tools/testing/selftests/bpf/test_verifier.c

   1 /*
   2  * Testsuite for eBPF verifier
   3  *
   4  * Copyright (c) 2014 PLUMgrid, http://plumgrid.com
   5  * Copyright (c) 2017 Facebook
   6  *
   7  * This program is free software; you can redistribute it and/or
   8  * modify it under the terms of version 2 of the GNU General Public
   9  * License as published by the Free Software Foundation.
  10  */
  11
  12 #include <endian.h>
  13 #include <asm/types.h>
  14 #include <linux/types.h>
  15 #include <stdint.h>
  16 #include <stdio.h>
  17 #include <stdlib.h>
  18 #include <unistd.h>
  19 #include <errno.h>
  20 #include <string.h>
  21 #include <stddef.h>
  22 #include <stdbool.h>
  23 #include <sched.h>
  24 #include <limits.h>
  25
  26 #include <sys/capability.h>
  27
  28 #include <linux/unistd.h>
  29 #include <linux/filter.h>
  30 #include <linux/bpf_perf_event.h>
  31 #include <linux/bpf.h>
  32 #include <linux/if_ether.h>
  33
  34 #include <bpf/bpf.h>
  35
  36 #ifdef HAVE_GENHDR
  37 # include "autoconf.h"
  38 #else
  39 # if defined(__i386) || defined(__x86_64) || defined(__s390x__) || defined(__aarch64__)
  40 #  define CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 1
  41 # endif
  42 #endif
  43 #include "bpf_rlimit.h"
  44 #include "bpf_rand.h"
  45 #include "bpf_util.h"
  46 #include "../../../include/linux/filter.h"
  47
  48 #define MAX_INSNS       BPF_MAXINSNS
  49 #define MAX_FIXUPS      8
  50 #define MAX_NR_MAPS     8
  51 #define POINTER_VALUE   0xcafe4all
  52 #define TEST_DATA_LEN   64
  53
  54 #define F_NEEDS_EFFICIENT_UNALIGNED_ACCESS      (1 << 0)
  55 #define F_LOAD_WITH_STRICT_ALIGNMENT            (1 << 1)
  56
  57 #define UNPRIV_SYSCTL "kernel/unprivileged_bpf_disabled"
  58 static bool unpriv_disabled = false;
  59
  60 struct bpf_test {
  61         const char *descr;
  62         struct bpf_insn insns[MAX_INSNS];
  63         int fixup_map1[MAX_FIXUPS];
  64         int fixup_map2[MAX_FIXUPS];
  65         int fixup_map3[MAX_FIXUPS];
  66         int fixup_map4[MAX_FIXUPS];
  67         int fixup_prog1[MAX_FIXUPS];
  68         int fixup_prog2[MAX_FIXUPS];
  69         int fixup_map_in_map[MAX_FIXUPS];
  70         int fixup_cgroup_storage[MAX_FIXUPS];
  71         const char *errstr;
  72         const char *errstr_unpriv;
  73         uint32_t retval;
  74         enum {
  75                 UNDEF,
  76                 ACCEPT,
  77                 REJECT
  78         } result, result_unpriv;
  79         enum bpf_prog_type prog_type;
  80         uint8_t flags;
  81         __u8 data[TEST_DATA_LEN];
  82         void (*fill_helper)(struct bpf_test *self);
  83 };
  84
  85 /* Note we want this to be 64 bit aligned so that the end of our array is
  86  * actually the end of the structure.
  87  */
  88 #define MAX_ENTRIES 11
  89
  90 struct test_val {
  91         unsigned int index;
  92         int foo[MAX_ENTRIES];
  93 };
  94
  95 struct other_val {
  96         long long foo;
  97         long long bar;
  98 };
  99
 100 static void bpf_fill_ld_abs_vlan_push_pop(struct bpf_test *self)
 101 {
 102         /* test: {skb->data[0], vlan_push} x 68 + {skb->data[0], vlan_pop} x 68 */
 103 #define PUSH_CNT 51
 104         unsigned int len = BPF_MAXINSNS;
 105         struct bpf_insn *insn = self->insns;
 106         int i = 0, j, k = 0;
 107
 108         insn[i++] = BPF_MOV64_REG(BPF_REG_6, BPF_REG_1);
 109 loop:
 110         for (j = 0; j < PUSH_CNT; j++) {
 111                 insn[i++] = BPF_LD_ABS(BPF_B, 0);
 112                 insn[i] = BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x34, len - i - 2);
 113                 i++;
 114                 insn[i++] = BPF_MOV64_REG(BPF_REG_1, BPF_REG_6);
 115                 insn[i++] = BPF_MOV64_IMM(BPF_REG_2, 1);
 116                 insn[i++] = BPF_MOV64_IMM(BPF_REG_3, 2);
 117                 insn[i++] = BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 118                                          BPF_FUNC_skb_vlan_push),
 119                 insn[i] = BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, len - i - 2);
 120                 i++;
 121         }
 122
 123         for (j = 0; j < PUSH_CNT; j++) {
 124                 insn[i++] = BPF_LD_ABS(BPF_B, 0);
 125                 insn[i] = BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x34, len - i - 2);
 126                 i++;
 127                 insn[i++] = BPF_MOV64_REG(BPF_REG_1, BPF_REG_6);
 128                 insn[i++] = BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 129                                          BPF_FUNC_skb_vlan_pop),
 130                 insn[i] = BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, len - i - 2);
 131                 i++;
 132         }
 133         if (++k < 5)
 134                 goto loop;
 135
 136         for (; i < len - 1; i++)
 137                 insn[i] = BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 0xbef);
 138         insn[len - 1] = BPF_EXIT_INSN();
 139 }
 140
 141 static void bpf_fill_jump_around_ld_abs(struct bpf_test *self)
 142 {
 143         struct bpf_insn *insn = self->insns;
 144         unsigned int len = BPF_MAXINSNS;
 145         int i = 0;
 146
 147         insn[i++] = BPF_MOV64_REG(BPF_REG_6, BPF_REG_1);
 148         insn[i++] = BPF_LD_ABS(BPF_B, 0);
 149         insn[i] = BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 10, len - i - 2);
 150         i++;
 151         while (i < len - 1)
 152                 insn[i++] = BPF_LD_ABS(BPF_B, 1);
 153         insn[i] = BPF_EXIT_INSN();
 154 }
 155
 156 static void bpf_fill_rand_ld_dw(struct bpf_test *self)
 157 {
 158         struct bpf_insn *insn = self->insns;
 159         uint64_t res = 0;
 160         int i = 0;
 161
 162         insn[i++] = BPF_MOV32_IMM(BPF_REG_0, 0);
 163         while (i < self->retval) {
 164                 uint64_t val = bpf_semi_rand_get();
 165                 struct bpf_insn tmp[2] = { BPF_LD_IMM64(BPF_REG_1, val) };
 166
 167                 res ^= val;
 168                 insn[i++] = tmp[0];
 169                 insn[i++] = tmp[1];
 170                 insn[i++] = BPF_ALU64_REG(BPF_XOR, BPF_REG_0, BPF_REG_1);
 171         }
 172         insn[i++] = BPF_MOV64_REG(BPF_REG_1, BPF_REG_0);
 173         insn[i++] = BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 32);
 174         insn[i++] = BPF_ALU64_REG(BPF_XOR, BPF_REG_0, BPF_REG_1);
 175         insn[i] = BPF_EXIT_INSN();
 176         res ^= (res >> 32);
 177         self->retval = (uint32_t)res;
 178 }
 179
 180 static struct bpf_test tests[] = {
 181         {
 182                 "add+sub+mul",
 183                 .insns = {
 184                         BPF_MOV64_IMM(BPF_REG_1, 1),
 185                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 2),
 186                         BPF_MOV64_IMM(BPF_REG_2, 3),
 187                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_2),
 188                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -1),
 189                         BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 3),
 190                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
 191                         BPF_EXIT_INSN(),
 192                 },
 193                 .result = ACCEPT,
 194                 .retval = -3,
 195         },
 196         {
 197                 "DIV32 by 0, zero check 1",
 198                 .insns = {
 199                         BPF_MOV32_IMM(BPF_REG_0, 42),
 200                         BPF_MOV32_IMM(BPF_REG_1, 0),
 201                         BPF_MOV32_IMM(BPF_REG_2, 1),
 202                         BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
 203                         BPF_EXIT_INSN(),
 204                 },
 205                 .result = ACCEPT,
 206                 .retval = 42,
 207         },
 208         {
 209                 "DIV32 by 0, zero check 2",
 210                 .insns = {
 211                         BPF_MOV32_IMM(BPF_REG_0, 42),
 212                         BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
 213                         BPF_MOV32_IMM(BPF_REG_2, 1),
 214                         BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
 215                         BPF_EXIT_INSN(),
 216                 },
 217                 .result = ACCEPT,
 218                 .retval = 42,
 219         },
 220         {
 221                 "DIV64 by 0, zero check",
 222                 .insns = {
 223                         BPF_MOV32_IMM(BPF_REG_0, 42),
 224                         BPF_MOV32_IMM(BPF_REG_1, 0),
 225                         BPF_MOV32_IMM(BPF_REG_2, 1),
 226                         BPF_ALU64_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
 227                         BPF_EXIT_INSN(),
 228                 },
 229                 .result = ACCEPT,
 230                 .retval = 42,
 231         },
 232         {
 233                 "MOD32 by 0, zero check 1",
 234                 .insns = {
 235                         BPF_MOV32_IMM(BPF_REG_0, 42),
 236                         BPF_MOV32_IMM(BPF_REG_1, 0),
 237                         BPF_MOV32_IMM(BPF_REG_2, 1),
 238                         BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 239                         BPF_EXIT_INSN(),
 240                 },
 241                 .result = ACCEPT,
 242                 .retval = 42,
 243         },
 244         {
 245                 "MOD32 by 0, zero check 2",
 246                 .insns = {
 247                         BPF_MOV32_IMM(BPF_REG_0, 42),
 248                         BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
 249                         BPF_MOV32_IMM(BPF_REG_2, 1),
 250                         BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 251                         BPF_EXIT_INSN(),
 252                 },
 253                 .result = ACCEPT,
 254                 .retval = 42,
 255         },
 256         {
 257                 "MOD64 by 0, zero check",
 258                 .insns = {
 259                         BPF_MOV32_IMM(BPF_REG_0, 42),
 260                         BPF_MOV32_IMM(BPF_REG_1, 0),
 261                         BPF_MOV32_IMM(BPF_REG_2, 1),
 262                         BPF_ALU64_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 263                         BPF_EXIT_INSN(),
 264                 },
 265                 .result = ACCEPT,
 266                 .retval = 42,
 267         },
 268         {
 269                 "DIV32 by 0, zero check ok, cls",
 270                 .insns = {
 271                         BPF_MOV32_IMM(BPF_REG_0, 42),
 272                         BPF_MOV32_IMM(BPF_REG_1, 2),
 273                         BPF_MOV32_IMM(BPF_REG_2, 16),
 274                         BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
 275                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 276                         BPF_EXIT_INSN(),
 277                 },
 278                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 279                 .result = ACCEPT,
 280                 .retval = 8,
 281         },
 282         {
 283                 "DIV32 by 0, zero check 1, cls",
 284                 .insns = {
 285                         BPF_MOV32_IMM(BPF_REG_1, 0),
 286                         BPF_MOV32_IMM(BPF_REG_0, 1),
 287                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 288                         BPF_EXIT_INSN(),
 289                 },
 290                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 291                 .result = ACCEPT,
 292                 .retval = 0,
 293         },
 294         {
 295                 "DIV32 by 0, zero check 2, cls",
 296                 .insns = {
 297                         BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
 298                         BPF_MOV32_IMM(BPF_REG_0, 1),
 299                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 300                         BPF_EXIT_INSN(),
 301                 },
 302                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 303                 .result = ACCEPT,
 304                 .retval = 0,
 305         },
 306         {
 307                 "DIV64 by 0, zero check, cls",
 308                 .insns = {
 309                         BPF_MOV32_IMM(BPF_REG_1, 0),
 310                         BPF_MOV32_IMM(BPF_REG_0, 1),
 311                         BPF_ALU64_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 312                         BPF_EXIT_INSN(),
 313                 },
 314                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 315                 .result = ACCEPT,
 316                 .retval = 0,
 317         },
 318         {
 319                 "MOD32 by 0, zero check ok, cls",
 320                 .insns = {
 321                         BPF_MOV32_IMM(BPF_REG_0, 42),
 322                         BPF_MOV32_IMM(BPF_REG_1, 3),
 323                         BPF_MOV32_IMM(BPF_REG_2, 5),
 324                         BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 325                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 326                         BPF_EXIT_INSN(),
 327                 },
 328                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 329                 .result = ACCEPT,
 330                 .retval = 2,
 331         },
 332         {
 333                 "MOD32 by 0, zero check 1, cls",
 334                 .insns = {
 335                         BPF_MOV32_IMM(BPF_REG_1, 0),
 336                         BPF_MOV32_IMM(BPF_REG_0, 1),
 337                         BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 338                         BPF_EXIT_INSN(),
 339                 },
 340                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 341                 .result = ACCEPT,
 342                 .retval = 1,
 343         },
 344         {
 345                 "MOD32 by 0, zero check 2, cls",
 346                 .insns = {
 347                         BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
 348                         BPF_MOV32_IMM(BPF_REG_0, 1),
 349                         BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 350                         BPF_EXIT_INSN(),
 351                 },
 352                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 353                 .result = ACCEPT,
 354                 .retval = 1,
 355         },
 356         {
 357                 "MOD64 by 0, zero check 1, cls",
 358                 .insns = {
 359                         BPF_MOV32_IMM(BPF_REG_1, 0),
 360                         BPF_MOV32_IMM(BPF_REG_0, 2),
 361                         BPF_ALU64_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 362                         BPF_EXIT_INSN(),
 363                 },
 364                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 365                 .result = ACCEPT,
 366                 .retval = 2,
 367         },
 368         {
 369                 "MOD64 by 0, zero check 2, cls",
 370                 .insns = {
 371                         BPF_MOV32_IMM(BPF_REG_1, 0),
 372                         BPF_MOV32_IMM(BPF_REG_0, -1),
 373                         BPF_ALU64_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 374                         BPF_EXIT_INSN(),
 375                 },
 376                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 377                 .result = ACCEPT,
 378                 .retval = -1,
 379         },
 380         /* Just make sure that JITs used udiv/umod as otherwise we get
 381          * an exception from INT_MIN/-1 overflow similarly as with div
 382          * by zero.
 383          */
 384         {
 385                 "DIV32 overflow, check 1",
 386                 .insns = {
 387                         BPF_MOV32_IMM(BPF_REG_1, -1),
 388                         BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
 389                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 390                         BPF_EXIT_INSN(),
 391                 },
 392                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 393                 .result = ACCEPT,
 394                 .retval = 0,
 395         },
 396         {
 397                 "DIV32 overflow, check 2",
 398                 .insns = {
 399                         BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
 400                         BPF_ALU32_IMM(BPF_DIV, BPF_REG_0, -1),
 401                         BPF_EXIT_INSN(),
 402                 },
 403                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 404                 .result = ACCEPT,
 405                 .retval = 0,
 406         },
 407         {
 408                 "DIV64 overflow, check 1",
 409                 .insns = {
 410                         BPF_MOV64_IMM(BPF_REG_1, -1),
 411                         BPF_LD_IMM64(BPF_REG_0, LLONG_MIN),
 412                         BPF_ALU64_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
 413                         BPF_EXIT_INSN(),
 414                 },
 415                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 416                 .result = ACCEPT,
 417                 .retval = 0,
 418         },
 419         {
 420                 "DIV64 overflow, check 2",
 421                 .insns = {
 422                         BPF_LD_IMM64(BPF_REG_0, LLONG_MIN),
 423                         BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, -1),
 424                         BPF_EXIT_INSN(),
 425                 },
 426                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 427                 .result = ACCEPT,
 428                 .retval = 0,
 429         },
 430         {
 431                 "MOD32 overflow, check 1",
 432                 .insns = {
 433                         BPF_MOV32_IMM(BPF_REG_1, -1),
 434                         BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
 435                         BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
 436                         BPF_EXIT_INSN(),
 437                 },
 438                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 439                 .result = ACCEPT,
 440                 .retval = INT_MIN,
 441         },
 442         {
 443                 "MOD32 overflow, check 2",
 444                 .insns = {
 445                         BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
 446                         BPF_ALU32_IMM(BPF_MOD, BPF_REG_0, -1),
 447                         BPF_EXIT_INSN(),
 448                 },
 449                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 450                 .result = ACCEPT,
 451                 .retval = INT_MIN,
 452         },
 453         {
 454                 "MOD64 overflow, check 1",
 455                 .insns = {
 456                         BPF_MOV64_IMM(BPF_REG_1, -1),
 457                         BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
 458                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
 459                         BPF_ALU64_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
 460                         BPF_MOV32_IMM(BPF_REG_0, 0),
 461                         BPF_JMP_REG(BPF_JNE, BPF_REG_3, BPF_REG_2, 1),
 462                         BPF_MOV32_IMM(BPF_REG_0, 1),
 463                         BPF_EXIT_INSN(),
 464                 },
 465                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 466                 .result = ACCEPT,
 467                 .retval = 1,
 468         },
 469         {
 470                 "MOD64 overflow, check 2",
 471                 .insns = {
 472                         BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
 473                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
 474                         BPF_ALU64_IMM(BPF_MOD, BPF_REG_2, -1),
 475                         BPF_MOV32_IMM(BPF_REG_0, 0),
 476                         BPF_JMP_REG(BPF_JNE, BPF_REG_3, BPF_REG_2, 1),
 477                         BPF_MOV32_IMM(BPF_REG_0, 1),
 478                         BPF_EXIT_INSN(),
 479                 },
 480                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 481                 .result = ACCEPT,
 482                 .retval = 1,
 483         },
 484         {
 485                 "xor32 zero extend check",
 486                 .insns = {
 487                         BPF_MOV32_IMM(BPF_REG_2, -1),
 488                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 32),
 489                         BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 0xffff),
 490                         BPF_ALU32_REG(BPF_XOR, BPF_REG_2, BPF_REG_2),
 491                         BPF_MOV32_IMM(BPF_REG_0, 2),
 492                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 1),
 493                         BPF_MOV32_IMM(BPF_REG_0, 1),
 494                         BPF_EXIT_INSN(),
 495                 },
 496                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 497                 .result = ACCEPT,
 498                 .retval = 1,
 499         },
 500         {
 501                 "empty prog",
 502                 .insns = {
 503                 },
 504                 .errstr = "unknown opcode 00",
 505                 .result = REJECT,
 506         },
 507         {
 508                 "only exit insn",
 509                 .insns = {
 510                         BPF_EXIT_INSN(),
 511                 },
 512                 .errstr = "R0 !read_ok",
 513                 .result = REJECT,
 514         },
 515         {
 516                 "unreachable",
 517                 .insns = {
 518                         BPF_EXIT_INSN(),
 519                         BPF_EXIT_INSN(),
 520                 },
 521                 .errstr = "unreachable",
 522                 .result = REJECT,
 523         },
 524         {
 525                 "unreachable2",
 526                 .insns = {
 527                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
 528                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
 529                         BPF_EXIT_INSN(),
 530                 },
 531                 .errstr = "unreachable",
 532                 .result = REJECT,
 533         },
 534         {
 535                 "out of range jump",
 536                 .insns = {
 537                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
 538                         BPF_EXIT_INSN(),
 539                 },
 540                 .errstr = "jump out of range",
 541                 .result = REJECT,
 542         },
 543         {
 544                 "out of range jump2",
 545                 .insns = {
 546                         BPF_JMP_IMM(BPF_JA, 0, 0, -2),
 547                         BPF_EXIT_INSN(),
 548                 },
 549                 .errstr = "jump out of range",
 550                 .result = REJECT,
 551         },
 552         {
 553                 "test1 ld_imm64",
 554                 .insns = {
 555                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 556                         BPF_LD_IMM64(BPF_REG_0, 0),
 557                         BPF_LD_IMM64(BPF_REG_0, 0),
 558                         BPF_LD_IMM64(BPF_REG_0, 1),
 559                         BPF_LD_IMM64(BPF_REG_0, 1),
 560                         BPF_MOV64_IMM(BPF_REG_0, 2),
 561                         BPF_EXIT_INSN(),
 562                 },
 563                 .errstr = "invalid BPF_LD_IMM insn",
 564                 .errstr_unpriv = "R1 pointer comparison",
 565                 .result = REJECT,
 566         },
 567         {
 568                 "test2 ld_imm64",
 569                 .insns = {
 570                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 571                         BPF_LD_IMM64(BPF_REG_0, 0),
 572                         BPF_LD_IMM64(BPF_REG_0, 0),
 573                         BPF_LD_IMM64(BPF_REG_0, 1),
 574                         BPF_LD_IMM64(BPF_REG_0, 1),
 575                         BPF_EXIT_INSN(),
 576                 },
 577                 .errstr = "invalid BPF_LD_IMM insn",
 578                 .errstr_unpriv = "R1 pointer comparison",
 579                 .result = REJECT,
 580         },
 581         {
 582                 "test3 ld_imm64",
 583                 .insns = {
 584                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 585                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 586                         BPF_LD_IMM64(BPF_REG_0, 0),
 587                         BPF_LD_IMM64(BPF_REG_0, 0),
 588                         BPF_LD_IMM64(BPF_REG_0, 1),
 589                         BPF_LD_IMM64(BPF_REG_0, 1),
 590                         BPF_EXIT_INSN(),
 591                 },
 592                 .errstr = "invalid bpf_ld_imm64 insn",
 593                 .result = REJECT,
 594         },
 595         {
 596                 "test4 ld_imm64",
 597                 .insns = {
 598                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 599                         BPF_EXIT_INSN(),
 600                 },
 601                 .errstr = "invalid bpf_ld_imm64 insn",
 602                 .result = REJECT,
 603         },
 604         {
 605                 "test5 ld_imm64",
 606                 .insns = {
 607                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 608                 },
 609                 .errstr = "invalid bpf_ld_imm64 insn",
 610                 .result = REJECT,
 611         },
 612         {
 613                 "test6 ld_imm64",
 614                 .insns = {
 615                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
 616                         BPF_RAW_INSN(0, 0, 0, 0, 0),
 617                         BPF_EXIT_INSN(),
 618                 },
 619                 .result = ACCEPT,
 620         },
 621         {
 622                 "test7 ld_imm64",
 623                 .insns = {
 624                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 625                         BPF_RAW_INSN(0, 0, 0, 0, 1),
 626                         BPF_EXIT_INSN(),
 627                 },
 628                 .result = ACCEPT,
 629                 .retval = 1,
 630         },
 631         {
 632                 "test8 ld_imm64",
 633                 .insns = {
 634                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 1, 1),
 635                         BPF_RAW_INSN(0, 0, 0, 0, 1),
 636                         BPF_EXIT_INSN(),
 637                 },
 638                 .errstr = "uses reserved fields",
 639                 .result = REJECT,
 640         },
 641         {
 642                 "test9 ld_imm64",
 643                 .insns = {
 644                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 645                         BPF_RAW_INSN(0, 0, 0, 1, 1),
 646                         BPF_EXIT_INSN(),
 647                 },
 648                 .errstr = "invalid bpf_ld_imm64 insn",
 649                 .result = REJECT,
 650         },
 651         {
 652                 "test10 ld_imm64",
 653                 .insns = {
 654                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 655                         BPF_RAW_INSN(0, BPF_REG_1, 0, 0, 1),
 656                         BPF_EXIT_INSN(),
 657                 },
 658                 .errstr = "invalid bpf_ld_imm64 insn",
 659                 .result = REJECT,
 660         },
 661         {
 662                 "test11 ld_imm64",
 663                 .insns = {
 664                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
 665                         BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
 666                         BPF_EXIT_INSN(),
 667                 },
 668                 .errstr = "invalid bpf_ld_imm64 insn",
 669                 .result = REJECT,
 670         },
 671         {
 672                 "test12 ld_imm64",
 673                 .insns = {
 674                         BPF_MOV64_IMM(BPF_REG_1, 0),
 675                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
 676                         BPF_RAW_INSN(0, 0, 0, 0, 1),
 677                         BPF_EXIT_INSN(),
 678                 },
 679                 .errstr = "not pointing to valid bpf_map",
 680                 .result = REJECT,
 681         },
 682         {
 683                 "test13 ld_imm64",
 684                 .insns = {
 685                         BPF_MOV64_IMM(BPF_REG_1, 0),
 686                         BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
 687                         BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
 688                         BPF_EXIT_INSN(),
 689                 },
 690                 .errstr = "invalid bpf_ld_imm64 insn",
 691                 .result = REJECT,
 692         },
 693         {
 694                 "arsh32 on imm",
 695                 .insns = {
 696                         BPF_MOV64_IMM(BPF_REG_0, 1),
 697                         BPF_ALU32_IMM(BPF_ARSH, BPF_REG_0, 5),
 698                         BPF_EXIT_INSN(),
 699                 },
 700                 .result = REJECT,
 701                 .errstr = "unknown opcode c4",
 702         },
 703         {
 704                 "arsh32 on reg",
 705                 .insns = {
 706                         BPF_MOV64_IMM(BPF_REG_0, 1),
 707                         BPF_MOV64_IMM(BPF_REG_1, 5),
 708                         BPF_ALU32_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),
 709                         BPF_EXIT_INSN(),
 710                 },
 711                 .result = REJECT,
 712                 .errstr = "unknown opcode cc",
 713         },
 714         {
 715                 "arsh64 on imm",
 716                 .insns = {
 717                         BPF_MOV64_IMM(BPF_REG_0, 1),
 718                         BPF_ALU64_IMM(BPF_ARSH, BPF_REG_0, 5),
 719                         BPF_EXIT_INSN(),
 720                 },
 721                 .result = ACCEPT,
 722         },
 723         {
 724                 "arsh64 on reg",
 725                 .insns = {
 726                         BPF_MOV64_IMM(BPF_REG_0, 1),
 727                         BPF_MOV64_IMM(BPF_REG_1, 5),
 728                         BPF_ALU64_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),
 729                         BPF_EXIT_INSN(),
 730                 },
 731                 .result = ACCEPT,
 732         },
 733         {
 734                 "no bpf_exit",
 735                 .insns = {
 736                         BPF_ALU64_REG(BPF_MOV, BPF_REG_0, BPF_REG_2),
 737                 },
 738                 .errstr = "not an exit",
 739                 .result = REJECT,
 740         },
 741         {
 742                 "loop (back-edge)",
 743                 .insns = {
 744                         BPF_JMP_IMM(BPF_JA, 0, 0, -1),
 745                         BPF_EXIT_INSN(),
 746                 },
 747                 .errstr = "back-edge",
 748                 .result = REJECT,
 749         },
 750         {
 751                 "loop2 (back-edge)",
 752                 .insns = {
 753                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
 754                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
 755                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
 756                         BPF_JMP_IMM(BPF_JA, 0, 0, -4),
 757                         BPF_EXIT_INSN(),
 758                 },
 759                 .errstr = "back-edge",
 760                 .result = REJECT,
 761         },
 762         {
 763                 "conditional loop",
 764                 .insns = {
 765                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
 766                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
 767                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
 768                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -3),
 769                         BPF_EXIT_INSN(),
 770                 },
 771                 .errstr = "back-edge",
 772                 .result = REJECT,
 773         },
 774         {
 775                 "read uninitialized register",
 776                 .insns = {
 777                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 778                         BPF_EXIT_INSN(),
 779                 },
 780                 .errstr = "R2 !read_ok",
 781                 .result = REJECT,
 782         },
 783         {
 784                 "read invalid register",
 785                 .insns = {
 786                         BPF_MOV64_REG(BPF_REG_0, -1),
 787                         BPF_EXIT_INSN(),
 788                 },
 789                 .errstr = "R15 is invalid",
 790                 .result = REJECT,
 791         },
 792         {
 793                 "program doesn't init R0 before exit",
 794                 .insns = {
 795                         BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_1),
 796                         BPF_EXIT_INSN(),
 797                 },
 798                 .errstr = "R0 !read_ok",
 799                 .result = REJECT,
 800         },
 801         {
 802                 "program doesn't init R0 before exit in all branches",
 803                 .insns = {
 804                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
 805                         BPF_MOV64_IMM(BPF_REG_0, 1),
 806                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
 807                         BPF_EXIT_INSN(),
 808                 },
 809                 .errstr = "R0 !read_ok",
 810                 .errstr_unpriv = "R1 pointer comparison",
 811                 .result = REJECT,
 812         },
 813         {
 814                 "stack out of bounds",
 815                 .insns = {
 816                         BPF_ST_MEM(BPF_DW, BPF_REG_10, 8, 0),
 817                         BPF_EXIT_INSN(),
 818                 },
 819                 .errstr = "invalid stack",
 820                 .result = REJECT,
 821         },
 822         {
 823                 "invalid call insn1",
 824                 .insns = {
 825                         BPF_RAW_INSN(BPF_JMP | BPF_CALL | BPF_X, 0, 0, 0, 0),
 826                         BPF_EXIT_INSN(),
 827                 },
 828                 .errstr = "unknown opcode 8d",
 829                 .result = REJECT,
 830         },
 831         {
 832                 "invalid call insn2",
 833                 .insns = {
 834                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 1, 0),
 835                         BPF_EXIT_INSN(),
 836                 },
 837                 .errstr = "BPF_CALL uses reserved",
 838                 .result = REJECT,
 839         },
 840         {
 841                 "invalid function call",
 842                 .insns = {
 843                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, 1234567),
 844                         BPF_EXIT_INSN(),
 845                 },
 846                 .errstr = "invalid func unknown#1234567",
 847                 .result = REJECT,
 848         },
 849         {
 850                 "uninitialized stack1",
 851                 .insns = {
 852                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 853                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 854                         BPF_LD_MAP_FD(BPF_REG_1, 0),
 855                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 856                                      BPF_FUNC_map_lookup_elem),
 857                         BPF_EXIT_INSN(),
 858                 },
 859                 .fixup_map1 = { 2 },
 860                 .errstr = "invalid indirect read from stack",
 861                 .result = REJECT,
 862         },
 863         {
 864                 "uninitialized stack2",
 865                 .insns = {
 866                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 867                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -8),
 868                         BPF_EXIT_INSN(),
 869                 },
 870                 .errstr = "invalid read from stack",
 871                 .result = REJECT,
 872         },
 873         {
 874                 "invalid fp arithmetic",
 875                 /* If this gets ever changed, make sure JITs can deal with it. */
 876                 .insns = {
 877                         BPF_MOV64_IMM(BPF_REG_0, 0),
 878                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
 879                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 8),
 880                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
 881                         BPF_EXIT_INSN(),
 882                 },
 883                 .errstr = "R1 subtraction from stack pointer",
 884                 .result = REJECT,
 885         },
 886         {
 887                 "non-invalid fp arithmetic",
 888                 .insns = {
 889                         BPF_MOV64_IMM(BPF_REG_0, 0),
 890                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
 891                         BPF_EXIT_INSN(),
 892                 },
 893                 .result = ACCEPT,
 894         },
 895         {
 896                 "invalid argument register",
 897                 .insns = {
 898                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 899                                      BPF_FUNC_get_cgroup_classid),
 900                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 901                                      BPF_FUNC_get_cgroup_classid),
 902                         BPF_EXIT_INSN(),
 903                 },
 904                 .errstr = "R1 !read_ok",
 905                 .result = REJECT,
 906                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 907         },
 908         {
 909                 "non-invalid argument register",
 910                 .insns = {
 911                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
 912                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 913                                      BPF_FUNC_get_cgroup_classid),
 914                         BPF_ALU64_REG(BPF_MOV, BPF_REG_1, BPF_REG_6),
 915                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
 916                                      BPF_FUNC_get_cgroup_classid),
 917                         BPF_EXIT_INSN(),
 918                 },
 919                 .result = ACCEPT,
 920                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 921         },
 922         {
 923                 "check valid spill/fill",
 924                 .insns = {
 925                         /* spill R1(ctx) into stack */
 926                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
 927                         /* fill it back into R2 */
 928                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
 929                         /* should be able to access R0 = *(R2 + 8) */
 930                         /* BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 8), */
 931                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 932                         BPF_EXIT_INSN(),
 933                 },
 934                 .errstr_unpriv = "R0 leaks addr",
 935                 .result = ACCEPT,
 936                 .result_unpriv = REJECT,
 937                 .retval = POINTER_VALUE,
 938         },
 939         {
 940                 "check valid spill/fill, skb mark",
 941                 .insns = {
 942                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
 943                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
 944                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
 945                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
 946                                     offsetof(struct __sk_buff, mark)),
 947                         BPF_EXIT_INSN(),
 948                 },
 949                 .result = ACCEPT,
 950                 .result_unpriv = ACCEPT,
 951         },
 952         {
 953                 "check corrupted spill/fill",
 954                 .insns = {
 955                         /* spill R1(ctx) into stack */
 956                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
 957                         /* mess up with R1 pointer on stack */
 958                         BPF_ST_MEM(BPF_B, BPF_REG_10, -7, 0x23),
 959                         /* fill back into R0 should fail */
 960                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
 961                         BPF_EXIT_INSN(),
 962                 },
 963                 .errstr_unpriv = "attempt to corrupt spilled",
 964                 .errstr = "corrupted spill",
 965                 .result = REJECT,
 966         },
 967         {
 968                 "invalid src register in STX",
 969                 .insns = {
 970                         BPF_STX_MEM(BPF_B, BPF_REG_10, -1, -1),
 971                         BPF_EXIT_INSN(),
 972                 },
 973                 .errstr = "R15 is invalid",
 974                 .result = REJECT,
 975         },
 976         {
 977                 "invalid dst register in STX",
 978                 .insns = {
 979                         BPF_STX_MEM(BPF_B, 14, BPF_REG_10, -1),
 980                         BPF_EXIT_INSN(),
 981                 },
 982                 .errstr = "R14 is invalid",
 983                 .result = REJECT,
 984         },
 985         {
 986                 "invalid dst register in ST",
 987                 .insns = {
 988                         BPF_ST_MEM(BPF_B, 14, -1, -1),
 989                         BPF_EXIT_INSN(),
 990                 },
 991                 .errstr = "R14 is invalid",
 992                 .result = REJECT,
 993         },
 994         {
 995                 "invalid src register in LDX",
 996                 .insns = {
 997                         BPF_LDX_MEM(BPF_B, BPF_REG_0, 12, 0),
 998                         BPF_EXIT_INSN(),
 999                 },
1000                 .errstr = "R12 is invalid",
1001                 .result = REJECT,
1002         },
1003         {
1004                 "invalid dst register in LDX",
1005                 .insns = {
1006                         BPF_LDX_MEM(BPF_B, 11, BPF_REG_1, 0),
1007                         BPF_EXIT_INSN(),
1008                 },
1009                 .errstr = "R11 is invalid",
1010                 .result = REJECT,
1011         },
1012         {
1013                 "junk insn",
1014                 .insns = {
1015                         BPF_RAW_INSN(0, 0, 0, 0, 0),
1016                         BPF_EXIT_INSN(),
1017                 },
1018                 .errstr = "unknown opcode 00",
1019                 .result = REJECT,
1020         },
1021         {
1022                 "junk insn2",
1023                 .insns = {
1024                         BPF_RAW_INSN(1, 0, 0, 0, 0),
1025                         BPF_EXIT_INSN(),
1026                 },
1027                 .errstr = "BPF_LDX uses reserved fields",
1028                 .result = REJECT,
1029         },
1030         {
1031                 "junk insn3",
1032                 .insns = {
1033                         BPF_RAW_INSN(-1, 0, 0, 0, 0),
1034                         BPF_EXIT_INSN(),
1035                 },
1036                 .errstr = "unknown opcode ff",
1037                 .result = REJECT,
1038         },
1039         {
1040                 "junk insn4",
1041                 .insns = {
1042                         BPF_RAW_INSN(-1, -1, -1, -1, -1),
1043                         BPF_EXIT_INSN(),
1044                 },
1045                 .errstr = "unknown opcode ff",
1046                 .result = REJECT,
1047         },
1048         {
1049                 "junk insn5",
1050                 .insns = {
1051                         BPF_RAW_INSN(0x7f, -1, -1, -1, -1),
1052                         BPF_EXIT_INSN(),
1053                 },
1054                 .errstr = "BPF_ALU uses reserved fields",
1055                 .result = REJECT,
1056         },
1057         {
1058                 "misaligned read from stack",
1059                 .insns = {
1060                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1061                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -4),
1062                         BPF_EXIT_INSN(),
1063                 },
1064                 .errstr = "misaligned stack access",
1065                 .result = REJECT,
1066         },
1067         {
1068                 "invalid map_fd for function call",
1069                 .insns = {
1070                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1071                         BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_10),
1072                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1073                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1074                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1075                                      BPF_FUNC_map_delete_elem),
1076                         BPF_EXIT_INSN(),
1077                 },
1078                 .errstr = "fd 0 is not pointing to valid bpf_map",
1079                 .result = REJECT,
1080         },
1081         {
1082                 "don't check return value before access",
1083                 .insns = {
1084                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1085                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1086                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1087                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1088                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1089                                      BPF_FUNC_map_lookup_elem),
1090                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1091                         BPF_EXIT_INSN(),
1092                 },
1093                 .fixup_map1 = { 3 },
1094                 .errstr = "R0 invalid mem access 'map_value_or_null'",
1095                 .result = REJECT,
1096         },
1097         {
1098                 "access memory with incorrect alignment",
1099                 .insns = {
1100                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1101                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1102                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1103                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1104                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1105                                      BPF_FUNC_map_lookup_elem),
1106                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
1107                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 4, 0),
1108                         BPF_EXIT_INSN(),
1109                 },
1110                 .fixup_map1 = { 3 },
1111                 .errstr = "misaligned value access",
1112                 .result = REJECT,
1113                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1114         },
1115         {
1116                 "sometimes access memory with incorrect alignment",
1117                 .insns = {
1118                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1119                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1120                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1121                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1122                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1123                                      BPF_FUNC_map_lookup_elem),
1124                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
1125                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1126                         BPF_EXIT_INSN(),
1127                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 1),
1128                         BPF_EXIT_INSN(),
1129                 },
1130                 .fixup_map1 = { 3 },
1131                 .errstr = "R0 invalid mem access",
1132                 .errstr_unpriv = "R0 leaks addr",
1133                 .result = REJECT,
1134                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
1135         },
1136         {
1137                 "jump test 1",
1138                 .insns = {
1139                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1140                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -8),
1141                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
1142                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
1143                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 1),
1144                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 1),
1145                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 1),
1146                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 2),
1147                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 1),
1148                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 3),
1149                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 1),
1150                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 4),
1151                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
1152                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 5),
1153                         BPF_MOV64_IMM(BPF_REG_0, 0),
1154                         BPF_EXIT_INSN(),
1155                 },
1156                 .errstr_unpriv = "R1 pointer comparison",
1157                 .result_unpriv = REJECT,
1158                 .result = ACCEPT,
1159         },
1160         {
1161                 "jump test 2",
1162                 .insns = {
1163                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1164                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
1165                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
1166                         BPF_JMP_IMM(BPF_JA, 0, 0, 14),
1167                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 2),
1168                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
1169                         BPF_JMP_IMM(BPF_JA, 0, 0, 11),
1170                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 2),
1171                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
1172                         BPF_JMP_IMM(BPF_JA, 0, 0, 8),
1173                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 2),
1174                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
1175                         BPF_JMP_IMM(BPF_JA, 0, 0, 5),
1176                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 2),
1177                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
1178                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1179                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
1180                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
1181                         BPF_MOV64_IMM(BPF_REG_0, 0),
1182                         BPF_EXIT_INSN(),
1183                 },
1184                 .errstr_unpriv = "R1 pointer comparison",
1185                 .result_unpriv = REJECT,
1186                 .result = ACCEPT,
1187         },
1188         {
1189                 "jump test 3",
1190                 .insns = {
1191                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1192                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
1193                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
1194                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1195                         BPF_JMP_IMM(BPF_JA, 0, 0, 19),
1196                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 3),
1197                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
1198                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1199                         BPF_JMP_IMM(BPF_JA, 0, 0, 15),
1200                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 3),
1201                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
1202                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -32),
1203                         BPF_JMP_IMM(BPF_JA, 0, 0, 11),
1204                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 3),
1205                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
1206                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -40),
1207                         BPF_JMP_IMM(BPF_JA, 0, 0, 7),
1208                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 3),
1209                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
1210                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -48),
1211                         BPF_JMP_IMM(BPF_JA, 0, 0, 3),
1212                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 0),
1213                         BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
1214                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -56),
1215                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1216                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1217                                      BPF_FUNC_map_delete_elem),
1218                         BPF_EXIT_INSN(),
1219                 },
1220                 .fixup_map1 = { 24 },
1221                 .errstr_unpriv = "R1 pointer comparison",
1222                 .result_unpriv = REJECT,
1223                 .result = ACCEPT,
1224                 .retval = -ENOENT,
1225         },
1226         {
1227                 "jump test 4",
1228                 .insns = {
1229                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1230                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1231                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1232                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1233                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1234                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1235                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1236                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1237                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1238                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1239                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1240                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1241                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1242                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1243                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1244                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1245                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1246                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1247                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1248                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1249                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1250                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1251                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1252                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1253                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1254                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1255                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1256                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1257                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1258                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1259                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1260                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1261                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
1262                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
1263                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
1264                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
1265                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1266                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1267                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1268                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
1269                         BPF_MOV64_IMM(BPF_REG_0, 0),
1270                         BPF_EXIT_INSN(),
1271                 },
1272                 .errstr_unpriv = "R1 pointer comparison",
1273                 .result_unpriv = REJECT,
1274                 .result = ACCEPT,
1275         },
1276         {
1277                 "jump test 5",
1278                 .insns = {
1279                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1280                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
1281                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1282                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1283                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1284                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1285                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1286                         BPF_MOV64_IMM(BPF_REG_0, 0),
1287                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1288                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1289                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1290                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1291                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1292                         BPF_MOV64_IMM(BPF_REG_0, 0),
1293                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1294                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1295                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1296                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1297                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1298                         BPF_MOV64_IMM(BPF_REG_0, 0),
1299                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1300                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1301                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1302                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1303                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1304                         BPF_MOV64_IMM(BPF_REG_0, 0),
1305                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1306                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
1307                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1308                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
1309                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1310                         BPF_MOV64_IMM(BPF_REG_0, 0),
1311                         BPF_EXIT_INSN(),
1312                 },
1313                 .errstr_unpriv = "R1 pointer comparison",
1314                 .result_unpriv = REJECT,
1315                 .result = ACCEPT,
1316         },
1317         {
1318                 "access skb fields ok",
1319                 .insns = {
1320                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1321                                     offsetof(struct __sk_buff, len)),
1322                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1323                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1324                                     offsetof(struct __sk_buff, mark)),
1325                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1326                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1327                                     offsetof(struct __sk_buff, pkt_type)),
1328                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
1329                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1330                                     offsetof(struct __sk_buff, queue_mapping)),
1331                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1332                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1333                                     offsetof(struct __sk_buff, protocol)),
1334                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1335                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1336                                     offsetof(struct __sk_buff, vlan_present)),
1337                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1338                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1339                                     offsetof(struct __sk_buff, vlan_tci)),
1340                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1341                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1342                                     offsetof(struct __sk_buff, napi_id)),
1343                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
1344                         BPF_EXIT_INSN(),
1345                 },
1346                 .result = ACCEPT,
1347         },
1348         {
1349                 "access skb fields bad1",
1350                 .insns = {
1351                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -4),
1352                         BPF_EXIT_INSN(),
1353                 },
1354                 .errstr = "invalid bpf_context access",
1355                 .result = REJECT,
1356         },
1357         {
1358                 "access skb fields bad2",
1359                 .insns = {
1360                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 9),
1361                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1362                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1363                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1364                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1365                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1366                                      BPF_FUNC_map_lookup_elem),
1367                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
1368                         BPF_EXIT_INSN(),
1369                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
1370                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1371                                     offsetof(struct __sk_buff, pkt_type)),
1372                         BPF_EXIT_INSN(),
1373                 },
1374                 .fixup_map1 = { 4 },
1375                 .errstr = "different pointers",
1376                 .errstr_unpriv = "R1 pointer comparison",
1377                 .result = REJECT,
1378         },
1379         {
1380                 "access skb fields bad3",
1381                 .insns = {
1382                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
1383                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1384                                     offsetof(struct __sk_buff, pkt_type)),
1385                         BPF_EXIT_INSN(),
1386                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1387                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1388                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1389                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1390                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1391                                      BPF_FUNC_map_lookup_elem),
1392                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
1393                         BPF_EXIT_INSN(),
1394                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
1395                         BPF_JMP_IMM(BPF_JA, 0, 0, -12),
1396                 },
1397                 .fixup_map1 = { 6 },
1398                 .errstr = "different pointers",
1399                 .errstr_unpriv = "R1 pointer comparison",
1400                 .result = REJECT,
1401         },
1402         {
1403                 "access skb fields bad4",
1404                 .insns = {
1405                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 3),
1406                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1407                                     offsetof(struct __sk_buff, len)),
1408                         BPF_MOV64_IMM(BPF_REG_0, 0),
1409                         BPF_EXIT_INSN(),
1410                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1411                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1412                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1413                         BPF_LD_MAP_FD(BPF_REG_1, 0),
1414                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
1415                                      BPF_FUNC_map_lookup_elem),
1416                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
1417                         BPF_EXIT_INSN(),
1418                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
1419                         BPF_JMP_IMM(BPF_JA, 0, 0, -13),
1420                 },
1421                 .fixup_map1 = { 7 },
1422                 .errstr = "different pointers",
1423                 .errstr_unpriv = "R1 pointer comparison",
1424                 .result = REJECT,
1425         },
1426         {
1427                 "invalid access __sk_buff family",
1428                 .insns = {
1429                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1430                                     offsetof(struct __sk_buff, family)),
1431                         BPF_EXIT_INSN(),
1432                 },
1433                 .errstr = "invalid bpf_context access",
1434                 .result = REJECT,
1435         },
1436         {
1437                 "invalid access __sk_buff remote_ip4",
1438                 .insns = {
1439                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1440                                     offsetof(struct __sk_buff, remote_ip4)),
1441                         BPF_EXIT_INSN(),
1442                 },
1443                 .errstr = "invalid bpf_context access",
1444                 .result = REJECT,
1445         },
1446         {
1447                 "invalid access __sk_buff local_ip4",
1448                 .insns = {
1449                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1450                                     offsetof(struct __sk_buff, local_ip4)),
1451                         BPF_EXIT_INSN(),
1452                 },
1453                 .errstr = "invalid bpf_context access",
1454                 .result = REJECT,
1455         },
1456         {
1457                 "invalid access __sk_buff remote_ip6",
1458                 .insns = {
1459                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1460                                     offsetof(struct __sk_buff, remote_ip6)),
1461                         BPF_EXIT_INSN(),
1462                 },
1463                 .errstr = "invalid bpf_context access",
1464                 .result = REJECT,
1465         },
1466         {
1467                 "invalid access __sk_buff local_ip6",
1468                 .insns = {
1469                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1470                                     offsetof(struct __sk_buff, local_ip6)),
1471                         BPF_EXIT_INSN(),
1472                 },
1473                 .errstr = "invalid bpf_context access",
1474                 .result = REJECT,
1475         },
1476         {
1477                 "invalid access __sk_buff remote_port",
1478                 .insns = {
1479                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1480                                     offsetof(struct __sk_buff, remote_port)),
1481                         BPF_EXIT_INSN(),
1482                 },
1483                 .errstr = "invalid bpf_context access",
1484                 .result = REJECT,
1485         },
1486         {
1487                 "invalid access __sk_buff remote_port",
1488                 .insns = {
1489                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1490                                     offsetof(struct __sk_buff, local_port)),
1491                         BPF_EXIT_INSN(),
1492                 },
1493                 .errstr = "invalid bpf_context access",
1494                 .result = REJECT,
1495         },
1496         {
1497                 "valid access __sk_buff family",
1498                 .insns = {
1499                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1500                                     offsetof(struct __sk_buff, family)),
1501                         BPF_EXIT_INSN(),
1502                 },
1503                 .result = ACCEPT,
1504                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1505         },
1506         {
1507                 "valid access __sk_buff remote_ip4",
1508                 .insns = {
1509                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1510                                     offsetof(struct __sk_buff, remote_ip4)),
1511                         BPF_EXIT_INSN(),
1512                 },
1513                 .result = ACCEPT,
1514                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1515         },
1516         {
1517                 "valid access __sk_buff local_ip4",
1518                 .insns = {
1519                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1520                                     offsetof(struct __sk_buff, local_ip4)),
1521                         BPF_EXIT_INSN(),
1522                 },
1523                 .result = ACCEPT,
1524                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1525         },
1526         {
1527                 "valid access __sk_buff remote_ip6",
1528                 .insns = {
1529                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1530                                     offsetof(struct __sk_buff, remote_ip6[0])),
1531                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1532                                     offsetof(struct __sk_buff, remote_ip6[1])),
1533                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1534                                     offsetof(struct __sk_buff, remote_ip6[2])),
1535                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1536                                     offsetof(struct __sk_buff, remote_ip6[3])),
1537                         BPF_EXIT_INSN(),
1538                 },
1539                 .result = ACCEPT,
1540                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1541         },
1542         {
1543                 "valid access __sk_buff local_ip6",
1544                 .insns = {
1545                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1546                                     offsetof(struct __sk_buff, local_ip6[0])),
1547                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1548                                     offsetof(struct __sk_buff, local_ip6[1])),
1549                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1550                                     offsetof(struct __sk_buff, local_ip6[2])),
1551                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1552                                     offsetof(struct __sk_buff, local_ip6[3])),
1553                         BPF_EXIT_INSN(),
1554                 },
1555                 .result = ACCEPT,
1556                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1557         },
1558         {
1559                 "valid access __sk_buff remote_port",
1560                 .insns = {
1561                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1562                                     offsetof(struct __sk_buff, remote_port)),
1563                         BPF_EXIT_INSN(),
1564                 },
1565                 .result = ACCEPT,
1566                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1567         },
1568         {
1569                 "valid access __sk_buff remote_port",
1570                 .insns = {
1571                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1572                                     offsetof(struct __sk_buff, local_port)),
1573                         BPF_EXIT_INSN(),
1574                 },
1575                 .result = ACCEPT,
1576                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1577         },
1578         {
1579                 "invalid access of tc_classid for SK_SKB",
1580                 .insns = {
1581                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1582                                     offsetof(struct __sk_buff, tc_classid)),
1583                         BPF_EXIT_INSN(),
1584                 },
1585                 .result = REJECT,
1586                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1587                 .errstr = "invalid bpf_context access",
1588         },
1589         {
1590                 "invalid access of skb->mark for SK_SKB",
1591                 .insns = {
1592                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1593                                     offsetof(struct __sk_buff, mark)),
1594                         BPF_EXIT_INSN(),
1595                 },
1596                 .result =  REJECT,
1597                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1598                 .errstr = "invalid bpf_context access",
1599         },
1600         {
1601                 "check skb->mark is not writeable by SK_SKB",
1602                 .insns = {
1603                         BPF_MOV64_IMM(BPF_REG_0, 0),
1604                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1605                                     offsetof(struct __sk_buff, mark)),
1606                         BPF_EXIT_INSN(),
1607                 },
1608                 .result =  REJECT,
1609                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1610                 .errstr = "invalid bpf_context access",
1611         },
1612         {
1613                 "check skb->tc_index is writeable by SK_SKB",
1614                 .insns = {
1615                         BPF_MOV64_IMM(BPF_REG_0, 0),
1616                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1617                                     offsetof(struct __sk_buff, tc_index)),
1618                         BPF_EXIT_INSN(),
1619                 },
1620                 .result = ACCEPT,
1621                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1622         },
1623         {
1624                 "check skb->priority is writeable by SK_SKB",
1625                 .insns = {
1626                         BPF_MOV64_IMM(BPF_REG_0, 0),
1627                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
1628                                     offsetof(struct __sk_buff, priority)),
1629                         BPF_EXIT_INSN(),
1630                 },
1631                 .result = ACCEPT,
1632                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1633         },
1634         {
1635                 "direct packet read for SK_SKB",
1636                 .insns = {
1637                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1638                                     offsetof(struct __sk_buff, data)),
1639                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1640                                     offsetof(struct __sk_buff, data_end)),
1641                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1642                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1643                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1644                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
1645                         BPF_MOV64_IMM(BPF_REG_0, 0),
1646                         BPF_EXIT_INSN(),
1647                 },
1648                 .result = ACCEPT,
1649                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1650         },
1651         {
1652                 "direct packet write for SK_SKB",
1653                 .insns = {
1654                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1655                                     offsetof(struct __sk_buff, data)),
1656                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1657                                     offsetof(struct __sk_buff, data_end)),
1658                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1659                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1660                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1661                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
1662                         BPF_MOV64_IMM(BPF_REG_0, 0),
1663                         BPF_EXIT_INSN(),
1664                 },
1665                 .result = ACCEPT,
1666                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1667         },
1668         {
1669                 "overlapping checks for direct packet access SK_SKB",
1670                 .insns = {
1671                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1672                                     offsetof(struct __sk_buff, data)),
1673                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1674                                     offsetof(struct __sk_buff, data_end)),
1675                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1676                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1677                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
1678                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
1679                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
1680                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
1681                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
1682                         BPF_MOV64_IMM(BPF_REG_0, 0),
1683                         BPF_EXIT_INSN(),
1684                 },
1685                 .result = ACCEPT,
1686                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1687         },
1688         {
1689                 "valid access family in SK_MSG",
1690                 .insns = {
1691                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1692                                     offsetof(struct sk_msg_md, family)),
1693                         BPF_EXIT_INSN(),
1694                 },
1695                 .result = ACCEPT,
1696                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1697         },
1698         {
1699                 "valid access remote_ip4 in SK_MSG",
1700                 .insns = {
1701                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1702                                     offsetof(struct sk_msg_md, remote_ip4)),
1703                         BPF_EXIT_INSN(),
1704                 },
1705                 .result = ACCEPT,
1706                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1707         },
1708         {
1709                 "valid access local_ip4 in SK_MSG",
1710                 .insns = {
1711                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1712                                     offsetof(struct sk_msg_md, local_ip4)),
1713                         BPF_EXIT_INSN(),
1714                 },
1715                 .result = ACCEPT,
1716                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1717         },
1718         {
1719                 "valid access remote_port in SK_MSG",
1720                 .insns = {
1721                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1722                                     offsetof(struct sk_msg_md, remote_port)),
1723                         BPF_EXIT_INSN(),
1724                 },
1725                 .result = ACCEPT,
1726                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1727         },
1728         {
1729                 "valid access local_port in SK_MSG",
1730                 .insns = {
1731                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1732                                     offsetof(struct sk_msg_md, local_port)),
1733                         BPF_EXIT_INSN(),
1734                 },
1735                 .result = ACCEPT,
1736                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1737         },
1738         {
1739                 "valid access remote_ip6 in SK_MSG",
1740                 .insns = {
1741                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1742                                     offsetof(struct sk_msg_md, remote_ip6[0])),
1743                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1744                                     offsetof(struct sk_msg_md, remote_ip6[1])),
1745                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1746                                     offsetof(struct sk_msg_md, remote_ip6[2])),
1747                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1748                                     offsetof(struct sk_msg_md, remote_ip6[3])),
1749                         BPF_EXIT_INSN(),
1750                 },
1751                 .result = ACCEPT,
1752                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1753         },
1754         {
1755                 "valid access local_ip6 in SK_MSG",
1756                 .insns = {
1757                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1758                                     offsetof(struct sk_msg_md, local_ip6[0])),
1759                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1760                                     offsetof(struct sk_msg_md, local_ip6[1])),
1761                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1762                                     offsetof(struct sk_msg_md, local_ip6[2])),
1763                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
1764                                     offsetof(struct sk_msg_md, local_ip6[3])),
1765                         BPF_EXIT_INSN(),
1766                 },
1767                 .result = ACCEPT,
1768                 .prog_type = BPF_PROG_TYPE_SK_SKB,
1769         },
1770         {
1771                 "invalid 64B read of family in SK_MSG",
1772                 .insns = {
1773                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
1774                                     offsetof(struct sk_msg_md, family)),
1775                         BPF_EXIT_INSN(),
1776                 },
1777                 .errstr = "invalid bpf_context access",
1778                 .result = REJECT,
1779                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1780         },
1781         {
1782                 "invalid read past end of SK_MSG",
1783                 .insns = {
1784                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1785                                     offsetof(struct sk_msg_md, local_port) + 4),
1786                         BPF_EXIT_INSN(),
1787                 },
1788                 .errstr = "R0 !read_ok",
1789                 .result = REJECT,
1790                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1791         },
1792         {
1793                 "invalid read offset in SK_MSG",
1794                 .insns = {
1795                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1796                                     offsetof(struct sk_msg_md, family) + 1),
1797                         BPF_EXIT_INSN(),
1798                 },
1799                 .errstr = "invalid bpf_context access",
1800                 .result = REJECT,
1801                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1802         },
1803         {
1804                 "direct packet read for SK_MSG",
1805                 .insns = {
1806                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
1807                                     offsetof(struct sk_msg_md, data)),
1808                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
1809                                     offsetof(struct sk_msg_md, data_end)),
1810                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1811                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1812                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1813                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
1814                         BPF_MOV64_IMM(BPF_REG_0, 0),
1815                         BPF_EXIT_INSN(),
1816                 },
1817                 .result = ACCEPT,
1818                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1819         },
1820         {
1821                 "direct packet write for SK_MSG",
1822                 .insns = {
1823                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
1824                                     offsetof(struct sk_msg_md, data)),
1825                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
1826                                     offsetof(struct sk_msg_md, data_end)),
1827                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1828                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1829                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
1830                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
1831                         BPF_MOV64_IMM(BPF_REG_0, 0),
1832                         BPF_EXIT_INSN(),
1833                 },
1834                 .result = ACCEPT,
1835                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1836         },
1837         {
1838                 "overlapping checks for direct packet access SK_MSG",
1839                 .insns = {
1840                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
1841                                     offsetof(struct sk_msg_md, data)),
1842                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
1843                                     offsetof(struct sk_msg_md, data_end)),
1844                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1845                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1846                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
1847                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
1848                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
1849                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
1850                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
1851                         BPF_MOV64_IMM(BPF_REG_0, 0),
1852                         BPF_EXIT_INSN(),
1853                 },
1854                 .result = ACCEPT,
1855                 .prog_type = BPF_PROG_TYPE_SK_MSG,
1856         },
1857         {
1858                 "check skb->mark is not writeable by sockets",
1859                 .insns = {
1860                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1861                                     offsetof(struct __sk_buff, mark)),
1862                         BPF_EXIT_INSN(),
1863                 },
1864                 .errstr = "invalid bpf_context access",
1865                 .errstr_unpriv = "R1 leaks addr",
1866                 .result = REJECT,
1867         },
1868         {
1869                 "check skb->tc_index is not writeable by sockets",
1870                 .insns = {
1871                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
1872                                     offsetof(struct __sk_buff, tc_index)),
1873                         BPF_EXIT_INSN(),
1874                 },
1875                 .errstr = "invalid bpf_context access",
1876                 .errstr_unpriv = "R1 leaks addr",
1877                 .result = REJECT,
1878         },
1879         {
1880                 "check cb access: byte",
1881                 .insns = {
1882                         BPF_MOV64_IMM(BPF_REG_0, 0),
1883                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1884                                     offsetof(struct __sk_buff, cb[0])),
1885                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1886                                     offsetof(struct __sk_buff, cb[0]) + 1),
1887                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1888                                     offsetof(struct __sk_buff, cb[0]) + 2),
1889                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1890                                     offsetof(struct __sk_buff, cb[0]) + 3),
1891                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1892                                     offsetof(struct __sk_buff, cb[1])),
1893                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1894                                     offsetof(struct __sk_buff, cb[1]) + 1),
1895                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1896                                     offsetof(struct __sk_buff, cb[1]) + 2),
1897                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1898                                     offsetof(struct __sk_buff, cb[1]) + 3),
1899                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1900                                     offsetof(struct __sk_buff, cb[2])),
1901                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1902                                     offsetof(struct __sk_buff, cb[2]) + 1),
1903                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1904                                     offsetof(struct __sk_buff, cb[2]) + 2),
1905                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1906                                     offsetof(struct __sk_buff, cb[2]) + 3),
1907                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1908                                     offsetof(struct __sk_buff, cb[3])),
1909                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1910                                     offsetof(struct __sk_buff, cb[3]) + 1),
1911                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1912                                     offsetof(struct __sk_buff, cb[3]) + 2),
1913                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1914                                     offsetof(struct __sk_buff, cb[3]) + 3),
1915                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1916                                     offsetof(struct __sk_buff, cb[4])),
1917                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1918                                     offsetof(struct __sk_buff, cb[4]) + 1),
1919                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1920                                     offsetof(struct __sk_buff, cb[4]) + 2),
1921                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1922                                     offsetof(struct __sk_buff, cb[4]) + 3),
1923                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1924                                     offsetof(struct __sk_buff, cb[0])),
1925                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1926                                     offsetof(struct __sk_buff, cb[0]) + 1),
1927                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1928                                     offsetof(struct __sk_buff, cb[0]) + 2),
1929                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1930                                     offsetof(struct __sk_buff, cb[0]) + 3),
1931                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1932                                     offsetof(struct __sk_buff, cb[1])),
1933                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1934                                     offsetof(struct __sk_buff, cb[1]) + 1),
1935                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1936                                     offsetof(struct __sk_buff, cb[1]) + 2),
1937                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1938                                     offsetof(struct __sk_buff, cb[1]) + 3),
1939                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1940                                     offsetof(struct __sk_buff, cb[2])),
1941                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1942                                     offsetof(struct __sk_buff, cb[2]) + 1),
1943                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1944                                     offsetof(struct __sk_buff, cb[2]) + 2),
1945                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1946                                     offsetof(struct __sk_buff, cb[2]) + 3),
1947                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1948                                     offsetof(struct __sk_buff, cb[3])),
1949                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1950                                     offsetof(struct __sk_buff, cb[3]) + 1),
1951                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1952                                     offsetof(struct __sk_buff, cb[3]) + 2),
1953                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1954                                     offsetof(struct __sk_buff, cb[3]) + 3),
1955                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1956                                     offsetof(struct __sk_buff, cb[4])),
1957                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1958                                     offsetof(struct __sk_buff, cb[4]) + 1),
1959                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1960                                     offsetof(struct __sk_buff, cb[4]) + 2),
1961                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1962                                     offsetof(struct __sk_buff, cb[4]) + 3),
1963                         BPF_EXIT_INSN(),
1964                 },
1965                 .result = ACCEPT,
1966         },
1967         {
1968                 "__sk_buff->hash, offset 0, byte store not permitted",
1969                 .insns = {
1970                         BPF_MOV64_IMM(BPF_REG_0, 0),
1971                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1972                                     offsetof(struct __sk_buff, hash)),
1973                         BPF_EXIT_INSN(),
1974                 },
1975                 .errstr = "invalid bpf_context access",
1976                 .result = REJECT,
1977         },
1978         {
1979                 "__sk_buff->tc_index, offset 3, byte store not permitted",
1980                 .insns = {
1981                         BPF_MOV64_IMM(BPF_REG_0, 0),
1982                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
1983                                     offsetof(struct __sk_buff, tc_index) + 3),
1984                         BPF_EXIT_INSN(),
1985                 },
1986                 .errstr = "invalid bpf_context access",
1987                 .result = REJECT,
1988         },
1989         {
1990                 "check skb->hash byte load permitted",
1991                 .insns = {
1992                         BPF_MOV64_IMM(BPF_REG_0, 0),
1993 #if __BYTE_ORDER == __LITTLE_ENDIAN
1994                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1995                                     offsetof(struct __sk_buff, hash)),
1996 #else
1997                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
1998                                     offsetof(struct __sk_buff, hash) + 3),
1999 #endif
2000                         BPF_EXIT_INSN(),
2001                 },
2002                 .result = ACCEPT,
2003         },
2004         {
2005                 "check skb->hash byte load not permitted 1",
2006                 .insns = {
2007                         BPF_MOV64_IMM(BPF_REG_0, 0),
2008                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
2009                                     offsetof(struct __sk_buff, hash) + 1),
2010                         BPF_EXIT_INSN(),
2011                 },
2012                 .errstr = "invalid bpf_context access",
2013                 .result = REJECT,
2014         },
2015         {
2016                 "check skb->hash byte load not permitted 2",
2017                 .insns = {
2018                         BPF_MOV64_IMM(BPF_REG_0, 0),
2019                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
2020                                     offsetof(struct __sk_buff, hash) + 2),
2021                         BPF_EXIT_INSN(),
2022                 },
2023                 .errstr = "invalid bpf_context access",
2024                 .result = REJECT,
2025         },
2026         {
2027                 "check skb->hash byte load not permitted 3",
2028                 .insns = {
2029                         BPF_MOV64_IMM(BPF_REG_0, 0),
2030 #if __BYTE_ORDER == __LITTLE_ENDIAN
2031                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
2032                                     offsetof(struct __sk_buff, hash) + 3),
2033 #else
2034                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
2035                                     offsetof(struct __sk_buff, hash)),
2036 #endif
2037                         BPF_EXIT_INSN(),
2038                 },
2039                 .errstr = "invalid bpf_context access",
2040                 .result = REJECT,
2041         },
2042         {
2043                 "check cb access: byte, wrong type",
2044                 .insns = {
2045                         BPF_MOV64_IMM(BPF_REG_0, 0),
2046                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
2047                                     offsetof(struct __sk_buff, cb[0])),
2048                         BPF_EXIT_INSN(),
2049                 },
2050                 .errstr = "invalid bpf_context access",
2051                 .result = REJECT,
2052                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
2053         },
2054         {
2055                 "check cb access: half",
2056                 .insns = {
2057                         BPF_MOV64_IMM(BPF_REG_0, 0),
2058                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2059                                     offsetof(struct __sk_buff, cb[0])),
2060                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2061                                     offsetof(struct __sk_buff, cb[0]) + 2),
2062                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2063                                     offsetof(struct __sk_buff, cb[1])),
2064                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2065                                     offsetof(struct __sk_buff, cb[1]) + 2),
2066                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2067                                     offsetof(struct __sk_buff, cb[2])),
2068                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2069                                     offsetof(struct __sk_buff, cb[2]) + 2),
2070                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2071                                     offsetof(struct __sk_buff, cb[3])),
2072                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2073                                     offsetof(struct __sk_buff, cb[3]) + 2),
2074                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2075                                     offsetof(struct __sk_buff, cb[4])),
2076                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2077                                     offsetof(struct __sk_buff, cb[4]) + 2),
2078                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2079                                     offsetof(struct __sk_buff, cb[0])),
2080                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2081                                     offsetof(struct __sk_buff, cb[0]) + 2),
2082                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2083                                     offsetof(struct __sk_buff, cb[1])),
2084                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2085                                     offsetof(struct __sk_buff, cb[1]) + 2),
2086                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2087                                     offsetof(struct __sk_buff, cb[2])),
2088                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2089                                     offsetof(struct __sk_buff, cb[2]) + 2),
2090                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2091                                     offsetof(struct __sk_buff, cb[3])),
2092                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2093                                     offsetof(struct __sk_buff, cb[3]) + 2),
2094                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2095                                     offsetof(struct __sk_buff, cb[4])),
2096                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2097                                     offsetof(struct __sk_buff, cb[4]) + 2),
2098                         BPF_EXIT_INSN(),
2099                 },
2100                 .result = ACCEPT,
2101         },
2102         {
2103                 "check cb access: half, unaligned",
2104                 .insns = {
2105                         BPF_MOV64_IMM(BPF_REG_0, 0),
2106                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2107                                     offsetof(struct __sk_buff, cb[0]) + 1),
2108                         BPF_EXIT_INSN(),
2109                 },
2110                 .errstr = "misaligned context access",
2111                 .result = REJECT,
2112                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2113         },
2114         {
2115                 "check __sk_buff->hash, offset 0, half store not permitted",
2116                 .insns = {
2117                         BPF_MOV64_IMM(BPF_REG_0, 0),
2118                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2119                                     offsetof(struct __sk_buff, hash)),
2120                         BPF_EXIT_INSN(),
2121                 },
2122                 .errstr = "invalid bpf_context access",
2123                 .result = REJECT,
2124         },
2125         {
2126                 "check __sk_buff->tc_index, offset 2, half store not permitted",
2127                 .insns = {
2128                         BPF_MOV64_IMM(BPF_REG_0, 0),
2129                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2130                                     offsetof(struct __sk_buff, tc_index) + 2),
2131                         BPF_EXIT_INSN(),
2132                 },
2133                 .errstr = "invalid bpf_context access",
2134                 .result = REJECT,
2135         },
2136         {
2137                 "check skb->hash half load permitted",
2138                 .insns = {
2139                         BPF_MOV64_IMM(BPF_REG_0, 0),
2140 #if __BYTE_ORDER == __LITTLE_ENDIAN
2141                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2142                                     offsetof(struct __sk_buff, hash)),
2143 #else
2144                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2145                                     offsetof(struct __sk_buff, hash) + 2),
2146 #endif
2147                         BPF_EXIT_INSN(),
2148                 },
2149                 .result = ACCEPT,
2150         },
2151         {
2152                 "check skb->hash half load not permitted",
2153                 .insns = {
2154                         BPF_MOV64_IMM(BPF_REG_0, 0),
2155 #if __BYTE_ORDER == __LITTLE_ENDIAN
2156                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2157                                     offsetof(struct __sk_buff, hash) + 2),
2158 #else
2159                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
2160                                     offsetof(struct __sk_buff, hash)),
2161 #endif
2162                         BPF_EXIT_INSN(),
2163                 },
2164                 .errstr = "invalid bpf_context access",
2165                 .result = REJECT,
2166         },
2167         {
2168                 "check cb access: half, wrong type",
2169                 .insns = {
2170                         BPF_MOV64_IMM(BPF_REG_0, 0),
2171                         BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
2172                                     offsetof(struct __sk_buff, cb[0])),
2173                         BPF_EXIT_INSN(),
2174                 },
2175                 .errstr = "invalid bpf_context access",
2176                 .result = REJECT,
2177                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
2178         },
2179         {
2180                 "check cb access: word",
2181                 .insns = {
2182                         BPF_MOV64_IMM(BPF_REG_0, 0),
2183                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2184                                     offsetof(struct __sk_buff, cb[0])),
2185                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2186                                     offsetof(struct __sk_buff, cb[1])),
2187                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2188                                     offsetof(struct __sk_buff, cb[2])),
2189                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2190                                     offsetof(struct __sk_buff, cb[3])),
2191                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2192                                     offsetof(struct __sk_buff, cb[4])),
2193                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2194                                     offsetof(struct __sk_buff, cb[0])),
2195                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2196                                     offsetof(struct __sk_buff, cb[1])),
2197                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2198                                     offsetof(struct __sk_buff, cb[2])),
2199                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2200                                     offsetof(struct __sk_buff, cb[3])),
2201                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2202                                     offsetof(struct __sk_buff, cb[4])),
2203                         BPF_EXIT_INSN(),
2204                 },
2205                 .result = ACCEPT,
2206         },
2207         {
2208                 "check cb access: word, unaligned 1",
2209                 .insns = {
2210                         BPF_MOV64_IMM(BPF_REG_0, 0),
2211                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2212                                     offsetof(struct __sk_buff, cb[0]) + 2),
2213                         BPF_EXIT_INSN(),
2214                 },
2215                 .errstr = "misaligned context access",
2216                 .result = REJECT,
2217                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2218         },
2219         {
2220                 "check cb access: word, unaligned 2",
2221                 .insns = {
2222                         BPF_MOV64_IMM(BPF_REG_0, 0),
2223                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2224                                     offsetof(struct __sk_buff, cb[4]) + 1),
2225                         BPF_EXIT_INSN(),
2226                 },
2227                 .errstr = "misaligned context access",
2228                 .result = REJECT,
2229                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2230         },
2231         {
2232                 "check cb access: word, unaligned 3",
2233                 .insns = {
2234                         BPF_MOV64_IMM(BPF_REG_0, 0),
2235                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2236                                     offsetof(struct __sk_buff, cb[4]) + 2),
2237                         BPF_EXIT_INSN(),
2238                 },
2239                 .errstr = "misaligned context access",
2240                 .result = REJECT,
2241                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2242         },
2243         {
2244                 "check cb access: word, unaligned 4",
2245                 .insns = {
2246                         BPF_MOV64_IMM(BPF_REG_0, 0),
2247                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2248                                     offsetof(struct __sk_buff, cb[4]) + 3),
2249                         BPF_EXIT_INSN(),
2250                 },
2251                 .errstr = "misaligned context access",
2252                 .result = REJECT,
2253                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2254         },
2255         {
2256                 "check cb access: double",
2257                 .insns = {
2258                         BPF_MOV64_IMM(BPF_REG_0, 0),
2259                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2260                                     offsetof(struct __sk_buff, cb[0])),
2261                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2262                                     offsetof(struct __sk_buff, cb[2])),
2263                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2264                                     offsetof(struct __sk_buff, cb[0])),
2265                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2266                                     offsetof(struct __sk_buff, cb[2])),
2267                         BPF_EXIT_INSN(),
2268                 },
2269                 .result = ACCEPT,
2270         },
2271         {
2272                 "check cb access: double, unaligned 1",
2273                 .insns = {
2274                         BPF_MOV64_IMM(BPF_REG_0, 0),
2275                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2276                                     offsetof(struct __sk_buff, cb[1])),
2277                         BPF_EXIT_INSN(),
2278                 },
2279                 .errstr = "misaligned context access",
2280                 .result = REJECT,
2281                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2282         },
2283         {
2284                 "check cb access: double, unaligned 2",
2285                 .insns = {
2286                         BPF_MOV64_IMM(BPF_REG_0, 0),
2287                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2288                                     offsetof(struct __sk_buff, cb[3])),
2289                         BPF_EXIT_INSN(),
2290                 },
2291                 .errstr = "misaligned context access",
2292                 .result = REJECT,
2293                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
2294         },
2295         {
2296                 "check cb access: double, oob 1",
2297                 .insns = {
2298                         BPF_MOV64_IMM(BPF_REG_0, 0),
2299                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2300                                     offsetof(struct __sk_buff, cb[4])),
2301                         BPF_EXIT_INSN(),
2302                 },
2303                 .errstr = "invalid bpf_context access",
2304                 .result = REJECT,
2305         },
2306         {
2307                 "check cb access: double, oob 2",
2308                 .insns = {
2309                         BPF_MOV64_IMM(BPF_REG_0, 0),
2310                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2311                                     offsetof(struct __sk_buff, cb[4])),
2312                         BPF_EXIT_INSN(),
2313                 },
2314                 .errstr = "invalid bpf_context access",
2315                 .result = REJECT,
2316         },
2317         {
2318                 "check __sk_buff->ifindex dw store not permitted",
2319                 .insns = {
2320                         BPF_MOV64_IMM(BPF_REG_0, 0),
2321                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2322                                     offsetof(struct __sk_buff, ifindex)),
2323                         BPF_EXIT_INSN(),
2324                 },
2325                 .errstr = "invalid bpf_context access",
2326                 .result = REJECT,
2327         },
2328         {
2329                 "check __sk_buff->ifindex dw load not permitted",
2330                 .insns = {
2331                         BPF_MOV64_IMM(BPF_REG_0, 0),
2332                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
2333                                     offsetof(struct __sk_buff, ifindex)),
2334                         BPF_EXIT_INSN(),
2335                 },
2336                 .errstr = "invalid bpf_context access",
2337                 .result = REJECT,
2338         },
2339         {
2340                 "check cb access: double, wrong type",
2341                 .insns = {
2342                         BPF_MOV64_IMM(BPF_REG_0, 0),
2343                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
2344                                     offsetof(struct __sk_buff, cb[0])),
2345                         BPF_EXIT_INSN(),
2346                 },
2347                 .errstr = "invalid bpf_context access",
2348                 .result = REJECT,
2349                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
2350         },
2351         {
2352                 "check out of range skb->cb access",
2353                 .insns = {
2354                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2355                                     offsetof(struct __sk_buff, cb[0]) + 256),
2356                         BPF_EXIT_INSN(),
2357                 },
2358                 .errstr = "invalid bpf_context access",
2359                 .errstr_unpriv = "",
2360                 .result = REJECT,
2361                 .prog_type = BPF_PROG_TYPE_SCHED_ACT,
2362         },
2363         {
2364                 "write skb fields from socket prog",
2365                 .insns = {
2366                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2367                                     offsetof(struct __sk_buff, cb[4])),
2368                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
2369                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2370                                     offsetof(struct __sk_buff, mark)),
2371                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2372                                     offsetof(struct __sk_buff, tc_index)),
2373                         BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
2374                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
2375                                     offsetof(struct __sk_buff, cb[0])),
2376                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
2377                                     offsetof(struct __sk_buff, cb[2])),
2378                         BPF_EXIT_INSN(),
2379                 },
2380                 .result = ACCEPT,
2381                 .errstr_unpriv = "R1 leaks addr",
2382                 .result_unpriv = REJECT,
2383         },
2384         {
2385                 "write skb fields from tc_cls_act prog",
2386                 .insns = {
2387                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2388                                     offsetof(struct __sk_buff, cb[0])),
2389                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2390                                     offsetof(struct __sk_buff, mark)),
2391                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
2392                                     offsetof(struct __sk_buff, tc_index)),
2393                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2394                                     offsetof(struct __sk_buff, tc_index)),
2395                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
2396                                     offsetof(struct __sk_buff, cb[3])),
2397                         BPF_EXIT_INSN(),
2398                 },
2399                 .errstr_unpriv = "",
2400                 .result_unpriv = REJECT,
2401                 .result = ACCEPT,
2402                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2403         },
2404         {
2405                 "PTR_TO_STACK store/load",
2406                 .insns = {
2407                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2408                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
2409                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
2410                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
2411                         BPF_EXIT_INSN(),
2412                 },
2413                 .result = ACCEPT,
2414                 .retval = 0xfaceb00c,
2415         },
2416         {
2417                 "PTR_TO_STACK store/load - bad alignment on off",
2418                 .insns = {
2419                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2420                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
2421                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
2422                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
2423                         BPF_EXIT_INSN(),
2424                 },
2425                 .result = REJECT,
2426                 .errstr = "misaligned stack access off (0x0; 0x0)+-8+2 size 8",
2427         },
2428         {
2429                 "PTR_TO_STACK store/load - bad alignment on reg",
2430                 .insns = {
2431                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2432                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
2433                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
2434                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
2435                         BPF_EXIT_INSN(),
2436                 },
2437                 .result = REJECT,
2438                 .errstr = "misaligned stack access off (0x0; 0x0)+-10+8 size 8",
2439         },
2440         {
2441                 "PTR_TO_STACK store/load - out of bounds low",
2442                 .insns = {
2443                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2444                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -80000),
2445                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
2446                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
2447                         BPF_EXIT_INSN(),
2448                 },
2449                 .result = REJECT,
2450                 .errstr = "invalid stack off=-79992 size=8",
2451         },
2452         {
2453                 "PTR_TO_STACK store/load - out of bounds high",
2454                 .insns = {
2455                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2456                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
2457                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
2458                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
2459                         BPF_EXIT_INSN(),
2460                 },
2461                 .result = REJECT,
2462                 .errstr = "invalid stack off=0 size=8",
2463         },
2464         {
2465                 "unpriv: return pointer",
2466                 .insns = {
2467                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
2468                         BPF_EXIT_INSN(),
2469                 },
2470                 .result = ACCEPT,
2471                 .result_unpriv = REJECT,
2472                 .errstr_unpriv = "R0 leaks addr",
2473                 .retval = POINTER_VALUE,
2474         },
2475         {
2476                 "unpriv: add const to pointer",
2477                 .insns = {
2478                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
2479                         BPF_MOV64_IMM(BPF_REG_0, 0),
2480                         BPF_EXIT_INSN(),
2481                 },
2482                 .result = ACCEPT,
2483         },
2484         {
2485                 "unpriv: add pointer to pointer",
2486                 .insns = {
2487                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
2488                         BPF_MOV64_IMM(BPF_REG_0, 0),
2489                         BPF_EXIT_INSN(),
2490                 },
2491                 .result = REJECT,
2492                 .errstr = "R1 pointer += pointer",
2493         },
2494         {
2495                 "unpriv: neg pointer",
2496                 .insns = {
2497                         BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0),
2498                         BPF_MOV64_IMM(BPF_REG_0, 0),
2499                         BPF_EXIT_INSN(),
2500                 },
2501                 .result = ACCEPT,
2502                 .result_unpriv = REJECT,
2503                 .errstr_unpriv = "R1 pointer arithmetic",
2504         },
2505         {
2506                 "unpriv: cmp pointer with const",
2507                 .insns = {
2508                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
2509                         BPF_MOV64_IMM(BPF_REG_0, 0),
2510                         BPF_EXIT_INSN(),
2511                 },
2512                 .result = ACCEPT,
2513                 .result_unpriv = REJECT,
2514                 .errstr_unpriv = "R1 pointer comparison",
2515         },
2516         {
2517                 "unpriv: cmp pointer with pointer",
2518                 .insns = {
2519                         BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
2520                         BPF_MOV64_IMM(BPF_REG_0, 0),
2521                         BPF_EXIT_INSN(),
2522                 },
2523                 .result = ACCEPT,
2524                 .result_unpriv = REJECT,
2525                 .errstr_unpriv = "R10 pointer comparison",
2526         },
2527         {
2528                 "unpriv: check that printk is disallowed",
2529                 .insns = {
2530                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2531                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
2532                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
2533                         BPF_MOV64_IMM(BPF_REG_2, 8),
2534                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
2535                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2536                                      BPF_FUNC_trace_printk),
2537                         BPF_MOV64_IMM(BPF_REG_0, 0),
2538                         BPF_EXIT_INSN(),
2539                 },
2540                 .errstr_unpriv = "unknown func bpf_trace_printk#6",
2541                 .result_unpriv = REJECT,
2542                 .result = ACCEPT,
2543         },
2544         {
2545                 "unpriv: pass pointer to helper function",
2546                 .insns = {
2547                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2548                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2549                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2550                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2551                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
2552                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
2553                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2554                                      BPF_FUNC_map_update_elem),
2555                         BPF_MOV64_IMM(BPF_REG_0, 0),
2556                         BPF_EXIT_INSN(),
2557                 },
2558                 .fixup_map1 = { 3 },
2559                 .errstr_unpriv = "R4 leaks addr",
2560                 .result_unpriv = REJECT,
2561                 .result = ACCEPT,
2562         },
2563         {
2564                 "unpriv: indirectly pass pointer on stack to helper function",
2565                 .insns = {
2566                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2567                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2568                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2569                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2570                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2571                                      BPF_FUNC_map_lookup_elem),
2572                         BPF_MOV64_IMM(BPF_REG_0, 0),
2573                         BPF_EXIT_INSN(),
2574                 },
2575                 .fixup_map1 = { 3 },
2576                 .errstr = "invalid indirect read from stack off -8+0 size 8",
2577                 .result = REJECT,
2578         },
2579         {
2580                 "unpriv: mangle pointer on stack 1",
2581                 .insns = {
2582                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2583                         BPF_ST_MEM(BPF_W, BPF_REG_10, -8, 0),
2584                         BPF_MOV64_IMM(BPF_REG_0, 0),
2585                         BPF_EXIT_INSN(),
2586                 },
2587                 .errstr_unpriv = "attempt to corrupt spilled",
2588                 .result_unpriv = REJECT,
2589                 .result = ACCEPT,
2590         },
2591         {
2592                 "unpriv: mangle pointer on stack 2",
2593                 .insns = {
2594                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2595                         BPF_ST_MEM(BPF_B, BPF_REG_10, -1, 0),
2596                         BPF_MOV64_IMM(BPF_REG_0, 0),
2597                         BPF_EXIT_INSN(),
2598                 },
2599                 .errstr_unpriv = "attempt to corrupt spilled",
2600                 .result_unpriv = REJECT,
2601                 .result = ACCEPT,
2602         },
2603         {
2604                 "unpriv: read pointer from stack in small chunks",
2605                 .insns = {
2606                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
2607                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -8),
2608                         BPF_MOV64_IMM(BPF_REG_0, 0),
2609                         BPF_EXIT_INSN(),
2610                 },
2611                 .errstr = "invalid size",
2612                 .result = REJECT,
2613         },
2614         {
2615                 "unpriv: write pointer into ctx",
2616                 .insns = {
2617                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
2618                         BPF_MOV64_IMM(BPF_REG_0, 0),
2619                         BPF_EXIT_INSN(),
2620                 },
2621                 .errstr_unpriv = "R1 leaks addr",
2622                 .result_unpriv = REJECT,
2623                 .errstr = "invalid bpf_context access",
2624                 .result = REJECT,
2625         },
2626         {
2627                 "unpriv: spill/fill of ctx",
2628                 .insns = {
2629                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2630                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2631                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2632                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2633                         BPF_MOV64_IMM(BPF_REG_0, 0),
2634                         BPF_EXIT_INSN(),
2635                 },
2636                 .result = ACCEPT,
2637         },
2638         {
2639                 "unpriv: spill/fill of ctx 2",
2640                 .insns = {
2641                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2642                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2643                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2644                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2645                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2646                                      BPF_FUNC_get_hash_recalc),
2647                         BPF_MOV64_IMM(BPF_REG_0, 0),
2648                         BPF_EXIT_INSN(),
2649                 },
2650                 .result = ACCEPT,
2651                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2652         },
2653         {
2654                 "unpriv: spill/fill of ctx 3",
2655                 .insns = {
2656                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2657                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2658                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2659                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
2660                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2661                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2662                                      BPF_FUNC_get_hash_recalc),
2663                         BPF_EXIT_INSN(),
2664                 },
2665                 .result = REJECT,
2666                 .errstr = "R1 type=fp expected=ctx",
2667                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2668         },
2669         {
2670                 "unpriv: spill/fill of ctx 4",
2671                 .insns = {
2672                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2673                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2674                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2675                         BPF_MOV64_IMM(BPF_REG_0, 1),
2676                         BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_10,
2677                                      BPF_REG_0, -8, 0),
2678                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2679                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2680                                      BPF_FUNC_get_hash_recalc),
2681                         BPF_EXIT_INSN(),
2682                 },
2683                 .result = REJECT,
2684                 .errstr = "R1 type=inv expected=ctx",
2685                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2686         },
2687         {
2688                 "unpriv: spill/fill of different pointers stx",
2689                 .insns = {
2690                         BPF_MOV64_IMM(BPF_REG_3, 42),
2691                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2692                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2693                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
2694                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2695                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
2696                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
2697                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
2698                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2699                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2700                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
2701                                     offsetof(struct __sk_buff, mark)),
2702                         BPF_MOV64_IMM(BPF_REG_0, 0),
2703                         BPF_EXIT_INSN(),
2704                 },
2705                 .result = REJECT,
2706                 .errstr = "same insn cannot be used with different pointers",
2707                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2708         },
2709         {
2710                 "unpriv: spill/fill of different pointers ldx",
2711                 .insns = {
2712                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2713                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2714                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
2715                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2716                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
2717                                       -(__s32)offsetof(struct bpf_perf_event_data,
2718                                                        sample_period) - 8),
2719                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
2720                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
2721                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
2722                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
2723                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1,
2724                                     offsetof(struct bpf_perf_event_data,
2725                                              sample_period)),
2726                         BPF_MOV64_IMM(BPF_REG_0, 0),
2727                         BPF_EXIT_INSN(),
2728                 },
2729                 .result = REJECT,
2730                 .errstr = "same insn cannot be used with different pointers",
2731                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
2732         },
2733         {
2734                 "unpriv: write pointer into map elem value",
2735                 .insns = {
2736                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
2737                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2738                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2739                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2740                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2741                                      BPF_FUNC_map_lookup_elem),
2742                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
2743                         BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
2744                         BPF_EXIT_INSN(),
2745                 },
2746                 .fixup_map1 = { 3 },
2747                 .errstr_unpriv = "R0 leaks addr",
2748                 .result_unpriv = REJECT,
2749                 .result = ACCEPT,
2750         },
2751         {
2752                 "alu32: mov u32 const",
2753                 .insns = {
2754                         BPF_MOV32_IMM(BPF_REG_7, 0),
2755                         BPF_ALU32_IMM(BPF_AND, BPF_REG_7, 1),
2756                         BPF_MOV32_REG(BPF_REG_0, BPF_REG_7),
2757                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
2758                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
2759                         BPF_EXIT_INSN(),
2760                 },
2761                 .result = ACCEPT,
2762                 .retval = 0,
2763         },
2764         {
2765                 "unpriv: partial copy of pointer",
2766                 .insns = {
2767                         BPF_MOV32_REG(BPF_REG_1, BPF_REG_10),
2768                         BPF_MOV64_IMM(BPF_REG_0, 0),
2769                         BPF_EXIT_INSN(),
2770                 },
2771                 .errstr_unpriv = "R10 partial copy",
2772                 .result_unpriv = REJECT,
2773                 .result = ACCEPT,
2774         },
2775         {
2776                 "unpriv: pass pointer to tail_call",
2777                 .insns = {
2778                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
2779                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2780                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2781                                      BPF_FUNC_tail_call),
2782                         BPF_MOV64_IMM(BPF_REG_0, 0),
2783                         BPF_EXIT_INSN(),
2784                 },
2785                 .fixup_prog1 = { 1 },
2786                 .errstr_unpriv = "R3 leaks addr into helper",
2787                 .result_unpriv = REJECT,
2788                 .result = ACCEPT,
2789         },
2790         {
2791                 "unpriv: cmp map pointer with zero",
2792                 .insns = {
2793                         BPF_MOV64_IMM(BPF_REG_1, 0),
2794                         BPF_LD_MAP_FD(BPF_REG_1, 0),
2795                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
2796                         BPF_MOV64_IMM(BPF_REG_0, 0),
2797                         BPF_EXIT_INSN(),
2798                 },
2799                 .fixup_map1 = { 1 },
2800                 .errstr_unpriv = "R1 pointer comparison",
2801                 .result_unpriv = REJECT,
2802                 .result = ACCEPT,
2803         },
2804         {
2805                 "unpriv: write into frame pointer",
2806                 .insns = {
2807                         BPF_MOV64_REG(BPF_REG_10, BPF_REG_1),
2808                         BPF_MOV64_IMM(BPF_REG_0, 0),
2809                         BPF_EXIT_INSN(),
2810                 },
2811                 .errstr = "frame pointer is read only",
2812                 .result = REJECT,
2813         },
2814         {
2815                 "unpriv: spill/fill frame pointer",
2816                 .insns = {
2817                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2818                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2819                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
2820                         BPF_LDX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, 0),
2821                         BPF_MOV64_IMM(BPF_REG_0, 0),
2822                         BPF_EXIT_INSN(),
2823                 },
2824                 .errstr = "frame pointer is read only",
2825                 .result = REJECT,
2826         },
2827         {
2828                 "unpriv: cmp of frame pointer",
2829                 .insns = {
2830                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_10, 0, 0),
2831                         BPF_MOV64_IMM(BPF_REG_0, 0),
2832                         BPF_EXIT_INSN(),
2833                 },
2834                 .errstr_unpriv = "R10 pointer comparison",
2835                 .result_unpriv = REJECT,
2836                 .result = ACCEPT,
2837         },
2838         {
2839                 "unpriv: adding of fp",
2840                 .insns = {
2841                         BPF_MOV64_IMM(BPF_REG_0, 0),
2842                         BPF_MOV64_IMM(BPF_REG_1, 0),
2843                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
2844                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, -8),
2845                         BPF_EXIT_INSN(),
2846                 },
2847                 .result = ACCEPT,
2848         },
2849         {
2850                 "unpriv: cmp of stack pointer",
2851                 .insns = {
2852                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
2853                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
2854                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_2, 0, 0),
2855                         BPF_MOV64_IMM(BPF_REG_0, 0),
2856                         BPF_EXIT_INSN(),
2857                 },
2858                 .errstr_unpriv = "R2 pointer comparison",
2859                 .result_unpriv = REJECT,
2860                 .result = ACCEPT,
2861         },
2862         {
2863                 "runtime/jit: tail_call within bounds, prog once",
2864                 .insns = {
2865                         BPF_MOV64_IMM(BPF_REG_3, 0),
2866                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2867                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2868                                      BPF_FUNC_tail_call),
2869                         BPF_MOV64_IMM(BPF_REG_0, 1),
2870                         BPF_EXIT_INSN(),
2871                 },
2872                 .fixup_prog1 = { 1 },
2873                 .result = ACCEPT,
2874                 .retval = 42,
2875         },
2876         {
2877                 "runtime/jit: tail_call within bounds, prog loop",
2878                 .insns = {
2879                         BPF_MOV64_IMM(BPF_REG_3, 1),
2880                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2881                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2882                                      BPF_FUNC_tail_call),
2883                         BPF_MOV64_IMM(BPF_REG_0, 1),
2884                         BPF_EXIT_INSN(),
2885                 },
2886                 .fixup_prog1 = { 1 },
2887                 .result = ACCEPT,
2888                 .retval = 41,
2889         },
2890         {
2891                 "runtime/jit: tail_call within bounds, no prog",
2892                 .insns = {
2893                         BPF_MOV64_IMM(BPF_REG_3, 2),
2894                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2895                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2896                                      BPF_FUNC_tail_call),
2897                         BPF_MOV64_IMM(BPF_REG_0, 1),
2898                         BPF_EXIT_INSN(),
2899                 },
2900                 .fixup_prog1 = { 1 },
2901                 .result = ACCEPT,
2902                 .retval = 1,
2903         },
2904         {
2905                 "runtime/jit: tail_call out of bounds",
2906                 .insns = {
2907                         BPF_MOV64_IMM(BPF_REG_3, 256),
2908                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2909                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2910                                      BPF_FUNC_tail_call),
2911                         BPF_MOV64_IMM(BPF_REG_0, 2),
2912                         BPF_EXIT_INSN(),
2913                 },
2914                 .fixup_prog1 = { 1 },
2915                 .result = ACCEPT,
2916                 .retval = 2,
2917         },
2918         {
2919                 "runtime/jit: pass negative index to tail_call",
2920                 .insns = {
2921                         BPF_MOV64_IMM(BPF_REG_3, -1),
2922                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2923                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2924                                      BPF_FUNC_tail_call),
2925                         BPF_MOV64_IMM(BPF_REG_0, 2),
2926                         BPF_EXIT_INSN(),
2927                 },
2928                 .fixup_prog1 = { 1 },
2929                 .result = ACCEPT,
2930                 .retval = 2,
2931         },
2932         {
2933                 "runtime/jit: pass > 32bit index to tail_call",
2934                 .insns = {
2935                         BPF_LD_IMM64(BPF_REG_3, 0x100000000ULL),
2936                         BPF_LD_MAP_FD(BPF_REG_2, 0),
2937                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2938                                      BPF_FUNC_tail_call),
2939                         BPF_MOV64_IMM(BPF_REG_0, 2),
2940                         BPF_EXIT_INSN(),
2941                 },
2942                 .fixup_prog1 = { 2 },
2943                 .result = ACCEPT,
2944                 .retval = 42,
2945         },
2946         {
2947                 "stack pointer arithmetic",
2948                 .insns = {
2949                         BPF_MOV64_IMM(BPF_REG_1, 4),
2950                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
2951                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
2952                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
2953                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
2954                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
2955                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_1),
2956                         BPF_ST_MEM(0, BPF_REG_2, 4, 0),
2957                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
2958                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
2959                         BPF_ST_MEM(0, BPF_REG_2, 4, 0),
2960                         BPF_MOV64_IMM(BPF_REG_0, 0),
2961                         BPF_EXIT_INSN(),
2962                 },
2963                 .result = ACCEPT,
2964         },
2965         {
2966                 "raw_stack: no skb_load_bytes",
2967                 .insns = {
2968                         BPF_MOV64_IMM(BPF_REG_2, 4),
2969                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2970                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2971                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2972                         BPF_MOV64_IMM(BPF_REG_4, 8),
2973                         /* Call to skb_load_bytes() omitted. */
2974                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2975                         BPF_EXIT_INSN(),
2976                 },
2977                 .result = REJECT,
2978                 .errstr = "invalid read from stack off -8+0 size 8",
2979                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2980         },
2981         {
2982                 "raw_stack: skb_load_bytes, negative len",
2983                 .insns = {
2984                         BPF_MOV64_IMM(BPF_REG_2, 4),
2985                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
2986                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
2987                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
2988                         BPF_MOV64_IMM(BPF_REG_4, -8),
2989                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
2990                                      BPF_FUNC_skb_load_bytes),
2991                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
2992                         BPF_EXIT_INSN(),
2993                 },
2994                 .result = REJECT,
2995                 .errstr = "R4 min value is negative",
2996                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
2997         },
2998         {
2999                 "raw_stack: skb_load_bytes, negative len 2",
3000                 .insns = {
3001                         BPF_MOV64_IMM(BPF_REG_2, 4),
3002                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3003                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3004                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3005                         BPF_MOV64_IMM(BPF_REG_4, ~0),
3006                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3007                                      BPF_FUNC_skb_load_bytes),
3008                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3009                         BPF_EXIT_INSN(),
3010                 },
3011                 .result = REJECT,
3012                 .errstr = "R4 min value is negative",
3013                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3014         },
3015         {
3016                 "raw_stack: skb_load_bytes, zero len",
3017                 .insns = {
3018                         BPF_MOV64_IMM(BPF_REG_2, 4),
3019                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3020                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3021                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3022                         BPF_MOV64_IMM(BPF_REG_4, 0),
3023                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3024                                      BPF_FUNC_skb_load_bytes),
3025                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3026                         BPF_EXIT_INSN(),
3027                 },
3028                 .result = REJECT,
3029                 .errstr = "invalid stack type R3",
3030                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3031         },
3032         {
3033                 "raw_stack: skb_load_bytes, no init",
3034                 .insns = {
3035                         BPF_MOV64_IMM(BPF_REG_2, 4),
3036                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3037                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3038                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3039                         BPF_MOV64_IMM(BPF_REG_4, 8),
3040                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3041                                      BPF_FUNC_skb_load_bytes),
3042                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3043                         BPF_EXIT_INSN(),
3044                 },
3045                 .result = ACCEPT,
3046                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3047         },
3048         {
3049                 "raw_stack: skb_load_bytes, init",
3050                 .insns = {
3051                         BPF_MOV64_IMM(BPF_REG_2, 4),
3052                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3053                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3054                         BPF_ST_MEM(BPF_DW, BPF_REG_6, 0, 0xcafe),
3055                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3056                         BPF_MOV64_IMM(BPF_REG_4, 8),
3057                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3058                                      BPF_FUNC_skb_load_bytes),
3059                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3060                         BPF_EXIT_INSN(),
3061                 },
3062                 .result = ACCEPT,
3063                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3064         },
3065         {
3066                 "raw_stack: skb_load_bytes, spilled regs around bounds",
3067                 .insns = {
3068                         BPF_MOV64_IMM(BPF_REG_2, 4),
3069                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3070                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
3071                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
3072                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
3073                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3074                         BPF_MOV64_IMM(BPF_REG_4, 8),
3075                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3076                                      BPF_FUNC_skb_load_bytes),
3077                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
3078                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
3079                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
3080                                     offsetof(struct __sk_buff, mark)),
3081                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
3082                                     offsetof(struct __sk_buff, priority)),
3083                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3084                         BPF_EXIT_INSN(),
3085                 },
3086                 .result = ACCEPT,
3087                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3088         },
3089         {
3090                 "raw_stack: skb_load_bytes, spilled regs corruption",
3091                 .insns = {
3092                         BPF_MOV64_IMM(BPF_REG_2, 4),
3093                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3094                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
3095                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
3096                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3097                         BPF_MOV64_IMM(BPF_REG_4, 8),
3098                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3099                                      BPF_FUNC_skb_load_bytes),
3100                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3101                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
3102                                     offsetof(struct __sk_buff, mark)),
3103                         BPF_EXIT_INSN(),
3104                 },
3105                 .result = REJECT,
3106                 .errstr = "R0 invalid mem access 'inv'",
3107                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3108         },
3109         {
3110                 "raw_stack: skb_load_bytes, spilled regs corruption 2",
3111                 .insns = {
3112                         BPF_MOV64_IMM(BPF_REG_2, 4),
3113                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3114                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
3115                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
3116                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  0),
3117                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
3118                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3119                         BPF_MOV64_IMM(BPF_REG_4, 8),
3120                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3121                                      BPF_FUNC_skb_load_bytes),
3122                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
3123                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
3124                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6,  0),
3125                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
3126                                     offsetof(struct __sk_buff, mark)),
3127                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
3128                                     offsetof(struct __sk_buff, priority)),
3129                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3130                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_3,
3131                                     offsetof(struct __sk_buff, pkt_type)),
3132                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
3133                         BPF_EXIT_INSN(),
3134                 },
3135                 .result = REJECT,
3136                 .errstr = "R3 invalid mem access 'inv'",
3137                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3138         },
3139         {
3140                 "raw_stack: skb_load_bytes, spilled regs + data",
3141                 .insns = {
3142                         BPF_MOV64_IMM(BPF_REG_2, 4),
3143                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3144                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
3145                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
3146                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  0),
3147                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
3148                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3149                         BPF_MOV64_IMM(BPF_REG_4, 8),
3150                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3151                                      BPF_FUNC_skb_load_bytes),
3152                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
3153                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
3154                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6,  0),
3155                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
3156                                     offsetof(struct __sk_buff, mark)),
3157                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
3158                                     offsetof(struct __sk_buff, priority)),
3159                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3160                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
3161                         BPF_EXIT_INSN(),
3162                 },
3163                 .result = ACCEPT,
3164                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3165         },
3166         {
3167                 "raw_stack: skb_load_bytes, invalid access 1",
3168                 .insns = {
3169                         BPF_MOV64_IMM(BPF_REG_2, 4),
3170                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3171                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -513),
3172                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3173                         BPF_MOV64_IMM(BPF_REG_4, 8),
3174                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3175                                      BPF_FUNC_skb_load_bytes),
3176                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3177                         BPF_EXIT_INSN(),
3178                 },
3179                 .result = REJECT,
3180                 .errstr = "invalid stack type R3 off=-513 access_size=8",
3181                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3182         },
3183         {
3184                 "raw_stack: skb_load_bytes, invalid access 2",
3185                 .insns = {
3186                         BPF_MOV64_IMM(BPF_REG_2, 4),
3187                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3188                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
3189                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3190                         BPF_MOV64_IMM(BPF_REG_4, 8),
3191                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3192                                      BPF_FUNC_skb_load_bytes),
3193                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3194                         BPF_EXIT_INSN(),
3195                 },
3196                 .result = REJECT,
3197                 .errstr = "invalid stack type R3 off=-1 access_size=8",
3198                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3199         },
3200         {
3201                 "raw_stack: skb_load_bytes, invalid access 3",
3202                 .insns = {
3203                         BPF_MOV64_IMM(BPF_REG_2, 4),
3204                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3205                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 0xffffffff),
3206                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3207                         BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
3208                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3209                                      BPF_FUNC_skb_load_bytes),
3210                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3211                         BPF_EXIT_INSN(),
3212                 },
3213                 .result = REJECT,
3214                 .errstr = "R4 min value is negative",
3215                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3216         },
3217         {
3218                 "raw_stack: skb_load_bytes, invalid access 4",
3219                 .insns = {
3220                         BPF_MOV64_IMM(BPF_REG_2, 4),
3221                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3222                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
3223                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3224                         BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
3225                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3226                                      BPF_FUNC_skb_load_bytes),
3227                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3228                         BPF_EXIT_INSN(),
3229                 },
3230                 .result = REJECT,
3231                 .errstr = "R4 unbounded memory access, use 'var &= const' or 'if (var < const)'",
3232                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3233         },
3234         {
3235                 "raw_stack: skb_load_bytes, invalid access 5",
3236                 .insns = {
3237                         BPF_MOV64_IMM(BPF_REG_2, 4),
3238                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3239                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
3240                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3241                         BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
3242                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3243                                      BPF_FUNC_skb_load_bytes),
3244                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3245                         BPF_EXIT_INSN(),
3246                 },
3247                 .result = REJECT,
3248                 .errstr = "R4 unbounded memory access, use 'var &= const' or 'if (var < const)'",
3249                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3250         },
3251         {
3252                 "raw_stack: skb_load_bytes, invalid access 6",
3253                 .insns = {
3254                         BPF_MOV64_IMM(BPF_REG_2, 4),
3255                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3256                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
3257                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3258                         BPF_MOV64_IMM(BPF_REG_4, 0),
3259                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3260                                      BPF_FUNC_skb_load_bytes),
3261                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3262                         BPF_EXIT_INSN(),
3263                 },
3264                 .result = REJECT,
3265                 .errstr = "invalid stack type R3 off=-512 access_size=0",
3266                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3267         },
3268         {
3269                 "raw_stack: skb_load_bytes, large access",
3270                 .insns = {
3271                         BPF_MOV64_IMM(BPF_REG_2, 4),
3272                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
3273                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
3274                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
3275                         BPF_MOV64_IMM(BPF_REG_4, 512),
3276                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3277                                      BPF_FUNC_skb_load_bytes),
3278                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
3279                         BPF_EXIT_INSN(),
3280                 },
3281                 .result = ACCEPT,
3282                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3283         },
3284         {
3285                 "context stores via ST",
3286                 .insns = {
3287                         BPF_MOV64_IMM(BPF_REG_0, 0),
3288                         BPF_ST_MEM(BPF_DW, BPF_REG_1, offsetof(struct __sk_buff, mark), 0),
3289                         BPF_EXIT_INSN(),
3290                 },
3291                 .errstr = "BPF_ST stores into R1 context is not allowed",
3292                 .result = REJECT,
3293                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3294         },
3295         {
3296                 "context stores via XADD",
3297                 .insns = {
3298                         BPF_MOV64_IMM(BPF_REG_0, 0),
3299                         BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_W, BPF_REG_1,
3300                                      BPF_REG_0, offsetof(struct __sk_buff, mark), 0),
3301                         BPF_EXIT_INSN(),
3302                 },
3303                 .errstr = "BPF_XADD stores into R1 context is not allowed",
3304                 .result = REJECT,
3305                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3306         },
3307         {
3308                 "direct packet access: test1",
3309                 .insns = {
3310                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3311                                     offsetof(struct __sk_buff, data)),
3312                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3313                                     offsetof(struct __sk_buff, data_end)),
3314                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3315                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3316                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3317                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3318                         BPF_MOV64_IMM(BPF_REG_0, 0),
3319                         BPF_EXIT_INSN(),
3320                 },
3321                 .result = ACCEPT,
3322                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3323         },
3324         {
3325                 "direct packet access: test2",
3326                 .insns = {
3327                         BPF_MOV64_IMM(BPF_REG_0, 1),
3328                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
3329                                     offsetof(struct __sk_buff, data_end)),
3330                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3331                                     offsetof(struct __sk_buff, data)),
3332                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3333                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 14),
3334                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_4, 15),
3335                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 7),
3336                         BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_3, 12),
3337                         BPF_ALU64_IMM(BPF_MUL, BPF_REG_4, 14),
3338                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3339                                     offsetof(struct __sk_buff, data)),
3340                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_4),
3341                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3342                                     offsetof(struct __sk_buff, len)),
3343                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 49),
3344                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 49),
3345                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_2),
3346                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_3),
3347                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
3348                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
3349                                     offsetof(struct __sk_buff, data_end)),
3350                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
3351                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_3, 4),
3352                         BPF_MOV64_IMM(BPF_REG_0, 0),
3353                         BPF_EXIT_INSN(),
3354                 },
3355                 .result = ACCEPT,
3356                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3357         },
3358         {
3359                 "direct packet access: test3",
3360                 .insns = {
3361                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3362                                     offsetof(struct __sk_buff, data)),
3363                         BPF_MOV64_IMM(BPF_REG_0, 0),
3364                         BPF_EXIT_INSN(),
3365                 },
3366                 .errstr = "invalid bpf_context access off=76",
3367                 .result = REJECT,
3368                 .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
3369         },
3370         {
3371                 "direct packet access: test4 (write)",
3372                 .insns = {
3373                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3374                                     offsetof(struct __sk_buff, data)),
3375                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3376                                     offsetof(struct __sk_buff, data_end)),
3377                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3378                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3379                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3380                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3381                         BPF_MOV64_IMM(BPF_REG_0, 0),
3382                         BPF_EXIT_INSN(),
3383                 },
3384                 .result = ACCEPT,
3385                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3386         },
3387         {
3388                 "direct packet access: test5 (pkt_end >= reg, good access)",
3389                 .insns = {
3390                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3391                                     offsetof(struct __sk_buff, data)),
3392                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3393                                     offsetof(struct __sk_buff, data_end)),
3394                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3395                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3396                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
3397                         BPF_MOV64_IMM(BPF_REG_0, 1),
3398                         BPF_EXIT_INSN(),
3399                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3400                         BPF_MOV64_IMM(BPF_REG_0, 0),
3401                         BPF_EXIT_INSN(),
3402                 },
3403                 .result = ACCEPT,
3404                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3405         },
3406         {
3407                 "direct packet access: test6 (pkt_end >= reg, bad access)",
3408                 .insns = {
3409                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3410                                     offsetof(struct __sk_buff, data)),
3411                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3412                                     offsetof(struct __sk_buff, data_end)),
3413                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3414                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3415                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
3416                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3417                         BPF_MOV64_IMM(BPF_REG_0, 1),
3418                         BPF_EXIT_INSN(),
3419                         BPF_MOV64_IMM(BPF_REG_0, 0),
3420                         BPF_EXIT_INSN(),
3421                 },
3422                 .errstr = "invalid access to packet",
3423                 .result = REJECT,
3424                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3425         },
3426         {
3427                 "direct packet access: test7 (pkt_end >= reg, both accesses)",
3428                 .insns = {
3429                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3430                                     offsetof(struct __sk_buff, data)),
3431                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3432                                     offsetof(struct __sk_buff, data_end)),
3433                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3434                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3435                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
3436                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3437                         BPF_MOV64_IMM(BPF_REG_0, 1),
3438                         BPF_EXIT_INSN(),
3439                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3440                         BPF_MOV64_IMM(BPF_REG_0, 0),
3441                         BPF_EXIT_INSN(),
3442                 },
3443                 .errstr = "invalid access to packet",
3444                 .result = REJECT,
3445                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3446         },
3447         {
3448                 "direct packet access: test8 (double test, variant 1)",
3449                 .insns = {
3450                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3451                                     offsetof(struct __sk_buff, data)),
3452                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3453                                     offsetof(struct __sk_buff, data_end)),
3454                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3455                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3456                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 4),
3457                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3458                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3459                         BPF_MOV64_IMM(BPF_REG_0, 1),
3460                         BPF_EXIT_INSN(),
3461                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3462                         BPF_MOV64_IMM(BPF_REG_0, 0),
3463                         BPF_EXIT_INSN(),
3464                 },
3465                 .result = ACCEPT,
3466                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3467         },
3468         {
3469                 "direct packet access: test9 (double test, variant 2)",
3470                 .insns = {
3471                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3472                                     offsetof(struct __sk_buff, data)),
3473                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3474                                     offsetof(struct __sk_buff, data_end)),
3475                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3476                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3477                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
3478                         BPF_MOV64_IMM(BPF_REG_0, 1),
3479                         BPF_EXIT_INSN(),
3480                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3481                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3482                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3483                         BPF_MOV64_IMM(BPF_REG_0, 0),
3484                         BPF_EXIT_INSN(),
3485                 },
3486                 .result = ACCEPT,
3487                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3488         },
3489         {
3490                 "direct packet access: test10 (write invalid)",
3491                 .insns = {
3492                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3493                                     offsetof(struct __sk_buff, data)),
3494                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3495                                     offsetof(struct __sk_buff, data_end)),
3496                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3497                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3498                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
3499                         BPF_MOV64_IMM(BPF_REG_0, 0),
3500                         BPF_EXIT_INSN(),
3501                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3502                         BPF_MOV64_IMM(BPF_REG_0, 0),
3503                         BPF_EXIT_INSN(),
3504                 },
3505                 .errstr = "invalid access to packet",
3506                 .result = REJECT,
3507                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3508         },
3509         {
3510                 "direct packet access: test11 (shift, good access)",
3511                 .insns = {
3512                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3513                                     offsetof(struct __sk_buff, data)),
3514                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3515                                     offsetof(struct __sk_buff, data_end)),
3516                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3517                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3518                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
3519                         BPF_MOV64_IMM(BPF_REG_3, 144),
3520                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3521                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
3522                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 3),
3523                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3524                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3525                         BPF_MOV64_IMM(BPF_REG_0, 1),
3526                         BPF_EXIT_INSN(),
3527                         BPF_MOV64_IMM(BPF_REG_0, 0),
3528                         BPF_EXIT_INSN(),
3529                 },
3530                 .result = ACCEPT,
3531                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3532                 .retval = 1,
3533         },
3534         {
3535                 "direct packet access: test12 (and, good access)",
3536                 .insns = {
3537                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3538                                     offsetof(struct __sk_buff, data)),
3539                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3540                                     offsetof(struct __sk_buff, data_end)),
3541                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3542                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3543                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
3544                         BPF_MOV64_IMM(BPF_REG_3, 144),
3545                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3546                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
3547                         BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
3548                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3549                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3550                         BPF_MOV64_IMM(BPF_REG_0, 1),
3551                         BPF_EXIT_INSN(),
3552                         BPF_MOV64_IMM(BPF_REG_0, 0),
3553                         BPF_EXIT_INSN(),
3554                 },
3555                 .result = ACCEPT,
3556                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3557                 .retval = 1,
3558         },
3559         {
3560                 "direct packet access: test13 (branches, good access)",
3561                 .insns = {
3562                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3563                                     offsetof(struct __sk_buff, data)),
3564                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3565                                     offsetof(struct __sk_buff, data_end)),
3566                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3567                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3568                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 13),
3569                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3570                                     offsetof(struct __sk_buff, mark)),
3571                         BPF_MOV64_IMM(BPF_REG_4, 1),
3572                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_4, 2),
3573                         BPF_MOV64_IMM(BPF_REG_3, 14),
3574                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
3575                         BPF_MOV64_IMM(BPF_REG_3, 24),
3576                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
3577                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
3578                         BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
3579                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3580                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3581                         BPF_MOV64_IMM(BPF_REG_0, 1),
3582                         BPF_EXIT_INSN(),
3583                         BPF_MOV64_IMM(BPF_REG_0, 0),
3584                         BPF_EXIT_INSN(),
3585                 },
3586                 .result = ACCEPT,
3587                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3588                 .retval = 1,
3589         },
3590         {
3591                 "direct packet access: test14 (pkt_ptr += 0, CONST_IMM, good access)",
3592                 .insns = {
3593                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3594                                     offsetof(struct __sk_buff, data)),
3595                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3596                                     offsetof(struct __sk_buff, data_end)),
3597                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3598                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
3599                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),
3600                         BPF_MOV64_IMM(BPF_REG_5, 12),
3601                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 4),
3602                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
3603                         BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
3604                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6, 0),
3605                         BPF_MOV64_IMM(BPF_REG_0, 1),
3606                         BPF_EXIT_INSN(),
3607                         BPF_MOV64_IMM(BPF_REG_0, 0),
3608                         BPF_EXIT_INSN(),
3609                 },
3610                 .result = ACCEPT,
3611                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3612                 .retval = 1,
3613         },
3614         {
3615                 "direct packet access: test15 (spill with xadd)",
3616                 .insns = {
3617                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3618                                     offsetof(struct __sk_buff, data)),
3619                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3620                                     offsetof(struct __sk_buff, data_end)),
3621                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3622                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3623                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
3624                         BPF_MOV64_IMM(BPF_REG_5, 4096),
3625                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
3626                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
3627                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
3628                         BPF_STX_XADD(BPF_DW, BPF_REG_4, BPF_REG_5, 0),
3629                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
3630                         BPF_STX_MEM(BPF_W, BPF_REG_2, BPF_REG_5, 0),
3631                         BPF_MOV64_IMM(BPF_REG_0, 0),
3632                         BPF_EXIT_INSN(),
3633                 },
3634                 .errstr = "R2 invalid mem access 'inv'",
3635                 .result = REJECT,
3636                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3637         },
3638         {
3639                 "direct packet access: test16 (arith on data_end)",
3640                 .insns = {
3641                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3642                                     offsetof(struct __sk_buff, data)),
3643                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3644                                     offsetof(struct __sk_buff, data_end)),
3645                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3646                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3647                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 16),
3648                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3649                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3650                         BPF_MOV64_IMM(BPF_REG_0, 0),
3651                         BPF_EXIT_INSN(),
3652                 },
3653                 .errstr = "R3 pointer arithmetic on PTR_TO_PACKET_END",
3654                 .result = REJECT,
3655                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3656         },
3657         {
3658                 "direct packet access: test17 (pruning, alignment)",
3659                 .insns = {
3660                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3661                                     offsetof(struct __sk_buff, data)),
3662                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3663                                     offsetof(struct __sk_buff, data_end)),
3664                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
3665                                     offsetof(struct __sk_buff, mark)),
3666                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3667                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 14),
3668                         BPF_JMP_IMM(BPF_JGT, BPF_REG_7, 1, 4),
3669                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3670                         BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, -4),
3671                         BPF_MOV64_IMM(BPF_REG_0, 0),
3672                         BPF_EXIT_INSN(),
3673                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
3674                         BPF_JMP_A(-6),
3675                 },
3676                 .errstr = "misaligned packet access off 2+(0x0; 0x0)+15+-4 size 4",
3677                 .result = REJECT,
3678                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3679                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
3680         },
3681         {
3682                 "direct packet access: test18 (imm += pkt_ptr, 1)",
3683                 .insns = {
3684                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3685                                     offsetof(struct __sk_buff, data)),
3686                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3687                                     offsetof(struct __sk_buff, data_end)),
3688                         BPF_MOV64_IMM(BPF_REG_0, 8),
3689                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3690                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3691                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
3692                         BPF_MOV64_IMM(BPF_REG_0, 0),
3693                         BPF_EXIT_INSN(),
3694                 },
3695                 .result = ACCEPT,
3696                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3697         },
3698         {
3699                 "direct packet access: test19 (imm += pkt_ptr, 2)",
3700                 .insns = {
3701                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3702                                     offsetof(struct __sk_buff, data)),
3703                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3704                                     offsetof(struct __sk_buff, data_end)),
3705                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3706                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3707                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
3708                         BPF_MOV64_IMM(BPF_REG_4, 4),
3709                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3710                         BPF_STX_MEM(BPF_B, BPF_REG_4, BPF_REG_4, 0),
3711                         BPF_MOV64_IMM(BPF_REG_0, 0),
3712                         BPF_EXIT_INSN(),
3713                 },
3714                 .result = ACCEPT,
3715                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3716         },
3717         {
3718                 "direct packet access: test20 (x += pkt_ptr, 1)",
3719                 .insns = {
3720                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3721                                     offsetof(struct __sk_buff, data)),
3722                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3723                                     offsetof(struct __sk_buff, data_end)),
3724                         BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
3725                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3726                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3727                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0x7fff),
3728                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3729                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3730                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
3731                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0x7fff - 1),
3732                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
3733                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
3734                         BPF_MOV64_IMM(BPF_REG_0, 0),
3735                         BPF_EXIT_INSN(),
3736                 },
3737                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3738                 .result = ACCEPT,
3739         },
3740         {
3741                 "direct packet access: test21 (x += pkt_ptr, 2)",
3742                 .insns = {
3743                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3744                                     offsetof(struct __sk_buff, data)),
3745                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3746                                     offsetof(struct __sk_buff, data_end)),
3747                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3748                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3749                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 9),
3750                         BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
3751                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -8),
3752                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
3753                         BPF_ALU64_IMM(BPF_AND, BPF_REG_4, 0x7fff),
3754                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3755                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
3756                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0x7fff - 1),
3757                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
3758                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
3759                         BPF_MOV64_IMM(BPF_REG_0, 0),
3760                         BPF_EXIT_INSN(),
3761                 },
3762                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3763                 .result = ACCEPT,
3764         },
3765         {
3766                 "direct packet access: test22 (x += pkt_ptr, 3)",
3767                 .insns = {
3768                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3769                                     offsetof(struct __sk_buff, data)),
3770                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3771                                     offsetof(struct __sk_buff, data_end)),
3772                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3773                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3774                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -8),
3775                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_3, -16),
3776                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_10, -16),
3777                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 11),
3778                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
3779                         BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
3780                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_4, -8),
3781                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
3782                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 49),
3783                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
3784                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
3785                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
3786                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
3787                         BPF_MOV64_IMM(BPF_REG_2, 1),
3788                         BPF_STX_MEM(BPF_H, BPF_REG_4, BPF_REG_2, 0),
3789                         BPF_MOV64_IMM(BPF_REG_0, 0),
3790                         BPF_EXIT_INSN(),
3791                 },
3792                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3793                 .result = ACCEPT,
3794         },
3795         {
3796                 "direct packet access: test23 (x += pkt_ptr, 4)",
3797                 .insns = {
3798                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3799                                     offsetof(struct __sk_buff, data)),
3800                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3801                                     offsetof(struct __sk_buff, data_end)),
3802                         BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
3803                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3804                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3805                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xffff),
3806                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3807                         BPF_MOV64_IMM(BPF_REG_0, 31),
3808                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_4),
3809                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3810                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
3811                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0xffff - 1),
3812                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3813                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_0, 0),
3814                         BPF_MOV64_IMM(BPF_REG_0, 0),
3815                         BPF_EXIT_INSN(),
3816                 },
3817                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3818                 .result = REJECT,
3819                 .errstr = "invalid access to packet, off=0 size=8, R5(id=1,off=0,r=0)",
3820         },
3821         {
3822                 "direct packet access: test24 (x += pkt_ptr, 5)",
3823                 .insns = {
3824                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3825                                     offsetof(struct __sk_buff, data)),
3826                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3827                                     offsetof(struct __sk_buff, data_end)),
3828                         BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
3829                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
3830                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
3831                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xff),
3832                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
3833                         BPF_MOV64_IMM(BPF_REG_0, 64),
3834                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_4),
3835                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
3836                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
3837                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x7fff - 1),
3838                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
3839                         BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_0, 0),
3840                         BPF_MOV64_IMM(BPF_REG_0, 0),
3841                         BPF_EXIT_INSN(),
3842                 },
3843                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3844                 .result = ACCEPT,
3845         },
3846         {
3847                 "direct packet access: test25 (marking on <, good access)",
3848                 .insns = {
3849                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3850                                     offsetof(struct __sk_buff, data)),
3851                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3852                                     offsetof(struct __sk_buff, data_end)),
3853                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3854                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3855                         BPF_JMP_REG(BPF_JLT, BPF_REG_0, BPF_REG_3, 2),
3856                         BPF_MOV64_IMM(BPF_REG_0, 0),
3857                         BPF_EXIT_INSN(),
3858                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3859                         BPF_JMP_IMM(BPF_JA, 0, 0, -4),
3860                 },
3861                 .result = ACCEPT,
3862                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3863         },
3864         {
3865                 "direct packet access: test26 (marking on <, bad access)",
3866                 .insns = {
3867                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3868                                     offsetof(struct __sk_buff, data)),
3869                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3870                                     offsetof(struct __sk_buff, data_end)),
3871                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3872                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3873                         BPF_JMP_REG(BPF_JLT, BPF_REG_0, BPF_REG_3, 3),
3874                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3875                         BPF_MOV64_IMM(BPF_REG_0, 0),
3876                         BPF_EXIT_INSN(),
3877                         BPF_JMP_IMM(BPF_JA, 0, 0, -3),
3878                 },
3879                 .result = REJECT,
3880                 .errstr = "invalid access to packet",
3881                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3882         },
3883         {
3884                 "direct packet access: test27 (marking on <=, good access)",
3885                 .insns = {
3886                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3887                                     offsetof(struct __sk_buff, data)),
3888                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3889                                     offsetof(struct __sk_buff, data_end)),
3890                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3891                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3892                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_0, 1),
3893                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3894                         BPF_MOV64_IMM(BPF_REG_0, 1),
3895                         BPF_EXIT_INSN(),
3896                 },
3897                 .result = ACCEPT,
3898                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3899                 .retval = 1,
3900         },
3901         {
3902                 "direct packet access: test28 (marking on <=, bad access)",
3903                 .insns = {
3904                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3905                                     offsetof(struct __sk_buff, data)),
3906                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3907                                     offsetof(struct __sk_buff, data_end)),
3908                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
3909                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
3910                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_0, 2),
3911                         BPF_MOV64_IMM(BPF_REG_0, 1),
3912                         BPF_EXIT_INSN(),
3913                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
3914                         BPF_JMP_IMM(BPF_JA, 0, 0, -4),
3915                 },
3916                 .result = REJECT,
3917                 .errstr = "invalid access to packet",
3918                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
3919         },
3920         {
3921                 "helper access to packet: test1, valid packet_ptr range",
3922                 .insns = {
3923                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3924                                     offsetof(struct xdp_md, data)),
3925                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3926                                     offsetof(struct xdp_md, data_end)),
3927                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
3928                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
3929                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
3930                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3931                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
3932                         BPF_MOV64_IMM(BPF_REG_4, 0),
3933                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3934                                      BPF_FUNC_map_update_elem),
3935                         BPF_MOV64_IMM(BPF_REG_0, 0),
3936                         BPF_EXIT_INSN(),
3937                 },
3938                 .fixup_map1 = { 5 },
3939                 .result_unpriv = ACCEPT,
3940                 .result = ACCEPT,
3941                 .prog_type = BPF_PROG_TYPE_XDP,
3942         },
3943         {
3944                 "helper access to packet: test2, unchecked packet_ptr",
3945                 .insns = {
3946                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3947                                     offsetof(struct xdp_md, data)),
3948                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3949                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3950                                      BPF_FUNC_map_lookup_elem),
3951                         BPF_MOV64_IMM(BPF_REG_0, 0),
3952                         BPF_EXIT_INSN(),
3953                 },
3954                 .fixup_map1 = { 1 },
3955                 .result = REJECT,
3956                 .errstr = "invalid access to packet",
3957                 .prog_type = BPF_PROG_TYPE_XDP,
3958         },
3959         {
3960                 "helper access to packet: test3, variable add",
3961                 .insns = {
3962                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3963                                         offsetof(struct xdp_md, data)),
3964                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3965                                         offsetof(struct xdp_md, data_end)),
3966                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3967                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
3968                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
3969                         BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
3970                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3971                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
3972                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
3973                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
3974                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
3975                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3976                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
3977                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
3978                                      BPF_FUNC_map_lookup_elem),
3979                         BPF_MOV64_IMM(BPF_REG_0, 0),
3980                         BPF_EXIT_INSN(),
3981                 },
3982                 .fixup_map1 = { 11 },
3983                 .result = ACCEPT,
3984                 .prog_type = BPF_PROG_TYPE_XDP,
3985         },
3986         {
3987                 "helper access to packet: test4, packet_ptr with bad range",
3988                 .insns = {
3989                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
3990                                     offsetof(struct xdp_md, data)),
3991                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
3992                                     offsetof(struct xdp_md, data_end)),
3993                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
3994                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
3995                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
3996                         BPF_MOV64_IMM(BPF_REG_0, 0),
3997                         BPF_EXIT_INSN(),
3998                         BPF_LD_MAP_FD(BPF_REG_1, 0),
3999                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4000                                      BPF_FUNC_map_lookup_elem),
4001                         BPF_MOV64_IMM(BPF_REG_0, 0),
4002                         BPF_EXIT_INSN(),
4003                 },
4004                 .fixup_map1 = { 7 },
4005                 .result = REJECT,
4006                 .errstr = "invalid access to packet",
4007                 .prog_type = BPF_PROG_TYPE_XDP,
4008         },
4009         {
4010                 "helper access to packet: test5, packet_ptr with too short range",
4011                 .insns = {
4012                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4013                                     offsetof(struct xdp_md, data)),
4014                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4015                                     offsetof(struct xdp_md, data_end)),
4016                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
4017                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4018                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
4019                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
4020                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4021                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4022                                      BPF_FUNC_map_lookup_elem),
4023                         BPF_MOV64_IMM(BPF_REG_0, 0),
4024                         BPF_EXIT_INSN(),
4025                 },
4026                 .fixup_map1 = { 6 },
4027                 .result = REJECT,
4028                 .errstr = "invalid access to packet",
4029                 .prog_type = BPF_PROG_TYPE_XDP,
4030         },
4031         {
4032                 "helper access to packet: test6, cls valid packet_ptr range",
4033                 .insns = {
4034                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4035                                     offsetof(struct __sk_buff, data)),
4036                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4037                                     offsetof(struct __sk_buff, data_end)),
4038                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
4039                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
4040                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
4041                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4042                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
4043                         BPF_MOV64_IMM(BPF_REG_4, 0),
4044                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4045                                      BPF_FUNC_map_update_elem),
4046                         BPF_MOV64_IMM(BPF_REG_0, 0),
4047                         BPF_EXIT_INSN(),
4048                 },
4049                 .fixup_map1 = { 5 },
4050                 .result = ACCEPT,
4051                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4052         },
4053         {
4054                 "helper access to packet: test7, cls unchecked packet_ptr",
4055                 .insns = {
4056                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4057                                     offsetof(struct __sk_buff, data)),
4058                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4059                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4060                                      BPF_FUNC_map_lookup_elem),
4061                         BPF_MOV64_IMM(BPF_REG_0, 0),
4062                         BPF_EXIT_INSN(),
4063                 },
4064                 .fixup_map1 = { 1 },
4065                 .result = REJECT,
4066                 .errstr = "invalid access to packet",
4067                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4068         },
4069         {
4070                 "helper access to packet: test8, cls variable add",
4071                 .insns = {
4072                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4073                                         offsetof(struct __sk_buff, data)),
4074                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4075                                         offsetof(struct __sk_buff, data_end)),
4076                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4077                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
4078                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
4079                         BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
4080                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4081                         BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
4082                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
4083                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
4084                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
4085                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4086                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
4087                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4088                                      BPF_FUNC_map_lookup_elem),
4089                         BPF_MOV64_IMM(BPF_REG_0, 0),
4090                         BPF_EXIT_INSN(),
4091                 },
4092                 .fixup_map1 = { 11 },
4093                 .result = ACCEPT,
4094                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4095         },
4096         {
4097                 "helper access to packet: test9, cls packet_ptr with bad range",
4098                 .insns = {
4099                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4100                                     offsetof(struct __sk_buff, data)),
4101                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4102                                     offsetof(struct __sk_buff, data_end)),
4103                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4104                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
4105                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
4106                         BPF_MOV64_IMM(BPF_REG_0, 0),
4107                         BPF_EXIT_INSN(),
4108                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4109                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4110                                      BPF_FUNC_map_lookup_elem),
4111                         BPF_MOV64_IMM(BPF_REG_0, 0),
4112                         BPF_EXIT_INSN(),
4113                 },
4114                 .fixup_map1 = { 7 },
4115                 .result = REJECT,
4116                 .errstr = "invalid access to packet",
4117                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4118         },
4119         {
4120                 "helper access to packet: test10, cls packet_ptr with too short range",
4121                 .insns = {
4122                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4123                                     offsetof(struct __sk_buff, data)),
4124                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4125                                     offsetof(struct __sk_buff, data_end)),
4126                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
4127                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
4128                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
4129                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
4130                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4131                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4132                                      BPF_FUNC_map_lookup_elem),
4133                         BPF_MOV64_IMM(BPF_REG_0, 0),
4134                         BPF_EXIT_INSN(),
4135                 },
4136                 .fixup_map1 = { 6 },
4137                 .result = REJECT,
4138                 .errstr = "invalid access to packet",
4139                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4140         },
4141         {
4142                 "helper access to packet: test11, cls unsuitable helper 1",
4143                 .insns = {
4144                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4145                                     offsetof(struct __sk_buff, data)),
4146                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4147                                     offsetof(struct __sk_buff, data_end)),
4148                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4149                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
4150                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 7),
4151                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_7, 4),
4152                         BPF_MOV64_IMM(BPF_REG_2, 0),
4153                         BPF_MOV64_IMM(BPF_REG_4, 42),
4154                         BPF_MOV64_IMM(BPF_REG_5, 0),
4155                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4156                                      BPF_FUNC_skb_store_bytes),
4157                         BPF_MOV64_IMM(BPF_REG_0, 0),
4158                         BPF_EXIT_INSN(),
4159                 },
4160                 .result = REJECT,
4161                 .errstr = "helper access to the packet",
4162                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4163         },
4164         {
4165                 "helper access to packet: test12, cls unsuitable helper 2",
4166                 .insns = {
4167                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4168                                     offsetof(struct __sk_buff, data)),
4169                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4170                                     offsetof(struct __sk_buff, data_end)),
4171                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
4172                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
4173                         BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_7, 3),
4174                         BPF_MOV64_IMM(BPF_REG_2, 0),
4175                         BPF_MOV64_IMM(BPF_REG_4, 4),
4176                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4177                                      BPF_FUNC_skb_load_bytes),
4178                         BPF_MOV64_IMM(BPF_REG_0, 0),
4179                         BPF_EXIT_INSN(),
4180                 },
4181                 .result = REJECT,
4182                 .errstr = "helper access to the packet",
4183                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4184         },
4185         {
4186                 "helper access to packet: test13, cls helper ok",
4187                 .insns = {
4188                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4189                                     offsetof(struct __sk_buff, data)),
4190                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4191                                     offsetof(struct __sk_buff, data_end)),
4192                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4193                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4194                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4195                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4196                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4197                         BPF_MOV64_IMM(BPF_REG_2, 4),
4198                         BPF_MOV64_IMM(BPF_REG_3, 0),
4199                         BPF_MOV64_IMM(BPF_REG_4, 0),
4200                         BPF_MOV64_IMM(BPF_REG_5, 0),
4201                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4202                                      BPF_FUNC_csum_diff),
4203                         BPF_MOV64_IMM(BPF_REG_0, 0),
4204                         BPF_EXIT_INSN(),
4205                 },
4206                 .result = ACCEPT,
4207                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4208         },
4209         {
4210                 "helper access to packet: test14, cls helper ok sub",
4211                 .insns = {
4212                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4213                                     offsetof(struct __sk_buff, data)),
4214                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4215                                     offsetof(struct __sk_buff, data_end)),
4216                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4217                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4218                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4219                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4220                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 4),
4221                         BPF_MOV64_IMM(BPF_REG_2, 4),
4222                         BPF_MOV64_IMM(BPF_REG_3, 0),
4223                         BPF_MOV64_IMM(BPF_REG_4, 0),
4224                         BPF_MOV64_IMM(BPF_REG_5, 0),
4225                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4226                                      BPF_FUNC_csum_diff),
4227                         BPF_MOV64_IMM(BPF_REG_0, 0),
4228                         BPF_EXIT_INSN(),
4229                 },
4230                 .result = ACCEPT,
4231                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4232         },
4233         {
4234                 "helper access to packet: test15, cls helper fail sub",
4235                 .insns = {
4236                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4237                                     offsetof(struct __sk_buff, data)),
4238                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4239                                     offsetof(struct __sk_buff, data_end)),
4240                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4241                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4242                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4243                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4244                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 12),
4245                         BPF_MOV64_IMM(BPF_REG_2, 4),
4246                         BPF_MOV64_IMM(BPF_REG_3, 0),
4247                         BPF_MOV64_IMM(BPF_REG_4, 0),
4248                         BPF_MOV64_IMM(BPF_REG_5, 0),
4249                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4250                                      BPF_FUNC_csum_diff),
4251                         BPF_MOV64_IMM(BPF_REG_0, 0),
4252                         BPF_EXIT_INSN(),
4253                 },
4254                 .result = REJECT,
4255                 .errstr = "invalid access to packet",
4256                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4257         },
4258         {
4259                 "helper access to packet: test16, cls helper fail range 1",
4260                 .insns = {
4261                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4262                                     offsetof(struct __sk_buff, data)),
4263                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4264                                     offsetof(struct __sk_buff, data_end)),
4265                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4266                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4267                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4268                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4269                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4270                         BPF_MOV64_IMM(BPF_REG_2, 8),
4271                         BPF_MOV64_IMM(BPF_REG_3, 0),
4272                         BPF_MOV64_IMM(BPF_REG_4, 0),
4273                         BPF_MOV64_IMM(BPF_REG_5, 0),
4274                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4275                                      BPF_FUNC_csum_diff),
4276                         BPF_MOV64_IMM(BPF_REG_0, 0),
4277                         BPF_EXIT_INSN(),
4278                 },
4279                 .result = REJECT,
4280                 .errstr = "invalid access to packet",
4281                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4282         },
4283         {
4284                 "helper access to packet: test17, cls helper fail range 2",
4285                 .insns = {
4286                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4287                                     offsetof(struct __sk_buff, data)),
4288                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4289                                     offsetof(struct __sk_buff, data_end)),
4290                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4291                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4292                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4293                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4294                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4295                         BPF_MOV64_IMM(BPF_REG_2, -9),
4296                         BPF_MOV64_IMM(BPF_REG_3, 0),
4297                         BPF_MOV64_IMM(BPF_REG_4, 0),
4298                         BPF_MOV64_IMM(BPF_REG_5, 0),
4299                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4300                                      BPF_FUNC_csum_diff),
4301                         BPF_MOV64_IMM(BPF_REG_0, 0),
4302                         BPF_EXIT_INSN(),
4303                 },
4304                 .result = REJECT,
4305                 .errstr = "R2 min value is negative",
4306                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4307         },
4308         {
4309                 "helper access to packet: test18, cls helper fail range 3",
4310                 .insns = {
4311                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4312                                     offsetof(struct __sk_buff, data)),
4313                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4314                                     offsetof(struct __sk_buff, data_end)),
4315                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4316                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4317                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4318                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4319                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4320                         BPF_MOV64_IMM(BPF_REG_2, ~0),
4321                         BPF_MOV64_IMM(BPF_REG_3, 0),
4322                         BPF_MOV64_IMM(BPF_REG_4, 0),
4323                         BPF_MOV64_IMM(BPF_REG_5, 0),
4324                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4325                                      BPF_FUNC_csum_diff),
4326                         BPF_MOV64_IMM(BPF_REG_0, 0),
4327                         BPF_EXIT_INSN(),
4328                 },
4329                 .result = REJECT,
4330                 .errstr = "R2 min value is negative",
4331                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4332         },
4333         {
4334                 "helper access to packet: test19, cls helper range zero",
4335                 .insns = {
4336                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4337                                     offsetof(struct __sk_buff, data)),
4338                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4339                                     offsetof(struct __sk_buff, data_end)),
4340                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4341                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4342                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4343                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4344                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4345                         BPF_MOV64_IMM(BPF_REG_2, 0),
4346                         BPF_MOV64_IMM(BPF_REG_3, 0),
4347                         BPF_MOV64_IMM(BPF_REG_4, 0),
4348                         BPF_MOV64_IMM(BPF_REG_5, 0),
4349                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4350                                      BPF_FUNC_csum_diff),
4351                         BPF_MOV64_IMM(BPF_REG_0, 0),
4352                         BPF_EXIT_INSN(),
4353                 },
4354                 .result = ACCEPT,
4355                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4356         },
4357         {
4358                 "helper access to packet: test20, pkt end as input",
4359                 .insns = {
4360                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4361                                     offsetof(struct __sk_buff, data)),
4362                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4363                                     offsetof(struct __sk_buff, data_end)),
4364                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4365                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4366                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4367                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4368                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
4369                         BPF_MOV64_IMM(BPF_REG_2, 4),
4370                         BPF_MOV64_IMM(BPF_REG_3, 0),
4371                         BPF_MOV64_IMM(BPF_REG_4, 0),
4372                         BPF_MOV64_IMM(BPF_REG_5, 0),
4373                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4374                                      BPF_FUNC_csum_diff),
4375                         BPF_MOV64_IMM(BPF_REG_0, 0),
4376                         BPF_EXIT_INSN(),
4377                 },
4378                 .result = REJECT,
4379                 .errstr = "R1 type=pkt_end expected=fp",
4380                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4381         },
4382         {
4383                 "helper access to packet: test21, wrong reg",
4384                 .insns = {
4385                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
4386                                     offsetof(struct __sk_buff, data)),
4387                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
4388                                     offsetof(struct __sk_buff, data_end)),
4389                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
4390                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
4391                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
4392                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
4393                         BPF_MOV64_IMM(BPF_REG_2, 4),
4394                         BPF_MOV64_IMM(BPF_REG_3, 0),
4395                         BPF_MOV64_IMM(BPF_REG_4, 0),
4396                         BPF_MOV64_IMM(BPF_REG_5, 0),
4397                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4398                                      BPF_FUNC_csum_diff),
4399                         BPF_MOV64_IMM(BPF_REG_0, 0),
4400                         BPF_EXIT_INSN(),
4401                 },
4402                 .result = REJECT,
4403                 .errstr = "invalid access to packet",
4404                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
4405         },
4406         {
4407                 "valid map access into an array with a constant",
4408                 .insns = {
4409                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4410                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4411                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4412                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4413                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4414                                      BPF_FUNC_map_lookup_elem),
4415                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4416                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4417                                    offsetof(struct test_val, foo)),
4418                         BPF_EXIT_INSN(),
4419                 },
4420                 .fixup_map2 = { 3 },
4421                 .errstr_unpriv = "R0 leaks addr",
4422                 .result_unpriv = REJECT,
4423                 .result = ACCEPT,
4424         },
4425         {
4426                 "valid map access into an array with a register",
4427                 .insns = {
4428                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4429                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4430                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4431                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4432                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4433                                      BPF_FUNC_map_lookup_elem),
4434                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4435                         BPF_MOV64_IMM(BPF_REG_1, 4),
4436                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4437                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4438                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4439                                    offsetof(struct test_val, foo)),
4440                         BPF_EXIT_INSN(),
4441                 },
4442                 .fixup_map2 = { 3 },
4443                 .errstr_unpriv = "R0 leaks addr",
4444                 .result_unpriv = REJECT,
4445                 .result = ACCEPT,
4446                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4447         },
4448         {
4449                 "valid map access into an array with a variable",
4450                 .insns = {
4451                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4452                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4453                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4454                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4455                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4456                                      BPF_FUNC_map_lookup_elem),
4457                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
4458                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4459                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 3),
4460                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4461                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4462                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4463                                    offsetof(struct test_val, foo)),
4464                         BPF_EXIT_INSN(),
4465                 },
4466                 .fixup_map2 = { 3 },
4467                 .errstr_unpriv = "R0 leaks addr",
4468                 .result_unpriv = REJECT,
4469                 .result = ACCEPT,
4470                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4471         },
4472         {
4473                 "valid map access into an array with a signed variable",
4474                 .insns = {
4475                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4476                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4477                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4478                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4479                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4480                                      BPF_FUNC_map_lookup_elem),
4481                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
4482                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4483                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 0xffffffff, 1),
4484                         BPF_MOV32_IMM(BPF_REG_1, 0),
4485                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
4486                         BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
4487                         BPF_MOV32_IMM(BPF_REG_1, 0),
4488                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
4489                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4490                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4491                                    offsetof(struct test_val, foo)),
4492                         BPF_EXIT_INSN(),
4493                 },
4494                 .fixup_map2 = { 3 },
4495                 .errstr_unpriv = "R0 leaks addr",
4496                 .result_unpriv = REJECT,
4497                 .result = ACCEPT,
4498                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4499         },
4500         {
4501                 "invalid map access into an array with a constant",
4502                 .insns = {
4503                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4504                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4505                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4506                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4507                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4508                                      BPF_FUNC_map_lookup_elem),
4509                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4510                         BPF_ST_MEM(BPF_DW, BPF_REG_0, (MAX_ENTRIES + 1) << 2,
4511                                    offsetof(struct test_val, foo)),
4512                         BPF_EXIT_INSN(),
4513                 },
4514                 .fixup_map2 = { 3 },
4515                 .errstr = "invalid access to map value, value_size=48 off=48 size=8",
4516                 .result = REJECT,
4517         },
4518         {
4519                 "invalid map access into an array with a register",
4520                 .insns = {
4521                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4522                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4523                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4524                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4525                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4526                                      BPF_FUNC_map_lookup_elem),
4527                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4528                         BPF_MOV64_IMM(BPF_REG_1, MAX_ENTRIES + 1),
4529                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4530                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4531                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4532                                    offsetof(struct test_val, foo)),
4533                         BPF_EXIT_INSN(),
4534                 },
4535                 .fixup_map2 = { 3 },
4536                 .errstr = "R0 min value is outside of the array range",
4537                 .result = REJECT,
4538                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4539         },
4540         {
4541                 "invalid map access into an array with a variable",
4542                 .insns = {
4543                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4544                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4545                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4546                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4547                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4548                                      BPF_FUNC_map_lookup_elem),
4549                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
4550                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4551                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4552                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4553                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4554                                    offsetof(struct test_val, foo)),
4555                         BPF_EXIT_INSN(),
4556                 },
4557                 .fixup_map2 = { 3 },
4558                 .errstr = "R0 unbounded memory access, make sure to bounds check any array access into a map",
4559                 .result = REJECT,
4560                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4561         },
4562         {
4563                 "invalid map access into an array with no floor check",
4564                 .insns = {
4565                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4566                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4567                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4568                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4569                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4570                                      BPF_FUNC_map_lookup_elem),
4571                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4572                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
4573                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
4574                         BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
4575                         BPF_MOV32_IMM(BPF_REG_1, 0),
4576                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
4577                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4578                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4579                                    offsetof(struct test_val, foo)),
4580                         BPF_EXIT_INSN(),
4581                 },
4582                 .fixup_map2 = { 3 },
4583                 .errstr_unpriv = "R0 leaks addr",
4584                 .errstr = "R0 unbounded memory access",
4585                 .result_unpriv = REJECT,
4586                 .result = REJECT,
4587                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4588         },
4589         {
4590                 "invalid map access into an array with a invalid max check",
4591                 .insns = {
4592                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4593                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4594                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4595                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4596                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4597                                      BPF_FUNC_map_lookup_elem),
4598                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
4599                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4600                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES + 1),
4601                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
4602                         BPF_MOV32_IMM(BPF_REG_1, 0),
4603                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
4604                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4605                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
4606                                    offsetof(struct test_val, foo)),
4607                         BPF_EXIT_INSN(),
4608                 },
4609                 .fixup_map2 = { 3 },
4610                 .errstr_unpriv = "R0 leaks addr",
4611                 .errstr = "invalid access to map value, value_size=48 off=44 size=8",
4612                 .result_unpriv = REJECT,
4613                 .result = REJECT,
4614                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4615         },
4616         {
4617                 "invalid map access into an array with a invalid max check",
4618                 .insns = {
4619                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4620                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4621                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4622                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4623                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4624                                      BPF_FUNC_map_lookup_elem),
4625                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
4626                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
4627                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4628                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4629                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4630                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4631                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4632                                      BPF_FUNC_map_lookup_elem),
4633                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
4634                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
4635                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
4636                                     offsetof(struct test_val, foo)),
4637                         BPF_EXIT_INSN(),
4638                 },
4639                 .fixup_map2 = { 3, 11 },
4640                 .errstr = "R0 pointer += pointer",
4641                 .result = REJECT,
4642                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4643         },
4644         {
4645                 "valid cgroup storage access",
4646                 .insns = {
4647                         BPF_MOV64_IMM(BPF_REG_2, 0),
4648                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4649                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4650                                      BPF_FUNC_get_local_storage),
4651                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4652                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
4653                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
4654                         BPF_EXIT_INSN(),
4655                 },
4656                 .fixup_cgroup_storage = { 1 },
4657                 .result = ACCEPT,
4658                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4659         },
4660         {
4661                 "invalid cgroup storage access 1",
4662                 .insns = {
4663                         BPF_MOV64_IMM(BPF_REG_2, 0),
4664                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4665                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4666                                      BPF_FUNC_get_local_storage),
4667                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4668                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
4669                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
4670                         BPF_EXIT_INSN(),
4671                 },
4672                 .fixup_map1 = { 1 },
4673                 .result = REJECT,
4674                 .errstr = "cannot pass map_type 1 into func bpf_get_local_storage",
4675                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4676         },
4677         {
4678                 "invalid cgroup storage access 2",
4679                 .insns = {
4680                         BPF_MOV64_IMM(BPF_REG_2, 0),
4681                         BPF_LD_MAP_FD(BPF_REG_1, 1),
4682                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4683                                      BPF_FUNC_get_local_storage),
4684                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
4685                         BPF_EXIT_INSN(),
4686                 },
4687                 .result = REJECT,
4688                 .errstr = "fd 1 is not pointing to valid bpf_map",
4689                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4690         },
4691         {
4692                 "invalid per-cgroup storage access 3",
4693                 .insns = {
4694                         BPF_MOV64_IMM(BPF_REG_2, 0),
4695                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4696                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4697                                      BPF_FUNC_get_local_storage),
4698                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 256),
4699                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
4700                         BPF_MOV64_IMM(BPF_REG_0, 0),
4701                         BPF_EXIT_INSN(),
4702                 },
4703                 .fixup_cgroup_storage = { 1 },
4704                 .result = REJECT,
4705                 .errstr = "invalid access to map value, value_size=64 off=256 size=4",
4706                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4707         },
4708         {
4709                 "invalid cgroup storage access 4",
4710                 .insns = {
4711                         BPF_MOV64_IMM(BPF_REG_2, 0),
4712                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4713                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4714                                      BPF_FUNC_get_local_storage),
4715                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, -2),
4716                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
4717                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
4718                         BPF_EXIT_INSN(),
4719                 },
4720                 .fixup_cgroup_storage = { 1 },
4721                 .result = REJECT,
4722                 .errstr = "invalid access to map value, value_size=64 off=-2 size=4",
4723                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4724         },
4725         {
4726                 "invalid cgroup storage access 5",
4727                 .insns = {
4728                         BPF_MOV64_IMM(BPF_REG_2, 7),
4729                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4730                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4731                                      BPF_FUNC_get_local_storage),
4732                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4733                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
4734                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
4735                         BPF_EXIT_INSN(),
4736                 },
4737                 .fixup_cgroup_storage = { 1 },
4738                 .result = REJECT,
4739                 .errstr = "get_local_storage() doesn't support non-zero flags",
4740                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4741         },
4742         {
4743                 "invalid cgroup storage access 6",
4744                 .insns = {
4745                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
4746                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4747                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4748                                      BPF_FUNC_get_local_storage),
4749                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4750                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
4751                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
4752                         BPF_EXIT_INSN(),
4753                 },
4754                 .fixup_cgroup_storage = { 1 },
4755                 .result = REJECT,
4756                 .errstr = "get_local_storage() doesn't support non-zero flags",
4757                 .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
4758         },
4759         {
4760                 "multiple registers share map_lookup_elem result",
4761                 .insns = {
4762                         BPF_MOV64_IMM(BPF_REG_1, 10),
4763                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4764                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4765                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4766                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4767                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4768                                      BPF_FUNC_map_lookup_elem),
4769                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4770                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4771                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4772                         BPF_EXIT_INSN(),
4773                 },
4774                 .fixup_map1 = { 4 },
4775                 .result = ACCEPT,
4776                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4777         },
4778         {
4779                 "alu ops on ptr_to_map_value_or_null, 1",
4780                 .insns = {
4781                         BPF_MOV64_IMM(BPF_REG_1, 10),
4782                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4783                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4784                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4785                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4786                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4787                                      BPF_FUNC_map_lookup_elem),
4788                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4789                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -2),
4790                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 2),
4791                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4792                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4793                         BPF_EXIT_INSN(),
4794                 },
4795                 .fixup_map1 = { 4 },
4796                 .errstr = "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",
4797                 .result = REJECT,
4798                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4799         },
4800         {
4801                 "alu ops on ptr_to_map_value_or_null, 2",
4802                 .insns = {
4803                         BPF_MOV64_IMM(BPF_REG_1, 10),
4804                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4805                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4806                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4807                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4808                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4809                                      BPF_FUNC_map_lookup_elem),
4810                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4811                         BPF_ALU64_IMM(BPF_AND, BPF_REG_4, -1),
4812                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4813                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4814                         BPF_EXIT_INSN(),
4815                 },
4816                 .fixup_map1 = { 4 },
4817                 .errstr = "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",
4818                 .result = REJECT,
4819                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4820         },
4821         {
4822                 "alu ops on ptr_to_map_value_or_null, 3",
4823                 .insns = {
4824                         BPF_MOV64_IMM(BPF_REG_1, 10),
4825                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4826                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4827                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4828                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4829                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4830                                      BPF_FUNC_map_lookup_elem),
4831                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4832                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_4, 1),
4833                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4834                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4835                         BPF_EXIT_INSN(),
4836                 },
4837                 .fixup_map1 = { 4 },
4838                 .errstr = "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",
4839                 .result = REJECT,
4840                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4841         },
4842         {
4843                 "invalid memory access with multiple map_lookup_elem calls",
4844                 .insns = {
4845                         BPF_MOV64_IMM(BPF_REG_1, 10),
4846                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4847                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4848                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4849                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4850                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
4851                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
4852                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4853                                      BPF_FUNC_map_lookup_elem),
4854                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4855                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
4856                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
4857                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4858                                      BPF_FUNC_map_lookup_elem),
4859                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4860                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4861                         BPF_EXIT_INSN(),
4862                 },
4863                 .fixup_map1 = { 4 },
4864                 .result = REJECT,
4865                 .errstr = "R4 !read_ok",
4866                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4867         },
4868         {
4869                 "valid indirect map_lookup_elem access with 2nd lookup in branch",
4870                 .insns = {
4871                         BPF_MOV64_IMM(BPF_REG_1, 10),
4872                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
4873                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4874                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4875                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4876                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
4877                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
4878                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4879                                      BPF_FUNC_map_lookup_elem),
4880                         BPF_MOV64_IMM(BPF_REG_2, 10),
4881                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 3),
4882                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
4883                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
4884                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
4885                                      BPF_FUNC_map_lookup_elem),
4886                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
4887                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
4888                         BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
4889                         BPF_EXIT_INSN(),
4890                 },
4891                 .fixup_map1 = { 4 },
4892                 .result = ACCEPT,
4893                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
4894         },
4895         {
4896                 "invalid map access from else condition",
4897                 .insns = {
4898                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
4899                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
4900                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
4901                         BPF_LD_MAP_FD(BPF_REG_1, 0),
4902                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
4903                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
4904                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
4905                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES-1, 1),
4906                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
4907                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
4908                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
4909                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
4910                         BPF_EXIT_INSN(),
4911                 },
4912                 .fixup_map2 = { 3 },
4913                 .errstr = "R0 unbounded memory access",
4914                 .result = REJECT,
4915                 .errstr_unpriv = "R0 leaks addr",
4916                 .result_unpriv = REJECT,
4917                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
4918         },
4919         {
4920                 "constant register |= constant should keep constant type",
4921                 .insns = {
4922                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4923                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
4924                         BPF_MOV64_IMM(BPF_REG_2, 34),
4925                         BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 13),
4926                         BPF_MOV64_IMM(BPF_REG_3, 0),
4927                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4928                         BPF_EXIT_INSN(),
4929                 },
4930                 .result = ACCEPT,
4931                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4932         },
4933         {
4934                 "constant register |= constant should not bypass stack boundary checks",
4935                 .insns = {
4936                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4937                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
4938                         BPF_MOV64_IMM(BPF_REG_2, 34),
4939                         BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 24),
4940                         BPF_MOV64_IMM(BPF_REG_3, 0),
4941                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4942                         BPF_EXIT_INSN(),
4943                 },
4944                 .errstr = "invalid stack type R1 off=-48 access_size=58",
4945                 .result = REJECT,
4946                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4947         },
4948         {
4949                 "constant register |= constant register should keep constant type",
4950                 .insns = {
4951                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4952                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
4953                         BPF_MOV64_IMM(BPF_REG_2, 34),
4954                         BPF_MOV64_IMM(BPF_REG_4, 13),
4955                         BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
4956                         BPF_MOV64_IMM(BPF_REG_3, 0),
4957                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4958                         BPF_EXIT_INSN(),
4959                 },
4960                 .result = ACCEPT,
4961                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4962         },
4963         {
4964                 "constant register |= constant register should not bypass stack boundary checks",
4965                 .insns = {
4966                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
4967                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
4968                         BPF_MOV64_IMM(BPF_REG_2, 34),
4969                         BPF_MOV64_IMM(BPF_REG_4, 24),
4970                         BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
4971                         BPF_MOV64_IMM(BPF_REG_3, 0),
4972                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
4973                         BPF_EXIT_INSN(),
4974                 },
4975                 .errstr = "invalid stack type R1 off=-48 access_size=58",
4976                 .result = REJECT,
4977                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
4978         },
4979         {
4980                 "invalid direct packet write for LWT_IN",
4981                 .insns = {
4982                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
4983                                     offsetof(struct __sk_buff, data)),
4984                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
4985                                     offsetof(struct __sk_buff, data_end)),
4986                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
4987                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
4988                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
4989                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
4990                         BPF_MOV64_IMM(BPF_REG_0, 0),
4991                         BPF_EXIT_INSN(),
4992                 },
4993                 .errstr = "cannot write into packet",
4994                 .result = REJECT,
4995                 .prog_type = BPF_PROG_TYPE_LWT_IN,
4996         },
4997         {
4998                 "invalid direct packet write for LWT_OUT",
4999                 .insns = {
5000                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5001                                     offsetof(struct __sk_buff, data)),
5002                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5003                                     offsetof(struct __sk_buff, data_end)),
5004                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5005                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5006                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5007                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
5008                         BPF_MOV64_IMM(BPF_REG_0, 0),
5009                         BPF_EXIT_INSN(),
5010                 },
5011                 .errstr = "cannot write into packet",
5012                 .result = REJECT,
5013                 .prog_type = BPF_PROG_TYPE_LWT_OUT,
5014         },
5015         {
5016                 "direct packet write for LWT_XMIT",
5017                 .insns = {
5018                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5019                                     offsetof(struct __sk_buff, data)),
5020                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5021                                     offsetof(struct __sk_buff, data_end)),
5022                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5023                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5024                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5025                         BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
5026                         BPF_MOV64_IMM(BPF_REG_0, 0),
5027                         BPF_EXIT_INSN(),
5028                 },
5029                 .result = ACCEPT,
5030                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
5031         },
5032         {
5033                 "direct packet read for LWT_IN",
5034                 .insns = {
5035                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5036                                     offsetof(struct __sk_buff, data)),
5037                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5038                                     offsetof(struct __sk_buff, data_end)),
5039                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5040                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5041                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5042                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
5043                         BPF_MOV64_IMM(BPF_REG_0, 0),
5044                         BPF_EXIT_INSN(),
5045                 },
5046                 .result = ACCEPT,
5047                 .prog_type = BPF_PROG_TYPE_LWT_IN,
5048         },
5049         {
5050                 "direct packet read for LWT_OUT",
5051                 .insns = {
5052                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5053                                     offsetof(struct __sk_buff, data)),
5054                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5055                                     offsetof(struct __sk_buff, data_end)),
5056                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5057                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5058                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5059                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
5060                         BPF_MOV64_IMM(BPF_REG_0, 0),
5061                         BPF_EXIT_INSN(),
5062                 },
5063                 .result = ACCEPT,
5064                 .prog_type = BPF_PROG_TYPE_LWT_OUT,
5065         },
5066         {
5067                 "direct packet read for LWT_XMIT",
5068                 .insns = {
5069                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5070                                     offsetof(struct __sk_buff, data)),
5071                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5072                                     offsetof(struct __sk_buff, data_end)),
5073                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5074                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5075                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
5076                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
5077                         BPF_MOV64_IMM(BPF_REG_0, 0),
5078                         BPF_EXIT_INSN(),
5079                 },
5080                 .result = ACCEPT,
5081                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
5082         },
5083         {
5084                 "overlapping checks for direct packet access",
5085                 .insns = {
5086                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
5087                                     offsetof(struct __sk_buff, data)),
5088                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
5089                                     offsetof(struct __sk_buff, data_end)),
5090                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
5091                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
5092                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
5093                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
5094                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
5095                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
5096                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
5097                         BPF_MOV64_IMM(BPF_REG_0, 0),
5098                         BPF_EXIT_INSN(),
5099                 },
5100                 .result = ACCEPT,
5101                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
5102         },
5103         {
5104                 "make headroom for LWT_XMIT",
5105                 .insns = {
5106                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5107                         BPF_MOV64_IMM(BPF_REG_2, 34),
5108                         BPF_MOV64_IMM(BPF_REG_3, 0),
5109                         BPF_EMIT_CALL(BPF_FUNC_skb_change_head),
5110                         /* split for s390 to succeed */
5111                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
5112                         BPF_MOV64_IMM(BPF_REG_2, 42),
5113                         BPF_MOV64_IMM(BPF_REG_3, 0),
5114                         BPF_EMIT_CALL(BPF_FUNC_skb_change_head),
5115                         BPF_MOV64_IMM(BPF_REG_0, 0),
5116                         BPF_EXIT_INSN(),
5117                 },
5118                 .result = ACCEPT,
5119                 .prog_type = BPF_PROG_TYPE_LWT_XMIT,
5120         },
5121         {
5122                 "invalid access of tc_classid for LWT_IN",
5123                 .insns = {
5124                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
5125                                     offsetof(struct __sk_buff, tc_classid)),
5126                         BPF_EXIT_INSN(),
5127                 },
5128                 .result = REJECT,
5129                 .errstr = "invalid bpf_context access",
5130         },
5131         {
5132                 "invalid access of tc_classid for LWT_OUT",
5133                 .insns = {
5134                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
5135                                     offsetof(struct __sk_buff, tc_classid)),
5136                         BPF_EXIT_INSN(),
5137                 },
5138                 .result = REJECT,
5139                 .errstr = "invalid bpf_context access",
5140         },
5141         {
5142                 "invalid access of tc_classid for LWT_XMIT",
5143                 .insns = {
5144                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
5145                                     offsetof(struct __sk_buff, tc_classid)),
5146                         BPF_EXIT_INSN(),
5147                 },
5148                 .result = REJECT,
5149                 .errstr = "invalid bpf_context access",
5150         },
5151         {
5152                 "leak pointer into ctx 1",
5153                 .insns = {
5154                         BPF_MOV64_IMM(BPF_REG_0, 0),
5155                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
5156                                     offsetof(struct __sk_buff, cb[0])),
5157                         BPF_LD_MAP_FD(BPF_REG_2, 0),
5158                         BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_2,
5159                                       offsetof(struct __sk_buff, cb[0])),
5160                         BPF_EXIT_INSN(),
5161                 },
5162                 .fixup_map1 = { 2 },
5163                 .errstr_unpriv = "R2 leaks addr into mem",
5164                 .result_unpriv = REJECT,
5165                 .result = REJECT,
5166                 .errstr = "BPF_XADD stores into R1 context is not allowed",
5167         },
5168         {
5169                 "leak pointer into ctx 2",
5170                 .insns = {
5171                         BPF_MOV64_IMM(BPF_REG_0, 0),
5172                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
5173                                     offsetof(struct __sk_buff, cb[0])),
5174                         BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_10,
5175                                       offsetof(struct __sk_buff, cb[0])),
5176                         BPF_EXIT_INSN(),
5177                 },
5178                 .errstr_unpriv = "R10 leaks addr into mem",
5179                 .result_unpriv = REJECT,
5180                 .result = REJECT,
5181                 .errstr = "BPF_XADD stores into R1 context is not allowed",
5182         },
5183         {
5184                 "leak pointer into ctx 3",
5185                 .insns = {
5186                         BPF_MOV64_IMM(BPF_REG_0, 0),
5187                         BPF_LD_MAP_FD(BPF_REG_2, 0),
5188                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2,
5189                                       offsetof(struct __sk_buff, cb[0])),
5190                         BPF_EXIT_INSN(),
5191                 },
5192                 .fixup_map1 = { 1 },
5193                 .errstr_unpriv = "R2 leaks addr into ctx",
5194                 .result_unpriv = REJECT,
5195                 .result = ACCEPT,
5196         },
5197         {
5198                 "leak pointer into map val",
5199                 .insns = {
5200                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
5201                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
5202                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5203                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5204                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5205                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
5206                                      BPF_FUNC_map_lookup_elem),
5207                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
5208                         BPF_MOV64_IMM(BPF_REG_3, 0),
5209                         BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
5210                         BPF_STX_XADD(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
5211                         BPF_MOV64_IMM(BPF_REG_0, 0),
5212                         BPF_EXIT_INSN(),
5213                 },
5214                 .fixup_map1 = { 4 },
5215                 .errstr_unpriv = "R6 leaks addr into mem",
5216                 .result_unpriv = REJECT,
5217                 .result = ACCEPT,
5218         },
5219         {
5220                 "helper access to map: full range",
5221                 .insns = {
5222                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5223                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5224                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5225                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5226                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5227                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5228                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5229                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
5230                         BPF_MOV64_IMM(BPF_REG_3, 0),
5231                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5232                         BPF_EXIT_INSN(),
5233                 },
5234                 .fixup_map2 = { 3 },
5235                 .result = ACCEPT,
5236                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5237         },
5238         {
5239                 "helper access to map: partial range",
5240                 .insns = {
5241                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5242                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5243                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5244                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5245                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5246                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5247                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5248                         BPF_MOV64_IMM(BPF_REG_2, 8),
5249                         BPF_MOV64_IMM(BPF_REG_3, 0),
5250                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5251                         BPF_EXIT_INSN(),
5252                 },
5253                 .fixup_map2 = { 3 },
5254                 .result = ACCEPT,
5255                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5256         },
5257         {
5258                 "helper access to map: empty range",
5259                 .insns = {
5260                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5261                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5262                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5263                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5264                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5265                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
5266                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5267                         BPF_MOV64_IMM(BPF_REG_2, 0),
5268                         BPF_EMIT_CALL(BPF_FUNC_trace_printk),
5269                         BPF_EXIT_INSN(),
5270                 },
5271                 .fixup_map2 = { 3 },
5272                 .errstr = "invalid access to map value, value_size=48 off=0 size=0",
5273                 .result = REJECT,
5274                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5275         },
5276         {
5277                 "helper access to map: out-of-bound range",
5278                 .insns = {
5279                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5280                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5281                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5282                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5283                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5284                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5285                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5286                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val) + 8),
5287                         BPF_MOV64_IMM(BPF_REG_3, 0),
5288                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5289                         BPF_EXIT_INSN(),
5290                 },
5291                 .fixup_map2 = { 3 },
5292                 .errstr = "invalid access to map value, value_size=48 off=0 size=56",
5293                 .result = REJECT,
5294                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5295         },
5296         {
5297                 "helper access to map: negative range",
5298                 .insns = {
5299                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5300                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5301                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5302                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5303                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5304                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5305                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5306                         BPF_MOV64_IMM(BPF_REG_2, -8),
5307                         BPF_MOV64_IMM(BPF_REG_3, 0),
5308                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5309                         BPF_EXIT_INSN(),
5310                 },
5311                 .fixup_map2 = { 3 },
5312                 .errstr = "R2 min value is negative",
5313                 .result = REJECT,
5314                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5315         },
5316         {
5317                 "helper access to adjusted map (via const imm): full range",
5318                 .insns = {
5319                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5320                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5321                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5322                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5323                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5324                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5325                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5326                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5327                                 offsetof(struct test_val, foo)),
5328                         BPF_MOV64_IMM(BPF_REG_2,
5329                                 sizeof(struct test_val) -
5330                                 offsetof(struct test_val, foo)),
5331                         BPF_MOV64_IMM(BPF_REG_3, 0),
5332                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5333                         BPF_EXIT_INSN(),
5334                 },
5335                 .fixup_map2 = { 3 },
5336                 .result = ACCEPT,
5337                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5338         },
5339         {
5340                 "helper access to adjusted map (via const imm): partial range",
5341                 .insns = {
5342                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5343                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5344                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5345                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5346                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5347                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5348                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5349                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5350                                 offsetof(struct test_val, foo)),
5351                         BPF_MOV64_IMM(BPF_REG_2, 8),
5352                         BPF_MOV64_IMM(BPF_REG_3, 0),
5353                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5354                         BPF_EXIT_INSN(),
5355                 },
5356                 .fixup_map2 = { 3 },
5357                 .result = ACCEPT,
5358                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5359         },
5360         {
5361                 "helper access to adjusted map (via const imm): empty range",
5362                 .insns = {
5363                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5364                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5365                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5366                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5367                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5368                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5369                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5370                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5371                                 offsetof(struct test_val, foo)),
5372                         BPF_MOV64_IMM(BPF_REG_2, 0),
5373                         BPF_EMIT_CALL(BPF_FUNC_trace_printk),
5374                         BPF_EXIT_INSN(),
5375                 },
5376                 .fixup_map2 = { 3 },
5377                 .errstr = "invalid access to map value, value_size=48 off=4 size=0",
5378                 .result = REJECT,
5379                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5380         },
5381         {
5382                 "helper access to adjusted map (via const imm): out-of-bound range",
5383                 .insns = {
5384                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5385                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5386                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5387                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5388                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5389                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5390                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5391                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5392                                 offsetof(struct test_val, foo)),
5393                         BPF_MOV64_IMM(BPF_REG_2,
5394                                 sizeof(struct test_val) -
5395                                 offsetof(struct test_val, foo) + 8),
5396                         BPF_MOV64_IMM(BPF_REG_3, 0),
5397                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5398                         BPF_EXIT_INSN(),
5399                 },
5400                 .fixup_map2 = { 3 },
5401                 .errstr = "invalid access to map value, value_size=48 off=4 size=52",
5402                 .result = REJECT,
5403                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5404         },
5405         {
5406                 "helper access to adjusted map (via const imm): negative range (> adjustment)",
5407                 .insns = {
5408                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5409                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5410                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5411                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5412                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5413                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5414                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5415                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5416                                 offsetof(struct test_val, foo)),
5417                         BPF_MOV64_IMM(BPF_REG_2, -8),
5418                         BPF_MOV64_IMM(BPF_REG_3, 0),
5419                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5420                         BPF_EXIT_INSN(),
5421                 },
5422                 .fixup_map2 = { 3 },
5423                 .errstr = "R2 min value is negative",
5424                 .result = REJECT,
5425                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5426         },
5427         {
5428                 "helper access to adjusted map (via const imm): negative range (< adjustment)",
5429                 .insns = {
5430                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5431                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5432                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5433                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5434                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5435                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5436                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5437                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
5438                                 offsetof(struct test_val, foo)),
5439                         BPF_MOV64_IMM(BPF_REG_2, -1),
5440                         BPF_MOV64_IMM(BPF_REG_3, 0),
5441                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5442                         BPF_EXIT_INSN(),
5443                 },
5444                 .fixup_map2 = { 3 },
5445                 .errstr = "R2 min value is negative",
5446                 .result = REJECT,
5447                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5448         },
5449         {
5450                 "helper access to adjusted map (via const reg): full range",
5451                 .insns = {
5452                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5453                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5454                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5455                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5456                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5457                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5458                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5459                         BPF_MOV64_IMM(BPF_REG_3,
5460                                 offsetof(struct test_val, foo)),
5461                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5462                         BPF_MOV64_IMM(BPF_REG_2,
5463                                 sizeof(struct test_val) -
5464                                 offsetof(struct test_val, foo)),
5465                         BPF_MOV64_IMM(BPF_REG_3, 0),
5466                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5467                         BPF_EXIT_INSN(),
5468                 },
5469                 .fixup_map2 = { 3 },
5470                 .result = ACCEPT,
5471                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5472         },
5473         {
5474                 "helper access to adjusted map (via const reg): partial range",
5475                 .insns = {
5476                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5477                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5478                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5479                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5480                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5481                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5482                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5483                         BPF_MOV64_IMM(BPF_REG_3,
5484                                 offsetof(struct test_val, foo)),
5485                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5486                         BPF_MOV64_IMM(BPF_REG_2, 8),
5487                         BPF_MOV64_IMM(BPF_REG_3, 0),
5488                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5489                         BPF_EXIT_INSN(),
5490                 },
5491                 .fixup_map2 = { 3 },
5492                 .result = ACCEPT,
5493                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5494         },
5495         {
5496                 "helper access to adjusted map (via const reg): empty range",
5497                 .insns = {
5498                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5499                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5500                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5501                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5502                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5503                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
5504                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5505                         BPF_MOV64_IMM(BPF_REG_3, 0),
5506                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5507                         BPF_MOV64_IMM(BPF_REG_2, 0),
5508                         BPF_EMIT_CALL(BPF_FUNC_trace_printk),
5509                         BPF_EXIT_INSN(),
5510                 },
5511                 .fixup_map2 = { 3 },
5512                 .errstr = "R1 min value is outside of the array range",
5513                 .result = REJECT,
5514                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5515         },
5516         {
5517                 "helper access to adjusted map (via const reg): out-of-bound range",
5518                 .insns = {
5519                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5520                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5521                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5522                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5523                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5524                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5525                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5526                         BPF_MOV64_IMM(BPF_REG_3,
5527                                 offsetof(struct test_val, foo)),
5528                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5529                         BPF_MOV64_IMM(BPF_REG_2,
5530                                 sizeof(struct test_val) -
5531                                 offsetof(struct test_val, foo) + 8),
5532                         BPF_MOV64_IMM(BPF_REG_3, 0),
5533                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5534                         BPF_EXIT_INSN(),
5535                 },
5536                 .fixup_map2 = { 3 },
5537                 .errstr = "invalid access to map value, value_size=48 off=4 size=52",
5538                 .result = REJECT,
5539                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5540         },
5541         {
5542                 "helper access to adjusted map (via const reg): negative range (> adjustment)",
5543                 .insns = {
5544                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5545                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5546                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5547                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5548                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5549                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5550                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5551                         BPF_MOV64_IMM(BPF_REG_3,
5552                                 offsetof(struct test_val, foo)),
5553                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5554                         BPF_MOV64_IMM(BPF_REG_2, -8),
5555                         BPF_MOV64_IMM(BPF_REG_3, 0),
5556                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5557                         BPF_EXIT_INSN(),
5558                 },
5559                 .fixup_map2 = { 3 },
5560                 .errstr = "R2 min value is negative",
5561                 .result = REJECT,
5562                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5563         },
5564         {
5565                 "helper access to adjusted map (via const reg): negative range (< adjustment)",
5566                 .insns = {
5567                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5568                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5569                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5570                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5571                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5572                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5573                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5574                         BPF_MOV64_IMM(BPF_REG_3,
5575                                 offsetof(struct test_val, foo)),
5576                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5577                         BPF_MOV64_IMM(BPF_REG_2, -1),
5578                         BPF_MOV64_IMM(BPF_REG_3, 0),
5579                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5580                         BPF_EXIT_INSN(),
5581                 },
5582                 .fixup_map2 = { 3 },
5583                 .errstr = "R2 min value is negative",
5584                 .result = REJECT,
5585                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5586         },
5587         {
5588                 "helper access to adjusted map (via variable): full range",
5589                 .insns = {
5590                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5591                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5592                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5593                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5594                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5595                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5596                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5597                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5598                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
5599                                 offsetof(struct test_val, foo), 4),
5600                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5601                         BPF_MOV64_IMM(BPF_REG_2,
5602                                 sizeof(struct test_val) -
5603                                 offsetof(struct test_val, foo)),
5604                         BPF_MOV64_IMM(BPF_REG_3, 0),
5605                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5606                         BPF_EXIT_INSN(),
5607                 },
5608                 .fixup_map2 = { 3 },
5609                 .result = ACCEPT,
5610                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5611         },
5612         {
5613                 "helper access to adjusted map (via variable): partial range",
5614                 .insns = {
5615                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5616                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5617                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5618                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5619                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5620                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5621                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5622                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5623                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
5624                                 offsetof(struct test_val, foo), 4),
5625                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5626                         BPF_MOV64_IMM(BPF_REG_2, 8),
5627                         BPF_MOV64_IMM(BPF_REG_3, 0),
5628                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5629                         BPF_EXIT_INSN(),
5630                 },
5631                 .fixup_map2 = { 3 },
5632                 .result = ACCEPT,
5633                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5634         },
5635         {
5636                 "helper access to adjusted map (via variable): empty range",
5637                 .insns = {
5638                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5639                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5640                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5641                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5642                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5643                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5644                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5645                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5646                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
5647                                 offsetof(struct test_val, foo), 3),
5648                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5649                         BPF_MOV64_IMM(BPF_REG_2, 0),
5650                         BPF_EMIT_CALL(BPF_FUNC_trace_printk),
5651                         BPF_EXIT_INSN(),
5652                 },
5653                 .fixup_map2 = { 3 },
5654                 .errstr = "R1 min value is outside of the array range",
5655                 .result = REJECT,
5656                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5657         },
5658         {
5659                 "helper access to adjusted map (via variable): no max check",
5660                 .insns = {
5661                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5662                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5663                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5664                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5665                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5666                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5667                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5668                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5669                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5670                         BPF_MOV64_IMM(BPF_REG_2, 1),
5671                         BPF_MOV64_IMM(BPF_REG_3, 0),
5672                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5673                         BPF_EXIT_INSN(),
5674                 },
5675                 .fixup_map2 = { 3 },
5676                 .errstr = "R1 unbounded memory access",
5677                 .result = REJECT,
5678                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5679         },
5680         {
5681                 "helper access to adjusted map (via variable): wrong max check",
5682                 .insns = {
5683                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5684                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5685                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5686                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5687                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5688                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
5689                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5690                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5691                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
5692                                 offsetof(struct test_val, foo), 4),
5693                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5694                         BPF_MOV64_IMM(BPF_REG_2,
5695                                 sizeof(struct test_val) -
5696                                 offsetof(struct test_val, foo) + 1),
5697                         BPF_MOV64_IMM(BPF_REG_3, 0),
5698                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
5699                         BPF_EXIT_INSN(),
5700                 },
5701                 .fixup_map2 = { 3 },
5702                 .errstr = "invalid access to map value, value_size=48 off=4 size=45",
5703                 .result = REJECT,
5704                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5705         },
5706         {
5707                 "helper access to map: bounds check using <, good access",
5708                 .insns = {
5709                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5710                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5711                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5712                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5713                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5714                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5715                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5716                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5717                         BPF_JMP_IMM(BPF_JLT, BPF_REG_3, 32, 2),
5718                         BPF_MOV64_IMM(BPF_REG_0, 0),
5719                         BPF_EXIT_INSN(),
5720                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5721                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5722                         BPF_MOV64_IMM(BPF_REG_0, 0),
5723                         BPF_EXIT_INSN(),
5724                 },
5725                 .fixup_map2 = { 3 },
5726                 .result = ACCEPT,
5727                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5728         },
5729         {
5730                 "helper access to map: bounds check using <, bad access",
5731                 .insns = {
5732                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5733                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5734                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5735                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5736                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5737                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5738                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5739                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5740                         BPF_JMP_IMM(BPF_JLT, BPF_REG_3, 32, 4),
5741                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5742                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5743                         BPF_MOV64_IMM(BPF_REG_0, 0),
5744                         BPF_EXIT_INSN(),
5745                         BPF_MOV64_IMM(BPF_REG_0, 0),
5746                         BPF_EXIT_INSN(),
5747                 },
5748                 .fixup_map2 = { 3 },
5749                 .result = REJECT,
5750                 .errstr = "R1 unbounded memory access",
5751                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5752         },
5753         {
5754                 "helper access to map: bounds check using <=, good access",
5755                 .insns = {
5756                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5757                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5758                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5759                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5760                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5761                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5762                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5763                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5764                         BPF_JMP_IMM(BPF_JLE, BPF_REG_3, 32, 2),
5765                         BPF_MOV64_IMM(BPF_REG_0, 0),
5766                         BPF_EXIT_INSN(),
5767                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5768                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5769                         BPF_MOV64_IMM(BPF_REG_0, 0),
5770                         BPF_EXIT_INSN(),
5771                 },
5772                 .fixup_map2 = { 3 },
5773                 .result = ACCEPT,
5774                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5775         },
5776         {
5777                 "helper access to map: bounds check using <=, bad access",
5778                 .insns = {
5779                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5780                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5781                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5782                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5783                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5784                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5785                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5786                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5787                         BPF_JMP_IMM(BPF_JLE, BPF_REG_3, 32, 4),
5788                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5789                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5790                         BPF_MOV64_IMM(BPF_REG_0, 0),
5791                         BPF_EXIT_INSN(),
5792                         BPF_MOV64_IMM(BPF_REG_0, 0),
5793                         BPF_EXIT_INSN(),
5794                 },
5795                 .fixup_map2 = { 3 },
5796                 .result = REJECT,
5797                 .errstr = "R1 unbounded memory access",
5798                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5799         },
5800         {
5801                 "helper access to map: bounds check using s<, good access",
5802                 .insns = {
5803                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5804                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5805                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5806                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5807                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5808                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5809                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5810                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5811                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
5812                         BPF_MOV64_IMM(BPF_REG_0, 0),
5813                         BPF_EXIT_INSN(),
5814                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 0, -3),
5815                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5816                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5817                         BPF_MOV64_IMM(BPF_REG_0, 0),
5818                         BPF_EXIT_INSN(),
5819                 },
5820                 .fixup_map2 = { 3 },
5821                 .result = ACCEPT,
5822                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5823         },
5824         {
5825                 "helper access to map: bounds check using s<, good access 2",
5826                 .insns = {
5827                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5828                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5829                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5830                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5831                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5832                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5833                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5834                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5835                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
5836                         BPF_MOV64_IMM(BPF_REG_0, 0),
5837                         BPF_EXIT_INSN(),
5838                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, -3, -3),
5839                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5840                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5841                         BPF_MOV64_IMM(BPF_REG_0, 0),
5842                         BPF_EXIT_INSN(),
5843                 },
5844                 .fixup_map2 = { 3 },
5845                 .result = ACCEPT,
5846                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5847         },
5848         {
5849                 "helper access to map: bounds check using s<, bad access",
5850                 .insns = {
5851                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5852                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5853                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5854                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5855                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5856                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5857                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5858                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
5859                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
5860                         BPF_MOV64_IMM(BPF_REG_0, 0),
5861                         BPF_EXIT_INSN(),
5862                         BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, -3, -3),
5863                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5864                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5865                         BPF_MOV64_IMM(BPF_REG_0, 0),
5866                         BPF_EXIT_INSN(),
5867                 },
5868                 .fixup_map2 = { 3 },
5869                 .result = REJECT,
5870                 .errstr = "R1 min value is negative",
5871                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5872         },
5873         {
5874                 "helper access to map: bounds check using s<=, good access",
5875                 .insns = {
5876                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5877                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5878                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5879                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5880                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5881                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5882                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5883                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5884                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
5885                         BPF_MOV64_IMM(BPF_REG_0, 0),
5886                         BPF_EXIT_INSN(),
5887                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 0, -3),
5888                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5889                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5890                         BPF_MOV64_IMM(BPF_REG_0, 0),
5891                         BPF_EXIT_INSN(),
5892                 },
5893                 .fixup_map2 = { 3 },
5894                 .result = ACCEPT,
5895                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5896         },
5897         {
5898                 "helper access to map: bounds check using s<=, good access 2",
5899                 .insns = {
5900                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5901                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5902                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5903                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5904                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5905                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5906                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5907                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
5908                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
5909                         BPF_MOV64_IMM(BPF_REG_0, 0),
5910                         BPF_EXIT_INSN(),
5911                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, -3, -3),
5912                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5913                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5914                         BPF_MOV64_IMM(BPF_REG_0, 0),
5915                         BPF_EXIT_INSN(),
5916                 },
5917                 .fixup_map2 = { 3 },
5918                 .result = ACCEPT,
5919                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5920         },
5921         {
5922                 "helper access to map: bounds check using s<=, bad access",
5923                 .insns = {
5924                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5925                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5926                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5927                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5928                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5929                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5930                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
5931                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
5932                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
5933                         BPF_MOV64_IMM(BPF_REG_0, 0),
5934                         BPF_EXIT_INSN(),
5935                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, -3, -3),
5936                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
5937                         BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
5938                         BPF_MOV64_IMM(BPF_REG_0, 0),
5939                         BPF_EXIT_INSN(),
5940                 },
5941                 .fixup_map2 = { 3 },
5942                 .result = REJECT,
5943                 .errstr = "R1 min value is negative",
5944                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5945         },
5946         {
5947                 "map lookup helper access to map",
5948                 .insns = {
5949                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5950                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5951                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5952                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5953                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5954                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
5955                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
5956                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5957                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5958                         BPF_EXIT_INSN(),
5959                 },
5960                 .fixup_map3 = { 3, 8 },
5961                 .result = ACCEPT,
5962                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5963         },
5964         {
5965                 "map update helper access to map",
5966                 .insns = {
5967                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5968                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5969                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5970                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5971                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5972                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5973                         BPF_MOV64_IMM(BPF_REG_4, 0),
5974                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
5975                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
5976                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5977                         BPF_EMIT_CALL(BPF_FUNC_map_update_elem),
5978                         BPF_EXIT_INSN(),
5979                 },
5980                 .fixup_map3 = { 3, 10 },
5981                 .result = ACCEPT,
5982                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
5983         },
5984         {
5985                 "map update helper access to map: wrong size",
5986                 .insns = {
5987                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
5988                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
5989                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
5990                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5991                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
5992                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
5993                         BPF_MOV64_IMM(BPF_REG_4, 0),
5994                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
5995                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
5996                         BPF_LD_MAP_FD(BPF_REG_1, 0),
5997                         BPF_EMIT_CALL(BPF_FUNC_map_update_elem),
5998                         BPF_EXIT_INSN(),
5999                 },
6000                 .fixup_map1 = { 3 },
6001                 .fixup_map3 = { 10 },
6002                 .result = REJECT,
6003                 .errstr = "invalid access to map value, value_size=8 off=0 size=16",
6004                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6005         },
6006         {
6007                 "map helper access to adjusted map (via const imm)",
6008                 .insns = {
6009                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6010                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6011                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6012                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6013                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6014                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
6015                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6016                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
6017                                       offsetof(struct other_val, bar)),
6018                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6019                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6020                         BPF_EXIT_INSN(),
6021                 },
6022                 .fixup_map3 = { 3, 9 },
6023                 .result = ACCEPT,
6024                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6025         },
6026         {
6027                 "map helper access to adjusted map (via const imm): out-of-bound 1",
6028                 .insns = {
6029                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6030                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6031                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6032                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6033                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6034                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
6035                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6036                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
6037                                       sizeof(struct other_val) - 4),
6038                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6039                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6040                         BPF_EXIT_INSN(),
6041                 },
6042                 .fixup_map3 = { 3, 9 },
6043                 .result = REJECT,
6044                 .errstr = "invalid access to map value, value_size=16 off=12 size=8",
6045                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6046         },
6047         {
6048                 "map helper access to adjusted map (via const imm): out-of-bound 2",
6049                 .insns = {
6050                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6051                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6052                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6053                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6054                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6055                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
6056                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6057                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
6058                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6059                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6060                         BPF_EXIT_INSN(),
6061                 },
6062                 .fixup_map3 = { 3, 9 },
6063                 .result = REJECT,
6064                 .errstr = "invalid access to map value, value_size=16 off=-4 size=8",
6065                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6066         },
6067         {
6068                 "map helper access to adjusted map (via const reg)",
6069                 .insns = {
6070                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6071                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6072                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6073                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6074                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6075                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6076                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6077                         BPF_MOV64_IMM(BPF_REG_3,
6078                                       offsetof(struct other_val, bar)),
6079                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6080                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6081                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6082                         BPF_EXIT_INSN(),
6083                 },
6084                 .fixup_map3 = { 3, 10 },
6085                 .result = ACCEPT,
6086                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6087         },
6088         {
6089                 "map helper access to adjusted map (via const reg): out-of-bound 1",
6090                 .insns = {
6091                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6092                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6093                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6094                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6095                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6096                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6097                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6098                         BPF_MOV64_IMM(BPF_REG_3,
6099                                       sizeof(struct other_val) - 4),
6100                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6101                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6102                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6103                         BPF_EXIT_INSN(),
6104                 },
6105                 .fixup_map3 = { 3, 10 },
6106                 .result = REJECT,
6107                 .errstr = "invalid access to map value, value_size=16 off=12 size=8",
6108                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6109         },
6110         {
6111                 "map helper access to adjusted map (via const reg): out-of-bound 2",
6112                 .insns = {
6113                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6114                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6115                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6116                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6117                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6118                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6119                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6120                         BPF_MOV64_IMM(BPF_REG_3, -4),
6121                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6122                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6123                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6124                         BPF_EXIT_INSN(),
6125                 },
6126                 .fixup_map3 = { 3, 10 },
6127                 .result = REJECT,
6128                 .errstr = "invalid access to map value, value_size=16 off=-4 size=8",
6129                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6130         },
6131         {
6132                 "map helper access to adjusted map (via variable)",
6133                 .insns = {
6134                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6135                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6136                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6137                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6138                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6139                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6140                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6141                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6142                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
6143                                     offsetof(struct other_val, bar), 4),
6144                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6145                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6146                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6147                         BPF_EXIT_INSN(),
6148                 },
6149                 .fixup_map3 = { 3, 11 },
6150                 .result = ACCEPT,
6151                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6152         },
6153         {
6154                 "map helper access to adjusted map (via variable): no max check",
6155                 .insns = {
6156                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6157                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6158                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6159                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6160                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6161                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6162                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6163                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6164                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6165                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6166                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6167                         BPF_EXIT_INSN(),
6168                 },
6169                 .fixup_map3 = { 3, 10 },
6170                 .result = REJECT,
6171                 .errstr = "R2 unbounded memory access, make sure to bounds check any array access into a map",
6172                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6173         },
6174         {
6175                 "map helper access to adjusted map (via variable): wrong max check",
6176                 .insns = {
6177                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6178                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6179                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6180                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6181                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6182                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6183                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
6184                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
6185                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
6186                                     offsetof(struct other_val, bar) + 1, 4),
6187                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
6188                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6189                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6190                         BPF_EXIT_INSN(),
6191                 },
6192                 .fixup_map3 = { 3, 11 },
6193                 .result = REJECT,
6194                 .errstr = "invalid access to map value, value_size=16 off=9 size=8",
6195                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6196         },
6197         {
6198                 "map element value is preserved across register spilling",
6199                 .insns = {
6200                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6201                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6202                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6203                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6204                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6205                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6206                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
6207                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6208                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
6209                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
6210                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
6211                         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
6212                         BPF_EXIT_INSN(),
6213                 },
6214                 .fixup_map2 = { 3 },
6215                 .errstr_unpriv = "R0 leaks addr",
6216                 .result = ACCEPT,
6217                 .result_unpriv = REJECT,
6218         },
6219         {
6220                 "map element value or null is marked on register spilling",
6221                 .insns = {
6222                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6223                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6224                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6225                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6226                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6227                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6228                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -152),
6229                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
6230                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
6231                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
6232                         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
6233                         BPF_EXIT_INSN(),
6234                 },
6235                 .fixup_map2 = { 3 },
6236                 .errstr_unpriv = "R0 leaks addr",
6237                 .result = ACCEPT,
6238                 .result_unpriv = REJECT,
6239         },
6240         {
6241                 "map element value store of cleared call register",
6242                 .insns = {
6243                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6244                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6245                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6246                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6247                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6248                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
6249                         BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
6250                         BPF_EXIT_INSN(),
6251                 },
6252                 .fixup_map2 = { 3 },
6253                 .errstr_unpriv = "R1 !read_ok",
6254                 .errstr = "R1 !read_ok",
6255                 .result = REJECT,
6256                 .result_unpriv = REJECT,
6257         },
6258         {
6259                 "map element value with unaligned store",
6260                 .insns = {
6261                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6262                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6263                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6264                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6265                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6266                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 17),
6267                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
6268                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
6269                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 43),
6270                         BPF_ST_MEM(BPF_DW, BPF_REG_0, -2, 44),
6271                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
6272                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 32),
6273                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 2, 33),
6274                         BPF_ST_MEM(BPF_DW, BPF_REG_8, -2, 34),
6275                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 5),
6276                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 22),
6277                         BPF_ST_MEM(BPF_DW, BPF_REG_8, 4, 23),
6278                         BPF_ST_MEM(BPF_DW, BPF_REG_8, -7, 24),
6279                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_8),
6280                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, 3),
6281                         BPF_ST_MEM(BPF_DW, BPF_REG_7, 0, 22),
6282                         BPF_ST_MEM(BPF_DW, BPF_REG_7, 4, 23),
6283                         BPF_ST_MEM(BPF_DW, BPF_REG_7, -4, 24),
6284                         BPF_EXIT_INSN(),
6285                 },
6286                 .fixup_map2 = { 3 },
6287                 .errstr_unpriv = "R0 leaks addr",
6288                 .result = ACCEPT,
6289                 .result_unpriv = REJECT,
6290                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
6291         },
6292         {
6293                 "map element value with unaligned load",
6294                 .insns = {
6295                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6296                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6297                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6298                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6299                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6300                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
6301                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
6302                         BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 9),
6303                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
6304                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
6305                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 2),
6306                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
6307                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 0),
6308                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 2),
6309                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 5),
6310                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
6311                         BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 4),
6312                         BPF_EXIT_INSN(),
6313                 },
6314                 .fixup_map2 = { 3 },
6315                 .errstr_unpriv = "R0 leaks addr",
6316                 .result = ACCEPT,
6317                 .result_unpriv = REJECT,
6318                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
6319         },
6320         {
6321                 "map element value illegal alu op, 1",
6322                 .insns = {
6323                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6324                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6325                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6326                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6327                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6328                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
6329                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 8),
6330                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
6331                         BPF_EXIT_INSN(),
6332                 },
6333                 .fixup_map2 = { 3 },
6334                 .errstr = "R0 bitwise operator &= on pointer",
6335                 .result = REJECT,
6336         },
6337         {
6338                 "map element value illegal alu op, 2",
6339                 .insns = {
6340                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6341                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6342                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6343                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6344                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6345                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
6346                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_0, 0),
6347                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
6348                         BPF_EXIT_INSN(),
6349                 },
6350                 .fixup_map2 = { 3 },
6351                 .errstr = "R0 32-bit pointer arithmetic prohibited",
6352                 .result = REJECT,
6353         },
6354         {
6355                 "map element value illegal alu op, 3",
6356                 .insns = {
6357                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6358                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6359                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6360                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6361                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6362                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
6363                         BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, 42),
6364                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
6365                         BPF_EXIT_INSN(),
6366                 },
6367                 .fixup_map2 = { 3 },
6368                 .errstr = "R0 pointer arithmetic with /= operator",
6369                 .result = REJECT,
6370         },
6371         {
6372                 "map element value illegal alu op, 4",
6373                 .insns = {
6374                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6375                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6376                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6377                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6378                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6379                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
6380                         BPF_ENDIAN(BPF_FROM_BE, BPF_REG_0, 64),
6381                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
6382                         BPF_EXIT_INSN(),
6383                 },
6384                 .fixup_map2 = { 3 },
6385                 .errstr_unpriv = "R0 pointer arithmetic prohibited",
6386                 .errstr = "invalid mem access 'inv'",
6387                 .result = REJECT,
6388                 .result_unpriv = REJECT,
6389         },
6390         {
6391                 "map element value illegal alu op, 5",
6392                 .insns = {
6393                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6394                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6395                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6396                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6397                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6398                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6399                         BPF_MOV64_IMM(BPF_REG_3, 4096),
6400                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6401                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6402                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
6403                         BPF_STX_XADD(BPF_DW, BPF_REG_2, BPF_REG_3, 0),
6404                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0),
6405                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
6406                         BPF_EXIT_INSN(),
6407                 },
6408                 .fixup_map2 = { 3 },
6409                 .errstr = "R0 invalid mem access 'inv'",
6410                 .result = REJECT,
6411         },
6412         {
6413                 "map element value is preserved across register spilling",
6414                 .insns = {
6415                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6416                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6417                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6418                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6419                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6420                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6421                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0,
6422                                 offsetof(struct test_val, foo)),
6423                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
6424                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6425                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
6426                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
6427                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
6428                         BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
6429                         BPF_EXIT_INSN(),
6430                 },
6431                 .fixup_map2 = { 3 },
6432                 .errstr_unpriv = "R0 leaks addr",
6433                 .result = ACCEPT,
6434                 .result_unpriv = REJECT,
6435                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
6436         },
6437         {
6438                 "helper access to variable memory: stack, bitwise AND + JMP, correct bounds",
6439                 .insns = {
6440                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6441                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6442                         BPF_MOV64_IMM(BPF_REG_0, 0),
6443                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
6444                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
6445                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
6446                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
6447                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
6448                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
6449                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
6450                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
6451                         BPF_MOV64_IMM(BPF_REG_2, 16),
6452                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6453                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6454                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
6455                         BPF_MOV64_IMM(BPF_REG_4, 0),
6456                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
6457                         BPF_MOV64_IMM(BPF_REG_3, 0),
6458                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6459                         BPF_MOV64_IMM(BPF_REG_0, 0),
6460                         BPF_EXIT_INSN(),
6461                 },
6462                 .result = ACCEPT,
6463                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6464         },
6465         {
6466                 "helper access to variable memory: stack, bitwise AND, zero included",
6467                 .insns = {
6468                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6469                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6470                         BPF_MOV64_IMM(BPF_REG_2, 16),
6471                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6472                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6473                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
6474                         BPF_MOV64_IMM(BPF_REG_3, 0),
6475                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6476                         BPF_EXIT_INSN(),
6477                 },
6478                 .errstr = "invalid indirect read from stack off -64+0 size 64",
6479                 .result = REJECT,
6480                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6481         },
6482         {
6483                 "helper access to variable memory: stack, bitwise AND + JMP, wrong max",
6484                 .insns = {
6485                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6486                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6487                         BPF_MOV64_IMM(BPF_REG_2, 16),
6488                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6489                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6490                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 65),
6491                         BPF_MOV64_IMM(BPF_REG_4, 0),
6492                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
6493                         BPF_MOV64_IMM(BPF_REG_3, 0),
6494                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6495                         BPF_MOV64_IMM(BPF_REG_0, 0),
6496                         BPF_EXIT_INSN(),
6497                 },
6498                 .errstr = "invalid stack type R1 off=-64 access_size=65",
6499                 .result = REJECT,
6500                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6501         },
6502         {
6503                 "helper access to variable memory: stack, JMP, correct bounds",
6504                 .insns = {
6505                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6506                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6507                         BPF_MOV64_IMM(BPF_REG_0, 0),
6508                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
6509                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
6510                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
6511                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
6512                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
6513                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
6514                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
6515                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
6516                         BPF_MOV64_IMM(BPF_REG_2, 16),
6517                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6518                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6519                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 4),
6520                         BPF_MOV64_IMM(BPF_REG_4, 0),
6521                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
6522                         BPF_MOV64_IMM(BPF_REG_3, 0),
6523                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6524                         BPF_MOV64_IMM(BPF_REG_0, 0),
6525                         BPF_EXIT_INSN(),
6526                 },
6527                 .result = ACCEPT,
6528                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6529         },
6530         {
6531                 "helper access to variable memory: stack, JMP (signed), correct bounds",
6532                 .insns = {
6533                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6534                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6535                         BPF_MOV64_IMM(BPF_REG_0, 0),
6536                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
6537                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
6538                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
6539                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
6540                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
6541                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
6542                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
6543                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
6544                         BPF_MOV64_IMM(BPF_REG_2, 16),
6545                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6546                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6547                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 4),
6548                         BPF_MOV64_IMM(BPF_REG_4, 0),
6549                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
6550                         BPF_MOV64_IMM(BPF_REG_3, 0),
6551                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6552                         BPF_MOV64_IMM(BPF_REG_0, 0),
6553                         BPF_EXIT_INSN(),
6554                 },
6555                 .result = ACCEPT,
6556                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6557         },
6558         {
6559                 "helper access to variable memory: stack, JMP, bounds + offset",
6560                 .insns = {
6561                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6562                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6563                         BPF_MOV64_IMM(BPF_REG_2, 16),
6564                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6565                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6566                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 5),
6567                         BPF_MOV64_IMM(BPF_REG_4, 0),
6568                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 3),
6569                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
6570                         BPF_MOV64_IMM(BPF_REG_3, 0),
6571                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6572                         BPF_MOV64_IMM(BPF_REG_0, 0),
6573                         BPF_EXIT_INSN(),
6574                 },
6575                 .errstr = "invalid stack type R1 off=-64 access_size=65",
6576                 .result = REJECT,
6577                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6578         },
6579         {
6580                 "helper access to variable memory: stack, JMP, wrong max",
6581                 .insns = {
6582                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6583                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6584                         BPF_MOV64_IMM(BPF_REG_2, 16),
6585                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6586                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6587                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 65, 4),
6588                         BPF_MOV64_IMM(BPF_REG_4, 0),
6589                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
6590                         BPF_MOV64_IMM(BPF_REG_3, 0),
6591                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6592                         BPF_MOV64_IMM(BPF_REG_0, 0),
6593                         BPF_EXIT_INSN(),
6594                 },
6595                 .errstr = "invalid stack type R1 off=-64 access_size=65",
6596                 .result = REJECT,
6597                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6598         },
6599         {
6600                 "helper access to variable memory: stack, JMP, no max check",
6601                 .insns = {
6602                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6603                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6604                         BPF_MOV64_IMM(BPF_REG_2, 16),
6605                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6606                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6607                         BPF_MOV64_IMM(BPF_REG_4, 0),
6608                         BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
6609                         BPF_MOV64_IMM(BPF_REG_3, 0),
6610                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6611                         BPF_MOV64_IMM(BPF_REG_0, 0),
6612                         BPF_EXIT_INSN(),
6613                 },
6614                 /* because max wasn't checked, signed min is negative */
6615                 .errstr = "R2 min value is negative, either use unsigned or 'var &= const'",
6616                 .result = REJECT,
6617                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6618         },
6619         {
6620                 "helper access to variable memory: stack, JMP, no min check",
6621                 .insns = {
6622                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6623                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6624                         BPF_MOV64_IMM(BPF_REG_2, 16),
6625                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6626                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6627                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 3),
6628                         BPF_MOV64_IMM(BPF_REG_3, 0),
6629                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6630                         BPF_MOV64_IMM(BPF_REG_0, 0),
6631                         BPF_EXIT_INSN(),
6632                 },
6633                 .errstr = "invalid indirect read from stack off -64+0 size 64",
6634                 .result = REJECT,
6635                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6636         },
6637         {
6638                 "helper access to variable memory: stack, JMP (signed), no min check",
6639                 .insns = {
6640                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6641                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
6642                         BPF_MOV64_IMM(BPF_REG_2, 16),
6643                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
6644                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
6645                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 3),
6646                         BPF_MOV64_IMM(BPF_REG_3, 0),
6647                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6648                         BPF_MOV64_IMM(BPF_REG_0, 0),
6649                         BPF_EXIT_INSN(),
6650                 },
6651                 .errstr = "R2 min value is negative",
6652                 .result = REJECT,
6653                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6654         },
6655         {
6656                 "helper access to variable memory: map, JMP, correct bounds",
6657                 .insns = {
6658                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6659                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6660                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6661                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6662                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6663                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
6664                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6665                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
6666                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
6667                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
6668                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
6669                                 sizeof(struct test_val), 4),
6670                         BPF_MOV64_IMM(BPF_REG_4, 0),
6671                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
6672                         BPF_MOV64_IMM(BPF_REG_3, 0),
6673                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6674                         BPF_MOV64_IMM(BPF_REG_0, 0),
6675                         BPF_EXIT_INSN(),
6676                 },
6677                 .fixup_map2 = { 3 },
6678                 .result = ACCEPT,
6679                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6680         },
6681         {
6682                 "helper access to variable memory: map, JMP, wrong max",
6683                 .insns = {
6684                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6685                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6686                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6687                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6688                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6689                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
6690                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6691                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
6692                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
6693                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
6694                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
6695                                 sizeof(struct test_val) + 1, 4),
6696                         BPF_MOV64_IMM(BPF_REG_4, 0),
6697                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
6698                         BPF_MOV64_IMM(BPF_REG_3, 0),
6699                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6700                         BPF_MOV64_IMM(BPF_REG_0, 0),
6701                         BPF_EXIT_INSN(),
6702                 },
6703                 .fixup_map2 = { 3 },
6704                 .errstr = "invalid access to map value, value_size=48 off=0 size=49",
6705                 .result = REJECT,
6706                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6707         },
6708         {
6709                 "helper access to variable memory: map adjusted, JMP, correct bounds",
6710                 .insns = {
6711                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6712                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6713                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6714                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6715                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6716                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
6717                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6718                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
6719                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
6720                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
6721                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
6722                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
6723                                 sizeof(struct test_val) - 20, 4),
6724                         BPF_MOV64_IMM(BPF_REG_4, 0),
6725                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
6726                         BPF_MOV64_IMM(BPF_REG_3, 0),
6727                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6728                         BPF_MOV64_IMM(BPF_REG_0, 0),
6729                         BPF_EXIT_INSN(),
6730                 },
6731                 .fixup_map2 = { 3 },
6732                 .result = ACCEPT,
6733                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6734         },
6735         {
6736                 "helper access to variable memory: map adjusted, JMP, wrong max",
6737                 .insns = {
6738                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6739                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6740                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
6741                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6742                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6743                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
6744                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6745                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
6746                         BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
6747                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
6748                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
6749                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
6750                                 sizeof(struct test_val) - 19, 4),
6751                         BPF_MOV64_IMM(BPF_REG_4, 0),
6752                         BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
6753                         BPF_MOV64_IMM(BPF_REG_3, 0),
6754                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6755                         BPF_MOV64_IMM(BPF_REG_0, 0),
6756                         BPF_EXIT_INSN(),
6757                 },
6758                 .fixup_map2 = { 3 },
6759                 .errstr = "R1 min value is outside of the array range",
6760                 .result = REJECT,
6761                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6762         },
6763         {
6764                 "helper access to variable memory: size = 0 allowed on NULL (ARG_PTR_TO_MEM_OR_NULL)",
6765                 .insns = {
6766                         BPF_MOV64_IMM(BPF_REG_1, 0),
6767                         BPF_MOV64_IMM(BPF_REG_2, 0),
6768                         BPF_MOV64_IMM(BPF_REG_3, 0),
6769                         BPF_MOV64_IMM(BPF_REG_4, 0),
6770                         BPF_MOV64_IMM(BPF_REG_5, 0),
6771                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6772                         BPF_EXIT_INSN(),
6773                 },
6774                 .result = ACCEPT,
6775                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6776         },
6777         {
6778                 "helper access to variable memory: size > 0 not allowed on NULL (ARG_PTR_TO_MEM_OR_NULL)",
6779                 .insns = {
6780                         BPF_MOV64_IMM(BPF_REG_1, 0),
6781                         BPF_MOV64_IMM(BPF_REG_2, 1),
6782                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
6783                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
6784                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
6785                         BPF_MOV64_IMM(BPF_REG_3, 0),
6786                         BPF_MOV64_IMM(BPF_REG_4, 0),
6787                         BPF_MOV64_IMM(BPF_REG_5, 0),
6788                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6789                         BPF_EXIT_INSN(),
6790                 },
6791                 .errstr = "R1 type=inv expected=fp",
6792                 .result = REJECT,
6793                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6794         },
6795         {
6796                 "helper access to variable memory: size = 0 allowed on != NULL stack pointer (ARG_PTR_TO_MEM_OR_NULL)",
6797                 .insns = {
6798                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6799                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
6800                         BPF_MOV64_IMM(BPF_REG_2, 0),
6801                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
6802                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 8),
6803                         BPF_MOV64_IMM(BPF_REG_3, 0),
6804                         BPF_MOV64_IMM(BPF_REG_4, 0),
6805                         BPF_MOV64_IMM(BPF_REG_5, 0),
6806                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6807                         BPF_EXIT_INSN(),
6808                 },
6809                 .result = ACCEPT,
6810                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6811         },
6812         {
6813                 "helper access to variable memory: size = 0 allowed on != NULL map pointer (ARG_PTR_TO_MEM_OR_NULL)",
6814                 .insns = {
6815                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6816                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6817                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6818                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6819                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6820                                      BPF_FUNC_map_lookup_elem),
6821                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6822                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6823                         BPF_MOV64_IMM(BPF_REG_2, 0),
6824                         BPF_MOV64_IMM(BPF_REG_3, 0),
6825                         BPF_MOV64_IMM(BPF_REG_4, 0),
6826                         BPF_MOV64_IMM(BPF_REG_5, 0),
6827                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6828                         BPF_EXIT_INSN(),
6829                 },
6830                 .fixup_map1 = { 3 },
6831                 .result = ACCEPT,
6832                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6833         },
6834         {
6835                 "helper access to variable memory: size possible = 0 allowed on != NULL stack pointer (ARG_PTR_TO_MEM_OR_NULL)",
6836                 .insns = {
6837                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6838                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6839                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6840                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6841                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6842                                      BPF_FUNC_map_lookup_elem),
6843                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
6844                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
6845                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 7),
6846                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6847                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
6848                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
6849                         BPF_MOV64_IMM(BPF_REG_3, 0),
6850                         BPF_MOV64_IMM(BPF_REG_4, 0),
6851                         BPF_MOV64_IMM(BPF_REG_5, 0),
6852                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6853                         BPF_EXIT_INSN(),
6854                 },
6855                 .fixup_map1 = { 3 },
6856                 .result = ACCEPT,
6857                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6858         },
6859         {
6860                 "helper access to variable memory: size possible = 0 allowed on != NULL map pointer (ARG_PTR_TO_MEM_OR_NULL)",
6861                 .insns = {
6862                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6863                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6864                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6865                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6866                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
6867                                      BPF_FUNC_map_lookup_elem),
6868                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
6869                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6870                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
6871                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
6872                         BPF_MOV64_IMM(BPF_REG_3, 0),
6873                         BPF_MOV64_IMM(BPF_REG_4, 0),
6874                         BPF_MOV64_IMM(BPF_REG_5, 0),
6875                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6876                         BPF_EXIT_INSN(),
6877                 },
6878                 .fixup_map1 = { 3 },
6879                 .result = ACCEPT,
6880                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6881         },
6882         {
6883                 "helper access to variable memory: size possible = 0 allowed on != NULL packet pointer (ARG_PTR_TO_MEM_OR_NULL)",
6884                 .insns = {
6885                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
6886                                     offsetof(struct __sk_buff, data)),
6887                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
6888                                     offsetof(struct __sk_buff, data_end)),
6889                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_6),
6890                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
6891                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),
6892                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
6893                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 0),
6894                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
6895                         BPF_MOV64_IMM(BPF_REG_3, 0),
6896                         BPF_MOV64_IMM(BPF_REG_4, 0),
6897                         BPF_MOV64_IMM(BPF_REG_5, 0),
6898                         BPF_EMIT_CALL(BPF_FUNC_csum_diff),
6899                         BPF_EXIT_INSN(),
6900                 },
6901                 .result = ACCEPT,
6902                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
6903                 .retval = 0 /* csum_diff of 64-byte packet */,
6904         },
6905         {
6906                 "helper access to variable memory: size = 0 not allowed on NULL (!ARG_PTR_TO_MEM_OR_NULL)",
6907                 .insns = {
6908                         BPF_MOV64_IMM(BPF_REG_1, 0),
6909                         BPF_MOV64_IMM(BPF_REG_2, 0),
6910                         BPF_MOV64_IMM(BPF_REG_3, 0),
6911                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6912                         BPF_EXIT_INSN(),
6913                 },
6914                 .errstr = "R1 type=inv expected=fp",
6915                 .result = REJECT,
6916                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6917         },
6918         {
6919                 "helper access to variable memory: size > 0 not allowed on NULL (!ARG_PTR_TO_MEM_OR_NULL)",
6920                 .insns = {
6921                         BPF_MOV64_IMM(BPF_REG_1, 0),
6922                         BPF_MOV64_IMM(BPF_REG_2, 1),
6923                         BPF_MOV64_IMM(BPF_REG_3, 0),
6924                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6925                         BPF_EXIT_INSN(),
6926                 },
6927                 .errstr = "R1 type=inv expected=fp",
6928                 .result = REJECT,
6929                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6930         },
6931         {
6932                 "helper access to variable memory: size = 0 allowed on != NULL stack pointer (!ARG_PTR_TO_MEM_OR_NULL)",
6933                 .insns = {
6934                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6935                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
6936                         BPF_MOV64_IMM(BPF_REG_2, 0),
6937                         BPF_MOV64_IMM(BPF_REG_3, 0),
6938                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6939                         BPF_EXIT_INSN(),
6940                 },
6941                 .result = ACCEPT,
6942                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6943         },
6944         {
6945                 "helper access to variable memory: size = 0 allowed on != NULL map pointer (!ARG_PTR_TO_MEM_OR_NULL)",
6946                 .insns = {
6947                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6948                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6949                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6950                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6951                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6952                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
6953                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6954                         BPF_MOV64_IMM(BPF_REG_2, 0),
6955                         BPF_MOV64_IMM(BPF_REG_3, 0),
6956                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6957                         BPF_EXIT_INSN(),
6958                 },
6959                 .fixup_map1 = { 3 },
6960                 .result = ACCEPT,
6961                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6962         },
6963         {
6964                 "helper access to variable memory: size possible = 0 allowed on != NULL stack pointer (!ARG_PTR_TO_MEM_OR_NULL)",
6965                 .insns = {
6966                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6967                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6968                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6969                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6970                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6971                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
6972                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
6973                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
6974                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
6975                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
6976                         BPF_MOV64_IMM(BPF_REG_3, 0),
6977                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6978                         BPF_EXIT_INSN(),
6979                 },
6980                 .fixup_map1 = { 3 },
6981                 .result = ACCEPT,
6982                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
6983         },
6984         {
6985                 "helper access to variable memory: size possible = 0 allowed on != NULL map pointer (!ARG_PTR_TO_MEM_OR_NULL)",
6986                 .insns = {
6987                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
6988                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
6989                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
6990                         BPF_LD_MAP_FD(BPF_REG_1, 0),
6991                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
6992                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
6993                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
6994                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
6995                         BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 2),
6996                         BPF_MOV64_IMM(BPF_REG_3, 0),
6997                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
6998                         BPF_EXIT_INSN(),
6999                 },
7000                 .fixup_map1 = { 3 },
7001                 .result = ACCEPT,
7002                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7003         },
7004         {
7005                 "helper access to variable memory: 8 bytes leak",
7006                 .insns = {
7007                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7008                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
7009                         BPF_MOV64_IMM(BPF_REG_0, 0),
7010                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
7011                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
7012                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
7013                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
7014                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
7015                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
7016                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
7017                         BPF_MOV64_IMM(BPF_REG_2, 1),
7018                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
7019                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
7020                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 63),
7021                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
7022                         BPF_MOV64_IMM(BPF_REG_3, 0),
7023                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7024                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7025                         BPF_EXIT_INSN(),
7026                 },
7027                 .errstr = "invalid indirect read from stack off -64+32 size 64",
7028                 .result = REJECT,
7029                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7030         },
7031         {
7032                 "helper access to variable memory: 8 bytes no leak (init memory)",
7033                 .insns = {
7034                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
7035                         BPF_MOV64_IMM(BPF_REG_0, 0),
7036                         BPF_MOV64_IMM(BPF_REG_0, 0),
7037                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
7038                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
7039                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
7040                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
7041                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
7042                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
7043                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
7044                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
7045                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
7046                         BPF_MOV64_IMM(BPF_REG_2, 0),
7047                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 32),
7048                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 32),
7049                         BPF_MOV64_IMM(BPF_REG_3, 0),
7050                         BPF_EMIT_CALL(BPF_FUNC_probe_read),
7051                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7052                         BPF_EXIT_INSN(),
7053                 },
7054                 .result = ACCEPT,
7055                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
7056         },
7057         {
7058                 "invalid and of negative number",
7059                 .insns = {
7060                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7061                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7062                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7063                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7064                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7065                                      BPF_FUNC_map_lookup_elem),
7066                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7067                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7068                         BPF_ALU64_IMM(BPF_AND, BPF_REG_1, -4),
7069                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
7070                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7071                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
7072                                    offsetof(struct test_val, foo)),
7073                         BPF_EXIT_INSN(),
7074                 },
7075                 .fixup_map2 = { 3 },
7076                 .errstr = "R0 max value is outside of the array range",
7077                 .result = REJECT,
7078                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7079         },
7080         {
7081                 "invalid range check",
7082                 .insns = {
7083                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7084                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7085                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7086                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7087                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7088                                      BPF_FUNC_map_lookup_elem),
7089                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 12),
7090                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
7091                         BPF_MOV64_IMM(BPF_REG_9, 1),
7092                         BPF_ALU32_IMM(BPF_MOD, BPF_REG_1, 2),
7093                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 1),
7094                         BPF_ALU32_REG(BPF_AND, BPF_REG_9, BPF_REG_1),
7095                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_9, 1),
7096                         BPF_ALU32_IMM(BPF_RSH, BPF_REG_9, 1),
7097                         BPF_MOV32_IMM(BPF_REG_3, 1),
7098                         BPF_ALU32_REG(BPF_SUB, BPF_REG_3, BPF_REG_9),
7099                         BPF_ALU32_IMM(BPF_MUL, BPF_REG_3, 0x10000000),
7100                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
7101                         BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_3, 0),
7102                         BPF_MOV64_REG(BPF_REG_0, 0),
7103                         BPF_EXIT_INSN(),
7104                 },
7105                 .fixup_map2 = { 3 },
7106                 .errstr = "R0 max value is outside of the array range",
7107                 .result = REJECT,
7108                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
7109         },
7110         {
7111                 "map in map access",
7112                 .insns = {
7113                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7114                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7115                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7116                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7117                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7118                                      BPF_FUNC_map_lookup_elem),
7119                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
7120                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7121                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7122                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7123                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7124                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7125                                      BPF_FUNC_map_lookup_elem),
7126                         BPF_MOV64_IMM(BPF_REG_0, 0),
7127                         BPF_EXIT_INSN(),
7128                 },
7129                 .fixup_map_in_map = { 3 },
7130                 .result = ACCEPT,
7131         },
7132         {
7133                 "invalid inner map pointer",
7134                 .insns = {
7135                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7136                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7137                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7138                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7139                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7140                                      BPF_FUNC_map_lookup_elem),
7141                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
7142                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7143                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7144                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7145                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7146                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
7147                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7148                                      BPF_FUNC_map_lookup_elem),
7149                         BPF_MOV64_IMM(BPF_REG_0, 0),
7150                         BPF_EXIT_INSN(),
7151                 },
7152                 .fixup_map_in_map = { 3 },
7153                 .errstr = "R1 pointer arithmetic on CONST_PTR_TO_MAP prohibited",
7154                 .result = REJECT,
7155         },
7156         {
7157                 "forgot null checking on the inner map pointer",
7158                 .insns = {
7159                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7160                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7161                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7162                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7163                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7164                                      BPF_FUNC_map_lookup_elem),
7165                         BPF_ST_MEM(0, BPF_REG_10, -4, 0),
7166                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7167                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
7168                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
7169                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7170                                      BPF_FUNC_map_lookup_elem),
7171                         BPF_MOV64_IMM(BPF_REG_0, 0),
7172                         BPF_EXIT_INSN(),
7173                 },
7174                 .fixup_map_in_map = { 3 },
7175                 .errstr = "R1 type=map_value_or_null expected=map_ptr",
7176                 .result = REJECT,
7177         },
7178         {
7179                 "ld_abs: check calling conv, r1",
7180                 .insns = {
7181                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7182                         BPF_MOV64_IMM(BPF_REG_1, 0),
7183                         BPF_LD_ABS(BPF_W, -0x200000),
7184                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
7185                         BPF_EXIT_INSN(),
7186                 },
7187                 .errstr = "R1 !read_ok",
7188                 .result = REJECT,
7189         },
7190         {
7191                 "ld_abs: check calling conv, r2",
7192                 .insns = {
7193                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7194                         BPF_MOV64_IMM(BPF_REG_2, 0),
7195                         BPF_LD_ABS(BPF_W, -0x200000),
7196                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
7197                         BPF_EXIT_INSN(),
7198                 },
7199                 .errstr = "R2 !read_ok",
7200                 .result = REJECT,
7201         },
7202         {
7203                 "ld_abs: check calling conv, r3",
7204                 .insns = {
7205                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7206                         BPF_MOV64_IMM(BPF_REG_3, 0),
7207                         BPF_LD_ABS(BPF_W, -0x200000),
7208                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
7209                         BPF_EXIT_INSN(),
7210                 },
7211                 .errstr = "R3 !read_ok",
7212                 .result = REJECT,
7213         },
7214         {
7215                 "ld_abs: check calling conv, r4",
7216                 .insns = {
7217                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7218                         BPF_MOV64_IMM(BPF_REG_4, 0),
7219                         BPF_LD_ABS(BPF_W, -0x200000),
7220                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
7221                         BPF_EXIT_INSN(),
7222                 },
7223                 .errstr = "R4 !read_ok",
7224                 .result = REJECT,
7225         },
7226         {
7227                 "ld_abs: check calling conv, r5",
7228                 .insns = {
7229                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7230                         BPF_MOV64_IMM(BPF_REG_5, 0),
7231                         BPF_LD_ABS(BPF_W, -0x200000),
7232                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
7233                         BPF_EXIT_INSN(),
7234                 },
7235                 .errstr = "R5 !read_ok",
7236                 .result = REJECT,
7237         },
7238         {
7239                 "ld_abs: check calling conv, r7",
7240                 .insns = {
7241                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7242                         BPF_MOV64_IMM(BPF_REG_7, 0),
7243                         BPF_LD_ABS(BPF_W, -0x200000),
7244                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
7245                         BPF_EXIT_INSN(),
7246                 },
7247                 .result = ACCEPT,
7248         },
7249         {
7250                 "ld_abs: tests on r6 and skb data reload helper",
7251                 .insns = {
7252                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7253                         BPF_LD_ABS(BPF_B, 0),
7254                         BPF_LD_ABS(BPF_H, 0),
7255                         BPF_LD_ABS(BPF_W, 0),
7256                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
7257                         BPF_MOV64_IMM(BPF_REG_6, 0),
7258                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
7259                         BPF_MOV64_IMM(BPF_REG_2, 1),
7260                         BPF_MOV64_IMM(BPF_REG_3, 2),
7261                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7262                                      BPF_FUNC_skb_vlan_push),
7263                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
7264                         BPF_LD_ABS(BPF_B, 0),
7265                         BPF_LD_ABS(BPF_H, 0),
7266                         BPF_LD_ABS(BPF_W, 0),
7267                         BPF_MOV64_IMM(BPF_REG_0, 42),
7268                         BPF_EXIT_INSN(),
7269                 },
7270                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
7271                 .result = ACCEPT,
7272                 .retval = 42 /* ultimate return value */,
7273         },
7274         {
7275                 "ld_ind: check calling conv, r1",
7276                 .insns = {
7277                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7278                         BPF_MOV64_IMM(BPF_REG_1, 1),
7279                         BPF_LD_IND(BPF_W, BPF_REG_1, -0x200000),
7280                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
7281                         BPF_EXIT_INSN(),
7282                 },
7283                 .errstr = "R1 !read_ok",
7284                 .result = REJECT,
7285         },
7286         {
7287                 "ld_ind: check calling conv, r2",
7288                 .insns = {
7289                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7290                         BPF_MOV64_IMM(BPF_REG_2, 1),
7291                         BPF_LD_IND(BPF_W, BPF_REG_2, -0x200000),
7292                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
7293                         BPF_EXIT_INSN(),
7294                 },
7295                 .errstr = "R2 !read_ok",
7296                 .result = REJECT,
7297         },
7298         {
7299                 "ld_ind: check calling conv, r3",
7300                 .insns = {
7301                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7302                         BPF_MOV64_IMM(BPF_REG_3, 1),
7303                         BPF_LD_IND(BPF_W, BPF_REG_3, -0x200000),
7304                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
7305                         BPF_EXIT_INSN(),
7306                 },
7307                 .errstr = "R3 !read_ok",
7308                 .result = REJECT,
7309         },
7310         {
7311                 "ld_ind: check calling conv, r4",
7312                 .insns = {
7313                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7314                         BPF_MOV64_IMM(BPF_REG_4, 1),
7315                         BPF_LD_IND(BPF_W, BPF_REG_4, -0x200000),
7316                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
7317                         BPF_EXIT_INSN(),
7318                 },
7319                 .errstr = "R4 !read_ok",
7320                 .result = REJECT,
7321         },
7322         {
7323                 "ld_ind: check calling conv, r5",
7324                 .insns = {
7325                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7326                         BPF_MOV64_IMM(BPF_REG_5, 1),
7327                         BPF_LD_IND(BPF_W, BPF_REG_5, -0x200000),
7328                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
7329                         BPF_EXIT_INSN(),
7330                 },
7331                 .errstr = "R5 !read_ok",
7332                 .result = REJECT,
7333         },
7334         {
7335                 "ld_ind: check calling conv, r7",
7336                 .insns = {
7337                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
7338                         BPF_MOV64_IMM(BPF_REG_7, 1),
7339                         BPF_LD_IND(BPF_W, BPF_REG_7, -0x200000),
7340                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
7341                         BPF_EXIT_INSN(),
7342                 },
7343                 .result = ACCEPT,
7344                 .retval = 1,
7345         },
7346         {
7347                 "check bpf_perf_event_data->sample_period byte load permitted",
7348                 .insns = {
7349                         BPF_MOV64_IMM(BPF_REG_0, 0),
7350 #if __BYTE_ORDER == __LITTLE_ENDIAN
7351                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
7352                                     offsetof(struct bpf_perf_event_data, sample_period)),
7353 #else
7354                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
7355                                     offsetof(struct bpf_perf_event_data, sample_period) + 7),
7356 #endif
7357                         BPF_EXIT_INSN(),
7358                 },
7359                 .result = ACCEPT,
7360                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
7361         },
7362         {
7363                 "check bpf_perf_event_data->sample_period half load permitted",
7364                 .insns = {
7365                         BPF_MOV64_IMM(BPF_REG_0, 0),
7366 #if __BYTE_ORDER == __LITTLE_ENDIAN
7367                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
7368                                     offsetof(struct bpf_perf_event_data, sample_period)),
7369 #else
7370                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
7371                                     offsetof(struct bpf_perf_event_data, sample_period) + 6),
7372 #endif
7373                         BPF_EXIT_INSN(),
7374                 },
7375                 .result = ACCEPT,
7376                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
7377         },
7378         {
7379                 "check bpf_perf_event_data->sample_period word load permitted",
7380                 .insns = {
7381                         BPF_MOV64_IMM(BPF_REG_0, 0),
7382 #if __BYTE_ORDER == __LITTLE_ENDIAN
7383                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
7384                                     offsetof(struct bpf_perf_event_data, sample_period)),
7385 #else
7386                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
7387                                     offsetof(struct bpf_perf_event_data, sample_period) + 4),
7388 #endif
7389                         BPF_EXIT_INSN(),
7390                 },
7391                 .result = ACCEPT,
7392                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
7393         },
7394         {
7395                 "check bpf_perf_event_data->sample_period dword load permitted",
7396                 .insns = {
7397                         BPF_MOV64_IMM(BPF_REG_0, 0),
7398                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
7399                                     offsetof(struct bpf_perf_event_data, sample_period)),
7400                         BPF_EXIT_INSN(),
7401                 },
7402                 .result = ACCEPT,
7403                 .prog_type = BPF_PROG_TYPE_PERF_EVENT,
7404         },
7405         {
7406                 "check skb->data half load not permitted",
7407                 .insns = {
7408                         BPF_MOV64_IMM(BPF_REG_0, 0),
7409 #if __BYTE_ORDER == __LITTLE_ENDIAN
7410                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
7411                                     offsetof(struct __sk_buff, data)),
7412 #else
7413                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
7414                                     offsetof(struct __sk_buff, data) + 2),
7415 #endif
7416                         BPF_EXIT_INSN(),
7417                 },
7418                 .result = REJECT,
7419                 .errstr = "invalid bpf_context access",
7420         },
7421         {
7422                 "check skb->tc_classid half load not permitted for lwt prog",
7423                 .insns = {
7424                         BPF_MOV64_IMM(BPF_REG_0, 0),
7425 #if __BYTE_ORDER == __LITTLE_ENDIAN
7426                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
7427                                     offsetof(struct __sk_buff, tc_classid)),
7428 #else
7429                         BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
7430                                     offsetof(struct __sk_buff, tc_classid) + 2),
7431 #endif
7432                         BPF_EXIT_INSN(),
7433                 },
7434                 .result = REJECT,
7435                 .errstr = "invalid bpf_context access",
7436                 .prog_type = BPF_PROG_TYPE_LWT_IN,
7437         },
7438         {
7439                 "bounds checks mixing signed and unsigned, positive bounds",
7440                 .insns = {
7441                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7442                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7443                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7444                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7445                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7446                                      BPF_FUNC_map_lookup_elem),
7447                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
7448                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7449                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7450                         BPF_MOV64_IMM(BPF_REG_2, 2),
7451                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 3),
7452                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 4, 2),
7453                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7454                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7455                         BPF_MOV64_IMM(BPF_REG_0, 0),
7456                         BPF_EXIT_INSN(),
7457                 },
7458                 .fixup_map1 = { 3 },
7459                 .errstr = "unbounded min value",
7460                 .result = REJECT,
7461         },
7462         {
7463                 "bounds checks mixing signed and unsigned",
7464                 .insns = {
7465                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7466                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7467                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7468                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7469                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7470                                      BPF_FUNC_map_lookup_elem),
7471                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
7472                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7473                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7474                         BPF_MOV64_IMM(BPF_REG_2, -1),
7475                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
7476                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7477                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7478                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7479                         BPF_MOV64_IMM(BPF_REG_0, 0),
7480                         BPF_EXIT_INSN(),
7481                 },
7482                 .fixup_map1 = { 3 },
7483                 .errstr = "unbounded min value",
7484                 .result = REJECT,
7485         },
7486         {
7487                 "bounds checks mixing signed and unsigned, variant 2",
7488                 .insns = {
7489                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7490                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7491                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7492                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7493                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7494                                      BPF_FUNC_map_lookup_elem),
7495                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7496                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7497                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7498                         BPF_MOV64_IMM(BPF_REG_2, -1),
7499                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
7500                         BPF_MOV64_IMM(BPF_REG_8, 0),
7501                         BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_1),
7502                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
7503                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
7504                         BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
7505                         BPF_MOV64_IMM(BPF_REG_0, 0),
7506                         BPF_EXIT_INSN(),
7507                 },
7508                 .fixup_map1 = { 3 },
7509                 .errstr = "unbounded min value",
7510                 .result = REJECT,
7511         },
7512         {
7513                 "bounds checks mixing signed and unsigned, variant 3",
7514                 .insns = {
7515                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7516                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7517                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7518                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7519                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7520                                      BPF_FUNC_map_lookup_elem),
7521                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
7522                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7523                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7524                         BPF_MOV64_IMM(BPF_REG_2, -1),
7525                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 4),
7526                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
7527                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
7528                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
7529                         BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
7530                         BPF_MOV64_IMM(BPF_REG_0, 0),
7531                         BPF_EXIT_INSN(),
7532                 },
7533                 .fixup_map1 = { 3 },
7534                 .errstr = "unbounded min value",
7535                 .result = REJECT,
7536         },
7537         {
7538                 "bounds checks mixing signed and unsigned, variant 4",
7539                 .insns = {
7540                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7541                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7542                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7543                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7544                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7545                                      BPF_FUNC_map_lookup_elem),
7546                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
7547                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7548                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7549                         BPF_MOV64_IMM(BPF_REG_2, 1),
7550                         BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
7551                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7552                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7553                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7554                         BPF_MOV64_IMM(BPF_REG_0, 0),
7555                         BPF_EXIT_INSN(),
7556                 },
7557                 .fixup_map1 = { 3 },
7558                 .result = ACCEPT,
7559         },
7560         {
7561                 "bounds checks mixing signed and unsigned, variant 5",
7562                 .insns = {
7563                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7564                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7565                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7566                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7567                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7568                                      BPF_FUNC_map_lookup_elem),
7569                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7570                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7571                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7572                         BPF_MOV64_IMM(BPF_REG_2, -1),
7573                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
7574                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 4),
7575                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 4),
7576                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
7577                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7578                         BPF_MOV64_IMM(BPF_REG_0, 0),
7579                         BPF_EXIT_INSN(),
7580                 },
7581                 .fixup_map1 = { 3 },
7582                 .errstr = "unbounded min value",
7583                 .result = REJECT,
7584         },
7585         {
7586                 "bounds checks mixing signed and unsigned, variant 6",
7587                 .insns = {
7588                         BPF_MOV64_IMM(BPF_REG_2, 0),
7589                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_10),
7590                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, -512),
7591                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7592                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -16),
7593                         BPF_MOV64_IMM(BPF_REG_6, -1),
7594                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_6, 5),
7595                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_4, 1, 4),
7596                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 1),
7597                         BPF_MOV64_IMM(BPF_REG_5, 0),
7598                         BPF_ST_MEM(BPF_H, BPF_REG_10, -512, 0),
7599                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7600                                      BPF_FUNC_skb_load_bytes),
7601                         BPF_MOV64_IMM(BPF_REG_0, 0),
7602                         BPF_EXIT_INSN(),
7603                 },
7604                 .errstr = "R4 min value is negative, either use unsigned",
7605                 .result = REJECT,
7606         },
7607         {
7608                 "bounds checks mixing signed and unsigned, variant 7",
7609                 .insns = {
7610                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7611                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7612                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7613                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7614                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7615                                      BPF_FUNC_map_lookup_elem),
7616                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
7617                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7618                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7619                         BPF_MOV64_IMM(BPF_REG_2, 1024 * 1024 * 1024),
7620                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
7621                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7622                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7623                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7624                         BPF_MOV64_IMM(BPF_REG_0, 0),
7625                         BPF_EXIT_INSN(),
7626                 },
7627                 .fixup_map1 = { 3 },
7628                 .result = ACCEPT,
7629         },
7630         {
7631                 "bounds checks mixing signed and unsigned, variant 8",
7632                 .insns = {
7633                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7634                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7635                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7636                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7637                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7638                                      BPF_FUNC_map_lookup_elem),
7639                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7640                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7641                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7642                         BPF_MOV64_IMM(BPF_REG_2, -1),
7643                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
7644                         BPF_MOV64_IMM(BPF_REG_0, 0),
7645                         BPF_EXIT_INSN(),
7646                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7647                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7648                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7649                         BPF_MOV64_IMM(BPF_REG_0, 0),
7650                         BPF_EXIT_INSN(),
7651                 },
7652                 .fixup_map1 = { 3 },
7653                 .errstr = "unbounded min value",
7654                 .result = REJECT,
7655         },
7656         {
7657                 "bounds checks mixing signed and unsigned, variant 9",
7658                 .insns = {
7659                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7660                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7661                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7662                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7663                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7664                                      BPF_FUNC_map_lookup_elem),
7665                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
7666                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7667                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7668                         BPF_LD_IMM64(BPF_REG_2, -9223372036854775808ULL),
7669                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
7670                         BPF_MOV64_IMM(BPF_REG_0, 0),
7671                         BPF_EXIT_INSN(),
7672                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7673                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7674                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7675                         BPF_MOV64_IMM(BPF_REG_0, 0),
7676                         BPF_EXIT_INSN(),
7677                 },
7678                 .fixup_map1 = { 3 },
7679                 .result = ACCEPT,
7680         },
7681         {
7682                 "bounds checks mixing signed and unsigned, variant 10",
7683                 .insns = {
7684                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7685                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7686                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7687                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7688                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7689                                      BPF_FUNC_map_lookup_elem),
7690                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7691                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7692                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7693                         BPF_MOV64_IMM(BPF_REG_2, 0),
7694                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
7695                         BPF_MOV64_IMM(BPF_REG_0, 0),
7696                         BPF_EXIT_INSN(),
7697                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7698                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7699                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7700                         BPF_MOV64_IMM(BPF_REG_0, 0),
7701                         BPF_EXIT_INSN(),
7702                 },
7703                 .fixup_map1 = { 3 },
7704                 .errstr = "unbounded min value",
7705                 .result = REJECT,
7706         },
7707         {
7708                 "bounds checks mixing signed and unsigned, variant 11",
7709                 .insns = {
7710                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7711                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7712                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7713                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7714                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7715                                      BPF_FUNC_map_lookup_elem),
7716                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7717                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7718                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7719                         BPF_MOV64_IMM(BPF_REG_2, -1),
7720                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
7721                         /* Dead branch. */
7722                         BPF_MOV64_IMM(BPF_REG_0, 0),
7723                         BPF_EXIT_INSN(),
7724                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7725                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7726                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7727                         BPF_MOV64_IMM(BPF_REG_0, 0),
7728                         BPF_EXIT_INSN(),
7729                 },
7730                 .fixup_map1 = { 3 },
7731                 .errstr = "unbounded min value",
7732                 .result = REJECT,
7733         },
7734         {
7735                 "bounds checks mixing signed and unsigned, variant 12",
7736                 .insns = {
7737                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7738                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7739                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7740                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7741                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7742                                      BPF_FUNC_map_lookup_elem),
7743                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7744                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7745                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7746                         BPF_MOV64_IMM(BPF_REG_2, -6),
7747                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
7748                         BPF_MOV64_IMM(BPF_REG_0, 0),
7749                         BPF_EXIT_INSN(),
7750                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7751                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7752                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7753                         BPF_MOV64_IMM(BPF_REG_0, 0),
7754                         BPF_EXIT_INSN(),
7755                 },
7756                 .fixup_map1 = { 3 },
7757                 .errstr = "unbounded min value",
7758                 .result = REJECT,
7759         },
7760         {
7761                 "bounds checks mixing signed and unsigned, variant 13",
7762                 .insns = {
7763                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7764                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7765                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7766                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7767                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7768                                      BPF_FUNC_map_lookup_elem),
7769                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
7770                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7771                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7772                         BPF_MOV64_IMM(BPF_REG_2, 2),
7773                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
7774                         BPF_MOV64_IMM(BPF_REG_7, 1),
7775                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 0, 2),
7776                         BPF_MOV64_IMM(BPF_REG_0, 0),
7777                         BPF_EXIT_INSN(),
7778                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_1),
7779                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 4, 2),
7780                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_7),
7781                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7782                         BPF_MOV64_IMM(BPF_REG_0, 0),
7783                         BPF_EXIT_INSN(),
7784                 },
7785                 .fixup_map1 = { 3 },
7786                 .errstr = "unbounded min value",
7787                 .result = REJECT,
7788         },
7789         {
7790                 "bounds checks mixing signed and unsigned, variant 14",
7791                 .insns = {
7792                         BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
7793                                     offsetof(struct __sk_buff, mark)),
7794                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7795                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7796                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7797                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7798                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7799                                      BPF_FUNC_map_lookup_elem),
7800                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
7801                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7802                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7803                         BPF_MOV64_IMM(BPF_REG_2, -1),
7804                         BPF_MOV64_IMM(BPF_REG_8, 2),
7805                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_9, 42, 6),
7806                         BPF_JMP_REG(BPF_JSGT, BPF_REG_8, BPF_REG_1, 3),
7807                         BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
7808                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7809                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7810                         BPF_MOV64_IMM(BPF_REG_0, 0),
7811                         BPF_EXIT_INSN(),
7812                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, -3),
7813                         BPF_JMP_IMM(BPF_JA, 0, 0, -7),
7814                 },
7815                 .fixup_map1 = { 4 },
7816                 .errstr = "R0 invalid mem access 'inv'",
7817                 .result = REJECT,
7818         },
7819         {
7820                 "bounds checks mixing signed and unsigned, variant 15",
7821                 .insns = {
7822                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7823                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7824                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7825                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7826                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7827                                      BPF_FUNC_map_lookup_elem),
7828                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7829                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
7830                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
7831                         BPF_MOV64_IMM(BPF_REG_2, -6),
7832                         BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
7833                         BPF_MOV64_IMM(BPF_REG_0, 0),
7834                         BPF_EXIT_INSN(),
7835                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7836                         BPF_JMP_IMM(BPF_JGT, BPF_REG_0, 1, 2),
7837                         BPF_MOV64_IMM(BPF_REG_0, 0),
7838                         BPF_EXIT_INSN(),
7839                         BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
7840                         BPF_MOV64_IMM(BPF_REG_0, 0),
7841                         BPF_EXIT_INSN(),
7842                 },
7843                 .fixup_map1 = { 3 },
7844                 .errstr = "unbounded min value",
7845                 .result = REJECT,
7846                 .result_unpriv = REJECT,
7847         },
7848         {
7849                 "subtraction bounds (map value) variant 1",
7850                 .insns = {
7851                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7852                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7853                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7854                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7855                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7856                                      BPF_FUNC_map_lookup_elem),
7857                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
7858                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7859                         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0xff, 7),
7860                         BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
7861                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3, 0xff, 5),
7862                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_3),
7863                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 56),
7864                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7865                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7866                         BPF_EXIT_INSN(),
7867                         BPF_MOV64_IMM(BPF_REG_0, 0),
7868                         BPF_EXIT_INSN(),
7869                 },
7870                 .fixup_map1 = { 3 },
7871                 .errstr = "R0 max value is outside of the array range",
7872                 .result = REJECT,
7873         },
7874         {
7875                 "subtraction bounds (map value) variant 2",
7876                 .insns = {
7877                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7878                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7879                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7880                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7881                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7882                                      BPF_FUNC_map_lookup_elem),
7883                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
7884                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
7885                         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0xff, 6),
7886                         BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
7887                         BPF_JMP_IMM(BPF_JGT, BPF_REG_3, 0xff, 4),
7888                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_3),
7889                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
7890                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7891                         BPF_EXIT_INSN(),
7892                         BPF_MOV64_IMM(BPF_REG_0, 0),
7893                         BPF_EXIT_INSN(),
7894                 },
7895                 .fixup_map1 = { 3 },
7896                 .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
7897                 .result = REJECT,
7898         },
7899         {
7900                 "bounds check based on zero-extended MOV",
7901                 .insns = {
7902                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7903                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7904                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7905                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7906                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7907                                      BPF_FUNC_map_lookup_elem),
7908                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7909                         /* r2 = 0x0000'0000'ffff'ffff */
7910                         BPF_MOV32_IMM(BPF_REG_2, 0xffffffff),
7911                         /* r2 = 0 */
7912                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 32),
7913                         /* no-op */
7914                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
7915                         /* access at offset 0 */
7916                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7917                         /* exit */
7918                         BPF_MOV64_IMM(BPF_REG_0, 0),
7919                         BPF_EXIT_INSN(),
7920                 },
7921                 .fixup_map1 = { 3 },
7922                 .result = ACCEPT
7923         },
7924         {
7925                 "bounds check based on sign-extended MOV. test1",
7926                 .insns = {
7927                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7928                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7929                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7930                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7931                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7932                                      BPF_FUNC_map_lookup_elem),
7933                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7934                         /* r2 = 0xffff'ffff'ffff'ffff */
7935                         BPF_MOV64_IMM(BPF_REG_2, 0xffffffff),
7936                         /* r2 = 0xffff'ffff */
7937                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 32),
7938                         /* r0 = <oob pointer> */
7939                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
7940                         /* access to OOB pointer */
7941                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7942                         /* exit */
7943                         BPF_MOV64_IMM(BPF_REG_0, 0),
7944                         BPF_EXIT_INSN(),
7945                 },
7946                 .fixup_map1 = { 3 },
7947                 .errstr = "map_value pointer and 4294967295",
7948                 .result = REJECT
7949         },
7950         {
7951                 "bounds check based on sign-extended MOV. test2",
7952                 .insns = {
7953                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7954                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7955                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7956                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7957                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7958                                      BPF_FUNC_map_lookup_elem),
7959                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7960                         /* r2 = 0xffff'ffff'ffff'ffff */
7961                         BPF_MOV64_IMM(BPF_REG_2, 0xffffffff),
7962                         /* r2 = 0xfff'ffff */
7963                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 36),
7964                         /* r0 = <oob pointer> */
7965                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
7966                         /* access to OOB pointer */
7967                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
7968                         /* exit */
7969                         BPF_MOV64_IMM(BPF_REG_0, 0),
7970                         BPF_EXIT_INSN(),
7971                 },
7972                 .fixup_map1 = { 3 },
7973                 .errstr = "R0 min value is outside of the array range",
7974                 .result = REJECT
7975         },
7976         {
7977                 "bounds check based on reg_off + var_off + insn_off. test1",
7978                 .insns = {
7979                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
7980                                     offsetof(struct __sk_buff, mark)),
7981                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
7982                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
7983                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
7984                         BPF_LD_MAP_FD(BPF_REG_1, 0),
7985                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
7986                                      BPF_FUNC_map_lookup_elem),
7987                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
7988                         BPF_ALU64_IMM(BPF_AND, BPF_REG_6, 1),
7989                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, (1 << 29) - 1),
7990                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_6),
7991                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, (1 << 29) - 1),
7992                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 3),
7993                         BPF_MOV64_IMM(BPF_REG_0, 0),
7994                         BPF_EXIT_INSN(),
7995                 },
7996                 .fixup_map1 = { 4 },
7997                 .errstr = "value_size=8 off=1073741825",
7998                 .result = REJECT,
7999                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
8000         },
8001         {
8002                 "bounds check based on reg_off + var_off + insn_off. test2",
8003                 .insns = {
8004                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
8005                                     offsetof(struct __sk_buff, mark)),
8006                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8007                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8008                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8009                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8010                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8011                                      BPF_FUNC_map_lookup_elem),
8012                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
8013                         BPF_ALU64_IMM(BPF_AND, BPF_REG_6, 1),
8014                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, (1 << 30) - 1),
8015                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_6),
8016                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, (1 << 29) - 1),
8017                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 3),
8018                         BPF_MOV64_IMM(BPF_REG_0, 0),
8019                         BPF_EXIT_INSN(),
8020                 },
8021                 .fixup_map1 = { 4 },
8022                 .errstr = "value 1073741823",
8023                 .result = REJECT,
8024                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
8025         },
8026         {
8027                 "bounds check after truncation of non-boundary-crossing range",
8028                 .insns = {
8029                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8030                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8031                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8032                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8033                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8034                                      BPF_FUNC_map_lookup_elem),
8035                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8036                         /* r1 = [0x00, 0xff] */
8037                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8038                         BPF_MOV64_IMM(BPF_REG_2, 1),
8039                         /* r2 = 0x10'0000'0000 */
8040                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 36),
8041                         /* r1 = [0x10'0000'0000, 0x10'0000'00ff] */
8042                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
8043                         /* r1 = [0x10'7fff'ffff, 0x10'8000'00fe] */
8044                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
8045                         /* r1 = [0x00, 0xff] */
8046                         BPF_ALU32_IMM(BPF_SUB, BPF_REG_1, 0x7fffffff),
8047                         /* r1 = 0 */
8048                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
8049                         /* no-op */
8050                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8051                         /* access at offset 0 */
8052                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8053                         /* exit */
8054                         BPF_MOV64_IMM(BPF_REG_0, 0),
8055                         BPF_EXIT_INSN(),
8056                 },
8057                 .fixup_map1 = { 3 },
8058                 .result = ACCEPT
8059         },
8060         {
8061                 "bounds check after truncation of boundary-crossing range (1)",
8062                 .insns = {
8063                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8064                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8065                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8066                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8067                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8068                                      BPF_FUNC_map_lookup_elem),
8069                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8070                         /* r1 = [0x00, 0xff] */
8071                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8072                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
8073                         /* r1 = [0xffff'ff80, 0x1'0000'007f] */
8074                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
8075                         /* r1 = [0xffff'ff80, 0xffff'ffff] or
8076                          *      [0x0000'0000, 0x0000'007f]
8077                          */
8078                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 0),
8079                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
8080                         /* r1 = [0x00, 0xff] or
8081                          *      [0xffff'ffff'0000'0080, 0xffff'ffff'ffff'ffff]
8082                          */
8083                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
8084                         /* r1 = 0 or
8085                          *      [0x00ff'ffff'ff00'0000, 0x00ff'ffff'ffff'ffff]
8086                          */
8087                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
8088                         /* no-op or OOB pointer computation */
8089                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8090                         /* potentially OOB access */
8091                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8092                         /* exit */
8093                         BPF_MOV64_IMM(BPF_REG_0, 0),
8094                         BPF_EXIT_INSN(),
8095                 },
8096                 .fixup_map1 = { 3 },
8097                 /* not actually fully unbounded, but the bound is very high */
8098                 .errstr = "R0 unbounded memory access",
8099                 .result = REJECT
8100         },
8101         {
8102                 "bounds check after truncation of boundary-crossing range (2)",
8103                 .insns = {
8104                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8105                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8106                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8107                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8108                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8109                                      BPF_FUNC_map_lookup_elem),
8110                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
8111                         /* r1 = [0x00, 0xff] */
8112                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8113                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
8114                         /* r1 = [0xffff'ff80, 0x1'0000'007f] */
8115                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
8116                         /* r1 = [0xffff'ff80, 0xffff'ffff] or
8117                          *      [0x0000'0000, 0x0000'007f]
8118                          * difference to previous test: truncation via MOV32
8119                          * instead of ALU32.
8120                          */
8121                         BPF_MOV32_REG(BPF_REG_1, BPF_REG_1),
8122                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
8123                         /* r1 = [0x00, 0xff] or
8124                          *      [0xffff'ffff'0000'0080, 0xffff'ffff'ffff'ffff]
8125                          */
8126                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
8127                         /* r1 = 0 or
8128                          *      [0x00ff'ffff'ff00'0000, 0x00ff'ffff'ffff'ffff]
8129                          */
8130                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
8131                         /* no-op or OOB pointer computation */
8132                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8133                         /* potentially OOB access */
8134                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8135                         /* exit */
8136                         BPF_MOV64_IMM(BPF_REG_0, 0),
8137                         BPF_EXIT_INSN(),
8138                 },
8139                 .fixup_map1 = { 3 },
8140                 /* not actually fully unbounded, but the bound is very high */
8141                 .errstr = "R0 unbounded memory access",
8142                 .result = REJECT
8143         },
8144         {
8145                 "bounds check after wrapping 32-bit addition",
8146                 .insns = {
8147                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8148                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8149                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8150                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8151                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8152                                      BPF_FUNC_map_lookup_elem),
8153                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
8154                         /* r1 = 0x7fff'ffff */
8155                         BPF_MOV64_IMM(BPF_REG_1, 0x7fffffff),
8156                         /* r1 = 0xffff'fffe */
8157                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
8158                         /* r1 = 0 */
8159                         BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 2),
8160                         /* no-op */
8161                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8162                         /* access at offset 0 */
8163                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8164                         /* exit */
8165                         BPF_MOV64_IMM(BPF_REG_0, 0),
8166                         BPF_EXIT_INSN(),
8167                 },
8168                 .fixup_map1 = { 3 },
8169                 .result = ACCEPT
8170         },
8171         {
8172                 "bounds check after shift with oversized count operand",
8173                 .insns = {
8174                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8175                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8176                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8177                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8178                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8179                                      BPF_FUNC_map_lookup_elem),
8180                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
8181                         BPF_MOV64_IMM(BPF_REG_2, 32),
8182                         BPF_MOV64_IMM(BPF_REG_1, 1),
8183                         /* r1 = (u32)1 << (u32)32 = ? */
8184                         BPF_ALU32_REG(BPF_LSH, BPF_REG_1, BPF_REG_2),
8185                         /* r1 = [0x0000, 0xffff] */
8186                         BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xffff),
8187                         /* computes unknown pointer, potentially OOB */
8188                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8189                         /* potentially OOB access */
8190                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8191                         /* exit */
8192                         BPF_MOV64_IMM(BPF_REG_0, 0),
8193                         BPF_EXIT_INSN(),
8194                 },
8195                 .fixup_map1 = { 3 },
8196                 .errstr = "R0 max value is outside of the array range",
8197                 .result = REJECT
8198         },
8199         {
8200                 "bounds check after right shift of maybe-negative number",
8201                 .insns = {
8202                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8203                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8204                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8205                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8206                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8207                                      BPF_FUNC_map_lookup_elem),
8208                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
8209                         /* r1 = [0x00, 0xff] */
8210                         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8211                         /* r1 = [-0x01, 0xfe] */
8212                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 1),
8213                         /* r1 = 0 or 0xff'ffff'ffff'ffff */
8214                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
8215                         /* r1 = 0 or 0xffff'ffff'ffff */
8216                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
8217                         /* computes unknown pointer, potentially OOB */
8218                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8219                         /* potentially OOB access */
8220                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8221                         /* exit */
8222                         BPF_MOV64_IMM(BPF_REG_0, 0),
8223                         BPF_EXIT_INSN(),
8224                 },
8225                 .fixup_map1 = { 3 },
8226                 .errstr = "R0 unbounded memory access",
8227                 .result = REJECT
8228         },
8229         {
8230                 "bounds check map access with off+size signed 32bit overflow. test1",
8231                 .insns = {
8232                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8233                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8234                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8235                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8236                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8237                                      BPF_FUNC_map_lookup_elem),
8238                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
8239                         BPF_EXIT_INSN(),
8240                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x7ffffffe),
8241                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
8242                         BPF_JMP_A(0),
8243                         BPF_EXIT_INSN(),
8244                 },
8245                 .fixup_map1 = { 3 },
8246                 .errstr = "map_value pointer and 2147483646",
8247                 .result = REJECT
8248         },
8249         {
8250                 "bounds check map access with off+size signed 32bit overflow. test2",
8251                 .insns = {
8252                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8253                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8254                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8255                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8256                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8257                                      BPF_FUNC_map_lookup_elem),
8258                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
8259                         BPF_EXIT_INSN(),
8260                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
8261                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
8262                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
8263                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
8264                         BPF_JMP_A(0),
8265                         BPF_EXIT_INSN(),
8266                 },
8267                 .fixup_map1 = { 3 },
8268                 .errstr = "pointer offset 1073741822",
8269                 .result = REJECT
8270         },
8271         {
8272                 "bounds check map access with off+size signed 32bit overflow. test3",
8273                 .insns = {
8274                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8275                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8276                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8277                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8278                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8279                                      BPF_FUNC_map_lookup_elem),
8280                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
8281                         BPF_EXIT_INSN(),
8282                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 0x1fffffff),
8283                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 0x1fffffff),
8284                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 2),
8285                         BPF_JMP_A(0),
8286                         BPF_EXIT_INSN(),
8287                 },
8288                 .fixup_map1 = { 3 },
8289                 .errstr = "pointer offset -1073741822",
8290                 .result = REJECT
8291         },
8292         {
8293                 "bounds check map access with off+size signed 32bit overflow. test4",
8294                 .insns = {
8295                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8296                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8297                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8298                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8299                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8300                                      BPF_FUNC_map_lookup_elem),
8301                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
8302                         BPF_EXIT_INSN(),
8303                         BPF_MOV64_IMM(BPF_REG_1, 1000000),
8304                         BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 1000000),
8305                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8306                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 2),
8307                         BPF_JMP_A(0),
8308                         BPF_EXIT_INSN(),
8309                 },
8310                 .fixup_map1 = { 3 },
8311                 .errstr = "map_value pointer and 1000000000000",
8312                 .result = REJECT
8313         },
8314         {
8315                 "pointer/scalar confusion in state equality check (way 1)",
8316                 .insns = {
8317                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8318                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8319                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8320                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8321                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8322                                      BPF_FUNC_map_lookup_elem),
8323                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
8324                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
8325                         BPF_JMP_A(1),
8326                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
8327                         BPF_JMP_A(0),
8328                         BPF_EXIT_INSN(),
8329                 },
8330                 .fixup_map1 = { 3 },
8331                 .result = ACCEPT,
8332                 .retval = POINTER_VALUE,
8333                 .result_unpriv = REJECT,
8334                 .errstr_unpriv = "R0 leaks addr as return value"
8335         },
8336         {
8337                 "pointer/scalar confusion in state equality check (way 2)",
8338                 .insns = {
8339                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8340                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8341                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8342                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8343                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8344                                      BPF_FUNC_map_lookup_elem),
8345                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
8346                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
8347                         BPF_JMP_A(1),
8348                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
8349                         BPF_EXIT_INSN(),
8350                 },
8351                 .fixup_map1 = { 3 },
8352                 .result = ACCEPT,
8353                 .retval = POINTER_VALUE,
8354                 .result_unpriv = REJECT,
8355                 .errstr_unpriv = "R0 leaks addr as return value"
8356         },
8357         {
8358                 "variable-offset ctx access",
8359                 .insns = {
8360                         /* Get an unknown value */
8361                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
8362                         /* Make it small and 4-byte aligned */
8363                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
8364                         /* add it to skb.  We now have either &skb->len or
8365                          * &skb->pkt_type, but we don't know which
8366                          */
8367                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
8368                         /* dereference it */
8369                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
8370                         BPF_EXIT_INSN(),
8371                 },
8372                 .errstr = "variable ctx access var_off=(0x0; 0x4)",
8373                 .result = REJECT,
8374                 .prog_type = BPF_PROG_TYPE_LWT_IN,
8375         },
8376         {
8377                 "variable-offset stack access",
8378                 .insns = {
8379                         /* Fill the top 8 bytes of the stack */
8380                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8381                         /* Get an unknown value */
8382                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
8383                         /* Make it small and 4-byte aligned */
8384                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
8385                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 8),
8386                         /* add it to fp.  We now have either fp-4 or fp-8, but
8387                          * we don't know which
8388                          */
8389                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
8390                         /* dereference it */
8391                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_2, 0),
8392                         BPF_EXIT_INSN(),
8393                 },
8394                 .errstr = "variable stack access var_off=(0xfffffffffffffff8; 0x4)",
8395                 .result = REJECT,
8396                 .prog_type = BPF_PROG_TYPE_LWT_IN,
8397         },
8398         {
8399                 "indirect variable-offset stack access",
8400                 .insns = {
8401                         /* Fill the top 8 bytes of the stack */
8402                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8403                         /* Get an unknown value */
8404                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
8405                         /* Make it small and 4-byte aligned */
8406                         BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
8407                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 8),
8408                         /* add it to fp.  We now have either fp-4 or fp-8, but
8409                          * we don't know which
8410                          */
8411                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
8412                         /* dereference it indirectly */
8413                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8414                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8415                                      BPF_FUNC_map_lookup_elem),
8416                         BPF_MOV64_IMM(BPF_REG_0, 0),
8417                         BPF_EXIT_INSN(),
8418                 },
8419                 .fixup_map1 = { 5 },
8420                 .errstr = "variable stack read R2",
8421                 .result = REJECT,
8422                 .prog_type = BPF_PROG_TYPE_LWT_IN,
8423         },
8424         {
8425                 "direct stack access with 32-bit wraparound. test1",
8426                 .insns = {
8427                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
8428                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
8429                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
8430                         BPF_MOV32_IMM(BPF_REG_0, 0),
8431                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8432                         BPF_EXIT_INSN()
8433                 },
8434                 .errstr = "fp pointer and 2147483647",
8435                 .result = REJECT
8436         },
8437         {
8438                 "direct stack access with 32-bit wraparound. test2",
8439                 .insns = {
8440                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
8441                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x3fffffff),
8442                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x3fffffff),
8443                         BPF_MOV32_IMM(BPF_REG_0, 0),
8444                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8445                         BPF_EXIT_INSN()
8446                 },
8447                 .errstr = "fp pointer and 1073741823",
8448                 .result = REJECT
8449         },
8450         {
8451                 "direct stack access with 32-bit wraparound. test3",
8452                 .insns = {
8453                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
8454                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x1fffffff),
8455                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x1fffffff),
8456                         BPF_MOV32_IMM(BPF_REG_0, 0),
8457                         BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
8458                         BPF_EXIT_INSN()
8459                 },
8460                 .errstr = "fp pointer offset 1073741822",
8461                 .result = REJECT
8462         },
8463         {
8464                 "liveness pruning and write screening",
8465                 .insns = {
8466                         /* Get an unknown value */
8467                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
8468                         /* branch conditions teach us nothing about R2 */
8469                         BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),
8470                         BPF_MOV64_IMM(BPF_REG_0, 0),
8471                         BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),
8472                         BPF_MOV64_IMM(BPF_REG_0, 0),
8473                         BPF_EXIT_INSN(),
8474                 },
8475                 .errstr = "R0 !read_ok",
8476                 .result = REJECT,
8477                 .prog_type = BPF_PROG_TYPE_LWT_IN,
8478         },
8479         {
8480                 "varlen_map_value_access pruning",
8481                 .insns = {
8482                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
8483                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
8484                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
8485                         BPF_LD_MAP_FD(BPF_REG_1, 0),
8486                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8487                                      BPF_FUNC_map_lookup_elem),
8488                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
8489                         BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
8490                         BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
8491                         BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
8492                         BPF_MOV32_IMM(BPF_REG_1, 0),
8493                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
8494                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
8495                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
8496                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
8497                                    offsetof(struct test_val, foo)),
8498                         BPF_EXIT_INSN(),
8499                 },
8500                 .fixup_map2 = { 3 },
8501                 .errstr_unpriv = "R0 leaks addr",
8502                 .errstr = "R0 unbounded memory access",
8503                 .result_unpriv = REJECT,
8504                 .result = REJECT,
8505                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8506         },
8507         {
8508                 "invalid 64-bit BPF_END",
8509                 .insns = {
8510                         BPF_MOV32_IMM(BPF_REG_0, 0),
8511                         {
8512                                 .code  = BPF_ALU64 | BPF_END | BPF_TO_LE,
8513                                 .dst_reg = BPF_REG_0,
8514                                 .src_reg = 0,
8515                                 .off   = 0,
8516                                 .imm   = 32,
8517                         },
8518                         BPF_EXIT_INSN(),
8519                 },
8520                 .errstr = "unknown opcode d7",
8521                 .result = REJECT,
8522         },
8523         {
8524                 "XDP, using ifindex from netdev",
8525                 .insns = {
8526                         BPF_MOV64_IMM(BPF_REG_0, 0),
8527                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8528                                     offsetof(struct xdp_md, ingress_ifindex)),
8529                         BPF_JMP_IMM(BPF_JLT, BPF_REG_2, 1, 1),
8530                         BPF_MOV64_IMM(BPF_REG_0, 1),
8531                         BPF_EXIT_INSN(),
8532                 },
8533                 .result = ACCEPT,
8534                 .prog_type = BPF_PROG_TYPE_XDP,
8535                 .retval = 1,
8536         },
8537         {
8538                 "meta access, test1",
8539                 .insns = {
8540                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8541                                     offsetof(struct xdp_md, data_meta)),
8542                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8543                                     offsetof(struct xdp_md, data)),
8544                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
8545                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
8546                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
8547                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8548                         BPF_MOV64_IMM(BPF_REG_0, 0),
8549                         BPF_EXIT_INSN(),
8550                 },
8551                 .result = ACCEPT,
8552                 .prog_type = BPF_PROG_TYPE_XDP,
8553         },
8554         {
8555                 "meta access, test2",
8556                 .insns = {
8557                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8558                                     offsetof(struct xdp_md, data_meta)),
8559                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8560                                     offsetof(struct xdp_md, data)),
8561                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
8562                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 8),
8563                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
8564                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
8565                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
8566                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
8567                         BPF_MOV64_IMM(BPF_REG_0, 0),
8568                         BPF_EXIT_INSN(),
8569                 },
8570                 .result = REJECT,
8571                 .errstr = "invalid access to packet, off=-8",
8572                 .prog_type = BPF_PROG_TYPE_XDP,
8573         },
8574         {
8575                 "meta access, test3",
8576                 .insns = {
8577                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8578                                     offsetof(struct xdp_md, data_meta)),
8579                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8580                                     offsetof(struct xdp_md, data_end)),
8581                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
8582                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
8583                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
8584                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8585                         BPF_MOV64_IMM(BPF_REG_0, 0),
8586                         BPF_EXIT_INSN(),
8587                 },
8588                 .result = REJECT,
8589                 .errstr = "invalid access to packet",
8590                 .prog_type = BPF_PROG_TYPE_XDP,
8591         },
8592         {
8593                 "meta access, test4",
8594                 .insns = {
8595                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8596                                     offsetof(struct xdp_md, data_meta)),
8597                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8598                                     offsetof(struct xdp_md, data_end)),
8599                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
8600                                     offsetof(struct xdp_md, data)),
8601                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
8602                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
8603                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
8604                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8605                         BPF_MOV64_IMM(BPF_REG_0, 0),
8606                         BPF_EXIT_INSN(),
8607                 },
8608                 .result = REJECT,
8609                 .errstr = "invalid access to packet",
8610                 .prog_type = BPF_PROG_TYPE_XDP,
8611         },
8612         {
8613                 "meta access, test5",
8614                 .insns = {
8615                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8616                                     offsetof(struct xdp_md, data_meta)),
8617                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
8618                                     offsetof(struct xdp_md, data)),
8619                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
8620                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
8621                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_4, 3),
8622                         BPF_MOV64_IMM(BPF_REG_2, -8),
8623                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
8624                                      BPF_FUNC_xdp_adjust_meta),
8625                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 0),
8626                         BPF_MOV64_IMM(BPF_REG_0, 0),
8627                         BPF_EXIT_INSN(),
8628                 },
8629                 .result = REJECT,
8630                 .errstr = "R3 !read_ok",
8631                 .prog_type = BPF_PROG_TYPE_XDP,
8632         },
8633         {
8634                 "meta access, test6",
8635                 .insns = {
8636                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8637                                     offsetof(struct xdp_md, data_meta)),
8638                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8639                                     offsetof(struct xdp_md, data)),
8640                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
8641                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
8642                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
8643                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
8644                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_0, 1),
8645                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8646                         BPF_MOV64_IMM(BPF_REG_0, 0),
8647                         BPF_EXIT_INSN(),
8648                 },
8649                 .result = REJECT,
8650                 .errstr = "invalid access to packet",
8651                 .prog_type = BPF_PROG_TYPE_XDP,
8652         },
8653         {
8654                 "meta access, test7",
8655                 .insns = {
8656                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8657                                     offsetof(struct xdp_md, data_meta)),
8658                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8659                                     offsetof(struct xdp_md, data)),
8660                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
8661                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
8662                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
8663                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
8664                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
8665                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8666                         BPF_MOV64_IMM(BPF_REG_0, 0),
8667                         BPF_EXIT_INSN(),
8668                 },
8669                 .result = ACCEPT,
8670                 .prog_type = BPF_PROG_TYPE_XDP,
8671         },
8672         {
8673                 "meta access, test8",
8674                 .insns = {
8675                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8676                                     offsetof(struct xdp_md, data_meta)),
8677                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8678                                     offsetof(struct xdp_md, data)),
8679                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
8680                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0xFFFF),
8681                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
8682                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8683                         BPF_MOV64_IMM(BPF_REG_0, 0),
8684                         BPF_EXIT_INSN(),
8685                 },
8686                 .result = ACCEPT,
8687                 .prog_type = BPF_PROG_TYPE_XDP,
8688         },
8689         {
8690                 "meta access, test9",
8691                 .insns = {
8692                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8693                                     offsetof(struct xdp_md, data_meta)),
8694                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8695                                     offsetof(struct xdp_md, data)),
8696                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
8697                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0xFFFF),
8698                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 1),
8699                         BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
8700                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8701                         BPF_MOV64_IMM(BPF_REG_0, 0),
8702                         BPF_EXIT_INSN(),
8703                 },
8704                 .result = REJECT,
8705                 .errstr = "invalid access to packet",
8706                 .prog_type = BPF_PROG_TYPE_XDP,
8707         },
8708         {
8709                 "meta access, test10",
8710                 .insns = {
8711                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8712                                     offsetof(struct xdp_md, data_meta)),
8713                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8714                                     offsetof(struct xdp_md, data)),
8715                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
8716                                     offsetof(struct xdp_md, data_end)),
8717                         BPF_MOV64_IMM(BPF_REG_5, 42),
8718                         BPF_MOV64_IMM(BPF_REG_6, 24),
8719                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_5, -8),
8720                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
8721                         BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -8),
8722                         BPF_JMP_IMM(BPF_JGT, BPF_REG_5, 100, 6),
8723                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_5),
8724                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
8725                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
8726                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
8727                         BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_5, 1),
8728                         BPF_LDX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
8729                         BPF_MOV64_IMM(BPF_REG_0, 0),
8730                         BPF_EXIT_INSN(),
8731                 },
8732                 .result = REJECT,
8733                 .errstr = "invalid access to packet",
8734                 .prog_type = BPF_PROG_TYPE_XDP,
8735         },
8736         {
8737                 "meta access, test11",
8738                 .insns = {
8739                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8740                                     offsetof(struct xdp_md, data_meta)),
8741                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8742                                     offsetof(struct xdp_md, data)),
8743                         BPF_MOV64_IMM(BPF_REG_5, 42),
8744                         BPF_MOV64_IMM(BPF_REG_6, 24),
8745                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_5, -8),
8746                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
8747                         BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -8),
8748                         BPF_JMP_IMM(BPF_JGT, BPF_REG_5, 100, 6),
8749                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_5),
8750                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
8751                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
8752                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
8753                         BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_3, 1),
8754                         BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_5, 0),
8755                         BPF_MOV64_IMM(BPF_REG_0, 0),
8756                         BPF_EXIT_INSN(),
8757                 },
8758                 .result = ACCEPT,
8759                 .prog_type = BPF_PROG_TYPE_XDP,
8760         },
8761         {
8762                 "meta access, test12",
8763                 .insns = {
8764                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8765                                     offsetof(struct xdp_md, data_meta)),
8766                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8767                                     offsetof(struct xdp_md, data)),
8768                         BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
8769                                     offsetof(struct xdp_md, data_end)),
8770                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
8771                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 16),
8772                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_4, 5),
8773                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 0),
8774                         BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
8775                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 16),
8776                         BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 1),
8777                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
8778                         BPF_MOV64_IMM(BPF_REG_0, 0),
8779                         BPF_EXIT_INSN(),
8780                 },
8781                 .result = ACCEPT,
8782                 .prog_type = BPF_PROG_TYPE_XDP,
8783         },
8784         {
8785                 "arithmetic ops make PTR_TO_CTX unusable",
8786                 .insns = {
8787                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
8788                                       offsetof(struct __sk_buff, data) -
8789                                       offsetof(struct __sk_buff, mark)),
8790                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
8791                                     offsetof(struct __sk_buff, mark)),
8792                         BPF_EXIT_INSN(),
8793                 },
8794                 .errstr = "dereference of modified ctx ptr",
8795                 .result = REJECT,
8796                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
8797         },
8798         {
8799                 "pkt_end - pkt_start is allowed",
8800                 .insns = {
8801                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
8802                                     offsetof(struct __sk_buff, data_end)),
8803                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8804                                     offsetof(struct __sk_buff, data)),
8805                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_2),
8806                         BPF_EXIT_INSN(),
8807                 },
8808                 .result = ACCEPT,
8809                 .retval = TEST_DATA_LEN,
8810                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
8811         },
8812         {
8813                 "XDP pkt read, pkt_end mangling, bad access 1",
8814                 .insns = {
8815                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8816                                     offsetof(struct xdp_md, data)),
8817                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8818                                     offsetof(struct xdp_md, data_end)),
8819                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8820                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8821                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 8),
8822                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
8823                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8824                         BPF_MOV64_IMM(BPF_REG_0, 0),
8825                         BPF_EXIT_INSN(),
8826                 },
8827                 .errstr = "R3 pointer arithmetic on PTR_TO_PACKET_END",
8828                 .result = REJECT,
8829                 .prog_type = BPF_PROG_TYPE_XDP,
8830         },
8831         {
8832                 "XDP pkt read, pkt_end mangling, bad access 2",
8833                 .insns = {
8834                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8835                                     offsetof(struct xdp_md, data)),
8836                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8837                                     offsetof(struct xdp_md, data_end)),
8838                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8839                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8840                         BPF_ALU64_IMM(BPF_SUB, BPF_REG_3, 8),
8841                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
8842                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8843                         BPF_MOV64_IMM(BPF_REG_0, 0),
8844                         BPF_EXIT_INSN(),
8845                 },
8846                 .errstr = "R3 pointer arithmetic on PTR_TO_PACKET_END",
8847                 .result = REJECT,
8848                 .prog_type = BPF_PROG_TYPE_XDP,
8849         },
8850         {
8851                 "XDP pkt read, pkt_data' > pkt_end, good access",
8852                 .insns = {
8853                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8854                                     offsetof(struct xdp_md, data)),
8855                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8856                                     offsetof(struct xdp_md, data_end)),
8857                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8858                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8859                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
8860                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8861                         BPF_MOV64_IMM(BPF_REG_0, 0),
8862                         BPF_EXIT_INSN(),
8863                 },
8864                 .result = ACCEPT,
8865                 .prog_type = BPF_PROG_TYPE_XDP,
8866         },
8867         {
8868                 "XDP pkt read, pkt_data' > pkt_end, bad access 1",
8869                 .insns = {
8870                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8871                                     offsetof(struct xdp_md, data)),
8872                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8873                                     offsetof(struct xdp_md, data_end)),
8874                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8875                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8876                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
8877                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
8878                         BPF_MOV64_IMM(BPF_REG_0, 0),
8879                         BPF_EXIT_INSN(),
8880                 },
8881                 .errstr = "R1 offset is outside of the packet",
8882                 .result = REJECT,
8883                 .prog_type = BPF_PROG_TYPE_XDP,
8884                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8885         },
8886         {
8887                 "XDP pkt read, pkt_data' > pkt_end, bad access 2",
8888                 .insns = {
8889                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8890                                     offsetof(struct xdp_md, data)),
8891                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8892                                     offsetof(struct xdp_md, data_end)),
8893                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8894                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8895                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0),
8896                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8897                         BPF_MOV64_IMM(BPF_REG_0, 0),
8898                         BPF_EXIT_INSN(),
8899                 },
8900                 .errstr = "R1 offset is outside of the packet",
8901                 .result = REJECT,
8902                 .prog_type = BPF_PROG_TYPE_XDP,
8903         },
8904         {
8905                 "XDP pkt read, pkt_end > pkt_data', good access",
8906                 .insns = {
8907                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8908                                     offsetof(struct xdp_md, data)),
8909                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8910                                     offsetof(struct xdp_md, data_end)),
8911                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8912                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8913                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
8914                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8915                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
8916                         BPF_MOV64_IMM(BPF_REG_0, 0),
8917                         BPF_EXIT_INSN(),
8918                 },
8919                 .result = ACCEPT,
8920                 .prog_type = BPF_PROG_TYPE_XDP,
8921                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8922         },
8923         {
8924                 "XDP pkt read, pkt_end > pkt_data', bad access 1",
8925                 .insns = {
8926                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8927                                     offsetof(struct xdp_md, data)),
8928                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8929                                     offsetof(struct xdp_md, data_end)),
8930                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8931                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8932                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
8933                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8934                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8935                         BPF_MOV64_IMM(BPF_REG_0, 0),
8936                         BPF_EXIT_INSN(),
8937                 },
8938                 .errstr = "R1 offset is outside of the packet",
8939                 .result = REJECT,
8940                 .prog_type = BPF_PROG_TYPE_XDP,
8941         },
8942         {
8943                 "XDP pkt read, pkt_end > pkt_data', bad access 2",
8944                 .insns = {
8945                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8946                                     offsetof(struct xdp_md, data)),
8947                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8948                                     offsetof(struct xdp_md, data_end)),
8949                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8950                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8951                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
8952                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8953                         BPF_MOV64_IMM(BPF_REG_0, 0),
8954                         BPF_EXIT_INSN(),
8955                 },
8956                 .errstr = "R1 offset is outside of the packet",
8957                 .result = REJECT,
8958                 .prog_type = BPF_PROG_TYPE_XDP,
8959         },
8960         {
8961                 "XDP pkt read, pkt_data' < pkt_end, good access",
8962                 .insns = {
8963                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8964                                     offsetof(struct xdp_md, data)),
8965                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8966                                     offsetof(struct xdp_md, data_end)),
8967                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8968                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8969                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
8970                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8971                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
8972                         BPF_MOV64_IMM(BPF_REG_0, 0),
8973                         BPF_EXIT_INSN(),
8974                 },
8975                 .result = ACCEPT,
8976                 .prog_type = BPF_PROG_TYPE_XDP,
8977                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
8978         },
8979         {
8980                 "XDP pkt read, pkt_data' < pkt_end, bad access 1",
8981                 .insns = {
8982                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
8983                                     offsetof(struct xdp_md, data)),
8984                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
8985                                     offsetof(struct xdp_md, data_end)),
8986                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8987                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
8988                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
8989                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
8990                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
8991                         BPF_MOV64_IMM(BPF_REG_0, 0),
8992                         BPF_EXIT_INSN(),
8993                 },
8994                 .errstr = "R1 offset is outside of the packet",
8995                 .result = REJECT,
8996                 .prog_type = BPF_PROG_TYPE_XDP,
8997         },
8998         {
8999                 "XDP pkt read, pkt_data' < pkt_end, bad access 2",
9000                 .insns = {
9001                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9002                                     offsetof(struct xdp_md, data)),
9003                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9004                                     offsetof(struct xdp_md, data_end)),
9005                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9006                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9007                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
9008                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9009                         BPF_MOV64_IMM(BPF_REG_0, 0),
9010                         BPF_EXIT_INSN(),
9011                 },
9012                 .errstr = "R1 offset is outside of the packet",
9013                 .result = REJECT,
9014                 .prog_type = BPF_PROG_TYPE_XDP,
9015         },
9016         {
9017                 "XDP pkt read, pkt_end < pkt_data', good access",
9018                 .insns = {
9019                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9020                                     offsetof(struct xdp_md, data)),
9021                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9022                                     offsetof(struct xdp_md, data_end)),
9023                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9024                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9025                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
9026                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9027                         BPF_MOV64_IMM(BPF_REG_0, 0),
9028                         BPF_EXIT_INSN(),
9029                 },
9030                 .result = ACCEPT,
9031                 .prog_type = BPF_PROG_TYPE_XDP,
9032         },
9033         {
9034                 "XDP pkt read, pkt_end < pkt_data', bad access 1",
9035                 .insns = {
9036                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9037                                     offsetof(struct xdp_md, data)),
9038                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9039                                     offsetof(struct xdp_md, data_end)),
9040                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9041                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9042                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
9043                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9044                         BPF_MOV64_IMM(BPF_REG_0, 0),
9045                         BPF_EXIT_INSN(),
9046                 },
9047                 .errstr = "R1 offset is outside of the packet",
9048                 .result = REJECT,
9049                 .prog_type = BPF_PROG_TYPE_XDP,
9050                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9051         },
9052         {
9053                 "XDP pkt read, pkt_end < pkt_data', bad access 2",
9054                 .insns = {
9055                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9056                                     offsetof(struct xdp_md, data)),
9057                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9058                                     offsetof(struct xdp_md, data_end)),
9059                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9060                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9061                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0),
9062                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9063                         BPF_MOV64_IMM(BPF_REG_0, 0),
9064                         BPF_EXIT_INSN(),
9065                 },
9066                 .errstr = "R1 offset is outside of the packet",
9067                 .result = REJECT,
9068                 .prog_type = BPF_PROG_TYPE_XDP,
9069         },
9070         {
9071                 "XDP pkt read, pkt_data' >= pkt_end, good access",
9072                 .insns = {
9073                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9074                                     offsetof(struct xdp_md, data)),
9075                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9076                                     offsetof(struct xdp_md, data_end)),
9077                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9078                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9079                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
9080                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9081                         BPF_MOV64_IMM(BPF_REG_0, 0),
9082                         BPF_EXIT_INSN(),
9083                 },
9084                 .result = ACCEPT,
9085                 .prog_type = BPF_PROG_TYPE_XDP,
9086                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9087         },
9088         {
9089                 "XDP pkt read, pkt_data' >= pkt_end, bad access 1",
9090                 .insns = {
9091                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9092                                     offsetof(struct xdp_md, data)),
9093                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9094                                     offsetof(struct xdp_md, data_end)),
9095                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9096                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9097                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
9098                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9099                         BPF_MOV64_IMM(BPF_REG_0, 0),
9100                         BPF_EXIT_INSN(),
9101                 },
9102                 .errstr = "R1 offset is outside of the packet",
9103                 .result = REJECT,
9104                 .prog_type = BPF_PROG_TYPE_XDP,
9105         },
9106         {
9107                 "XDP pkt read, pkt_data' >= pkt_end, bad access 2",
9108                 .insns = {
9109                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9110                                     offsetof(struct xdp_md, data)),
9111                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9112                                     offsetof(struct xdp_md, data_end)),
9113                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9114                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9115                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0),
9116                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9117                         BPF_MOV64_IMM(BPF_REG_0, 0),
9118                         BPF_EXIT_INSN(),
9119                 },
9120                 .errstr = "R1 offset is outside of the packet",
9121                 .result = REJECT,
9122                 .prog_type = BPF_PROG_TYPE_XDP,
9123                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9124         },
9125         {
9126                 "XDP pkt read, pkt_end >= pkt_data', good access",
9127                 .insns = {
9128                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9129                                     offsetof(struct xdp_md, data)),
9130                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9131                                     offsetof(struct xdp_md, data_end)),
9132                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9133                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9134                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
9135                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9136                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9137                         BPF_MOV64_IMM(BPF_REG_0, 0),
9138                         BPF_EXIT_INSN(),
9139                 },
9140                 .result = ACCEPT,
9141                 .prog_type = BPF_PROG_TYPE_XDP,
9142         },
9143         {
9144                 "XDP pkt read, pkt_end >= pkt_data', bad access 1",
9145                 .insns = {
9146                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9147                                     offsetof(struct xdp_md, data)),
9148                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9149                                     offsetof(struct xdp_md, data_end)),
9150                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9151                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9152                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
9153                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9154                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9155                         BPF_MOV64_IMM(BPF_REG_0, 0),
9156                         BPF_EXIT_INSN(),
9157                 },
9158                 .errstr = "R1 offset is outside of the packet",
9159                 .result = REJECT,
9160                 .prog_type = BPF_PROG_TYPE_XDP,
9161                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9162         },
9163         {
9164                 "XDP pkt read, pkt_end >= pkt_data', bad access 2",
9165                 .insns = {
9166                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9167                                     offsetof(struct xdp_md, data)),
9168                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9169                                     offsetof(struct xdp_md, data_end)),
9170                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9171                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9172                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
9173                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9174                         BPF_MOV64_IMM(BPF_REG_0, 0),
9175                         BPF_EXIT_INSN(),
9176                 },
9177                 .errstr = "R1 offset is outside of the packet",
9178                 .result = REJECT,
9179                 .prog_type = BPF_PROG_TYPE_XDP,
9180         },
9181         {
9182                 "XDP pkt read, pkt_data' <= pkt_end, good access",
9183                 .insns = {
9184                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9185                                     offsetof(struct xdp_md, data)),
9186                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9187                                     offsetof(struct xdp_md, data_end)),
9188                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9189                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9190                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9191                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9192                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9193                         BPF_MOV64_IMM(BPF_REG_0, 0),
9194                         BPF_EXIT_INSN(),
9195                 },
9196                 .result = ACCEPT,
9197                 .prog_type = BPF_PROG_TYPE_XDP,
9198         },
9199         {
9200                 "XDP pkt read, pkt_data' <= pkt_end, bad access 1",
9201                 .insns = {
9202                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9203                                     offsetof(struct xdp_md, data)),
9204                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9205                                     offsetof(struct xdp_md, data_end)),
9206                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9207                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9208                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9209                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9210                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9211                         BPF_MOV64_IMM(BPF_REG_0, 0),
9212                         BPF_EXIT_INSN(),
9213                 },
9214                 .errstr = "R1 offset is outside of the packet",
9215                 .result = REJECT,
9216                 .prog_type = BPF_PROG_TYPE_XDP,
9217                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9218         },
9219         {
9220                 "XDP pkt read, pkt_data' <= pkt_end, bad access 2",
9221                 .insns = {
9222                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9223                                     offsetof(struct xdp_md, data)),
9224                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9225                                     offsetof(struct xdp_md, data_end)),
9226                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9227                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9228                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9229                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9230                         BPF_MOV64_IMM(BPF_REG_0, 0),
9231                         BPF_EXIT_INSN(),
9232                 },
9233                 .errstr = "R1 offset is outside of the packet",
9234                 .result = REJECT,
9235                 .prog_type = BPF_PROG_TYPE_XDP,
9236         },
9237         {
9238                 "XDP pkt read, pkt_end <= pkt_data', good access",
9239                 .insns = {
9240                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9241                                     offsetof(struct xdp_md, data)),
9242                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9243                                     offsetof(struct xdp_md, data_end)),
9244                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9245                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9246                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
9247                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9248                         BPF_MOV64_IMM(BPF_REG_0, 0),
9249                         BPF_EXIT_INSN(),
9250                 },
9251                 .result = ACCEPT,
9252                 .prog_type = BPF_PROG_TYPE_XDP,
9253                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9254         },
9255         {
9256                 "XDP pkt read, pkt_end <= pkt_data', bad access 1",
9257                 .insns = {
9258                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9259                                     offsetof(struct xdp_md, data)),
9260                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9261                                     offsetof(struct xdp_md, data_end)),
9262                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9263                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9264                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
9265                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9266                         BPF_MOV64_IMM(BPF_REG_0, 0),
9267                         BPF_EXIT_INSN(),
9268                 },
9269                 .errstr = "R1 offset is outside of the packet",
9270                 .result = REJECT,
9271                 .prog_type = BPF_PROG_TYPE_XDP,
9272         },
9273         {
9274                 "XDP pkt read, pkt_end <= pkt_data', bad access 2",
9275                 .insns = {
9276                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9277                                     offsetof(struct xdp_md, data)),
9278                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9279                                     offsetof(struct xdp_md, data_end)),
9280                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9281                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9282                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0),
9283                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9284                         BPF_MOV64_IMM(BPF_REG_0, 0),
9285                         BPF_EXIT_INSN(),
9286                 },
9287                 .errstr = "R1 offset is outside of the packet",
9288                 .result = REJECT,
9289                 .prog_type = BPF_PROG_TYPE_XDP,
9290                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9291         },
9292         {
9293                 "XDP pkt read, pkt_meta' > pkt_data, good access",
9294                 .insns = {
9295                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9296                                     offsetof(struct xdp_md, data_meta)),
9297                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9298                                     offsetof(struct xdp_md, data)),
9299                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9300                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9301                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
9302                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9303                         BPF_MOV64_IMM(BPF_REG_0, 0),
9304                         BPF_EXIT_INSN(),
9305                 },
9306                 .result = ACCEPT,
9307                 .prog_type = BPF_PROG_TYPE_XDP,
9308         },
9309         {
9310                 "XDP pkt read, pkt_meta' > pkt_data, bad access 1",
9311                 .insns = {
9312                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9313                                     offsetof(struct xdp_md, data_meta)),
9314                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9315                                     offsetof(struct xdp_md, data)),
9316                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9317                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9318                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
9319                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9320                         BPF_MOV64_IMM(BPF_REG_0, 0),
9321                         BPF_EXIT_INSN(),
9322                 },
9323                 .errstr = "R1 offset is outside of the packet",
9324                 .result = REJECT,
9325                 .prog_type = BPF_PROG_TYPE_XDP,
9326                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9327         },
9328         {
9329                 "XDP pkt read, pkt_meta' > pkt_data, bad access 2",
9330                 .insns = {
9331                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9332                                     offsetof(struct xdp_md, data_meta)),
9333                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9334                                     offsetof(struct xdp_md, data)),
9335                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9336                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9337                         BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0),
9338                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9339                         BPF_MOV64_IMM(BPF_REG_0, 0),
9340                         BPF_EXIT_INSN(),
9341                 },
9342                 .errstr = "R1 offset is outside of the packet",
9343                 .result = REJECT,
9344                 .prog_type = BPF_PROG_TYPE_XDP,
9345         },
9346         {
9347                 "XDP pkt read, pkt_data > pkt_meta', good access",
9348                 .insns = {
9349                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9350                                     offsetof(struct xdp_md, data_meta)),
9351                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9352                                     offsetof(struct xdp_md, data)),
9353                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9354                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9355                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
9356                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9357                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9358                         BPF_MOV64_IMM(BPF_REG_0, 0),
9359                         BPF_EXIT_INSN(),
9360                 },
9361                 .result = ACCEPT,
9362                 .prog_type = BPF_PROG_TYPE_XDP,
9363                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9364         },
9365         {
9366                 "XDP pkt read, pkt_data > pkt_meta', bad access 1",
9367                 .insns = {
9368                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9369                                     offsetof(struct xdp_md, data_meta)),
9370                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9371                                     offsetof(struct xdp_md, data)),
9372                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9373                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9374                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
9375                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9376                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9377                         BPF_MOV64_IMM(BPF_REG_0, 0),
9378                         BPF_EXIT_INSN(),
9379                 },
9380                 .errstr = "R1 offset is outside of the packet",
9381                 .result = REJECT,
9382                 .prog_type = BPF_PROG_TYPE_XDP,
9383         },
9384         {
9385                 "XDP pkt read, pkt_data > pkt_meta', bad access 2",
9386                 .insns = {
9387                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9388                                     offsetof(struct xdp_md, data_meta)),
9389                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9390                                     offsetof(struct xdp_md, data)),
9391                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9392                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9393                         BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
9394                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9395                         BPF_MOV64_IMM(BPF_REG_0, 0),
9396                         BPF_EXIT_INSN(),
9397                 },
9398                 .errstr = "R1 offset is outside of the packet",
9399                 .result = REJECT,
9400                 .prog_type = BPF_PROG_TYPE_XDP,
9401         },
9402         {
9403                 "XDP pkt read, pkt_meta' < pkt_data, good access",
9404                 .insns = {
9405                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9406                                     offsetof(struct xdp_md, data_meta)),
9407                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9408                                     offsetof(struct xdp_md, data)),
9409                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9410                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9411                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
9412                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9413                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9414                         BPF_MOV64_IMM(BPF_REG_0, 0),
9415                         BPF_EXIT_INSN(),
9416                 },
9417                 .result = ACCEPT,
9418                 .prog_type = BPF_PROG_TYPE_XDP,
9419                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9420         },
9421         {
9422                 "XDP pkt read, pkt_meta' < pkt_data, bad access 1",
9423                 .insns = {
9424                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9425                                     offsetof(struct xdp_md, data_meta)),
9426                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9427                                     offsetof(struct xdp_md, data)),
9428                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9429                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9430                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
9431                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9432                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9433                         BPF_MOV64_IMM(BPF_REG_0, 0),
9434                         BPF_EXIT_INSN(),
9435                 },
9436                 .errstr = "R1 offset is outside of the packet",
9437                 .result = REJECT,
9438                 .prog_type = BPF_PROG_TYPE_XDP,
9439         },
9440         {
9441                 "XDP pkt read, pkt_meta' < pkt_data, bad access 2",
9442                 .insns = {
9443                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9444                                     offsetof(struct xdp_md, data_meta)),
9445                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9446                                     offsetof(struct xdp_md, data)),
9447                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9448                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9449                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
9450                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9451                         BPF_MOV64_IMM(BPF_REG_0, 0),
9452                         BPF_EXIT_INSN(),
9453                 },
9454                 .errstr = "R1 offset is outside of the packet",
9455                 .result = REJECT,
9456                 .prog_type = BPF_PROG_TYPE_XDP,
9457         },
9458         {
9459                 "XDP pkt read, pkt_data < pkt_meta', good access",
9460                 .insns = {
9461                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9462                                     offsetof(struct xdp_md, data_meta)),
9463                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9464                                     offsetof(struct xdp_md, data)),
9465                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9466                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9467                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
9468                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9469                         BPF_MOV64_IMM(BPF_REG_0, 0),
9470                         BPF_EXIT_INSN(),
9471                 },
9472                 .result = ACCEPT,
9473                 .prog_type = BPF_PROG_TYPE_XDP,
9474         },
9475         {
9476                 "XDP pkt read, pkt_data < pkt_meta', bad access 1",
9477                 .insns = {
9478                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9479                                     offsetof(struct xdp_md, data_meta)),
9480                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9481                                     offsetof(struct xdp_md, data)),
9482                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9483                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9484                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
9485                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9486                         BPF_MOV64_IMM(BPF_REG_0, 0),
9487                         BPF_EXIT_INSN(),
9488                 },
9489                 .errstr = "R1 offset is outside of the packet",
9490                 .result = REJECT,
9491                 .prog_type = BPF_PROG_TYPE_XDP,
9492                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9493         },
9494         {
9495                 "XDP pkt read, pkt_data < pkt_meta', bad access 2",
9496                 .insns = {
9497                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9498                                     offsetof(struct xdp_md, data_meta)),
9499                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9500                                     offsetof(struct xdp_md, data)),
9501                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9502                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9503                         BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0),
9504                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9505                         BPF_MOV64_IMM(BPF_REG_0, 0),
9506                         BPF_EXIT_INSN(),
9507                 },
9508                 .errstr = "R1 offset is outside of the packet",
9509                 .result = REJECT,
9510                 .prog_type = BPF_PROG_TYPE_XDP,
9511         },
9512         {
9513                 "XDP pkt read, pkt_meta' >= pkt_data, good access",
9514                 .insns = {
9515                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9516                                     offsetof(struct xdp_md, data_meta)),
9517                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9518                                     offsetof(struct xdp_md, data)),
9519                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9520                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9521                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
9522                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9523                         BPF_MOV64_IMM(BPF_REG_0, 0),
9524                         BPF_EXIT_INSN(),
9525                 },
9526                 .result = ACCEPT,
9527                 .prog_type = BPF_PROG_TYPE_XDP,
9528                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9529         },
9530         {
9531                 "XDP pkt read, pkt_meta' >= pkt_data, bad access 1",
9532                 .insns = {
9533                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9534                                     offsetof(struct xdp_md, data_meta)),
9535                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9536                                     offsetof(struct xdp_md, data)),
9537                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9538                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9539                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
9540                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9541                         BPF_MOV64_IMM(BPF_REG_0, 0),
9542                         BPF_EXIT_INSN(),
9543                 },
9544                 .errstr = "R1 offset is outside of the packet",
9545                 .result = REJECT,
9546                 .prog_type = BPF_PROG_TYPE_XDP,
9547         },
9548         {
9549                 "XDP pkt read, pkt_meta' >= pkt_data, bad access 2",
9550                 .insns = {
9551                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9552                                     offsetof(struct xdp_md, data_meta)),
9553                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9554                                     offsetof(struct xdp_md, data)),
9555                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9556                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9557                         BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0),
9558                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9559                         BPF_MOV64_IMM(BPF_REG_0, 0),
9560                         BPF_EXIT_INSN(),
9561                 },
9562                 .errstr = "R1 offset is outside of the packet",
9563                 .result = REJECT,
9564                 .prog_type = BPF_PROG_TYPE_XDP,
9565                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9566         },
9567         {
9568                 "XDP pkt read, pkt_data >= pkt_meta', good access",
9569                 .insns = {
9570                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9571                                     offsetof(struct xdp_md, data_meta)),
9572                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9573                                     offsetof(struct xdp_md, data)),
9574                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9575                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9576                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
9577                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9578                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9579                         BPF_MOV64_IMM(BPF_REG_0, 0),
9580                         BPF_EXIT_INSN(),
9581                 },
9582                 .result = ACCEPT,
9583                 .prog_type = BPF_PROG_TYPE_XDP,
9584         },
9585         {
9586                 "XDP pkt read, pkt_data >= pkt_meta', bad access 1",
9587                 .insns = {
9588                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9589                                     offsetof(struct xdp_md, data_meta)),
9590                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9591                                     offsetof(struct xdp_md, data)),
9592                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9593                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9594                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
9595                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9596                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9597                         BPF_MOV64_IMM(BPF_REG_0, 0),
9598                         BPF_EXIT_INSN(),
9599                 },
9600                 .errstr = "R1 offset is outside of the packet",
9601                 .result = REJECT,
9602                 .prog_type = BPF_PROG_TYPE_XDP,
9603                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9604         },
9605         {
9606                 "XDP pkt read, pkt_data >= pkt_meta', bad access 2",
9607                 .insns = {
9608                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9609                                     offsetof(struct xdp_md, data_meta)),
9610                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9611                                     offsetof(struct xdp_md, data)),
9612                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9613                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9614                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
9615                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9616                         BPF_MOV64_IMM(BPF_REG_0, 0),
9617                         BPF_EXIT_INSN(),
9618                 },
9619                 .errstr = "R1 offset is outside of the packet",
9620                 .result = REJECT,
9621                 .prog_type = BPF_PROG_TYPE_XDP,
9622         },
9623         {
9624                 "XDP pkt read, pkt_meta' <= pkt_data, good access",
9625                 .insns = {
9626                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9627                                     offsetof(struct xdp_md, data_meta)),
9628                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9629                                     offsetof(struct xdp_md, data)),
9630                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9631                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9632                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9633                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9634                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9635                         BPF_MOV64_IMM(BPF_REG_0, 0),
9636                         BPF_EXIT_INSN(),
9637                 },
9638                 .result = ACCEPT,
9639                 .prog_type = BPF_PROG_TYPE_XDP,
9640         },
9641         {
9642                 "XDP pkt read, pkt_meta' <= pkt_data, bad access 1",
9643                 .insns = {
9644                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9645                                     offsetof(struct xdp_md, data_meta)),
9646                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9647                                     offsetof(struct xdp_md, data)),
9648                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9649                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9650                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9651                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9652                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
9653                         BPF_MOV64_IMM(BPF_REG_0, 0),
9654                         BPF_EXIT_INSN(),
9655                 },
9656                 .errstr = "R1 offset is outside of the packet",
9657                 .result = REJECT,
9658                 .prog_type = BPF_PROG_TYPE_XDP,
9659                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9660         },
9661         {
9662                 "XDP pkt read, pkt_meta' <= pkt_data, bad access 2",
9663                 .insns = {
9664                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9665                                     offsetof(struct xdp_md, data_meta)),
9666                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9667                                     offsetof(struct xdp_md, data)),
9668                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9669                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9670                         BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
9671                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9672                         BPF_MOV64_IMM(BPF_REG_0, 0),
9673                         BPF_EXIT_INSN(),
9674                 },
9675                 .errstr = "R1 offset is outside of the packet",
9676                 .result = REJECT,
9677                 .prog_type = BPF_PROG_TYPE_XDP,
9678         },
9679         {
9680                 "XDP pkt read, pkt_data <= pkt_meta', good access",
9681                 .insns = {
9682                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9683                                     offsetof(struct xdp_md, data_meta)),
9684                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9685                                     offsetof(struct xdp_md, data)),
9686                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9687                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9688                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
9689                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9690                         BPF_MOV64_IMM(BPF_REG_0, 0),
9691                         BPF_EXIT_INSN(),
9692                 },
9693                 .result = ACCEPT,
9694                 .prog_type = BPF_PROG_TYPE_XDP,
9695                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9696         },
9697         {
9698                 "XDP pkt read, pkt_data <= pkt_meta', bad access 1",
9699                 .insns = {
9700                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9701                                     offsetof(struct xdp_md, data_meta)),
9702                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9703                                     offsetof(struct xdp_md, data)),
9704                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9705                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9706                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
9707                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
9708                         BPF_MOV64_IMM(BPF_REG_0, 0),
9709                         BPF_EXIT_INSN(),
9710                 },
9711                 .errstr = "R1 offset is outside of the packet",
9712                 .result = REJECT,
9713                 .prog_type = BPF_PROG_TYPE_XDP,
9714         },
9715         {
9716                 "XDP pkt read, pkt_data <= pkt_meta', bad access 2",
9717                 .insns = {
9718                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
9719                                     offsetof(struct xdp_md, data_meta)),
9720                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
9721                                     offsetof(struct xdp_md, data)),
9722                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
9723                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9724                         BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0),
9725                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
9726                         BPF_MOV64_IMM(BPF_REG_0, 0),
9727                         BPF_EXIT_INSN(),
9728                 },
9729                 .errstr = "R1 offset is outside of the packet",
9730                 .result = REJECT,
9731                 .prog_type = BPF_PROG_TYPE_XDP,
9732                 .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
9733         },
9734         {
9735                 "check deducing bounds from const, 1",
9736                 .insns = {
9737                         BPF_MOV64_IMM(BPF_REG_0, 1),
9738                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 0),
9739                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9740                         BPF_EXIT_INSN(),
9741                 },
9742                 .result = REJECT,
9743                 .errstr = "R0 tried to subtract pointer from scalar",
9744         },
9745         {
9746                 "check deducing bounds from const, 2",
9747                 .insns = {
9748                         BPF_MOV64_IMM(BPF_REG_0, 1),
9749                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1),
9750                         BPF_EXIT_INSN(),
9751                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 1, 1),
9752                         BPF_EXIT_INSN(),
9753                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
9754                         BPF_EXIT_INSN(),
9755                 },
9756                 .result = ACCEPT,
9757                 .retval = 1,
9758         },
9759         {
9760                 "check deducing bounds from const, 3",
9761                 .insns = {
9762                         BPF_MOV64_IMM(BPF_REG_0, 0),
9763                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
9764                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9765                         BPF_EXIT_INSN(),
9766                 },
9767                 .result = REJECT,
9768                 .errstr = "R0 tried to subtract pointer from scalar",
9769         },
9770         {
9771                 "check deducing bounds from const, 4",
9772                 .insns = {
9773                         BPF_MOV64_IMM(BPF_REG_0, 0),
9774                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 1),
9775                         BPF_EXIT_INSN(),
9776                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
9777                         BPF_EXIT_INSN(),
9778                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
9779                         BPF_EXIT_INSN(),
9780                 },
9781                 .result = ACCEPT,
9782         },
9783         {
9784                 "check deducing bounds from const, 5",
9785                 .insns = {
9786                         BPF_MOV64_IMM(BPF_REG_0, 0),
9787                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
9788                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9789                         BPF_EXIT_INSN(),
9790                 },
9791                 .result = REJECT,
9792                 .errstr = "R0 tried to subtract pointer from scalar",
9793         },
9794         {
9795                 "check deducing bounds from const, 6",
9796                 .insns = {
9797                         BPF_MOV64_IMM(BPF_REG_0, 0),
9798                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
9799                         BPF_EXIT_INSN(),
9800                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9801                         BPF_EXIT_INSN(),
9802                 },
9803                 .result = REJECT,
9804                 .errstr = "R0 tried to subtract pointer from scalar",
9805         },
9806         {
9807                 "check deducing bounds from const, 7",
9808                 .insns = {
9809                         BPF_MOV64_IMM(BPF_REG_0, ~0),
9810                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
9811                         BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
9812                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9813                                     offsetof(struct __sk_buff, mark)),
9814                         BPF_EXIT_INSN(),
9815                 },
9816                 .result = REJECT,
9817                 .errstr = "dereference of modified ctx ptr",
9818         },
9819         {
9820                 "check deducing bounds from const, 8",
9821                 .insns = {
9822                         BPF_MOV64_IMM(BPF_REG_0, ~0),
9823                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
9824                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
9825                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9826                                     offsetof(struct __sk_buff, mark)),
9827                         BPF_EXIT_INSN(),
9828                 },
9829                 .result = REJECT,
9830                 .errstr = "dereference of modified ctx ptr",
9831         },
9832         {
9833                 "check deducing bounds from const, 9",
9834                 .insns = {
9835                         BPF_MOV64_IMM(BPF_REG_0, 0),
9836                         BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
9837                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9838                         BPF_EXIT_INSN(),
9839                 },
9840                 .result = REJECT,
9841                 .errstr = "R0 tried to subtract pointer from scalar",
9842         },
9843         {
9844                 "check deducing bounds from const, 10",
9845                 .insns = {
9846                         BPF_MOV64_IMM(BPF_REG_0, 0),
9847                         BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
9848                         /* Marks reg as unknown. */
9849                         BPF_ALU64_IMM(BPF_NEG, BPF_REG_0, 0),
9850                         BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
9851                         BPF_EXIT_INSN(),
9852                 },
9853                 .result = REJECT,
9854                 .errstr = "math between ctx pointer and register with unbounded min value is not allowed",
9855         },
9856         {
9857                 "bpf_exit with invalid return code. test1",
9858                 .insns = {
9859                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
9860                         BPF_EXIT_INSN(),
9861                 },
9862                 .errstr = "R0 has value (0x0; 0xffffffff)",
9863                 .result = REJECT,
9864                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9865         },
9866         {
9867                 "bpf_exit with invalid return code. test2",
9868                 .insns = {
9869                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
9870                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
9871                         BPF_EXIT_INSN(),
9872                 },
9873                 .result = ACCEPT,
9874                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9875         },
9876         {
9877                 "bpf_exit with invalid return code. test3",
9878                 .insns = {
9879                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
9880                         BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 3),
9881                         BPF_EXIT_INSN(),
9882                 },
9883                 .errstr = "R0 has value (0x0; 0x3)",
9884                 .result = REJECT,
9885                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9886         },
9887         {
9888                 "bpf_exit with invalid return code. test4",
9889                 .insns = {
9890                         BPF_MOV64_IMM(BPF_REG_0, 1),
9891                         BPF_EXIT_INSN(),
9892                 },
9893                 .result = ACCEPT,
9894                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9895         },
9896         {
9897                 "bpf_exit with invalid return code. test5",
9898                 .insns = {
9899                         BPF_MOV64_IMM(BPF_REG_0, 2),
9900                         BPF_EXIT_INSN(),
9901                 },
9902                 .errstr = "R0 has value (0x2; 0x0)",
9903                 .result = REJECT,
9904                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9905         },
9906         {
9907                 "bpf_exit with invalid return code. test6",
9908                 .insns = {
9909                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
9910                         BPF_EXIT_INSN(),
9911                 },
9912                 .errstr = "R0 is not a known value (ctx)",
9913                 .result = REJECT,
9914                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9915         },
9916         {
9917                 "bpf_exit with invalid return code. test7",
9918                 .insns = {
9919                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
9920                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 4),
9921                         BPF_ALU64_REG(BPF_MUL, BPF_REG_0, BPF_REG_2),
9922                         BPF_EXIT_INSN(),
9923                 },
9924                 .errstr = "R0 has unknown scalar value",
9925                 .result = REJECT,
9926                 .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
9927         },
9928         {
9929                 "calls: basic sanity",
9930                 .insns = {
9931                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
9932                         BPF_MOV64_IMM(BPF_REG_0, 1),
9933                         BPF_EXIT_INSN(),
9934                         BPF_MOV64_IMM(BPF_REG_0, 2),
9935                         BPF_EXIT_INSN(),
9936                 },
9937                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
9938                 .result = ACCEPT,
9939         },
9940         {
9941                 "calls: not on unpriviledged",
9942                 .insns = {
9943                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
9944                         BPF_MOV64_IMM(BPF_REG_0, 1),
9945                         BPF_EXIT_INSN(),
9946                         BPF_MOV64_IMM(BPF_REG_0, 2),
9947                         BPF_EXIT_INSN(),
9948                 },
9949                 .errstr_unpriv = "function calls to other bpf functions are allowed for root only",
9950                 .result_unpriv = REJECT,
9951                 .result = ACCEPT,
9952                 .retval = 1,
9953         },
9954         {
9955                 "calls: div by 0 in subprog",
9956                 .insns = {
9957                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
9958                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
9959                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
9960                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
9961                                     offsetof(struct __sk_buff, data_end)),
9962                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
9963                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
9964                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
9965                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
9966                         BPF_MOV64_IMM(BPF_REG_0, 1),
9967                         BPF_EXIT_INSN(),
9968                         BPF_MOV32_IMM(BPF_REG_2, 0),
9969                         BPF_MOV32_IMM(BPF_REG_3, 1),
9970                         BPF_ALU32_REG(BPF_DIV, BPF_REG_3, BPF_REG_2),
9971                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9972                                     offsetof(struct __sk_buff, data)),
9973                         BPF_EXIT_INSN(),
9974                 },
9975                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
9976                 .result = ACCEPT,
9977                 .retval = 1,
9978         },
9979         {
9980                 "calls: multiple ret types in subprog 1",
9981                 .insns = {
9982                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
9983                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
9984                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
9985                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
9986                                     offsetof(struct __sk_buff, data_end)),
9987                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
9988                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
9989                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
9990                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
9991                         BPF_MOV64_IMM(BPF_REG_0, 1),
9992                         BPF_EXIT_INSN(),
9993                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
9994                                     offsetof(struct __sk_buff, data)),
9995                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
9996                         BPF_MOV32_IMM(BPF_REG_0, 42),
9997                         BPF_EXIT_INSN(),
9998                 },
9999                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10000                 .result = REJECT,
10001                 .errstr = "R0 invalid mem access 'inv'",
10002         },
10003         {
10004                 "calls: multiple ret types in subprog 2",
10005                 .insns = {
10006                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10007                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
10008                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10009                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
10010                                     offsetof(struct __sk_buff, data_end)),
10011                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
10012                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
10013                         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
10014                         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
10015                         BPF_MOV64_IMM(BPF_REG_0, 1),
10016                         BPF_EXIT_INSN(),
10017                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10018                                     offsetof(struct __sk_buff, data)),
10019                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10020                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 9),
10021                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10022                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10023                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10024                         BPF_LD_MAP_FD(BPF_REG_1, 0),
10025                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10026                                      BPF_FUNC_map_lookup_elem),
10027                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
10028                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_6,
10029                                     offsetof(struct __sk_buff, data)),
10030                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 64),
10031                         BPF_EXIT_INSN(),
10032                 },
10033                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10034                 .fixup_map1 = { 16 },
10035                 .result = REJECT,
10036                 .errstr = "R0 min value is outside of the array range",
10037         },
10038         {
10039                 "calls: overlapping caller/callee",
10040                 .insns = {
10041                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 0),
10042                         BPF_MOV64_IMM(BPF_REG_0, 1),
10043                         BPF_EXIT_INSN(),
10044                 },
10045                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10046                 .errstr = "last insn is not an exit or jmp",
10047                 .result = REJECT,
10048         },
10049         {
10050                 "calls: wrong recursive calls",
10051                 .insns = {
10052                         BPF_JMP_IMM(BPF_JA, 0, 0, 4),
10053                         BPF_JMP_IMM(BPF_JA, 0, 0, 4),
10054                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
10055                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
10056                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
10057                         BPF_MOV64_IMM(BPF_REG_0, 1),
10058                         BPF_EXIT_INSN(),
10059                 },
10060                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10061                 .errstr = "jump out of range",
10062                 .result = REJECT,
10063         },
10064         {
10065                 "calls: wrong src reg",
10066                 .insns = {
10067                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 2, 0, 0),
10068                         BPF_MOV64_IMM(BPF_REG_0, 1),
10069                         BPF_EXIT_INSN(),
10070                 },
10071                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10072                 .errstr = "BPF_CALL uses reserved fields",
10073                 .result = REJECT,
10074         },
10075         {
10076                 "calls: wrong off value",
10077                 .insns = {
10078                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, -1, 2),
10079                         BPF_MOV64_IMM(BPF_REG_0, 1),
10080                         BPF_EXIT_INSN(),
10081                         BPF_MOV64_IMM(BPF_REG_0, 2),
10082                         BPF_EXIT_INSN(),
10083                 },
10084                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10085                 .errstr = "BPF_CALL uses reserved fields",
10086                 .result = REJECT,
10087         },
10088         {
10089                 "calls: jump back loop",
10090                 .insns = {
10091                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -1),
10092                         BPF_MOV64_IMM(BPF_REG_0, 1),
10093                         BPF_EXIT_INSN(),
10094                 },
10095                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10096                 .errstr = "back-edge from insn 0 to 0",
10097                 .result = REJECT,
10098         },
10099         {
10100                 "calls: conditional call",
10101                 .insns = {
10102                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10103                                     offsetof(struct __sk_buff, mark)),
10104                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
10105                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10106                         BPF_MOV64_IMM(BPF_REG_0, 1),
10107                         BPF_EXIT_INSN(),
10108                         BPF_MOV64_IMM(BPF_REG_0, 2),
10109                         BPF_EXIT_INSN(),
10110                 },
10111                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10112                 .errstr = "jump out of range",
10113                 .result = REJECT,
10114         },
10115         {
10116                 "calls: conditional call 2",
10117                 .insns = {
10118                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10119                                     offsetof(struct __sk_buff, mark)),
10120                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
10121                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10122                         BPF_MOV64_IMM(BPF_REG_0, 1),
10123                         BPF_EXIT_INSN(),
10124                         BPF_MOV64_IMM(BPF_REG_0, 2),
10125                         BPF_EXIT_INSN(),
10126                         BPF_MOV64_IMM(BPF_REG_0, 3),
10127                         BPF_EXIT_INSN(),
10128                 },
10129                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10130                 .result = ACCEPT,
10131         },
10132         {
10133                 "calls: conditional call 3",
10134                 .insns = {
10135                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10136                                     offsetof(struct __sk_buff, mark)),
10137                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
10138                         BPF_JMP_IMM(BPF_JA, 0, 0, 4),
10139                         BPF_MOV64_IMM(BPF_REG_0, 1),
10140                         BPF_EXIT_INSN(),
10141                         BPF_MOV64_IMM(BPF_REG_0, 1),
10142                         BPF_JMP_IMM(BPF_JA, 0, 0, -6),
10143                         BPF_MOV64_IMM(BPF_REG_0, 3),
10144                         BPF_JMP_IMM(BPF_JA, 0, 0, -6),
10145                 },
10146                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10147                 .errstr = "back-edge from insn",
10148                 .result = REJECT,
10149         },
10150         {
10151                 "calls: conditional call 4",
10152                 .insns = {
10153                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10154                                     offsetof(struct __sk_buff, mark)),
10155                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
10156                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10157                         BPF_MOV64_IMM(BPF_REG_0, 1),
10158                         BPF_EXIT_INSN(),
10159                         BPF_MOV64_IMM(BPF_REG_0, 1),
10160                         BPF_JMP_IMM(BPF_JA, 0, 0, -5),
10161                         BPF_MOV64_IMM(BPF_REG_0, 3),
10162                         BPF_EXIT_INSN(),
10163                 },
10164                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10165                 .result = ACCEPT,
10166         },
10167         {
10168                 "calls: conditional call 5",
10169                 .insns = {
10170                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10171                                     offsetof(struct __sk_buff, mark)),
10172                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
10173                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10174                         BPF_MOV64_IMM(BPF_REG_0, 1),
10175                         BPF_EXIT_INSN(),
10176                         BPF_MOV64_IMM(BPF_REG_0, 1),
10177                         BPF_JMP_IMM(BPF_JA, 0, 0, -6),
10178                         BPF_MOV64_IMM(BPF_REG_0, 3),
10179                         BPF_EXIT_INSN(),
10180                 },
10181                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10182                 .errstr = "back-edge from insn",
10183                 .result = REJECT,
10184         },
10185         {
10186                 "calls: conditional call 6",
10187                 .insns = {
10188                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10189                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, -2),
10190                         BPF_EXIT_INSN(),
10191                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10192                                     offsetof(struct __sk_buff, mark)),
10193                         BPF_EXIT_INSN(),
10194                 },
10195                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10196                 .errstr = "back-edge from insn",
10197                 .result = REJECT,
10198         },
10199         {
10200                 "calls: using r0 returned by callee",
10201                 .insns = {
10202                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10203                         BPF_EXIT_INSN(),
10204                         BPF_MOV64_IMM(BPF_REG_0, 2),
10205                         BPF_EXIT_INSN(),
10206                 },
10207                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10208                 .result = ACCEPT,
10209         },
10210         {
10211                 "calls: using uninit r0 from callee",
10212                 .insns = {
10213                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10214                         BPF_EXIT_INSN(),
10215                         BPF_EXIT_INSN(),
10216                 },
10217                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10218                 .errstr = "!read_ok",
10219                 .result = REJECT,
10220         },
10221         {
10222                 "calls: callee is using r1",
10223                 .insns = {
10224                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10225                         BPF_EXIT_INSN(),
10226                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10227                                     offsetof(struct __sk_buff, len)),
10228                         BPF_EXIT_INSN(),
10229                 },
10230                 .prog_type = BPF_PROG_TYPE_SCHED_ACT,
10231                 .result = ACCEPT,
10232                 .retval = TEST_DATA_LEN,
10233         },
10234         {
10235                 "calls: callee using args1",
10236                 .insns = {
10237                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10238                         BPF_EXIT_INSN(),
10239                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
10240                         BPF_EXIT_INSN(),
10241                 },
10242                 .errstr_unpriv = "allowed for root only",
10243                 .result_unpriv = REJECT,
10244                 .result = ACCEPT,
10245                 .retval = POINTER_VALUE,
10246         },
10247         {
10248                 "calls: callee using wrong args2",
10249                 .insns = {
10250                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10251                         BPF_EXIT_INSN(),
10252                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
10253                         BPF_EXIT_INSN(),
10254                 },
10255                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10256                 .errstr = "R2 !read_ok",
10257                 .result = REJECT,
10258         },
10259         {
10260                 "calls: callee using two args",
10261                 .insns = {
10262                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10263                         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_6,
10264                                     offsetof(struct __sk_buff, len)),
10265                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_6,
10266                                     offsetof(struct __sk_buff, len)),
10267                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10268                         BPF_EXIT_INSN(),
10269                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
10270                         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
10271                         BPF_EXIT_INSN(),
10272                 },
10273                 .errstr_unpriv = "allowed for root only",
10274                 .result_unpriv = REJECT,
10275                 .result = ACCEPT,
10276                 .retval = TEST_DATA_LEN + TEST_DATA_LEN - ETH_HLEN - ETH_HLEN,
10277         },
10278         {
10279                 "calls: callee changing pkt pointers",
10280                 .insns = {
10281                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
10282                                     offsetof(struct xdp_md, data)),
10283                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
10284                                     offsetof(struct xdp_md, data_end)),
10285                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_6),
10286                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 8),
10287                         BPF_JMP_REG(BPF_JGT, BPF_REG_8, BPF_REG_7, 2),
10288                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10289                         /* clear_all_pkt_pointers() has to walk all frames
10290                          * to make sure that pkt pointers in the caller
10291                          * are cleared when callee is calling a helper that
10292                          * adjusts packet size
10293                          */
10294                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
10295                         BPF_MOV32_IMM(BPF_REG_0, 0),
10296                         BPF_EXIT_INSN(),
10297                         BPF_MOV64_IMM(BPF_REG_2, 0),
10298                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10299                                      BPF_FUNC_xdp_adjust_head),
10300                         BPF_EXIT_INSN(),
10301                 },
10302                 .result = REJECT,
10303                 .errstr = "R6 invalid mem access 'inv'",
10304                 .prog_type = BPF_PROG_TYPE_XDP,
10305         },
10306         {
10307                 "calls: two calls with args",
10308                 .insns = {
10309                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10310                         BPF_EXIT_INSN(),
10311                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10312                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
10313                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
10314                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10315                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10316                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
10317                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
10318                         BPF_EXIT_INSN(),
10319                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10320                                     offsetof(struct __sk_buff, len)),
10321                         BPF_EXIT_INSN(),
10322                 },
10323                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10324                 .result = ACCEPT,
10325                 .retval = TEST_DATA_LEN + TEST_DATA_LEN,
10326         },
10327         {
10328                 "calls: calls with stack arith",
10329                 .insns = {
10330                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10331                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
10332                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10333                         BPF_EXIT_INSN(),
10334                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
10335                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10336                         BPF_EXIT_INSN(),
10337                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
10338                         BPF_MOV64_IMM(BPF_REG_0, 42),
10339                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
10340                         BPF_EXIT_INSN(),
10341                 },
10342                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10343                 .result = ACCEPT,
10344                 .retval = 42,
10345         },
10346         {
10347                 "calls: calls with misaligned stack access",
10348                 .insns = {
10349                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10350                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -63),
10351                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10352                         BPF_EXIT_INSN(),
10353                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -61),
10354                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10355                         BPF_EXIT_INSN(),
10356                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -63),
10357                         BPF_MOV64_IMM(BPF_REG_0, 42),
10358                         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
10359                         BPF_EXIT_INSN(),
10360                 },
10361                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10362                 .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
10363                 .errstr = "misaligned stack access",
10364                 .result = REJECT,
10365         },
10366         {
10367                 "calls: calls control flow, jump test",
10368                 .insns = {
10369                         BPF_MOV64_IMM(BPF_REG_0, 42),
10370                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
10371                         BPF_MOV64_IMM(BPF_REG_0, 43),
10372                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10373                         BPF_JMP_IMM(BPF_JA, 0, 0, -3),
10374                         BPF_EXIT_INSN(),
10375                 },
10376                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10377                 .result = ACCEPT,
10378                 .retval = 43,
10379         },
10380         {
10381                 "calls: calls control flow, jump test 2",
10382                 .insns = {
10383                         BPF_MOV64_IMM(BPF_REG_0, 42),
10384                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
10385                         BPF_MOV64_IMM(BPF_REG_0, 43),
10386                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
10387                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -3),
10388                         BPF_EXIT_INSN(),
10389                 },
10390                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10391                 .errstr = "jump out of range from insn 1 to 4",
10392                 .result = REJECT,
10393         },
10394         {
10395                 "calls: two calls with bad jump",
10396                 .insns = {
10397                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10398                         BPF_EXIT_INSN(),
10399                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10400                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
10401                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
10402                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10403                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10404                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
10405                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
10406                         BPF_EXIT_INSN(),
10407                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10408                                     offsetof(struct __sk_buff, len)),
10409                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, -3),
10410                         BPF_EXIT_INSN(),
10411                 },
10412                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10413                 .errstr = "jump out of range from insn 11 to 9",
10414                 .result = REJECT,
10415         },
10416         {
10417                 "calls: recursive call. test1",
10418                 .insns = {
10419                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10420                         BPF_EXIT_INSN(),
10421                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -1),
10422                         BPF_EXIT_INSN(),
10423                 },
10424                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10425                 .errstr = "back-edge",
10426                 .result = REJECT,
10427         },
10428         {
10429                 "calls: recursive call. test2",
10430                 .insns = {
10431                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10432                         BPF_EXIT_INSN(),
10433                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -3),
10434                         BPF_EXIT_INSN(),
10435                 },
10436                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10437                 .errstr = "back-edge",
10438                 .result = REJECT,
10439         },
10440         {
10441                 "calls: unreachable code",
10442                 .insns = {
10443                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10444                         BPF_EXIT_INSN(),
10445                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10446                         BPF_EXIT_INSN(),
10447                         BPF_MOV64_IMM(BPF_REG_0, 0),
10448                         BPF_EXIT_INSN(),
10449                         BPF_MOV64_IMM(BPF_REG_0, 0),
10450                         BPF_EXIT_INSN(),
10451                 },
10452                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10453                 .errstr = "unreachable insn 6",
10454                 .result = REJECT,
10455         },
10456         {
10457                 "calls: invalid call",
10458                 .insns = {
10459                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10460                         BPF_EXIT_INSN(),
10461                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -4),
10462                         BPF_EXIT_INSN(),
10463                 },
10464                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10465                 .errstr = "invalid destination",
10466                 .result = REJECT,
10467         },
10468         {
10469                 "calls: invalid call 2",
10470                 .insns = {
10471                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10472                         BPF_EXIT_INSN(),
10473                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 0x7fffffff),
10474                         BPF_EXIT_INSN(),
10475                 },
10476                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10477                 .errstr = "invalid destination",
10478                 .result = REJECT,
10479         },
10480         {
10481                 "calls: jumping across function bodies. test1",
10482                 .insns = {
10483                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10484                         BPF_MOV64_IMM(BPF_REG_0, 0),
10485                         BPF_EXIT_INSN(),
10486                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -3),
10487                         BPF_EXIT_INSN(),
10488                 },
10489                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10490                 .errstr = "jump out of range",
10491                 .result = REJECT,
10492         },
10493         {
10494                 "calls: jumping across function bodies. test2",
10495                 .insns = {
10496                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
10497                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10498                         BPF_MOV64_IMM(BPF_REG_0, 0),
10499                         BPF_EXIT_INSN(),
10500                         BPF_EXIT_INSN(),
10501                 },
10502                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10503                 .errstr = "jump out of range",
10504                 .result = REJECT,
10505         },
10506         {
10507                 "calls: call without exit",
10508                 .insns = {
10509                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10510                         BPF_EXIT_INSN(),
10511                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10512                         BPF_EXIT_INSN(),
10513                         BPF_MOV64_IMM(BPF_REG_0, 0),
10514                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -2),
10515                 },
10516                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10517                 .errstr = "not an exit",
10518                 .result = REJECT,
10519         },
10520         {
10521                 "calls: call into middle of ld_imm64",
10522                 .insns = {
10523                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10524                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10525                         BPF_MOV64_IMM(BPF_REG_0, 0),
10526                         BPF_EXIT_INSN(),
10527                         BPF_LD_IMM64(BPF_REG_0, 0),
10528                         BPF_EXIT_INSN(),
10529                 },
10530                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10531                 .errstr = "last insn",
10532                 .result = REJECT,
10533         },
10534         {
10535                 "calls: call into middle of other call",
10536                 .insns = {
10537                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10538                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10539                         BPF_MOV64_IMM(BPF_REG_0, 0),
10540                         BPF_EXIT_INSN(),
10541                         BPF_MOV64_IMM(BPF_REG_0, 0),
10542                         BPF_MOV64_IMM(BPF_REG_0, 0),
10543                         BPF_EXIT_INSN(),
10544                 },
10545                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10546                 .errstr = "last insn",
10547                 .result = REJECT,
10548         },
10549         {
10550                 "calls: ld_abs with changing ctx data in callee",
10551                 .insns = {
10552                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10553                         BPF_LD_ABS(BPF_B, 0),
10554                         BPF_LD_ABS(BPF_H, 0),
10555                         BPF_LD_ABS(BPF_W, 0),
10556                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
10557                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
10558                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
10559                         BPF_LD_ABS(BPF_B, 0),
10560                         BPF_LD_ABS(BPF_H, 0),
10561                         BPF_LD_ABS(BPF_W, 0),
10562                         BPF_EXIT_INSN(),
10563                         BPF_MOV64_IMM(BPF_REG_2, 1),
10564                         BPF_MOV64_IMM(BPF_REG_3, 2),
10565                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10566                                      BPF_FUNC_skb_vlan_push),
10567                         BPF_EXIT_INSN(),
10568                 },
10569                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
10570                 .errstr = "BPF_LD_[ABS|IND] instructions cannot be mixed",
10571                 .result = REJECT,
10572         },
10573         {
10574                 "calls: two calls with bad fallthrough",
10575                 .insns = {
10576                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10577                         BPF_EXIT_INSN(),
10578                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10579                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
10580                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
10581                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10582                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10583                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
10584                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
10585                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_0),
10586                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
10587                                     offsetof(struct __sk_buff, len)),
10588                         BPF_EXIT_INSN(),
10589                 },
10590                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
10591                 .errstr = "not an exit",
10592                 .result = REJECT,
10593         },
10594         {
10595                 "calls: two calls with stack read",
10596                 .insns = {
10597                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10598                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10599                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10600                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10601                         BPF_EXIT_INSN(),
10602                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10603                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
10604                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
10605                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10606                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10607                         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
10608                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
10609                         BPF_EXIT_INSN(),
10610                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
10611                         BPF_EXIT_INSN(),
10612                 },
10613                 .prog_type = BPF_PROG_TYPE_XDP,
10614                 .result = ACCEPT,
10615         },
10616         {
10617                 "calls: two calls with stack write",
10618                 .insns = {
10619                         /* main prog */
10620                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10621                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10622                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10623                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10624                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10625                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10626                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
10627                         BPF_EXIT_INSN(),
10628
10629                         /* subprog 1 */
10630                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10631                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10632                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 7),
10633                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
10634                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10635                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
10636                         BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_0),
10637                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_8),
10638                         /* write into stack frame of main prog */
10639                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
10640                         BPF_EXIT_INSN(),
10641
10642                         /* subprog 2 */
10643                         /* read from stack frame of main prog */
10644                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
10645                         BPF_EXIT_INSN(),
10646                 },
10647                 .prog_type = BPF_PROG_TYPE_XDP,
10648                 .result = ACCEPT,
10649         },
10650         {
10651                 "calls: stack overflow using two frames (pre-call access)",
10652                 .insns = {
10653                         /* prog 1 */
10654                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
10655                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1),
10656                         BPF_EXIT_INSN(),
10657
10658                         /* prog 2 */
10659                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
10660                         BPF_MOV64_IMM(BPF_REG_0, 0),
10661                         BPF_EXIT_INSN(),
10662                 },
10663                 .prog_type = BPF_PROG_TYPE_XDP,
10664                 .errstr = "combined stack size",
10665                 .result = REJECT,
10666         },
10667         {
10668                 "calls: stack overflow using two frames (post-call access)",
10669                 .insns = {
10670                         /* prog 1 */
10671                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 2),
10672                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
10673                         BPF_EXIT_INSN(),
10674
10675                         /* prog 2 */
10676                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
10677                         BPF_MOV64_IMM(BPF_REG_0, 0),
10678                         BPF_EXIT_INSN(),
10679                 },
10680                 .prog_type = BPF_PROG_TYPE_XDP,
10681                 .errstr = "combined stack size",
10682                 .result = REJECT,
10683         },
10684         {
10685                 "calls: stack depth check using three frames. test1",
10686                 .insns = {
10687                         /* main */
10688                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
10689                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 5), /* call B */
10690                         BPF_ST_MEM(BPF_B, BPF_REG_10, -32, 0),
10691                         BPF_MOV64_IMM(BPF_REG_0, 0),
10692                         BPF_EXIT_INSN(),
10693                         /* A */
10694                         BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
10695                         BPF_EXIT_INSN(),
10696                         /* B */
10697                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -3), /* call A */
10698                         BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
10699                         BPF_EXIT_INSN(),
10700                 },
10701                 .prog_type = BPF_PROG_TYPE_XDP,
10702                 /* stack_main=32, stack_A=256, stack_B=64
10703                  * and max(main+A, main+A+B) < 512
10704                  */
10705                 .result = ACCEPT,
10706         },
10707         {
10708                 "calls: stack depth check using three frames. test2",
10709                 .insns = {
10710                         /* main */
10711                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
10712                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 5), /* call B */
10713                         BPF_ST_MEM(BPF_B, BPF_REG_10, -32, 0),
10714                         BPF_MOV64_IMM(BPF_REG_0, 0),
10715                         BPF_EXIT_INSN(),
10716                         /* A */
10717                         BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
10718                         BPF_EXIT_INSN(),
10719                         /* B */
10720                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -3), /* call A */
10721                         BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
10722                         BPF_EXIT_INSN(),
10723                 },
10724                 .prog_type = BPF_PROG_TYPE_XDP,
10725                 /* stack_main=32, stack_A=64, stack_B=256
10726                  * and max(main+A, main+A+B) < 512
10727                  */
10728                 .result = ACCEPT,
10729         },
10730         {
10731                 "calls: stack depth check using three frames. test3",
10732                 .insns = {
10733                         /* main */
10734                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10735                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 6), /* call A */
10736                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10737                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 8), /* call B */
10738                         BPF_JMP_IMM(BPF_JGE, BPF_REG_6, 0, 1),
10739                         BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
10740                         BPF_MOV64_IMM(BPF_REG_0, 0),
10741                         BPF_EXIT_INSN(),
10742                         /* A */
10743                         BPF_JMP_IMM(BPF_JLT, BPF_REG_1, 10, 1),
10744                         BPF_EXIT_INSN(),
10745                         BPF_ST_MEM(BPF_B, BPF_REG_10, -224, 0),
10746                         BPF_JMP_IMM(BPF_JA, 0, 0, -3),
10747                         /* B */
10748                         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 2, 1),
10749                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -6), /* call A */
10750                         BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
10751                         BPF_EXIT_INSN(),
10752                 },
10753                 .prog_type = BPF_PROG_TYPE_XDP,
10754                 /* stack_main=64, stack_A=224, stack_B=256
10755                  * and max(main+A, main+A+B) > 512
10756                  */
10757                 .errstr = "combined stack",
10758                 .result = REJECT,
10759         },
10760         {
10761                 "calls: stack depth check using three frames. test4",
10762                 /* void main(void) {
10763                  *   func1(0);
10764                  *   func1(1);
10765                  *   func2(1);
10766                  * }
10767                  * void func1(int alloc_or_recurse) {
10768                  *   if (alloc_or_recurse) {
10769                  *     frame_pointer[-300] = 1;
10770                  *   } else {
10771                  *     func2(alloc_or_recurse);
10772                  *   }
10773                  * }
10774                  * void func2(int alloc_or_recurse) {
10775                  *   if (alloc_or_recurse) {
10776                  *     frame_pointer[-300] = 1;
10777                  *   }
10778                  * }
10779                  */
10780                 .insns = {
10781                         /* main */
10782                         BPF_MOV64_IMM(BPF_REG_1, 0),
10783                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 6), /* call A */
10784                         BPF_MOV64_IMM(BPF_REG_1, 1),
10785                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
10786                         BPF_MOV64_IMM(BPF_REG_1, 1),
10787                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 7), /* call B */
10788                         BPF_MOV64_IMM(BPF_REG_0, 0),
10789                         BPF_EXIT_INSN(),
10790                         /* A */
10791                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
10792                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
10793                         BPF_EXIT_INSN(),
10794                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call B */
10795                         BPF_EXIT_INSN(),
10796                         /* B */
10797                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
10798                         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
10799                         BPF_EXIT_INSN(),
10800                 },
10801                 .prog_type = BPF_PROG_TYPE_XDP,
10802                 .result = REJECT,
10803                 .errstr = "combined stack",
10804         },
10805         {
10806                 "calls: stack depth check using three frames. test5",
10807                 .insns = {
10808                         /* main */
10809                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call A */
10810                         BPF_EXIT_INSN(),
10811                         /* A */
10812                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call B */
10813                         BPF_EXIT_INSN(),
10814                         /* B */
10815                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call C */
10816                         BPF_EXIT_INSN(),
10817                         /* C */
10818                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call D */
10819                         BPF_EXIT_INSN(),
10820                         /* D */
10821                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call E */
10822                         BPF_EXIT_INSN(),
10823                         /* E */
10824                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call F */
10825                         BPF_EXIT_INSN(),
10826                         /* F */
10827                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call G */
10828                         BPF_EXIT_INSN(),
10829                         /* G */
10830                         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call H */
10831                         BPF_EXIT_INSN(),
10832                         /* H */
10833                         BPF_MOV64_IMM(BPF_REG_0, 0),
10834                         BPF_EXIT_INSN(),
10835                 },
10836                 .prog_type = BPF_PROG_TYPE_XDP,
10837                 .errstr = "call stack",
10838                 .result = REJECT,
10839         },
10840         {
10841                 "calls: spill into caller stack frame",
10842                 .insns = {
10843                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10844                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10845                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10846                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10847                         BPF_EXIT_INSN(),
10848                         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
10849                         BPF_MOV64_IMM(BPF_REG_0, 0),
10850                         BPF_EXIT_INSN(),
10851                 },
10852                 .prog_type = BPF_PROG_TYPE_XDP,
10853                 .errstr = "cannot spill",
10854                 .result = REJECT,
10855         },
10856         {
10857                 "calls: write into caller stack frame",
10858                 .insns = {
10859                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10860                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10861                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10862                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10863                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
10864                         BPF_EXIT_INSN(),
10865                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 42),
10866                         BPF_MOV64_IMM(BPF_REG_0, 0),
10867                         BPF_EXIT_INSN(),
10868                 },
10869                 .prog_type = BPF_PROG_TYPE_XDP,
10870                 .result = ACCEPT,
10871                 .retval = 42,
10872         },
10873         {
10874                 "calls: write into callee stack frame",
10875                 .insns = {
10876                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10877                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
10878                         BPF_EXIT_INSN(),
10879                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
10880                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, -8),
10881                         BPF_EXIT_INSN(),
10882                 },
10883                 .prog_type = BPF_PROG_TYPE_XDP,
10884                 .errstr = "cannot return stack pointer",
10885                 .result = REJECT,
10886         },
10887         {
10888                 "calls: two calls with stack write and void return",
10889                 .insns = {
10890                         /* main prog */
10891                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10892                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10893                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10894                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10895                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10896                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10897                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
10898                         BPF_EXIT_INSN(),
10899
10900                         /* subprog 1 */
10901                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10902                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10903                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10904                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
10905                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10906                         BPF_EXIT_INSN(),
10907
10908                         /* subprog 2 */
10909                         /* write into stack frame of main prog */
10910                         BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 0),
10911                         BPF_EXIT_INSN(), /* void return */
10912                 },
10913                 .prog_type = BPF_PROG_TYPE_XDP,
10914                 .result = ACCEPT,
10915         },
10916         {
10917                 "calls: ambiguous return value",
10918                 .insns = {
10919                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10920                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
10921                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
10922                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
10923                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10924                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
10925                         BPF_EXIT_INSN(),
10926                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
10927                         BPF_MOV64_IMM(BPF_REG_0, 0),
10928                         BPF_EXIT_INSN(),
10929                 },
10930                 .errstr_unpriv = "allowed for root only",
10931                 .result_unpriv = REJECT,
10932                 .errstr = "R0 !read_ok",
10933                 .result = REJECT,
10934         },
10935         {
10936                 "calls: two calls that return map_value",
10937                 .insns = {
10938                         /* main prog */
10939                         /* pass fp-16, fp-8 into a function */
10940                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10941                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10942                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10943                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10944                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
10945
10946                         /* fetch map_value_ptr from the stack of this function */
10947                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
10948                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
10949                         /* write into map value */
10950                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10951                         /* fetch secound map_value_ptr from the stack */
10952                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
10953                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
10954                         /* write into map value */
10955                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
10956                         BPF_MOV64_IMM(BPF_REG_0, 0),
10957                         BPF_EXIT_INSN(),
10958
10959                         /* subprog 1 */
10960                         /* call 3rd function twice */
10961                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10962                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
10963                         /* first time with fp-8 */
10964                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
10965                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
10966                         /* second time with fp-16 */
10967                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
10968                         BPF_EXIT_INSN(),
10969
10970                         /* subprog 2 */
10971                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
10972                         /* lookup from map */
10973                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
10974                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10975                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
10976                         BPF_LD_MAP_FD(BPF_REG_1, 0),
10977                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
10978                                      BPF_FUNC_map_lookup_elem),
10979                         /* write map_value_ptr into stack frame of main prog */
10980                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
10981                         BPF_MOV64_IMM(BPF_REG_0, 0),
10982                         BPF_EXIT_INSN(), /* return 0 */
10983                 },
10984                 .prog_type = BPF_PROG_TYPE_XDP,
10985                 .fixup_map1 = { 23 },
10986                 .result = ACCEPT,
10987         },
10988         {
10989                 "calls: two calls that return map_value with bool condition",
10990                 .insns = {
10991                         /* main prog */
10992                         /* pass fp-16, fp-8 into a function */
10993                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
10994                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
10995                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
10996                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
10997                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
10998                         BPF_MOV64_IMM(BPF_REG_0, 0),
10999                         BPF_EXIT_INSN(),
11000
11001                         /* subprog 1 */
11002                         /* call 3rd function twice */
11003                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11004                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11005                         /* first time with fp-8 */
11006                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 9),
11007                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
11008                         /* fetch map_value_ptr from the stack of this function */
11009                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
11010                         /* write into map value */
11011                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11012                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
11013                         /* second time with fp-16 */
11014                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
11015                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
11016                         /* fetch secound map_value_ptr from the stack */
11017                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
11018                         /* write into map value */
11019                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11020                         BPF_EXIT_INSN(),
11021
11022                         /* subprog 2 */
11023                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11024                         /* lookup from map */
11025                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11026                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11027                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11028                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11029                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11030                                      BPF_FUNC_map_lookup_elem),
11031                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11032                         BPF_MOV64_IMM(BPF_REG_0, 0),
11033                         BPF_EXIT_INSN(), /* return 0 */
11034                         /* write map_value_ptr into stack frame of main prog */
11035                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11036                         BPF_MOV64_IMM(BPF_REG_0, 1),
11037                         BPF_EXIT_INSN(), /* return 1 */
11038                 },
11039                 .prog_type = BPF_PROG_TYPE_XDP,
11040                 .fixup_map1 = { 23 },
11041                 .result = ACCEPT,
11042         },
11043         {
11044                 "calls: two calls that return map_value with incorrect bool check",
11045                 .insns = {
11046                         /* main prog */
11047                         /* pass fp-16, fp-8 into a function */
11048                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11049                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11050                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11051                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11052                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11053                         BPF_MOV64_IMM(BPF_REG_0, 0),
11054                         BPF_EXIT_INSN(),
11055
11056                         /* subprog 1 */
11057                         /* call 3rd function twice */
11058                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11059                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11060                         /* first time with fp-8 */
11061                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 9),
11062                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
11063                         /* fetch map_value_ptr from the stack of this function */
11064                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
11065                         /* write into map value */
11066                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11067                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
11068                         /* second time with fp-16 */
11069                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
11070                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11071                         /* fetch secound map_value_ptr from the stack */
11072                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
11073                         /* write into map value */
11074                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11075                         BPF_EXIT_INSN(),
11076
11077                         /* subprog 2 */
11078                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11079                         /* lookup from map */
11080                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11081                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11082                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11083                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11084                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11085                                      BPF_FUNC_map_lookup_elem),
11086                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11087                         BPF_MOV64_IMM(BPF_REG_0, 0),
11088                         BPF_EXIT_INSN(), /* return 0 */
11089                         /* write map_value_ptr into stack frame of main prog */
11090                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11091                         BPF_MOV64_IMM(BPF_REG_0, 1),
11092                         BPF_EXIT_INSN(), /* return 1 */
11093                 },
11094                 .prog_type = BPF_PROG_TYPE_XDP,
11095                 .fixup_map1 = { 23 },
11096                 .result = REJECT,
11097                 .errstr = "invalid read from stack off -16+0 size 8",
11098         },
11099         {
11100                 "calls: two calls that receive map_value via arg=ptr_stack_of_caller. test1",
11101                 .insns = {
11102                         /* main prog */
11103                         /* pass fp-16, fp-8 into a function */
11104                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11105                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11106                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11107                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11108                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11109                         BPF_MOV64_IMM(BPF_REG_0, 0),
11110                         BPF_EXIT_INSN(),
11111
11112                         /* subprog 1 */
11113                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11114                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11115                         /* 1st lookup from map */
11116                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11117                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11118                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11119                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11120                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11121                                      BPF_FUNC_map_lookup_elem),
11122                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11123                         BPF_MOV64_IMM(BPF_REG_8, 0),
11124                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11125                         /* write map_value_ptr into stack frame of main prog at fp-8 */
11126                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11127                         BPF_MOV64_IMM(BPF_REG_8, 1),
11128
11129                         /* 2nd lookup from map */
11130                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), /* 20 */
11131                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11132                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11133                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, /* 24 */
11134                                      BPF_FUNC_map_lookup_elem),
11135                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11136                         BPF_MOV64_IMM(BPF_REG_9, 0),
11137                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11138                         /* write map_value_ptr into stack frame of main prog at fp-16 */
11139                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
11140                         BPF_MOV64_IMM(BPF_REG_9, 1),
11141
11142                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
11143                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), /* 30 */
11144                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
11145                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
11146                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
11147                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),  /* 34 */
11148                         BPF_EXIT_INSN(),
11149
11150                         /* subprog 2 */
11151                         /* if arg2 == 1 do *arg1 = 0 */
11152                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
11153                         /* fetch map_value_ptr from the stack of this function */
11154                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
11155                         /* write into map value */
11156                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11157
11158                         /* if arg4 == 1 do *arg3 = 0 */
11159                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
11160                         /* fetch map_value_ptr from the stack of this function */
11161                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
11162                         /* write into map value */
11163                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 0),
11164                         BPF_EXIT_INSN(),
11165                 },
11166                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11167                 .fixup_map1 = { 12, 22 },
11168                 .result = REJECT,
11169                 .errstr = "invalid access to map value, value_size=8 off=2 size=8",
11170         },
11171         {
11172                 "calls: two calls that receive map_value via arg=ptr_stack_of_caller. test2",
11173                 .insns = {
11174                         /* main prog */
11175                         /* pass fp-16, fp-8 into a function */
11176                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11177                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11178                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11179                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11180                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11181                         BPF_MOV64_IMM(BPF_REG_0, 0),
11182                         BPF_EXIT_INSN(),
11183
11184                         /* subprog 1 */
11185                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11186                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11187                         /* 1st lookup from map */
11188                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11189                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11190                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11191                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11192                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11193                                      BPF_FUNC_map_lookup_elem),
11194                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11195                         BPF_MOV64_IMM(BPF_REG_8, 0),
11196                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11197                         /* write map_value_ptr into stack frame of main prog at fp-8 */
11198                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11199                         BPF_MOV64_IMM(BPF_REG_8, 1),
11200
11201                         /* 2nd lookup from map */
11202                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), /* 20 */
11203                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11204                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11205                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, /* 24 */
11206                                      BPF_FUNC_map_lookup_elem),
11207                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11208                         BPF_MOV64_IMM(BPF_REG_9, 0),
11209                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11210                         /* write map_value_ptr into stack frame of main prog at fp-16 */
11211                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
11212                         BPF_MOV64_IMM(BPF_REG_9, 1),
11213
11214                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
11215                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), /* 30 */
11216                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
11217                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
11218                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
11219                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),  /* 34 */
11220                         BPF_EXIT_INSN(),
11221
11222                         /* subprog 2 */
11223                         /* if arg2 == 1 do *arg1 = 0 */
11224                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
11225                         /* fetch map_value_ptr from the stack of this function */
11226                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
11227                         /* write into map value */
11228                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11229
11230                         /* if arg4 == 1 do *arg3 = 0 */
11231                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
11232                         /* fetch map_value_ptr from the stack of this function */
11233                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
11234                         /* write into map value */
11235                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11236                         BPF_EXIT_INSN(),
11237                 },
11238                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11239                 .fixup_map1 = { 12, 22 },
11240                 .result = ACCEPT,
11241         },
11242         {
11243                 "calls: two jumps that receive map_value via arg=ptr_stack_of_jumper. test3",
11244                 .insns = {
11245                         /* main prog */
11246                         /* pass fp-16, fp-8 into a function */
11247                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11248                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11249                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11250                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11251                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2),
11252                         BPF_MOV64_IMM(BPF_REG_0, 0),
11253                         BPF_EXIT_INSN(),
11254
11255                         /* subprog 1 */
11256                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11257                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11258                         /* 1st lookup from map */
11259                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -24, 0),
11260                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11261                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -24),
11262                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11263                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11264                                      BPF_FUNC_map_lookup_elem),
11265                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11266                         BPF_MOV64_IMM(BPF_REG_8, 0),
11267                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11268                         /* write map_value_ptr into stack frame of main prog at fp-8 */
11269                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11270                         BPF_MOV64_IMM(BPF_REG_8, 1),
11271
11272                         /* 2nd lookup from map */
11273                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11274                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -24),
11275                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11276                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11277                                      BPF_FUNC_map_lookup_elem),
11278                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11279                         BPF_MOV64_IMM(BPF_REG_9, 0),  // 26
11280                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11281                         /* write map_value_ptr into stack frame of main prog at fp-16 */
11282                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
11283                         BPF_MOV64_IMM(BPF_REG_9, 1),
11284
11285                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
11286                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), // 30
11287                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
11288                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
11289                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
11290                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1), // 34
11291                         BPF_JMP_IMM(BPF_JA, 0, 0, -30),
11292
11293                         /* subprog 2 */
11294                         /* if arg2 == 1 do *arg1 = 0 */
11295                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
11296                         /* fetch map_value_ptr from the stack of this function */
11297                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
11298                         /* write into map value */
11299                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11300
11301                         /* if arg4 == 1 do *arg3 = 0 */
11302                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
11303                         /* fetch map_value_ptr from the stack of this function */
11304                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
11305                         /* write into map value */
11306                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 0),
11307                         BPF_JMP_IMM(BPF_JA, 0, 0, -8),
11308                 },
11309                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11310                 .fixup_map1 = { 12, 22 },
11311                 .result = REJECT,
11312                 .errstr = "invalid access to map value, value_size=8 off=2 size=8",
11313         },
11314         {
11315                 "calls: two calls that receive map_value_ptr_or_null via arg. test1",
11316                 .insns = {
11317                         /* main prog */
11318                         /* pass fp-16, fp-8 into a function */
11319                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11320                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11321                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11322                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11323                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11324                         BPF_MOV64_IMM(BPF_REG_0, 0),
11325                         BPF_EXIT_INSN(),
11326
11327                         /* subprog 1 */
11328                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11329                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11330                         /* 1st lookup from map */
11331                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11332                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11333                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11334                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11335                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11336                                      BPF_FUNC_map_lookup_elem),
11337                         /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
11338                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11339                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11340                         BPF_MOV64_IMM(BPF_REG_8, 0),
11341                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
11342                         BPF_MOV64_IMM(BPF_REG_8, 1),
11343
11344                         /* 2nd lookup from map */
11345                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11346                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11347                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11348                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11349                                      BPF_FUNC_map_lookup_elem),
11350                         /* write map_value_ptr_or_null into stack frame of main prog at fp-16 */
11351                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
11352                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11353                         BPF_MOV64_IMM(BPF_REG_9, 0),
11354                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
11355                         BPF_MOV64_IMM(BPF_REG_9, 1),
11356
11357                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
11358                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
11359                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
11360                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
11361                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
11362                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11363                         BPF_EXIT_INSN(),
11364
11365                         /* subprog 2 */
11366                         /* if arg2 == 1 do *arg1 = 0 */
11367                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
11368                         /* fetch map_value_ptr from the stack of this function */
11369                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
11370                         /* write into map value */
11371                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11372
11373                         /* if arg4 == 1 do *arg3 = 0 */
11374                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
11375                         /* fetch map_value_ptr from the stack of this function */
11376                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
11377                         /* write into map value */
11378                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11379                         BPF_EXIT_INSN(),
11380                 },
11381                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11382                 .fixup_map1 = { 12, 22 },
11383                 .result = ACCEPT,
11384         },
11385         {
11386                 "calls: two calls that receive map_value_ptr_or_null via arg. test2",
11387                 .insns = {
11388                         /* main prog */
11389                         /* pass fp-16, fp-8 into a function */
11390                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
11391                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
11392                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11393                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
11394                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
11395                         BPF_MOV64_IMM(BPF_REG_0, 0),
11396                         BPF_EXIT_INSN(),
11397
11398                         /* subprog 1 */
11399                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
11400                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
11401                         /* 1st lookup from map */
11402                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11403                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11404                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11405                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11406                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11407                                      BPF_FUNC_map_lookup_elem),
11408                         /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
11409                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11410                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11411                         BPF_MOV64_IMM(BPF_REG_8, 0),
11412                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
11413                         BPF_MOV64_IMM(BPF_REG_8, 1),
11414
11415                         /* 2nd lookup from map */
11416                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11417                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11418                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11419                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11420                                      BPF_FUNC_map_lookup_elem),
11421                         /* write map_value_ptr_or_null into stack frame of main prog at fp-16 */
11422                         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
11423                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
11424                         BPF_MOV64_IMM(BPF_REG_9, 0),
11425                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
11426                         BPF_MOV64_IMM(BPF_REG_9, 1),
11427
11428                         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
11429                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
11430                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
11431                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
11432                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
11433                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11434                         BPF_EXIT_INSN(),
11435
11436                         /* subprog 2 */
11437                         /* if arg2 == 1 do *arg1 = 0 */
11438                         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
11439                         /* fetch map_value_ptr from the stack of this function */
11440                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
11441                         /* write into map value */
11442                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11443
11444                         /* if arg4 == 0 do *arg3 = 0 */
11445                         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 0, 2),
11446                         /* fetch map_value_ptr from the stack of this function */
11447                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
11448                         /* write into map value */
11449                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
11450                         BPF_EXIT_INSN(),
11451                 },
11452                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11453                 .fixup_map1 = { 12, 22 },
11454                 .result = REJECT,
11455                 .errstr = "R0 invalid mem access 'inv'",
11456         },
11457         {
11458                 "calls: pkt_ptr spill into caller stack",
11459                 .insns = {
11460                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11461                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11462                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
11463                         BPF_EXIT_INSN(),
11464
11465                         /* subprog 1 */
11466                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11467                                     offsetof(struct __sk_buff, data)),
11468                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11469                                     offsetof(struct __sk_buff, data_end)),
11470                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11471                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11472                         /* spill unchecked pkt_ptr into stack of caller */
11473                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11474                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
11475                         /* now the pkt range is verified, read pkt_ptr from stack */
11476                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
11477                         /* write 4 bytes into packet */
11478                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11479                         BPF_EXIT_INSN(),
11480                 },
11481                 .result = ACCEPT,
11482                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11483                 .retval = POINTER_VALUE,
11484         },
11485         {
11486                 "calls: pkt_ptr spill into caller stack 2",
11487                 .insns = {
11488                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11489                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11490                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11491                         /* Marking is still kept, but not in all cases safe. */
11492                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11493                         BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
11494                         BPF_EXIT_INSN(),
11495
11496                         /* subprog 1 */
11497                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11498                                     offsetof(struct __sk_buff, data)),
11499                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11500                                     offsetof(struct __sk_buff, data_end)),
11501                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11502                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11503                         /* spill unchecked pkt_ptr into stack of caller */
11504                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11505                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
11506                         /* now the pkt range is verified, read pkt_ptr from stack */
11507                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
11508                         /* write 4 bytes into packet */
11509                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11510                         BPF_EXIT_INSN(),
11511                 },
11512                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11513                 .errstr = "invalid access to packet",
11514                 .result = REJECT,
11515         },
11516         {
11517                 "calls: pkt_ptr spill into caller stack 3",
11518                 .insns = {
11519                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11520                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11521                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
11522                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
11523                         /* Marking is still kept and safe here. */
11524                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11525                         BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
11526                         BPF_EXIT_INSN(),
11527
11528                         /* subprog 1 */
11529                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11530                                     offsetof(struct __sk_buff, data)),
11531                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11532                                     offsetof(struct __sk_buff, data_end)),
11533                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11534                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11535                         /* spill unchecked pkt_ptr into stack of caller */
11536                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11537                         BPF_MOV64_IMM(BPF_REG_5, 0),
11538                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
11539                         BPF_MOV64_IMM(BPF_REG_5, 1),
11540                         /* now the pkt range is verified, read pkt_ptr from stack */
11541                         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
11542                         /* write 4 bytes into packet */
11543                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11544                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11545                         BPF_EXIT_INSN(),
11546                 },
11547                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11548                 .result = ACCEPT,
11549                 .retval = 1,
11550         },
11551         {
11552                 "calls: pkt_ptr spill into caller stack 4",
11553                 .insns = {
11554                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11555                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11556                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
11557                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
11558                         /* Check marking propagated. */
11559                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11560                         BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
11561                         BPF_EXIT_INSN(),
11562
11563                         /* subprog 1 */
11564                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11565                                     offsetof(struct __sk_buff, data)),
11566                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11567                                     offsetof(struct __sk_buff, data_end)),
11568                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11569                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11570                         /* spill unchecked pkt_ptr into stack of caller */
11571                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11572                         BPF_MOV64_IMM(BPF_REG_5, 0),
11573                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
11574                         BPF_MOV64_IMM(BPF_REG_5, 1),
11575                         /* don't read back pkt_ptr from stack here */
11576                         /* write 4 bytes into packet */
11577                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11578                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11579                         BPF_EXIT_INSN(),
11580                 },
11581                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11582                 .result = ACCEPT,
11583                 .retval = 1,
11584         },
11585         {
11586                 "calls: pkt_ptr spill into caller stack 5",
11587                 .insns = {
11588                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11589                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11590                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_1, 0),
11591                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11592                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11593                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
11594                         BPF_EXIT_INSN(),
11595
11596                         /* subprog 1 */
11597                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11598                                     offsetof(struct __sk_buff, data)),
11599                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11600                                     offsetof(struct __sk_buff, data_end)),
11601                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11602                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11603                         BPF_MOV64_IMM(BPF_REG_5, 0),
11604                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
11605                         /* spill checked pkt_ptr into stack of caller */
11606                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11607                         BPF_MOV64_IMM(BPF_REG_5, 1),
11608                         /* don't read back pkt_ptr from stack here */
11609                         /* write 4 bytes into packet */
11610                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11611                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11612                         BPF_EXIT_INSN(),
11613                 },
11614                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11615                 .errstr = "same insn cannot be used with different",
11616                 .result = REJECT,
11617         },
11618         {
11619                 "calls: pkt_ptr spill into caller stack 6",
11620                 .insns = {
11621                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11622                                     offsetof(struct __sk_buff, data_end)),
11623                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11624                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11625                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11626                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11627                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11628                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
11629                         BPF_EXIT_INSN(),
11630
11631                         /* subprog 1 */
11632                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11633                                     offsetof(struct __sk_buff, data)),
11634                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11635                                     offsetof(struct __sk_buff, data_end)),
11636                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11637                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11638                         BPF_MOV64_IMM(BPF_REG_5, 0),
11639                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
11640                         /* spill checked pkt_ptr into stack of caller */
11641                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11642                         BPF_MOV64_IMM(BPF_REG_5, 1),
11643                         /* don't read back pkt_ptr from stack here */
11644                         /* write 4 bytes into packet */
11645                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11646                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11647                         BPF_EXIT_INSN(),
11648                 },
11649                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11650                 .errstr = "R4 invalid mem access",
11651                 .result = REJECT,
11652         },
11653         {
11654                 "calls: pkt_ptr spill into caller stack 7",
11655                 .insns = {
11656                         BPF_MOV64_IMM(BPF_REG_2, 0),
11657                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11658                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11659                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11660                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11661                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11662                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
11663                         BPF_EXIT_INSN(),
11664
11665                         /* subprog 1 */
11666                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11667                                     offsetof(struct __sk_buff, data)),
11668                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11669                                     offsetof(struct __sk_buff, data_end)),
11670                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11671                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11672                         BPF_MOV64_IMM(BPF_REG_5, 0),
11673                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
11674                         /* spill checked pkt_ptr into stack of caller */
11675                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11676                         BPF_MOV64_IMM(BPF_REG_5, 1),
11677                         /* don't read back pkt_ptr from stack here */
11678                         /* write 4 bytes into packet */
11679                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11680                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11681                         BPF_EXIT_INSN(),
11682                 },
11683                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11684                 .errstr = "R4 invalid mem access",
11685                 .result = REJECT,
11686         },
11687         {
11688                 "calls: pkt_ptr spill into caller stack 8",
11689                 .insns = {
11690                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11691                                     offsetof(struct __sk_buff, data)),
11692                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11693                                     offsetof(struct __sk_buff, data_end)),
11694                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11695                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11696                         BPF_JMP_REG(BPF_JLE, BPF_REG_0, BPF_REG_3, 1),
11697                         BPF_EXIT_INSN(),
11698                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11699                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11700                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11701                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11702                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11703                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
11704                         BPF_EXIT_INSN(),
11705
11706                         /* subprog 1 */
11707                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11708                                     offsetof(struct __sk_buff, data)),
11709                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11710                                     offsetof(struct __sk_buff, data_end)),
11711                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11712                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11713                         BPF_MOV64_IMM(BPF_REG_5, 0),
11714                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
11715                         /* spill checked pkt_ptr into stack of caller */
11716                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11717                         BPF_MOV64_IMM(BPF_REG_5, 1),
11718                         /* don't read back pkt_ptr from stack here */
11719                         /* write 4 bytes into packet */
11720                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11721                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11722                         BPF_EXIT_INSN(),
11723                 },
11724                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11725                 .result = ACCEPT,
11726         },
11727         {
11728                 "calls: pkt_ptr spill into caller stack 9",
11729                 .insns = {
11730                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11731                                     offsetof(struct __sk_buff, data)),
11732                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11733                                     offsetof(struct __sk_buff, data_end)),
11734                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11735                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11736                         BPF_JMP_REG(BPF_JLE, BPF_REG_0, BPF_REG_3, 1),
11737                         BPF_EXIT_INSN(),
11738                         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
11739                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
11740                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11741                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
11742                         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
11743                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
11744                         BPF_EXIT_INSN(),
11745
11746                         /* subprog 1 */
11747                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
11748                                     offsetof(struct __sk_buff, data)),
11749                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
11750                                     offsetof(struct __sk_buff, data_end)),
11751                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
11752                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
11753                         BPF_MOV64_IMM(BPF_REG_5, 0),
11754                         /* spill unchecked pkt_ptr into stack of caller */
11755                         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
11756                         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
11757                         BPF_MOV64_IMM(BPF_REG_5, 1),
11758                         /* don't read back pkt_ptr from stack here */
11759                         /* write 4 bytes into packet */
11760                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
11761                         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
11762                         BPF_EXIT_INSN(),
11763                 },
11764                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11765                 .errstr = "invalid access to packet",
11766                 .result = REJECT,
11767         },
11768         {
11769                 "calls: caller stack init to zero or map_value_or_null",
11770                 .insns = {
11771                         BPF_MOV64_IMM(BPF_REG_0, 0),
11772                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
11773                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11774                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11775                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
11776                         /* fetch map_value_or_null or const_zero from stack */
11777                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
11778                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
11779                         /* store into map_value */
11780                         BPF_ST_MEM(BPF_W, BPF_REG_0, 0, 0),
11781                         BPF_EXIT_INSN(),
11782
11783                         /* subprog 1 */
11784                         /* if (ctx == 0) return; */
11785                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 8),
11786                         /* else bpf_map_lookup() and *(fp - 8) = r0 */
11787                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
11788                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11789                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11790                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11791                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11792                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11793                                      BPF_FUNC_map_lookup_elem),
11794                         /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
11795                         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
11796                         BPF_EXIT_INSN(),
11797                 },
11798                 .fixup_map1 = { 13 },
11799                 .result = ACCEPT,
11800                 .prog_type = BPF_PROG_TYPE_XDP,
11801         },
11802         {
11803                 "calls: stack init to zero and pruning",
11804                 .insns = {
11805                         /* first make allocated_stack 16 byte */
11806                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, 0),
11807                         /* now fork the execution such that the false branch
11808                          * of JGT insn will be verified second and it skisp zero
11809                          * init of fp-8 stack slot. If stack liveness marking
11810                          * is missing live_read marks from call map_lookup
11811                          * processing then pruning will incorrectly assume
11812                          * that fp-8 stack slot was unused in the fall-through
11813                          * branch and will accept the program incorrectly
11814                          */
11815                         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 2, 2),
11816                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11817                         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
11818                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11819                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11820                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11821                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11822                                      BPF_FUNC_map_lookup_elem),
11823                         BPF_EXIT_INSN(),
11824                 },
11825                 .fixup_map2 = { 6 },
11826                 .errstr = "invalid indirect read from stack off -8+0 size 8",
11827                 .result = REJECT,
11828                 .prog_type = BPF_PROG_TYPE_XDP,
11829         },
11830         {
11831                 "calls: two calls returning different map pointers for lookup (hash, array)",
11832                 .insns = {
11833                         /* main prog */
11834                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2),
11835                         BPF_CALL_REL(11),
11836                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
11837                         BPF_CALL_REL(12),
11838                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
11839                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11840                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11841                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11842                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11843                                      BPF_FUNC_map_lookup_elem),
11844                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
11845                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
11846                                    offsetof(struct test_val, foo)),
11847                         BPF_MOV64_IMM(BPF_REG_0, 1),
11848                         BPF_EXIT_INSN(),
11849                         /* subprog 1 */
11850                         BPF_LD_MAP_FD(BPF_REG_0, 0),
11851                         BPF_EXIT_INSN(),
11852                         /* subprog 2 */
11853                         BPF_LD_MAP_FD(BPF_REG_0, 0),
11854                         BPF_EXIT_INSN(),
11855                 },
11856                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11857                 .fixup_map2 = { 13 },
11858                 .fixup_map4 = { 16 },
11859                 .result = ACCEPT,
11860                 .retval = 1,
11861         },
11862         {
11863                 "calls: two calls returning different map pointers for lookup (hash, map in map)",
11864                 .insns = {
11865                         /* main prog */
11866                         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2),
11867                         BPF_CALL_REL(11),
11868                         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
11869                         BPF_CALL_REL(12),
11870                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
11871                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
11872                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11873                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11874                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11875                                      BPF_FUNC_map_lookup_elem),
11876                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
11877                         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
11878                                    offsetof(struct test_val, foo)),
11879                         BPF_MOV64_IMM(BPF_REG_0, 1),
11880                         BPF_EXIT_INSN(),
11881                         /* subprog 1 */
11882                         BPF_LD_MAP_FD(BPF_REG_0, 0),
11883                         BPF_EXIT_INSN(),
11884                         /* subprog 2 */
11885                         BPF_LD_MAP_FD(BPF_REG_0, 0),
11886                         BPF_EXIT_INSN(),
11887                 },
11888                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
11889                 .fixup_map_in_map = { 16 },
11890                 .fixup_map4 = { 13 },
11891                 .result = REJECT,
11892                 .errstr = "R0 invalid mem access 'map_ptr'",
11893         },
11894         {
11895                 "cond: two branches returning different map pointers for lookup (tail, tail)",
11896                 .insns = {
11897                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
11898                                     offsetof(struct __sk_buff, mark)),
11899                         BPF_JMP_IMM(BPF_JNE, BPF_REG_6, 0, 3),
11900                         BPF_LD_MAP_FD(BPF_REG_2, 0),
11901                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11902                         BPF_LD_MAP_FD(BPF_REG_2, 0),
11903                         BPF_MOV64_IMM(BPF_REG_3, 7),
11904                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11905                                      BPF_FUNC_tail_call),
11906                         BPF_MOV64_IMM(BPF_REG_0, 1),
11907                         BPF_EXIT_INSN(),
11908                 },
11909                 .fixup_prog1 = { 5 },
11910                 .fixup_prog2 = { 2 },
11911                 .result_unpriv = REJECT,
11912                 .errstr_unpriv = "tail_call abusing map_ptr",
11913                 .result = ACCEPT,
11914                 .retval = 42,
11915         },
11916         {
11917                 "cond: two branches returning same map pointers for lookup (tail, tail)",
11918                 .insns = {
11919                         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
11920                                     offsetof(struct __sk_buff, mark)),
11921                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_6, 0, 3),
11922                         BPF_LD_MAP_FD(BPF_REG_2, 0),
11923                         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
11924                         BPF_LD_MAP_FD(BPF_REG_2, 0),
11925                         BPF_MOV64_IMM(BPF_REG_3, 7),
11926                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
11927                                      BPF_FUNC_tail_call),
11928                         BPF_MOV64_IMM(BPF_REG_0, 1),
11929                         BPF_EXIT_INSN(),
11930                 },
11931                 .fixup_prog2 = { 2, 5 },
11932                 .result_unpriv = ACCEPT,
11933                 .result = ACCEPT,
11934                 .retval = 42,
11935         },
11936         {
11937                 "search pruning: all branches should be verified (nop operation)",
11938                 .insns = {
11939                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11940                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11941                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
11942                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11943                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
11944                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
11945                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
11946                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_3, 0xbeef, 2),
11947                         BPF_MOV64_IMM(BPF_REG_4, 0),
11948                         BPF_JMP_A(1),
11949                         BPF_MOV64_IMM(BPF_REG_4, 1),
11950                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -16),
11951                         BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns),
11952                         BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -16),
11953                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_5, 0, 2),
11954                         BPF_MOV64_IMM(BPF_REG_6, 0),
11955                         BPF_ST_MEM(BPF_DW, BPF_REG_6, 0, 0xdead),
11956                         BPF_EXIT_INSN(),
11957                 },
11958                 .fixup_map1 = { 3 },
11959                 .errstr = "R6 invalid mem access 'inv'",
11960                 .result = REJECT,
11961                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11962         },
11963         {
11964                 "search pruning: all branches should be verified (invalid stack access)",
11965                 .insns = {
11966                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
11967                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
11968                         BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
11969                         BPF_LD_MAP_FD(BPF_REG_1, 0),
11970                         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
11971                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
11972                         BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
11973                         BPF_MOV64_IMM(BPF_REG_4, 0),
11974                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_3, 0xbeef, 2),
11975                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -16),
11976                         BPF_JMP_A(1),
11977                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -24),
11978                         BPF_EMIT_CALL(BPF_FUNC_ktime_get_ns),
11979                         BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_10, -16),
11980                         BPF_EXIT_INSN(),
11981                 },
11982                 .fixup_map1 = { 3 },
11983                 .errstr = "invalid read from stack off -16+0 size 8",
11984                 .result = REJECT,
11985                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
11986         },
11987         {
11988                 "jit: lsh, rsh, arsh by 1",
11989                 .insns = {
11990                         BPF_MOV64_IMM(BPF_REG_0, 1),
11991                         BPF_MOV64_IMM(BPF_REG_1, 0xff),
11992                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 1),
11993                         BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 1),
11994                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0x3fc, 1),
11995                         BPF_EXIT_INSN(),
11996                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 1),
11997                         BPF_ALU32_IMM(BPF_RSH, BPF_REG_1, 1),
11998                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0xff, 1),
11999                         BPF_EXIT_INSN(),
12000                         BPF_ALU64_IMM(BPF_ARSH, BPF_REG_1, 1),
12001                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0x7f, 1),
12002                         BPF_EXIT_INSN(),
12003                         BPF_MOV64_IMM(BPF_REG_0, 2),
12004                         BPF_EXIT_INSN(),
12005                 },
12006                 .result = ACCEPT,
12007                 .retval = 2,
12008         },
12009         {
12010                 "jit: mov32 for ldimm64, 1",
12011                 .insns = {
12012                         BPF_MOV64_IMM(BPF_REG_0, 2),
12013                         BPF_LD_IMM64(BPF_REG_1, 0xfeffffffffffffffULL),
12014                         BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 32),
12015                         BPF_LD_IMM64(BPF_REG_2, 0xfeffffffULL),
12016                         BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_2, 1),
12017                         BPF_MOV64_IMM(BPF_REG_0, 1),
12018                         BPF_EXIT_INSN(),
12019                 },
12020                 .result = ACCEPT,
12021                 .retval = 2,
12022         },
12023         {
12024                 "jit: mov32 for ldimm64, 2",
12025                 .insns = {
12026                         BPF_MOV64_IMM(BPF_REG_0, 1),
12027                         BPF_LD_IMM64(BPF_REG_1, 0x1ffffffffULL),
12028                         BPF_LD_IMM64(BPF_REG_2, 0xffffffffULL),
12029                         BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_2, 1),
12030                         BPF_MOV64_IMM(BPF_REG_0, 2),
12031                         BPF_EXIT_INSN(),
12032                 },
12033                 .result = ACCEPT,
12034                 .retval = 2,
12035         },
12036         {
12037                 "jit: various mul tests",
12038                 .insns = {
12039                         BPF_LD_IMM64(BPF_REG_2, 0xeeff0d413122ULL),
12040                         BPF_LD_IMM64(BPF_REG_0, 0xfefefeULL),
12041                         BPF_LD_IMM64(BPF_REG_1, 0xefefefULL),
12042                         BPF_ALU64_REG(BPF_MUL, BPF_REG_0, BPF_REG_1),
12043                         BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_2, 2),
12044                         BPF_MOV64_IMM(BPF_REG_0, 1),
12045                         BPF_EXIT_INSN(),
12046                         BPF_LD_IMM64(BPF_REG_3, 0xfefefeULL),
12047                         BPF_ALU64_REG(BPF_MUL, BPF_REG_3, BPF_REG_1),
12048                         BPF_JMP_REG(BPF_JEQ, BPF_REG_3, BPF_REG_2, 2),
12049                         BPF_MOV64_IMM(BPF_REG_0, 1),
12050                         BPF_EXIT_INSN(),
12051                         BPF_MOV32_REG(BPF_REG_2, BPF_REG_2),
12052                         BPF_LD_IMM64(BPF_REG_0, 0xfefefeULL),
12053                         BPF_ALU32_REG(BPF_MUL, BPF_REG_0, BPF_REG_1),
12054                         BPF_JMP_REG(BPF_JEQ, BPF_REG_0, BPF_REG_2, 2),
12055                         BPF_MOV64_IMM(BPF_REG_0, 1),
12056                         BPF_EXIT_INSN(),
12057                         BPF_LD_IMM64(BPF_REG_3, 0xfefefeULL),
12058                         BPF_ALU32_REG(BPF_MUL, BPF_REG_3, BPF_REG_1),
12059                         BPF_JMP_REG(BPF_JEQ, BPF_REG_3, BPF_REG_2, 2),
12060                         BPF_MOV64_IMM(BPF_REG_0, 1),
12061                         BPF_EXIT_INSN(),
12062                         BPF_LD_IMM64(BPF_REG_0, 0x952a7bbcULL),
12063                         BPF_LD_IMM64(BPF_REG_1, 0xfefefeULL),
12064                         BPF_LD_IMM64(BPF_REG_2, 0xeeff0d413122ULL),
12065                         BPF_ALU32_REG(BPF_MUL, BPF_REG_2, BPF_REG_1),
12066                         BPF_JMP_REG(BPF_JEQ, BPF_REG_2, BPF_REG_0, 2),
12067                         BPF_MOV64_IMM(BPF_REG_0, 1),
12068                         BPF_EXIT_INSN(),
12069                         BPF_MOV64_IMM(BPF_REG_0, 2),
12070                         BPF_EXIT_INSN(),
12071                 },
12072                 .result = ACCEPT,
12073                 .retval = 2,
12074         },
12075         {
12076                 "xadd/w check unaligned stack",
12077                 .insns = {
12078                         BPF_MOV64_IMM(BPF_REG_0, 1),
12079                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
12080                         BPF_STX_XADD(BPF_W, BPF_REG_10, BPF_REG_0, -7),
12081                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
12082                         BPF_EXIT_INSN(),
12083                 },
12084                 .result = REJECT,
12085                 .errstr = "misaligned stack access off",
12086                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12087         },
12088         {
12089                 "xadd/w check unaligned map",
12090                 .insns = {
12091                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
12092                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12093                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12094                         BPF_LD_MAP_FD(BPF_REG_1, 0),
12095                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12096                                      BPF_FUNC_map_lookup_elem),
12097                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
12098                         BPF_EXIT_INSN(),
12099                         BPF_MOV64_IMM(BPF_REG_1, 1),
12100                         BPF_STX_XADD(BPF_W, BPF_REG_0, BPF_REG_1, 3),
12101                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, 3),
12102                         BPF_EXIT_INSN(),
12103                 },
12104                 .fixup_map1 = { 3 },
12105                 .result = REJECT,
12106                 .errstr = "misaligned value access off",
12107                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12108         },
12109         {
12110                 "xadd/w check unaligned pkt",
12111                 .insns = {
12112                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
12113                                     offsetof(struct xdp_md, data)),
12114                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
12115                                     offsetof(struct xdp_md, data_end)),
12116                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
12117                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
12118                         BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 2),
12119                         BPF_MOV64_IMM(BPF_REG_0, 99),
12120                         BPF_JMP_IMM(BPF_JA, 0, 0, 6),
12121                         BPF_MOV64_IMM(BPF_REG_0, 1),
12122                         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
12123                         BPF_ST_MEM(BPF_W, BPF_REG_2, 3, 0),
12124                         BPF_STX_XADD(BPF_W, BPF_REG_2, BPF_REG_0, 1),
12125                         BPF_STX_XADD(BPF_W, BPF_REG_2, BPF_REG_0, 2),
12126                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_2, 1),
12127                         BPF_EXIT_INSN(),
12128                 },
12129                 .result = REJECT,
12130                 .errstr = "BPF_XADD stores into R2 packet",
12131                 .prog_type = BPF_PROG_TYPE_XDP,
12132         },
12133         {
12134                 "xadd/w check whether src/dst got mangled, 1",
12135                 .insns = {
12136                         BPF_MOV64_IMM(BPF_REG_0, 1),
12137                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
12138                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
12139                         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
12140                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
12141                         BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
12142                         BPF_JMP_REG(BPF_JNE, BPF_REG_6, BPF_REG_0, 3),
12143                         BPF_JMP_REG(BPF_JNE, BPF_REG_7, BPF_REG_10, 2),
12144                         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
12145                         BPF_EXIT_INSN(),
12146                         BPF_MOV64_IMM(BPF_REG_0, 42),
12147                         BPF_EXIT_INSN(),
12148                 },
12149                 .result = ACCEPT,
12150                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12151                 .retval = 3,
12152         },
12153         {
12154                 "xadd/w check whether src/dst got mangled, 2",
12155                 .insns = {
12156                         BPF_MOV64_IMM(BPF_REG_0, 1),
12157                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
12158                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
12159                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -8),
12160                         BPF_STX_XADD(BPF_W, BPF_REG_10, BPF_REG_0, -8),
12161                         BPF_STX_XADD(BPF_W, BPF_REG_10, BPF_REG_0, -8),
12162                         BPF_JMP_REG(BPF_JNE, BPF_REG_6, BPF_REG_0, 3),
12163                         BPF_JMP_REG(BPF_JNE, BPF_REG_7, BPF_REG_10, 2),
12164                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -8),
12165                         BPF_EXIT_INSN(),
12166                         BPF_MOV64_IMM(BPF_REG_0, 42),
12167                         BPF_EXIT_INSN(),
12168                 },
12169                 .result = ACCEPT,
12170                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12171                 .retval = 3,
12172         },
12173         {
12174                 "bpf_get_stack return R0 within range",
12175                 .insns = {
12176                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12177                         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
12178                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
12179                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
12180                         BPF_LD_MAP_FD(BPF_REG_1, 0),
12181                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12182                                      BPF_FUNC_map_lookup_elem),
12183                         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 28),
12184                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
12185                         BPF_MOV64_IMM(BPF_REG_9, sizeof(struct test_val)),
12186                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
12187                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
12188                         BPF_MOV64_IMM(BPF_REG_3, sizeof(struct test_val)),
12189                         BPF_MOV64_IMM(BPF_REG_4, 256),
12190                         BPF_EMIT_CALL(BPF_FUNC_get_stack),
12191                         BPF_MOV64_IMM(BPF_REG_1, 0),
12192                         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
12193                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_8, 32),
12194                         BPF_ALU64_IMM(BPF_ARSH, BPF_REG_8, 32),
12195                         BPF_JMP_REG(BPF_JSLT, BPF_REG_1, BPF_REG_8, 16),
12196                         BPF_ALU64_REG(BPF_SUB, BPF_REG_9, BPF_REG_8),
12197                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
12198                         BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_8),
12199                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_9),
12200                         BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 32),
12201                         BPF_ALU64_IMM(BPF_ARSH, BPF_REG_1, 32),
12202                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
12203                         BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_1),
12204                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
12205                         BPF_MOV64_IMM(BPF_REG_5, sizeof(struct test_val)),
12206                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_5),
12207                         BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 4),
12208                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
12209                         BPF_MOV64_REG(BPF_REG_3, BPF_REG_9),
12210                         BPF_MOV64_IMM(BPF_REG_4, 0),
12211                         BPF_EMIT_CALL(BPF_FUNC_get_stack),
12212                         BPF_EXIT_INSN(),
12213                 },
12214                 .fixup_map2 = { 4 },
12215                 .result = ACCEPT,
12216                 .prog_type = BPF_PROG_TYPE_TRACEPOINT,
12217         },
12218         {
12219                 "ld_abs: invalid op 1",
12220                 .insns = {
12221                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12222                         BPF_LD_ABS(BPF_DW, 0),
12223                         BPF_EXIT_INSN(),
12224                 },
12225                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12226                 .result = REJECT,
12227                 .errstr = "unknown opcode",
12228         },
12229         {
12230                 "ld_abs: invalid op 2",
12231                 .insns = {
12232                         BPF_MOV32_IMM(BPF_REG_0, 256),
12233                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12234                         BPF_LD_IND(BPF_DW, BPF_REG_0, 0),
12235                         BPF_EXIT_INSN(),
12236                 },
12237                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12238                 .result = REJECT,
12239                 .errstr = "unknown opcode",
12240         },
12241         {
12242                 "ld_abs: nmap reduced",
12243                 .insns = {
12244                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12245                         BPF_LD_ABS(BPF_H, 12),
12246                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x806, 28),
12247                         BPF_LD_ABS(BPF_H, 12),
12248                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x806, 26),
12249                         BPF_MOV32_IMM(BPF_REG_0, 18),
12250                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -64),
12251                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_10, -64),
12252                         BPF_LD_IND(BPF_W, BPF_REG_7, 14),
12253                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -60),
12254                         BPF_MOV32_IMM(BPF_REG_0, 280971478),
12255                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -56),
12256                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_10, -56),
12257                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -60),
12258                         BPF_ALU32_REG(BPF_SUB, BPF_REG_0, BPF_REG_7),
12259                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 15),
12260                         BPF_LD_ABS(BPF_H, 12),
12261                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0x806, 13),
12262                         BPF_MOV32_IMM(BPF_REG_0, 22),
12263                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -56),
12264                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_10, -56),
12265                         BPF_LD_IND(BPF_H, BPF_REG_7, 14),
12266                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -52),
12267                         BPF_MOV32_IMM(BPF_REG_0, 17366),
12268                         BPF_STX_MEM(BPF_W, BPF_REG_10, BPF_REG_0, -48),
12269                         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_10, -48),
12270                         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -52),
12271                         BPF_ALU32_REG(BPF_SUB, BPF_REG_0, BPF_REG_7),
12272                         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
12273                         BPF_MOV32_IMM(BPF_REG_0, 256),
12274                         BPF_EXIT_INSN(),
12275                         BPF_MOV32_IMM(BPF_REG_0, 0),
12276                         BPF_EXIT_INSN(),
12277                 },
12278                 .data = {
12279                         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x08, 0x06, 0,
12280                         0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
12281                         0x10, 0xbf, 0x48, 0xd6, 0x43, 0xd6,
12282                 },
12283                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12284                 .result = ACCEPT,
12285                 .retval = 256,
12286         },
12287         {
12288                 "ld_abs: div + abs, test 1",
12289                 .insns = {
12290                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
12291                         BPF_LD_ABS(BPF_B, 3),
12292                         BPF_ALU64_IMM(BPF_MOV, BPF_REG_2, 2),
12293                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_2),
12294                         BPF_ALU64_REG(BPF_MOV, BPF_REG_8, BPF_REG_0),
12295                         BPF_LD_ABS(BPF_B, 4),
12296                         BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_0),
12297                         BPF_LD_IND(BPF_B, BPF_REG_8, -70),
12298                         BPF_EXIT_INSN(),
12299                 },
12300                 .data = {
12301                         10, 20, 30, 40, 50,
12302                 },
12303                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12304                 .result = ACCEPT,
12305                 .retval = 10,
12306         },
12307         {
12308                 "ld_abs: div + abs, test 2",
12309                 .insns = {
12310                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
12311                         BPF_LD_ABS(BPF_B, 3),
12312                         BPF_ALU64_IMM(BPF_MOV, BPF_REG_2, 2),
12313                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_2),
12314                         BPF_ALU64_REG(BPF_MOV, BPF_REG_8, BPF_REG_0),
12315                         BPF_LD_ABS(BPF_B, 128),
12316                         BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_0),
12317                         BPF_LD_IND(BPF_B, BPF_REG_8, -70),
12318                         BPF_EXIT_INSN(),
12319                 },
12320                 .data = {
12321                         10, 20, 30, 40, 50,
12322                 },
12323                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12324                 .result = ACCEPT,
12325                 .retval = 0,
12326         },
12327         {
12328                 "ld_abs: div + abs, test 3",
12329                 .insns = {
12330                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
12331                         BPF_ALU64_IMM(BPF_MOV, BPF_REG_7, 0),
12332                         BPF_LD_ABS(BPF_B, 3),
12333                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_7),
12334                         BPF_EXIT_INSN(),
12335                 },
12336                 .data = {
12337                         10, 20, 30, 40, 50,
12338                 },
12339                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12340                 .result = ACCEPT,
12341                 .retval = 0,
12342         },
12343         {
12344                 "ld_abs: div + abs, test 4",
12345                 .insns = {
12346                         BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
12347                         BPF_ALU64_IMM(BPF_MOV, BPF_REG_7, 0),
12348                         BPF_LD_ABS(BPF_B, 256),
12349                         BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_7),
12350                         BPF_EXIT_INSN(),
12351                 },
12352                 .data = {
12353                         10, 20, 30, 40, 50,
12354                 },
12355                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12356                 .result = ACCEPT,
12357                 .retval = 0,
12358         },
12359         {
12360                 "ld_abs: vlan + abs, test 1",
12361                 .insns = { },
12362                 .data = {
12363                         0x34,
12364                 },
12365                 .fill_helper = bpf_fill_ld_abs_vlan_push_pop,
12366                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12367                 .result = ACCEPT,
12368                 .retval = 0xbef,
12369         },
12370         {
12371                 "ld_abs: vlan + abs, test 2",
12372                 .insns = {
12373                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12374                         BPF_LD_ABS(BPF_B, 0),
12375                         BPF_LD_ABS(BPF_H, 0),
12376                         BPF_LD_ABS(BPF_W, 0),
12377                         BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
12378                         BPF_MOV64_IMM(BPF_REG_6, 0),
12379                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
12380                         BPF_MOV64_IMM(BPF_REG_2, 1),
12381                         BPF_MOV64_IMM(BPF_REG_3, 2),
12382                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12383                                      BPF_FUNC_skb_vlan_push),
12384                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
12385                         BPF_LD_ABS(BPF_B, 0),
12386                         BPF_LD_ABS(BPF_H, 0),
12387                         BPF_LD_ABS(BPF_W, 0),
12388                         BPF_MOV64_IMM(BPF_REG_0, 42),
12389                         BPF_EXIT_INSN(),
12390                 },
12391                 .data = {
12392                         0x34,
12393                 },
12394                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12395                 .result = ACCEPT,
12396                 .retval = 42,
12397         },
12398         {
12399                 "ld_abs: jump around ld_abs",
12400                 .insns = { },
12401                 .data = {
12402                         10, 11,
12403                 },
12404                 .fill_helper = bpf_fill_jump_around_ld_abs,
12405                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12406                 .result = ACCEPT,
12407                 .retval = 10,
12408         },
12409         {
12410                 "ld_dw: xor semi-random 64 bit imms, test 1",
12411                 .insns = { },
12412                 .data = { },
12413                 .fill_helper = bpf_fill_rand_ld_dw,
12414                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12415                 .result = ACCEPT,
12416                 .retval = 4090,
12417         },
12418         {
12419                 "ld_dw: xor semi-random 64 bit imms, test 2",
12420                 .insns = { },
12421                 .data = { },
12422                 .fill_helper = bpf_fill_rand_ld_dw,
12423                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12424                 .result = ACCEPT,
12425                 .retval = 2047,
12426         },
12427         {
12428                 "ld_dw: xor semi-random 64 bit imms, test 3",
12429                 .insns = { },
12430                 .data = { },
12431                 .fill_helper = bpf_fill_rand_ld_dw,
12432                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12433                 .result = ACCEPT,
12434                 .retval = 511,
12435         },
12436         {
12437                 "ld_dw: xor semi-random 64 bit imms, test 4",
12438                 .insns = { },
12439                 .data = { },
12440                 .fill_helper = bpf_fill_rand_ld_dw,
12441                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12442                 .result = ACCEPT,
12443                 .retval = 5,
12444         },
12445         {
12446                 "pass unmodified ctx pointer to helper",
12447                 .insns = {
12448                         BPF_MOV64_IMM(BPF_REG_2, 0),
12449                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12450                                      BPF_FUNC_csum_update),
12451                         BPF_MOV64_IMM(BPF_REG_0, 0),
12452                         BPF_EXIT_INSN(),
12453                 },
12454                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12455                 .result = ACCEPT,
12456         },
12457         {
12458                 "pass modified ctx pointer to helper, 1",
12459                 .insns = {
12460                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -612),
12461                         BPF_MOV64_IMM(BPF_REG_2, 0),
12462                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12463                                      BPF_FUNC_csum_update),
12464                         BPF_MOV64_IMM(BPF_REG_0, 0),
12465                         BPF_EXIT_INSN(),
12466                 },
12467                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12468                 .result = REJECT,
12469                 .errstr = "dereference of modified ctx ptr",
12470         },
12471         {
12472                 "pass modified ctx pointer to helper, 2",
12473                 .insns = {
12474                         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -612),
12475                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12476                                      BPF_FUNC_get_socket_cookie),
12477                         BPF_MOV64_IMM(BPF_REG_0, 0),
12478                         BPF_EXIT_INSN(),
12479                 },
12480                 .result_unpriv = REJECT,
12481                 .result = REJECT,
12482                 .errstr_unpriv = "dereference of modified ctx ptr",
12483                 .errstr = "dereference of modified ctx ptr",
12484         },
12485         {
12486                 "pass modified ctx pointer to helper, 3",
12487                 .insns = {
12488                         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 0),
12489                         BPF_ALU64_IMM(BPF_AND, BPF_REG_3, 4),
12490                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
12491                         BPF_MOV64_IMM(BPF_REG_2, 0),
12492                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12493                                      BPF_FUNC_csum_update),
12494                         BPF_MOV64_IMM(BPF_REG_0, 0),
12495                         BPF_EXIT_INSN(),
12496                 },
12497                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12498                 .result = REJECT,
12499                 .errstr = "variable ctx access var_off=(0x0; 0x4)",
12500         },
12501         {
12502                 "mov64 src == dst",
12503                 .insns = {
12504                         BPF_MOV64_IMM(BPF_REG_2, 0),
12505                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_2),
12506                         // Check bounds are OK
12507                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
12508                         BPF_MOV64_IMM(BPF_REG_0, 0),
12509                         BPF_EXIT_INSN(),
12510                 },
12511                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12512                 .result = ACCEPT,
12513         },
12514         {
12515                 "mov64 src != dst",
12516                 .insns = {
12517                         BPF_MOV64_IMM(BPF_REG_3, 0),
12518                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_3),
12519                         // Check bounds are OK
12520                         BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
12521                         BPF_MOV64_IMM(BPF_REG_0, 0),
12522                         BPF_EXIT_INSN(),
12523                 },
12524                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
12525                 .result = ACCEPT,
12526         },
12527         {
12528                 "calls: ctx read at start of subprog",
12529                 .insns = {
12530                         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
12531                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
12532                         BPF_JMP_REG(BPF_JSGT, BPF_REG_0, BPF_REG_0, 0),
12533                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
12534                         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
12535                         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
12536                         BPF_EXIT_INSN(),
12537                         BPF_LDX_MEM(BPF_B, BPF_REG_9, BPF_REG_1, 0),
12538                         BPF_MOV64_IMM(BPF_REG_0, 0),
12539                         BPF_EXIT_INSN(),
12540                 },
12541                 .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
12542                 .errstr_unpriv = "function calls to other bpf functions are allowed for root only",
12543                 .result_unpriv = REJECT,
12544                 .result = ACCEPT,
12545         },
12546 };
12547
12548 static int probe_filter_length(const struct bpf_insn *fp)
12549 {
12550         int len;
12551
12552         for (len = MAX_INSNS - 1; len > 0; --len)
12553                 if (fp[len].code != 0 || fp[len].imm != 0)
12554                         break;
12555         return len + 1;
12556 }
12557
12558 static int create_map(uint32_t type, uint32_t size_key,
12559                       uint32_t size_value, uint32_t max_elem)
12560 {
12561         int fd;
12562
12563         fd = bpf_create_map(type, size_key, size_value, max_elem,
12564                             type == BPF_MAP_TYPE_HASH ? BPF_F_NO_PREALLOC : 0);
12565         if (fd < 0)
12566                 printf("Failed to create hash map '%s'!\n", strerror(errno));
12567
12568         return fd;
12569 }
12570
12571 static int create_prog_dummy1(void)
12572 {
12573         struct bpf_insn prog[] = {
12574                 BPF_MOV64_IMM(BPF_REG_0, 42),
12575                 BPF_EXIT_INSN(),
12576         };
12577
12578         return bpf_load_program(BPF_PROG_TYPE_SOCKET_FILTER, prog,
12579                                 ARRAY_SIZE(prog), "GPL", 0, NULL, 0);
12580 }
12581
12582 static int create_prog_dummy2(int mfd, int idx)
12583 {
12584         struct bpf_insn prog[] = {
12585                 BPF_MOV64_IMM(BPF_REG_3, idx),
12586                 BPF_LD_MAP_FD(BPF_REG_2, mfd),
12587                 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
12588                              BPF_FUNC_tail_call),
12589                 BPF_MOV64_IMM(BPF_REG_0, 41),
12590                 BPF_EXIT_INSN(),
12591         };
12592
12593         return bpf_load_program(BPF_PROG_TYPE_SOCKET_FILTER, prog,
12594                                 ARRAY_SIZE(prog), "GPL", 0, NULL, 0);
12595 }
12596
12597 static int create_prog_array(uint32_t max_elem, int p1key)
12598 {
12599         int p2key = 1;
12600         int mfd, p1fd, p2fd;
12601
12602         mfd = bpf_create_map(BPF_MAP_TYPE_PROG_ARRAY, sizeof(int),
12603                              sizeof(int), max_elem, 0);
12604         if (mfd < 0) {
12605                 printf("Failed to create prog array '%s'!\n", strerror(errno));
12606                 return -1;
12607         }
12608
12609         p1fd = create_prog_dummy1();
12610         p2fd = create_prog_dummy2(mfd, p2key);
12611         if (p1fd < 0 || p2fd < 0)
12612                 goto out;
12613         if (bpf_map_update_elem(mfd, &p1key, &p1fd, BPF_ANY) < 0)
12614                 goto out;
12615         if (bpf_map_update_elem(mfd, &p2key, &p2fd, BPF_ANY) < 0)
12616                 goto out;
12617         close(p2fd);
12618         close(p1fd);
12619
12620         return mfd;
12621 out:
12622         close(p2fd);
12623         close(p1fd);
12624         close(mfd);
12625         return -1;
12626 }
12627
12628 static int create_map_in_map(void)
12629 {
12630         int inner_map_fd, outer_map_fd;
12631
12632         inner_map_fd = bpf_create_map(BPF_MAP_TYPE_ARRAY, sizeof(int),
12633                                       sizeof(int), 1, 0);
12634         if (inner_map_fd < 0) {
12635                 printf("Failed to create array '%s'!\n", strerror(errno));
12636                 return inner_map_fd;
12637         }
12638
12639         outer_map_fd = bpf_create_map_in_map(BPF_MAP_TYPE_ARRAY_OF_MAPS, NULL,
12640                                              sizeof(int), inner_map_fd, 1, 0);
12641         if (outer_map_fd < 0)
12642                 printf("Failed to create array of maps '%s'!\n",
12643                        strerror(errno));
12644
12645         close(inner_map_fd);
12646
12647         return outer_map_fd;
12648 }
12649
12650 static int create_cgroup_storage(void)
12651 {
12652         int fd;
12653
12654         fd = bpf_create_map(BPF_MAP_TYPE_CGROUP_STORAGE,
12655                             sizeof(struct bpf_cgroup_storage_key),
12656                             TEST_DATA_LEN, 0, 0);
12657         if (fd < 0)
12658                 printf("Failed to create array '%s'!\n", strerror(errno));
12659
12660         return fd;
12661 }
12662
12663 static char bpf_vlog[UINT_MAX >> 8];
12664
12665 static void do_test_fixup(struct bpf_test *test, struct bpf_insn *prog,
12666                           int *map_fds)
12667 {
12668         int *fixup_map1 = test->fixup_map1;
12669         int *fixup_map2 = test->fixup_map2;
12670         int *fixup_map3 = test->fixup_map3;
12671         int *fixup_map4 = test->fixup_map4;
12672         int *fixup_prog1 = test->fixup_prog1;
12673         int *fixup_prog2 = test->fixup_prog2;
12674         int *fixup_map_in_map = test->fixup_map_in_map;
12675         int *fixup_cgroup_storage = test->fixup_cgroup_storage;
12676
12677         if (test->fill_helper)
12678                 test->fill_helper(test);
12679
12680         /* Allocating HTs with 1 elem is fine here, since we only test
12681          * for verifier and not do a runtime lookup, so the only thing
12682          * that really matters is value size in this case.
12683          */
12684         if (*fixup_map1) {
12685                 map_fds[0] = create_map(BPF_MAP_TYPE_HASH, sizeof(long long),
12686                                         sizeof(long long), 1);
12687                 do {
12688                         prog[*fixup_map1].imm = map_fds[0];
12689                         fixup_map1++;
12690                 } while (*fixup_map1);
12691         }
12692
12693         if (*fixup_map2) {
12694                 map_fds[1] = create_map(BPF_MAP_TYPE_HASH, sizeof(long long),
12695                                         sizeof(struct test_val), 1);
12696                 do {
12697                         prog[*fixup_map2].imm = map_fds[1];
12698                         fixup_map2++;
12699                 } while (*fixup_map2);
12700         }
12701
12702         if (*fixup_map3) {
12703                 map_fds[2] = create_map(BPF_MAP_TYPE_HASH, sizeof(long long),
12704                                         sizeof(struct other_val), 1);
12705                 do {
12706                         prog[*fixup_map3].imm = map_fds[2];
12707                         fixup_map3++;
12708                 } while (*fixup_map3);
12709         }
12710
12711         if (*fixup_map4) {
12712                 map_fds[3] = create_map(BPF_MAP_TYPE_ARRAY, sizeof(int),
12713                                         sizeof(struct test_val), 1);
12714                 do {
12715                         prog[*fixup_map4].imm = map_fds[3];
12716                         fixup_map4++;
12717                 } while (*fixup_map4);
12718         }
12719
12720         if (*fixup_prog1) {
12721                 map_fds[4] = create_prog_array(4, 0);
12722                 do {
12723                         prog[*fixup_prog1].imm = map_fds[4];
12724                         fixup_prog1++;
12725                 } while (*fixup_prog1);
12726         }
12727
12728         if (*fixup_prog2) {
12729                 map_fds[5] = create_prog_array(8, 7);
12730                 do {
12731                         prog[*fixup_prog2].imm = map_fds[5];
12732                         fixup_prog2++;
12733                 } while (*fixup_prog2);
12734         }
12735
12736         if (*fixup_map_in_map) {
12737                 map_fds[6] = create_map_in_map();
12738                 do {
12739                         prog[*fixup_map_in_map].imm = map_fds[6];
12740                         fixup_map_in_map++;
12741                 } while (*fixup_map_in_map);
12742         }
12743
12744         if (*fixup_cgroup_storage) {
12745                 map_fds[7] = create_cgroup_storage();
12746                 do {
12747                         prog[*fixup_cgroup_storage].imm = map_fds[7];
12748                         fixup_cgroup_storage++;
12749                 } while (*fixup_cgroup_storage);
12750         }
12751 }
12752
12753 static void do_test_single(struct bpf_test *test, bool unpriv,
12754                            int *passes, int *errors)
12755 {
12756         int fd_prog, expected_ret, reject_from_alignment;
12757         int prog_len, prog_type = test->prog_type;
12758         struct bpf_insn *prog = test->insns;
12759         int map_fds[MAX_NR_MAPS];
12760         const char *expected_err;
12761         uint32_t retval;
12762         int i, err;
12763
12764         for (i = 0; i < MAX_NR_MAPS; i++)
12765                 map_fds[i] = -1;
12766
12767         do_test_fixup(test, prog, map_fds);
12768         prog_len = probe_filter_length(prog);
12769
12770         fd_prog = bpf_verify_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
12771                                      prog, prog_len, test->flags & F_LOAD_WITH_STRICT_ALIGNMENT,
12772                                      "GPL", 0, bpf_vlog, sizeof(bpf_vlog), 1);
12773
12774         expected_ret = unpriv && test->result_unpriv != UNDEF ?
12775                        test->result_unpriv : test->result;
12776         expected_err = unpriv && test->errstr_unpriv ?
12777                        test->errstr_unpriv : test->errstr;
12778
12779         reject_from_alignment = fd_prog < 0 &&
12780                                 (test->flags & F_NEEDS_EFFICIENT_UNALIGNED_ACCESS) &&
12781                                 strstr(bpf_vlog, "misaligned");
12782 #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
12783         if (reject_from_alignment) {
12784                 printf("FAIL\nFailed due to alignment despite having efficient unaligned access: '%s'!\n",
12785                        strerror(errno));
12786                 goto fail_log;
12787         }
12788 #endif
12789         if (expected_ret == ACCEPT) {
12790                 if (fd_prog < 0 && !reject_from_alignment) {
12791                         printf("FAIL\nFailed to load prog '%s'!\n",
12792                                strerror(errno));
12793                         goto fail_log;
12794                 }
12795         } else {
12796                 if (fd_prog >= 0) {
12797                         printf("FAIL\nUnexpected success to load!\n");
12798                         goto fail_log;
12799                 }
12800                 if (!strstr(bpf_vlog, expected_err) && !reject_from_alignment) {
12801                         printf("FAIL\nUnexpected error message!\n\tEXP: %s\n\tRES: %s\n",
12802                               expected_err, bpf_vlog);
12803                         goto fail_log;
12804                 }
12805         }
12806
12807         if (fd_prog >= 0) {
12808                 __u8 tmp[TEST_DATA_LEN << 2];
12809                 __u32 size_tmp = sizeof(tmp);
12810
12811                 err = bpf_prog_test_run(fd_prog, 1, test->data,
12812                                         sizeof(test->data), tmp, &size_tmp,
12813                                         &retval, NULL);
12814                 if (err && errno != 524/*ENOTSUPP*/ && errno != EPERM) {
12815                         printf("Unexpected bpf_prog_test_run error\n");
12816                         goto fail_log;
12817                 }
12818                 if (!err && retval != test->retval &&
12819                     test->retval != POINTER_VALUE) {
12820                         printf("FAIL retval %d != %d\n", retval, test->retval);
12821                         goto fail_log;
12822                 }
12823         }
12824         (*passes)++;
12825         printf("OK%s\n", reject_from_alignment ?
12826                " (NOTE: reject due to unknown alignment)" : "");
12827 close_fds:
12828         close(fd_prog);
12829         for (i = 0; i < MAX_NR_MAPS; i++)
12830                 close(map_fds[i]);
12831         sched_yield();
12832         return;
12833 fail_log:
12834         (*errors)++;
12835         printf("%s", bpf_vlog);
12836         goto close_fds;
12837 }
12838
12839 static bool is_admin(void)
12840 {
12841         cap_t caps;
12842         cap_flag_value_t sysadmin = CAP_CLEAR;
12843         const cap_value_t cap_val = CAP_SYS_ADMIN;
12844
12845 #ifdef CAP_IS_SUPPORTED
12846         if (!CAP_IS_SUPPORTED(CAP_SETFCAP)) {
12847                 perror("cap_get_flag");
12848                 return false;
12849         }
12850 #endif
12851         caps = cap_get_proc();
12852         if (!caps) {
12853                 perror("cap_get_proc");
12854                 return false;
12855         }
12856         if (cap_get_flag(caps, cap_val, CAP_EFFECTIVE, &sysadmin))
12857                 perror("cap_get_flag");
12858         if (cap_free(caps))
12859                 perror("cap_free");
12860         return (sysadmin == CAP_SET);
12861 }
12862
12863 static int set_admin(bool admin)
12864 {
12865         cap_t caps;
12866         const cap_value_t cap_val = CAP_SYS_ADMIN;
12867         int ret = -1;
12868
12869         caps = cap_get_proc();
12870         if (!caps) {
12871                 perror("cap_get_proc");
12872                 return -1;
12873         }
12874         if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap_val,
12875                                 admin ? CAP_SET : CAP_CLEAR)) {
12876                 perror("cap_set_flag");
12877                 goto out;
12878         }
12879         if (cap_set_proc(caps)) {
12880                 perror("cap_set_proc");
12881                 goto out;
12882         }
12883         ret = 0;
12884 out:
12885         if (cap_free(caps))
12886                 perror("cap_free");
12887         return ret;
12888 }
12889
12890 static void get_unpriv_disabled()
12891 {
12892         char buf[2];
12893         FILE *fd;
12894
12895         fd = fopen("/proc/sys/"UNPRIV_SYSCTL, "r");
12896         if (!fd) {
12897                 perror("fopen /proc/sys/"UNPRIV_SYSCTL);
12898                 unpriv_disabled = true;
12899                 return;
12900         }
12901         if (fgets(buf, 2, fd) == buf && atoi(buf))
12902                 unpriv_disabled = true;
12903         fclose(fd);
12904 }
12905
12906 static int do_test(bool unpriv, unsigned int from, unsigned int to)
12907 {
12908         int i, passes = 0, errors = 0, skips = 0;
12909
12910         for (i = from; i < to; i++) {
12911                 struct bpf_test *test = &tests[i];
12912
12913                 /* Program types that are not supported by non-root we
12914                  * skip right away.
12915                  */
12916                 if (!test->prog_type && unpriv_disabled) {
12917                         printf("#%d/u %s SKIP\n", i, test->descr);
12918                         skips++;
12919                 } else if (!test->prog_type) {
12920                         if (!unpriv)
12921                                 set_admin(false);
12922                         printf("#%d/u %s ", i, test->descr);
12923                         do_test_single(test, true, &passes, &errors);
12924                         if (!unpriv)
12925                                 set_admin(true);
12926                 }
12927
12928                 if (unpriv) {
12929                         printf("#%d/p %s SKIP\n", i, test->descr);
12930                         skips++;
12931                 } else {
12932                         printf("#%d/p %s ", i, test->descr);
12933                         do_test_single(test, false, &passes, &errors);
12934                 }
12935         }
12936
12937         printf("Summary: %d PASSED, %d SKIPPED, %d FAILED\n", passes,
12938                skips, errors);
12939         return errors ? EXIT_FAILURE : EXIT_SUCCESS;
12940 }
12941
12942 int main(int argc, char **argv)
12943 {
12944         unsigned int from = 0, to = ARRAY_SIZE(tests);
12945         bool unpriv = !is_admin();
12946
12947         if (argc == 3) {
12948                 unsigned int l = atoi(argv[argc - 2]);
12949                 unsigned int u = atoi(argv[argc - 1]);
12950
12951                 if (l < to && u < to) {
12952                         from = l;
12953                         to   = u + 1;
12954                 }
12955         } else if (argc == 2) {
12956                 unsigned int t = atoi(argv[argc - 1]);
12957
12958                 if (t < to) {
12959                         from = t;
12960                         to   = t + 1;
12961                 }
12962         }
12963
12964         get_unpriv_disabled();
12965         if (unpriv && unpriv_disabled) {
12966                 printf("Cannot run as unprivileged user with sysctl %s.\n",
12967                        UNPRIV_SYSCTL);
12968                 return EXIT_FAILURE;
12969         }
12970
12971         bpf_semi_rand_init();
12972         return do_test(unpriv, from, to);
12973 }