0001 {
0002 "helper access to packet: test1, valid packet_ptr range",
0003 .insns = {
0004 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
0005 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
0006 offsetof(struct xdp_md, data_end)),
0007 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
0008 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
0009 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
0010 BPF_LD_MAP_FD(BPF_REG_1, 0),
0011 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
0012 BPF_MOV64_IMM(BPF_REG_4, 0),
0013 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_update_elem),
0014 BPF_MOV64_IMM(BPF_REG_0, 0),
0015 BPF_EXIT_INSN(),
0016 },
0017 .fixup_map_hash_8b = { 5 },
0018 .result_unpriv = ACCEPT,
0019 .result = ACCEPT,
0020 .prog_type = BPF_PROG_TYPE_XDP,
0021 },
0022 {
0023 "helper access to packet: test2, unchecked packet_ptr",
0024 .insns = {
0025 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
0026 BPF_LD_MAP_FD(BPF_REG_1, 0),
0027 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
0028 BPF_MOV64_IMM(BPF_REG_0, 0),
0029 BPF_EXIT_INSN(),
0030 },
0031 .fixup_map_hash_8b = { 1 },
0032 .result = REJECT,
0033 .errstr = "invalid access to packet",
0034 .prog_type = BPF_PROG_TYPE_XDP,
0035 },
0036 {
0037 "helper access to packet: test3, variable add",
0038 .insns = {
0039 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
0040 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
0041 offsetof(struct xdp_md, data_end)),
0042 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
0043 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
0044 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
0045 BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
0046 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
0047 BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
0048 BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
0049 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
0050 BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
0051 BPF_LD_MAP_FD(BPF_REG_1, 0),
0052 BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
0053 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
0054 BPF_MOV64_IMM(BPF_REG_0, 0),
0055 BPF_EXIT_INSN(),
0056 },
0057 .fixup_map_hash_8b = { 11 },
0058 .result = ACCEPT,
0059 .prog_type = BPF_PROG_TYPE_XDP,
0060 },
0061 {
0062 "helper access to packet: test4, packet_ptr with bad range",
0063 .insns = {
0064 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
0065 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
0066 offsetof(struct xdp_md, data_end)),
0067 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
0068 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
0069 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
0070 BPF_MOV64_IMM(BPF_REG_0, 0),
0071 BPF_EXIT_INSN(),
0072 BPF_LD_MAP_FD(BPF_REG_1, 0),
0073 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
0074 BPF_MOV64_IMM(BPF_REG_0, 0),
0075 BPF_EXIT_INSN(),
0076 },
0077 .fixup_map_hash_8b = { 7 },
0078 .result = REJECT,
0079 .errstr = "invalid access to packet",
0080 .prog_type = BPF_PROG_TYPE_XDP,
0081 },
0082 {
0083 "helper access to packet: test5, packet_ptr with too short range",
0084 .insns = {
0085 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
0086 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
0087 offsetof(struct xdp_md, data_end)),
0088 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
0089 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
0090 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
0091 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
0092 BPF_LD_MAP_FD(BPF_REG_1, 0),
0093 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
0094 BPF_MOV64_IMM(BPF_REG_0, 0),
0095 BPF_EXIT_INSN(),
0096 },
0097 .fixup_map_hash_8b = { 6 },
0098 .result = REJECT,
0099 .errstr = "invalid access to packet",
0100 .prog_type = BPF_PROG_TYPE_XDP,
0101 },
0102 {
0103 "helper access to packet: test6, cls valid packet_ptr range",
0104 .insns = {
0105 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
0106 offsetof(struct __sk_buff, data)),
0107 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
0108 offsetof(struct __sk_buff, data_end)),
0109 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
0110 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
0111 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
0112 BPF_LD_MAP_FD(BPF_REG_1, 0),
0113 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
0114 BPF_MOV64_IMM(BPF_REG_4, 0),
0115 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_update_elem),
0116 BPF_MOV64_IMM(BPF_REG_0, 0),
0117 BPF_EXIT_INSN(),
0118 },
0119 .fixup_map_hash_8b = { 5 },
0120 .result = ACCEPT,
0121 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
0122 },
0123 {
0124 "helper access to packet: test7, cls unchecked packet_ptr",
0125 .insns = {
0126 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
0127 offsetof(struct __sk_buff, data)),
0128 BPF_LD_MAP_FD(BPF_REG_1, 0),
0129 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
0130 BPF_MOV64_IMM(BPF_REG_0, 0),
0131 BPF_EXIT_INSN(),
0132 },
0133 .fixup_map_hash_8b = { 1 },
0134 .result = REJECT,
0135 .errstr = "invalid access to packet",
0136 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
0137 },
0138 {
0139 "helper access to packet: test8, cls variable add",
0140 .insns = {
0141 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
0142 offsetof(struct __sk_buff, data)),
0143 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
0144 offsetof(struct __sk_buff, data_end)),
0145 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
0146 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
0147 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
0148 BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
0149 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
0150 BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
0151 BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
0152 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
0153 BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
0154 BPF_LD_MAP_FD(BPF_REG_1, 0),
0155 BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
0156 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
0157 BPF_MOV64_IMM(BPF_REG_0, 0),
0158 BPF_EXIT_INSN(),
0159 },
0160 .fixup_map_hash_8b = { 11 },
0161 .result = ACCEPT,
0162 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
0163 },
0164 {
0165 "helper access to packet: test9, cls packet_ptr with bad range",
0166 .insns = {
0167 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
0168 offsetof(struct __sk_buff, data)),
0169 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
0170 offsetof(struct __sk_buff, data_end)),
0171 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
0172 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
0173 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
0174 BPF_MOV64_IMM(BPF_REG_0, 0),
0175 BPF_EXIT_INSN(),
0176 BPF_LD_MAP_FD(BPF_REG_1, 0),
0177 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
0178 BPF_MOV64_IMM(BPF_REG_0, 0),
0179 BPF_EXIT_INSN(),
0180 },
0181 .fixup_map_hash_8b = { 7 },
0182 .result = REJECT,
0183 .errstr = "invalid access to packet",
0184 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
0185 },
0186 {
0187 "helper access to packet: test10, cls packet_ptr with too short range",
0188 .insns = {
0189 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
0190 offsetof(struct __sk_buff, data)),
0191 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
0192 offsetof(struct __sk_buff, data_end)),
0193 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
0194 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
0195 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
0196 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
0197 BPF_LD_MAP_FD(BPF_REG_1, 0),
0198 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
0199 BPF_MOV64_IMM(BPF_REG_0, 0),
0200 BPF_EXIT_INSN(),
0201 },
0202 .fixup_map_hash_8b = { 6 },
0203 .result = REJECT,
0204 .errstr = "invalid access to packet",
0205 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
0206 },
0207 {
0208 "helper access to packet: test11, cls unsuitable helper 1",
0209 .insns = {
0210 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
0211 offsetof(struct __sk_buff, data)),
0212 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
0213 offsetof(struct __sk_buff, data_end)),
0214 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
0215 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
0216 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 7),
0217 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_7, 4),
0218 BPF_MOV64_IMM(BPF_REG_2, 0),
0219 BPF_MOV64_IMM(BPF_REG_4, 42),
0220 BPF_MOV64_IMM(BPF_REG_5, 0),
0221 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_store_bytes),
0222 BPF_MOV64_IMM(BPF_REG_0, 0),
0223 BPF_EXIT_INSN(),
0224 },
0225 .result = REJECT,
0226 .errstr = "helper access to the packet",
0227 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
0228 },
0229 {
0230 "helper access to packet: test12, cls unsuitable helper 2",
0231 .insns = {
0232 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
0233 offsetof(struct __sk_buff, data)),
0234 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
0235 offsetof(struct __sk_buff, data_end)),
0236 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
0237 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
0238 BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_7, 3),
0239 BPF_MOV64_IMM(BPF_REG_2, 0),
0240 BPF_MOV64_IMM(BPF_REG_4, 4),
0241 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes),
0242 BPF_MOV64_IMM(BPF_REG_0, 0),
0243 BPF_EXIT_INSN(),
0244 },
0245 .result = REJECT,
0246 .errstr = "helper access to the packet",
0247 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
0248 },
0249 {
0250 "helper access to packet: test13, cls helper ok",
0251 .insns = {
0252 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
0253 offsetof(struct __sk_buff, data)),
0254 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
0255 offsetof(struct __sk_buff, data_end)),
0256 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
0257 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
0258 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
0259 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
0260 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
0261 BPF_MOV64_IMM(BPF_REG_2, 4),
0262 BPF_MOV64_IMM(BPF_REG_3, 0),
0263 BPF_MOV64_IMM(BPF_REG_4, 0),
0264 BPF_MOV64_IMM(BPF_REG_5, 0),
0265 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
0266 BPF_MOV64_IMM(BPF_REG_0, 0),
0267 BPF_EXIT_INSN(),
0268 },
0269 .result = ACCEPT,
0270 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
0271 },
0272 {
0273 "helper access to packet: test14, cls helper ok sub",
0274 .insns = {
0275 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
0276 offsetof(struct __sk_buff, data)),
0277 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
0278 offsetof(struct __sk_buff, data_end)),
0279 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
0280 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
0281 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
0282 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
0283 BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 4),
0284 BPF_MOV64_IMM(BPF_REG_2, 4),
0285 BPF_MOV64_IMM(BPF_REG_3, 0),
0286 BPF_MOV64_IMM(BPF_REG_4, 0),
0287 BPF_MOV64_IMM(BPF_REG_5, 0),
0288 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
0289 BPF_MOV64_IMM(BPF_REG_0, 0),
0290 BPF_EXIT_INSN(),
0291 },
0292 .result = ACCEPT,
0293 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
0294 },
0295 {
0296 "helper access to packet: test15, cls helper fail sub",
0297 .insns = {
0298 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
0299 offsetof(struct __sk_buff, data)),
0300 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
0301 offsetof(struct __sk_buff, data_end)),
0302 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
0303 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
0304 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
0305 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
0306 BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 12),
0307 BPF_MOV64_IMM(BPF_REG_2, 4),
0308 BPF_MOV64_IMM(BPF_REG_3, 0),
0309 BPF_MOV64_IMM(BPF_REG_4, 0),
0310 BPF_MOV64_IMM(BPF_REG_5, 0),
0311 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
0312 BPF_MOV64_IMM(BPF_REG_0, 0),
0313 BPF_EXIT_INSN(),
0314 },
0315 .result = REJECT,
0316 .errstr = "invalid access to packet",
0317 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
0318 },
0319 {
0320 "helper access to packet: test16, cls helper fail range 1",
0321 .insns = {
0322 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
0323 offsetof(struct __sk_buff, data)),
0324 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
0325 offsetof(struct __sk_buff, data_end)),
0326 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
0327 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
0328 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
0329 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
0330 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
0331 BPF_MOV64_IMM(BPF_REG_2, 8),
0332 BPF_MOV64_IMM(BPF_REG_3, 0),
0333 BPF_MOV64_IMM(BPF_REG_4, 0),
0334 BPF_MOV64_IMM(BPF_REG_5, 0),
0335 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
0336 BPF_MOV64_IMM(BPF_REG_0, 0),
0337 BPF_EXIT_INSN(),
0338 },
0339 .result = REJECT,
0340 .errstr = "invalid access to packet",
0341 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
0342 },
0343 {
0344 "helper access to packet: test17, cls helper fail range 2",
0345 .insns = {
0346 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
0347 offsetof(struct __sk_buff, data)),
0348 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
0349 offsetof(struct __sk_buff, data_end)),
0350 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
0351 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
0352 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
0353 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
0354 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
0355 BPF_MOV64_IMM(BPF_REG_2, -9),
0356 BPF_MOV64_IMM(BPF_REG_3, 0),
0357 BPF_MOV64_IMM(BPF_REG_4, 0),
0358 BPF_MOV64_IMM(BPF_REG_5, 0),
0359 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
0360 BPF_MOV64_IMM(BPF_REG_0, 0),
0361 BPF_EXIT_INSN(),
0362 },
0363 .result = REJECT,
0364 .errstr = "R2 min value is negative",
0365 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
0366 },
0367 {
0368 "helper access to packet: test18, cls helper fail range 3",
0369 .insns = {
0370 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
0371 offsetof(struct __sk_buff, data)),
0372 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
0373 offsetof(struct __sk_buff, data_end)),
0374 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
0375 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
0376 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
0377 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
0378 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
0379 BPF_MOV64_IMM(BPF_REG_2, ~0),
0380 BPF_MOV64_IMM(BPF_REG_3, 0),
0381 BPF_MOV64_IMM(BPF_REG_4, 0),
0382 BPF_MOV64_IMM(BPF_REG_5, 0),
0383 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
0384 BPF_MOV64_IMM(BPF_REG_0, 0),
0385 BPF_EXIT_INSN(),
0386 },
0387 .result = REJECT,
0388 .errstr = "R2 min value is negative",
0389 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
0390 },
0391 {
0392 "helper access to packet: test19, cls helper range zero",
0393 .insns = {
0394 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
0395 offsetof(struct __sk_buff, data)),
0396 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
0397 offsetof(struct __sk_buff, data_end)),
0398 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
0399 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
0400 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
0401 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
0402 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
0403 BPF_MOV64_IMM(BPF_REG_2, 0),
0404 BPF_MOV64_IMM(BPF_REG_3, 0),
0405 BPF_MOV64_IMM(BPF_REG_4, 0),
0406 BPF_MOV64_IMM(BPF_REG_5, 0),
0407 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
0408 BPF_MOV64_IMM(BPF_REG_0, 0),
0409 BPF_EXIT_INSN(),
0410 },
0411 .result = ACCEPT,
0412 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
0413 },
0414 {
0415 "helper access to packet: test20, pkt end as input",
0416 .insns = {
0417 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
0418 offsetof(struct __sk_buff, data)),
0419 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
0420 offsetof(struct __sk_buff, data_end)),
0421 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
0422 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
0423 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
0424 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
0425 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
0426 BPF_MOV64_IMM(BPF_REG_2, 4),
0427 BPF_MOV64_IMM(BPF_REG_3, 0),
0428 BPF_MOV64_IMM(BPF_REG_4, 0),
0429 BPF_MOV64_IMM(BPF_REG_5, 0),
0430 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
0431 BPF_MOV64_IMM(BPF_REG_0, 0),
0432 BPF_EXIT_INSN(),
0433 },
0434 .result = REJECT,
0435 .errstr = "R1 type=pkt_end expected=fp",
0436 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
0437 },
0438 {
0439 "helper access to packet: test21, wrong reg",
0440 .insns = {
0441 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
0442 offsetof(struct __sk_buff, data)),
0443 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
0444 offsetof(struct __sk_buff, data_end)),
0445 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
0446 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
0447 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
0448 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
0449 BPF_MOV64_IMM(BPF_REG_2, 4),
0450 BPF_MOV64_IMM(BPF_REG_3, 0),
0451 BPF_MOV64_IMM(BPF_REG_4, 0),
0452 BPF_MOV64_IMM(BPF_REG_5, 0),
0453 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
0454 BPF_MOV64_IMM(BPF_REG_0, 0),
0455 BPF_EXIT_INSN(),
0456 },
0457 .result = REJECT,
0458 .errstr = "invalid access to packet",
0459 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
0460 },
