selftests: bpf: break up test_verifier
authorJakub Kicinski <jakub.kicinski@netronome.com>
Fri, 25 Jan 2019 23:24:43 +0000 (15:24 -0800)
committerAlexei Starovoitov <ast@kernel.org>
Mon, 28 Jan 2019 05:37:45 +0000 (21:37 -0800)
Break up the first 10 kLoC of test verifier test cases
out into smaller files.  Looks like git line counting
gets a little flismy above 16 bit integers, so we need
two commits to break up test_verifier.

Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Acked-by: Jiong Wang <jiong.wang@netronome.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
48 files changed:
tools/testing/selftests/bpf/test_verifier.c
tools/testing/selftests/bpf/verifier/and.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/array_access.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/basic.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/basic_call.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/basic_instr.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/basic_stack.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/basic_stx_ldx.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/bounds.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/bounds_mix_sign_unsign.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/cfg.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/cgroup_skb.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/cgroup_storage.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/const_or.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/ctx.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/ctx_sk_msg.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/ctx_skb.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/direct_packet_access.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/direct_stack_access_wraparound.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/div0.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/div_overflow.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/helper_access_var_len.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/helper_packet_access.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/helper_value_access.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/jump.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/junk_insn.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/ld_abs.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/ld_imm64.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/ld_ind.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/leak_ptr.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/lwt.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/map_in_map.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/map_ret_val.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/perf_event_sample_period.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/prevent_map_lookup.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/raw_stack.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/runtime_jit.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/search_pruning.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/spill_fill.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/stack_ptr.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/uninit.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/unpriv.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/value.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/value_adj_spill.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/value_illegal_alu.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/value_or_null.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/value_ptr_arith.c [new file with mode: 0644]
tools/testing/selftests/bpf/verifier/var_off.c [new file with mode: 0644]

index 0a1847c3d1a3b0dee298ab4ddd3efe4aee51fdf1..fcdb7e2d2ec0ea5295e2069d6352bad294aedae1 100644 (file)
@@ -251,10142 +251,6 @@ static struct bpf_test tests[] = {
 #define FILL_ARRAY
 #include <verifier/tests.h>
 #undef FILL_ARRAY
-       {
-               "add+sub+mul",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_1, 1),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 2),
-                       BPF_MOV64_IMM(BPF_REG_2, 3),
-                       BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -1),
-                       BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 3),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .retval = -3,
-       },
-       {
-               "DIV32 by 0, zero check 1",
-               .insns = {
-                       BPF_MOV32_IMM(BPF_REG_0, 42),
-                       BPF_MOV32_IMM(BPF_REG_1, 0),
-                       BPF_MOV32_IMM(BPF_REG_2, 1),
-                       BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .retval = 42,
-       },
-       {
-               "DIV32 by 0, zero check 2",
-               .insns = {
-                       BPF_MOV32_IMM(BPF_REG_0, 42),
-                       BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
-                       BPF_MOV32_IMM(BPF_REG_2, 1),
-                       BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .retval = 42,
-       },
-       {
-               "DIV64 by 0, zero check",
-               .insns = {
-                       BPF_MOV32_IMM(BPF_REG_0, 42),
-                       BPF_MOV32_IMM(BPF_REG_1, 0),
-                       BPF_MOV32_IMM(BPF_REG_2, 1),
-                       BPF_ALU64_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .retval = 42,
-       },
-       {
-               "MOD32 by 0, zero check 1",
-               .insns = {
-                       BPF_MOV32_IMM(BPF_REG_0, 42),
-                       BPF_MOV32_IMM(BPF_REG_1, 0),
-                       BPF_MOV32_IMM(BPF_REG_2, 1),
-                       BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .retval = 42,
-       },
-       {
-               "MOD32 by 0, zero check 2",
-               .insns = {
-                       BPF_MOV32_IMM(BPF_REG_0, 42),
-                       BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
-                       BPF_MOV32_IMM(BPF_REG_2, 1),
-                       BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .retval = 42,
-       },
-       {
-               "MOD64 by 0, zero check",
-               .insns = {
-                       BPF_MOV32_IMM(BPF_REG_0, 42),
-                       BPF_MOV32_IMM(BPF_REG_1, 0),
-                       BPF_MOV32_IMM(BPF_REG_2, 1),
-                       BPF_ALU64_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .retval = 42,
-       },
-       {
-               "DIV32 by 0, zero check ok, cls",
-               .insns = {
-                       BPF_MOV32_IMM(BPF_REG_0, 42),
-                       BPF_MOV32_IMM(BPF_REG_1, 2),
-                       BPF_MOV32_IMM(BPF_REG_2, 16),
-                       BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_EXIT_INSN(),
-               },
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .result = ACCEPT,
-               .retval = 8,
-       },
-       {
-               "DIV32 by 0, zero check 1, cls",
-               .insns = {
-                       BPF_MOV32_IMM(BPF_REG_1, 0),
-                       BPF_MOV32_IMM(BPF_REG_0, 1),
-                       BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
-                       BPF_EXIT_INSN(),
-               },
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .result = ACCEPT,
-               .retval = 0,
-       },
-       {
-               "DIV32 by 0, zero check 2, cls",
-               .insns = {
-                       BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
-                       BPF_MOV32_IMM(BPF_REG_0, 1),
-                       BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
-                       BPF_EXIT_INSN(),
-               },
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .result = ACCEPT,
-               .retval = 0,
-       },
-       {
-               "DIV64 by 0, zero check, cls",
-               .insns = {
-                       BPF_MOV32_IMM(BPF_REG_1, 0),
-                       BPF_MOV32_IMM(BPF_REG_0, 1),
-                       BPF_ALU64_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
-                       BPF_EXIT_INSN(),
-               },
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .result = ACCEPT,
-               .retval = 0,
-       },
-       {
-               "MOD32 by 0, zero check ok, cls",
-               .insns = {
-                       BPF_MOV32_IMM(BPF_REG_0, 42),
-                       BPF_MOV32_IMM(BPF_REG_1, 3),
-                       BPF_MOV32_IMM(BPF_REG_2, 5),
-                       BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_EXIT_INSN(),
-               },
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .result = ACCEPT,
-               .retval = 2,
-       },
-       {
-               "MOD32 by 0, zero check 1, cls",
-               .insns = {
-                       BPF_MOV32_IMM(BPF_REG_1, 0),
-                       BPF_MOV32_IMM(BPF_REG_0, 1),
-                       BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
-                       BPF_EXIT_INSN(),
-               },
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .result = ACCEPT,
-               .retval = 1,
-       },
-       {
-               "MOD32 by 0, zero check 2, cls",
-               .insns = {
-                       BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
-                       BPF_MOV32_IMM(BPF_REG_0, 1),
-                       BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
-                       BPF_EXIT_INSN(),
-               },
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .result = ACCEPT,
-               .retval = 1,
-       },
-       {
-               "MOD64 by 0, zero check 1, cls",
-               .insns = {
-                       BPF_MOV32_IMM(BPF_REG_1, 0),
-                       BPF_MOV32_IMM(BPF_REG_0, 2),
-                       BPF_ALU64_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
-                       BPF_EXIT_INSN(),
-               },
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .result = ACCEPT,
-               .retval = 2,
-       },
-       {
-               "MOD64 by 0, zero check 2, cls",
-               .insns = {
-                       BPF_MOV32_IMM(BPF_REG_1, 0),
-                       BPF_MOV32_IMM(BPF_REG_0, -1),
-                       BPF_ALU64_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
-                       BPF_EXIT_INSN(),
-               },
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .result = ACCEPT,
-               .retval = -1,
-       },
-       /* Just make sure that JITs used udiv/umod as otherwise we get
-        * an exception from INT_MIN/-1 overflow similarly as with div
-        * by zero.
-        */
-       {
-               "DIV32 overflow, check 1",
-               .insns = {
-                       BPF_MOV32_IMM(BPF_REG_1, -1),
-                       BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
-                       BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
-                       BPF_EXIT_INSN(),
-               },
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .result = ACCEPT,
-               .retval = 0,
-       },
-       {
-               "DIV32 overflow, check 2",
-               .insns = {
-                       BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
-                       BPF_ALU32_IMM(BPF_DIV, BPF_REG_0, -1),
-                       BPF_EXIT_INSN(),
-               },
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .result = ACCEPT,
-               .retval = 0,
-       },
-       {
-               "DIV64 overflow, check 1",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_1, -1),
-                       BPF_LD_IMM64(BPF_REG_0, LLONG_MIN),
-                       BPF_ALU64_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
-                       BPF_EXIT_INSN(),
-               },
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .result = ACCEPT,
-               .retval = 0,
-       },
-       {
-               "DIV64 overflow, check 2",
-               .insns = {
-                       BPF_LD_IMM64(BPF_REG_0, LLONG_MIN),
-                       BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, -1),
-                       BPF_EXIT_INSN(),
-               },
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .result = ACCEPT,
-               .retval = 0,
-       },
-       {
-               "MOD32 overflow, check 1",
-               .insns = {
-                       BPF_MOV32_IMM(BPF_REG_1, -1),
-                       BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
-                       BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
-                       BPF_EXIT_INSN(),
-               },
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .result = ACCEPT,
-               .retval = INT_MIN,
-       },
-       {
-               "MOD32 overflow, check 2",
-               .insns = {
-                       BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
-                       BPF_ALU32_IMM(BPF_MOD, BPF_REG_0, -1),
-                       BPF_EXIT_INSN(),
-               },
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .result = ACCEPT,
-               .retval = INT_MIN,
-       },
-       {
-               "MOD64 overflow, check 1",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_1, -1),
-                       BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
-                       BPF_ALU64_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
-                       BPF_MOV32_IMM(BPF_REG_0, 0),
-                       BPF_JMP_REG(BPF_JNE, BPF_REG_3, BPF_REG_2, 1),
-                       BPF_MOV32_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .result = ACCEPT,
-               .retval = 1,
-       },
-       {
-               "MOD64 overflow, check 2",
-               .insns = {
-                       BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_MOD, BPF_REG_2, -1),
-                       BPF_MOV32_IMM(BPF_REG_0, 0),
-                       BPF_JMP_REG(BPF_JNE, BPF_REG_3, BPF_REG_2, 1),
-                       BPF_MOV32_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .result = ACCEPT,
-               .retval = 1,
-       },
-       {
-               "xor32 zero extend check",
-               .insns = {
-                       BPF_MOV32_IMM(BPF_REG_2, -1),
-                       BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 32),
-                       BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 0xffff),
-                       BPF_ALU32_REG(BPF_XOR, BPF_REG_2, BPF_REG_2),
-                       BPF_MOV32_IMM(BPF_REG_0, 2),
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 1),
-                       BPF_MOV32_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .result = ACCEPT,
-               .retval = 1,
-       },
-       {
-               "empty prog",
-               .insns = {
-               },
-               .errstr = "unknown opcode 00",
-               .result = REJECT,
-       },
-       {
-               "only exit insn",
-               .insns = {
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R0 !read_ok",
-               .result = REJECT,
-       },
-       {
-               "unreachable",
-               .insns = {
-                       BPF_EXIT_INSN(),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "unreachable",
-               .result = REJECT,
-       },
-       {
-               "unreachable2",
-               .insns = {
-                       BPF_JMP_IMM(BPF_JA, 0, 0, 1),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "unreachable",
-               .result = REJECT,
-       },
-       {
-               "out of range jump",
-               .insns = {
-                       BPF_JMP_IMM(BPF_JA, 0, 0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "jump out of range",
-               .result = REJECT,
-       },
-       {
-               "out of range jump2",
-               .insns = {
-                       BPF_JMP_IMM(BPF_JA, 0, 0, -2),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "jump out of range",
-               .result = REJECT,
-       },
-       {
-               "test1 ld_imm64",
-               .insns = {
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
-                       BPF_LD_IMM64(BPF_REG_0, 0),
-                       BPF_LD_IMM64(BPF_REG_0, 0),
-                       BPF_LD_IMM64(BPF_REG_0, 1),
-                       BPF_LD_IMM64(BPF_REG_0, 1),
-                       BPF_MOV64_IMM(BPF_REG_0, 2),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid BPF_LD_IMM insn",
-               .errstr_unpriv = "R1 pointer comparison",
-               .result = REJECT,
-       },
-       {
-               "test2 ld_imm64",
-               .insns = {
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
-                       BPF_LD_IMM64(BPF_REG_0, 0),
-                       BPF_LD_IMM64(BPF_REG_0, 0),
-                       BPF_LD_IMM64(BPF_REG_0, 1),
-                       BPF_LD_IMM64(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid BPF_LD_IMM insn",
-               .errstr_unpriv = "R1 pointer comparison",
-               .result = REJECT,
-       },
-       {
-               "test3 ld_imm64",
-               .insns = {
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
-                       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
-                       BPF_LD_IMM64(BPF_REG_0, 0),
-                       BPF_LD_IMM64(BPF_REG_0, 0),
-                       BPF_LD_IMM64(BPF_REG_0, 1),
-                       BPF_LD_IMM64(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_ld_imm64 insn",
-               .result = REJECT,
-       },
-       {
-               "test4 ld_imm64",
-               .insns = {
-                       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_ld_imm64 insn",
-               .result = REJECT,
-       },
-       {
-               "test5 ld_imm64",
-               .insns = {
-                       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
-               },
-               .errstr = "invalid bpf_ld_imm64 insn",
-               .result = REJECT,
-       },
-       {
-               "test6 ld_imm64",
-               .insns = {
-                       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
-                       BPF_RAW_INSN(0, 0, 0, 0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-       },
-       {
-               "test7 ld_imm64",
-               .insns = {
-                       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
-                       BPF_RAW_INSN(0, 0, 0, 0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .retval = 1,
-       },
-       {
-               "test8 ld_imm64",
-               .insns = {
-                       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 1, 1),
-                       BPF_RAW_INSN(0, 0, 0, 0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "uses reserved fields",
-               .result = REJECT,
-       },
-       {
-               "test9 ld_imm64",
-               .insns = {
-                       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
-                       BPF_RAW_INSN(0, 0, 0, 1, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_ld_imm64 insn",
-               .result = REJECT,
-       },
-       {
-               "test10 ld_imm64",
-               .insns = {
-                       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
-                       BPF_RAW_INSN(0, BPF_REG_1, 0, 0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_ld_imm64 insn",
-               .result = REJECT,
-       },
-       {
-               "test11 ld_imm64",
-               .insns = {
-                       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
-                       BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_ld_imm64 insn",
-               .result = REJECT,
-       },
-       {
-               "test12 ld_imm64",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
-                       BPF_RAW_INSN(0, 0, 0, 0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "not pointing to valid bpf_map",
-               .result = REJECT,
-       },
-       {
-               "test13 ld_imm64",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
-                       BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_ld_imm64 insn",
-               .result = REJECT,
-       },
-       {
-               "arsh32 on imm",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_ALU32_IMM(BPF_ARSH, BPF_REG_0, 5),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .retval = 0,
-       },
-       {
-               "arsh32 on imm 2",
-               .insns = {
-                       BPF_LD_IMM64(BPF_REG_0, 0x1122334485667788),
-                       BPF_ALU32_IMM(BPF_ARSH, BPF_REG_0, 7),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .retval = -16069393,
-       },
-       {
-               "arsh32 on reg",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_MOV64_IMM(BPF_REG_1, 5),
-                       BPF_ALU32_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .retval = 0,
-       },
-       {
-               "arsh32 on reg 2",
-               .insns = {
-                       BPF_LD_IMM64(BPF_REG_0, 0xffff55667788),
-                       BPF_MOV64_IMM(BPF_REG_1, 15),
-                       BPF_ALU32_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .retval = 43724,
-       },
-       {
-               "arsh64 on imm",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_ALU64_IMM(BPF_ARSH, BPF_REG_0, 5),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-       },
-       {
-               "arsh64 on reg",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_MOV64_IMM(BPF_REG_1, 5),
-                       BPF_ALU64_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-       },
-       {
-               "no bpf_exit",
-               .insns = {
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_0, BPF_REG_2),
-               },
-               .errstr = "not an exit",
-               .result = REJECT,
-       },
-       {
-               "loop (back-edge)",
-               .insns = {
-                       BPF_JMP_IMM(BPF_JA, 0, 0, -1),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "back-edge",
-               .result = REJECT,
-       },
-       {
-               "loop2 (back-edge)",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, -4),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "back-edge",
-               .result = REJECT,
-       },
-       {
-               "conditional loop",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -3),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "back-edge",
-               .result = REJECT,
-       },
-       {
-               "read uninitialized register",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R2 !read_ok",
-               .result = REJECT,
-       },
-       {
-               "read invalid register",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_0, -1),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R15 is invalid",
-               .result = REJECT,
-       },
-       {
-               "program doesn't init R0 before exit",
-               .insns = {
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_1),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R0 !read_ok",
-               .result = REJECT,
-       },
-       {
-               "program doesn't init R0 before exit in all branches",
-               .insns = {
-                       BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R0 !read_ok",
-               .errstr_unpriv = "R1 pointer comparison",
-               .result = REJECT,
-       },
-       {
-               "stack out of bounds",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, 8, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid stack",
-               .result = REJECT,
-       },
-       {
-               "invalid call insn1",
-               .insns = {
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL | BPF_X, 0, 0, 0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "unknown opcode 8d",
-               .result = REJECT,
-       },
-       {
-               "invalid call insn2",
-               .insns = {
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 1, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "BPF_CALL uses reserved",
-               .result = REJECT,
-       },
-       {
-               "invalid function call",
-               .insns = {
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, 1234567),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid func unknown#1234567",
-               .result = REJECT,
-       },
-       {
-               "uninitialized stack1",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 2 },
-               .errstr = "invalid indirect read from stack",
-               .result = REJECT,
-       },
-       {
-               "uninitialized stack2",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -8),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid read from stack",
-               .result = REJECT,
-       },
-       {
-               "invalid fp arithmetic",
-               /* If this gets ever changed, make sure JITs can deal with it. */
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 8),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R1 subtraction from stack pointer",
-               .result = REJECT,
-       },
-       {
-               "non-invalid fp arithmetic",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-       },
-       {
-               "invalid argument register",
-               .insns = {
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_get_cgroup_classid),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_get_cgroup_classid),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R1 !read_ok",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "non-invalid argument register",
-               .insns = {
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_get_cgroup_classid),
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_1, BPF_REG_6),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_get_cgroup_classid),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "check valid spill/fill",
-               .insns = {
-                       /* spill R1(ctx) into stack */
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
-                       /* fill it back into R2 */
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
-                       /* should be able to access R0 = *(R2 + 8) */
-                       /* BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 8), */
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr_unpriv = "R0 leaks addr",
-               .result = ACCEPT,
-               .result_unpriv = REJECT,
-               .retval = POINTER_VALUE,
-       },
-       {
-               "check valid spill/fill, skb mark",
-               .insns = {
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
-                                   offsetof(struct __sk_buff, mark)),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .result_unpriv = ACCEPT,
-       },
-       {
-               "check corrupted spill/fill",
-               .insns = {
-                       /* spill R1(ctx) into stack */
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
-                       /* mess up with R1 pointer on stack */
-                       BPF_ST_MEM(BPF_B, BPF_REG_10, -7, 0x23),
-                       /* fill back into R0 is fine for priv.
-                        * R0 now becomes SCALAR_VALUE.
-                        */
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
-                       /* Load from R0 should fail. */
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 8),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr_unpriv = "attempt to corrupt spilled",
-               .errstr = "R0 invalid mem access 'inv",
-               .result = REJECT,
-       },
-       {
-               "check corrupted spill/fill, LSB",
-               .insns = {
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
-                       BPF_ST_MEM(BPF_H, BPF_REG_10, -8, 0xcafe),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr_unpriv = "attempt to corrupt spilled",
-               .result_unpriv = REJECT,
-               .result = ACCEPT,
-               .retval = POINTER_VALUE,
-       },
-       {
-               "check corrupted spill/fill, MSB",
-               .insns = {
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
-                       BPF_ST_MEM(BPF_W, BPF_REG_10, -4, 0x12345678),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr_unpriv = "attempt to corrupt spilled",
-               .result_unpriv = REJECT,
-               .result = ACCEPT,
-               .retval = POINTER_VALUE,
-       },
-       {
-               "invalid src register in STX",
-               .insns = {
-                       BPF_STX_MEM(BPF_B, BPF_REG_10, -1, -1),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R15 is invalid",
-               .result = REJECT,
-       },
-       {
-               "invalid dst register in STX",
-               .insns = {
-                       BPF_STX_MEM(BPF_B, 14, BPF_REG_10, -1),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R14 is invalid",
-               .result = REJECT,
-       },
-       {
-               "invalid dst register in ST",
-               .insns = {
-                       BPF_ST_MEM(BPF_B, 14, -1, -1),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R14 is invalid",
-               .result = REJECT,
-       },
-       {
-               "invalid src register in LDX",
-               .insns = {
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, 12, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R12 is invalid",
-               .result = REJECT,
-       },
-       {
-               "invalid dst register in LDX",
-               .insns = {
-                       BPF_LDX_MEM(BPF_B, 11, BPF_REG_1, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R11 is invalid",
-               .result = REJECT,
-       },
-       {
-               "junk insn",
-               .insns = {
-                       BPF_RAW_INSN(0, 0, 0, 0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "unknown opcode 00",
-               .result = REJECT,
-       },
-       {
-               "junk insn2",
-               .insns = {
-                       BPF_RAW_INSN(1, 0, 0, 0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "BPF_LDX uses reserved fields",
-               .result = REJECT,
-       },
-       {
-               "junk insn3",
-               .insns = {
-                       BPF_RAW_INSN(-1, 0, 0, 0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "unknown opcode ff",
-               .result = REJECT,
-       },
-       {
-               "junk insn4",
-               .insns = {
-                       BPF_RAW_INSN(-1, -1, -1, -1, -1),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "unknown opcode ff",
-               .result = REJECT,
-       },
-       {
-               "junk insn5",
-               .insns = {
-                       BPF_RAW_INSN(0x7f, -1, -1, -1, -1),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "BPF_ALU uses reserved fields",
-               .result = REJECT,
-       },
-       {
-               "misaligned read from stack",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -4),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "misaligned stack access",
-               .result = REJECT,
-       },
-       {
-               "invalid map_fd for function call",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_delete_elem),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "fd 0 is not pointing to valid bpf_map",
-               .result = REJECT,
-       },
-       {
-               "don't check return value before access",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr = "R0 invalid mem access 'map_value_or_null'",
-               .result = REJECT,
-       },
-       {
-               "access memory with incorrect alignment",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_0, 4, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr = "misaligned value access",
-               .result = REJECT,
-               .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
-       },
-       {
-               "sometimes access memory with incorrect alignment",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr = "R0 invalid mem access",
-               .errstr_unpriv = "R0 leaks addr",
-               .result = REJECT,
-               .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
-       },
-       {
-               "jump test 1",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -8),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 1),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 1),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 1),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 2),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 1),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 3),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 1),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 4),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 5),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr_unpriv = "R1 pointer comparison",
-               .result_unpriv = REJECT,
-               .result = ACCEPT,
-       },
-       {
-               "jump test 2",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, 14),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 2),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, 11),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 2),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, 8),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 2),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, 5),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 2),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, 2),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr_unpriv = "R1 pointer comparison",
-               .result_unpriv = REJECT,
-               .result = ACCEPT,
-       },
-       {
-               "jump test 3",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, 19),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 3),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, 15),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 3),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -32),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, 11),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 3),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -40),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, 7),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 3),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -48),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, 3),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 0),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -56),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_delete_elem),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 24 },
-               .errstr_unpriv = "R1 pointer comparison",
-               .result_unpriv = REJECT,
-               .result = ACCEPT,
-               .retval = -ENOENT,
-       },
-       {
-               "jump test 4",
-               .insns = {
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr_unpriv = "R1 pointer comparison",
-               .result_unpriv = REJECT,
-               .result = ACCEPT,
-       },
-       {
-               "jump test 5",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
-                       BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, 2),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, 2),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, 2),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, 2),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, 2),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr_unpriv = "R1 pointer comparison",
-               .result_unpriv = REJECT,
-               .result = ACCEPT,
-       },
-       {
-               "access skb fields ok",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, len)),
-                       BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, mark)),
-                       BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, pkt_type)),
-                       BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, queue_mapping)),
-                       BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, protocol)),
-                       BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, vlan_present)),
-                       BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, vlan_tci)),
-                       BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, napi_id)),
-                       BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-       },
-       {
-               "access skb fields bad1",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -4),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .result = REJECT,
-       },
-       {
-               "access skb fields bad2",
-               .insns = {
-                       BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 9),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
-                       BPF_EXIT_INSN(),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, pkt_type)),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 4 },
-               .errstr = "different pointers",
-               .errstr_unpriv = "R1 pointer comparison",
-               .result = REJECT,
-       },
-       {
-               "access skb fields bad3",
-               .insns = {
-                       BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, pkt_type)),
-                       BPF_EXIT_INSN(),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
-                       BPF_EXIT_INSN(),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, -12),
-               },
-               .fixup_map_hash_8b = { 6 },
-               .errstr = "different pointers",
-               .errstr_unpriv = "R1 pointer comparison",
-               .result = REJECT,
-       },
-       {
-               "access skb fields bad4",
-               .insns = {
-                       BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 3),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
-                                   offsetof(struct __sk_buff, len)),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
-                       BPF_EXIT_INSN(),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, -13),
-               },
-               .fixup_map_hash_8b = { 7 },
-               .errstr = "different pointers",
-               .errstr_unpriv = "R1 pointer comparison",
-               .result = REJECT,
-       },
-       {
-               "invalid access __sk_buff family",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, family)),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .result = REJECT,
-       },
-       {
-               "invalid access __sk_buff remote_ip4",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, remote_ip4)),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .result = REJECT,
-       },
-       {
-               "invalid access __sk_buff local_ip4",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, local_ip4)),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .result = REJECT,
-       },
-       {
-               "invalid access __sk_buff remote_ip6",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, remote_ip6)),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .result = REJECT,
-       },
-       {
-               "invalid access __sk_buff local_ip6",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, local_ip6)),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .result = REJECT,
-       },
-       {
-               "invalid access __sk_buff remote_port",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, remote_port)),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .result = REJECT,
-       },
-       {
-               "invalid access __sk_buff remote_port",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, local_port)),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .result = REJECT,
-       },
-       {
-               "valid access __sk_buff family",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, family)),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SK_SKB,
-       },
-       {
-               "valid access __sk_buff remote_ip4",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, remote_ip4)),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SK_SKB,
-       },
-       {
-               "valid access __sk_buff local_ip4",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, local_ip4)),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SK_SKB,
-       },
-       {
-               "valid access __sk_buff remote_ip6",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, remote_ip6[0])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, remote_ip6[1])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, remote_ip6[2])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, remote_ip6[3])),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SK_SKB,
-       },
-       {
-               "valid access __sk_buff local_ip6",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, local_ip6[0])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, local_ip6[1])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, local_ip6[2])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, local_ip6[3])),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SK_SKB,
-       },
-       {
-               "valid access __sk_buff remote_port",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, remote_port)),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SK_SKB,
-       },
-       {
-               "valid access __sk_buff remote_port",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, local_port)),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SK_SKB,
-       },
-       {
-               "invalid access of tc_classid for SK_SKB",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, tc_classid)),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_SK_SKB,
-               .errstr = "invalid bpf_context access",
-       },
-       {
-               "invalid access of skb->mark for SK_SKB",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, mark)),
-                       BPF_EXIT_INSN(),
-               },
-               .result =  REJECT,
-               .prog_type = BPF_PROG_TYPE_SK_SKB,
-               .errstr = "invalid bpf_context access",
-       },
-       {
-               "check skb->mark is not writeable by SK_SKB",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, mark)),
-                       BPF_EXIT_INSN(),
-               },
-               .result =  REJECT,
-               .prog_type = BPF_PROG_TYPE_SK_SKB,
-               .errstr = "invalid bpf_context access",
-       },
-       {
-               "check skb->tc_index is writeable by SK_SKB",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, tc_index)),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SK_SKB,
-       },
-       {
-               "check skb->priority is writeable by SK_SKB",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, priority)),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SK_SKB,
-       },
-       {
-               "direct packet read for SK_SKB",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SK_SKB,
-       },
-       {
-               "direct packet write for SK_SKB",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
-                       BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SK_SKB,
-       },
-       {
-               "overlapping checks for direct packet access SK_SKB",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SK_SKB,
-       },
-       {
-               "valid access family in SK_MSG",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct sk_msg_md, family)),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SK_MSG,
-       },
-       {
-               "valid access remote_ip4 in SK_MSG",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct sk_msg_md, remote_ip4)),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SK_MSG,
-       },
-       {
-               "valid access local_ip4 in SK_MSG",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct sk_msg_md, local_ip4)),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SK_MSG,
-       },
-       {
-               "valid access remote_port in SK_MSG",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct sk_msg_md, remote_port)),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SK_MSG,
-       },
-       {
-               "valid access local_port in SK_MSG",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct sk_msg_md, local_port)),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SK_MSG,
-       },
-       {
-               "valid access remote_ip6 in SK_MSG",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct sk_msg_md, remote_ip6[0])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct sk_msg_md, remote_ip6[1])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct sk_msg_md, remote_ip6[2])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct sk_msg_md, remote_ip6[3])),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SK_SKB,
-       },
-       {
-               "valid access local_ip6 in SK_MSG",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct sk_msg_md, local_ip6[0])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct sk_msg_md, local_ip6[1])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct sk_msg_md, local_ip6[2])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct sk_msg_md, local_ip6[3])),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SK_SKB,
-       },
-       {
-               "valid access size in SK_MSG",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct sk_msg_md, size)),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SK_MSG,
-       },
-       {
-               "invalid 64B read of size in SK_MSG",
-               .insns = {
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct sk_msg_md, size)),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_SK_MSG,
-       },
-       {
-               "invalid read past end of SK_MSG",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct sk_msg_md, size) + 4),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_SK_MSG,
-       },
-       {
-               "invalid read offset in SK_MSG",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct sk_msg_md, family) + 1),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_SK_MSG,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "direct packet read for SK_MSG",
-               .insns = {
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct sk_msg_md, data)),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct sk_msg_md, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SK_MSG,
-       },
-       {
-               "direct packet write for SK_MSG",
-               .insns = {
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct sk_msg_md, data)),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct sk_msg_md, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
-                       BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SK_MSG,
-       },
-       {
-               "overlapping checks for direct packet access SK_MSG",
-               .insns = {
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct sk_msg_md, data)),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct sk_msg_md, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SK_MSG,
-       },
-       {
-               "check skb->mark is not writeable by sockets",
-               .insns = {
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
-                                   offsetof(struct __sk_buff, mark)),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .errstr_unpriv = "R1 leaks addr",
-               .result = REJECT,
-       },
-       {
-               "check skb->tc_index is not writeable by sockets",
-               .insns = {
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
-                                   offsetof(struct __sk_buff, tc_index)),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .errstr_unpriv = "R1 leaks addr",
-               .result = REJECT,
-       },
-       {
-               "check cb access: byte",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[0])),
-                       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[0]) + 1),
-                       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[0]) + 2),
-                       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[0]) + 3),
-                       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[1])),
-                       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[1]) + 1),
-                       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[1]) + 2),
-                       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[1]) + 3),
-                       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[2])),
-                       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[2]) + 1),
-                       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[2]) + 2),
-                       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[2]) + 3),
-                       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[3])),
-                       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[3]) + 1),
-                       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[3]) + 2),
-                       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[3]) + 3),
-                       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[4])),
-                       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[4]) + 1),
-                       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[4]) + 2),
-                       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[4]) + 3),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[0])),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[0]) + 1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[0]) + 2),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[0]) + 3),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[1])),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[1]) + 1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[1]) + 2),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[1]) + 3),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[2])),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[2]) + 1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[2]) + 2),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[2]) + 3),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[3])),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[3]) + 1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[3]) + 2),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[3]) + 3),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[4])),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[4]) + 1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[4]) + 2),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[4]) + 3),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-       },
-       {
-               "__sk_buff->hash, offset 0, byte store not permitted",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, hash)),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .result = REJECT,
-       },
-       {
-               "__sk_buff->tc_index, offset 3, byte store not permitted",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, tc_index) + 3),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .result = REJECT,
-       },
-       {
-               "check skb->hash byte load permitted",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-#if __BYTE_ORDER == __LITTLE_ENDIAN
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, hash)),
-#else
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, hash) + 3),
-#endif
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-       },
-       {
-               "check skb->hash byte load permitted 1",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, hash) + 1),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-       },
-       {
-               "check skb->hash byte load permitted 2",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, hash) + 2),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-       },
-       {
-               "check skb->hash byte load permitted 3",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-#if __BYTE_ORDER == __LITTLE_ENDIAN
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, hash) + 3),
-#else
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, hash)),
-#endif
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-       },
-       {
-               "check cb access: byte, wrong type",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[0])),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
-       },
-       {
-               "check cb access: half",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[0])),
-                       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[0]) + 2),
-                       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[1])),
-                       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[1]) + 2),
-                       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[2])),
-                       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[2]) + 2),
-                       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[3])),
-                       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[3]) + 2),
-                       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[4])),
-                       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[4]) + 2),
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[0])),
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[0]) + 2),
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[1])),
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[1]) + 2),
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[2])),
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[2]) + 2),
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[3])),
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[3]) + 2),
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[4])),
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[4]) + 2),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-       },
-       {
-               "check cb access: half, unaligned",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[0]) + 1),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "misaligned context access",
-               .result = REJECT,
-               .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
-       },
-       {
-               "check __sk_buff->hash, offset 0, half store not permitted",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, hash)),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .result = REJECT,
-       },
-       {
-               "check __sk_buff->tc_index, offset 2, half store not permitted",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, tc_index) + 2),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .result = REJECT,
-       },
-       {
-               "check skb->hash half load permitted",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-#if __BYTE_ORDER == __LITTLE_ENDIAN
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, hash)),
-#else
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, hash) + 2),
-#endif
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-       },
-       {
-               "check skb->hash half load permitted 2",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-#if __BYTE_ORDER == __LITTLE_ENDIAN
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, hash) + 2),
-#else
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, hash)),
-#endif
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-       },
-       {
-               "check skb->hash half load not permitted, unaligned 1",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-#if __BYTE_ORDER == __LITTLE_ENDIAN
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, hash) + 1),
-#else
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, hash) + 3),
-#endif
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .result = REJECT,
-       },
-       {
-               "check skb->hash half load not permitted, unaligned 3",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-#if __BYTE_ORDER == __LITTLE_ENDIAN
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, hash) + 3),
-#else
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, hash) + 1),
-#endif
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .result = REJECT,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "check cb access: half, wrong type",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[0])),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
-       },
-       {
-               "check cb access: word",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[0])),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[1])),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[2])),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[3])),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[4])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[0])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[1])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[2])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[3])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[4])),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-       },
-       {
-               "check cb access: word, unaligned 1",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[0]) + 2),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "misaligned context access",
-               .result = REJECT,
-               .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
-       },
-       {
-               "check cb access: word, unaligned 2",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[4]) + 1),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "misaligned context access",
-               .result = REJECT,
-               .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
-       },
-       {
-               "check cb access: word, unaligned 3",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[4]) + 2),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "misaligned context access",
-               .result = REJECT,
-               .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
-       },
-       {
-               "check cb access: word, unaligned 4",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[4]) + 3),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "misaligned context access",
-               .result = REJECT,
-               .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
-       },
-       {
-               "check cb access: double",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[0])),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[2])),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[0])),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[2])),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-       },
-       {
-               "check cb access: double, unaligned 1",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[1])),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "misaligned context access",
-               .result = REJECT,
-               .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
-       },
-       {
-               "check cb access: double, unaligned 2",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[3])),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "misaligned context access",
-               .result = REJECT,
-               .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
-       },
-       {
-               "check cb access: double, oob 1",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[4])),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .result = REJECT,
-       },
-       {
-               "check cb access: double, oob 2",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[4])),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .result = REJECT,
-       },
-       {
-               "check __sk_buff->ifindex dw store not permitted",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, ifindex)),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .result = REJECT,
-       },
-       {
-               "check __sk_buff->ifindex dw load not permitted",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, ifindex)),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .result = REJECT,
-       },
-       {
-               "check cb access: double, wrong type",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[0])),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
-       },
-       {
-               "check out of range skb->cb access",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[0]) + 256),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access",
-               .errstr_unpriv = "",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_SCHED_ACT,
-       },
-       {
-               "write skb fields from socket prog",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[4])),
-                       BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, mark)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, tc_index)),
-                       BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[0])),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[2])),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .errstr_unpriv = "R1 leaks addr",
-               .result_unpriv = REJECT,
-       },
-       {
-               "write skb fields from tc_cls_act prog",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[0])),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, mark)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, tc_index)),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, tc_index)),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[3])),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, tstamp)),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, tstamp)),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr_unpriv = "",
-               .result_unpriv = REJECT,
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "PTR_TO_STACK store/load",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .retval = 0xfaceb00c,
-       },
-       {
-               "PTR_TO_STACK store/load - bad alignment on off",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "misaligned stack access off (0x0; 0x0)+-8+2 size 8",
-       },
-       {
-               "PTR_TO_STACK store/load - bad alignment on reg",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "misaligned stack access off (0x0; 0x0)+-10+8 size 8",
-       },
-       {
-               "PTR_TO_STACK store/load - out of bounds low",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -80000),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "invalid stack off=-79992 size=8",
-               .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
-       },
-       {
-               "PTR_TO_STACK store/load - out of bounds high",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "invalid stack off=0 size=8",
-       },
-       {
-               "unpriv: return pointer",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .result_unpriv = REJECT,
-               .errstr_unpriv = "R0 leaks addr",
-               .retval = POINTER_VALUE,
-       },
-       {
-               "unpriv: add const to pointer",
-               .insns = {
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-       },
-       {
-               "unpriv: add pointer to pointer",
-               .insns = {
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "R1 pointer += pointer",
-       },
-       {
-               "unpriv: neg pointer",
-               .insns = {
-                       BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .result_unpriv = REJECT,
-               .errstr_unpriv = "R1 pointer arithmetic",
-       },
-       {
-               "unpriv: cmp pointer with const",
-               .insns = {
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .result_unpriv = REJECT,
-               .errstr_unpriv = "R1 pointer comparison",
-       },
-       {
-               "unpriv: cmp pointer with pointer",
-               .insns = {
-                       BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .result_unpriv = REJECT,
-               .errstr_unpriv = "R10 pointer comparison",
-       },
-       {
-               "unpriv: check that printk is disallowed",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
-                       BPF_MOV64_IMM(BPF_REG_2, 8),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_trace_printk),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr_unpriv = "unknown func bpf_trace_printk#6",
-               .result_unpriv = REJECT,
-               .result = ACCEPT,
-       },
-       {
-               "unpriv: pass pointer to helper function",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
-                       BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_update_elem),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr_unpriv = "R4 leaks addr",
-               .result_unpriv = REJECT,
-               .result = ACCEPT,
-       },
-       {
-               "unpriv: indirectly pass pointer on stack to helper function",
-               .insns = {
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr = "invalid indirect read from stack off -8+0 size 8",
-               .result = REJECT,
-       },
-       {
-               "unpriv: mangle pointer on stack 1",
-               .insns = {
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
-                       BPF_ST_MEM(BPF_W, BPF_REG_10, -8, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr_unpriv = "attempt to corrupt spilled",
-               .result_unpriv = REJECT,
-               .result = ACCEPT,
-       },
-       {
-               "unpriv: mangle pointer on stack 2",
-               .insns = {
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
-                       BPF_ST_MEM(BPF_B, BPF_REG_10, -1, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr_unpriv = "attempt to corrupt spilled",
-               .result_unpriv = REJECT,
-               .result = ACCEPT,
-       },
-       {
-               "unpriv: read pointer from stack in small chunks",
-               .insns = {
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -8),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid size",
-               .result = REJECT,
-       },
-       {
-               "unpriv: write pointer into ctx",
-               .insns = {
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr_unpriv = "R1 leaks addr",
-               .result_unpriv = REJECT,
-               .errstr = "invalid bpf_context access",
-               .result = REJECT,
-       },
-       {
-               "unpriv: spill/fill of ctx",
-               .insns = {
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-       },
-       {
-               "unpriv: spill/fill of ctx 2",
-               .insns = {
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_get_hash_recalc),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "unpriv: spill/fill of ctx 3",
-               .insns = {
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_get_hash_recalc),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "R1 type=fp expected=ctx",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "unpriv: spill/fill of ctx 4",
-               .insns = {
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_10,
-                                    BPF_REG_0, -8, 0),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_get_hash_recalc),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "R1 type=inv expected=ctx",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "unpriv: spill/fill of different pointers stx",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_3, 42),
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
-                                   offsetof(struct __sk_buff, mark)),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "same insn cannot be used with different pointers",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "unpriv: spill/fill of different pointers stx - ctx and sock",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
-                       /* struct bpf_sock *sock = bpf_sock_lookup(...); */
-                       BPF_SK_LOOKUP,
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
-                       /* u64 foo; */
-                       /* void *target = &foo; */
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
-                       /* if (skb == NULL) *target = sock; */
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
-                               BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
-                       /* else *target = skb; */
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
-                               BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
-                       /* struct __sk_buff *skb = *target; */
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
-                       /* skb->mark = 42; */
-                       BPF_MOV64_IMM(BPF_REG_3, 42),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
-                                   offsetof(struct __sk_buff, mark)),
-                       /* if (sk) bpf_sk_release(sk) */
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
-                               BPF_EMIT_CALL(BPF_FUNC_sk_release),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "type=ctx expected=sock",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "unpriv: spill/fill of different pointers stx - leak sock",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
-                       /* struct bpf_sock *sock = bpf_sock_lookup(...); */
-                       BPF_SK_LOOKUP,
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
-                       /* u64 foo; */
-                       /* void *target = &foo; */
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
-                       /* if (skb == NULL) *target = sock; */
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
-                               BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
-                       /* else *target = skb; */
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
-                               BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
-                       /* struct __sk_buff *skb = *target; */
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
-                       /* skb->mark = 42; */
-                       BPF_MOV64_IMM(BPF_REG_3, 42),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
-                                   offsetof(struct __sk_buff, mark)),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               //.errstr = "same insn cannot be used with different pointers",
-               .errstr = "Unreleased reference",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "unpriv: spill/fill of different pointers stx - sock and ctx (read)",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
-                       /* struct bpf_sock *sock = bpf_sock_lookup(...); */
-                       BPF_SK_LOOKUP,
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
-                       /* u64 foo; */
-                       /* void *target = &foo; */
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
-                       /* if (skb) *target = skb */
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
-                               BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
-                       /* else *target = sock */
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
-                               BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
-                       /* struct bpf_sock *sk = *target; */
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
-                       /* if (sk) u32 foo = sk->mark; bpf_sk_release(sk); */
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
-                               BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                           offsetof(struct bpf_sock, mark)),
-                               BPF_EMIT_CALL(BPF_FUNC_sk_release),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "same insn cannot be used with different pointers",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "unpriv: spill/fill of different pointers stx - sock and ctx (write)",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
-                       /* struct bpf_sock *sock = bpf_sock_lookup(...); */
-                       BPF_SK_LOOKUP,
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
-                       /* u64 foo; */
-                       /* void *target = &foo; */
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
-                       /* if (skb) *target = skb */
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
-                               BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
-                       /* else *target = sock */
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
-                               BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
-                       /* struct bpf_sock *sk = *target; */
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
-                       /* if (sk) sk->mark = 42; bpf_sk_release(sk); */
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
-                               BPF_MOV64_IMM(BPF_REG_3, 42),
-                               BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
-                                           offsetof(struct bpf_sock, mark)),
-                               BPF_EMIT_CALL(BPF_FUNC_sk_release),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               //.errstr = "same insn cannot be used with different pointers",
-               .errstr = "cannot write into socket",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "unpriv: spill/fill of different pointers ldx",
-               .insns = {
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
-                                     -(__s32)offsetof(struct bpf_perf_event_data,
-                                                      sample_period) - 8),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1,
-                                   offsetof(struct bpf_perf_event_data,
-                                            sample_period)),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "same insn cannot be used with different pointers",
-               .prog_type = BPF_PROG_TYPE_PERF_EVENT,
-       },
-       {
-               "unpriv: write pointer into map elem value",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr_unpriv = "R0 leaks addr",
-               .result_unpriv = REJECT,
-               .result = ACCEPT,
-       },
-       {
-               "alu32: mov u32 const",
-               .insns = {
-                       BPF_MOV32_IMM(BPF_REG_7, 0),
-                       BPF_ALU32_IMM(BPF_AND, BPF_REG_7, 1),
-                       BPF_MOV32_REG(BPF_REG_0, BPF_REG_7),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .retval = 0,
-       },
-       {
-               "unpriv: partial copy of pointer",
-               .insns = {
-                       BPF_MOV32_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr_unpriv = "R10 partial copy",
-               .result_unpriv = REJECT,
-               .result = ACCEPT,
-       },
-       {
-               "unpriv: pass pointer to tail_call",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
-                       BPF_LD_MAP_FD(BPF_REG_2, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_tail_call),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_prog1 = { 1 },
-               .errstr_unpriv = "R3 leaks addr into helper",
-               .result_unpriv = REJECT,
-               .result = ACCEPT,
-       },
-       {
-               "unpriv: cmp map pointer with zero",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_1, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 1 },
-               .errstr_unpriv = "R1 pointer comparison",
-               .result_unpriv = REJECT,
-               .result = ACCEPT,
-       },
-       {
-               "unpriv: write into frame pointer",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_10, BPF_REG_1),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "frame pointer is read only",
-               .result = REJECT,
-       },
-       {
-               "unpriv: spill/fill frame pointer",
-               .insns = {
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "frame pointer is read only",
-               .result = REJECT,
-       },
-       {
-               "unpriv: cmp of frame pointer",
-               .insns = {
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_10, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr_unpriv = "R10 pointer comparison",
-               .result_unpriv = REJECT,
-               .result = ACCEPT,
-       },
-       {
-               "unpriv: adding of fp",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_1, 0),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, -8),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
-               .result_unpriv = REJECT,
-               .result = ACCEPT,
-       },
-       {
-               "unpriv: cmp of stack pointer",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_2, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr_unpriv = "R2 pointer comparison",
-               .result_unpriv = REJECT,
-               .result = ACCEPT,
-       },
-       {
-               "runtime/jit: tail_call within bounds, prog once",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_LD_MAP_FD(BPF_REG_2, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_tail_call),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_prog1 = { 1 },
-               .result = ACCEPT,
-               .retval = 42,
-       },
-       {
-               "runtime/jit: tail_call within bounds, prog loop",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_3, 1),
-                       BPF_LD_MAP_FD(BPF_REG_2, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_tail_call),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_prog1 = { 1 },
-               .result = ACCEPT,
-               .retval = 41,
-       },
-       {
-               "runtime/jit: tail_call within bounds, no prog",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_3, 2),
-                       BPF_LD_MAP_FD(BPF_REG_2, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_tail_call),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_prog1 = { 1 },
-               .result = ACCEPT,
-               .retval = 1,
-       },
-       {
-               "runtime/jit: tail_call out of bounds",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_3, 256),
-                       BPF_LD_MAP_FD(BPF_REG_2, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_tail_call),
-                       BPF_MOV64_IMM(BPF_REG_0, 2),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_prog1 = { 1 },
-               .result = ACCEPT,
-               .retval = 2,
-       },
-       {
-               "runtime/jit: pass negative index to tail_call",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_3, -1),
-                       BPF_LD_MAP_FD(BPF_REG_2, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_tail_call),
-                       BPF_MOV64_IMM(BPF_REG_0, 2),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_prog1 = { 1 },
-               .result = ACCEPT,
-               .retval = 2,
-       },
-       {
-               "runtime/jit: pass > 32bit index to tail_call",
-               .insns = {
-                       BPF_LD_IMM64(BPF_REG_3, 0x100000000ULL),
-                       BPF_LD_MAP_FD(BPF_REG_2, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_tail_call),
-                       BPF_MOV64_IMM(BPF_REG_0, 2),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_prog1 = { 2 },
-               .result = ACCEPT,
-               .retval = 42,
-               /* Verifier rewrite for unpriv skips tail call here. */
-               .retval_unpriv = 2,
-       },
-       {
-               "PTR_TO_STACK check high 1",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -1),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .retval = 42,
-       },
-       {
-               "PTR_TO_STACK check high 2",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, -1, 42),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, -1),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .retval = 42,
-       },
-       {
-               "PTR_TO_STACK check high 3",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, -1, 42),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, -1),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
-               .result_unpriv = REJECT,
-               .result = ACCEPT,
-               .retval = 42,
-       },
-       {
-               "PTR_TO_STACK check high 4",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
-               .errstr = "invalid stack off=0 size=1",
-               .result = REJECT,
-       },
-       {
-               "PTR_TO_STACK check high 5",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, (1 << 29) - 1),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "invalid stack off",
-       },
-       {
-               "PTR_TO_STACK check high 6",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, (1 << 29) - 1),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, SHRT_MAX, 42),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, SHRT_MAX),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "invalid stack off",
-       },
-       {
-               "PTR_TO_STACK check high 7",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, (1 << 29) - 1),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, (1 << 29) - 1),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, SHRT_MAX, 42),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, SHRT_MAX),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
-               .errstr = "fp pointer offset",
-       },
-       {
-               "PTR_TO_STACK check low 1",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -512),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .retval = 42,
-       },
-       {
-               "PTR_TO_STACK check low 2",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -513),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, 1, 42),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .result_unpriv = REJECT,
-               .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
-               .result = ACCEPT,
-               .retval = 42,
-       },
-       {
-               "PTR_TO_STACK check low 3",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -513),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
-               .errstr = "invalid stack off=-513 size=1",
-               .result = REJECT,
-       },
-       {
-               "PTR_TO_STACK check low 4",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, INT_MIN),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "math between fp pointer",
-       },
-       {
-               "PTR_TO_STACK check low 5",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -((1 << 29) - 1)),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "invalid stack off",
-       },
-       {
-               "PTR_TO_STACK check low 6",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -((1 << 29) - 1)),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, SHRT_MIN, 42),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, SHRT_MIN),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "invalid stack off",
-       },
-       {
-               "PTR_TO_STACK check low 7",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -((1 << 29) - 1)),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -((1 << 29) - 1)),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, SHRT_MIN, 42),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, SHRT_MIN),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
-               .errstr = "fp pointer offset",
-       },
-       {
-               "PTR_TO_STACK mixed reg/k, 1",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -3),
-                       BPF_MOV64_IMM(BPF_REG_2, -3),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .retval = 42,
-       },
-       {
-               "PTR_TO_STACK mixed reg/k, 2",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, 0),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -3),
-                       BPF_MOV64_IMM(BPF_REG_2, -3),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
-                       BPF_MOV64_REG(BPF_REG_5, BPF_REG_10),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_5, -6),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .retval = 42,
-       },
-       {
-               "PTR_TO_STACK mixed reg/k, 3",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -3),
-                       BPF_MOV64_IMM(BPF_REG_2, -3),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .retval = -3,
-       },
-       {
-               "PTR_TO_STACK reg",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_MOV64_IMM(BPF_REG_2, -3),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result_unpriv = REJECT,
-               .errstr_unpriv = "invalid stack off=0 size=1",
-               .result = ACCEPT,
-               .retval = 42,
-       },
-       {
-               "stack pointer arithmetic",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_1, 4),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, 0),
-                       BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_1),
-                       BPF_ST_MEM(0, BPF_REG_2, 4, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
-                       BPF_ST_MEM(0, BPF_REG_2, 4, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-       },
-       {
-               "raw_stack: no skb_load_bytes",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 4),
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
-                       BPF_MOV64_IMM(BPF_REG_4, 8),
-                       /* Call to skb_load_bytes() omitted. */
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "invalid read from stack off -8+0 size 8",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "raw_stack: skb_load_bytes, negative len",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 4),
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
-                       BPF_MOV64_IMM(BPF_REG_4, -8),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_skb_load_bytes),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "R4 min value is negative",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "raw_stack: skb_load_bytes, negative len 2",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 4),
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
-                       BPF_MOV64_IMM(BPF_REG_4, ~0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_skb_load_bytes),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "R4 min value is negative",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "raw_stack: skb_load_bytes, zero len",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 4),
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_skb_load_bytes),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "invalid stack type R3",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "raw_stack: skb_load_bytes, no init",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 4),
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
-                       BPF_MOV64_IMM(BPF_REG_4, 8),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_skb_load_bytes),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "raw_stack: skb_load_bytes, init",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 4),
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_6, 0, 0xcafe),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
-                       BPF_MOV64_IMM(BPF_REG_4, 8),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_skb_load_bytes),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "raw_stack: skb_load_bytes, spilled regs around bounds",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 4),
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
-                       BPF_MOV64_IMM(BPF_REG_4, 8),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_skb_load_bytes),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
-                                   offsetof(struct __sk_buff, mark)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
-                                   offsetof(struct __sk_buff, priority)),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "raw_stack: skb_load_bytes, spilled regs corruption",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 4),
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
-                       BPF_MOV64_IMM(BPF_REG_4, 8),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_skb_load_bytes),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
-                                   offsetof(struct __sk_buff, mark)),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "R0 invalid mem access 'inv'",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "raw_stack: skb_load_bytes, spilled regs corruption 2",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 4),
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  0),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
-                       BPF_MOV64_IMM(BPF_REG_4, 8),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_skb_load_bytes),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6,  0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
-                                   offsetof(struct __sk_buff, mark)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
-                                   offsetof(struct __sk_buff, priority)),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_3,
-                                   offsetof(struct __sk_buff, pkt_type)),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "R3 invalid mem access 'inv'",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "raw_stack: skb_load_bytes, spilled regs + data",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 4),
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  0),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
-                       BPF_MOV64_IMM(BPF_REG_4, 8),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_skb_load_bytes),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6,  0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
-                                   offsetof(struct __sk_buff, mark)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
-                                   offsetof(struct __sk_buff, priority)),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "raw_stack: skb_load_bytes, invalid access 1",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 4),
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -513),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
-                       BPF_MOV64_IMM(BPF_REG_4, 8),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_skb_load_bytes),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "invalid stack type R3 off=-513 access_size=8",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "raw_stack: skb_load_bytes, invalid access 2",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 4),
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
-                       BPF_MOV64_IMM(BPF_REG_4, 8),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_skb_load_bytes),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "invalid stack type R3 off=-1 access_size=8",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "raw_stack: skb_load_bytes, invalid access 3",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 4),
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 0xffffffff),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
-                       BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_skb_load_bytes),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "R4 min value is negative",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "raw_stack: skb_load_bytes, invalid access 4",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 4),
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
-                       BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_skb_load_bytes),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "R4 unbounded memory access, use 'var &= const' or 'if (var < const)'",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "raw_stack: skb_load_bytes, invalid access 5",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 4),
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
-                       BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_skb_load_bytes),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "R4 unbounded memory access, use 'var &= const' or 'if (var < const)'",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "raw_stack: skb_load_bytes, invalid access 6",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 4),
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_skb_load_bytes),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "invalid stack type R3 off=-512 access_size=0",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "raw_stack: skb_load_bytes, large access",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 4),
-                       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
-                       BPF_MOV64_IMM(BPF_REG_4, 512),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_skb_load_bytes),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "context stores via ST",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_1, offsetof(struct __sk_buff, mark), 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "BPF_ST stores into R1 ctx is not allowed",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "context stores via XADD",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_W, BPF_REG_1,
-                                    BPF_REG_0, offsetof(struct __sk_buff, mark), 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "BPF_XADD stores into R1 ctx is not allowed",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "direct packet access: test1",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "direct packet access: test2",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 14),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_4, 15),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 7),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_3, 12),
-                       BPF_ALU64_IMM(BPF_MUL, BPF_REG_4, 14),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_4),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, len)),
-                       BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 49),
-                       BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 49),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_2),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_3),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_3, 4),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "direct packet access: test3",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid bpf_context access off=76",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
-       },
-       {
-               "direct packet access: test4 (write)",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
-                       BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "direct packet access: test5 (pkt_end >= reg, good access)",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "direct packet access: test6 (pkt_end >= reg, bad access)",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid access to packet",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "direct packet access: test7 (pkt_end >= reg, both accesses)",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid access to packet",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "direct packet access: test8 (double test, variant 1)",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 4),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "direct packet access: test9 (double test, variant 2)",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "direct packet access: test10 (write invalid)",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid access to packet",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "direct packet access: test11 (shift, good access)",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
-                       BPF_MOV64_IMM(BPF_REG_3, 144),
-                       BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
-                       BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 3),
-                       BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .retval = 1,
-       },
-       {
-               "direct packet access: test12 (and, good access)",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
-                       BPF_MOV64_IMM(BPF_REG_3, 144),
-                       BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
-                       BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .retval = 1,
-       },
-       {
-               "direct packet access: test13 (branches, good access)",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 13),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, mark)),
-                       BPF_MOV64_IMM(BPF_REG_4, 1),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_4, 2),
-                       BPF_MOV64_IMM(BPF_REG_3, 14),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, 1),
-                       BPF_MOV64_IMM(BPF_REG_3, 24),
-                       BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
-                       BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .retval = 1,
-       },
-       {
-               "direct packet access: test14 (pkt_ptr += 0, CONST_IMM, good access)",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),
-                       BPF_MOV64_IMM(BPF_REG_5, 12),
-                       BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 4),
-                       BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .retval = 1,
-       },
-       {
-               "direct packet access: test15 (spill with xadd)",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
-                       BPF_MOV64_IMM(BPF_REG_5, 4096),
-                       BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
-                       BPF_STX_XADD(BPF_DW, BPF_REG_4, BPF_REG_5, 0),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
-                       BPF_STX_MEM(BPF_W, BPF_REG_2, BPF_REG_5, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R2 invalid mem access 'inv'",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "direct packet access: test16 (arith on data_end)",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 16),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
-                       BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R3 pointer arithmetic on pkt_end",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "direct packet access: test17 (pruning, alignment)",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
-                                   offsetof(struct __sk_buff, mark)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 14),
-                       BPF_JMP_IMM(BPF_JGT, BPF_REG_7, 1, 4),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
-                       BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, -4),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
-                       BPF_JMP_A(-6),
-               },
-               .errstr = "misaligned packet access off 2+(0x0; 0x0)+15+-4 size 4",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
-       },
-       {
-               "direct packet access: test18 (imm += pkt_ptr, 1)",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_IMM(BPF_REG_0, 8),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
-                       BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "direct packet access: test19 (imm += pkt_ptr, 2)",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
-                       BPF_MOV64_IMM(BPF_REG_4, 4),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
-                       BPF_STX_MEM(BPF_B, BPF_REG_4, BPF_REG_4, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "direct packet access: test20 (x += pkt_ptr, 1)",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0x7fff),
-                       BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
-                       BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0x7fff - 1),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .result = ACCEPT,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "direct packet access: test21 (x += pkt_ptr, 2)",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 9),
-                       BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_4, 0x7fff),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
-                       BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0x7fff - 1),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .result = ACCEPT,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "direct packet access: test22 (x += pkt_ptr, 3)",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -8),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_3, -16),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_10, -16),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 11),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
-                       BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
-                       BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_4, -8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
-                       BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 49),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
-                       BPF_MOV64_IMM(BPF_REG_2, 1),
-                       BPF_STX_MEM(BPF_H, BPF_REG_4, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .result = ACCEPT,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "direct packet access: test23 (x += pkt_ptr, 4)",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xffff),
-                       BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
-                       BPF_MOV64_IMM(BPF_REG_0, 31),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_4),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
-                       BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0xffff - 1),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .result = REJECT,
-               .errstr = "invalid access to packet, off=0 size=8, R5(id=1,off=0,r=0)",
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "direct packet access: test24 (x += pkt_ptr, 5)",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xff),
-                       BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
-                       BPF_MOV64_IMM(BPF_REG_0, 64),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_4),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
-                       BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x7fff - 1),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .result = ACCEPT,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "direct packet access: test25 (marking on <, good access)",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JLT, BPF_REG_0, BPF_REG_3, 2),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, -4),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "direct packet access: test26 (marking on <, bad access)",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JLT, BPF_REG_0, BPF_REG_3, 3),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, -3),
-               },
-               .result = REJECT,
-               .errstr = "invalid access to packet",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "direct packet access: test27 (marking on <=, good access)",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_0, 1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .retval = 1,
-       },
-       {
-               "direct packet access: test28 (marking on <=, bad access)",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_0, 2),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, -4),
-               },
-               .result = REJECT,
-               .errstr = "invalid access to packet",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "helper access to packet: test1, valid packet_ptr range",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct xdp_md, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct xdp_md, data_end)),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_update_elem),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 5 },
-               .result_unpriv = ACCEPT,
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_XDP,
-       },
-       {
-               "helper access to packet: test2, unchecked packet_ptr",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct xdp_md, data)),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 1 },
-               .result = REJECT,
-               .errstr = "invalid access to packet",
-               .prog_type = BPF_PROG_TYPE_XDP,
-       },
-       {
-               "helper access to packet: test3, variable add",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                       offsetof(struct xdp_md, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                       offsetof(struct xdp_md, data_end)),
-                       BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
-                       BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
-                       BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 11 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_XDP,
-       },
-       {
-               "helper access to packet: test4, packet_ptr with bad range",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct xdp_md, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct xdp_md, data_end)),
-                       BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 7 },
-               .result = REJECT,
-               .errstr = "invalid access to packet",
-               .prog_type = BPF_PROG_TYPE_XDP,
-       },
-       {
-               "helper access to packet: test5, packet_ptr with too short range",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct xdp_md, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct xdp_md, data_end)),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
-                       BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 6 },
-               .result = REJECT,
-               .errstr = "invalid access to packet",
-               .prog_type = BPF_PROG_TYPE_XDP,
-       },
-       {
-               "helper access to packet: test6, cls valid packet_ptr range",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_update_elem),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 5 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "helper access to packet: test7, cls unchecked packet_ptr",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 1 },
-               .result = REJECT,
-               .errstr = "invalid access to packet",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "helper access to packet: test8, cls variable add",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                       offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                       offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
-                       BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
-                       BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 11 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "helper access to packet: test9, cls packet_ptr with bad range",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 7 },
-               .result = REJECT,
-               .errstr = "invalid access to packet",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "helper access to packet: test10, cls packet_ptr with too short range",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
-                       BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 6 },
-               .result = REJECT,
-               .errstr = "invalid access to packet",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "helper access to packet: test11, cls unsuitable helper 1",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 7),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_7, 4),
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_4, 42),
-                       BPF_MOV64_IMM(BPF_REG_5, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_skb_store_bytes),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "helper access to the packet",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "helper access to packet: test12, cls unsuitable helper 2",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_7, 3),
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_4, 4),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_skb_load_bytes),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "helper access to the packet",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "helper access to packet: test13, cls helper ok",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
-                       BPF_MOV64_IMM(BPF_REG_2, 4),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_MOV64_IMM(BPF_REG_5, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_csum_diff),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "helper access to packet: test14, cls helper ok sub",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
-                       BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 4),
-                       BPF_MOV64_IMM(BPF_REG_2, 4),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_MOV64_IMM(BPF_REG_5, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_csum_diff),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "helper access to packet: test15, cls helper fail sub",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
-                       BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 12),
-                       BPF_MOV64_IMM(BPF_REG_2, 4),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_MOV64_IMM(BPF_REG_5, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_csum_diff),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "invalid access to packet",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "helper access to packet: test16, cls helper fail range 1",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
-                       BPF_MOV64_IMM(BPF_REG_2, 8),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_MOV64_IMM(BPF_REG_5, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_csum_diff),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "invalid access to packet",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "helper access to packet: test17, cls helper fail range 2",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
-                       BPF_MOV64_IMM(BPF_REG_2, -9),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_MOV64_IMM(BPF_REG_5, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_csum_diff),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "R2 min value is negative",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "helper access to packet: test18, cls helper fail range 3",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
-                       BPF_MOV64_IMM(BPF_REG_2, ~0),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_MOV64_IMM(BPF_REG_5, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_csum_diff),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "R2 min value is negative",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "helper access to packet: test19, cls helper range zero",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_MOV64_IMM(BPF_REG_5, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_csum_diff),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "helper access to packet: test20, pkt end as input",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
-                       BPF_MOV64_IMM(BPF_REG_2, 4),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_MOV64_IMM(BPF_REG_5, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_csum_diff),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "R1 type=pkt_end expected=fp",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "helper access to packet: test21, wrong reg",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
-                       BPF_MOV64_IMM(BPF_REG_2, 4),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_MOV64_IMM(BPF_REG_5, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_csum_diff),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "invalid access to packet",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "prevent map lookup in sockmap",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_sockmap = { 3 },
-               .result = REJECT,
-               .errstr = "cannot pass map_type 15 into func bpf_map_lookup_elem",
-               .prog_type = BPF_PROG_TYPE_SOCK_OPS,
-       },
-       {
-               "prevent map lookup in sockhash",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_sockhash = { 3 },
-               .result = REJECT,
-               .errstr = "cannot pass map_type 18 into func bpf_map_lookup_elem",
-               .prog_type = BPF_PROG_TYPE_SOCK_OPS,
-       },
-       {
-               "prevent map lookup in xskmap",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_xskmap = { 3 },
-               .result = REJECT,
-               .errstr = "cannot pass map_type 17 into func bpf_map_lookup_elem",
-               .prog_type = BPF_PROG_TYPE_XDP,
-       },
-       {
-               "prevent map lookup in stack trace",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_stacktrace = { 3 },
-               .result = REJECT,
-               .errstr = "cannot pass map_type 7 into func bpf_map_lookup_elem",
-               .prog_type = BPF_PROG_TYPE_PERF_EVENT,
-       },
-       {
-               "prevent map lookup in prog array",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_prog2 = { 3 },
-               .result = REJECT,
-               .errstr = "cannot pass map_type 3 into func bpf_map_lookup_elem",
-       },
-       {
-               "valid map access into an array with a constant",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
-                                  offsetof(struct test_val, foo)),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr_unpriv = "R0 leaks addr",
-               .result_unpriv = REJECT,
-               .result = ACCEPT,
-       },
-       {
-               "valid map access into an array with a register",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_MOV64_IMM(BPF_REG_1, 4),
-                       BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
-                                  offsetof(struct test_val, foo)),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr_unpriv = "R0 leaks addr",
-               .result_unpriv = REJECT,
-               .result = ACCEPT,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "valid map access into an array with a variable",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 3),
-                       BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
-                                  offsetof(struct test_val, foo)),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr_unpriv = "R0 leaks addr",
-               .result_unpriv = REJECT,
-               .result = ACCEPT,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "valid map access into an array with a signed variable",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 0xffffffff, 1),
-                       BPF_MOV32_IMM(BPF_REG_1, 0),
-                       BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
-                       BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
-                       BPF_MOV32_IMM(BPF_REG_1, 0),
-                       BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
-                                  offsetof(struct test_val, foo)),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr_unpriv = "R0 leaks addr",
-               .result_unpriv = REJECT,
-               .result = ACCEPT,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "invalid map access into an array with a constant",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_0, (MAX_ENTRIES + 1) << 2,
-                                  offsetof(struct test_val, foo)),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr = "invalid access to map value, value_size=48 off=48 size=8",
-               .result = REJECT,
-       },
-       {
-               "invalid map access into an array with a register",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_MOV64_IMM(BPF_REG_1, MAX_ENTRIES + 1),
-                       BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
-                                  offsetof(struct test_val, foo)),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr = "R0 min value is outside of the array range",
-               .result = REJECT,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "invalid map access into an array with a variable",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
-                                  offsetof(struct test_val, foo)),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr = "R0 unbounded memory access, make sure to bounds check any array access into a map",
-               .result = REJECT,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "invalid map access into an array with no floor check",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
-                       BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
-                       BPF_MOV32_IMM(BPF_REG_1, 0),
-                       BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
-                                  offsetof(struct test_val, foo)),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr_unpriv = "R0 leaks addr",
-               .errstr = "R0 unbounded memory access",
-               .result_unpriv = REJECT,
-               .result = REJECT,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "invalid map access into an array with a invalid max check",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES + 1),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
-                       BPF_MOV32_IMM(BPF_REG_1, 0),
-                       BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
-                                  offsetof(struct test_val, foo)),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr_unpriv = "R0 leaks addr",
-               .errstr = "invalid access to map value, value_size=48 off=44 size=8",
-               .result_unpriv = REJECT,
-               .result = REJECT,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "invalid map access into an array with a invalid max check",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
-                       BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
-                                   offsetof(struct test_val, foo)),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3, 11 },
-               .errstr = "R0 pointer += pointer",
-               .result = REJECT,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "direct packet read test#1 for CGROUP_SKB",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
-                                   offsetof(struct __sk_buff, len)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
-                                   offsetof(struct __sk_buff, pkt_type)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
-                                   offsetof(struct __sk_buff, mark)),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_6,
-                                   offsetof(struct __sk_buff, mark)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
-                                   offsetof(struct __sk_buff, queue_mapping)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_8, BPF_REG_1,
-                                   offsetof(struct __sk_buff, protocol)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
-                                   offsetof(struct __sk_buff, vlan_present)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .result_unpriv = REJECT,
-               .errstr_unpriv = "invalid bpf_context access off=76 size=4",
-               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-       },
-       {
-               "direct packet read test#2 for CGROUP_SKB",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
-                                   offsetof(struct __sk_buff, vlan_tci)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
-                                   offsetof(struct __sk_buff, vlan_proto)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
-                                   offsetof(struct __sk_buff, priority)),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_6,
-                                   offsetof(struct __sk_buff, priority)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
-                                   offsetof(struct __sk_buff,
-                                            ingress_ifindex)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_8, BPF_REG_1,
-                                   offsetof(struct __sk_buff, tc_index)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
-                                   offsetof(struct __sk_buff, hash)),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-       },
-       {
-               "direct packet read test#3 for CGROUP_SKB",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[0])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[1])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[2])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[3])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_8, BPF_REG_1,
-                                   offsetof(struct __sk_buff, cb[4])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
-                                   offsetof(struct __sk_buff, napi_id)),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_4,
-                                   offsetof(struct __sk_buff, cb[0])),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_5,
-                                   offsetof(struct __sk_buff, cb[1])),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_6,
-                                   offsetof(struct __sk_buff, cb[2])),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_7,
-                                   offsetof(struct __sk_buff, cb[3])),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_8,
-                                   offsetof(struct __sk_buff, cb[4])),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-       },
-       {
-               "direct packet read test#4 for CGROUP_SKB",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, family)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, remote_ip4)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
-                                   offsetof(struct __sk_buff, local_ip4)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
-                                   offsetof(struct __sk_buff, remote_ip6[0])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
-                                   offsetof(struct __sk_buff, remote_ip6[1])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
-                                   offsetof(struct __sk_buff, remote_ip6[2])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
-                                   offsetof(struct __sk_buff, remote_ip6[3])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
-                                   offsetof(struct __sk_buff, local_ip6[0])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
-                                   offsetof(struct __sk_buff, local_ip6[1])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
-                                   offsetof(struct __sk_buff, local_ip6[2])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
-                                   offsetof(struct __sk_buff, local_ip6[3])),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
-                                   offsetof(struct __sk_buff, remote_port)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_8, BPF_REG_1,
-                                   offsetof(struct __sk_buff, local_port)),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-       },
-       {
-               "invalid access of tc_classid for CGROUP_SKB",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, tc_classid)),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "invalid bpf_context access",
-               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-       },
-       {
-               "invalid access of data_meta for CGROUP_SKB",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_meta)),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "invalid bpf_context access",
-               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-       },
-       {
-               "invalid access of flow_keys for CGROUP_SKB",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, flow_keys)),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "invalid bpf_context access",
-               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-       },
-       {
-               "invalid write access to napi_id for CGROUP_SKB",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
-                                   offsetof(struct __sk_buff, napi_id)),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_9,
-                                   offsetof(struct __sk_buff, napi_id)),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "invalid bpf_context access",
-               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-       },
-       {
-               "valid cgroup storage access",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_get_local_storage),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_cgroup_storage = { 1 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-       },
-       {
-               "invalid cgroup storage access 1",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_get_local_storage),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 1 },
-               .result = REJECT,
-               .errstr = "cannot pass map_type 1 into func bpf_get_local_storage",
-               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-       },
-       {
-               "invalid cgroup storage access 2",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 1),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_get_local_storage),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "fd 1 is not pointing to valid bpf_map",
-               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-       },
-       {
-               "invalid cgroup storage access 3",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_get_local_storage),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 256),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_cgroup_storage = { 1 },
-               .result = REJECT,
-               .errstr = "invalid access to map value, value_size=64 off=256 size=4",
-               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-       },
-       {
-               "invalid cgroup storage access 4",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_get_local_storage),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, -2),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_cgroup_storage = { 1 },
-               .result = REJECT,
-               .errstr = "invalid access to map value, value_size=64 off=-2 size=4",
-               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "invalid cgroup storage access 5",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 7),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_get_local_storage),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_cgroup_storage = { 1 },
-               .result = REJECT,
-               .errstr = "get_local_storage() doesn't support non-zero flags",
-               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-       },
-       {
-               "invalid cgroup storage access 6",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_get_local_storage),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_cgroup_storage = { 1 },
-               .result = REJECT,
-               .errstr = "get_local_storage() doesn't support non-zero flags",
-               .errstr_unpriv = "R2 leaks addr into helper function",
-               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-       },
-       {
-               "valid per-cpu cgroup storage access",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_get_local_storage),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_percpu_cgroup_storage = { 1 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-       },
-       {
-               "invalid per-cpu cgroup storage access 1",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_get_local_storage),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 1 },
-               .result = REJECT,
-               .errstr = "cannot pass map_type 1 into func bpf_get_local_storage",
-               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-       },
-       {
-               "invalid per-cpu cgroup storage access 2",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 1),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_get_local_storage),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "fd 1 is not pointing to valid bpf_map",
-               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-       },
-       {
-               "invalid per-cpu cgroup storage access 3",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_get_local_storage),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 256),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_percpu_cgroup_storage = { 1 },
-               .result = REJECT,
-               .errstr = "invalid access to map value, value_size=64 off=256 size=4",
-               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-       },
-       {
-               "invalid per-cpu cgroup storage access 4",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_get_local_storage),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, -2),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_cgroup_storage = { 1 },
-               .result = REJECT,
-               .errstr = "invalid access to map value, value_size=64 off=-2 size=4",
-               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "invalid per-cpu cgroup storage access 5",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 7),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_get_local_storage),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_percpu_cgroup_storage = { 1 },
-               .result = REJECT,
-               .errstr = "get_local_storage() doesn't support non-zero flags",
-               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-       },
-       {
-               "invalid per-cpu cgroup storage access 6",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_get_local_storage),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_percpu_cgroup_storage = { 1 },
-               .result = REJECT,
-               .errstr = "get_local_storage() doesn't support non-zero flags",
-               .errstr_unpriv = "R2 leaks addr into helper function",
-               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-       },
-       {
-               "write tstamp from CGROUP_SKB",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, tstamp)),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .result_unpriv = REJECT,
-               .errstr_unpriv = "invalid bpf_context access off=152 size=8",
-               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-       },
-       {
-               "read tstamp from CGROUP_SKB",
-               .insns = {
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, tstamp)),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-       },
-       {
-               "read gso_segs from CGROUP_SKB",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, gso_segs)),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-       },
-       {
-               "write gso_segs from CGROUP_SKB",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, gso_segs)),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .result_unpriv = REJECT,
-               .errstr = "invalid bpf_context access off=164 size=4",
-               .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
-       },
-       {
-               "read gso_segs from CLS",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, gso_segs)),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "multiple registers share map_lookup_elem result",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_1, 10),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 4 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS
-       },
-       {
-               "alu ops on ptr_to_map_value_or_null, 1",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_1, 10),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 2),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 4 },
-               .errstr = "R4 pointer arithmetic on map_value_or_null",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS
-       },
-       {
-               "alu ops on ptr_to_map_value_or_null, 2",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_1, 10),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_4, -1),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 4 },
-               .errstr = "R4 pointer arithmetic on map_value_or_null",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS
-       },
-       {
-               "alu ops on ptr_to_map_value_or_null, 3",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_1, 10),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
-                       BPF_ALU64_IMM(BPF_LSH, BPF_REG_4, 1),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 4 },
-               .errstr = "R4 pointer arithmetic on map_value_or_null",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS
-       },
-       {
-               "invalid memory access with multiple map_lookup_elem calls",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_1, 10),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
-                       BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 4 },
-               .result = REJECT,
-               .errstr = "R4 !read_ok",
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS
-       },
-       {
-               "valid indirect map_lookup_elem access with 2nd lookup in branch",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_1, 10),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
-                       BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_MOV64_IMM(BPF_REG_2, 10),
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 3),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 4 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS
-       },
-       {
-               "invalid map access from else condition",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES-1, 1),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
-                       BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr = "R0 unbounded memory access",
-               .result = REJECT,
-               .errstr_unpriv = "R0 leaks addr",
-               .result_unpriv = REJECT,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "constant register |= constant should keep constant type",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
-                       BPF_MOV64_IMM(BPF_REG_2, 34),
-                       BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 13),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "constant register |= constant should not bypass stack boundary checks",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
-                       BPF_MOV64_IMM(BPF_REG_2, 34),
-                       BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 24),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid stack type R1 off=-48 access_size=58",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "constant register |= constant register should keep constant type",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
-                       BPF_MOV64_IMM(BPF_REG_2, 34),
-                       BPF_MOV64_IMM(BPF_REG_4, 13),
-                       BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "constant register |= constant register should not bypass stack boundary checks",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
-                       BPF_MOV64_IMM(BPF_REG_2, 34),
-                       BPF_MOV64_IMM(BPF_REG_4, 24),
-                       BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid stack type R1 off=-48 access_size=58",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "invalid direct packet write for LWT_IN",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
-                       BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "cannot write into packet",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_LWT_IN,
-       },
-       {
-               "invalid direct packet write for LWT_OUT",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
-                       BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "cannot write into packet",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_LWT_OUT,
-       },
-       {
-               "direct packet write for LWT_XMIT",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
-                       BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_LWT_XMIT,
-       },
-       {
-               "direct packet read for LWT_IN",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_LWT_IN,
-       },
-       {
-               "direct packet read for LWT_OUT",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_LWT_OUT,
-       },
-       {
-               "direct packet read for LWT_XMIT",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_LWT_XMIT,
-       },
-       {
-               "overlapping checks for direct packet access",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_LWT_XMIT,
-       },
-       {
-               "make headroom for LWT_XMIT",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
-                       BPF_MOV64_IMM(BPF_REG_2, 34),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_skb_change_head),
-                       /* split for s390 to succeed */
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
-                       BPF_MOV64_IMM(BPF_REG_2, 42),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_skb_change_head),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_LWT_XMIT,
-       },
-       {
-               "invalid access of tc_classid for LWT_IN",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, tc_classid)),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "invalid bpf_context access",
-       },
-       {
-               "invalid access of tc_classid for LWT_OUT",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, tc_classid)),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "invalid bpf_context access",
-       },
-       {
-               "invalid access of tc_classid for LWT_XMIT",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, tc_classid)),
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "invalid bpf_context access",
-       },
-       {
-               "leak pointer into ctx 1",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[0])),
-                       BPF_LD_MAP_FD(BPF_REG_2, 0),
-                       BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_2,
-                                     offsetof(struct __sk_buff, cb[0])),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 2 },
-               .errstr_unpriv = "R2 leaks addr into mem",
-               .result_unpriv = REJECT,
-               .result = REJECT,
-               .errstr = "BPF_XADD stores into R1 ctx is not allowed",
-       },
-       {
-               "leak pointer into ctx 2",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
-                                   offsetof(struct __sk_buff, cb[0])),
-                       BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_10,
-                                     offsetof(struct __sk_buff, cb[0])),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr_unpriv = "R10 leaks addr into mem",
-               .result_unpriv = REJECT,
-               .result = REJECT,
-               .errstr = "BPF_XADD stores into R1 ctx is not allowed",
-       },
-       {
-               "leak pointer into ctx 3",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_2, 0),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2,
-                                     offsetof(struct __sk_buff, cb[0])),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 1 },
-               .errstr_unpriv = "R2 leaks addr into ctx",
-               .result_unpriv = REJECT,
-               .result = ACCEPT,
-       },
-       {
-               "leak pointer into map val",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
-                       BPF_STX_XADD(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 4 },
-               .errstr_unpriv = "R6 leaks addr into mem",
-               .result_unpriv = REJECT,
-               .result = ACCEPT,
-       },
-       {
-               "helper access to map: full range",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to map: partial range",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_MOV64_IMM(BPF_REG_2, 8),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to map: empty range",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_trace_printk),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr = "invalid access to map value, value_size=48 off=0 size=0",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to map: out-of-bound range",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val) + 8),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr = "invalid access to map value, value_size=48 off=0 size=56",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to map: negative range",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_MOV64_IMM(BPF_REG_2, -8),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr = "R2 min value is negative",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to adjusted map (via const imm): full range",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
-                               offsetof(struct test_val, foo)),
-                       BPF_MOV64_IMM(BPF_REG_2,
-                               sizeof(struct test_val) -
-                               offsetof(struct test_val, foo)),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to adjusted map (via const imm): partial range",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
-                               offsetof(struct test_val, foo)),
-                       BPF_MOV64_IMM(BPF_REG_2, 8),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to adjusted map (via const imm): empty range",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
-                               offsetof(struct test_val, foo)),
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_trace_printk),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr = "invalid access to map value, value_size=48 off=4 size=0",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to adjusted map (via const imm): out-of-bound range",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
-                               offsetof(struct test_val, foo)),
-                       BPF_MOV64_IMM(BPF_REG_2,
-                               sizeof(struct test_val) -
-                               offsetof(struct test_val, foo) + 8),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr = "invalid access to map value, value_size=48 off=4 size=52",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to adjusted map (via const imm): negative range (> adjustment)",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
-                               offsetof(struct test_val, foo)),
-                       BPF_MOV64_IMM(BPF_REG_2, -8),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr = "R2 min value is negative",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to adjusted map (via const imm): negative range (< adjustment)",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
-                               offsetof(struct test_val, foo)),
-                       BPF_MOV64_IMM(BPF_REG_2, -1),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr = "R2 min value is negative",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to adjusted map (via const reg): full range",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_MOV64_IMM(BPF_REG_3,
-                               offsetof(struct test_val, foo)),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
-                       BPF_MOV64_IMM(BPF_REG_2,
-                               sizeof(struct test_val) -
-                               offsetof(struct test_val, foo)),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to adjusted map (via const reg): partial range",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_MOV64_IMM(BPF_REG_3,
-                               offsetof(struct test_val, foo)),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
-                       BPF_MOV64_IMM(BPF_REG_2, 8),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to adjusted map (via const reg): empty range",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_trace_printk),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr = "R1 min value is outside of the array range",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to adjusted map (via const reg): out-of-bound range",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_MOV64_IMM(BPF_REG_3,
-                               offsetof(struct test_val, foo)),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
-                       BPF_MOV64_IMM(BPF_REG_2,
-                               sizeof(struct test_val) -
-                               offsetof(struct test_val, foo) + 8),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr = "invalid access to map value, value_size=48 off=4 size=52",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to adjusted map (via const reg): negative range (> adjustment)",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_MOV64_IMM(BPF_REG_3,
-                               offsetof(struct test_val, foo)),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
-                       BPF_MOV64_IMM(BPF_REG_2, -8),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr = "R2 min value is negative",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to adjusted map (via const reg): negative range (< adjustment)",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_MOV64_IMM(BPF_REG_3,
-                               offsetof(struct test_val, foo)),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
-                       BPF_MOV64_IMM(BPF_REG_2, -1),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr = "R2 min value is negative",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to adjusted map (via variable): full range",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
-                               offsetof(struct test_val, foo), 4),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
-                       BPF_MOV64_IMM(BPF_REG_2,
-                               sizeof(struct test_val) -
-                               offsetof(struct test_val, foo)),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to adjusted map (via variable): partial range",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
-                               offsetof(struct test_val, foo), 4),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
-                       BPF_MOV64_IMM(BPF_REG_2, 8),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to adjusted map (via variable): empty range",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
-                               offsetof(struct test_val, foo), 3),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_trace_printk),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr = "R1 min value is outside of the array range",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to adjusted map (via variable): no max check",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
-                       BPF_MOV64_IMM(BPF_REG_2, 1),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr = "R1 unbounded memory access",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to adjusted map (via variable): wrong max check",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
-                               offsetof(struct test_val, foo), 4),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
-                       BPF_MOV64_IMM(BPF_REG_2,
-                               sizeof(struct test_val) -
-                               offsetof(struct test_val, foo) + 1),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr = "invalid access to map value, value_size=48 off=4 size=45",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to map: bounds check using <, good access",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JLT, BPF_REG_3, 32, 2),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to map: bounds check using <, bad access",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JLT, BPF_REG_3, 32, 4),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .result = REJECT,
-               .errstr = "R1 unbounded memory access",
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to map: bounds check using <=, good access",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JLE, BPF_REG_3, 32, 2),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to map: bounds check using <=, bad access",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JLE, BPF_REG_3, 32, 4),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .result = REJECT,
-               .errstr = "R1 unbounded memory access",
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to map: bounds check using s<, good access",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 0, -3),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to map: bounds check using s<, good access 2",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, -3, -3),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to map: bounds check using s<, bad access",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, -3, -3),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .result = REJECT,
-               .errstr = "R1 min value is negative",
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to map: bounds check using s<=, good access",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 0, -3),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to map: bounds check using s<=, good access 2",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, -3, -3),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to map: bounds check using s<=, bad access",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, -3, -3),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
-                       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .result = REJECT,
-               .errstr = "R1 min value is negative",
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "map access: known scalar += value_ptr from different maps",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, len)),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 3),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
-                       BPF_MOV64_IMM(BPF_REG_1, 4),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_16b = { 5 },
-               .fixup_map_array_48b = { 8 },
-               .result = ACCEPT,
-               .result_unpriv = REJECT,
-               .errstr_unpriv = "R1 tried to add from different maps",
-               .retval = 1,
-       },
-       {
-               "map access: value_ptr -= known scalar from different maps",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, len)),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 3),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_MOV64_IMM(BPF_REG_1, 4),
-                       BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_16b = { 5 },
-               .fixup_map_array_48b = { 8 },
-               .result = ACCEPT,
-               .result_unpriv = REJECT,
-               .errstr_unpriv = "R0 min value is outside of the array range",
-               .retval = 1,
-       },
-       {
-               "map access: known scalar += value_ptr from different maps, but same value properties",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, len)),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 3),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
-                       BPF_MOV64_IMM(BPF_REG_1, 4),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 5 },
-               .fixup_map_array_48b = { 8 },
-               .result = ACCEPT,
-               .retval = 1,
-       },
-       {
-               "map access: mixing value pointer and scalar, 1",
-               .insns = {
-                       // load map value pointer into r0 and r2
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_LD_MAP_FD(BPF_REG_ARG1, 0),
-                       BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -16),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_FP, -16, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
-                       BPF_EXIT_INSN(),
-                       // load some number from the map into r1
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       // depending on r1, branch:
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 3),
-                       // branch A
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_JMP_A(2),
-                       // branch B
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_3, 0x100000),
-                       // common instruction
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
-                       // depending on r1, branch:
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
-                       // branch A
-                       BPF_JMP_A(4),
-                       // branch B
-                       BPF_MOV64_IMM(BPF_REG_0, 0x13371337),
-                       // verifier follows fall-through
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0x100000, 2),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       // fake-dead code; targeted from branch A to
-                       // prevent dead code sanitization
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 1 },
-               .result = ACCEPT,
-               .result_unpriv = REJECT,
-               .errstr_unpriv = "R2 tried to add from different pointers or scalars",
-               .retval = 0,
-       },
-       {
-               "map access: mixing value pointer and scalar, 2",
-               .insns = {
-                       // load map value pointer into r0 and r2
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_LD_MAP_FD(BPF_REG_ARG1, 0),
-                       BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -16),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_FP, -16, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
-                       BPF_EXIT_INSN(),
-                       // load some number from the map into r1
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       // depending on r1, branch:
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
-                       // branch A
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_3, 0x100000),
-                       BPF_JMP_A(2),
-                       // branch B
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       // common instruction
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
-                       // depending on r1, branch:
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
-                       // branch A
-                       BPF_JMP_A(4),
-                       // branch B
-                       BPF_MOV64_IMM(BPF_REG_0, 0x13371337),
-                       // verifier follows fall-through
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0x100000, 2),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       // fake-dead code; targeted from branch A to
-                       // prevent dead code sanitization
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 1 },
-               .result = ACCEPT,
-               .result_unpriv = REJECT,
-               .errstr_unpriv = "R2 tried to add from different maps or paths",
-               .retval = 0,
-       },
-       {
-               "sanitation: alu with different scalars",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_LD_MAP_FD(BPF_REG_ARG1, 0),
-                       BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -16),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_FP, -16, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
-                       BPF_EXIT_INSN(),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_3, 0x100000),
-                       BPF_JMP_A(2),
-                       BPF_MOV64_IMM(BPF_REG_2, 42),
-                       BPF_MOV64_IMM(BPF_REG_3, 0x100001),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 1 },
-               .result = ACCEPT,
-               .retval = 0x100000,
-       },
-       {
-               "map access: value_ptr += known scalar, upper oob arith, test 1",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_MOV64_IMM(BPF_REG_1, 48),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = ACCEPT,
-               .result_unpriv = REJECT,
-               .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
-               .retval = 1,
-       },
-       {
-               "map access: value_ptr += known scalar, upper oob arith, test 2",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_MOV64_IMM(BPF_REG_1, 49),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = ACCEPT,
-               .result_unpriv = REJECT,
-               .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
-               .retval = 1,
-       },
-       {
-               "map access: value_ptr += known scalar, upper oob arith, test 3",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_MOV64_IMM(BPF_REG_1, 47),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = ACCEPT,
-               .result_unpriv = REJECT,
-               .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
-               .retval = 1,
-       },
-       {
-               "map access: value_ptr -= known scalar, lower oob arith, test 1",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
-                       BPF_MOV64_IMM(BPF_REG_1, 47),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_MOV64_IMM(BPF_REG_1, 48),
-                       BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = REJECT,
-               .errstr = "R0 min value is outside of the array range",
-               .result_unpriv = REJECT,
-               .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
-       },
-       {
-               "map access: value_ptr -= known scalar, lower oob arith, test 2",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
-                       BPF_MOV64_IMM(BPF_REG_1, 47),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_MOV64_IMM(BPF_REG_1, 48),
-                       BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
-                       BPF_MOV64_IMM(BPF_REG_1, 1),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = ACCEPT,
-               .result_unpriv = REJECT,
-               .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
-               .retval = 1,
-       },
-       {
-               "map access: value_ptr -= known scalar, lower oob arith, test 3",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
-                       BPF_MOV64_IMM(BPF_REG_1, 47),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_MOV64_IMM(BPF_REG_1, 47),
-                       BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = ACCEPT,
-               .result_unpriv = REJECT,
-               .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
-               .retval = 1,
-       },
-       {
-               "map access: known scalar += value_ptr",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
-                       BPF_MOV64_IMM(BPF_REG_1, 4),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = ACCEPT,
-               .retval = 1,
-       },
-       {
-               "map access: value_ptr += known scalar, 1",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
-                       BPF_MOV64_IMM(BPF_REG_1, 4),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = ACCEPT,
-               .retval = 1,
-       },
-       {
-               "map access: value_ptr += known scalar, 2",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
-                       BPF_MOV64_IMM(BPF_REG_1, 49),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = REJECT,
-               .errstr = "invalid access to map value",
-       },
-       {
-               "map access: value_ptr += known scalar, 3",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
-                       BPF_MOV64_IMM(BPF_REG_1, -1),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = REJECT,
-               .errstr = "invalid access to map value",
-       },
-       {
-               "map access: value_ptr += known scalar, 4",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
-                       BPF_MOV64_IMM(BPF_REG_1, 5),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_MOV64_IMM(BPF_REG_1, -2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_MOV64_IMM(BPF_REG_1, -1),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = ACCEPT,
-               .result_unpriv = REJECT,
-               .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
-               .retval = 1,
-       },
-       {
-               "map access: value_ptr += known scalar, 5",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
-                       BPF_MOV64_IMM(BPF_REG_1, (6 + 1) * sizeof(int)),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = ACCEPT,
-               .retval = 0xabcdef12,
-       },
-       {
-               "map access: value_ptr += known scalar, 6",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
-                       BPF_MOV64_IMM(BPF_REG_1, (3 + 1) * sizeof(int)),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_MOV64_IMM(BPF_REG_1, 3 * sizeof(int)),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = ACCEPT,
-               .retval = 0xabcdef12,
-       },
-       {
-               "map access: unknown scalar += value_ptr, 1",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = ACCEPT,
-               .retval = 1,
-       },
-       {
-               "map access: unknown scalar += value_ptr, 2",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 31),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = ACCEPT,
-               .retval = 0xabcdef12,
-       },
-       {
-               "map access: unknown scalar += value_ptr, 3",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
-                       BPF_MOV64_IMM(BPF_REG_1, -1),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_MOV64_IMM(BPF_REG_1, 1),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 31),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = ACCEPT,
-               .result_unpriv = REJECT,
-               .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
-               .retval = 0xabcdef12,
-       },
-       {
-               "map access: unknown scalar += value_ptr, 4",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
-                       BPF_MOV64_IMM(BPF_REG_1, 19),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 31),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = REJECT,
-               .errstr = "R1 max value is outside of the array range",
-               .errstr_unpriv = "R1 pointer arithmetic of map value goes out of range",
-       },
-       {
-               "map access: value_ptr += unknown scalar, 1",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = ACCEPT,
-               .retval = 1,
-       },
-       {
-               "map access: value_ptr += unknown scalar, 2",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 31),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = ACCEPT,
-               .retval = 0xabcdef12,
-       },
-       {
-               "map access: value_ptr += unknown scalar, 3",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 16),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_3, 1),
-                       BPF_ALU64_IMM(BPF_OR, BPF_REG_3, 1),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_3, 4),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-                       BPF_MOV64_IMM(BPF_REG_0, 2),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, -3),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = ACCEPT,
-               .retval = 1,
-       },
-       {
-               "map access: value_ptr += value_ptr",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = REJECT,
-               .errstr = "R0 pointer += pointer prohibited",
-       },
-       {
-               "map access: known scalar -= value_ptr",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
-                       BPF_MOV64_IMM(BPF_REG_1, 4),
-                       BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = REJECT,
-               .errstr = "R1 tried to subtract pointer from scalar",
-       },
-       {
-               "map access: value_ptr -= known scalar",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
-                       BPF_MOV64_IMM(BPF_REG_1, 4),
-                       BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = REJECT,
-               .errstr = "R0 min value is outside of the array range",
-       },
-       {
-               "map access: value_ptr -= known scalar, 2",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
-                       BPF_MOV64_IMM(BPF_REG_1, 6),
-                       BPF_MOV64_IMM(BPF_REG_2, 4),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_2),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = ACCEPT,
-               .result_unpriv = REJECT,
-               .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
-               .retval = 1,
-       },
-       {
-               "map access: unknown scalar -= value_ptr",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
-                       BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = REJECT,
-               .errstr = "R1 tried to subtract pointer from scalar",
-       },
-       {
-               "map access: value_ptr -= unknown scalar",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
-                       BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = REJECT,
-               .errstr = "R0 min value is negative",
-       },
-       {
-               "map access: value_ptr -= unknown scalar, 2",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
-                       BPF_ALU64_IMM(BPF_OR, BPF_REG_1, 0x7),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0x7),
-                       BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = ACCEPT,
-               .result_unpriv = REJECT,
-               .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
-               .retval = 1,
-       },
-       {
-               "map access: value_ptr -= value_ptr",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
-                       BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 1),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_array_48b = { 3 },
-               .result = REJECT,
-               .errstr = "R0 invalid mem access 'inv'",
-               .errstr_unpriv = "R0 pointer -= pointer prohibited",
-       },
-       {
-               "map lookup helper access to map",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_16b = { 3, 8 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "map update helper access to map",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_update_elem),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_16b = { 3, 10 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "map update helper access to map: wrong size",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_update_elem),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .fixup_map_hash_16b = { 10 },
-               .result = REJECT,
-               .errstr = "invalid access to map value, value_size=8 off=0 size=16",
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "map helper access to adjusted map (via const imm)",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
-                                     offsetof(struct other_val, bar)),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_16b = { 3, 9 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "map helper access to adjusted map (via const imm): out-of-bound 1",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
-                                     sizeof(struct other_val) - 4),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_16b = { 3, 9 },
-               .result = REJECT,
-               .errstr = "invalid access to map value, value_size=16 off=12 size=8",
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "map helper access to adjusted map (via const imm): out-of-bound 2",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_16b = { 3, 9 },
-               .result = REJECT,
-               .errstr = "invalid access to map value, value_size=16 off=-4 size=8",
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "map helper access to adjusted map (via const reg)",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
-                       BPF_MOV64_IMM(BPF_REG_3,
-                                     offsetof(struct other_val, bar)),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_16b = { 3, 10 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "map helper access to adjusted map (via const reg): out-of-bound 1",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
-                       BPF_MOV64_IMM(BPF_REG_3,
-                                     sizeof(struct other_val) - 4),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_16b = { 3, 10 },
-               .result = REJECT,
-               .errstr = "invalid access to map value, value_size=16 off=12 size=8",
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "map helper access to adjusted map (via const reg): out-of-bound 2",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
-                       BPF_MOV64_IMM(BPF_REG_3, -4),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_16b = { 3, 10 },
-               .result = REJECT,
-               .errstr = "invalid access to map value, value_size=16 off=-4 size=8",
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "map helper access to adjusted map (via variable)",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
-                                   offsetof(struct other_val, bar), 4),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_16b = { 3, 11 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "map helper access to adjusted map (via variable): no max check",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_16b = { 3, 10 },
-               .result = REJECT,
-               .errstr = "R2 unbounded memory access, make sure to bounds check any array access into a map",
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "map helper access to adjusted map (via variable): wrong max check",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JGT, BPF_REG_3,
-                                   offsetof(struct other_val, bar) + 1, 4),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_16b = { 3, 11 },
-               .result = REJECT,
-               .errstr = "invalid access to map value, value_size=16 off=9 size=8",
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "map element value is preserved across register spilling",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr_unpriv = "R0 leaks addr",
-               .result = ACCEPT,
-               .result_unpriv = REJECT,
-       },
-       {
-               "map element value or null is marked on register spilling",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -152),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr_unpriv = "R0 leaks addr",
-               .result = ACCEPT,
-               .result_unpriv = REJECT,
-       },
-       {
-               "map element value store of cleared call register",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr_unpriv = "R1 !read_ok",
-               .errstr = "R1 !read_ok",
-               .result = REJECT,
-               .result_unpriv = REJECT,
-       },
-       {
-               "map element value with unaligned store",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 17),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 43),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_0, -2, 44),
-                       BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 32),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_8, 2, 33),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_8, -2, 34),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 5),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 22),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_8, 4, 23),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_8, -7, 24),
-                       BPF_MOV64_REG(BPF_REG_7, BPF_REG_8),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, 3),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_7, 0, 22),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_7, 4, 23),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_7, -4, 24),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr_unpriv = "R0 leaks addr",
-               .result = ACCEPT,
-               .result_unpriv = REJECT,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "map element value with unaligned load",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 9),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 2),
-                       BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 0),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 2),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 5),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 4),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr_unpriv = "R0 leaks addr",
-               .result = ACCEPT,
-               .result_unpriv = REJECT,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "map element value illegal alu op, 1",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr = "R0 bitwise operator &= on pointer",
-               .result = REJECT,
-       },
-       {
-               "map element value illegal alu op, 2",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
-                       BPF_ALU32_IMM(BPF_ADD, BPF_REG_0, 0),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr = "R0 32-bit pointer arithmetic prohibited",
-               .result = REJECT,
-       },
-       {
-               "map element value illegal alu op, 3",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
-                       BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, 42),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr = "R0 pointer arithmetic with /= operator",
-               .result = REJECT,
-       },
-       {
-               "map element value illegal alu op, 4",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
-                       BPF_ENDIAN(BPF_FROM_BE, BPF_REG_0, 64),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr_unpriv = "R0 pointer arithmetic prohibited",
-               .errstr = "invalid mem access 'inv'",
-               .result = REJECT,
-               .result_unpriv = REJECT,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "map element value illegal alu op, 5",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
-                       BPF_MOV64_IMM(BPF_REG_3, 4096),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
-                       BPF_STX_XADD(BPF_DW, BPF_REG_2, BPF_REG_3, 0),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr = "R0 invalid mem access 'inv'",
-               .result = REJECT,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "map element value is preserved across register spilling",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0,
-                               offsetof(struct test_val, foo)),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr_unpriv = "R0 leaks addr",
-               .result = ACCEPT,
-               .result_unpriv = REJECT,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "helper access to variable memory: stack, bitwise AND + JMP, correct bounds",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
-                       BPF_MOV64_IMM(BPF_REG_2, 16),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to variable memory: stack, bitwise AND, zero included",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
-                       BPF_MOV64_IMM(BPF_REG_2, 16),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid indirect read from stack off -64+0 size 64",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to variable memory: stack, bitwise AND + JMP, wrong max",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
-                       BPF_MOV64_IMM(BPF_REG_2, 16),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 65),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid stack type R1 off=-64 access_size=65",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to variable memory: stack, JMP, correct bounds",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
-                       BPF_MOV64_IMM(BPF_REG_2, 16),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
-                       BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 4),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to variable memory: stack, JMP (signed), correct bounds",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
-                       BPF_MOV64_IMM(BPF_REG_2, 16),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
-                       BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 4),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to variable memory: stack, JMP, bounds + offset",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
-                       BPF_MOV64_IMM(BPF_REG_2, 16),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
-                       BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 5),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 3),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid stack type R1 off=-64 access_size=65",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to variable memory: stack, JMP, wrong max",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
-                       BPF_MOV64_IMM(BPF_REG_2, 16),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
-                       BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 65, 4),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid stack type R1 off=-64 access_size=65",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to variable memory: stack, JMP, no max check",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
-                       BPF_MOV64_IMM(BPF_REG_2, 16),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               /* because max wasn't checked, signed min is negative */
-               .errstr = "R2 min value is negative, either use unsigned or 'var &= const'",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to variable memory: stack, JMP, no min check",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
-                       BPF_MOV64_IMM(BPF_REG_2, 16),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
-                       BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 3),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid indirect read from stack off -64+0 size 64",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to variable memory: stack, JMP (signed), no min check",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
-                       BPF_MOV64_IMM(BPF_REG_2, 16),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
-                       BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 3),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R2 min value is negative",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to variable memory: map, JMP, correct bounds",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
-                       BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
-                               sizeof(struct test_val), 4),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to variable memory: map, JMP, wrong max",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
-                       BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
-                               sizeof(struct test_val) + 1, 4),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr = "invalid access to map value, value_size=48 off=0 size=49",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to variable memory: map adjusted, JMP, correct bounds",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
-                       BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
-                       BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
-                               sizeof(struct test_val) - 20, 4),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to variable memory: map adjusted, JMP, wrong max",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
-                       BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
-                       BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
-                               sizeof(struct test_val) - 19, 4),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr = "R1 min value is outside of the array range",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to variable memory: size = 0 allowed on NULL (ARG_PTR_TO_MEM_OR_NULL)",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_1, 0),
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_MOV64_IMM(BPF_REG_5, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_csum_diff),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "helper access to variable memory: size > 0 not allowed on NULL (ARG_PTR_TO_MEM_OR_NULL)",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_1, 0),
-                       BPF_MOV64_IMM(BPF_REG_2, 1),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_MOV64_IMM(BPF_REG_5, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_csum_diff),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R1 type=inv expected=fp",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "helper access to variable memory: size = 0 allowed on != NULL stack pointer (ARG_PTR_TO_MEM_OR_NULL)",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 8),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_MOV64_IMM(BPF_REG_5, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_csum_diff),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "helper access to variable memory: size = 0 allowed on != NULL map pointer (ARG_PTR_TO_MEM_OR_NULL)",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_MOV64_IMM(BPF_REG_5, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_csum_diff),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "helper access to variable memory: size possible = 0 allowed on != NULL stack pointer (ARG_PTR_TO_MEM_OR_NULL)",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 7),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_MOV64_IMM(BPF_REG_5, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_csum_diff),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "helper access to variable memory: size possible = 0 allowed on != NULL map pointer (ARG_PTR_TO_MEM_OR_NULL)",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_MOV64_IMM(BPF_REG_5, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_csum_diff),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "helper access to variable memory: size possible = 0 allowed on != NULL packet pointer (ARG_PTR_TO_MEM_OR_NULL)",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data_end)),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_6),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 0),
-                       BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_MOV64_IMM(BPF_REG_5, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_csum_diff),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .retval = 0 /* csum_diff of 64-byte packet */,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "helper access to variable memory: size = 0 not allowed on NULL (!ARG_PTR_TO_MEM_OR_NULL)",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_1, 0),
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R1 type=inv expected=fp",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to variable memory: size > 0 not allowed on NULL (!ARG_PTR_TO_MEM_OR_NULL)",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_1, 0),
-                       BPF_MOV64_IMM(BPF_REG_2, 1),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R1 type=inv expected=fp",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to variable memory: size = 0 allowed on != NULL stack pointer (!ARG_PTR_TO_MEM_OR_NULL)",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to variable memory: size = 0 allowed on != NULL map pointer (!ARG_PTR_TO_MEM_OR_NULL)",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to variable memory: size possible = 0 allowed on != NULL stack pointer (!ARG_PTR_TO_MEM_OR_NULL)",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to variable memory: size possible = 0 allowed on != NULL map pointer (!ARG_PTR_TO_MEM_OR_NULL)",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 2),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to variable memory: 8 bytes leak",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
-                       BPF_MOV64_IMM(BPF_REG_2, 1),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 63),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "invalid indirect read from stack off -64+32 size 64",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "helper access to variable memory: 8 bytes no leak (init memory)",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 32),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 32),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_EMIT_CALL(BPF_FUNC_probe_read),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_TRACEPOINT,
-       },
-       {
-               "invalid and of negative number",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_1, -4),
-                       BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
-                                  offsetof(struct test_val, foo)),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr = "R0 max value is outside of the array range",
-               .result = REJECT,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "invalid range check",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 12),
-                       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_9, 1),
-                       BPF_ALU32_IMM(BPF_MOD, BPF_REG_1, 2),
-                       BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 1),
-                       BPF_ALU32_REG(BPF_AND, BPF_REG_9, BPF_REG_1),
-                       BPF_ALU32_IMM(BPF_ADD, BPF_REG_9, 1),
-                       BPF_ALU32_IMM(BPF_RSH, BPF_REG_9, 1),
-                       BPF_MOV32_IMM(BPF_REG_3, 1),
-                       BPF_ALU32_REG(BPF_SUB, BPF_REG_3, BPF_REG_9),
-                       BPF_ALU32_IMM(BPF_MUL, BPF_REG_3, 0x10000000),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
-                       BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_3, 0),
-                       BPF_MOV64_REG(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr = "R0 max value is outside of the array range",
-               .result = REJECT,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
-       {
-               "map in map access",
-               .insns = {
-                       BPF_ST_MEM(0, BPF_REG_10, -4, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
-                       BPF_ST_MEM(0, BPF_REG_10, -4, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_in_map = { 3 },
-               .result = ACCEPT,
-       },
-       {
-               "invalid inner map pointer",
-               .insns = {
-                       BPF_ST_MEM(0, BPF_REG_10, -4, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
-                       BPF_ST_MEM(0, BPF_REG_10, -4, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_in_map = { 3 },
-               .errstr = "R1 pointer arithmetic on map_ptr prohibited",
-               .result = REJECT,
-       },
-       {
-               "forgot null checking on the inner map pointer",
-               .insns = {
-                       BPF_ST_MEM(0, BPF_REG_10, -4, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_ST_MEM(0, BPF_REG_10, -4, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_in_map = { 3 },
-               .errstr = "R1 type=map_value_or_null expected=map_ptr",
-               .result = REJECT,
-       },
-       {
-               "ld_abs: check calling conv, r1",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
-                       BPF_MOV64_IMM(BPF_REG_1, 0),
-                       BPF_LD_ABS(BPF_W, -0x200000),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R1 !read_ok",
-               .result = REJECT,
-       },
-       {
-               "ld_abs: check calling conv, r2",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_LD_ABS(BPF_W, -0x200000),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R2 !read_ok",
-               .result = REJECT,
-       },
-       {
-               "ld_abs: check calling conv, r3",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
-                       BPF_MOV64_IMM(BPF_REG_3, 0),
-                       BPF_LD_ABS(BPF_W, -0x200000),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R3 !read_ok",
-               .result = REJECT,
-       },
-       {
-               "ld_abs: check calling conv, r4",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
-                       BPF_MOV64_IMM(BPF_REG_4, 0),
-                       BPF_LD_ABS(BPF_W, -0x200000),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R4 !read_ok",
-               .result = REJECT,
-       },
-       {
-               "ld_abs: check calling conv, r5",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
-                       BPF_MOV64_IMM(BPF_REG_5, 0),
-                       BPF_LD_ABS(BPF_W, -0x200000),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R5 !read_ok",
-               .result = REJECT,
-       },
-       {
-               "ld_abs: check calling conv, r7",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
-                       BPF_MOV64_IMM(BPF_REG_7, 0),
-                       BPF_LD_ABS(BPF_W, -0x200000),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-       },
-       {
-               "ld_abs: tests on r6 and skb data reload helper",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
-                       BPF_LD_ABS(BPF_B, 0),
-                       BPF_LD_ABS(BPF_H, 0),
-                       BPF_LD_ABS(BPF_W, 0),
-                       BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
-                       BPF_MOV64_IMM(BPF_REG_6, 0),
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
-                       BPF_MOV64_IMM(BPF_REG_2, 1),
-                       BPF_MOV64_IMM(BPF_REG_3, 2),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_skb_vlan_push),
-                       BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
-                       BPF_LD_ABS(BPF_B, 0),
-                       BPF_LD_ABS(BPF_H, 0),
-                       BPF_LD_ABS(BPF_W, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 42),
-                       BPF_EXIT_INSN(),
-               },
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-               .result = ACCEPT,
-               .retval = 42 /* ultimate return value */,
-       },
-       {
-               "ld_ind: check calling conv, r1",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
-                       BPF_MOV64_IMM(BPF_REG_1, 1),
-                       BPF_LD_IND(BPF_W, BPF_REG_1, -0x200000),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R1 !read_ok",
-               .result = REJECT,
-       },
-       {
-               "ld_ind: check calling conv, r2",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
-                       BPF_MOV64_IMM(BPF_REG_2, 1),
-                       BPF_LD_IND(BPF_W, BPF_REG_2, -0x200000),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R2 !read_ok",
-               .result = REJECT,
-       },
-       {
-               "ld_ind: check calling conv, r3",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
-                       BPF_MOV64_IMM(BPF_REG_3, 1),
-                       BPF_LD_IND(BPF_W, BPF_REG_3, -0x200000),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R3 !read_ok",
-               .result = REJECT,
-       },
-       {
-               "ld_ind: check calling conv, r4",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
-                       BPF_MOV64_IMM(BPF_REG_4, 1),
-                       BPF_LD_IND(BPF_W, BPF_REG_4, -0x200000),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R4 !read_ok",
-               .result = REJECT,
-       },
-       {
-               "ld_ind: check calling conv, r5",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
-                       BPF_MOV64_IMM(BPF_REG_5, 1),
-                       BPF_LD_IND(BPF_W, BPF_REG_5, -0x200000),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R5 !read_ok",
-               .result = REJECT,
-       },
-       {
-               "ld_ind: check calling conv, r7",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
-                       BPF_MOV64_IMM(BPF_REG_7, 1),
-                       BPF_LD_IND(BPF_W, BPF_REG_7, -0x200000),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .retval = 1,
-       },
-       {
-               "check bpf_perf_event_data->sample_period byte load permitted",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-#if __BYTE_ORDER == __LITTLE_ENDIAN
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct bpf_perf_event_data, sample_period)),
-#else
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct bpf_perf_event_data, sample_period) + 7),
-#endif
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_PERF_EVENT,
-       },
-       {
-               "check bpf_perf_event_data->sample_period half load permitted",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-#if __BYTE_ORDER == __LITTLE_ENDIAN
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct bpf_perf_event_data, sample_period)),
-#else
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct bpf_perf_event_data, sample_period) + 6),
-#endif
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_PERF_EVENT,
-       },
-       {
-               "check bpf_perf_event_data->sample_period word load permitted",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-#if __BYTE_ORDER == __LITTLE_ENDIAN
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct bpf_perf_event_data, sample_period)),
-#else
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct bpf_perf_event_data, sample_period) + 4),
-#endif
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_PERF_EVENT,
-       },
-       {
-               "check bpf_perf_event_data->sample_period dword load permitted",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct bpf_perf_event_data, sample_period)),
-                       BPF_EXIT_INSN(),
-               },
-               .result = ACCEPT,
-               .prog_type = BPF_PROG_TYPE_PERF_EVENT,
-       },
-       {
-               "check skb->data half load not permitted",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-#if __BYTE_ORDER == __LITTLE_ENDIAN
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data)),
-#else
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, data) + 2),
-#endif
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "invalid bpf_context access",
-       },
-       {
-               "check skb->tc_classid half load not permitted for lwt prog",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-#if __BYTE_ORDER == __LITTLE_ENDIAN
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, tc_classid)),
-#else
-                       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
-                                   offsetof(struct __sk_buff, tc_classid) + 2),
-#endif
-                       BPF_EXIT_INSN(),
-               },
-               .result = REJECT,
-               .errstr = "invalid bpf_context access",
-               .prog_type = BPF_PROG_TYPE_LWT_IN,
-       },
-       {
-               "bounds checks mixing signed and unsigned, positive bounds",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
-                       BPF_MOV64_IMM(BPF_REG_2, 2),
-                       BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 3),
-                       BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 4, 2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr = "unbounded min value",
-               .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
-               .result = REJECT,
-       },
-       {
-               "bounds checks mixing signed and unsigned",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
-                       BPF_MOV64_IMM(BPF_REG_2, -1),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
-                       BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr = "unbounded min value",
-               .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
-               .result = REJECT,
-       },
-       {
-               "bounds checks mixing signed and unsigned, variant 2",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
-                       BPF_MOV64_IMM(BPF_REG_2, -1),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
-                       BPF_MOV64_IMM(BPF_REG_8, 0),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_1),
-                       BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
-                       BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr = "unbounded min value",
-               .errstr_unpriv = "R8 has unknown scalar with mixed signed bounds",
-               .result = REJECT,
-       },
-       {
-               "bounds checks mixing signed and unsigned, variant 3",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
-                       BPF_MOV64_IMM(BPF_REG_2, -1),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 4),
-                       BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
-                       BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
-                       BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr = "unbounded min value",
-               .errstr_unpriv = "R8 has unknown scalar with mixed signed bounds",
-               .result = REJECT,
-       },
-       {
-               "bounds checks mixing signed and unsigned, variant 4",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
-                       BPF_MOV64_IMM(BPF_REG_2, 1),
-                       BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
-                       BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .result = ACCEPT,
-       },
-       {
-               "bounds checks mixing signed and unsigned, variant 5",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
-                       BPF_MOV64_IMM(BPF_REG_2, -1),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
-                       BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 4),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 4),
-                       BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
-                       BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr = "unbounded min value",
-               .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
-               .result = REJECT,
-       },
-       {
-               "bounds checks mixing signed and unsigned, variant 6",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_MOV64_REG(BPF_REG_3, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, -512),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -16),
-                       BPF_MOV64_IMM(BPF_REG_6, -1),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_6, 5),
-                       BPF_JMP_IMM(BPF_JSGT, BPF_REG_4, 1, 4),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 1),
-                       BPF_MOV64_IMM(BPF_REG_5, 0),
-                       BPF_ST_MEM(BPF_H, BPF_REG_10, -512, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_skb_load_bytes),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R4 min value is negative, either use unsigned",
-               .result = REJECT,
-       },
-       {
-               "bounds checks mixing signed and unsigned, variant 7",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
-                       BPF_MOV64_IMM(BPF_REG_2, 1024 * 1024 * 1024),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
-                       BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .result = ACCEPT,
-       },
-       {
-               "bounds checks mixing signed and unsigned, variant 8",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
-                       BPF_MOV64_IMM(BPF_REG_2, -1),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr = "unbounded min value",
-               .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
-               .result = REJECT,
-       },
-       {
-               "bounds checks mixing signed and unsigned, variant 9",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
-                       BPF_LD_IMM64(BPF_REG_2, -9223372036854775808ULL),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .result = ACCEPT,
-       },
-       {
-               "bounds checks mixing signed and unsigned, variant 10",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
-                       BPF_MOV64_IMM(BPF_REG_2, 0),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr = "unbounded min value",
-               .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
-               .result = REJECT,
-       },
-       {
-               "bounds checks mixing signed and unsigned, variant 11",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
-                       BPF_MOV64_IMM(BPF_REG_2, -1),
-                       BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
-                       /* Dead branch. */
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr = "unbounded min value",
-               .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
-               .result = REJECT,
-       },
-       {
-               "bounds checks mixing signed and unsigned, variant 12",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
-                       BPF_MOV64_IMM(BPF_REG_2, -6),
-                       BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr = "unbounded min value",
-               .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
-               .result = REJECT,
-       },
-       {
-               "bounds checks mixing signed and unsigned, variant 13",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
-                       BPF_MOV64_IMM(BPF_REG_2, 2),
-                       BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
-                       BPF_MOV64_IMM(BPF_REG_7, 1),
-                       BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 0, 2),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_1),
-                       BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 4, 2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_7),
-                       BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr = "unbounded min value",
-               .errstr_unpriv = "R7 has unknown scalar with mixed signed bounds",
-               .result = REJECT,
-       },
-       {
-               "bounds checks mixing signed and unsigned, variant 14",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
-                                   offsetof(struct __sk_buff, mark)),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
-                       BPF_MOV64_IMM(BPF_REG_2, -1),
-                       BPF_MOV64_IMM(BPF_REG_8, 2),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_9, 42, 6),
-                       BPF_JMP_REG(BPF_JSGT, BPF_REG_8, BPF_REG_1, 3),
-                       BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, -3),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, -7),
-               },
-               .fixup_map_hash_8b = { 4 },
-               .errstr = "unbounded min value",
-               .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
-               .result = REJECT,
-       },
-       {
-               "bounds checks mixing signed and unsigned, variant 15",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
-                       BPF_MOV64_IMM(BPF_REG_2, -6),
-                       BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_JMP_IMM(BPF_JGT, BPF_REG_0, 1, 2),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr = "unbounded min value",
-               .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
-               .result = REJECT,
-               .result_unpriv = REJECT,
-       },
-       {
-               "subtraction bounds (map value) variant 1",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0xff, 7),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
-                       BPF_JMP_IMM(BPF_JGT, BPF_REG_3, 0xff, 5),
-                       BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_3),
-                       BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 56),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr = "R0 max value is outside of the array range",
-               .result = REJECT,
-       },
-       {
-               "subtraction bounds (map value) variant 2",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0xff, 6),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
-                       BPF_JMP_IMM(BPF_JGT, BPF_REG_3, 0xff, 4),
-                       BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_3),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
-               .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
-               .result = REJECT,
-       },
-       {
-               "check subtraction on pointers for unpriv",
-               .insns = {
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_LD_MAP_FD(BPF_REG_ARG1, 0),
-                       BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_ARG2, 0, 9),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_MOV64_REG(BPF_REG_9, BPF_REG_FP),
-                       BPF_ALU64_REG(BPF_SUB, BPF_REG_9, BPF_REG_0),
-                       BPF_LD_MAP_FD(BPF_REG_ARG1, 0),
-                       BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -8),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_ARG2, 0, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
-                       BPF_EXIT_INSN(),
-                       BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_9, 0),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 1, 9 },
-               .result = ACCEPT,
-               .result_unpriv = REJECT,
-               .errstr_unpriv = "R9 pointer -= pointer prohibited",
-       },
-       {
-               "bounds check based on zero-extended MOV",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       /* r2 = 0x0000'0000'ffff'ffff */
-                       BPF_MOV32_IMM(BPF_REG_2, 0xffffffff),
-                       /* r2 = 0 */
-                       BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 32),
-                       /* no-op */
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
-                       /* access at offset 0 */
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
-                       /* exit */
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .result = ACCEPT
-       },
-       {
-               "bounds check based on sign-extended MOV. test1",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       /* r2 = 0xffff'ffff'ffff'ffff */
-                       BPF_MOV64_IMM(BPF_REG_2, 0xffffffff),
-                       /* r2 = 0xffff'ffff */
-                       BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 32),
-                       /* r0 = <oob pointer> */
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
-                       /* access to OOB pointer */
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
-                       /* exit */
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr = "map_value pointer and 4294967295",
-               .result = REJECT
-       },
-       {
-               "bounds check based on sign-extended MOV. test2",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       /* r2 = 0xffff'ffff'ffff'ffff */
-                       BPF_MOV64_IMM(BPF_REG_2, 0xffffffff),
-                       /* r2 = 0xfff'ffff */
-                       BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 36),
-                       /* r0 = <oob pointer> */
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
-                       /* access to OOB pointer */
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
-                       /* exit */
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr = "R0 min value is outside of the array range",
-               .result = REJECT
-       },
-       {
-               "bounds check based on reg_off + var_off + insn_off. test1",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
-                                   offsetof(struct __sk_buff, mark)),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_6, 1),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, (1 << 29) - 1),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_6),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, (1 << 29) - 1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 3),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 4 },
-               .errstr = "value_size=8 off=1073741825",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "bounds check based on reg_off + var_off + insn_off. test2",
-               .insns = {
-                       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
-                                   offsetof(struct __sk_buff, mark)),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_6, 1),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, (1 << 30) - 1),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_6),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, (1 << 29) - 1),
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 3),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 4 },
-               .errstr = "value 1073741823",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-       },
-       {
-               "bounds check after truncation of non-boundary-crossing range",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
-                       /* r1 = [0x00, 0xff] */
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_MOV64_IMM(BPF_REG_2, 1),
-                       /* r2 = 0x10'0000'0000 */
-                       BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 36),
-                       /* r1 = [0x10'0000'0000, 0x10'0000'00ff] */
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
-                       /* r1 = [0x10'7fff'ffff, 0x10'8000'00fe] */
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
-                       /* r1 = [0x00, 0xff] */
-                       BPF_ALU32_IMM(BPF_SUB, BPF_REG_1, 0x7fffffff),
-                       /* r1 = 0 */
-                       BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
-                       /* no-op */
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       /* access at offset 0 */
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
-                       /* exit */
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .result = ACCEPT
-       },
-       {
-               "bounds check after truncation of boundary-crossing range (1)",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
-                       /* r1 = [0x00, 0xff] */
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
-                       /* r1 = [0xffff'ff80, 0x1'0000'007f] */
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
-                       /* r1 = [0xffff'ff80, 0xffff'ffff] or
-                        *      [0x0000'0000, 0x0000'007f]
-                        */
-                       BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 0),
-                       BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
-                       /* r1 = [0x00, 0xff] or
-                        *      [0xffff'ffff'0000'0080, 0xffff'ffff'ffff'ffff]
-                        */
-                       BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
-                       /* r1 = 0 or
-                        *      [0x00ff'ffff'ff00'0000, 0x00ff'ffff'ffff'ffff]
-                        */
-                       BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
-                       /* no-op or OOB pointer computation */
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       /* potentially OOB access */
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
-                       /* exit */
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               /* not actually fully unbounded, but the bound is very high */
-               .errstr = "R0 unbounded memory access",
-               .result = REJECT
-       },
-       {
-               "bounds check after truncation of boundary-crossing range (2)",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
-                       /* r1 = [0x00, 0xff] */
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
-                       /* r1 = [0xffff'ff80, 0x1'0000'007f] */
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
-                       /* r1 = [0xffff'ff80, 0xffff'ffff] or
-                        *      [0x0000'0000, 0x0000'007f]
-                        * difference to previous test: truncation via MOV32
-                        * instead of ALU32.
-                        */
-                       BPF_MOV32_REG(BPF_REG_1, BPF_REG_1),
-                       BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
-                       /* r1 = [0x00, 0xff] or
-                        *      [0xffff'ffff'0000'0080, 0xffff'ffff'ffff'ffff]
-                        */
-                       BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
-                       /* r1 = 0 or
-                        *      [0x00ff'ffff'ff00'0000, 0x00ff'ffff'ffff'ffff]
-                        */
-                       BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
-                       /* no-op or OOB pointer computation */
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       /* potentially OOB access */
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
-                       /* exit */
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               /* not actually fully unbounded, but the bound is very high */
-               .errstr = "R0 unbounded memory access",
-               .result = REJECT
-       },
-       {
-               "bounds check after wrapping 32-bit addition",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
-                       /* r1 = 0x7fff'ffff */
-                       BPF_MOV64_IMM(BPF_REG_1, 0x7fffffff),
-                       /* r1 = 0xffff'fffe */
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
-                       /* r1 = 0 */
-                       BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 2),
-                       /* no-op */
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       /* access at offset 0 */
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
-                       /* exit */
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .result = ACCEPT
-       },
-       {
-               "bounds check after shift with oversized count operand",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
-                       BPF_MOV64_IMM(BPF_REG_2, 32),
-                       BPF_MOV64_IMM(BPF_REG_1, 1),
-                       /* r1 = (u32)1 << (u32)32 = ? */
-                       BPF_ALU32_REG(BPF_LSH, BPF_REG_1, BPF_REG_2),
-                       /* r1 = [0x0000, 0xffff] */
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xffff),
-                       /* computes unknown pointer, potentially OOB */
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       /* potentially OOB access */
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
-                       /* exit */
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr = "R0 max value is outside of the array range",
-               .result = REJECT
-       },
-       {
-               "bounds check after right shift of maybe-negative number",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
-                       /* r1 = [0x00, 0xff] */
-                       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       /* r1 = [-0x01, 0xfe] */
-                       BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 1),
-                       /* r1 = 0 or 0xff'ffff'ffff'ffff */
-                       BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
-                       /* r1 = 0 or 0xffff'ffff'ffff */
-                       BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
-                       /* computes unknown pointer, potentially OOB */
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       /* potentially OOB access */
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
-                       /* exit */
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr = "R0 unbounded memory access",
-               .result = REJECT
-       },
-       {
-               "bounds check after 32-bit right shift with 64-bit input",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
-                       /* r1 = 2 */
-                       BPF_MOV64_IMM(BPF_REG_1, 2),
-                       /* r1 = 1<<32 */
-                       BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 31),
-                       /* r1 = 0 (NOT 2!) */
-                       BPF_ALU32_IMM(BPF_RSH, BPF_REG_1, 31),
-                       /* r1 = 0xffff'fffe (NOT 0!) */
-                       BPF_ALU32_IMM(BPF_SUB, BPF_REG_1, 2),
-                       /* computes OOB pointer */
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       /* OOB access */
-                       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
-                       /* exit */
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr = "R0 invalid mem access",
-               .result = REJECT,
-       },
-       {
-               "bounds check map access with off+size signed 32bit overflow. test1",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
-                       BPF_EXIT_INSN(),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x7ffffffe),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
-                       BPF_JMP_A(0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr = "map_value pointer and 2147483646",
-               .result = REJECT
-       },
-       {
-               "bounds check map access with off+size signed 32bit overflow. test2",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
-                       BPF_EXIT_INSN(),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
-                       BPF_JMP_A(0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr = "pointer offset 1073741822",
-               .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
-               .result = REJECT
-       },
-       {
-               "bounds check map access with off+size signed 32bit overflow. test3",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
-                       BPF_EXIT_INSN(),
-                       BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 0x1fffffff),
-                       BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 0x1fffffff),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 2),
-                       BPF_JMP_A(0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr = "pointer offset -1073741822",
-               .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
-               .result = REJECT
-       },
-       {
-               "bounds check map access with off+size signed 32bit overflow. test4",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
-                       BPF_EXIT_INSN(),
-                       BPF_MOV64_IMM(BPF_REG_1, 1000000),
-                       BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 1000000),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 2),
-                       BPF_JMP_A(0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .errstr = "map_value pointer and 1000000000000",
-               .result = REJECT
-       },
-       {
-               "pointer/scalar confusion in state equality check (way 1)",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
-                       BPF_JMP_A(1),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
-                       BPF_JMP_A(0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .result = ACCEPT,
-               .retval = POINTER_VALUE,
-               .result_unpriv = REJECT,
-               .errstr_unpriv = "R0 leaks addr as return value"
-       },
-       {
-               "pointer/scalar confusion in state equality check (way 2)",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
-                       BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
-                       BPF_JMP_A(1),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 3 },
-               .result = ACCEPT,
-               .retval = POINTER_VALUE,
-               .result_unpriv = REJECT,
-               .errstr_unpriv = "R0 leaks addr as return value"
-       },
-       {
-               "variable-offset ctx access",
-               .insns = {
-                       /* Get an unknown value */
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
-                       /* Make it small and 4-byte aligned */
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
-                       /* add it to skb.  We now have either &skb->len or
-                        * &skb->pkt_type, but we don't know which
-                        */
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
-                       /* dereference it */
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "variable ctx access var_off=(0x0; 0x4)",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_LWT_IN,
-       },
-       {
-               "variable-offset stack access",
-               .insns = {
-                       /* Fill the top 8 bytes of the stack */
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       /* Get an unknown value */
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
-                       /* Make it small and 4-byte aligned */
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
-                       BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 8),
-                       /* add it to fp.  We now have either fp-4 or fp-8, but
-                        * we don't know which
-                        */
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
-                       /* dereference it */
-                       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_2, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "variable stack access var_off=(0xfffffffffffffff8; 0x4)",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_LWT_IN,
-       },
-       {
-               "indirect variable-offset stack access",
-               .insns = {
-                       /* Fill the top 8 bytes of the stack */
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       /* Get an unknown value */
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
-                       /* Make it small and 4-byte aligned */
-                       BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
-                       BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 8),
-                       /* add it to fp.  We now have either fp-4 or fp-8, but
-                        * we don't know which
-                        */
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
-                       /* dereference it indirectly */
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_8b = { 5 },
-               .errstr = "variable stack read R2",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_LWT_IN,
-       },
-       {
-               "direct stack access with 32-bit wraparound. test1",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
-                       BPF_MOV32_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_EXIT_INSN()
-               },
-               .errstr = "fp pointer and 2147483647",
-               .result = REJECT
-       },
-       {
-               "direct stack access with 32-bit wraparound. test2",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x3fffffff),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x3fffffff),
-                       BPF_MOV32_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_EXIT_INSN()
-               },
-               .errstr = "fp pointer and 1073741823",
-               .result = REJECT
-       },
-       {
-               "direct stack access with 32-bit wraparound. test3",
-               .insns = {
-                       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x1fffffff),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x1fffffff),
-                       BPF_MOV32_IMM(BPF_REG_0, 0),
-                       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_EXIT_INSN()
-               },
-               .errstr = "fp pointer offset 1073741822",
-               .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
-               .result = REJECT
-       },
-       {
-               "liveness pruning and write screening",
-               .insns = {
-                       /* Get an unknown value */
-                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
-                       /* branch conditions teach us nothing about R2 */
-                       BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),
-                       BPF_MOV64_IMM(BPF_REG_0, 0),
-                       BPF_EXIT_INSN(),
-               },
-               .errstr = "R0 !read_ok",
-               .result = REJECT,
-               .prog_type = BPF_PROG_TYPE_LWT_IN,
-       },
-       {
-               "varlen_map_value_access pruning",
-               .insns = {
-                       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
-                       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
-                       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
-                       BPF_LD_MAP_FD(BPF_REG_1, 0),
-                       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
-                                    BPF_FUNC_map_lookup_elem),
-                       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
-                       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
-                       BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
-                       BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
-                       BPF_MOV32_IMM(BPF_REG_1, 0),
-                       BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
-                       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
-                       BPF_JMP_IMM(BPF_JA, 0, 0, 0),
-                       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0,
-                                  offsetof(struct test_val, foo)),
-                       BPF_EXIT_INSN(),
-               },
-               .fixup_map_hash_48b = { 3 },
-               .errstr_unpriv = "R0 leaks addr",
-               .errstr = "R0 unbounded memory access",
-               .result_unpriv = REJECT,
-               .result = REJECT,
-               .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
-       },
        {
                "invalid 64-bit BPF_END",
                .insns = {
diff --git a/tools/testing/selftests/bpf/verifier/and.c b/tools/testing/selftests/bpf/verifier/and.c
new file mode 100644 (file)
index 0000000..e0fad15
--- /dev/null
@@ -0,0 +1,50 @@
+{
+       "invalid and of negative number",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_1, -4),
+       BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr = "R0 max value is outside of the array range",
+       .result = REJECT,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
+{
+       "invalid range check",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 12),
+       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_9, 1),
+       BPF_ALU32_IMM(BPF_MOD, BPF_REG_1, 2),
+       BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 1),
+       BPF_ALU32_REG(BPF_AND, BPF_REG_9, BPF_REG_1),
+       BPF_ALU32_IMM(BPF_ADD, BPF_REG_9, 1),
+       BPF_ALU32_IMM(BPF_RSH, BPF_REG_9, 1),
+       BPF_MOV32_IMM(BPF_REG_3, 1),
+       BPF_ALU32_REG(BPF_SUB, BPF_REG_3, BPF_REG_9),
+       BPF_ALU32_IMM(BPF_MUL, BPF_REG_3, 0x10000000),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
+       BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_3, 0),
+       BPF_MOV64_REG(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr = "R0 max value is outside of the array range",
+       .result = REJECT,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
diff --git a/tools/testing/selftests/bpf/verifier/array_access.c b/tools/testing/selftests/bpf/verifier/array_access.c
new file mode 100644 (file)
index 0000000..0dcecaf
--- /dev/null
@@ -0,0 +1,219 @@
+{
+       "valid map access into an array with a constant",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr_unpriv = "R0 leaks addr",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+},
+{
+       "valid map access into an array with a register",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_MOV64_IMM(BPF_REG_1, 4),
+       BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr_unpriv = "R0 leaks addr",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
+{
+       "valid map access into an array with a variable",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
+       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 3),
+       BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr_unpriv = "R0 leaks addr",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
+{
+       "valid map access into an array with a signed variable",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
+       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 0xffffffff, 1),
+       BPF_MOV32_IMM(BPF_REG_1, 0),
+       BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
+       BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
+       BPF_MOV32_IMM(BPF_REG_1, 0),
+       BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr_unpriv = "R0 leaks addr",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
+{
+       "invalid map access into an array with a constant",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+       BPF_ST_MEM(BPF_DW, BPF_REG_0, (MAX_ENTRIES + 1) << 2,
+                  offsetof(struct test_val, foo)),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr = "invalid access to map value, value_size=48 off=48 size=8",
+       .result = REJECT,
+},
+{
+       "invalid map access into an array with a register",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_MOV64_IMM(BPF_REG_1, MAX_ENTRIES + 1),
+       BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr = "R0 min value is outside of the array range",
+       .result = REJECT,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
+{
+       "invalid map access into an array with a variable",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
+       BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr = "R0 unbounded memory access, make sure to bounds check any array access into a map",
+       .result = REJECT,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
+{
+       "invalid map access into an array with no floor check",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
+       BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
+       BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
+       BPF_MOV32_IMM(BPF_REG_1, 0),
+       BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr_unpriv = "R0 leaks addr",
+       .errstr = "R0 unbounded memory access",
+       .result_unpriv = REJECT,
+       .result = REJECT,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
+{
+       "invalid map access into an array with a invalid max check",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
+       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
+       BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES + 1),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
+       BPF_MOV32_IMM(BPF_REG_1, 0),
+       BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr_unpriv = "R0 leaks addr",
+       .errstr = "invalid access to map value, value_size=48 off=44 size=8",
+       .result_unpriv = REJECT,
+       .result = REJECT,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
+{
+       "invalid map access into an array with a invalid max check",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
+       BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
+                   offsetof(struct test_val, foo)),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3, 11 },
+       .errstr = "R0 pointer += pointer",
+       .result = REJECT,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
diff --git a/tools/testing/selftests/bpf/verifier/basic.c b/tools/testing/selftests/bpf/verifier/basic.c
new file mode 100644 (file)
index 0000000..b8d1864
--- /dev/null
@@ -0,0 +1,23 @@
+{
+       "empty prog",
+       .insns = {
+       },
+       .errstr = "unknown opcode 00",
+       .result = REJECT,
+},
+{
+       "only exit insn",
+       .insns = {
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R0 !read_ok",
+       .result = REJECT,
+},
+{
+       "no bpf_exit",
+       .insns = {
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_0, BPF_REG_2),
+       },
+       .errstr = "not an exit",
+       .result = REJECT,
+},
diff --git a/tools/testing/selftests/bpf/verifier/basic_call.c b/tools/testing/selftests/bpf/verifier/basic_call.c
new file mode 100644 (file)
index 0000000..a8c6ab4
--- /dev/null
@@ -0,0 +1,50 @@
+{
+       "invalid call insn1",
+       .insns = {
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL | BPF_X, 0, 0, 0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "unknown opcode 8d",
+       .result = REJECT,
+},
+{
+       "invalid call insn2",
+       .insns = {
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 1, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "BPF_CALL uses reserved",
+       .result = REJECT,
+},
+{
+       "invalid function call",
+       .insns = {
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, 1234567),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid func unknown#1234567",
+       .result = REJECT,
+},
+{
+       "invalid argument register",
+       .insns = {
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_cgroup_classid),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_cgroup_classid),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R1 !read_ok",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "non-invalid argument register",
+       .insns = {
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_cgroup_classid),
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_1, BPF_REG_6),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_cgroup_classid),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
diff --git a/tools/testing/selftests/bpf/verifier/basic_instr.c b/tools/testing/selftests/bpf/verifier/basic_instr.c
new file mode 100644 (file)
index 0000000..a18686a
--- /dev/null
@@ -0,0 +1,92 @@
+{
+       "add+sub+mul",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_1, 1),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 2),
+       BPF_MOV64_IMM(BPF_REG_2, 3),
+       BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -1),
+       BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 3),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .retval = -3,
+},
+{
+       "xor32 zero extend check",
+       .insns = {
+       BPF_MOV32_IMM(BPF_REG_2, -1),
+       BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 32),
+       BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 0xffff),
+       BPF_ALU32_REG(BPF_XOR, BPF_REG_2, BPF_REG_2),
+       BPF_MOV32_IMM(BPF_REG_0, 2),
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 1),
+       BPF_MOV32_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .result = ACCEPT,
+       .retval = 1,
+},
+{
+       "arsh32 on imm",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_ALU32_IMM(BPF_ARSH, BPF_REG_0, 5),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .retval = 0,
+},
+{
+       "arsh32 on imm 2",
+       .insns = {
+       BPF_LD_IMM64(BPF_REG_0, 0x1122334485667788),
+       BPF_ALU32_IMM(BPF_ARSH, BPF_REG_0, 7),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .retval = -16069393,
+},
+{
+       "arsh32 on reg",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_MOV64_IMM(BPF_REG_1, 5),
+       BPF_ALU32_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .retval = 0,
+},
+{
+       "arsh32 on reg 2",
+       .insns = {
+       BPF_LD_IMM64(BPF_REG_0, 0xffff55667788),
+       BPF_MOV64_IMM(BPF_REG_1, 15),
+       BPF_ALU32_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .retval = 43724,
+},
+{
+       "arsh64 on imm",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_ALU64_IMM(BPF_ARSH, BPF_REG_0, 5),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+},
+{
+       "arsh64 on reg",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_MOV64_IMM(BPF_REG_1, 5),
+       BPF_ALU64_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+},
diff --git a/tools/testing/selftests/bpf/verifier/basic_stack.c b/tools/testing/selftests/bpf/verifier/basic_stack.c
new file mode 100644 (file)
index 0000000..b56f811
--- /dev/null
@@ -0,0 +1,64 @@
+{
+       "stack out of bounds",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, 8, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid stack",
+       .result = REJECT,
+},
+{
+       "uninitialized stack1",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 2 },
+       .errstr = "invalid indirect read from stack",
+       .result = REJECT,
+},
+{
+       "uninitialized stack2",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -8),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid read from stack",
+       .result = REJECT,
+},
+{
+       "invalid fp arithmetic",
+       /* If this gets ever changed, make sure JITs can deal with it. */
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 8),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R1 subtraction from stack pointer",
+       .result = REJECT,
+},
+{
+       "non-invalid fp arithmetic",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+},
+{
+       "misaligned read from stack",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -4),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "misaligned stack access",
+       .result = REJECT,
+},
diff --git a/tools/testing/selftests/bpf/verifier/basic_stx_ldx.c b/tools/testing/selftests/bpf/verifier/basic_stx_ldx.c
new file mode 100644 (file)
index 0000000..7a0aab3
--- /dev/null
@@ -0,0 +1,45 @@
+{
+       "invalid src register in STX",
+       .insns = {
+       BPF_STX_MEM(BPF_B, BPF_REG_10, -1, -1),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R15 is invalid",
+       .result = REJECT,
+},
+{
+       "invalid dst register in STX",
+       .insns = {
+       BPF_STX_MEM(BPF_B, 14, BPF_REG_10, -1),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R14 is invalid",
+       .result = REJECT,
+},
+{
+       "invalid dst register in ST",
+       .insns = {
+       BPF_ST_MEM(BPF_B, 14, -1, -1),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R14 is invalid",
+       .result = REJECT,
+},
+{
+       "invalid src register in LDX",
+       .insns = {
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, 12, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R12 is invalid",
+       .result = REJECT,
+},
+{
+       "invalid dst register in LDX",
+       .insns = {
+       BPF_LDX_MEM(BPF_B, 11, BPF_REG_1, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R11 is invalid",
+       .result = REJECT,
+},
diff --git a/tools/testing/selftests/bpf/verifier/bounds.c b/tools/testing/selftests/bpf/verifier/bounds.c
new file mode 100644 (file)
index 0000000..d55f476
--- /dev/null
@@ -0,0 +1,508 @@
+{
+       "subtraction bounds (map value) variant 1",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0xff, 7),
+       BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
+       BPF_JMP_IMM(BPF_JGT, BPF_REG_3, 0xff, 5),
+       BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_3),
+       BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 56),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr = "R0 max value is outside of the array range",
+       .result = REJECT,
+},
+{
+       "subtraction bounds (map value) variant 2",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0xff, 6),
+       BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
+       BPF_JMP_IMM(BPF_JGT, BPF_REG_3, 0xff, 4),
+       BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_3),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
+       .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
+       .result = REJECT,
+},
+{
+       "check subtraction on pointers for unpriv",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_LD_MAP_FD(BPF_REG_ARG1, 0),
+       BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_ARG2, 0, 9),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_MOV64_REG(BPF_REG_9, BPF_REG_FP),
+       BPF_ALU64_REG(BPF_SUB, BPF_REG_9, BPF_REG_0),
+       BPF_LD_MAP_FD(BPF_REG_ARG1, 0),
+       BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_ARG2, 0, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+       BPF_EXIT_INSN(),
+       BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_9, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 1, 9 },
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "R9 pointer -= pointer prohibited",
+},
+{
+       "bounds check based on zero-extended MOV",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       /* r2 = 0x0000'0000'ffff'ffff */
+       BPF_MOV32_IMM(BPF_REG_2, 0xffffffff),
+       /* r2 = 0 */
+       BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 32),
+       /* no-op */
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
+       /* access at offset 0 */
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+       /* exit */
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .result = ACCEPT
+},
+{
+       "bounds check based on sign-extended MOV. test1",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       /* r2 = 0xffff'ffff'ffff'ffff */
+       BPF_MOV64_IMM(BPF_REG_2, 0xffffffff),
+       /* r2 = 0xffff'ffff */
+       BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 32),
+       /* r0 = <oob pointer> */
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
+       /* access to OOB pointer */
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+       /* exit */
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr = "map_value pointer and 4294967295",
+       .result = REJECT
+},
+{
+       "bounds check based on sign-extended MOV. test2",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       /* r2 = 0xffff'ffff'ffff'ffff */
+       BPF_MOV64_IMM(BPF_REG_2, 0xffffffff),
+       /* r2 = 0xfff'ffff */
+       BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 36),
+       /* r0 = <oob pointer> */
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
+       /* access to OOB pointer */
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+       /* exit */
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr = "R0 min value is outside of the array range",
+       .result = REJECT
+},
+{
+       "bounds check based on reg_off + var_off + insn_off. test1",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
+                   offsetof(struct __sk_buff, mark)),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_6, 1),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, (1 << 29) - 1),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_6),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, (1 << 29) - 1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 3),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 4 },
+       .errstr = "value_size=8 off=1073741825",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "bounds check based on reg_off + var_off + insn_off. test2",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
+                   offsetof(struct __sk_buff, mark)),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_6, 1),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, (1 << 30) - 1),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_6),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, (1 << 29) - 1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 3),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 4 },
+       .errstr = "value 1073741823",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "bounds check after truncation of non-boundary-crossing range",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
+       /* r1 = [0x00, 0xff] */
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_2, 1),
+       /* r2 = 0x10'0000'0000 */
+       BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 36),
+       /* r1 = [0x10'0000'0000, 0x10'0000'00ff] */
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
+       /* r1 = [0x10'7fff'ffff, 0x10'8000'00fe] */
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
+       /* r1 = [0x00, 0xff] */
+       BPF_ALU32_IMM(BPF_SUB, BPF_REG_1, 0x7fffffff),
+       /* r1 = 0 */
+       BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
+       /* no-op */
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       /* access at offset 0 */
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+       /* exit */
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .result = ACCEPT
+},
+{
+       "bounds check after truncation of boundary-crossing range (1)",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
+       /* r1 = [0x00, 0xff] */
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
+       /* r1 = [0xffff'ff80, 0x1'0000'007f] */
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
+       /* r1 = [0xffff'ff80, 0xffff'ffff] or
+        *      [0x0000'0000, 0x0000'007f]
+        */
+       BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 0),
+       BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
+       /* r1 = [0x00, 0xff] or
+        *      [0xffff'ffff'0000'0080, 0xffff'ffff'ffff'ffff]
+        */
+       BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
+       /* r1 = 0 or
+        *      [0x00ff'ffff'ff00'0000, 0x00ff'ffff'ffff'ffff]
+        */
+       BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
+       /* no-op or OOB pointer computation */
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       /* potentially OOB access */
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+       /* exit */
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       /* not actually fully unbounded, but the bound is very high */
+       .errstr = "R0 unbounded memory access",
+       .result = REJECT
+},
+{
+       "bounds check after truncation of boundary-crossing range (2)",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
+       /* r1 = [0x00, 0xff] */
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
+       /* r1 = [0xffff'ff80, 0x1'0000'007f] */
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
+       /* r1 = [0xffff'ff80, 0xffff'ffff] or
+        *      [0x0000'0000, 0x0000'007f]
+        * difference to previous test: truncation via MOV32
+        * instead of ALU32.
+        */
+       BPF_MOV32_REG(BPF_REG_1, BPF_REG_1),
+       BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
+       /* r1 = [0x00, 0xff] or
+        *      [0xffff'ffff'0000'0080, 0xffff'ffff'ffff'ffff]
+        */
+       BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
+       /* r1 = 0 or
+        *      [0x00ff'ffff'ff00'0000, 0x00ff'ffff'ffff'ffff]
+        */
+       BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
+       /* no-op or OOB pointer computation */
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       /* potentially OOB access */
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+       /* exit */
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       /* not actually fully unbounded, but the bound is very high */
+       .errstr = "R0 unbounded memory access",
+       .result = REJECT
+},
+{
+       "bounds check after wrapping 32-bit addition",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
+       /* r1 = 0x7fff'ffff */
+       BPF_MOV64_IMM(BPF_REG_1, 0x7fffffff),
+       /* r1 = 0xffff'fffe */
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
+       /* r1 = 0 */
+       BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 2),
+       /* no-op */
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       /* access at offset 0 */
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+       /* exit */
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .result = ACCEPT
+},
+{
+       "bounds check after shift with oversized count operand",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
+       BPF_MOV64_IMM(BPF_REG_2, 32),
+       BPF_MOV64_IMM(BPF_REG_1, 1),
+       /* r1 = (u32)1 << (u32)32 = ? */
+       BPF_ALU32_REG(BPF_LSH, BPF_REG_1, BPF_REG_2),
+       /* r1 = [0x0000, 0xffff] */
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xffff),
+       /* computes unknown pointer, potentially OOB */
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       /* potentially OOB access */
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+       /* exit */
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr = "R0 max value is outside of the array range",
+       .result = REJECT
+},
+{
+       "bounds check after right shift of maybe-negative number",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
+       /* r1 = [0x00, 0xff] */
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       /* r1 = [-0x01, 0xfe] */
+       BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 1),
+       /* r1 = 0 or 0xff'ffff'ffff'ffff */
+       BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
+       /* r1 = 0 or 0xffff'ffff'ffff */
+       BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
+       /* computes unknown pointer, potentially OOB */
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       /* potentially OOB access */
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+       /* exit */
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr = "R0 unbounded memory access",
+       .result = REJECT
+},
+{
+       "bounds check after 32-bit right shift with 64-bit input",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
+       /* r1 = 2 */
+       BPF_MOV64_IMM(BPF_REG_1, 2),
+       /* r1 = 1<<32 */
+       BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 31),
+       /* r1 = 0 (NOT 2!) */
+       BPF_ALU32_IMM(BPF_RSH, BPF_REG_1, 31),
+       /* r1 = 0xffff'fffe (NOT 0!) */
+       BPF_ALU32_IMM(BPF_SUB, BPF_REG_1, 2),
+       /* computes OOB pointer */
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       /* OOB access */
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+       /* exit */
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr = "R0 invalid mem access",
+       .result = REJECT,
+},
+{
+       "bounds check map access with off+size signed 32bit overflow. test1",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+       BPF_EXIT_INSN(),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x7ffffffe),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
+       BPF_JMP_A(0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr = "map_value pointer and 2147483646",
+       .result = REJECT
+},
+{
+       "bounds check map access with off+size signed 32bit overflow. test2",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+       BPF_EXIT_INSN(),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
+       BPF_JMP_A(0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr = "pointer offset 1073741822",
+       .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
+       .result = REJECT
+},
+{
+       "bounds check map access with off+size signed 32bit overflow. test3",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+       BPF_EXIT_INSN(),
+       BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 0x1fffffff),
+       BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 0x1fffffff),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 2),
+       BPF_JMP_A(0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr = "pointer offset -1073741822",
+       .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
+       .result = REJECT
+},
+{
+       "bounds check map access with off+size signed 32bit overflow. test4",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+       BPF_EXIT_INSN(),
+       BPF_MOV64_IMM(BPF_REG_1, 1000000),
+       BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 1000000),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 2),
+       BPF_JMP_A(0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr = "map_value pointer and 1000000000000",
+       .result = REJECT
+},
diff --git a/tools/testing/selftests/bpf/verifier/bounds_mix_sign_unsign.c b/tools/testing/selftests/bpf/verifier/bounds_mix_sign_unsign.c
new file mode 100644 (file)
index 0000000..9baca7a
--- /dev/null
@@ -0,0 +1,406 @@
+{
+       "bounds checks mixing signed and unsigned, positive bounds",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+       BPF_MOV64_IMM(BPF_REG_2, 2),
+       BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 3),
+       BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 4, 2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr = "unbounded min value",
+       .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
+       .result = REJECT,
+},
+{
+       "bounds checks mixing signed and unsigned",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+       BPF_MOV64_IMM(BPF_REG_2, -1),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
+       BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr = "unbounded min value",
+       .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
+       .result = REJECT,
+},
+{
+       "bounds checks mixing signed and unsigned, variant 2",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+       BPF_MOV64_IMM(BPF_REG_2, -1),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
+       BPF_MOV64_IMM(BPF_REG_8, 0),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_1),
+       BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
+       BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr = "unbounded min value",
+       .errstr_unpriv = "R8 has unknown scalar with mixed signed bounds",
+       .result = REJECT,
+},
+{
+       "bounds checks mixing signed and unsigned, variant 3",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+       BPF_MOV64_IMM(BPF_REG_2, -1),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 4),
+       BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
+       BPF_JMP_IMM(BPF_JSGT, BPF_REG_8, 1, 2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_8),
+       BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr = "unbounded min value",
+       .errstr_unpriv = "R8 has unknown scalar with mixed signed bounds",
+       .result = REJECT,
+},
+{
+       "bounds checks mixing signed and unsigned, variant 4",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+       BPF_MOV64_IMM(BPF_REG_2, 1),
+       BPF_ALU64_REG(BPF_AND, BPF_REG_1, BPF_REG_2),
+       BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .result = ACCEPT,
+},
+{
+       "bounds checks mixing signed and unsigned, variant 5",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+       BPF_MOV64_IMM(BPF_REG_2, -1),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 5),
+       BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 4),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 4),
+       BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
+       BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr = "unbounded min value",
+       .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
+       .result = REJECT,
+},
+{
+       "bounds checks mixing signed and unsigned, variant 6",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, -512),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -16),
+       BPF_MOV64_IMM(BPF_REG_6, -1),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_6, 5),
+       BPF_JMP_IMM(BPF_JSGT, BPF_REG_4, 1, 4),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 1),
+       BPF_MOV64_IMM(BPF_REG_5, 0),
+       BPF_ST_MEM(BPF_H, BPF_REG_10, -512, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R4 min value is negative, either use unsigned",
+       .result = REJECT,
+},
+{
+       "bounds checks mixing signed and unsigned, variant 7",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+       BPF_MOV64_IMM(BPF_REG_2, 1024 * 1024 * 1024),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
+       BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .result = ACCEPT,
+},
+{
+       "bounds checks mixing signed and unsigned, variant 8",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+       BPF_MOV64_IMM(BPF_REG_2, -1),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr = "unbounded min value",
+       .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
+       .result = REJECT,
+},
+{
+       "bounds checks mixing signed and unsigned, variant 9",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+       BPF_LD_IMM64(BPF_REG_2, -9223372036854775808ULL),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .result = ACCEPT,
+},
+{
+       "bounds checks mixing signed and unsigned, variant 10",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr = "unbounded min value",
+       .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
+       .result = REJECT,
+},
+{
+       "bounds checks mixing signed and unsigned, variant 11",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+       BPF_MOV64_IMM(BPF_REG_2, -1),
+       BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
+       /* Dead branch. */
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr = "unbounded min value",
+       .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
+       .result = REJECT,
+},
+{
+       "bounds checks mixing signed and unsigned, variant 12",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+       BPF_MOV64_IMM(BPF_REG_2, -6),
+       BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr = "unbounded min value",
+       .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
+       .result = REJECT,
+},
+{
+       "bounds checks mixing signed and unsigned, variant 13",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+       BPF_MOV64_IMM(BPF_REG_2, 2),
+       BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
+       BPF_MOV64_IMM(BPF_REG_7, 1),
+       BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 0, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_1),
+       BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, 4, 2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_7),
+       BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr = "unbounded min value",
+       .errstr_unpriv = "R7 has unknown scalar with mixed signed bounds",
+       .result = REJECT,
+},
+{
+       "bounds checks mixing signed and unsigned, variant 14",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
+                   offsetof(struct __sk_buff, mark)),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+       BPF_MOV64_IMM(BPF_REG_2, -1),
+       BPF_MOV64_IMM(BPF_REG_8, 2),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_9, 42, 6),
+       BPF_JMP_REG(BPF_JSGT, BPF_REG_8, BPF_REG_1, 3),
+       BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, -3),
+       BPF_JMP_IMM(BPF_JA, 0, 0, -7),
+       },
+       .fixup_map_hash_8b = { 4 },
+       .errstr = "unbounded min value",
+       .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
+       .result = REJECT,
+},
+{
+       "bounds checks mixing signed and unsigned, variant 15",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+       BPF_MOV64_IMM(BPF_REG_2, -6),
+       BPF_JMP_REG(BPF_JGE, BPF_REG_2, BPF_REG_1, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_JMP_IMM(BPF_JGT, BPF_REG_0, 1, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr = "unbounded min value",
+       .errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
+       .result = REJECT,
+       .result_unpriv = REJECT,
+},
diff --git a/tools/testing/selftests/bpf/verifier/cfg.c b/tools/testing/selftests/bpf/verifier/cfg.c
new file mode 100644 (file)
index 0000000..349c086
--- /dev/null
@@ -0,0 +1,70 @@
+{
+       "unreachable",
+       .insns = {
+       BPF_EXIT_INSN(),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "unreachable",
+       .result = REJECT,
+},
+{
+       "unreachable2",
+       .insns = {
+       BPF_JMP_IMM(BPF_JA, 0, 0, 1),
+       BPF_JMP_IMM(BPF_JA, 0, 0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "unreachable",
+       .result = REJECT,
+},
+{
+       "out of range jump",
+       .insns = {
+       BPF_JMP_IMM(BPF_JA, 0, 0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "jump out of range",
+       .result = REJECT,
+},
+{
+       "out of range jump2",
+       .insns = {
+       BPF_JMP_IMM(BPF_JA, 0, 0, -2),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "jump out of range",
+       .result = REJECT,
+},
+{
+       "loop (back-edge)",
+       .insns = {
+       BPF_JMP_IMM(BPF_JA, 0, 0, -1),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "back-edge",
+       .result = REJECT,
+},
+{
+       "loop2 (back-edge)",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
+       BPF_JMP_IMM(BPF_JA, 0, 0, -4),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "back-edge",
+       .result = REJECT,
+},
+{
+       "conditional loop",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -3),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "back-edge",
+       .result = REJECT,
+},
diff --git a/tools/testing/selftests/bpf/verifier/cgroup_skb.c b/tools/testing/selftests/bpf/verifier/cgroup_skb.c
new file mode 100644 (file)
index 0000000..52e4c03
--- /dev/null
@@ -0,0 +1,197 @@
+{
+       "direct packet read test#1 for CGROUP_SKB",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
+                   offsetof(struct __sk_buff, len)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
+                   offsetof(struct __sk_buff, pkt_type)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
+                   offsetof(struct __sk_buff, mark)),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_6,
+                   offsetof(struct __sk_buff, mark)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
+                   offsetof(struct __sk_buff, queue_mapping)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_8, BPF_REG_1,
+                   offsetof(struct __sk_buff, protocol)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
+                   offsetof(struct __sk_buff, vlan_present)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "invalid bpf_context access off=76 size=4",
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+},
+{
+       "direct packet read test#2 for CGROUP_SKB",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
+                   offsetof(struct __sk_buff, vlan_tci)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
+                   offsetof(struct __sk_buff, vlan_proto)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
+                   offsetof(struct __sk_buff, priority)),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_6,
+                   offsetof(struct __sk_buff, priority)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
+                   offsetof(struct __sk_buff, ingress_ifindex)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_8, BPF_REG_1,
+                   offsetof(struct __sk_buff, tc_index)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
+                   offsetof(struct __sk_buff, hash)),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+},
+{
+       "direct packet read test#3 for CGROUP_SKB",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[0])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[1])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[2])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[3])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_8, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[4])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
+                   offsetof(struct __sk_buff, napi_id)),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_4,
+                   offsetof(struct __sk_buff, cb[0])),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_5,
+                   offsetof(struct __sk_buff, cb[1])),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_6,
+                   offsetof(struct __sk_buff, cb[2])),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_7,
+                   offsetof(struct __sk_buff, cb[3])),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_8,
+                   offsetof(struct __sk_buff, cb[4])),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+},
+{
+       "direct packet read test#4 for CGROUP_SKB",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, family)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, remote_ip4)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
+                   offsetof(struct __sk_buff, local_ip4)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
+                   offsetof(struct __sk_buff, remote_ip6[0])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
+                   offsetof(struct __sk_buff, remote_ip6[1])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
+                   offsetof(struct __sk_buff, remote_ip6[2])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_5, BPF_REG_1,
+                   offsetof(struct __sk_buff, remote_ip6[3])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
+                   offsetof(struct __sk_buff, local_ip6[0])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
+                   offsetof(struct __sk_buff, local_ip6[1])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
+                   offsetof(struct __sk_buff, local_ip6[2])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
+                   offsetof(struct __sk_buff, local_ip6[3])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
+                   offsetof(struct __sk_buff, remote_port)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_8, BPF_REG_1,
+                   offsetof(struct __sk_buff, local_port)),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+},
+{
+       "invalid access of tc_classid for CGROUP_SKB",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, tc_classid)),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "invalid bpf_context access",
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+},
+{
+       "invalid access of data_meta for CGROUP_SKB",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_meta)),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "invalid bpf_context access",
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+},
+{
+       "invalid access of flow_keys for CGROUP_SKB",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, flow_keys)),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "invalid bpf_context access",
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+},
+{
+       "invalid write access to napi_id for CGROUP_SKB",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_9, BPF_REG_1,
+                   offsetof(struct __sk_buff, napi_id)),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_9,
+                   offsetof(struct __sk_buff, napi_id)),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "invalid bpf_context access",
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+},
+{
+       "write tstamp from CGROUP_SKB",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, tstamp)),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "invalid bpf_context access off=152 size=8",
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+},
+{
+       "read tstamp from CGROUP_SKB",
+       .insns = {
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, tstamp)),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+},
diff --git a/tools/testing/selftests/bpf/verifier/cgroup_storage.c b/tools/testing/selftests/bpf/verifier/cgroup_storage.c
new file mode 100644 (file)
index 0000000..97057c0
--- /dev/null
@@ -0,0 +1,220 @@
+{
+       "valid cgroup storage access",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
+       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_cgroup_storage = { 1 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+},
+{
+       "invalid cgroup storage access 1",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
+       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 1 },
+       .result = REJECT,
+       .errstr = "cannot pass map_type 1 into func bpf_get_local_storage",
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+},
+{
+       "invalid cgroup storage access 2",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 1),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "fd 1 is not pointing to valid bpf_map",
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+},
+{
+       "invalid cgroup storage access 3",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
+       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 256),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_cgroup_storage = { 1 },
+       .result = REJECT,
+       .errstr = "invalid access to map value, value_size=64 off=256 size=4",
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+},
+{
+       "invalid cgroup storage access 4",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
+       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, -2),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_cgroup_storage = { 1 },
+       .result = REJECT,
+       .errstr = "invalid access to map value, value_size=64 off=-2 size=4",
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
+{
+       "invalid cgroup storage access 5",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 7),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
+       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_cgroup_storage = { 1 },
+       .result = REJECT,
+       .errstr = "get_local_storage() doesn't support non-zero flags",
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+},
+{
+       "invalid cgroup storage access 6",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
+       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_cgroup_storage = { 1 },
+       .result = REJECT,
+       .errstr = "get_local_storage() doesn't support non-zero flags",
+       .errstr_unpriv = "R2 leaks addr into helper function",
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+},
+{
+       "valid per-cpu cgroup storage access",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
+       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_percpu_cgroup_storage = { 1 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+},
+{
+       "invalid per-cpu cgroup storage access 1",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
+       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 1 },
+       .result = REJECT,
+       .errstr = "cannot pass map_type 1 into func bpf_get_local_storage",
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+},
+{
+       "invalid per-cpu cgroup storage access 2",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 1),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "fd 1 is not pointing to valid bpf_map",
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+},
+{
+       "invalid per-cpu cgroup storage access 3",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
+       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 256),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_percpu_cgroup_storage = { 1 },
+       .result = REJECT,
+       .errstr = "invalid access to map value, value_size=64 off=256 size=4",
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+},
+{
+       "invalid per-cpu cgroup storage access 4",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
+       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, -2),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_cgroup_storage = { 1 },
+       .result = REJECT,
+       .errstr = "invalid access to map value, value_size=64 off=-2 size=4",
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
+{
+       "invalid per-cpu cgroup storage access 5",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 7),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
+       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_percpu_cgroup_storage = { 1 },
+       .result = REJECT,
+       .errstr = "get_local_storage() doesn't support non-zero flags",
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+},
+{
+       "invalid per-cpu cgroup storage access 6",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_1),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_local_storage),
+       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_percpu_cgroup_storage = { 1 },
+       .result = REJECT,
+       .errstr = "get_local_storage() doesn't support non-zero flags",
+       .errstr_unpriv = "R2 leaks addr into helper function",
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+},
diff --git a/tools/testing/selftests/bpf/verifier/const_or.c b/tools/testing/selftests/bpf/verifier/const_or.c
new file mode 100644 (file)
index 0000000..84446df
--- /dev/null
@@ -0,0 +1,60 @@
+{
+       "constant register |= constant should keep constant type",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
+       BPF_MOV64_IMM(BPF_REG_2, 34),
+       BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 13),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "constant register |= constant should not bypass stack boundary checks",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
+       BPF_MOV64_IMM(BPF_REG_2, 34),
+       BPF_ALU64_IMM(BPF_OR, BPF_REG_2, 24),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid stack type R1 off=-48 access_size=58",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "constant register |= constant register should keep constant type",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
+       BPF_MOV64_IMM(BPF_REG_2, 34),
+       BPF_MOV64_IMM(BPF_REG_4, 13),
+       BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "constant register |= constant register should not bypass stack boundary checks",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -48),
+       BPF_MOV64_IMM(BPF_REG_2, 34),
+       BPF_MOV64_IMM(BPF_REG_4, 24),
+       BPF_ALU64_REG(BPF_OR, BPF_REG_2, BPF_REG_4),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid stack type R1 off=-48 access_size=58",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
diff --git a/tools/testing/selftests/bpf/verifier/ctx.c b/tools/testing/selftests/bpf/verifier/ctx.c
new file mode 100644 (file)
index 0000000..0d623af
--- /dev/null
@@ -0,0 +1,23 @@
+{
+       "context stores via ST",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_ST_MEM(BPF_DW, BPF_REG_1, offsetof(struct __sk_buff, mark), 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "BPF_ST stores into R1 ctx is not allowed",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "context stores via XADD",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_W, BPF_REG_1,
+                    BPF_REG_0, offsetof(struct __sk_buff, mark), 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "BPF_XADD stores into R1 ctx is not allowed",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
diff --git a/tools/testing/selftests/bpf/verifier/ctx_sk_msg.c b/tools/testing/selftests/bpf/verifier/ctx_sk_msg.c
new file mode 100644 (file)
index 0000000..b019577
--- /dev/null
@@ -0,0 +1,180 @@
+{
+       "valid access family in SK_MSG",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct sk_msg_md, family)),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SK_MSG,
+},
+{
+       "valid access remote_ip4 in SK_MSG",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct sk_msg_md, remote_ip4)),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SK_MSG,
+},
+{
+       "valid access local_ip4 in SK_MSG",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct sk_msg_md, local_ip4)),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SK_MSG,
+},
+{
+       "valid access remote_port in SK_MSG",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct sk_msg_md, remote_port)),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SK_MSG,
+},
+{
+       "valid access local_port in SK_MSG",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct sk_msg_md, local_port)),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SK_MSG,
+},
+{
+       "valid access remote_ip6 in SK_MSG",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct sk_msg_md, remote_ip6[0])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct sk_msg_md, remote_ip6[1])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct sk_msg_md, remote_ip6[2])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct sk_msg_md, remote_ip6[3])),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SK_SKB,
+},
+{
+       "valid access local_ip6 in SK_MSG",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct sk_msg_md, local_ip6[0])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct sk_msg_md, local_ip6[1])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct sk_msg_md, local_ip6[2])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct sk_msg_md, local_ip6[3])),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SK_SKB,
+},
+{
+       "valid access size in SK_MSG",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct sk_msg_md, size)),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SK_MSG,
+},
+{
+       "invalid 64B read of size in SK_MSG",
+       .insns = {
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct sk_msg_md, size)),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_SK_MSG,
+},
+{
+       "invalid read past end of SK_MSG",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct sk_msg_md, size) + 4),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_SK_MSG,
+},
+{
+       "invalid read offset in SK_MSG",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct sk_msg_md, family) + 1),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_SK_MSG,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
+{
+       "direct packet read for SK_MSG",
+       .insns = {
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct sk_msg_md, data)),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct sk_msg_md, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SK_MSG,
+},
+{
+       "direct packet write for SK_MSG",
+       .insns = {
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct sk_msg_md, data)),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct sk_msg_md, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
+       BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SK_MSG,
+},
+{
+       "overlapping checks for direct packet access SK_MSG",
+       .insns = {
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct sk_msg_md, data)),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct sk_msg_md, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SK_MSG,
+},
diff --git a/tools/testing/selftests/bpf/verifier/ctx_skb.c b/tools/testing/selftests/bpf/verifier/ctx_skb.c
new file mode 100644 (file)
index 0000000..f32e4da
--- /dev/null
@@ -0,0 +1,1001 @@
+{
+       "access skb fields ok",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, len)),
+       BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, mark)),
+       BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, pkt_type)),
+       BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, queue_mapping)),
+       BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, protocol)),
+       BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, vlan_present)),
+       BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, vlan_tci)),
+       BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, napi_id)),
+       BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+},
+{
+       "access skb fields bad1",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -4),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .result = REJECT,
+},
+{
+       "access skb fields bad2",
+       .insns = {
+       BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 9),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+       BPF_EXIT_INSN(),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, pkt_type)),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 4 },
+       .errstr = "different pointers",
+       .errstr_unpriv = "R1 pointer comparison",
+       .result = REJECT,
+},
+{
+       "access skb fields bad3",
+       .insns = {
+       BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, pkt_type)),
+       BPF_EXIT_INSN(),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+       BPF_EXIT_INSN(),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_JMP_IMM(BPF_JA, 0, 0, -12),
+       },
+       .fixup_map_hash_8b = { 6 },
+       .errstr = "different pointers",
+       .errstr_unpriv = "R1 pointer comparison",
+       .result = REJECT,
+},
+{
+       "access skb fields bad4",
+       .insns = {
+       BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 3),
+       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
+                   offsetof(struct __sk_buff, len)),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+       BPF_EXIT_INSN(),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_JMP_IMM(BPF_JA, 0, 0, -13),
+       },
+       .fixup_map_hash_8b = { 7 },
+       .errstr = "different pointers",
+       .errstr_unpriv = "R1 pointer comparison",
+       .result = REJECT,
+},
+{
+       "invalid access __sk_buff family",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, family)),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .result = REJECT,
+},
+{
+       "invalid access __sk_buff remote_ip4",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, remote_ip4)),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .result = REJECT,
+},
+{
+       "invalid access __sk_buff local_ip4",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, local_ip4)),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .result = REJECT,
+},
+{
+       "invalid access __sk_buff remote_ip6",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, remote_ip6)),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .result = REJECT,
+},
+{
+       "invalid access __sk_buff local_ip6",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, local_ip6)),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .result = REJECT,
+},
+{
+       "invalid access __sk_buff remote_port",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, remote_port)),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .result = REJECT,
+},
+{
+       "invalid access __sk_buff remote_port",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, local_port)),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .result = REJECT,
+},
+{
+       "valid access __sk_buff family",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, family)),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SK_SKB,
+},
+{
+       "valid access __sk_buff remote_ip4",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, remote_ip4)),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SK_SKB,
+},
+{
+       "valid access __sk_buff local_ip4",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, local_ip4)),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SK_SKB,
+},
+{
+       "valid access __sk_buff remote_ip6",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, remote_ip6[0])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, remote_ip6[1])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, remote_ip6[2])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, remote_ip6[3])),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SK_SKB,
+},
+{
+       "valid access __sk_buff local_ip6",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, local_ip6[0])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, local_ip6[1])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, local_ip6[2])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, local_ip6[3])),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SK_SKB,
+},
+{
+       "valid access __sk_buff remote_port",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, remote_port)),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SK_SKB,
+},
+{
+       "valid access __sk_buff remote_port",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, local_port)),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SK_SKB,
+},
+{
+       "invalid access of tc_classid for SK_SKB",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, tc_classid)),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_SK_SKB,
+       .errstr = "invalid bpf_context access",
+},
+{
+       "invalid access of skb->mark for SK_SKB",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, mark)),
+       BPF_EXIT_INSN(),
+       },
+       .result =  REJECT,
+       .prog_type = BPF_PROG_TYPE_SK_SKB,
+       .errstr = "invalid bpf_context access",
+},
+{
+       "check skb->mark is not writeable by SK_SKB",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, mark)),
+       BPF_EXIT_INSN(),
+       },
+       .result =  REJECT,
+       .prog_type = BPF_PROG_TYPE_SK_SKB,
+       .errstr = "invalid bpf_context access",
+},
+{
+       "check skb->tc_index is writeable by SK_SKB",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, tc_index)),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SK_SKB,
+},
+{
+       "check skb->priority is writeable by SK_SKB",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, priority)),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SK_SKB,
+},
+{
+       "direct packet read for SK_SKB",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SK_SKB,
+},
+{
+       "direct packet write for SK_SKB",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
+       BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SK_SKB,
+},
+{
+       "overlapping checks for direct packet access SK_SKB",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SK_SKB,
+},
+{
+       "check skb->mark is not writeable by sockets",
+       .insns = {
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
+                   offsetof(struct __sk_buff, mark)),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .errstr_unpriv = "R1 leaks addr",
+       .result = REJECT,
+},
+{
+       "check skb->tc_index is not writeable by sockets",
+       .insns = {
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
+                   offsetof(struct __sk_buff, tc_index)),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .errstr_unpriv = "R1 leaks addr",
+       .result = REJECT,
+},
+{
+       "check cb access: byte",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[0])),
+       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[0]) + 1),
+       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[0]) + 2),
+       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[0]) + 3),
+       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[1])),
+       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[1]) + 1),
+       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[1]) + 2),
+       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[1]) + 3),
+       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[2])),
+       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[2]) + 1),
+       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[2]) + 2),
+       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[2]) + 3),
+       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[3])),
+       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[3]) + 1),
+       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[3]) + 2),
+       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[3]) + 3),
+       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[4])),
+       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[4]) + 1),
+       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[4]) + 2),
+       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[4]) + 3),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[0])),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[0]) + 1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[0]) + 2),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[0]) + 3),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[1])),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[1]) + 1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[1]) + 2),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[1]) + 3),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[2])),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[2]) + 1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[2]) + 2),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[2]) + 3),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[3])),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[3]) + 1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[3]) + 2),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[3]) + 3),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[4])),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[4]) + 1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[4]) + 2),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[4]) + 3),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+},
+{
+       "__sk_buff->hash, offset 0, byte store not permitted",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, hash)),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .result = REJECT,
+},
+{
+       "__sk_buff->tc_index, offset 3, byte store not permitted",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, tc_index) + 3),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .result = REJECT,
+},
+{
+       "check skb->hash byte load permitted",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, hash)),
+#else
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, hash) + 3),
+#endif
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+},
+{
+       "check skb->hash byte load permitted 1",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, hash) + 1),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+},
+{
+       "check skb->hash byte load permitted 2",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, hash) + 2),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+},
+{
+       "check skb->hash byte load permitted 3",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, hash) + 3),
+#else
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, hash)),
+#endif
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+},
+{
+       "check cb access: byte, wrong type",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[0])),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
+},
+{
+       "check cb access: half",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[0])),
+       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[0]) + 2),
+       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[1])),
+       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[1]) + 2),
+       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[2])),
+       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[2]) + 2),
+       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[3])),
+       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[3]) + 2),
+       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[4])),
+       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[4]) + 2),
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[0])),
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[0]) + 2),
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[1])),
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[1]) + 2),
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[2])),
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[2]) + 2),
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[3])),
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[3]) + 2),
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[4])),
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[4]) + 2),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+},
+{
+       "check cb access: half, unaligned",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[0]) + 1),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "misaligned context access",
+       .result = REJECT,
+       .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
+},
+{
+       "check __sk_buff->hash, offset 0, half store not permitted",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, hash)),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .result = REJECT,
+},
+{
+       "check __sk_buff->tc_index, offset 2, half store not permitted",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, tc_index) + 2),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .result = REJECT,
+},
+{
+       "check skb->hash half load permitted",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, hash)),
+#else
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, hash) + 2),
+#endif
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+},
+{
+       "check skb->hash half load permitted 2",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, hash) + 2),
+#else
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, hash)),
+#endif
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+},
+{
+       "check skb->hash half load not permitted, unaligned 1",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, hash) + 1),
+#else
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, hash) + 3),
+#endif
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .result = REJECT,
+},
+{
+       "check skb->hash half load not permitted, unaligned 3",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, hash) + 3),
+#else
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, hash) + 1),
+#endif
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .result = REJECT,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
+{
+       "check cb access: half, wrong type",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[0])),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
+},
+{
+       "check cb access: word",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[0])),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[1])),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[2])),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[3])),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[4])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[0])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[1])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[2])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[3])),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[4])),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+},
+{
+       "check cb access: word, unaligned 1",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[0]) + 2),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "misaligned context access",
+       .result = REJECT,
+       .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
+},
+{
+       "check cb access: word, unaligned 2",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[4]) + 1),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "misaligned context access",
+       .result = REJECT,
+       .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
+},
+{
+       "check cb access: word, unaligned 3",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[4]) + 2),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "misaligned context access",
+       .result = REJECT,
+       .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
+},
+{
+       "check cb access: word, unaligned 4",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[4]) + 3),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "misaligned context access",
+       .result = REJECT,
+       .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
+},
+{
+       "check cb access: double",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[0])),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[2])),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[0])),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[2])),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+},
+{
+       "check cb access: double, unaligned 1",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[1])),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "misaligned context access",
+       .result = REJECT,
+       .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
+},
+{
+       "check cb access: double, unaligned 2",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[3])),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "misaligned context access",
+       .result = REJECT,
+       .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
+},
+{
+       "check cb access: double, oob 1",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[4])),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .result = REJECT,
+},
+{
+       "check cb access: double, oob 2",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[4])),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .result = REJECT,
+},
+{
+       "check __sk_buff->ifindex dw store not permitted",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, ifindex)),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .result = REJECT,
+},
+{
+       "check __sk_buff->ifindex dw load not permitted",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, ifindex)),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .result = REJECT,
+},
+{
+       "check cb access: double, wrong type",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[0])),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
+},
+{
+       "check out of range skb->cb access",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[0]) + 256),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access",
+       .errstr_unpriv = "",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_SCHED_ACT,
+},
+{
+       "write skb fields from socket prog",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[4])),
+       BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, mark)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, tc_index)),
+       BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[0])),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[2])),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .errstr_unpriv = "R1 leaks addr",
+       .result_unpriv = REJECT,
+},
+{
+       "write skb fields from tc_cls_act prog",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, cb[0])),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, mark)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, tc_index)),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, tc_index)),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[3])),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, tstamp)),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, tstamp)),
+       BPF_EXIT_INSN(),
+       },
+       .errstr_unpriv = "",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "check skb->data half load not permitted",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+#else
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, data) + 2),
+#endif
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "invalid bpf_context access",
+},
+{
+       "read gso_segs from CGROUP_SKB",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, gso_segs)),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+},
+{
+       "write gso_segs from CGROUP_SKB",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, gso_segs)),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .result_unpriv = REJECT,
+       .errstr = "invalid bpf_context access off=164 size=4",
+       .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+},
+{
+       "read gso_segs from CLS",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, gso_segs)),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
diff --git a/tools/testing/selftests/bpf/verifier/direct_packet_access.c b/tools/testing/selftests/bpf/verifier/direct_packet_access.c
new file mode 100644 (file)
index 0000000..650ae00
--- /dev/null
@@ -0,0 +1,619 @@
+{
+       "direct packet access: test1",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "direct packet access: test2",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 14),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_4, 15),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_3, 7),
+       BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_3, 12),
+       BPF_ALU64_IMM(BPF_MUL, BPF_REG_4, 14),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_4),
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, len)),
+       BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 49),
+       BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 49),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_3, BPF_REG_2),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_3),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
+       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_3, 4),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "direct packet access: test3",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_context access off=76",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
+},
+{
+       "direct packet access: test4 (write)",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
+       BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "direct packet access: test5 (pkt_end >= reg, good access)",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "direct packet access: test6 (pkt_end >= reg, bad access)",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid access to packet",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "direct packet access: test7 (pkt_end >= reg, both accesses)",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 3),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid access to packet",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "direct packet access: test8 (double test, variant 1)",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 4),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "direct packet access: test9 (double test, variant 2)",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "direct packet access: test10 (write invalid)",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid access to packet",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "direct packet access: test11 (shift, good access)",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
+       BPF_MOV64_IMM(BPF_REG_3, 144),
+       BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
+       BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 3),
+       BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .retval = 1,
+},
+{
+       "direct packet access: test12 (and, good access)",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
+       BPF_MOV64_IMM(BPF_REG_3, 144),
+       BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
+       BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .retval = 1,
+},
+{
+       "direct packet access: test13 (branches, good access)",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 13),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, mark)),
+       BPF_MOV64_IMM(BPF_REG_4, 1),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_4, 2),
+       BPF_MOV64_IMM(BPF_REG_3, 14),
+       BPF_JMP_IMM(BPF_JA, 0, 0, 1),
+       BPF_MOV64_IMM(BPF_REG_3, 24),
+       BPF_MOV64_REG(BPF_REG_5, BPF_REG_3),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 23),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_5, 15),
+       BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .retval = 1,
+},
+{
+       "direct packet access: test14 (pkt_ptr += 0, CONST_IMM, good access)",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),
+       BPF_MOV64_IMM(BPF_REG_5, 12),
+       BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 4),
+       BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .retval = 1,
+},
+{
+       "direct packet access: test15 (spill with xadd)",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 8),
+       BPF_MOV64_IMM(BPF_REG_5, 4096),
+       BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
+       BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
+       BPF_STX_XADD(BPF_DW, BPF_REG_4, BPF_REG_5, 0),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
+       BPF_STX_MEM(BPF_W, BPF_REG_2, BPF_REG_5, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R2 invalid mem access 'inv'",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
+{
+       "direct packet access: test16 (arith on data_end)",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 16),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
+       BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R3 pointer arithmetic on pkt_end",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "direct packet access: test17 (pruning, alignment)",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
+                   offsetof(struct __sk_buff, mark)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 14),
+       BPF_JMP_IMM(BPF_JGT, BPF_REG_7, 1, 4),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
+       BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, -4),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
+       BPF_JMP_A(-6),
+       },
+       .errstr = "misaligned packet access off 2+(0x0; 0x0)+15+-4 size 4",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
+},
+{
+       "direct packet access: test18 (imm += pkt_ptr, 1)",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_IMM(BPF_REG_0, 8),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
+       BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "direct packet access: test19 (imm += pkt_ptr, 2)",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
+       BPF_MOV64_IMM(BPF_REG_4, 4),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
+       BPF_STX_MEM(BPF_B, BPF_REG_4, BPF_REG_4, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "direct packet access: test20 (x += pkt_ptr, 1)",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0x7fff),
+       BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
+       BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0x7fff - 1),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
+       BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .result = ACCEPT,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
+{
+       "direct packet access: test21 (x += pkt_ptr, 2)",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 9),
+       BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_4, -8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_4, 0x7fff),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
+       BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 0x7fff - 1),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 1),
+       BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_4, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .result = ACCEPT,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
+{
+       "direct packet access: test22 (x += pkt_ptr, 3)",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -8),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_3, -16),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_10, -16),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 11),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
+       BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
+       BPF_STX_XADD(BPF_DW, BPF_REG_10, BPF_REG_4, -8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
+       BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 49),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_2),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
+       BPF_MOV64_IMM(BPF_REG_2, 1),
+       BPF_STX_MEM(BPF_H, BPF_REG_4, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .result = ACCEPT,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
+{
+       "direct packet access: test23 (x += pkt_ptr, 4)",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xffff),
+       BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
+       BPF_MOV64_IMM(BPF_REG_0, 31),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_4),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
+       BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0xffff - 1),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
+       BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .result = REJECT,
+       .errstr = "invalid access to packet, off=0 size=8, R5(id=1,off=0,r=0)",
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
+{
+       "direct packet access: test24 (x += pkt_ptr, 5)",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_IMM(BPF_REG_0, 0xffffffff),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xff),
+       BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
+       BPF_MOV64_IMM(BPF_REG_0, 64),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_4),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
+       BPF_MOV64_REG(BPF_REG_5, BPF_REG_0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x7fff - 1),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
+       BPF_STX_MEM(BPF_DW, BPF_REG_5, BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .result = ACCEPT,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
+{
+       "direct packet access: test25 (marking on <, good access)",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JLT, BPF_REG_0, BPF_REG_3, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
+       BPF_JMP_IMM(BPF_JA, 0, 0, -4),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "direct packet access: test26 (marking on <, bad access)",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JLT, BPF_REG_0, BPF_REG_3, 3),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_JMP_IMM(BPF_JA, 0, 0, -3),
+       },
+       .result = REJECT,
+       .errstr = "invalid access to packet",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "direct packet access: test27 (marking on <=, good access)",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_0, 1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .retval = 1,
+},
+{
+       "direct packet access: test28 (marking on <=, bad access)",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_0, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
+       BPF_JMP_IMM(BPF_JA, 0, 0, -4),
+       },
+       .result = REJECT,
+       .errstr = "invalid access to packet",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
diff --git a/tools/testing/selftests/bpf/verifier/direct_stack_access_wraparound.c b/tools/testing/selftests/bpf/verifier/direct_stack_access_wraparound.c
new file mode 100644 (file)
index 0000000..698e377
--- /dev/null
@@ -0,0 +1,40 @@
+{
+       "direct stack access with 32-bit wraparound. test1",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
+       BPF_MOV32_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "fp pointer and 2147483647",
+       .result = REJECT
+},
+{
+       "direct stack access with 32-bit wraparound. test2",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x3fffffff),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x3fffffff),
+       BPF_MOV32_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "fp pointer and 1073741823",
+       .result = REJECT
+},
+{
+       "direct stack access with 32-bit wraparound. test3",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x1fffffff),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x1fffffff),
+       BPF_MOV32_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "fp pointer offset 1073741822",
+       .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
+       .result = REJECT
+},
diff --git a/tools/testing/selftests/bpf/verifier/div0.c b/tools/testing/selftests/bpf/verifier/div0.c
new file mode 100644 (file)
index 0000000..7685edf
--- /dev/null
@@ -0,0 +1,184 @@
+{
+       "DIV32 by 0, zero check 1",
+       .insns = {
+       BPF_MOV32_IMM(BPF_REG_0, 42),
+       BPF_MOV32_IMM(BPF_REG_1, 0),
+       BPF_MOV32_IMM(BPF_REG_2, 1),
+       BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .retval = 42,
+},
+{
+       "DIV32 by 0, zero check 2",
+       .insns = {
+       BPF_MOV32_IMM(BPF_REG_0, 42),
+       BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
+       BPF_MOV32_IMM(BPF_REG_2, 1),
+       BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .retval = 42,
+},
+{
+       "DIV64 by 0, zero check",
+       .insns = {
+       BPF_MOV32_IMM(BPF_REG_0, 42),
+       BPF_MOV32_IMM(BPF_REG_1, 0),
+       BPF_MOV32_IMM(BPF_REG_2, 1),
+       BPF_ALU64_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .retval = 42,
+},
+{
+       "MOD32 by 0, zero check 1",
+       .insns = {
+       BPF_MOV32_IMM(BPF_REG_0, 42),
+       BPF_MOV32_IMM(BPF_REG_1, 0),
+       BPF_MOV32_IMM(BPF_REG_2, 1),
+       BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .retval = 42,
+},
+{
+       "MOD32 by 0, zero check 2",
+       .insns = {
+       BPF_MOV32_IMM(BPF_REG_0, 42),
+       BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
+       BPF_MOV32_IMM(BPF_REG_2, 1),
+       BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .retval = 42,
+},
+{
+       "MOD64 by 0, zero check",
+       .insns = {
+       BPF_MOV32_IMM(BPF_REG_0, 42),
+       BPF_MOV32_IMM(BPF_REG_1, 0),
+       BPF_MOV32_IMM(BPF_REG_2, 1),
+       BPF_ALU64_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .retval = 42,
+},
+{
+       "DIV32 by 0, zero check ok, cls",
+       .insns = {
+       BPF_MOV32_IMM(BPF_REG_0, 42),
+       BPF_MOV32_IMM(BPF_REG_1, 2),
+       BPF_MOV32_IMM(BPF_REG_2, 16),
+       BPF_ALU32_REG(BPF_DIV, BPF_REG_2, BPF_REG_1),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .result = ACCEPT,
+       .retval = 8,
+},
+{
+       "DIV32 by 0, zero check 1, cls",
+       .insns = {
+       BPF_MOV32_IMM(BPF_REG_1, 0),
+       BPF_MOV32_IMM(BPF_REG_0, 1),
+       BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .result = ACCEPT,
+       .retval = 0,
+},
+{
+       "DIV32 by 0, zero check 2, cls",
+       .insns = {
+       BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
+       BPF_MOV32_IMM(BPF_REG_0, 1),
+       BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .result = ACCEPT,
+       .retval = 0,
+},
+{
+       "DIV64 by 0, zero check, cls",
+       .insns = {
+       BPF_MOV32_IMM(BPF_REG_1, 0),
+       BPF_MOV32_IMM(BPF_REG_0, 1),
+       BPF_ALU64_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .result = ACCEPT,
+       .retval = 0,
+},
+{
+       "MOD32 by 0, zero check ok, cls",
+       .insns = {
+       BPF_MOV32_IMM(BPF_REG_0, 42),
+       BPF_MOV32_IMM(BPF_REG_1, 3),
+       BPF_MOV32_IMM(BPF_REG_2, 5),
+       BPF_ALU32_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .result = ACCEPT,
+       .retval = 2,
+},
+{
+       "MOD32 by 0, zero check 1, cls",
+       .insns = {
+       BPF_MOV32_IMM(BPF_REG_1, 0),
+       BPF_MOV32_IMM(BPF_REG_0, 1),
+       BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .result = ACCEPT,
+       .retval = 1,
+},
+{
+       "MOD32 by 0, zero check 2, cls",
+       .insns = {
+       BPF_LD_IMM64(BPF_REG_1, 0xffffffff00000000LL),
+       BPF_MOV32_IMM(BPF_REG_0, 1),
+       BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .result = ACCEPT,
+       .retval = 1,
+},
+{
+       "MOD64 by 0, zero check 1, cls",
+       .insns = {
+       BPF_MOV32_IMM(BPF_REG_1, 0),
+       BPF_MOV32_IMM(BPF_REG_0, 2),
+       BPF_ALU64_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .result = ACCEPT,
+       .retval = 2,
+},
+{
+       "MOD64 by 0, zero check 2, cls",
+       .insns = {
+       BPF_MOV32_IMM(BPF_REG_1, 0),
+       BPF_MOV32_IMM(BPF_REG_0, -1),
+       BPF_ALU64_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .result = ACCEPT,
+       .retval = -1,
+},
diff --git a/tools/testing/selftests/bpf/verifier/div_overflow.c b/tools/testing/selftests/bpf/verifier/div_overflow.c
new file mode 100644 (file)
index 0000000..bd3f38d
--- /dev/null
@@ -0,0 +1,104 @@
+/* Just make sure that JITs used udiv/umod as otherwise we get
+ * an exception from INT_MIN/-1 overflow similarly as with div
+ * by zero.
+ */
+{
+       "DIV32 overflow, check 1",
+       .insns = {
+       BPF_MOV32_IMM(BPF_REG_1, -1),
+       BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
+       BPF_ALU32_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .result = ACCEPT,
+       .retval = 0,
+},
+{
+       "DIV32 overflow, check 2",
+       .insns = {
+       BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
+       BPF_ALU32_IMM(BPF_DIV, BPF_REG_0, -1),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .result = ACCEPT,
+       .retval = 0,
+},
+{
+       "DIV64 overflow, check 1",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_1, -1),
+       BPF_LD_IMM64(BPF_REG_0, LLONG_MIN),
+       BPF_ALU64_REG(BPF_DIV, BPF_REG_0, BPF_REG_1),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .result = ACCEPT,
+       .retval = 0,
+},
+{
+       "DIV64 overflow, check 2",
+       .insns = {
+       BPF_LD_IMM64(BPF_REG_0, LLONG_MIN),
+       BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, -1),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .result = ACCEPT,
+       .retval = 0,
+},
+{
+       "MOD32 overflow, check 1",
+       .insns = {
+       BPF_MOV32_IMM(BPF_REG_1, -1),
+       BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
+       BPF_ALU32_REG(BPF_MOD, BPF_REG_0, BPF_REG_1),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .result = ACCEPT,
+       .retval = INT_MIN,
+},
+{
+       "MOD32 overflow, check 2",
+       .insns = {
+       BPF_MOV32_IMM(BPF_REG_0, INT_MIN),
+       BPF_ALU32_IMM(BPF_MOD, BPF_REG_0, -1),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .result = ACCEPT,
+       .retval = INT_MIN,
+},
+{
+       "MOD64 overflow, check 1",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_1, -1),
+       BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
+       BPF_ALU64_REG(BPF_MOD, BPF_REG_2, BPF_REG_1),
+       BPF_MOV32_IMM(BPF_REG_0, 0),
+       BPF_JMP_REG(BPF_JNE, BPF_REG_3, BPF_REG_2, 1),
+       BPF_MOV32_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .result = ACCEPT,
+       .retval = 1,
+},
+{
+       "MOD64 overflow, check 2",
+       .insns = {
+       BPF_LD_IMM64(BPF_REG_2, LLONG_MIN),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_MOD, BPF_REG_2, -1),
+       BPF_MOV32_IMM(BPF_REG_0, 0),
+       BPF_JMP_REG(BPF_JNE, BPF_REG_3, BPF_REG_2, 1),
+       BPF_MOV32_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .result = ACCEPT,
+       .retval = 1,
+},
diff --git a/tools/testing/selftests/bpf/verifier/helper_access_var_len.c b/tools/testing/selftests/bpf/verifier/helper_access_var_len.c
new file mode 100644 (file)
index 0000000..1f39d84
--- /dev/null
@@ -0,0 +1,614 @@
+{
+       "helper access to variable memory: stack, bitwise AND + JMP, correct bounds",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
+       BPF_MOV64_IMM(BPF_REG_2, 16),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to variable memory: stack, bitwise AND, zero included",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
+       BPF_MOV64_IMM(BPF_REG_2, 16),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid indirect read from stack off -64+0 size 64",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to variable memory: stack, bitwise AND + JMP, wrong max",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
+       BPF_MOV64_IMM(BPF_REG_2, 16),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 65),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid stack type R1 off=-64 access_size=65",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to variable memory: stack, JMP, correct bounds",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
+       BPF_MOV64_IMM(BPF_REG_2, 16),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
+       BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 4),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to variable memory: stack, JMP (signed), correct bounds",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
+       BPF_MOV64_IMM(BPF_REG_2, 16),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
+       BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 4),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to variable memory: stack, JMP, bounds + offset",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
+       BPF_MOV64_IMM(BPF_REG_2, 16),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
+       BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 5),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 3),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid stack type R1 off=-64 access_size=65",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to variable memory: stack, JMP, wrong max",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
+       BPF_MOV64_IMM(BPF_REG_2, 16),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
+       BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 65, 4),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid stack type R1 off=-64 access_size=65",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to variable memory: stack, JMP, no max check",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
+       BPF_MOV64_IMM(BPF_REG_2, 16),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_JMP_REG(BPF_JGE, BPF_REG_4, BPF_REG_2, 2),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       /* because max wasn't checked, signed min is negative */
+       .errstr = "R2 min value is negative, either use unsigned or 'var &= const'",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to variable memory: stack, JMP, no min check",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
+       BPF_MOV64_IMM(BPF_REG_2, 16),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
+       BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 3),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid indirect read from stack off -64+0 size 64",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to variable memory: stack, JMP (signed), no min check",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
+       BPF_MOV64_IMM(BPF_REG_2, 16),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -128),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -128),
+       BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 3),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R2 min value is negative",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to variable memory: map, JMP, correct bounds",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
+       BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, sizeof(struct test_val), 4),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to variable memory: map, JMP, wrong max",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
+       BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, sizeof(struct test_val) + 1, 4),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr = "invalid access to map value, value_size=48 off=0 size=49",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to variable memory: map adjusted, JMP, correct bounds",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
+       BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
+       BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, sizeof(struct test_val) - 20, 4),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to variable memory: map adjusted, JMP, wrong max",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 20),
+       BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
+       BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, sizeof(struct test_val) - 19, 4),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_JMP_REG(BPF_JSGE, BPF_REG_4, BPF_REG_2, 2),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr = "R1 min value is outside of the array range",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to variable memory: size = 0 allowed on NULL (ARG_PTR_TO_MEM_OR_NULL)",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_1, 0),
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_MOV64_IMM(BPF_REG_5, 0),
+       BPF_EMIT_CALL(BPF_FUNC_csum_diff),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "helper access to variable memory: size > 0 not allowed on NULL (ARG_PTR_TO_MEM_OR_NULL)",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_1, 0),
+       BPF_MOV64_IMM(BPF_REG_2, 1),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_MOV64_IMM(BPF_REG_5, 0),
+       BPF_EMIT_CALL(BPF_FUNC_csum_diff),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R1 type=inv expected=fp",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "helper access to variable memory: size = 0 allowed on != NULL stack pointer (ARG_PTR_TO_MEM_OR_NULL)",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 8),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_MOV64_IMM(BPF_REG_5, 0),
+       BPF_EMIT_CALL(BPF_FUNC_csum_diff),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "helper access to variable memory: size = 0 allowed on != NULL map pointer (ARG_PTR_TO_MEM_OR_NULL)",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_MOV64_IMM(BPF_REG_5, 0),
+       BPF_EMIT_CALL(BPF_FUNC_csum_diff),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "helper access to variable memory: size possible = 0 allowed on != NULL stack pointer (ARG_PTR_TO_MEM_OR_NULL)",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 7),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_MOV64_IMM(BPF_REG_5, 0),
+       BPF_EMIT_CALL(BPF_FUNC_csum_diff),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "helper access to variable memory: size possible = 0 allowed on != NULL map pointer (ARG_PTR_TO_MEM_OR_NULL)",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_MOV64_IMM(BPF_REG_5, 0),
+       BPF_EMIT_CALL(BPF_FUNC_csum_diff),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "helper access to variable memory: size possible = 0 allowed on != NULL packet pointer (ARG_PTR_TO_MEM_OR_NULL)",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_6),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, 0),
+       BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_MOV64_IMM(BPF_REG_5, 0),
+       BPF_EMIT_CALL(BPF_FUNC_csum_diff),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .retval = 0 /* csum_diff of 64-byte packet */,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
+{
+       "helper access to variable memory: size = 0 not allowed on NULL (!ARG_PTR_TO_MEM_OR_NULL)",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_1, 0),
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R1 type=inv expected=fp",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to variable memory: size > 0 not allowed on NULL (!ARG_PTR_TO_MEM_OR_NULL)",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_1, 0),
+       BPF_MOV64_IMM(BPF_REG_2, 1),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R1 type=inv expected=fp",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to variable memory: size = 0 allowed on != NULL stack pointer (!ARG_PTR_TO_MEM_OR_NULL)",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to variable memory: size = 0 allowed on != NULL map pointer (!ARG_PTR_TO_MEM_OR_NULL)",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to variable memory: size possible = 0 allowed on != NULL stack pointer (!ARG_PTR_TO_MEM_OR_NULL)",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 4),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to variable memory: size possible = 0 allowed on != NULL map pointer (!ARG_PTR_TO_MEM_OR_NULL)",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 8, 2),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to variable memory: 8 bytes leak",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
+       BPF_MOV64_IMM(BPF_REG_2, 1),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -128),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -128),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 63),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid indirect read from stack off -64+32 size 64",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to variable memory: 8 bytes no leak (init memory)",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -64),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -56),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -48),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -40),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -32),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -24),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -16),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -64),
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 32),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 32),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
diff --git a/tools/testing/selftests/bpf/verifier/helper_packet_access.c b/tools/testing/selftests/bpf/verifier/helper_packet_access.c
new file mode 100644 (file)
index 0000000..ae54587
--- /dev/null
@@ -0,0 +1,460 @@
+{
+       "helper access to packet: test1, valid packet_ptr range",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct xdp_md, data_end)),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_update_elem),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 5 },
+       .result_unpriv = ACCEPT,
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_XDP,
+},
+{
+       "helper access to packet: test2, unchecked packet_ptr",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 1 },
+       .result = REJECT,
+       .errstr = "invalid access to packet",
+       .prog_type = BPF_PROG_TYPE_XDP,
+},
+{
+       "helper access to packet: test3, variable add",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                       offsetof(struct xdp_md, data_end)),
+       BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
+       BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
+       BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
+       BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 11 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_XDP,
+},
+{
+       "helper access to packet: test4, packet_ptr with bad range",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct xdp_md, data_end)),
+       BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 7 },
+       .result = REJECT,
+       .errstr = "invalid access to packet",
+       .prog_type = BPF_PROG_TYPE_XDP,
+},
+{
+       "helper access to packet: test5, packet_ptr with too short range",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct xdp_md, data_end)),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
+       BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 6 },
+       .result = REJECT,
+       .errstr = "invalid access to packet",
+       .prog_type = BPF_PROG_TYPE_XDP,
+},
+{
+       "helper access to packet: test6, cls valid packet_ptr range",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_update_elem),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 5 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "helper access to packet: test7, cls unchecked packet_ptr",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 1 },
+       .result = REJECT,
+       .errstr = "invalid access to packet",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "helper access to packet: test8, cls variable add",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                       offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                       offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
+       BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
+       BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
+       BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 11 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "helper access to packet: test9, cls packet_ptr with bad range",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 7 },
+       .result = REJECT,
+       .errstr = "invalid access to packet",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "helper access to packet: test10, cls packet_ptr with too short range",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
+       BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 6 },
+       .result = REJECT,
+       .errstr = "invalid access to packet",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "helper access to packet: test11, cls unsuitable helper 1",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 7),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_7, 4),
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_4, 42),
+       BPF_MOV64_IMM(BPF_REG_5, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_store_bytes),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "helper access to the packet",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "helper access to packet: test12, cls unsuitable helper 2",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_7, 3),
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_4, 4),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "helper access to the packet",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "helper access to packet: test13, cls helper ok",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+       BPF_MOV64_IMM(BPF_REG_2, 4),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_MOV64_IMM(BPF_REG_5, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "helper access to packet: test14, cls helper ok sub",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
+       BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 4),
+       BPF_MOV64_IMM(BPF_REG_2, 4),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_MOV64_IMM(BPF_REG_5, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "helper access to packet: test15, cls helper fail sub",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
+       BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 12),
+       BPF_MOV64_IMM(BPF_REG_2, 4),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_MOV64_IMM(BPF_REG_5, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "invalid access to packet",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "helper access to packet: test16, cls helper fail range 1",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+       BPF_MOV64_IMM(BPF_REG_2, 8),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_MOV64_IMM(BPF_REG_5, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "invalid access to packet",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "helper access to packet: test17, cls helper fail range 2",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+       BPF_MOV64_IMM(BPF_REG_2, -9),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_MOV64_IMM(BPF_REG_5, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "R2 min value is negative",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "helper access to packet: test18, cls helper fail range 3",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+       BPF_MOV64_IMM(BPF_REG_2, ~0),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_MOV64_IMM(BPF_REG_5, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "R2 min value is negative",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "helper access to packet: test19, cls helper range zero",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_MOV64_IMM(BPF_REG_5, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "helper access to packet: test20, pkt end as input",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
+       BPF_MOV64_IMM(BPF_REG_2, 4),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_MOV64_IMM(BPF_REG_5, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "R1 type=pkt_end expected=fp",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "helper access to packet: test21, wrong reg",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
+       BPF_MOV64_IMM(BPF_REG_2, 4),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_MOV64_IMM(BPF_REG_5, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "invalid access to packet",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
diff --git a/tools/testing/selftests/bpf/verifier/helper_value_access.c b/tools/testing/selftests/bpf/verifier/helper_value_access.c
new file mode 100644 (file)
index 0000000..7572e40
--- /dev/null
@@ -0,0 +1,953 @@
+{
+       "helper access to map: full range",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val)),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to map: partial range",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_MOV64_IMM(BPF_REG_2, 8),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to map: empty range",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_EMIT_CALL(BPF_FUNC_trace_printk),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr = "invalid access to map value, value_size=48 off=0 size=0",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to map: out-of-bound range",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_MOV64_IMM(BPF_REG_2, sizeof(struct test_val) + 8),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr = "invalid access to map value, value_size=48 off=0 size=56",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to map: negative range",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_MOV64_IMM(BPF_REG_2, -8),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr = "R2 min value is negative",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to adjusted map (via const imm): full range",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, offsetof(struct test_val, foo)),
+       BPF_MOV64_IMM(BPF_REG_2,
+                     sizeof(struct test_val) - offsetof(struct test_val, foo)),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to adjusted map (via const imm): partial range",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, offsetof(struct test_val, foo)),
+       BPF_MOV64_IMM(BPF_REG_2, 8),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to adjusted map (via const imm): empty range",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, offsetof(struct test_val, foo)),
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_EMIT_CALL(BPF_FUNC_trace_printk),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr = "invalid access to map value, value_size=48 off=4 size=0",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to adjusted map (via const imm): out-of-bound range",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, offsetof(struct test_val, foo)),
+       BPF_MOV64_IMM(BPF_REG_2,
+                     sizeof(struct test_val) - offsetof(struct test_val, foo) + 8),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr = "invalid access to map value, value_size=48 off=4 size=52",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to adjusted map (via const imm): negative range (> adjustment)",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, offsetof(struct test_val, foo)),
+       BPF_MOV64_IMM(BPF_REG_2, -8),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr = "R2 min value is negative",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to adjusted map (via const imm): negative range (< adjustment)",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, offsetof(struct test_val, foo)),
+       BPF_MOV64_IMM(BPF_REG_2, -1),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr = "R2 min value is negative",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to adjusted map (via const reg): full range",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_MOV64_IMM(BPF_REG_3, offsetof(struct test_val, foo)),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
+       BPF_MOV64_IMM(BPF_REG_2,
+                     sizeof(struct test_val) - offsetof(struct test_val, foo)),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to adjusted map (via const reg): partial range",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_MOV64_IMM(BPF_REG_3, offsetof(struct test_val, foo)),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
+       BPF_MOV64_IMM(BPF_REG_2, 8),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to adjusted map (via const reg): empty range",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_EMIT_CALL(BPF_FUNC_trace_printk),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr = "R1 min value is outside of the array range",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to adjusted map (via const reg): out-of-bound range",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_MOV64_IMM(BPF_REG_3, offsetof(struct test_val, foo)),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
+       BPF_MOV64_IMM(BPF_REG_2,
+                     sizeof(struct test_val) -
+                     offsetof(struct test_val, foo) + 8),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr = "invalid access to map value, value_size=48 off=4 size=52",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to adjusted map (via const reg): negative range (> adjustment)",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_MOV64_IMM(BPF_REG_3, offsetof(struct test_val, foo)),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
+       BPF_MOV64_IMM(BPF_REG_2, -8),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr = "R2 min value is negative",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to adjusted map (via const reg): negative range (< adjustment)",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_MOV64_IMM(BPF_REG_3, offsetof(struct test_val, foo)),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
+       BPF_MOV64_IMM(BPF_REG_2, -1),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr = "R2 min value is negative",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to adjusted map (via variable): full range",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JGT, BPF_REG_3, offsetof(struct test_val, foo), 4),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
+       BPF_MOV64_IMM(BPF_REG_2,
+                     sizeof(struct test_val) - offsetof(struct test_val, foo)),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to adjusted map (via variable): partial range",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JGT, BPF_REG_3, offsetof(struct test_val, foo), 4),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
+       BPF_MOV64_IMM(BPF_REG_2, 8),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to adjusted map (via variable): empty range",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JGT, BPF_REG_3, offsetof(struct test_val, foo), 3),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_EMIT_CALL(BPF_FUNC_trace_printk),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr = "R1 min value is outside of the array range",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to adjusted map (via variable): no max check",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
+       BPF_MOV64_IMM(BPF_REG_2, 1),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr = "R1 unbounded memory access",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to adjusted map (via variable): wrong max check",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JGT, BPF_REG_3, offsetof(struct test_val, foo), 4),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
+       BPF_MOV64_IMM(BPF_REG_2,
+                     sizeof(struct test_val) -
+                     offsetof(struct test_val, foo) + 1),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_probe_read),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr = "invalid access to map value, value_size=48 off=4 size=45",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to map: bounds check using <, good access",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JLT, BPF_REG_3, 32, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to map: bounds check using <, bad access",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JLT, BPF_REG_3, 32, 4),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .result = REJECT,
+       .errstr = "R1 unbounded memory access",
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to map: bounds check using <=, good access",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JLE, BPF_REG_3, 32, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to map: bounds check using <=, bad access",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JLE, BPF_REG_3, 32, 4),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .result = REJECT,
+       .errstr = "R1 unbounded memory access",
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to map: bounds check using s<, good access",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 0, -3),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to map: bounds check using s<, good access 2",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, -3, -3),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to map: bounds check using s<, bad access",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, 32, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_JMP_IMM(BPF_JSLT, BPF_REG_3, -3, -3),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .result = REJECT,
+       .errstr = "R1 min value is negative",
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to map: bounds check using s<=, good access",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 0, -3),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to map: bounds check using s<=, good access 2",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, -3, -3),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "helper access to map: bounds check using s<=, bad access",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, 32, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       BPF_JMP_IMM(BPF_JSLE, BPF_REG_3, -3, -3),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_3),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .result = REJECT,
+       .errstr = "R1 min value is negative",
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "map lookup helper access to map",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_16b = { 3, 8 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "map update helper access to map",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_update_elem),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_16b = { 3, 10 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "map update helper access to map: wrong size",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_update_elem),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .fixup_map_hash_16b = { 10 },
+       .result = REJECT,
+       .errstr = "invalid access to map value, value_size=8 off=0 size=16",
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "map helper access to adjusted map (via const imm)",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, offsetof(struct other_val, bar)),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_16b = { 3, 9 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "map helper access to adjusted map (via const imm): out-of-bound 1",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, sizeof(struct other_val) - 4),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_16b = { 3, 9 },
+       .result = REJECT,
+       .errstr = "invalid access to map value, value_size=16 off=12 size=8",
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "map helper access to adjusted map (via const imm): out-of-bound 2",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_16b = { 3, 9 },
+       .result = REJECT,
+       .errstr = "invalid access to map value, value_size=16 off=-4 size=8",
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "map helper access to adjusted map (via const reg)",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
+       BPF_MOV64_IMM(BPF_REG_3, offsetof(struct other_val, bar)),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_16b = { 3, 10 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "map helper access to adjusted map (via const reg): out-of-bound 1",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
+       BPF_MOV64_IMM(BPF_REG_3, sizeof(struct other_val) - 4),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_16b = { 3, 10 },
+       .result = REJECT,
+       .errstr = "invalid access to map value, value_size=16 off=12 size=8",
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "map helper access to adjusted map (via const reg): out-of-bound 2",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
+       BPF_MOV64_IMM(BPF_REG_3, -4),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_16b = { 3, 10 },
+       .result = REJECT,
+       .errstr = "invalid access to map value, value_size=16 off=-4 size=8",
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "map helper access to adjusted map (via variable)",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JGT, BPF_REG_3, offsetof(struct other_val, bar), 4),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_16b = { 3, 11 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "map helper access to adjusted map (via variable): no max check",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_16b = { 3, 10 },
+       .result = REJECT,
+       .errstr = "R2 unbounded memory access, make sure to bounds check any array access into a map",
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
+{
+       "map helper access to adjusted map (via variable): wrong max check",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JGT, BPF_REG_3, offsetof(struct other_val, bar) + 1, 4),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_16b = { 3, 11 },
+       .result = REJECT,
+       .errstr = "invalid access to map value, value_size=16 off=9 size=8",
+       .prog_type = BPF_PROG_TYPE_TRACEPOINT,
+},
diff --git a/tools/testing/selftests/bpf/verifier/jump.c b/tools/testing/selftests/bpf/verifier/jump.c
new file mode 100644 (file)
index 0000000..8e6fcc8
--- /dev/null
@@ -0,0 +1,180 @@
+{
+       "jump test 1",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_1, -8),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 1),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 1),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 1),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 2),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 1),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 3),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 1),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 4),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 5),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr_unpriv = "R1 pointer comparison",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+},
+{
+       "jump test 2",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
+       BPF_JMP_IMM(BPF_JA, 0, 0, 14),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 2),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
+       BPF_JMP_IMM(BPF_JA, 0, 0, 11),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 2),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
+       BPF_JMP_IMM(BPF_JA, 0, 0, 8),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 2),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
+       BPF_JMP_IMM(BPF_JA, 0, 0, 5),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 2),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
+       BPF_JMP_IMM(BPF_JA, 0, 0, 2),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 1),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr_unpriv = "R1 pointer comparison",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+},
+{
+       "jump test 3",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_JMP_IMM(BPF_JA, 0, 0, 19),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 3),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, -16, 0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
+       BPF_JMP_IMM(BPF_JA, 0, 0, 15),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 2, 3),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, -32, 0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -32),
+       BPF_JMP_IMM(BPF_JA, 0, 0, 11),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 3, 3),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, -40, 0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -40),
+       BPF_JMP_IMM(BPF_JA, 0, 0, 7),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 4, 3),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, -48, 0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -48),
+       BPF_JMP_IMM(BPF_JA, 0, 0, 3),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 5, 0),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, -56, 0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -56),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_delete_elem),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 24 },
+       .errstr_unpriv = "R1 pointer comparison",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+       .retval = -ENOENT,
+},
+{
+       "jump test 4",
+       .insns = {
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 1),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 2),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 3),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 4),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr_unpriv = "R1 pointer comparison",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+},
+{
+       "jump test 5",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
+       BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
+       BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
+       BPF_JMP_IMM(BPF_JA, 0, 0, 2),
+       BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
+       BPF_JMP_IMM(BPF_JA, 0, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
+       BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
+       BPF_JMP_IMM(BPF_JA, 0, 0, 2),
+       BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
+       BPF_JMP_IMM(BPF_JA, 0, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
+       BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
+       BPF_JMP_IMM(BPF_JA, 0, 0, 2),
+       BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
+       BPF_JMP_IMM(BPF_JA, 0, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
+       BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
+       BPF_JMP_IMM(BPF_JA, 0, 0, 2),
+       BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
+       BPF_JMP_IMM(BPF_JA, 0, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
+       BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_3, -8),
+       BPF_JMP_IMM(BPF_JA, 0, 0, 2),
+       BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_2, -8),
+       BPF_JMP_IMM(BPF_JA, 0, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr_unpriv = "R1 pointer comparison",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+},
diff --git a/tools/testing/selftests/bpf/verifier/junk_insn.c b/tools/testing/selftests/bpf/verifier/junk_insn.c
new file mode 100644 (file)
index 0000000..89d690f
--- /dev/null
@@ -0,0 +1,45 @@
+{
+       "junk insn",
+       .insns = {
+       BPF_RAW_INSN(0, 0, 0, 0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "unknown opcode 00",
+       .result = REJECT,
+},
+{
+       "junk insn2",
+       .insns = {
+       BPF_RAW_INSN(1, 0, 0, 0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "BPF_LDX uses reserved fields",
+       .result = REJECT,
+},
+{
+       "junk insn3",
+       .insns = {
+       BPF_RAW_INSN(-1, 0, 0, 0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "unknown opcode ff",
+       .result = REJECT,
+},
+{
+       "junk insn4",
+       .insns = {
+       BPF_RAW_INSN(-1, -1, -1, -1, -1),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "unknown opcode ff",
+       .result = REJECT,
+},
+{
+       "junk insn5",
+       .insns = {
+       BPF_RAW_INSN(0x7f, -1, -1, -1, -1),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "BPF_ALU uses reserved fields",
+       .result = REJECT,
+},
diff --git a/tools/testing/selftests/bpf/verifier/ld_abs.c b/tools/testing/selftests/bpf/verifier/ld_abs.c
new file mode 100644 (file)
index 0000000..287b6fe
--- /dev/null
@@ -0,0 +1,95 @@
+{
+       "ld_abs: check calling conv, r1",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+       BPF_MOV64_IMM(BPF_REG_1, 0),
+       BPF_LD_ABS(BPF_W, -0x200000),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R1 !read_ok",
+       .result = REJECT,
+},
+{
+       "ld_abs: check calling conv, r2",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_LD_ABS(BPF_W, -0x200000),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R2 !read_ok",
+       .result = REJECT,
+},
+{
+       "ld_abs: check calling conv, r3",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_LD_ABS(BPF_W, -0x200000),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R3 !read_ok",
+       .result = REJECT,
+},
+{
+       "ld_abs: check calling conv, r4",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_LD_ABS(BPF_W, -0x200000),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R4 !read_ok",
+       .result = REJECT,
+},
+{
+       "ld_abs: check calling conv, r5",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+       BPF_MOV64_IMM(BPF_REG_5, 0),
+       BPF_LD_ABS(BPF_W, -0x200000),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R5 !read_ok",
+       .result = REJECT,
+},
+{
+       "ld_abs: check calling conv, r7",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+       BPF_MOV64_IMM(BPF_REG_7, 0),
+       BPF_LD_ABS(BPF_W, -0x200000),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+},
+{
+       "ld_abs: tests on r6 and skb data reload helper",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+       BPF_LD_ABS(BPF_B, 0),
+       BPF_LD_ABS(BPF_H, 0),
+       BPF_LD_ABS(BPF_W, 0),
+       BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
+       BPF_MOV64_IMM(BPF_REG_6, 0),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
+       BPF_MOV64_IMM(BPF_REG_2, 1),
+       BPF_MOV64_IMM(BPF_REG_3, 2),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_vlan_push),
+       BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
+       BPF_LD_ABS(BPF_B, 0),
+       BPF_LD_ABS(BPF_H, 0),
+       BPF_LD_ABS(BPF_W, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 42),
+       BPF_EXIT_INSN(),
+       },
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .result = ACCEPT,
+       .retval = 42 /* ultimate return value */,
+},
diff --git a/tools/testing/selftests/bpf/verifier/ld_imm64.c b/tools/testing/selftests/bpf/verifier/ld_imm64.c
new file mode 100644 (file)
index 0000000..28b8c80
--- /dev/null
@@ -0,0 +1,141 @@
+{
+       "test1 ld_imm64",
+       .insns = {
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
+       BPF_LD_IMM64(BPF_REG_0, 0),
+       BPF_LD_IMM64(BPF_REG_0, 0),
+       BPF_LD_IMM64(BPF_REG_0, 1),
+       BPF_LD_IMM64(BPF_REG_0, 1),
+       BPF_MOV64_IMM(BPF_REG_0, 2),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid BPF_LD_IMM insn",
+       .errstr_unpriv = "R1 pointer comparison",
+       .result = REJECT,
+},
+{
+       "test2 ld_imm64",
+       .insns = {
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
+       BPF_LD_IMM64(BPF_REG_0, 0),
+       BPF_LD_IMM64(BPF_REG_0, 0),
+       BPF_LD_IMM64(BPF_REG_0, 1),
+       BPF_LD_IMM64(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid BPF_LD_IMM insn",
+       .errstr_unpriv = "R1 pointer comparison",
+       .result = REJECT,
+},
+{
+       "test3 ld_imm64",
+       .insns = {
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
+       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
+       BPF_LD_IMM64(BPF_REG_0, 0),
+       BPF_LD_IMM64(BPF_REG_0, 0),
+       BPF_LD_IMM64(BPF_REG_0, 1),
+       BPF_LD_IMM64(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_ld_imm64 insn",
+       .result = REJECT,
+},
+{
+       "test4 ld_imm64",
+       .insns = {
+       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_ld_imm64 insn",
+       .result = REJECT,
+},
+{
+       "test5 ld_imm64",
+       .insns = {
+       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
+       },
+       .errstr = "invalid bpf_ld_imm64 insn",
+       .result = REJECT,
+},
+{
+       "test6 ld_imm64",
+       .insns = {
+       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 0),
+       BPF_RAW_INSN(0, 0, 0, 0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+},
+{
+       "test7 ld_imm64",
+       .insns = {
+       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
+       BPF_RAW_INSN(0, 0, 0, 0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .retval = 1,
+},
+{
+       "test8 ld_imm64",
+       .insns = {
+       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 1, 1),
+       BPF_RAW_INSN(0, 0, 0, 0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "uses reserved fields",
+       .result = REJECT,
+},
+{
+       "test9 ld_imm64",
+       .insns = {
+       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
+       BPF_RAW_INSN(0, 0, 0, 1, 1),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_ld_imm64 insn",
+       .result = REJECT,
+},
+{
+       "test10 ld_imm64",
+       .insns = {
+       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
+       BPF_RAW_INSN(0, BPF_REG_1, 0, 0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_ld_imm64 insn",
+       .result = REJECT,
+},
+{
+       "test11 ld_imm64",
+       .insns = {
+       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, 0, 0, 1),
+       BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_ld_imm64 insn",
+       .result = REJECT,
+},
+{
+       "test12 ld_imm64",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
+       BPF_RAW_INSN(0, 0, 0, 0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "not pointing to valid bpf_map",
+       .result = REJECT,
+},
+{
+       "test13 ld_imm64",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_LD | BPF_IMM | BPF_DW, 0, BPF_REG_1, 0, 1),
+       BPF_RAW_INSN(0, 0, BPF_REG_1, 0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid bpf_ld_imm64 insn",
+       .result = REJECT,
+},
diff --git a/tools/testing/selftests/bpf/verifier/ld_ind.c b/tools/testing/selftests/bpf/verifier/ld_ind.c
new file mode 100644 (file)
index 0000000..0797342
--- /dev/null
@@ -0,0 +1,72 @@
+{
+       "ld_ind: check calling conv, r1",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+       BPF_MOV64_IMM(BPF_REG_1, 1),
+       BPF_LD_IND(BPF_W, BPF_REG_1, -0x200000),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R1 !read_ok",
+       .result = REJECT,
+},
+{
+       "ld_ind: check calling conv, r2",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+       BPF_MOV64_IMM(BPF_REG_2, 1),
+       BPF_LD_IND(BPF_W, BPF_REG_2, -0x200000),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R2 !read_ok",
+       .result = REJECT,
+},
+{
+       "ld_ind: check calling conv, r3",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+       BPF_MOV64_IMM(BPF_REG_3, 1),
+       BPF_LD_IND(BPF_W, BPF_REG_3, -0x200000),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R3 !read_ok",
+       .result = REJECT,
+},
+{
+       "ld_ind: check calling conv, r4",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+       BPF_MOV64_IMM(BPF_REG_4, 1),
+       BPF_LD_IND(BPF_W, BPF_REG_4, -0x200000),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R4 !read_ok",
+       .result = REJECT,
+},
+{
+       "ld_ind: check calling conv, r5",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+       BPF_MOV64_IMM(BPF_REG_5, 1),
+       BPF_LD_IND(BPF_W, BPF_REG_5, -0x200000),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R5 !read_ok",
+       .result = REJECT,
+},
+{
+       "ld_ind: check calling conv, r7",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+       BPF_MOV64_IMM(BPF_REG_7, 1),
+       BPF_LD_IND(BPF_W, BPF_REG_7, -0x200000),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .retval = 1,
+},
diff --git a/tools/testing/selftests/bpf/verifier/leak_ptr.c b/tools/testing/selftests/bpf/verifier/leak_ptr.c
new file mode 100644 (file)
index 0000000..d6eec17
--- /dev/null
@@ -0,0 +1,67 @@
+{
+       "leak pointer into ctx 1",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[0])),
+       BPF_LD_MAP_FD(BPF_REG_2, 0),
+       BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_2,
+                     offsetof(struct __sk_buff, cb[0])),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 2 },
+       .errstr_unpriv = "R2 leaks addr into mem",
+       .result_unpriv = REJECT,
+       .result = REJECT,
+       .errstr = "BPF_XADD stores into R1 ctx is not allowed",
+},
+{
+       "leak pointer into ctx 2",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
+                   offsetof(struct __sk_buff, cb[0])),
+       BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_10,
+                     offsetof(struct __sk_buff, cb[0])),
+       BPF_EXIT_INSN(),
+       },
+       .errstr_unpriv = "R10 leaks addr into mem",
+       .result_unpriv = REJECT,
+       .result = REJECT,
+       .errstr = "BPF_XADD stores into R1 ctx is not allowed",
+},
+{
+       "leak pointer into ctx 3",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_LD_MAP_FD(BPF_REG_2, 0),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2,
+                     offsetof(struct __sk_buff, cb[0])),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 1 },
+       .errstr_unpriv = "R2 leaks addr into ctx",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+},
+{
+       "leak pointer into map val",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
+       BPF_STX_XADD(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 4 },
+       .errstr_unpriv = "R6 leaks addr into mem",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+},
diff --git a/tools/testing/selftests/bpf/verifier/lwt.c b/tools/testing/selftests/bpf/verifier/lwt.c
new file mode 100644 (file)
index 0000000..2cab6a3
--- /dev/null
@@ -0,0 +1,189 @@
+{
+       "invalid direct packet write for LWT_IN",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
+       BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "cannot write into packet",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_LWT_IN,
+},
+{
+       "invalid direct packet write for LWT_OUT",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
+       BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "cannot write into packet",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_LWT_OUT,
+},
+{
+       "direct packet write for LWT_XMIT",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
+       BPF_STX_MEM(BPF_B, BPF_REG_2, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_LWT_XMIT,
+},
+{
+       "direct packet read for LWT_IN",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_LWT_IN,
+},
+{
+       "direct packet read for LWT_OUT",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_LWT_OUT,
+},
+{
+       "direct packet read for LWT_XMIT",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_LWT_XMIT,
+},
+{
+       "overlapping checks for direct packet access",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                   offsetof(struct __sk_buff, data)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                   offsetof(struct __sk_buff, data_end)),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 4),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_2, 6),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_LWT_XMIT,
+},
+{
+       "make headroom for LWT_XMIT",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+       BPF_MOV64_IMM(BPF_REG_2, 34),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_skb_change_head),
+       /* split for s390 to succeed */
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
+       BPF_MOV64_IMM(BPF_REG_2, 42),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_EMIT_CALL(BPF_FUNC_skb_change_head),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_LWT_XMIT,
+},
+{
+       "invalid access of tc_classid for LWT_IN",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, tc_classid)),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "invalid bpf_context access",
+},
+{
+       "invalid access of tc_classid for LWT_OUT",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, tc_classid)),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "invalid bpf_context access",
+},
+{
+       "invalid access of tc_classid for LWT_XMIT",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, tc_classid)),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "invalid bpf_context access",
+},
+{
+       "check skb->tc_classid half load not permitted for lwt prog",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, tc_classid)),
+#else
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, tc_classid) + 2),
+#endif
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "invalid bpf_context access",
+       .prog_type = BPF_PROG_TYPE_LWT_IN,
+},
diff --git a/tools/testing/selftests/bpf/verifier/map_in_map.c b/tools/testing/selftests/bpf/verifier/map_in_map.c
new file mode 100644 (file)
index 0000000..2798927
--- /dev/null
@@ -0,0 +1,62 @@
+{
+       "map in map access",
+       .insns = {
+       BPF_ST_MEM(0, BPF_REG_10, -4, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
+       BPF_ST_MEM(0, BPF_REG_10, -4, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_in_map = { 3 },
+       .result = ACCEPT,
+},
+{
+       "invalid inner map pointer",
+       .insns = {
+       BPF_ST_MEM(0, BPF_REG_10, -4, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
+       BPF_ST_MEM(0, BPF_REG_10, -4, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_in_map = { 3 },
+       .errstr = "R1 pointer arithmetic on map_ptr prohibited",
+       .result = REJECT,
+},
+{
+       "forgot null checking on the inner map pointer",
+       .insns = {
+       BPF_ST_MEM(0, BPF_REG_10, -4, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_ST_MEM(0, BPF_REG_10, -4, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_in_map = { 3 },
+       .errstr = "R1 type=map_value_or_null expected=map_ptr",
+       .result = REJECT,
+},
diff --git a/tools/testing/selftests/bpf/verifier/map_ret_val.c b/tools/testing/selftests/bpf/verifier/map_ret_val.c
new file mode 100644 (file)
index 0000000..bdd0e8d
--- /dev/null
@@ -0,0 +1,65 @@
+{
+       "invalid map_fd for function call",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_delete_elem),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "fd 0 is not pointing to valid bpf_map",
+       .result = REJECT,
+},
+{
+       "don't check return value before access",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr = "R0 invalid mem access 'map_value_or_null'",
+       .result = REJECT,
+},
+{
+       "access memory with incorrect alignment",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+       BPF_ST_MEM(BPF_DW, BPF_REG_0, 4, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr = "misaligned value access",
+       .result = REJECT,
+       .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
+},
+{
+       "sometimes access memory with incorrect alignment",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
+       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
+       BPF_EXIT_INSN(),
+       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr = "R0 invalid mem access",
+       .errstr_unpriv = "R0 leaks addr",
+       .result = REJECT,
+       .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
+},
diff --git a/tools/testing/selftests/bpf/verifier/perf_event_sample_period.c b/tools/testing/selftests/bpf/verifier/perf_event_sample_period.c
new file mode 100644 (file)
index 0000000..471c1a5
--- /dev/null
@@ -0,0 +1,59 @@
+{
+       "check bpf_perf_event_data->sample_period byte load permitted",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct bpf_perf_event_data, sample_period)),
+#else
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct bpf_perf_event_data, sample_period) + 7),
+#endif
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_PERF_EVENT,
+},
+{
+       "check bpf_perf_event_data->sample_period half load permitted",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct bpf_perf_event_data, sample_period)),
+#else
+       BPF_LDX_MEM(BPF_H, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct bpf_perf_event_data, sample_period) + 6),
+#endif
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_PERF_EVENT,
+},
+{
+       "check bpf_perf_event_data->sample_period word load permitted",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct bpf_perf_event_data, sample_period)),
+#else
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct bpf_perf_event_data, sample_period) + 4),
+#endif
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_PERF_EVENT,
+},
+{
+       "check bpf_perf_event_data->sample_period dword load permitted",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct bpf_perf_event_data, sample_period)),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_PERF_EVENT,
+},
diff --git a/tools/testing/selftests/bpf/verifier/prevent_map_lookup.c b/tools/testing/selftests/bpf/verifier/prevent_map_lookup.c
new file mode 100644 (file)
index 0000000..bbdba99
--- /dev/null
@@ -0,0 +1,74 @@
+{
+       "prevent map lookup in sockmap",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_sockmap = { 3 },
+       .result = REJECT,
+       .errstr = "cannot pass map_type 15 into func bpf_map_lookup_elem",
+       .prog_type = BPF_PROG_TYPE_SOCK_OPS,
+},
+{
+       "prevent map lookup in sockhash",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_sockhash = { 3 },
+       .result = REJECT,
+       .errstr = "cannot pass map_type 18 into func bpf_map_lookup_elem",
+       .prog_type = BPF_PROG_TYPE_SOCK_OPS,
+},
+{
+       "prevent map lookup in xskmap",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_xskmap = { 3 },
+       .result = REJECT,
+       .errstr = "cannot pass map_type 17 into func bpf_map_lookup_elem",
+       .prog_type = BPF_PROG_TYPE_XDP,
+},
+{
+       "prevent map lookup in stack trace",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_stacktrace = { 3 },
+       .result = REJECT,
+       .errstr = "cannot pass map_type 7 into func bpf_map_lookup_elem",
+       .prog_type = BPF_PROG_TYPE_PERF_EVENT,
+},
+{
+       "prevent map lookup in prog array",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_prog2 = { 3 },
+       .result = REJECT,
+       .errstr = "cannot pass map_type 3 into func bpf_map_lookup_elem",
+},
diff --git a/tools/testing/selftests/bpf/verifier/raw_stack.c b/tools/testing/selftests/bpf/verifier/raw_stack.c
new file mode 100644 (file)
index 0000000..193d9e8
--- /dev/null
@@ -0,0 +1,305 @@
+{
+       "raw_stack: no skb_load_bytes",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 4),
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
+       BPF_MOV64_IMM(BPF_REG_4, 8),
+       /* Call to skb_load_bytes() omitted. */
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "invalid read from stack off -8+0 size 8",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "raw_stack: skb_load_bytes, negative len",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 4),
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
+       BPF_MOV64_IMM(BPF_REG_4, -8),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "R4 min value is negative",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "raw_stack: skb_load_bytes, negative len 2",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 4),
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
+       BPF_MOV64_IMM(BPF_REG_4, ~0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "R4 min value is negative",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "raw_stack: skb_load_bytes, zero len",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 4),
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "invalid stack type R3",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "raw_stack: skb_load_bytes, no init",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 4),
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
+       BPF_MOV64_IMM(BPF_REG_4, 8),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "raw_stack: skb_load_bytes, init",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 4),
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_6, 0, 0xcafe),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
+       BPF_MOV64_IMM(BPF_REG_4, 8),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "raw_stack: skb_load_bytes, spilled regs around bounds",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 4),
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
+       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
+       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
+       BPF_MOV64_IMM(BPF_REG_4, 8),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
+                   offsetof(struct __sk_buff, mark)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
+                   offsetof(struct __sk_buff, priority)),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "raw_stack: skb_load_bytes, spilled regs corruption",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 4),
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
+       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
+       BPF_MOV64_IMM(BPF_REG_4, 8),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
+                   offsetof(struct __sk_buff, mark)),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "R0 invalid mem access 'inv'",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
+{
+       "raw_stack: skb_load_bytes, spilled regs corruption 2",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 4),
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
+       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
+       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  0),
+       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
+       BPF_MOV64_IMM(BPF_REG_4, 8),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6,  0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
+                   offsetof(struct __sk_buff, mark)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
+                   offsetof(struct __sk_buff, priority)),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
+       BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_3,
+                   offsetof(struct __sk_buff, pkt_type)),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "R3 invalid mem access 'inv'",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
+{
+       "raw_stack: skb_load_bytes, spilled regs + data",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 4),
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -16),
+       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, -8),
+       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  0),
+       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1,  8),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
+       BPF_MOV64_IMM(BPF_REG_4, 8),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, -8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6,  8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6,  0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
+                   offsetof(struct __sk_buff, mark)),
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_2,
+                   offsetof(struct __sk_buff, priority)),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "raw_stack: skb_load_bytes, invalid access 1",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 4),
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -513),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
+       BPF_MOV64_IMM(BPF_REG_4, 8),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "invalid stack type R3 off=-513 access_size=8",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "raw_stack: skb_load_bytes, invalid access 2",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 4),
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
+       BPF_MOV64_IMM(BPF_REG_4, 8),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "invalid stack type R3 off=-1 access_size=8",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "raw_stack: skb_load_bytes, invalid access 3",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 4),
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 0xffffffff),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
+       BPF_MOV64_IMM(BPF_REG_4, 0xffffffff),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "R4 min value is negative",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "raw_stack: skb_load_bytes, invalid access 4",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 4),
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -1),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
+       BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "R4 unbounded memory access, use 'var &= const' or 'if (var < const)'",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "raw_stack: skb_load_bytes, invalid access 5",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 4),
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
+       BPF_MOV64_IMM(BPF_REG_4, 0x7fffffff),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "R4 unbounded memory access, use 'var &= const' or 'if (var < const)'",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "raw_stack: skb_load_bytes, invalid access 6",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 4),
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
+       BPF_MOV64_IMM(BPF_REG_4, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "invalid stack type R3 off=-512 access_size=0",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "raw_stack: skb_load_bytes, large access",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_2, 4),
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -512),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
+       BPF_MOV64_IMM(BPF_REG_4, 512),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
diff --git a/tools/testing/selftests/bpf/verifier/runtime_jit.c b/tools/testing/selftests/bpf/verifier/runtime_jit.c
new file mode 100644 (file)
index 0000000..a9a8f62
--- /dev/null
@@ -0,0 +1,80 @@
+{
+       "runtime/jit: tail_call within bounds, prog once",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_LD_MAP_FD(BPF_REG_2, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_tail_call),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_prog1 = { 1 },
+       .result = ACCEPT,
+       .retval = 42,
+},
+{
+       "runtime/jit: tail_call within bounds, prog loop",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_3, 1),
+       BPF_LD_MAP_FD(BPF_REG_2, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_tail_call),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_prog1 = { 1 },
+       .result = ACCEPT,
+       .retval = 41,
+},
+{
+       "runtime/jit: tail_call within bounds, no prog",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_3, 2),
+       BPF_LD_MAP_FD(BPF_REG_2, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_tail_call),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_prog1 = { 1 },
+       .result = ACCEPT,
+       .retval = 1,
+},
+{
+       "runtime/jit: tail_call out of bounds",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_3, 256),
+       BPF_LD_MAP_FD(BPF_REG_2, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_tail_call),
+       BPF_MOV64_IMM(BPF_REG_0, 2),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_prog1 = { 1 },
+       .result = ACCEPT,
+       .retval = 2,
+},
+{
+       "runtime/jit: pass negative index to tail_call",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_3, -1),
+       BPF_LD_MAP_FD(BPF_REG_2, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_tail_call),
+       BPF_MOV64_IMM(BPF_REG_0, 2),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_prog1 = { 1 },
+       .result = ACCEPT,
+       .retval = 2,
+},
+{
+       "runtime/jit: pass > 32bit index to tail_call",
+       .insns = {
+       BPF_LD_IMM64(BPF_REG_3, 0x100000000ULL),
+       BPF_LD_MAP_FD(BPF_REG_2, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_tail_call),
+       BPF_MOV64_IMM(BPF_REG_0, 2),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_prog1 = { 2 },
+       .result = ACCEPT,
+       .retval = 42,
+       /* Verifier rewrite for unpriv skips tail call here. */
+       .retval_unpriv = 2,
+},
diff --git a/tools/testing/selftests/bpf/verifier/search_pruning.c b/tools/testing/selftests/bpf/verifier/search_pruning.c
new file mode 100644 (file)
index 0000000..33e2ea9
--- /dev/null
@@ -0,0 +1,83 @@
+{
+       "pointer/scalar confusion in state equality check (way 1)",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
+       BPF_JMP_A(1),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
+       BPF_JMP_A(0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .result = ACCEPT,
+       .retval = POINTER_VALUE,
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "R0 leaks addr as return value"
+},
+{
+       "pointer/scalar confusion in state equality check (way 2)",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
+       BPF_JMP_A(1),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .result = ACCEPT,
+       .retval = POINTER_VALUE,
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "R0 leaks addr as return value"
+},
+{
+       "liveness pruning and write screening",
+       .insns = {
+       /* Get an unknown value */
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
+       /* branch conditions teach us nothing about R2 */
+       BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JGE, BPF_REG_2, 0, 1),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R0 !read_ok",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_LWT_IN,
+},
+{
+       "varlen_map_value_access pruning",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
+       BPF_MOV32_IMM(BPF_REG_2, MAX_ENTRIES),
+       BPF_JMP_REG(BPF_JSGT, BPF_REG_2, BPF_REG_1, 1),
+       BPF_MOV32_IMM(BPF_REG_1, 0),
+       BPF_ALU32_IMM(BPF_LSH, BPF_REG_1, 2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_JMP_IMM(BPF_JA, 0, 0, 0),
+       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr_unpriv = "R0 leaks addr",
+       .errstr = "R0 unbounded memory access",
+       .result_unpriv = REJECT,
+       .result = REJECT,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
diff --git a/tools/testing/selftests/bpf/verifier/spill_fill.c b/tools/testing/selftests/bpf/verifier/spill_fill.c
new file mode 100644 (file)
index 0000000..d58db72
--- /dev/null
@@ -0,0 +1,75 @@
+{
+       "check valid spill/fill",
+       .insns = {
+       /* spill R1(ctx) into stack */
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
+       /* fill it back into R2 */
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_10, -8),
+       /* should be able to access R0 = *(R2 + 8) */
+       /* BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 8), */
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_EXIT_INSN(),
+       },
+       .errstr_unpriv = "R0 leaks addr",
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+       .retval = POINTER_VALUE,
+},
+{
+       "check valid spill/fill, skb mark",
+       .insns = {
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_1),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, -8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0,
+                   offsetof(struct __sk_buff, mark)),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .result_unpriv = ACCEPT,
+},
+{
+       "check corrupted spill/fill",
+       .insns = {
+       /* spill R1(ctx) into stack */
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
+       /* mess up with R1 pointer on stack */
+       BPF_ST_MEM(BPF_B, BPF_REG_10, -7, 0x23),
+       /* fill back into R0 is fine for priv.
+        * R0 now becomes SCALAR_VALUE.
+        */
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
+       /* Load from R0 should fail. */
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 8),
+       BPF_EXIT_INSN(),
+       },
+       .errstr_unpriv = "attempt to corrupt spilled",
+       .errstr = "R0 invalid mem access 'inv",
+       .result = REJECT,
+},
+{
+       "check corrupted spill/fill, LSB",
+       .insns = {
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
+       BPF_ST_MEM(BPF_H, BPF_REG_10, -8, 0xcafe),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
+       BPF_EXIT_INSN(),
+       },
+       .errstr_unpriv = "attempt to corrupt spilled",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+       .retval = POINTER_VALUE,
+},
+{
+       "check corrupted spill/fill, MSB",
+       .insns = {
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
+       BPF_ST_MEM(BPF_W, BPF_REG_10, -4, 0x12345678),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
+       BPF_EXIT_INSN(),
+       },
+       .errstr_unpriv = "attempt to corrupt spilled",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+       .retval = POINTER_VALUE,
+},
diff --git a/tools/testing/selftests/bpf/verifier/stack_ptr.c b/tools/testing/selftests/bpf/verifier/stack_ptr.c
new file mode 100644 (file)
index 0000000..7276620
--- /dev/null
@@ -0,0 +1,317 @@
+{
+       "PTR_TO_STACK store/load",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
+       BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .retval = 0xfaceb00c,
+},
+{
+       "PTR_TO_STACK store/load - bad alignment on off",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "misaligned stack access off (0x0; 0x0)+-8+2 size 8",
+},
+{
+       "PTR_TO_STACK store/load - bad alignment on reg",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
+       BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "misaligned stack access off (0x0; 0x0)+-10+8 size 8",
+},
+{
+       "PTR_TO_STACK store/load - out of bounds low",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -80000),
+       BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "invalid stack off=-79992 size=8",
+       .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
+},
+{
+       "PTR_TO_STACK store/load - out of bounds high",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "invalid stack off=0 size=8",
+},
+{
+       "PTR_TO_STACK check high 1",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -1),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .retval = 42,
+},
+{
+       "PTR_TO_STACK check high 2",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, -1, 42),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, -1),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .retval = 42,
+},
+{
+       "PTR_TO_STACK check high 3",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, -1, 42),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, -1),
+       BPF_EXIT_INSN(),
+       },
+       .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+       .retval = 42,
+},
+{
+       "PTR_TO_STACK check high 4",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
+       .errstr = "invalid stack off=0 size=1",
+       .result = REJECT,
+},
+{
+       "PTR_TO_STACK check high 5",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, (1 << 29) - 1),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "invalid stack off",
+},
+{
+       "PTR_TO_STACK check high 6",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, (1 << 29) - 1),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, SHRT_MAX, 42),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, SHRT_MAX),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "invalid stack off",
+},
+{
+       "PTR_TO_STACK check high 7",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, (1 << 29) - 1),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, (1 << 29) - 1),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, SHRT_MAX, 42),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, SHRT_MAX),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
+       .errstr = "fp pointer offset",
+},
+{
+       "PTR_TO_STACK check low 1",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -512),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .retval = 42,
+},
+{
+       "PTR_TO_STACK check low 2",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -513),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, 1, 42),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 1),
+       BPF_EXIT_INSN(),
+       },
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
+       .result = ACCEPT,
+       .retval = 42,
+},
+{
+       "PTR_TO_STACK check low 3",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -513),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
+       .errstr = "invalid stack off=-513 size=1",
+       .result = REJECT,
+},
+{
+       "PTR_TO_STACK check low 4",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, INT_MIN),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "math between fp pointer",
+},
+{
+       "PTR_TO_STACK check low 5",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -((1 << 29) - 1)),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "invalid stack off",
+},
+{
+       "PTR_TO_STACK check low 6",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -((1 << 29) - 1)),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, SHRT_MIN, 42),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, SHRT_MIN),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "invalid stack off",
+},
+{
+       "PTR_TO_STACK check low 7",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -((1 << 29) - 1)),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -((1 << 29) - 1)),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, SHRT_MIN, 42),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, SHRT_MIN),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
+       .errstr = "fp pointer offset",
+},
+{
+       "PTR_TO_STACK mixed reg/k, 1",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -3),
+       BPF_MOV64_IMM(BPF_REG_2, -3),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .retval = 42,
+},
+{
+       "PTR_TO_STACK mixed reg/k, 2",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, 0),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -3),
+       BPF_MOV64_IMM(BPF_REG_2, -3),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
+       BPF_MOV64_REG(BPF_REG_5, BPF_REG_10),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_5, -6),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .retval = 42,
+},
+{
+       "PTR_TO_STACK mixed reg/k, 3",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -3),
+       BPF_MOV64_IMM(BPF_REG_2, -3),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .retval = -3,
+},
+{
+       "PTR_TO_STACK reg",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_MOV64_IMM(BPF_REG_2, -3),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
+       BPF_ST_MEM(BPF_B, BPF_REG_1, 0, 42),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "invalid stack off=0 size=1",
+       .result = ACCEPT,
+       .retval = 42,
+},
+{
+       "stack pointer arithmetic",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_1, 4),
+       BPF_JMP_IMM(BPF_JA, 0, 0, 0),
+       BPF_MOV64_REG(BPF_REG_7, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, -10),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_1),
+       BPF_ST_MEM(0, BPF_REG_2, 4, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
+       BPF_ST_MEM(0, BPF_REG_2, 4, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+},
diff --git a/tools/testing/selftests/bpf/verifier/uninit.c b/tools/testing/selftests/bpf/verifier/uninit.c
new file mode 100644 (file)
index 0000000..987a587
--- /dev/null
@@ -0,0 +1,39 @@
+{
+       "read uninitialized register",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R2 !read_ok",
+       .result = REJECT,
+},
+{
+       "read invalid register",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_0, -1),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R15 is invalid",
+       .result = REJECT,
+},
+{
+       "program doesn't init R0 before exit",
+       .insns = {
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_2, BPF_REG_1),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R0 !read_ok",
+       .result = REJECT,
+},
+{
+       "program doesn't init R0 before exit in all branches",
+       .insns = {
+       BPF_JMP_IMM(BPF_JGE, BPF_REG_1, 0, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 2),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "R0 !read_ok",
+       .errstr_unpriv = "R1 pointer comparison",
+       .result = REJECT,
+},
diff --git a/tools/testing/selftests/bpf/verifier/unpriv.c b/tools/testing/selftests/bpf/verifier/unpriv.c
new file mode 100644 (file)
index 0000000..dca58cf
--- /dev/null
@@ -0,0 +1,521 @@
+{
+       "unpriv: return pointer",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "R0 leaks addr",
+       .retval = POINTER_VALUE,
+},
+{
+       "unpriv: add const to pointer",
+       .insns = {
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+},
+{
+       "unpriv: add pointer to pointer",
+       .insns = {
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "R1 pointer += pointer",
+},
+{
+       "unpriv: neg pointer",
+       .insns = {
+       BPF_ALU64_IMM(BPF_NEG, BPF_REG_1, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "R1 pointer arithmetic",
+},
+{
+       "unpriv: cmp pointer with const",
+       .insns = {
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "R1 pointer comparison",
+},
+{
+       "unpriv: cmp pointer with pointer",
+       .insns = {
+       BPF_JMP_REG(BPF_JEQ, BPF_REG_1, BPF_REG_10, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "R10 pointer comparison",
+},
+{
+       "unpriv: check that printk is disallowed",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
+       BPF_MOV64_IMM(BPF_REG_2, 8),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_trace_printk),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr_unpriv = "unknown func bpf_trace_printk#6",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+},
+{
+       "unpriv: pass pointer to helper function",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
+       BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_update_elem),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr_unpriv = "R4 leaks addr",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+},
+{
+       "unpriv: indirectly pass pointer on stack to helper function",
+       .insns = {
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr = "invalid indirect read from stack off -8+0 size 8",
+       .result = REJECT,
+},
+{
+       "unpriv: mangle pointer on stack 1",
+       .insns = {
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
+       BPF_ST_MEM(BPF_W, BPF_REG_10, -8, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr_unpriv = "attempt to corrupt spilled",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+},
+{
+       "unpriv: mangle pointer on stack 2",
+       .insns = {
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
+       BPF_ST_MEM(BPF_B, BPF_REG_10, -1, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr_unpriv = "attempt to corrupt spilled",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+},
+{
+       "unpriv: read pointer from stack in small chunks",
+       .insns = {
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_10, -8),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_10, -8),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "invalid size",
+       .result = REJECT,
+},
+{
+       "unpriv: write pointer into ctx",
+       .insns = {
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr_unpriv = "R1 leaks addr",
+       .result_unpriv = REJECT,
+       .errstr = "invalid bpf_context access",
+       .result = REJECT,
+},
+{
+       "unpriv: spill/fill of ctx",
+       .insns = {
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
+       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+},
+{
+       "unpriv: spill/fill of ctx 2",
+       .insns = {
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
+       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_hash_recalc),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "unpriv: spill/fill of ctx 3",
+       .insns = {
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
+       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
+       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_hash_recalc),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "R1 type=fp expected=ctx",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "unpriv: spill/fill of ctx 4",
+       .insns = {
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
+       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_RAW_INSN(BPF_STX | BPF_XADD | BPF_DW, BPF_REG_10, BPF_REG_0, -8, 0),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_hash_recalc),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "R1 type=inv expected=ctx",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "unpriv: spill/fill of different pointers stx",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_3, 42),
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
+       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
+       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
+                   offsetof(struct __sk_buff, mark)),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "same insn cannot be used with different pointers",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "unpriv: spill/fill of different pointers stx - ctx and sock",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
+       /* struct bpf_sock *sock = bpf_sock_lookup(...); */
+       BPF_SK_LOOKUP,
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
+       /* u64 foo; */
+       /* void *target = &foo; */
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
+       /* if (skb == NULL) *target = sock; */
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
+               BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
+       /* else *target = skb; */
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
+               BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
+       /* struct __sk_buff *skb = *target; */
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
+       /* skb->mark = 42; */
+       BPF_MOV64_IMM(BPF_REG_3, 42),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
+                   offsetof(struct __sk_buff, mark)),
+       /* if (sk) bpf_sk_release(sk) */
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
+               BPF_EMIT_CALL(BPF_FUNC_sk_release),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "type=ctx expected=sock",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "unpriv: spill/fill of different pointers stx - leak sock",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
+       /* struct bpf_sock *sock = bpf_sock_lookup(...); */
+       BPF_SK_LOOKUP,
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
+       /* u64 foo; */
+       /* void *target = &foo; */
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
+       /* if (skb == NULL) *target = sock; */
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
+               BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
+       /* else *target = skb; */
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
+               BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
+       /* struct __sk_buff *skb = *target; */
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
+       /* skb->mark = 42; */
+       BPF_MOV64_IMM(BPF_REG_3, 42),
+       BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
+                   offsetof(struct __sk_buff, mark)),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       //.errstr = "same insn cannot be used with different pointers",
+       .errstr = "Unreleased reference",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "unpriv: spill/fill of different pointers stx - sock and ctx (read)",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
+       /* struct bpf_sock *sock = bpf_sock_lookup(...); */
+       BPF_SK_LOOKUP,
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
+       /* u64 foo; */
+       /* void *target = &foo; */
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
+       /* if (skb) *target = skb */
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
+               BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
+       /* else *target = sock */
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
+               BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
+       /* struct bpf_sock *sk = *target; */
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
+       /* if (sk) u32 foo = sk->mark; bpf_sk_release(sk); */
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
+               BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                           offsetof(struct bpf_sock, mark)),
+               BPF_EMIT_CALL(BPF_FUNC_sk_release),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "same insn cannot be used with different pointers",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "unpriv: spill/fill of different pointers stx - sock and ctx (write)",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
+       /* struct bpf_sock *sock = bpf_sock_lookup(...); */
+       BPF_SK_LOOKUP,
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
+       /* u64 foo; */
+       /* void *target = &foo; */
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
+       /* if (skb) *target = skb */
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
+               BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
+       /* else *target = sock */
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
+               BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
+       /* struct bpf_sock *sk = *target; */
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
+       /* if (sk) sk->mark = 42; bpf_sk_release(sk); */
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
+               BPF_MOV64_IMM(BPF_REG_3, 42),
+               BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_3,
+                           offsetof(struct bpf_sock, mark)),
+               BPF_EMIT_CALL(BPF_FUNC_sk_release),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       //.errstr = "same insn cannot be used with different pointers",
+       .errstr = "cannot write into socket",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+},
+{
+       "unpriv: spill/fill of different pointers ldx",
+       .insns = {
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,
+                     -(__s32)offsetof(struct bpf_perf_event_data,
+                                      sample_period) - 8),
+       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_2, 0),
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
+       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1,
+                   offsetof(struct bpf_perf_event_data, sample_period)),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = REJECT,
+       .errstr = "same insn cannot be used with different pointers",
+       .prog_type = BPF_PROG_TYPE_PERF_EVENT,
+},
+{
+       "unpriv: write pointer into map elem value",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+       BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 3 },
+       .errstr_unpriv = "R0 leaks addr",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+},
+{
+       "alu32: mov u32 const",
+       .insns = {
+       BPF_MOV32_IMM(BPF_REG_7, 0),
+       BPF_ALU32_IMM(BPF_AND, BPF_REG_7, 1),
+       BPF_MOV32_REG(BPF_REG_0, BPF_REG_7),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
+       BPF_EXIT_INSN(),
+       },
+       .result = ACCEPT,
+       .retval = 0,
+},
+{
+       "unpriv: partial copy of pointer",
+       .insns = {
+       BPF_MOV32_REG(BPF_REG_1, BPF_REG_10),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr_unpriv = "R10 partial copy",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+},
+{
+       "unpriv: pass pointer to tail_call",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_3, BPF_REG_1),
+       BPF_LD_MAP_FD(BPF_REG_2, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_tail_call),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_prog1 = { 1 },
+       .errstr_unpriv = "R3 leaks addr into helper",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+},
+{
+       "unpriv: cmp map pointer with zero",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_1, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 1 },
+       .errstr_unpriv = "R1 pointer comparison",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+},
+{
+       "unpriv: write into frame pointer",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_10, BPF_REG_1),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "frame pointer is read only",
+       .result = REJECT,
+},
+{
+       "unpriv: spill/fill frame pointer",
+       .insns = {
+       BPF_ALU64_REG(BPF_MOV, BPF_REG_6, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
+       BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_10, 0),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_10, BPF_REG_6, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "frame pointer is read only",
+       .result = REJECT,
+},
+{
+       "unpriv: cmp of frame pointer",
+       .insns = {
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_10, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr_unpriv = "R10 pointer comparison",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+},
+{
+       "unpriv: adding of fp",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_1, 0),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_10),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, -8),
+       BPF_EXIT_INSN(),
+       },
+       .errstr_unpriv = "R1 stack pointer arithmetic goes out of range",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+},
+{
+       "unpriv: cmp of stack pointer",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_2, 0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr_unpriv = "R2 pointer comparison",
+       .result_unpriv = REJECT,
+       .result = ACCEPT,
+},
diff --git a/tools/testing/selftests/bpf/verifier/value.c b/tools/testing/selftests/bpf/verifier/value.c
new file mode 100644 (file)
index 0000000..0e42592
--- /dev/null
@@ -0,0 +1,104 @@
+{
+       "map element value store of cleared call register",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+       BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr_unpriv = "R1 !read_ok",
+       .errstr = "R1 !read_ok",
+       .result = REJECT,
+       .result_unpriv = REJECT,
+},
+{
+       "map element value with unaligned store",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 17),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
+       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
+       BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 43),
+       BPF_ST_MEM(BPF_DW, BPF_REG_0, -2, 44),
+       BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
+       BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 32),
+       BPF_ST_MEM(BPF_DW, BPF_REG_8, 2, 33),
+       BPF_ST_MEM(BPF_DW, BPF_REG_8, -2, 34),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 5),
+       BPF_ST_MEM(BPF_DW, BPF_REG_8, 0, 22),
+       BPF_ST_MEM(BPF_DW, BPF_REG_8, 4, 23),
+       BPF_ST_MEM(BPF_DW, BPF_REG_8, -7, 24),
+       BPF_MOV64_REG(BPF_REG_7, BPF_REG_8),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_7, 3),
+       BPF_ST_MEM(BPF_DW, BPF_REG_7, 0, 22),
+       BPF_ST_MEM(BPF_DW, BPF_REG_7, 4, 23),
+       BPF_ST_MEM(BPF_DW, BPF_REG_7, -4, 24),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr_unpriv = "R0 leaks addr",
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
+{
+       "map element value with unaligned load",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
+       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES, 9),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 3),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 2),
+       BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 0),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_8, 2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 5),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 4),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr_unpriv = "R0 leaks addr",
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
+{
+       "map element value is preserved across register spilling",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, offsetof(struct test_val, foo)),
+       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
+       BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr_unpriv = "R0 leaks addr",
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
diff --git a/tools/testing/selftests/bpf/verifier/value_adj_spill.c b/tools/testing/selftests/bpf/verifier/value_adj_spill.c
new file mode 100644 (file)
index 0000000..7135e80
--- /dev/null
@@ -0,0 +1,43 @@
+{
+       "map element value is preserved across register spilling",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
+       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -184),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
+       BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr_unpriv = "R0 leaks addr",
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+},
+{
+       "map element value or null is marked on register spilling",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -152),
+       BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_1, 0),
+       BPF_ST_MEM(BPF_DW, BPF_REG_3, 0, 42),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr_unpriv = "R0 leaks addr",
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+},
diff --git a/tools/testing/selftests/bpf/verifier/value_illegal_alu.c b/tools/testing/selftests/bpf/verifier/value_illegal_alu.c
new file mode 100644 (file)
index 0000000..7f6c232
--- /dev/null
@@ -0,0 +1,94 @@
+{
+       "map element value illegal alu op, 1",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr = "R0 bitwise operator &= on pointer",
+       .result = REJECT,
+},
+{
+       "map element value illegal alu op, 2",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
+       BPF_ALU32_IMM(BPF_ADD, BPF_REG_0, 0),
+       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr = "R0 32-bit pointer arithmetic prohibited",
+       .result = REJECT,
+},
+{
+       "map element value illegal alu op, 3",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
+       BPF_ALU64_IMM(BPF_DIV, BPF_REG_0, 42),
+       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr = "R0 pointer arithmetic with /= operator",
+       .result = REJECT,
+},
+{
+       "map element value illegal alu op, 4",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
+       BPF_ENDIAN(BPF_FROM_BE, BPF_REG_0, 64),
+       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr_unpriv = "R0 pointer arithmetic prohibited",
+       .errstr = "invalid mem access 'inv'",
+       .result = REJECT,
+       .result_unpriv = REJECT,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
+{
+       "map element value illegal alu op, 5",
+       .insns = {
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
+       BPF_MOV64_IMM(BPF_REG_3, 4096),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
+       BPF_STX_XADD(BPF_DW, BPF_REG_2, BPF_REG_3, 0),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0),
+       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 22),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr = "R0 invalid mem access 'inv'",
+       .result = REJECT,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
diff --git a/tools/testing/selftests/bpf/verifier/value_or_null.c b/tools/testing/selftests/bpf/verifier/value_or_null.c
new file mode 100644 (file)
index 0000000..860d4a7
--- /dev/null
@@ -0,0 +1,152 @@
+{
+       "multiple registers share map_lookup_elem result",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_1, 10),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+       BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 4 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS
+},
+{
+       "alu ops on ptr_to_map_value_or_null, 1",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_1, 10),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -2),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 2),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+       BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 4 },
+       .errstr = "R4 pointer arithmetic on map_value_or_null",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS
+},
+{
+       "alu ops on ptr_to_map_value_or_null, 2",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_1, 10),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_4, -1),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+       BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 4 },
+       .errstr = "R4 pointer arithmetic on map_value_or_null",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS
+},
+{
+       "alu ops on ptr_to_map_value_or_null, 3",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_1, 10),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
+       BPF_ALU64_IMM(BPF_LSH, BPF_REG_4, 1),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+       BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 4 },
+       .errstr = "R4 pointer arithmetic on map_value_or_null",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS
+},
+{
+       "invalid memory access with multiple map_lookup_elem calls",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_1, 10),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
+       BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+       BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 4 },
+       .result = REJECT,
+       .errstr = "R4 !read_ok",
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS
+},
+{
+       "valid indirect map_lookup_elem access with 2nd lookup in branch",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_1, 10),
+       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
+       BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_MOV64_IMM(BPF_REG_2, 10),
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0, 3),
+       BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_7),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+       BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 4 },
+       .result = ACCEPT,
+       .prog_type = BPF_PROG_TYPE_SCHED_CLS
+},
+{
+       "invalid map access from else condition",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
+       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JGE, BPF_REG_1, MAX_ENTRIES-1, 1),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
+       BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, offsetof(struct test_val, foo)),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 3 },
+       .errstr = "R0 unbounded memory access",
+       .result = REJECT,
+       .errstr_unpriv = "R0 leaks addr",
+       .result_unpriv = REJECT,
+       .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
+},
diff --git a/tools/testing/selftests/bpf/verifier/value_ptr_arith.c b/tools/testing/selftests/bpf/verifier/value_ptr_arith.c
new file mode 100644 (file)
index 0000000..9ab5ace
--- /dev/null
@@ -0,0 +1,792 @@
+{
+       "map access: known scalar += value_ptr from different maps",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, len)),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 3),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
+       BPF_MOV64_IMM(BPF_REG_1, 4),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_16b = { 5 },
+       .fixup_map_array_48b = { 8 },
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "R1 tried to add from different maps",
+       .retval = 1,
+},
+{
+       "map access: value_ptr -= known scalar from different maps",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, len)),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 3),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_MOV64_IMM(BPF_REG_1, 4),
+       BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_16b = { 5 },
+       .fixup_map_array_48b = { 8 },
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "R0 min value is outside of the array range",
+       .retval = 1,
+},
+{
+       "map access: known scalar += value_ptr from different maps, but same value properties",
+       .insns = {
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                   offsetof(struct __sk_buff, len)),
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 3),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
+       BPF_MOV64_IMM(BPF_REG_1, 4),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_48b = { 5 },
+       .fixup_map_array_48b = { 8 },
+       .result = ACCEPT,
+       .retval = 1,
+},
+{
+       "map access: mixing value pointer and scalar, 1",
+       .insns = {
+       // load map value pointer into r0 and r2
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_LD_MAP_FD(BPF_REG_ARG1, 0),
+       BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -16),
+       BPF_ST_MEM(BPF_DW, BPF_REG_FP, -16, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+       BPF_EXIT_INSN(),
+       // load some number from the map into r1
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       // depending on r1, branch:
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 3),
+       // branch A
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       BPF_JMP_A(2),
+       // branch B
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_3, 0x100000),
+       // common instruction
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
+       // depending on r1, branch:
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
+       // branch A
+       BPF_JMP_A(4),
+       // branch B
+       BPF_MOV64_IMM(BPF_REG_0, 0x13371337),
+       // verifier follows fall-through
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0x100000, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       // fake-dead code; targeted from branch A to
+       // prevent dead code sanitization
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 1 },
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "R2 tried to add from different pointers or scalars",
+       .retval = 0,
+},
+{
+       "map access: mixing value pointer and scalar, 2",
+       .insns = {
+       // load map value pointer into r0 and r2
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_LD_MAP_FD(BPF_REG_ARG1, 0),
+       BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -16),
+       BPF_ST_MEM(BPF_DW, BPF_REG_FP, -16, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+       BPF_EXIT_INSN(),
+       // load some number from the map into r1
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       // depending on r1, branch:
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
+       // branch A
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_3, 0x100000),
+       BPF_JMP_A(2),
+       // branch B
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
+       BPF_MOV64_IMM(BPF_REG_3, 0),
+       // common instruction
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
+       // depending on r1, branch:
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1),
+       // branch A
+       BPF_JMP_A(4),
+       // branch B
+       BPF_MOV64_IMM(BPF_REG_0, 0x13371337),
+       // verifier follows fall-through
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 0x100000, 2),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       // fake-dead code; targeted from branch A to
+       // prevent dead code sanitization
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 1 },
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "R2 tried to add from different maps or paths",
+       .retval = 0,
+},
+{
+       "sanitation: alu with different scalars",
+       .insns = {
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_LD_MAP_FD(BPF_REG_ARG1, 0),
+       BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -16),
+       BPF_ST_MEM(BPF_DW, BPF_REG_FP, -16, 0),
+       BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
+       BPF_EXIT_INSN(),
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
+       BPF_MOV64_IMM(BPF_REG_2, 0),
+       BPF_MOV64_IMM(BPF_REG_3, 0x100000),
+       BPF_JMP_A(2),
+       BPF_MOV64_IMM(BPF_REG_2, 42),
+       BPF_MOV64_IMM(BPF_REG_3, 0x100001),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),
+       BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 1 },
+       .result = ACCEPT,
+       .retval = 0x100000,
+},
+{
+       "map access: value_ptr += known scalar, upper oob arith, test 1",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_MOV64_IMM(BPF_REG_1, 48),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
+       .retval = 1,
+},
+{
+       "map access: value_ptr += known scalar, upper oob arith, test 2",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_MOV64_IMM(BPF_REG_1, 49),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
+       .retval = 1,
+},
+{
+       "map access: value_ptr += known scalar, upper oob arith, test 3",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_MOV64_IMM(BPF_REG_1, 47),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
+       .retval = 1,
+},
+{
+       "map access: value_ptr -= known scalar, lower oob arith, test 1",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
+       BPF_MOV64_IMM(BPF_REG_1, 47),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_MOV64_IMM(BPF_REG_1, 48),
+       BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = REJECT,
+       .errstr = "R0 min value is outside of the array range",
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
+},
+{
+       "map access: value_ptr -= known scalar, lower oob arith, test 2",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
+       BPF_MOV64_IMM(BPF_REG_1, 47),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_MOV64_IMM(BPF_REG_1, 48),
+       BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
+       BPF_MOV64_IMM(BPF_REG_1, 1),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
+       .retval = 1,
+},
+{
+       "map access: value_ptr -= known scalar, lower oob arith, test 3",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
+       BPF_MOV64_IMM(BPF_REG_1, 47),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_MOV64_IMM(BPF_REG_1, 47),
+       BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
+       .retval = 1,
+},
+{
+       "map access: known scalar += value_ptr",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
+       BPF_MOV64_IMM(BPF_REG_1, 4),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = ACCEPT,
+       .retval = 1,
+},
+{
+       "map access: value_ptr += known scalar, 1",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
+       BPF_MOV64_IMM(BPF_REG_1, 4),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = ACCEPT,
+       .retval = 1,
+},
+{
+       "map access: value_ptr += known scalar, 2",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
+       BPF_MOV64_IMM(BPF_REG_1, 49),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = REJECT,
+       .errstr = "invalid access to map value",
+},
+{
+       "map access: value_ptr += known scalar, 3",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
+       BPF_MOV64_IMM(BPF_REG_1, -1),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = REJECT,
+       .errstr = "invalid access to map value",
+},
+{
+       "map access: value_ptr += known scalar, 4",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
+       BPF_MOV64_IMM(BPF_REG_1, 5),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_MOV64_IMM(BPF_REG_1, -2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_MOV64_IMM(BPF_REG_1, -1),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
+       .retval = 1,
+},
+{
+       "map access: value_ptr += known scalar, 5",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
+       BPF_MOV64_IMM(BPF_REG_1, (6 + 1) * sizeof(int)),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = ACCEPT,
+       .retval = 0xabcdef12,
+},
+{
+       "map access: value_ptr += known scalar, 6",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
+       BPF_MOV64_IMM(BPF_REG_1, (3 + 1) * sizeof(int)),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_MOV64_IMM(BPF_REG_1, 3 * sizeof(int)),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = ACCEPT,
+       .retval = 0xabcdef12,
+},
+{
+       "map access: unknown scalar += value_ptr, 1",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = ACCEPT,
+       .retval = 1,
+},
+{
+       "map access: unknown scalar += value_ptr, 2",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 31),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = ACCEPT,
+       .retval = 0xabcdef12,
+},
+{
+       "map access: unknown scalar += value_ptr, 3",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
+       BPF_MOV64_IMM(BPF_REG_1, -1),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_MOV64_IMM(BPF_REG_1, 1),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 31),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
+       .retval = 0xabcdef12,
+},
+{
+       "map access: unknown scalar += value_ptr, 4",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
+       BPF_MOV64_IMM(BPF_REG_1, 19),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 31),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = REJECT,
+       .errstr = "R1 max value is outside of the array range",
+       .errstr_unpriv = "R1 pointer arithmetic of map value goes out of range",
+},
+{
+       "map access: value_ptr += unknown scalar, 1",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = ACCEPT,
+       .retval = 1,
+},
+{
+       "map access: value_ptr += unknown scalar, 2",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_0, 0),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 31),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = ACCEPT,
+       .retval = 0xabcdef12,
+},
+{
+       "map access: value_ptr += unknown scalar, 3",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 11),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0, 0),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 8),
+       BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 16),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_3, 1),
+       BPF_ALU64_IMM(BPF_OR, BPF_REG_3, 1),
+       BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_3, 4),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_3),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       BPF_MOV64_IMM(BPF_REG_0, 2),
+       BPF_JMP_IMM(BPF_JA, 0, 0, -3),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = ACCEPT,
+       .retval = 1,
+},
+{
+       "map access: value_ptr += value_ptr",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_0),
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = REJECT,
+       .errstr = "R0 pointer += pointer prohibited",
+},
+{
+       "map access: known scalar -= value_ptr",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
+       BPF_MOV64_IMM(BPF_REG_1, 4),
+       BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = REJECT,
+       .errstr = "R1 tried to subtract pointer from scalar",
+},
+{
+       "map access: value_ptr -= known scalar",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
+       BPF_MOV64_IMM(BPF_REG_1, 4),
+       BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = REJECT,
+       .errstr = "R0 min value is outside of the array range",
+},
+{
+       "map access: value_ptr -= known scalar, 2",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
+       BPF_MOV64_IMM(BPF_REG_1, 6),
+       BPF_MOV64_IMM(BPF_REG_2, 4),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_2),
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
+       .retval = 1,
+},
+{
+       "map access: unknown scalar -= value_ptr",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
+       BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
+       BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = REJECT,
+       .errstr = "R1 tried to subtract pointer from scalar",
+},
+{
+       "map access: value_ptr -= unknown scalar",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
+       BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = REJECT,
+       .errstr = "R0 min value is negative",
+},
+{
+       "map access: value_ptr -= unknown scalar, 2",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xf),
+       BPF_ALU64_IMM(BPF_OR, BPF_REG_1, 0x7),
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0x7),
+       BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = ACCEPT,
+       .result_unpriv = REJECT,
+       .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
+       .retval = 1,
+},
+{
+       "map access: value_ptr -= value_ptr",
+       .insns = {
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
+       BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_0),
+       BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
+       BPF_MOV64_IMM(BPF_REG_0, 1),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_array_48b = { 3 },
+       .result = REJECT,
+       .errstr = "R0 invalid mem access 'inv'",
+       .errstr_unpriv = "R0 pointer -= pointer prohibited",
+},
diff --git a/tools/testing/selftests/bpf/verifier/var_off.c b/tools/testing/selftests/bpf/verifier/var_off.c
new file mode 100644 (file)
index 0000000..1e536ff
--- /dev/null
@@ -0,0 +1,66 @@
+{
+       "variable-offset ctx access",
+       .insns = {
+       /* Get an unknown value */
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
+       /* Make it small and 4-byte aligned */
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
+       /* add it to skb.  We now have either &skb->len or
+        * &skb->pkt_type, but we don't know which
+        */
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
+       /* dereference it */
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "variable ctx access var_off=(0x0; 0x4)",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_LWT_IN,
+},
+{
+       "variable-offset stack access",
+       .insns = {
+       /* Fill the top 8 bytes of the stack */
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       /* Get an unknown value */
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
+       /* Make it small and 4-byte aligned */
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
+       BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 8),
+       /* add it to fp.  We now have either fp-4 or fp-8, but
+        * we don't know which
+        */
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
+       /* dereference it */
+       BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_2, 0),
+       BPF_EXIT_INSN(),
+       },
+       .errstr = "variable stack access var_off=(0xfffffffffffffff8; 0x4)",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_LWT_IN,
+},
+{
+       "indirect variable-offset stack access",
+       .insns = {
+       /* Fill the top 8 bytes of the stack */
+       BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+       /* Get an unknown value */
+       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),
+       /* Make it small and 4-byte aligned */
+       BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),
+       BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 8),
+       /* add it to fp.  We now have either fp-4 or fp-8, but
+        * we don't know which
+        */
+       BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),
+       /* dereference it indirectly */
+       BPF_LD_MAP_FD(BPF_REG_1, 0),
+       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
+       BPF_MOV64_IMM(BPF_REG_0, 0),
+       BPF_EXIT_INSN(),
+       },
+       .fixup_map_hash_8b = { 5 },
+       .errstr = "variable stack read R2",
+       .result = REJECT,
+       .prog_type = BPF_PROG_TYPE_LWT_IN,
+},