1 { 2 "helper access to packet: test1, valid packet_ptr range", 3 .insns = { 4 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 5 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 6 offsetof(struct xdp_md, data_end)), 7 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 8 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 9 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5), 10 BPF_LD_MAP_FD(BPF_REG_1, 0), 11 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2), 12 BPF_MOV64_IMM(BPF_REG_4, 0), 13 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_update_elem), 14 BPF_MOV64_IMM(BPF_REG_0, 0), 15 BPF_EXIT_INSN(), 16 }, 17 .fixup_map_hash_8b = { 5 }, 18 .result_unpriv = ACCEPT, 19 .result = ACCEPT, 20 .prog_type = BPF_PROG_TYPE_XDP, 21 }, 22 { 23 "helper access to packet: test2, unchecked packet_ptr", 24 .insns = { 25 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 26 BPF_LD_MAP_FD(BPF_REG_1, 0), 27 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 28 BPF_MOV64_IMM(BPF_REG_0, 0), 29 BPF_EXIT_INSN(), 30 }, 31 .fixup_map_hash_8b = { 1 }, 32 .result = REJECT, 33 .errstr = "invalid access to packet", 34 .prog_type = BPF_PROG_TYPE_XDP, 35 }, 36 { 37 "helper access to packet: test3, variable add", 38 .insns = { 39 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 40 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 41 offsetof(struct xdp_md, data_end)), 42 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2), 43 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8), 44 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10), 45 BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0), 46 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2), 47 BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5), 48 BPF_MOV64_REG(BPF_REG_5, BPF_REG_4), 49 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8), 50 BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4), 51 BPF_LD_MAP_FD(BPF_REG_1, 0), 52 BPF_MOV64_REG(BPF_REG_2, BPF_REG_4), 53 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 54 BPF_MOV64_IMM(BPF_REG_0, 0), 55 BPF_EXIT_INSN(), 56 }, 57 .fixup_map_hash_8b = { 11 }, 58 .result = ACCEPT, 59 .prog_type = BPF_PROG_TYPE_XDP, 60 }, 61 { 62 "helper access to packet: test4, packet_ptr with bad range", 63 .insns = { 64 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 65 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 66 offsetof(struct xdp_md, data_end)), 67 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2), 68 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4), 69 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2), 70 BPF_MOV64_IMM(BPF_REG_0, 0), 71 BPF_EXIT_INSN(), 72 BPF_LD_MAP_FD(BPF_REG_1, 0), 73 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 74 BPF_MOV64_IMM(BPF_REG_0, 0), 75 BPF_EXIT_INSN(), 76 }, 77 .fixup_map_hash_8b = { 7 }, 78 .result = REJECT, 79 .errstr = "invalid access to packet", 80 .prog_type = BPF_PROG_TYPE_XDP, 81 }, 82 { 83 "helper access to packet: test5, packet_ptr with too short range", 84 .insns = { 85 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)), 86 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 87 offsetof(struct xdp_md, data_end)), 88 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1), 89 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2), 90 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7), 91 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3), 92 BPF_LD_MAP_FD(BPF_REG_1, 0), 93 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 94 BPF_MOV64_IMM(BPF_REG_0, 0), 95 BPF_EXIT_INSN(), 96 }, 97 .fixup_map_hash_8b = { 6 }, 98 .result = REJECT, 99 .errstr = "invalid access to packet", 100 .prog_type = BPF_PROG_TYPE_XDP, 101 }, 102 { 103 "helper access to packet: test6, cls valid packet_ptr range", 104 .insns = { 105 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 106 offsetof(struct __sk_buff, data)), 107 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 108 offsetof(struct __sk_buff, data_end)), 109 BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), 110 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), 111 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5), 112 BPF_LD_MAP_FD(BPF_REG_1, 0), 113 BPF_MOV64_REG(BPF_REG_3, BPF_REG_2), 114 BPF_MOV64_IMM(BPF_REG_4, 0), 115 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_update_elem), 116 BPF_MOV64_IMM(BPF_REG_0, 0), 117 BPF_EXIT_INSN(), 118 }, 119 .fixup_map_hash_8b = { 5 }, 120 .result = ACCEPT, 121 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 122 }, 123 { 124 "helper access to packet: test7, cls unchecked packet_ptr", 125 .insns = { 126 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 127 offsetof(struct __sk_buff, data)), 128 BPF_LD_MAP_FD(BPF_REG_1, 0), 129 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 130 BPF_MOV64_IMM(BPF_REG_0, 0), 131 BPF_EXIT_INSN(), 132 }, 133 .fixup_map_hash_8b = { 1 }, 134 .result = REJECT, 135 .errstr = "invalid access to packet", 136 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 137 }, 138 { 139 "helper access to packet: test8, cls variable add", 140 .insns = { 141 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 142 offsetof(struct __sk_buff, data)), 143 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 144 offsetof(struct __sk_buff, data_end)), 145 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2), 146 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8), 147 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10), 148 BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0), 149 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2), 150 BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5), 151 BPF_MOV64_REG(BPF_REG_5, BPF_REG_4), 152 BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8), 153 BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4), 154 BPF_LD_MAP_FD(BPF_REG_1, 0), 155 BPF_MOV64_REG(BPF_REG_2, BPF_REG_4), 156 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 157 BPF_MOV64_IMM(BPF_REG_0, 0), 158 BPF_EXIT_INSN(), 159 }, 160 .fixup_map_hash_8b = { 11 }, 161 .result = ACCEPT, 162 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 163 }, 164 { 165 "helper access to packet: test9, cls packet_ptr with bad range", 166 .insns = { 167 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 168 offsetof(struct __sk_buff, data)), 169 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 170 offsetof(struct __sk_buff, data_end)), 171 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2), 172 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4), 173 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2), 174 BPF_MOV64_IMM(BPF_REG_0, 0), 175 BPF_EXIT_INSN(), 176 BPF_LD_MAP_FD(BPF_REG_1, 0), 177 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 178 BPF_MOV64_IMM(BPF_REG_0, 0), 179 BPF_EXIT_INSN(), 180 }, 181 .fixup_map_hash_8b = { 7 }, 182 .result = REJECT, 183 .errstr = "invalid access to packet", 184 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 185 }, 186 { 187 "helper access to packet: test10, cls packet_ptr with too short range", 188 .insns = { 189 BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 190 offsetof(struct __sk_buff, data)), 191 BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, 192 offsetof(struct __sk_buff, data_end)), 193 BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1), 194 BPF_MOV64_REG(BPF_REG_4, BPF_REG_2), 195 BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7), 196 BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3), 197 BPF_LD_MAP_FD(BPF_REG_1, 0), 198 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem), 199 BPF_MOV64_IMM(BPF_REG_0, 0), 200 BPF_EXIT_INSN(), 201 }, 202 .fixup_map_hash_8b = { 6 }, 203 .result = REJECT, 204 .errstr = "invalid access to packet", 205 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 206 }, 207 { 208 "helper access to packet: test11, cls unsuitable helper 1", 209 .insns = { 210 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1, 211 offsetof(struct __sk_buff, data)), 212 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1, 213 offsetof(struct __sk_buff, data_end)), 214 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1), 215 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6), 216 BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 7), 217 BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_7, 4), 218 BPF_MOV64_IMM(BPF_REG_2, 0), 219 BPF_MOV64_IMM(BPF_REG_4, 42), 220 BPF_MOV64_IMM(BPF_REG_5, 0), 221 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_store_bytes), 222 BPF_MOV64_IMM(BPF_REG_0, 0), 223 BPF_EXIT_INSN(), 224 }, 225 .result = REJECT, 226 .errstr = "helper access to the packet", 227 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 228 }, 229 { 230 "helper access to packet: test12, cls unsuitable helper 2", 231 .insns = { 232 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1, 233 offsetof(struct __sk_buff, data)), 234 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1, 235 offsetof(struct __sk_buff, data_end)), 236 BPF_MOV64_REG(BPF_REG_3, BPF_REG_6), 237 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8), 238 BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_7, 3), 239 BPF_MOV64_IMM(BPF_REG_2, 0), 240 BPF_MOV64_IMM(BPF_REG_4, 4), 241 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes), 242 BPF_MOV64_IMM(BPF_REG_0, 0), 243 BPF_EXIT_INSN(), 244 }, 245 .result = REJECT, 246 .errstr = "helper access to the packet", 247 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 248 }, 249 { 250 "helper access to packet: test13, cls helper ok", 251 .insns = { 252 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1, 253 offsetof(struct __sk_buff, data)), 254 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1, 255 offsetof(struct __sk_buff, data_end)), 256 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1), 257 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 258 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7), 259 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6), 260 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 261 BPF_MOV64_IMM(BPF_REG_2, 4), 262 BPF_MOV64_IMM(BPF_REG_3, 0), 263 BPF_MOV64_IMM(BPF_REG_4, 0), 264 BPF_MOV64_IMM(BPF_REG_5, 0), 265 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff), 266 BPF_MOV64_IMM(BPF_REG_0, 0), 267 BPF_EXIT_INSN(), 268 }, 269 .result = ACCEPT, 270 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 271 }, 272 { 273 "helper access to packet: test14, cls helper ok sub", 274 .insns = { 275 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1, 276 offsetof(struct __sk_buff, data)), 277 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1, 278 offsetof(struct __sk_buff, data_end)), 279 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1), 280 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 281 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7), 282 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6), 283 BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 4), 284 BPF_MOV64_IMM(BPF_REG_2, 4), 285 BPF_MOV64_IMM(BPF_REG_3, 0), 286 BPF_MOV64_IMM(BPF_REG_4, 0), 287 BPF_MOV64_IMM(BPF_REG_5, 0), 288 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff), 289 BPF_MOV64_IMM(BPF_REG_0, 0), 290 BPF_EXIT_INSN(), 291 }, 292 .result = ACCEPT, 293 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 294 }, 295 { 296 "helper access to packet: test15, cls helper fail sub", 297 .insns = { 298 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1, 299 offsetof(struct __sk_buff, data)), 300 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1, 301 offsetof(struct __sk_buff, data_end)), 302 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1), 303 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 304 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7), 305 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6), 306 BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 12), 307 BPF_MOV64_IMM(BPF_REG_2, 4), 308 BPF_MOV64_IMM(BPF_REG_3, 0), 309 BPF_MOV64_IMM(BPF_REG_4, 0), 310 BPF_MOV64_IMM(BPF_REG_5, 0), 311 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff), 312 BPF_MOV64_IMM(BPF_REG_0, 0), 313 BPF_EXIT_INSN(), 314 }, 315 .result = REJECT, 316 .errstr = "invalid access to packet", 317 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 318 }, 319 { 320 "helper access to packet: test16, cls helper fail range 1", 321 .insns = { 322 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1, 323 offsetof(struct __sk_buff, data)), 324 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1, 325 offsetof(struct __sk_buff, data_end)), 326 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1), 327 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 328 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7), 329 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6), 330 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 331 BPF_MOV64_IMM(BPF_REG_2, 8), 332 BPF_MOV64_IMM(BPF_REG_3, 0), 333 BPF_MOV64_IMM(BPF_REG_4, 0), 334 BPF_MOV64_IMM(BPF_REG_5, 0), 335 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff), 336 BPF_MOV64_IMM(BPF_REG_0, 0), 337 BPF_EXIT_INSN(), 338 }, 339 .result = REJECT, 340 .errstr = "invalid access to packet", 341 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 342 }, 343 { 344 "helper access to packet: test17, cls helper fail range 2", 345 .insns = { 346 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1, 347 offsetof(struct __sk_buff, data)), 348 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1, 349 offsetof(struct __sk_buff, data_end)), 350 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1), 351 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 352 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7), 353 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6), 354 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 355 BPF_MOV64_IMM(BPF_REG_2, -9), 356 BPF_MOV64_IMM(BPF_REG_3, 0), 357 BPF_MOV64_IMM(BPF_REG_4, 0), 358 BPF_MOV64_IMM(BPF_REG_5, 0), 359 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff), 360 BPF_MOV64_IMM(BPF_REG_0, 0), 361 BPF_EXIT_INSN(), 362 }, 363 .result = REJECT, 364 .errstr = "R2 min value is negative", 365 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 366 }, 367 { 368 "helper access to packet: test18, cls helper fail range 3", 369 .insns = { 370 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1, 371 offsetof(struct __sk_buff, data)), 372 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1, 373 offsetof(struct __sk_buff, data_end)), 374 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1), 375 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 376 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7), 377 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6), 378 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 379 BPF_MOV64_IMM(BPF_REG_2, ~0), 380 BPF_MOV64_IMM(BPF_REG_3, 0), 381 BPF_MOV64_IMM(BPF_REG_4, 0), 382 BPF_MOV64_IMM(BPF_REG_5, 0), 383 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff), 384 BPF_MOV64_IMM(BPF_REG_0, 0), 385 BPF_EXIT_INSN(), 386 }, 387 .result = REJECT, 388 .errstr = "R2 min value is negative", 389 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 390 }, 391 { 392 "helper access to packet: test19, cls helper range zero", 393 .insns = { 394 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1, 395 offsetof(struct __sk_buff, data)), 396 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1, 397 offsetof(struct __sk_buff, data_end)), 398 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1), 399 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 400 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7), 401 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6), 402 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 403 BPF_MOV64_IMM(BPF_REG_2, 0), 404 BPF_MOV64_IMM(BPF_REG_3, 0), 405 BPF_MOV64_IMM(BPF_REG_4, 0), 406 BPF_MOV64_IMM(BPF_REG_5, 0), 407 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff), 408 BPF_MOV64_IMM(BPF_REG_0, 0), 409 BPF_EXIT_INSN(), 410 }, 411 .result = ACCEPT, 412 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 413 }, 414 { 415 "helper access to packet: test20, pkt end as input", 416 .insns = { 417 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1, 418 offsetof(struct __sk_buff, data)), 419 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1, 420 offsetof(struct __sk_buff, data_end)), 421 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1), 422 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 423 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7), 424 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6), 425 BPF_MOV64_REG(BPF_REG_1, BPF_REG_7), 426 BPF_MOV64_IMM(BPF_REG_2, 4), 427 BPF_MOV64_IMM(BPF_REG_3, 0), 428 BPF_MOV64_IMM(BPF_REG_4, 0), 429 BPF_MOV64_IMM(BPF_REG_5, 0), 430 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff), 431 BPF_MOV64_IMM(BPF_REG_0, 0), 432 BPF_EXIT_INSN(), 433 }, 434 .result = REJECT, 435 .errstr = "R1 type=pkt_end expected=fp", 436 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 437 }, 438 { 439 "helper access to packet: test21, wrong reg", 440 .insns = { 441 BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1, 442 offsetof(struct __sk_buff, data)), 443 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1, 444 offsetof(struct __sk_buff, data_end)), 445 BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1), 446 BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), 447 BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7), 448 BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6), 449 BPF_MOV64_IMM(BPF_REG_2, 4), 450 BPF_MOV64_IMM(BPF_REG_3, 0), 451 BPF_MOV64_IMM(BPF_REG_4, 0), 452 BPF_MOV64_IMM(BPF_REG_5, 0), 453 BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff), 454 BPF_MOV64_IMM(BPF_REG_0, 0), 455 BPF_EXIT_INSN(), 456 }, 457 .result = REJECT, 458 .errstr = "invalid access to packet", 459 .prog_type = BPF_PROG_TYPE_SCHED_CLS, 460 }, 461