1 {
2 "helper access to packet: test1, valid packet_ptr range",
3 .insns = {
4 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
5 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
6 offsetof(struct xdp_md, data_end)),
7 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
8 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
9 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
10 BPF_LD_MAP_FD(BPF_REG_1, 0),
11 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
12 BPF_MOV64_IMM(BPF_REG_4, 0),
13 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_update_elem),
14 BPF_MOV64_IMM(BPF_REG_0, 0),
15 BPF_EXIT_INSN(),
16 },
17 .fixup_map_hash_8b = { 5 },
18 .result_unpriv = ACCEPT,
19 .result = ACCEPT,
20 .prog_type = BPF_PROG_TYPE_XDP,
21 },
22 {
23 "helper access to packet: test2, unchecked packet_ptr",
24 .insns = {
25 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
26 BPF_LD_MAP_FD(BPF_REG_1, 0),
27 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
28 BPF_MOV64_IMM(BPF_REG_0, 0),
29 BPF_EXIT_INSN(),
30 },
31 .fixup_map_hash_8b = { 1 },
32 .result = REJECT,
33 .errstr = "invalid access to packet",
34 .prog_type = BPF_PROG_TYPE_XDP,
35 },
36 {
37 "helper access to packet: test3, variable add",
38 .insns = {
39 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
40 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
41 offsetof(struct xdp_md, data_end)),
42 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
43 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
44 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
45 BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
46 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
47 BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
48 BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
49 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
50 BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
51 BPF_LD_MAP_FD(BPF_REG_1, 0),
52 BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
53 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
54 BPF_MOV64_IMM(BPF_REG_0, 0),
55 BPF_EXIT_INSN(),
56 },
57 .fixup_map_hash_8b = { 11 },
58 .result = ACCEPT,
59 .prog_type = BPF_PROG_TYPE_XDP,
60 },
61 {
62 "helper access to packet: test4, packet_ptr with bad range",
63 .insns = {
64 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
65 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
66 offsetof(struct xdp_md, data_end)),
67 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
68 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
69 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
70 BPF_MOV64_IMM(BPF_REG_0, 0),
71 BPF_EXIT_INSN(),
72 BPF_LD_MAP_FD(BPF_REG_1, 0),
73 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
74 BPF_MOV64_IMM(BPF_REG_0, 0),
75 BPF_EXIT_INSN(),
76 },
77 .fixup_map_hash_8b = { 7 },
78 .result = REJECT,
79 .errstr = "invalid access to packet",
80 .prog_type = BPF_PROG_TYPE_XDP,
81 },
82 {
83 "helper access to packet: test5, packet_ptr with too short range",
84 .insns = {
85 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
86 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
87 offsetof(struct xdp_md, data_end)),
88 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
89 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
90 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
91 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
92 BPF_LD_MAP_FD(BPF_REG_1, 0),
93 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
94 BPF_MOV64_IMM(BPF_REG_0, 0),
95 BPF_EXIT_INSN(),
96 },
97 .fixup_map_hash_8b = { 6 },
98 .result = REJECT,
99 .errstr = "invalid access to packet",
100 .prog_type = BPF_PROG_TYPE_XDP,
101 },
102 {
103 "helper access to packet: test6, cls valid packet_ptr range",
104 .insns = {
105 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
106 offsetof(struct __sk_buff, data)),
107 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
108 offsetof(struct __sk_buff, data_end)),
109 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
110 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
111 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
112 BPF_LD_MAP_FD(BPF_REG_1, 0),
113 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
114 BPF_MOV64_IMM(BPF_REG_4, 0),
115 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_update_elem),
116 BPF_MOV64_IMM(BPF_REG_0, 0),
117 BPF_EXIT_INSN(),
118 },
119 .fixup_map_hash_8b = { 5 },
120 .result = ACCEPT,
121 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
122 },
123 {
124 "helper access to packet: test7, cls unchecked packet_ptr",
125 .insns = {
126 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
127 offsetof(struct __sk_buff, data)),
128 BPF_LD_MAP_FD(BPF_REG_1, 0),
129 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
130 BPF_MOV64_IMM(BPF_REG_0, 0),
131 BPF_EXIT_INSN(),
132 },
133 .fixup_map_hash_8b = { 1 },
134 .result = REJECT,
135 .errstr = "invalid access to packet",
136 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
137 },
138 {
139 "helper access to packet: test8, cls variable add",
140 .insns = {
141 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
142 offsetof(struct __sk_buff, data)),
143 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
144 offsetof(struct __sk_buff, data_end)),
145 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
146 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
147 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
148 BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
149 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
150 BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
151 BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
152 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
153 BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
154 BPF_LD_MAP_FD(BPF_REG_1, 0),
155 BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
156 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
157 BPF_MOV64_IMM(BPF_REG_0, 0),
158 BPF_EXIT_INSN(),
159 },
160 .fixup_map_hash_8b = { 11 },
161 .result = ACCEPT,
162 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
163 },
164 {
165 "helper access to packet: test9, cls packet_ptr with bad range",
166 .insns = {
167 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
168 offsetof(struct __sk_buff, data)),
169 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
170 offsetof(struct __sk_buff, data_end)),
171 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
172 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
173 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
174 BPF_MOV64_IMM(BPF_REG_0, 0),
175 BPF_EXIT_INSN(),
176 BPF_LD_MAP_FD(BPF_REG_1, 0),
177 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
178 BPF_MOV64_IMM(BPF_REG_0, 0),
179 BPF_EXIT_INSN(),
180 },
181 .fixup_map_hash_8b = { 7 },
182 .result = REJECT,
183 .errstr = "invalid access to packet",
184 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
185 },
186 {
187 "helper access to packet: test10, cls packet_ptr with too short range",
188 .insns = {
189 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
190 offsetof(struct __sk_buff, data)),
191 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
192 offsetof(struct __sk_buff, data_end)),
193 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
194 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
195 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
196 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
197 BPF_LD_MAP_FD(BPF_REG_1, 0),
198 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
199 BPF_MOV64_IMM(BPF_REG_0, 0),
200 BPF_EXIT_INSN(),
201 },
202 .fixup_map_hash_8b = { 6 },
203 .result = REJECT,
204 .errstr = "invalid access to packet",
205 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
206 },
207 {
208 "helper access to packet: test11, cls unsuitable helper 1",
209 .insns = {
210 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
211 offsetof(struct __sk_buff, data)),
212 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
213 offsetof(struct __sk_buff, data_end)),
214 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
215 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
216 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 7),
217 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_7, 4),
218 BPF_MOV64_IMM(BPF_REG_2, 0),
219 BPF_MOV64_IMM(BPF_REG_4, 42),
220 BPF_MOV64_IMM(BPF_REG_5, 0),
221 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_store_bytes),
222 BPF_MOV64_IMM(BPF_REG_0, 0),
223 BPF_EXIT_INSN(),
224 },
225 .result = REJECT,
226 .errstr = "helper access to the packet",
227 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
228 },
229 {
230 "helper access to packet: test12, cls unsuitable helper 2",
231 .insns = {
232 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
233 offsetof(struct __sk_buff, data)),
234 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
235 offsetof(struct __sk_buff, data_end)),
236 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
237 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
238 BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_7, 3),
239 BPF_MOV64_IMM(BPF_REG_2, 0),
240 BPF_MOV64_IMM(BPF_REG_4, 4),
241 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes),
242 BPF_MOV64_IMM(BPF_REG_0, 0),
243 BPF_EXIT_INSN(),
244 },
245 .result = REJECT,
246 .errstr = "helper access to the packet",
247 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
248 },
249 {
250 "helper access to packet: test13, cls helper ok",
251 .insns = {
252 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
253 offsetof(struct __sk_buff, data)),
254 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
255 offsetof(struct __sk_buff, data_end)),
256 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
257 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
258 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
259 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
260 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
261 BPF_MOV64_IMM(BPF_REG_2, 4),
262 BPF_MOV64_IMM(BPF_REG_3, 0),
263 BPF_MOV64_IMM(BPF_REG_4, 0),
264 BPF_MOV64_IMM(BPF_REG_5, 0),
265 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
266 BPF_MOV64_IMM(BPF_REG_0, 0),
267 BPF_EXIT_INSN(),
268 },
269 .result = ACCEPT,
270 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
271 },
272 {
273 "helper access to packet: test14, cls helper ok sub",
274 .insns = {
275 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
276 offsetof(struct __sk_buff, data)),
277 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
278 offsetof(struct __sk_buff, data_end)),
279 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
280 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
281 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
282 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
283 BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 4),
284 BPF_MOV64_IMM(BPF_REG_2, 4),
285 BPF_MOV64_IMM(BPF_REG_3, 0),
286 BPF_MOV64_IMM(BPF_REG_4, 0),
287 BPF_MOV64_IMM(BPF_REG_5, 0),
288 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
289 BPF_MOV64_IMM(BPF_REG_0, 0),
290 BPF_EXIT_INSN(),
291 },
292 .result = ACCEPT,
293 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
294 },
295 {
296 "helper access to packet: test15, cls helper fail sub",
297 .insns = {
298 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
299 offsetof(struct __sk_buff, data)),
300 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
301 offsetof(struct __sk_buff, data_end)),
302 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
303 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
304 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
305 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
306 BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 12),
307 BPF_MOV64_IMM(BPF_REG_2, 4),
308 BPF_MOV64_IMM(BPF_REG_3, 0),
309 BPF_MOV64_IMM(BPF_REG_4, 0),
310 BPF_MOV64_IMM(BPF_REG_5, 0),
311 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
312 BPF_MOV64_IMM(BPF_REG_0, 0),
313 BPF_EXIT_INSN(),
314 },
315 .result = REJECT,
316 .errstr = "invalid access to packet",
317 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
318 },
319 {
320 "helper access to packet: test16, cls helper fail range 1",
321 .insns = {
322 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
323 offsetof(struct __sk_buff, data)),
324 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
325 offsetof(struct __sk_buff, data_end)),
326 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
327 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
328 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
329 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
330 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
331 BPF_MOV64_IMM(BPF_REG_2, 8),
332 BPF_MOV64_IMM(BPF_REG_3, 0),
333 BPF_MOV64_IMM(BPF_REG_4, 0),
334 BPF_MOV64_IMM(BPF_REG_5, 0),
335 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
336 BPF_MOV64_IMM(BPF_REG_0, 0),
337 BPF_EXIT_INSN(),
338 },
339 .result = REJECT,
340 .errstr = "invalid access to packet",
341 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
342 },
343 {
344 "helper access to packet: test17, cls helper fail range 2",
345 .insns = {
346 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
347 offsetof(struct __sk_buff, data)),
348 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
349 offsetof(struct __sk_buff, data_end)),
350 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
351 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
352 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
353 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
354 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
355 BPF_MOV64_IMM(BPF_REG_2, -9),
356 BPF_MOV64_IMM(BPF_REG_3, 0),
357 BPF_MOV64_IMM(BPF_REG_4, 0),
358 BPF_MOV64_IMM(BPF_REG_5, 0),
359 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
360 BPF_MOV64_IMM(BPF_REG_0, 0),
361 BPF_EXIT_INSN(),
362 },
363 .result = REJECT,
364 .errstr = "R2 min value is negative",
365 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
366 },
367 {
368 "helper access to packet: test18, cls helper fail range 3",
369 .insns = {
370 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
371 offsetof(struct __sk_buff, data)),
372 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
373 offsetof(struct __sk_buff, data_end)),
374 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
375 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
376 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
377 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
378 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
379 BPF_MOV64_IMM(BPF_REG_2, ~0),
380 BPF_MOV64_IMM(BPF_REG_3, 0),
381 BPF_MOV64_IMM(BPF_REG_4, 0),
382 BPF_MOV64_IMM(BPF_REG_5, 0),
383 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
384 BPF_MOV64_IMM(BPF_REG_0, 0),
385 BPF_EXIT_INSN(),
386 },
387 .result = REJECT,
388 .errstr = "R2 min value is negative",
389 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
390 },
391 {
392 "helper access to packet: test19, cls helper range zero",
393 .insns = {
394 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
395 offsetof(struct __sk_buff, data)),
396 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
397 offsetof(struct __sk_buff, data_end)),
398 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
399 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
400 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
401 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
402 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
403 BPF_MOV64_IMM(BPF_REG_2, 0),
404 BPF_MOV64_IMM(BPF_REG_3, 0),
405 BPF_MOV64_IMM(BPF_REG_4, 0),
406 BPF_MOV64_IMM(BPF_REG_5, 0),
407 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
408 BPF_MOV64_IMM(BPF_REG_0, 0),
409 BPF_EXIT_INSN(),
410 },
411 .result = ACCEPT,
412 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
413 },
414 {
415 "helper access to packet: test20, pkt end as input",
416 .insns = {
417 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
418 offsetof(struct __sk_buff, data)),
419 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
420 offsetof(struct __sk_buff, data_end)),
421 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
422 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
423 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
424 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
425 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
426 BPF_MOV64_IMM(BPF_REG_2, 4),
427 BPF_MOV64_IMM(BPF_REG_3, 0),
428 BPF_MOV64_IMM(BPF_REG_4, 0),
429 BPF_MOV64_IMM(BPF_REG_5, 0),
430 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
431 BPF_MOV64_IMM(BPF_REG_0, 0),
432 BPF_EXIT_INSN(),
433 },
434 .result = REJECT,
435 .errstr = "R1 type=pkt_end expected=fp",
436 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
437 },
438 {
439 "helper access to packet: test21, wrong reg",
440 .insns = {
441 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
442 offsetof(struct __sk_buff, data)),
443 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
444 offsetof(struct __sk_buff, data_end)),
445 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
446 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
447 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
448 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
449 BPF_MOV64_IMM(BPF_REG_2, 4),
450 BPF_MOV64_IMM(BPF_REG_3, 0),
451 BPF_MOV64_IMM(BPF_REG_4, 0),
452 BPF_MOV64_IMM(BPF_REG_5, 0),
453 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
454 BPF_MOV64_IMM(BPF_REG_0, 0),
455 BPF_EXIT_INSN(),
456 },
457 .result = REJECT,
458 .errstr = "invalid access to packet",
459 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
460 },