                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3480         },
3481         {
3482                 "direct packet access: test19 (imm += pkt_ptr, 2)",
3483                 .insns = {
3484                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3485                                     offsetof(struct __sk_buff, data)),
3486                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3487                                     offsetof(struct __sk_buff, data_end)),
3488                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3489                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3490                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
3491                         BPF_MOV64_IMM(BPF_REG_4, 4),
3492                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3493                         BPF_STX_MEM(BPF_B, BPF_REG_4, BPF_REG_4, 0),
3494                         BPF_MOV64_IMM(BPF_REG_0, 0),
3495                         BPF_EXIT_INSN(),
3496                 },
3497                 .result = ACCEPT,
3498                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3499         },
3500         {
3501                 "direct packet access: test20 (x += pkt_ptr, 1)",
3502                 .insns = {
3503                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3504                                     offsetof(struct __sk_buff, data)),
3505                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3506                                     offsetof(struct __sk_buff, data_end)),
3507                         BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
3508                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3509                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3510                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0x7fff),
3511                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3512                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3513                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
3514                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0x7fff - 1),
3515                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
3516                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
3517                         BPF_MOV64_IMM(BPF_REG_0, 0),
3518                         BPF_EXIT_INSN(),
3519                 },
3520                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3521                 .result = ACCEPT,
3522         },
3523         {
3524                 "direct packet access: test21 (x += pkt_ptr, 2)",
3525                 .insns = {
3526                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3527                                     offsetof(struct __sk_buff, data)),
3528                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3529                                     offsetof(struct __sk_buff, data_end)),
3530                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3531                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3532                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 9),
3533                         BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
3534                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -8),
3535                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
3536                         BPF_ALU64_IMM(BPF_AND, BPF_REG_4, 0x7fff),
3537                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3538                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
3539                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0x7fff - 1),
3540                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
3541                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
3542                         BPF_MOV64_IMM(BPF_REG_0, 0),
3543                         BPF_EXIT_INSN(),
3544                 },
3545                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3546                 .result = ACCEPT,
3547         },
3548         {
3549                 "direct packet access: test22 (x += pkt_ptr, 3)",
3550                 .insns = {
3551                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3552                                     offsetof(struct __sk_buff, data)),
3553                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3554                                     offsetof(struct __sk_buff, data_end)),
3555                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3556                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3557                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -8),
3558                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_3, -16),
3559                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_10, -16),
3560                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 11),
3561                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
3562                         BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
3563                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_4, -8),
3564                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
3565                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 49),
3566                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3567                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
3568                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
3569                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
3570                         BPF_MOV64_IMM(BPF_REG_2, 1),
3571                         BPF_STX_MEM(BPF_H, BPF_REG_4, BPF_REG_2, 0),
3572                         BPF_MOV64_IMM(BPF_REG_0, 0),
3573                         BPF_EXIT_INSN(),
3574                 },
3575                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3576                 .result = ACCEPT,
3577         },
3578         {
3579                 "direct packet access: test23 (x += pkt_ptr, 4)",
3580                 .insns = {
3581                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3582                                     offsetof(struct __sk_buff, data)),
3583                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3584                                     offsetof(struct __sk_buff, data_end)),
3585                         BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
3586                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3587                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3588                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xffff),
3589                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3590                         BPF_MOV64_IMM(BPF_REG_0, 31),
3591                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_4),
3592                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3593                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
3594                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0xffff - 1),
3595                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3596                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_0, 0),
3597                         BPF_MOV64_IMM(BPF_REG_0, 0),
3598                         BPF_EXIT_INSN(),
3599                 },
3600                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3601                 .result = REJECT,
3602                 .errstr = "invalid access to packet, off=0 size=8, R5(id=1,off=0,r=0)",
3603         },
3604         {
3605                 "direct packet access: test24 (x += pkt_ptr, 5)",
3606                 .insns = {
3607                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3608                                     offsetof(struct __sk_buff, data)),
3609                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3610                                     offsetof(struct __sk_buff, data_end)),
3611                         BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
3612                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3613                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3614                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xff),
3615                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3616                         BPF_MOV64_IMM(BPF_REG_0, 64),
3617                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_4),
3618                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3619                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
3620                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x7fff - 1),
3621                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3622                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_0, 0),
3623                         BPF_MOV64_IMM(BPF_REG_0, 0),
3624                         BPF_EXIT_INSN(),
3625                 },
3626                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3627                 .result = ACCEPT,
3628         },
3629         {
3630                 "direct packet access: test25 (marking on <, good access)",
3631                 .insns = {
3632                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3633                                     offsetof(struct __sk_buff, data)),
3634                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3635                                     offsetof(struct __sk_buff, data_end)),
3636                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3637                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3638                         BPF_JMP_REG(BPF_JLT, BPF_REG_0, BPF_REG_3, 2),
3639                         BPF_MOV64_IMM(BPF_REG_0, 0),
3640                         BPF_EXIT_INSN(),
3641                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3642                         BPF_JMP_IMM(BPF_JA, 0, 0, -4),
3643                 },
3644                 .result = ACCEPT,
3645                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3646         },
3647         {
3648                 "direct packet access: test26 (marking on <, bad access)",
3649                 .insns = {
3650                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3651                                     offsetof(struct __sk_buff, data)),
3652                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3653                                     offsetof(struct __sk_buff, data_end)),
3654                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3655                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3656                         BPF_JMP_REG(BPF_JLT, BPF_REG_0, BPF_REG_3, 3),
3657                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3658                         BPF_MOV64_IMM(BPF_REG_0, 0),
3659                         BPF_EXIT_INSN(),
3660                         BPF_JMP_IMM(BPF_JA, 0, 0, -3),
3661                 },
3662                 .result = REJECT,
3663                 .errstr = "invalid access to packet",
3664                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3665         },
3666         {
3667                 "direct packet access: test27 (marking on <=, good access)",
3668                 .insns = {
3669                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3670                                     offsetof(struct __sk_buff, data)),
3671                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3672                                     offsetof(struct __sk_buff, data_end)),
3673                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3674                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3675                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_0, 1),
3676                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3677                         BPF_MOV64_IMM(BPF_REG_0, 1),
3678                         BPF_EXIT_INSN(),
3679                 },
3680                 .result = ACCEPT,
3681                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3682                 .retval = 1,
3683         },
3684         {
3685                 "direct packet access: test28 (marking on <=, bad access)",
3686                 .insns = {
3687                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3688                                     offsetof(struct __sk_buff, data)),
3689                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3690                                     offsetof(struct __sk_buff, data_end)),
3691                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3692                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3693                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_0, 2),
3694                         BPF_MOV64_IMM(BPF_REG_0, 1),
3695                         BPF_EXIT_INSN(),
3696                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3697                         BPF_JMP_IMM(BPF_JA, 0, 0, -4),
3698                 },
3699                 .result = REJECT,
3700                 .errstr = "invalid access to packet",
3701                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3702         },
3703         {
3704                 "helper access to packet: test1, valid packet_ptr range",
3705                 .insns = {
3706                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3707                                     offsetof(struct xdp_md, data)),
3708                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3709                                     offsetof(struct xdp_md, data_end)),
3710                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
3711                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
3712                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
3713                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3714                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
3715                         BPF_MOV64_IMM(BPF_REG_4, 0),
3716                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3717                                      BPF_FUNC_map_update_elem),
3718                         BPF_MOV64_IMM(BPF_REG_0, 0),
3719                         BPF_EXIT_INSN(),
3720                 },
3721                 .fixup_map1 = { 5 },
3722                 .result_unpriv = ACCEPT,
3723                 .result = ACCEPT,
3724                 .prog_type = BPF_PROG_TYPE_XDP,
3725         },
3726         {
3727                 "helper access to packet: test2, unchecked packet_ptr",
3728                 .insns = {
3729                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3730                                     offsetof(struct xdp_md, data)),
3731                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3732                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3733                                      BPF_FUNC_map_lookup_elem),
3734                         BPF_MOV64_IMM(BPF_REG_0, 0),
3735                         BPF_EXIT_INSN(),
3736                 },
3737                 .fixup_map1 = { 1 },
3738                 .result = REJECT,
3739                 .errstr = "invalid access to packet",
3740                 .prog_type = BPF_PROG_TYPE_XDP,
3741         },
3742         {
3743                 "helper access to packet: test3, variable add",
3744                 .insns = {
3745                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3746                                         offsetof(struct xdp_md, data)),
3747                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3748                                         offsetof(struct xdp_md, data_end)),
3749                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3750                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
3751                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
3752                         BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
3753                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3754                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
3755                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
3756                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
3757                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
3758                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3759                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
3760                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3761                                      BPF_FUNC_map_lookup_elem),
3762                         BPF_MOV64_IMM(BPF_REG_0, 0),
3763                         BPF_EXIT_INSN(),
3764                 },
3765                 .fixup_map1 = { 11 },
3766                 .result = ACCEPT,
3767                 .prog_type = BPF_PROG_TYPE_XDP,
3768         },
3769         {
3770                 "helper access to packet: test4, packet_ptr with bad range",
3771                 .insns = {
3772                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3773                                     offsetof(struct xdp_md, data)),
3774                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3775                                     offsetof(struct xdp_md, data_end)),
3776                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3777                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
3778                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
3779                         BPF_MOV64_IMM(BPF_REG_0, 0),
3780                         BPF_EXIT_INSN(),
3781                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3782                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3783                                      BPF_FUNC_map_lookup_elem),
3784                         BPF_MOV64_IMM(BPF_REG_0, 0),
3785                         BPF_EXIT_INSN(),
3786                 },
3787                 .fixup_map1 = { 7 },
3788                 .result = REJECT,
3789                 .errstr = "invalid access to packet",
3790                 .prog_type = BPF_PROG_TYPE_XDP,
3791         },
3792         {
3793                 "helper access to packet: test5, packet_ptr with too short range",
3794                 .insns = {
3795                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3796                                     offsetof(struct xdp_md, data)),
3797                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3798                                     offsetof(struct xdp_md, data_end)),
3799                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
3800                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3801                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
3802                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
3803                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3804                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3805                                      BPF_FUNC_map_lookup_elem),
3806                         BPF_MOV64_IMM(BPF_REG_0, 0),
3807                         BPF_EXIT_INSN(),
3808                 },
3809                 .fixup_map1 = { 6 },
3810                 .result = REJECT,
3811                 .errstr = "invalid access to packet",
3812                 .prog_type = BPF_PROG_TYPE_XDP,
3813         },
3814         {
3815                 "helper access to packet: test6, cls valid packet_ptr range",
3816                 .insns = {
3817                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3818                                     offsetof(struct __sk_buff, data)),
3819                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3820                                     offsetof(struct __sk_buff, data_end)),
3821                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
3822                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
3823                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
3824                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3825                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
3826                         BPF_MOV64_IMM(BPF_REG_4, 0),
3827                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3828                                      BPF_FUNC_map_update_elem),
3829                         BPF_MOV64_IMM(BPF_REG_0, 0),
3830                         BPF_EXIT_INSN(),
3831                 },
3832                 .fixup_map1 = { 5 },
3833                 .result = ACCEPT,
3834                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3835         },
3836         {
3837                 "helper access to packet: test7, cls unchecked packet_ptr",
3838                 .insns = {
3839                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3840                                     offsetof(struct __sk_buff, data)),
3841                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3842                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3843                                      BPF_FUNC_map_lookup_elem),
3844                         BPF_MOV64_IMM(BPF_REG_0, 0),
3845                         BPF_EXIT_INSN(),
3846                 },
3847                 .fixup_map1 = { 1 },
3848                 .result = REJECT,
3849                 .errstr = "invalid access to packet",
3850                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3851         },
3852         {
3853                 "helper access to packet: test8, cls variable add",
3854                 .insns = {
3855                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3856                                         offsetof(struct __sk_buff, data)),
3857                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3858                                         offsetof(struct __sk_buff, data_end)),
3859                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3860                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
3861                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
3862                         BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
3863                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3864                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
3865                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
3866                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
3867                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
3868                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3869                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
3870                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3871                                      BPF_FUNC_map_lookup_elem),
3872                         BPF_MOV64_IMM(BPF_REG_0, 0),
3873                         BPF_EXIT_INSN(),
3874                 },
3875                 .fixup_map1 = { 11 },
3876                 .result = ACCEPT,
3877                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3878         },
3879         {
3880                 "helper access to packet: test9, cls packet_ptr with bad range",
3881                 .insns = {
3882                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3883                                     offsetof(struct __sk_buff, data)),
3884                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3885                                     offsetof(struct __sk_buff, data_end)),
3886                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3887                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
3888                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
3889                         BPF_MOV64_IMM(BPF_REG_0, 0),
3890                         BPF_EXIT_INSN(),
3891                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3892                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3893                                      BPF_FUNC_map_lookup_elem),
3894                         BPF_MOV64_IMM(BPF_REG_0, 0),
3895                         BPF_EXIT_INSN(),
3896                 },
3897                 .fixup_map1 = { 7 },
3898                 .result = REJECT,
3899                 .errstr = "invalid access to packet",
3900                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3901         },
3902         {
3903                 "helper access to packet: test10, cls packet_ptr with too short range",
3904                 .insns = {
3905                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3906                                     offsetof(struct __sk_buff, data)),
3907                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3908                                     offsetof(struct __sk_buff, data_end)),
3909                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
3910                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3911                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
3912                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
3913                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3914                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3915                                      BPF_FUNC_map_lookup_elem),
3916                         BPF_MOV64_IMM(BPF_REG_0, 0),
3917                         BPF_EXIT_INSN(),
3918                 },
3919                 .fixup_map1 = { 6 },
3920                 .result = REJECT,
3921                 .errstr = "invalid access to packet",
3922                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3923         },
3924         {
3925                 "helper access to packet: test11, cls unsuitable helper 1",
3926                 .insns = {
3927                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3928                                     offsetof(struct __sk_buff, data)),
3929                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3930                                     offsetof(struct __sk_buff, data_end)),
3931                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3932                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3933                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 7),
3934                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_7, 4),
3935                         BPF_MOV64_IMM(BPF_REG_2, 0),
3936                         BPF_MOV64_IMM(BPF_REG_4, 42),
3937                         BPF_MOV64_IMM(BPF_REG_5, 0),
3938                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3939                                      BPF_FUNC_skb_store_bytes),
3940                         BPF_MOV64_IMM(BPF_REG_0, 0),
3941                         BPF_EXIT_INSN(),
3942                 },
3943                 .result = REJECT,
3944                 .errstr = "helper access to the packet",
3945                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3946         },
3947         {
3948                 "helper access to packet: test12, cls unsuitable helper 2",
3949                 .insns = {
3950                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3951                                     offsetof(struct __sk_buff, data)),
3952                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3953                                     offsetof(struct __sk_buff, data_end)),
3954                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3955                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
3956                         BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_7, 3),
3957                         BPF_MOV64_IMM(BPF_REG_2, 0),
3958                         BPF_MOV64_IMM(BPF_REG_4, 4),
3959                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3960                                      BPF_FUNC_skb_load_bytes),
3961                         BPF_MOV64_IMM(BPF_REG_0, 0),
3962                         BPF_EXIT_INSN(),
3963                 },
3964                 .result = REJECT,
3965                 .errstr = "helper access to the packet",
3966                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3967         },
3968         {
3969                 "helper access to packet: test13, cls helper ok",
3970                 .insns = {
3971                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3972                                     offsetof(struct __sk_buff, data)),
3973                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3974                                     offsetof(struct __sk_buff, data_end)),
3975                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
3976                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3977                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
3978                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
3979                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
3980                         BPF_MOV64_IMM(BPF_REG_2, 4),
3981                         BPF_MOV64_IMM(BPF_REG_3, 0),
3982                         BPF_MOV64_IMM(BPF_REG_4, 0),
3983                         BPF_MOV64_IMM(BPF_REG_5, 0),
3984                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3985                                      BPF_FUNC_csum_diff),
3986                         BPF_MOV64_IMM(BPF_REG_0, 0),
3987                         BPF_EXIT_INSN(),
3988                 },
3989                 .result = ACCEPT,
3990                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3991         },
3992         {
3993                 "helper access to packet: test14, cls helper ok sub",
3994                 .insns = {
3995                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
3996                                     offsetof(struct __sk_buff, data)),
3997                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3998                                     offsetof(struct __sk_buff, data_end)),
3999                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4000                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4001                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4002                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4003                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 4),
4004                         BPF_MOV64_IMM(BPF_REG_2, 4),
4005                         BPF_MOV64_IMM(BPF_REG_3, 0),
4006                         BPF_MOV64_IMM(BPF_REG_4, 0),
4007                         BPF_MOV64_IMM(BPF_REG_5, 0),
4008                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4009                                      BPF_FUNC_csum_diff),
4010                         BPF_MOV64_IMM(BPF_REG_0, 0),
4011                         BPF_EXIT_INSN(),
4012                 },
4013                 .result = ACCEPT,
4014                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4015         },
4016         {
4017                 "helper access to packet: test15, cls helper fail sub",
4018                 .insns = {
4019                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4020                                     offsetof(struct __sk_buff, data)),
4021                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4022                                     offsetof(struct __sk_buff, data_end)),
4023                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4024                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4025                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4026                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4027                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 12),
4028                         BPF_MOV64_IMM(BPF_REG_2, 4),
4029                         BPF_MOV64_IMM(BPF_REG_3, 0),
4030                         BPF_MOV64_IMM(BPF_REG_4, 0),
4031                         BPF_MOV64_IMM(BPF_REG_5, 0),
4032                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4033                                      BPF_FUNC_csum_diff),
4034                         BPF_MOV64_IMM(BPF_REG_0, 0),
4035                         BPF_EXIT_INSN(),
4036                 },
4037                 .result = REJECT,
4038                 .errstr = "invalid access to packet",
4039                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4040         },
4041         {
4042                 "helper access to packet: test16, cls helper fail range 1",
4043                 .insns = {
4044                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4045                                     offsetof(struct __sk_buff, data)),
4046                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4047                                     offsetof(struct __sk_buff, data_end)),
4048                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4049                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4050                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4051                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4052                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4053                         BPF_MOV64_IMM(BPF_REG_2, 8),
4054                         BPF_MOV64_IMM(BPF_REG_3, 0),
4055                         BPF_MOV64_IMM(BPF_REG_4, 0),
4056                         BPF_MOV64_IMM(BPF_REG_5, 0),
4057                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4058                                      BPF_FUNC_csum_diff),
4059                         BPF_MOV64_IMM(BPF_REG_0, 0),
4060                         BPF_EXIT_INSN(),
4061                 },
4062                 .result = REJECT,
4063                 .errstr = "invalid access to packet",
4064                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4065         },
4066         {
4067                 "helper access to packet: test17, cls helper fail range 2",
4068                 .insns = {
4069                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4070                                     offsetof(struct __sk_buff, data)),
4071                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4072                                     offsetof(struct __sk_buff, data_end)),
4073                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4074                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4075                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4076                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4077                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4078                         BPF_MOV64_IMM(BPF_REG_2, -9),
4079                         BPF_MOV64_IMM(BPF_REG_3, 0),
4080                         BPF_MOV64_IMM(BPF_REG_4, 0),
4081                         BPF_MOV64_IMM(BPF_REG_5, 0),
4082                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4083                                      BPF_FUNC_csum_diff),
4084                         BPF_MOV64_IMM(BPF_REG_0, 0),
4085                         BPF_EXIT_INSN(),
4086                 },
4087                 .result = REJECT,
4088                 .errstr = "R2 min value is negative",
4089                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4090         },
4091         {
4092                 "helper access to packet: test18, cls helper fail range 3",
4093                 .insns = {
4094                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4095                                     offsetof(struct __sk_buff, data)),
4096                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4097                                     offsetof(struct __sk_buff, data_end)),
4098                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4099                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4100                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4101                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4102                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4103                         BPF_MOV64_IMM(BPF_REG_2, ~0),
4104                         BPF_MOV64_IMM(BPF_REG_3, 0),
4105                         BPF_MOV64_IMM(BPF_REG_4, 0),
4106                         BPF_MOV64_IMM(BPF_REG_5, 0),
4107                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4108                                      BPF_FUNC_csum_diff),
4109                         BPF_MOV64_IMM(BPF_REG_0, 0),
4110                         BPF_EXIT_INSN(),
4111                 },
4112                 .result = REJECT,
4113                 .errstr = "R2 min value is negative",
4114                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4115         },
4116         {
4117                 "helper access to packet: test19, cls helper range zero",
4118                 .insns = {
4119                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4120                                     offsetof(struct __sk_buff, data)),
4121                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4122                                     offsetof(struct __sk_buff, data_end)),
4123                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4124                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4125                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4126                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4127                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4128                         BPF_MOV64_IMM(BPF_REG_2, 0),
4129                         BPF_MOV64_IMM(BPF_REG_3, 0),
4130                         BPF_MOV64_IMM(BPF_REG_4, 0),
4131                         BPF_MOV64_IMM(BPF_REG_5, 0),
4132                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4133                                      BPF_FUNC_csum_diff),
4134                         BPF_MOV64_IMM(BPF_REG_0, 0),
4135                         BPF_EXIT_INSN(),
4136                 },
4137                 .result = ACCEPT,
4138                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4139         },
4140         {
4141                 "helper access to packet: test20, pkt end as input",
4142                 .insns = {
4143                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4144                                     offsetof(struct __sk_buff, data)),
4145                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4146                                     offsetof(struct __sk_buff, data_end)),
4147                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4148                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4149                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4150                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4151                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
4152                         BPF_MOV64_IMM(BPF_REG_2, 4),
4153                         BPF_MOV64_IMM(BPF_REG_3, 0),
4154                         BPF_MOV64_IMM(BPF_REG_4, 0),
4155                         BPF_MOV64_IMM(BPF_REG_5, 0),
4156                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4157                                      BPF_FUNC_csum_diff),
4158                         BPF_MOV64_IMM(BPF_REG_0, 0),
4159                         BPF_EXIT_INSN(),
4160                 },
4161                 .result = REJECT,
4162                 .errstr = "R1 type=pkt_end expected=fp",
4163                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4164         },
4165         {
4166                 "helper access to packet: test21, wrong reg",
4167                 .insns = {
4168                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4169                                     offsetof(struct __sk_buff, data)),
4170                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4171                                     offsetof(struct __sk_buff, data_end)),
4172                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4173                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4174                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4175                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4176                         BPF_MOV64_IMM(BPF_REG_2, 4),
4177                         BPF_MOV64_IMM(BPF_REG_3, 0),
4178                         BPF_MOV64_IMM(BPF_REG_4, 0),
4179                         BPF_MOV64_IMM(BPF_REG_5, 0),
4180                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4181                                      BPF_FUNC_csum_diff),
4182                         BPF_MOV64_IMM(BPF_REG_0, 0),
4183                         BPF_EXIT_INSN(),
4184                 },
4185                 .result = REJECT,
4186                 .errstr = "invalid access to packet",
4187                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4188         },
4189         {
4190                 "valid map access into an array with a constant",
4191                 .insns = {
4192                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4193                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4194                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4195                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4196                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4197                                      BPF_FUNC_map_lookup_elem),
4198                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4199                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4200                                    offsetof(struct test_val, foo)),
4201                         BPF_EXIT_INSN(),
4202                 },
4203                 .fixup_map2 = { 3 },
4204                 .errstr_unpriv = "R0 leaks addr",
4205                 .result_unpriv = REJECT,
4206                 .result = ACCEPT,
4207         },
4208         {
4209                 "valid map access into an array with a register",
4210                 .insns = {
4211                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4212                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4213                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4214                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4215                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4216                                      BPF_FUNC_map_lookup_elem),
4217                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4218                         BPF_MOV64_IMM(BPF_REG_1, 4),
4219                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4220                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4221                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4222                                    offsetof(struct test_val, foo)),
4223                         BPF_EXIT_INSN(),
4224                 },
4225                 .fixup_map2 = { 3 },
4226                 .errstr_unpriv = "R0 leaks addr",
4227                 .result_unpriv = REJECT,
4228                 .result = ACCEPT,
4229                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4230         },
4231         {
4232                 "valid map access into an array with a variable",
4233                 .insns = {
4234                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4235                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4236                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4237                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4238                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4239                                      BPF_FUNC_map_lookup_elem),
4240                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4241                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4242                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 3),
4243                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4244                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4245                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4246                                    offsetof(struct test_val, foo)),
4247                         BPF_EXIT_INSN(),
4248                 },
4249                 .fixup_map2 = { 3 },
4250                 .errstr_unpriv = "R0 leaks addr",
4251                 .result_unpriv = REJECT,
4252                 .result = ACCEPT,
4253                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4254         },
4255         {
4256                 "valid map access into an array with a signed variable",
4257                 .insns = {
4258                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4259                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4260                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4261                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4262                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4263                                      BPF_FUNC_map_lookup_elem),
4264                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
4265                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4266                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 0xffffffff, 1),
4267                         BPF_MOV32_IMM(BPF_REG_1, 0),
4268                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
4269                         BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
4270                         BPF_MOV32_IMM(BPF_REG_1, 0),
4271                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
4272                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4273                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4274                                    offsetof(struct test_val, foo)),
4275                         BPF_EXIT_INSN(),
4276                 },
4277                 .fixup_map2 = { 3 },
4278                 .errstr_unpriv = "R0 leaks addr",
4279                 .result_unpriv = REJECT,
4280                 .result = ACCEPT,
4281                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4282         },
4283         {
4284                 "invalid map access into an array with a constant",
4285                 .insns = {
4286                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4287                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4288                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4289                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4290                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4291                                      BPF_FUNC_map_lookup_elem),
4292                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4293                         BPF_ST_MEM(BPF_DW, BPF_REG_0, (MAX_ENTRIES + 1) << 2,
4294                                    offsetof(struct test_val, foo)),
4295                         BPF_EXIT_INSN(),
4296                 },
4297                 .fixup_map2 = { 3 },
4298                 .errstr = "invalid access to map value, value_size=48 off=48 size=8",
4299                 .result = REJECT,
4300         },
4301         {
4302                 "invalid map access into an array with a register",
4303                 .insns = {
4304                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4305                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4306                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4307                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4308                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4309                                      BPF_FUNC_map_lookup_elem),
4310                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4311                         BPF_MOV64_IMM(BPF_REG_1, MAX_ENTRIES + 1),
4312                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4313                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4314                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4315                                    offsetof(struct test_val, foo)),
4316                         BPF_EXIT_INSN(),
4317                 },
4318                 .fixup_map2 = { 3 },
4319                 .errstr = "R0 min value is outside of the array range",
4320                 .result = REJECT,
4321                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4322         },
4323         {
4324                 "invalid map access into an array with a variable",
4325                 .insns = {
4326                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4327                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4328                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4329                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4330                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4331                                      BPF_FUNC_map_lookup_elem),
4332                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4333                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4334                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4335                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4336                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4337                                    offsetof(struct test_val, foo)),
4338                         BPF_EXIT_INSN(),
4339                 },
4340                 .fixup_map2 = { 3 },
4341                 .errstr = "R0 unbounded memory access, make sure to bounds check any array access into a map",
4342                 .result = REJECT,
4343                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4344         },
4345         {
4346                 "invalid map access into an array with no floor check",
4347                 .insns = {
4348                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4349                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4350                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4351                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4352                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4353                                      BPF_FUNC_map_lookup_elem),
4354                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4355                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
4356                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
4357                         BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
4358                         BPF_MOV32_IMM(BPF_REG_1, 0),
4359                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
4360                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4361                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4362                                    offsetof(struct test_val, foo)),
4363                         BPF_EXIT_INSN(),
4364                 },
4365                 .fixup_map2 = { 3 },
4366                 .errstr_unpriv = "R0 leaks addr",
4367                 .errstr = "R0 unbounded memory access",
4368                 .result_unpriv = REJECT,
4369                 .result = REJECT,
4370                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4371         },
4372         {
4373                 "invalid map access into an array with a invalid max check",
4374                 .insns = {
4375                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4376                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4377                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4378                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4379                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4380                                      BPF_FUNC_map_lookup_elem),
4381                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4382                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4383                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES + 1),
4384                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
4385                         BPF_MOV32_IMM(BPF_REG_1, 0),
4386                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
4387                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4388                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4389                                    offsetof(struct test_val, foo)),
4390                         BPF_EXIT_INSN(),
4391                 },
4392                 .fixup_map2 = { 3 },
4393                 .errstr_unpriv = "R0 leaks addr",
4394                 .errstr = "invalid access to map value, value_size=48 off=44 size=8",
4395                 .result_unpriv = REJECT,
4396                 .result = REJECT,
4397                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4398         },
4399         {
4400                 "invalid map access into an array with a invalid max check",
4401                 .insns = {
4402                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4403                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4404                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4405                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4406                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4407                                      BPF_FUNC_map_lookup_elem),
4408                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
4409                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
4410                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4411                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4412                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4413                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4414                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4415                                      BPF_FUNC_map_lookup_elem),
4416                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
4417                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
4418                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
4419                                     offsetof(struct test_val, foo)),
4420                         BPF_EXIT_INSN(),
4421                 },
4422                 .fixup_map2 = { 3, 11 },
4423                 .errstr = "R0 pointer += pointer",
4424                 .result = REJECT,
4425                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4426         },
4427         {
4428                 "multiple registers share map_lookup_elem result",
4429                 .insns = {
4430                         BPF_MOV64_IMM(BPF_REG_1, 10),
4431                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4432                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4433                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4434                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4435                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4436                                      BPF_FUNC_map_lookup_elem),
4437                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4438                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4439                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4440                         BPF_EXIT_INSN(),
4441                 },
4442                 .fixup_map1 = { 4 },
4443                 .result = ACCEPT,
4444                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4445         },
4446         {
4447                 "alu ops on ptr_to_map_value_or_null, 1",
4448                 .insns = {
4449                         BPF_MOV64_IMM(BPF_REG_1, 10),
4450                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4451                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4452                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4453                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4454                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4455                                      BPF_FUNC_map_lookup_elem),
4456                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4457                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -2),
4458                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 2),
4459                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4460                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4461                         BPF_EXIT_INSN(),
4462                 },
4463                 .fixup_map1 = { 4 },
4464                 .errstr = "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",
4465                 .result = REJECT,
4466                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4467         },
4468         {
4469                 "alu ops on ptr_to_map_value_or_null, 2",
4470                 .insns = {
4471                         BPF_MOV64_IMM(BPF_REG_1, 10),
4472                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4473                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4474                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4475                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4476                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4477                                      BPF_FUNC_map_lookup_elem),
4478                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4479                         BPF_ALU64_IMM(BPF_AND, BPF_REG_4, -1),
4480                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4481                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4482                         BPF_EXIT_INSN(),
4483                 },
4484                 .fixup_map1 = { 4 },
4485                 .errstr = "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",
4486                 .result = REJECT,
4487                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4488         },
4489         {
4490                 "alu ops on ptr_to_map_value_or_null, 3",
4491                 .insns = {
4492                         BPF_MOV64_IMM(BPF_REG_1, 10),
4493                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4494                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4495                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4496                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4497                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4498                                      BPF_FUNC_map_lookup_elem),
4499                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4500                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_4, 1),
4501                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4502                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4503                         BPF_EXIT_INSN(),
4504                 },
4505                 .fixup_map1 = { 4 },
4506                 .errstr = "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",
4507                 .result = REJECT,
4508                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4509         },
4510         {
4511                 "invalid memory access with multiple map_lookup_elem calls",
4512                 .insns = {
4513                         BPF_MOV64_IMM(BPF_REG_1, 10),
4514                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4515                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4516                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4517                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4518                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
4519                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
4520                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4521                                      BPF_FUNC_map_lookup_elem),
4522                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4523                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
4524                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
4525                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4526                                      BPF_FUNC_map_lookup_elem),
4527                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4528                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4529                         BPF_EXIT_INSN(),
4530                 },
4531                 .fixup_map1 = { 4 },
4532                 .result = REJECT,
4533                 .errstr = "R4 !read_ok",
4534                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4535         },
4536         {
4537                 "valid indirect map_lookup_elem access with 2nd lookup in branch",
4538                 .insns = {
4539                         BPF_MOV64_IMM(BPF_REG_1, 10),
4540                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4541                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4542                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4543                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4544                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
4545                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
4546                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4547                                      BPF_FUNC_map_lookup_elem),
4548                         BPF_MOV64_IMM(BPF_REG_2, 10),
4549                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 3),
4550                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
4551                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
4552                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4553                                      BPF_FUNC_map_lookup_elem),
4554                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4555                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4556                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4557                         BPF_EXIT_INSN(),
4558                 },
4559                 .fixup_map1 = { 4 },
4560                 .result = ACCEPT,
4561                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4562         },
4563         {
4564                 "invalid map access from else condition",
4565                 .insns = {
4566                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4567                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4568                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4569                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4570                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
4571                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4572                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4573                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES-1, 1),
4574                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
4575                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4576                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4577                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
4578                         BPF_EXIT_INSN(),
4579                 },
4580                 .fixup_map2 = { 3 },
4581                 .errstr = "R0 unbounded memory access",
4582                 .result = REJECT,
4583                 .errstr_unpriv = "R0 leaks addr",
4584                 .result_unpriv = REJECT,
4585                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4586         },
4587         {
4588                 "constant register |= constant should keep constant type",
4589                 .insns = {
4590                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4591                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
4592                         BPF_MOV64_IMM(BPF_REG_2, 34),
4593                         BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 13),
4594                         BPF_MOV64_IMM(BPF_REG_3, 0),
4595                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4596                         BPF_EXIT_INSN(),
4597                 },
4598                 .result = ACCEPT,
4599                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4600         },
4601         {
4602                 "constant register |= constant should not bypass stack boundary checks",
4603                 .insns = {
4604                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4605                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
4606                         BPF_MOV64_IMM(BPF_REG_2, 34),
4607                         BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 24),
4608                         BPF_MOV64_IMM(BPF_REG_3, 0),
4609                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4610                         BPF_EXIT_INSN(),
4611                 },
4612                 .errstr = "invalid stack type R1 off=-48 access_size=58",
4613                 .result = REJECT,
4614                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4615         },
4616         {
4617                 "constant register |= constant register should keep constant type",
4618                 .insns = {
4619                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4620                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
4621                         BPF_MOV64_IMM(BPF_REG_2, 34),
4622                         BPF_MOV64_IMM(BPF_REG_4, 13),
4623                         BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
4624                         BPF_MOV64_IMM(BPF_REG_3, 0),
4625                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4626                         BPF_EXIT_INSN(),
4627                 },
4628                 .result = ACCEPT,
4629                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4630         },
4631         {
4632                 "constant register |= constant register should not bypass stack boundary checks",
4633                 .insns = {
4634                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4635                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
4636                         BPF_MOV64_IMM(BPF_REG_2, 34),
4637                         BPF_MOV64_IMM(BPF_REG_4, 24),
4638                         BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
4639                         BPF_MOV64_IMM(BPF_REG_3, 0),
4640                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4641                         BPF_EXIT_INSN(),
4642                 },
4643                 .errstr = "invalid stack type R1 off=-48 access_size=58",
4644                 .result = REJECT,
4645                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4646         },
4647         {
4648                 "invalid direct packet write for LWT_IN",
4649                 .insns = {
4650                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4651                                     offsetof(struct __sk_buff, data)),
4652                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4653                                     offsetof(struct __sk_buff, data_end)),
4654                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4655                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4656                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4657                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
4658                         BPF_MOV64_IMM(BPF_REG_0, 0),
4659                         BPF_EXIT_INSN(),
4660                 },
4661                 .errstr = "cannot write into packet",
4662                 .result = REJECT,
4663                 .prog_type = BPF_PROG_TYPE_LWT_IN,
4664         },
4665         {
4666                 "invalid direct packet write for LWT_OUT",
4667                 .insns = {
4668                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4669                                     offsetof(struct __sk_buff, data)),
4670                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4671                                     offsetof(struct __sk_buff, data_end)),
4672                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4673                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4674                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4675                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
4676                         BPF_MOV64_IMM(BPF_REG_0, 0),
4677                         BPF_EXIT_INSN(),
4678                 },
4679                 .errstr = "cannot write into packet",
4680                 .result = REJECT,
4681                 .prog_type = BPF_PROG_TYPE_LWT_OUT,
4682         },
4683         {
4684                 "direct packet write for LWT_XMIT",
4685                 .insns = {
4686                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4687                                     offsetof(struct __sk_buff, data)),
4688                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4689                                     offsetof(struct __sk_buff, data_end)),
4690                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4691                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4692                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4693                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
4694                         BPF_MOV64_IMM(BPF_REG_0, 0),
4695                         BPF_EXIT_INSN(),
4696                 },
4697                 .result = ACCEPT,
4698                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
4699         },
4700         {
4701                 "direct packet read for LWT_IN",
4702                 .insns = {
4703                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4704                                     offsetof(struct __sk_buff, data)),
4705                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4706                                     offsetof(struct __sk_buff, data_end)),
4707                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4708                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4709                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4710                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
4711                         BPF_MOV64_IMM(BPF_REG_0, 0),
4712                         BPF_EXIT_INSN(),
4713                 },
4714                 .result = ACCEPT,
4715                 .prog_type = BPF_PROG_TYPE_LWT_IN,
4716         },
4717         {
4718                 "direct packet read for LWT_OUT",
4719                 .insns = {
4720                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4721                                     offsetof(struct __sk_buff, data)),
4722                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4723                                     offsetof(struct __sk_buff, data_end)),
4724                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4725                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4726                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4727                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
4728                         BPF_MOV64_IMM(BPF_REG_0, 0),
4729                         BPF_EXIT_INSN(),
4730                 },
4731                 .result = ACCEPT,
4732                 .prog_type = BPF_PROG_TYPE_LWT_OUT,
4733         },
4734         {
4735                 "direct packet read for LWT_XMIT",
4736                 .insns = {
4737                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4738                                     offsetof(struct __sk_buff, data)),
4739                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4740                                     offsetof(struct __sk_buff, data_end)),
4741                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4742                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4743                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4744                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
4745                         BPF_MOV64_IMM(BPF_REG_0, 0),
4746                         BPF_EXIT_INSN(),
4747                 },
4748                 .result = ACCEPT,
4749                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
4750         },
4751         {
4752                 "overlapping checks for direct packet access",
4753                 .insns = {
4754                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4755                                     offsetof(struct __sk_buff, data)),
4756                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4757                                     offsetof(struct __sk_buff, data_end)),
4758                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4759                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4760                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
4761                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
4762                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
4763                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
4764                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
4765                         BPF_MOV64_IMM(BPF_REG_0, 0),
4766                         BPF_EXIT_INSN(),
4767                 },
4768                 .result = ACCEPT,
4769                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
4770         },
4771         {
4772                 "invalid access of tc_classid for LWT_IN",
4773                 .insns = {
4774                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
4775                                     offsetof(struct __sk_buff, tc_classid)),
4776                         BPF_EXIT_INSN(),
4777                 },
4778                 .result = REJECT,
4779                 .errstr = "invalid bpf_context access",
4780         },
4781         {
4782                 "invalid access of tc_classid for LWT_OUT",
4783                 .insns = {
4784                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
4785                                     offsetof(struct __sk_buff, tc_classid)),
4786                         BPF_EXIT_INSN(),
4787                 },
4788                 .result = REJECT,
4789                 .errstr = "invalid bpf_context access",
4790         },
4791         {
4792                 "invalid access of tc_classid for LWT_XMIT",
4793                 .insns = {
4794                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
4795                                     offsetof(struct __sk_buff, tc_classid)),
4796                         BPF_EXIT_INSN(),
4797                 },
4798                 .result = REJECT,
4799                 .errstr = "invalid bpf_context access",
4800         },
4801         {
4802                 "leak pointer into ctx 1",
4803                 .insns = {
4804                         BPF_MOV64_IMM(BPF_REG_0, 0),
4805                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
4806                                     offsetof(struct __sk_buff, cb[0])),
4807                         BPF_LD_MAP_FD(BPF_REG_2, 0),
4808                         BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_2,
4809                                       offsetof(struct __sk_buff, cb[0])),
4810                         BPF_EXIT_INSN(),
4811                 },
4812                 .fixup_map1 = { 2 },
4813                 .errstr_unpriv = "R2 leaks addr into mem",
4814                 .result_unpriv = REJECT,
4815                 .result = REJECT,
4816                 .errstr = "BPF_XADD stores into R1 context is not allowed",
4817         },
4818         {
4819                 "leak pointer into ctx 2",
4820                 .insns = {
4821                         BPF_MOV64_IMM(BPF_REG_0, 0),
4822                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
4823                                     offsetof(struct __sk_buff, cb[0])),
4824                         BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_10,
4825                                       offsetof(struct __sk_buff, cb[0])),
4826                         BPF_EXIT_INSN(),
4827                 },
4828                 .errstr_unpriv = "R10 leaks addr into mem",
4829                 .result_unpriv = REJECT,
4830                 .result = REJECT,
4831                 .errstr = "BPF_XADD stores into R1 context is not allowed",
4832         },
4833         {
4834                 "leak pointer into ctx 3",
4835                 .insns = {
4836                         BPF_MOV64_IMM(BPF_REG_0, 0),
4837                         BPF_LD_MAP_FD(BPF_REG_2, 0),
4838                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2,
4839                                       offsetof(struct __sk_buff, cb[0])),
4840                         BPF_EXIT_INSN(),
4841                 },
4842                 .fixup_map1 = { 1 },
4843                 .errstr_unpriv = "R2 leaks addr into ctx",
4844                 .result_unpriv = REJECT,
4845                 .result = ACCEPT,
4846         },
4847         {
4848                 "leak pointer into map val",
4849                 .insns = {
4850                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
4851                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4852                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4853                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4854                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4855                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4856                                      BPF_FUNC_map_lookup_elem),
4857                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
4858                         BPF_MOV64_IMM(BPF_REG_3, 0),
4859                         BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
4860                         BPF_STX_XADD(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
4861                         BPF_MOV64_IMM(BPF_REG_0, 0),
4862                         BPF_EXIT_INSN(),
4863                 },
4864                 .fixup_map1 = { 4 },
4865                 .errstr_unpriv = "R6 leaks addr into mem",
4866                 .result_unpriv = REJECT,
4867                 .result = ACCEPT,
4868         },
4869         {
4870                 "helper access to map: full range",
4871                 .insns = {
4872                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4873                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4874                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4875                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4876                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4877                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4878                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4879                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
4880                         BPF_MOV64_IMM(BPF_REG_3, 0),
4881                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4882                         BPF_EXIT_INSN(),
4883                 },
4884                 .fixup_map2 = { 3 },
4885                 .result = ACCEPT,
4886                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4887         },
4888         {
4889                 "helper access to map: partial range",
4890                 .insns = {
4891                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4892                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4893                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4894                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4895                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4896                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4897                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4898                         BPF_MOV64_IMM(BPF_REG_2, 8),
4899                         BPF_MOV64_IMM(BPF_REG_3, 0),
4900                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4901                         BPF_EXIT_INSN(),
4902                 },
4903                 .fixup_map2 = { 3 },
4904                 .result = ACCEPT,
4905                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4906         },
4907         {
4908                 "helper access to map: empty range",
4909                 .insns = {
4910                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4911                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4912                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4913                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4914                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4915                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
4916                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4917                         BPF_MOV64_IMM(BPF_REG_2, 0),
4918                         BPF_EMIT_CALL(BPF_FUNC_trace_printk),
4919                         BPF_EXIT_INSN(),
4920                 },
4921                 .fixup_map2 = { 3 },
4922                 .errstr = "invalid access to map value, value_size=48 off=0 size=0",
4923                 .result = REJECT,
4924                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4925         },
4926         {
4927                 "helper access to map: out-of-bound range",
4928                 .insns = {
4929                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4930                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4931                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4932                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4933                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4934                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4935                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4936                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val) + 8),
4937                         BPF_MOV64_IMM(BPF_REG_3, 0),
4938                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4939                         BPF_EXIT_INSN(),
4940                 },
4941                 .fixup_map2 = { 3 },
4942                 .errstr = "invalid access to map value, value_size=48 off=0 size=56",
4943                 .result = REJECT,
4944                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4945         },
4946         {
4947                 "helper access to map: negative range",
4948                 .insns = {
4949                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4950                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4951                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4952                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4953                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4954                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4955                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4956                         BPF_MOV64_IMM(BPF_REG_2, -8),
4957                         BPF_MOV64_IMM(BPF_REG_3, 0),
4958                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4959                         BPF_EXIT_INSN(),
4960                 },
4961                 .fixup_map2 = { 3 },
4962                 .errstr = "R2 min value is negative",
4963                 .result = REJECT,
4964                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4965         },
4966         {
4967                 "helper access to adjusted map (via const imm): full range",
4968                 .insns = {
4969                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4970                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4971                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4972                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4973                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4974                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4975                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4976                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
4977                                 offsetof(struct test_val, foo)),
4978                         BPF_MOV64_IMM(BPF_REG_2,
4979                                 sizeof(struct test_val) -
4980                                 offsetof(struct test_val, foo)),
4981                         BPF_MOV64_IMM(BPF_REG_3, 0),
4982                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4983                         BPF_EXIT_INSN(),
4984                 },
4985                 .fixup_map2 = { 3 },
4986                 .result = ACCEPT,
4987                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4988         },
4989         {
4990                 "helper access to adjusted map (via const imm): partial range",
4991                 .insns = {
4992                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4993                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4994                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
4995                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4996                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
4997                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4998                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
4999                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5000                                 offsetof(struct test_val, foo)),
5001                         BPF_MOV64_IMM(BPF_REG_2, 8),
5002                         BPF_MOV64_IMM(BPF_REG_3, 0),
5003                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5004                         BPF_EXIT_INSN(),
5005                 },
5006                 .fixup_map2 = { 3 },
5007                 .result = ACCEPT,
5008                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5009         },
5010         {
5011                 "helper access to adjusted map (via const imm): empty range",
5012                 .insns = {
5013                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5014                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5015                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5016                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5017                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5018                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5019                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5020                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5021                                 offsetof(struct test_val, foo)),
5022                         BPF_MOV64_IMM(BPF_REG_2, 0),
5023                         BPF_EMIT_CALL(BPF_FUNC_trace_printk),
5024                         BPF_EXIT_INSN(),
5025                 },
5026                 .fixup_map2 = { 3 },
5027                 .errstr = "invalid access to map value, value_size=48 off=4 size=0",
5028                 .result = REJECT,
5029                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5030         },
5031         {
5032                 "helper access to adjusted map (via const imm): out-of-bound range",
5033                 .insns = {
5034                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5035                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5036                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5037                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5038                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5039                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5040                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5041                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5042                                 offsetof(struct test_val, foo)),
5043                         BPF_MOV64_IMM(BPF_REG_2,
5044                                 sizeof(struct test_val) -
5045                                 offsetof(struct test_val, foo) + 8),
5046                         BPF_MOV64_IMM(BPF_REG_3, 0),
5047                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5048                         BPF_EXIT_INSN(),
5049                 },
5050                 .fixup_map2 = { 3 },
5051                 .errstr = "invalid access to map value, value_size=48 off=4 size=52",
5052                 .result = REJECT,
5053                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5054         },
5055         {
5056                 "helper access to adjusted map (via const imm): negative range (> adjustment)",
5057                 .insns = {
5058                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5059                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5060                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5061                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5062                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5063                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5064                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5065                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5066                                 offsetof(struct test_val, foo)),
5067                         BPF_MOV64_IMM(BPF_REG_2, -8),
5068                         BPF_MOV64_IMM(BPF_REG_3, 0),
5069                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5070                         BPF_EXIT_INSN(),
5071                 },
5072                 .fixup_map2 = { 3 },
5073                 .errstr = "R2 min value is negative",
5074                 .result = REJECT,
5075                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5076         },
5077         {
5078                 "helper access to adjusted map (via const imm): negative range (< adjustment)",
5079                 .insns = {
5080                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5081                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5082                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5083                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5084                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5085                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5086                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5087                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5088                                 offsetof(struct test_val, foo)),
5089                         BPF_MOV64_IMM(BPF_REG_2, -1),
5090                         BPF_MOV64_IMM(BPF_REG_3, 0),
5091                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5092                         BPF_EXIT_INSN(),
5093                 },
5094                 .fixup_map2 = { 3 },
5095                 .errstr = "R2 min value is negative",
5096                 .result = REJECT,
5097                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5098         },
5099         {
5100                 "helper access to adjusted map (via const reg): full range",
5101                 .insns = {
5102                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5103                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5104                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5105                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5106                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5107                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5108                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5109                         BPF_MOV64_IMM(BPF_REG_3,
5110                                 offsetof(struct test_val, foo)),
5111                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5112                         BPF_MOV64_IMM(BPF_REG_2,
5113                                 sizeof(struct test_val) -
5114                                 offsetof(struct test_val, foo)),
5115                         BPF_MOV64_IMM(BPF_REG_3, 0),
5116                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5117                         BPF_EXIT_INSN(),
5118                 },
5119                 .fixup_map2 = { 3 },
5120                 .result = ACCEPT,
5121                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5122         },
5123         {
5124                 "helper access to adjusted map (via const reg): partial range",
5125                 .insns = {
5126                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5127                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5128                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5129                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5130                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5131                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5132                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5133                         BPF_MOV64_IMM(BPF_REG_3,
5134                                 offsetof(struct test_val, foo)),
5135                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5136                         BPF_MOV64_IMM(BPF_REG_2, 8),
5137                         BPF_MOV64_IMM(BPF_REG_3, 0),
5138                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5139                         BPF_EXIT_INSN(),
5140                 },
5141                 .fixup_map2 = { 3 },
5142                 .result = ACCEPT,
5143                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5144         },
5145         {
5146                 "helper access to adjusted map (via const reg): empty range",
5147                 .insns = {
5148                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5149                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5150                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5151                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5152                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5153                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5154                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5155                         BPF_MOV64_IMM(BPF_REG_3, 0),
5156                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5157                         BPF_MOV64_IMM(BPF_REG_2, 0),
5158                         BPF_EMIT_CALL(BPF_FUNC_trace_printk),
5159                         BPF_EXIT_INSN(),
5160                 },
5161                 .fixup_map2 = { 3 },
5162                 .errstr = "R1 min value is outside of the array range",
5163                 .result = REJECT,
5164                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5165         },
5166         {
5167                 "helper access to adjusted map (via const reg): out-of-bound range",
5168                 .insns = {
5169                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5170                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5171                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5172                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5173                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5174                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5175                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5176                         BPF_MOV64_IMM(BPF_REG_3,
5177                                 offsetof(struct test_val, foo)),
5178                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5179                         BPF_MOV64_IMM(BPF_REG_2,
5180                                 sizeof(struct test_val) -
5181                                 offsetof(struct test_val, foo) + 8),
5182                         BPF_MOV64_IMM(BPF_REG_3, 0),
5183                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5184                         BPF_EXIT_INSN(),
5185                 },
5186                 .fixup_map2 = { 3 },
5187                 .errstr = "invalid access to map value, value_size=48 off=4 size=52",
5188                 .result = REJECT,
5189                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5190         },
5191         {
5192                 "helper access to adjusted map (via const reg): negative range (> adjustment)",
5193                 .insns = {
5194                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5195                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5196                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5197                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5198                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5199                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5200                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5201                         BPF_MOV64_IMM(BPF_REG_3,
5202                                 offsetof(struct test_val, foo)),
5203                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5204                         BPF_MOV64_IMM(BPF_REG_2, -8),
5205                         BPF_MOV64_IMM(BPF_REG_3, 0),
5206                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5207                         BPF_EXIT_INSN(),
5208                 },
5209                 .fixup_map2 = { 3 },
5210                 .errstr = "R2 min value is negative",
5211                 .result = REJECT,
5212                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5213         },
5214         {
5215                 "helper access to adjusted map (via const reg): negative range (< adjustment)",
5216                 .insns = {
5217                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5218                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5219                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5220                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5221                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5222                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5223                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5224                         BPF_MOV64_IMM(BPF_REG_3,
5225                                 offsetof(struct test_val, foo)),
5226                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5227                         BPF_MOV64_IMM(BPF_REG_2, -1),
5228                         BPF_MOV64_IMM(BPF_REG_3, 0),
5229                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5230                         BPF_EXIT_INSN(),
5231                 },
5232                 .fixup_map2 = { 3 },
5233                 .errstr = "R2 min value is negative",
5234                 .result = REJECT,
5235                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5236         },
5237         {
5238                 "helper access to adjusted map (via variable): full range",
5239                 .insns = {
5240                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5241                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5242                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5243                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5244                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5245                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5246                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5247                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5248                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
5249                                 offsetof(struct test_val, foo), 4),
5250                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5251                         BPF_MOV64_IMM(BPF_REG_2,
5252                                 sizeof(struct test_val) -
5253                                 offsetof(struct test_val, foo)),
5254                         BPF_MOV64_IMM(BPF_REG_3, 0),
5255                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5256                         BPF_EXIT_INSN(),
5257                 },
5258                 .fixup_map2 = { 3 },
5259                 .result = ACCEPT,
5260                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5261         },
5262         {
5263                 "helper access to adjusted map (via variable): partial range",
5264                 .insns = {
5265                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5266                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5267                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5268                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5269                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5270                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5271                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5272                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5273                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
5274                                 offsetof(struct test_val, foo), 4),
5275                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5276                         BPF_MOV64_IMM(BPF_REG_2, 8),
5277                         BPF_MOV64_IMM(BPF_REG_3, 0),
5278                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5279                         BPF_EXIT_INSN(),
5280                 },
5281                 .fixup_map2 = { 3 },
5282                 .result = ACCEPT,
5283                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5284         },
5285         {
5286                 "helper access to adjusted map (via variable): empty range",
5287                 .insns = {
5288                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5289                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5290                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5291                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5292                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5293                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5294                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5295                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5296                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
5297                                 offsetof(struct test_val, foo), 3),
5298                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5299                         BPF_MOV64_IMM(BPF_REG_2, 0),
5300                         BPF_EMIT_CALL(BPF_FUNC_trace_printk),
5301                         BPF_EXIT_INSN(),
5302                 },
5303                 .fixup_map2 = { 3 },
5304                 .errstr = "R1 min value is outside of the array range",
5305                 .result = REJECT,
5306                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5307         },
5308         {
5309                 "helper access to adjusted map (via variable): no max check",
5310                 .insns = {
5311                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5312                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5313                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5314                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5315                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5316                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5317                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5318                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5319                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5320                         BPF_MOV64_IMM(BPF_REG_2, 1),
5321                         BPF_MOV64_IMM(BPF_REG_3, 0),
5322                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5323                         BPF_EXIT_INSN(),
5324                 },
5325                 .fixup_map2 = { 3 },
5326                 .errstr = "R1 unbounded memory access",
5327                 .result = REJECT,
5328                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5329         },
5330         {
5331                 "helper access to adjusted map (via variable): wrong max check",
5332                 .insns = {
5333                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5334                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5335                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5336                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5337                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5338                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5339                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5340                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5341                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
5342                                 offsetof(struct test_val, foo), 4),
5343                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5344                         BPF_MOV64_IMM(BPF_REG_2,
5345                                 sizeof(struct test_val) -
5346                                 offsetof(struct test_val, foo) + 1),
5347                         BPF_MOV64_IMM(BPF_REG_3, 0),
5348                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5349                         BPF_EXIT_INSN(),
5350                 },
5351                 .fixup_map2 = { 3 },
5352                 .errstr = "invalid access to map value, value_size=48 off=4 size=45",
5353                 .result = REJECT,
5354                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5355         },
5356         {
5357                 "helper access to map: bounds check using <, good access",
5358                 .insns = {
5359                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5360                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5361                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5362                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5363                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5364                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5365                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5366                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5367                         BPF_JMP_IMM(BPF_JLT, BPF_REG_3, 32, 2),
5368                         BPF_MOV64_IMM(BPF_REG_0, 0),
5369                         BPF_EXIT_INSN(),
5370                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5371                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5372                         BPF_MOV64_IMM(BPF_REG_0, 0),
5373                         BPF_EXIT_INSN(),
5374                 },
5375                 .fixup_map2 = { 3 },
5376                 .result = ACCEPT,
5377                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5378         },
5379         {
5380                 "helper access to map: bounds check using <, bad access",
5381                 .insns = {
5382                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5383                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5384                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5385                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5386                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5387                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5388                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5389                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5390                         BPF_JMP_IMM(BPF_JLT, BPF_REG_3, 32, 4),
5391                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5392                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5393                         BPF_MOV64_IMM(BPF_REG_0, 0),
5394                         BPF_EXIT_INSN(),
5395                         BPF_MOV64_IMM(BPF_REG_0, 0),
5396                         BPF_EXIT_INSN(),
5397                 },
5398                 .fixup_map2 = { 3 },
5399                 .result = REJECT,
5400                 .errstr = "R1 unbounded memory access",
5401                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5402         },
5403         {
5404                 "helper access to map: bounds check using <=, good access",
5405                 .insns = {
5406                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5407                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5408                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5409                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5410                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5411                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5412                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5413                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5414                         BPF_JMP_IMM(BPF_JLE, BPF_REG_3, 32, 2),
5415                         BPF_MOV64_IMM(BPF_REG_0, 0),
5416                         BPF_EXIT_INSN(),
5417                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5418                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5419                         BPF_MOV64_IMM(BPF_REG_0, 0),
5420                         BPF_EXIT_INSN(),
5421                 },
5422                 .fixup_map2 = { 3 },
5423                 .result = ACCEPT,
5424                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5425         },
5426         {
5427                 "helper access to map: bounds check using <=, bad access",
5428                 .insns = {
5429                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5430                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5431                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5432                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5433                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5434                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5435                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5436                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5437                         BPF_JMP_IMM(BPF_JLE, BPF_REG_3, 32, 4),
5438                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5439                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5440                         BPF_MOV64_IMM(BPF_REG_0, 0),
5441                         BPF_EXIT_INSN(),
5442                         BPF_MOV64_IMM(BPF_REG_0, 0),
5443                         BPF_EXIT_INSN(),
5444                 },
5445                 .fixup_map2 = { 3 },
5446                 .result = REJECT,
5447                 .errstr = "R1 unbounded memory access",
5448                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5449         },
5450         {
5451                 "helper access to map: bounds check using s<, good access",
5452                 .insns = {
5453                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5454                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5455                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5456                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5457                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5458                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5459                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5460                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5461                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
5462                         BPF_MOV64_IMM(BPF_REG_0, 0),
5463                         BPF_EXIT_INSN(),
5464                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 0, -3),
5465                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5466                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5467                         BPF_MOV64_IMM(BPF_REG_0, 0),
5468                         BPF_EXIT_INSN(),
5469                 },
5470                 .fixup_map2 = { 3 },
5471                 .result = ACCEPT,
5472                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5473         },
5474         {
5475                 "helper access to map: bounds check using s<, good access 2",
5476                 .insns = {
5477                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5478                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5479                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5480                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5481                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5482                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5483                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5484                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5485                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
5486                         BPF_MOV64_IMM(BPF_REG_0, 0),
5487                         BPF_EXIT_INSN(),
5488                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, -3, -3),
5489                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5490                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5491                         BPF_MOV64_IMM(BPF_REG_0, 0),
5492                         BPF_EXIT_INSN(),
5493                 },
5494                 .fixup_map2 = { 3 },
5495                 .result = ACCEPT,
5496                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5497         },
5498         {
5499                 "helper access to map: bounds check using s<, bad access",
5500                 .insns = {
5501                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5502                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5503                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5504                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5505                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5506                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5507                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5508                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
5509                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
5510                         BPF_MOV64_IMM(BPF_REG_0, 0),
5511                         BPF_EXIT_INSN(),
5512                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, -3, -3),
5513                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5514                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5515                         BPF_MOV64_IMM(BPF_REG_0, 0),
5516                         BPF_EXIT_INSN(),
5517                 },
5518                 .fixup_map2 = { 3 },
5519                 .result = REJECT,
5520                 .errstr = "R1 min value is negative",
5521                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5522         },
5523         {
5524                 "helper access to map: bounds check using s<=, good access",
5525                 .insns = {
5526                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5527                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5528                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5529                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5530                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5531                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5532                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5533                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5534                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
5535                         BPF_MOV64_IMM(BPF_REG_0, 0),
5536                         BPF_EXIT_INSN(),
5537                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 0, -3),
5538                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5539                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5540                         BPF_MOV64_IMM(BPF_REG_0, 0),
5541                         BPF_EXIT_INSN(),
5542                 },
5543                 .fixup_map2 = { 3 },
5544                 .result = ACCEPT,
5545                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5546         },
5547         {
5548                 "helper access to map: bounds check using s<=, good access 2",
5549                 .insns = {
5550                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5551                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5552                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5553                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5554                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5555                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5556                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5557                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5558                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
5559                         BPF_MOV64_IMM(BPF_REG_0, 0),
5560                         BPF_EXIT_INSN(),
5561                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, -3, -3),
5562                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5563                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5564                         BPF_MOV64_IMM(BPF_REG_0, 0),
5565                         BPF_EXIT_INSN(),
5566                 },
5567                 .fixup_map2 = { 3 },
5568                 .result = ACCEPT,
5569                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5570         },
5571         {
5572                 "helper access to map: bounds check using s<=, bad access",
5573                 .insns = {
5574                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5575                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5576                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5577                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5578                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5579                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5580                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5581                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
5582                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
5583                         BPF_MOV64_IMM(BPF_REG_0, 0),
5584                         BPF_EXIT_INSN(),
5585                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, -3, -3),
5586                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5587                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5588                         BPF_MOV64_IMM(BPF_REG_0, 0),
5589                         BPF_EXIT_INSN(),
5590                 },
5591                 .fixup_map2 = { 3 },
5592                 .result = REJECT,
5593                 .errstr = "R1 min value is negative",
5594                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5595         },
5596         {
5597                 "map element value is preserved across register spilling",
5598                 .insns = {
5599                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5600                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5601                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5602                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5603                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5604                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5605                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
5606                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5607                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
5608                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
5609                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
5610                         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
5611                         BPF_EXIT_INSN(),
5612                 },
5613                 .fixup_map2 = { 3 },
5614                 .errstr_unpriv = "R0 leaks addr",
5615                 .result = ACCEPT,
5616                 .result_unpriv = REJECT,
5617         },
5618         {
5619                 "map element value or null is marked on register spilling",
5620                 .insns = {
5621                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5622                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5623                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5624                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5625                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5626                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5627                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -152),
5628                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
5629                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
5630                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
5631                         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
5632                         BPF_EXIT_INSN(),
5633                 },
5634                 .fixup_map2 = { 3 },
5635                 .errstr_unpriv = "R0 leaks addr",
5636                 .result = ACCEPT,
5637                 .result_unpriv = REJECT,
5638         },
5639         {
5640                 "map element value store of cleared call register",
5641                 .insns = {
5642                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5643                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5644                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5645                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5646                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5647                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
5648                         BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
5649                         BPF_EXIT_INSN(),
5650                 },
5651                 .fixup_map2 = { 3 },
5652                 .errstr_unpriv = "R1 !read_ok",
5653                 .errstr = "R1 !read_ok",
5654                 .result = REJECT,
5655                 .result_unpriv = REJECT,
5656         },
5657         {
5658                 "map element value with unaligned store",
5659                 .insns = {
5660                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5661                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5662                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5663                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5664                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5665                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 17),
5666                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
5667                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
5668                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 43),
5669                         BPF_ST_MEM(BPF_DW, BPF_REG_0, -2, 44),
5670                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
5671                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 32),
5672                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 2, 33),
5673                         BPF_ST_MEM(BPF_DW, BPF_REG_8, -2, 34),
5674                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 5),
5675                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 22),
5676                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 4, 23),
5677                         BPF_ST_MEM(BPF_DW, BPF_REG_8, -7, 24),
5678                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_8),
5679                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, 3),
5680                         BPF_ST_MEM(BPF_DW, BPF_REG_7, 0, 22),
5681                         BPF_ST_MEM(BPF_DW, BPF_REG_7, 4, 23),
5682                         BPF_ST_MEM(BPF_DW, BPF_REG_7, -4, 24),
5683                         BPF_EXIT_INSN(),
5684                 },
5685                 .fixup_map2 = { 3 },
5686                 .errstr_unpriv = "R0 leaks addr",
5687                 .result = ACCEPT,
5688                 .result_unpriv = REJECT,
5689                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
5690         },
5691         {
5692                 "map element value with unaligned load",
5693                 .insns = {
5694                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5695                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5696                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5697                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5698                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5699                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
5700                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
5701                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 9),
5702                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
5703                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
5704                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 2),
5705                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
5706                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 0),
5707                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 2),
5708                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 5),
5709                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
5710                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 4),
5711                         BPF_EXIT_INSN(),
5712                 },
5713                 .fixup_map2 = { 3 },
5714                 .errstr_unpriv = "R0 leaks addr",
5715                 .result = ACCEPT,
5716                 .result_unpriv = REJECT,
5717                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
5718         },
5719         {
5720                 "map element value illegal alu op, 1",
5721                 .insns = {
5722                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5723                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5724                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5725                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5726                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5727                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
5728                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 8),
5729                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
5730                         BPF_EXIT_INSN(),
5731                 },
5732                 .fixup_map2 = { 3 },
5733                 .errstr = "R0 bitwise operator &= on pointer",
5734                 .result = REJECT,
5735         },
5736         {
5737                 "map element value illegal alu op, 2",
5738                 .insns = {
5739                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5740                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5741                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5742                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5743                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5744                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
5745                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_0, 0),
5746                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
5747                         BPF_EXIT_INSN(),
5748                 },
5749                 .fixup_map2 = { 3 },
5750                 .errstr = "R0 32-bit pointer arithmetic prohibited",
5751                 .result = REJECT,
5752         },
5753         {
5754                 "map element value illegal alu op, 3",
5755                 .insns = {
5756                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5757                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5758                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5759                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5760                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5761                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
5762                         BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, 42),
5763                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
5764                         BPF_EXIT_INSN(),
5765                 },
5766                 .fixup_map2 = { 3 },
5767                 .errstr = "R0 pointer arithmetic with /= operator",
5768                 .result = REJECT,
5769         },
5770         {
5771                 "map element value illegal alu op, 4",
5772                 .insns = {
5773                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5774                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5775                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5776                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5777                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5778                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
5779                         BPF_ENDIAN(BPF_FROM_BE, BPF_REG_0, 64),
5780                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
5781                         BPF_EXIT_INSN(),
5782                 },
5783                 .fixup_map2 = { 3 },
5784                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
5785                 .errstr = "invalid mem access 'inv'",
5786                 .result = REJECT,
5787                 .result_unpriv = REJECT,
5788         },
5789         {
5790                 "map element value illegal alu op, 5",
5791                 .insns = {
5792                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5793                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5794                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5795                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5796                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5797                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5798                         BPF_MOV64_IMM(BPF_REG_3, 4096),
5799                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5800                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5801                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
5802                         BPF_STX_XADD(BPF_DW, BPF_REG_2, BPF_REG_3, 0),
5803                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0),
5804                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
5805                         BPF_EXIT_INSN(),
5806                 },
5807                 .fixup_map2 = { 3 },
5808                 .errstr = "R0 invalid mem access 'inv'",
5809                 .result = REJECT,
5810         },
5811         {
5812                 "map element value is preserved across register spilling",
5813                 .insns = {
5814                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5815                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5816                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5817                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5818                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5819                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5820                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0,
5821                                 offsetof(struct test_val, foo)),
5822                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
5823                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5824                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
5825                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
5826                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
5827                         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
5828                         BPF_EXIT_INSN(),
5829                 },
5830                 .fixup_map2 = { 3 },
5831                 .errstr_unpriv = "R0 leaks addr",
5832                 .result = ACCEPT,
5833                 .result_unpriv = REJECT,
5834                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
5835         },
5836         {
5837                 "helper access to variable memory: stack, bitwise AND + JMP, correct bounds",
5838                 .insns = {
5839                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5840                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5841                         BPF_MOV64_IMM(BPF_REG_0, 0),
5842                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
5843                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
5844                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
5845                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
5846                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
5847                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
5848                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
5849                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
5850                         BPF_MOV64_IMM(BPF_REG_2, 16),
5851                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5852                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5853                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
5854                         BPF_MOV64_IMM(BPF_REG_4, 0),
5855                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
5856                         BPF_MOV64_IMM(BPF_REG_3, 0),
5857                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5858                         BPF_MOV64_IMM(BPF_REG_0, 0),
5859                         BPF_EXIT_INSN(),
5860                 },
5861                 .result = ACCEPT,
5862                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5863         },
5864         {
5865                 "helper access to variable memory: stack, bitwise AND, zero included",
5866                 .insns = {
5867                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5868                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5869                         BPF_MOV64_IMM(BPF_REG_2, 16),
5870                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5871                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5872                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
5873                         BPF_MOV64_IMM(BPF_REG_3, 0),
5874                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5875                         BPF_EXIT_INSN(),
5876                 },
5877                 .errstr = "invalid indirect read from stack off -64+0 size 64",
5878                 .result = REJECT,
5879                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5880         },
5881         {
5882                 "helper access to variable memory: stack, bitwise AND + JMP, wrong max",
5883                 .insns = {
5884                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5885                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5886                         BPF_MOV64_IMM(BPF_REG_2, 16),
5887                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5888                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5889                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 65),
5890                         BPF_MOV64_IMM(BPF_REG_4, 0),
5891                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
5892                         BPF_MOV64_IMM(BPF_REG_3, 0),
5893                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5894                         BPF_MOV64_IMM(BPF_REG_0, 0),
5895                         BPF_EXIT_INSN(),
5896                 },
5897                 .errstr = "invalid stack type R1 off=-64 access_size=65",
5898                 .result = REJECT,
5899                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5900         },
5901         {
5902                 "helper access to variable memory: stack, JMP, correct bounds",
5903                 .insns = {
5904                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5905                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5906                         BPF_MOV64_IMM(BPF_REG_0, 0),
5907                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
5908                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
5909                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
5910                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
5911                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
5912                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
5913                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
5914                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
5915                         BPF_MOV64_IMM(BPF_REG_2, 16),
5916                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5917                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5918                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 4),
5919                         BPF_MOV64_IMM(BPF_REG_4, 0),
5920                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
5921                         BPF_MOV64_IMM(BPF_REG_3, 0),
5922                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5923                         BPF_MOV64_IMM(BPF_REG_0, 0),
5924                         BPF_EXIT_INSN(),
5925                 },
5926                 .result = ACCEPT,
5927                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5928         },
5929         {
5930                 "helper access to variable memory: stack, JMP (signed), correct bounds",
5931                 .insns = {
5932                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5933                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5934                         BPF_MOV64_IMM(BPF_REG_0, 0),
5935                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
5936                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
5937                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
5938                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
5939                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
5940                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
5941                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
5942                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
5943                         BPF_MOV64_IMM(BPF_REG_2, 16),
5944                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5945                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5946                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 4),
5947                         BPF_MOV64_IMM(BPF_REG_4, 0),
5948                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
5949                         BPF_MOV64_IMM(BPF_REG_3, 0),
5950                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5951                         BPF_MOV64_IMM(BPF_REG_0, 0),
5952                         BPF_EXIT_INSN(),
5953                 },
5954                 .result = ACCEPT,
5955                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5956         },
5957         {
5958                 "helper access to variable memory: stack, JMP, bounds + offset",
5959                 .insns = {
5960                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5961                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5962                         BPF_MOV64_IMM(BPF_REG_2, 16),
5963                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5964                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5965                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 5),
5966                         BPF_MOV64_IMM(BPF_REG_4, 0),
5967                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 3),
5968                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
5969                         BPF_MOV64_IMM(BPF_REG_3, 0),
5970                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5971                         BPF_MOV64_IMM(BPF_REG_0, 0),
5972                         BPF_EXIT_INSN(),
5973                 },
5974                 .errstr = "invalid stack type R1 off=-64 access_size=65",
5975                 .result = REJECT,
5976                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5977         },
5978         {
5979                 "helper access to variable memory: stack, JMP, wrong max",
5980                 .insns = {
5981                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
5982                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
5983                         BPF_MOV64_IMM(BPF_REG_2, 16),
5984                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
5985                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
5986                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 65, 4),
5987                         BPF_MOV64_IMM(BPF_REG_4, 0),
5988                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
5989                         BPF_MOV64_IMM(BPF_REG_3, 0),
5990                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5991                         BPF_MOV64_IMM(BPF_REG_0, 0),
5992                         BPF_EXIT_INSN(),
5993                 },
5994                 .errstr = "invalid stack type R1 off=-64 access_size=65",
5995                 .result = REJECT,
5996                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5997         },
5998         {
5999                 "helper access to variable memory: stack, JMP, no max check",
6000                 .insns = {
6001                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6002                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6003                         BPF_MOV64_IMM(BPF_REG_2, 16),
6004                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6005                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6006                         BPF_MOV64_IMM(BPF_REG_4, 0),
6007                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
6008                         BPF_MOV64_IMM(BPF_REG_3, 0),
6009                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6010                         BPF_MOV64_IMM(BPF_REG_0, 0),
6011                         BPF_EXIT_INSN(),
6012                 },
6013                 /* because max wasn't checked, signed min is negative */
6014                 .errstr = "R2 min value is negative, either use unsigned or 'var &= const'",
6015                 .result = REJECT,
6016                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6017         },
6018         {
6019                 "helper access to variable memory: stack, JMP, no min check",
6020                 .insns = {
6021                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6022                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6023                         BPF_MOV64_IMM(BPF_REG_2, 16),
6024                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6025                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6026                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 3),
6027                         BPF_MOV64_IMM(BPF_REG_3, 0),
6028                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6029                         BPF_MOV64_IMM(BPF_REG_0, 0),
6030                         BPF_EXIT_INSN(),
6031                 },
6032                 .errstr = "invalid indirect read from stack off -64+0 size 64",
6033                 .result = REJECT,
6034                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6035         },
6036         {
6037                 "helper access to variable memory: stack, JMP (signed), no min check",
6038                 .insns = {
6039                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6040                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6041                         BPF_MOV64_IMM(BPF_REG_2, 16),
6042                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6043                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6044                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 3),
6045                         BPF_MOV64_IMM(BPF_REG_3, 0),
6046                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6047                         BPF_MOV64_IMM(BPF_REG_0, 0),
6048                         BPF_EXIT_INSN(),
6049                 },
6050                 .errstr = "R2 min value is negative",
6051                 .result = REJECT,
6052                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6053         },
6054         {
6055                 "helper access to variable memory: map, JMP, correct bounds",
6056                 .insns = {
6057                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6058                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6059                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6060                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6061                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6062                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
6063                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6064                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
6065                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
6066                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
6067                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
6068                                 sizeof(struct test_val), 4),
6069                         BPF_MOV64_IMM(BPF_REG_4, 0),
6070                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
6071                         BPF_MOV64_IMM(BPF_REG_3, 0),
6072                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6073                         BPF_MOV64_IMM(BPF_REG_0, 0),
6074                         BPF_EXIT_INSN(),
6075                 },
6076                 .fixup_map2 = { 3 },
6077                 .result = ACCEPT,
6078                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6079         },
6080         {
6081                 "helper access to variable memory: map, JMP, wrong max",
6082                 .insns = {
6083                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6084                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6085                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6086                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6087                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6088                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
6089                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6090                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
6091                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
6092                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
6093                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
6094                                 sizeof(struct test_val) + 1, 4),
6095                         BPF_MOV64_IMM(BPF_REG_4, 0),
6096                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
6097                         BPF_MOV64_IMM(BPF_REG_3, 0),
6098                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6099                         BPF_MOV64_IMM(BPF_REG_0, 0),
6100                         BPF_EXIT_INSN(),
6101                 },
6102                 .fixup_map2 = { 3 },
6103                 .errstr = "invalid access to map value, value_size=48 off=0 size=49",
6104                 .result = REJECT,
6105                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6106         },
6107         {
6108                 "helper access to variable memory: map adjusted, JMP, correct bounds",
6109                 .insns = {
6110                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6111                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6112                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6113                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6114                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6115                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
6116                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6117                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
6118                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
6119                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
6120                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
6121                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
6122                                 sizeof(struct test_val) - 20, 4),
6123                         BPF_MOV64_IMM(BPF_REG_4, 0),
6124                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
6125                         BPF_MOV64_IMM(BPF_REG_3, 0),
6126                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6127                         BPF_MOV64_IMM(BPF_REG_0, 0),
6128                         BPF_EXIT_INSN(),
6129                 },
6130                 .fixup_map2 = { 3 },
6131                 .result = ACCEPT,
6132                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6133         },
6134         {
6135                 "helper access to variable memory: map adjusted, JMP, wrong max",
6136                 .insns = {
6137                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6138                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6139                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6140                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6141                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6142                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
6143                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6144                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
6145                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
6146                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
6147                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
6148                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
6149                                 sizeof(struct test_val) - 19, 4),
6150                         BPF_MOV64_IMM(BPF_REG_4, 0),
6151                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
6152                         BPF_MOV64_IMM(BPF_REG_3, 0),
6153                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6154                         BPF_MOV64_IMM(BPF_REG_0, 0),
6155                         BPF_EXIT_INSN(),
6156                 },
6157                 .fixup_map2 = { 3 },
6158                 .errstr = "R1 min value is outside of the array range",
6159                 .result = REJECT,
6160                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6161         },
6162         {
6163                 "helper access to variable memory: size = 0 allowed on NULL (ARG_PTR_TO_MEM_OR_NULL)",
6164                 .insns = {
6165                         BPF_MOV64_IMM(BPF_REG_1, 0),
6166                         BPF_MOV64_IMM(BPF_REG_2, 0),
6167                         BPF_MOV64_IMM(BPF_REG_3, 0),
6168                         BPF_MOV64_IMM(BPF_REG_4, 0),
6169                         BPF_MOV64_IMM(BPF_REG_5, 0),
6170                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6171                         BPF_EXIT_INSN(),
6172                 },
6173                 .result = ACCEPT,
6174                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6175         },
6176         {
6177                 "helper access to variable memory: size > 0 not allowed on NULL (ARG_PTR_TO_MEM_OR_NULL)",
6178                 .insns = {
6179                         BPF_MOV64_IMM(BPF_REG_1, 0),
6180                         BPF_MOV64_IMM(BPF_REG_2, 1),
6181                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
6182                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
6183                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
6184                         BPF_MOV64_IMM(BPF_REG_3, 0),
6185                         BPF_MOV64_IMM(BPF_REG_4, 0),
6186                         BPF_MOV64_IMM(BPF_REG_5, 0),
6187                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6188                         BPF_EXIT_INSN(),
6189                 },
6190                 .errstr = "R1 type=inv expected=fp",
6191                 .result = REJECT,
6192                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6193         },
6194         {
6195                 "helper access to variable memory: size = 0 allowed on != NULL stack pointer (ARG_PTR_TO_MEM_OR_NULL)",
6196                 .insns = {
6197                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6198                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
6199                         BPF_MOV64_IMM(BPF_REG_2, 0),
6200                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
6201                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 8),
6202                         BPF_MOV64_IMM(BPF_REG_3, 0),
6203                         BPF_MOV64_IMM(BPF_REG_4, 0),
6204                         BPF_MOV64_IMM(BPF_REG_5, 0),
6205                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6206                         BPF_EXIT_INSN(),
6207                 },
6208                 .result = ACCEPT,
6209                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6210         },
6211         {
6212                 "helper access to variable memory: size = 0 allowed on != NULL map pointer (ARG_PTR_TO_MEM_OR_NULL)",
6213                 .insns = {
6214                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6215                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6216                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6217                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6218                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6219                                      BPF_FUNC_map_lookup_elem),
6220                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6221                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6222                         BPF_MOV64_IMM(BPF_REG_2, 0),
6223                         BPF_MOV64_IMM(BPF_REG_3, 0),
6224                         BPF_MOV64_IMM(BPF_REG_4, 0),
6225                         BPF_MOV64_IMM(BPF_REG_5, 0),
6226                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6227                         BPF_EXIT_INSN(),
6228                 },
6229                 .fixup_map1 = { 3 },
6230                 .result = ACCEPT,
6231                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6232         },
6233         {
6234                 "helper access to variable memory: size possible = 0 allowed on != NULL stack pointer (ARG_PTR_TO_MEM_OR_NULL)",
6235                 .insns = {
6236                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6237                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6238                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6239                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6240                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6241                                      BPF_FUNC_map_lookup_elem),
6242                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6243                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
6244                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 7),
6245                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6246                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
6247                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
6248                         BPF_MOV64_IMM(BPF_REG_3, 0),
6249                         BPF_MOV64_IMM(BPF_REG_4, 0),
6250                         BPF_MOV64_IMM(BPF_REG_5, 0),
6251                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6252                         BPF_EXIT_INSN(),
6253                 },
6254                 .fixup_map1 = { 3 },
6255                 .result = ACCEPT,
6256                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6257         },
6258         {
6259                 "helper access to variable memory: size possible = 0 allowed on != NULL map pointer (ARG_PTR_TO_MEM_OR_NULL)",
6260                 .insns = {
6261                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6262                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6263                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6264                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6265                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6266                                      BPF_FUNC_map_lookup_elem),
6267                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6268                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6269                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
6270                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
6271                         BPF_MOV64_IMM(BPF_REG_3, 0),
6272                         BPF_MOV64_IMM(BPF_REG_4, 0),
6273                         BPF_MOV64_IMM(BPF_REG_5, 0),
6274                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6275                         BPF_EXIT_INSN(),
6276                 },
6277                 .fixup_map1 = { 3 },
6278                 .result = ACCEPT,
6279                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6280         },
6281         {
6282                 "helper access to variable memory: size possible = 0 allowed on != NULL packet pointer (ARG_PTR_TO_MEM_OR_NULL)",
6283                 .insns = {
6284                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
6285                                     offsetof(struct __sk_buff, data)),
6286                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
6287                                     offsetof(struct __sk_buff, data_end)),
6288                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_6),
6289                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
6290                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),
6291                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
6292                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 0),
6293                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
6294                         BPF_MOV64_IMM(BPF_REG_3, 0),
6295                         BPF_MOV64_IMM(BPF_REG_4, 0),
6296                         BPF_MOV64_IMM(BPF_REG_5, 0),
6297                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6298                         BPF_EXIT_INSN(),
6299                 },
6300                 .result = ACCEPT,
6301                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6302                 .retval = 0 /* csum_diff of 64-byte packet */,
6303         },
6304         {
6305                 "helper access to variable memory: size = 0 not allowed on NULL (!ARG_PTR_TO_MEM_OR_NULL)",
6306                 .insns = {
6307                         BPF_MOV64_IMM(BPF_REG_1, 0),
6308                         BPF_MOV64_IMM(BPF_REG_2, 0),
6309                         BPF_MOV64_IMM(BPF_REG_3, 0),
6310                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6311                         BPF_EXIT_INSN(),
6312                 },
6313                 .errstr = "R1 type=inv expected=fp",
6314                 .result = REJECT,
6315                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6316         },
6317         {
6318                 "helper access to variable memory: size > 0 not allowed on NULL (!ARG_PTR_TO_MEM_OR_NULL)",
6319                 .insns = {
6320                         BPF_MOV64_IMM(BPF_REG_1, 0),
6321                         BPF_MOV64_IMM(BPF_REG_2, 1),
6322                         BPF_MOV64_IMM(BPF_REG_3, 0),
6323                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6324                         BPF_EXIT_INSN(),
6325                 },
6326                 .errstr = "R1 type=inv expected=fp",
6327                 .result = REJECT,
6328                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6329         },
6330         {
6331                 "helper access to variable memory: size = 0 allowed on != NULL stack pointer (!ARG_PTR_TO_MEM_OR_NULL)",
6332                 .insns = {
6333                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6334                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
6335                         BPF_MOV64_IMM(BPF_REG_2, 0),
6336                         BPF_MOV64_IMM(BPF_REG_3, 0),
6337                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6338                         BPF_EXIT_INSN(),
6339                 },
6340                 .result = ACCEPT,
6341                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6342         },
6343         {
6344                 "helper access to variable memory: size = 0 allowed on != NULL map pointer (!ARG_PTR_TO_MEM_OR_NULL)",
6345                 .insns = {
6346                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6347                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6348                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6349                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6350                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6351                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6352                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6353                         BPF_MOV64_IMM(BPF_REG_2, 0),
6354                         BPF_MOV64_IMM(BPF_REG_3, 0),
6355                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6356                         BPF_EXIT_INSN(),
6357                 },
6358                 .fixup_map1 = { 3 },
6359                 .result = ACCEPT,
6360                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6361         },
6362         {
6363                 "helper access to variable memory: size possible = 0 allowed on != NULL stack pointer (!ARG_PTR_TO_MEM_OR_NULL)",
6364                 .insns = {
6365                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6366                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6367                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6368                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6369                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6370                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6371                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
6372                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
6373                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6374                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
6375                         BPF_MOV64_IMM(BPF_REG_3, 0),
6376                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6377                         BPF_EXIT_INSN(),
6378                 },
6379                 .fixup_map1 = { 3 },
6380                 .result = ACCEPT,
6381                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6382         },
6383         {
6384                 "helper access to variable memory: size possible = 0 allowed on != NULL map pointer (!ARG_PTR_TO_MEM_OR_NULL)",
6385                 .insns = {
6386                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6387                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6388                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6389                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6390                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6391                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
6392                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6393                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
6394                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 2),
6395                         BPF_MOV64_IMM(BPF_REG_3, 0),
6396                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6397                         BPF_EXIT_INSN(),
6398                 },
6399                 .fixup_map1 = { 3 },
6400                 .result = ACCEPT,
6401                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6402         },
6403         {
6404                 "helper access to variable memory: 8 bytes leak",
6405                 .insns = {
6406                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6407                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6408                         BPF_MOV64_IMM(BPF_REG_0, 0),
6409                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
6410                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
6411                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
6412                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
6413                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
6414                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
6415                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
6416                         BPF_MOV64_IMM(BPF_REG_2, 1),
6417                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
6418                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
6419                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 63),
6420                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
6421                         BPF_MOV64_IMM(BPF_REG_3, 0),
6422                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6423                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6424                         BPF_EXIT_INSN(),
6425                 },
6426                 .errstr = "invalid indirect read from stack off -64+32 size 64",
6427                 .result = REJECT,
6428                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6429         },
6430         {
6431                 "helper access to variable memory: 8 bytes no leak (init memory)",
6432                 .insns = {
6433                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6434                         BPF_MOV64_IMM(BPF_REG_0, 0),
6435                         BPF_MOV64_IMM(BPF_REG_0, 0),
6436                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
6437                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
6438                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
6439                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
6440                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
6441                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
6442                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
6443                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
6444                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6445                         BPF_MOV64_IMM(BPF_REG_2, 0),
6446                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 32),
6447                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 32),
6448                         BPF_MOV64_IMM(BPF_REG_3, 0),
6449                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6450                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6451                         BPF_EXIT_INSN(),
6452                 },
6453                 .result = ACCEPT,
6454                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6455         },
6456         {
6457                 "invalid and of negative number",
6458                 .insns = {
6459                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6460                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6461                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6462                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6463                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6464                                      BPF_FUNC_map_lookup_elem),
6465                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6466                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
6467                         BPF_ALU64_IMM(BPF_AND, BPF_REG_1, -4),
6468                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
6469                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6470                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
6471                                    offsetof(struct test_val, foo)),
6472                         BPF_EXIT_INSN(),
6473                 },
6474                 .fixup_map2 = { 3 },
6475                 .errstr = "R0 max value is outside of the array range",
6476                 .result = REJECT,
6477                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
6478         },
6479         {
6480                 "invalid range check",
6481                 .insns = {
6482                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6483                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6484                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6485                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6486                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6487                                      BPF_FUNC_map_lookup_elem),
6488                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 12),
6489                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
6490                         BPF_MOV64_IMM(BPF_REG_9, 1),
6491                         BPF_ALU32_IMM(BPF_MOD, BPF_REG_1, 2),
6492                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 1),
6493                         BPF_ALU32_REG(BPF_AND, BPF_REG_9, BPF_REG_1),
6494                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_9, 1),
6495                         BPF_ALU32_IMM(BPF_RSH, BPF_REG_9, 1),
6496                         BPF_MOV32_IMM(BPF_REG_3, 1),
6497                         BPF_ALU32_REG(BPF_SUB, BPF_REG_3, BPF_REG_9),
6498                         BPF_ALU32_IMM(BPF_MUL, BPF_REG_3, 0x10000000),
6499                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
6500                         BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_3, 0),
6501                         BPF_MOV64_REG(BPF_REG_0, 0),
6502                         BPF_EXIT_INSN(),
6503                 },
6504                 .fixup_map2 = { 3 },
6505                 .errstr = "R0 max value is outside of the array range",
6506                 .result = REJECT,
6507                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
6508         },
6509         {
6510                 "map in map access",
6511                 .insns = {
6512                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
6513                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6514                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
6515                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6516                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6517                                      BPF_FUNC_map_lookup_elem),
6518                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
6519                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
6520                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6521                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
6522                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6523                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6524                                      BPF_FUNC_map_lookup_elem),
6525                         BPF_MOV64_REG(BPF_REG_0, 0),
6526                         BPF_EXIT_INSN(),
6527                 },
6528                 .fixup_map_in_map = { 3 },
6529                 .result = ACCEPT,
6530         },
6531         {
6532                 "invalid inner map pointer",
6533                 .insns = {
6534                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
6535                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6536                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
6537                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6538                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6539                                      BPF_FUNC_map_lookup_elem),
6540                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6541                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
6542                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6543                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
6544                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6545                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
6546                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6547                                      BPF_FUNC_map_lookup_elem),
6548                         BPF_MOV64_REG(BPF_REG_0, 0),
6549                         BPF_EXIT_INSN(),
6550                 },
6551                 .fixup_map_in_map = { 3 },
6552                 .errstr = "R1 pointer arithmetic on CONST_PTR_TO_MAP prohibited",
6553                 .result = REJECT,
6554         },
6555         {
6556                 "forgot null checking on the inner map pointer",
6557                 .insns = {
6558                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
6559                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6560                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
6561                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6562                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6563                                      BPF_FUNC_map_lookup_elem),
6564                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
6565                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6566                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
6567                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6568                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6569                                      BPF_FUNC_map_lookup_elem),
6570                         BPF_MOV64_REG(BPF_REG_0, 0),
6571                         BPF_EXIT_INSN(),
6572                 },
6573                 .fixup_map_in_map = { 3 },
6574                 .errstr = "R1 type=map_value_or_null expected=map_ptr",
6575                 .result = REJECT,
6576         },
6577         {
6578                 "ld_abs: check calling conv, r1",
6579                 .insns = {
6580                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6581                         BPF_MOV64_IMM(BPF_REG_1, 0),
6582                         BPF_LD_ABS(BPF_W, -0x200000),
6583                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
6584                         BPF_EXIT_INSN(),
6585                 },
6586                 .errstr = "R1 !read_ok",
6587                 .result = REJECT,
6588         },
6589         {
6590                 "ld_abs: check calling conv, r2",
6591                 .insns = {
6592                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6593                         BPF_MOV64_IMM(BPF_REG_2, 0),
6594                         BPF_LD_ABS(BPF_W, -0x200000),
6595                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
6596                         BPF_EXIT_INSN(),
6597                 },
6598                 .errstr = "R2 !read_ok",
6599                 .result = REJECT,
6600         },
6601         {
6602                 "ld_abs: check calling conv, r3",
6603                 .insns = {
6604                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6605                         BPF_MOV64_IMM(BPF_REG_3, 0),
6606                         BPF_LD_ABS(BPF_W, -0x200000),
6607                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
6608                         BPF_EXIT_INSN(),
6609                 },
6610                 .errstr = "R3 !read_ok",
6611                 .result = REJECT,
6612         },
6613         {
6614                 "ld_abs: check calling conv, r4",
6615                 .insns = {
6616                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6617                         BPF_MOV64_IMM(BPF_REG_4, 0),
6618                         BPF_LD_ABS(BPF_W, -0x200000),
6619                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
6620                         BPF_EXIT_INSN(),
6621                 },
6622                 .errstr = "R4 !read_ok",
6623                 .result = REJECT,
6624         },
6625         {
6626                 "ld_abs: check calling conv, r5",
6627                 .insns = {
6628                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6629                         BPF_MOV64_IMM(BPF_REG_5, 0),
6630                         BPF_LD_ABS(BPF_W, -0x200000),
6631                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
6632                         BPF_EXIT_INSN(),
6633                 },
6634                 .errstr = "R5 !read_ok",
6635                 .result = REJECT,
6636         },
6637         {
6638                 "ld_abs: check calling conv, r7",
6639                 .insns = {
6640                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6641                         BPF_MOV64_IMM(BPF_REG_7, 0),
6642                         BPF_LD_ABS(BPF_W, -0x200000),
6643                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
6644                         BPF_EXIT_INSN(),
6645                 },
6646                 .result = ACCEPT,
6647         },
6648         {
6649                 "ld_abs: tests on r6 and skb data reload helper",
6650                 .insns = {
6651                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6652                         BPF_LD_ABS(BPF_B, 0),
6653                         BPF_LD_ABS(BPF_H, 0),
6654                         BPF_LD_ABS(BPF_W, 0),
6655                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
6656                         BPF_MOV64_IMM(BPF_REG_6, 0),
6657                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
6658                         BPF_MOV64_IMM(BPF_REG_2, 1),
6659                         BPF_MOV64_IMM(BPF_REG_3, 2),
6660                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6661                                      BPF_FUNC_skb_vlan_push),
6662                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
6663                         BPF_LD_ABS(BPF_B, 0),
6664                         BPF_LD_ABS(BPF_H, 0),
6665                         BPF_LD_ABS(BPF_W, 0),
6666                         BPF_MOV64_IMM(BPF_REG_0, 42),
6667                         BPF_EXIT_INSN(),
6668                 },
6669                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6670                 .result = ACCEPT,
6671                 .retval = 42 /* ultimate return value */,
6672         },
6673         {
6674                 "ld_ind: check calling conv, r1",
6675                 .insns = {
6676                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6677                         BPF_MOV64_IMM(BPF_REG_1, 1),
6678                         BPF_LD_IND(BPF_W, BPF_REG_1, -0x200000),
6679                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
6680                         BPF_EXIT_INSN(),
6681                 },
6682                 .errstr = "R1 !read_ok",
6683                 .result = REJECT,
6684         },
6685         {
6686                 "ld_ind: check calling conv, r2",
6687                 .insns = {
6688                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6689                         BPF_MOV64_IMM(BPF_REG_2, 1),
6690                         BPF_LD_IND(BPF_W, BPF_REG_2, -0x200000),
6691                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
6692                         BPF_EXIT_INSN(),
6693                 },
6694                 .errstr = "R2 !read_ok",
6695                 .result = REJECT,
6696         },
6697         {
6698                 "ld_ind: check calling conv, r3",
6699                 .insns = {
6700                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6701                         BPF_MOV64_IMM(BPF_REG_3, 1),
6702                         BPF_LD_IND(BPF_W, BPF_REG_3, -0x200000),
6703                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
6704                         BPF_EXIT_INSN(),
6705                 },
6706                 .errstr = "R3 !read_ok",
6707                 .result = REJECT,
6708         },
6709         {
6710                 "ld_ind: check calling conv, r4",
6711                 .insns = {
6712                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6713                         BPF_MOV64_IMM(BPF_REG_4, 1),
6714                         BPF_LD_IND(BPF_W, BPF_REG_4, -0x200000),
6715                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
6716                         BPF_EXIT_INSN(),
6717                 },
6718                 .errstr = "R4 !read_ok",
6719                 .result = REJECT,
6720         },
6721         {
6722                 "ld_ind: check calling conv, r5",
6723                 .insns = {
6724                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6725                         BPF_MOV64_IMM(BPF_REG_5, 1),
6726                         BPF_LD_IND(BPF_W, BPF_REG_5, -0x200000),
6727                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
6728                         BPF_EXIT_INSN(),
6729                 },
6730                 .errstr = "R5 !read_ok",
6731                 .result = REJECT,
6732         },
6733         {
6734                 "ld_ind: check calling conv, r7",
6735                 .insns = {
6736                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
6737                         BPF_MOV64_IMM(BPF_REG_7, 1),
6738                         BPF_LD_IND(BPF_W, BPF_REG_7, -0x200000),
6739                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
6740                         BPF_EXIT_INSN(),
6741                 },
6742                 .result = ACCEPT,
6743                 .retval = 1,
6744         },
6745         {
6746                 "check bpf_perf_event_data->sample_period byte load permitted",
6747                 .insns = {
6748                         BPF_MOV64_IMM(BPF_REG_0, 0),
6749 #if __BYTE_ORDER == __LITTLE_ENDIAN
6750                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
6751                                     offsetof(struct bpf_perf_event_data, sample_period)),
6752 #else
6753                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
6754                                     offsetof(struct bpf_perf_event_data, sample_period) + 7),
6755 #endif
6756                         BPF_EXIT_INSN(),
6757                 },
6758                 .result = ACCEPT,
6759                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
6760         },
6761         {
6762                 "check bpf_perf_event_data->sample_period half load permitted",
6763                 .insns = {
6764                         BPF_MOV64_IMM(BPF_REG_0, 0),
6765 #if __BYTE_ORDER == __LITTLE_ENDIAN
6766                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
6767                                     offsetof(struct bpf_perf_event_data, sample_period)),
6768 #else
6769                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
6770                                     offsetof(struct bpf_perf_event_data, sample_period) + 6),
6771 #endif
6772                         BPF_EXIT_INSN(),
6773                 },
6774                 .result = ACCEPT,
6775                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
6776         },
6777         {
6778                 "check bpf_perf_event_data->sample_period word load permitted",
6779                 .insns = {
6780                         BPF_MOV64_IMM(BPF_REG_0, 0),
6781 #if __BYTE_ORDER == __LITTLE_ENDIAN
6782                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
6783                                     offsetof(struct bpf_perf_event_data, sample_period)),
6784 #else
6785                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
6786                                     offsetof(struct bpf_perf_event_data, sample_period) + 4),
6787 #endif
6788                         BPF_EXIT_INSN(),
6789                 },
6790                 .result = ACCEPT,
6791                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
6792         },
6793         {
6794                 "check bpf_perf_event_data->sample_period dword load permitted",
6795                 .insns = {
6796                         BPF_MOV64_IMM(BPF_REG_0, 0),
6797                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
6798                                     offsetof(struct bpf_perf_event_data, sample_period)),
6799                         BPF_EXIT_INSN(),
6800                 },
6801                 .result = ACCEPT,
6802                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
6803         },
6804         {
6805                 "check skb->data half load not permitted",
6806                 .insns = {
6807                         BPF_MOV64_IMM(BPF_REG_0, 0),
6808 #if __BYTE_ORDER == __LITTLE_ENDIAN
6809                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
6810                                     offsetof(struct __sk_buff, data)),
6811 #else
6812                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
6813                                     offsetof(struct __sk_buff, data) + 2),
6814 #endif
6815                         BPF_EXIT_INSN(),
6816                 },
6817                 .result = REJECT,
6818                 .errstr = "invalid bpf_context access",
6819         },
6820         {
6821                 "check skb->tc_classid half load not permitted for lwt prog",
6822                 .insns = {
6823                         BPF_MOV64_IMM(BPF_REG_0, 0),
6824 #if __BYTE_ORDER == __LITTLE_ENDIAN
6825                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
6826                                     offsetof(struct __sk_buff, tc_classid)),
6827 #else
6828                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
6829                                     offsetof(struct __sk_buff, tc_classid) + 2),
6830 #endif
6831                         BPF_EXIT_INSN(),
6832                 },
6833                 .result = REJECT,
6834                 .errstr = "invalid bpf_context access",
6835                 .prog_type = BPF_PROG_TYPE_LWT_IN,
6836         },
6837         {
6838                 "bounds checks mixing signed and unsigned, positive bounds",
6839                 .insns = {
6840                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6841                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6842                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6843                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6844                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6845                                      BPF_FUNC_map_lookup_elem),
6846                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6847                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6848                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6849                         BPF_MOV64_IMM(BPF_REG_2, 2),
6850                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 3),
6851                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 4, 2),
6852                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6853                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6854                         BPF_MOV64_IMM(BPF_REG_0, 0),
6855                         BPF_EXIT_INSN(),
6856                 },
6857                 .fixup_map1 = { 3 },
6858                 .errstr = "unbounded min value",
6859                 .result = REJECT,
6860         },
6861         {
6862                 "bounds checks mixing signed and unsigned",
6863                 .insns = {
6864                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6865                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6866                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6867                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6868                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6869                                      BPF_FUNC_map_lookup_elem),
6870                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6871                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6872                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6873                         BPF_MOV64_IMM(BPF_REG_2, -1),
6874                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
6875                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
6876                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6877                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6878                         BPF_MOV64_IMM(BPF_REG_0, 0),
6879                         BPF_EXIT_INSN(),
6880                 },
6881                 .fixup_map1 = { 3 },
6882                 .errstr = "unbounded min value",
6883                 .result = REJECT,
6884         },
6885         {
6886                 "bounds checks mixing signed and unsigned, variant 2",
6887                 .insns = {
6888                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6889                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6890                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6891                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6892                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6893                                      BPF_FUNC_map_lookup_elem),
6894                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6895                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6896                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6897                         BPF_MOV64_IMM(BPF_REG_2, -1),
6898                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
6899                         BPF_MOV64_IMM(BPF_REG_8, 0),
6900                         BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_1),
6901                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
6902                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
6903                         BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
6904                         BPF_MOV64_IMM(BPF_REG_0, 0),
6905                         BPF_EXIT_INSN(),
6906                 },
6907                 .fixup_map1 = { 3 },
6908                 .errstr = "unbounded min value",
6909                 .result = REJECT,
6910         },
6911         {
6912                 "bounds checks mixing signed and unsigned, variant 3",
6913                 .insns = {
6914                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6915                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6916                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6917                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6918                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6919                                      BPF_FUNC_map_lookup_elem),
6920                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
6921                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6922                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6923                         BPF_MOV64_IMM(BPF_REG_2, -1),
6924                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 4),
6925                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
6926                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
6927                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
6928                         BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
6929                         BPF_MOV64_IMM(BPF_REG_0, 0),
6930                         BPF_EXIT_INSN(),
6931                 },
6932                 .fixup_map1 = { 3 },
6933                 .errstr = "unbounded min value",
6934                 .result = REJECT,
6935         },
6936         {
6937                 "bounds checks mixing signed and unsigned, variant 4",
6938                 .insns = {
6939                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6940                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6941                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6942                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6943                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6944                                      BPF_FUNC_map_lookup_elem),
6945                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6946                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6947                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6948                         BPF_MOV64_IMM(BPF_REG_2, 1),
6949                         BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
6950                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
6951                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
6952                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6953                         BPF_MOV64_IMM(BPF_REG_0, 0),
6954                         BPF_EXIT_INSN(),
6955                 },
6956                 .fixup_map1 = { 3 },
6957                 .result = ACCEPT,
6958         },
6959         {
6960                 "bounds checks mixing signed and unsigned, variant 5",
6961                 .insns = {
6962                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6963                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6964                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6965                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6966                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6967                                      BPF_FUNC_map_lookup_elem),
6968                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6969                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6970                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
6971                         BPF_MOV64_IMM(BPF_REG_2, -1),
6972                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
6973                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 4),
6974                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 4),
6975                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
6976                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
6977                         BPF_MOV64_IMM(BPF_REG_0, 0),
6978                         BPF_EXIT_INSN(),
6979                 },
6980                 .fixup_map1 = { 3 },
6981                 .errstr = "unbounded min value",
6982                 .result = REJECT,
6983         },
6984         {
6985                 "bounds checks mixing signed and unsigned, variant 6",
6986                 .insns = {
6987                         BPF_MOV64_IMM(BPF_REG_2, 0),
6988                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_10),
6989                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, -512),
6990                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
6991                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -16),
6992                         BPF_MOV64_IMM(BPF_REG_6, -1),
6993                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_6, 5),
6994                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_4, 1, 4),
6995                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 1),
6996                         BPF_MOV64_IMM(BPF_REG_5, 0),
6997                         BPF_ST_MEM(BPF_H, BPF_REG_10, -512, 0),
6998                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6999                                      BPF_FUNC_skb_load_bytes),
7000                         BPF_MOV64_IMM(BPF_REG_0, 0),
7001                         BPF_EXIT_INSN(),
7002                 },
7003                 .errstr = "R4 min value is negative, either use unsigned",
7004                 .result = REJECT,
7005         },
7006         {
7007                 "bounds checks mixing signed and unsigned, variant 7",
7008                 .insns = {
7009                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7010                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7011                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7012                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7013                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7014                                      BPF_FUNC_map_lookup_elem),
7015                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
7016                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7017                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7018                         BPF_MOV64_IMM(BPF_REG_2, 1024 * 1024 * 1024),
7019                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
7020                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7021                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7022                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7023                         BPF_MOV64_IMM(BPF_REG_0, 0),
7024                         BPF_EXIT_INSN(),
7025                 },
7026                 .fixup_map1 = { 3 },
7027                 .result = ACCEPT,
7028         },
7029         {
7030                 "bounds checks mixing signed and unsigned, variant 8",
7031                 .insns = {
7032                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7033                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7034                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7035                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7036                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7037                                      BPF_FUNC_map_lookup_elem),
7038                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7039                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7040                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7041                         BPF_MOV64_IMM(BPF_REG_2, -1),
7042                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
7043                         BPF_MOV64_IMM(BPF_REG_0, 0),
7044                         BPF_EXIT_INSN(),
7045                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7046                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7047                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7048                         BPF_MOV64_IMM(BPF_REG_0, 0),
7049                         BPF_EXIT_INSN(),
7050                 },
7051                 .fixup_map1 = { 3 },
7052                 .errstr = "unbounded min value",
7053                 .result = REJECT,
7054         },
7055         {
7056                 "bounds checks mixing signed and unsigned, variant 9",
7057                 .insns = {
7058                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7059                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7060                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7061                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7062                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7063                                      BPF_FUNC_map_lookup_elem),
7064                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
7065                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7066                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7067                         BPF_LD_IMM64(BPF_REG_2, -9223372036854775808ULL),
7068                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
7069                         BPF_MOV64_IMM(BPF_REG_0, 0),
7070                         BPF_EXIT_INSN(),
7071                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7072                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7073                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7074                         BPF_MOV64_IMM(BPF_REG_0, 0),
7075                         BPF_EXIT_INSN(),
7076                 },
7077                 .fixup_map1 = { 3 },
7078                 .result = ACCEPT,
7079         },
7080         {
7081                 "bounds checks mixing signed and unsigned, variant 10",
7082                 .insns = {
7083                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7084                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7085                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7086                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7087                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7088                                      BPF_FUNC_map_lookup_elem),
7089                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7090                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7091                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7092                         BPF_MOV64_IMM(BPF_REG_2, 0),
7093                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
7094                         BPF_MOV64_IMM(BPF_REG_0, 0),
7095                         BPF_EXIT_INSN(),
7096                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7097                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7098                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7099                         BPF_MOV64_IMM(BPF_REG_0, 0),
7100                         BPF_EXIT_INSN(),
7101                 },
7102                 .fixup_map1 = { 3 },
7103                 .errstr = "unbounded min value",
7104                 .result = REJECT,
7105         },
7106         {
7107                 "bounds checks mixing signed and unsigned, variant 11",
7108                 .insns = {
7109                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7110                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7111                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7112                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7113                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7114                                      BPF_FUNC_map_lookup_elem),
7115                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7116                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7117                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7118                         BPF_MOV64_IMM(BPF_REG_2, -1),
7119                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
7120                         /* Dead branch. */
7121                         BPF_MOV64_IMM(BPF_REG_0, 0),
7122                         BPF_EXIT_INSN(),
7123                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7124                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7125                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7126                         BPF_MOV64_IMM(BPF_REG_0, 0),
7127                         BPF_EXIT_INSN(),
7128                 },
7129                 .fixup_map1 = { 3 },
7130                 .errstr = "unbounded min value",
7131                 .result = REJECT,
7132         },
7133         {
7134                 "bounds checks mixing signed and unsigned, variant 12",
7135                 .insns = {
7136                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7137                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7138                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7139                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7140                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7141                                      BPF_FUNC_map_lookup_elem),
7142                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7143                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7144                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7145                         BPF_MOV64_IMM(BPF_REG_2, -6),
7146                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
7147                         BPF_MOV64_IMM(BPF_REG_0, 0),
7148                         BPF_EXIT_INSN(),
7149                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7150                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7151                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7152                         BPF_MOV64_IMM(BPF_REG_0, 0),
7153                         BPF_EXIT_INSN(),
7154                 },
7155                 .fixup_map1 = { 3 },
7156                 .errstr = "unbounded min value",
7157                 .result = REJECT,
7158         },
7159         {
7160                 "bounds checks mixing signed and unsigned, variant 13",
7161                 .insns = {
7162                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7163                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7164                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7165                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7166                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7167                                      BPF_FUNC_map_lookup_elem),
7168                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
7169                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7170                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7171                         BPF_MOV64_IMM(BPF_REG_2, 2),
7172                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
7173                         BPF_MOV64_IMM(BPF_REG_7, 1),
7174                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 0, 2),
7175                         BPF_MOV64_IMM(BPF_REG_0, 0),
7176                         BPF_EXIT_INSN(),
7177                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_1),
7178                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 4, 2),
7179                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_7),
7180                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7181                         BPF_MOV64_IMM(BPF_REG_0, 0),
7182                         BPF_EXIT_INSN(),
7183                 },
7184                 .fixup_map1 = { 3 },
7185                 .errstr = "unbounded min value",
7186                 .result = REJECT,
7187         },
7188         {
7189                 "bounds checks mixing signed and unsigned, variant 14",
7190                 .insns = {
7191                         BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
7192                                     offsetof(struct __sk_buff, mark)),
7193                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7194                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7195                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7196                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7197                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7198                                      BPF_FUNC_map_lookup_elem),
7199                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
7200                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7201                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7202                         BPF_MOV64_IMM(BPF_REG_2, -1),
7203                         BPF_MOV64_IMM(BPF_REG_8, 2),
7204                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_9, 42, 6),
7205                         BPF_JMP_REG(BPF_JSGT, BPF_REG_8, BPF_REG_1, 3),
7206                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7207                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7208                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7209                         BPF_MOV64_IMM(BPF_REG_0, 0),
7210                         BPF_EXIT_INSN(),
7211                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, -3),
7212                         BPF_JMP_IMM(BPF_JA, 0, 0, -7),
7213                 },
7214                 .fixup_map1 = { 4 },
7215                 .errstr = "R0 invalid mem access 'inv'",
7216                 .result = REJECT,
7217         },
7218         {
7219                 "bounds checks mixing signed and unsigned, variant 15",
7220                 .insns = {
7221                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7222                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7223                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7224                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7225                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7226                                      BPF_FUNC_map_lookup_elem),
7227                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7228                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7229                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7230                         BPF_MOV64_IMM(BPF_REG_2, -6),
7231                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
7232                         BPF_MOV64_IMM(BPF_REG_0, 0),
7233                         BPF_EXIT_INSN(),
7234                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7235                         BPF_JMP_IMM(BPF_JGT, BPF_REG_0, 1, 2),
7236                         BPF_MOV64_IMM(BPF_REG_0, 0),
7237                         BPF_EXIT_INSN(),
7238                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7239                         BPF_MOV64_IMM(BPF_REG_0, 0),
7240                         BPF_EXIT_INSN(),
7241                 },
7242                 .fixup_map1 = { 3 },
7243                 .errstr = "unbounded min value",
7244                 .result = REJECT,
7245                 .result_unpriv = REJECT,
7246         },
7247         {
7248                 "subtraction bounds (map value) variant 1",
7249                 .insns = {
7250                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7251                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7252                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7253                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7254                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7255                                      BPF_FUNC_map_lookup_elem),
7256                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7257                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7258                         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0xff, 7),
7259                         BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
7260                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3, 0xff, 5),
7261                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_3),
7262                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 56),
7263                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7264                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7265                         BPF_EXIT_INSN(),
7266                         BPF_MOV64_IMM(BPF_REG_0, 0),
7267                         BPF_EXIT_INSN(),
7268                 },
7269                 .fixup_map1 = { 3 },
7270                 .errstr = "R0 max value is outside of the array range",
7271                 .result = REJECT,
7272         },
7273         {
7274                 "subtraction bounds (map value) variant 2",
7275                 .insns = {
7276                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7277                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7278                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7279                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7280                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7281                                      BPF_FUNC_map_lookup_elem),
7282                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
7283                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7284                         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0xff, 6),
7285                         BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
7286                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3, 0xff, 4),
7287                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_3),
7288                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7289                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7290                         BPF_EXIT_INSN(),
7291                         BPF_MOV64_IMM(BPF_REG_0, 0),
7292                         BPF_EXIT_INSN(),
7293                 },
7294                 .fixup_map1 = { 3 },
7295                 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
7296                 .result = REJECT,
7297         },
7298         {
7299                 "bounds check based on zero-extended MOV",
7300                 .insns = {
7301                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7302                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7303                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7304                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7305                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7306                                      BPF_FUNC_map_lookup_elem),
7307                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7308                         /* r2 = 0x0000'0000'ffff'ffff */
7309                         BPF_MOV32_IMM(BPF_REG_2, 0xffffffff),
7310                         /* r2 = 0 */
7311                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 32),
7312                         /* no-op */
7313                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
7314                         /* access at offset 0 */
7315                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7316                         /* exit */
7317                         BPF_MOV64_IMM(BPF_REG_0, 0),
7318                         BPF_EXIT_INSN(),
7319                 },
7320                 .fixup_map1 = { 3 },
7321                 .result = ACCEPT
7322         },
7323         {
7324                 "bounds check based on sign-extended MOV. test1",
7325                 .insns = {
7326                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7327                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7328                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7329                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7330                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7331                                      BPF_FUNC_map_lookup_elem),
7332                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7333                         /* r2 = 0xffff'ffff'ffff'ffff */
7334                         BPF_MOV64_IMM(BPF_REG_2, 0xffffffff),
7335                         /* r2 = 0xffff'ffff */
7336                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 32),
7337                         /* r0 = <oob pointer> */
7338                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
7339                         /* access to OOB pointer */
7340                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7341                         /* exit */
7342                         BPF_MOV64_IMM(BPF_REG_0, 0),
7343                         BPF_EXIT_INSN(),
7344                 },
7345                 .fixup_map1 = { 3 },
7346                 .errstr = "map_value pointer and 4294967295",
7347                 .result = REJECT
7348         },
7349         {
7350                 "bounds check based on sign-extended MOV. test2",
7351                 .insns = {
7352                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7353                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7354                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7355                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7356                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7357                                      BPF_FUNC_map_lookup_elem),
7358                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7359                         /* r2 = 0xffff'ffff'ffff'ffff */
7360                         BPF_MOV64_IMM(BPF_REG_2, 0xffffffff),
7361                         /* r2 = 0xfff'ffff */
7362                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 36),
7363                         /* r0 = <oob pointer> */
7364                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
7365                         /* access to OOB pointer */
7366                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7367                         /* exit */
7368                         BPF_MOV64_IMM(BPF_REG_0, 0),
7369                         BPF_EXIT_INSN(),
7370                 },
7371                 .fixup_map1 = { 3 },
7372                 .errstr = "R0 min value is outside of the array range",
7373                 .result = REJECT
7374         },
7375         {
7376                 "bounds check based on reg_off + var_off + insn_off. test1",
7377                 .insns = {
7378                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
7379                                     offsetof(struct __sk_buff, mark)),
7380                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7381                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7382                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7383                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7384                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7385                                      BPF_FUNC_map_lookup_elem),
7386                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7387                         BPF_ALU64_IMM(BPF_AND, BPF_REG_6, 1),
7388                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, (1 << 29) - 1),
7389                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_6),
7390                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, (1 << 29) - 1),
7391                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 3),
7392                         BPF_MOV64_IMM(BPF_REG_0, 0),
7393                         BPF_EXIT_INSN(),
7394                 },
7395                 .fixup_map1 = { 4 },
7396                 .errstr = "value_size=8 off=1073741825",
7397                 .result = REJECT,
7398                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7399         },
7400         {
7401                 "bounds check based on reg_off + var_off + insn_off. test2",
7402                 .insns = {
7403                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
7404                                     offsetof(struct __sk_buff, mark)),
7405                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7406                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7407                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7408                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7409                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7410                                      BPF_FUNC_map_lookup_elem),
7411                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7412                         BPF_ALU64_IMM(BPF_AND, BPF_REG_6, 1),
7413                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, (1 << 30) - 1),
7414                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_6),
7415                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, (1 << 29) - 1),
7416                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 3),
7417                         BPF_MOV64_IMM(BPF_REG_0, 0),
7418                         BPF_EXIT_INSN(),
7419                 },
7420                 .fixup_map1 = { 4 },
7421                 .errstr = "value 1073741823",
7422                 .result = REJECT,
7423                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7424         },
7425         {
7426                 "bounds check after truncation of non-boundary-crossing range",
7427                 .insns = {
7428                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7429                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7430                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7431                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7432                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7433                                      BPF_FUNC_map_lookup_elem),
7434                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7435                         /* r1 = [0x00, 0xff] */
7436                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7437                         BPF_MOV64_IMM(BPF_REG_2, 1),
7438                         /* r2 = 0x10'0000'0000 */
7439                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 36),
7440                         /* r1 = [0x10'0000'0000, 0x10'0000'00ff] */
7441                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
7442                         /* r1 = [0x10'7fff'ffff, 0x10'8000'00fe] */
7443                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
7444                         /* r1 = [0x00, 0xff] */
7445                         BPF_ALU32_IMM(BPF_SUB, BPF_REG_1, 0x7fffffff),
7446                         /* r1 = 0 */
7447                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
7448                         /* no-op */
7449                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7450                         /* access at offset 0 */
7451                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7452                         /* exit */
7453                         BPF_MOV64_IMM(BPF_REG_0, 0),
7454                         BPF_EXIT_INSN(),
7455                 },
7456                 .fixup_map1 = { 3 },
7457                 .result = ACCEPT
7458         },
7459         {
7460                 "bounds check after truncation of boundary-crossing range (1)",
7461                 .insns = {
7462                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7463                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7464                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7465                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7466                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7467                                      BPF_FUNC_map_lookup_elem),
7468                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7469                         /* r1 = [0x00, 0xff] */
7470                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7471                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
7472                         /* r1 = [0xffff'ff80, 0x1'0000'007f] */
7473                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
7474                         /* r1 = [0xffff'ff80, 0xffff'ffff] or
7475                          *      [0x0000'0000, 0x0000'007f]
7476                          */
7477                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 0),
7478                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
7479                         /* r1 = [0x00, 0xff] or
7480                          *      [0xffff'ffff'0000'0080, 0xffff'ffff'ffff'ffff]
7481                          */
7482                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
7483                         /* r1 = 0 or
7484                          *      [0x00ff'ffff'ff00'0000, 0x00ff'ffff'ffff'ffff]
7485                          */
7486                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
7487                         /* no-op or OOB pointer computation */
7488                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7489                         /* potentially OOB access */
7490                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7491                         /* exit */
7492                         BPF_MOV64_IMM(BPF_REG_0, 0),
7493                         BPF_EXIT_INSN(),
7494                 },
7495                 .fixup_map1 = { 3 },
7496                 /* not actually fully unbounded, but the bound is very high */
7497                 .errstr = "R0 unbounded memory access",
7498                 .result = REJECT
7499         },
7500         {
7501                 "bounds check after truncation of boundary-crossing range (2)",
7502                 .insns = {
7503                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7504                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7505                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7506                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7507                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7508                                      BPF_FUNC_map_lookup_elem),
7509                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7510                         /* r1 = [0x00, 0xff] */
7511                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7512                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
7513                         /* r1 = [0xffff'ff80, 0x1'0000'007f] */
7514                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
7515                         /* r1 = [0xffff'ff80, 0xffff'ffff] or
7516                          *      [0x0000'0000, 0x0000'007f]
7517                          * difference to previous test: truncation via MOV32
7518                          * instead of ALU32.
7519                          */
7520                         BPF_MOV32_REG(BPF_REG_1, BPF_REG_1),
7521                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
7522                         /* r1 = [0x00, 0xff] or
7523                          *      [0xffff'ffff'0000'0080, 0xffff'ffff'ffff'ffff]
7524                          */
7525                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
7526                         /* r1 = 0 or
7527                          *      [0x00ff'ffff'ff00'0000, 0x00ff'ffff'ffff'ffff]
7528                          */
7529                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
7530                         /* no-op or OOB pointer computation */
7531                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7532                         /* potentially OOB access */
7533                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7534                         /* exit */
7535                         BPF_MOV64_IMM(BPF_REG_0, 0),
7536                         BPF_EXIT_INSN(),
7537                 },
7538                 .fixup_map1 = { 3 },
7539                 /* not actually fully unbounded, but the bound is very high */
7540                 .errstr = "R0 unbounded memory access",
7541                 .result = REJECT
7542         },
7543         {
7544                 "bounds check after wrapping 32-bit addition",
7545                 .insns = {
7546                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7547                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7548                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7549                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7550                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7551                                      BPF_FUNC_map_lookup_elem),
7552                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
7553                         /* r1 = 0x7fff'ffff */
7554                         BPF_MOV64_IMM(BPF_REG_1, 0x7fffffff),
7555                         /* r1 = 0xffff'fffe */
7556                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
7557                         /* r1 = 0 */
7558                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 2),
7559                         /* no-op */
7560                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7561                         /* access at offset 0 */
7562                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7563                         /* exit */
7564                         BPF_MOV64_IMM(BPF_REG_0, 0),
7565                         BPF_EXIT_INSN(),
7566                 },
7567                 .fixup_map1 = { 3 },
7568                 .result = ACCEPT
7569         },
7570         {
7571                 "bounds check after shift with oversized count operand",
7572                 .insns = {
7573                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7574                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7575                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7576                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7577                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7578                                      BPF_FUNC_map_lookup_elem),
7579                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
7580                         BPF_MOV64_IMM(BPF_REG_2, 32),
7581                         BPF_MOV64_IMM(BPF_REG_1, 1),
7582                         /* r1 = (u32)1 << (u32)32 = ? */
7583                         BPF_ALU32_REG(BPF_LSH, BPF_REG_1, BPF_REG_2),
7584                         /* r1 = [0x0000, 0xffff] */
7585                         BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xffff),
7586                         /* computes unknown pointer, potentially OOB */
7587                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7588                         /* potentially OOB access */
7589                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7590                         /* exit */
7591                         BPF_MOV64_IMM(BPF_REG_0, 0),
7592                         BPF_EXIT_INSN(),
7593                 },
7594                 .fixup_map1 = { 3 },
7595                 .errstr = "R0 max value is outside of the array range",
7596                 .result = REJECT
7597         },
7598         {
7599                 "bounds check after right shift of maybe-negative number",
7600                 .insns = {
7601                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7602                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7603                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7604                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7605                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7606                                      BPF_FUNC_map_lookup_elem),
7607                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
7608                         /* r1 = [0x00, 0xff] */
7609                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7610                         /* r1 = [-0x01, 0xfe] */
7611                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 1),
7612                         /* r1 = 0 or 0xff'ffff'ffff'ffff */
7613                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
7614                         /* r1 = 0 or 0xffff'ffff'ffff */
7615                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
7616                         /* computes unknown pointer, potentially OOB */
7617                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7618                         /* potentially OOB access */
7619                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7620                         /* exit */
7621                         BPF_MOV64_IMM(BPF_REG_0, 0),
7622                         BPF_EXIT_INSN(),
7623                 },
7624                 .fixup_map1 = { 3 },
7625                 .errstr = "R0 unbounded memory access",
7626                 .result = REJECT
7627         },
7628         {
7629                 "bounds check map access with off+size signed 32bit overflow. test1",
7630                 .insns = {
7631                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7632                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7633                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7634                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7635                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7636                                      BPF_FUNC_map_lookup_elem),
7637                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
7638                         BPF_EXIT_INSN(),
7639                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x7ffffffe),
7640                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
7641                         BPF_JMP_A(0),
7642                         BPF_EXIT_INSN(),
7643                 },
7644                 .fixup_map1 = { 3 },
7645                 .errstr = "map_value pointer and 2147483646",
7646                 .result = REJECT
7647         },
7648         {
7649                 "bounds check map access with off+size signed 32bit overflow. test2",
7650                 .insns = {
7651                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7652                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7653                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7654                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7655                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7656                                      BPF_FUNC_map_lookup_elem),
7657                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
7658                         BPF_EXIT_INSN(),
7659                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
7660                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
7661                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
7662                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
7663                         BPF_JMP_A(0),
7664                         BPF_EXIT_INSN(),
7665                 },
7666                 .fixup_map1 = { 3 },
7667                 .errstr = "pointer offset 1073741822",
7668                 .result = REJECT
7669         },
7670         {
7671                 "bounds check map access with off+size signed 32bit overflow. test3",
7672                 .insns = {
7673                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7674                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7675                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7676                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7677                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7678                                      BPF_FUNC_map_lookup_elem),
7679                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
7680                         BPF_EXIT_INSN(),
7681                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 0x1fffffff),
7682                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 0x1fffffff),
7683                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 2),
7684                         BPF_JMP_A(0),
7685                         BPF_EXIT_INSN(),
7686                 },
7687                 .fixup_map1 = { 3 },
7688                 .errstr = "pointer offset -1073741822",
7689                 .result = REJECT
7690         },
7691         {
7692                 "bounds check map access with off+size signed 32bit overflow. test4",
7693                 .insns = {
7694                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7695                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7696                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7697                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7698                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7699                                      BPF_FUNC_map_lookup_elem),
7700                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
7701                         BPF_EXIT_INSN(),
7702                         BPF_MOV64_IMM(BPF_REG_1, 1000000),
7703                         BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 1000000),
7704                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7705                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 2),
7706                         BPF_JMP_A(0),
7707                         BPF_EXIT_INSN(),
7708                 },
7709                 .fixup_map1 = { 3 },
7710                 .errstr = "map_value pointer and 1000000000000",
7711                 .result = REJECT
7712         },
7713         {
7714                 "pointer/scalar confusion in state equality check (way 1)",
7715                 .insns = {
7716                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7717                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7718                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7719                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7720                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7721                                      BPF_FUNC_map_lookup_elem),
7722                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
7723                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
7724                         BPF_JMP_A(1),
7725                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
7726                         BPF_JMP_A(0),
7727                         BPF_EXIT_INSN(),
7728                 },
7729                 .fixup_map1 = { 3 },
7730                 .result = ACCEPT,
7731                 .retval = POINTER_VALUE,
7732                 .result_unpriv = REJECT,
7733                 .errstr_unpriv = "R0 leaks addr as return value"
7734         },
7735         {
7736                 "pointer/scalar confusion in state equality check (way 2)",
7737                 .insns = {
7738                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7739                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7740                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7741                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7742                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7743                                      BPF_FUNC_map_lookup_elem),
7744                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
7745                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
7746                         BPF_JMP_A(1),
7747                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
7748                         BPF_EXIT_INSN(),
7749                 },
7750                 .fixup_map1 = { 3 },
7751                 .result = ACCEPT,
7752                 .retval = POINTER_VALUE,
7753                 .result_unpriv = REJECT,
7754                 .errstr_unpriv = "R0 leaks addr as return value"
7755         },
7756         {
7757                 "variable-offset ctx access",
7758                 .insns = {
7759                         /* Get an unknown value */
7760                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
7761                         /* Make it small and 4-byte aligned */
7762                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
7763                         /* add it to skb.  We now have either &skb->len or
7764                          * &skb->pkt_type, but we don't know which
7765                          */
7766                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
7767                         /* dereference it */
7768                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
7769                         BPF_EXIT_INSN(),
7770                 },
7771                 .errstr = "variable ctx access var_off=(0x0; 0x4)",
7772                 .result = REJECT,
7773                 .prog_type = BPF_PROG_TYPE_LWT_IN,
7774         },
7775         {
7776                 "variable-offset stack access",
7777                 .insns = {
7778                         /* Fill the top 8 bytes of the stack */
7779                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7780                         /* Get an unknown value */
7781                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
7782                         /* Make it small and 4-byte aligned */
7783                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
7784                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 8),
7785                         /* add it to fp.  We now have either fp-4 or fp-8, but
7786                          * we don't know which
7787                          */
7788                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
7789                         /* dereference it */
7790                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_2, 0),
7791                         BPF_EXIT_INSN(),
7792                 },
7793                 .errstr = "variable stack access var_off=(0xfffffffffffffff8; 0x4)",
7794                 .result = REJECT,
7795                 .prog_type = BPF_PROG_TYPE_LWT_IN,
7796         },
7797         {
7798                 "indirect variable-offset stack access",
7799                 .insns = {
7800                         /* Fill the top 8 bytes of the stack */
7801                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7802                         /* Get an unknown value */
7803                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
7804                         /* Make it small and 4-byte aligned */
7805                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
7806                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 8),
7807                         /* add it to fp.  We now have either fp-4 or fp-8, but
7808                          * we don't know which
7809                          */
7810                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
7811                         /* dereference it indirectly */
7812                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7813                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7814                                      BPF_FUNC_map_lookup_elem),
7815                         BPF_MOV64_IMM(BPF_REG_0, 0),
7816                         BPF_EXIT_INSN(),
7817                 },
7818                 .fixup_map1 = { 5 },
7819                 .errstr = "variable stack read R2",
7820                 .result = REJECT,
7821                 .prog_type = BPF_PROG_TYPE_LWT_IN,
7822         },
7823         {
7824                 "direct stack access with 32-bit wraparound. test1",
7825                 .insns = {
7826                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7827                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
7828                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
7829                         BPF_MOV32_IMM(BPF_REG_0, 0),
7830                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7831                         BPF_EXIT_INSN()
7832                 },
7833                 .errstr = "fp pointer and 2147483647",
7834                 .result = REJECT
7835         },
7836         {
7837                 "direct stack access with 32-bit wraparound. test2",
7838                 .insns = {
7839                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7840                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x3fffffff),
7841                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x3fffffff),
7842                         BPF_MOV32_IMM(BPF_REG_0, 0),
7843                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7844                         BPF_EXIT_INSN()
7845                 },
7846                 .errstr = "fp pointer and 1073741823",
7847                 .result = REJECT
7848         },
7849         {
7850                 "direct stack access with 32-bit wraparound. test3",
7851                 .insns = {
7852                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7853                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x1fffffff),
7854                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x1fffffff),
7855                         BPF_MOV32_IMM(BPF_REG_0, 0),
7856                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7857                         BPF_EXIT_INSN()
7858                 },
7859                 .errstr = "fp pointer offset 1073741822",
7860                 .result = REJECT
7861         },
7862         {
7863                 "liveness pruning and write screening",
7864                 .insns = {
7865                         /* Get an unknown value */
7866                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
7867                         /* branch conditions teach us nothing about R2 */
7868                         BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),
7869                         BPF_MOV64_IMM(BPF_REG_0, 0),
7870                         BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),
7871                         BPF_MOV64_IMM(BPF_REG_0, 0),
7872                         BPF_EXIT_INSN(),
7873                 },
7874                 .errstr = "R0 !read_ok",
7875                 .result = REJECT,
7876                 .prog_type = BPF_PROG_TYPE_LWT_IN,
7877         },
7878         {
7879                 "varlen_map_value_access pruning",
7880                 .insns = {
7881                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7882                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7883                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7884                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7885                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7886                                      BPF_FUNC_map_lookup_elem),
7887                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
7888                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
7889                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
7890                         BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
7891                         BPF_MOV32_IMM(BPF_REG_1, 0),
7892                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
7893                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7894                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
7895                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
7896                                    offsetof(struct test_val, foo)),
7897                         BPF_EXIT_INSN(),
7898                 },
7899                 .fixup_map2 = { 3 },
7900                 .errstr_unpriv = "R0 leaks addr",
7901                 .errstr = "R0 unbounded memory access",
7902                 .result_unpriv = REJECT,
7903                 .result = REJECT,
7904                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7905         },
7906         {
7907                 "invalid 64-bit BPF_END",
7908                 .insns = {
7909                         BPF_MOV32_IMM(BPF_REG_0, 0),
7910                         {
7911                                 .code  = BPF_ALU64 | BPF_END | BPF_TO_LE,
7912                                 .dst_reg = BPF_REG_0,
7913                                 .src_reg = 0,
7914                                 .off   = 0,
7915                                 .imm   = 32,
7916                         },
7917                         BPF_EXIT_INSN(),
7918                 },
7919                 .errstr = "unknown opcode d7",
7920                 .result = REJECT,
7921         },
7922         {
7923                 "XDP, using ifindex from netdev",
7924                 .insns = {
7925                         BPF_MOV64_IMM(BPF_REG_0, 0),
7926                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7927                                     offsetof(struct xdp_md, ingress_ifindex)),
7928                         BPF_JMP_IMM(BPF_JLT, BPF_REG_2, 1, 1),
7929                         BPF_MOV64_IMM(BPF_REG_0, 1),
7930                         BPF_EXIT_INSN(),
7931                 },
7932                 .result = ACCEPT,
7933                 .prog_type = BPF_PROG_TYPE_XDP,
7934                 .retval = 1,
7935         },
7936         {
7937                 "meta access, test1",
7938                 .insns = {
7939                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7940                                     offsetof(struct xdp_md, data_meta)),
7941                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7942                                     offsetof(struct xdp_md, data)),
7943                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
7944                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
7945                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
7946                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
7947                         BPF_MOV64_IMM(BPF_REG_0, 0),
7948                         BPF_EXIT_INSN(),
7949                 },
7950                 .result = ACCEPT,
7951                 .prog_type = BPF_PROG_TYPE_XDP,
7952         },
7953         {
7954                 "meta access, test2",
7955                 .insns = {
7956                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7957                                     offsetof(struct xdp_md, data_meta)),
7958                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7959                                     offsetof(struct xdp_md, data)),
7960                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
7961                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 8),
7962                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
7963                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
7964                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
7965                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7966                         BPF_MOV64_IMM(BPF_REG_0, 0),
7967                         BPF_EXIT_INSN(),
7968                 },
7969                 .result = REJECT,
7970                 .errstr = "invalid access to packet, off=-8",
7971                 .prog_type = BPF_PROG_TYPE_XDP,
7972         },
7973         {
7974                 "meta access, test3",
7975                 .insns = {
7976                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7977                                     offsetof(struct xdp_md, data_meta)),
7978                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7979                                     offsetof(struct xdp_md, data_end)),
7980                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
7981                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
7982                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
7983                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
7984                         BPF_MOV64_IMM(BPF_REG_0, 0),
7985                         BPF_EXIT_INSN(),
7986                 },
7987                 .result = REJECT,
7988                 .errstr = "invalid access to packet",
7989                 .prog_type = BPF_PROG_TYPE_XDP,
7990         },
7991         {
7992                 "meta access, test4",
7993                 .insns = {
7994                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
7995                                     offsetof(struct xdp_md, data_meta)),
7996                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
7997                                     offsetof(struct xdp_md, data_end)),
7998                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
7999                                     offsetof(struct xdp_md, data)),
8000                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
8001                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
8002                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
8003                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8004                         BPF_MOV64_IMM(BPF_REG_0, 0),
8005                         BPF_EXIT_INSN(),
8006                 },
8007                 .result = REJECT,
8008                 .errstr = "invalid access to packet",
8009                 .prog_type = BPF_PROG_TYPE_XDP,
8010         },
8011         {
8012                 "meta access, test5",
8013                 .insns = {
8014                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8015                                     offsetof(struct xdp_md, data_meta)),
8016                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
8017                                     offsetof(struct xdp_md, data)),
8018                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
8019                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
8020                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_4, 3),
8021                         BPF_MOV64_IMM(BPF_REG_2, -8),
8022                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8023                                      BPF_FUNC_xdp_adjust_meta),
8024                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 0),
8025                         BPF_MOV64_IMM(BPF_REG_0, 0),
8026                         BPF_EXIT_INSN(),
8027                 },
8028                 .result = REJECT,
8029                 .errstr = "R3 !read_ok",
8030                 .prog_type = BPF_PROG_TYPE_XDP,
8031         },
8032         {
8033                 "meta access, test6",
8034                 .insns = {
8035                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8036                                     offsetof(struct xdp_md, data_meta)),
8037                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8038                                     offsetof(struct xdp_md, data)),
8039                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
8040                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
8041                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
8042                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
8043                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_0, 1),
8044                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8045                         BPF_MOV64_IMM(BPF_REG_0, 0),
8046                         BPF_EXIT_INSN(),
8047                 },
8048                 .result = REJECT,
8049                 .errstr = "invalid access to packet",
8050                 .prog_type = BPF_PROG_TYPE_XDP,
8051         },
8052         {
8053                 "meta access, test7",
8054                 .insns = {
8055                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8056                                     offsetof(struct xdp_md, data_meta)),
8057                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8058                                     offsetof(struct xdp_md, data)),
8059                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
8060                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
8061                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
8062                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
8063                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
8064                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8065                         BPF_MOV64_IMM(BPF_REG_0, 0),
8066                         BPF_EXIT_INSN(),
8067                 },
8068                 .result = ACCEPT,
8069                 .prog_type = BPF_PROG_TYPE_XDP,
8070         },
8071         {
8072                 "meta access, test8",
8073                 .insns = {
8074                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8075                                     offsetof(struct xdp_md, data_meta)),
8076                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8077                                     offsetof(struct xdp_md, data)),
8078                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
8079                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0xFFFF),
8080                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
8081                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8082                         BPF_MOV64_IMM(BPF_REG_0, 0),
8083                         BPF_EXIT_INSN(),
8084                 },
8085                 .result = ACCEPT,
8086                 .prog_type = BPF_PROG_TYPE_XDP,
8087         },
8088         {
8089                 "meta access, test9",
8090                 .insns = {
8091                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8092                                     offsetof(struct xdp_md, data_meta)),
8093                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8094                                     offsetof(struct xdp_md, data)),
8095                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
8096                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0xFFFF),
8097                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 1),
8098                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
8099                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8100                         BPF_MOV64_IMM(BPF_REG_0, 0),
8101                         BPF_EXIT_INSN(),
8102                 },
8103                 .result = REJECT,
8104                 .errstr = "invalid access to packet",
8105                 .prog_type = BPF_PROG_TYPE_XDP,
8106         },
8107         {
8108                 "meta access, test10",
8109                 .insns = {
8110                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8111                                     offsetof(struct xdp_md, data_meta)),
8112                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8113                                     offsetof(struct xdp_md, data)),
8114                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
8115                                     offsetof(struct xdp_md, data_end)),
8116                         BPF_MOV64_IMM(BPF_REG_5, 42),
8117                         BPF_MOV64_IMM(BPF_REG_6, 24),
8118                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_5, -8),
8119                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
8120                         BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -8),
8121                         BPF_JMP_IMM(BPF_JGT, BPF_REG_5, 100, 6),
8122                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_5),
8123                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
8124                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
8125                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
8126                         BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_5, 1),
8127                         BPF_LDX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
8128                         BPF_MOV64_IMM(BPF_REG_0, 0),
8129                         BPF_EXIT_INSN(),
8130                 },
8131                 .result = REJECT,
8132                 .errstr = "invalid access to packet",
8133                 .prog_type = BPF_PROG_TYPE_XDP,
8134         },
8135         {
8136                 "meta access, test11",
8137                 .insns = {
8138                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8139                                     offsetof(struct xdp_md, data_meta)),
8140                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8141                                     offsetof(struct xdp_md, data)),
8142                         BPF_MOV64_IMM(BPF_REG_5, 42),
8143                         BPF_MOV64_IMM(BPF_REG_6, 24),
8144                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_5, -8),
8145                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
8146                         BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -8),
8147                         BPF_JMP_IMM(BPF_JGT, BPF_REG_5, 100, 6),
8148                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_5),
8149                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
8150                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
8151                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
8152                         BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_3, 1),
8153                         BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_5, 0),
8154                         BPF_MOV64_IMM(BPF_REG_0, 0),
8155                         BPF_EXIT_INSN(),
8156                 },
8157                 .result = ACCEPT,
8158                 .prog_type = BPF_PROG_TYPE_XDP,
8159         },
8160         {
8161                 "meta access, test12",
8162                 .insns = {
8163                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8164                                     offsetof(struct xdp_md, data_meta)),
8165                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8166                                     offsetof(struct xdp_md, data)),
8167                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
8168                                     offsetof(struct xdp_md, data_end)),
8169                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
8170                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 16),
8171                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_4, 5),
8172                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 0),
8173                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
8174                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 16),
8175                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 1),
8176                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8177                         BPF_MOV64_IMM(BPF_REG_0, 0),
8178                         BPF_EXIT_INSN(),
8179                 },
8180                 .result = ACCEPT,
8181                 .prog_type = BPF_PROG_TYPE_XDP,
8182         },
8183         {
8184                 "arithmetic ops make PTR_TO_CTX unusable",
8185                 .insns = {
8186                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
8187                                       offsetof(struct __sk_buff, data) -
8188                                       offsetof(struct __sk_buff, mark)),
8189                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
8190                                     offsetof(struct __sk_buff, mark)),
8191                         BPF_EXIT_INSN(),
8192                 },
8193                 .errstr = "dereference of modified ctx ptr R1 off=68+8, ctx+const is allowed, ctx+const+const is not",
8194                 .result = REJECT,
8195                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
8196         },
8197         {
8198                 "pkt_end - pkt_start is allowed",
8199                 .insns = {
8200                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
8201                                     offsetof(struct __sk_buff, data_end)),
8202                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8203                                     offsetof(struct __sk_buff, data)),
8204                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_2),
8205                         BPF_EXIT_INSN(),
8206                 },
8207                 .result = ACCEPT,
8208                 .retval = TEST_DATA_LEN,
8209                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
8210         },
8211         {
8212                 "XDP pkt read, pkt_end mangling, bad access 1",
8213                 .insns = {
8214                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8215                                     offsetof(struct xdp_md, data)),
8216                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8217                                     offsetof(struct xdp_md, data_end)),
8218                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8219                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8220                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 8),
8221                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
8222                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8223                         BPF_MOV64_IMM(BPF_REG_0, 0),
8224                         BPF_EXIT_INSN(),
8225                 },
8226                 .errstr = "R3 pointer arithmetic on PTR_TO_PACKET_END",
8227                 .result = REJECT,
8228                 .prog_type = BPF_PROG_TYPE_XDP,
8229         },
8230         {
8231                 "XDP pkt read, pkt_end mangling, bad access 2",
8232                 .insns = {
8233                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8234                                     offsetof(struct xdp_md, data)),
8235                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8236                                     offsetof(struct xdp_md, data_end)),
8237                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8238                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8239                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_3, 8),
8240                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
8241                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8242                         BPF_MOV64_IMM(BPF_REG_0, 0),
8243                         BPF_EXIT_INSN(),
8244                 },
8245                 .errstr = "R3 pointer arithmetic on PTR_TO_PACKET_END",
8246                 .result = REJECT,
8247                 .prog_type = BPF_PROG_TYPE_XDP,
8248         },
8249         {
8250                 "XDP pkt read, pkt_data' > pkt_end, good access",
8251                 .insns = {
8252                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8253                                     offsetof(struct xdp_md, data)),
8254                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8255                                     offsetof(struct xdp_md, data_end)),
8256                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8257                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8258                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
8259                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8260                         BPF_MOV64_IMM(BPF_REG_0, 0),
8261                         BPF_EXIT_INSN(),
8262                 },
8263                 .result = ACCEPT,
8264                 .prog_type = BPF_PROG_TYPE_XDP,
8265         },
8266         {
8267                 "XDP pkt read, pkt_data' > pkt_end, bad access 1",
8268                 .insns = {
8269                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8270                                     offsetof(struct xdp_md, data)),
8271                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8272                                     offsetof(struct xdp_md, data_end)),
8273                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8274                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8275                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
8276                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
8277                         BPF_MOV64_IMM(BPF_REG_0, 0),
8278                         BPF_EXIT_INSN(),
8279                 },
8280                 .errstr = "R1 offset is outside of the packet",
8281                 .result = REJECT,
8282                 .prog_type = BPF_PROG_TYPE_XDP,
8283                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8284         },
8285         {
8286                 "XDP pkt read, pkt_data' > pkt_end, bad access 2",
8287                 .insns = {
8288                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8289                                     offsetof(struct xdp_md, data)),
8290                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8291                                     offsetof(struct xdp_md, data_end)),
8292                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8293                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8294                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0),
8295                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8296                         BPF_MOV64_IMM(BPF_REG_0, 0),
8297                         BPF_EXIT_INSN(),
8298                 },
8299                 .errstr = "R1 offset is outside of the packet",
8300                 .result = REJECT,
8301                 .prog_type = BPF_PROG_TYPE_XDP,
8302         },
8303         {
8304                 "XDP pkt read, pkt_end > pkt_data', good access",
8305                 .insns = {
8306                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8307                                     offsetof(struct xdp_md, data)),
8308                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8309                                     offsetof(struct xdp_md, data_end)),
8310                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8311                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8312                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
8313                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8314                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
8315                         BPF_MOV64_IMM(BPF_REG_0, 0),
8316                         BPF_EXIT_INSN(),
8317                 },
8318                 .result = ACCEPT,
8319                 .prog_type = BPF_PROG_TYPE_XDP,
8320                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8321         },
8322         {
8323                 "XDP pkt read, pkt_end > pkt_data', bad access 1",
8324                 .insns = {
8325                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8326                                     offsetof(struct xdp_md, data)),
8327                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8328                                     offsetof(struct xdp_md, data_end)),
8329                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8330                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8331                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
8332                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8333                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8334                         BPF_MOV64_IMM(BPF_REG_0, 0),
8335                         BPF_EXIT_INSN(),
8336                 },
8337                 .errstr = "R1 offset is outside of the packet",
8338                 .result = REJECT,
8339                 .prog_type = BPF_PROG_TYPE_XDP,
8340         },
8341         {
8342                 "XDP pkt read, pkt_end > pkt_data', bad access 2",
8343                 .insns = {
8344                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8345                                     offsetof(struct xdp_md, data)),
8346                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8347                                     offsetof(struct xdp_md, data_end)),
8348                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8349                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8350                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
8351                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8352                         BPF_MOV64_IMM(BPF_REG_0, 0),
8353                         BPF_EXIT_INSN(),
8354                 },
8355                 .errstr = "R1 offset is outside of the packet",
8356                 .result = REJECT,
8357                 .prog_type = BPF_PROG_TYPE_XDP,
8358         },
8359         {
8360                 "XDP pkt read, pkt_data' < pkt_end, good access",
8361                 .insns = {
8362                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8363                                     offsetof(struct xdp_md, data)),
8364                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8365                                     offsetof(struct xdp_md, data_end)),
8366                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8367                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8368                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
8369                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8370                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
8371                         BPF_MOV64_IMM(BPF_REG_0, 0),
8372                         BPF_EXIT_INSN(),
8373                 },
8374                 .result = ACCEPT,
8375                 .prog_type = BPF_PROG_TYPE_XDP,
8376                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8377         },
8378         {
8379                 "XDP pkt read, pkt_data' < pkt_end, bad access 1",
8380                 .insns = {
8381                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8382                                     offsetof(struct xdp_md, data)),
8383                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8384                                     offsetof(struct xdp_md, data_end)),
8385                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8386                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8387                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
8388                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8389                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8390                         BPF_MOV64_IMM(BPF_REG_0, 0),
8391                         BPF_EXIT_INSN(),
8392                 },
8393                 .errstr = "R1 offset is outside of the packet",
8394                 .result = REJECT,
8395                 .prog_type = BPF_PROG_TYPE_XDP,
8396         },
8397         {
8398                 "XDP pkt read, pkt_data' < pkt_end, bad access 2",
8399                 .insns = {
8400                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8401                                     offsetof(struct xdp_md, data)),
8402                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8403                                     offsetof(struct xdp_md, data_end)),
8404                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8405                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8406                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
8407                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8408                         BPF_MOV64_IMM(BPF_REG_0, 0),
8409                         BPF_EXIT_INSN(),
8410                 },
8411                 .errstr = "R1 offset is outside of the packet",
8412                 .result = REJECT,
8413                 .prog_type = BPF_PROG_TYPE_XDP,
8414         },
8415         {
8416                 "XDP pkt read, pkt_end < pkt_data', good access",
8417                 .insns = {
8418                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8419                                     offsetof(struct xdp_md, data)),
8420                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8421                                     offsetof(struct xdp_md, data_end)),
8422                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8423                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8424                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
8425                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8426                         BPF_MOV64_IMM(BPF_REG_0, 0),
8427                         BPF_EXIT_INSN(),
8428                 },
8429                 .result = ACCEPT,
8430                 .prog_type = BPF_PROG_TYPE_XDP,
8431         },
8432         {
8433                 "XDP pkt read, pkt_end < pkt_data', bad access 1",
8434                 .insns = {
8435                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8436                                     offsetof(struct xdp_md, data)),
8437                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8438                                     offsetof(struct xdp_md, data_end)),
8439                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8440                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8441                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
8442                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
8443                         BPF_MOV64_IMM(BPF_REG_0, 0),
8444                         BPF_EXIT_INSN(),
8445                 },
8446                 .errstr = "R1 offset is outside of the packet",
8447                 .result = REJECT,
8448                 .prog_type = BPF_PROG_TYPE_XDP,
8449                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8450         },
8451         {
8452                 "XDP pkt read, pkt_end < pkt_data', bad access 2",
8453                 .insns = {
8454                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8455                                     offsetof(struct xdp_md, data)),
8456                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8457                                     offsetof(struct xdp_md, data_end)),
8458                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8459                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8460                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0),
8461                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8462                         BPF_MOV64_IMM(BPF_REG_0, 0),
8463                         BPF_EXIT_INSN(),
8464                 },
8465                 .errstr = "R1 offset is outside of the packet",
8466                 .result = REJECT,
8467                 .prog_type = BPF_PROG_TYPE_XDP,
8468         },
8469         {
8470                 "XDP pkt read, pkt_data' >= pkt_end, good access",
8471                 .insns = {
8472                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8473                                     offsetof(struct xdp_md, data)),
8474                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8475                                     offsetof(struct xdp_md, data_end)),
8476                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8477                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8478                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
8479                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
8480                         BPF_MOV64_IMM(BPF_REG_0, 0),
8481                         BPF_EXIT_INSN(),
8482                 },
8483                 .result = ACCEPT,
8484                 .prog_type = BPF_PROG_TYPE_XDP,
8485                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8486         },
8487         {
8488                 "XDP pkt read, pkt_data' >= pkt_end, bad access 1",
8489                 .insns = {
8490                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8491                                     offsetof(struct xdp_md, data)),
8492                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8493                                     offsetof(struct xdp_md, data_end)),
8494                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8495                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8496                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
8497                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8498                         BPF_MOV64_IMM(BPF_REG_0, 0),
8499                         BPF_EXIT_INSN(),
8500                 },
8501                 .errstr = "R1 offset is outside of the packet",
8502                 .result = REJECT,
8503                 .prog_type = BPF_PROG_TYPE_XDP,
8504         },
8505         {
8506                 "XDP pkt read, pkt_data' >= pkt_end, bad access 2",
8507                 .insns = {
8508                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8509                                     offsetof(struct xdp_md, data)),
8510                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8511                                     offsetof(struct xdp_md, data_end)),
8512                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8513                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8514                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0),
8515                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
8516                         BPF_MOV64_IMM(BPF_REG_0, 0),
8517                         BPF_EXIT_INSN(),
8518                 },
8519                 .errstr = "R1 offset is outside of the packet",
8520                 .result = REJECT,
8521                 .prog_type = BPF_PROG_TYPE_XDP,
8522                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8523         },
8524         {
8525                 "XDP pkt read, pkt_end >= pkt_data', good access",
8526                 .insns = {
8527                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8528                                     offsetof(struct xdp_md, data)),
8529                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8530                                     offsetof(struct xdp_md, data_end)),
8531                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8532                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8533                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
8534                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8535                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8536                         BPF_MOV64_IMM(BPF_REG_0, 0),
8537                         BPF_EXIT_INSN(),
8538                 },
8539                 .result = ACCEPT,
8540                 .prog_type = BPF_PROG_TYPE_XDP,
8541         },
8542         {
8543                 "XDP pkt read, pkt_end >= pkt_data', bad access 1",
8544                 .insns = {
8545                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8546                                     offsetof(struct xdp_md, data)),
8547                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8548                                     offsetof(struct xdp_md, data_end)),
8549                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8550                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8551                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
8552                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8553                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
8554                         BPF_MOV64_IMM(BPF_REG_0, 0),
8555                         BPF_EXIT_INSN(),
8556                 },
8557                 .errstr = "R1 offset is outside of the packet",
8558                 .result = REJECT,
8559                 .prog_type = BPF_PROG_TYPE_XDP,
8560                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8561         },
8562         {
8563                 "XDP pkt read, pkt_end >= pkt_data', bad access 2",
8564                 .insns = {
8565                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8566                                     offsetof(struct xdp_md, data)),
8567                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8568                                     offsetof(struct xdp_md, data_end)),
8569                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8570                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8571                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
8572                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8573                         BPF_MOV64_IMM(BPF_REG_0, 0),
8574                         BPF_EXIT_INSN(),
8575                 },
8576                 .errstr = "R1 offset is outside of the packet",
8577                 .result = REJECT,
8578                 .prog_type = BPF_PROG_TYPE_XDP,
8579         },
8580         {
8581                 "XDP pkt read, pkt_data' <= pkt_end, good access",
8582                 .insns = {
8583                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8584                                     offsetof(struct xdp_md, data)),
8585                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8586                                     offsetof(struct xdp_md, data_end)),
8587                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8588                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8589                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
8590                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8591                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8592                         BPF_MOV64_IMM(BPF_REG_0, 0),
8593                         BPF_EXIT_INSN(),
8594                 },
8595                 .result = ACCEPT,
8596                 .prog_type = BPF_PROG_TYPE_XDP,
8597         },
8598         {
8599                 "XDP pkt read, pkt_data' <= pkt_end, bad access 1",
8600                 .insns = {
8601                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8602                                     offsetof(struct xdp_md, data)),
8603                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8604                                     offsetof(struct xdp_md, data_end)),
8605                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8606                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8607                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
8608                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8609                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
8610                         BPF_MOV64_IMM(BPF_REG_0, 0),
8611                         BPF_EXIT_INSN(),
8612                 },
8613                 .errstr = "R1 offset is outside of the packet",
8614                 .result = REJECT,
8615                 .prog_type = BPF_PROG_TYPE_XDP,
8616                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8617         },
8618         {
8619                 "XDP pkt read, pkt_data' <= pkt_end, bad access 2",
8620                 .insns = {
8621                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8622                                     offsetof(struct xdp_md, data)),
8623                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8624                                     offsetof(struct xdp_md, data_end)),
8625                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8626                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8627                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
8628                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8629                         BPF_MOV64_IMM(BPF_REG_0, 0),
8630                         BPF_EXIT_INSN(),
8631                 },
8632                 .errstr = "R1 offset is outside of the packet",
8633                 .result = REJECT,
8634                 .prog_type = BPF_PROG_TYPE_XDP,
8635         },
8636         {
8637                 "XDP pkt read, pkt_end <= pkt_data', good access",
8638                 .insns = {
8639                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8640                                     offsetof(struct xdp_md, data)),
8641                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8642                                     offsetof(struct xdp_md, data_end)),
8643                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8644                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8645                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
8646                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
8647                         BPF_MOV64_IMM(BPF_REG_0, 0),
8648                         BPF_EXIT_INSN(),
8649                 },
8650                 .result = ACCEPT,
8651                 .prog_type = BPF_PROG_TYPE_XDP,
8652                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8653         },
8654         {
8655                 "XDP pkt read, pkt_end <= pkt_data', bad access 1",
8656                 .insns = {
8657                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8658                                     offsetof(struct xdp_md, data)),
8659                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8660                                     offsetof(struct xdp_md, data_end)),
8661                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8662                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8663                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
8664                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8665                         BPF_MOV64_IMM(BPF_REG_0, 0),
8666                         BPF_EXIT_INSN(),
8667                 },
8668                 .errstr = "R1 offset is outside of the packet",
8669                 .result = REJECT,
8670                 .prog_type = BPF_PROG_TYPE_XDP,
8671         },
8672         {
8673                 "XDP pkt read, pkt_end <= pkt_data', bad access 2",
8674                 .insns = {
8675                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8676                                     offsetof(struct xdp_md, data)),
8677                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8678                                     offsetof(struct xdp_md, data_end)),
8679                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8680                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8681                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0),
8682                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
8683                         BPF_MOV64_IMM(BPF_REG_0, 0),
8684                         BPF_EXIT_INSN(),
8685                 },
8686                 .errstr = "R1 offset is outside of the packet",
8687                 .result = REJECT,
8688                 .prog_type = BPF_PROG_TYPE_XDP,
8689                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8690         },
8691         {
8692                 "XDP pkt read, pkt_meta' > pkt_data, good access",
8693                 .insns = {
8694                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8695                                     offsetof(struct xdp_md, data_meta)),
8696                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8697                                     offsetof(struct xdp_md, data)),
8698                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8699                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8700                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
8701                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8702                         BPF_MOV64_IMM(BPF_REG_0, 0),
8703                         BPF_EXIT_INSN(),
8704                 },
8705                 .result = ACCEPT,
8706                 .prog_type = BPF_PROG_TYPE_XDP,
8707         },
8708         {
8709                 "XDP pkt read, pkt_meta' > pkt_data, bad access 1",
8710                 .insns = {
8711                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8712                                     offsetof(struct xdp_md, data_meta)),
8713                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8714                                     offsetof(struct xdp_md, data)),
8715                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8716                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8717                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
8718                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
8719                         BPF_MOV64_IMM(BPF_REG_0, 0),
8720                         BPF_EXIT_INSN(),
8721                 },
8722                 .errstr = "R1 offset is outside of the packet",
8723                 .result = REJECT,
8724                 .prog_type = BPF_PROG_TYPE_XDP,
8725                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8726         },
8727         {
8728                 "XDP pkt read, pkt_meta' > pkt_data, bad access 2",
8729                 .insns = {
8730                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8731                                     offsetof(struct xdp_md, data_meta)),
8732                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8733                                     offsetof(struct xdp_md, data)),
8734                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8735                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8736                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0),
8737                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8738                         BPF_MOV64_IMM(BPF_REG_0, 0),
8739                         BPF_EXIT_INSN(),
8740                 },
8741                 .errstr = "R1 offset is outside of the packet",
8742                 .result = REJECT,
8743                 .prog_type = BPF_PROG_TYPE_XDP,
8744         },
8745         {
8746                 "XDP pkt read, pkt_data > pkt_meta', good access",
8747                 .insns = {
8748                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8749                                     offsetof(struct xdp_md, data_meta)),
8750                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8751                                     offsetof(struct xdp_md, data)),
8752                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8753                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8754                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
8755                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8756                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
8757                         BPF_MOV64_IMM(BPF_REG_0, 0),
8758                         BPF_EXIT_INSN(),
8759                 },
8760                 .result = ACCEPT,
8761                 .prog_type = BPF_PROG_TYPE_XDP,
8762                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8763         },
8764         {
8765                 "XDP pkt read, pkt_data > pkt_meta', bad access 1",
8766                 .insns = {
8767                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8768                                     offsetof(struct xdp_md, data_meta)),
8769                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8770                                     offsetof(struct xdp_md, data)),
8771                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8772                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8773                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
8774                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8775                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8776                         BPF_MOV64_IMM(BPF_REG_0, 0),
8777                         BPF_EXIT_INSN(),
8778                 },
8779                 .errstr = "R1 offset is outside of the packet",
8780                 .result = REJECT,
8781                 .prog_type = BPF_PROG_TYPE_XDP,
8782         },
8783         {
8784                 "XDP pkt read, pkt_data > pkt_meta', bad access 2",
8785                 .insns = {
8786                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8787                                     offsetof(struct xdp_md, data_meta)),
8788                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8789                                     offsetof(struct xdp_md, data)),
8790                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8791                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8792                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
8793                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8794                         BPF_MOV64_IMM(BPF_REG_0, 0),
8795                         BPF_EXIT_INSN(),
8796                 },
8797                 .errstr = "R1 offset is outside of the packet",
8798                 .result = REJECT,
8799                 .prog_type = BPF_PROG_TYPE_XDP,
8800         },
8801         {
8802                 "XDP pkt read, pkt_meta' < pkt_data, good access",
8803                 .insns = {
8804                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8805                                     offsetof(struct xdp_md, data_meta)),
8806                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8807                                     offsetof(struct xdp_md, data)),
8808                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8809                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8810                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
8811                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8812                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
8813                         BPF_MOV64_IMM(BPF_REG_0, 0),
8814                         BPF_EXIT_INSN(),
8815                 },
8816                 .result = ACCEPT,
8817                 .prog_type = BPF_PROG_TYPE_XDP,
8818                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8819         },
8820         {
8821                 "XDP pkt read, pkt_meta' < pkt_data, bad access 1",
8822                 .insns = {
8823                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8824                                     offsetof(struct xdp_md, data_meta)),
8825                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8826                                     offsetof(struct xdp_md, data)),
8827                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8828                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8829                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
8830                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8831                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8832                         BPF_MOV64_IMM(BPF_REG_0, 0),
8833                         BPF_EXIT_INSN(),
8834                 },
8835                 .errstr = "R1 offset is outside of the packet",
8836                 .result = REJECT,
8837                 .prog_type = BPF_PROG_TYPE_XDP,
8838         },
8839         {
8840                 "XDP pkt read, pkt_meta' < pkt_data, bad access 2",
8841                 .insns = {
8842                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8843                                     offsetof(struct xdp_md, data_meta)),
8844                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8845                                     offsetof(struct xdp_md, data)),
8846                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8847                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8848                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
8849                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8850                         BPF_MOV64_IMM(BPF_REG_0, 0),
8851                         BPF_EXIT_INSN(),
8852                 },
8853                 .errstr = "R1 offset is outside of the packet",
8854                 .result = REJECT,
8855                 .prog_type = BPF_PROG_TYPE_XDP,
8856         },
8857         {
8858                 "XDP pkt read, pkt_data < pkt_meta', good access",
8859                 .insns = {
8860                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8861                                     offsetof(struct xdp_md, data_meta)),
8862                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8863                                     offsetof(struct xdp_md, data)),
8864                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8865                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8866                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
8867                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8868                         BPF_MOV64_IMM(BPF_REG_0, 0),
8869                         BPF_EXIT_INSN(),
8870                 },
8871                 .result = ACCEPT,
8872                 .prog_type = BPF_PROG_TYPE_XDP,
8873         },
8874         {
8875                 "XDP pkt read, pkt_data < pkt_meta', bad access 1",
8876                 .insns = {
8877                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8878                                     offsetof(struct xdp_md, data_meta)),
8879                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8880                                     offsetof(struct xdp_md, data)),
8881                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8882                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8883                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
8884                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
8885                         BPF_MOV64_IMM(BPF_REG_0, 0),
8886                         BPF_EXIT_INSN(),
8887                 },
8888                 .errstr = "R1 offset is outside of the packet",
8889                 .result = REJECT,
8890                 .prog_type = BPF_PROG_TYPE_XDP,
8891                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8892         },
8893         {
8894                 "XDP pkt read, pkt_data < pkt_meta', bad access 2",
8895                 .insns = {
8896                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8897                                     offsetof(struct xdp_md, data_meta)),
8898                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8899                                     offsetof(struct xdp_md, data)),
8900                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8901                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8902                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0),
8903                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8904                         BPF_MOV64_IMM(BPF_REG_0, 0),
8905                         BPF_EXIT_INSN(),
8906                 },
8907                 .errstr = "R1 offset is outside of the packet",
8908                 .result = REJECT,
8909                 .prog_type = BPF_PROG_TYPE_XDP,
8910         },
8911         {
8912                 "XDP pkt read, pkt_meta' >= pkt_data, good access",
8913                 .insns = {
8914                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8915                                     offsetof(struct xdp_md, data_meta)),
8916                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8917                                     offsetof(struct xdp_md, data)),
8918                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8919                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8920                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
8921                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
8922                         BPF_MOV64_IMM(BPF_REG_0, 0),
8923                         BPF_EXIT_INSN(),
8924                 },
8925                 .result = ACCEPT,
8926                 .prog_type = BPF_PROG_TYPE_XDP,
8927                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8928         },
8929         {
8930                 "XDP pkt read, pkt_meta' >= pkt_data, bad access 1",
8931                 .insns = {
8932                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8933                                     offsetof(struct xdp_md, data_meta)),
8934                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8935                                     offsetof(struct xdp_md, data)),
8936                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8937                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8938                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
8939                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8940                         BPF_MOV64_IMM(BPF_REG_0, 0),
8941                         BPF_EXIT_INSN(),
8942                 },
8943                 .errstr = "R1 offset is outside of the packet",
8944                 .result = REJECT,
8945                 .prog_type = BPF_PROG_TYPE_XDP,
8946         },
8947         {
8948                 "XDP pkt read, pkt_meta' >= pkt_data, bad access 2",
8949                 .insns = {
8950                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8951                                     offsetof(struct xdp_md, data_meta)),
8952                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8953                                     offsetof(struct xdp_md, data)),
8954                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8955                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8956                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0),
8957                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
8958                         BPF_MOV64_IMM(BPF_REG_0, 0),
8959                         BPF_EXIT_INSN(),
8960                 },
8961                 .errstr = "R1 offset is outside of the packet",
8962                 .result = REJECT,
8963                 .prog_type = BPF_PROG_TYPE_XDP,
8964                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8965         },
8966         {
8967                 "XDP pkt read, pkt_data >= pkt_meta', good access",
8968                 .insns = {
8969                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8970                                     offsetof(struct xdp_md, data_meta)),
8971                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8972                                     offsetof(struct xdp_md, data)),
8973                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8974                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8975                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
8976                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8977                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8978                         BPF_MOV64_IMM(BPF_REG_0, 0),
8979                         BPF_EXIT_INSN(),
8980                 },
8981                 .result = ACCEPT,
8982                 .prog_type = BPF_PROG_TYPE_XDP,
8983         },
8984         {
8985                 "XDP pkt read, pkt_data >= pkt_meta', bad access 1",
8986                 .insns = {
8987                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8988                                     offsetof(struct xdp_md, data_meta)),
8989                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8990                                     offsetof(struct xdp_md, data)),
8991                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8992                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8993                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
8994                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8995                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
8996                         BPF_MOV64_IMM(BPF_REG_0, 0),
8997                         BPF_EXIT_INSN(),
8998                 },
8999                 .errstr = "R1 offset is outside of the packet",
9000                 .result = REJECT,
9001                 .prog_type = BPF_PROG_TYPE_XDP,
9002                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9003         },
9004         {
9005                 "XDP pkt read, pkt_data >= pkt_meta', bad access 2",
9006                 .insns = {
9007                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9008                                     offsetof(struct xdp_md, data_meta)),
9009                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9010                                     offsetof(struct xdp_md, data)),
9011                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9012                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9013                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
9014                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9015                         BPF_MOV64_IMM(BPF_REG_0, 0),
9016                         BPF_EXIT_INSN(),
9017                 },
9018                 .errstr = "R1 offset is outside of the packet",
9019                 .result = REJECT,
9020                 .prog_type = BPF_PROG_TYPE_XDP,
9021         },
9022         {
9023                 "XDP pkt read, pkt_meta' <= pkt_data, good access",
9024                 .insns = {
9025                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9026                                     offsetof(struct xdp_md, data_meta)),
9027                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9028                                     offsetof(struct xdp_md, data)),
9029                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9030                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9031                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9032                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9033                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9034                         BPF_MOV64_IMM(BPF_REG_0, 0),
9035                         BPF_EXIT_INSN(),
9036                 },
9037                 .result = ACCEPT,
9038                 .prog_type = BPF_PROG_TYPE_XDP,
9039         },
9040         {
9041                 "XDP pkt read, pkt_meta' <= pkt_data, bad access 1",
9042                 .insns = {
9043                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9044                                     offsetof(struct xdp_md, data_meta)),
9045                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9046                                     offsetof(struct xdp_md, data)),
9047                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9048                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9049                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9050                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9051                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9052                         BPF_MOV64_IMM(BPF_REG_0, 0),
9053                         BPF_EXIT_INSN(),
9054                 },
9055                 .errstr = "R1 offset is outside of the packet",
9056                 .result = REJECT,
9057                 .prog_type = BPF_PROG_TYPE_XDP,
9058                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9059         },
9060         {
9061                 "XDP pkt read, pkt_meta' <= pkt_data, bad access 2",
9062                 .insns = {
9063                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9064                                     offsetof(struct xdp_md, data_meta)),
9065                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9066                                     offsetof(struct xdp_md, data)),
9067                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9068                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9069                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9070                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9071                         BPF_MOV64_IMM(BPF_REG_0, 0),
9072                         BPF_EXIT_INSN(),
9073                 },
9074                 .errstr = "R1 offset is outside of the packet",
9075                 .result = REJECT,
9076                 .prog_type = BPF_PROG_TYPE_XDP,
9077         },
9078         {
9079                 "XDP pkt read, pkt_data <= pkt_meta', good access",
9080                 .insns = {
9081                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9082                                     offsetof(struct xdp_md, data_meta)),
9083                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9084                                     offsetof(struct xdp_md, data)),
9085                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9086                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9087                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
9088                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9089                         BPF_MOV64_IMM(BPF_REG_0, 0),
9090                         BPF_EXIT_INSN(),
9091                 },
9092                 .result = ACCEPT,
9093                 .prog_type = BPF_PROG_TYPE_XDP,
9094                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9095         },
9096         {
9097                 "XDP pkt read, pkt_data <= pkt_meta', bad access 1",
9098                 .insns = {
9099                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9100                                     offsetof(struct xdp_md, data_meta)),
9101                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9102                                     offsetof(struct xdp_md, data)),
9103                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9104                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9105                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
9106                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9107                         BPF_MOV64_IMM(BPF_REG_0, 0),
9108                         BPF_EXIT_INSN(),
9109                 },
9110                 .errstr = "R1 offset is outside of the packet",
9111                 .result = REJECT,
9112                 .prog_type = BPF_PROG_TYPE_XDP,
9113         },
9114         {
9115                 "XDP pkt read, pkt_data <= pkt_meta', bad access 2",
9116                 .insns = {
9117                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9118                                     offsetof(struct xdp_md, data_meta)),
9119                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9120                                     offsetof(struct xdp_md, data)),
9121                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9122                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9123                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0),
9124                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9125                         BPF_MOV64_IMM(BPF_REG_0, 0),
9126                         BPF_EXIT_INSN(),
9127                 },
9128                 .errstr = "R1 offset is outside of the packet",
9129                 .result = REJECT,
9130                 .prog_type = BPF_PROG_TYPE_XDP,
9131                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9132         },
9133         {
9134                 "check deducing bounds from const, 1",
9135                 .insns = {
9136                         BPF_MOV64_IMM(BPF_REG_0, 1),
9137                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 0),
9138                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9139                         BPF_EXIT_INSN(),
9140                 },
9141                 .result = REJECT,
9142                 .errstr = "R0 tried to subtract pointer from scalar",
9143         },
9144         {
9145                 "check deducing bounds from const, 2",
9146                 .insns = {
9147                         BPF_MOV64_IMM(BPF_REG_0, 1),
9148                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1),
9149                         BPF_EXIT_INSN(),
9150                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 1, 1),
9151                         BPF_EXIT_INSN(),
9152                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
9153                         BPF_EXIT_INSN(),
9154                 },
9155                 .result = ACCEPT,
9156                 .retval = 1,
9157         },
9158         {
9159                 "check deducing bounds from const, 3",
9160                 .insns = {
9161                         BPF_MOV64_IMM(BPF_REG_0, 0),
9162                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
9163                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9164                         BPF_EXIT_INSN(),
9165                 },
9166                 .result = REJECT,
9167                 .errstr = "R0 tried to subtract pointer from scalar",
9168         },
9169         {
9170                 "check deducing bounds from const, 4",
9171                 .insns = {
9172                         BPF_MOV64_IMM(BPF_REG_0, 0),
9173                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 1),
9174                         BPF_EXIT_INSN(),
9175                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
9176                         BPF_EXIT_INSN(),
9177                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
9178                         BPF_EXIT_INSN(),
9179                 },
9180                 .result = ACCEPT,
9181         },
9182         {
9183                 "check deducing bounds from const, 5",
9184                 .insns = {
9185                         BPF_MOV64_IMM(BPF_REG_0, 0),
9186                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
9187                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9188                         BPF_EXIT_INSN(),
9189                 },
9190                 .result = REJECT,
9191                 .errstr = "R0 tried to subtract pointer from scalar",
9192         },
9193         {
9194                 "check deducing bounds from const, 6",
9195                 .insns = {
9196                         BPF_MOV64_IMM(BPF_REG_0, 0),
9197                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
9198                         BPF_EXIT_INSN(),
9199                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9200                         BPF_EXIT_INSN(),
9201                 },
9202                 .result = REJECT,
9203                 .errstr = "R0 tried to subtract pointer from scalar",
9204         },
9205         {
9206                 "check deducing bounds from const, 7",
9207                 .insns = {
9208                         BPF_MOV64_IMM(BPF_REG_0, ~0),
9209                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
9210                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
9211                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9212                                     offsetof(struct __sk_buff, mark)),
9213                         BPF_EXIT_INSN(),
9214                 },
9215                 .result = REJECT,
9216                 .errstr = "dereference of modified ctx ptr",
9217         },
9218         {
9219                 "check deducing bounds from const, 8",
9220                 .insns = {
9221                         BPF_MOV64_IMM(BPF_REG_0, ~0),
9222                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
9223                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
9224                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9225                                     offsetof(struct __sk_buff, mark)),
9226                         BPF_EXIT_INSN(),
9227                 },
9228                 .result = REJECT,
9229                 .errstr = "dereference of modified ctx ptr",
9230         },
9231         {
9232                 "check deducing bounds from const, 9",
9233                 .insns = {
9234                         BPF_MOV64_IMM(BPF_REG_0, 0),
9235                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
9236                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9237                         BPF_EXIT_INSN(),
9238                 },
9239                 .result = REJECT,
9240                 .errstr = "R0 tried to subtract pointer from scalar",
9241         },
9242         {
9243                 "check deducing bounds from const, 10",
9244                 .insns = {
9245                         BPF_MOV64_IMM(BPF_REG_0, 0),
9246                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
9247                         /* Marks reg as unknown. */
9248                         BPF_ALU64_IMM(BPF_NEG, BPF_REG_0, 0),
9249                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9250                         BPF_EXIT_INSN(),
9251                 },
9252                 .result = REJECT,
9253                 .errstr = "math between ctx pointer and register with unbounded min value is not allowed",
9254         },
9255         {
9256                 "bpf_exit with invalid return code. test1",
9257                 .insns = {
9258                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
9259                         BPF_EXIT_INSN(),
9260                 },
9261                 .errstr = "R0 has value (0x0; 0xffffffff)",
9262                 .result = REJECT,
9263                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9264         },
9265         {
9266                 "bpf_exit with invalid return code. test2",
9267                 .insns = {
9268                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
9269                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
9270                         BPF_EXIT_INSN(),
9271                 },
9272                 .result = ACCEPT,
9273                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9274         },
9275         {
9276                 "bpf_exit with invalid return code. test3",
9277                 .insns = {
9278                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
9279                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 3),
9280                         BPF_EXIT_INSN(),
9281                 },
9282                 .errstr = "R0 has value (0x0; 0x3)",
9283                 .result = REJECT,
9284                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9285         },
9286         {
9287                 "bpf_exit with invalid return code. test4",
9288                 .insns = {
9289                         BPF_MOV64_IMM(BPF_REG_0, 1),
9290                         BPF_EXIT_INSN(),
9291                 },
9292                 .result = ACCEPT,
9293                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9294         },
9295         {
9296                 "bpf_exit with invalid return code. test5",
9297                 .insns = {
9298                         BPF_MOV64_IMM(BPF_REG_0, 2),
9299                         BPF_EXIT_INSN(),
9300                 },
9301                 .errstr = "R0 has value (0x2; 0x0)",
9302                 .result = REJECT,
9303                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9304         },
9305         {
9306                 "bpf_exit with invalid return code. test6",
9307                 .insns = {
9308                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
9309                         BPF_EXIT_INSN(),
9310                 },
9311                 .errstr = "R0 is not a known value (ctx)",
9312                 .result = REJECT,
9313                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9314         },
9315         {
9316                 "bpf_exit with invalid return code. test7",
9317                 .insns = {
9318                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
9319                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 4),
9320                         BPF_ALU64_REG(BPF_MUL, BPF_REG_0, BPF_REG_2),
9321                         BPF_EXIT_INSN(),
9322                 },
9323                 .errstr = "R0 has unknown scalar value",
9324                 .result = REJECT,
9325                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9326         },
9327         {
9328                 "calls: basic sanity",
9329                 .insns = {
9330                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
9331                         BPF_MOV64_IMM(BPF_REG_0, 1),
9332                         BPF_EXIT_INSN(),
9333                         BPF_MOV64_IMM(BPF_REG_0, 2),
9334                         BPF_EXIT_INSN(),
9335                 },
9336                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9337                 .result = ACCEPT,
9338         },
9339         {
9340                 "calls: not on unpriviledged",
9341                 .insns = {
9342                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
9343                         BPF_MOV64_IMM(BPF_REG_0, 1),
9344                         BPF_EXIT_INSN(),
9345                         BPF_MOV64_IMM(BPF_REG_0, 2),
9346                         BPF_EXIT_INSN(),
9347                 },
9348                 .errstr_unpriv = "function calls to other bpf functions are allowed for root only",
9349                 .result_unpriv = REJECT,
9350                 .result = ACCEPT,
9351                 .retval = 1,
9352         },
9353         {
9354                 "calls: div by 0 in subprog",
9355                 .insns = {
9356                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
9357                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
9358                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
9359                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
9360                                     offsetof(struct __sk_buff, data_end)),
9361                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
9362                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
9363                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
9364                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
9365                         BPF_MOV64_IMM(BPF_REG_0, 1),
9366                         BPF_EXIT_INSN(),
9367                         BPF_MOV32_IMM(BPF_REG_2, 0),
9368                         BPF_MOV32_IMM(BPF_REG_3, 1),
9369                         BPF_ALU32_REG(BPF_DIV, BPF_REG_3, BPF_REG_2),
9370                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9371                                     offsetof(struct __sk_buff, data)),
9372                         BPF_EXIT_INSN(),
9373                 },
9374                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
9375                 .result = ACCEPT,
9376                 .retval = 1,
9377         },
9378         {
9379                 "calls: multiple ret types in subprog 1",
9380                 .insns = {
9381                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
9382                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
9383                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
9384                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
9385                                     offsetof(struct __sk_buff, data_end)),
9386                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
9387                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
9388                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
9389                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
9390                         BPF_MOV64_IMM(BPF_REG_0, 1),
9391                         BPF_EXIT_INSN(),
9392                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9393                                     offsetof(struct __sk_buff, data)),
9394                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
9395                         BPF_MOV32_IMM(BPF_REG_0, 42),
9396                         BPF_EXIT_INSN(),
9397                 },
9398                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
9399                 .result = REJECT,
9400                 .errstr = "R0 invalid mem access 'inv'",
9401         },
9402         {
9403                 "calls: multiple ret types in subprog 2",
9404                 .insns = {
9405                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
9406                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
9407                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
9408                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
9409                                     offsetof(struct __sk_buff, data_end)),
9410                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
9411                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
9412                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
9413                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
9414                         BPF_MOV64_IMM(BPF_REG_0, 1),
9415                         BPF_EXIT_INSN(),
9416                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9417                                     offsetof(struct __sk_buff, data)),
9418                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
9419                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 9),
9420                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
9421                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
9422                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
9423                         BPF_LD_MAP_FD(BPF_REG_1, 0),
9424                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
9425                                      BPF_FUNC_map_lookup_elem),
9426                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
9427                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_6,
9428                                     offsetof(struct __sk_buff, data)),
9429                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 64),
9430                         BPF_EXIT_INSN(),
9431                 },
9432                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
9433                 .fixup_map1 = { 16 },
9434                 .result = REJECT,
9435                 .errstr = "R0 min value is outside of the array range",
9436         },
9437         {
9438                 "calls: overlapping caller/callee",
9439                 .insns = {
9440                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 0),
9441                         BPF_MOV64_IMM(BPF_REG_0, 1),
9442                         BPF_EXIT_INSN(),
9443                 },
9444                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9445                 .errstr = "last insn is not an exit or jmp",
9446                 .result = REJECT,
9447         },
9448         {
9449                 "calls: wrong recursive calls",
9450                 .insns = {
9451                         BPF_JMP_IMM(BPF_JA, 0, 0, 4),
9452                         BPF_JMP_IMM(BPF_JA, 0, 0, 4),
9453                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
9454                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
9455                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
9456                         BPF_MOV64_IMM(BPF_REG_0, 1),
9457                         BPF_EXIT_INSN(),
9458                 },
9459                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9460                 .errstr = "jump out of range",
9461                 .result = REJECT,
9462         },
9463         {
9464                 "calls: wrong src reg",
9465                 .insns = {
9466                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 2, 0, 0),
9467                         BPF_MOV64_IMM(BPF_REG_0, 1),
9468                         BPF_EXIT_INSN(),
9469                 },
9470                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9471                 .errstr = "BPF_CALL uses reserved fields",
9472                 .result = REJECT,
9473         },
9474         {
9475                 "calls: wrong off value",
9476                 .insns = {
9477                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, -1, 2),
9478                         BPF_MOV64_IMM(BPF_REG_0, 1),
9479                         BPF_EXIT_INSN(),
9480                         BPF_MOV64_IMM(BPF_REG_0, 2),
9481                         BPF_EXIT_INSN(),
9482                 },
9483                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9484                 .errstr = "BPF_CALL uses reserved fields",
9485                 .result = REJECT,
9486         },
9487         {
9488                 "calls: jump back loop",
9489                 .insns = {
9490                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -1),
9491                         BPF_MOV64_IMM(BPF_REG_0, 1),
9492                         BPF_EXIT_INSN(),
9493                 },
9494                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9495                 .errstr = "back-edge from insn 0 to 0",
9496                 .result = REJECT,
9497         },
9498         {
9499                 "calls: conditional call",
9500                 .insns = {
9501                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9502                                     offsetof(struct __sk_buff, mark)),
9503                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
9504                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
9505                         BPF_MOV64_IMM(BPF_REG_0, 1),
9506                         BPF_EXIT_INSN(),
9507                         BPF_MOV64_IMM(BPF_REG_0, 2),
9508                         BPF_EXIT_INSN(),
9509                 },
9510                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9511                 .errstr = "jump out of range",
9512                 .result = REJECT,
9513         },
9514         {
9515                 "calls: conditional call 2",
9516                 .insns = {
9517                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9518                                     offsetof(struct __sk_buff, mark)),
9519                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
9520                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
9521                         BPF_MOV64_IMM(BPF_REG_0, 1),
9522                         BPF_EXIT_INSN(),
9523                         BPF_MOV64_IMM(BPF_REG_0, 2),
9524                         BPF_EXIT_INSN(),
9525                         BPF_MOV64_IMM(BPF_REG_0, 3),
9526                         BPF_EXIT_INSN(),
9527                 },
9528                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9529                 .result = ACCEPT,
9530         },
9531         {
9532                 "calls: conditional call 3",
9533                 .insns = {
9534                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9535                                     offsetof(struct __sk_buff, mark)),
9536                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
9537                         BPF_JMP_IMM(BPF_JA, 0, 0, 4),
9538                         BPF_MOV64_IMM(BPF_REG_0, 1),
9539                         BPF_EXIT_INSN(),
9540                         BPF_MOV64_IMM(BPF_REG_0, 1),
9541                         BPF_JMP_IMM(BPF_JA, 0, 0, -6),
9542                         BPF_MOV64_IMM(BPF_REG_0, 3),
9543                         BPF_JMP_IMM(BPF_JA, 0, 0, -6),
9544                 },
9545                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9546                 .errstr = "back-edge from insn",
9547                 .result = REJECT,
9548         },
9549         {
9550                 "calls: conditional call 4",
9551                 .insns = {
9552                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9553                                     offsetof(struct __sk_buff, mark)),
9554                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
9555                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
9556                         BPF_MOV64_IMM(BPF_REG_0, 1),
9557                         BPF_EXIT_INSN(),
9558                         BPF_MOV64_IMM(BPF_REG_0, 1),
9559                         BPF_JMP_IMM(BPF_JA, 0, 0, -5),
9560                         BPF_MOV64_IMM(BPF_REG_0, 3),
9561                         BPF_EXIT_INSN(),
9562                 },
9563                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9564                 .result = ACCEPT,
9565         },
9566         {
9567                 "calls: conditional call 5",
9568                 .insns = {
9569                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9570                                     offsetof(struct __sk_buff, mark)),
9571                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
9572                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
9573                         BPF_MOV64_IMM(BPF_REG_0, 1),
9574                         BPF_EXIT_INSN(),
9575                         BPF_MOV64_IMM(BPF_REG_0, 1),
9576                         BPF_JMP_IMM(BPF_JA, 0, 0, -6),
9577                         BPF_MOV64_IMM(BPF_REG_0, 3),
9578                         BPF_EXIT_INSN(),
9579                 },
9580                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9581                 .errstr = "back-edge from insn",
9582                 .result = REJECT,
9583         },
9584         {
9585                 "calls: conditional call 6",
9586                 .insns = {
9587                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
9588                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, -2),
9589                         BPF_EXIT_INSN(),
9590                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9591                                     offsetof(struct __sk_buff, mark)),
9592                         BPF_EXIT_INSN(),
9593                 },
9594                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9595                 .errstr = "back-edge from insn",
9596                 .result = REJECT,
9597         },
9598         {
9599                 "calls: using r0 returned by callee",
9600                 .insns = {
9601                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9602                         BPF_EXIT_INSN(),
9603                         BPF_MOV64_IMM(BPF_REG_0, 2),
9604                         BPF_EXIT_INSN(),
9605                 },
9606                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9607                 .result = ACCEPT,
9608         },
9609         {
9610                 "calls: using uninit r0 from callee",
9611                 .insns = {
9612                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9613                         BPF_EXIT_INSN(),
9614                         BPF_EXIT_INSN(),
9615                 },
9616                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9617                 .errstr = "!read_ok",
9618                 .result = REJECT,
9619         },
9620         {
9621                 "calls: callee is using r1",
9622                 .insns = {
9623                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9624                         BPF_EXIT_INSN(),
9625                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9626                                     offsetof(struct __sk_buff, len)),
9627                         BPF_EXIT_INSN(),
9628                 },
9629                 .prog_type = BPF_PROG_TYPE_SCHED_ACT,
9630                 .result = ACCEPT,
9631                 .retval = TEST_DATA_LEN,
9632         },
9633         {
9634                 "calls: callee using args1",
9635                 .insns = {
9636                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9637                         BPF_EXIT_INSN(),
9638                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
9639                         BPF_EXIT_INSN(),
9640                 },
9641                 .errstr_unpriv = "allowed for root only",
9642                 .result_unpriv = REJECT,
9643                 .result = ACCEPT,
9644                 .retval = POINTER_VALUE,
9645         },
9646         {
9647                 "calls: callee using wrong args2",
9648                 .insns = {
9649                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9650                         BPF_EXIT_INSN(),
9651                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
9652                         BPF_EXIT_INSN(),
9653                 },
9654                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9655                 .errstr = "R2 !read_ok",
9656                 .result = REJECT,
9657         },
9658         {
9659                 "calls: callee using two args",
9660                 .insns = {
9661                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
9662                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_6,
9663                                     offsetof(struct __sk_buff, len)),
9664                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_6,
9665                                     offsetof(struct __sk_buff, len)),
9666                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9667                         BPF_EXIT_INSN(),
9668                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
9669                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
9670                         BPF_EXIT_INSN(),
9671                 },
9672                 .errstr_unpriv = "allowed for root only",
9673                 .result_unpriv = REJECT,
9674                 .result = ACCEPT,
9675                 .retval = TEST_DATA_LEN + TEST_DATA_LEN - ETH_HLEN - ETH_HLEN,
9676         },
9677         {
9678                 "calls: callee changing pkt pointers",
9679                 .insns = {
9680                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
9681                                     offsetof(struct xdp_md, data)),
9682                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
9683                                     offsetof(struct xdp_md, data_end)),
9684                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_6),
9685                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 8),
9686                         BPF_JMP_REG(BPF_JGT, BPF_REG_8, BPF_REG_7, 2),
9687                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
9688                         /* clear_all_pkt_pointers() has to walk all frames
9689                          * to make sure that pkt pointers in the caller
9690                          * are cleared when callee is calling a helper that
9691                          * adjusts packet size
9692                          */
9693                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
9694                         BPF_MOV32_IMM(BPF_REG_0, 0),
9695                         BPF_EXIT_INSN(),
9696                         BPF_MOV64_IMM(BPF_REG_2, 0),
9697                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
9698                                      BPF_FUNC_xdp_adjust_head),
9699                         BPF_EXIT_INSN(),
9700                 },
9701                 .result = REJECT,
9702                 .errstr = "R6 invalid mem access 'inv'",
9703                 .prog_type = BPF_PROG_TYPE_XDP,
9704         },
9705         {
9706                 "calls: two calls with args",
9707                 .insns = {
9708                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9709                         BPF_EXIT_INSN(),
9710                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
9711                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
9712                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
9713                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
9714                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
9715                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
9716                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
9717                         BPF_EXIT_INSN(),
9718                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9719                                     offsetof(struct __sk_buff, len)),
9720                         BPF_EXIT_INSN(),
9721                 },
9722                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
9723                 .result = ACCEPT,
9724                 .retval = TEST_DATA_LEN + TEST_DATA_LEN,
9725         },
9726         {
9727                 "calls: calls with stack arith",
9728                 .insns = {
9729                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
9730                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
9731                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9732                         BPF_EXIT_INSN(),
9733                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
9734                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9735                         BPF_EXIT_INSN(),
9736                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
9737                         BPF_MOV64_IMM(BPF_REG_0, 42),
9738                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
9739                         BPF_EXIT_INSN(),
9740                 },
9741                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
9742                 .result = ACCEPT,
9743                 .retval = 42,
9744         },
9745         {
9746                 "calls: calls with misaligned stack access",
9747                 .insns = {
9748                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
9749                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -63),
9750                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9751                         BPF_EXIT_INSN(),
9752                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -61),
9753                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9754                         BPF_EXIT_INSN(),
9755                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -63),
9756                         BPF_MOV64_IMM(BPF_REG_0, 42),
9757                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
9758                         BPF_EXIT_INSN(),
9759                 },
9760                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
9761                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
9762                 .errstr = "misaligned stack access",
9763                 .result = REJECT,
9764         },
9765         {
9766                 "calls: calls control flow, jump test",
9767                 .insns = {
9768                         BPF_MOV64_IMM(BPF_REG_0, 42),
9769                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
9770                         BPF_MOV64_IMM(BPF_REG_0, 43),
9771                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9772                         BPF_JMP_IMM(BPF_JA, 0, 0, -3),
9773                         BPF_EXIT_INSN(),
9774                 },
9775                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
9776                 .result = ACCEPT,
9777                 .retval = 43,
9778         },
9779         {
9780                 "calls: calls control flow, jump test 2",
9781                 .insns = {
9782                         BPF_MOV64_IMM(BPF_REG_0, 42),
9783                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
9784                         BPF_MOV64_IMM(BPF_REG_0, 43),
9785                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9786                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -3),
9787                         BPF_EXIT_INSN(),
9788                 },
9789                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
9790                 .errstr = "jump out of range from insn 1 to 4",
9791                 .result = REJECT,
9792         },
9793         {
9794                 "calls: two calls with bad jump",
9795                 .insns = {
9796                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9797                         BPF_EXIT_INSN(),
9798                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
9799                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
9800                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
9801                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
9802                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
9803                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
9804                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
9805                         BPF_EXIT_INSN(),
9806                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9807                                     offsetof(struct __sk_buff, len)),
9808                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, -3),
9809                         BPF_EXIT_INSN(),
9810                 },
9811                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9812                 .errstr = "jump out of range from insn 11 to 9",
9813                 .result = REJECT,
9814         },
9815         {
9816                 "calls: recursive call. test1",
9817                 .insns = {
9818                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9819                         BPF_EXIT_INSN(),
9820                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -1),
9821                         BPF_EXIT_INSN(),
9822                 },
9823                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9824                 .errstr = "back-edge",
9825                 .result = REJECT,
9826         },
9827         {
9828                 "calls: recursive call. test2",
9829                 .insns = {
9830                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9831                         BPF_EXIT_INSN(),
9832                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -3),
9833                         BPF_EXIT_INSN(),
9834                 },
9835                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9836                 .errstr = "back-edge",
9837                 .result = REJECT,
9838         },
9839         {
9840                 "calls: unreachable code",
9841                 .insns = {
9842                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9843                         BPF_EXIT_INSN(),
9844                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9845                         BPF_EXIT_INSN(),
9846                         BPF_MOV64_IMM(BPF_REG_0, 0),
9847                         BPF_EXIT_INSN(),
9848                         BPF_MOV64_IMM(BPF_REG_0, 0),
9849                         BPF_EXIT_INSN(),
9850                 },
9851                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9852                 .errstr = "unreachable insn 6",
9853                 .result = REJECT,
9854         },
9855         {
9856                 "calls: invalid call",
9857                 .insns = {
9858                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9859                         BPF_EXIT_INSN(),
9860                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -4),
9861                         BPF_EXIT_INSN(),
9862                 },
9863                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9864                 .errstr = "invalid destination",
9865                 .result = REJECT,
9866         },
9867         {
9868                 "calls: invalid call 2",
9869                 .insns = {
9870                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9871                         BPF_EXIT_INSN(),
9872                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 0x7fffffff),
9873                         BPF_EXIT_INSN(),
9874                 },
9875                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9876                 .errstr = "invalid destination",
9877                 .result = REJECT,
9878         },
9879         {
9880                 "calls: jumping across function bodies. test1",
9881                 .insns = {
9882                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
9883                         BPF_MOV64_IMM(BPF_REG_0, 0),
9884                         BPF_EXIT_INSN(),
9885                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -3),
9886                         BPF_EXIT_INSN(),
9887                 },
9888                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9889                 .errstr = "jump out of range",
9890                 .result = REJECT,
9891         },
9892         {
9893                 "calls: jumping across function bodies. test2",
9894                 .insns = {
9895                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
9896                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
9897                         BPF_MOV64_IMM(BPF_REG_0, 0),
9898                         BPF_EXIT_INSN(),
9899                         BPF_EXIT_INSN(),
9900                 },
9901                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9902                 .errstr = "jump out of range",
9903                 .result = REJECT,
9904         },
9905         {
9906                 "calls: call without exit",
9907                 .insns = {
9908                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9909                         BPF_EXIT_INSN(),
9910                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9911                         BPF_EXIT_INSN(),
9912                         BPF_MOV64_IMM(BPF_REG_0, 0),
9913                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -2),
9914                 },
9915                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9916                 .errstr = "not an exit",
9917                 .result = REJECT,
9918         },
9919         {
9920                 "calls: call into middle of ld_imm64",
9921                 .insns = {
9922                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
9923                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
9924                         BPF_MOV64_IMM(BPF_REG_0, 0),
9925                         BPF_EXIT_INSN(),
9926                         BPF_LD_IMM64(BPF_REG_0, 0),
9927                         BPF_EXIT_INSN(),
9928                 },
9929                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9930                 .errstr = "last insn",
9931                 .result = REJECT,
9932         },
9933         {
9934                 "calls: call into middle of other call",
9935                 .insns = {
9936                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
9937                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
9938                         BPF_MOV64_IMM(BPF_REG_0, 0),
9939                         BPF_EXIT_INSN(),
9940                         BPF_MOV64_IMM(BPF_REG_0, 0),
9941                         BPF_MOV64_IMM(BPF_REG_0, 0),
9942                         BPF_EXIT_INSN(),
9943                 },
9944                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9945                 .errstr = "last insn",
9946                 .result = REJECT,
9947         },
9948         {
9949                 "calls: ld_abs with changing ctx data in callee",
9950                 .insns = {
9951                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
9952                         BPF_LD_ABS(BPF_B, 0),
9953                         BPF_LD_ABS(BPF_H, 0),
9954                         BPF_LD_ABS(BPF_W, 0),
9955                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
9956                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
9957                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
9958                         BPF_LD_ABS(BPF_B, 0),
9959                         BPF_LD_ABS(BPF_H, 0),
9960                         BPF_LD_ABS(BPF_W, 0),
9961                         BPF_EXIT_INSN(),
9962                         BPF_MOV64_IMM(BPF_REG_2, 1),
9963                         BPF_MOV64_IMM(BPF_REG_3, 2),
9964                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
9965                                      BPF_FUNC_skb_vlan_push),
9966                         BPF_EXIT_INSN(),
9967                 },
9968                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
9969                 .errstr = "BPF_LD_[ABS|IND] instructions cannot be mixed",
9970                 .result = REJECT,
9971         },
9972         {
9973                 "calls: two calls with bad fallthrough",
9974                 .insns = {
9975                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
9976                         BPF_EXIT_INSN(),
9977                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
9978                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
9979                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
9980                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
9981                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
9982                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
9983                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
9984                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_0),
9985                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9986                                     offsetof(struct __sk_buff, len)),
9987                         BPF_EXIT_INSN(),
9988                 },
9989                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9990                 .errstr = "not an exit",
9991                 .result = REJECT,
9992         },
9993         {
9994                 "calls: two calls with stack read",
9995                 .insns = {
9996                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
9997                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
9998                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
9999                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10000                         BPF_EXIT_INSN(),
10001                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10002                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
10003                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
10004                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10005                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10006                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
10007                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
10008                         BPF_EXIT_INSN(),
10009                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
10010                         BPF_EXIT_INSN(),
10011                 },
10012                 .prog_type = BPF_PROG_TYPE_XDP,
10013                 .result = ACCEPT,
10014         },
10015         {
10016                 "calls: two calls with stack write",
10017                 .insns = {
10018                         /* main prog */
10019                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10020                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10021                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10022                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10023                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10024                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10025                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
10026                         BPF_EXIT_INSN(),
10027
10028                         /* subprog 1 */
10029                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10030                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10031                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 7),
10032                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
10033                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10034                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10035                         BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_0),
10036                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_8),
10037                         /* write into stack frame of main prog */
10038                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
10039                         BPF_EXIT_INSN(),
10040
10041                         /* subprog 2 */
10042                         /* read from stack frame of main prog */
10043                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
10044                         BPF_EXIT_INSN(),
10045                 },
10046                 .prog_type = BPF_PROG_TYPE_XDP,
10047                 .result = ACCEPT,
10048         },
10049         {
10050                 "calls: stack overflow using two frames (pre-call access)",
10051                 .insns = {
10052                         /* prog 1 */
10053                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
10054                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1),
10055                         BPF_EXIT_INSN(),
10056
10057                         /* prog 2 */
10058                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
10059                         BPF_MOV64_IMM(BPF_REG_0, 0),
10060                         BPF_EXIT_INSN(),
10061                 },
10062                 .prog_type = BPF_PROG_TYPE_XDP,
10063                 .errstr = "combined stack size",
10064                 .result = REJECT,
10065         },
10066         {
10067                 "calls: stack overflow using two frames (post-call access)",
10068                 .insns = {
10069                         /* prog 1 */
10070                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 2),
10071                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
10072                         BPF_EXIT_INSN(),
10073
10074                         /* prog 2 */
10075                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
10076                         BPF_MOV64_IMM(BPF_REG_0, 0),
10077                         BPF_EXIT_INSN(),
10078                 },
10079                 .prog_type = BPF_PROG_TYPE_XDP,
10080                 .errstr = "combined stack size",
10081                 .result = REJECT,
10082         },
10083         {
10084                 "calls: stack depth check using three frames. test1",
10085                 .insns = {
10086                         /* main */
10087                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
10088                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 5), /* call B */
10089                         BPF_ST_MEM(BPF_B, BPF_REG_10, -32, 0),
10090                         BPF_MOV64_IMM(BPF_REG_0, 0),
10091                         BPF_EXIT_INSN(),
10092                         /* A */
10093                         BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
10094                         BPF_EXIT_INSN(),
10095                         /* B */
10096                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -3), /* call A */
10097                         BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
10098                         BPF_EXIT_INSN(),
10099                 },
10100                 .prog_type = BPF_PROG_TYPE_XDP,
10101                 /* stack_main=32, stack_A=256, stack_B=64
10102                  * and max(main+A, main+A+B) < 512
10103                  */
10104                 .result = ACCEPT,
10105         },
10106         {
10107                 "calls: stack depth check using three frames. test2",
10108                 .insns = {
10109                         /* main */
10110                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
10111                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 5), /* call B */
10112                         BPF_ST_MEM(BPF_B, BPF_REG_10, -32, 0),
10113                         BPF_MOV64_IMM(BPF_REG_0, 0),
10114                         BPF_EXIT_INSN(),
10115                         /* A */
10116                         BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
10117                         BPF_EXIT_INSN(),
10118                         /* B */
10119                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -3), /* call A */
10120                         BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
10121                         BPF_EXIT_INSN(),
10122                 },
10123                 .prog_type = BPF_PROG_TYPE_XDP,
10124                 /* stack_main=32, stack_A=64, stack_B=256
10125                  * and max(main+A, main+A+B) < 512
10126                  */
10127                 .result = ACCEPT,
10128         },
10129         {
10130                 "calls: stack depth check using three frames. test3",
10131                 .insns = {
10132                         /* main */
10133                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10134                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 6), /* call A */
10135                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10136                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 8), /* call B */
10137                         BPF_JMP_IMM(BPF_JGE, BPF_REG_6, 0, 1),
10138                         BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
10139                         BPF_MOV64_IMM(BPF_REG_0, 0),
10140                         BPF_EXIT_INSN(),
10141                         /* A */
10142                         BPF_JMP_IMM(BPF_JLT, BPF_REG_1, 10, 1),
10143                         BPF_EXIT_INSN(),
10144                         BPF_ST_MEM(BPF_B, BPF_REG_10, -224, 0),
10145                         BPF_JMP_IMM(BPF_JA, 0, 0, -3),
10146                         /* B */
10147                         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 2, 1),
10148                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -6), /* call A */
10149                         BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
10150                         BPF_EXIT_INSN(),
10151                 },
10152                 .prog_type = BPF_PROG_TYPE_XDP,
10153                 /* stack_main=64, stack_A=224, stack_B=256
10154                  * and max(main+A, main+A+B) > 512
10155                  */
10156                 .errstr = "combined stack",
10157                 .result = REJECT,
10158         },
10159         {
10160                 "calls: stack depth check using three frames. test4",
10161                 /* void main(void) {
10162                  *   func1(0);
10163                  *   func1(1);
10164                  *   func2(1);
10165                  * }
10166                  * void func1(int alloc_or_recurse) {
10167                  *   if (alloc_or_recurse) {
10168                  *     frame_pointer[-300] = 1;
10169                  *   } else {
10170                  *     func2(alloc_or_recurse);
10171                  *   }
10172                  * }
10173                  * void func2(int alloc_or_recurse) {
10174                  *   if (alloc_or_recurse) {
10175                  *     frame_pointer[-300] = 1;
10176                  *   }
10177                  * }
10178                  */
10179                 .insns = {
10180                         /* main */
10181                         BPF_MOV64_IMM(BPF_REG_1, 0),
10182                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 6), /* call A */
10183                         BPF_MOV64_IMM(BPF_REG_1, 1),
10184                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
10185                         BPF_MOV64_IMM(BPF_REG_1, 1),
10186                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 7), /* call B */
10187                         BPF_MOV64_IMM(BPF_REG_0, 0),
10188                         BPF_EXIT_INSN(),
10189                         /* A */
10190                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
10191                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
10192                         BPF_EXIT_INSN(),
10193                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call B */
10194                         BPF_EXIT_INSN(),
10195                         /* B */
10196                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
10197                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
10198                         BPF_EXIT_INSN(),
10199                 },
10200                 .prog_type = BPF_PROG_TYPE_XDP,
10201                 .result = REJECT,
10202                 .errstr = "combined stack",
10203         },
10204         {
10205                 "calls: stack depth check using three frames. test5",
10206                 .insns = {
10207                         /* main */
10208                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call A */
10209                         BPF_EXIT_INSN(),
10210                         /* A */
10211                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call B */
10212                         BPF_EXIT_INSN(),
10213                         /* B */
10214                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call C */
10215                         BPF_EXIT_INSN(),
10216                         /* C */
10217                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call D */
10218                         BPF_EXIT_INSN(),
10219                         /* D */
10220                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call E */
10221                         BPF_EXIT_INSN(),
10222                         /* E */
10223                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call F */
10224                         BPF_EXIT_INSN(),
10225                         /* F */
10226                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call G */
10227                         BPF_EXIT_INSN(),
10228                         /* G */
10229                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call H */
10230                         BPF_EXIT_INSN(),
10231                         /* H */
10232                         BPF_MOV64_IMM(BPF_REG_0, 0),
10233                         BPF_EXIT_INSN(),
10234                 },
10235                 .prog_type = BPF_PROG_TYPE_XDP,
10236                 .errstr = "call stack",
10237                 .result = REJECT,
10238         },
10239         {
10240                 "calls: spill into caller stack frame",
10241                 .insns = {
10242                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10243                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10244                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10245                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10246                         BPF_EXIT_INSN(),
10247                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
10248                         BPF_MOV64_IMM(BPF_REG_0, 0),
10249                         BPF_EXIT_INSN(),
10250                 },
10251                 .prog_type = BPF_PROG_TYPE_XDP,
10252                 .errstr = "cannot spill",
10253                 .result = REJECT,
10254         },
10255         {
10256                 "calls: write into caller stack frame",
10257                 .insns = {
10258                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10259                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10260                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10261                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10262                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
10263                         BPF_EXIT_INSN(),
10264                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 42),
10265                         BPF_MOV64_IMM(BPF_REG_0, 0),
10266                         BPF_EXIT_INSN(),
10267                 },
10268                 .prog_type = BPF_PROG_TYPE_XDP,
10269                 .result = ACCEPT,
10270                 .retval = 42,
10271         },
10272         {
10273                 "calls: write into callee stack frame",
10274                 .insns = {
10275                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10276                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
10277                         BPF_EXIT_INSN(),
10278                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
10279                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, -8),
10280                         BPF_EXIT_INSN(),
10281                 },
10282                 .prog_type = BPF_PROG_TYPE_XDP,
10283                 .errstr = "cannot return stack pointer",
10284                 .result = REJECT,
10285         },
10286         {
10287                 "calls: two calls with stack write and void return",
10288                 .insns = {
10289                         /* main prog */
10290                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10291                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10292                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10293                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10294                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10295                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10296                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
10297                         BPF_EXIT_INSN(),
10298
10299                         /* subprog 1 */
10300                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10301                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10302                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10303                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
10304                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10305                         BPF_EXIT_INSN(),
10306
10307                         /* subprog 2 */
10308                         /* write into stack frame of main prog */
10309                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 0),
10310                         BPF_EXIT_INSN(), /* void return */
10311                 },
10312                 .prog_type = BPF_PROG_TYPE_XDP,
10313                 .result = ACCEPT,
10314         },
10315         {
10316                 "calls: ambiguous return value",
10317                 .insns = {
10318                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10319                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
10320                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
10321                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10322                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10323                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
10324                         BPF_EXIT_INSN(),
10325                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
10326                         BPF_MOV64_IMM(BPF_REG_0, 0),
10327                         BPF_EXIT_INSN(),
10328                 },
10329                 .errstr_unpriv = "allowed for root only",
10330                 .result_unpriv = REJECT,
10331                 .errstr = "R0 !read_ok",
10332                 .result = REJECT,
10333         },
10334         {
10335                 "calls: two calls that return map_value",
10336                 .insns = {
10337                         /* main prog */
10338                         /* pass fp-16, fp-8 into a function */
10339                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10340                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10341                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10342                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10343                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
10344
10345                         /* fetch map_value_ptr from the stack of this function */
10346                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
10347                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
10348                         /* write into map value */
10349                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10350                         /* fetch secound map_value_ptr from the stack */
10351                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
10352                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
10353                         /* write into map value */
10354                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10355                         BPF_MOV64_IMM(BPF_REG_0, 0),
10356                         BPF_EXIT_INSN(),
10357
10358                         /* subprog 1 */
10359                         /* call 3rd function twice */
10360                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10361                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10362                         /* first time with fp-8 */
10363                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10364                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
10365                         /* second time with fp-16 */
10366                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10367                         BPF_EXIT_INSN(),
10368
10369                         /* subprog 2 */
10370                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10371                         /* lookup from map */
10372                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10373                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10374                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10375                         BPF_LD_MAP_FD(BPF_REG_1, 0),
10376                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10377                                      BPF_FUNC_map_lookup_elem),
10378                         /* write map_value_ptr into stack frame of main prog */
10379                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
10380                         BPF_MOV64_IMM(BPF_REG_0, 0),
10381                         BPF_EXIT_INSN(), /* return 0 */
10382                 },
10383                 .prog_type = BPF_PROG_TYPE_XDP,
10384                 .fixup_map1 = { 23 },
10385                 .result = ACCEPT,
10386         },
10387         {
10388                 "calls: two calls that return map_value with bool condition",
10389                 .insns = {
10390                         /* main prog */
10391                         /* pass fp-16, fp-8 into a function */
10392                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10393                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10394                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10395                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10396                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10397                         BPF_MOV64_IMM(BPF_REG_0, 0),
10398                         BPF_EXIT_INSN(),
10399
10400                         /* subprog 1 */
10401                         /* call 3rd function twice */
10402                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10403                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10404                         /* first time with fp-8 */
10405                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 9),
10406                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
10407                         /* fetch map_value_ptr from the stack of this function */
10408                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
10409                         /* write into map value */
10410                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10411                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
10412                         /* second time with fp-16 */
10413                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10414                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
10415                         /* fetch secound map_value_ptr from the stack */
10416                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
10417                         /* write into map value */
10418                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10419                         BPF_EXIT_INSN(),
10420
10421                         /* subprog 2 */
10422                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10423                         /* lookup from map */
10424                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10425                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10426                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10427                         BPF_LD_MAP_FD(BPF_REG_1, 0),
10428                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10429                                      BPF_FUNC_map_lookup_elem),
10430                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
10431                         BPF_MOV64_IMM(BPF_REG_0, 0),
10432                         BPF_EXIT_INSN(), /* return 0 */
10433                         /* write map_value_ptr into stack frame of main prog */
10434                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
10435                         BPF_MOV64_IMM(BPF_REG_0, 1),
10436                         BPF_EXIT_INSN(), /* return 1 */
10437                 },
10438                 .prog_type = BPF_PROG_TYPE_XDP,
10439                 .fixup_map1 = { 23 },
10440                 .result = ACCEPT,
10441         },
10442         {
10443                 "calls: two calls that return map_value with incorrect bool check",
10444                 .insns = {
10445                         /* main prog */
10446                         /* pass fp-16, fp-8 into a function */
10447                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10448                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10449                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10450                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10451                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10452                         BPF_MOV64_IMM(BPF_REG_0, 0),
10453                         BPF_EXIT_INSN(),
10454
10455                         /* subprog 1 */
10456                         /* call 3rd function twice */
10457                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10458                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10459                         /* first time with fp-8 */
10460                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 9),
10461                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
10462                         /* fetch map_value_ptr from the stack of this function */
10463                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
10464                         /* write into map value */
10465                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10466                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
10467                         /* second time with fp-16 */
10468                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10469                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
10470                         /* fetch secound map_value_ptr from the stack */
10471                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
10472                         /* write into map value */
10473                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10474                         BPF_EXIT_INSN(),
10475
10476                         /* subprog 2 */
10477                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10478                         /* lookup from map */
10479                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10480                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10481                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10482                         BPF_LD_MAP_FD(BPF_REG_1, 0),
10483                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10484                                      BPF_FUNC_map_lookup_elem),
10485                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
10486                         BPF_MOV64_IMM(BPF_REG_0, 0),
10487                         BPF_EXIT_INSN(), /* return 0 */
10488                         /* write map_value_ptr into stack frame of main prog */
10489                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
10490                         BPF_MOV64_IMM(BPF_REG_0, 1),
10491                         BPF_EXIT_INSN(), /* return 1 */
10492                 },
10493                 .prog_type = BPF_PROG_TYPE_XDP,
10494                 .fixup_map1 = { 23 },
10495                 .result = REJECT,
10496                 .errstr = "invalid read from stack off -16+0 size 8",
10497         },
10498         {
10499                 "calls: two calls that receive map_value via arg=ptr_stack_of_caller. test1",
10500                 .insns = {
10501                         /* main prog */
10502                         /* pass fp-16, fp-8 into a function */
10503                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10504                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10505                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10506                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10507                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10508                         BPF_MOV64_IMM(BPF_REG_0, 0),
10509                         BPF_EXIT_INSN(),
10510
10511                         /* subprog 1 */
10512                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10513                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10514                         /* 1st lookup from map */
10515                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10516                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10517                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10518                         BPF_LD_MAP_FD(BPF_REG_1, 0),
10519                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10520                                      BPF_FUNC_map_lookup_elem),
10521                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
10522                         BPF_MOV64_IMM(BPF_REG_8, 0),
10523                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
10524                         /* write map_value_ptr into stack frame of main prog at fp-8 */
10525                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
10526                         BPF_MOV64_IMM(BPF_REG_8, 1),
10527
10528                         /* 2nd lookup from map */
10529                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), /* 20 */
10530                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10531                         BPF_LD_MAP_FD(BPF_REG_1, 0),
10532                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, /* 24 */
10533                                      BPF_FUNC_map_lookup_elem),
10534                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
10535                         BPF_MOV64_IMM(BPF_REG_9, 0),
10536                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
10537                         /* write map_value_ptr into stack frame of main prog at fp-16 */
10538                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
10539                         BPF_MOV64_IMM(BPF_REG_9, 1),
10540
10541                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
10542                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), /* 30 */
10543                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
10544                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
10545                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
10546                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),  /* 34 */
10547                         BPF_EXIT_INSN(),
10548
10549                         /* subprog 2 */
10550                         /* if arg2 == 1 do *arg1 = 0 */
10551                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
10552                         /* fetch map_value_ptr from the stack of this function */
10553                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
10554                         /* write into map value */
10555                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10556
10557                         /* if arg4 == 1 do *arg3 = 0 */
10558                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
10559                         /* fetch map_value_ptr from the stack of this function */
10560                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
10561                         /* write into map value */
10562                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 0),
10563                         BPF_EXIT_INSN(),
10564                 },
10565                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10566                 .fixup_map1 = { 12, 22 },
10567                 .result = REJECT,
10568                 .errstr = "invalid access to map value, value_size=8 off=2 size=8",
10569         },
10570         {
10571                 "calls: two calls that receive map_value via arg=ptr_stack_of_caller. test2",
10572                 .insns = {
10573                         /* main prog */
10574                         /* pass fp-16, fp-8 into a function */
10575                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10576                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10577                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10578                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10579                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10580                         BPF_MOV64_IMM(BPF_REG_0, 0),
10581                         BPF_EXIT_INSN(),
10582
10583                         /* subprog 1 */
10584                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10585                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10586                         /* 1st lookup from map */
10587                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10588                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10589                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10590                         BPF_LD_MAP_FD(BPF_REG_1, 0),
10591                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10592                                      BPF_FUNC_map_lookup_elem),
10593                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
10594                         BPF_MOV64_IMM(BPF_REG_8, 0),
10595                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
10596                         /* write map_value_ptr into stack frame of main prog at fp-8 */
10597                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
10598                         BPF_MOV64_IMM(BPF_REG_8, 1),
10599
10600                         /* 2nd lookup from map */
10601                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), /* 20 */
10602                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10603                         BPF_LD_MAP_FD(BPF_REG_1, 0),
10604                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, /* 24 */
10605                                      BPF_FUNC_map_lookup_elem),
10606                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
10607                         BPF_MOV64_IMM(BPF_REG_9, 0),
10608                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
10609                         /* write map_value_ptr into stack frame of main prog at fp-16 */
10610                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
10611                         BPF_MOV64_IMM(BPF_REG_9, 1),
10612
10613                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
10614                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), /* 30 */
10615                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
10616                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
10617                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
10618                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),  /* 34 */
10619                         BPF_EXIT_INSN(),
10620
10621                         /* subprog 2 */
10622                         /* if arg2 == 1 do *arg1 = 0 */
10623                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
10624                         /* fetch map_value_ptr from the stack of this function */
10625                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
10626                         /* write into map value */
10627                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10628
10629                         /* if arg4 == 1 do *arg3 = 0 */
10630                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
10631                         /* fetch map_value_ptr from the stack of this function */
10632                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
10633                         /* write into map value */
10634                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10635                         BPF_EXIT_INSN(),
10636                 },
10637                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10638                 .fixup_map1 = { 12, 22 },
10639                 .result = ACCEPT,
10640         },
10641         {
10642                 "calls: two jumps that receive map_value via arg=ptr_stack_of_jumper. test3",
10643                 .insns = {
10644                         /* main prog */
10645                         /* pass fp-16, fp-8 into a function */
10646                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10647                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10648                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10649                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10650                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2),
10651                         BPF_MOV64_IMM(BPF_REG_0, 0),
10652                         BPF_EXIT_INSN(),
10653
10654                         /* subprog 1 */
10655                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10656                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10657                         /* 1st lookup from map */
10658                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -24, 0),
10659                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10660                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -24),
10661                         BPF_LD_MAP_FD(BPF_REG_1, 0),
10662                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10663                                      BPF_FUNC_map_lookup_elem),
10664                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
10665                         BPF_MOV64_IMM(BPF_REG_8, 0),
10666                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
10667                         /* write map_value_ptr into stack frame of main prog at fp-8 */
10668                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
10669                         BPF_MOV64_IMM(BPF_REG_8, 1),
10670
10671                         /* 2nd lookup from map */
10672                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10673                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -24),
10674                         BPF_LD_MAP_FD(BPF_REG_1, 0),
10675                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10676                                      BPF_FUNC_map_lookup_elem),
10677                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
10678                         BPF_MOV64_IMM(BPF_REG_9, 0),  // 26
10679                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
10680                         /* write map_value_ptr into stack frame of main prog at fp-16 */
10681                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
10682                         BPF_MOV64_IMM(BPF_REG_9, 1),
10683
10684                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
10685                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), // 30
10686                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
10687                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
10688                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
10689                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1), // 34
10690                         BPF_JMP_IMM(BPF_JA, 0, 0, -30),
10691
10692                         /* subprog 2 */
10693                         /* if arg2 == 1 do *arg1 = 0 */
10694                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
10695                         /* fetch map_value_ptr from the stack of this function */
10696                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
10697                         /* write into map value */
10698                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10699
10700                         /* if arg4 == 1 do *arg3 = 0 */
10701                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
10702                         /* fetch map_value_ptr from the stack of this function */
10703                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
10704                         /* write into map value */
10705                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 0),
10706                         BPF_JMP_IMM(BPF_JA, 0, 0, -8),
10707                 },
10708                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10709                 .fixup_map1 = { 12, 22 },
10710                 .result = REJECT,
10711                 .errstr = "invalid access to map value, value_size=8 off=2 size=8",
10712         },
10713         {
10714                 "calls: two calls that receive map_value_ptr_or_null via arg. test1",
10715                 .insns = {
10716                         /* main prog */
10717                         /* pass fp-16, fp-8 into a function */
10718                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10719                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10720                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10721                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10722                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10723                         BPF_MOV64_IMM(BPF_REG_0, 0),
10724                         BPF_EXIT_INSN(),
10725
10726                         /* subprog 1 */
10727                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10728                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10729                         /* 1st lookup from map */
10730                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10731                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10732                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10733                         BPF_LD_MAP_FD(BPF_REG_1, 0),
10734                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10735                                      BPF_FUNC_map_lookup_elem),
10736                         /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
10737                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
10738                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
10739                         BPF_MOV64_IMM(BPF_REG_8, 0),
10740                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10741                         BPF_MOV64_IMM(BPF_REG_8, 1),
10742
10743                         /* 2nd lookup from map */
10744                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10745                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10746                         BPF_LD_MAP_FD(BPF_REG_1, 0),
10747                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10748                                      BPF_FUNC_map_lookup_elem),
10749                         /* write map_value_ptr_or_null into stack frame of main prog at fp-16 */
10750                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
10751                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
10752                         BPF_MOV64_IMM(BPF_REG_9, 0),
10753                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10754                         BPF_MOV64_IMM(BPF_REG_9, 1),
10755
10756                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
10757                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10758                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
10759                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
10760                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
10761                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10762                         BPF_EXIT_INSN(),
10763
10764                         /* subprog 2 */
10765                         /* if arg2 == 1 do *arg1 = 0 */
10766                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
10767                         /* fetch map_value_ptr from the stack of this function */
10768                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
10769                         /* write into map value */
10770                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10771
10772                         /* if arg4 == 1 do *arg3 = 0 */
10773                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
10774                         /* fetch map_value_ptr from the stack of this function */
10775                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
10776                         /* write into map value */
10777                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10778                         BPF_EXIT_INSN(),
10779                 },
10780                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10781                 .fixup_map1 = { 12, 22 },
10782                 .result = ACCEPT,
10783         },
10784         {
10785                 "calls: two calls that receive map_value_ptr_or_null via arg. test2",
10786                 .insns = {
10787                         /* main prog */
10788                         /* pass fp-16, fp-8 into a function */
10789                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10790                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10791                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10792                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10793                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10794                         BPF_MOV64_IMM(BPF_REG_0, 0),
10795                         BPF_EXIT_INSN(),
10796
10797                         /* subprog 1 */
10798                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10799                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10800                         /* 1st lookup from map */
10801                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10802                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10803                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10804                         BPF_LD_MAP_FD(BPF_REG_1, 0),
10805                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10806                                      BPF_FUNC_map_lookup_elem),
10807                         /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
10808                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
10809                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
10810                         BPF_MOV64_IMM(BPF_REG_8, 0),
10811                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10812                         BPF_MOV64_IMM(BPF_REG_8, 1),
10813
10814                         /* 2nd lookup from map */
10815                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10816                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10817                         BPF_LD_MAP_FD(BPF_REG_1, 0),
10818                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10819                                      BPF_FUNC_map_lookup_elem),
10820                         /* write map_value_ptr_or_null into stack frame of main prog at fp-16 */
10821                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
10822                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
10823                         BPF_MOV64_IMM(BPF_REG_9, 0),
10824                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10825                         BPF_MOV64_IMM(BPF_REG_9, 1),
10826
10827                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
10828                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10829                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
10830                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
10831                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
10832                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10833                         BPF_EXIT_INSN(),
10834
10835                         /* subprog 2 */
10836                         /* if arg2 == 1 do *arg1 = 0 */
10837                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
10838                         /* fetch map_value_ptr from the stack of this function */
10839                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
10840                         /* write into map value */
10841                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10842
10843                         /* if arg4 == 0 do *arg3 = 0 */
10844                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 0, 2),
10845                         /* fetch map_value_ptr from the stack of this function */
10846                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
10847                         /* write into map value */
10848                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10849                         BPF_EXIT_INSN(),
10850                 },
10851                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10852                 .fixup_map1 = { 12, 22 },
10853                 .result = REJECT,
10854                 .errstr = "R0 invalid mem access 'inv'",
10855         },
10856         {
10857                 "calls: pkt_ptr spill into caller stack",
10858                 .insns = {
10859                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
10860                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
10861                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10862                         BPF_EXIT_INSN(),
10863
10864                         /* subprog 1 */
10865                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10866                                     offsetof(struct __sk_buff, data)),
10867                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10868                                     offsetof(struct __sk_buff, data_end)),
10869                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
10870                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
10871                         /* spill unchecked pkt_ptr into stack of caller */
10872                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
10873                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
10874                         /* now the pkt range is verified, read pkt_ptr from stack */
10875                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
10876                         /* write 4 bytes into packet */
10877                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
10878                         BPF_EXIT_INSN(),
10879                 },
10880                 .result = ACCEPT,
10881                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10882                 .retval = POINTER_VALUE,
10883         },
10884         {
10885                 "calls: pkt_ptr spill into caller stack 2",
10886                 .insns = {
10887                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
10888                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
10889                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10890                         /* Marking is still kept, but not in all cases safe. */
10891                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
10892                         BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
10893                         BPF_EXIT_INSN(),
10894
10895                         /* subprog 1 */
10896                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10897                                     offsetof(struct __sk_buff, data)),
10898                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10899                                     offsetof(struct __sk_buff, data_end)),
10900                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
10901                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
10902                         /* spill unchecked pkt_ptr into stack of caller */
10903                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
10904                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
10905                         /* now the pkt range is verified, read pkt_ptr from stack */
10906                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
10907                         /* write 4 bytes into packet */
10908                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
10909                         BPF_EXIT_INSN(),
10910                 },
10911                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10912                 .errstr = "invalid access to packet",
10913                 .result = REJECT,
10914         },
10915         {
10916                 "calls: pkt_ptr spill into caller stack 3",
10917                 .insns = {
10918                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
10919                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
10920                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10921                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
10922                         /* Marking is still kept and safe here. */
10923                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
10924                         BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
10925                         BPF_EXIT_INSN(),
10926
10927                         /* subprog 1 */
10928                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10929                                     offsetof(struct __sk_buff, data)),
10930                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10931                                     offsetof(struct __sk_buff, data_end)),
10932                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
10933                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
10934                         /* spill unchecked pkt_ptr into stack of caller */
10935                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
10936                         BPF_MOV64_IMM(BPF_REG_5, 0),
10937                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
10938                         BPF_MOV64_IMM(BPF_REG_5, 1),
10939                         /* now the pkt range is verified, read pkt_ptr from stack */
10940                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
10941                         /* write 4 bytes into packet */
10942                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
10943                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
10944                         BPF_EXIT_INSN(),
10945                 },
10946                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10947                 .result = ACCEPT,
10948                 .retval = 1,
10949         },
10950         {
10951                 "calls: pkt_ptr spill into caller stack 4",
10952                 .insns = {
10953                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
10954                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
10955                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10956                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
10957                         /* Check marking propagated. */
10958                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
10959                         BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
10960                         BPF_EXIT_INSN(),
10961
10962                         /* subprog 1 */
10963                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10964                                     offsetof(struct __sk_buff, data)),
10965                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10966                                     offsetof(struct __sk_buff, data_end)),
10967                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
10968                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
10969                         /* spill unchecked pkt_ptr into stack of caller */
10970                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
10971                         BPF_MOV64_IMM(BPF_REG_5, 0),
10972                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
10973                         BPF_MOV64_IMM(BPF_REG_5, 1),
10974                         /* don't read back pkt_ptr from stack here */
10975                         /* write 4 bytes into packet */
10976                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
10977                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
10978                         BPF_EXIT_INSN(),
10979                 },
10980                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10981                 .result = ACCEPT,
10982                 .retval = 1,
10983         },
10984         {
10985                 "calls: pkt_ptr spill into caller stack 5",
10986                 .insns = {
10987                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
10988                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
10989                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_1, 0),
10990                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10991                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
10992                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
10993                         BPF_EXIT_INSN(),
10994
10995                         /* subprog 1 */
10996                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
10997                                     offsetof(struct __sk_buff, data)),
10998                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
10999                                     offsetof(struct __sk_buff, data_end)),
11000                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11001                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11002                         BPF_MOV64_IMM(BPF_REG_5, 0),
11003                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
11004                         /* spill checked pkt_ptr into stack of caller */
11005                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11006                         BPF_MOV64_IMM(BPF_REG_5, 1),
11007                         /* don't read back pkt_ptr from stack here */
11008                         /* write 4 bytes into packet */
11009                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11010                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11011                         BPF_EXIT_INSN(),
11012                 },
11013                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11014                 .errstr = "same insn cannot be used with different",
11015                 .result = REJECT,
11016         },
11017         {
11018                 "calls: pkt_ptr spill into caller stack 6",
11019                 .insns = {
11020                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11021                                     offsetof(struct __sk_buff, data_end)),
11022                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11023                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11024                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11025                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11026                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11027                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
11028                         BPF_EXIT_INSN(),
11029
11030                         /* subprog 1 */
11031                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11032                                     offsetof(struct __sk_buff, data)),
11033                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11034                                     offsetof(struct __sk_buff, data_end)),
11035                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11036                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11037                         BPF_MOV64_IMM(BPF_REG_5, 0),
11038                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
11039                         /* spill checked pkt_ptr into stack of caller */
11040                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11041                         BPF_MOV64_IMM(BPF_REG_5, 1),
11042                         /* don't read back pkt_ptr from stack here */
11043                         /* write 4 bytes into packet */
11044                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11045                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11046                         BPF_EXIT_INSN(),
11047                 },
11048                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11049                 .errstr = "R4 invalid mem access",
11050                 .result = REJECT,
11051         },
11052         {
11053                 "calls: pkt_ptr spill into caller stack 7",
11054                 .insns = {
11055                         BPF_MOV64_IMM(BPF_REG_2, 0),
11056                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11057                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11058                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11059                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11060                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11061                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
11062                         BPF_EXIT_INSN(),
11063
11064                         /* subprog 1 */
11065                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11066                                     offsetof(struct __sk_buff, data)),
11067                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11068                                     offsetof(struct __sk_buff, data_end)),
11069                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11070                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11071                         BPF_MOV64_IMM(BPF_REG_5, 0),
11072                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
11073                         /* spill checked pkt_ptr into stack of caller */
11074                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11075                         BPF_MOV64_IMM(BPF_REG_5, 1),
11076                         /* don't read back pkt_ptr from stack here */
11077                         /* write 4 bytes into packet */
11078                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11079                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11080                         BPF_EXIT_INSN(),
11081                 },
11082                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11083                 .errstr = "R4 invalid mem access",
11084                 .result = REJECT,
11085         },
11086         {
11087                 "calls: pkt_ptr spill into caller stack 8",
11088                 .insns = {
11089                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11090                                     offsetof(struct __sk_buff, data)),
11091                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11092                                     offsetof(struct __sk_buff, data_end)),
11093                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11094                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11095                         BPF_JMP_REG(BPF_JLE, BPF_REG_0, BPF_REG_3, 1),
11096                         BPF_EXIT_INSN(),
11097                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11098                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11099                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11100                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11101                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11102                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
11103                         BPF_EXIT_INSN(),
11104
11105                         /* subprog 1 */
11106                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11107                                     offsetof(struct __sk_buff, data)),
11108                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11109                                     offsetof(struct __sk_buff, data_end)),
11110                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11111                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11112                         BPF_MOV64_IMM(BPF_REG_5, 0),
11113                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
11114                         /* spill checked pkt_ptr into stack of caller */
11115                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11116                         BPF_MOV64_IMM(BPF_REG_5, 1),
11117                         /* don't read back pkt_ptr from stack here */
11118                         /* write 4 bytes into packet */
11119                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11120                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11121                         BPF_EXIT_INSN(),
11122                 },
11123                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11124                 .result = ACCEPT,
11125         },
11126         {
11127                 "calls: pkt_ptr spill into caller stack 9",
11128                 .insns = {
11129                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11130                                     offsetof(struct __sk_buff, data)),
11131                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11132                                     offsetof(struct __sk_buff, data_end)),
11133                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11134                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11135                         BPF_JMP_REG(BPF_JLE, BPF_REG_0, BPF_REG_3, 1),
11136                         BPF_EXIT_INSN(),
11137                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11138                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11139                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11140                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11141                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11142                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
11143                         BPF_EXIT_INSN(),
11144
11145                         /* subprog 1 */
11146                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11147                                     offsetof(struct __sk_buff, data)),
11148                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11149                                     offsetof(struct __sk_buff, data_end)),
11150                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11151                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11152                         BPF_MOV64_IMM(BPF_REG_5, 0),
11153                         /* spill unchecked pkt_ptr into stack of caller */
11154                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11155                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
11156                         BPF_MOV64_IMM(BPF_REG_5, 1),
11157                         /* don't read back pkt_ptr from stack here */
11158                         /* write 4 bytes into packet */
11159                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11160                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11161                         BPF_EXIT_INSN(),
11162                 },
11163                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11164                 .errstr = "invalid access to packet",
11165                 .result = REJECT,
11166         },
11167         {
11168                 "calls: caller stack init to zero or map_value_or_null",
11169                 .insns = {
11170                         BPF_MOV64_IMM(BPF_REG_0, 0),
11171                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
11172                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11173                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11174                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
11175                         /* fetch map_value_or_null or const_zero from stack */
11176                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
11177                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
11178                         /* store into map_value */
11179                         BPF_ST_MEM(BPF_W, BPF_REG_0, 0, 0),
11180                         BPF_EXIT_INSN(),
11181
11182                         /* subprog 1 */
11183                         /* if (ctx == 0) return; */
11184                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 8),
11185                         /* else bpf_map_lookup() and *(fp - 8) = r0 */
11186                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
11187                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11188                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11189                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11190                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11191                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11192                                      BPF_FUNC_map_lookup_elem),
11193                         /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
11194                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11195                         BPF_EXIT_INSN(),
11196                 },
11197                 .fixup_map1 = { 13 },
11198                 .result = ACCEPT,
11199                 .prog_type = BPF_PROG_TYPE_XDP,
11200         },
11201         {
11202                 "calls: stack init to zero and pruning",
11203                 .insns = {
11204                         /* first make allocated_stack 16 byte */
11205                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, 0),
11206                         /* now fork the execution such that the false branch
11207                          * of JGT insn will be verified second and it skisp zero
11208                          * init of fp-8 stack slot. If stack liveness marking
11209                          * is missing live_read marks from call map_lookup
11210                          * processing then pruning will incorrectly assume
11211                          * that fp-8 stack slot was unused in the fall-through
11212                          * branch and will accept the program incorrectly
11213                          */
11214                         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 2, 2),
11215                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11216                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
11217                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11218                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11219                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11220                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11221                                      BPF_FUNC_map_lookup_elem),
11222                         BPF_EXIT_INSN(),
11223                 },
11224                 .fixup_map2 = { 6 },
11225                 .errstr = "invalid indirect read from stack off -8+0 size 8",
11226                 .result = REJECT,
11227                 .prog_type = BPF_PROG_TYPE_XDP,
11228         },
11229         {
11230                 "search pruning: all branches should be verified (nop operation)",
11231                 .insns = {
11232                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11233                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11234                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
11235                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11236                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
11237                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
11238                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
11239                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_3, 0xbeef, 2),
11240                         BPF_MOV64_IMM(BPF_REG_4, 0),
11241                         BPF_JMP_A(1),
11242                         BPF_MOV64_IMM(BPF_REG_4, 1),
11243                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -16),
11244                         BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns),
11245                         BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -16),
11246                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_5, 0, 2),
11247                         BPF_MOV64_IMM(BPF_REG_6, 0),
11248                         BPF_ST_MEM(BPF_DW, BPF_REG_6, 0, 0xdead),
11249                         BPF_EXIT_INSN(),
11250                 },
11251                 .fixup_map1 = { 3 },
11252                 .errstr = "R6 invalid mem access 'inv'",
11253                 .result = REJECT,
11254                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11255         },
11256         {
11257                 "search pruning: all branches should be verified (invalid stack access)",
11258                 .insns = {
11259                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11260                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11261                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
11262                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11263                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
11264                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
11265                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
11266                         BPF_MOV64_IMM(BPF_REG_4, 0),
11267                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_3, 0xbeef, 2),
11268                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -16),
11269                         BPF_JMP_A(1),
11270                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -24),
11271                         BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns),
11272                         BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -16),
11273                         BPF_EXIT_INSN(),
11274                 },
11275                 .fixup_map1 = { 3 },
11276                 .errstr = "invalid read from stack off -16+0 size 8",
11277                 .result = REJECT,
11278                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11279         },
11280         {
11281                 "jit: lsh, rsh, arsh by 1",
11282                 .insns = {
11283                         BPF_MOV64_IMM(BPF_REG_0, 1),
11284                         BPF_MOV64_IMM(BPF_REG_1, 0xff),
11285                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 1),
11286                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 1),
11287                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0x3fc, 1),
11288                         BPF_EXIT_INSN(),
11289                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 1),
11290                         BPF_ALU32_IMM(BPF_RSH, BPF_REG_1, 1),
11291                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0xff, 1),
11292                         BPF_EXIT_INSN(),
11293                         BPF_ALU64_IMM(BPF_ARSH, BPF_REG_1, 1),
11294                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0x7f, 1),
11295                         BPF_EXIT_INSN(),
11296                         BPF_MOV64_IMM(BPF_REG_0, 2),
11297                         BPF_EXIT_INSN(),
11298                 },
11299                 .result = ACCEPT,
11300                 .retval = 2,
11301         },
11302         {
11303                 "jit: mov32 for ldimm64, 1",
11304                 .insns = {
11305                         BPF_MOV64_IMM(BPF_REG_0, 2),
11306                         BPF_LD_IMM64(BPF_REG_1, 0xfeffffffffffffffULL),
11307                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 32),
11308                         BPF_LD_IMM64(BPF_REG_2, 0xfeffffffULL),
11309                         BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_2, 1),
11310                         BPF_MOV64_IMM(BPF_REG_0, 1),
11311                         BPF_EXIT_INSN(),
11312                 },
11313                 .result = ACCEPT,
11314                 .retval = 2,
11315         },
11316         {
11317                 "jit: mov32 for ldimm64, 2",
11318                 .insns = {
11319                         BPF_MOV64_IMM(BPF_REG_0, 1),
11320                         BPF_LD_IMM64(BPF_REG_1, 0x1ffffffffULL),
11321                         BPF_LD_IMM64(BPF_REG_2, 0xffffffffULL),
11322                         BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_2, 1),
11323                         BPF_MOV64_IMM(BPF_REG_0, 2),
11324                         BPF_EXIT_INSN(),
11325                 },
11326                 .result = ACCEPT,
11327                 .retval = 2,
11328         },
11329         {
11330                 "jit: various mul tests",
11331                 .insns = {
11332                         BPF_LD_IMM64(BPF_REG_2, 0xeeff0d413122ULL),
11333                         BPF_LD_IMM64(BPF_REG_0, 0xfefefeULL),
11334                         BPF_LD_IMM64(BPF_REG_1, 0xefefefULL),
11335                         BPF_ALU64_REG(BPF_MUL, BPF_REG_0, BPF_REG_1),
11336                         BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_2, 2),
11337                         BPF_MOV64_IMM(BPF_REG_0, 1),
11338                         BPF_EXIT_INSN(),
11339                         BPF_LD_IMM64(BPF_REG_3, 0xfefefeULL),
11340                         BPF_ALU64_REG(BPF_MUL, BPF_REG_3, BPF_REG_1),
11341                         BPF_JMP_REG(BPF_JEQ, BPF_REG_3, BPF_REG_2, 2),
11342                         BPF_MOV64_IMM(BPF_REG_0, 1),
11343                         BPF_EXIT_INSN(),
11344                         BPF_MOV32_REG(BPF_REG_2, BPF_REG_2),
11345                         BPF_LD_IMM64(BPF_REG_0, 0xfefefeULL),
11346                         BPF_ALU32_REG(BPF_MUL, BPF_REG_0, BPF_REG_1),
11347                         BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_2, 2),
11348                         BPF_MOV64_IMM(BPF_REG_0, 1),
11349                         BPF_EXIT_INSN(),
11350                         BPF_LD_IMM64(BPF_REG_3, 0xfefefeULL),
11351                         BPF_ALU32_REG(BPF_MUL, BPF_REG_3, BPF_REG_1),
11352                         BPF_JMP_REG(BPF_JEQ, BPF_REG_3, BPF_REG_2, 2),
11353                         BPF_MOV64_IMM(BPF_REG_0, 1),
11354                         BPF_EXIT_INSN(),
11355                         BPF_LD_IMM64(BPF_REG_0, 0x952a7bbcULL),
11356                         BPF_LD_IMM64(BPF_REG_1, 0xfefefeULL),
11357                         BPF_LD_IMM64(BPF_REG_2, 0xeeff0d413122ULL),
11358                         BPF_ALU32_REG(BPF_MUL, BPF_REG_2, BPF_REG_1),
11359                         BPF_JMP_REG(BPF_JEQ, BPF_REG_2, BPF_REG_0, 2),
11360                         BPF_MOV64_IMM(BPF_REG_0, 1),
11361                         BPF_EXIT_INSN(),
11362                         BPF_MOV64_IMM(BPF_REG_0, 2),
11363                         BPF_EXIT_INSN(),
11364                 },
11365                 .result = ACCEPT,
11366                 .retval = 2,
11367         },
11368         {
11369                 "xadd/w check unaligned stack",
11370                 .insns = {
11371                         BPF_MOV64_IMM(BPF_REG_0, 1),
11372                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
11373                         BPF_STX_XADD(BPF_W, BPF_REG_10, BPF_REG_0, -7),
11374                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
11375                         BPF_EXIT_INSN(),
11376                 },
11377                 .result = REJECT,
11378                 .errstr = "misaligned stack access off",
11379                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11380         },
11381         {
11382                 "xadd/w check unaligned map",
11383                 .insns = {
11384                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11385                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11386                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11387                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11388                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11389                                      BPF_FUNC_map_lookup_elem),
11390                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
11391                         BPF_EXIT_INSN(),
11392                         BPF_MOV64_IMM(BPF_REG_1, 1),
11393                         BPF_STX_XADD(BPF_W, BPF_REG_0, BPF_REG_1, 3),
11394                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, 3),
11395                         BPF_EXIT_INSN(),
11396                 },
11397                 .fixup_map1 = { 3 },
11398                 .result = REJECT,
11399                 .errstr = "misaligned value access off",
11400                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11401         },
11402         {
11403                 "xadd/w check unaligned pkt",
11404                 .insns = {
11405                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11406                                     offsetof(struct xdp_md, data)),
11407                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11408                                     offsetof(struct xdp_md, data_end)),
11409                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
11410                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
11411                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 2),
11412                         BPF_MOV64_IMM(BPF_REG_0, 99),
11413                         BPF_JMP_IMM(BPF_JA, 0, 0, 6),
11414                         BPF_MOV64_IMM(BPF_REG_0, 1),
11415                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11416                         BPF_ST_MEM(BPF_W, BPF_REG_2, 3, 0),
11417                         BPF_STX_XADD(BPF_W, BPF_REG_2, BPF_REG_0, 1),
11418                         BPF_STX_XADD(BPF_W, BPF_REG_2, BPF_REG_0, 2),
11419                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_2, 1),
11420                         BPF_EXIT_INSN(),
11421                 },
11422                 .result = REJECT,
11423                 .errstr = "BPF_XADD stores into R2 packet",
11424                 .prog_type = BPF_PROG_TYPE_XDP,
11425         },
11426 };
11427
11428 static int probe_filter_length(const struct bpf_insn *fp)
11429 {
11430         int len;
11431
11432         for (len = MAX_INSNS - 1; len > 0; --len)
11433                 if (fp[len].code != 0 || fp[len].imm != 0)
11434                         break;
11435         return len + 1;
11436 }
11437
11438 static int create_map(uint32_t size_value, uint32_t max_elem)
11439 {
11440         int fd;
11441
11442         fd = bpf_create_map(BPF_MAP_TYPE_HASH, sizeof(long long),
11443                             size_value, max_elem, BPF_F_NO_PREALLOC);
11444         if (fd < 0)
11445                 printf("Failed to create hash map '%s'!\n", strerror(errno));
11446
11447         return fd;
11448 }
11449
11450 static int create_prog_dummy1(void)
11451 {
11452         struct bpf_insn prog[] = {
11453                 BPF_MOV64_IMM(BPF_REG_0, 42),
11454                 BPF_EXIT_INSN(),
11455         };
11456
11457         return bpf_load_program(BPF_PROG_TYPE_SOCKET_FILTER, prog,
11458                                 ARRAY_SIZE(prog), "GPL", 0, NULL, 0);
11459 }
11460
11461 static int create_prog_dummy2(int mfd, int idx)
11462 {
11463         struct bpf_insn prog[] = {
11464                 BPF_MOV64_IMM(BPF_REG_3, idx),
11465                 BPF_LD_MAP_FD(BPF_REG_2, mfd),
11466                 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11467                              BPF_FUNC_tail_call),
11468                 BPF_MOV64_IMM(BPF_REG_0, 41),
11469                 BPF_EXIT_INSN(),
11470         };
11471
11472         return bpf_load_program(BPF_PROG_TYPE_SOCKET_FILTER, prog,
11473                                 ARRAY_SIZE(prog), "GPL", 0, NULL, 0);
11474 }
11475
11476 static int create_prog_array(void)
11477 {
11478         int p1key = 0, p2key = 1;
11479         int mfd, p1fd, p2fd;
11480
11481         mfd = bpf_create_map(BPF_MAP_TYPE_PROG_ARRAY, sizeof(int),
11482                              sizeof(int), 4, 0);
11483         if (mfd < 0) {
11484                 printf("Failed to create prog array '%s'!\n", strerror(errno));
11485                 return -1;
11486         }
11487
11488         p1fd = create_prog_dummy1();
11489         p2fd = create_prog_dummy2(mfd, p2key);
11490         if (p1fd < 0 || p2fd < 0)
11491                 goto out;
11492         if (bpf_map_update_elem(mfd, &p1key, &p1fd, BPF_ANY) < 0)
11493                 goto out;
11494         if (bpf_map_update_elem(mfd, &p2key, &p2fd, BPF_ANY) < 0)
11495                 goto out;
11496         close(p2fd);
11497         close(p1fd);
11498
11499         return mfd;
11500 out:
11501         close(p2fd);
11502         close(p1fd);
11503         close(mfd);
11504         return -1;
11505 }
11506
11507 static int create_map_in_map(void)
11508 {
11509         int inner_map_fd, outer_map_fd;
11510
11511         inner_map_fd = bpf_create_map(BPF_MAP_TYPE_ARRAY, sizeof(int),
11512                                       sizeof(int), 1, 0);
11513         if (inner_map_fd < 0) {
11514                 printf("Failed to create array '%s'!\n", strerror(errno));
11515                 return inner_map_fd;
11516         }
11517
11518         outer_map_fd = bpf_create_map_in_map(BPF_MAP_TYPE_ARRAY_OF_MAPS, NULL,
11519                                              sizeof(int), inner_map_fd, 1, 0);
11520         if (outer_map_fd < 0)
11521                 printf("Failed to create array of maps '%s'!\n",
11522                        strerror(errno));
11523
11524         close(inner_map_fd);
11525
11526         return outer_map_fd;
11527 }
11528
11529 static char bpf_vlog[32768];
11530
11531 static void do_test_fixup(struct bpf_test *test, struct bpf_insn *prog,
11532                           int *map_fds)
11533 {
11534         int *fixup_map1 = test->fixup_map1;
11535         int *fixup_map2 = test->fixup_map2;
11536         int *fixup_prog = test->fixup_prog;
11537         int *fixup_map_in_map = test->fixup_map_in_map;
11538
11539         /* Allocating HTs with 1 elem is fine here, since we only test
11540          * for verifier and not do a runtime lookup, so the only thing
11541          * that really matters is value size in this case.
11542          */
11543         if (*fixup_map1) {
11544                 map_fds[0] = create_map(sizeof(long long), 1);
11545                 do {
11546                         prog[*fixup_map1].imm = map_fds[0];
11547                         fixup_map1++;
11548                 } while (*fixup_map1);
11549         }
11550
11551         if (*fixup_map2) {
11552                 map_fds[1] = create_map(sizeof(struct test_val), 1);
11553                 do {
11554                         prog[*fixup_map2].imm = map_fds[1];
11555                         fixup_map2++;
11556                 } while (*fixup_map2);
11557         }
11558
11559         if (*fixup_prog) {
11560                 map_fds[2] = create_prog_array();
11561                 do {
11562                         prog[*fixup_prog].imm = map_fds[2];
11563                         fixup_prog++;
11564                 } while (*fixup_prog);
11565         }
11566
11567         if (*fixup_map_in_map) {
11568                 map_fds[3] = create_map_in_map();
11569                 do {
11570                         prog[*fixup_map_in_map].imm = map_fds[3];
11571                         fixup_map_in_map++;
11572                 } while (*fixup_map_in_map);
11573         }
11574 }
11575
11576 static void do_test_single(struct bpf_test *test, bool unpriv,
11577                            int *passes, int *errors)
11578 {
11579         int fd_prog, expected_ret, reject_from_alignment;
11580         struct bpf_insn *prog = test->insns;
11581         int prog_len = probe_filter_length(prog);
11582         char data_in[TEST_DATA_LEN] = {};
11583         int prog_type = test->prog_type;
11584         int map_fds[MAX_NR_MAPS];
11585         const char *expected_err;
11586         uint32_t retval;
11587         int i, err;
11588
11589         for (i = 0; i < MAX_NR_MAPS; i++)
11590                 map_fds[i] = -1;
11591
11592         do_test_fixup(test, prog, map_fds);
11593
11594         fd_prog = bpf_verify_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
11595                                      prog, prog_len, test->flags & F_LOAD_WITH_STRICT_ALIGNMENT,
11596                                      "GPL", 0, bpf_vlog, sizeof(bpf_vlog), 1);
11597
11598         expected_ret = unpriv && test->result_unpriv != UNDEF ?
11599                        test->result_unpriv : test->result;
11600         expected_err = unpriv && test->errstr_unpriv ?
11601                        test->errstr_unpriv : test->errstr;
11602
11603         reject_from_alignment = fd_prog < 0 &&
11604                                 (test->flags & F_NEEDS_EFFICIENT_UNALIGNED_ACCESS) &&
11605                                 strstr(bpf_vlog, "Unknown alignment.");
11606 #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
11607         if (reject_from_alignment) {
11608                 printf("FAIL\nFailed due to alignment despite having efficient unaligned access: '%s'!\n",
11609                        strerror(errno));
11610                 goto fail_log;
11611         }
11612 #endif
11613         if (expected_ret == ACCEPT) {
11614                 if (fd_prog < 0 && !reject_from_alignment) {
11615                         printf("FAIL\nFailed to load prog '%s'!\n",
11616                                strerror(errno));
11617                         goto fail_log;
11618                 }
11619         } else {
11620                 if (fd_prog >= 0) {
11621                         printf("FAIL\nUnexpected success to load!\n");
11622                         goto fail_log;
11623                 }
11624                 if (!strstr(bpf_vlog, expected_err) && !reject_from_alignment) {
11625                         printf("FAIL\nUnexpected error message!\n\tEXP: %s\n\tRES: %s\n",
11626                               expected_err, bpf_vlog);
11627                         goto fail_log;
11628                 }
11629         }
11630
11631         if (fd_prog >= 0) {
11632                 err = bpf_prog_test_run(fd_prog, 1, data_in, sizeof(data_in),
11633                                         NULL, NULL, &retval, NULL);
11634                 if (err && errno != 524/*ENOTSUPP*/ && errno != EPERM) {
11635                         printf("Unexpected bpf_prog_test_run error\n");
11636                         goto fail_log;
11637                 }
11638                 if (!err && retval != test->retval &&
11639                     test->retval != POINTER_VALUE) {
11640                         printf("FAIL retval %d != %d\n", retval, test->retval);
11641                         goto fail_log;
11642                 }
11643         }
11644         (*passes)++;
11645         printf("OK%s\n", reject_from_alignment ?
11646                " (NOTE: reject due to unknown alignment)" : "");
11647 close_fds:
11648         close(fd_prog);
11649         for (i = 0; i < MAX_NR_MAPS; i++)
11650                 close(map_fds[i]);
11651         sched_yield();
11652         return;
11653 fail_log:
11654         (*errors)++;
11655         printf("%s", bpf_vlog);
11656         goto close_fds;
11657 }
11658
11659 static bool is_admin(void)
11660 {
11661         cap_t caps;
11662         cap_flag_value_t sysadmin = CAP_CLEAR;
11663         const cap_value_t cap_val = CAP_SYS_ADMIN;
11664
11665 #ifdef CAP_IS_SUPPORTED
11666         if (!CAP_IS_SUPPORTED(CAP_SETFCAP)) {
11667                 perror("cap_get_flag");
11668                 return false;
11669         }
11670 #endif
11671         caps = cap_get_proc();
11672         if (!caps) {
11673                 perror("cap_get_proc");
11674                 return false;
11675         }
11676         if (cap_get_flag(caps, cap_val, CAP_EFFECTIVE, &sysadmin))
11677                 perror("cap_get_flag");
11678         if (cap_free(caps))
11679                 perror("cap_free");
11680         return (sysadmin == CAP_SET);
11681 }
11682
11683 static int set_admin(bool admin)
11684 {
11685         cap_t caps;
11686         const cap_value_t cap_val = CAP_SYS_ADMIN;
11687         int ret = -1;
11688
11689         caps = cap_get_proc();
11690         if (!caps) {
11691                 perror("cap_get_proc");
11692                 return -1;
11693         }
11694         if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_val,
11695                                 admin ? CAP_SET : CAP_CLEAR)) {
11696                 perror("cap_set_flag");
11697                 goto out;
11698         }
11699         if (cap_set_proc(caps)) {
11700                 perror("cap_set_proc");
11701                 goto out;
11702         }
11703         ret = 0;
11704 out:
11705         if (cap_free(caps))
11706                 perror("cap_free");
11707         return ret;
11708 }
11709
11710 static void get_unpriv_disabled()
11711 {
11712         char buf[2];
11713         FILE *fd;
11714
11715         fd = fopen("/proc/sys/"UNPRIV_SYSCTL, "r");
11716         if (fgets(buf, 2, fd) == buf && atoi(buf))
11717                 unpriv_disabled = true;
11718         fclose(fd);
11719 }
11720
11721 static int do_test(bool unpriv, unsigned int from, unsigned int to)
11722 {
11723         int i, passes = 0, errors = 0, skips = 0;
11724
11725         for (i = from; i < to; i++) {
11726                 struct bpf_test *test = &tests[i];
11727
11728                 /* Program types that are not supported by non-root we
11729                  * skip right away.
11730                  */
11731                 if (!test->prog_type && unpriv_disabled) {
11732                         printf("#%d/u %s SKIP\n", i, test->descr);
11733                         skips++;
11734                 } else if (!test->prog_type) {
11735                         if (!unpriv)
11736                                 set_admin(false);
11737                         printf("#%d/u %s ", i, test->descr);
11738                         do_test_single(test, true, &passes, &errors);
11739                         if (!unpriv)
11740                                 set_admin(true);
11741                 }
11742
11743                 if (unpriv) {
11744                         printf("#%d/p %s SKIP\n", i, test->descr);
11745                         skips++;
11746                 } else {
11747                         printf("#%d/p %s ", i, test->descr);
11748                         do_test_single(test, false, &passes, &errors);
11749                 }
11750         }
11751
11752         printf("Summary: %d PASSED, %d SKIPPED, %d FAILED\n", passes,
11753                skips, errors);
11754         return errors ? EXIT_FAILURE : EXIT_SUCCESS;
11755 }
11756
11757 int main(int argc, char **argv)
11758 {
11759         unsigned int from = 0, to = ARRAY_SIZE(tests);
11760         bool unpriv = !is_admin();
11761
11762         if (argc == 3) {
11763                 unsigned int l = atoi(argv[argc - 2]);
11764                 unsigned int u = atoi(argv[argc - 1]);
11765
11766                 if (l < to && u < to) {
11767                         from = l;
11768                         to   = u + 1;
11769                 }
11770         } else if (argc == 2) {
11771                 unsigned int t = atoi(argv[argc - 1]);
11772
11773                 if (t < to) {
11774                         from = t;
11775                         to   = t + 1;
11776                 }
11777         }
11778
11779         get_unpriv_disabled();
11780         if (unpriv && unpriv_disabled) {
11781                 printf("Cannot run as unprivileged user with sysctl %s.\n",
11782                        UNPRIV_SYSCTL);
11783                 return EXIT_FAILURE;
11784         }
11785
11786         return do_test(unpriv, from, to);
11787 }