tools/testing/selftests/bpf/test_verifier.c

   1 /*
   2  * Testsuite for eBPF verifier
   3  *
   4  * Copyright (c) 2014 PLUMgrid, http://plumgrid.com
   5  * Copyright (c) 2017 Facebook
   6  *
   7  * This program is free software; you can redistribute it and/or
   8  * modify it under the terms of version 2 of the GNU General Public
   9  * License as published by the Free Software Foundation.
  10  */
  11
  12 #include <endian.h>
  13 #include <asm/types.h>
  14 #include <linux/types.h>
  15 #include <stdint.h>
  16 #include <stdio.h>
  17 #include <stdlib.h>
  18 #include <unistd.h>
  19 #include <errno.h>
  20 #include <string.h>
  21 #include <stddef.h>
  22 #include <stdbool.h>
  23 #include <sched.h>
  24 #include <limits.h>
  25
  26 #include <sys/capability.h>
  27
  28 #include <linux/unistd.h>
  29 #include <linux/filter.h>
  30 #include <linux/bpf_perf_event.h>
  31 #include <linux/bpf.h>
  32 #include <linux/if_ether.h>
  33
  34 #include <bpf/bpf.h>
  35
  36 #ifdef HAVE_GENHDR
  37 # include "autoconf.h"
  38 #else
  39 # if defined(__i386) || defined(__x86_64) || defined(__s390x__) || defined(__aarch64__)
  40 #  define CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 1
  41 # endif
  42 #endif
  43 #include "bpf_rlimit.h"
  44 #include "bpf_rand.h"
  45 #include "../../../include/linux/filter.h"
  46
  47 #ifndef ARRAY_SIZE
  48 # define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
  49 #endif
  50
  51 #define MAX_INSNS       BPF_MAXINSNS
  52 #define MAX_FIXUPS      8
  53 #define MAX_NR_MAPS     8
  54 #define POINTER_VALUE   0xcafe4all
  55 #define TEST_DATA_LEN   64
  56
  57 #define F_NEEDS_EFFICIENT_UNALIGNED_ACCESS      (1 << 0)
  58 #define F_LOAD_WITH_STRICT_ALIGNMENT            (1 << 1)
  59
  60 #define UNPRIV_SYSCTL "kernel/unprivileged_bpf_disabled"
  61 static bool unpriv_disabled = false;
  62
  63 struct bpf_test {
  64         const char *descr;
  65         struct bpf_insn insns[MAX_INSNS];
  66         int fixup_map1[MAX_FIXUPS];
  67         int fixup_map2[MAX_FIXUPS];
  68         int fixup_map3[MAX_FIXUPS];
  69         int fixup_map4[MAX_FIXUPS];
  70         int fixup_prog1[MAX_FIXUPS];
  71         int fixup_prog2[MAX_FIXUPS];
  72         int fixup_map_in_map[MAX_FIXUPS];
  73         int fixup_cgroup_storage[MAX_FIXUPS];
  74         const char *errstr;
  75         const char *errstr_unpriv;
  76         uint32_t retval;
  77         enum {
  78                 UNDEF,
  79                 ACCEPT,
  80                 REJECT
  81         } result, result_unpriv;
  82         enum bpf_prog_type prog_type;
  83         uint8_t flags;
  84         __u8 data[TEST_DATA_LEN];
  85         void (*fill_helper)(struct bpf_test *self);
  86 };
  87
  88 /* Note we want this to be 64 bit aligned so that the end of our array is
  89  * actually the end of the structure.
  90  */
  91 #define MAX_ENTRIES 11
  92
  93 struct test_val {
  94         unsigned int index;
  95         int foo[MAX_ENTRIES];
  96 };
  97
  98 struct other_val {
  99         long long foo;
 100         long long bar;
 101 };
 102
 103 static void bpf_fill_ld_abs_vlan_push_pop(struct bpf_test *self)
 104 {
 105         /* test: {skb->data[0], vlan_push} x 68 + {skb->data[0], vlan_pop} x 68 */
 106 #define PUSH_CNT 51
 107         unsigned int len = BPF_MAXINSNS;
 108         struct bpf_insn *insn = self->insns;
 109         int i = 0, j, k = 0;
 110
 111         insn[i++] = BPF_MOV64_REG(BPF_REG_6, BPF_REG_1);
 112 loop:
 113         for (j = 0; j < PUSH_CNT; j++) {
 114                 insn[i++] = BPF_LD_ABS(BPF_B, 0);
 115                 insn[i] = BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x34, len - i - 2);
 116                 i++;
 117                 insn[i++] = BPF_MOV64_REG(BPF_REG_1, BPF_REG_6);
 118                 insn[i++] = BPF_MOV64_IMM(BPF_REG_2, 1);
 119                 insn[i++] = BPF_MOV64_IMM(BPF_REG_3, 2);
 120                 insn[i++] = BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 121                                          BPF_FUNC_skb_vlan_push),
 122                 insn[i] = BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, len - i - 2);
 123                 i++;
 124         }
 125
 126         for (j = 0; j < PUSH_CNT; j++) {
 127                 insn[i++] = BPF_LD_ABS(BPF_B, 0);
 128                 insn[i] = BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x34, len - i - 2);
 129                 i++;
 130                 insn[i++] = BPF_MOV64_REG(BPF_REG_1, BPF_REG_6);
 131                 insn[i++] = BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 132                                          BPF_FUNC_skb_vlan_pop),
 133                 insn[i] = BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, len - i - 2);
 134                 i++;
 135         }
 136         if (++k < 5)
 137                 goto loop;
 138
 139         for (; i < len - 1; i++)
 140                 insn[i] = BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 0xbef);
 141         insn[len - 1] = BPF_EXIT_INSN();
 142 }
 143
 144 static void bpf_fill_jump_around_ld_abs(struct bpf_test *self)
 145 {
 146         struct bpf_insn *insn = self->insns;
 147         unsigned int len = BPF_MAXINSNS;
 148         int i = 0;
 149
 150         insn[i++] = BPF_MOV64_REG(BPF_REG_6, BPF_REG_1);
 151         insn[i++] = BPF_LD_ABS(BPF_B, 0);
 152         insn[i] = BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 10, len - i - 2);
 153         i++;
 154         while (i < len - 1)
 155                 insn[i++] = BPF_LD_ABS(BPF_B, 1);
 156         insn[i] = BPF_EXIT_INSN();
 157 }
 158
 159 static void bpf_fill_rand_ld_dw(struct bpf_test *self)
 160 {
 161         struct bpf_insn *insn = self->insns;
 162         uint64_t res = 0;
 163         int i = 0;
 164
 165         insn[i++] = BPF_MOV32_IMM(BPF_REG_0, 0);
 166         while (i < self->retval) {
 167                 uint64_t val = bpf_semi_rand_get();
 168                 struct bpf_insn tmp[2] = { BPF_LD_IMM64(BPF_REG_1, val) };
 169
 170                 res ^= val;
 171                 insn[i++] = tmp[0];
 172                 insn[i++] = tmp[1];
 173                 insn[i++] = BPF_ALU64_REG(BPF_XOR, BPF_REG_0, BPF_REG_1);
 174         }
 175         insn[i++] = BPF_MOV64_REG(BPF_REG_1, BPF_REG_0);
 176         insn[i++] = BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 32);
 177         insn[i++] = BPF_ALU64_REG(BPF_XOR, BPF_REG_0, BPF_REG_1);
 178         insn[i] = BPF_EXIT_INSN();
 179         res ^= (res >> 32);
 180         self->retval = (uint32_t)res;
 181 }
 182
 183 static struct bpf_test tests[] = {
 184         {
 185                 "add+sub+mul",
 186                 .insns = {
 187                         BPF_MOV64_IMM(BPF_REG_1, 1),
 188                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 2),
 189                         BPF_MOV64_IMM(BPF_REG_2, 3),
 190                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_2),
 191                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -1),
 192                         BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 3),
 193                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
 194                         BPF_EXIT_INSN(),
 195                 },
 196                 .result = ACCEPT,
 197                 .retval = -3,
 198         },
 199         {
 200                 "DIV32 by 0, zero check 1",
 201                 .insns = {
 202                         BPF_MOV32_IMM(BPF_REG_0, 42),
 203                         BPF_MOV32_IMM(BPF_REG_1, 0),
 204                         BPF_MOV32_IMM(BPF_REG_2, 1),
 205                         BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
 206                         BPF_EXIT_INSN(),
 207                 },
 208                 .result = ACCEPT,
 209                 .retval = 42,
 210         },
 211         {
 212                 "DIV32 by 0, zero check 2",
 213                 .insns = {
 214                         BPF_MOV32_IMM(BPF_REG_0, 42),
 215                         BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
 216                         BPF_MOV32_IMM(BPF_REG_2, 1),
 217                         BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
 218                         BPF_EXIT_INSN(),
 219                 },
 220                 .result = ACCEPT,
 221                 .retval = 42,
 222         },
 223         {
 224                 "DIV64 by 0, zero check",
 225                 .insns = {
 226                         BPF_MOV32_IMM(BPF_REG_0, 42),
 227                         BPF_MOV32_IMM(BPF_REG_1, 0),
 228                         BPF_MOV32_IMM(BPF_REG_2, 1),
 229                         BPF_ALU64_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
 230                         BPF_EXIT_INSN(),
 231                 },
 232                 .result = ACCEPT,
 233                 .retval = 42,
 234         },
 235         {
 236                 "MOD32 by 0, zero check 1",
 237                 .insns = {
 238                         BPF_MOV32_IMM(BPF_REG_0, 42),
 239                         BPF_MOV32_IMM(BPF_REG_1, 0),
 240                         BPF_MOV32_IMM(BPF_REG_2, 1),
 241                         BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 242                         BPF_EXIT_INSN(),
 243                 },
 244                 .result = ACCEPT,
 245                 .retval = 42,
 246         },
 247         {
 248                 "MOD32 by 0, zero check 2",
 249                 .insns = {
 250                         BPF_MOV32_IMM(BPF_REG_0, 42),
 251                         BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
 252                         BPF_MOV32_IMM(BPF_REG_2, 1),
 253                         BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 254                         BPF_EXIT_INSN(),
 255                 },
 256                 .result = ACCEPT,
 257                 .retval = 42,
 258         },
 259         {
 260                 "MOD64 by 0, zero check",
 261                 .insns = {
 262                         BPF_MOV32_IMM(BPF_REG_0, 42),
 263                         BPF_MOV32_IMM(BPF_REG_1, 0),
 264                         BPF_MOV32_IMM(BPF_REG_2, 1),
 265                         BPF_ALU64_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 266                         BPF_EXIT_INSN(),
 267                 },
 268                 .result = ACCEPT,
 269                 .retval = 42,
 270         },
 271         {
 272                 "DIV32 by 0, zero check ok, cls",
 273                 .insns = {
 274                         BPF_MOV32_IMM(BPF_REG_0, 42),
 275                         BPF_MOV32_IMM(BPF_REG_1, 2),
 276                         BPF_MOV32_IMM(BPF_REG_2, 16),
 277                         BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
 278                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 279                         BPF_EXIT_INSN(),
 280                 },
 281                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 282                 .result = ACCEPT,
 283                 .retval = 8,
 284         },
 285         {
 286                 "DIV32 by 0, zero check 1, cls",
 287                 .insns = {
 288                         BPF_MOV32_IMM(BPF_REG_1, 0),
 289                         BPF_MOV32_IMM(BPF_REG_0, 1),
 290                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 291                         BPF_EXIT_INSN(),
 292                 },
 293                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 294                 .result = ACCEPT,
 295                 .retval = 0,
 296         },
 297         {
 298                 "DIV32 by 0, zero check 2, cls",
 299                 .insns = {
 300                         BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
 301                         BPF_MOV32_IMM(BPF_REG_0, 1),
 302                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 303                         BPF_EXIT_INSN(),
 304                 },
 305                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 306                 .result = ACCEPT,
 307                 .retval = 0,
 308         },
 309         {
 310                 "DIV64 by 0, zero check, cls",
 311                 .insns = {
 312                         BPF_MOV32_IMM(BPF_REG_1, 0),
 313                         BPF_MOV32_IMM(BPF_REG_0, 1),
 314                         BPF_ALU64_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 315                         BPF_EXIT_INSN(),
 316                 },
 317                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 318                 .result = ACCEPT,
 319                 .retval = 0,
 320         },
 321         {
 322                 "MOD32 by 0, zero check ok, cls",
 323                 .insns = {
 324                         BPF_MOV32_IMM(BPF_REG_0, 42),
 325                         BPF_MOV32_IMM(BPF_REG_1, 3),
 326                         BPF_MOV32_IMM(BPF_REG_2, 5),
 327                         BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 328                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 329                         BPF_EXIT_INSN(),
 330                 },
 331                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 332                 .result = ACCEPT,
 333                 .retval = 2,
 334         },
 335         {
 336                 "MOD32 by 0, zero check 1, cls",
 337                 .insns = {
 338                         BPF_MOV32_IMM(BPF_REG_1, 0),
 339                         BPF_MOV32_IMM(BPF_REG_0, 1),
 340                         BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 341                         BPF_EXIT_INSN(),
 342                 },
 343                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 344                 .result = ACCEPT,
 345                 .retval = 1,
 346         },
 347         {
 348                 "MOD32 by 0, zero check 2, cls",
 349                 .insns = {
 350                         BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
 351                         BPF_MOV32_IMM(BPF_REG_0, 1),
 352                         BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 353                         BPF_EXIT_INSN(),
 354                 },
 355                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 356                 .result = ACCEPT,
 357                 .retval = 1,
 358         },
 359         {
 360                 "MOD64 by 0, zero check 1, cls",
 361                 .insns = {
 362                         BPF_MOV32_IMM(BPF_REG_1, 0),
 363                         BPF_MOV32_IMM(BPF_REG_0, 2),
 364                         BPF_ALU64_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 365                         BPF_EXIT_INSN(),
 366                 },
 367                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 368                 .result = ACCEPT,
 369                 .retval = 2,
 370         },
 371         {
 372                 "MOD64 by 0, zero check 2, cls",
 373                 .insns = {
 374                         BPF_MOV32_IMM(BPF_REG_1, 0),
 375                         BPF_MOV32_IMM(BPF_REG_0, -1),
 376                         BPF_ALU64_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 377                         BPF_EXIT_INSN(),
 378                 },
 379                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 380                 .result = ACCEPT,
 381                 .retval = -1,
 382         },
 383         /* Just make sure that JITs used udiv/umod as otherwise we get
 384          * an exception from INT_MIN/-1 overflow similarly as with div
 385          * by zero.
 386          */
 387         {
 388                 "DIV32 overflow, check 1",
 389                 .insns = {
 390                         BPF_MOV32_IMM(BPF_REG_1, -1),
 391                         BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
 392                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 393                         BPF_EXIT_INSN(),
 394                 },
 395                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 396                 .result = ACCEPT,
 397                 .retval = 0,
 398         },
 399         {
 400                 "DIV32 overflow, check 2",
 401                 .insns = {
 402                         BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
 403                         BPF_ALU32_IMM(BPF_DIV, BPF_REG_0, -1),
 404                         BPF_EXIT_INSN(),
 405                 },
 406                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 407                 .result = ACCEPT,
 408                 .retval = 0,
 409         },
 410         {
 411                 "DIV64 overflow, check 1",
 412                 .insns = {
 413                         BPF_MOV64_IMM(BPF_REG_1, -1),
 414                         BPF_LD_IMM64(BPF_REG_0, LLONG_MIN),
 415                         BPF_ALU64_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 416                         BPF_EXIT_INSN(),
 417                 },
 418                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 419                 .result = ACCEPT,
 420                 .retval = 0,
 421         },
 422         {
 423                 "DIV64 overflow, check 2",
 424                 .insns = {
 425                         BPF_LD_IMM64(BPF_REG_0, LLONG_MIN),
 426                         BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, -1),
 427                         BPF_EXIT_INSN(),
 428                 },
 429                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 430                 .result = ACCEPT,
 431                 .retval = 0,
 432         },
 433         {
 434                 "MOD32 overflow, check 1",
 435                 .insns = {
 436                         BPF_MOV32_IMM(BPF_REG_1, -1),
 437                         BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
 438                         BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 439                         BPF_EXIT_INSN(),
 440                 },
 441                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 442                 .result = ACCEPT,
 443                 .retval = INT_MIN,
 444         },
 445         {
 446                 "MOD32 overflow, check 2",
 447                 .insns = {
 448                         BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
 449                         BPF_ALU32_IMM(BPF_MOD, BPF_REG_0, -1),
 450                         BPF_EXIT_INSN(),
 451                 },
 452                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 453                 .result = ACCEPT,
 454                 .retval = INT_MIN,
 455         },
 456         {
 457                 "MOD64 overflow, check 1",
 458                 .insns = {
 459                         BPF_MOV64_IMM(BPF_REG_1, -1),
 460                         BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
 461                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
 462                         BPF_ALU64_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 463                         BPF_MOV32_IMM(BPF_REG_0, 0),
 464                         BPF_JMP_REG(BPF_JNE, BPF_REG_3, BPF_REG_2, 1),
 465                         BPF_MOV32_IMM(BPF_REG_0, 1),
 466                         BPF_EXIT_INSN(),
 467                 },
 468                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 469                 .result = ACCEPT,
 470                 .retval = 1,
 471         },
 472         {
 473                 "MOD64 overflow, check 2",
 474                 .insns = {
 475                         BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
 476                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
 477                         BPF_ALU64_IMM(BPF_MOD, BPF_REG_2, -1),
 478                         BPF_MOV32_IMM(BPF_REG_0, 0),
 479                         BPF_JMP_REG(BPF_JNE, BPF_REG_3, BPF_REG_2, 1),
 480                         BPF_MOV32_IMM(BPF_REG_0, 1),
 481                         BPF_EXIT_INSN(),
 482                 },
 483                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 484                 .result = ACCEPT,
 485                 .retval = 1,
 486         },
 487         {
 488                 "xor32 zero extend check",
 489                 .insns = {
 490                         BPF_MOV32_IMM(BPF_REG_2, -1),
 491                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 32),
 492                         BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 0xffff),
 493                         BPF_ALU32_REG(BPF_XOR, BPF_REG_2, BPF_REG_2),
 494                         BPF_MOV32_IMM(BPF_REG_0, 2),
 495                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 1),
 496                         BPF_MOV32_IMM(BPF_REG_0, 1),
 497                         BPF_EXIT_INSN(),
 498                 },
 499                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 500                 .result = ACCEPT,
 501                 .retval = 1,
 502         },
 503         {
 504                 "empty prog",
 505                 .insns = {
 506                 },
 507                 .errstr = "unknown opcode 00",
 508                 .result = REJECT,
 509         },
 510         {
 511                 "only exit insn",
 512                 .insns = {
 513                         BPF_EXIT_INSN(),
 514                 },
 515                 .errstr = "R0 !read_ok",
 516                 .result = REJECT,
 517         },
 518         {
 519                 "unreachable",
 520                 .insns = {
 521                         BPF_EXIT_INSN(),
 522                         BPF_EXIT_INSN(),
 523                 },
 524                 .errstr = "unreachable",
 525                 .result = REJECT,
 526         },
 527         {
 528                 "unreachable2",
 529                 .insns = {
 530                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
 531                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
 532                         BPF_EXIT_INSN(),
 533                 },
 534                 .errstr = "unreachable",
 535                 .result = REJECT,
 536         },
 537         {
 538                 "out of range jump",
 539                 .insns = {
 540                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
 541                         BPF_EXIT_INSN(),
 542                 },
 543                 .errstr = "jump out of range",
 544                 .result = REJECT,
 545         },
 546         {
 547                 "out of range jump2",
 548                 .insns = {
 549                         BPF_JMP_IMM(BPF_JA, 0, 0, -2),
 550                         BPF_EXIT_INSN(),
 551                 },
 552                 .errstr = "jump out of range",
 553                 .result = REJECT,
 554         },
 555         {
 556                 "test1 ld_imm64",
 557                 .insns = {
 558                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 559                         BPF_LD_IMM64(BPF_REG_0, 0),
 560                         BPF_LD_IMM64(BPF_REG_0, 0),
 561                         BPF_LD_IMM64(BPF_REG_0, 1),
 562                         BPF_LD_IMM64(BPF_REG_0, 1),
 563                         BPF_MOV64_IMM(BPF_REG_0, 2),
 564                         BPF_EXIT_INSN(),
 565                 },
 566                 .errstr = "invalid BPF_LD_IMM insn",
 567                 .errstr_unpriv = "R1 pointer comparison",
 568                 .result = REJECT,
 569         },
 570         {
 571                 "test2 ld_imm64",
 572                 .insns = {
 573                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 574                         BPF_LD_IMM64(BPF_REG_0, 0),
 575                         BPF_LD_IMM64(BPF_REG_0, 0),
 576                         BPF_LD_IMM64(BPF_REG_0, 1),
 577                         BPF_LD_IMM64(BPF_REG_0, 1),
 578                         BPF_EXIT_INSN(),
 579                 },
 580                 .errstr = "invalid BPF_LD_IMM insn",
 581                 .errstr_unpriv = "R1 pointer comparison",
 582                 .result = REJECT,
 583         },
 584         {
 585                 "test3 ld_imm64",
 586                 .insns = {
 587                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 588                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 589                         BPF_LD_IMM64(BPF_REG_0, 0),
 590                         BPF_LD_IMM64(BPF_REG_0, 0),
 591                         BPF_LD_IMM64(BPF_REG_0, 1),
 592                         BPF_LD_IMM64(BPF_REG_0, 1),
 593                         BPF_EXIT_INSN(),
 594                 },
 595                 .errstr = "invalid bpf_ld_imm64 insn",
 596                 .result = REJECT,
 597         },
 598         {
 599                 "test4 ld_imm64",
 600                 .insns = {
 601                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 602                         BPF_EXIT_INSN(),
 603                 },
 604                 .errstr = "invalid bpf_ld_imm64 insn",
 605                 .result = REJECT,
 606         },
 607         {
 608                 "test5 ld_imm64",
 609                 .insns = {
 610                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 611                 },
 612                 .errstr = "invalid bpf_ld_imm64 insn",
 613                 .result = REJECT,
 614         },
 615         {
 616                 "test6 ld_imm64",
 617                 .insns = {
 618                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 619                         BPF_RAW_INSN(0, 0, 0, 0, 0),
 620                         BPF_EXIT_INSN(),
 621                 },
 622                 .result = ACCEPT,
 623         },
 624         {
 625                 "test7 ld_imm64",
 626                 .insns = {
 627                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 628                         BPF_RAW_INSN(0, 0, 0, 0, 1),
 629                         BPF_EXIT_INSN(),
 630                 },
 631                 .result = ACCEPT,
 632                 .retval = 1,
 633         },
 634         {
 635                 "test8 ld_imm64",
 636                 .insns = {
 637                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 1, 1),
 638                         BPF_RAW_INSN(0, 0, 0, 0, 1),
 639                         BPF_EXIT_INSN(),
 640                 },
 641                 .errstr = "uses reserved fields",
 642                 .result = REJECT,
 643         },
 644         {
 645                 "test9 ld_imm64",
 646                 .insns = {
 647                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 648                         BPF_RAW_INSN(0, 0, 0, 1, 1),
 649                         BPF_EXIT_INSN(),
 650                 },
 651                 .errstr = "invalid bpf_ld_imm64 insn",
 652                 .result = REJECT,
 653         },
 654         {
 655                 "test10 ld_imm64",
 656                 .insns = {
 657                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 658                         BPF_RAW_INSN(0, BPF_REG_1, 0, 0, 1),
 659                         BPF_EXIT_INSN(),
 660                 },
 661                 .errstr = "invalid bpf_ld_imm64 insn",
 662                 .result = REJECT,
 663         },
 664         {
 665                 "test11 ld_imm64",
 666                 .insns = {
 667                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 668                         BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
 669                         BPF_EXIT_INSN(),
 670                 },
 671                 .errstr = "invalid bpf_ld_imm64 insn",
 672                 .result = REJECT,
 673         },
 674         {
 675                 "test12 ld_imm64",
 676                 .insns = {
 677                         BPF_MOV64_IMM(BPF_REG_1, 0),
 678                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
 679                         BPF_RAW_INSN(0, 0, 0, 0, 1),
 680                         BPF_EXIT_INSN(),
 681                 },
 682                 .errstr = "not pointing to valid bpf_map",
 683                 .result = REJECT,
 684         },
 685         {
 686                 "test13 ld_imm64",
 687                 .insns = {
 688                         BPF_MOV64_IMM(BPF_REG_1, 0),
 689                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
 690                         BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
 691                         BPF_EXIT_INSN(),
 692                 },
 693                 .errstr = "invalid bpf_ld_imm64 insn",
 694                 .result = REJECT,
 695         },
 696         {
 697                 "arsh32 on imm",
 698                 .insns = {
 699                         BPF_MOV64_IMM(BPF_REG_0, 1),
 700                         BPF_ALU32_IMM(BPF_ARSH, BPF_REG_0, 5),
 701                         BPF_EXIT_INSN(),
 702                 },
 703                 .result = REJECT,
 704                 .errstr = "unknown opcode c4",
 705         },
 706         {
 707                 "arsh32 on reg",
 708                 .insns = {
 709                         BPF_MOV64_IMM(BPF_REG_0, 1),
 710                         BPF_MOV64_IMM(BPF_REG_1, 5),
 711                         BPF_ALU32_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),
 712                         BPF_EXIT_INSN(),
 713                 },
 714                 .result = REJECT,
 715                 .errstr = "unknown opcode cc",
 716         },
 717         {
 718                 "arsh64 on imm",
 719                 .insns = {
 720                         BPF_MOV64_IMM(BPF_REG_0, 1),
 721                         BPF_ALU64_IMM(BPF_ARSH, BPF_REG_0, 5),
 722                         BPF_EXIT_INSN(),
 723                 },
 724                 .result = ACCEPT,
 725         },
 726         {
 727                 "arsh64 on reg",
 728                 .insns = {
 729                         BPF_MOV64_IMM(BPF_REG_0, 1),
 730                         BPF_MOV64_IMM(BPF_REG_1, 5),
 731                         BPF_ALU64_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),
 732                         BPF_EXIT_INSN(),
 733                 },
 734                 .result = ACCEPT,
 735         },
 736         {
 737                 "no bpf_exit",
 738                 .insns = {
 739                         BPF_ALU64_REG(BPF_MOV, BPF_REG_0, BPF_REG_2),
 740                 },
 741                 .errstr = "not an exit",
 742                 .result = REJECT,
 743         },
 744         {
 745                 "loop (back-edge)",
 746                 .insns = {
 747                         BPF_JMP_IMM(BPF_JA, 0, 0, -1),
 748                         BPF_EXIT_INSN(),
 749                 },
 750                 .errstr = "back-edge",
 751                 .result = REJECT,
 752         },
 753         {
 754                 "loop2 (back-edge)",
 755                 .insns = {
 756                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
 757                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
 758                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
 759                         BPF_JMP_IMM(BPF_JA, 0, 0, -4),
 760                         BPF_EXIT_INSN(),
 761                 },
 762                 .errstr = "back-edge",
 763                 .result = REJECT,
 764         },
 765         {
 766                 "conditional loop",
 767                 .insns = {
 768                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
 769                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
 770                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
 771                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -3),
 772                         BPF_EXIT_INSN(),
 773                 },
 774                 .errstr = "back-edge",
 775                 .result = REJECT,
 776         },
 777         {
 778                 "read uninitialized register",
 779                 .insns = {
 780                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 781                         BPF_EXIT_INSN(),
 782                 },
 783                 .errstr = "R2 !read_ok",
 784                 .result = REJECT,
 785         },
 786         {
 787                 "read invalid register",
 788                 .insns = {
 789                         BPF_MOV64_REG(BPF_REG_0, -1),
 790                         BPF_EXIT_INSN(),
 791                 },
 792                 .errstr = "R15 is invalid",
 793                 .result = REJECT,
 794         },
 795         {
 796                 "program doesn't init R0 before exit",
 797                 .insns = {
 798                         BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_1),
 799                         BPF_EXIT_INSN(),
 800                 },
 801                 .errstr = "R0 !read_ok",
 802                 .result = REJECT,
 803         },
 804         {
 805                 "program doesn't init R0 before exit in all branches",
 806                 .insns = {
 807                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
 808                         BPF_MOV64_IMM(BPF_REG_0, 1),
 809                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
 810                         BPF_EXIT_INSN(),
 811                 },
 812                 .errstr = "R0 !read_ok",
 813                 .errstr_unpriv = "R1 pointer comparison",
 814                 .result = REJECT,
 815         },
 816         {
 817                 "stack out of bounds",
 818                 .insns = {
 819                         BPF_ST_MEM(BPF_DW, BPF_REG_10, 8, 0),
 820                         BPF_EXIT_INSN(),
 821                 },
 822                 .errstr = "invalid stack",
 823                 .result = REJECT,
 824         },
 825         {
 826                 "invalid call insn1",
 827                 .insns = {
 828                         BPF_RAW_INSN(BPF_JMP | BPF_CALL | BPF_X, 0, 0, 0, 0),
 829                         BPF_EXIT_INSN(),
 830                 },
 831                 .errstr = "unknown opcode 8d",
 832                 .result = REJECT,
 833         },
 834         {
 835                 "invalid call insn2",
 836                 .insns = {
 837                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 1, 0),
 838                         BPF_EXIT_INSN(),
 839                 },
 840                 .errstr = "BPF_CALL uses reserved",
 841                 .result = REJECT,
 842         },
 843         {
 844                 "invalid function call",
 845                 .insns = {
 846                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, 1234567),
 847                         BPF_EXIT_INSN(),
 848                 },
 849                 .errstr = "invalid func unknown#1234567",
 850                 .result = REJECT,
 851         },
 852         {
 853                 "uninitialized stack1",
 854                 .insns = {
 855                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 856                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 857                         BPF_LD_MAP_FD(BPF_REG_1, 0),
 858                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 859                                      BPF_FUNC_map_lookup_elem),
 860                         BPF_EXIT_INSN(),
 861                 },
 862                 .fixup_map1 = { 2 },
 863                 .errstr = "invalid indirect read from stack",
 864                 .result = REJECT,
 865         },
 866         {
 867                 "uninitialized stack2",
 868                 .insns = {
 869                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 870                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -8),
 871                         BPF_EXIT_INSN(),
 872                 },
 873                 .errstr = "invalid read from stack",
 874                 .result = REJECT,
 875         },
 876         {
 877                 "invalid fp arithmetic",
 878                 /* If this gets ever changed, make sure JITs can deal with it. */
 879                 .insns = {
 880                         BPF_MOV64_IMM(BPF_REG_0, 0),
 881                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
 882                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 8),
 883                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
 884                         BPF_EXIT_INSN(),
 885                 },
 886                 .errstr = "R1 subtraction from stack pointer",
 887                 .result = REJECT,
 888         },
 889         {
 890                 "non-invalid fp arithmetic",
 891                 .insns = {
 892                         BPF_MOV64_IMM(BPF_REG_0, 0),
 893                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
 894                         BPF_EXIT_INSN(),
 895                 },
 896                 .result = ACCEPT,
 897         },
 898         {
 899                 "invalid argument register",
 900                 .insns = {
 901                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 902                                      BPF_FUNC_get_cgroup_classid),
 903                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 904                                      BPF_FUNC_get_cgroup_classid),
 905                         BPF_EXIT_INSN(),
 906                 },
 907                 .errstr = "R1 !read_ok",
 908                 .result = REJECT,
 909                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 910         },
 911         {
 912                 "non-invalid argument register",
 913                 .insns = {
 914                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
 915                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 916                                      BPF_FUNC_get_cgroup_classid),
 917                         BPF_ALU64_REG(BPF_MOV, BPF_REG_1, BPF_REG_6),
 918                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 919                                      BPF_FUNC_get_cgroup_classid),
 920                         BPF_EXIT_INSN(),
 921                 },
 922                 .result = ACCEPT,
 923                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 924         },
 925         {
 926                 "check valid spill/fill",
 927                 .insns = {
 928                         /* spill R1(ctx) into stack */
 929                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
 930                         /* fill it back into R2 */
 931                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
 932                         /* should be able to access R0 = *(R2 + 8) */
 933                         /* BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 8), */
 934                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 935                         BPF_EXIT_INSN(),
 936                 },
 937                 .errstr_unpriv = "R0 leaks addr",
 938                 .result = ACCEPT,
 939                 .result_unpriv = REJECT,
 940                 .retval = POINTER_VALUE,
 941         },
 942         {
 943                 "check valid spill/fill, skb mark",
 944                 .insns = {
 945                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
 946                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
 947                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
 948                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
 949                                     offsetof(struct __sk_buff, mark)),
 950                         BPF_EXIT_INSN(),
 951                 },
 952                 .result = ACCEPT,
 953                 .result_unpriv = ACCEPT,
 954         },
 955         {
 956                 "check corrupted spill/fill",
 957                 .insns = {
 958                         /* spill R1(ctx) into stack */
 959                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
 960                         /* mess up with R1 pointer on stack */
 961                         BPF_ST_MEM(BPF_B, BPF_REG_10, -7, 0x23),
 962                         /* fill back into R0 should fail */
 963                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
 964                         BPF_EXIT_INSN(),
 965                 },
 966                 .errstr_unpriv = "attempt to corrupt spilled",
 967                 .errstr = "corrupted spill",
 968                 .result = REJECT,
 969         },
 970         {
 971                 "invalid src register in STX",
 972                 .insns = {
 973                         BPF_STX_MEM(BPF_B, BPF_REG_10, -1, -1),
 974                         BPF_EXIT_INSN(),
 975                 },
 976                 .errstr = "R15 is invalid",
 977                 .result = REJECT,
 978         },
 979         {
 980                 "invalid dst register in STX",
 981                 .insns = {
 982                         BPF_STX_MEM(BPF_B, 14, BPF_REG_10, -1),
 983                         BPF_EXIT_INSN(),
 984                 },
 985                 .errstr = "R14 is invalid",
 986                 .result = REJECT,
 987         },
 988         {
 989                 "invalid dst register in ST",
 990                 .insns = {
 991                         BPF_ST_MEM(BPF_B, 14, -1, -1),
 992                         BPF_EXIT_INSN(),
 993                 },
 994                 .errstr = "R14 is invalid",
 995                 .result = REJECT,
 996         },
 997         {
 998                 "invalid src register in LDX",
 999                 .insns = {
1000                         BPF_LDX_MEM(BPF_B, BPF_REG_0, 12, 0),
1001                         BPF_EXIT_INSN(),
1002                 },
1003                 .errstr = "R12 is invalid",
1004                 .result = REJECT,
1005         },
1006         {
1007                 "invalid dst register in LDX",
1008                 .insns = {
1009                         BPF_LDX_MEM(BPF_B, 11, BPF_REG_1, 0),
1010                         BPF_EXIT_INSN(),
1011                 },
1012                 .errstr = "R11 is invalid",
1013                 .result = REJECT,
1014         },
1015         {
1016                 "junk insn",
1017                 .insns = {
1018                         BPF_RAW_INSN(0, 0, 0, 0, 0),
1019                         BPF_EXIT_INSN(),
1020                 },
1021                 .errstr = "unknown opcode 00",
1022                 .result = REJECT,
1023         },
1024         {
1025                 "junk insn2",
1026                 .insns = {
1027                         BPF_RAW_INSN(1, 0, 0, 0, 0),
1028                         BPF_EXIT_INSN(),
1029                 },
1030                 .errstr = "BPF_LDX uses reserved fields",
1031                 .result = REJECT,
1032         },
1033         {
1034                 "junk insn3",
1035                 .insns = {
1036                         BPF_RAW_INSN(-1, 0, 0, 0, 0),
1037                         BPF_EXIT_INSN(),
1038                 },
1039                 .errstr = "unknown opcode ff",
1040                 .result = REJECT,
1041         },
1042         {
1043                 "junk insn4",
1044                 .insns = {
1045                         BPF_RAW_INSN(-1, -1, -1, -1, -1),
1046                         BPF_EXIT_INSN(),
1047                 },
1048                 .errstr = "unknown opcode ff",
1049                 .result = REJECT,
1050         },
1051         {
1052                 "junk insn5",
1053                 .insns = {
1054                         BPF_RAW_INSN(0x7f, -1, -1, -1, -1),
1055                         BPF_EXIT_INSN(),
1056                 },
1057                 .errstr = "BPF_ALU uses reserved fields",
1058                 .result = REJECT,
1059         },
1060         {
1061                 "misaligned read from stack",
1062                 .insns = {
1063                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1064                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -4),
1065                         BPF_EXIT_INSN(),
1066                 },
1067                 .errstr = "misaligned stack access",
1068                 .result = REJECT,
1069         },
1070         {
1071                 "invalid map_fd for function call",
1072                 .insns = {
1073                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1074                         BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_10),
1075                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1076                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1077                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1078                                      BPF_FUNC_map_delete_elem),
1079                         BPF_EXIT_INSN(),
1080                 },
1081                 .errstr = "fd 0 is not pointing to valid bpf_map",
1082                 .result = REJECT,
1083         },
1084         {
1085                 "don't check return value before access",
1086                 .insns = {
1087                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1088                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1089                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1090                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1091                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1092                                      BPF_FUNC_map_lookup_elem),
1093                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1094                         BPF_EXIT_INSN(),
1095                 },
1096                 .fixup_map1 = { 3 },
1097                 .errstr = "R0 invalid mem access 'map_value_or_null'",
1098                 .result = REJECT,
1099         },
1100         {
1101                 "access memory with incorrect alignment",
1102                 .insns = {
1103                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1104                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1105                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1106                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1107                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1108                                      BPF_FUNC_map_lookup_elem),
1109                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
1110                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 4, 0),
1111                         BPF_EXIT_INSN(),
1112                 },
1113                 .fixup_map1 = { 3 },
1114                 .errstr = "misaligned value access",
1115                 .result = REJECT,
1116                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1117         },
1118         {
1119                 "sometimes access memory with incorrect alignment",
1120                 .insns = {
1121                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1122                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1123                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1124                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1125                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1126                                      BPF_FUNC_map_lookup_elem),
1127                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
1128                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1129                         BPF_EXIT_INSN(),
1130                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 1),
1131                         BPF_EXIT_INSN(),
1132                 },
1133                 .fixup_map1 = { 3 },
1134                 .errstr = "R0 invalid mem access",
1135                 .errstr_unpriv = "R0 leaks addr",
1136                 .result = REJECT,
1137                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1138         },
1139         {
1140                 "jump test 1",
1141                 .insns = {
1142                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1143                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -8),
1144                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
1145                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
1146                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 1),
1147                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 1),
1148                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 1),
1149                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 2),
1150                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 1),
1151                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 3),
1152                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 1),
1153                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 4),
1154                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
1155                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 5),
1156                         BPF_MOV64_IMM(BPF_REG_0, 0),
1157                         BPF_EXIT_INSN(),
1158                 },
1159                 .errstr_unpriv = "R1 pointer comparison",
1160                 .result_unpriv = REJECT,
1161                 .result = ACCEPT,
1162         },
1163         {
1164                 "jump test 2",
1165                 .insns = {
1166                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1167                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
1168                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
1169                         BPF_JMP_IMM(BPF_JA, 0, 0, 14),
1170                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 2),
1171                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
1172                         BPF_JMP_IMM(BPF_JA, 0, 0, 11),
1173                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 2),
1174                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
1175                         BPF_JMP_IMM(BPF_JA, 0, 0, 8),
1176                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 2),
1177                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
1178                         BPF_JMP_IMM(BPF_JA, 0, 0, 5),
1179                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 2),
1180                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
1181                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1182                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
1183                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
1184                         BPF_MOV64_IMM(BPF_REG_0, 0),
1185                         BPF_EXIT_INSN(),
1186                 },
1187                 .errstr_unpriv = "R1 pointer comparison",
1188                 .result_unpriv = REJECT,
1189                 .result = ACCEPT,
1190         },
1191         {
1192                 "jump test 3",
1193                 .insns = {
1194                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1195                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
1196                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
1197                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1198                         BPF_JMP_IMM(BPF_JA, 0, 0, 19),
1199                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 3),
1200                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
1201                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1202                         BPF_JMP_IMM(BPF_JA, 0, 0, 15),
1203                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 3),
1204                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
1205                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -32),
1206                         BPF_JMP_IMM(BPF_JA, 0, 0, 11),
1207                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 3),
1208                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
1209                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -40),
1210                         BPF_JMP_IMM(BPF_JA, 0, 0, 7),
1211                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 3),
1212                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
1213                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -48),
1214                         BPF_JMP_IMM(BPF_JA, 0, 0, 3),
1215                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 0),
1216                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
1217                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -56),
1218                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1219                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1220                                      BPF_FUNC_map_delete_elem),
1221                         BPF_EXIT_INSN(),
1222                 },
1223                 .fixup_map1 = { 24 },
1224                 .errstr_unpriv = "R1 pointer comparison",
1225                 .result_unpriv = REJECT,
1226                 .result = ACCEPT,
1227                 .retval = -ENOENT,
1228         },
1229         {
1230                 "jump test 4",
1231                 .insns = {
1232                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1233                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1234                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1235                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1236                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1237                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1238                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1239                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1240                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1241                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1242                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1243                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1244                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1245                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1246                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1247                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1248                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1249                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1250                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1251                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1252                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1253                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1254                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1255                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1256                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1257                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1258                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1259                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1260                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1261                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1262                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1263                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1264                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1265                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1266                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1267                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1268                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1269                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1270                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1271                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1272                         BPF_MOV64_IMM(BPF_REG_0, 0),
1273                         BPF_EXIT_INSN(),
1274                 },
1275                 .errstr_unpriv = "R1 pointer comparison",
1276                 .result_unpriv = REJECT,
1277                 .result = ACCEPT,
1278         },
1279         {
1280                 "jump test 5",
1281                 .insns = {
1282                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1283                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
1284                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1285                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1286                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1287                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1288                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1289                         BPF_MOV64_IMM(BPF_REG_0, 0),
1290                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1291                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1292                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1293                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1294                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1295                         BPF_MOV64_IMM(BPF_REG_0, 0),
1296                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1297                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1298                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1299                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1300                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1301                         BPF_MOV64_IMM(BPF_REG_0, 0),
1302                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1303                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1304                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1305                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1306                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1307                         BPF_MOV64_IMM(BPF_REG_0, 0),
1308                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1309                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1310                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1311                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1312                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1313                         BPF_MOV64_IMM(BPF_REG_0, 0),
1314                         BPF_EXIT_INSN(),
1315                 },
1316                 .errstr_unpriv = "R1 pointer comparison",
1317                 .result_unpriv = REJECT,
1318                 .result = ACCEPT,
1319         },
1320         {
1321                 "access skb fields ok",
1322                 .insns = {
1323                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1324                                     offsetof(struct __sk_buff, len)),
1325                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1326                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1327                                     offsetof(struct __sk_buff, mark)),
1328                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1329                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1330                                     offsetof(struct __sk_buff, pkt_type)),
1331                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1332                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1333                                     offsetof(struct __sk_buff, queue_mapping)),
1334                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1335                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1336                                     offsetof(struct __sk_buff, protocol)),
1337                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1338                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1339                                     offsetof(struct __sk_buff, vlan_present)),
1340                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1341                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1342                                     offsetof(struct __sk_buff, vlan_tci)),
1343                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1344                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1345                                     offsetof(struct __sk_buff, napi_id)),
1346                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1347                         BPF_EXIT_INSN(),
1348                 },
1349                 .result = ACCEPT,
1350         },
1351         {
1352                 "access skb fields bad1",
1353                 .insns = {
1354                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -4),
1355                         BPF_EXIT_INSN(),
1356                 },
1357                 .errstr = "invalid bpf_context access",
1358                 .result = REJECT,
1359         },
1360         {
1361                 "access skb fields bad2",
1362                 .insns = {
1363                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 9),
1364                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1365                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1366                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1367                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1368                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1369                                      BPF_FUNC_map_lookup_elem),
1370                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
1371                         BPF_EXIT_INSN(),
1372                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
1373                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1374                                     offsetof(struct __sk_buff, pkt_type)),
1375                         BPF_EXIT_INSN(),
1376                 },
1377                 .fixup_map1 = { 4 },
1378                 .errstr = "different pointers",
1379                 .errstr_unpriv = "R1 pointer comparison",
1380                 .result = REJECT,
1381         },
1382         {
1383                 "access skb fields bad3",
1384                 .insns = {
1385                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1386                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1387                                     offsetof(struct __sk_buff, pkt_type)),
1388                         BPF_EXIT_INSN(),
1389                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1390                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1391                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1392                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1393                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1394                                      BPF_FUNC_map_lookup_elem),
1395                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
1396                         BPF_EXIT_INSN(),
1397                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
1398                         BPF_JMP_IMM(BPF_JA, 0, 0, -12),
1399                 },
1400                 .fixup_map1 = { 6 },
1401                 .errstr = "different pointers",
1402                 .errstr_unpriv = "R1 pointer comparison",
1403                 .result = REJECT,
1404         },
1405         {
1406                 "access skb fields bad4",
1407                 .insns = {
1408                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 3),
1409                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1410                                     offsetof(struct __sk_buff, len)),
1411                         BPF_MOV64_IMM(BPF_REG_0, 0),
1412                         BPF_EXIT_INSN(),
1413                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1414                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1415                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1416                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1417                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1418                                      BPF_FUNC_map_lookup_elem),
1419                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
1420                         BPF_EXIT_INSN(),
1421                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
1422                         BPF_JMP_IMM(BPF_JA, 0, 0, -13),
1423                 },
1424                 .fixup_map1 = { 7 },
1425                 .errstr = "different pointers",
1426                 .errstr_unpriv = "R1 pointer comparison",
1427                 .result = REJECT,
1428         },
1429         {
1430                 "invalid access __sk_buff family",
1431                 .insns = {
1432                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1433                                     offsetof(struct __sk_buff, family)),
1434                         BPF_EXIT_INSN(),
1435                 },
1436                 .errstr = "invalid bpf_context access",
1437                 .result = REJECT,
1438         },
1439         {
1440                 "invalid access __sk_buff remote_ip4",
1441                 .insns = {
1442                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1443                                     offsetof(struct __sk_buff, remote_ip4)),
1444                         BPF_EXIT_INSN(),
1445                 },
1446                 .errstr = "invalid bpf_context access",
1447                 .result = REJECT,
1448         },
1449         {
1450                 "invalid access __sk_buff local_ip4",
1451                 .insns = {
1452                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1453                                     offsetof(struct __sk_buff, local_ip4)),
1454                         BPF_EXIT_INSN(),
1455                 },
1456                 .errstr = "invalid bpf_context access",
1457                 .result = REJECT,
1458         },
1459         {
1460                 "invalid access __sk_buff remote_ip6",
1461                 .insns = {
1462                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1463                                     offsetof(struct __sk_buff, remote_ip6)),
1464                         BPF_EXIT_INSN(),
1465                 },
1466                 .errstr = "invalid bpf_context access",
1467                 .result = REJECT,
1468         },
1469         {
1470                 "invalid access __sk_buff local_ip6",
1471                 .insns = {
1472                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1473                                     offsetof(struct __sk_buff, local_ip6)),
1474                         BPF_EXIT_INSN(),
1475                 },
1476                 .errstr = "invalid bpf_context access",
1477                 .result = REJECT,
1478         },
1479         {
1480                 "invalid access __sk_buff remote_port",
1481                 .insns = {
1482                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1483                                     offsetof(struct __sk_buff, remote_port)),
1484                         BPF_EXIT_INSN(),
1485                 },
1486                 .errstr = "invalid bpf_context access",
1487                 .result = REJECT,
1488         },
1489         {
1490                 "invalid access __sk_buff remote_port",
1491                 .insns = {
1492                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1493                                     offsetof(struct __sk_buff, local_port)),
1494                         BPF_EXIT_INSN(),
1495                 },
1496                 .errstr = "invalid bpf_context access",
1497                 .result = REJECT,
1498         },
1499         {
1500                 "valid access __sk_buff family",
1501                 .insns = {
1502                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1503                                     offsetof(struct __sk_buff, family)),
1504                         BPF_EXIT_INSN(),
1505                 },
1506                 .result = ACCEPT,
1507                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1508         },
1509         {
1510                 "valid access __sk_buff remote_ip4",
1511                 .insns = {
1512                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1513                                     offsetof(struct __sk_buff, remote_ip4)),
1514                         BPF_EXIT_INSN(),
1515                 },
1516                 .result = ACCEPT,
1517                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1518         },
1519         {
1520                 "valid access __sk_buff local_ip4",
1521                 .insns = {
1522                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1523                                     offsetof(struct __sk_buff, local_ip4)),
1524                         BPF_EXIT_INSN(),
1525                 },
1526                 .result = ACCEPT,
1527                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1528         },
1529         {
1530                 "valid access __sk_buff remote_ip6",
1531                 .insns = {
1532                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1533                                     offsetof(struct __sk_buff, remote_ip6[0])),
1534                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1535                                     offsetof(struct __sk_buff, remote_ip6[1])),
1536                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1537                                     offsetof(struct __sk_buff, remote_ip6[2])),
1538                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1539                                     offsetof(struct __sk_buff, remote_ip6[3])),
1540                         BPF_EXIT_INSN(),
1541                 },
1542                 .result = ACCEPT,
1543                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1544         },
1545         {
1546                 "valid access __sk_buff local_ip6",
1547                 .insns = {
1548                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1549                                     offsetof(struct __sk_buff, local_ip6[0])),
1550                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1551                                     offsetof(struct __sk_buff, local_ip6[1])),
1552                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1553                                     offsetof(struct __sk_buff, local_ip6[2])),
1554                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1555                                     offsetof(struct __sk_buff, local_ip6[3])),
1556                         BPF_EXIT_INSN(),
1557                 },
1558                 .result = ACCEPT,
1559                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1560         },
1561         {
1562                 "valid access __sk_buff remote_port",
1563                 .insns = {
1564                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1565                                     offsetof(struct __sk_buff, remote_port)),
1566                         BPF_EXIT_INSN(),
1567                 },
1568                 .result = ACCEPT,
1569                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1570         },
1571         {
1572                 "valid access __sk_buff remote_port",
1573                 .insns = {
1574                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1575                                     offsetof(struct __sk_buff, local_port)),
1576                         BPF_EXIT_INSN(),
1577                 },
1578                 .result = ACCEPT,
1579                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1580         },
1581         {
1582                 "invalid access of tc_classid for SK_SKB",
1583                 .insns = {
1584                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1585                                     offsetof(struct __sk_buff, tc_classid)),
1586                         BPF_EXIT_INSN(),
1587                 },
1588                 .result = REJECT,
1589                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1590                 .errstr = "invalid bpf_context access",
1591         },
1592         {
1593                 "invalid access of skb->mark for SK_SKB",
1594                 .insns = {
1595                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1596                                     offsetof(struct __sk_buff, mark)),
1597                         BPF_EXIT_INSN(),
1598                 },
1599                 .result =  REJECT,
1600                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1601                 .errstr = "invalid bpf_context access",
1602         },
1603         {
1604                 "check skb->mark is not writeable by SK_SKB",
1605                 .insns = {
1606                         BPF_MOV64_IMM(BPF_REG_0, 0),
1607                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1608                                     offsetof(struct __sk_buff, mark)),
1609                         BPF_EXIT_INSN(),
1610                 },
1611                 .result =  REJECT,
1612                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1613                 .errstr = "invalid bpf_context access",
1614         },
1615         {
1616                 "check skb->tc_index is writeable by SK_SKB",
1617                 .insns = {
1618                         BPF_MOV64_IMM(BPF_REG_0, 0),
1619                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1620                                     offsetof(struct __sk_buff, tc_index)),
1621                         BPF_EXIT_INSN(),
1622                 },
1623                 .result = ACCEPT,
1624                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1625         },
1626         {
1627                 "check skb->priority is writeable by SK_SKB",
1628                 .insns = {
1629                         BPF_MOV64_IMM(BPF_REG_0, 0),
1630                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1631                                     offsetof(struct __sk_buff, priority)),
1632                         BPF_EXIT_INSN(),
1633                 },
1634                 .result = ACCEPT,
1635                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1636         },
1637         {
1638                 "direct packet read for SK_SKB",
1639                 .insns = {
1640                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1641                                     offsetof(struct __sk_buff, data)),
1642                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1643                                     offsetof(struct __sk_buff, data_end)),
1644                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1645                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1646                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1647                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
1648                         BPF_MOV64_IMM(BPF_REG_0, 0),
1649                         BPF_EXIT_INSN(),
1650                 },
1651                 .result = ACCEPT,
1652                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1653         },
1654         {
1655                 "direct packet write for SK_SKB",
1656                 .insns = {
1657                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1658                                     offsetof(struct __sk_buff, data)),
1659                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1660                                     offsetof(struct __sk_buff, data_end)),
1661                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1662                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1663                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1664                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
1665                         BPF_MOV64_IMM(BPF_REG_0, 0),
1666                         BPF_EXIT_INSN(),
1667                 },
1668                 .result = ACCEPT,
1669                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1670         },
1671         {
1672                 "overlapping checks for direct packet access SK_SKB",
1673                 .insns = {
1674                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1675                                     offsetof(struct __sk_buff, data)),
1676                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1677                                     offsetof(struct __sk_buff, data_end)),
1678                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1679                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1680                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
1681                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
1682                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
1683                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
1684                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
1685                         BPF_MOV64_IMM(BPF_REG_0, 0),
1686                         BPF_EXIT_INSN(),
1687                 },
1688                 .result = ACCEPT,
1689                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1690         },
1691         {
1692                 "valid access family in SK_MSG",
1693                 .insns = {
1694                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1695                                     offsetof(struct sk_msg_md, family)),
1696                         BPF_EXIT_INSN(),
1697                 },
1698                 .result = ACCEPT,
1699                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1700         },
1701         {
1702                 "valid access remote_ip4 in SK_MSG",
1703                 .insns = {
1704                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1705                                     offsetof(struct sk_msg_md, remote_ip4)),
1706                         BPF_EXIT_INSN(),
1707                 },
1708                 .result = ACCEPT,
1709                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1710         },
1711         {
1712                 "valid access local_ip4 in SK_MSG",
1713                 .insns = {
1714                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1715                                     offsetof(struct sk_msg_md, local_ip4)),
1716                         BPF_EXIT_INSN(),
1717                 },
1718                 .result = ACCEPT,
1719                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1720         },
1721         {
1722                 "valid access remote_port in SK_MSG",
1723                 .insns = {
1724                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1725                                     offsetof(struct sk_msg_md, remote_port)),
1726                         BPF_EXIT_INSN(),
1727                 },
1728                 .result = ACCEPT,
1729                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1730         },
1731         {
1732                 "valid access local_port in SK_MSG",
1733                 .insns = {
1734                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1735                                     offsetof(struct sk_msg_md, local_port)),
1736                         BPF_EXIT_INSN(),
1737                 },
1738                 .result = ACCEPT,
1739                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1740         },
1741         {
1742                 "valid access remote_ip6 in SK_MSG",
1743                 .insns = {
1744                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1745                                     offsetof(struct sk_msg_md, remote_ip6[0])),
1746                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1747                                     offsetof(struct sk_msg_md, remote_ip6[1])),
1748                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1749                                     offsetof(struct sk_msg_md, remote_ip6[2])),
1750                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1751                                     offsetof(struct sk_msg_md, remote_ip6[3])),
1752                         BPF_EXIT_INSN(),
1753                 },
1754                 .result = ACCEPT,
1755                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1756         },
1757         {
1758                 "valid access local_ip6 in SK_MSG",
1759                 .insns = {
1760                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1761                                     offsetof(struct sk_msg_md, local_ip6[0])),
1762                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1763                                     offsetof(struct sk_msg_md, local_ip6[1])),
1764                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1765                                     offsetof(struct sk_msg_md, local_ip6[2])),
1766                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1767                                     offsetof(struct sk_msg_md, local_ip6[3])),
1768                         BPF_EXIT_INSN(),
1769                 },
1770                 .result = ACCEPT,
1771                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1772         },
1773         {
1774                 "invalid 64B read of family in SK_MSG",
1775                 .insns = {
1776                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
1777                                     offsetof(struct sk_msg_md, family)),
1778                         BPF_EXIT_INSN(),
1779                 },
1780                 .errstr = "invalid bpf_context access",
1781                 .result = REJECT,
1782                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1783         },
1784         {
1785                 "invalid read past end of SK_MSG",
1786                 .insns = {
1787                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1788                                     offsetof(struct sk_msg_md, local_port) + 4),
1789                         BPF_EXIT_INSN(),
1790                 },
1791                 .errstr = "R0 !read_ok",
1792                 .result = REJECT,
1793                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1794         },
1795         {
1796                 "invalid read offset in SK_MSG",
1797                 .insns = {
1798                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1799                                     offsetof(struct sk_msg_md, family) + 1),
1800                         BPF_EXIT_INSN(),
1801                 },
1802                 .errstr = "invalid bpf_context access",
1803                 .result = REJECT,
1804                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1805         },
1806         {
1807                 "direct packet read for SK_MSG",
1808                 .insns = {
1809                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
1810                                     offsetof(struct sk_msg_md, data)),
1811                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
1812                                     offsetof(struct sk_msg_md, data_end)),
1813                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1814                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1815                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1816                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
1817                         BPF_MOV64_IMM(BPF_REG_0, 0),
1818                         BPF_EXIT_INSN(),
1819                 },
1820                 .result = ACCEPT,
1821                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1822         },
1823         {
1824                 "direct packet write for SK_MSG",
1825                 .insns = {
1826                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
1827                                     offsetof(struct sk_msg_md, data)),
1828                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
1829                                     offsetof(struct sk_msg_md, data_end)),
1830                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1831                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1832                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1833                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
1834                         BPF_MOV64_IMM(BPF_REG_0, 0),
1835                         BPF_EXIT_INSN(),
1836                 },
1837                 .result = ACCEPT,
1838                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1839         },
1840         {
1841                 "overlapping checks for direct packet access SK_MSG",
1842                 .insns = {
1843                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
1844                                     offsetof(struct sk_msg_md, data)),
1845                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
1846                                     offsetof(struct sk_msg_md, data_end)),
1847                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1848                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1849                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
1850                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
1851                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
1852                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
1853                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
1854                         BPF_MOV64_IMM(BPF_REG_0, 0),
1855                         BPF_EXIT_INSN(),
1856                 },
1857                 .result = ACCEPT,
1858                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1859         },
1860         {
1861                 "check skb->mark is not writeable by sockets",
1862                 .insns = {
1863                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1864                                     offsetof(struct __sk_buff, mark)),
1865                         BPF_EXIT_INSN(),
1866                 },
1867                 .errstr = "invalid bpf_context access",
1868                 .errstr_unpriv = "R1 leaks addr",
1869                 .result = REJECT,
1870         },
1871         {
1872                 "check skb->tc_index is not writeable by sockets",
1873                 .insns = {
1874                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1875                                     offsetof(struct __sk_buff, tc_index)),
1876                         BPF_EXIT_INSN(),
1877                 },
1878                 .errstr = "invalid bpf_context access",
1879                 .errstr_unpriv = "R1 leaks addr",
1880                 .result = REJECT,
1881         },
1882         {
1883                 "check cb access: byte",
1884                 .insns = {
1885                         BPF_MOV64_IMM(BPF_REG_0, 0),
1886                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1887                                     offsetof(struct __sk_buff, cb[0])),
1888                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1889                                     offsetof(struct __sk_buff, cb[0]) + 1),
1890                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1891                                     offsetof(struct __sk_buff, cb[0]) + 2),
1892                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1893                                     offsetof(struct __sk_buff, cb[0]) + 3),
1894                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1895                                     offsetof(struct __sk_buff, cb[1])),
1896                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1897                                     offsetof(struct __sk_buff, cb[1]) + 1),
1898                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1899                                     offsetof(struct __sk_buff, cb[1]) + 2),
1900                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1901                                     offsetof(struct __sk_buff, cb[1]) + 3),
1902                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1903                                     offsetof(struct __sk_buff, cb[2])),
1904                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1905                                     offsetof(struct __sk_buff, cb[2]) + 1),
1906                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1907                                     offsetof(struct __sk_buff, cb[2]) + 2),
1908                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1909                                     offsetof(struct __sk_buff, cb[2]) + 3),
1910                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1911                                     offsetof(struct __sk_buff, cb[3])),
1912                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1913                                     offsetof(struct __sk_buff, cb[3]) + 1),
1914                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1915                                     offsetof(struct __sk_buff, cb[3]) + 2),
1916                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1917                                     offsetof(struct __sk_buff, cb[3]) + 3),
1918                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1919                                     offsetof(struct __sk_buff, cb[4])),
1920                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1921                                     offsetof(struct __sk_buff, cb[4]) + 1),
1922                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1923                                     offsetof(struct __sk_buff, cb[4]) + 2),
1924                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1925                                     offsetof(struct __sk_buff, cb[4]) + 3),
1926                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1927                                     offsetof(struct __sk_buff, cb[0])),
1928                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1929                                     offsetof(struct __sk_buff, cb[0]) + 1),
1930                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1931                                     offsetof(struct __sk_buff, cb[0]) + 2),
1932                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1933                                     offsetof(struct __sk_buff, cb[0]) + 3),
1934                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1935                                     offsetof(struct __sk_buff, cb[1])),
1936                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1937                                     offsetof(struct __sk_buff, cb[1]) + 1),
1938                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1939                                     offsetof(struct __sk_buff, cb[1]) + 2),
1940                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1941                                     offsetof(struct __sk_buff, cb[1]) + 3),
1942                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1943                                     offsetof(struct __sk_buff, cb[2])),
1944                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1945                                     offsetof(struct __sk_buff, cb[2]) + 1),
1946                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1947                                     offsetof(struct __sk_buff, cb[2]) + 2),
1948                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1949                                     offsetof(struct __sk_buff, cb[2]) + 3),
1950                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1951                                     offsetof(struct __sk_buff, cb[3])),
1952                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1953                                     offsetof(struct __sk_buff, cb[3]) + 1),
1954                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1955                                     offsetof(struct __sk_buff, cb[3]) + 2),
1956                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1957                                     offsetof(struct __sk_buff, cb[3]) + 3),
1958                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1959                                     offsetof(struct __sk_buff, cb[4])),
1960                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1961                                     offsetof(struct __sk_buff, cb[4]) + 1),
1962                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1963                                     offsetof(struct __sk_buff, cb[4]) + 2),
1964                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1965                                     offsetof(struct __sk_buff, cb[4]) + 3),
1966                         BPF_EXIT_INSN(),
1967                 },
1968                 .result = ACCEPT,
1969         },
1970         {
1971                 "__sk_buff->hash, offset 0, byte store not permitted",
1972                 .insns = {
1973                         BPF_MOV64_IMM(BPF_REG_0, 0),
1974                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1975                                     offsetof(struct __sk_buff, hash)),
1976                         BPF_EXIT_INSN(),
1977                 },
1978                 .errstr = "invalid bpf_context access",
1979                 .result = REJECT,
1980         },
1981         {
1982                 "__sk_buff->tc_index, offset 3, byte store not permitted",
1983                 .insns = {
1984                         BPF_MOV64_IMM(BPF_REG_0, 0),
1985                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1986                                     offsetof(struct __sk_buff, tc_index) + 3),
1987                         BPF_EXIT_INSN(),
1988                 },
1989                 .errstr = "invalid bpf_context access",
1990                 .result = REJECT,
1991         },
1992         {
1993                 "check skb->hash byte load permitted",
1994                 .insns = {
1995                         BPF_MOV64_IMM(BPF_REG_0, 0),
1996 #if __BYTE_ORDER == __LITTLE_ENDIAN
1997                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1998                                     offsetof(struct __sk_buff, hash)),
1999 #else
2000                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
2001                                     offsetof(struct __sk_buff, hash) + 3),
2002 #endif
2003                         BPF_EXIT_INSN(),
2004                 },
2005                 .result = ACCEPT,
2006         },
2007         {
2008                 "check skb->hash byte load not permitted 1",
2009                 .insns = {
2010                         BPF_MOV64_IMM(BPF_REG_0, 0),
2011                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
2012                                     offsetof(struct __sk_buff, hash) + 1),
2013                         BPF_EXIT_INSN(),
2014                 },
2015                 .errstr = "invalid bpf_context access",
2016                 .result = REJECT,
2017         },
2018         {
2019                 "check skb->hash byte load not permitted 2",
2020                 .insns = {
2021                         BPF_MOV64_IMM(BPF_REG_0, 0),
2022                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
2023                                     offsetof(struct __sk_buff, hash) + 2),
2024                         BPF_EXIT_INSN(),
2025                 },
2026                 .errstr = "invalid bpf_context access",
2027                 .result = REJECT,
2028         },
2029         {
2030                 "check skb->hash byte load not permitted 3",
2031                 .insns = {
2032                         BPF_MOV64_IMM(BPF_REG_0, 0),
2033 #if __BYTE_ORDER == __LITTLE_ENDIAN
2034                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
2035                                     offsetof(struct __sk_buff, hash) + 3),
2036 #else
2037                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
2038                                     offsetof(struct __sk_buff, hash)),
2039 #endif
2040                         BPF_EXIT_INSN(),
2041                 },
2042                 .errstr = "invalid bpf_context access",
2043                 .result = REJECT,
2044         },
2045         {
2046                 "check cb access: byte, wrong type",
2047                 .insns = {
2048                         BPF_MOV64_IMM(BPF_REG_0, 0),
2049                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
2050                                     offsetof(struct __sk_buff, cb[0])),
2051                         BPF_EXIT_INSN(),
2052                 },
2053                 .errstr = "invalid bpf_context access",
2054                 .result = REJECT,
2055                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
2056         },
2057         {
2058                 "check cb access: half",
2059                 .insns = {
2060                         BPF_MOV64_IMM(BPF_REG_0, 0),
2061                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2062                                     offsetof(struct __sk_buff, cb[0])),
2063                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2064                                     offsetof(struct __sk_buff, cb[0]) + 2),
2065                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2066                                     offsetof(struct __sk_buff, cb[1])),
2067                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2068                                     offsetof(struct __sk_buff, cb[1]) + 2),
2069                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2070                                     offsetof(struct __sk_buff, cb[2])),
2071                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2072                                     offsetof(struct __sk_buff, cb[2]) + 2),
2073                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2074                                     offsetof(struct __sk_buff, cb[3])),
2075                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2076                                     offsetof(struct __sk_buff, cb[3]) + 2),
2077                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2078                                     offsetof(struct __sk_buff, cb[4])),
2079                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2080                                     offsetof(struct __sk_buff, cb[4]) + 2),
2081                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2082                                     offsetof(struct __sk_buff, cb[0])),
2083                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2084                                     offsetof(struct __sk_buff, cb[0]) + 2),
2085                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2086                                     offsetof(struct __sk_buff, cb[1])),
2087                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2088                                     offsetof(struct __sk_buff, cb[1]) + 2),
2089                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2090                                     offsetof(struct __sk_buff, cb[2])),
2091                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2092                                     offsetof(struct __sk_buff, cb[2]) + 2),
2093                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2094                                     offsetof(struct __sk_buff, cb[3])),
2095                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2096                                     offsetof(struct __sk_buff, cb[3]) + 2),
2097                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2098                                     offsetof(struct __sk_buff, cb[4])),
2099                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2100                                     offsetof(struct __sk_buff, cb[4]) + 2),
2101                         BPF_EXIT_INSN(),
2102                 },
2103                 .result = ACCEPT,
2104         },
2105         {
2106                 "check cb access: half, unaligned",
2107                 .insns = {
2108                         BPF_MOV64_IMM(BPF_REG_0, 0),
2109                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2110                                     offsetof(struct __sk_buff, cb[0]) + 1),
2111                         BPF_EXIT_INSN(),
2112                 },
2113                 .errstr = "misaligned context access",
2114                 .result = REJECT,
2115                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2116         },
2117         {
2118                 "check __sk_buff->hash, offset 0, half store not permitted",
2119                 .insns = {
2120                         BPF_MOV64_IMM(BPF_REG_0, 0),
2121                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2122                                     offsetof(struct __sk_buff, hash)),
2123                         BPF_EXIT_INSN(),
2124                 },
2125                 .errstr = "invalid bpf_context access",
2126                 .result = REJECT,
2127         },
2128         {
2129                 "check __sk_buff->tc_index, offset 2, half store not permitted",
2130                 .insns = {
2131                         BPF_MOV64_IMM(BPF_REG_0, 0),
2132                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2133                                     offsetof(struct __sk_buff, tc_index) + 2),
2134                         BPF_EXIT_INSN(),
2135                 },
2136                 .errstr = "invalid bpf_context access",
2137                 .result = REJECT,
2138         },
2139         {
2140                 "check skb->hash half load permitted",
2141                 .insns = {
2142                         BPF_MOV64_IMM(BPF_REG_0, 0),
2143 #if __BYTE_ORDER == __LITTLE_ENDIAN
2144                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2145                                     offsetof(struct __sk_buff, hash)),
2146 #else
2147                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2148                                     offsetof(struct __sk_buff, hash) + 2),
2149 #endif
2150                         BPF_EXIT_INSN(),
2151                 },
2152                 .result = ACCEPT,
2153         },
2154         {
2155                 "check skb->hash half load not permitted",
2156                 .insns = {
2157                         BPF_MOV64_IMM(BPF_REG_0, 0),
2158 #if __BYTE_ORDER == __LITTLE_ENDIAN
2159                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2160                                     offsetof(struct __sk_buff, hash) + 2),
2161 #else
2162                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2163                                     offsetof(struct __sk_buff, hash)),
2164 #endif
2165                         BPF_EXIT_INSN(),
2166                 },
2167                 .errstr = "invalid bpf_context access",
2168                 .result = REJECT,
2169         },
2170         {
2171                 "check cb access: half, wrong type",
2172                 .insns = {
2173                         BPF_MOV64_IMM(BPF_REG_0, 0),
2174                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2175                                     offsetof(struct __sk_buff, cb[0])),
2176                         BPF_EXIT_INSN(),
2177                 },
2178                 .errstr = "invalid bpf_context access",
2179                 .result = REJECT,
2180                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
2181         },
2182         {
2183                 "check cb access: word",
2184                 .insns = {
2185                         BPF_MOV64_IMM(BPF_REG_0, 0),
2186                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2187                                     offsetof(struct __sk_buff, cb[0])),
2188                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2189                                     offsetof(struct __sk_buff, cb[1])),
2190                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2191                                     offsetof(struct __sk_buff, cb[2])),
2192                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2193                                     offsetof(struct __sk_buff, cb[3])),
2194                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2195                                     offsetof(struct __sk_buff, cb[4])),
2196                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2197                                     offsetof(struct __sk_buff, cb[0])),
2198                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2199                                     offsetof(struct __sk_buff, cb[1])),
2200                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2201                                     offsetof(struct __sk_buff, cb[2])),
2202                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2203                                     offsetof(struct __sk_buff, cb[3])),
2204                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2205                                     offsetof(struct __sk_buff, cb[4])),
2206                         BPF_EXIT_INSN(),
2207                 },
2208                 .result = ACCEPT,
2209         },
2210         {
2211                 "check cb access: word, unaligned 1",
2212                 .insns = {
2213                         BPF_MOV64_IMM(BPF_REG_0, 0),
2214                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2215                                     offsetof(struct __sk_buff, cb[0]) + 2),
2216                         BPF_EXIT_INSN(),
2217                 },
2218                 .errstr = "misaligned context access",
2219                 .result = REJECT,
2220                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2221         },
2222         {
2223                 "check cb access: word, unaligned 2",
2224                 .insns = {
2225                         BPF_MOV64_IMM(BPF_REG_0, 0),
2226                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2227                                     offsetof(struct __sk_buff, cb[4]) + 1),
2228                         BPF_EXIT_INSN(),
2229                 },
2230                 .errstr = "misaligned context access",
2231                 .result = REJECT,
2232                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2233         },
2234         {
2235                 "check cb access: word, unaligned 3",
2236                 .insns = {
2237                         BPF_MOV64_IMM(BPF_REG_0, 0),
2238                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2239                                     offsetof(struct __sk_buff, cb[4]) + 2),
2240                         BPF_EXIT_INSN(),
2241                 },
2242                 .errstr = "misaligned context access",
2243                 .result = REJECT,
2244                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2245         },
2246         {
2247                 "check cb access: word, unaligned 4",
2248                 .insns = {
2249                         BPF_MOV64_IMM(BPF_REG_0, 0),
2250                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2251                                     offsetof(struct __sk_buff, cb[4]) + 3),
2252                         BPF_EXIT_INSN(),
2253                 },
2254                 .errstr = "misaligned context access",
2255                 .result = REJECT,
2256                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2257         },
2258         {
2259                 "check cb access: double",
2260                 .insns = {
2261                         BPF_MOV64_IMM(BPF_REG_0, 0),
2262                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2263                                     offsetof(struct __sk_buff, cb[0])),
2264                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2265                                     offsetof(struct __sk_buff, cb[2])),
2266                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2267                                     offsetof(struct __sk_buff, cb[0])),
2268                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2269                                     offsetof(struct __sk_buff, cb[2])),
2270                         BPF_EXIT_INSN(),
2271                 },
2272                 .result = ACCEPT,
2273         },
2274         {
2275                 "check cb access: double, unaligned 1",
2276                 .insns = {
2277                         BPF_MOV64_IMM(BPF_REG_0, 0),
2278                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2279                                     offsetof(struct __sk_buff, cb[1])),
2280                         BPF_EXIT_INSN(),
2281                 },
2282                 .errstr = "misaligned context access",
2283                 .result = REJECT,
2284                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2285         },
2286         {
2287                 "check cb access: double, unaligned 2",
2288                 .insns = {
2289                         BPF_MOV64_IMM(BPF_REG_0, 0),
2290                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2291                                     offsetof(struct __sk_buff, cb[3])),
2292                         BPF_EXIT_INSN(),
2293                 },
2294                 .errstr = "misaligned context access",
2295                 .result = REJECT,
2296                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2297         },
2298         {
2299                 "check cb access: double, oob 1",
2300                 .insns = {
2301                         BPF_MOV64_IMM(BPF_REG_0, 0),
2302                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2303                                     offsetof(struct __sk_buff, cb[4])),
2304                         BPF_EXIT_INSN(),
2305                 },
2306                 .errstr = "invalid bpf_context access",
2307                 .result = REJECT,
2308         },
2309         {
2310                 "check cb access: double, oob 2",
2311                 .insns = {
2312                         BPF_MOV64_IMM(BPF_REG_0, 0),
2313                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2314                                     offsetof(struct __sk_buff, cb[4])),
2315                         BPF_EXIT_INSN(),
2316                 },
2317                 .errstr = "invalid bpf_context access",
2318                 .result = REJECT,
2319         },
2320         {
2321                 "check __sk_buff->ifindex dw store not permitted",
2322                 .insns = {
2323                         BPF_MOV64_IMM(BPF_REG_0, 0),
2324                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2325                                     offsetof(struct __sk_buff, ifindex)),
2326                         BPF_EXIT_INSN(),
2327                 },
2328                 .errstr = "invalid bpf_context access",
2329                 .result = REJECT,
2330         },
2331         {
2332                 "check __sk_buff->ifindex dw load not permitted",
2333                 .insns = {
2334                         BPF_MOV64_IMM(BPF_REG_0, 0),
2335                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2336                                     offsetof(struct __sk_buff, ifindex)),
2337                         BPF_EXIT_INSN(),
2338                 },
2339                 .errstr = "invalid bpf_context access",
2340                 .result = REJECT,
2341         },
2342         {
2343                 "check cb access: double, wrong type",
2344                 .insns = {
2345                         BPF_MOV64_IMM(BPF_REG_0, 0),
2346                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2347                                     offsetof(struct __sk_buff, cb[0])),
2348                         BPF_EXIT_INSN(),
2349                 },
2350                 .errstr = "invalid bpf_context access",
2351                 .result = REJECT,
2352                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
2353         },
2354         {
2355                 "check out of range skb->cb access",
2356                 .insns = {
2357                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2358                                     offsetof(struct __sk_buff, cb[0]) + 256),
2359                         BPF_EXIT_INSN(),
2360                 },
2361                 .errstr = "invalid bpf_context access",
2362                 .errstr_unpriv = "",
2363                 .result = REJECT,
2364                 .prog_type = BPF_PROG_TYPE_SCHED_ACT,
2365         },
2366         {
2367                 "write skb fields from socket prog",
2368                 .insns = {
2369                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2370                                     offsetof(struct __sk_buff, cb[4])),
2371                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
2372                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2373                                     offsetof(struct __sk_buff, mark)),
2374                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2375                                     offsetof(struct __sk_buff, tc_index)),
2376                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
2377                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
2378                                     offsetof(struct __sk_buff, cb[0])),
2379                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
2380                                     offsetof(struct __sk_buff, cb[2])),
2381                         BPF_EXIT_INSN(),
2382                 },
2383                 .result = ACCEPT,
2384                 .errstr_unpriv = "R1 leaks addr",
2385                 .result_unpriv = REJECT,
2386         },
2387         {
2388                 "write skb fields from tc_cls_act prog",
2389                 .insns = {
2390                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2391                                     offsetof(struct __sk_buff, cb[0])),
2392                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2393                                     offsetof(struct __sk_buff, mark)),
2394                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2395                                     offsetof(struct __sk_buff, tc_index)),
2396                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2397                                     offsetof(struct __sk_buff, tc_index)),
2398                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2399                                     offsetof(struct __sk_buff, cb[3])),
2400                         BPF_EXIT_INSN(),
2401                 },
2402                 .errstr_unpriv = "",
2403                 .result_unpriv = REJECT,
2404                 .result = ACCEPT,
2405                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2406         },
2407         {
2408                 "PTR_TO_STACK store/load",
2409                 .insns = {
2410                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2411                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
2412                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
2413                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
2414                         BPF_EXIT_INSN(),
2415                 },
2416                 .result = ACCEPT,
2417                 .retval = 0xfaceb00c,
2418         },
2419         {
2420                 "PTR_TO_STACK store/load - bad alignment on off",
2421                 .insns = {
2422                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2423                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
2424                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
2425                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
2426                         BPF_EXIT_INSN(),
2427                 },
2428                 .result = REJECT,
2429                 .errstr = "misaligned stack access off (0x0; 0x0)+-8+2 size 8",
2430         },
2431         {
2432                 "PTR_TO_STACK store/load - bad alignment on reg",
2433                 .insns = {
2434                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2435                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
2436                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
2437                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
2438                         BPF_EXIT_INSN(),
2439                 },
2440                 .result = REJECT,
2441                 .errstr = "misaligned stack access off (0x0; 0x0)+-10+8 size 8",
2442         },
2443         {
2444                 "PTR_TO_STACK store/load - out of bounds low",
2445                 .insns = {
2446                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2447                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -80000),
2448                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
2449                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
2450                         BPF_EXIT_INSN(),
2451                 },
2452                 .result = REJECT,
2453                 .errstr = "invalid stack off=-79992 size=8",
2454         },
2455         {
2456                 "PTR_TO_STACK store/load - out of bounds high",
2457                 .insns = {
2458                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2459                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
2460                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
2461                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
2462                         BPF_EXIT_INSN(),
2463                 },
2464                 .result = REJECT,
2465                 .errstr = "invalid stack off=0 size=8",
2466         },
2467         {
2468                 "unpriv: return pointer",
2469                 .insns = {
2470                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
2471                         BPF_EXIT_INSN(),
2472                 },
2473                 .result = ACCEPT,
2474                 .result_unpriv = REJECT,
2475                 .errstr_unpriv = "R0 leaks addr",
2476                 .retval = POINTER_VALUE,
2477         },
2478         {
2479                 "unpriv: add const to pointer",
2480                 .insns = {
2481                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
2482                         BPF_MOV64_IMM(BPF_REG_0, 0),
2483                         BPF_EXIT_INSN(),
2484                 },
2485                 .result = ACCEPT,
2486         },
2487         {
2488                 "unpriv: add pointer to pointer",
2489                 .insns = {
2490                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
2491                         BPF_MOV64_IMM(BPF_REG_0, 0),
2492                         BPF_EXIT_INSN(),
2493                 },
2494                 .result = REJECT,
2495                 .errstr = "R1 pointer += pointer",
2496         },
2497         {
2498                 "unpriv: neg pointer",
2499                 .insns = {
2500                         BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0),
2501                         BPF_MOV64_IMM(BPF_REG_0, 0),
2502                         BPF_EXIT_INSN(),
2503                 },
2504                 .result = ACCEPT,
2505                 .result_unpriv = REJECT,
2506                 .errstr_unpriv = "R1 pointer arithmetic",
2507         },
2508         {
2509                 "unpriv: cmp pointer with const",
2510                 .insns = {
2511                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
2512                         BPF_MOV64_IMM(BPF_REG_0, 0),
2513                         BPF_EXIT_INSN(),
2514                 },
2515                 .result = ACCEPT,
2516                 .result_unpriv = REJECT,
2517                 .errstr_unpriv = "R1 pointer comparison",
2518         },
2519         {
2520                 "unpriv: cmp pointer with pointer",
2521                 .insns = {
2522                         BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
2523                         BPF_MOV64_IMM(BPF_REG_0, 0),
2524                         BPF_EXIT_INSN(),
2525                 },
2526                 .result = ACCEPT,
2527                 .result_unpriv = REJECT,
2528                 .errstr_unpriv = "R10 pointer comparison",
2529         },
2530         {
2531                 "unpriv: check that printk is disallowed",
2532                 .insns = {
2533                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2534                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2535                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
2536                         BPF_MOV64_IMM(BPF_REG_2, 8),
2537                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
2538                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2539                                      BPF_FUNC_trace_printk),
2540                         BPF_MOV64_IMM(BPF_REG_0, 0),
2541                         BPF_EXIT_INSN(),
2542                 },
2543                 .errstr_unpriv = "unknown func bpf_trace_printk#6",
2544                 .result_unpriv = REJECT,
2545                 .result = ACCEPT,
2546         },
2547         {
2548                 "unpriv: pass pointer to helper function",
2549                 .insns = {
2550                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2551                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2552                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2553                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2554                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
2555                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2556                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2557                                      BPF_FUNC_map_update_elem),
2558                         BPF_MOV64_IMM(BPF_REG_0, 0),
2559                         BPF_EXIT_INSN(),
2560                 },
2561                 .fixup_map1 = { 3 },
2562                 .errstr_unpriv = "R4 leaks addr",
2563                 .result_unpriv = REJECT,
2564                 .result = ACCEPT,
2565         },
2566         {
2567                 "unpriv: indirectly pass pointer on stack to helper function",
2568                 .insns = {
2569                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2570                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2571                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2572                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2573                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2574                                      BPF_FUNC_map_lookup_elem),
2575                         BPF_MOV64_IMM(BPF_REG_0, 0),
2576                         BPF_EXIT_INSN(),
2577                 },
2578                 .fixup_map1 = { 3 },
2579                 .errstr = "invalid indirect read from stack off -8+0 size 8",
2580                 .result = REJECT,
2581         },
2582         {
2583                 "unpriv: mangle pointer on stack 1",
2584                 .insns = {
2585                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2586                         BPF_ST_MEM(BPF_W, BPF_REG_10, -8, 0),
2587                         BPF_MOV64_IMM(BPF_REG_0, 0),
2588                         BPF_EXIT_INSN(),
2589                 },
2590                 .errstr_unpriv = "attempt to corrupt spilled",
2591                 .result_unpriv = REJECT,
2592                 .result = ACCEPT,
2593         },
2594         {
2595                 "unpriv: mangle pointer on stack 2",
2596                 .insns = {
2597                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2598                         BPF_ST_MEM(BPF_B, BPF_REG_10, -1, 0),
2599                         BPF_MOV64_IMM(BPF_REG_0, 0),
2600                         BPF_EXIT_INSN(),
2601                 },
2602                 .errstr_unpriv = "attempt to corrupt spilled",
2603                 .result_unpriv = REJECT,
2604                 .result = ACCEPT,
2605         },
2606         {
2607                 "unpriv: read pointer from stack in small chunks",
2608                 .insns = {
2609                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2610                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -8),
2611                         BPF_MOV64_IMM(BPF_REG_0, 0),
2612                         BPF_EXIT_INSN(),
2613                 },
2614                 .errstr = "invalid size",
2615                 .result = REJECT,
2616         },
2617         {
2618                 "unpriv: write pointer into ctx",
2619                 .insns = {
2620                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
2621                         BPF_MOV64_IMM(BPF_REG_0, 0),
2622                         BPF_EXIT_INSN(),
2623                 },
2624                 .errstr_unpriv = "R1 leaks addr",
2625                 .result_unpriv = REJECT,
2626                 .errstr = "invalid bpf_context access",
2627                 .result = REJECT,
2628         },
2629         {
2630                 "unpriv: spill/fill of ctx",
2631                 .insns = {
2632                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2633                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2634                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2635                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2636                         BPF_MOV64_IMM(BPF_REG_0, 0),
2637                         BPF_EXIT_INSN(),
2638                 },
2639                 .result = ACCEPT,
2640         },
2641         {
2642                 "unpriv: spill/fill of ctx 2",
2643                 .insns = {
2644                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2645                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2646                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2647                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2648                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2649                                      BPF_FUNC_get_hash_recalc),
2650                         BPF_MOV64_IMM(BPF_REG_0, 0),
2651                         BPF_EXIT_INSN(),
2652                 },
2653                 .result = ACCEPT,
2654                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2655         },
2656         {
2657                 "unpriv: spill/fill of ctx 3",
2658                 .insns = {
2659                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2660                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2661                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2662                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
2663                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2664                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2665                                      BPF_FUNC_get_hash_recalc),
2666                         BPF_EXIT_INSN(),
2667                 },
2668                 .result = REJECT,
2669                 .errstr = "R1 type=fp expected=ctx",
2670                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2671         },
2672         {
2673                 "unpriv: spill/fill of ctx 4",
2674                 .insns = {
2675                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2676                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2677                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2678                         BPF_MOV64_IMM(BPF_REG_0, 1),
2679                         BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_10,
2680                                      BPF_REG_0, -8, 0),
2681                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2682                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2683                                      BPF_FUNC_get_hash_recalc),
2684                         BPF_EXIT_INSN(),
2685                 },
2686                 .result = REJECT,
2687                 .errstr = "R1 type=inv expected=ctx",
2688                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2689         },
2690         {
2691                 "unpriv: spill/fill of different pointers stx",
2692                 .insns = {
2693                         BPF_MOV64_IMM(BPF_REG_3, 42),
2694                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2695                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2696                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
2697                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2698                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
2699                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
2700                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
2701                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2702                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2703                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
2704                                     offsetof(struct __sk_buff, mark)),
2705                         BPF_MOV64_IMM(BPF_REG_0, 0),
2706                         BPF_EXIT_INSN(),
2707                 },
2708                 .result = REJECT,
2709                 .errstr = "same insn cannot be used with different pointers",
2710                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2711         },
2712         {
2713                 "unpriv: spill/fill of different pointers ldx",
2714                 .insns = {
2715                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2716                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2717                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
2718                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2719                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
2720                                       -(__s32)offsetof(struct bpf_perf_event_data,
2721                                                        sample_period) - 8),
2722                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
2723                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
2724                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2725                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2726                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1,
2727                                     offsetof(struct bpf_perf_event_data,
2728                                              sample_period)),
2729                         BPF_MOV64_IMM(BPF_REG_0, 0),
2730                         BPF_EXIT_INSN(),
2731                 },
2732                 .result = REJECT,
2733                 .errstr = "same insn cannot be used with different pointers",
2734                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
2735         },
2736         {
2737                 "unpriv: write pointer into map elem value",
2738                 .insns = {
2739                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2740                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2741                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2742                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2743                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2744                                      BPF_FUNC_map_lookup_elem),
2745                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
2746                         BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
2747                         BPF_EXIT_INSN(),
2748                 },
2749                 .fixup_map1 = { 3 },
2750                 .errstr_unpriv = "R0 leaks addr",
2751                 .result_unpriv = REJECT,
2752                 .result = ACCEPT,
2753         },
2754         {
2755                 "unpriv: partial copy of pointer",
2756                 .insns = {
2757                         BPF_MOV32_REG(BPF_REG_1, BPF_REG_10),
2758                         BPF_MOV64_IMM(BPF_REG_0, 0),
2759                         BPF_EXIT_INSN(),
2760                 },
2761                 .errstr_unpriv = "R10 partial copy",
2762                 .result_unpriv = REJECT,
2763                 .result = ACCEPT,
2764         },
2765         {
2766                 "unpriv: pass pointer to tail_call",
2767                 .insns = {
2768                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
2769                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2770                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2771                                      BPF_FUNC_tail_call),
2772                         BPF_MOV64_IMM(BPF_REG_0, 0),
2773                         BPF_EXIT_INSN(),
2774                 },
2775                 .fixup_prog1 = { 1 },
2776                 .errstr_unpriv = "R3 leaks addr into helper",
2777                 .result_unpriv = REJECT,
2778                 .result = ACCEPT,
2779         },
2780         {
2781                 "unpriv: cmp map pointer with zero",
2782                 .insns = {
2783                         BPF_MOV64_IMM(BPF_REG_1, 0),
2784                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2785                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
2786                         BPF_MOV64_IMM(BPF_REG_0, 0),
2787                         BPF_EXIT_INSN(),
2788                 },
2789                 .fixup_map1 = { 1 },
2790                 .errstr_unpriv = "R1 pointer comparison",
2791                 .result_unpriv = REJECT,
2792                 .result = ACCEPT,
2793         },
2794         {
2795                 "unpriv: write into frame pointer",
2796                 .insns = {
2797                         BPF_MOV64_REG(BPF_REG_10, BPF_REG_1),
2798                         BPF_MOV64_IMM(BPF_REG_0, 0),
2799                         BPF_EXIT_INSN(),
2800                 },
2801                 .errstr = "frame pointer is read only",
2802                 .result = REJECT,
2803         },
2804         {
2805                 "unpriv: spill/fill frame pointer",
2806                 .insns = {
2807                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2808                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2809                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
2810                         BPF_LDX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, 0),
2811                         BPF_MOV64_IMM(BPF_REG_0, 0),
2812                         BPF_EXIT_INSN(),
2813                 },
2814                 .errstr = "frame pointer is read only",
2815                 .result = REJECT,
2816         },
2817         {
2818                 "unpriv: cmp of frame pointer",
2819                 .insns = {
2820                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_10, 0, 0),
2821                         BPF_MOV64_IMM(BPF_REG_0, 0),
2822                         BPF_EXIT_INSN(),
2823                 },
2824                 .errstr_unpriv = "R10 pointer comparison",
2825                 .result_unpriv = REJECT,
2826                 .result = ACCEPT,
2827         },
2828         {
2829                 "unpriv: adding of fp",
2830                 .insns = {
2831                         BPF_MOV64_IMM(BPF_REG_0, 0),
2832                         BPF_MOV64_IMM(BPF_REG_1, 0),
2833                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
2834                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, -8),
2835                         BPF_EXIT_INSN(),
2836                 },
2837                 .result = ACCEPT,
2838         },
2839         {
2840                 "unpriv: cmp of stack pointer",
2841                 .insns = {
2842                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2843                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2844                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_2, 0, 0),
2845                         BPF_MOV64_IMM(BPF_REG_0, 0),
2846                         BPF_EXIT_INSN(),
2847                 },
2848                 .errstr_unpriv = "R2 pointer comparison",
2849                 .result_unpriv = REJECT,
2850                 .result = ACCEPT,
2851         },
2852         {
2853                 "runtime/jit: tail_call within bounds, prog once",
2854                 .insns = {
2855                         BPF_MOV64_IMM(BPF_REG_3, 0),
2856                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2857                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2858                                      BPF_FUNC_tail_call),
2859                         BPF_MOV64_IMM(BPF_REG_0, 1),
2860                         BPF_EXIT_INSN(),
2861                 },
2862                 .fixup_prog1 = { 1 },
2863                 .result = ACCEPT,
2864                 .retval = 42,
2865         },
2866         {
2867                 "runtime/jit: tail_call within bounds, prog loop",
2868                 .insns = {
2869                         BPF_MOV64_IMM(BPF_REG_3, 1),
2870                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2871                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2872                                      BPF_FUNC_tail_call),
2873                         BPF_MOV64_IMM(BPF_REG_0, 1),
2874                         BPF_EXIT_INSN(),
2875                 },
2876                 .fixup_prog1 = { 1 },
2877                 .result = ACCEPT,
2878                 .retval = 41,
2879         },
2880         {
2881                 "runtime/jit: tail_call within bounds, no prog",
2882                 .insns = {
2883                         BPF_MOV64_IMM(BPF_REG_3, 2),
2884                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2885                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2886                                      BPF_FUNC_tail_call),
2887                         BPF_MOV64_IMM(BPF_REG_0, 1),
2888                         BPF_EXIT_INSN(),
2889                 },
2890                 .fixup_prog1 = { 1 },
2891                 .result = ACCEPT,
2892                 .retval = 1,
2893         },
2894         {
2895                 "runtime/jit: tail_call out of bounds",
2896                 .insns = {
2897                         BPF_MOV64_IMM(BPF_REG_3, 256),
2898                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2899                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2900                                      BPF_FUNC_tail_call),
2901                         BPF_MOV64_IMM(BPF_REG_0, 2),
2902                         BPF_EXIT_INSN(),
2903                 },
2904                 .fixup_prog1 = { 1 },
2905                 .result = ACCEPT,
2906                 .retval = 2,
2907         },
2908         {
2909                 "runtime/jit: pass negative index to tail_call",
2910                 .insns = {
2911                         BPF_MOV64_IMM(BPF_REG_3, -1),
2912                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2913                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2914                                      BPF_FUNC_tail_call),
2915                         BPF_MOV64_IMM(BPF_REG_0, 2),
2916                         BPF_EXIT_INSN(),
2917                 },
2918                 .fixup_prog1 = { 1 },
2919                 .result = ACCEPT,
2920                 .retval = 2,
2921         },
2922         {
2923                 "runtime/jit: pass > 32bit index to tail_call",
2924                 .insns = {
2925                         BPF_LD_IMM64(BPF_REG_3, 0x100000000ULL),
2926                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2927                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2928                                      BPF_FUNC_tail_call),
2929                         BPF_MOV64_IMM(BPF_REG_0, 2),
2930                         BPF_EXIT_INSN(),
2931                 },
2932                 .fixup_prog1 = { 2 },
2933                 .result = ACCEPT,
2934                 .retval = 42,
2935         },
2936         {
2937                 "stack pointer arithmetic",
2938                 .insns = {
2939                         BPF_MOV64_IMM(BPF_REG_1, 4),
2940                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
2941                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
2942                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
2943                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
2944                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
2945                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_1),
2946                         BPF_ST_MEM(0, BPF_REG_2, 4, 0),
2947                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
2948                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
2949                         BPF_ST_MEM(0, BPF_REG_2, 4, 0),
2950                         BPF_MOV64_IMM(BPF_REG_0, 0),
2951                         BPF_EXIT_INSN(),
2952                 },
2953                 .result = ACCEPT,
2954         },
2955         {
2956                 "raw_stack: no skb_load_bytes",
2957                 .insns = {
2958                         BPF_MOV64_IMM(BPF_REG_2, 4),
2959                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2960                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2961                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2962                         BPF_MOV64_IMM(BPF_REG_4, 8),
2963                         /* Call to skb_load_bytes() omitted. */
2964                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2965                         BPF_EXIT_INSN(),
2966                 },
2967                 .result = REJECT,
2968                 .errstr = "invalid read from stack off -8+0 size 8",
2969                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2970         },
2971         {
2972                 "raw_stack: skb_load_bytes, negative len",
2973                 .insns = {
2974                         BPF_MOV64_IMM(BPF_REG_2, 4),
2975                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2976                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2977                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2978                         BPF_MOV64_IMM(BPF_REG_4, -8),
2979                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2980                                      BPF_FUNC_skb_load_bytes),
2981                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2982                         BPF_EXIT_INSN(),
2983                 },
2984                 .result = REJECT,
2985                 .errstr = "R4 min value is negative",
2986                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2987         },
2988         {
2989                 "raw_stack: skb_load_bytes, negative len 2",
2990                 .insns = {
2991                         BPF_MOV64_IMM(BPF_REG_2, 4),
2992                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2993                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2994                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2995                         BPF_MOV64_IMM(BPF_REG_4, ~0),
2996                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2997                                      BPF_FUNC_skb_load_bytes),
2998                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2999                         BPF_EXIT_INSN(),
3000                 },
3001                 .result = REJECT,
3002                 .errstr = "R4 min value is negative",
3003                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3004         },
3005         {
3006                 "raw_stack: skb_load_bytes, zero len",
3007                 .insns = {
3008                         BPF_MOV64_IMM(BPF_REG_2, 4),
3009                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3010                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3011                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3012                         BPF_MOV64_IMM(BPF_REG_4, 0),
3013                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3014                                      BPF_FUNC_skb_load_bytes),
3015                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3016                         BPF_EXIT_INSN(),
3017                 },
3018                 .result = REJECT,
3019                 .errstr = "invalid stack type R3",
3020                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3021         },
3022         {
3023                 "raw_stack: skb_load_bytes, no init",
3024                 .insns = {
3025                         BPF_MOV64_IMM(BPF_REG_2, 4),
3026                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3027                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3028                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3029                         BPF_MOV64_IMM(BPF_REG_4, 8),
3030                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3031                                      BPF_FUNC_skb_load_bytes),
3032                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3033                         BPF_EXIT_INSN(),
3034                 },
3035                 .result = ACCEPT,
3036                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3037         },
3038         {
3039                 "raw_stack: skb_load_bytes, init",
3040                 .insns = {
3041                         BPF_MOV64_IMM(BPF_REG_2, 4),
3042                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3043                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3044                         BPF_ST_MEM(BPF_DW, BPF_REG_6, 0, 0xcafe),
3045                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3046                         BPF_MOV64_IMM(BPF_REG_4, 8),
3047                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3048                                      BPF_FUNC_skb_load_bytes),
3049                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3050                         BPF_EXIT_INSN(),
3051                 },
3052                 .result = ACCEPT,
3053                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3054         },
3055         {
3056                 "raw_stack: skb_load_bytes, spilled regs around bounds",
3057                 .insns = {
3058                         BPF_MOV64_IMM(BPF_REG_2, 4),
3059                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3060                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
3061                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
3062                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
3063                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3064                         BPF_MOV64_IMM(BPF_REG_4, 8),
3065                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3066                                      BPF_FUNC_skb_load_bytes),
3067                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
3068                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
3069                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
3070                                     offsetof(struct __sk_buff, mark)),
3071                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
3072                                     offsetof(struct __sk_buff, priority)),
3073                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3074                         BPF_EXIT_INSN(),
3075                 },
3076                 .result = ACCEPT,
3077                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3078         },
3079         {
3080                 "raw_stack: skb_load_bytes, spilled regs corruption",
3081                 .insns = {
3082                         BPF_MOV64_IMM(BPF_REG_2, 4),
3083                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3084                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3085                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
3086                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3087                         BPF_MOV64_IMM(BPF_REG_4, 8),
3088                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3089                                      BPF_FUNC_skb_load_bytes),
3090                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3091                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
3092                                     offsetof(struct __sk_buff, mark)),
3093                         BPF_EXIT_INSN(),
3094                 },
3095                 .result = REJECT,
3096                 .errstr = "R0 invalid mem access 'inv'",
3097                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3098         },
3099         {
3100                 "raw_stack: skb_load_bytes, spilled regs corruption 2",
3101                 .insns = {
3102                         BPF_MOV64_IMM(BPF_REG_2, 4),
3103                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3104                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
3105                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
3106                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  0),
3107                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
3108                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3109                         BPF_MOV64_IMM(BPF_REG_4, 8),
3110                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3111                                      BPF_FUNC_skb_load_bytes),
3112                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
3113                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
3114                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6,  0),
3115                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
3116                                     offsetof(struct __sk_buff, mark)),
3117                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
3118                                     offsetof(struct __sk_buff, priority)),
3119                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3120                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_3,
3121                                     offsetof(struct __sk_buff, pkt_type)),
3122                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
3123                         BPF_EXIT_INSN(),
3124                 },
3125                 .result = REJECT,
3126                 .errstr = "R3 invalid mem access 'inv'",
3127                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3128         },
3129         {
3130                 "raw_stack: skb_load_bytes, spilled regs + data",
3131                 .insns = {
3132                         BPF_MOV64_IMM(BPF_REG_2, 4),
3133                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3134                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
3135                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
3136                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  0),
3137                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
3138                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3139                         BPF_MOV64_IMM(BPF_REG_4, 8),
3140                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3141                                      BPF_FUNC_skb_load_bytes),
3142                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
3143                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
3144                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6,  0),
3145                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
3146                                     offsetof(struct __sk_buff, mark)),
3147                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
3148                                     offsetof(struct __sk_buff, priority)),
3149                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3150                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
3151                         BPF_EXIT_INSN(),
3152                 },
3153                 .result = ACCEPT,
3154                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3155         },
3156         {
3157                 "raw_stack: skb_load_bytes, invalid access 1",
3158                 .insns = {
3159                         BPF_MOV64_IMM(BPF_REG_2, 4),
3160                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3161                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -513),
3162                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3163                         BPF_MOV64_IMM(BPF_REG_4, 8),
3164                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3165                                      BPF_FUNC_skb_load_bytes),
3166                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3167                         BPF_EXIT_INSN(),
3168                 },
3169                 .result = REJECT,
3170                 .errstr = "invalid stack type R3 off=-513 access_size=8",
3171                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3172         },
3173         {
3174                 "raw_stack: skb_load_bytes, invalid access 2",
3175                 .insns = {
3176                         BPF_MOV64_IMM(BPF_REG_2, 4),
3177                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3178                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
3179                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3180                         BPF_MOV64_IMM(BPF_REG_4, 8),
3181                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3182                                      BPF_FUNC_skb_load_bytes),
3183                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3184                         BPF_EXIT_INSN(),
3185                 },
3186                 .result = REJECT,
3187                 .errstr = "invalid stack type R3 off=-1 access_size=8",
3188                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3189         },
3190         {
3191                 "raw_stack: skb_load_bytes, invalid access 3",
3192                 .insns = {
3193                         BPF_MOV64_IMM(BPF_REG_2, 4),
3194                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3195                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 0xffffffff),
3196                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3197                         BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
3198                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3199                                      BPF_FUNC_skb_load_bytes),
3200                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3201                         BPF_EXIT_INSN(),
3202                 },
3203                 .result = REJECT,
3204                 .errstr = "R4 min value is negative",
3205                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3206         },
3207         {
3208                 "raw_stack: skb_load_bytes, invalid access 4",
3209                 .insns = {
3210                         BPF_MOV64_IMM(BPF_REG_2, 4),
3211                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3212                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
3213                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3214                         BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
3215                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3216                                      BPF_FUNC_skb_load_bytes),
3217                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3218                         BPF_EXIT_INSN(),
3219                 },
3220                 .result = REJECT,
3221                 .errstr = "R4 unbounded memory access, use 'var &= const' or 'if (var < const)'",
3222                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3223         },
3224         {
3225                 "raw_stack: skb_load_bytes, invalid access 5",
3226                 .insns = {
3227                         BPF_MOV64_IMM(BPF_REG_2, 4),
3228                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3229                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
3230                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3231                         BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
3232                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3233                                      BPF_FUNC_skb_load_bytes),
3234                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3235                         BPF_EXIT_INSN(),
3236                 },
3237                 .result = REJECT,
3238                 .errstr = "R4 unbounded memory access, use 'var &= const' or 'if (var < const)'",
3239                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3240         },
3241         {
3242                 "raw_stack: skb_load_bytes, invalid access 6",
3243                 .insns = {
3244                         BPF_MOV64_IMM(BPF_REG_2, 4),
3245                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3246                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
3247                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3248                         BPF_MOV64_IMM(BPF_REG_4, 0),
3249                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3250                                      BPF_FUNC_skb_load_bytes),
3251                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3252                         BPF_EXIT_INSN(),
3253                 },
3254                 .result = REJECT,
3255                 .errstr = "invalid stack type R3 off=-512 access_size=0",
3256                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3257         },
3258         {
3259                 "raw_stack: skb_load_bytes, large access",
3260                 .insns = {
3261                         BPF_MOV64_IMM(BPF_REG_2, 4),
3262                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3263                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
3264                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3265                         BPF_MOV64_IMM(BPF_REG_4, 512),
3266                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3267                                      BPF_FUNC_skb_load_bytes),
3268                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3269                         BPF_EXIT_INSN(),
3270                 },
3271                 .result = ACCEPT,
3272                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3273         },
3274         {
3275                 "context stores via ST",
3276                 .insns = {
3277                         BPF_MOV64_IMM(BPF_REG_0, 0),
3278                         BPF_ST_MEM(BPF_DW, BPF_REG_1, offsetof(struct __sk_buff, mark), 0),
3279                         BPF_EXIT_INSN(),
3280                 },
3281                 .errstr = "BPF_ST stores into R1 context is not allowed",
3282                 .result = REJECT,
3283                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3284         },
3285         {
3286                 "context stores via XADD",
3287                 .insns = {
3288                         BPF_MOV64_IMM(BPF_REG_0, 0),
3289                         BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_W, BPF_REG_1,
3290                                      BPF_REG_0, offsetof(struct __sk_buff, mark), 0),
3291                         BPF_EXIT_INSN(),
3292                 },
3293                 .errstr = "BPF_XADD stores into R1 context is not allowed",
3294                 .result = REJECT,
3295                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3296         },
3297         {
3298                 "direct packet access: test1",
3299                 .insns = {
3300                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3301                                     offsetof(struct __sk_buff, data)),
3302                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3303                                     offsetof(struct __sk_buff, data_end)),
3304                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3305                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3306                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3307                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3308                         BPF_MOV64_IMM(BPF_REG_0, 0),
3309                         BPF_EXIT_INSN(),
3310                 },
3311                 .result = ACCEPT,
3312                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3313         },
3314         {
3315                 "direct packet access: test2",
3316                 .insns = {
3317                         BPF_MOV64_IMM(BPF_REG_0, 1),
3318                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
3319                                     offsetof(struct __sk_buff, data_end)),
3320                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3321                                     offsetof(struct __sk_buff, data)),
3322                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3323                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 14),
3324                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_4, 15),
3325                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 7),
3326                         BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_3, 12),
3327                         BPF_ALU64_IMM(BPF_MUL, BPF_REG_4, 14),
3328                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3329                                     offsetof(struct __sk_buff, data)),
3330                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_4),
3331                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3332                                     offsetof(struct __sk_buff, len)),
3333                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 49),
3334                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 49),
3335                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_2),
3336                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_3),
3337                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
3338                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
3339                                     offsetof(struct __sk_buff, data_end)),
3340                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
3341                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_3, 4),
3342                         BPF_MOV64_IMM(BPF_REG_0, 0),
3343                         BPF_EXIT_INSN(),
3344                 },
3345                 .result = ACCEPT,
3346                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3347         },
3348         {
3349                 "direct packet access: test3",
3350                 .insns = {
3351                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3352                                     offsetof(struct __sk_buff, data)),
3353                         BPF_MOV64_IMM(BPF_REG_0, 0),
3354                         BPF_EXIT_INSN(),
3355                 },
3356                 .errstr = "invalid bpf_context access off=76",
3357                 .result = REJECT,
3358                 .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
3359         },
3360         {
3361                 "direct packet access: test4 (write)",
3362                 .insns = {
3363                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3364                                     offsetof(struct __sk_buff, data)),
3365                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3366                                     offsetof(struct __sk_buff, data_end)),
3367                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3368                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3369                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3370                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3371                         BPF_MOV64_IMM(BPF_REG_0, 0),
3372                         BPF_EXIT_INSN(),
3373                 },
3374                 .result = ACCEPT,
3375                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3376         },
3377         {
3378                 "direct packet access: test5 (pkt_end >= reg, good access)",
3379                 .insns = {
3380                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3381                                     offsetof(struct __sk_buff, data)),
3382                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3383                                     offsetof(struct __sk_buff, data_end)),
3384                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3385                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3386                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
3387                         BPF_MOV64_IMM(BPF_REG_0, 1),
3388                         BPF_EXIT_INSN(),
3389                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3390                         BPF_MOV64_IMM(BPF_REG_0, 0),
3391                         BPF_EXIT_INSN(),
3392                 },
3393                 .result = ACCEPT,
3394                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3395         },
3396         {
3397                 "direct packet access: test6 (pkt_end >= reg, bad access)",
3398                 .insns = {
3399                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3400                                     offsetof(struct __sk_buff, data)),
3401                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3402                                     offsetof(struct __sk_buff, data_end)),
3403                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3404                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3405                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
3406                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3407                         BPF_MOV64_IMM(BPF_REG_0, 1),
3408                         BPF_EXIT_INSN(),
3409                         BPF_MOV64_IMM(BPF_REG_0, 0),
3410                         BPF_EXIT_INSN(),
3411                 },
3412                 .errstr = "invalid access to packet",
3413                 .result = REJECT,
3414                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3415         },
3416         {
3417                 "direct packet access: test7 (pkt_end >= reg, both accesses)",
3418                 .insns = {
3419                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3420                                     offsetof(struct __sk_buff, data)),
3421                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3422                                     offsetof(struct __sk_buff, data_end)),
3423                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3424                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3425                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
3426                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3427                         BPF_MOV64_IMM(BPF_REG_0, 1),
3428                         BPF_EXIT_INSN(),
3429                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3430                         BPF_MOV64_IMM(BPF_REG_0, 0),
3431                         BPF_EXIT_INSN(),
3432                 },
3433                 .errstr = "invalid access to packet",
3434                 .result = REJECT,
3435                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3436         },
3437         {
3438                 "direct packet access: test8 (double test, variant 1)",
3439                 .insns = {
3440                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3441                                     offsetof(struct __sk_buff, data)),
3442                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3443                                     offsetof(struct __sk_buff, data_end)),
3444                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3445                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3446                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 4),
3447                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3448                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3449                         BPF_MOV64_IMM(BPF_REG_0, 1),
3450                         BPF_EXIT_INSN(),
3451                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3452                         BPF_MOV64_IMM(BPF_REG_0, 0),
3453                         BPF_EXIT_INSN(),
3454                 },
3455                 .result = ACCEPT,
3456                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3457         },
3458         {
3459                 "direct packet access: test9 (double test, variant 2)",
3460                 .insns = {
3461                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3462                                     offsetof(struct __sk_buff, data)),
3463                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3464                                     offsetof(struct __sk_buff, data_end)),
3465                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3466                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3467                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
3468                         BPF_MOV64_IMM(BPF_REG_0, 1),
3469                         BPF_EXIT_INSN(),
3470                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3471                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3472                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3473                         BPF_MOV64_IMM(BPF_REG_0, 0),
3474                         BPF_EXIT_INSN(),
3475                 },
3476                 .result = ACCEPT,
3477                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3478         },
3479         {
3480                 "direct packet access: test10 (write invalid)",
3481                 .insns = {
3482                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3483                                     offsetof(struct __sk_buff, data)),
3484                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3485                                     offsetof(struct __sk_buff, data_end)),
3486                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3487                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3488                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
3489                         BPF_MOV64_IMM(BPF_REG_0, 0),
3490                         BPF_EXIT_INSN(),
3491                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3492                         BPF_MOV64_IMM(BPF_REG_0, 0),
3493                         BPF_EXIT_INSN(),
3494                 },
3495                 .errstr = "invalid access to packet",
3496                 .result = REJECT,
3497                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3498         },
3499         {
3500                 "direct packet access: test11 (shift, good access)",
3501                 .insns = {
3502                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3503                                     offsetof(struct __sk_buff, data)),
3504                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3505                                     offsetof(struct __sk_buff, data_end)),
3506                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3507                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3508                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
3509                         BPF_MOV64_IMM(BPF_REG_3, 144),
3510                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3511                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
3512                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 3),
3513                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3514                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3515                         BPF_MOV64_IMM(BPF_REG_0, 1),
3516                         BPF_EXIT_INSN(),
3517                         BPF_MOV64_IMM(BPF_REG_0, 0),
3518                         BPF_EXIT_INSN(),
3519                 },
3520                 .result = ACCEPT,
3521                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3522                 .retval = 1,
3523         },
3524         {
3525                 "direct packet access: test12 (and, good access)",
3526                 .insns = {
3527                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3528                                     offsetof(struct __sk_buff, data)),
3529                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3530                                     offsetof(struct __sk_buff, data_end)),
3531                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3532                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3533                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
3534                         BPF_MOV64_IMM(BPF_REG_3, 144),
3535                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3536                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
3537                         BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
3538                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3539                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3540                         BPF_MOV64_IMM(BPF_REG_0, 1),
3541                         BPF_EXIT_INSN(),
3542                         BPF_MOV64_IMM(BPF_REG_0, 0),
3543                         BPF_EXIT_INSN(),
3544                 },
3545                 .result = ACCEPT,
3546                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3547                 .retval = 1,
3548         },
3549         {
3550                 "direct packet access: test13 (branches, good access)",
3551                 .insns = {
3552                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3553                                     offsetof(struct __sk_buff, data)),
3554                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3555                                     offsetof(struct __sk_buff, data_end)),
3556                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3557                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3558                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 13),
3559                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3560                                     offsetof(struct __sk_buff, mark)),
3561                         BPF_MOV64_IMM(BPF_REG_4, 1),
3562                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_4, 2),
3563                         BPF_MOV64_IMM(BPF_REG_3, 14),
3564                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
3565                         BPF_MOV64_IMM(BPF_REG_3, 24),
3566                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3567                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
3568                         BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
3569                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3570                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3571                         BPF_MOV64_IMM(BPF_REG_0, 1),
3572                         BPF_EXIT_INSN(),
3573                         BPF_MOV64_IMM(BPF_REG_0, 0),
3574                         BPF_EXIT_INSN(),
3575                 },
3576                 .result = ACCEPT,
3577                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3578                 .retval = 1,
3579         },
3580         {
3581                 "direct packet access: test14 (pkt_ptr += 0, CONST_IMM, good access)",
3582                 .insns = {
3583                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3584                                     offsetof(struct __sk_buff, data)),
3585                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3586                                     offsetof(struct __sk_buff, data_end)),
3587                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3588                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3589                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),
3590                         BPF_MOV64_IMM(BPF_REG_5, 12),
3591                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 4),
3592                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3593                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3594                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6, 0),
3595                         BPF_MOV64_IMM(BPF_REG_0, 1),
3596                         BPF_EXIT_INSN(),
3597                         BPF_MOV64_IMM(BPF_REG_0, 0),
3598                         BPF_EXIT_INSN(),
3599                 },
3600                 .result = ACCEPT,
3601                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3602                 .retval = 1,
3603         },
3604         {
3605                 "direct packet access: test15 (spill with xadd)",
3606                 .insns = {
3607                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3608                                     offsetof(struct __sk_buff, data)),
3609                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3610                                     offsetof(struct __sk_buff, data_end)),
3611                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3612                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3613                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
3614                         BPF_MOV64_IMM(BPF_REG_5, 4096),
3615                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
3616                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
3617                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
3618                         BPF_STX_XADD(BPF_DW, BPF_REG_4, BPF_REG_5, 0),
3619                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
3620                         BPF_STX_MEM(BPF_W, BPF_REG_2, BPF_REG_5, 0),
3621                         BPF_MOV64_IMM(BPF_REG_0, 0),
3622                         BPF_EXIT_INSN(),
3623                 },
3624                 .errstr = "R2 invalid mem access 'inv'",
3625                 .result = REJECT,
3626                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3627         },
3628         {
3629                 "direct packet access: test16 (arith on data_end)",
3630                 .insns = {
3631                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3632                                     offsetof(struct __sk_buff, data)),
3633                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3634                                     offsetof(struct __sk_buff, data_end)),
3635                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3636                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3637                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 16),
3638                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3639                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3640                         BPF_MOV64_IMM(BPF_REG_0, 0),
3641                         BPF_EXIT_INSN(),
3642                 },
3643                 .errstr = "R3 pointer arithmetic on PTR_TO_PACKET_END",
3644                 .result = REJECT,
3645                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3646         },
3647         {
3648                 "direct packet access: test17 (pruning, alignment)",
3649                 .insns = {
3650                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3651                                     offsetof(struct __sk_buff, data)),
3652                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3653                                     offsetof(struct __sk_buff, data_end)),
3654                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3655                                     offsetof(struct __sk_buff, mark)),
3656                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3657                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 14),
3658                         BPF_JMP_IMM(BPF_JGT, BPF_REG_7, 1, 4),
3659                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3660                         BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, -4),
3661                         BPF_MOV64_IMM(BPF_REG_0, 0),
3662                         BPF_EXIT_INSN(),
3663                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
3664                         BPF_JMP_A(-6),
3665                 },
3666                 .errstr = "misaligned packet access off 2+(0x0; 0x0)+15+-4 size 4",
3667                 .result = REJECT,
3668                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3669                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
3670         },
3671         {
3672                 "direct packet access: test18 (imm += pkt_ptr, 1)",
3673                 .insns = {
3674                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3675                                     offsetof(struct __sk_buff, data)),
3676                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3677                                     offsetof(struct __sk_buff, data_end)),
3678                         BPF_MOV64_IMM(BPF_REG_0, 8),
3679                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3680                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3681                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3682                         BPF_MOV64_IMM(BPF_REG_0, 0),
3683                         BPF_EXIT_INSN(),
3684                 },
3685                 .result = ACCEPT,
3686                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3687         },
3688         {
3689                 "direct packet access: test19 (imm += pkt_ptr, 2)",
3690                 .insns = {
3691                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3692                                     offsetof(struct __sk_buff, data)),
3693                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3694                                     offsetof(struct __sk_buff, data_end)),
3695                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3696                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3697                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
3698                         BPF_MOV64_IMM(BPF_REG_4, 4),
3699                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3700                         BPF_STX_MEM(BPF_B, BPF_REG_4, BPF_REG_4, 0),
3701                         BPF_MOV64_IMM(BPF_REG_0, 0),
3702                         BPF_EXIT_INSN(),
3703                 },
3704                 .result = ACCEPT,
3705                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3706         },
3707         {
3708                 "direct packet access: test20 (x += pkt_ptr, 1)",
3709                 .insns = {
3710                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3711                                     offsetof(struct __sk_buff, data)),
3712                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3713                                     offsetof(struct __sk_buff, data_end)),
3714                         BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
3715                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3716                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3717                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0x7fff),
3718                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3719                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3720                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
3721                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0x7fff - 1),
3722                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
3723                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
3724                         BPF_MOV64_IMM(BPF_REG_0, 0),
3725                         BPF_EXIT_INSN(),
3726                 },
3727                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3728                 .result = ACCEPT,
3729         },
3730         {
3731                 "direct packet access: test21 (x += pkt_ptr, 2)",
3732                 .insns = {
3733                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3734                                     offsetof(struct __sk_buff, data)),
3735                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3736                                     offsetof(struct __sk_buff, data_end)),
3737                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3738                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3739                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 9),
3740                         BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
3741                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -8),
3742                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
3743                         BPF_ALU64_IMM(BPF_AND, BPF_REG_4, 0x7fff),
3744                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3745                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
3746                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0x7fff - 1),
3747                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
3748                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
3749                         BPF_MOV64_IMM(BPF_REG_0, 0),
3750                         BPF_EXIT_INSN(),
3751                 },
3752                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3753                 .result = ACCEPT,
3754         },
3755         {
3756                 "direct packet access: test22 (x += pkt_ptr, 3)",
3757                 .insns = {
3758                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3759                                     offsetof(struct __sk_buff, data)),
3760                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3761                                     offsetof(struct __sk_buff, data_end)),
3762                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3763                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3764                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -8),
3765                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_3, -16),
3766                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_10, -16),
3767                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 11),
3768                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
3769                         BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
3770                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_4, -8),
3771                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
3772                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 49),
3773                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3774                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
3775                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
3776                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
3777                         BPF_MOV64_IMM(BPF_REG_2, 1),
3778                         BPF_STX_MEM(BPF_H, BPF_REG_4, BPF_REG_2, 0),
3779                         BPF_MOV64_IMM(BPF_REG_0, 0),
3780                         BPF_EXIT_INSN(),
3781                 },
3782                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3783                 .result = ACCEPT,
3784         },
3785         {
3786                 "direct packet access: test23 (x += pkt_ptr, 4)",
3787                 .insns = {
3788                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3789                                     offsetof(struct __sk_buff, data)),
3790                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3791                                     offsetof(struct __sk_buff, data_end)),
3792                         BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
3793                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3794                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3795                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xffff),
3796                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3797                         BPF_MOV64_IMM(BPF_REG_0, 31),
3798                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_4),
3799                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3800                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
3801                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0xffff - 1),
3802                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3803                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_0, 0),
3804                         BPF_MOV64_IMM(BPF_REG_0, 0),
3805                         BPF_EXIT_INSN(),
3806                 },
3807                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3808                 .result = REJECT,
3809                 .errstr = "invalid access to packet, off=0 size=8, R5(id=1,off=0,r=0)",
3810         },
3811         {
3812                 "direct packet access: test24 (x += pkt_ptr, 5)",
3813                 .insns = {
3814                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3815                                     offsetof(struct __sk_buff, data)),
3816                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3817                                     offsetof(struct __sk_buff, data_end)),
3818                         BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
3819                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3820                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3821                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xff),
3822                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3823                         BPF_MOV64_IMM(BPF_REG_0, 64),
3824                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_4),
3825                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3826                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
3827                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x7fff - 1),
3828                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3829                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_0, 0),
3830                         BPF_MOV64_IMM(BPF_REG_0, 0),
3831                         BPF_EXIT_INSN(),
3832                 },
3833                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3834                 .result = ACCEPT,
3835         },
3836         {
3837                 "direct packet access: test25 (marking on <, good access)",
3838                 .insns = {
3839                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3840                                     offsetof(struct __sk_buff, data)),
3841                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3842                                     offsetof(struct __sk_buff, data_end)),
3843                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3844                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3845                         BPF_JMP_REG(BPF_JLT, BPF_REG_0, BPF_REG_3, 2),
3846                         BPF_MOV64_IMM(BPF_REG_0, 0),
3847                         BPF_EXIT_INSN(),
3848                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3849                         BPF_JMP_IMM(BPF_JA, 0, 0, -4),
3850                 },
3851                 .result = ACCEPT,
3852                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3853         },
3854         {
3855                 "direct packet access: test26 (marking on <, bad access)",
3856                 .insns = {
3857                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3858                                     offsetof(struct __sk_buff, data)),
3859                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3860                                     offsetof(struct __sk_buff, data_end)),
3861                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3862                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3863                         BPF_JMP_REG(BPF_JLT, BPF_REG_0, BPF_REG_3, 3),
3864                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3865                         BPF_MOV64_IMM(BPF_REG_0, 0),
3866                         BPF_EXIT_INSN(),
3867                         BPF_JMP_IMM(BPF_JA, 0, 0, -3),
3868                 },
3869                 .result = REJECT,
3870                 .errstr = "invalid access to packet",
3871                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3872         },
3873         {
3874                 "direct packet access: test27 (marking on <=, good access)",
3875                 .insns = {
3876                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3877                                     offsetof(struct __sk_buff, data)),
3878                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3879                                     offsetof(struct __sk_buff, data_end)),
3880                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3881                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3882                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_0, 1),
3883                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3884                         BPF_MOV64_IMM(BPF_REG_0, 1),
3885                         BPF_EXIT_INSN(),
3886                 },
3887                 .result = ACCEPT,
3888                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3889                 .retval = 1,
3890         },
3891         {
3892                 "direct packet access: test28 (marking on <=, bad access)",
3893                 .insns = {
3894                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3895                                     offsetof(struct __sk_buff, data)),
3896                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3897                                     offsetof(struct __sk_buff, data_end)),
3898                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3899                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3900                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_0, 2),
3901                         BPF_MOV64_IMM(BPF_REG_0, 1),
3902                         BPF_EXIT_INSN(),
3903                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3904                         BPF_JMP_IMM(BPF_JA, 0, 0, -4),
3905                 },
3906                 .result = REJECT,
3907                 .errstr = "invalid access to packet",
3908                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3909         },
3910         {
3911                 "helper access to packet: test1, valid packet_ptr range",
3912                 .insns = {
3913                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3914                                     offsetof(struct xdp_md, data)),
3915                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3916                                     offsetof(struct xdp_md, data_end)),
3917                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
3918                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
3919                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
3920                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3921                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
3922                         BPF_MOV64_IMM(BPF_REG_4, 0),
3923                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3924                                      BPF_FUNC_map_update_elem),
3925                         BPF_MOV64_IMM(BPF_REG_0, 0),
3926                         BPF_EXIT_INSN(),
3927                 },
3928                 .fixup_map1 = { 5 },
3929                 .result_unpriv = ACCEPT,
3930                 .result = ACCEPT,
3931                 .prog_type = BPF_PROG_TYPE_XDP,
3932         },
3933         {
3934                 "helper access to packet: test2, unchecked packet_ptr",
3935                 .insns = {
3936                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3937                                     offsetof(struct xdp_md, data)),
3938                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3939                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3940                                      BPF_FUNC_map_lookup_elem),
3941                         BPF_MOV64_IMM(BPF_REG_0, 0),
3942                         BPF_EXIT_INSN(),
3943                 },
3944                 .fixup_map1 = { 1 },
3945                 .result = REJECT,
3946                 .errstr = "invalid access to packet",
3947                 .prog_type = BPF_PROG_TYPE_XDP,
3948         },
3949         {
3950                 "helper access to packet: test3, variable add",
3951                 .insns = {
3952                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3953                                         offsetof(struct xdp_md, data)),
3954                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3955                                         offsetof(struct xdp_md, data_end)),
3956                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3957                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
3958                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
3959                         BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
3960                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3961                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
3962                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
3963                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
3964                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
3965                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3966                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
3967                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3968                                      BPF_FUNC_map_lookup_elem),
3969                         BPF_MOV64_IMM(BPF_REG_0, 0),
3970                         BPF_EXIT_INSN(),
3971                 },
3972                 .fixup_map1 = { 11 },
3973                 .result = ACCEPT,
3974                 .prog_type = BPF_PROG_TYPE_XDP,
3975         },
3976         {
3977                 "helper access to packet: test4, packet_ptr with bad range",
3978                 .insns = {
3979                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3980                                     offsetof(struct xdp_md, data)),
3981                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3982                                     offsetof(struct xdp_md, data_end)),
3983                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3984                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
3985                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
3986                         BPF_MOV64_IMM(BPF_REG_0, 0),
3987                         BPF_EXIT_INSN(),
3988                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3989                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3990                                      BPF_FUNC_map_lookup_elem),
3991                         BPF_MOV64_IMM(BPF_REG_0, 0),
3992                         BPF_EXIT_INSN(),
3993                 },
3994                 .fixup_map1 = { 7 },
3995                 .result = REJECT,
3996                 .errstr = "invalid access to packet",
3997                 .prog_type = BPF_PROG_TYPE_XDP,
3998         },
3999         {
4000                 "helper access to packet: test5, packet_ptr with too short range",
4001                 .insns = {
4002                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4003                                     offsetof(struct xdp_md, data)),
4004                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4005                                     offsetof(struct xdp_md, data_end)),
4006                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
4007                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4008                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
4009                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
4010                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4011                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4012                                      BPF_FUNC_map_lookup_elem),
4013                         BPF_MOV64_IMM(BPF_REG_0, 0),
4014                         BPF_EXIT_INSN(),
4015                 },
4016                 .fixup_map1 = { 6 },
4017                 .result = REJECT,
4018                 .errstr = "invalid access to packet",
4019                 .prog_type = BPF_PROG_TYPE_XDP,
4020         },
4021         {
4022                 "helper access to packet: test6, cls valid packet_ptr range",
4023                 .insns = {
4024                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4025                                     offsetof(struct __sk_buff, data)),
4026                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4027                                     offsetof(struct __sk_buff, data_end)),
4028                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
4029                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
4030                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
4031                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4032                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
4033                         BPF_MOV64_IMM(BPF_REG_4, 0),
4034                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4035                                      BPF_FUNC_map_update_elem),
4036                         BPF_MOV64_IMM(BPF_REG_0, 0),
4037                         BPF_EXIT_INSN(),
4038                 },
4039                 .fixup_map1 = { 5 },
4040                 .result = ACCEPT,
4041                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4042         },
4043         {
4044                 "helper access to packet: test7, cls unchecked packet_ptr",
4045                 .insns = {
4046                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4047                                     offsetof(struct __sk_buff, data)),
4048                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4049                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4050                                      BPF_FUNC_map_lookup_elem),
4051                         BPF_MOV64_IMM(BPF_REG_0, 0),
4052                         BPF_EXIT_INSN(),
4053                 },
4054                 .fixup_map1 = { 1 },
4055                 .result = REJECT,
4056                 .errstr = "invalid access to packet",
4057                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4058         },
4059         {
4060                 "helper access to packet: test8, cls variable add",
4061                 .insns = {
4062                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4063                                         offsetof(struct __sk_buff, data)),
4064                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4065                                         offsetof(struct __sk_buff, data_end)),
4066                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4067                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
4068                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
4069                         BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
4070                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4071                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
4072                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
4073                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
4074                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
4075                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4076                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
4077                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4078                                      BPF_FUNC_map_lookup_elem),
4079                         BPF_MOV64_IMM(BPF_REG_0, 0),
4080                         BPF_EXIT_INSN(),
4081                 },
4082                 .fixup_map1 = { 11 },
4083                 .result = ACCEPT,
4084                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4085         },
4086         {
4087                 "helper access to packet: test9, cls packet_ptr with bad range",
4088                 .insns = {
4089                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4090                                     offsetof(struct __sk_buff, data)),
4091                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4092                                     offsetof(struct __sk_buff, data_end)),
4093                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4094                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
4095                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
4096                         BPF_MOV64_IMM(BPF_REG_0, 0),
4097                         BPF_EXIT_INSN(),
4098                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4099                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4100                                      BPF_FUNC_map_lookup_elem),
4101                         BPF_MOV64_IMM(BPF_REG_0, 0),
4102                         BPF_EXIT_INSN(),
4103                 },
4104                 .fixup_map1 = { 7 },
4105                 .result = REJECT,
4106                 .errstr = "invalid access to packet",
4107                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4108         },
4109         {
4110                 "helper access to packet: test10, cls packet_ptr with too short range",
4111                 .insns = {
4112                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4113                                     offsetof(struct __sk_buff, data)),
4114                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4115                                     offsetof(struct __sk_buff, data_end)),
4116                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
4117                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4118                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
4119                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
4120                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4121                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4122                                      BPF_FUNC_map_lookup_elem),
4123                         BPF_MOV64_IMM(BPF_REG_0, 0),
4124                         BPF_EXIT_INSN(),
4125                 },
4126                 .fixup_map1 = { 6 },
4127                 .result = REJECT,
4128                 .errstr = "invalid access to packet",
4129                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4130         },
4131         {
4132                 "helper access to packet: test11, cls unsuitable helper 1",
4133                 .insns = {
4134                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4135                                     offsetof(struct __sk_buff, data)),
4136                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4137                                     offsetof(struct __sk_buff, data_end)),
4138                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4139                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
4140                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 7),
4141                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_7, 4),
4142                         BPF_MOV64_IMM(BPF_REG_2, 0),
4143                         BPF_MOV64_IMM(BPF_REG_4, 42),
4144                         BPF_MOV64_IMM(BPF_REG_5, 0),
4145                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4146                                      BPF_FUNC_skb_store_bytes),
4147                         BPF_MOV64_IMM(BPF_REG_0, 0),
4148                         BPF_EXIT_INSN(),
4149                 },
4150                 .result = REJECT,
4151                 .errstr = "helper access to the packet",
4152                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4153         },
4154         {
4155                 "helper access to packet: test12, cls unsuitable helper 2",
4156                 .insns = {
4157                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4158                                     offsetof(struct __sk_buff, data)),
4159                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4160                                     offsetof(struct __sk_buff, data_end)),
4161                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
4162                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
4163                         BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_7, 3),
4164                         BPF_MOV64_IMM(BPF_REG_2, 0),
4165                         BPF_MOV64_IMM(BPF_REG_4, 4),
4166                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4167                                      BPF_FUNC_skb_load_bytes),
4168                         BPF_MOV64_IMM(BPF_REG_0, 0),
4169                         BPF_EXIT_INSN(),
4170                 },
4171                 .result = REJECT,
4172                 .errstr = "helper access to the packet",
4173                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4174         },
4175         {
4176                 "helper access to packet: test13, cls helper ok",
4177                 .insns = {
4178                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4179                                     offsetof(struct __sk_buff, data)),
4180                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4181                                     offsetof(struct __sk_buff, data_end)),
4182                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4183                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4184                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4185                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4186                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4187                         BPF_MOV64_IMM(BPF_REG_2, 4),
4188                         BPF_MOV64_IMM(BPF_REG_3, 0),
4189                         BPF_MOV64_IMM(BPF_REG_4, 0),
4190                         BPF_MOV64_IMM(BPF_REG_5, 0),
4191                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4192                                      BPF_FUNC_csum_diff),
4193                         BPF_MOV64_IMM(BPF_REG_0, 0),
4194                         BPF_EXIT_INSN(),
4195                 },
4196                 .result = ACCEPT,
4197                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4198         },
4199         {
4200                 "helper access to packet: test14, cls helper ok sub",
4201                 .insns = {
4202                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4203                                     offsetof(struct __sk_buff, data)),
4204                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4205                                     offsetof(struct __sk_buff, data_end)),
4206                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4207                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4208                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4209                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4210                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 4),
4211                         BPF_MOV64_IMM(BPF_REG_2, 4),
4212                         BPF_MOV64_IMM(BPF_REG_3, 0),
4213                         BPF_MOV64_IMM(BPF_REG_4, 0),
4214                         BPF_MOV64_IMM(BPF_REG_5, 0),
4215                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4216                                      BPF_FUNC_csum_diff),
4217                         BPF_MOV64_IMM(BPF_REG_0, 0),
4218                         BPF_EXIT_INSN(),
4219                 },
4220                 .result = ACCEPT,
4221                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4222         },
4223         {
4224                 "helper access to packet: test15, cls helper fail sub",
4225                 .insns = {
4226                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4227                                     offsetof(struct __sk_buff, data)),
4228                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4229                                     offsetof(struct __sk_buff, data_end)),
4230                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4231                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4232                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4233                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4234                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 12),
4235                         BPF_MOV64_IMM(BPF_REG_2, 4),
4236                         BPF_MOV64_IMM(BPF_REG_3, 0),
4237                         BPF_MOV64_IMM(BPF_REG_4, 0),
4238                         BPF_MOV64_IMM(BPF_REG_5, 0),
4239                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4240                                      BPF_FUNC_csum_diff),
4241                         BPF_MOV64_IMM(BPF_REG_0, 0),
4242                         BPF_EXIT_INSN(),
4243                 },
4244                 .result = REJECT,
4245                 .errstr = "invalid access to packet",
4246                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4247         },
4248         {
4249                 "helper access to packet: test16, cls helper fail range 1",
4250                 .insns = {
4251                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4252                                     offsetof(struct __sk_buff, data)),
4253                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4254                                     offsetof(struct __sk_buff, data_end)),
4255                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4256                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4257                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4258                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4259                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4260                         BPF_MOV64_IMM(BPF_REG_2, 8),
4261                         BPF_MOV64_IMM(BPF_REG_3, 0),
4262                         BPF_MOV64_IMM(BPF_REG_4, 0),
4263                         BPF_MOV64_IMM(BPF_REG_5, 0),
4264                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4265                                      BPF_FUNC_csum_diff),
4266                         BPF_MOV64_IMM(BPF_REG_0, 0),
4267                         BPF_EXIT_INSN(),
4268                 },
4269                 .result = REJECT,
4270                 .errstr = "invalid access to packet",
4271                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4272         },
4273         {
4274                 "helper access to packet: test17, cls helper fail range 2",
4275                 .insns = {
4276                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4277                                     offsetof(struct __sk_buff, data)),
4278                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4279                                     offsetof(struct __sk_buff, data_end)),
4280                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4281                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4282                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4283                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4284                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4285                         BPF_MOV64_IMM(BPF_REG_2, -9),
4286                         BPF_MOV64_IMM(BPF_REG_3, 0),
4287                         BPF_MOV64_IMM(BPF_REG_4, 0),
4288                         BPF_MOV64_IMM(BPF_REG_5, 0),
4289                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4290                                      BPF_FUNC_csum_diff),
4291                         BPF_MOV64_IMM(BPF_REG_0, 0),
4292                         BPF_EXIT_INSN(),
4293                 },
4294                 .result = REJECT,
4295                 .errstr = "R2 min value is negative",
4296                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4297         },
4298         {
4299                 "helper access to packet: test18, cls helper fail range 3",
4300                 .insns = {
4301                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4302                                     offsetof(struct __sk_buff, data)),
4303                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4304                                     offsetof(struct __sk_buff, data_end)),
4305                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4306                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4307                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4308                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4309                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4310                         BPF_MOV64_IMM(BPF_REG_2, ~0),
4311                         BPF_MOV64_IMM(BPF_REG_3, 0),
4312                         BPF_MOV64_IMM(BPF_REG_4, 0),
4313                         BPF_MOV64_IMM(BPF_REG_5, 0),
4314                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4315                                      BPF_FUNC_csum_diff),
4316                         BPF_MOV64_IMM(BPF_REG_0, 0),
4317                         BPF_EXIT_INSN(),
4318                 },
4319                 .result = REJECT,
4320                 .errstr = "R2 min value is negative",
4321                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4322         },
4323         {
4324                 "helper access to packet: test19, cls helper range zero",
4325                 .insns = {
4326                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4327                                     offsetof(struct __sk_buff, data)),
4328                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4329                                     offsetof(struct __sk_buff, data_end)),
4330                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4331                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4332                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4333                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4334                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4335                         BPF_MOV64_IMM(BPF_REG_2, 0),
4336                         BPF_MOV64_IMM(BPF_REG_3, 0),
4337                         BPF_MOV64_IMM(BPF_REG_4, 0),
4338                         BPF_MOV64_IMM(BPF_REG_5, 0),
4339                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4340                                      BPF_FUNC_csum_diff),
4341                         BPF_MOV64_IMM(BPF_REG_0, 0),
4342                         BPF_EXIT_INSN(),
4343                 },
4344                 .result = ACCEPT,
4345                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4346         },
4347         {
4348                 "helper access to packet: test20, pkt end as input",
4349                 .insns = {
4350                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4351                                     offsetof(struct __sk_buff, data)),
4352                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4353                                     offsetof(struct __sk_buff, data_end)),
4354                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4355                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4356                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4357                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4358                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
4359                         BPF_MOV64_IMM(BPF_REG_2, 4),
4360                         BPF_MOV64_IMM(BPF_REG_3, 0),
4361                         BPF_MOV64_IMM(BPF_REG_4, 0),
4362                         BPF_MOV64_IMM(BPF_REG_5, 0),
4363                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4364                                      BPF_FUNC_csum_diff),
4365                         BPF_MOV64_IMM(BPF_REG_0, 0),
4366                         BPF_EXIT_INSN(),
4367                 },
4368                 .result = REJECT,
4369                 .errstr = "R1 type=pkt_end expected=fp",
4370                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4371         },
4372         {
4373                 "helper access to packet: test21, wrong reg",
4374                 .insns = {
4375                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4376                                     offsetof(struct __sk_buff, data)),
4377                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4378                                     offsetof(struct __sk_buff, data_end)),
4379                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4380                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4381                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4382                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4383                         BPF_MOV64_IMM(BPF_REG_2, 4),
4384                         BPF_MOV64_IMM(BPF_REG_3, 0),
4385                         BPF_MOV64_IMM(BPF_REG_4, 0),
4386                         BPF_MOV64_IMM(BPF_REG_5, 0),
4387                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4388                                      BPF_FUNC_csum_diff),
4389                         BPF_MOV64_IMM(BPF_REG_0, 0),
4390                         BPF_EXIT_INSN(),
4391                 },
4392                 .result = REJECT,
4393                 .errstr = "invalid access to packet",
4394                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4395         },
4396         {
4397                 "valid map access into an array with a constant",
4398                 .insns = {
4399                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4400                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4401                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4402                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4403                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4404                                      BPF_FUNC_map_lookup_elem),
4405                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4406                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4407                                    offsetof(struct test_val, foo)),
4408                         BPF_EXIT_INSN(),
4409                 },
4410                 .fixup_map2 = { 3 },
4411                 .errstr_unpriv = "R0 leaks addr",
4412                 .result_unpriv = REJECT,
4413                 .result = ACCEPT,
4414         },
4415         {
4416                 "valid map access into an array with a register",
4417                 .insns = {
4418                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4419                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4420                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4421                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4422                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4423                                      BPF_FUNC_map_lookup_elem),
4424                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4425                         BPF_MOV64_IMM(BPF_REG_1, 4),
4426                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4427                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4428                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4429                                    offsetof(struct test_val, foo)),
4430                         BPF_EXIT_INSN(),
4431                 },
4432                 .fixup_map2 = { 3 },
4433                 .errstr_unpriv = "R0 leaks addr",
4434                 .result_unpriv = REJECT,
4435                 .result = ACCEPT,
4436                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4437         },
4438         {
4439                 "valid map access into an array with a variable",
4440                 .insns = {
4441                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4442                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4443                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4444                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4445                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4446                                      BPF_FUNC_map_lookup_elem),
4447                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4448                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4449                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 3),
4450                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4451                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4452                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4453                                    offsetof(struct test_val, foo)),
4454                         BPF_EXIT_INSN(),
4455                 },
4456                 .fixup_map2 = { 3 },
4457                 .errstr_unpriv = "R0 leaks addr",
4458                 .result_unpriv = REJECT,
4459                 .result = ACCEPT,
4460                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4461         },
4462         {
4463                 "valid map access into an array with a signed variable",
4464                 .insns = {
4465                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4466                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4467                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4468                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4469                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4470                                      BPF_FUNC_map_lookup_elem),
4471                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
4472                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4473                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 0xffffffff, 1),
4474                         BPF_MOV32_IMM(BPF_REG_1, 0),
4475                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
4476                         BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
4477                         BPF_MOV32_IMM(BPF_REG_1, 0),
4478                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
4479                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4480                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4481                                    offsetof(struct test_val, foo)),
4482                         BPF_EXIT_INSN(),
4483                 },
4484                 .fixup_map2 = { 3 },
4485                 .errstr_unpriv = "R0 leaks addr",
4486                 .result_unpriv = REJECT,
4487                 .result = ACCEPT,
4488                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4489         },
4490         {
4491                 "invalid map access into an array with a constant",
4492                 .insns = {
4493                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4494                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4495                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4496                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4497                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4498                                      BPF_FUNC_map_lookup_elem),
4499                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4500                         BPF_ST_MEM(BPF_DW, BPF_REG_0, (MAX_ENTRIES + 1) << 2,
4501                                    offsetof(struct test_val, foo)),
4502                         BPF_EXIT_INSN(),
4503                 },
4504                 .fixup_map2 = { 3 },
4505                 .errstr = "invalid access to map value, value_size=48 off=48 size=8",
4506                 .result = REJECT,
4507         },
4508         {
4509                 "invalid map access into an array with a register",
4510                 .insns = {
4511                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4512                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4513                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4514                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4515                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4516                                      BPF_FUNC_map_lookup_elem),
4517                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4518                         BPF_MOV64_IMM(BPF_REG_1, MAX_ENTRIES + 1),
4519                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4520                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4521                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4522                                    offsetof(struct test_val, foo)),
4523                         BPF_EXIT_INSN(),
4524                 },
4525                 .fixup_map2 = { 3 },
4526                 .errstr = "R0 min value is outside of the array range",
4527                 .result = REJECT,
4528                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4529         },
4530         {
4531                 "invalid map access into an array with a variable",
4532                 .insns = {
4533                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4534                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4535                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4536                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4537                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4538                                      BPF_FUNC_map_lookup_elem),
4539                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4540                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4541                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4542                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4543                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4544                                    offsetof(struct test_val, foo)),
4545                         BPF_EXIT_INSN(),
4546                 },
4547                 .fixup_map2 = { 3 },
4548                 .errstr = "R0 unbounded memory access, make sure to bounds check any array access into a map",
4549                 .result = REJECT,
4550                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4551         },
4552         {
4553                 "invalid map access into an array with no floor check",
4554                 .insns = {
4555                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4556                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4557                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4558                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4559                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4560                                      BPF_FUNC_map_lookup_elem),
4561                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4562                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
4563                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
4564                         BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
4565                         BPF_MOV32_IMM(BPF_REG_1, 0),
4566                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
4567                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4568                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4569                                    offsetof(struct test_val, foo)),
4570                         BPF_EXIT_INSN(),
4571                 },
4572                 .fixup_map2 = { 3 },
4573                 .errstr_unpriv = "R0 leaks addr",
4574                 .errstr = "R0 unbounded memory access",
4575                 .result_unpriv = REJECT,
4576                 .result = REJECT,
4577                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4578         },
4579         {
4580                 "invalid map access into an array with a invalid max check",
4581                 .insns = {
4582                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4583                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4584                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4585                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4586                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4587                                      BPF_FUNC_map_lookup_elem),
4588                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4589                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4590                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES + 1),
4591                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
4592                         BPF_MOV32_IMM(BPF_REG_1, 0),
4593                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
4594                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4595                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4596                                    offsetof(struct test_val, foo)),
4597                         BPF_EXIT_INSN(),
4598                 },
4599                 .fixup_map2 = { 3 },
4600                 .errstr_unpriv = "R0 leaks addr",
4601                 .errstr = "invalid access to map value, value_size=48 off=44 size=8",
4602                 .result_unpriv = REJECT,
4603                 .result = REJECT,
4604                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4605         },
4606         {
4607                 "invalid map access into an array with a invalid max check",
4608                 .insns = {
4609                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4610                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4611                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4612                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4613                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4614                                      BPF_FUNC_map_lookup_elem),
4615                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
4616                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
4617                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4618                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4619                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4620                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4621                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4622                                      BPF_FUNC_map_lookup_elem),
4623                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
4624                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
4625                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
4626                                     offsetof(struct test_val, foo)),
4627                         BPF_EXIT_INSN(),
4628                 },
4629                 .fixup_map2 = { 3, 11 },
4630                 .errstr = "R0 pointer += pointer",
4631                 .result = REJECT,
4632                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4633         },
4634         {
4635                 "valid cgroup storage access",
4636                 .insns = {
4637                         BPF_MOV64_IMM(BPF_REG_2, 0),
4638                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4639                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4640                                      BPF_FUNC_get_local_storage),
4641                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4642                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
4643                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
4644                         BPF_EXIT_INSN(),
4645                 },
4646                 .fixup_cgroup_storage = { 1 },
4647                 .result = ACCEPT,
4648                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4649         },
4650         {
4651                 "invalid cgroup storage access 1",
4652                 .insns = {
4653                         BPF_MOV64_IMM(BPF_REG_2, 0),
4654                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4655                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4656                                      BPF_FUNC_get_local_storage),
4657                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4658                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
4659                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
4660                         BPF_EXIT_INSN(),
4661                 },
4662                 .fixup_map1 = { 1 },
4663                 .result = REJECT,
4664                 .errstr = "cannot pass map_type 1 into func bpf_get_local_storage",
4665                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4666         },
4667         {
4668                 "invalid cgroup storage access 2",
4669                 .insns = {
4670                         BPF_MOV64_IMM(BPF_REG_2, 0),
4671                         BPF_LD_MAP_FD(BPF_REG_1, 1),
4672                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4673                                      BPF_FUNC_get_local_storage),
4674                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
4675                         BPF_EXIT_INSN(),
4676                 },
4677                 .result = REJECT,
4678                 .errstr = "fd 1 is not pointing to valid bpf_map",
4679                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4680         },
4681         {
4682                 "invalid per-cgroup storage access 3",
4683                 .insns = {
4684                         BPF_MOV64_IMM(BPF_REG_2, 0),
4685                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4686                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4687                                      BPF_FUNC_get_local_storage),
4688                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 256),
4689                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
4690                         BPF_MOV64_IMM(BPF_REG_0, 0),
4691                         BPF_EXIT_INSN(),
4692                 },
4693                 .fixup_cgroup_storage = { 1 },
4694                 .result = REJECT,
4695                 .errstr = "invalid access to map value, value_size=64 off=256 size=4",
4696                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4697         },
4698         {
4699                 "invalid cgroup storage access 4",
4700                 .insns = {
4701                         BPF_MOV64_IMM(BPF_REG_2, 0),
4702                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4703                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4704                                      BPF_FUNC_get_local_storage),
4705                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, -2),
4706                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
4707                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
4708                         BPF_EXIT_INSN(),
4709                 },
4710                 .fixup_cgroup_storage = { 1 },
4711                 .result = REJECT,
4712                 .errstr = "invalid access to map value, value_size=64 off=-2 size=4",
4713                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4714         },
4715         {
4716                 "invalid cgroup storage access 5",
4717                 .insns = {
4718                         BPF_MOV64_IMM(BPF_REG_2, 7),
4719                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4720                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4721                                      BPF_FUNC_get_local_storage),
4722                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4723                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
4724                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
4725                         BPF_EXIT_INSN(),
4726                 },
4727                 .fixup_cgroup_storage = { 1 },
4728                 .result = REJECT,
4729                 .errstr = "get_local_storage() doesn't support non-zero flags",
4730                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4731         },
4732         {
4733                 "invalid cgroup storage access 6",
4734                 .insns = {
4735                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
4736                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4737                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4738                                      BPF_FUNC_get_local_storage),
4739                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4740                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
4741                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
4742                         BPF_EXIT_INSN(),
4743                 },
4744                 .fixup_cgroup_storage = { 1 },
4745                 .result = REJECT,
4746                 .errstr = "get_local_storage() doesn't support non-zero flags",
4747                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4748         },
4749         {
4750                 "multiple registers share map_lookup_elem result",
4751                 .insns = {
4752                         BPF_MOV64_IMM(BPF_REG_1, 10),
4753                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4754                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4755                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4756                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4757                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4758                                      BPF_FUNC_map_lookup_elem),
4759                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4760                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4761                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4762                         BPF_EXIT_INSN(),
4763                 },
4764                 .fixup_map1 = { 4 },
4765                 .result = ACCEPT,
4766                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4767         },
4768         {
4769                 "alu ops on ptr_to_map_value_or_null, 1",
4770                 .insns = {
4771                         BPF_MOV64_IMM(BPF_REG_1, 10),
4772                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4773                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4774                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4775                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4776                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4777                                      BPF_FUNC_map_lookup_elem),
4778                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4779                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -2),
4780                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 2),
4781                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4782                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4783                         BPF_EXIT_INSN(),
4784                 },
4785                 .fixup_map1 = { 4 },
4786                 .errstr = "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",
4787                 .result = REJECT,
4788                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4789         },
4790         {
4791                 "alu ops on ptr_to_map_value_or_null, 2",
4792                 .insns = {
4793                         BPF_MOV64_IMM(BPF_REG_1, 10),
4794                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4795                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4796                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4797                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4798                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4799                                      BPF_FUNC_map_lookup_elem),
4800                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4801                         BPF_ALU64_IMM(BPF_AND, BPF_REG_4, -1),
4802                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4803                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4804                         BPF_EXIT_INSN(),
4805                 },
4806                 .fixup_map1 = { 4 },
4807                 .errstr = "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",
4808                 .result = REJECT,
4809                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4810         },
4811         {
4812                 "alu ops on ptr_to_map_value_or_null, 3",
4813                 .insns = {
4814                         BPF_MOV64_IMM(BPF_REG_1, 10),
4815                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4816                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4817                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4818                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4819                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4820                                      BPF_FUNC_map_lookup_elem),
4821                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4822                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_4, 1),
4823                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4824                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4825                         BPF_EXIT_INSN(),
4826                 },
4827                 .fixup_map1 = { 4 },
4828                 .errstr = "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",
4829                 .result = REJECT,
4830                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4831         },
4832         {
4833                 "invalid memory access with multiple map_lookup_elem calls",
4834                 .insns = {
4835                         BPF_MOV64_IMM(BPF_REG_1, 10),
4836                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4837                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4838                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4839                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4840                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
4841                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
4842                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4843                                      BPF_FUNC_map_lookup_elem),
4844                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4845                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
4846                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
4847                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4848                                      BPF_FUNC_map_lookup_elem),
4849                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4850                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4851                         BPF_EXIT_INSN(),
4852                 },
4853                 .fixup_map1 = { 4 },
4854                 .result = REJECT,
4855                 .errstr = "R4 !read_ok",
4856                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4857         },
4858         {
4859                 "valid indirect map_lookup_elem access with 2nd lookup in branch",
4860                 .insns = {
4861                         BPF_MOV64_IMM(BPF_REG_1, 10),
4862                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4863                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4864                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4865                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4866                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
4867                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
4868                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4869                                      BPF_FUNC_map_lookup_elem),
4870                         BPF_MOV64_IMM(BPF_REG_2, 10),
4871                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 3),
4872                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
4873                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
4874                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4875                                      BPF_FUNC_map_lookup_elem),
4876                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4877                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4878                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4879                         BPF_EXIT_INSN(),
4880                 },
4881                 .fixup_map1 = { 4 },
4882                 .result = ACCEPT,
4883                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4884         },
4885         {
4886                 "invalid map access from else condition",
4887                 .insns = {
4888                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4889                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4890                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4891                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4892                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
4893                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4894                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4895                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES-1, 1),
4896                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
4897                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4898                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4899                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
4900                         BPF_EXIT_INSN(),
4901                 },
4902                 .fixup_map2 = { 3 },
4903                 .errstr = "R0 unbounded memory access",
4904                 .result = REJECT,
4905                 .errstr_unpriv = "R0 leaks addr",
4906                 .result_unpriv = REJECT,
4907                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4908         },
4909         {
4910                 "constant register |= constant should keep constant type",
4911                 .insns = {
4912                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4913                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
4914                         BPF_MOV64_IMM(BPF_REG_2, 34),
4915                         BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 13),
4916                         BPF_MOV64_IMM(BPF_REG_3, 0),
4917                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4918                         BPF_EXIT_INSN(),
4919                 },
4920                 .result = ACCEPT,
4921                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4922         },
4923         {
4924                 "constant register |= constant should not bypass stack boundary checks",
4925                 .insns = {
4926                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4927                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
4928                         BPF_MOV64_IMM(BPF_REG_2, 34),
4929                         BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 24),
4930                         BPF_MOV64_IMM(BPF_REG_3, 0),
4931                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4932                         BPF_EXIT_INSN(),
4933                 },
4934                 .errstr = "invalid stack type R1 off=-48 access_size=58",
4935                 .result = REJECT,
4936                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4937         },
4938         {
4939                 "constant register |= constant register should keep constant type",
4940                 .insns = {
4941                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4942                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
4943                         BPF_MOV64_IMM(BPF_REG_2, 34),
4944                         BPF_MOV64_IMM(BPF_REG_4, 13),
4945                         BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
4946                         BPF_MOV64_IMM(BPF_REG_3, 0),
4947                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4948                         BPF_EXIT_INSN(),
4949                 },
4950                 .result = ACCEPT,
4951                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4952         },
4953         {
4954                 "constant register |= constant register should not bypass stack boundary checks",
4955                 .insns = {
4956                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4957                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
4958                         BPF_MOV64_IMM(BPF_REG_2, 34),
4959                         BPF_MOV64_IMM(BPF_REG_4, 24),
4960                         BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
4961                         BPF_MOV64_IMM(BPF_REG_3, 0),
4962                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4963                         BPF_EXIT_INSN(),
4964                 },
4965                 .errstr = "invalid stack type R1 off=-48 access_size=58",
4966                 .result = REJECT,
4967                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4968         },
4969         {
4970                 "invalid direct packet write for LWT_IN",
4971                 .insns = {
4972                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4973                                     offsetof(struct __sk_buff, data)),
4974                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4975                                     offsetof(struct __sk_buff, data_end)),
4976                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4977                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4978                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4979                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
4980                         BPF_MOV64_IMM(BPF_REG_0, 0),
4981                         BPF_EXIT_INSN(),
4982                 },
4983                 .errstr = "cannot write into packet",
4984                 .result = REJECT,
4985                 .prog_type = BPF_PROG_TYPE_LWT_IN,
4986         },
4987         {
4988                 "invalid direct packet write for LWT_OUT",
4989                 .insns = {
4990                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4991                                     offsetof(struct __sk_buff, data)),
4992                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4993                                     offsetof(struct __sk_buff, data_end)),
4994                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4995                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4996                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4997                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
4998                         BPF_MOV64_IMM(BPF_REG_0, 0),
4999                         BPF_EXIT_INSN(),
5000                 },
5001                 .errstr = "cannot write into packet",
5002                 .result = REJECT,
5003                 .prog_type = BPF_PROG_TYPE_LWT_OUT,
5004         },
5005         {
5006                 "direct packet write for LWT_XMIT",
5007                 .insns = {
5008                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5009                                     offsetof(struct __sk_buff, data)),
5010                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5011                                     offsetof(struct __sk_buff, data_end)),
5012                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5013                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5014                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5015                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
5016                         BPF_MOV64_IMM(BPF_REG_0, 0),
5017                         BPF_EXIT_INSN(),
5018                 },
5019                 .result = ACCEPT,
5020                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
5021         },
5022         {
5023                 "direct packet read for LWT_IN",
5024                 .insns = {
5025                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5026                                     offsetof(struct __sk_buff, data)),
5027                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5028                                     offsetof(struct __sk_buff, data_end)),
5029                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5030                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5031                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5032                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
5033                         BPF_MOV64_IMM(BPF_REG_0, 0),
5034                         BPF_EXIT_INSN(),
5035                 },
5036                 .result = ACCEPT,
5037                 .prog_type = BPF_PROG_TYPE_LWT_IN,
5038         },
5039         {
5040                 "direct packet read for LWT_OUT",
5041                 .insns = {
5042                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5043                                     offsetof(struct __sk_buff, data)),
5044                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5045                                     offsetof(struct __sk_buff, data_end)),
5046                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5047                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5048                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5049                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
5050                         BPF_MOV64_IMM(BPF_REG_0, 0),
5051                         BPF_EXIT_INSN(),
5052                 },
5053                 .result = ACCEPT,
5054                 .prog_type = BPF_PROG_TYPE_LWT_OUT,
5055         },
5056         {
5057                 "direct packet read for LWT_XMIT",
5058                 .insns = {
5059                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5060                                     offsetof(struct __sk_buff, data)),
5061                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5062                                     offsetof(struct __sk_buff, data_end)),
5063                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5064                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5065                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5066                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
5067                         BPF_MOV64_IMM(BPF_REG_0, 0),
5068                         BPF_EXIT_INSN(),
5069                 },
5070                 .result = ACCEPT,
5071                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
5072         },
5073         {
5074                 "overlapping checks for direct packet access",
5075                 .insns = {
5076                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5077                                     offsetof(struct __sk_buff, data)),
5078                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5079                                     offsetof(struct __sk_buff, data_end)),
5080                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5081                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5082                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
5083                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
5084                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
5085                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
5086                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
5087                         BPF_MOV64_IMM(BPF_REG_0, 0),
5088                         BPF_EXIT_INSN(),
5089                 },
5090                 .result = ACCEPT,
5091                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
5092         },
5093         {
5094                 "make headroom for LWT_XMIT",
5095                 .insns = {
5096                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5097                         BPF_MOV64_IMM(BPF_REG_2, 34),
5098                         BPF_MOV64_IMM(BPF_REG_3, 0),
5099                         BPF_EMIT_CALL(BPF_FUNC_skb_change_head),
5100                         /* split for s390 to succeed */
5101                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
5102                         BPF_MOV64_IMM(BPF_REG_2, 42),
5103                         BPF_MOV64_IMM(BPF_REG_3, 0),
5104                         BPF_EMIT_CALL(BPF_FUNC_skb_change_head),
5105                         BPF_MOV64_IMM(BPF_REG_0, 0),
5106                         BPF_EXIT_INSN(),
5107                 },
5108                 .result = ACCEPT,
5109                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
5110         },
5111         {
5112                 "invalid access of tc_classid for LWT_IN",
5113                 .insns = {
5114                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
5115                                     offsetof(struct __sk_buff, tc_classid)),
5116                         BPF_EXIT_INSN(),
5117                 },
5118                 .result = REJECT,
5119                 .errstr = "invalid bpf_context access",
5120         },
5121         {
5122                 "invalid access of tc_classid for LWT_OUT",
5123                 .insns = {
5124                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
5125                                     offsetof(struct __sk_buff, tc_classid)),
5126                         BPF_EXIT_INSN(),
5127                 },
5128                 .result = REJECT,
5129                 .errstr = "invalid bpf_context access",
5130         },
5131         {
5132                 "invalid access of tc_classid for LWT_XMIT",
5133                 .insns = {
5134                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
5135                                     offsetof(struct __sk_buff, tc_classid)),
5136                         BPF_EXIT_INSN(),
5137                 },
5138                 .result = REJECT,
5139                 .errstr = "invalid bpf_context access",
5140         },
5141         {
5142                 "leak pointer into ctx 1",
5143                 .insns = {
5144                         BPF_MOV64_IMM(BPF_REG_0, 0),
5145                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
5146                                     offsetof(struct __sk_buff, cb[0])),
5147                         BPF_LD_MAP_FD(BPF_REG_2, 0),
5148                         BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_2,
5149                                       offsetof(struct __sk_buff, cb[0])),
5150                         BPF_EXIT_INSN(),
5151                 },
5152                 .fixup_map1 = { 2 },
5153                 .errstr_unpriv = "R2 leaks addr into mem",
5154                 .result_unpriv = REJECT,
5155                 .result = REJECT,
5156                 .errstr = "BPF_XADD stores into R1 context is not allowed",
5157         },
5158         {
5159                 "leak pointer into ctx 2",
5160                 .insns = {
5161                         BPF_MOV64_IMM(BPF_REG_0, 0),
5162                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
5163                                     offsetof(struct __sk_buff, cb[0])),
5164                         BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_10,
5165                                       offsetof(struct __sk_buff, cb[0])),
5166                         BPF_EXIT_INSN(),
5167                 },
5168                 .errstr_unpriv = "R10 leaks addr into mem",
5169                 .result_unpriv = REJECT,
5170                 .result = REJECT,
5171                 .errstr = "BPF_XADD stores into R1 context is not allowed",
5172         },
5173         {
5174                 "leak pointer into ctx 3",
5175                 .insns = {
5176                         BPF_MOV64_IMM(BPF_REG_0, 0),
5177                         BPF_LD_MAP_FD(BPF_REG_2, 0),
5178                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2,
5179                                       offsetof(struct __sk_buff, cb[0])),
5180                         BPF_EXIT_INSN(),
5181                 },
5182                 .fixup_map1 = { 1 },
5183                 .errstr_unpriv = "R2 leaks addr into ctx",
5184                 .result_unpriv = REJECT,
5185                 .result = ACCEPT,
5186         },
5187         {
5188                 "leak pointer into map val",
5189                 .insns = {
5190                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5191                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5192                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5193                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5194                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5195                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5196                                      BPF_FUNC_map_lookup_elem),
5197                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
5198                         BPF_MOV64_IMM(BPF_REG_3, 0),
5199                         BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
5200                         BPF_STX_XADD(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
5201                         BPF_MOV64_IMM(BPF_REG_0, 0),
5202                         BPF_EXIT_INSN(),
5203                 },
5204                 .fixup_map1 = { 4 },
5205                 .errstr_unpriv = "R6 leaks addr into mem",
5206                 .result_unpriv = REJECT,
5207                 .result = ACCEPT,
5208         },
5209         {
5210                 "helper access to map: full range",
5211                 .insns = {
5212                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5213                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5214                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5215                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5216                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5217                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5218                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5219                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
5220                         BPF_MOV64_IMM(BPF_REG_3, 0),
5221                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5222                         BPF_EXIT_INSN(),
5223                 },
5224                 .fixup_map2 = { 3 },
5225                 .result = ACCEPT,
5226                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5227         },
5228         {
5229                 "helper access to map: partial range",
5230                 .insns = {
5231                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5232                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5233                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5234                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5235                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5236                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5237                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5238                         BPF_MOV64_IMM(BPF_REG_2, 8),
5239                         BPF_MOV64_IMM(BPF_REG_3, 0),
5240                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5241                         BPF_EXIT_INSN(),
5242                 },
5243                 .fixup_map2 = { 3 },
5244                 .result = ACCEPT,
5245                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5246         },
5247         {
5248                 "helper access to map: empty range",
5249                 .insns = {
5250                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5251                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5252                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5253                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5254                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5255                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
5256                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5257                         BPF_MOV64_IMM(BPF_REG_2, 0),
5258                         BPF_EMIT_CALL(BPF_FUNC_trace_printk),
5259                         BPF_EXIT_INSN(),
5260                 },
5261                 .fixup_map2 = { 3 },
5262                 .errstr = "invalid access to map value, value_size=48 off=0 size=0",
5263                 .result = REJECT,
5264                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5265         },
5266         {
5267                 "helper access to map: out-of-bound range",
5268                 .insns = {
5269                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5270                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5271                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5272                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5273                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5274                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5275                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5276                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val) + 8),
5277                         BPF_MOV64_IMM(BPF_REG_3, 0),
5278                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5279                         BPF_EXIT_INSN(),
5280                 },
5281                 .fixup_map2 = { 3 },
5282                 .errstr = "invalid access to map value, value_size=48 off=0 size=56",
5283                 .result = REJECT,
5284                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5285         },
5286         {
5287                 "helper access to map: negative range",
5288                 .insns = {
5289                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5290                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5291                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5292                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5293                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5294                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5295                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5296                         BPF_MOV64_IMM(BPF_REG_2, -8),
5297                         BPF_MOV64_IMM(BPF_REG_3, 0),
5298                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5299                         BPF_EXIT_INSN(),
5300                 },
5301                 .fixup_map2 = { 3 },
5302                 .errstr = "R2 min value is negative",
5303                 .result = REJECT,
5304                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5305         },
5306         {
5307                 "helper access to adjusted map (via const imm): full range",
5308                 .insns = {
5309                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5310                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5311                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5312                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5313                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5314                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5315                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5316                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5317                                 offsetof(struct test_val, foo)),
5318                         BPF_MOV64_IMM(BPF_REG_2,
5319                                 sizeof(struct test_val) -
5320                                 offsetof(struct test_val, foo)),
5321                         BPF_MOV64_IMM(BPF_REG_3, 0),
5322                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5323                         BPF_EXIT_INSN(),
5324                 },
5325                 .fixup_map2 = { 3 },
5326                 .result = ACCEPT,
5327                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5328         },
5329         {
5330                 "helper access to adjusted map (via const imm): partial range",
5331                 .insns = {
5332                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5333                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5334                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5335                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5336                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5337                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5338                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5339                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5340                                 offsetof(struct test_val, foo)),
5341                         BPF_MOV64_IMM(BPF_REG_2, 8),
5342                         BPF_MOV64_IMM(BPF_REG_3, 0),
5343                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5344                         BPF_EXIT_INSN(),
5345                 },
5346                 .fixup_map2 = { 3 },
5347                 .result = ACCEPT,
5348                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5349         },
5350         {
5351                 "helper access to adjusted map (via const imm): empty range",
5352                 .insns = {
5353                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5354                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5355                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5356                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5357                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5358                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5359                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5360                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5361                                 offsetof(struct test_val, foo)),
5362                         BPF_MOV64_IMM(BPF_REG_2, 0),
5363                         BPF_EMIT_CALL(BPF_FUNC_trace_printk),
5364                         BPF_EXIT_INSN(),
5365                 },
5366                 .fixup_map2 = { 3 },
5367                 .errstr = "invalid access to map value, value_size=48 off=4 size=0",
5368                 .result = REJECT,
5369                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5370         },
5371         {
5372                 "helper access to adjusted map (via const imm): out-of-bound range",
5373                 .insns = {
5374                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5375                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5376                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5377                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5378                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5379                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5380                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5381                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5382                                 offsetof(struct test_val, foo)),
5383                         BPF_MOV64_IMM(BPF_REG_2,
5384                                 sizeof(struct test_val) -
5385                                 offsetof(struct test_val, foo) + 8),
5386                         BPF_MOV64_IMM(BPF_REG_3, 0),
5387                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5388                         BPF_EXIT_INSN(),
5389                 },
5390                 .fixup_map2 = { 3 },
5391                 .errstr = "invalid access to map value, value_size=48 off=4 size=52",
5392                 .result = REJECT,
5393                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5394         },
5395         {
5396                 "helper access to adjusted map (via const imm): negative range (> adjustment)",
5397                 .insns = {
5398                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5399                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5400                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5401                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5402                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5403                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5404                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5405                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5406                                 offsetof(struct test_val, foo)),
5407                         BPF_MOV64_IMM(BPF_REG_2, -8),
5408                         BPF_MOV64_IMM(BPF_REG_3, 0),
5409                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5410                         BPF_EXIT_INSN(),
5411                 },
5412                 .fixup_map2 = { 3 },
5413                 .errstr = "R2 min value is negative",
5414                 .result = REJECT,
5415                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5416         },
5417         {
5418                 "helper access to adjusted map (via const imm): negative range (< adjustment)",
5419                 .insns = {
5420                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5421                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5422                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5423                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5424                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5425                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5426                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5427                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5428                                 offsetof(struct test_val, foo)),
5429                         BPF_MOV64_IMM(BPF_REG_2, -1),
5430                         BPF_MOV64_IMM(BPF_REG_3, 0),
5431                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5432                         BPF_EXIT_INSN(),
5433                 },
5434                 .fixup_map2 = { 3 },
5435                 .errstr = "R2 min value is negative",
5436                 .result = REJECT,
5437                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5438         },
5439         {
5440                 "helper access to adjusted map (via const reg): full range",
5441                 .insns = {
5442                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5443                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5444                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5445                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5446                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5447                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5448                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5449                         BPF_MOV64_IMM(BPF_REG_3,
5450                                 offsetof(struct test_val, foo)),
5451                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5452                         BPF_MOV64_IMM(BPF_REG_2,
5453                                 sizeof(struct test_val) -
5454                                 offsetof(struct test_val, foo)),
5455                         BPF_MOV64_IMM(BPF_REG_3, 0),
5456                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5457                         BPF_EXIT_INSN(),
5458                 },
5459                 .fixup_map2 = { 3 },
5460                 .result = ACCEPT,
5461                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5462         },
5463         {
5464                 "helper access to adjusted map (via const reg): partial range",
5465                 .insns = {
5466                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5467                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5468                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5469                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5470                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5471                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5472                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5473                         BPF_MOV64_IMM(BPF_REG_3,
5474                                 offsetof(struct test_val, foo)),
5475                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5476                         BPF_MOV64_IMM(BPF_REG_2, 8),
5477                         BPF_MOV64_IMM(BPF_REG_3, 0),
5478                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5479                         BPF_EXIT_INSN(),
5480                 },
5481                 .fixup_map2 = { 3 },
5482                 .result = ACCEPT,
5483                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5484         },
5485         {
5486                 "helper access to adjusted map (via const reg): empty range",
5487                 .insns = {
5488                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5489                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5490                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5491                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5492                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5493                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5494                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5495                         BPF_MOV64_IMM(BPF_REG_3, 0),
5496                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5497                         BPF_MOV64_IMM(BPF_REG_2, 0),
5498                         BPF_EMIT_CALL(BPF_FUNC_trace_printk),
5499                         BPF_EXIT_INSN(),
5500                 },
5501                 .fixup_map2 = { 3 },
5502                 .errstr = "R1 min value is outside of the array range",
5503                 .result = REJECT,
5504                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5505         },
5506         {
5507                 "helper access to adjusted map (via const reg): out-of-bound range",
5508                 .insns = {
5509                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5510                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5511                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5512                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5513                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5514                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5515                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5516                         BPF_MOV64_IMM(BPF_REG_3,
5517                                 offsetof(struct test_val, foo)),
5518                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5519                         BPF_MOV64_IMM(BPF_REG_2,
5520                                 sizeof(struct test_val) -
5521                                 offsetof(struct test_val, foo) + 8),
5522                         BPF_MOV64_IMM(BPF_REG_3, 0),
5523                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5524                         BPF_EXIT_INSN(),
5525                 },
5526                 .fixup_map2 = { 3 },
5527                 .errstr = "invalid access to map value, value_size=48 off=4 size=52",
5528                 .result = REJECT,
5529                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5530         },
5531         {
5532                 "helper access to adjusted map (via const reg): negative range (> adjustment)",
5533                 .insns = {
5534                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5535                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5536                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5537                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5538                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5539                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5540                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5541                         BPF_MOV64_IMM(BPF_REG_3,
5542                                 offsetof(struct test_val, foo)),
5543                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5544                         BPF_MOV64_IMM(BPF_REG_2, -8),
5545                         BPF_MOV64_IMM(BPF_REG_3, 0),
5546                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5547                         BPF_EXIT_INSN(),
5548                 },
5549                 .fixup_map2 = { 3 },
5550                 .errstr = "R2 min value is negative",
5551                 .result = REJECT,
5552                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5553         },
5554         {
5555                 "helper access to adjusted map (via const reg): negative range (< adjustment)",
5556                 .insns = {
5557                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5558                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5559                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5560                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5561                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5562                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5563                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5564                         BPF_MOV64_IMM(BPF_REG_3,
5565                                 offsetof(struct test_val, foo)),
5566                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5567                         BPF_MOV64_IMM(BPF_REG_2, -1),
5568                         BPF_MOV64_IMM(BPF_REG_3, 0),
5569                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5570                         BPF_EXIT_INSN(),
5571                 },
5572                 .fixup_map2 = { 3 },
5573                 .errstr = "R2 min value is negative",
5574                 .result = REJECT,
5575                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5576         },
5577         {
5578                 "helper access to adjusted map (via variable): full range",
5579                 .insns = {
5580                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5581                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5582                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5583                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5584                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5585                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5586                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5587                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5588                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
5589                                 offsetof(struct test_val, foo), 4),
5590                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5591                         BPF_MOV64_IMM(BPF_REG_2,
5592                                 sizeof(struct test_val) -
5593                                 offsetof(struct test_val, foo)),
5594                         BPF_MOV64_IMM(BPF_REG_3, 0),
5595                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5596                         BPF_EXIT_INSN(),
5597                 },
5598                 .fixup_map2 = { 3 },
5599                 .result = ACCEPT,
5600                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5601         },
5602         {
5603                 "helper access to adjusted map (via variable): partial range",
5604                 .insns = {
5605                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5606                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5607                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5608                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5609                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5610                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5611                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5612                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5613                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
5614                                 offsetof(struct test_val, foo), 4),
5615                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5616                         BPF_MOV64_IMM(BPF_REG_2, 8),
5617                         BPF_MOV64_IMM(BPF_REG_3, 0),
5618                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5619                         BPF_EXIT_INSN(),
5620                 },
5621                 .fixup_map2 = { 3 },
5622                 .result = ACCEPT,
5623                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5624         },
5625         {
5626                 "helper access to adjusted map (via variable): empty range",
5627                 .insns = {
5628                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5629                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5630                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5631                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5632                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5633                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5634                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5635                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5636                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
5637                                 offsetof(struct test_val, foo), 3),
5638                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5639                         BPF_MOV64_IMM(BPF_REG_2, 0),
5640                         BPF_EMIT_CALL(BPF_FUNC_trace_printk),
5641                         BPF_EXIT_INSN(),
5642                 },
5643                 .fixup_map2 = { 3 },
5644                 .errstr = "R1 min value is outside of the array range",
5645                 .result = REJECT,
5646                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5647         },
5648         {
5649                 "helper access to adjusted map (via variable): no max check",
5650                 .insns = {
5651                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5652                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5653                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5654                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5655                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5656                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5657                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5658                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5659                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5660                         BPF_MOV64_IMM(BPF_REG_2, 1),
5661                         BPF_MOV64_IMM(BPF_REG_3, 0),
5662                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5663                         BPF_EXIT_INSN(),
5664                 },
5665                 .fixup_map2 = { 3 },
5666                 .errstr = "R1 unbounded memory access",
5667                 .result = REJECT,
5668                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5669         },
5670         {
5671                 "helper access to adjusted map (via variable): wrong max check",
5672                 .insns = {
5673                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5674                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5675                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5676                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5677                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5678                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5679                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5680                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5681                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
5682                                 offsetof(struct test_val, foo), 4),
5683                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5684                         BPF_MOV64_IMM(BPF_REG_2,
5685                                 sizeof(struct test_val) -
5686                                 offsetof(struct test_val, foo) + 1),
5687                         BPF_MOV64_IMM(BPF_REG_3, 0),
5688                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5689                         BPF_EXIT_INSN(),
5690                 },
5691                 .fixup_map2 = { 3 },
5692                 .errstr = "invalid access to map value, value_size=48 off=4 size=45",
5693                 .result = REJECT,
5694                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5695         },
5696         {
5697                 "helper access to map: bounds check using <, good access",
5698                 .insns = {
5699                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5700                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5701                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5702                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5703                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5704                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5705                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5706                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5707                         BPF_JMP_IMM(BPF_JLT, BPF_REG_3, 32, 2),
5708                         BPF_MOV64_IMM(BPF_REG_0, 0),
5709                         BPF_EXIT_INSN(),
5710                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5711                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5712                         BPF_MOV64_IMM(BPF_REG_0, 0),
5713                         BPF_EXIT_INSN(),
5714                 },
5715                 .fixup_map2 = { 3 },
5716                 .result = ACCEPT,
5717                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5718         },
5719         {
5720                 "helper access to map: bounds check using <, bad access",
5721                 .insns = {
5722                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5723                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5724                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5725                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5726                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5727                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5728                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5729                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5730                         BPF_JMP_IMM(BPF_JLT, BPF_REG_3, 32, 4),
5731                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5732                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5733                         BPF_MOV64_IMM(BPF_REG_0, 0),
5734                         BPF_EXIT_INSN(),
5735                         BPF_MOV64_IMM(BPF_REG_0, 0),
5736                         BPF_EXIT_INSN(),
5737                 },
5738                 .fixup_map2 = { 3 },
5739                 .result = REJECT,
5740                 .errstr = "R1 unbounded memory access",
5741                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5742         },
5743         {
5744                 "helper access to map: bounds check using <=, good access",
5745                 .insns = {
5746                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5747                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5748                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5749                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5750                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5751                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5752                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5753                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5754                         BPF_JMP_IMM(BPF_JLE, BPF_REG_3, 32, 2),
5755                         BPF_MOV64_IMM(BPF_REG_0, 0),
5756                         BPF_EXIT_INSN(),
5757                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5758                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5759                         BPF_MOV64_IMM(BPF_REG_0, 0),
5760                         BPF_EXIT_INSN(),
5761                 },
5762                 .fixup_map2 = { 3 },
5763                 .result = ACCEPT,
5764                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5765         },
5766         {
5767                 "helper access to map: bounds check using <=, bad access",
5768                 .insns = {
5769                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5770                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5771                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5772                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5773                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5774                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5775                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5776                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5777                         BPF_JMP_IMM(BPF_JLE, BPF_REG_3, 32, 4),
5778                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5779                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5780                         BPF_MOV64_IMM(BPF_REG_0, 0),
5781                         BPF_EXIT_INSN(),
5782                         BPF_MOV64_IMM(BPF_REG_0, 0),
5783                         BPF_EXIT_INSN(),
5784                 },
5785                 .fixup_map2 = { 3 },
5786                 .result = REJECT,
5787                 .errstr = "R1 unbounded memory access",
5788                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5789         },
5790         {
5791                 "helper access to map: bounds check using s<, good access",
5792                 .insns = {
5793                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5794                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5795                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5796                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5797                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5798                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5799                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5800                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5801                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
5802                         BPF_MOV64_IMM(BPF_REG_0, 0),
5803                         BPF_EXIT_INSN(),
5804                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 0, -3),
5805                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5806                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5807                         BPF_MOV64_IMM(BPF_REG_0, 0),
5808                         BPF_EXIT_INSN(),
5809                 },
5810                 .fixup_map2 = { 3 },
5811                 .result = ACCEPT,
5812                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5813         },
5814         {
5815                 "helper access to map: bounds check using s<, good access 2",
5816                 .insns = {
5817                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5818                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5819                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5820                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5821                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5822                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5823                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5824                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5825                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
5826                         BPF_MOV64_IMM(BPF_REG_0, 0),
5827                         BPF_EXIT_INSN(),
5828                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, -3, -3),
5829                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5830                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5831                         BPF_MOV64_IMM(BPF_REG_0, 0),
5832                         BPF_EXIT_INSN(),
5833                 },
5834                 .fixup_map2 = { 3 },
5835                 .result = ACCEPT,
5836                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5837         },
5838         {
5839                 "helper access to map: bounds check using s<, bad access",
5840                 .insns = {
5841                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5842                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5843                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5844                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5845                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5846                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5847                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5848                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
5849                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
5850                         BPF_MOV64_IMM(BPF_REG_0, 0),
5851                         BPF_EXIT_INSN(),
5852                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, -3, -3),
5853                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5854                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5855                         BPF_MOV64_IMM(BPF_REG_0, 0),
5856                         BPF_EXIT_INSN(),
5857                 },
5858                 .fixup_map2 = { 3 },
5859                 .result = REJECT,
5860                 .errstr = "R1 min value is negative",
5861                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5862         },
5863         {
5864                 "helper access to map: bounds check using s<=, good access",
5865                 .insns = {
5866                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5867                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5868                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5869                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5870                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5871                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5872                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5873                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5874                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
5875                         BPF_MOV64_IMM(BPF_REG_0, 0),
5876                         BPF_EXIT_INSN(),
5877                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 0, -3),
5878                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5879                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5880                         BPF_MOV64_IMM(BPF_REG_0, 0),
5881                         BPF_EXIT_INSN(),
5882                 },
5883                 .fixup_map2 = { 3 },
5884                 .result = ACCEPT,
5885                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5886         },
5887         {
5888                 "helper access to map: bounds check using s<=, good access 2",
5889                 .insns = {
5890                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5891                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5892                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5893                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5894                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5895                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5896                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5897                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5898                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
5899                         BPF_MOV64_IMM(BPF_REG_0, 0),
5900                         BPF_EXIT_INSN(),
5901                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, -3, -3),
5902                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5903                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5904                         BPF_MOV64_IMM(BPF_REG_0, 0),
5905                         BPF_EXIT_INSN(),
5906                 },
5907                 .fixup_map2 = { 3 },
5908                 .result = ACCEPT,
5909                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5910         },
5911         {
5912                 "helper access to map: bounds check using s<=, bad access",
5913                 .insns = {
5914                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5915                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5916                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5917                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5918                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5919                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5920                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5921                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
5922                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
5923                         BPF_MOV64_IMM(BPF_REG_0, 0),
5924                         BPF_EXIT_INSN(),
5925                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, -3, -3),
5926                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5927                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5928                         BPF_MOV64_IMM(BPF_REG_0, 0),
5929                         BPF_EXIT_INSN(),
5930                 },
5931                 .fixup_map2 = { 3 },
5932                 .result = REJECT,
5933                 .errstr = "R1 min value is negative",
5934                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5935         },
5936         {
5937                 "map lookup helper access to map",
5938                 .insns = {
5939                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5940                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5941                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5942                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5943                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5944                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5945                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
5946                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5947                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5948                         BPF_EXIT_INSN(),
5949                 },
5950                 .fixup_map3 = { 3, 8 },
5951                 .result = ACCEPT,
5952                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5953         },
5954         {
5955                 "map update helper access to map",
5956                 .insns = {
5957                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5958                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5959                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5960                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5961                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5962                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5963                         BPF_MOV64_IMM(BPF_REG_4, 0),
5964                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
5965                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
5966                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5967                         BPF_EMIT_CALL(BPF_FUNC_map_update_elem),
5968                         BPF_EXIT_INSN(),
5969                 },
5970                 .fixup_map3 = { 3, 10 },
5971                 .result = ACCEPT,
5972                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5973         },
5974         {
5975                 "map update helper access to map: wrong size",
5976                 .insns = {
5977                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5978                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5979                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5980                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5981                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5982                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5983                         BPF_MOV64_IMM(BPF_REG_4, 0),
5984                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
5985                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
5986                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5987                         BPF_EMIT_CALL(BPF_FUNC_map_update_elem),
5988                         BPF_EXIT_INSN(),
5989                 },
5990                 .fixup_map1 = { 3 },
5991                 .fixup_map3 = { 10 },
5992                 .result = REJECT,
5993                 .errstr = "invalid access to map value, value_size=8 off=0 size=16",
5994                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5995         },
5996         {
5997                 "map helper access to adjusted map (via const imm)",
5998                 .insns = {
5999                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6000                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6001                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6002                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6003                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6004                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
6005                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6006                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
6007                                       offsetof(struct other_val, bar)),
6008                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6009                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6010                         BPF_EXIT_INSN(),
6011                 },
6012                 .fixup_map3 = { 3, 9 },
6013                 .result = ACCEPT,
6014                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6015         },
6016         {
6017                 "map helper access to adjusted map (via const imm): out-of-bound 1",
6018                 .insns = {
6019                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6020                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6021                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6022                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6023                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6024                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
6025                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6026                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
6027                                       sizeof(struct other_val) - 4),
6028                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6029                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6030                         BPF_EXIT_INSN(),
6031                 },
6032                 .fixup_map3 = { 3, 9 },
6033                 .result = REJECT,
6034                 .errstr = "invalid access to map value, value_size=16 off=12 size=8",
6035                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6036         },
6037         {
6038                 "map helper access to adjusted map (via const imm): out-of-bound 2",
6039                 .insns = {
6040                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6041                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6042                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6043                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6044                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6045                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
6046                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6047                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
6048                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6049                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6050                         BPF_EXIT_INSN(),
6051                 },
6052                 .fixup_map3 = { 3, 9 },
6053                 .result = REJECT,
6054                 .errstr = "invalid access to map value, value_size=16 off=-4 size=8",
6055                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6056         },
6057         {
6058                 "map helper access to adjusted map (via const reg)",
6059                 .insns = {
6060                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6061                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6062                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6063                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6064                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6065                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6066                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6067                         BPF_MOV64_IMM(BPF_REG_3,
6068                                       offsetof(struct other_val, bar)),
6069                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6070                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6071                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6072                         BPF_EXIT_INSN(),
6073                 },
6074                 .fixup_map3 = { 3, 10 },
6075                 .result = ACCEPT,
6076                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6077         },
6078         {
6079                 "map helper access to adjusted map (via const reg): out-of-bound 1",
6080                 .insns = {
6081                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6082                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6083                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6084                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6085                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6086                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6087                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6088                         BPF_MOV64_IMM(BPF_REG_3,
6089                                       sizeof(struct other_val) - 4),
6090                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6091                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6092                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6093                         BPF_EXIT_INSN(),
6094                 },
6095                 .fixup_map3 = { 3, 10 },
6096                 .result = REJECT,
6097                 .errstr = "invalid access to map value, value_size=16 off=12 size=8",
6098                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6099         },
6100         {
6101                 "map helper access to adjusted map (via const reg): out-of-bound 2",
6102                 .insns = {
6103                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6104                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6105                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6106                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6107                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6108                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6109                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6110                         BPF_MOV64_IMM(BPF_REG_3, -4),
6111                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6112                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6113                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6114                         BPF_EXIT_INSN(),
6115                 },
6116                 .fixup_map3 = { 3, 10 },
6117                 .result = REJECT,
6118                 .errstr = "invalid access to map value, value_size=16 off=-4 size=8",
6119                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6120         },
6121         {
6122                 "map helper access to adjusted map (via variable)",
6123                 .insns = {
6124                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6125                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6126                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6127                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6128                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6129                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6130                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6131                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6132                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
6133                                     offsetof(struct other_val, bar), 4),
6134                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6135                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6136                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6137                         BPF_EXIT_INSN(),
6138                 },
6139                 .fixup_map3 = { 3, 11 },
6140                 .result = ACCEPT,
6141                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6142         },
6143         {
6144                 "map helper access to adjusted map (via variable): no max check",
6145                 .insns = {
6146                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6147                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6148                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6149                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6150                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6151                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6152                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6153                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6154                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6155                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6156                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6157                         BPF_EXIT_INSN(),
6158                 },
6159                 .fixup_map3 = { 3, 10 },
6160                 .result = REJECT,
6161                 .errstr = "R2 unbounded memory access, make sure to bounds check any array access into a map",
6162                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6163         },
6164         {
6165                 "map helper access to adjusted map (via variable): wrong max check",
6166                 .insns = {
6167                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6168                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6169                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6170                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6171                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6172                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6173                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6174                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6175                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
6176                                     offsetof(struct other_val, bar) + 1, 4),
6177                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6178                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6179                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6180                         BPF_EXIT_INSN(),
6181                 },
6182                 .fixup_map3 = { 3, 11 },
6183                 .result = REJECT,
6184                 .errstr = "invalid access to map value, value_size=16 off=9 size=8",
6185                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6186         },
6187         {
6188                 "map element value is preserved across register spilling",
6189                 .insns = {
6190                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6191                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6192                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6193                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6194                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6195                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6196                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
6197                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6198                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
6199                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
6200                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
6201                         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
6202                         BPF_EXIT_INSN(),
6203                 },
6204                 .fixup_map2 = { 3 },
6205                 .errstr_unpriv = "R0 leaks addr",
6206                 .result = ACCEPT,
6207                 .result_unpriv = REJECT,
6208         },
6209         {
6210                 "map element value or null is marked on register spilling",
6211                 .insns = {
6212                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6213                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6214                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6215                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6216                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6217                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6218                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -152),
6219                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
6220                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
6221                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
6222                         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
6223                         BPF_EXIT_INSN(),
6224                 },
6225                 .fixup_map2 = { 3 },
6226                 .errstr_unpriv = "R0 leaks addr",
6227                 .result = ACCEPT,
6228                 .result_unpriv = REJECT,
6229         },
6230         {
6231                 "map element value store of cleared call register",
6232                 .insns = {
6233                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6234                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6235                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6236                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6237                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6238                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
6239                         BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
6240                         BPF_EXIT_INSN(),
6241                 },
6242                 .fixup_map2 = { 3 },
6243                 .errstr_unpriv = "R1 !read_ok",
6244                 .errstr = "R1 !read_ok",
6245                 .result = REJECT,
6246                 .result_unpriv = REJECT,
6247         },
6248         {
6249                 "map element value with unaligned store",
6250                 .insns = {
6251                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6252                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6253                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6254                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6255                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6256                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 17),
6257                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
6258                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
6259                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 43),
6260                         BPF_ST_MEM(BPF_DW, BPF_REG_0, -2, 44),
6261                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
6262                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 32),
6263                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 2, 33),
6264                         BPF_ST_MEM(BPF_DW, BPF_REG_8, -2, 34),
6265                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 5),
6266                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 22),
6267                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 4, 23),
6268                         BPF_ST_MEM(BPF_DW, BPF_REG_8, -7, 24),
6269                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_8),
6270                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, 3),
6271                         BPF_ST_MEM(BPF_DW, BPF_REG_7, 0, 22),
6272                         BPF_ST_MEM(BPF_DW, BPF_REG_7, 4, 23),
6273                         BPF_ST_MEM(BPF_DW, BPF_REG_7, -4, 24),
6274                         BPF_EXIT_INSN(),
6275                 },
6276                 .fixup_map2 = { 3 },
6277                 .errstr_unpriv = "R0 leaks addr",
6278                 .result = ACCEPT,
6279                 .result_unpriv = REJECT,
6280                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
6281         },
6282         {
6283                 "map element value with unaligned load",
6284                 .insns = {
6285                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6286                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6287                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6288                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6289                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6290                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
6291                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
6292                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 9),
6293                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
6294                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
6295                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 2),
6296                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
6297                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 0),
6298                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 2),
6299                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 5),
6300                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
6301                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 4),
6302                         BPF_EXIT_INSN(),
6303                 },
6304                 .fixup_map2 = { 3 },
6305                 .errstr_unpriv = "R0 leaks addr",
6306                 .result = ACCEPT,
6307                 .result_unpriv = REJECT,
6308                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
6309         },
6310         {
6311                 "map element value illegal alu op, 1",
6312                 .insns = {
6313                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6314                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6315                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6316                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6317                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6318                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
6319                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 8),
6320                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
6321                         BPF_EXIT_INSN(),
6322                 },
6323                 .fixup_map2 = { 3 },
6324                 .errstr = "R0 bitwise operator &= on pointer",
6325                 .result = REJECT,
6326         },
6327         {
6328                 "map element value illegal alu op, 2",
6329                 .insns = {
6330                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6331                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6332                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6333                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6334                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6335                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
6336                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_0, 0),
6337                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
6338                         BPF_EXIT_INSN(),
6339                 },
6340                 .fixup_map2 = { 3 },
6341                 .errstr = "R0 32-bit pointer arithmetic prohibited",
6342                 .result = REJECT,
6343         },
6344         {
6345                 "map element value illegal alu op, 3",
6346                 .insns = {
6347                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6348                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6349                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6350                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6351                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6352                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
6353                         BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, 42),
6354                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
6355                         BPF_EXIT_INSN(),
6356                 },
6357                 .fixup_map2 = { 3 },
6358                 .errstr = "R0 pointer arithmetic with /= operator",
6359                 .result = REJECT,
6360         },
6361         {
6362                 "map element value illegal alu op, 4",
6363                 .insns = {
6364                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6365                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6366                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6367                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6368                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6369                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
6370                         BPF_ENDIAN(BPF_FROM_BE, BPF_REG_0, 64),
6371                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
6372                         BPF_EXIT_INSN(),
6373                 },
6374                 .fixup_map2 = { 3 },
6375                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
6376                 .errstr = "invalid mem access 'inv'",
6377                 .result = REJECT,
6378                 .result_unpriv = REJECT,
6379         },
6380         {
6381                 "map element value illegal alu op, 5",
6382                 .insns = {
6383                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6384                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6385                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6386                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6387                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6388                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6389                         BPF_MOV64_IMM(BPF_REG_3, 4096),
6390                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6391                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6392                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
6393                         BPF_STX_XADD(BPF_DW, BPF_REG_2, BPF_REG_3, 0),
6394                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0),
6395                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
6396                         BPF_EXIT_INSN(),
6397                 },
6398                 .fixup_map2 = { 3 },
6399                 .errstr = "R0 invalid mem access 'inv'",
6400                 .result = REJECT,
6401         },
6402         {
6403                 "map element value is preserved across register spilling",
6404                 .insns = {
6405                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6406                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6407                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6408                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6409                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6410                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6411                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0,
6412                                 offsetof(struct test_val, foo)),
6413                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
6414                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6415                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
6416                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
6417                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
6418                         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
6419                         BPF_EXIT_INSN(),
6420                 },
6421                 .fixup_map2 = { 3 },
6422                 .errstr_unpriv = "R0 leaks addr",
6423                 .result = ACCEPT,
6424                 .result_unpriv = REJECT,
6425                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
6426         },
6427         {
6428                 "helper access to variable memory: stack, bitwise AND + JMP, correct bounds",
6429                 .insns = {
6430                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6431                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6432                         BPF_MOV64_IMM(BPF_REG_0, 0),
6433                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
6434                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
6435                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
6436                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
6437                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
6438                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
6439                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
6440                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
6441                         BPF_MOV64_IMM(BPF_REG_2, 16),
6442                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6443                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6444                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
6445                         BPF_MOV64_IMM(BPF_REG_4, 0),
6446                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
6447                         BPF_MOV64_IMM(BPF_REG_3, 0),
6448                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6449                         BPF_MOV64_IMM(BPF_REG_0, 0),
6450                         BPF_EXIT_INSN(),
6451                 },
6452                 .result = ACCEPT,
6453                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6454         },
6455         {
6456                 "helper access to variable memory: stack, bitwise AND, zero included",
6457                 .insns = {
6458                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6459                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6460                         BPF_MOV64_IMM(BPF_REG_2, 16),
6461                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6462                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6463                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
6464                         BPF_MOV64_IMM(BPF_REG_3, 0),
6465                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6466                         BPF_EXIT_INSN(),
6467                 },
6468                 .errstr = "invalid indirect read from stack off -64+0 size 64",
6469                 .result = REJECT,
6470                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6471         },
6472         {
6473                 "helper access to variable memory: stack, bitwise AND + JMP, wrong max",
6474                 .insns = {
6475                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6476                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6477                         BPF_MOV64_IMM(BPF_REG_2, 16),
6478                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6479                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6480                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 65),
6481                         BPF_MOV64_IMM(BPF_REG_4, 0),
6482                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
6483                         BPF_MOV64_IMM(BPF_REG_3, 0),
6484                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6485                         BPF_MOV64_IMM(BPF_REG_0, 0),
6486                         BPF_EXIT_INSN(),
6487                 },
6488                 .errstr = "invalid stack type R1 off=-64 access_size=65",
6489                 .result = REJECT,
6490                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6491         },
6492         {
6493                 "helper access to variable memory: stack, JMP, correct bounds",
6494                 .insns = {
6495                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6496                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6497                         BPF_MOV64_IMM(BPF_REG_0, 0),
6498                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
6499                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
6500                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
6501                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
6502                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
6503                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
6504                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
6505                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
6506                         BPF_MOV64_IMM(BPF_REG_2, 16),
6507                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6508                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6509                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 4),
6510                         BPF_MOV64_IMM(BPF_REG_4, 0),
6511                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
6512                         BPF_MOV64_IMM(BPF_REG_3, 0),
6513                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6514                         BPF_MOV64_IMM(BPF_REG_0, 0),
6515                         BPF_EXIT_INSN(),
6516                 },
6517                 .result = ACCEPT,
6518                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6519         },
6520         {
6521                 "helper access to variable memory: stack, JMP (signed), correct bounds",
6522                 .insns = {
6523                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6524                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6525                         BPF_MOV64_IMM(BPF_REG_0, 0),
6526                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
6527                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
6528                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
6529                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
6530                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
6531                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
6532                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
6533                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
6534                         BPF_MOV64_IMM(BPF_REG_2, 16),
6535                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6536                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6537                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 4),
6538                         BPF_MOV64_IMM(BPF_REG_4, 0),
6539                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
6540                         BPF_MOV64_IMM(BPF_REG_3, 0),
6541                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6542                         BPF_MOV64_IMM(BPF_REG_0, 0),
6543                         BPF_EXIT_INSN(),
6544                 },
6545                 .result = ACCEPT,
6546                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6547         },
6548         {
6549                 "helper access to variable memory: stack, JMP, bounds + offset",
6550                 .insns = {
6551                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6552                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6553                         BPF_MOV64_IMM(BPF_REG_2, 16),
6554                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6555                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6556                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 5),
6557                         BPF_MOV64_IMM(BPF_REG_4, 0),
6558                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 3),
6559                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
6560                         BPF_MOV64_IMM(BPF_REG_3, 0),
6561                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6562                         BPF_MOV64_IMM(BPF_REG_0, 0),
6563                         BPF_EXIT_INSN(),
6564                 },
6565                 .errstr = "invalid stack type R1 off=-64 access_size=65",
6566                 .result = REJECT,
6567                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6568         },
6569         {
6570                 "helper access to variable memory: stack, JMP, wrong max",
6571                 .insns = {
6572                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6573                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6574                         BPF_MOV64_IMM(BPF_REG_2, 16),
6575                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6576                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6577                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 65, 4),
6578                         BPF_MOV64_IMM(BPF_REG_4, 0),
6579                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
6580                         BPF_MOV64_IMM(BPF_REG_3, 0),
6581                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6582                         BPF_MOV64_IMM(BPF_REG_0, 0),
6583                         BPF_EXIT_INSN(),
6584                 },
6585                 .errstr = "invalid stack type R1 off=-64 access_size=65",
6586                 .result = REJECT,
6587                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6588         },
6589         {
6590                 "helper access to variable memory: stack, JMP, no max check",
6591                 .insns = {
6592                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6593                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6594                         BPF_MOV64_IMM(BPF_REG_2, 16),
6595                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6596                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6597                         BPF_MOV64_IMM(BPF_REG_4, 0),
6598                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
6599                         BPF_MOV64_IMM(BPF_REG_3, 0),
6600                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6601                         BPF_MOV64_IMM(BPF_REG_0, 0),
6602                         BPF_EXIT_INSN(),
6603                 },
6604                 /* because max wasn't checked, signed min is negative */
6605                 .errstr = "R2 min value is negative, either use unsigned or 'var &= const'",
6606                 .result = REJECT,
6607                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6608         },
6609         {
6610                 "helper access to variable memory: stack, JMP, no min check",
6611                 .insns = {
6612                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6613                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6614                         BPF_MOV64_IMM(BPF_REG_2, 16),
6615                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6616                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6617                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 3),
6618                         BPF_MOV64_IMM(BPF_REG_3, 0),
6619                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6620                         BPF_MOV64_IMM(BPF_REG_0, 0),
6621                         BPF_EXIT_INSN(),
6622                 },
6623                 .errstr = "invalid indirect read from stack off -64+0 size 64",
6624                 .result = REJECT,
6625                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6626         },
6627         {
6628                 "helper access to variable memory: stack, JMP (signed), no min check",
6629                 .insns = {
6630                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6631                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6632                         BPF_MOV64_IMM(BPF_REG_2, 16),
6633                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6634                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6635                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 3),
6636                         BPF_MOV64_IMM(BPF_REG_3, 0),
6637                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6638                         BPF_MOV64_IMM(BPF_REG_0, 0),
6639                         BPF_EXIT_INSN(),
6640                 },
6641                 .errstr = "R2 min value is negative",
6642                 .result = REJECT,
6643                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6644         },
6645         {
6646                 "helper access to variable memory: map, JMP, correct bounds",
6647                 .insns = {
6648                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6649                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6650                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6651                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6652                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6653                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
6654                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6655                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
6656                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
6657                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
6658                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
6659                                 sizeof(struct test_val), 4),
6660                         BPF_MOV64_IMM(BPF_REG_4, 0),
6661                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
6662                         BPF_MOV64_IMM(BPF_REG_3, 0),
6663                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6664                         BPF_MOV64_IMM(BPF_REG_0, 0),
6665                         BPF_EXIT_INSN(),
6666                 },
6667                 .fixup_map2 = { 3 },
6668                 .result = ACCEPT,
6669                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6670         },
6671         {
6672                 "helper access to variable memory: map, JMP, wrong max",
6673                 .insns = {
6674                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6675                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6676                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6677                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6678                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6679                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
6680                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6681                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
6682                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
6683                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
6684                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
6685                                 sizeof(struct test_val) + 1, 4),
6686                         BPF_MOV64_IMM(BPF_REG_4, 0),
6687                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
6688                         BPF_MOV64_IMM(BPF_REG_3, 0),
6689                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6690                         BPF_MOV64_IMM(BPF_REG_0, 0),
6691                         BPF_EXIT_INSN(),
6692                 },
6693                 .fixup_map2 = { 3 },
6694                 .errstr = "invalid access to map value, value_size=48 off=0 size=49",
6695                 .result = REJECT,
6696                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6697         },
6698         {
6699                 "helper access to variable memory: map adjusted, JMP, correct bounds",
6700                 .insns = {
6701                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6702                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6703                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6704                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6705                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6706                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
6707                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6708                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
6709                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
6710                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
6711                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
6712                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
6713                                 sizeof(struct test_val) - 20, 4),
6714                         BPF_MOV64_IMM(BPF_REG_4, 0),
6715                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
6716                         BPF_MOV64_IMM(BPF_REG_3, 0),
6717                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6718                         BPF_MOV64_IMM(BPF_REG_0, 0),
6719                         BPF_EXIT_INSN(),
6720                 },
6721                 .fixup_map2 = { 3 },
6722                 .result = ACCEPT,
6723                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6724         },
6725         {
6726                 "helper access to variable memory: map adjusted, JMP, wrong max",
6727                 .insns = {
6728                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6729                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6730                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6731                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6732                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6733                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
6734                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6735                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
6736                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
6737                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
6738                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
6739                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
6740                                 sizeof(struct test_val) - 19, 4),
6741                         BPF_MOV64_IMM(BPF_REG_4, 0),
6742                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
6743                         BPF_MOV64_IMM(BPF_REG_3, 0),
6744                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6745                         BPF_MOV64_IMM(BPF_REG_0, 0),
6746                         BPF_EXIT_INSN(),
6747                 },
6748                 .fixup_map2 = { 3 },
6749                 .errstr = "R1 min value is outside of the array range",
6750                 .result = REJECT,
6751                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6752         },
6753         {
6754                 "helper access to variable memory: size = 0 allowed on NULL (ARG_PTR_TO_MEM_OR_NULL)",
6755                 .insns = {
6756                         BPF_MOV64_IMM(BPF_REG_1, 0),
6757                         BPF_MOV64_IMM(BPF_REG_2, 0),
6758                         BPF_MOV64_IMM(BPF_REG_3, 0),
6759                         BPF_MOV64_IMM(BPF_REG_4, 0),
6760                         BPF_MOV64_IMM(BPF_REG_5, 0),
6761                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6762                         BPF_EXIT_INSN(),
6763                 },
6764                 .result = ACCEPT,
6765                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6766         },
6767         {
6768                 "helper access to variable memory: size > 0 not allowed on NULL (ARG_PTR_TO_MEM_OR_NULL)",
6769                 .insns = {
6770                         BPF_MOV64_IMM(BPF_REG_1, 0),
6771                         BPF_MOV64_IMM(BPF_REG_2, 1),
6772                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
6773                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
6774                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
6775                         BPF_MOV64_IMM(BPF_REG_3, 0),
6776                         BPF_MOV64_IMM(BPF_REG_4, 0),
6777                         BPF_MOV64_IMM(BPF_REG_5, 0),
6778                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6779                         BPF_EXIT_INSN(),
6780                 },
6781                 .errstr = "R1 type=inv expected=fp",
6782                 .result = REJECT,
6783                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6784         },
6785         {
6786                 "helper access to variable memory: size = 0 allowed on != NULL stack pointer (ARG_PTR_TO_MEM_OR_NULL)",
6787                 .insns = {
6788                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6789                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
6790                         BPF_MOV64_IMM(BPF_REG_2, 0),
6791                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
6792                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 8),
6793                         BPF_MOV64_IMM(BPF_REG_3, 0),
6794                         BPF_MOV64_IMM(BPF_REG_4, 0),
6795                         BPF_MOV64_IMM(BPF_REG_5, 0),
6796                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6797                         BPF_EXIT_INSN(),
6798                 },
6799                 .result = ACCEPT,
6800                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6801         },
6802         {
6803                 "helper access to variable memory: size = 0 allowed on != NULL map pointer (ARG_PTR_TO_MEM_OR_NULL)",
6804                 .insns = {
6805                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6806                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6807                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6808                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6809                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6810                                      BPF_FUNC_map_lookup_elem),
6811                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6812                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6813                         BPF_MOV64_IMM(BPF_REG_2, 0),
6814                         BPF_MOV64_IMM(BPF_REG_3, 0),
6815                         BPF_MOV64_IMM(BPF_REG_4, 0),
6816                         BPF_MOV64_IMM(BPF_REG_5, 0),
6817                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6818                         BPF_EXIT_INSN(),
6819                 },
6820                 .fixup_map1 = { 3 },
6821                 .result = ACCEPT,
6822                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6823         },
6824         {
6825                 "helper access to variable memory: size possible = 0 allowed on != NULL stack pointer (ARG_PTR_TO_MEM_OR_NULL)",
6826                 .insns = {
6827                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6828                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6829                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6830                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6831                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6832                                      BPF_FUNC_map_lookup_elem),
6833                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6834                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
6835                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 7),
6836                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6837                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
6838                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
6839                         BPF_MOV64_IMM(BPF_REG_3, 0),
6840                         BPF_MOV64_IMM(BPF_REG_4, 0),
6841                         BPF_MOV64_IMM(BPF_REG_5, 0),
6842                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6843                         BPF_EXIT_INSN(),
6844                 },
6845                 .fixup_map1 = { 3 },
6846                 .result = ACCEPT,
6847                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6848         },
6849         {
6850                 "helper access to variable memory: size possible = 0 allowed on != NULL map pointer (ARG_PTR_TO_MEM_OR_NULL)",
6851                 .insns = {
6852                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6853                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6854                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6855                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6856                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6857                                      BPF_FUNC_map_lookup_elem),
6858                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6859                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6860                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
6861                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
6862                         BPF_MOV64_IMM(BPF_REG_3, 0),
6863                         BPF_MOV64_IMM(BPF_REG_4, 0),
6864                         BPF_MOV64_IMM(BPF_REG_5, 0),
6865                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6866                         BPF_EXIT_INSN(),
6867                 },
6868                 .fixup_map1 = { 3 },
6869                 .result = ACCEPT,
6870                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6871         },
6872         {
6873                 "helper access to variable memory: size possible = 0 allowed on != NULL packet pointer (ARG_PTR_TO_MEM_OR_NULL)",
6874                 .insns = {
6875                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
6876                                     offsetof(struct __sk_buff, data)),
6877                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
6878                                     offsetof(struct __sk_buff, data_end)),
6879                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_6),
6880                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
6881                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),
6882                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
6883                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 0),
6884                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
6885                         BPF_MOV64_IMM(BPF_REG_3, 0),
6886                         BPF_MOV64_IMM(BPF_REG_4, 0),
6887                         BPF_MOV64_IMM(BPF_REG_5, 0),
6888                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6889                         BPF_EXIT_INSN(),
6890                 },
6891                 .result = ACCEPT,
6892                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6893                 .retval = 0 /* csum_diff of 64-byte packet */,
6894         },
6895         {
6896                 "helper access to variable memory: size = 0 not allowed on NULL (!ARG_PTR_TO_MEM_OR_NULL)",
6897                 .insns = {
6898                         BPF_MOV64_IMM(BPF_REG_1, 0),
6899                         BPF_MOV64_IMM(BPF_REG_2, 0),
6900                         BPF_MOV64_IMM(BPF_REG_3, 0),
6901                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6902                         BPF_EXIT_INSN(),
6903                 },
6904                 .errstr = "R1 type=inv expected=fp",
6905                 .result = REJECT,
6906                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6907         },
6908         {
6909                 "helper access to variable memory: size > 0 not allowed on NULL (!ARG_PTR_TO_MEM_OR_NULL)",
6910                 .insns = {
6911                         BPF_MOV64_IMM(BPF_REG_1, 0),
6912                         BPF_MOV64_IMM(BPF_REG_2, 1),
6913                         BPF_MOV64_IMM(BPF_REG_3, 0),
6914                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6915                         BPF_EXIT_INSN(),
6916                 },
6917                 .errstr = "R1 type=inv expected=fp",
6918                 .result = REJECT,
6919                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6920         },
6921         {
6922                 "helper access to variable memory: size = 0 allowed on != NULL stack pointer (!ARG_PTR_TO_MEM_OR_NULL)",
6923                 .insns = {
6924                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6925                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
6926                         BPF_MOV64_IMM(BPF_REG_2, 0),
6927                         BPF_MOV64_IMM(BPF_REG_3, 0),
6928                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6929                         BPF_EXIT_INSN(),
6930                 },
6931                 .result = ACCEPT,
6932                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6933         },
6934         {
6935                 "helper access to variable memory: size = 0 allowed on != NULL map pointer (!ARG_PTR_TO_MEM_OR_NULL)",
6936                 .insns = {
6937                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6938                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6939                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6940                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6941                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6942                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6943                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6944                         BPF_MOV64_IMM(BPF_REG_2, 0),
6945                         BPF_MOV64_IMM(BPF_REG_3, 0),
6946                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6947                         BPF_EXIT_INSN(),
6948                 },
6949                 .fixup_map1 = { 3 },
6950                 .result = ACCEPT,
6951                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6952         },
6953         {
6954                 "helper access to variable memory: size possible = 0 allowed on != NULL stack pointer (!ARG_PTR_TO_MEM_OR_NULL)",
6955                 .insns = {
6956                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6957                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6958                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6959                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6960                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6961                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6962                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
6963                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
6964                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6965                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
6966                         BPF_MOV64_IMM(BPF_REG_3, 0),
6967                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6968                         BPF_EXIT_INSN(),
6969                 },
6970                 .fixup_map1 = { 3 },
6971                 .result = ACCEPT,
6972                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6973         },
6974         {
6975                 "helper access to variable memory: size possible = 0 allowed on != NULL map pointer (!ARG_PTR_TO_MEM_OR_NULL)",
6976                 .insns = {
6977                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6978                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6979                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6980                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6981                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6982                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
6983                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6984                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
6985                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 2),
6986                         BPF_MOV64_IMM(BPF_REG_3, 0),
6987                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6988                         BPF_EXIT_INSN(),
6989                 },
6990                 .fixup_map1 = { 3 },
6991                 .result = ACCEPT,
6992                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6993         },
6994         {
6995                 "helper access to variable memory: 8 bytes leak",
6996                 .insns = {
6997                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6998                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6999                         BPF_MOV64_IMM(BPF_REG_0, 0),
7000                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
7001                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
7002                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
7003                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
7004                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
7005                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
7006                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
7007                         BPF_MOV64_IMM(BPF_REG_2, 1),
7008                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
7009                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
7010                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 63),
7011                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
7012                         BPF_MOV64_IMM(BPF_REG_3, 0),
7013                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7014                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7015                         BPF_EXIT_INSN(),
7016                 },
7017                 .errstr = "invalid indirect read from stack off -64+32 size 64",
7018                 .result = REJECT,
7019                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7020         },
7021         {
7022                 "helper access to variable memory: 8 bytes no leak (init memory)",
7023                 .insns = {
7024                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7025                         BPF_MOV64_IMM(BPF_REG_0, 0),
7026                         BPF_MOV64_IMM(BPF_REG_0, 0),
7027                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
7028                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
7029                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
7030                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
7031                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
7032                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
7033                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
7034                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
7035                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
7036                         BPF_MOV64_IMM(BPF_REG_2, 0),
7037                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 32),
7038                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 32),
7039                         BPF_MOV64_IMM(BPF_REG_3, 0),
7040                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7041                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7042                         BPF_EXIT_INSN(),
7043                 },
7044                 .result = ACCEPT,
7045                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7046         },
7047         {
7048                 "invalid and of negative number",
7049                 .insns = {
7050                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7051                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7052                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7053                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7054                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7055                                      BPF_FUNC_map_lookup_elem),
7056                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7057                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7058                         BPF_ALU64_IMM(BPF_AND, BPF_REG_1, -4),
7059                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
7060                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7061                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
7062                                    offsetof(struct test_val, foo)),
7063                         BPF_EXIT_INSN(),
7064                 },
7065                 .fixup_map2 = { 3 },
7066                 .errstr = "R0 max value is outside of the array range",
7067                 .result = REJECT,
7068                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7069         },
7070         {
7071                 "invalid range check",
7072                 .insns = {
7073                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7074                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7075                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7076                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7077                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7078                                      BPF_FUNC_map_lookup_elem),
7079                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 12),
7080                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
7081                         BPF_MOV64_IMM(BPF_REG_9, 1),
7082                         BPF_ALU32_IMM(BPF_MOD, BPF_REG_1, 2),
7083                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 1),
7084                         BPF_ALU32_REG(BPF_AND, BPF_REG_9, BPF_REG_1),
7085                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_9, 1),
7086                         BPF_ALU32_IMM(BPF_RSH, BPF_REG_9, 1),
7087                         BPF_MOV32_IMM(BPF_REG_3, 1),
7088                         BPF_ALU32_REG(BPF_SUB, BPF_REG_3, BPF_REG_9),
7089                         BPF_ALU32_IMM(BPF_MUL, BPF_REG_3, 0x10000000),
7090                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
7091                         BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_3, 0),
7092                         BPF_MOV64_REG(BPF_REG_0, 0),
7093                         BPF_EXIT_INSN(),
7094                 },
7095                 .fixup_map2 = { 3 },
7096                 .errstr = "R0 max value is outside of the array range",
7097                 .result = REJECT,
7098                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7099         },
7100         {
7101                 "map in map access",
7102                 .insns = {
7103                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7104                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7105                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7106                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7107                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7108                                      BPF_FUNC_map_lookup_elem),
7109                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
7110                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7111                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7112                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7113                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7114                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7115                                      BPF_FUNC_map_lookup_elem),
7116                         BPF_MOV64_REG(BPF_REG_0, 0),
7117                         BPF_EXIT_INSN(),
7118                 },
7119                 .fixup_map_in_map = { 3 },
7120                 .result = ACCEPT,
7121         },
7122         {
7123                 "invalid inner map pointer",
7124                 .insns = {
7125                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7126                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7127                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7128                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7129                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7130                                      BPF_FUNC_map_lookup_elem),
7131                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
7132                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7133                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7134                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7135                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7136                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7137                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7138                                      BPF_FUNC_map_lookup_elem),
7139                         BPF_MOV64_REG(BPF_REG_0, 0),
7140                         BPF_EXIT_INSN(),
7141                 },
7142                 .fixup_map_in_map = { 3 },
7143                 .errstr = "R1 pointer arithmetic on CONST_PTR_TO_MAP prohibited",
7144                 .result = REJECT,
7145         },
7146         {
7147                 "forgot null checking on the inner map pointer",
7148                 .insns = {
7149                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7150                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7151                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7152                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7153                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7154                                      BPF_FUNC_map_lookup_elem),
7155                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7156                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7157                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7158                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7159                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7160                                      BPF_FUNC_map_lookup_elem),
7161                         BPF_MOV64_REG(BPF_REG_0, 0),
7162                         BPF_EXIT_INSN(),
7163                 },
7164                 .fixup_map_in_map = { 3 },
7165                 .errstr = "R1 type=map_value_or_null expected=map_ptr",
7166                 .result = REJECT,
7167         },
7168         {
7169                 "ld_abs: check calling conv, r1",
7170                 .insns = {
7171                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7172                         BPF_MOV64_IMM(BPF_REG_1, 0),
7173                         BPF_LD_ABS(BPF_W, -0x200000),
7174                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
7175                         BPF_EXIT_INSN(),
7176                 },
7177                 .errstr = "R1 !read_ok",
7178                 .result = REJECT,
7179         },
7180         {
7181                 "ld_abs: check calling conv, r2",
7182                 .insns = {
7183                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7184                         BPF_MOV64_IMM(BPF_REG_2, 0),
7185                         BPF_LD_ABS(BPF_W, -0x200000),
7186                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
7187                         BPF_EXIT_INSN(),
7188                 },
7189                 .errstr = "R2 !read_ok",
7190                 .result = REJECT,
7191         },
7192         {
7193                 "ld_abs: check calling conv, r3",
7194                 .insns = {
7195                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7196                         BPF_MOV64_IMM(BPF_REG_3, 0),
7197                         BPF_LD_ABS(BPF_W, -0x200000),
7198                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
7199                         BPF_EXIT_INSN(),
7200                 },
7201                 .errstr = "R3 !read_ok",
7202                 .result = REJECT,
7203         },
7204         {
7205                 "ld_abs: check calling conv, r4",
7206                 .insns = {
7207                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7208                         BPF_MOV64_IMM(BPF_REG_4, 0),
7209                         BPF_LD_ABS(BPF_W, -0x200000),
7210                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
7211                         BPF_EXIT_INSN(),
7212                 },
7213                 .errstr = "R4 !read_ok",
7214                 .result = REJECT,
7215         },
7216         {
7217                 "ld_abs: check calling conv, r5",
7218                 .insns = {
7219                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7220                         BPF_MOV64_IMM(BPF_REG_5, 0),
7221                         BPF_LD_ABS(BPF_W, -0x200000),
7222                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
7223                         BPF_EXIT_INSN(),
7224                 },
7225                 .errstr = "R5 !read_ok",
7226                 .result = REJECT,
7227         },
7228         {
7229                 "ld_abs: check calling conv, r7",
7230                 .insns = {
7231                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7232                         BPF_MOV64_IMM(BPF_REG_7, 0),
7233                         BPF_LD_ABS(BPF_W, -0x200000),
7234                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
7235                         BPF_EXIT_INSN(),
7236                 },
7237                 .result = ACCEPT,
7238         },
7239         {
7240                 "ld_abs: tests on r6 and skb data reload helper",
7241                 .insns = {
7242                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7243                         BPF_LD_ABS(BPF_B, 0),
7244                         BPF_LD_ABS(BPF_H, 0),
7245                         BPF_LD_ABS(BPF_W, 0),
7246                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
7247                         BPF_MOV64_IMM(BPF_REG_6, 0),
7248                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
7249                         BPF_MOV64_IMM(BPF_REG_2, 1),
7250                         BPF_MOV64_IMM(BPF_REG_3, 2),
7251                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7252                                      BPF_FUNC_skb_vlan_push),
7253                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
7254                         BPF_LD_ABS(BPF_B, 0),
7255                         BPF_LD_ABS(BPF_H, 0),
7256                         BPF_LD_ABS(BPF_W, 0),
7257                         BPF_MOV64_IMM(BPF_REG_0, 42),
7258                         BPF_EXIT_INSN(),
7259                 },
7260                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7261                 .result = ACCEPT,
7262                 .retval = 42 /* ultimate return value */,
7263         },
7264         {
7265                 "ld_ind: check calling conv, r1",
7266                 .insns = {
7267                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7268                         BPF_MOV64_IMM(BPF_REG_1, 1),
7269                         BPF_LD_IND(BPF_W, BPF_REG_1, -0x200000),
7270                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
7271                         BPF_EXIT_INSN(),
7272                 },
7273                 .errstr = "R1 !read_ok",
7274                 .result = REJECT,
7275         },
7276         {
7277                 "ld_ind: check calling conv, r2",
7278                 .insns = {
7279                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7280                         BPF_MOV64_IMM(BPF_REG_2, 1),
7281                         BPF_LD_IND(BPF_W, BPF_REG_2, -0x200000),
7282                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
7283                         BPF_EXIT_INSN(),
7284                 },
7285                 .errstr = "R2 !read_ok",
7286                 .result = REJECT,
7287         },
7288         {
7289                 "ld_ind: check calling conv, r3",
7290                 .insns = {
7291                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7292                         BPF_MOV64_IMM(BPF_REG_3, 1),
7293                         BPF_LD_IND(BPF_W, BPF_REG_3, -0x200000),
7294                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
7295                         BPF_EXIT_INSN(),
7296                 },
7297                 .errstr = "R3 !read_ok",
7298                 .result = REJECT,
7299         },
7300         {
7301                 "ld_ind: check calling conv, r4",
7302                 .insns = {
7303                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7304                         BPF_MOV64_IMM(BPF_REG_4, 1),
7305                         BPF_LD_IND(BPF_W, BPF_REG_4, -0x200000),
7306                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
7307                         BPF_EXIT_INSN(),
7308                 },
7309                 .errstr = "R4 !read_ok",
7310                 .result = REJECT,
7311         },
7312         {
7313                 "ld_ind: check calling conv, r5",
7314                 .insns = {
7315                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7316                         BPF_MOV64_IMM(BPF_REG_5, 1),
7317                         BPF_LD_IND(BPF_W, BPF_REG_5, -0x200000),
7318                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
7319                         BPF_EXIT_INSN(),
7320                 },
7321                 .errstr = "R5 !read_ok",
7322                 .result = REJECT,
7323         },
7324         {
7325                 "ld_ind: check calling conv, r7",
7326                 .insns = {
7327                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7328                         BPF_MOV64_IMM(BPF_REG_7, 1),
7329                         BPF_LD_IND(BPF_W, BPF_REG_7, -0x200000),
7330                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
7331                         BPF_EXIT_INSN(),
7332                 },
7333                 .result = ACCEPT,
7334                 .retval = 1,
7335         },
7336         {
7337                 "check bpf_perf_event_data->sample_period byte load permitted",
7338                 .insns = {
7339                         BPF_MOV64_IMM(BPF_REG_0, 0),
7340 #if __BYTE_ORDER == __LITTLE_ENDIAN
7341                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
7342                                     offsetof(struct bpf_perf_event_data, sample_period)),
7343 #else
7344                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
7345                                     offsetof(struct bpf_perf_event_data, sample_period) + 7),
7346 #endif
7347                         BPF_EXIT_INSN(),
7348                 },
7349                 .result = ACCEPT,
7350                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
7351         },
7352         {
7353                 "check bpf_perf_event_data->sample_period half load permitted",
7354                 .insns = {
7355                         BPF_MOV64_IMM(BPF_REG_0, 0),
7356 #if __BYTE_ORDER == __LITTLE_ENDIAN
7357                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
7358                                     offsetof(struct bpf_perf_event_data, sample_period)),
7359 #else
7360                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
7361                                     offsetof(struct bpf_perf_event_data, sample_period) + 6),
7362 #endif
7363                         BPF_EXIT_INSN(),
7364                 },
7365                 .result = ACCEPT,
7366                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
7367         },
7368         {
7369                 "check bpf_perf_event_data->sample_period word load permitted",
7370                 .insns = {
7371                         BPF_MOV64_IMM(BPF_REG_0, 0),
7372 #if __BYTE_ORDER == __LITTLE_ENDIAN
7373                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
7374                                     offsetof(struct bpf_perf_event_data, sample_period)),
7375 #else
7376                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
7377                                     offsetof(struct bpf_perf_event_data, sample_period) + 4),
7378 #endif
7379                         BPF_EXIT_INSN(),
7380                 },
7381                 .result = ACCEPT,
7382                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
7383         },
7384         {
7385                 "check bpf_perf_event_data->sample_period dword load permitted",
7386                 .insns = {
7387                         BPF_MOV64_IMM(BPF_REG_0, 0),
7388                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
7389                                     offsetof(struct bpf_perf_event_data, sample_period)),
7390                         BPF_EXIT_INSN(),
7391                 },
7392                 .result = ACCEPT,
7393                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
7394         },
7395         {
7396                 "check skb->data half load not permitted",
7397                 .insns = {
7398                         BPF_MOV64_IMM(BPF_REG_0, 0),
7399 #if __BYTE_ORDER == __LITTLE_ENDIAN
7400                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
7401                                     offsetof(struct __sk_buff, data)),
7402 #else
7403                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
7404                                     offsetof(struct __sk_buff, data) + 2),
7405 #endif
7406                         BPF_EXIT_INSN(),
7407                 },
7408                 .result = REJECT,
7409                 .errstr = "invalid bpf_context access",
7410         },
7411         {
7412                 "check skb->tc_classid half load not permitted for lwt prog",
7413                 .insns = {
7414                         BPF_MOV64_IMM(BPF_REG_0, 0),
7415 #if __BYTE_ORDER == __LITTLE_ENDIAN
7416                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
7417                                     offsetof(struct __sk_buff, tc_classid)),
7418 #else
7419                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
7420                                     offsetof(struct __sk_buff, tc_classid) + 2),
7421 #endif
7422                         BPF_EXIT_INSN(),
7423                 },
7424                 .result = REJECT,
7425                 .errstr = "invalid bpf_context access",
7426                 .prog_type = BPF_PROG_TYPE_LWT_IN,
7427         },
7428         {
7429                 "bounds checks mixing signed and unsigned, positive bounds",
7430                 .insns = {
7431                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7432                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7433                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7434                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7435                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7436                                      BPF_FUNC_map_lookup_elem),
7437                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
7438                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7439                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7440                         BPF_MOV64_IMM(BPF_REG_2, 2),
7441                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 3),
7442                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 4, 2),
7443                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7444                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7445                         BPF_MOV64_IMM(BPF_REG_0, 0),
7446                         BPF_EXIT_INSN(),
7447                 },
7448                 .fixup_map1 = { 3 },
7449                 .errstr = "unbounded min value",
7450                 .result = REJECT,
7451         },
7452         {
7453                 "bounds checks mixing signed and unsigned",
7454                 .insns = {
7455                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7456                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7457                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7458                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7459                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7460                                      BPF_FUNC_map_lookup_elem),
7461                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
7462                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7463                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7464                         BPF_MOV64_IMM(BPF_REG_2, -1),
7465                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
7466                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7467                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7468                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7469                         BPF_MOV64_IMM(BPF_REG_0, 0),
7470                         BPF_EXIT_INSN(),
7471                 },
7472                 .fixup_map1 = { 3 },
7473                 .errstr = "unbounded min value",
7474                 .result = REJECT,
7475         },
7476         {
7477                 "bounds checks mixing signed and unsigned, variant 2",
7478                 .insns = {
7479                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7480                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7481                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7482                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7483                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7484                                      BPF_FUNC_map_lookup_elem),
7485                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7486                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7487                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7488                         BPF_MOV64_IMM(BPF_REG_2, -1),
7489                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
7490                         BPF_MOV64_IMM(BPF_REG_8, 0),
7491                         BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_1),
7492                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
7493                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
7494                         BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
7495                         BPF_MOV64_IMM(BPF_REG_0, 0),
7496                         BPF_EXIT_INSN(),
7497                 },
7498                 .fixup_map1 = { 3 },
7499                 .errstr = "unbounded min value",
7500                 .result = REJECT,
7501         },
7502         {
7503                 "bounds checks mixing signed and unsigned, variant 3",
7504                 .insns = {
7505                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7506                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7507                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7508                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7509                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7510                                      BPF_FUNC_map_lookup_elem),
7511                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
7512                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7513                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7514                         BPF_MOV64_IMM(BPF_REG_2, -1),
7515                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 4),
7516                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
7517                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
7518                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
7519                         BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
7520                         BPF_MOV64_IMM(BPF_REG_0, 0),
7521                         BPF_EXIT_INSN(),
7522                 },
7523                 .fixup_map1 = { 3 },
7524                 .errstr = "unbounded min value",
7525                 .result = REJECT,
7526         },
7527         {
7528                 "bounds checks mixing signed and unsigned, variant 4",
7529                 .insns = {
7530                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7531                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7532                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7533                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7534                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7535                                      BPF_FUNC_map_lookup_elem),
7536                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
7537                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7538                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7539                         BPF_MOV64_IMM(BPF_REG_2, 1),
7540                         BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
7541                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7542                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7543                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7544                         BPF_MOV64_IMM(BPF_REG_0, 0),
7545                         BPF_EXIT_INSN(),
7546                 },
7547                 .fixup_map1 = { 3 },
7548                 .result = ACCEPT,
7549         },
7550         {
7551                 "bounds checks mixing signed and unsigned, variant 5",
7552                 .insns = {
7553                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7554                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7555                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7556                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7557                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7558                                      BPF_FUNC_map_lookup_elem),
7559                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7560                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7561                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7562                         BPF_MOV64_IMM(BPF_REG_2, -1),
7563                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
7564                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 4),
7565                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 4),
7566                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
7567                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7568                         BPF_MOV64_IMM(BPF_REG_0, 0),
7569                         BPF_EXIT_INSN(),
7570                 },
7571                 .fixup_map1 = { 3 },
7572                 .errstr = "unbounded min value",
7573                 .result = REJECT,
7574         },
7575         {
7576                 "bounds checks mixing signed and unsigned, variant 6",
7577                 .insns = {
7578                         BPF_MOV64_IMM(BPF_REG_2, 0),
7579                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_10),
7580                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, -512),
7581                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7582                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -16),
7583                         BPF_MOV64_IMM(BPF_REG_6, -1),
7584                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_6, 5),
7585                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_4, 1, 4),
7586                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 1),
7587                         BPF_MOV64_IMM(BPF_REG_5, 0),
7588                         BPF_ST_MEM(BPF_H, BPF_REG_10, -512, 0),
7589                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7590                                      BPF_FUNC_skb_load_bytes),
7591                         BPF_MOV64_IMM(BPF_REG_0, 0),
7592                         BPF_EXIT_INSN(),
7593                 },
7594                 .errstr = "R4 min value is negative, either use unsigned",
7595                 .result = REJECT,
7596         },
7597         {
7598                 "bounds checks mixing signed and unsigned, variant 7",
7599                 .insns = {
7600                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7601                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7602                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7603                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7604                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7605                                      BPF_FUNC_map_lookup_elem),
7606                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
7607                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7608                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7609                         BPF_MOV64_IMM(BPF_REG_2, 1024 * 1024 * 1024),
7610                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
7611                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7612                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7613                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7614                         BPF_MOV64_IMM(BPF_REG_0, 0),
7615                         BPF_EXIT_INSN(),
7616                 },
7617                 .fixup_map1 = { 3 },
7618                 .result = ACCEPT,
7619         },
7620         {
7621                 "bounds checks mixing signed and unsigned, variant 8",
7622                 .insns = {
7623                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7624                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7625                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7626                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7627                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7628                                      BPF_FUNC_map_lookup_elem),
7629                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7630                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7631                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7632                         BPF_MOV64_IMM(BPF_REG_2, -1),
7633                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
7634                         BPF_MOV64_IMM(BPF_REG_0, 0),
7635                         BPF_EXIT_INSN(),
7636                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7637                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7638                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7639                         BPF_MOV64_IMM(BPF_REG_0, 0),
7640                         BPF_EXIT_INSN(),
7641                 },
7642                 .fixup_map1 = { 3 },
7643                 .errstr = "unbounded min value",
7644                 .result = REJECT,
7645         },
7646         {
7647                 "bounds checks mixing signed and unsigned, variant 9",
7648                 .insns = {
7649                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7650                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7651                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7652                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7653                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7654                                      BPF_FUNC_map_lookup_elem),
7655                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
7656                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7657                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7658                         BPF_LD_IMM64(BPF_REG_2, -9223372036854775808ULL),
7659                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
7660                         BPF_MOV64_IMM(BPF_REG_0, 0),
7661                         BPF_EXIT_INSN(),
7662                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7663                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7664                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7665                         BPF_MOV64_IMM(BPF_REG_0, 0),
7666                         BPF_EXIT_INSN(),
7667                 },
7668                 .fixup_map1 = { 3 },
7669                 .result = ACCEPT,
7670         },
7671         {
7672                 "bounds checks mixing signed and unsigned, variant 10",
7673                 .insns = {
7674                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7675                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7676                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7677                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7678                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7679                                      BPF_FUNC_map_lookup_elem),
7680                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7681                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7682                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7683                         BPF_MOV64_IMM(BPF_REG_2, 0),
7684                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
7685                         BPF_MOV64_IMM(BPF_REG_0, 0),
7686                         BPF_EXIT_INSN(),
7687                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7688                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7689                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7690                         BPF_MOV64_IMM(BPF_REG_0, 0),
7691                         BPF_EXIT_INSN(),
7692                 },
7693                 .fixup_map1 = { 3 },
7694                 .errstr = "unbounded min value",
7695                 .result = REJECT,
7696         },
7697         {
7698                 "bounds checks mixing signed and unsigned, variant 11",
7699                 .insns = {
7700                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7701                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7702                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7703                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7704                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7705                                      BPF_FUNC_map_lookup_elem),
7706                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7707                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7708                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7709                         BPF_MOV64_IMM(BPF_REG_2, -1),
7710                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
7711                         /* Dead branch. */
7712                         BPF_MOV64_IMM(BPF_REG_0, 0),
7713                         BPF_EXIT_INSN(),
7714                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7715                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7716                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7717                         BPF_MOV64_IMM(BPF_REG_0, 0),
7718                         BPF_EXIT_INSN(),
7719                 },
7720                 .fixup_map1 = { 3 },
7721                 .errstr = "unbounded min value",
7722                 .result = REJECT,
7723         },
7724         {
7725                 "bounds checks mixing signed and unsigned, variant 12",
7726                 .insns = {
7727                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7728                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7729                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7730                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7731                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7732                                      BPF_FUNC_map_lookup_elem),
7733                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7734                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7735                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7736                         BPF_MOV64_IMM(BPF_REG_2, -6),
7737                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
7738                         BPF_MOV64_IMM(BPF_REG_0, 0),
7739                         BPF_EXIT_INSN(),
7740                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7741                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7742                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7743                         BPF_MOV64_IMM(BPF_REG_0, 0),
7744                         BPF_EXIT_INSN(),
7745                 },
7746                 .fixup_map1 = { 3 },
7747                 .errstr = "unbounded min value",
7748                 .result = REJECT,
7749         },
7750         {
7751                 "bounds checks mixing signed and unsigned, variant 13",
7752                 .insns = {
7753                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7754                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7755                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7756                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7757                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7758                                      BPF_FUNC_map_lookup_elem),
7759                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
7760                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7761                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7762                         BPF_MOV64_IMM(BPF_REG_2, 2),
7763                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
7764                         BPF_MOV64_IMM(BPF_REG_7, 1),
7765                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 0, 2),
7766                         BPF_MOV64_IMM(BPF_REG_0, 0),
7767                         BPF_EXIT_INSN(),
7768                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_1),
7769                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 4, 2),
7770                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_7),
7771                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7772                         BPF_MOV64_IMM(BPF_REG_0, 0),
7773                         BPF_EXIT_INSN(),
7774                 },
7775                 .fixup_map1 = { 3 },
7776                 .errstr = "unbounded min value",
7777                 .result = REJECT,
7778         },
7779         {
7780                 "bounds checks mixing signed and unsigned, variant 14",
7781                 .insns = {
7782                         BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
7783                                     offsetof(struct __sk_buff, mark)),
7784                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7785                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7786                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7787                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7788                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7789                                      BPF_FUNC_map_lookup_elem),
7790                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
7791                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7792                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7793                         BPF_MOV64_IMM(BPF_REG_2, -1),
7794                         BPF_MOV64_IMM(BPF_REG_8, 2),
7795                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_9, 42, 6),
7796                         BPF_JMP_REG(BPF_JSGT, BPF_REG_8, BPF_REG_1, 3),
7797                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7798                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7799                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7800                         BPF_MOV64_IMM(BPF_REG_0, 0),
7801                         BPF_EXIT_INSN(),
7802                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, -3),
7803                         BPF_JMP_IMM(BPF_JA, 0, 0, -7),
7804                 },
7805                 .fixup_map1 = { 4 },
7806                 .errstr = "R0 invalid mem access 'inv'",
7807                 .result = REJECT,
7808         },
7809         {
7810                 "bounds checks mixing signed and unsigned, variant 15",
7811                 .insns = {
7812                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7813                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7814                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7815                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7816                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7817                                      BPF_FUNC_map_lookup_elem),
7818                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7819                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7820                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7821                         BPF_MOV64_IMM(BPF_REG_2, -6),
7822                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
7823                         BPF_MOV64_IMM(BPF_REG_0, 0),
7824                         BPF_EXIT_INSN(),
7825                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7826                         BPF_JMP_IMM(BPF_JGT, BPF_REG_0, 1, 2),
7827                         BPF_MOV64_IMM(BPF_REG_0, 0),
7828                         BPF_EXIT_INSN(),
7829                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7830                         BPF_MOV64_IMM(BPF_REG_0, 0),
7831                         BPF_EXIT_INSN(),
7832                 },
7833                 .fixup_map1 = { 3 },
7834                 .errstr = "unbounded min value",
7835                 .result = REJECT,
7836                 .result_unpriv = REJECT,
7837         },
7838         {
7839                 "subtraction bounds (map value) variant 1",
7840                 .insns = {
7841                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7842                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7843                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7844                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7845                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7846                                      BPF_FUNC_map_lookup_elem),
7847                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7848                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7849                         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0xff, 7),
7850                         BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
7851                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3, 0xff, 5),
7852                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_3),
7853                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 56),
7854                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7855                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7856                         BPF_EXIT_INSN(),
7857                         BPF_MOV64_IMM(BPF_REG_0, 0),
7858                         BPF_EXIT_INSN(),
7859                 },
7860                 .fixup_map1 = { 3 },
7861                 .errstr = "R0 max value is outside of the array range",
7862                 .result = REJECT,
7863         },
7864         {
7865                 "subtraction bounds (map value) variant 2",
7866                 .insns = {
7867                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7868                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7869                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7870                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7871                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7872                                      BPF_FUNC_map_lookup_elem),
7873                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
7874                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7875                         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0xff, 6),
7876                         BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
7877                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3, 0xff, 4),
7878                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_3),
7879                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7880                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7881                         BPF_EXIT_INSN(),
7882                         BPF_MOV64_IMM(BPF_REG_0, 0),
7883                         BPF_EXIT_INSN(),
7884                 },
7885                 .fixup_map1 = { 3 },
7886                 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
7887                 .result = REJECT,
7888         },
7889         {
7890                 "bounds check based on zero-extended MOV",
7891                 .insns = {
7892                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7893                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7894                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7895                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7896                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7897                                      BPF_FUNC_map_lookup_elem),
7898                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7899                         /* r2 = 0x0000'0000'ffff'ffff */
7900                         BPF_MOV32_IMM(BPF_REG_2, 0xffffffff),
7901                         /* r2 = 0 */
7902                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 32),
7903                         /* no-op */
7904                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
7905                         /* access at offset 0 */
7906                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7907                         /* exit */
7908                         BPF_MOV64_IMM(BPF_REG_0, 0),
7909                         BPF_EXIT_INSN(),
7910                 },
7911                 .fixup_map1 = { 3 },
7912                 .result = ACCEPT
7913         },
7914         {
7915                 "bounds check based on sign-extended MOV. test1",
7916                 .insns = {
7917                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7918                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7919                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7920                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7921                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7922                                      BPF_FUNC_map_lookup_elem),
7923                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7924                         /* r2 = 0xffff'ffff'ffff'ffff */
7925                         BPF_MOV64_IMM(BPF_REG_2, 0xffffffff),
7926                         /* r2 = 0xffff'ffff */
7927                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 32),
7928                         /* r0 = <oob pointer> */
7929                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
7930                         /* access to OOB pointer */
7931                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7932                         /* exit */
7933                         BPF_MOV64_IMM(BPF_REG_0, 0),
7934                         BPF_EXIT_INSN(),
7935                 },
7936                 .fixup_map1 = { 3 },
7937                 .errstr = "map_value pointer and 4294967295",
7938                 .result = REJECT
7939         },
7940         {
7941                 "bounds check based on sign-extended MOV. test2",
7942                 .insns = {
7943                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7944                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7945                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7946                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7947                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7948                                      BPF_FUNC_map_lookup_elem),
7949                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7950                         /* r2 = 0xffff'ffff'ffff'ffff */
7951                         BPF_MOV64_IMM(BPF_REG_2, 0xffffffff),
7952                         /* r2 = 0xfff'ffff */
7953                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 36),
7954                         /* r0 = <oob pointer> */
7955                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
7956                         /* access to OOB pointer */
7957                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7958                         /* exit */
7959                         BPF_MOV64_IMM(BPF_REG_0, 0),
7960                         BPF_EXIT_INSN(),
7961                 },
7962                 .fixup_map1 = { 3 },
7963                 .errstr = "R0 min value is outside of the array range",
7964                 .result = REJECT
7965         },
7966         {
7967                 "bounds check based on reg_off + var_off + insn_off. test1",
7968                 .insns = {
7969                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
7970                                     offsetof(struct __sk_buff, mark)),
7971                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7972                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7973                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7974                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7975                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7976                                      BPF_FUNC_map_lookup_elem),
7977                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7978                         BPF_ALU64_IMM(BPF_AND, BPF_REG_6, 1),
7979                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, (1 << 29) - 1),
7980                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_6),
7981                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, (1 << 29) - 1),
7982                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 3),
7983                         BPF_MOV64_IMM(BPF_REG_0, 0),
7984                         BPF_EXIT_INSN(),
7985                 },
7986                 .fixup_map1 = { 4 },
7987                 .errstr = "value_size=8 off=1073741825",
7988                 .result = REJECT,
7989                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7990         },
7991         {
7992                 "bounds check based on reg_off + var_off + insn_off. test2",
7993                 .insns = {
7994                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
7995                                     offsetof(struct __sk_buff, mark)),
7996                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7997                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7998                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7999                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8000                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8001                                      BPF_FUNC_map_lookup_elem),
8002                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
8003                         BPF_ALU64_IMM(BPF_AND, BPF_REG_6, 1),
8004                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, (1 << 30) - 1),
8005                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_6),
8006                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, (1 << 29) - 1),
8007                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 3),
8008                         BPF_MOV64_IMM(BPF_REG_0, 0),
8009                         BPF_EXIT_INSN(),
8010                 },
8011                 .fixup_map1 = { 4 },
8012                 .errstr = "value 1073741823",
8013                 .result = REJECT,
8014                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
8015         },
8016         {
8017                 "bounds check after truncation of non-boundary-crossing range",
8018                 .insns = {
8019                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8020                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8021                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8022                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8023                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8024                                      BPF_FUNC_map_lookup_elem),
8025                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8026                         /* r1 = [0x00, 0xff] */
8027                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8028                         BPF_MOV64_IMM(BPF_REG_2, 1),
8029                         /* r2 = 0x10'0000'0000 */
8030                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 36),
8031                         /* r1 = [0x10'0000'0000, 0x10'0000'00ff] */
8032                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
8033                         /* r1 = [0x10'7fff'ffff, 0x10'8000'00fe] */
8034                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
8035                         /* r1 = [0x00, 0xff] */
8036                         BPF_ALU32_IMM(BPF_SUB, BPF_REG_1, 0x7fffffff),
8037                         /* r1 = 0 */
8038                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
8039                         /* no-op */
8040                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8041                         /* access at offset 0 */
8042                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8043                         /* exit */
8044                         BPF_MOV64_IMM(BPF_REG_0, 0),
8045                         BPF_EXIT_INSN(),
8046                 },
8047                 .fixup_map1 = { 3 },
8048                 .result = ACCEPT
8049         },
8050         {
8051                 "bounds check after truncation of boundary-crossing range (1)",
8052                 .insns = {
8053                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8054                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8055                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8056                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8057                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8058                                      BPF_FUNC_map_lookup_elem),
8059                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8060                         /* r1 = [0x00, 0xff] */
8061                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8062                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
8063                         /* r1 = [0xffff'ff80, 0x1'0000'007f] */
8064                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
8065                         /* r1 = [0xffff'ff80, 0xffff'ffff] or
8066                          *      [0x0000'0000, 0x0000'007f]
8067                          */
8068                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 0),
8069                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
8070                         /* r1 = [0x00, 0xff] or
8071                          *      [0xffff'ffff'0000'0080, 0xffff'ffff'ffff'ffff]
8072                          */
8073                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
8074                         /* r1 = 0 or
8075                          *      [0x00ff'ffff'ff00'0000, 0x00ff'ffff'ffff'ffff]
8076                          */
8077                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
8078                         /* no-op or OOB pointer computation */
8079                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8080                         /* potentially OOB access */
8081                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8082                         /* exit */
8083                         BPF_MOV64_IMM(BPF_REG_0, 0),
8084                         BPF_EXIT_INSN(),
8085                 },
8086                 .fixup_map1 = { 3 },
8087                 /* not actually fully unbounded, but the bound is very high */
8088                 .errstr = "R0 unbounded memory access",
8089                 .result = REJECT
8090         },
8091         {
8092                 "bounds check after truncation of boundary-crossing range (2)",
8093                 .insns = {
8094                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8095                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8096                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8097                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8098                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8099                                      BPF_FUNC_map_lookup_elem),
8100                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8101                         /* r1 = [0x00, 0xff] */
8102                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8103                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
8104                         /* r1 = [0xffff'ff80, 0x1'0000'007f] */
8105                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
8106                         /* r1 = [0xffff'ff80, 0xffff'ffff] or
8107                          *      [0x0000'0000, 0x0000'007f]
8108                          * difference to previous test: truncation via MOV32
8109                          * instead of ALU32.
8110                          */
8111                         BPF_MOV32_REG(BPF_REG_1, BPF_REG_1),
8112                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
8113                         /* r1 = [0x00, 0xff] or
8114                          *      [0xffff'ffff'0000'0080, 0xffff'ffff'ffff'ffff]
8115                          */
8116                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
8117                         /* r1 = 0 or
8118                          *      [0x00ff'ffff'ff00'0000, 0x00ff'ffff'ffff'ffff]
8119                          */
8120                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
8121                         /* no-op or OOB pointer computation */
8122                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8123                         /* potentially OOB access */
8124                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8125                         /* exit */
8126                         BPF_MOV64_IMM(BPF_REG_0, 0),
8127                         BPF_EXIT_INSN(),
8128                 },
8129                 .fixup_map1 = { 3 },
8130                 /* not actually fully unbounded, but the bound is very high */
8131                 .errstr = "R0 unbounded memory access",
8132                 .result = REJECT
8133         },
8134         {
8135                 "bounds check after wrapping 32-bit addition",
8136                 .insns = {
8137                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8138                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8139                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8140                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8141                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8142                                      BPF_FUNC_map_lookup_elem),
8143                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
8144                         /* r1 = 0x7fff'ffff */
8145                         BPF_MOV64_IMM(BPF_REG_1, 0x7fffffff),
8146                         /* r1 = 0xffff'fffe */
8147                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
8148                         /* r1 = 0 */
8149                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 2),
8150                         /* no-op */
8151                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8152                         /* access at offset 0 */
8153                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8154                         /* exit */
8155                         BPF_MOV64_IMM(BPF_REG_0, 0),
8156                         BPF_EXIT_INSN(),
8157                 },
8158                 .fixup_map1 = { 3 },
8159                 .result = ACCEPT
8160         },
8161         {
8162                 "bounds check after shift with oversized count operand",
8163                 .insns = {
8164                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8165                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8166                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8167                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8168                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8169                                      BPF_FUNC_map_lookup_elem),
8170                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
8171                         BPF_MOV64_IMM(BPF_REG_2, 32),
8172                         BPF_MOV64_IMM(BPF_REG_1, 1),
8173                         /* r1 = (u32)1 << (u32)32 = ? */
8174                         BPF_ALU32_REG(BPF_LSH, BPF_REG_1, BPF_REG_2),
8175                         /* r1 = [0x0000, 0xffff] */
8176                         BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xffff),
8177                         /* computes unknown pointer, potentially OOB */
8178                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8179                         /* potentially OOB access */
8180                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8181                         /* exit */
8182                         BPF_MOV64_IMM(BPF_REG_0, 0),
8183                         BPF_EXIT_INSN(),
8184                 },
8185                 .fixup_map1 = { 3 },
8186                 .errstr = "R0 max value is outside of the array range",
8187                 .result = REJECT
8188         },
8189         {
8190                 "bounds check after right shift of maybe-negative number",
8191                 .insns = {
8192                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8193                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8194                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8195                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8196                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8197                                      BPF_FUNC_map_lookup_elem),
8198                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
8199                         /* r1 = [0x00, 0xff] */
8200                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8201                         /* r1 = [-0x01, 0xfe] */
8202                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 1),
8203                         /* r1 = 0 or 0xff'ffff'ffff'ffff */
8204                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
8205                         /* r1 = 0 or 0xffff'ffff'ffff */
8206                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
8207                         /* computes unknown pointer, potentially OOB */
8208                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8209                         /* potentially OOB access */
8210                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8211                         /* exit */
8212                         BPF_MOV64_IMM(BPF_REG_0, 0),
8213                         BPF_EXIT_INSN(),
8214                 },
8215                 .fixup_map1 = { 3 },
8216                 .errstr = "R0 unbounded memory access",
8217                 .result = REJECT
8218         },
8219         {
8220                 "bounds check map access with off+size signed 32bit overflow. test1",
8221                 .insns = {
8222                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8223                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8224                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8225                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8226                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8227                                      BPF_FUNC_map_lookup_elem),
8228                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
8229                         BPF_EXIT_INSN(),
8230                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x7ffffffe),
8231                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
8232                         BPF_JMP_A(0),
8233                         BPF_EXIT_INSN(),
8234                 },
8235                 .fixup_map1 = { 3 },
8236                 .errstr = "map_value pointer and 2147483646",
8237                 .result = REJECT
8238         },
8239         {
8240                 "bounds check map access with off+size signed 32bit overflow. test2",
8241                 .insns = {
8242                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8243                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8244                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8245                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8246                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8247                                      BPF_FUNC_map_lookup_elem),
8248                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
8249                         BPF_EXIT_INSN(),
8250                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
8251                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
8252                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
8253                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
8254                         BPF_JMP_A(0),
8255                         BPF_EXIT_INSN(),
8256                 },
8257                 .fixup_map1 = { 3 },
8258                 .errstr = "pointer offset 1073741822",
8259                 .result = REJECT
8260         },
8261         {
8262                 "bounds check map access with off+size signed 32bit overflow. test3",
8263                 .insns = {
8264                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8265                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8266                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8267                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8268                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8269                                      BPF_FUNC_map_lookup_elem),
8270                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
8271                         BPF_EXIT_INSN(),
8272                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 0x1fffffff),
8273                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 0x1fffffff),
8274                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 2),
8275                         BPF_JMP_A(0),
8276                         BPF_EXIT_INSN(),
8277                 },
8278                 .fixup_map1 = { 3 },
8279                 .errstr = "pointer offset -1073741822",
8280                 .result = REJECT
8281         },
8282         {
8283                 "bounds check map access with off+size signed 32bit overflow. test4",
8284                 .insns = {
8285                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8286                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8287                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8288                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8289                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8290                                      BPF_FUNC_map_lookup_elem),
8291                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
8292                         BPF_EXIT_INSN(),
8293                         BPF_MOV64_IMM(BPF_REG_1, 1000000),
8294                         BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 1000000),
8295                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8296                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 2),
8297                         BPF_JMP_A(0),
8298                         BPF_EXIT_INSN(),
8299                 },
8300                 .fixup_map1 = { 3 },
8301                 .errstr = "map_value pointer and 1000000000000",
8302                 .result = REJECT
8303         },
8304         {
8305                 "pointer/scalar confusion in state equality check (way 1)",
8306                 .insns = {
8307                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8308                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8309                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8310                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8311                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8312                                      BPF_FUNC_map_lookup_elem),
8313                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
8314                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
8315                         BPF_JMP_A(1),
8316                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
8317                         BPF_JMP_A(0),
8318                         BPF_EXIT_INSN(),
8319                 },
8320                 .fixup_map1 = { 3 },
8321                 .result = ACCEPT,
8322                 .retval = POINTER_VALUE,
8323                 .result_unpriv = REJECT,
8324                 .errstr_unpriv = "R0 leaks addr as return value"
8325         },
8326         {
8327                 "pointer/scalar confusion in state equality check (way 2)",
8328                 .insns = {
8329                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8330                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8331                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8332                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8333                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8334                                      BPF_FUNC_map_lookup_elem),
8335                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
8336                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
8337                         BPF_JMP_A(1),
8338                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
8339                         BPF_EXIT_INSN(),
8340                 },
8341                 .fixup_map1 = { 3 },
8342                 .result = ACCEPT,
8343                 .retval = POINTER_VALUE,
8344                 .result_unpriv = REJECT,
8345                 .errstr_unpriv = "R0 leaks addr as return value"
8346         },
8347         {
8348                 "variable-offset ctx access",
8349                 .insns = {
8350                         /* Get an unknown value */
8351                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
8352                         /* Make it small and 4-byte aligned */
8353                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
8354                         /* add it to skb.  We now have either &skb->len or
8355                          * &skb->pkt_type, but we don't know which
8356                          */
8357                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
8358                         /* dereference it */
8359                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
8360                         BPF_EXIT_INSN(),
8361                 },
8362                 .errstr = "variable ctx access var_off=(0x0; 0x4)",
8363                 .result = REJECT,
8364                 .prog_type = BPF_PROG_TYPE_LWT_IN,
8365         },
8366         {
8367                 "variable-offset stack access",
8368                 .insns = {
8369                         /* Fill the top 8 bytes of the stack */
8370                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8371                         /* Get an unknown value */
8372                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
8373                         /* Make it small and 4-byte aligned */
8374                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
8375                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 8),
8376                         /* add it to fp.  We now have either fp-4 or fp-8, but
8377                          * we don't know which
8378                          */
8379                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
8380                         /* dereference it */
8381                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_2, 0),
8382                         BPF_EXIT_INSN(),
8383                 },
8384                 .errstr = "variable stack access var_off=(0xfffffffffffffff8; 0x4)",
8385                 .result = REJECT,
8386                 .prog_type = BPF_PROG_TYPE_LWT_IN,
8387         },
8388         {
8389                 "indirect variable-offset stack access",
8390                 .insns = {
8391                         /* Fill the top 8 bytes of the stack */
8392                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8393                         /* Get an unknown value */
8394                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
8395                         /* Make it small and 4-byte aligned */
8396                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
8397                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 8),
8398                         /* add it to fp.  We now have either fp-4 or fp-8, but
8399                          * we don't know which
8400                          */
8401                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
8402                         /* dereference it indirectly */
8403                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8404                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8405                                      BPF_FUNC_map_lookup_elem),
8406                         BPF_MOV64_IMM(BPF_REG_0, 0),
8407                         BPF_EXIT_INSN(),
8408                 },
8409                 .fixup_map1 = { 5 },
8410                 .errstr = "variable stack read R2",
8411                 .result = REJECT,
8412                 .prog_type = BPF_PROG_TYPE_LWT_IN,
8413         },
8414         {
8415                 "direct stack access with 32-bit wraparound. test1",
8416                 .insns = {
8417                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
8418                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
8419                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
8420                         BPF_MOV32_IMM(BPF_REG_0, 0),
8421                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8422                         BPF_EXIT_INSN()
8423                 },
8424                 .errstr = "fp pointer and 2147483647",
8425                 .result = REJECT
8426         },
8427         {
8428                 "direct stack access with 32-bit wraparound. test2",
8429                 .insns = {
8430                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
8431                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x3fffffff),
8432                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x3fffffff),
8433                         BPF_MOV32_IMM(BPF_REG_0, 0),
8434                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8435                         BPF_EXIT_INSN()
8436                 },
8437                 .errstr = "fp pointer and 1073741823",
8438                 .result = REJECT
8439         },
8440         {
8441                 "direct stack access with 32-bit wraparound. test3",
8442                 .insns = {
8443                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
8444                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x1fffffff),
8445                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x1fffffff),
8446                         BPF_MOV32_IMM(BPF_REG_0, 0),
8447                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8448                         BPF_EXIT_INSN()
8449                 },
8450                 .errstr = "fp pointer offset 1073741822",
8451                 .result = REJECT
8452         },
8453         {
8454                 "liveness pruning and write screening",
8455                 .insns = {
8456                         /* Get an unknown value */
8457                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
8458                         /* branch conditions teach us nothing about R2 */
8459                         BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),
8460                         BPF_MOV64_IMM(BPF_REG_0, 0),
8461                         BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),
8462                         BPF_MOV64_IMM(BPF_REG_0, 0),
8463                         BPF_EXIT_INSN(),
8464                 },
8465                 .errstr = "R0 !read_ok",
8466                 .result = REJECT,
8467                 .prog_type = BPF_PROG_TYPE_LWT_IN,
8468         },
8469         {
8470                 "varlen_map_value_access pruning",
8471                 .insns = {
8472                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8473                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8474                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8475                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8476                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8477                                      BPF_FUNC_map_lookup_elem),
8478                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
8479                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
8480                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
8481                         BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
8482                         BPF_MOV32_IMM(BPF_REG_1, 0),
8483                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
8484                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8485                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
8486                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
8487                                    offsetof(struct test_val, foo)),
8488                         BPF_EXIT_INSN(),
8489                 },
8490                 .fixup_map2 = { 3 },
8491                 .errstr_unpriv = "R0 leaks addr",
8492                 .errstr = "R0 unbounded memory access",
8493                 .result_unpriv = REJECT,
8494                 .result = REJECT,
8495                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8496         },
8497         {
8498                 "invalid 64-bit BPF_END",
8499                 .insns = {
8500                         BPF_MOV32_IMM(BPF_REG_0, 0),
8501                         {
8502                                 .code  = BPF_ALU64 | BPF_END | BPF_TO_LE,
8503                                 .dst_reg = BPF_REG_0,
8504                                 .src_reg = 0,
8505                                 .off   = 0,
8506                                 .imm   = 32,
8507                         },
8508                         BPF_EXIT_INSN(),
8509                 },
8510                 .errstr = "unknown opcode d7",
8511                 .result = REJECT,
8512         },
8513         {
8514                 "XDP, using ifindex from netdev",
8515                 .insns = {
8516                         BPF_MOV64_IMM(BPF_REG_0, 0),
8517                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8518                                     offsetof(struct xdp_md, ingress_ifindex)),
8519                         BPF_JMP_IMM(BPF_JLT, BPF_REG_2, 1, 1),
8520                         BPF_MOV64_IMM(BPF_REG_0, 1),
8521                         BPF_EXIT_INSN(),
8522                 },
8523                 .result = ACCEPT,
8524                 .prog_type = BPF_PROG_TYPE_XDP,
8525                 .retval = 1,
8526         },
8527         {
8528                 "meta access, test1",
8529                 .insns = {
8530                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8531                                     offsetof(struct xdp_md, data_meta)),
8532                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8533                                     offsetof(struct xdp_md, data)),
8534                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
8535                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
8536                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
8537                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8538                         BPF_MOV64_IMM(BPF_REG_0, 0),
8539                         BPF_EXIT_INSN(),
8540                 },
8541                 .result = ACCEPT,
8542                 .prog_type = BPF_PROG_TYPE_XDP,
8543         },
8544         {
8545                 "meta access, test2",
8546                 .insns = {
8547                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8548                                     offsetof(struct xdp_md, data_meta)),
8549                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8550                                     offsetof(struct xdp_md, data)),
8551                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
8552                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 8),
8553                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
8554                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
8555                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
8556                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8557                         BPF_MOV64_IMM(BPF_REG_0, 0),
8558                         BPF_EXIT_INSN(),
8559                 },
8560                 .result = REJECT,
8561                 .errstr = "invalid access to packet, off=-8",
8562                 .prog_type = BPF_PROG_TYPE_XDP,
8563         },
8564         {
8565                 "meta access, test3",
8566                 .insns = {
8567                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8568                                     offsetof(struct xdp_md, data_meta)),
8569                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8570                                     offsetof(struct xdp_md, data_end)),
8571                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
8572                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
8573                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
8574                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8575                         BPF_MOV64_IMM(BPF_REG_0, 0),
8576                         BPF_EXIT_INSN(),
8577                 },
8578                 .result = REJECT,
8579                 .errstr = "invalid access to packet",
8580                 .prog_type = BPF_PROG_TYPE_XDP,
8581         },
8582         {
8583                 "meta access, test4",
8584                 .insns = {
8585                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8586                                     offsetof(struct xdp_md, data_meta)),
8587                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8588                                     offsetof(struct xdp_md, data_end)),
8589                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
8590                                     offsetof(struct xdp_md, data)),
8591                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
8592                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
8593                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
8594                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8595                         BPF_MOV64_IMM(BPF_REG_0, 0),
8596                         BPF_EXIT_INSN(),
8597                 },
8598                 .result = REJECT,
8599                 .errstr = "invalid access to packet",
8600                 .prog_type = BPF_PROG_TYPE_XDP,
8601         },
8602         {
8603                 "meta access, test5",
8604                 .insns = {
8605                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8606                                     offsetof(struct xdp_md, data_meta)),
8607                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
8608                                     offsetof(struct xdp_md, data)),
8609                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
8610                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
8611                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_4, 3),
8612                         BPF_MOV64_IMM(BPF_REG_2, -8),
8613                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8614                                      BPF_FUNC_xdp_adjust_meta),
8615                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 0),
8616                         BPF_MOV64_IMM(BPF_REG_0, 0),
8617                         BPF_EXIT_INSN(),
8618                 },
8619                 .result = REJECT,
8620                 .errstr = "R3 !read_ok",
8621                 .prog_type = BPF_PROG_TYPE_XDP,
8622         },
8623         {
8624                 "meta access, test6",
8625                 .insns = {
8626                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8627                                     offsetof(struct xdp_md, data_meta)),
8628                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8629                                     offsetof(struct xdp_md, data)),
8630                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
8631                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
8632                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
8633                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
8634                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_0, 1),
8635                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8636                         BPF_MOV64_IMM(BPF_REG_0, 0),
8637                         BPF_EXIT_INSN(),
8638                 },
8639                 .result = REJECT,
8640                 .errstr = "invalid access to packet",
8641                 .prog_type = BPF_PROG_TYPE_XDP,
8642         },
8643         {
8644                 "meta access, test7",
8645                 .insns = {
8646                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8647                                     offsetof(struct xdp_md, data_meta)),
8648                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8649                                     offsetof(struct xdp_md, data)),
8650                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
8651                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
8652                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
8653                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
8654                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
8655                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8656                         BPF_MOV64_IMM(BPF_REG_0, 0),
8657                         BPF_EXIT_INSN(),
8658                 },
8659                 .result = ACCEPT,
8660                 .prog_type = BPF_PROG_TYPE_XDP,
8661         },
8662         {
8663                 "meta access, test8",
8664                 .insns = {
8665                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8666                                     offsetof(struct xdp_md, data_meta)),
8667                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8668                                     offsetof(struct xdp_md, data)),
8669                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
8670                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0xFFFF),
8671                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
8672                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8673                         BPF_MOV64_IMM(BPF_REG_0, 0),
8674                         BPF_EXIT_INSN(),
8675                 },
8676                 .result = ACCEPT,
8677                 .prog_type = BPF_PROG_TYPE_XDP,
8678         },
8679         {
8680                 "meta access, test9",
8681                 .insns = {
8682                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8683                                     offsetof(struct xdp_md, data_meta)),
8684                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8685                                     offsetof(struct xdp_md, data)),
8686                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
8687                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0xFFFF),
8688                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 1),
8689                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
8690                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8691                         BPF_MOV64_IMM(BPF_REG_0, 0),
8692                         BPF_EXIT_INSN(),
8693                 },
8694                 .result = REJECT,
8695                 .errstr = "invalid access to packet",
8696                 .prog_type = BPF_PROG_TYPE_XDP,
8697         },
8698         {
8699                 "meta access, test10",
8700                 .insns = {
8701                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8702                                     offsetof(struct xdp_md, data_meta)),
8703                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8704                                     offsetof(struct xdp_md, data)),
8705                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
8706                                     offsetof(struct xdp_md, data_end)),
8707                         BPF_MOV64_IMM(BPF_REG_5, 42),
8708                         BPF_MOV64_IMM(BPF_REG_6, 24),
8709                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_5, -8),
8710                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
8711                         BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -8),
8712                         BPF_JMP_IMM(BPF_JGT, BPF_REG_5, 100, 6),
8713                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_5),
8714                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
8715                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
8716                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
8717                         BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_5, 1),
8718                         BPF_LDX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
8719                         BPF_MOV64_IMM(BPF_REG_0, 0),
8720                         BPF_EXIT_INSN(),
8721                 },
8722                 .result = REJECT,
8723                 .errstr = "invalid access to packet",
8724                 .prog_type = BPF_PROG_TYPE_XDP,
8725         },
8726         {
8727                 "meta access, test11",
8728                 .insns = {
8729                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8730                                     offsetof(struct xdp_md, data_meta)),
8731                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8732                                     offsetof(struct xdp_md, data)),
8733                         BPF_MOV64_IMM(BPF_REG_5, 42),
8734                         BPF_MOV64_IMM(BPF_REG_6, 24),
8735                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_5, -8),
8736                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
8737                         BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -8),
8738                         BPF_JMP_IMM(BPF_JGT, BPF_REG_5, 100, 6),
8739                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_5),
8740                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
8741                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
8742                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
8743                         BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_3, 1),
8744                         BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_5, 0),
8745                         BPF_MOV64_IMM(BPF_REG_0, 0),
8746                         BPF_EXIT_INSN(),
8747                 },
8748                 .result = ACCEPT,
8749                 .prog_type = BPF_PROG_TYPE_XDP,
8750         },
8751         {
8752                 "meta access, test12",
8753                 .insns = {
8754                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8755                                     offsetof(struct xdp_md, data_meta)),
8756                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8757                                     offsetof(struct xdp_md, data)),
8758                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
8759                                     offsetof(struct xdp_md, data_end)),
8760                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
8761                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 16),
8762                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_4, 5),
8763                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 0),
8764                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
8765                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 16),
8766                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 1),
8767                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8768                         BPF_MOV64_IMM(BPF_REG_0, 0),
8769                         BPF_EXIT_INSN(),
8770                 },
8771                 .result = ACCEPT,
8772                 .prog_type = BPF_PROG_TYPE_XDP,
8773         },
8774         {
8775                 "arithmetic ops make PTR_TO_CTX unusable",
8776                 .insns = {
8777                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
8778                                       offsetof(struct __sk_buff, data) -
8779                                       offsetof(struct __sk_buff, mark)),
8780                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
8781                                     offsetof(struct __sk_buff, mark)),
8782                         BPF_EXIT_INSN(),
8783                 },
8784                 .errstr = "dereference of modified ctx ptr",
8785                 .result = REJECT,
8786                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
8787         },
8788         {
8789                 "pkt_end - pkt_start is allowed",
8790                 .insns = {
8791                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
8792                                     offsetof(struct __sk_buff, data_end)),
8793                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8794                                     offsetof(struct __sk_buff, data)),
8795                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_2),
8796                         BPF_EXIT_INSN(),
8797                 },
8798                 .result = ACCEPT,
8799                 .retval = TEST_DATA_LEN,
8800                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
8801         },
8802         {
8803                 "XDP pkt read, pkt_end mangling, bad access 1",
8804                 .insns = {
8805                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8806                                     offsetof(struct xdp_md, data)),
8807                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8808                                     offsetof(struct xdp_md, data_end)),
8809                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8810                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8811                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 8),
8812                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
8813                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8814                         BPF_MOV64_IMM(BPF_REG_0, 0),
8815                         BPF_EXIT_INSN(),
8816                 },
8817                 .errstr = "R3 pointer arithmetic on PTR_TO_PACKET_END",
8818                 .result = REJECT,
8819                 .prog_type = BPF_PROG_TYPE_XDP,
8820         },
8821         {
8822                 "XDP pkt read, pkt_end mangling, bad access 2",
8823                 .insns = {
8824                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8825                                     offsetof(struct xdp_md, data)),
8826                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8827                                     offsetof(struct xdp_md, data_end)),
8828                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8829                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8830                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_3, 8),
8831                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
8832                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8833                         BPF_MOV64_IMM(BPF_REG_0, 0),
8834                         BPF_EXIT_INSN(),
8835                 },
8836                 .errstr = "R3 pointer arithmetic on PTR_TO_PACKET_END",
8837                 .result = REJECT,
8838                 .prog_type = BPF_PROG_TYPE_XDP,
8839         },
8840         {
8841                 "XDP pkt read, pkt_data' > pkt_end, good access",
8842                 .insns = {
8843                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8844                                     offsetof(struct xdp_md, data)),
8845                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8846                                     offsetof(struct xdp_md, data_end)),
8847                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8848                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8849                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
8850                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8851                         BPF_MOV64_IMM(BPF_REG_0, 0),
8852                         BPF_EXIT_INSN(),
8853                 },
8854                 .result = ACCEPT,
8855                 .prog_type = BPF_PROG_TYPE_XDP,
8856         },
8857         {
8858                 "XDP pkt read, pkt_data' > pkt_end, bad access 1",
8859                 .insns = {
8860                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8861                                     offsetof(struct xdp_md, data)),
8862                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8863                                     offsetof(struct xdp_md, data_end)),
8864                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8865                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8866                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
8867                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
8868                         BPF_MOV64_IMM(BPF_REG_0, 0),
8869                         BPF_EXIT_INSN(),
8870                 },
8871                 .errstr = "R1 offset is outside of the packet",
8872                 .result = REJECT,
8873                 .prog_type = BPF_PROG_TYPE_XDP,
8874                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8875         },
8876         {
8877                 "XDP pkt read, pkt_data' > pkt_end, bad access 2",
8878                 .insns = {
8879                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8880                                     offsetof(struct xdp_md, data)),
8881                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8882                                     offsetof(struct xdp_md, data_end)),
8883                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8884                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8885                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0),
8886                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8887                         BPF_MOV64_IMM(BPF_REG_0, 0),
8888                         BPF_EXIT_INSN(),
8889                 },
8890                 .errstr = "R1 offset is outside of the packet",
8891                 .result = REJECT,
8892                 .prog_type = BPF_PROG_TYPE_XDP,
8893         },
8894         {
8895                 "XDP pkt read, pkt_end > pkt_data', good access",
8896                 .insns = {
8897                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8898                                     offsetof(struct xdp_md, data)),
8899                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8900                                     offsetof(struct xdp_md, data_end)),
8901                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8902                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8903                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
8904                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8905                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
8906                         BPF_MOV64_IMM(BPF_REG_0, 0),
8907                         BPF_EXIT_INSN(),
8908                 },
8909                 .result = ACCEPT,
8910                 .prog_type = BPF_PROG_TYPE_XDP,
8911                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8912         },
8913         {
8914                 "XDP pkt read, pkt_end > pkt_data', bad access 1",
8915                 .insns = {
8916                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8917                                     offsetof(struct xdp_md, data)),
8918                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8919                                     offsetof(struct xdp_md, data_end)),
8920                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8921                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8922                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
8923                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8924                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8925                         BPF_MOV64_IMM(BPF_REG_0, 0),
8926                         BPF_EXIT_INSN(),
8927                 },
8928                 .errstr = "R1 offset is outside of the packet",
8929                 .result = REJECT,
8930                 .prog_type = BPF_PROG_TYPE_XDP,
8931         },
8932         {
8933                 "XDP pkt read, pkt_end > pkt_data', bad access 2",
8934                 .insns = {
8935                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8936                                     offsetof(struct xdp_md, data)),
8937                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8938                                     offsetof(struct xdp_md, data_end)),
8939                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8940                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8941                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
8942                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8943                         BPF_MOV64_IMM(BPF_REG_0, 0),
8944                         BPF_EXIT_INSN(),
8945                 },
8946                 .errstr = "R1 offset is outside of the packet",
8947                 .result = REJECT,
8948                 .prog_type = BPF_PROG_TYPE_XDP,
8949         },
8950         {
8951                 "XDP pkt read, pkt_data' < pkt_end, good access",
8952                 .insns = {
8953                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8954                                     offsetof(struct xdp_md, data)),
8955                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8956                                     offsetof(struct xdp_md, data_end)),
8957                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8958                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8959                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
8960                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8961                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
8962                         BPF_MOV64_IMM(BPF_REG_0, 0),
8963                         BPF_EXIT_INSN(),
8964                 },
8965                 .result = ACCEPT,
8966                 .prog_type = BPF_PROG_TYPE_XDP,
8967                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8968         },
8969         {
8970                 "XDP pkt read, pkt_data' < pkt_end, bad access 1",
8971                 .insns = {
8972                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8973                                     offsetof(struct xdp_md, data)),
8974                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8975                                     offsetof(struct xdp_md, data_end)),
8976                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8977                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8978                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
8979                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8980                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8981                         BPF_MOV64_IMM(BPF_REG_0, 0),
8982                         BPF_EXIT_INSN(),
8983                 },
8984                 .errstr = "R1 offset is outside of the packet",
8985                 .result = REJECT,
8986                 .prog_type = BPF_PROG_TYPE_XDP,
8987         },
8988         {
8989                 "XDP pkt read, pkt_data' < pkt_end, bad access 2",
8990                 .insns = {
8991                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8992                                     offsetof(struct xdp_md, data)),
8993                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8994                                     offsetof(struct xdp_md, data_end)),
8995                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8996                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8997                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
8998                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8999                         BPF_MOV64_IMM(BPF_REG_0, 0),
9000                         BPF_EXIT_INSN(),
9001                 },
9002                 .errstr = "R1 offset is outside of the packet",
9003                 .result = REJECT,
9004                 .prog_type = BPF_PROG_TYPE_XDP,
9005         },
9006         {
9007                 "XDP pkt read, pkt_end < pkt_data', good access",
9008                 .insns = {
9009                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9010                                     offsetof(struct xdp_md, data)),
9011                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9012                                     offsetof(struct xdp_md, data_end)),
9013                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9014                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9015                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
9016                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9017                         BPF_MOV64_IMM(BPF_REG_0, 0),
9018                         BPF_EXIT_INSN(),
9019                 },
9020                 .result = ACCEPT,
9021                 .prog_type = BPF_PROG_TYPE_XDP,
9022         },
9023         {
9024                 "XDP pkt read, pkt_end < pkt_data', bad access 1",
9025                 .insns = {
9026                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9027                                     offsetof(struct xdp_md, data)),
9028                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9029                                     offsetof(struct xdp_md, data_end)),
9030                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9031                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9032                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
9033                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9034                         BPF_MOV64_IMM(BPF_REG_0, 0),
9035                         BPF_EXIT_INSN(),
9036                 },
9037                 .errstr = "R1 offset is outside of the packet",
9038                 .result = REJECT,
9039                 .prog_type = BPF_PROG_TYPE_XDP,
9040                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9041         },
9042         {
9043                 "XDP pkt read, pkt_end < pkt_data', bad access 2",
9044                 .insns = {
9045                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9046                                     offsetof(struct xdp_md, data)),
9047                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9048                                     offsetof(struct xdp_md, data_end)),
9049                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9050                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9051                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0),
9052                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9053                         BPF_MOV64_IMM(BPF_REG_0, 0),
9054                         BPF_EXIT_INSN(),
9055                 },
9056                 .errstr = "R1 offset is outside of the packet",
9057                 .result = REJECT,
9058                 .prog_type = BPF_PROG_TYPE_XDP,
9059         },
9060         {
9061                 "XDP pkt read, pkt_data' >= pkt_end, good access",
9062                 .insns = {
9063                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9064                                     offsetof(struct xdp_md, data)),
9065                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9066                                     offsetof(struct xdp_md, data_end)),
9067                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9068                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9069                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
9070                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9071                         BPF_MOV64_IMM(BPF_REG_0, 0),
9072                         BPF_EXIT_INSN(),
9073                 },
9074                 .result = ACCEPT,
9075                 .prog_type = BPF_PROG_TYPE_XDP,
9076                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9077         },
9078         {
9079                 "XDP pkt read, pkt_data' >= pkt_end, bad access 1",
9080                 .insns = {
9081                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9082                                     offsetof(struct xdp_md, data)),
9083                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9084                                     offsetof(struct xdp_md, data_end)),
9085                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9086                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9087                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
9088                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9089                         BPF_MOV64_IMM(BPF_REG_0, 0),
9090                         BPF_EXIT_INSN(),
9091                 },
9092                 .errstr = "R1 offset is outside of the packet",
9093                 .result = REJECT,
9094                 .prog_type = BPF_PROG_TYPE_XDP,
9095         },
9096         {
9097                 "XDP pkt read, pkt_data' >= pkt_end, bad access 2",
9098                 .insns = {
9099                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9100                                     offsetof(struct xdp_md, data)),
9101                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9102                                     offsetof(struct xdp_md, data_end)),
9103                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9104                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9105                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0),
9106                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9107                         BPF_MOV64_IMM(BPF_REG_0, 0),
9108                         BPF_EXIT_INSN(),
9109                 },
9110                 .errstr = "R1 offset is outside of the packet",
9111                 .result = REJECT,
9112                 .prog_type = BPF_PROG_TYPE_XDP,
9113                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9114         },
9115         {
9116                 "XDP pkt read, pkt_end >= pkt_data', good access",
9117                 .insns = {
9118                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9119                                     offsetof(struct xdp_md, data)),
9120                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9121                                     offsetof(struct xdp_md, data_end)),
9122                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9123                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9124                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
9125                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9126                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9127                         BPF_MOV64_IMM(BPF_REG_0, 0),
9128                         BPF_EXIT_INSN(),
9129                 },
9130                 .result = ACCEPT,
9131                 .prog_type = BPF_PROG_TYPE_XDP,
9132         },
9133         {
9134                 "XDP pkt read, pkt_end >= pkt_data', bad access 1",
9135                 .insns = {
9136                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9137                                     offsetof(struct xdp_md, data)),
9138                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9139                                     offsetof(struct xdp_md, data_end)),
9140                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9141                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9142                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
9143                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9144                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9145                         BPF_MOV64_IMM(BPF_REG_0, 0),
9146                         BPF_EXIT_INSN(),
9147                 },
9148                 .errstr = "R1 offset is outside of the packet",
9149                 .result = REJECT,
9150                 .prog_type = BPF_PROG_TYPE_XDP,
9151                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9152         },
9153         {
9154                 "XDP pkt read, pkt_end >= pkt_data', bad access 2",
9155                 .insns = {
9156                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9157                                     offsetof(struct xdp_md, data)),
9158                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9159                                     offsetof(struct xdp_md, data_end)),
9160                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9161                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9162                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
9163                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9164                         BPF_MOV64_IMM(BPF_REG_0, 0),
9165                         BPF_EXIT_INSN(),
9166                 },
9167                 .errstr = "R1 offset is outside of the packet",
9168                 .result = REJECT,
9169                 .prog_type = BPF_PROG_TYPE_XDP,
9170         },
9171         {
9172                 "XDP pkt read, pkt_data' <= pkt_end, good access",
9173                 .insns = {
9174                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9175                                     offsetof(struct xdp_md, data)),
9176                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9177                                     offsetof(struct xdp_md, data_end)),
9178                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9179                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9180                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9181                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9182                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9183                         BPF_MOV64_IMM(BPF_REG_0, 0),
9184                         BPF_EXIT_INSN(),
9185                 },
9186                 .result = ACCEPT,
9187                 .prog_type = BPF_PROG_TYPE_XDP,
9188         },
9189         {
9190                 "XDP pkt read, pkt_data' <= pkt_end, bad access 1",
9191                 .insns = {
9192                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9193                                     offsetof(struct xdp_md, data)),
9194                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9195                                     offsetof(struct xdp_md, data_end)),
9196                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9197                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9198                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9199                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9200                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9201                         BPF_MOV64_IMM(BPF_REG_0, 0),
9202                         BPF_EXIT_INSN(),
9203                 },
9204                 .errstr = "R1 offset is outside of the packet",
9205                 .result = REJECT,
9206                 .prog_type = BPF_PROG_TYPE_XDP,
9207                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9208         },
9209         {
9210                 "XDP pkt read, pkt_data' <= pkt_end, bad access 2",
9211                 .insns = {
9212                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9213                                     offsetof(struct xdp_md, data)),
9214                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9215                                     offsetof(struct xdp_md, data_end)),
9216                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9217                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9218                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9219                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9220                         BPF_MOV64_IMM(BPF_REG_0, 0),
9221                         BPF_EXIT_INSN(),
9222                 },
9223                 .errstr = "R1 offset is outside of the packet",
9224                 .result = REJECT,
9225                 .prog_type = BPF_PROG_TYPE_XDP,
9226         },
9227         {
9228                 "XDP pkt read, pkt_end <= pkt_data', good access",
9229                 .insns = {
9230                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9231                                     offsetof(struct xdp_md, data)),
9232                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9233                                     offsetof(struct xdp_md, data_end)),
9234                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9235                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9236                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
9237                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9238                         BPF_MOV64_IMM(BPF_REG_0, 0),
9239                         BPF_EXIT_INSN(),
9240                 },
9241                 .result = ACCEPT,
9242                 .prog_type = BPF_PROG_TYPE_XDP,
9243                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9244         },
9245         {
9246                 "XDP pkt read, pkt_end <= pkt_data', bad access 1",
9247                 .insns = {
9248                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9249                                     offsetof(struct xdp_md, data)),
9250                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9251                                     offsetof(struct xdp_md, data_end)),
9252                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9253                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9254                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
9255                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9256                         BPF_MOV64_IMM(BPF_REG_0, 0),
9257                         BPF_EXIT_INSN(),
9258                 },
9259                 .errstr = "R1 offset is outside of the packet",
9260                 .result = REJECT,
9261                 .prog_type = BPF_PROG_TYPE_XDP,
9262         },
9263         {
9264                 "XDP pkt read, pkt_end <= pkt_data', bad access 2",
9265                 .insns = {
9266                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9267                                     offsetof(struct xdp_md, data)),
9268                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9269                                     offsetof(struct xdp_md, data_end)),
9270                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9271                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9272                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0),
9273                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9274                         BPF_MOV64_IMM(BPF_REG_0, 0),
9275                         BPF_EXIT_INSN(),
9276                 },
9277                 .errstr = "R1 offset is outside of the packet",
9278                 .result = REJECT,
9279                 .prog_type = BPF_PROG_TYPE_XDP,
9280                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9281         },
9282         {
9283                 "XDP pkt read, pkt_meta' > pkt_data, good access",
9284                 .insns = {
9285                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9286                                     offsetof(struct xdp_md, data_meta)),
9287                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9288                                     offsetof(struct xdp_md, data)),
9289                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9290                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9291                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
9292                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9293                         BPF_MOV64_IMM(BPF_REG_0, 0),
9294                         BPF_EXIT_INSN(),
9295                 },
9296                 .result = ACCEPT,
9297                 .prog_type = BPF_PROG_TYPE_XDP,
9298         },
9299         {
9300                 "XDP pkt read, pkt_meta' > pkt_data, bad access 1",
9301                 .insns = {
9302                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9303                                     offsetof(struct xdp_md, data_meta)),
9304                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9305                                     offsetof(struct xdp_md, data)),
9306                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9307                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9308                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
9309                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9310                         BPF_MOV64_IMM(BPF_REG_0, 0),
9311                         BPF_EXIT_INSN(),
9312                 },
9313                 .errstr = "R1 offset is outside of the packet",
9314                 .result = REJECT,
9315                 .prog_type = BPF_PROG_TYPE_XDP,
9316                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9317         },
9318         {
9319                 "XDP pkt read, pkt_meta' > pkt_data, bad access 2",
9320                 .insns = {
9321                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9322                                     offsetof(struct xdp_md, data_meta)),
9323                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9324                                     offsetof(struct xdp_md, data)),
9325                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9326                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9327                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0),
9328                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9329                         BPF_MOV64_IMM(BPF_REG_0, 0),
9330                         BPF_EXIT_INSN(),
9331                 },
9332                 .errstr = "R1 offset is outside of the packet",
9333                 .result = REJECT,
9334                 .prog_type = BPF_PROG_TYPE_XDP,
9335         },
9336         {
9337                 "XDP pkt read, pkt_data > pkt_meta', good access",
9338                 .insns = {
9339                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9340                                     offsetof(struct xdp_md, data_meta)),
9341                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9342                                     offsetof(struct xdp_md, data)),
9343                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9344                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9345                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
9346                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9347                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9348                         BPF_MOV64_IMM(BPF_REG_0, 0),
9349                         BPF_EXIT_INSN(),
9350                 },
9351                 .result = ACCEPT,
9352                 .prog_type = BPF_PROG_TYPE_XDP,
9353                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9354         },
9355         {
9356                 "XDP pkt read, pkt_data > pkt_meta', bad access 1",
9357                 .insns = {
9358                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9359                                     offsetof(struct xdp_md, data_meta)),
9360                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9361                                     offsetof(struct xdp_md, data)),
9362                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9363                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9364                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
9365                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9366                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9367                         BPF_MOV64_IMM(BPF_REG_0, 0),
9368                         BPF_EXIT_INSN(),
9369                 },
9370                 .errstr = "R1 offset is outside of the packet",
9371                 .result = REJECT,
9372                 .prog_type = BPF_PROG_TYPE_XDP,
9373         },
9374         {
9375                 "XDP pkt read, pkt_data > pkt_meta', bad access 2",
9376                 .insns = {
9377                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9378                                     offsetof(struct xdp_md, data_meta)),
9379                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9380                                     offsetof(struct xdp_md, data)),
9381                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9382                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9383                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
9384                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9385                         BPF_MOV64_IMM(BPF_REG_0, 0),
9386                         BPF_EXIT_INSN(),
9387                 },
9388                 .errstr = "R1 offset is outside of the packet",
9389                 .result = REJECT,
9390                 .prog_type = BPF_PROG_TYPE_XDP,
9391         },
9392         {
9393                 "XDP pkt read, pkt_meta' < pkt_data, good access",
9394                 .insns = {
9395                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9396                                     offsetof(struct xdp_md, data_meta)),
9397                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9398                                     offsetof(struct xdp_md, data)),
9399                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9400                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9401                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
9402                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9403                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9404                         BPF_MOV64_IMM(BPF_REG_0, 0),
9405                         BPF_EXIT_INSN(),
9406                 },
9407                 .result = ACCEPT,
9408                 .prog_type = BPF_PROG_TYPE_XDP,
9409                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9410         },
9411         {
9412                 "XDP pkt read, pkt_meta' < pkt_data, bad access 1",
9413                 .insns = {
9414                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9415                                     offsetof(struct xdp_md, data_meta)),
9416                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9417                                     offsetof(struct xdp_md, data)),
9418                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9419                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9420                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
9421                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9422                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9423                         BPF_MOV64_IMM(BPF_REG_0, 0),
9424                         BPF_EXIT_INSN(),
9425                 },
9426                 .errstr = "R1 offset is outside of the packet",
9427                 .result = REJECT,
9428                 .prog_type = BPF_PROG_TYPE_XDP,
9429         },
9430         {
9431                 "XDP pkt read, pkt_meta' < pkt_data, bad access 2",
9432                 .insns = {
9433                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9434                                     offsetof(struct xdp_md, data_meta)),
9435                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9436                                     offsetof(struct xdp_md, data)),
9437                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9438                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9439                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
9440                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9441                         BPF_MOV64_IMM(BPF_REG_0, 0),
9442                         BPF_EXIT_INSN(),
9443                 },
9444                 .errstr = "R1 offset is outside of the packet",
9445                 .result = REJECT,
9446                 .prog_type = BPF_PROG_TYPE_XDP,
9447         },
9448         {
9449                 "XDP pkt read, pkt_data < pkt_meta', good access",
9450                 .insns = {
9451                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9452                                     offsetof(struct xdp_md, data_meta)),
9453                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9454                                     offsetof(struct xdp_md, data)),
9455                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9456                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9457                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
9458                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9459                         BPF_MOV64_IMM(BPF_REG_0, 0),
9460                         BPF_EXIT_INSN(),
9461                 },
9462                 .result = ACCEPT,
9463                 .prog_type = BPF_PROG_TYPE_XDP,
9464         },
9465         {
9466                 "XDP pkt read, pkt_data < pkt_meta', bad access 1",
9467                 .insns = {
9468                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9469                                     offsetof(struct xdp_md, data_meta)),
9470                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9471                                     offsetof(struct xdp_md, data)),
9472                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9473                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9474                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
9475                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9476                         BPF_MOV64_IMM(BPF_REG_0, 0),
9477                         BPF_EXIT_INSN(),
9478                 },
9479                 .errstr = "R1 offset is outside of the packet",
9480                 .result = REJECT,
9481                 .prog_type = BPF_PROG_TYPE_XDP,
9482                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9483         },
9484         {
9485                 "XDP pkt read, pkt_data < pkt_meta', bad access 2",
9486                 .insns = {
9487                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9488                                     offsetof(struct xdp_md, data_meta)),
9489                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9490                                     offsetof(struct xdp_md, data)),
9491                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9492                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9493                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0),
9494                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9495                         BPF_MOV64_IMM(BPF_REG_0, 0),
9496                         BPF_EXIT_INSN(),
9497                 },
9498                 .errstr = "R1 offset is outside of the packet",
9499                 .result = REJECT,
9500                 .prog_type = BPF_PROG_TYPE_XDP,
9501         },
9502         {
9503                 "XDP pkt read, pkt_meta' >= pkt_data, good access",
9504                 .insns = {
9505                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9506                                     offsetof(struct xdp_md, data_meta)),
9507                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9508                                     offsetof(struct xdp_md, data)),
9509                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9510                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9511                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
9512                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9513                         BPF_MOV64_IMM(BPF_REG_0, 0),
9514                         BPF_EXIT_INSN(),
9515                 },
9516                 .result = ACCEPT,
9517                 .prog_type = BPF_PROG_TYPE_XDP,
9518                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9519         },
9520         {
9521                 "XDP pkt read, pkt_meta' >= pkt_data, bad access 1",
9522                 .insns = {
9523                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9524                                     offsetof(struct xdp_md, data_meta)),
9525                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9526                                     offsetof(struct xdp_md, data)),
9527                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9528                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9529                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
9530                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9531                         BPF_MOV64_IMM(BPF_REG_0, 0),
9532                         BPF_EXIT_INSN(),
9533                 },
9534                 .errstr = "R1 offset is outside of the packet",
9535                 .result = REJECT,
9536                 .prog_type = BPF_PROG_TYPE_XDP,
9537         },
9538         {
9539                 "XDP pkt read, pkt_meta' >= pkt_data, bad access 2",
9540                 .insns = {
9541                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9542                                     offsetof(struct xdp_md, data_meta)),
9543                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9544                                     offsetof(struct xdp_md, data)),
9545                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9546                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9547                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0),
9548                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9549                         BPF_MOV64_IMM(BPF_REG_0, 0),
9550                         BPF_EXIT_INSN(),
9551                 },
9552                 .errstr = "R1 offset is outside of the packet",
9553                 .result = REJECT,
9554                 .prog_type = BPF_PROG_TYPE_XDP,
9555                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9556         },
9557         {
9558                 "XDP pkt read, pkt_data >= pkt_meta', good access",
9559                 .insns = {
9560                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9561                                     offsetof(struct xdp_md, data_meta)),
9562                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9563                                     offsetof(struct xdp_md, data)),
9564                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9565                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9566                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
9567                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9568                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9569                         BPF_MOV64_IMM(BPF_REG_0, 0),
9570                         BPF_EXIT_INSN(),
9571                 },
9572                 .result = ACCEPT,
9573                 .prog_type = BPF_PROG_TYPE_XDP,
9574         },
9575         {
9576                 "XDP pkt read, pkt_data >= pkt_meta', bad access 1",
9577                 .insns = {
9578                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9579                                     offsetof(struct xdp_md, data_meta)),
9580                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9581                                     offsetof(struct xdp_md, data)),
9582                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9583                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9584                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
9585                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9586                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9587                         BPF_MOV64_IMM(BPF_REG_0, 0),
9588                         BPF_EXIT_INSN(),
9589                 },
9590                 .errstr = "R1 offset is outside of the packet",
9591                 .result = REJECT,
9592                 .prog_type = BPF_PROG_TYPE_XDP,
9593                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9594         },
9595         {
9596                 "XDP pkt read, pkt_data >= pkt_meta', bad access 2",
9597                 .insns = {
9598                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9599                                     offsetof(struct xdp_md, data_meta)),
9600                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9601                                     offsetof(struct xdp_md, data)),
9602                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9603                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9604                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
9605                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9606                         BPF_MOV64_IMM(BPF_REG_0, 0),
9607                         BPF_EXIT_INSN(),
9608                 },
9609                 .errstr = "R1 offset is outside of the packet",
9610                 .result = REJECT,
9611                 .prog_type = BPF_PROG_TYPE_XDP,
9612         },
9613         {
9614                 "XDP pkt read, pkt_meta' <= pkt_data, good access",
9615                 .insns = {
9616                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9617                                     offsetof(struct xdp_md, data_meta)),
9618                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9619                                     offsetof(struct xdp_md, data)),
9620                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9621                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9622                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9623                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9624                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9625                         BPF_MOV64_IMM(BPF_REG_0, 0),
9626                         BPF_EXIT_INSN(),
9627                 },
9628                 .result = ACCEPT,
9629                 .prog_type = BPF_PROG_TYPE_XDP,
9630         },
9631         {
9632                 "XDP pkt read, pkt_meta' <= pkt_data, bad access 1",
9633                 .insns = {
9634                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9635                                     offsetof(struct xdp_md, data_meta)),
9636                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9637                                     offsetof(struct xdp_md, data)),
9638                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9639                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9640                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9641                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9642                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9643                         BPF_MOV64_IMM(BPF_REG_0, 0),
9644                         BPF_EXIT_INSN(),
9645                 },
9646                 .errstr = "R1 offset is outside of the packet",
9647                 .result = REJECT,
9648                 .prog_type = BPF_PROG_TYPE_XDP,
9649                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9650         },
9651         {
9652                 "XDP pkt read, pkt_meta' <= pkt_data, bad access 2",
9653                 .insns = {
9654                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9655                                     offsetof(struct xdp_md, data_meta)),
9656                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9657                                     offsetof(struct xdp_md, data)),
9658                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9659                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9660                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9661                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9662                         BPF_MOV64_IMM(BPF_REG_0, 0),
9663                         BPF_EXIT_INSN(),
9664                 },
9665                 .errstr = "R1 offset is outside of the packet",
9666                 .result = REJECT,
9667                 .prog_type = BPF_PROG_TYPE_XDP,
9668         },
9669         {
9670                 "XDP pkt read, pkt_data <= pkt_meta', good access",
9671                 .insns = {
9672                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9673                                     offsetof(struct xdp_md, data_meta)),
9674                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9675                                     offsetof(struct xdp_md, data)),
9676                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9677                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9678                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
9679                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9680                         BPF_MOV64_IMM(BPF_REG_0, 0),
9681                         BPF_EXIT_INSN(),
9682                 },
9683                 .result = ACCEPT,
9684                 .prog_type = BPF_PROG_TYPE_XDP,
9685                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9686         },
9687         {
9688                 "XDP pkt read, pkt_data <= pkt_meta', bad access 1",
9689                 .insns = {
9690                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9691                                     offsetof(struct xdp_md, data_meta)),
9692                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9693                                     offsetof(struct xdp_md, data)),
9694                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9695                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9696                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
9697                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9698                         BPF_MOV64_IMM(BPF_REG_0, 0),
9699                         BPF_EXIT_INSN(),
9700                 },
9701                 .errstr = "R1 offset is outside of the packet",
9702                 .result = REJECT,
9703                 .prog_type = BPF_PROG_TYPE_XDP,
9704         },
9705         {
9706                 "XDP pkt read, pkt_data <= pkt_meta', bad access 2",
9707                 .insns = {
9708                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9709                                     offsetof(struct xdp_md, data_meta)),
9710                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9711                                     offsetof(struct xdp_md, data)),
9712                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9713                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9714                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0),
9715                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9716                         BPF_MOV64_IMM(BPF_REG_0, 0),
9717                         BPF_EXIT_INSN(),
9718                 },
9719                 .errstr = "R1 offset is outside of the packet",
9720                 .result = REJECT,
9721                 .prog_type = BPF_PROG_TYPE_XDP,
9722                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9723         },
9724         {
9725                 "check deducing bounds from const, 1",
9726                 .insns = {
9727                         BPF_MOV64_IMM(BPF_REG_0, 1),
9728                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 0),
9729                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9730                         BPF_EXIT_INSN(),
9731                 },
9732                 .result = REJECT,
9733                 .errstr = "R0 tried to subtract pointer from scalar",
9734         },
9735         {
9736                 "check deducing bounds from const, 2",
9737                 .insns = {
9738                         BPF_MOV64_IMM(BPF_REG_0, 1),
9739                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1),
9740                         BPF_EXIT_INSN(),
9741                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 1, 1),
9742                         BPF_EXIT_INSN(),
9743                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
9744                         BPF_EXIT_INSN(),
9745                 },
9746                 .result = ACCEPT,
9747                 .retval = 1,
9748         },
9749         {
9750                 "check deducing bounds from const, 3",
9751                 .insns = {
9752                         BPF_MOV64_IMM(BPF_REG_0, 0),
9753                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
9754                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9755                         BPF_EXIT_INSN(),
9756                 },
9757                 .result = REJECT,
9758                 .errstr = "R0 tried to subtract pointer from scalar",
9759         },
9760         {
9761                 "check deducing bounds from const, 4",
9762                 .insns = {
9763                         BPF_MOV64_IMM(BPF_REG_0, 0),
9764                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 1),
9765                         BPF_EXIT_INSN(),
9766                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
9767                         BPF_EXIT_INSN(),
9768                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
9769                         BPF_EXIT_INSN(),
9770                 },
9771                 .result = ACCEPT,
9772         },
9773         {
9774                 "check deducing bounds from const, 5",
9775                 .insns = {
9776                         BPF_MOV64_IMM(BPF_REG_0, 0),
9777                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
9778                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9779                         BPF_EXIT_INSN(),
9780                 },
9781                 .result = REJECT,
9782                 .errstr = "R0 tried to subtract pointer from scalar",
9783         },
9784         {
9785                 "check deducing bounds from const, 6",
9786                 .insns = {
9787                         BPF_MOV64_IMM(BPF_REG_0, 0),
9788                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
9789                         BPF_EXIT_INSN(),
9790                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9791                         BPF_EXIT_INSN(),
9792                 },
9793                 .result = REJECT,
9794                 .errstr = "R0 tried to subtract pointer from scalar",
9795         },
9796         {
9797                 "check deducing bounds from const, 7",
9798                 .insns = {
9799                         BPF_MOV64_IMM(BPF_REG_0, ~0),
9800                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
9801                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
9802                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9803                                     offsetof(struct __sk_buff, mark)),
9804                         BPF_EXIT_INSN(),
9805                 },
9806                 .result = REJECT,
9807                 .errstr = "dereference of modified ctx ptr",
9808         },
9809         {
9810                 "check deducing bounds from const, 8",
9811                 .insns = {
9812                         BPF_MOV64_IMM(BPF_REG_0, ~0),
9813                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
9814                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
9815                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9816                                     offsetof(struct __sk_buff, mark)),
9817                         BPF_EXIT_INSN(),
9818                 },
9819                 .result = REJECT,
9820                 .errstr = "dereference of modified ctx ptr",
9821         },
9822         {
9823                 "check deducing bounds from const, 9",
9824                 .insns = {
9825                         BPF_MOV64_IMM(BPF_REG_0, 0),
9826                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
9827                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9828                         BPF_EXIT_INSN(),
9829                 },
9830                 .result = REJECT,
9831                 .errstr = "R0 tried to subtract pointer from scalar",
9832         },
9833         {
9834                 "check deducing bounds from const, 10",
9835                 .insns = {
9836                         BPF_MOV64_IMM(BPF_REG_0, 0),
9837                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
9838                         /* Marks reg as unknown. */
9839                         BPF_ALU64_IMM(BPF_NEG, BPF_REG_0, 0),
9840                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9841                         BPF_EXIT_INSN(),
9842                 },
9843                 .result = REJECT,
9844                 .errstr = "math between ctx pointer and register with unbounded min value is not allowed",
9845         },
9846         {
9847                 "bpf_exit with invalid return code. test1",
9848                 .insns = {
9849                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
9850                         BPF_EXIT_INSN(),
9851                 },
9852                 .errstr = "R0 has value (0x0; 0xffffffff)",
9853                 .result = REJECT,
9854                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9855         },
9856         {
9857                 "bpf_exit with invalid return code. test2",
9858                 .insns = {
9859                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
9860                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
9861                         BPF_EXIT_INSN(),
9862                 },
9863                 .result = ACCEPT,
9864                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9865         },
9866         {
9867                 "bpf_exit with invalid return code. test3",
9868                 .insns = {
9869                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
9870                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 3),
9871                         BPF_EXIT_INSN(),
9872                 },
9873                 .errstr = "R0 has value (0x0; 0x3)",
9874                 .result = REJECT,
9875                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9876         },
9877         {
9878                 "bpf_exit with invalid return code. test4",
9879                 .insns = {
9880                         BPF_MOV64_IMM(BPF_REG_0, 1),
9881                         BPF_EXIT_INSN(),
9882                 },
9883                 .result = ACCEPT,
9884                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9885         },
9886         {
9887                 "bpf_exit with invalid return code. test5",
9888                 .insns = {
9889                         BPF_MOV64_IMM(BPF_REG_0, 2),
9890                         BPF_EXIT_INSN(),
9891                 },
9892                 .errstr = "R0 has value (0x2; 0x0)",
9893                 .result = REJECT,
9894                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9895         },
9896         {
9897                 "bpf_exit with invalid return code. test6",
9898                 .insns = {
9899                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
9900                         BPF_EXIT_INSN(),
9901                 },
9902                 .errstr = "R0 is not a known value (ctx)",
9903                 .result = REJECT,
9904                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9905         },
9906         {
9907                 "bpf_exit with invalid return code. test7",
9908                 .insns = {
9909                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
9910                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 4),
9911                         BPF_ALU64_REG(BPF_MUL, BPF_REG_0, BPF_REG_2),
9912                         BPF_EXIT_INSN(),
9913                 },
9914                 .errstr = "R0 has unknown scalar value",
9915                 .result = REJECT,
9916                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9917         },
9918         {
9919                 "calls: basic sanity",
9920                 .insns = {
9921                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
9922                         BPF_MOV64_IMM(BPF_REG_0, 1),
9923                         BPF_EXIT_INSN(),
9924                         BPF_MOV64_IMM(BPF_REG_0, 2),
9925                         BPF_EXIT_INSN(),
9926                 },
9927                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9928                 .result = ACCEPT,
9929         },
9930         {
9931                 "calls: not on unpriviledged",
9932                 .insns = {
9933                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
9934                         BPF_MOV64_IMM(BPF_REG_0, 1),
9935                         BPF_EXIT_INSN(),
9936                         BPF_MOV64_IMM(BPF_REG_0, 2),
9937                         BPF_EXIT_INSN(),
9938                 },
9939                 .errstr_unpriv = "function calls to other bpf functions are allowed for root only",
9940                 .result_unpriv = REJECT,
9941                 .result = ACCEPT,
9942                 .retval = 1,
9943         },
9944         {
9945                 "calls: div by 0 in subprog",
9946                 .insns = {
9947                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
9948                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
9949                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
9950                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
9951                                     offsetof(struct __sk_buff, data_end)),
9952                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
9953                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
9954                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
9955                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
9956                         BPF_MOV64_IMM(BPF_REG_0, 1),
9957                         BPF_EXIT_INSN(),
9958                         BPF_MOV32_IMM(BPF_REG_2, 0),
9959                         BPF_MOV32_IMM(BPF_REG_3, 1),
9960                         BPF_ALU32_REG(BPF_DIV, BPF_REG_3, BPF_REG_2),
9961                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9962                                     offsetof(struct __sk_buff, data)),
9963                         BPF_EXIT_INSN(),
9964                 },
9965                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
9966                 .result = ACCEPT,
9967                 .retval = 1,
9968         },
9969         {
9970                 "calls: multiple ret types in subprog 1",
9971                 .insns = {
9972                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
9973                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
9974                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
9975                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
9976                                     offsetof(struct __sk_buff, data_end)),
9977                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
9978                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
9979                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
9980                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
9981                         BPF_MOV64_IMM(BPF_REG_0, 1),
9982                         BPF_EXIT_INSN(),
9983                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9984                                     offsetof(struct __sk_buff, data)),
9985                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
9986                         BPF_MOV32_IMM(BPF_REG_0, 42),
9987                         BPF_EXIT_INSN(),
9988                 },
9989                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
9990                 .result = REJECT,
9991                 .errstr = "R0 invalid mem access 'inv'",
9992         },
9993         {
9994                 "calls: multiple ret types in subprog 2",
9995                 .insns = {
9996                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
9997                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
9998                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
9999                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
10000                                     offsetof(struct __sk_buff, data_end)),
10001                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
10002                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
10003                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
10004                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
10005                         BPF_MOV64_IMM(BPF_REG_0, 1),
10006                         BPF_EXIT_INSN(),
10007                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10008                                     offsetof(struct __sk_buff, data)),
10009                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10010                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 9),
10011                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10012                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10013                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10014                         BPF_LD_MAP_FD(BPF_REG_1, 0),
10015                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10016                                      BPF_FUNC_map_lookup_elem),
10017                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
10018                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_6,
10019                                     offsetof(struct __sk_buff, data)),
10020                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 64),
10021                         BPF_EXIT_INSN(),
10022                 },
10023                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10024                 .fixup_map1 = { 16 },
10025                 .result = REJECT,
10026                 .errstr = "R0 min value is outside of the array range",
10027         },
10028         {
10029                 "calls: overlapping caller/callee",
10030                 .insns = {
10031                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 0),
10032                         BPF_MOV64_IMM(BPF_REG_0, 1),
10033                         BPF_EXIT_INSN(),
10034                 },
10035                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10036                 .errstr = "last insn is not an exit or jmp",
10037                 .result = REJECT,
10038         },
10039         {
10040                 "calls: wrong recursive calls",
10041                 .insns = {
10042                         BPF_JMP_IMM(BPF_JA, 0, 0, 4),
10043                         BPF_JMP_IMM(BPF_JA, 0, 0, 4),
10044                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
10045                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
10046                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
10047                         BPF_MOV64_IMM(BPF_REG_0, 1),
10048                         BPF_EXIT_INSN(),
10049                 },
10050                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10051                 .errstr = "jump out of range",
10052                 .result = REJECT,
10053         },
10054         {
10055                 "calls: wrong src reg",
10056                 .insns = {
10057                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 2, 0, 0),
10058                         BPF_MOV64_IMM(BPF_REG_0, 1),
10059                         BPF_EXIT_INSN(),
10060                 },
10061                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10062                 .errstr = "BPF_CALL uses reserved fields",
10063                 .result = REJECT,
10064         },
10065         {
10066                 "calls: wrong off value",
10067                 .insns = {
10068                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, -1, 2),
10069                         BPF_MOV64_IMM(BPF_REG_0, 1),
10070                         BPF_EXIT_INSN(),
10071                         BPF_MOV64_IMM(BPF_REG_0, 2),
10072                         BPF_EXIT_INSN(),
10073                 },
10074                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10075                 .errstr = "BPF_CALL uses reserved fields",
10076                 .result = REJECT,
10077         },
10078         {
10079                 "calls: jump back loop",
10080                 .insns = {
10081                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -1),
10082                         BPF_MOV64_IMM(BPF_REG_0, 1),
10083                         BPF_EXIT_INSN(),
10084                 },
10085                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10086                 .errstr = "back-edge from insn 0 to 0",
10087                 .result = REJECT,
10088         },
10089         {
10090                 "calls: conditional call",
10091                 .insns = {
10092                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10093                                     offsetof(struct __sk_buff, mark)),
10094                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
10095                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10096                         BPF_MOV64_IMM(BPF_REG_0, 1),
10097                         BPF_EXIT_INSN(),
10098                         BPF_MOV64_IMM(BPF_REG_0, 2),
10099                         BPF_EXIT_INSN(),
10100                 },
10101                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10102                 .errstr = "jump out of range",
10103                 .result = REJECT,
10104         },
10105         {
10106                 "calls: conditional call 2",
10107                 .insns = {
10108                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10109                                     offsetof(struct __sk_buff, mark)),
10110                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
10111                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10112                         BPF_MOV64_IMM(BPF_REG_0, 1),
10113                         BPF_EXIT_INSN(),
10114                         BPF_MOV64_IMM(BPF_REG_0, 2),
10115                         BPF_EXIT_INSN(),
10116                         BPF_MOV64_IMM(BPF_REG_0, 3),
10117                         BPF_EXIT_INSN(),
10118                 },
10119                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10120                 .result = ACCEPT,
10121         },
10122         {
10123                 "calls: conditional call 3",
10124                 .insns = {
10125                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10126                                     offsetof(struct __sk_buff, mark)),
10127                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
10128                         BPF_JMP_IMM(BPF_JA, 0, 0, 4),
10129                         BPF_MOV64_IMM(BPF_REG_0, 1),
10130                         BPF_EXIT_INSN(),
10131                         BPF_MOV64_IMM(BPF_REG_0, 1),
10132                         BPF_JMP_IMM(BPF_JA, 0, 0, -6),
10133                         BPF_MOV64_IMM(BPF_REG_0, 3),
10134                         BPF_JMP_IMM(BPF_JA, 0, 0, -6),
10135                 },
10136                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10137                 .errstr = "back-edge from insn",
10138                 .result = REJECT,
10139         },
10140         {
10141                 "calls: conditional call 4",
10142                 .insns = {
10143                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10144                                     offsetof(struct __sk_buff, mark)),
10145                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
10146                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10147                         BPF_MOV64_IMM(BPF_REG_0, 1),
10148                         BPF_EXIT_INSN(),
10149                         BPF_MOV64_IMM(BPF_REG_0, 1),
10150                         BPF_JMP_IMM(BPF_JA, 0, 0, -5),
10151                         BPF_MOV64_IMM(BPF_REG_0, 3),
10152                         BPF_EXIT_INSN(),
10153                 },
10154                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10155                 .result = ACCEPT,
10156         },
10157         {
10158                 "calls: conditional call 5",
10159                 .insns = {
10160                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10161                                     offsetof(struct __sk_buff, mark)),
10162                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
10163                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10164                         BPF_MOV64_IMM(BPF_REG_0, 1),
10165                         BPF_EXIT_INSN(),
10166                         BPF_MOV64_IMM(BPF_REG_0, 1),
10167                         BPF_JMP_IMM(BPF_JA, 0, 0, -6),
10168                         BPF_MOV64_IMM(BPF_REG_0, 3),
10169                         BPF_EXIT_INSN(),
10170                 },
10171                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10172                 .errstr = "back-edge from insn",
10173                 .result = REJECT,
10174         },
10175         {
10176                 "calls: conditional call 6",
10177                 .insns = {
10178                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10179                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, -2),
10180                         BPF_EXIT_INSN(),
10181                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10182                                     offsetof(struct __sk_buff, mark)),
10183                         BPF_EXIT_INSN(),
10184                 },
10185                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10186                 .errstr = "back-edge from insn",
10187                 .result = REJECT,
10188         },
10189         {
10190                 "calls: using r0 returned by callee",
10191                 .insns = {
10192                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10193                         BPF_EXIT_INSN(),
10194                         BPF_MOV64_IMM(BPF_REG_0, 2),
10195                         BPF_EXIT_INSN(),
10196                 },
10197                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10198                 .result = ACCEPT,
10199         },
10200         {
10201                 "calls: using uninit r0 from callee",
10202                 .insns = {
10203                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10204                         BPF_EXIT_INSN(),
10205                         BPF_EXIT_INSN(),
10206                 },
10207                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10208                 .errstr = "!read_ok",
10209                 .result = REJECT,
10210         },
10211         {
10212                 "calls: callee is using r1",
10213                 .insns = {
10214                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10215                         BPF_EXIT_INSN(),
10216                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10217                                     offsetof(struct __sk_buff, len)),
10218                         BPF_EXIT_INSN(),
10219                 },
10220                 .prog_type = BPF_PROG_TYPE_SCHED_ACT,
10221                 .result = ACCEPT,
10222                 .retval = TEST_DATA_LEN,
10223         },
10224         {
10225                 "calls: callee using args1",
10226                 .insns = {
10227                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10228                         BPF_EXIT_INSN(),
10229                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
10230                         BPF_EXIT_INSN(),
10231                 },
10232                 .errstr_unpriv = "allowed for root only",
10233                 .result_unpriv = REJECT,
10234                 .result = ACCEPT,
10235                 .retval = POINTER_VALUE,
10236         },
10237         {
10238                 "calls: callee using wrong args2",
10239                 .insns = {
10240                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10241                         BPF_EXIT_INSN(),
10242                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
10243                         BPF_EXIT_INSN(),
10244                 },
10245                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10246                 .errstr = "R2 !read_ok",
10247                 .result = REJECT,
10248         },
10249         {
10250                 "calls: callee using two args",
10251                 .insns = {
10252                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10253                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_6,
10254                                     offsetof(struct __sk_buff, len)),
10255                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_6,
10256                                     offsetof(struct __sk_buff, len)),
10257                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10258                         BPF_EXIT_INSN(),
10259                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
10260                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
10261                         BPF_EXIT_INSN(),
10262                 },
10263                 .errstr_unpriv = "allowed for root only",
10264                 .result_unpriv = REJECT,
10265                 .result = ACCEPT,
10266                 .retval = TEST_DATA_LEN + TEST_DATA_LEN - ETH_HLEN - ETH_HLEN,
10267         },
10268         {
10269                 "calls: callee changing pkt pointers",
10270                 .insns = {
10271                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
10272                                     offsetof(struct xdp_md, data)),
10273                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
10274                                     offsetof(struct xdp_md, data_end)),
10275                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_6),
10276                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 8),
10277                         BPF_JMP_REG(BPF_JGT, BPF_REG_8, BPF_REG_7, 2),
10278                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10279                         /* clear_all_pkt_pointers() has to walk all frames
10280                          * to make sure that pkt pointers in the caller
10281                          * are cleared when callee is calling a helper that
10282                          * adjusts packet size
10283                          */
10284                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
10285                         BPF_MOV32_IMM(BPF_REG_0, 0),
10286                         BPF_EXIT_INSN(),
10287                         BPF_MOV64_IMM(BPF_REG_2, 0),
10288                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10289                                      BPF_FUNC_xdp_adjust_head),
10290                         BPF_EXIT_INSN(),
10291                 },
10292                 .result = REJECT,
10293                 .errstr = "R6 invalid mem access 'inv'",
10294                 .prog_type = BPF_PROG_TYPE_XDP,
10295         },
10296         {
10297                 "calls: two calls with args",
10298                 .insns = {
10299                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10300                         BPF_EXIT_INSN(),
10301                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10302                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
10303                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
10304                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10305                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10306                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
10307                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
10308                         BPF_EXIT_INSN(),
10309                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10310                                     offsetof(struct __sk_buff, len)),
10311                         BPF_EXIT_INSN(),
10312                 },
10313                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10314                 .result = ACCEPT,
10315                 .retval = TEST_DATA_LEN + TEST_DATA_LEN,
10316         },
10317         {
10318                 "calls: calls with stack arith",
10319                 .insns = {
10320                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10321                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
10322                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10323                         BPF_EXIT_INSN(),
10324                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
10325                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10326                         BPF_EXIT_INSN(),
10327                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
10328                         BPF_MOV64_IMM(BPF_REG_0, 42),
10329                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
10330                         BPF_EXIT_INSN(),
10331                 },
10332                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10333                 .result = ACCEPT,
10334                 .retval = 42,
10335         },
10336         {
10337                 "calls: calls with misaligned stack access",
10338                 .insns = {
10339                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10340                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -63),
10341                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10342                         BPF_EXIT_INSN(),
10343                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -61),
10344                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10345                         BPF_EXIT_INSN(),
10346                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -63),
10347                         BPF_MOV64_IMM(BPF_REG_0, 42),
10348                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
10349                         BPF_EXIT_INSN(),
10350                 },
10351                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10352                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
10353                 .errstr = "misaligned stack access",
10354                 .result = REJECT,
10355         },
10356         {
10357                 "calls: calls control flow, jump test",
10358                 .insns = {
10359                         BPF_MOV64_IMM(BPF_REG_0, 42),
10360                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
10361                         BPF_MOV64_IMM(BPF_REG_0, 43),
10362                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10363                         BPF_JMP_IMM(BPF_JA, 0, 0, -3),
10364                         BPF_EXIT_INSN(),
10365                 },
10366                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10367                 .result = ACCEPT,
10368                 .retval = 43,
10369         },
10370         {
10371                 "calls: calls control flow, jump test 2",
10372                 .insns = {
10373                         BPF_MOV64_IMM(BPF_REG_0, 42),
10374                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
10375                         BPF_MOV64_IMM(BPF_REG_0, 43),
10376                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10377                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -3),
10378                         BPF_EXIT_INSN(),
10379                 },
10380                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10381                 .errstr = "jump out of range from insn 1 to 4",
10382                 .result = REJECT,
10383         },
10384         {
10385                 "calls: two calls with bad jump",
10386                 .insns = {
10387                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10388                         BPF_EXIT_INSN(),
10389                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10390                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
10391                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
10392                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10393                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10394                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
10395                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
10396                         BPF_EXIT_INSN(),
10397                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10398                                     offsetof(struct __sk_buff, len)),
10399                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, -3),
10400                         BPF_EXIT_INSN(),
10401                 },
10402                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10403                 .errstr = "jump out of range from insn 11 to 9",
10404                 .result = REJECT,
10405         },
10406         {
10407                 "calls: recursive call. test1",
10408                 .insns = {
10409                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10410                         BPF_EXIT_INSN(),
10411                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -1),
10412                         BPF_EXIT_INSN(),
10413                 },
10414                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10415                 .errstr = "back-edge",
10416                 .result = REJECT,
10417         },
10418         {
10419                 "calls: recursive call. test2",
10420                 .insns = {
10421                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10422                         BPF_EXIT_INSN(),
10423                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -3),
10424                         BPF_EXIT_INSN(),
10425                 },
10426                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10427                 .errstr = "back-edge",
10428                 .result = REJECT,
10429         },
10430         {
10431                 "calls: unreachable code",
10432                 .insns = {
10433                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10434                         BPF_EXIT_INSN(),
10435                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10436                         BPF_EXIT_INSN(),
10437                         BPF_MOV64_IMM(BPF_REG_0, 0),
10438                         BPF_EXIT_INSN(),
10439                         BPF_MOV64_IMM(BPF_REG_0, 0),
10440                         BPF_EXIT_INSN(),
10441                 },
10442                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10443                 .errstr = "unreachable insn 6",
10444                 .result = REJECT,
10445         },
10446         {
10447                 "calls: invalid call",
10448                 .insns = {
10449                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10450                         BPF_EXIT_INSN(),
10451                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -4),
10452                         BPF_EXIT_INSN(),
10453                 },
10454                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10455                 .errstr = "invalid destination",
10456                 .result = REJECT,
10457         },
10458         {
10459                 "calls: invalid call 2",
10460                 .insns = {
10461                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10462                         BPF_EXIT_INSN(),
10463                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 0x7fffffff),
10464                         BPF_EXIT_INSN(),
10465                 },
10466                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10467                 .errstr = "invalid destination",
10468                 .result = REJECT,
10469         },
10470         {
10471                 "calls: jumping across function bodies. test1",
10472                 .insns = {
10473                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10474                         BPF_MOV64_IMM(BPF_REG_0, 0),
10475                         BPF_EXIT_INSN(),
10476                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -3),
10477                         BPF_EXIT_INSN(),
10478                 },
10479                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10480                 .errstr = "jump out of range",
10481                 .result = REJECT,
10482         },
10483         {
10484                 "calls: jumping across function bodies. test2",
10485                 .insns = {
10486                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
10487                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10488                         BPF_MOV64_IMM(BPF_REG_0, 0),
10489                         BPF_EXIT_INSN(),
10490                         BPF_EXIT_INSN(),
10491                 },
10492                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10493                 .errstr = "jump out of range",
10494                 .result = REJECT,
10495         },
10496         {
10497                 "calls: call without exit",
10498                 .insns = {
10499                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10500                         BPF_EXIT_INSN(),
10501                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10502                         BPF_EXIT_INSN(),
10503                         BPF_MOV64_IMM(BPF_REG_0, 0),
10504                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -2),
10505                 },
10506                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10507                 .errstr = "not an exit",
10508                 .result = REJECT,
10509         },
10510         {
10511                 "calls: call into middle of ld_imm64",
10512                 .insns = {
10513                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10514                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10515                         BPF_MOV64_IMM(BPF_REG_0, 0),
10516                         BPF_EXIT_INSN(),
10517                         BPF_LD_IMM64(BPF_REG_0, 0),
10518                         BPF_EXIT_INSN(),
10519                 },
10520                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10521                 .errstr = "last insn",
10522                 .result = REJECT,
10523         },
10524         {
10525                 "calls: call into middle of other call",
10526                 .insns = {
10527                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10528                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10529                         BPF_MOV64_IMM(BPF_REG_0, 0),
10530                         BPF_EXIT_INSN(),
10531                         BPF_MOV64_IMM(BPF_REG_0, 0),
10532                         BPF_MOV64_IMM(BPF_REG_0, 0),
10533                         BPF_EXIT_INSN(),
10534                 },
10535                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10536                 .errstr = "last insn",
10537                 .result = REJECT,
10538         },
10539         {
10540                 "calls: ld_abs with changing ctx data in callee",
10541                 .insns = {
10542                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10543                         BPF_LD_ABS(BPF_B, 0),
10544                         BPF_LD_ABS(BPF_H, 0),
10545                         BPF_LD_ABS(BPF_W, 0),
10546                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
10547                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
10548                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
10549                         BPF_LD_ABS(BPF_B, 0),
10550                         BPF_LD_ABS(BPF_H, 0),
10551                         BPF_LD_ABS(BPF_W, 0),
10552                         BPF_EXIT_INSN(),
10553                         BPF_MOV64_IMM(BPF_REG_2, 1),
10554                         BPF_MOV64_IMM(BPF_REG_3, 2),
10555                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10556                                      BPF_FUNC_skb_vlan_push),
10557                         BPF_EXIT_INSN(),
10558                 },
10559                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10560                 .errstr = "BPF_LD_[ABS|IND] instructions cannot be mixed",
10561                 .result = REJECT,
10562         },
10563         {
10564                 "calls: two calls with bad fallthrough",
10565                 .insns = {
10566                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10567                         BPF_EXIT_INSN(),
10568                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10569                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
10570                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
10571                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10572                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10573                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
10574                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
10575                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_0),
10576                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10577                                     offsetof(struct __sk_buff, len)),
10578                         BPF_EXIT_INSN(),
10579                 },
10580                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10581                 .errstr = "not an exit",
10582                 .result = REJECT,
10583         },
10584         {
10585                 "calls: two calls with stack read",
10586                 .insns = {
10587                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10588                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10589                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10590                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10591                         BPF_EXIT_INSN(),
10592                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10593                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
10594                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
10595                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10596                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10597                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
10598                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
10599                         BPF_EXIT_INSN(),
10600                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
10601                         BPF_EXIT_INSN(),
10602                 },
10603                 .prog_type = BPF_PROG_TYPE_XDP,
10604                 .result = ACCEPT,
10605         },
10606         {
10607                 "calls: two calls with stack write",
10608                 .insns = {
10609                         /* main prog */
10610                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10611                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10612                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10613                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10614                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10615                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10616                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
10617                         BPF_EXIT_INSN(),
10618
10619                         /* subprog 1 */
10620                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10621                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10622                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 7),
10623                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
10624                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10625                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10626                         BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_0),
10627                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_8),
10628                         /* write into stack frame of main prog */
10629                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
10630                         BPF_EXIT_INSN(),
10631
10632                         /* subprog 2 */
10633                         /* read from stack frame of main prog */
10634                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
10635                         BPF_EXIT_INSN(),
10636                 },
10637                 .prog_type = BPF_PROG_TYPE_XDP,
10638                 .result = ACCEPT,
10639         },
10640         {
10641                 "calls: stack overflow using two frames (pre-call access)",
10642                 .insns = {
10643                         /* prog 1 */
10644                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
10645                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1),
10646                         BPF_EXIT_INSN(),
10647
10648                         /* prog 2 */
10649                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
10650                         BPF_MOV64_IMM(BPF_REG_0, 0),
10651                         BPF_EXIT_INSN(),
10652                 },
10653                 .prog_type = BPF_PROG_TYPE_XDP,
10654                 .errstr = "combined stack size",
10655                 .result = REJECT,
10656         },
10657         {
10658                 "calls: stack overflow using two frames (post-call access)",
10659                 .insns = {
10660                         /* prog 1 */
10661                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 2),
10662                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
10663                         BPF_EXIT_INSN(),
10664
10665                         /* prog 2 */
10666                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
10667                         BPF_MOV64_IMM(BPF_REG_0, 0),
10668                         BPF_EXIT_INSN(),
10669                 },
10670                 .prog_type = BPF_PROG_TYPE_XDP,
10671                 .errstr = "combined stack size",
10672                 .result = REJECT,
10673         },
10674         {
10675                 "calls: stack depth check using three frames. test1",
10676                 .insns = {
10677                         /* main */
10678                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
10679                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 5), /* call B */
10680                         BPF_ST_MEM(BPF_B, BPF_REG_10, -32, 0),
10681                         BPF_MOV64_IMM(BPF_REG_0, 0),
10682                         BPF_EXIT_INSN(),
10683                         /* A */
10684                         BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
10685                         BPF_EXIT_INSN(),
10686                         /* B */
10687                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -3), /* call A */
10688                         BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
10689                         BPF_EXIT_INSN(),
10690                 },
10691                 .prog_type = BPF_PROG_TYPE_XDP,
10692                 /* stack_main=32, stack_A=256, stack_B=64
10693                  * and max(main+A, main+A+B) < 512
10694                  */
10695                 .result = ACCEPT,
10696         },
10697         {
10698                 "calls: stack depth check using three frames. test2",
10699                 .insns = {
10700                         /* main */
10701                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
10702                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 5), /* call B */
10703                         BPF_ST_MEM(BPF_B, BPF_REG_10, -32, 0),
10704                         BPF_MOV64_IMM(BPF_REG_0, 0),
10705                         BPF_EXIT_INSN(),
10706                         /* A */
10707                         BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
10708                         BPF_EXIT_INSN(),
10709                         /* B */
10710                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -3), /* call A */
10711                         BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
10712                         BPF_EXIT_INSN(),
10713                 },
10714                 .prog_type = BPF_PROG_TYPE_XDP,
10715                 /* stack_main=32, stack_A=64, stack_B=256
10716                  * and max(main+A, main+A+B) < 512
10717                  */
10718                 .result = ACCEPT,
10719         },
10720         {
10721                 "calls: stack depth check using three frames. test3",
10722                 .insns = {
10723                         /* main */
10724                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10725                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 6), /* call A */
10726                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10727                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 8), /* call B */
10728                         BPF_JMP_IMM(BPF_JGE, BPF_REG_6, 0, 1),
10729                         BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
10730                         BPF_MOV64_IMM(BPF_REG_0, 0),
10731                         BPF_EXIT_INSN(),
10732                         /* A */
10733                         BPF_JMP_IMM(BPF_JLT, BPF_REG_1, 10, 1),
10734                         BPF_EXIT_INSN(),
10735                         BPF_ST_MEM(BPF_B, BPF_REG_10, -224, 0),
10736                         BPF_JMP_IMM(BPF_JA, 0, 0, -3),
10737                         /* B */
10738                         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 2, 1),
10739                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -6), /* call A */
10740                         BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
10741                         BPF_EXIT_INSN(),
10742                 },
10743                 .prog_type = BPF_PROG_TYPE_XDP,
10744                 /* stack_main=64, stack_A=224, stack_B=256
10745                  * and max(main+A, main+A+B) > 512
10746                  */
10747                 .errstr = "combined stack",
10748                 .result = REJECT,
10749         },
10750         {
10751                 "calls: stack depth check using three frames. test4",
10752                 /* void main(void) {
10753                  *   func1(0);
10754                  *   func1(1);
10755                  *   func2(1);
10756                  * }
10757                  * void func1(int alloc_or_recurse) {
10758                  *   if (alloc_or_recurse) {
10759                  *     frame_pointer[-300] = 1;
10760                  *   } else {
10761                  *     func2(alloc_or_recurse);
10762                  *   }
10763                  * }
10764                  * void func2(int alloc_or_recurse) {
10765                  *   if (alloc_or_recurse) {
10766                  *     frame_pointer[-300] = 1;
10767                  *   }
10768                  * }
10769                  */
10770                 .insns = {
10771                         /* main */
10772                         BPF_MOV64_IMM(BPF_REG_1, 0),
10773                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 6), /* call A */
10774                         BPF_MOV64_IMM(BPF_REG_1, 1),
10775                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
10776                         BPF_MOV64_IMM(BPF_REG_1, 1),
10777                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 7), /* call B */
10778                         BPF_MOV64_IMM(BPF_REG_0, 0),
10779                         BPF_EXIT_INSN(),
10780                         /* A */
10781                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
10782                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
10783                         BPF_EXIT_INSN(),
10784                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call B */
10785                         BPF_EXIT_INSN(),
10786                         /* B */
10787                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
10788                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
10789                         BPF_EXIT_INSN(),
10790                 },
10791                 .prog_type = BPF_PROG_TYPE_XDP,
10792                 .result = REJECT,
10793                 .errstr = "combined stack",
10794         },
10795         {
10796                 "calls: stack depth check using three frames. test5",
10797                 .insns = {
10798                         /* main */
10799                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call A */
10800                         BPF_EXIT_INSN(),
10801                         /* A */
10802                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call B */
10803                         BPF_EXIT_INSN(),
10804                         /* B */
10805                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call C */
10806                         BPF_EXIT_INSN(),
10807                         /* C */
10808                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call D */
10809                         BPF_EXIT_INSN(),
10810                         /* D */
10811                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call E */
10812                         BPF_EXIT_INSN(),
10813                         /* E */
10814                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call F */
10815                         BPF_EXIT_INSN(),
10816                         /* F */
10817                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call G */
10818                         BPF_EXIT_INSN(),
10819                         /* G */
10820                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call H */
10821                         BPF_EXIT_INSN(),
10822                         /* H */
10823                         BPF_MOV64_IMM(BPF_REG_0, 0),
10824                         BPF_EXIT_INSN(),
10825                 },
10826                 .prog_type = BPF_PROG_TYPE_XDP,
10827                 .errstr = "call stack",
10828                 .result = REJECT,
10829         },
10830         {
10831                 "calls: spill into caller stack frame",
10832                 .insns = {
10833                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10834                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10835                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10836                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10837                         BPF_EXIT_INSN(),
10838                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
10839                         BPF_MOV64_IMM(BPF_REG_0, 0),
10840                         BPF_EXIT_INSN(),
10841                 },
10842                 .prog_type = BPF_PROG_TYPE_XDP,
10843                 .errstr = "cannot spill",
10844                 .result = REJECT,
10845         },
10846         {
10847                 "calls: write into caller stack frame",
10848                 .insns = {
10849                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10850                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10851                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10852                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10853                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
10854                         BPF_EXIT_INSN(),
10855                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 42),
10856                         BPF_MOV64_IMM(BPF_REG_0, 0),
10857                         BPF_EXIT_INSN(),
10858                 },
10859                 .prog_type = BPF_PROG_TYPE_XDP,
10860                 .result = ACCEPT,
10861                 .retval = 42,
10862         },
10863         {
10864                 "calls: write into callee stack frame",
10865                 .insns = {
10866                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10867                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
10868                         BPF_EXIT_INSN(),
10869                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
10870                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, -8),
10871                         BPF_EXIT_INSN(),
10872                 },
10873                 .prog_type = BPF_PROG_TYPE_XDP,
10874                 .errstr = "cannot return stack pointer",
10875                 .result = REJECT,
10876         },
10877         {
10878                 "calls: two calls with stack write and void return",
10879                 .insns = {
10880                         /* main prog */
10881                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10882                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10883                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10884                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10885                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10886                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10887                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
10888                         BPF_EXIT_INSN(),
10889
10890                         /* subprog 1 */
10891                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10892                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10893                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10894                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
10895                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10896                         BPF_EXIT_INSN(),
10897
10898                         /* subprog 2 */
10899                         /* write into stack frame of main prog */
10900                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 0),
10901                         BPF_EXIT_INSN(), /* void return */
10902                 },
10903                 .prog_type = BPF_PROG_TYPE_XDP,
10904                 .result = ACCEPT,
10905         },
10906         {
10907                 "calls: ambiguous return value",
10908                 .insns = {
10909                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10910                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
10911                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
10912                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10913                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10914                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
10915                         BPF_EXIT_INSN(),
10916                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
10917                         BPF_MOV64_IMM(BPF_REG_0, 0),
10918                         BPF_EXIT_INSN(),
10919                 },
10920                 .errstr_unpriv = "allowed for root only",
10921                 .result_unpriv = REJECT,
10922                 .errstr = "R0 !read_ok",
10923                 .result = REJECT,
10924         },
10925         {
10926                 "calls: two calls that return map_value",
10927                 .insns = {
10928                         /* main prog */
10929                         /* pass fp-16, fp-8 into a function */
10930                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10931                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10932                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10933                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10934                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
10935
10936                         /* fetch map_value_ptr from the stack of this function */
10937                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
10938                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
10939                         /* write into map value */
10940                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10941                         /* fetch secound map_value_ptr from the stack */
10942                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
10943                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
10944                         /* write into map value */
10945                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10946                         BPF_MOV64_IMM(BPF_REG_0, 0),
10947                         BPF_EXIT_INSN(),
10948
10949                         /* subprog 1 */
10950                         /* call 3rd function twice */
10951                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10952                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10953                         /* first time with fp-8 */
10954                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10955                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
10956                         /* second time with fp-16 */
10957                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10958                         BPF_EXIT_INSN(),
10959
10960                         /* subprog 2 */
10961                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10962                         /* lookup from map */
10963                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10964                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10965                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10966                         BPF_LD_MAP_FD(BPF_REG_1, 0),
10967                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10968                                      BPF_FUNC_map_lookup_elem),
10969                         /* write map_value_ptr into stack frame of main prog */
10970                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
10971                         BPF_MOV64_IMM(BPF_REG_0, 0),
10972                         BPF_EXIT_INSN(), /* return 0 */
10973                 },
10974                 .prog_type = BPF_PROG_TYPE_XDP,
10975                 .fixup_map1 = { 23 },
10976                 .result = ACCEPT,
10977         },
10978         {
10979                 "calls: two calls that return map_value with bool condition",
10980                 .insns = {
10981                         /* main prog */
10982                         /* pass fp-16, fp-8 into a function */
10983                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10984                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10985                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10986                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10987                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10988                         BPF_MOV64_IMM(BPF_REG_0, 0),
10989                         BPF_EXIT_INSN(),
10990
10991                         /* subprog 1 */
10992                         /* call 3rd function twice */
10993                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10994                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10995                         /* first time with fp-8 */
10996                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 9),
10997                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
10998                         /* fetch map_value_ptr from the stack of this function */
10999                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
11000                         /* write into map value */
11001                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11002                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
11003                         /* second time with fp-16 */
11004                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
11005                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
11006                         /* fetch secound map_value_ptr from the stack */
11007                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
11008                         /* write into map value */
11009                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11010                         BPF_EXIT_INSN(),
11011
11012                         /* subprog 2 */
11013                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11014                         /* lookup from map */
11015                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11016                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11017                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11018                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11019                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11020                                      BPF_FUNC_map_lookup_elem),
11021                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11022                         BPF_MOV64_IMM(BPF_REG_0, 0),
11023                         BPF_EXIT_INSN(), /* return 0 */
11024                         /* write map_value_ptr into stack frame of main prog */
11025                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11026                         BPF_MOV64_IMM(BPF_REG_0, 1),
11027                         BPF_EXIT_INSN(), /* return 1 */
11028                 },
11029                 .prog_type = BPF_PROG_TYPE_XDP,
11030                 .fixup_map1 = { 23 },
11031                 .result = ACCEPT,
11032         },
11033         {
11034                 "calls: two calls that return map_value with incorrect bool check",
11035                 .insns = {
11036                         /* main prog */
11037                         /* pass fp-16, fp-8 into a function */
11038                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11039                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11040                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11041                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11042                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11043                         BPF_MOV64_IMM(BPF_REG_0, 0),
11044                         BPF_EXIT_INSN(),
11045
11046                         /* subprog 1 */
11047                         /* call 3rd function twice */
11048                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11049                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11050                         /* first time with fp-8 */
11051                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 9),
11052                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
11053                         /* fetch map_value_ptr from the stack of this function */
11054                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
11055                         /* write into map value */
11056                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11057                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
11058                         /* second time with fp-16 */
11059                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
11060                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11061                         /* fetch secound map_value_ptr from the stack */
11062                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
11063                         /* write into map value */
11064                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11065                         BPF_EXIT_INSN(),
11066
11067                         /* subprog 2 */
11068                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11069                         /* lookup from map */
11070                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11071                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11072                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11073                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11074                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11075                                      BPF_FUNC_map_lookup_elem),
11076                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11077                         BPF_MOV64_IMM(BPF_REG_0, 0),
11078                         BPF_EXIT_INSN(), /* return 0 */
11079                         /* write map_value_ptr into stack frame of main prog */
11080                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11081                         BPF_MOV64_IMM(BPF_REG_0, 1),
11082                         BPF_EXIT_INSN(), /* return 1 */
11083                 },
11084                 .prog_type = BPF_PROG_TYPE_XDP,
11085                 .fixup_map1 = { 23 },
11086                 .result = REJECT,
11087                 .errstr = "invalid read from stack off -16+0 size 8",
11088         },
11089         {
11090                 "calls: two calls that receive map_value via arg=ptr_stack_of_caller. test1",
11091                 .insns = {
11092                         /* main prog */
11093                         /* pass fp-16, fp-8 into a function */
11094                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11095                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11096                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11097                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11098                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11099                         BPF_MOV64_IMM(BPF_REG_0, 0),
11100                         BPF_EXIT_INSN(),
11101
11102                         /* subprog 1 */
11103                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11104                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11105                         /* 1st lookup from map */
11106                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11107                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11108                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11109                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11110                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11111                                      BPF_FUNC_map_lookup_elem),
11112                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11113                         BPF_MOV64_IMM(BPF_REG_8, 0),
11114                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11115                         /* write map_value_ptr into stack frame of main prog at fp-8 */
11116                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11117                         BPF_MOV64_IMM(BPF_REG_8, 1),
11118
11119                         /* 2nd lookup from map */
11120                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), /* 20 */
11121                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11122                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11123                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, /* 24 */
11124                                      BPF_FUNC_map_lookup_elem),
11125                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11126                         BPF_MOV64_IMM(BPF_REG_9, 0),
11127                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11128                         /* write map_value_ptr into stack frame of main prog at fp-16 */
11129                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
11130                         BPF_MOV64_IMM(BPF_REG_9, 1),
11131
11132                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
11133                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), /* 30 */
11134                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
11135                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
11136                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
11137                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),  /* 34 */
11138                         BPF_EXIT_INSN(),
11139
11140                         /* subprog 2 */
11141                         /* if arg2 == 1 do *arg1 = 0 */
11142                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
11143                         /* fetch map_value_ptr from the stack of this function */
11144                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
11145                         /* write into map value */
11146                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11147
11148                         /* if arg4 == 1 do *arg3 = 0 */
11149                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
11150                         /* fetch map_value_ptr from the stack of this function */
11151                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
11152                         /* write into map value */
11153                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 0),
11154                         BPF_EXIT_INSN(),
11155                 },
11156                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11157                 .fixup_map1 = { 12, 22 },
11158                 .result = REJECT,
11159                 .errstr = "invalid access to map value, value_size=8 off=2 size=8",
11160         },
11161         {
11162                 "calls: two calls that receive map_value via arg=ptr_stack_of_caller. test2",
11163                 .insns = {
11164                         /* main prog */
11165                         /* pass fp-16, fp-8 into a function */
11166                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11167                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11168                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11169                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11170                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11171                         BPF_MOV64_IMM(BPF_REG_0, 0),
11172                         BPF_EXIT_INSN(),
11173
11174                         /* subprog 1 */
11175                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11176                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11177                         /* 1st lookup from map */
11178                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11179                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11180                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11181                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11182                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11183                                      BPF_FUNC_map_lookup_elem),
11184                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11185                         BPF_MOV64_IMM(BPF_REG_8, 0),
11186                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11187                         /* write map_value_ptr into stack frame of main prog at fp-8 */
11188                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11189                         BPF_MOV64_IMM(BPF_REG_8, 1),
11190
11191                         /* 2nd lookup from map */
11192                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), /* 20 */
11193                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11194                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11195                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, /* 24 */
11196                                      BPF_FUNC_map_lookup_elem),
11197                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11198                         BPF_MOV64_IMM(BPF_REG_9, 0),
11199                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11200                         /* write map_value_ptr into stack frame of main prog at fp-16 */
11201                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
11202                         BPF_MOV64_IMM(BPF_REG_9, 1),
11203
11204                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
11205                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), /* 30 */
11206                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
11207                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
11208                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
11209                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),  /* 34 */
11210                         BPF_EXIT_INSN(),
11211
11212                         /* subprog 2 */
11213                         /* if arg2 == 1 do *arg1 = 0 */
11214                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
11215                         /* fetch map_value_ptr from the stack of this function */
11216                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
11217                         /* write into map value */
11218                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11219
11220                         /* if arg4 == 1 do *arg3 = 0 */
11221                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
11222                         /* fetch map_value_ptr from the stack of this function */
11223                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
11224                         /* write into map value */
11225                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11226                         BPF_EXIT_INSN(),
11227                 },
11228                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11229                 .fixup_map1 = { 12, 22 },
11230                 .result = ACCEPT,
11231         },
11232         {
11233                 "calls: two jumps that receive map_value via arg=ptr_stack_of_jumper. test3",
11234                 .insns = {
11235                         /* main prog */
11236                         /* pass fp-16, fp-8 into a function */
11237                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11238                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11239                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11240                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11241                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2),
11242                         BPF_MOV64_IMM(BPF_REG_0, 0),
11243                         BPF_EXIT_INSN(),
11244
11245                         /* subprog 1 */
11246                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11247                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11248                         /* 1st lookup from map */
11249                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -24, 0),
11250                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11251                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -24),
11252                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11253                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11254                                      BPF_FUNC_map_lookup_elem),
11255                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11256                         BPF_MOV64_IMM(BPF_REG_8, 0),
11257                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11258                         /* write map_value_ptr into stack frame of main prog at fp-8 */
11259                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11260                         BPF_MOV64_IMM(BPF_REG_8, 1),
11261
11262                         /* 2nd lookup from map */
11263                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11264                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -24),
11265                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11266                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11267                                      BPF_FUNC_map_lookup_elem),
11268                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11269                         BPF_MOV64_IMM(BPF_REG_9, 0),  // 26
11270                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11271                         /* write map_value_ptr into stack frame of main prog at fp-16 */
11272                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
11273                         BPF_MOV64_IMM(BPF_REG_9, 1),
11274
11275                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
11276                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), // 30
11277                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
11278                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
11279                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
11280                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1), // 34
11281                         BPF_JMP_IMM(BPF_JA, 0, 0, -30),
11282
11283                         /* subprog 2 */
11284                         /* if arg2 == 1 do *arg1 = 0 */
11285                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
11286                         /* fetch map_value_ptr from the stack of this function */
11287                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
11288                         /* write into map value */
11289                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11290
11291                         /* if arg4 == 1 do *arg3 = 0 */
11292                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
11293                         /* fetch map_value_ptr from the stack of this function */
11294                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
11295                         /* write into map value */
11296                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 0),
11297                         BPF_JMP_IMM(BPF_JA, 0, 0, -8),
11298                 },
11299                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11300                 .fixup_map1 = { 12, 22 },
11301                 .result = REJECT,
11302                 .errstr = "invalid access to map value, value_size=8 off=2 size=8",
11303         },
11304         {
11305                 "calls: two calls that receive map_value_ptr_or_null via arg. test1",
11306                 .insns = {
11307                         /* main prog */
11308                         /* pass fp-16, fp-8 into a function */
11309                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11310                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11311                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11312                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11313                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11314                         BPF_MOV64_IMM(BPF_REG_0, 0),
11315                         BPF_EXIT_INSN(),
11316
11317                         /* subprog 1 */
11318                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11319                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11320                         /* 1st lookup from map */
11321                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11322                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11323                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11324                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11325                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11326                                      BPF_FUNC_map_lookup_elem),
11327                         /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
11328                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11329                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11330                         BPF_MOV64_IMM(BPF_REG_8, 0),
11331                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
11332                         BPF_MOV64_IMM(BPF_REG_8, 1),
11333
11334                         /* 2nd lookup from map */
11335                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11336                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11337                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11338                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11339                                      BPF_FUNC_map_lookup_elem),
11340                         /* write map_value_ptr_or_null into stack frame of main prog at fp-16 */
11341                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
11342                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11343                         BPF_MOV64_IMM(BPF_REG_9, 0),
11344                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
11345                         BPF_MOV64_IMM(BPF_REG_9, 1),
11346
11347                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
11348                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
11349                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
11350                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
11351                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
11352                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11353                         BPF_EXIT_INSN(),
11354
11355                         /* subprog 2 */
11356                         /* if arg2 == 1 do *arg1 = 0 */
11357                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
11358                         /* fetch map_value_ptr from the stack of this function */
11359                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
11360                         /* write into map value */
11361                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11362
11363                         /* if arg4 == 1 do *arg3 = 0 */
11364                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
11365                         /* fetch map_value_ptr from the stack of this function */
11366                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
11367                         /* write into map value */
11368                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11369                         BPF_EXIT_INSN(),
11370                 },
11371                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11372                 .fixup_map1 = { 12, 22 },
11373                 .result = ACCEPT,
11374         },
11375         {
11376                 "calls: two calls that receive map_value_ptr_or_null via arg. test2",
11377                 .insns = {
11378                         /* main prog */
11379                         /* pass fp-16, fp-8 into a function */
11380                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11381                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11382                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11383                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11384                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11385                         BPF_MOV64_IMM(BPF_REG_0, 0),
11386                         BPF_EXIT_INSN(),
11387
11388                         /* subprog 1 */
11389                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11390                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11391                         /* 1st lookup from map */
11392                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11393                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11394                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11395                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11396                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11397                                      BPF_FUNC_map_lookup_elem),
11398                         /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
11399                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11400                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11401                         BPF_MOV64_IMM(BPF_REG_8, 0),
11402                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
11403                         BPF_MOV64_IMM(BPF_REG_8, 1),
11404
11405                         /* 2nd lookup from map */
11406                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11407                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11408                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11409                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11410                                      BPF_FUNC_map_lookup_elem),
11411                         /* write map_value_ptr_or_null into stack frame of main prog at fp-16 */
11412                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
11413                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11414                         BPF_MOV64_IMM(BPF_REG_9, 0),
11415                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
11416                         BPF_MOV64_IMM(BPF_REG_9, 1),
11417
11418                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
11419                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
11420                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
11421                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
11422                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
11423                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11424                         BPF_EXIT_INSN(),
11425
11426                         /* subprog 2 */
11427                         /* if arg2 == 1 do *arg1 = 0 */
11428                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
11429                         /* fetch map_value_ptr from the stack of this function */
11430                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
11431                         /* write into map value */
11432                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11433
11434                         /* if arg4 == 0 do *arg3 = 0 */
11435                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 0, 2),
11436                         /* fetch map_value_ptr from the stack of this function */
11437                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
11438                         /* write into map value */
11439                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11440                         BPF_EXIT_INSN(),
11441                 },
11442                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11443                 .fixup_map1 = { 12, 22 },
11444                 .result = REJECT,
11445                 .errstr = "R0 invalid mem access 'inv'",
11446         },
11447         {
11448                 "calls: pkt_ptr spill into caller stack",
11449                 .insns = {
11450                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11451                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11452                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11453                         BPF_EXIT_INSN(),
11454
11455                         /* subprog 1 */
11456                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11457                                     offsetof(struct __sk_buff, data)),
11458                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11459                                     offsetof(struct __sk_buff, data_end)),
11460                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11461                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11462                         /* spill unchecked pkt_ptr into stack of caller */
11463                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11464                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
11465                         /* now the pkt range is verified, read pkt_ptr from stack */
11466                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
11467                         /* write 4 bytes into packet */
11468                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11469                         BPF_EXIT_INSN(),
11470                 },
11471                 .result = ACCEPT,
11472                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11473                 .retval = POINTER_VALUE,
11474         },
11475         {
11476                 "calls: pkt_ptr spill into caller stack 2",
11477                 .insns = {
11478                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11479                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11480                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11481                         /* Marking is still kept, but not in all cases safe. */
11482                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11483                         BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
11484                         BPF_EXIT_INSN(),
11485
11486                         /* subprog 1 */
11487                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11488                                     offsetof(struct __sk_buff, data)),
11489                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11490                                     offsetof(struct __sk_buff, data_end)),
11491                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11492                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11493                         /* spill unchecked pkt_ptr into stack of caller */
11494                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11495                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
11496                         /* now the pkt range is verified, read pkt_ptr from stack */
11497                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
11498                         /* write 4 bytes into packet */
11499                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11500                         BPF_EXIT_INSN(),
11501                 },
11502                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11503                 .errstr = "invalid access to packet",
11504                 .result = REJECT,
11505         },
11506         {
11507                 "calls: pkt_ptr spill into caller stack 3",
11508                 .insns = {
11509                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11510                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11511                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
11512                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
11513                         /* Marking is still kept and safe here. */
11514                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11515                         BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
11516                         BPF_EXIT_INSN(),
11517
11518                         /* subprog 1 */
11519                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11520                                     offsetof(struct __sk_buff, data)),
11521                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11522                                     offsetof(struct __sk_buff, data_end)),
11523                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11524                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11525                         /* spill unchecked pkt_ptr into stack of caller */
11526                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11527                         BPF_MOV64_IMM(BPF_REG_5, 0),
11528                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
11529                         BPF_MOV64_IMM(BPF_REG_5, 1),
11530                         /* now the pkt range is verified, read pkt_ptr from stack */
11531                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
11532                         /* write 4 bytes into packet */
11533                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11534                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11535                         BPF_EXIT_INSN(),
11536                 },
11537                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11538                 .result = ACCEPT,
11539                 .retval = 1,
11540         },
11541         {
11542                 "calls: pkt_ptr spill into caller stack 4",
11543                 .insns = {
11544                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11545                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11546                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
11547                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
11548                         /* Check marking propagated. */
11549                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11550                         BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
11551                         BPF_EXIT_INSN(),
11552
11553                         /* subprog 1 */
11554                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11555                                     offsetof(struct __sk_buff, data)),
11556                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11557                                     offsetof(struct __sk_buff, data_end)),
11558                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11559                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11560                         /* spill unchecked pkt_ptr into stack of caller */
11561                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11562                         BPF_MOV64_IMM(BPF_REG_5, 0),
11563                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
11564                         BPF_MOV64_IMM(BPF_REG_5, 1),
11565                         /* don't read back pkt_ptr from stack here */
11566                         /* write 4 bytes into packet */
11567                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11568                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11569                         BPF_EXIT_INSN(),
11570                 },
11571                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11572                 .result = ACCEPT,
11573                 .retval = 1,
11574         },
11575         {
11576                 "calls: pkt_ptr spill into caller stack 5",
11577                 .insns = {
11578                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11579                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11580                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_1, 0),
11581                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11582                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11583                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
11584                         BPF_EXIT_INSN(),
11585
11586                         /* subprog 1 */
11587                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11588                                     offsetof(struct __sk_buff, data)),
11589                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11590                                     offsetof(struct __sk_buff, data_end)),
11591                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11592                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11593                         BPF_MOV64_IMM(BPF_REG_5, 0),
11594                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
11595                         /* spill checked pkt_ptr into stack of caller */
11596                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11597                         BPF_MOV64_IMM(BPF_REG_5, 1),
11598                         /* don't read back pkt_ptr from stack here */
11599                         /* write 4 bytes into packet */
11600                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11601                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11602                         BPF_EXIT_INSN(),
11603                 },
11604                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11605                 .errstr = "same insn cannot be used with different",
11606                 .result = REJECT,
11607         },
11608         {
11609                 "calls: pkt_ptr spill into caller stack 6",
11610                 .insns = {
11611                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11612                                     offsetof(struct __sk_buff, data_end)),
11613                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11614                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11615                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11616                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11617                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11618                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
11619                         BPF_EXIT_INSN(),
11620
11621                         /* subprog 1 */
11622                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11623                                     offsetof(struct __sk_buff, data)),
11624                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11625                                     offsetof(struct __sk_buff, data_end)),
11626                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11627                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11628                         BPF_MOV64_IMM(BPF_REG_5, 0),
11629                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
11630                         /* spill checked pkt_ptr into stack of caller */
11631                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11632                         BPF_MOV64_IMM(BPF_REG_5, 1),
11633                         /* don't read back pkt_ptr from stack here */
11634                         /* write 4 bytes into packet */
11635                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11636                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11637                         BPF_EXIT_INSN(),
11638                 },
11639                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11640                 .errstr = "R4 invalid mem access",
11641                 .result = REJECT,
11642         },
11643         {
11644                 "calls: pkt_ptr spill into caller stack 7",
11645                 .insns = {
11646                         BPF_MOV64_IMM(BPF_REG_2, 0),
11647                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11648                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11649                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11650                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11651                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11652                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
11653                         BPF_EXIT_INSN(),
11654
11655                         /* subprog 1 */
11656                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11657                                     offsetof(struct __sk_buff, data)),
11658                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11659                                     offsetof(struct __sk_buff, data_end)),
11660                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11661                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11662                         BPF_MOV64_IMM(BPF_REG_5, 0),
11663                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
11664                         /* spill checked pkt_ptr into stack of caller */
11665                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11666                         BPF_MOV64_IMM(BPF_REG_5, 1),
11667                         /* don't read back pkt_ptr from stack here */
11668                         /* write 4 bytes into packet */
11669                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11670                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11671                         BPF_EXIT_INSN(),
11672                 },
11673                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11674                 .errstr = "R4 invalid mem access",
11675                 .result = REJECT,
11676         },
11677         {
11678                 "calls: pkt_ptr spill into caller stack 8",
11679                 .insns = {
11680                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11681                                     offsetof(struct __sk_buff, data)),
11682                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11683                                     offsetof(struct __sk_buff, data_end)),
11684                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11685                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11686                         BPF_JMP_REG(BPF_JLE, BPF_REG_0, BPF_REG_3, 1),
11687                         BPF_EXIT_INSN(),
11688                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11689                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11690                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11691                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11692                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11693                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
11694                         BPF_EXIT_INSN(),
11695
11696                         /* subprog 1 */
11697                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11698                                     offsetof(struct __sk_buff, data)),
11699                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11700                                     offsetof(struct __sk_buff, data_end)),
11701                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11702                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11703                         BPF_MOV64_IMM(BPF_REG_5, 0),
11704                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
11705                         /* spill checked pkt_ptr into stack of caller */
11706                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11707                         BPF_MOV64_IMM(BPF_REG_5, 1),
11708                         /* don't read back pkt_ptr from stack here */
11709                         /* write 4 bytes into packet */
11710                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11711                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11712                         BPF_EXIT_INSN(),
11713                 },
11714                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11715                 .result = ACCEPT,
11716         },
11717         {
11718                 "calls: pkt_ptr spill into caller stack 9",
11719                 .insns = {
11720                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11721                                     offsetof(struct __sk_buff, data)),
11722                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11723                                     offsetof(struct __sk_buff, data_end)),
11724                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11725                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11726                         BPF_JMP_REG(BPF_JLE, BPF_REG_0, BPF_REG_3, 1),
11727                         BPF_EXIT_INSN(),
11728                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11729                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11730                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11731                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11732                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11733                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
11734                         BPF_EXIT_INSN(),
11735
11736                         /* subprog 1 */
11737                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11738                                     offsetof(struct __sk_buff, data)),
11739                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11740                                     offsetof(struct __sk_buff, data_end)),
11741                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11742                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11743                         BPF_MOV64_IMM(BPF_REG_5, 0),
11744                         /* spill unchecked pkt_ptr into stack of caller */
11745                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11746                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
11747                         BPF_MOV64_IMM(BPF_REG_5, 1),
11748                         /* don't read back pkt_ptr from stack here */
11749                         /* write 4 bytes into packet */
11750                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11751                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11752                         BPF_EXIT_INSN(),
11753                 },
11754                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11755                 .errstr = "invalid access to packet",
11756                 .result = REJECT,
11757         },
11758         {
11759                 "calls: caller stack init to zero or map_value_or_null",
11760                 .insns = {
11761                         BPF_MOV64_IMM(BPF_REG_0, 0),
11762                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
11763                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11764                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11765                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
11766                         /* fetch map_value_or_null or const_zero from stack */
11767                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
11768                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
11769                         /* store into map_value */
11770                         BPF_ST_MEM(BPF_W, BPF_REG_0, 0, 0),
11771                         BPF_EXIT_INSN(),
11772
11773                         /* subprog 1 */
11774                         /* if (ctx == 0) return; */
11775                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 8),
11776                         /* else bpf_map_lookup() and *(fp - 8) = r0 */
11777                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
11778                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11779                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11780                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11781                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11782                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11783                                      BPF_FUNC_map_lookup_elem),
11784                         /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
11785                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11786                         BPF_EXIT_INSN(),
11787                 },
11788                 .fixup_map1 = { 13 },
11789                 .result = ACCEPT,
11790                 .prog_type = BPF_PROG_TYPE_XDP,
11791         },
11792         {
11793                 "calls: stack init to zero and pruning",
11794                 .insns = {
11795                         /* first make allocated_stack 16 byte */
11796                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, 0),
11797                         /* now fork the execution such that the false branch
11798                          * of JGT insn will be verified second and it skisp zero
11799                          * init of fp-8 stack slot. If stack liveness marking
11800                          * is missing live_read marks from call map_lookup
11801                          * processing then pruning will incorrectly assume
11802                          * that fp-8 stack slot was unused in the fall-through
11803                          * branch and will accept the program incorrectly
11804                          */
11805                         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 2, 2),
11806                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11807                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
11808                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11809                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11810                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11811                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11812                                      BPF_FUNC_map_lookup_elem),
11813                         BPF_EXIT_INSN(),
11814                 },
11815                 .fixup_map2 = { 6 },
11816                 .errstr = "invalid indirect read from stack off -8+0 size 8",
11817                 .result = REJECT,
11818                 .prog_type = BPF_PROG_TYPE_XDP,
11819         },
11820         {
11821                 "calls: two calls returning different map pointers for lookup (hash, array)",
11822                 .insns = {
11823                         /* main prog */
11824                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2),
11825                         BPF_CALL_REL(11),
11826                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
11827                         BPF_CALL_REL(12),
11828                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
11829                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11830                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11831                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11832                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11833                                      BPF_FUNC_map_lookup_elem),
11834                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
11835                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
11836                                    offsetof(struct test_val, foo)),
11837                         BPF_MOV64_IMM(BPF_REG_0, 1),
11838                         BPF_EXIT_INSN(),
11839                         /* subprog 1 */
11840                         BPF_LD_MAP_FD(BPF_REG_0, 0),
11841                         BPF_EXIT_INSN(),
11842                         /* subprog 2 */
11843                         BPF_LD_MAP_FD(BPF_REG_0, 0),
11844                         BPF_EXIT_INSN(),
11845                 },
11846                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11847                 .fixup_map2 = { 13 },
11848                 .fixup_map4 = { 16 },
11849                 .result = ACCEPT,
11850                 .retval = 1,
11851         },
11852         {
11853                 "calls: two calls returning different map pointers for lookup (hash, map in map)",
11854                 .insns = {
11855                         /* main prog */
11856                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2),
11857                         BPF_CALL_REL(11),
11858                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
11859                         BPF_CALL_REL(12),
11860                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
11861                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11862                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11863                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11864                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11865                                      BPF_FUNC_map_lookup_elem),
11866                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
11867                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
11868                                    offsetof(struct test_val, foo)),
11869                         BPF_MOV64_IMM(BPF_REG_0, 1),
11870                         BPF_EXIT_INSN(),
11871                         /* subprog 1 */
11872                         BPF_LD_MAP_FD(BPF_REG_0, 0),
11873                         BPF_EXIT_INSN(),
11874                         /* subprog 2 */
11875                         BPF_LD_MAP_FD(BPF_REG_0, 0),
11876                         BPF_EXIT_INSN(),
11877                 },
11878                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11879                 .fixup_map_in_map = { 16 },
11880                 .fixup_map4 = { 13 },
11881                 .result = REJECT,
11882                 .errstr = "R0 invalid mem access 'map_ptr'",
11883         },
11884         {
11885                 "cond: two branches returning different map pointers for lookup (tail, tail)",
11886                 .insns = {
11887                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
11888                                     offsetof(struct __sk_buff, mark)),
11889                         BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 0, 3),
11890                         BPF_LD_MAP_FD(BPF_REG_2, 0),
11891                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11892                         BPF_LD_MAP_FD(BPF_REG_2, 0),
11893                         BPF_MOV64_IMM(BPF_REG_3, 7),
11894                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11895                                      BPF_FUNC_tail_call),
11896                         BPF_MOV64_IMM(BPF_REG_0, 1),
11897                         BPF_EXIT_INSN(),
11898                 },
11899                 .fixup_prog1 = { 5 },
11900                 .fixup_prog2 = { 2 },
11901                 .result_unpriv = REJECT,
11902                 .errstr_unpriv = "tail_call abusing map_ptr",
11903                 .result = ACCEPT,
11904                 .retval = 42,
11905         },
11906         {
11907                 "cond: two branches returning same map pointers for lookup (tail, tail)",
11908                 .insns = {
11909                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
11910                                     offsetof(struct __sk_buff, mark)),
11911                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 3),
11912                         BPF_LD_MAP_FD(BPF_REG_2, 0),
11913                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11914                         BPF_LD_MAP_FD(BPF_REG_2, 0),
11915                         BPF_MOV64_IMM(BPF_REG_3, 7),
11916                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11917                                      BPF_FUNC_tail_call),
11918                         BPF_MOV64_IMM(BPF_REG_0, 1),
11919                         BPF_EXIT_INSN(),
11920                 },
11921                 .fixup_prog2 = { 2, 5 },
11922                 .result_unpriv = ACCEPT,
11923                 .result = ACCEPT,
11924                 .retval = 42,
11925         },
11926         {
11927                 "search pruning: all branches should be verified (nop operation)",
11928                 .insns = {
11929                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11930                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11931                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
11932                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11933                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
11934                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
11935                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
11936                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_3, 0xbeef, 2),
11937                         BPF_MOV64_IMM(BPF_REG_4, 0),
11938                         BPF_JMP_A(1),
11939                         BPF_MOV64_IMM(BPF_REG_4, 1),
11940                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -16),
11941                         BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns),
11942                         BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -16),
11943                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_5, 0, 2),
11944                         BPF_MOV64_IMM(BPF_REG_6, 0),
11945                         BPF_ST_MEM(BPF_DW, BPF_REG_6, 0, 0xdead),
11946                         BPF_EXIT_INSN(),
11947                 },
11948                 .fixup_map1 = { 3 },
11949                 .errstr = "R6 invalid mem access 'inv'",
11950                 .result = REJECT,
11951                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11952         },
11953         {
11954                 "search pruning: all branches should be verified (invalid stack access)",
11955                 .insns = {
11956                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11957                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11958                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
11959                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11960                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
11961                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
11962                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
11963                         BPF_MOV64_IMM(BPF_REG_4, 0),
11964                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_3, 0xbeef, 2),
11965                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -16),
11966                         BPF_JMP_A(1),
11967                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -24),
11968                         BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns),
11969                         BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -16),
11970                         BPF_EXIT_INSN(),
11971                 },
11972                 .fixup_map1 = { 3 },
11973                 .errstr = "invalid read from stack off -16+0 size 8",
11974                 .result = REJECT,
11975                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11976         },
11977         {
11978                 "jit: lsh, rsh, arsh by 1",
11979                 .insns = {
11980                         BPF_MOV64_IMM(BPF_REG_0, 1),
11981                         BPF_MOV64_IMM(BPF_REG_1, 0xff),
11982                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 1),
11983                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 1),
11984                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0x3fc, 1),
11985                         BPF_EXIT_INSN(),
11986                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 1),
11987                         BPF_ALU32_IMM(BPF_RSH, BPF_REG_1, 1),
11988                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0xff, 1),
11989                         BPF_EXIT_INSN(),
11990                         BPF_ALU64_IMM(BPF_ARSH, BPF_REG_1, 1),
11991                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0x7f, 1),
11992                         BPF_EXIT_INSN(),
11993                         BPF_MOV64_IMM(BPF_REG_0, 2),
11994                         BPF_EXIT_INSN(),
11995                 },
11996                 .result = ACCEPT,
11997                 .retval = 2,
11998         },
11999         {
12000                 "jit: mov32 for ldimm64, 1",
12001                 .insns = {
12002                         BPF_MOV64_IMM(BPF_REG_0, 2),
12003                         BPF_LD_IMM64(BPF_REG_1, 0xfeffffffffffffffULL),
12004                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 32),
12005                         BPF_LD_IMM64(BPF_REG_2, 0xfeffffffULL),
12006                         BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_2, 1),
12007                         BPF_MOV64_IMM(BPF_REG_0, 1),
12008                         BPF_EXIT_INSN(),
12009                 },
12010                 .result = ACCEPT,
12011                 .retval = 2,
12012         },
12013         {
12014                 "jit: mov32 for ldimm64, 2",
12015                 .insns = {
12016                         BPF_MOV64_IMM(BPF_REG_0, 1),
12017                         BPF_LD_IMM64(BPF_REG_1, 0x1ffffffffULL),
12018                         BPF_LD_IMM64(BPF_REG_2, 0xffffffffULL),
12019                         BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_2, 1),
12020                         BPF_MOV64_IMM(BPF_REG_0, 2),
12021                         BPF_EXIT_INSN(),
12022                 },
12023                 .result = ACCEPT,
12024                 .retval = 2,
12025         },
12026         {
12027                 "jit: various mul tests",
12028                 .insns = {
12029                         BPF_LD_IMM64(BPF_REG_2, 0xeeff0d413122ULL),
12030                         BPF_LD_IMM64(BPF_REG_0, 0xfefefeULL),
12031                         BPF_LD_IMM64(BPF_REG_1, 0xefefefULL),
12032                         BPF_ALU64_REG(BPF_MUL, BPF_REG_0, BPF_REG_1),
12033                         BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_2, 2),
12034                         BPF_MOV64_IMM(BPF_REG_0, 1),
12035                         BPF_EXIT_INSN(),
12036                         BPF_LD_IMM64(BPF_REG_3, 0xfefefeULL),
12037                         BPF_ALU64_REG(BPF_MUL, BPF_REG_3, BPF_REG_1),
12038                         BPF_JMP_REG(BPF_JEQ, BPF_REG_3, BPF_REG_2, 2),
12039                         BPF_MOV64_IMM(BPF_REG_0, 1),
12040                         BPF_EXIT_INSN(),
12041                         BPF_MOV32_REG(BPF_REG_2, BPF_REG_2),
12042                         BPF_LD_IMM64(BPF_REG_0, 0xfefefeULL),
12043                         BPF_ALU32_REG(BPF_MUL, BPF_REG_0, BPF_REG_1),
12044                         BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_2, 2),
12045                         BPF_MOV64_IMM(BPF_REG_0, 1),
12046                         BPF_EXIT_INSN(),
12047                         BPF_LD_IMM64(BPF_REG_3, 0xfefefeULL),
12048                         BPF_ALU32_REG(BPF_MUL, BPF_REG_3, BPF_REG_1),
12049                         BPF_JMP_REG(BPF_JEQ, BPF_REG_3, BPF_REG_2, 2),
12050                         BPF_MOV64_IMM(BPF_REG_0, 1),
12051                         BPF_EXIT_INSN(),
12052                         BPF_LD_IMM64(BPF_REG_0, 0x952a7bbcULL),
12053                         BPF_LD_IMM64(BPF_REG_1, 0xfefefeULL),
12054                         BPF_LD_IMM64(BPF_REG_2, 0xeeff0d413122ULL),
12055                         BPF_ALU32_REG(BPF_MUL, BPF_REG_2, BPF_REG_1),
12056                         BPF_JMP_REG(BPF_JEQ, BPF_REG_2, BPF_REG_0, 2),
12057                         BPF_MOV64_IMM(BPF_REG_0, 1),
12058                         BPF_EXIT_INSN(),
12059                         BPF_MOV64_IMM(BPF_REG_0, 2),
12060                         BPF_EXIT_INSN(),
12061                 },
12062                 .result = ACCEPT,
12063                 .retval = 2,
12064         },
12065         {
12066                 "xadd/w check unaligned stack",
12067                 .insns = {
12068                         BPF_MOV64_IMM(BPF_REG_0, 1),
12069                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
12070                         BPF_STX_XADD(BPF_W, BPF_REG_10, BPF_REG_0, -7),
12071                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
12072                         BPF_EXIT_INSN(),
12073                 },
12074                 .result = REJECT,
12075                 .errstr = "misaligned stack access off",
12076                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12077         },
12078         {
12079                 "xadd/w check unaligned map",
12080                 .insns = {
12081                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
12082                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12083                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12084                         BPF_LD_MAP_FD(BPF_REG_1, 0),
12085                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12086                                      BPF_FUNC_map_lookup_elem),
12087                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
12088                         BPF_EXIT_INSN(),
12089                         BPF_MOV64_IMM(BPF_REG_1, 1),
12090                         BPF_STX_XADD(BPF_W, BPF_REG_0, BPF_REG_1, 3),
12091                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, 3),
12092                         BPF_EXIT_INSN(),
12093                 },
12094                 .fixup_map1 = { 3 },
12095                 .result = REJECT,
12096                 .errstr = "misaligned value access off",
12097                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12098         },
12099         {
12100                 "xadd/w check unaligned pkt",
12101                 .insns = {
12102                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12103                                     offsetof(struct xdp_md, data)),
12104                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
12105                                     offsetof(struct xdp_md, data_end)),
12106                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
12107                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
12108                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 2),
12109                         BPF_MOV64_IMM(BPF_REG_0, 99),
12110                         BPF_JMP_IMM(BPF_JA, 0, 0, 6),
12111                         BPF_MOV64_IMM(BPF_REG_0, 1),
12112                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
12113                         BPF_ST_MEM(BPF_W, BPF_REG_2, 3, 0),
12114                         BPF_STX_XADD(BPF_W, BPF_REG_2, BPF_REG_0, 1),
12115                         BPF_STX_XADD(BPF_W, BPF_REG_2, BPF_REG_0, 2),
12116                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_2, 1),
12117                         BPF_EXIT_INSN(),
12118                 },
12119                 .result = REJECT,
12120                 .errstr = "BPF_XADD stores into R2 packet",
12121                 .prog_type = BPF_PROG_TYPE_XDP,
12122         },
12123         {
12124                 "bpf_get_stack return R0 within range",
12125                 .insns = {
12126                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12127                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
12128                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12129                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12130                         BPF_LD_MAP_FD(BPF_REG_1, 0),
12131                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12132                                      BPF_FUNC_map_lookup_elem),
12133                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 28),
12134                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
12135                         BPF_MOV64_IMM(BPF_REG_9, sizeof(struct test_val)),
12136                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
12137                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
12138                         BPF_MOV64_IMM(BPF_REG_3, sizeof(struct test_val)),
12139                         BPF_MOV64_IMM(BPF_REG_4, 256),
12140                         BPF_EMIT_CALL(BPF_FUNC_get_stack),
12141                         BPF_MOV64_IMM(BPF_REG_1, 0),
12142                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
12143                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_8, 32),
12144                         BPF_ALU64_IMM(BPF_ARSH, BPF_REG_8, 32),
12145                         BPF_JMP_REG(BPF_JSLT, BPF_REG_1, BPF_REG_8, 16),
12146                         BPF_ALU64_REG(BPF_SUB, BPF_REG_9, BPF_REG_8),
12147                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
12148                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_8),
12149                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_9),
12150                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 32),
12151                         BPF_ALU64_IMM(BPF_ARSH, BPF_REG_1, 32),
12152                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
12153                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_1),
12154                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
12155                         BPF_MOV64_IMM(BPF_REG_5, sizeof(struct test_val)),
12156                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_5),
12157                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 4),
12158                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
12159                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_9),
12160                         BPF_MOV64_IMM(BPF_REG_4, 0),
12161                         BPF_EMIT_CALL(BPF_FUNC_get_stack),
12162                         BPF_EXIT_INSN(),
12163                 },
12164                 .fixup_map2 = { 4 },
12165                 .result = ACCEPT,
12166                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
12167         },
12168         {
12169                 "ld_abs: invalid op 1",
12170                 .insns = {
12171                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12172                         BPF_LD_ABS(BPF_DW, 0),
12173                         BPF_EXIT_INSN(),
12174                 },
12175                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12176                 .result = REJECT,
12177                 .errstr = "unknown opcode",
12178         },
12179         {
12180                 "ld_abs: invalid op 2",
12181                 .insns = {
12182                         BPF_MOV32_IMM(BPF_REG_0, 256),
12183                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12184                         BPF_LD_IND(BPF_DW, BPF_REG_0, 0),
12185                         BPF_EXIT_INSN(),
12186                 },
12187                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12188                 .result = REJECT,
12189                 .errstr = "unknown opcode",
12190         },
12191         {
12192                 "ld_abs: nmap reduced",
12193                 .insns = {
12194                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12195                         BPF_LD_ABS(BPF_H, 12),
12196                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x806, 28),
12197                         BPF_LD_ABS(BPF_H, 12),
12198                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x806, 26),
12199                         BPF_MOV32_IMM(BPF_REG_0, 18),
12200                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -64),
12201                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_10, -64),
12202                         BPF_LD_IND(BPF_W, BPF_REG_7, 14),
12203                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -60),
12204                         BPF_MOV32_IMM(BPF_REG_0, 280971478),
12205                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -56),
12206                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_10, -56),
12207                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -60),
12208                         BPF_ALU32_REG(BPF_SUB, BPF_REG_0, BPF_REG_7),
12209                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 15),
12210                         BPF_LD_ABS(BPF_H, 12),
12211                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x806, 13),
12212                         BPF_MOV32_IMM(BPF_REG_0, 22),
12213                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -56),
12214                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_10, -56),
12215                         BPF_LD_IND(BPF_H, BPF_REG_7, 14),
12216                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -52),
12217                         BPF_MOV32_IMM(BPF_REG_0, 17366),
12218                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -48),
12219                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_10, -48),
12220                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -52),
12221                         BPF_ALU32_REG(BPF_SUB, BPF_REG_0, BPF_REG_7),
12222                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
12223                         BPF_MOV32_IMM(BPF_REG_0, 256),
12224                         BPF_EXIT_INSN(),
12225                         BPF_MOV32_IMM(BPF_REG_0, 0),
12226                         BPF_EXIT_INSN(),
12227                 },
12228                 .data = {
12229                         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x08, 0x06, 0,
12230                         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
12231                         0x10, 0xbf, 0x48, 0xd6, 0x43, 0xd6,
12232                 },
12233                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12234                 .result = ACCEPT,
12235                 .retval = 256,
12236         },
12237         {
12238                 "ld_abs: div + abs, test 1",
12239                 .insns = {
12240                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
12241                         BPF_LD_ABS(BPF_B, 3),
12242                         BPF_ALU64_IMM(BPF_MOV, BPF_REG_2, 2),
12243                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_2),
12244                         BPF_ALU64_REG(BPF_MOV, BPF_REG_8, BPF_REG_0),
12245                         BPF_LD_ABS(BPF_B, 4),
12246                         BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_0),
12247                         BPF_LD_IND(BPF_B, BPF_REG_8, -70),
12248                         BPF_EXIT_INSN(),
12249                 },
12250                 .data = {
12251                         10, 20, 30, 40, 50,
12252                 },
12253                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12254                 .result = ACCEPT,
12255                 .retval = 10,
12256         },
12257         {
12258                 "ld_abs: div + abs, test 2",
12259                 .insns = {
12260                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
12261                         BPF_LD_ABS(BPF_B, 3),
12262                         BPF_ALU64_IMM(BPF_MOV, BPF_REG_2, 2),
12263                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_2),
12264                         BPF_ALU64_REG(BPF_MOV, BPF_REG_8, BPF_REG_0),
12265                         BPF_LD_ABS(BPF_B, 128),
12266                         BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_0),
12267                         BPF_LD_IND(BPF_B, BPF_REG_8, -70),
12268                         BPF_EXIT_INSN(),
12269                 },
12270                 .data = {
12271                         10, 20, 30, 40, 50,
12272                 },
12273                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12274                 .result = ACCEPT,
12275                 .retval = 0,
12276         },
12277         {
12278                 "ld_abs: div + abs, test 3",
12279                 .insns = {
12280                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
12281                         BPF_ALU64_IMM(BPF_MOV, BPF_REG_7, 0),
12282                         BPF_LD_ABS(BPF_B, 3),
12283                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_7),
12284                         BPF_EXIT_INSN(),
12285                 },
12286                 .data = {
12287                         10, 20, 30, 40, 50,
12288                 },
12289                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12290                 .result = ACCEPT,
12291                 .retval = 0,
12292         },
12293         {
12294                 "ld_abs: div + abs, test 4",
12295                 .insns = {
12296                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
12297                         BPF_ALU64_IMM(BPF_MOV, BPF_REG_7, 0),
12298                         BPF_LD_ABS(BPF_B, 256),
12299                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_7),
12300                         BPF_EXIT_INSN(),
12301                 },
12302                 .data = {
12303                         10, 20, 30, 40, 50,
12304                 },
12305                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12306                 .result = ACCEPT,
12307                 .retval = 0,
12308         },
12309         {
12310                 "ld_abs: vlan + abs, test 1",
12311                 .insns = { },
12312                 .data = {
12313                         0x34,
12314                 },
12315                 .fill_helper = bpf_fill_ld_abs_vlan_push_pop,
12316                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12317                 .result = ACCEPT,
12318                 .retval = 0xbef,
12319         },
12320         {
12321                 "ld_abs: vlan + abs, test 2",
12322                 .insns = {
12323                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12324                         BPF_LD_ABS(BPF_B, 0),
12325                         BPF_LD_ABS(BPF_H, 0),
12326                         BPF_LD_ABS(BPF_W, 0),
12327                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
12328                         BPF_MOV64_IMM(BPF_REG_6, 0),
12329                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
12330                         BPF_MOV64_IMM(BPF_REG_2, 1),
12331                         BPF_MOV64_IMM(BPF_REG_3, 2),
12332                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12333                                      BPF_FUNC_skb_vlan_push),
12334                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
12335                         BPF_LD_ABS(BPF_B, 0),
12336                         BPF_LD_ABS(BPF_H, 0),
12337                         BPF_LD_ABS(BPF_W, 0),
12338                         BPF_MOV64_IMM(BPF_REG_0, 42),
12339                         BPF_EXIT_INSN(),
12340                 },
12341                 .data = {
12342                         0x34,
12343                 },
12344                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12345                 .result = ACCEPT,
12346                 .retval = 42,
12347         },
12348         {
12349                 "ld_abs: jump around ld_abs",
12350                 .insns = { },
12351                 .data = {
12352                         10, 11,
12353                 },
12354                 .fill_helper = bpf_fill_jump_around_ld_abs,
12355                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12356                 .result = ACCEPT,
12357                 .retval = 10,
12358         },
12359         {
12360                 "ld_dw: xor semi-random 64 bit imms, test 1",
12361                 .insns = { },
12362                 .data = { },
12363                 .fill_helper = bpf_fill_rand_ld_dw,
12364                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12365                 .result = ACCEPT,
12366                 .retval = 4090,
12367         },
12368         {
12369                 "ld_dw: xor semi-random 64 bit imms, test 2",
12370                 .insns = { },
12371                 .data = { },
12372                 .fill_helper = bpf_fill_rand_ld_dw,
12373                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12374                 .result = ACCEPT,
12375                 .retval = 2047,
12376         },
12377         {
12378                 "ld_dw: xor semi-random 64 bit imms, test 3",
12379                 .insns = { },
12380                 .data = { },
12381                 .fill_helper = bpf_fill_rand_ld_dw,
12382                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12383                 .result = ACCEPT,
12384                 .retval = 511,
12385         },
12386         {
12387                 "ld_dw: xor semi-random 64 bit imms, test 4",
12388                 .insns = { },
12389                 .data = { },
12390                 .fill_helper = bpf_fill_rand_ld_dw,
12391                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12392                 .result = ACCEPT,
12393                 .retval = 5,
12394         },
12395         {
12396                 "pass unmodified ctx pointer to helper",
12397                 .insns = {
12398                         BPF_MOV64_IMM(BPF_REG_2, 0),
12399                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12400                                      BPF_FUNC_csum_update),
12401                         BPF_MOV64_IMM(BPF_REG_0, 0),
12402                         BPF_EXIT_INSN(),
12403                 },
12404                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12405                 .result = ACCEPT,
12406         },
12407         {
12408                 "pass modified ctx pointer to helper, 1",
12409                 .insns = {
12410                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -612),
12411                         BPF_MOV64_IMM(BPF_REG_2, 0),
12412                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12413                                      BPF_FUNC_csum_update),
12414                         BPF_MOV64_IMM(BPF_REG_0, 0),
12415                         BPF_EXIT_INSN(),
12416                 },
12417                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12418                 .result = REJECT,
12419                 .errstr = "dereference of modified ctx ptr",
12420         },
12421         {
12422                 "pass modified ctx pointer to helper, 2",
12423                 .insns = {
12424                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -612),
12425                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12426                                      BPF_FUNC_get_socket_cookie),
12427                         BPF_MOV64_IMM(BPF_REG_0, 0),
12428                         BPF_EXIT_INSN(),
12429                 },
12430                 .result_unpriv = REJECT,
12431                 .result = REJECT,
12432                 .errstr_unpriv = "dereference of modified ctx ptr",
12433                 .errstr = "dereference of modified ctx ptr",
12434         },
12435         {
12436                 "pass modified ctx pointer to helper, 3",
12437                 .insns = {
12438                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 0),
12439                         BPF_ALU64_IMM(BPF_AND, BPF_REG_3, 4),
12440                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
12441                         BPF_MOV64_IMM(BPF_REG_2, 0),
12442                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12443                                      BPF_FUNC_csum_update),
12444                         BPF_MOV64_IMM(BPF_REG_0, 0),
12445                         BPF_EXIT_INSN(),
12446                 },
12447                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12448                 .result = REJECT,
12449                 .errstr = "variable ctx access var_off=(0x0; 0x4)",
12450         },
12451         {
12452                 "mov64 src == dst",
12453                 .insns = {
12454                         BPF_MOV64_IMM(BPF_REG_2, 0),
12455                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_2),
12456                         // Check bounds are OK
12457                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
12458                         BPF_MOV64_IMM(BPF_REG_0, 0),
12459                         BPF_EXIT_INSN(),
12460                 },
12461                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12462                 .result = ACCEPT,
12463         },
12464         {
12465                 "mov64 src != dst",
12466                 .insns = {
12467                         BPF_MOV64_IMM(BPF_REG_3, 0),
12468                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_3),
12469                         // Check bounds are OK
12470                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
12471                         BPF_MOV64_IMM(BPF_REG_0, 0),
12472                         BPF_EXIT_INSN(),
12473                 },
12474                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12475                 .result = ACCEPT,
12476         },
12477 };
12478
12479 static int probe_filter_length(const struct bpf_insn *fp)
12480 {
12481         int len;
12482
12483         for (len = MAX_INSNS - 1; len > 0; --len)
12484                 if (fp[len].code != 0 || fp[len].imm != 0)
12485                         break;
12486         return len + 1;
12487 }
12488
12489 static int create_map(uint32_t type, uint32_t size_key,
12490                       uint32_t size_value, uint32_t max_elem)
12491 {
12492         int fd;
12493
12494         fd = bpf_create_map(type, size_key, size_value, max_elem,
12495                             type == BPF_MAP_TYPE_HASH ? BPF_F_NO_PREALLOC : 0);
12496         if (fd < 0)
12497                 printf("Failed to create hash map '%s'!\n", strerror(errno));
12498
12499         return fd;
12500 }
12501
12502 static int create_prog_dummy1(void)
12503 {
12504         struct bpf_insn prog[] = {
12505                 BPF_MOV64_IMM(BPF_REG_0, 42),
12506                 BPF_EXIT_INSN(),
12507         };
12508
12509         return bpf_load_program(BPF_PROG_TYPE_SOCKET_FILTER, prog,
12510                                 ARRAY_SIZE(prog), "GPL", 0, NULL, 0);
12511 }
12512
12513 static int create_prog_dummy2(int mfd, int idx)
12514 {
12515         struct bpf_insn prog[] = {
12516                 BPF_MOV64_IMM(BPF_REG_3, idx),
12517                 BPF_LD_MAP_FD(BPF_REG_2, mfd),
12518                 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12519                              BPF_FUNC_tail_call),
12520                 BPF_MOV64_IMM(BPF_REG_0, 41),
12521                 BPF_EXIT_INSN(),
12522         };
12523
12524         return bpf_load_program(BPF_PROG_TYPE_SOCKET_FILTER, prog,
12525                                 ARRAY_SIZE(prog), "GPL", 0, NULL, 0);
12526 }
12527
12528 static int create_prog_array(uint32_t max_elem, int p1key)
12529 {
12530         int p2key = 1;
12531         int mfd, p1fd, p2fd;
12532
12533         mfd = bpf_create_map(BPF_MAP_TYPE_PROG_ARRAY, sizeof(int),
12534                              sizeof(int), max_elem, 0);
12535         if (mfd < 0) {
12536                 printf("Failed to create prog array '%s'!\n", strerror(errno));
12537                 return -1;
12538         }
12539
12540         p1fd = create_prog_dummy1();
12541         p2fd = create_prog_dummy2(mfd, p2key);
12542         if (p1fd < 0 || p2fd < 0)
12543                 goto out;
12544         if (bpf_map_update_elem(mfd, &p1key, &p1fd, BPF_ANY) < 0)
12545                 goto out;
12546         if (bpf_map_update_elem(mfd, &p2key, &p2fd, BPF_ANY) < 0)
12547                 goto out;
12548         close(p2fd);
12549         close(p1fd);
12550
12551         return mfd;
12552 out:
12553         close(p2fd);
12554         close(p1fd);
12555         close(mfd);
12556         return -1;
12557 }
12558
12559 static int create_map_in_map(void)
12560 {
12561         int inner_map_fd, outer_map_fd;
12562
12563         inner_map_fd = bpf_create_map(BPF_MAP_TYPE_ARRAY, sizeof(int),
12564                                       sizeof(int), 1, 0);
12565         if (inner_map_fd < 0) {
12566                 printf("Failed to create array '%s'!\n", strerror(errno));
12567                 return inner_map_fd;
12568         }
12569
12570         outer_map_fd = bpf_create_map_in_map(BPF_MAP_TYPE_ARRAY_OF_MAPS, NULL,
12571                                              sizeof(int), inner_map_fd, 1, 0);
12572         if (outer_map_fd < 0)
12573                 printf("Failed to create array of maps '%s'!\n",
12574                        strerror(errno));
12575
12576         close(inner_map_fd);
12577
12578         return outer_map_fd;
12579 }
12580
12581 static int create_cgroup_storage(void)
12582 {
12583         int fd;
12584
12585         fd = bpf_create_map(BPF_MAP_TYPE_CGROUP_STORAGE,
12586                             sizeof(struct bpf_cgroup_storage_key),
12587                             TEST_DATA_LEN, 0, 0);
12588         if (fd < 0)
12589                 printf("Failed to create array '%s'!\n", strerror(errno));
12590
12591         return fd;
12592 }
12593
12594 static char bpf_vlog[UINT_MAX >> 8];
12595
12596 static void do_test_fixup(struct bpf_test *test, struct bpf_insn *prog,
12597                           int *map_fds)
12598 {
12599         int *fixup_map1 = test->fixup_map1;
12600         int *fixup_map2 = test->fixup_map2;
12601         int *fixup_map3 = test->fixup_map3;
12602         int *fixup_map4 = test->fixup_map4;
12603         int *fixup_prog1 = test->fixup_prog1;
12604         int *fixup_prog2 = test->fixup_prog2;
12605         int *fixup_map_in_map = test->fixup_map_in_map;
12606         int *fixup_cgroup_storage = test->fixup_cgroup_storage;
12607
12608         if (test->fill_helper)
12609                 test->fill_helper(test);
12610
12611         /* Allocating HTs with 1 elem is fine here, since we only test
12612          * for verifier and not do a runtime lookup, so the only thing
12613          * that really matters is value size in this case.
12614          */
12615         if (*fixup_map1) {
12616                 map_fds[0] = create_map(BPF_MAP_TYPE_HASH, sizeof(long long),
12617                                         sizeof(long long), 1);
12618                 do {
12619                         prog[*fixup_map1].imm = map_fds[0];
12620                         fixup_map1++;
12621                 } while (*fixup_map1);
12622         }
12623
12624         if (*fixup_map2) {
12625                 map_fds[1] = create_map(BPF_MAP_TYPE_HASH, sizeof(long long),
12626                                         sizeof(struct test_val), 1);
12627                 do {
12628                         prog[*fixup_map2].imm = map_fds[1];
12629                         fixup_map2++;
12630                 } while (*fixup_map2);
12631         }
12632
12633         if (*fixup_map3) {
12634                 map_fds[2] = create_map(BPF_MAP_TYPE_HASH, sizeof(long long),
12635                                         sizeof(struct other_val), 1);
12636                 do {
12637                         prog[*fixup_map3].imm = map_fds[2];
12638                         fixup_map3++;
12639                 } while (*fixup_map3);
12640         }
12641
12642         if (*fixup_map4) {
12643                 map_fds[3] = create_map(BPF_MAP_TYPE_ARRAY, sizeof(int),
12644                                         sizeof(struct test_val), 1);
12645                 do {
12646                         prog[*fixup_map4].imm = map_fds[3];
12647                         fixup_map4++;
12648                 } while (*fixup_map4);
12649         }
12650
12651         if (*fixup_prog1) {
12652                 map_fds[4] = create_prog_array(4, 0);
12653                 do {
12654                         prog[*fixup_prog1].imm = map_fds[4];
12655                         fixup_prog1++;
12656                 } while (*fixup_prog1);
12657         }
12658
12659         if (*fixup_prog2) {
12660                 map_fds[5] = create_prog_array(8, 7);
12661                 do {
12662                         prog[*fixup_prog2].imm = map_fds[5];
12663                         fixup_prog2++;
12664                 } while (*fixup_prog2);
12665         }
12666
12667         if (*fixup_map_in_map) {
12668                 map_fds[6] = create_map_in_map();
12669                 do {
12670                         prog[*fixup_map_in_map].imm = map_fds[6];
12671                         fixup_map_in_map++;
12672                 } while (*fixup_map_in_map);
12673         }
12674
12675         if (*fixup_cgroup_storage) {
12676                 map_fds[7] = create_cgroup_storage();
12677                 do {
12678                         prog[*fixup_cgroup_storage].imm = map_fds[7];
12679                         fixup_cgroup_storage++;
12680                 } while (*fixup_cgroup_storage);
12681         }
12682 }
12683
12684 static void do_test_single(struct bpf_test *test, bool unpriv,
12685                            int *passes, int *errors)
12686 {
12687         int fd_prog, expected_ret, reject_from_alignment;
12688         int prog_len, prog_type = test->prog_type;
12689         struct bpf_insn *prog = test->insns;
12690         int map_fds[MAX_NR_MAPS];
12691         const char *expected_err;
12692         uint32_t retval;
12693         int i, err;
12694
12695         for (i = 0; i < MAX_NR_MAPS; i++)
12696                 map_fds[i] = -1;
12697
12698         do_test_fixup(test, prog, map_fds);
12699         prog_len = probe_filter_length(prog);
12700
12701         fd_prog = bpf_verify_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
12702                                      prog, prog_len, test->flags & F_LOAD_WITH_STRICT_ALIGNMENT,
12703                                      "GPL", 0, bpf_vlog, sizeof(bpf_vlog), 1);
12704
12705         expected_ret = unpriv && test->result_unpriv != UNDEF ?
12706                        test->result_unpriv : test->result;
12707         expected_err = unpriv && test->errstr_unpriv ?
12708                        test->errstr_unpriv : test->errstr;
12709
12710         reject_from_alignment = fd_prog < 0 &&
12711                                 (test->flags & F_NEEDS_EFFICIENT_UNALIGNED_ACCESS) &&
12712                                 strstr(bpf_vlog, "Unknown alignment.");
12713 #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
12714         if (reject_from_alignment) {
12715                 printf("FAIL\nFailed due to alignment despite having efficient unaligned access: '%s'!\n",
12716                        strerror(errno));
12717                 goto fail_log;
12718         }
12719 #endif
12720         if (expected_ret == ACCEPT) {
12721                 if (fd_prog < 0 && !reject_from_alignment) {
12722                         printf("FAIL\nFailed to load prog '%s'!\n",
12723                                strerror(errno));
12724                         goto fail_log;
12725                 }
12726         } else {
12727                 if (fd_prog >= 0) {
12728                         printf("FAIL\nUnexpected success to load!\n");
12729                         goto fail_log;
12730                 }
12731                 if (!strstr(bpf_vlog, expected_err) && !reject_from_alignment) {
12732                         printf("FAIL\nUnexpected error message!\n\tEXP: %s\n\tRES: %s\n",
12733                               expected_err, bpf_vlog);
12734                         goto fail_log;
12735                 }
12736         }
12737
12738         if (fd_prog >= 0) {
12739                 __u8 tmp[TEST_DATA_LEN << 2];
12740                 __u32 size_tmp = sizeof(tmp);
12741
12742                 err = bpf_prog_test_run(fd_prog, 1, test->data,
12743                                         sizeof(test->data), tmp, &size_tmp,
12744                                         &retval, NULL);
12745                 if (err && errno != 524/*ENOTSUPP*/ && errno != EPERM) {
12746                         printf("Unexpected bpf_prog_test_run error\n");
12747                         goto fail_log;
12748                 }
12749                 if (!err && retval != test->retval &&
12750                     test->retval != POINTER_VALUE) {
12751                         printf("FAIL retval %d != %d\n", retval, test->retval);
12752                         goto fail_log;
12753                 }
12754         }
12755         (*passes)++;
12756         printf("OK%s\n", reject_from_alignment ?
12757                " (NOTE: reject due to unknown alignment)" : "");
12758 close_fds:
12759         close(fd_prog);
12760         for (i = 0; i < MAX_NR_MAPS; i++)
12761                 close(map_fds[i]);
12762         sched_yield();
12763         return;
12764 fail_log:
12765         (*errors)++;
12766         printf("%s", bpf_vlog);
12767         goto close_fds;
12768 }
12769
12770 static bool is_admin(void)
12771 {
12772         cap_t caps;
12773         cap_flag_value_t sysadmin = CAP_CLEAR;
12774         const cap_value_t cap_val = CAP_SYS_ADMIN;
12775
12776 #ifdef CAP_IS_SUPPORTED
12777         if (!CAP_IS_SUPPORTED(CAP_SETFCAP)) {
12778                 perror("cap_get_flag");
12779                 return false;
12780         }
12781 #endif
12782         caps = cap_get_proc();
12783         if (!caps) {
12784                 perror("cap_get_proc");
12785                 return false;
12786         }
12787         if (cap_get_flag(caps, cap_val, CAP_EFFECTIVE, &sysadmin))
12788                 perror("cap_get_flag");
12789         if (cap_free(caps))
12790                 perror("cap_free");
12791         return (sysadmin == CAP_SET);
12792 }
12793
12794 static int set_admin(bool admin)
12795 {
12796         cap_t caps;
12797         const cap_value_t cap_val = CAP_SYS_ADMIN;
12798         int ret = -1;
12799
12800         caps = cap_get_proc();
12801         if (!caps) {
12802                 perror("cap_get_proc");
12803                 return -1;
12804         }
12805         if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_val,
12806                                 admin ? CAP_SET : CAP_CLEAR)) {
12807                 perror("cap_set_flag");
12808                 goto out;
12809         }
12810         if (cap_set_proc(caps)) {
12811                 perror("cap_set_proc");
12812                 goto out;
12813         }
12814         ret = 0;
12815 out:
12816         if (cap_free(caps))
12817                 perror("cap_free");
12818         return ret;
12819 }
12820
12821 static void get_unpriv_disabled()
12822 {
12823         char buf[2];
12824         FILE *fd;
12825
12826         fd = fopen("/proc/sys/"UNPRIV_SYSCTL, "r");
12827         if (!fd) {
12828                 perror("fopen /proc/sys/"UNPRIV_SYSCTL);
12829                 unpriv_disabled = true;
12830                 return;
12831         }
12832         if (fgets(buf, 2, fd) == buf && atoi(buf))
12833                 unpriv_disabled = true;
12834         fclose(fd);
12835 }
12836
12837 static int do_test(bool unpriv, unsigned int from, unsigned int to)
12838 {
12839         int i, passes = 0, errors = 0, skips = 0;
12840
12841         for (i = from; i < to; i++) {
12842                 struct bpf_test *test = &tests[i];
12843
12844                 /* Program types that are not supported by non-root we
12845                  * skip right away.
12846                  */
12847                 if (!test->prog_type && unpriv_disabled) {
12848                         printf("#%d/u %s SKIP\n", i, test->descr);
12849                         skips++;
12850                 } else if (!test->prog_type) {
12851                         if (!unpriv)
12852                                 set_admin(false);
12853                         printf("#%d/u %s ", i, test->descr);
12854                         do_test_single(test, true, &passes, &errors);
12855                         if (!unpriv)
12856                                 set_admin(true);
12857                 }
12858
12859                 if (unpriv) {
12860                         printf("#%d/p %s SKIP\n", i, test->descr);
12861                         skips++;
12862                 } else {
12863                         printf("#%d/p %s ", i, test->descr);
12864                         do_test_single(test, false, &passes, &errors);
12865                 }
12866         }
12867
12868         printf("Summary: %d PASSED, %d SKIPPED, %d FAILED\n", passes,
12869                skips, errors);
12870         return errors ? EXIT_FAILURE : EXIT_SUCCESS;
12871 }
12872
12873 int main(int argc, char **argv)
12874 {
12875         unsigned int from = 0, to = ARRAY_SIZE(tests);
12876         bool unpriv = !is_admin();
12877
12878         if (argc == 3) {
12879                 unsigned int l = atoi(argv[argc - 2]);
12880                 unsigned int u = atoi(argv[argc - 1]);
12881
12882                 if (l < to && u < to) {
12883                         from = l;
12884                         to   = u + 1;
12885                 }
12886         } else if (argc == 2) {
12887                 unsigned int t = atoi(argv[argc - 1]);
12888
12889                 if (t < to) {
12890                         from = t;
12891                         to   = t + 1;
12892                 }
12893         }
12894
12895         get_unpriv_disabled();
12896         if (unpriv && unpriv_disabled) {
12897                 printf("Cannot run as unprivileged user with sysctl %s.\n",
12898                        UNPRIV_SYSCTL);
12899                 return EXIT_FAILURE;
12900         }
12901
12902         bpf_semi_rand_init();
12903         return do_test(unpriv, from, to);
12904 }