tools/testing/selftests/bpf/verifier/calls.c

   1 {
   2         "calls: basic sanity",
   3         .insns = {
   4         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
   5         BPF_MOV64_IMM(BPF_REG_0, 1),
   6         BPF_EXIT_INSN(),
   7         BPF_MOV64_IMM(BPF_REG_0, 2),
   8         BPF_EXIT_INSN(),
   9         },
  10         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
  11         .result = ACCEPT,
  12 },
  13 {
  14         "calls: not on unpriviledged",
  15         .insns = {
  16         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
  17         BPF_MOV64_IMM(BPF_REG_0, 1),
  18         BPF_EXIT_INSN(),
  19         BPF_MOV64_IMM(BPF_REG_0, 2),
  20         BPF_EXIT_INSN(),
  21         },
  22         .errstr_unpriv = "function calls to other bpf functions are allowed for root only",
  23         .result_unpriv = REJECT,
  24         .result = ACCEPT,
  25         .retval = 1,
  26 },
  27 {
  28         "calls: div by 0 in subprog",
  29         .insns = {
  30         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
  31         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
  32         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
  33         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
  34                     offsetof(struct __sk_buff, data_end)),
  35         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
  36         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
  37         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
  38         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
  39         BPF_MOV64_IMM(BPF_REG_0, 1),
  40         BPF_EXIT_INSN(),
  41         BPF_MOV32_IMM(BPF_REG_2, 0),
  42         BPF_MOV32_IMM(BPF_REG_3, 1),
  43         BPF_ALU32_REG(BPF_DIV, BPF_REG_3, BPF_REG_2),
  44         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
  45                     offsetof(struct __sk_buff, data)),
  46         BPF_EXIT_INSN(),
  47         },
  48         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
  49         .result = ACCEPT,
  50         .retval = 1,
  51 },
  52 {
  53         "calls: multiple ret types in subprog 1",
  54         .insns = {
  55         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
  56         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
  57         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
  58         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
  59                     offsetof(struct __sk_buff, data_end)),
  60         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
  61         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
  62         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
  63         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
  64         BPF_MOV64_IMM(BPF_REG_0, 1),
  65         BPF_EXIT_INSN(),
  66         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
  67                     offsetof(struct __sk_buff, data)),
  68         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
  69         BPF_MOV32_IMM(BPF_REG_0, 42),
  70         BPF_EXIT_INSN(),
  71         },
  72         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
  73         .result = REJECT,
  74         .errstr = "R0 invalid mem access 'inv'",
  75 },
  76 {
  77         "calls: multiple ret types in subprog 2",
  78         .insns = {
  79         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
  80         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
  81         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
  82         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
  83                     offsetof(struct __sk_buff, data_end)),
  84         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
  85         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
  86         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
  87         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
  88         BPF_MOV64_IMM(BPF_REG_0, 1),
  89         BPF_EXIT_INSN(),
  90         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
  91                     offsetof(struct __sk_buff, data)),
  92         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
  93         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 9),
  94         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
  95         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
  96         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
  97         BPF_LD_MAP_FD(BPF_REG_1, 0),
  98         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
  99         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
 100         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_6,
 101                     offsetof(struct __sk_buff, data)),
 102         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 64),
 103         BPF_EXIT_INSN(),
 104         },
 105         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 106         .fixup_map_hash_8b = { 16 },
 107         .result = REJECT,
 108         .errstr = "R0 min value is outside of the array range",
 109 },
 110 {
 111         "calls: overlapping caller/callee",
 112         .insns = {
 113         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 0),
 114         BPF_MOV64_IMM(BPF_REG_0, 1),
 115         BPF_EXIT_INSN(),
 116         },
 117         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 118         .errstr = "last insn is not an exit or jmp",
 119         .result = REJECT,
 120 },
 121 {
 122         "calls: wrong recursive calls",
 123         .insns = {
 124         BPF_JMP_IMM(BPF_JA, 0, 0, 4),
 125         BPF_JMP_IMM(BPF_JA, 0, 0, 4),
 126         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
 127         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
 128         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
 129         BPF_MOV64_IMM(BPF_REG_0, 1),
 130         BPF_EXIT_INSN(),
 131         },
 132         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 133         .errstr = "jump out of range",
 134         .result = REJECT,
 135 },
 136 {
 137         "calls: wrong src reg",
 138         .insns = {
 139         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 2, 0, 0),
 140         BPF_MOV64_IMM(BPF_REG_0, 1),
 141         BPF_EXIT_INSN(),
 142         },
 143         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 144         .errstr = "BPF_CALL uses reserved fields",
 145         .result = REJECT,
 146 },
 147 {
 148         "calls: wrong off value",
 149         .insns = {
 150         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, -1, 2),
 151         BPF_MOV64_IMM(BPF_REG_0, 1),
 152         BPF_EXIT_INSN(),
 153         BPF_MOV64_IMM(BPF_REG_0, 2),
 154         BPF_EXIT_INSN(),
 155         },
 156         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 157         .errstr = "BPF_CALL uses reserved fields",
 158         .result = REJECT,
 159 },
 160 {
 161         "calls: jump back loop",
 162         .insns = {
 163         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -1),
 164         BPF_MOV64_IMM(BPF_REG_0, 1),
 165         BPF_EXIT_INSN(),
 166         },
 167         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 168         .errstr = "back-edge from insn 0 to 0",
 169         .result = REJECT,
 170 },
 171 {
 172         "calls: conditional call",
 173         .insns = {
 174         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 175                     offsetof(struct __sk_buff, mark)),
 176         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
 177         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
 178         BPF_MOV64_IMM(BPF_REG_0, 1),
 179         BPF_EXIT_INSN(),
 180         BPF_MOV64_IMM(BPF_REG_0, 2),
 181         BPF_EXIT_INSN(),
 182         },
 183         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 184         .errstr = "jump out of range",
 185         .result = REJECT,
 186 },
 187 {
 188         "calls: conditional call 2",
 189         .insns = {
 190         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 191                     offsetof(struct __sk_buff, mark)),
 192         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
 193         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
 194         BPF_MOV64_IMM(BPF_REG_0, 1),
 195         BPF_EXIT_INSN(),
 196         BPF_MOV64_IMM(BPF_REG_0, 2),
 197         BPF_EXIT_INSN(),
 198         BPF_MOV64_IMM(BPF_REG_0, 3),
 199         BPF_EXIT_INSN(),
 200         },
 201         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 202         .result = ACCEPT,
 203 },
 204 {
 205         "calls: conditional call 3",
 206         .insns = {
 207         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 208                     offsetof(struct __sk_buff, mark)),
 209         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
 210         BPF_JMP_IMM(BPF_JA, 0, 0, 4),
 211         BPF_MOV64_IMM(BPF_REG_0, 1),
 212         BPF_EXIT_INSN(),
 213         BPF_MOV64_IMM(BPF_REG_0, 1),
 214         BPF_JMP_IMM(BPF_JA, 0, 0, -6),
 215         BPF_MOV64_IMM(BPF_REG_0, 3),
 216         BPF_JMP_IMM(BPF_JA, 0, 0, -6),
 217         },
 218         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 219         .errstr = "back-edge from insn",
 220         .result = REJECT,
 221 },
 222 {
 223         "calls: conditional call 4",
 224         .insns = {
 225         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 226                     offsetof(struct __sk_buff, mark)),
 227         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
 228         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
 229         BPF_MOV64_IMM(BPF_REG_0, 1),
 230         BPF_EXIT_INSN(),
 231         BPF_MOV64_IMM(BPF_REG_0, 1),
 232         BPF_JMP_IMM(BPF_JA, 0, 0, -5),
 233         BPF_MOV64_IMM(BPF_REG_0, 3),
 234         BPF_EXIT_INSN(),
 235         },
 236         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 237         .result = ACCEPT,
 238 },
 239 {
 240         "calls: conditional call 5",
 241         .insns = {
 242         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 243                     offsetof(struct __sk_buff, mark)),
 244         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
 245         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
 246         BPF_MOV64_IMM(BPF_REG_0, 1),
 247         BPF_EXIT_INSN(),
 248         BPF_MOV64_IMM(BPF_REG_0, 1),
 249         BPF_JMP_IMM(BPF_JA, 0, 0, -6),
 250         BPF_MOV64_IMM(BPF_REG_0, 3),
 251         BPF_EXIT_INSN(),
 252         },
 253         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 254         .errstr = "back-edge from insn",
 255         .result = REJECT,
 256 },
 257 {
 258         "calls: conditional call 6",
 259         .insns = {
 260         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
 261         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, -2),
 262         BPF_EXIT_INSN(),
 263         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 264                     offsetof(struct __sk_buff, mark)),
 265         BPF_EXIT_INSN(),
 266         },
 267         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 268         .errstr = "back-edge from insn",
 269         .result = REJECT,
 270 },
 271 {
 272         "calls: using r0 returned by callee",
 273         .insns = {
 274         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 275         BPF_EXIT_INSN(),
 276         BPF_MOV64_IMM(BPF_REG_0, 2),
 277         BPF_EXIT_INSN(),
 278         },
 279         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 280         .result = ACCEPT,
 281 },
 282 {
 283         "calls: using uninit r0 from callee",
 284         .insns = {
 285         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 286         BPF_EXIT_INSN(),
 287         BPF_EXIT_INSN(),
 288         },
 289         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 290         .errstr = "!read_ok",
 291         .result = REJECT,
 292 },
 293 {
 294         "calls: callee is using r1",
 295         .insns = {
 296         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 297         BPF_EXIT_INSN(),
 298         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 299                     offsetof(struct __sk_buff, len)),
 300         BPF_EXIT_INSN(),
 301         },
 302         .prog_type = BPF_PROG_TYPE_SCHED_ACT,
 303         .result = ACCEPT,
 304         .retval = TEST_DATA_LEN,
 305 },
 306 {
 307         "calls: callee using args1",
 308         .insns = {
 309         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 310         BPF_EXIT_INSN(),
 311         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
 312         BPF_EXIT_INSN(),
 313         },
 314         .errstr_unpriv = "allowed for root only",
 315         .result_unpriv = REJECT,
 316         .result = ACCEPT,
 317         .retval = POINTER_VALUE,
 318 },
 319 {
 320         "calls: callee using wrong args2",
 321         .insns = {
 322         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 323         BPF_EXIT_INSN(),
 324         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 325         BPF_EXIT_INSN(),
 326         },
 327         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 328         .errstr = "R2 !read_ok",
 329         .result = REJECT,
 330 },
 331 {
 332         "calls: callee using two args",
 333         .insns = {
 334         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 335         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_6,
 336                     offsetof(struct __sk_buff, len)),
 337         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_6,
 338                     offsetof(struct __sk_buff, len)),
 339         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 340         BPF_EXIT_INSN(),
 341         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
 342         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
 343         BPF_EXIT_INSN(),
 344         },
 345         .errstr_unpriv = "allowed for root only",
 346         .result_unpriv = REJECT,
 347         .result = ACCEPT,
 348         .retval = TEST_DATA_LEN + TEST_DATA_LEN - ETH_HLEN - ETH_HLEN,
 349 },
 350 {
 351         "calls: callee changing pkt pointers",
 352         .insns = {
 353         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1, offsetof(struct xdp_md, data)),
 354         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
 355                     offsetof(struct xdp_md, data_end)),
 356         BPF_MOV64_REG(BPF_REG_8, BPF_REG_6),
 357         BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 8),
 358         BPF_JMP_REG(BPF_JGT, BPF_REG_8, BPF_REG_7, 2),
 359         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
 360         /* clear_all_pkt_pointers() has to walk all frames
 361          * to make sure that pkt pointers in the caller
 362          * are cleared when callee is calling a helper that
 363          * adjusts packet size
 364          */
 365         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
 366         BPF_MOV32_IMM(BPF_REG_0, 0),
 367         BPF_EXIT_INSN(),
 368         BPF_MOV64_IMM(BPF_REG_2, 0),
 369         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_xdp_adjust_head),
 370         BPF_EXIT_INSN(),
 371         },
 372         .result = REJECT,
 373         .errstr = "R6 invalid mem access 'inv'",
 374         .prog_type = BPF_PROG_TYPE_XDP,
 375         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
 376 },
 377 {
 378         "calls: two calls with args",
 379         .insns = {
 380         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 381         BPF_EXIT_INSN(),
 382         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 383         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
 384         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
 385         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 386         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
 387         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
 388         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
 389         BPF_EXIT_INSN(),
 390         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 391                     offsetof(struct __sk_buff, len)),
 392         BPF_EXIT_INSN(),
 393         },
 394         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 395         .result = ACCEPT,
 396         .retval = TEST_DATA_LEN + TEST_DATA_LEN,
 397 },
 398 {
 399         "calls: calls with stack arith",
 400         .insns = {
 401         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 402         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
 403         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 404         BPF_EXIT_INSN(),
 405         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
 406         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 407         BPF_EXIT_INSN(),
 408         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
 409         BPF_MOV64_IMM(BPF_REG_0, 42),
 410         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
 411         BPF_EXIT_INSN(),
 412         },
 413         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 414         .result = ACCEPT,
 415         .retval = 42,
 416 },
 417 {
 418         "calls: calls with misaligned stack access",
 419         .insns = {
 420         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 421         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -63),
 422         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 423         BPF_EXIT_INSN(),
 424         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -61),
 425         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 426         BPF_EXIT_INSN(),
 427         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -63),
 428         BPF_MOV64_IMM(BPF_REG_0, 42),
 429         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
 430         BPF_EXIT_INSN(),
 431         },
 432         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 433         .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
 434         .errstr = "misaligned stack access",
 435         .result = REJECT,
 436 },
 437 {
 438         "calls: calls control flow, jump test",
 439         .insns = {
 440         BPF_MOV64_IMM(BPF_REG_0, 42),
 441         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
 442         BPF_MOV64_IMM(BPF_REG_0, 43),
 443         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
 444         BPF_JMP_IMM(BPF_JA, 0, 0, -3),
 445         BPF_EXIT_INSN(),
 446         },
 447         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 448         .result = ACCEPT,
 449         .retval = 43,
 450 },
 451 {
 452         "calls: calls control flow, jump test 2",
 453         .insns = {
 454         BPF_MOV64_IMM(BPF_REG_0, 42),
 455         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
 456         BPF_MOV64_IMM(BPF_REG_0, 43),
 457         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
 458         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -3),
 459         BPF_EXIT_INSN(),
 460         },
 461         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 462         .errstr = "jump out of range from insn 1 to 4",
 463         .result = REJECT,
 464 },
 465 {
 466         "calls: two calls with bad jump",
 467         .insns = {
 468         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 469         BPF_EXIT_INSN(),
 470         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 471         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
 472         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
 473         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 474         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
 475         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
 476         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
 477         BPF_EXIT_INSN(),
 478         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 479                     offsetof(struct __sk_buff, len)),
 480         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, -3),
 481         BPF_EXIT_INSN(),
 482         },
 483         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 484         .errstr = "jump out of range from insn 11 to 9",
 485         .result = REJECT,
 486 },
 487 {
 488         "calls: recursive call. test1",
 489         .insns = {
 490         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 491         BPF_EXIT_INSN(),
 492         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -1),
 493         BPF_EXIT_INSN(),
 494         },
 495         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 496         .errstr = "back-edge",
 497         .result = REJECT,
 498 },
 499 {
 500         "calls: recursive call. test2",
 501         .insns = {
 502         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 503         BPF_EXIT_INSN(),
 504         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -3),
 505         BPF_EXIT_INSN(),
 506         },
 507         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 508         .errstr = "back-edge",
 509         .result = REJECT,
 510 },
 511 {
 512         "calls: unreachable code",
 513         .insns = {
 514         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 515         BPF_EXIT_INSN(),
 516         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 517         BPF_EXIT_INSN(),
 518         BPF_MOV64_IMM(BPF_REG_0, 0),
 519         BPF_EXIT_INSN(),
 520         BPF_MOV64_IMM(BPF_REG_0, 0),
 521         BPF_EXIT_INSN(),
 522         },
 523         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 524         .errstr = "unreachable insn 6",
 525         .result = REJECT,
 526 },
 527 {
 528         "calls: invalid call",
 529         .insns = {
 530         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 531         BPF_EXIT_INSN(),
 532         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -4),
 533         BPF_EXIT_INSN(),
 534         },
 535         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 536         .errstr = "invalid destination",
 537         .result = REJECT,
 538 },
 539 {
 540         "calls: invalid call 2",
 541         .insns = {
 542         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 543         BPF_EXIT_INSN(),
 544         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 0x7fffffff),
 545         BPF_EXIT_INSN(),
 546         },
 547         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 548         .errstr = "invalid destination",
 549         .result = REJECT,
 550 },
 551 {
 552         "calls: jumping across function bodies. test1",
 553         .insns = {
 554         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
 555         BPF_MOV64_IMM(BPF_REG_0, 0),
 556         BPF_EXIT_INSN(),
 557         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -3),
 558         BPF_EXIT_INSN(),
 559         },
 560         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 561         .errstr = "jump out of range",
 562         .result = REJECT,
 563 },
 564 {
 565         "calls: jumping across function bodies. test2",
 566         .insns = {
 567         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
 568         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
 569         BPF_MOV64_IMM(BPF_REG_0, 0),
 570         BPF_EXIT_INSN(),
 571         BPF_EXIT_INSN(),
 572         },
 573         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 574         .errstr = "jump out of range",
 575         .result = REJECT,
 576 },
 577 {
 578         "calls: call without exit",
 579         .insns = {
 580         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 581         BPF_EXIT_INSN(),
 582         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 583         BPF_EXIT_INSN(),
 584         BPF_MOV64_IMM(BPF_REG_0, 0),
 585         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -2),
 586         },
 587         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 588         .errstr = "not an exit",
 589         .result = REJECT,
 590 },
 591 {
 592         "calls: call into middle of ld_imm64",
 593         .insns = {
 594         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
 595         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
 596         BPF_MOV64_IMM(BPF_REG_0, 0),
 597         BPF_EXIT_INSN(),
 598         BPF_LD_IMM64(BPF_REG_0, 0),
 599         BPF_EXIT_INSN(),
 600         },
 601         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 602         .errstr = "last insn",
 603         .result = REJECT,
 604 },
 605 {
 606         "calls: call into middle of other call",
 607         .insns = {
 608         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
 609         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
 610         BPF_MOV64_IMM(BPF_REG_0, 0),
 611         BPF_EXIT_INSN(),
 612         BPF_MOV64_IMM(BPF_REG_0, 0),
 613         BPF_MOV64_IMM(BPF_REG_0, 0),
 614         BPF_EXIT_INSN(),
 615         },
 616         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 617         .errstr = "last insn",
 618         .result = REJECT,
 619 },
 620 {
 621         "calls: ld_abs with changing ctx data in callee",
 622         .insns = {
 623         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 624         BPF_LD_ABS(BPF_B, 0),
 625         BPF_LD_ABS(BPF_H, 0),
 626         BPF_LD_ABS(BPF_W, 0),
 627         BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
 628         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
 629         BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
 630         BPF_LD_ABS(BPF_B, 0),
 631         BPF_LD_ABS(BPF_H, 0),
 632         BPF_LD_ABS(BPF_W, 0),
 633         BPF_EXIT_INSN(),
 634         BPF_MOV64_IMM(BPF_REG_2, 1),
 635         BPF_MOV64_IMM(BPF_REG_3, 2),
 636         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_vlan_push),
 637         BPF_EXIT_INSN(),
 638         },
 639         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 640         .errstr = "BPF_LD_[ABS|IND] instructions cannot be mixed",
 641         .result = REJECT,
 642 },
 643 {
 644         "calls: two calls with bad fallthrough",
 645         .insns = {
 646         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 647         BPF_EXIT_INSN(),
 648         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 649         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
 650         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
 651         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 652         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
 653         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
 654         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
 655         BPF_MOV64_REG(BPF_REG_0, BPF_REG_0),
 656         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 657                     offsetof(struct __sk_buff, len)),
 658         BPF_EXIT_INSN(),
 659         },
 660         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 661         .errstr = "not an exit",
 662         .result = REJECT,
 663 },
 664 {
 665         "calls: two calls with stack read",
 666         .insns = {
 667         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 668         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
 669         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
 670         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 671         BPF_EXIT_INSN(),
 672         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 673         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
 674         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
 675         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 676         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
 677         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
 678         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
 679         BPF_EXIT_INSN(),
 680         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
 681         BPF_EXIT_INSN(),
 682         },
 683         .prog_type = BPF_PROG_TYPE_XDP,
 684         .result = ACCEPT,
 685 },
 686 {
 687         "calls: two calls with stack write",
 688         .insns = {
 689         /* main prog */
 690         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 691         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
 692         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
 693         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 694         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
 695         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
 696         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
 697         BPF_EXIT_INSN(),
 698
 699         /* subprog 1 */
 700         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 701         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
 702         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 7),
 703         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
 704         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 705         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
 706         BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_0),
 707         BPF_MOV64_REG(BPF_REG_0, BPF_REG_8),
 708         /* write into stack frame of main prog */
 709         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
 710         BPF_EXIT_INSN(),
 711
 712         /* subprog 2 */
 713         /* read from stack frame of main prog */
 714         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
 715         BPF_EXIT_INSN(),
 716         },
 717         .prog_type = BPF_PROG_TYPE_XDP,
 718         .result = ACCEPT,
 719 },
 720 {
 721         "calls: stack overflow using two frames (pre-call access)",
 722         .insns = {
 723         /* prog 1 */
 724         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
 725         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1),
 726         BPF_EXIT_INSN(),
 727
 728         /* prog 2 */
 729         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
 730         BPF_MOV64_IMM(BPF_REG_0, 0),
 731         BPF_EXIT_INSN(),
 732         },
 733         .prog_type = BPF_PROG_TYPE_XDP,
 734         .errstr = "combined stack size",
 735         .result = REJECT,
 736 },
 737 {
 738         "calls: stack overflow using two frames (post-call access)",
 739         .insns = {
 740         /* prog 1 */
 741         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 2),
 742         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
 743         BPF_EXIT_INSN(),
 744
 745         /* prog 2 */
 746         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
 747         BPF_MOV64_IMM(BPF_REG_0, 0),
 748         BPF_EXIT_INSN(),
 749         },
 750         .prog_type = BPF_PROG_TYPE_XDP,
 751         .errstr = "combined stack size",
 752         .result = REJECT,
 753 },
 754 {
 755         "calls: stack depth check using three frames. test1",
 756         .insns = {
 757         /* main */
 758         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
 759         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 5), /* call B */
 760         BPF_ST_MEM(BPF_B, BPF_REG_10, -32, 0),
 761         BPF_MOV64_IMM(BPF_REG_0, 0),
 762         BPF_EXIT_INSN(),
 763         /* A */
 764         BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
 765         BPF_EXIT_INSN(),
 766         /* B */
 767         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -3), /* call A */
 768         BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
 769         BPF_EXIT_INSN(),
 770         },
 771         .prog_type = BPF_PROG_TYPE_XDP,
 772         /* stack_main=32, stack_A=256, stack_B=64
 773          * and max(main+A, main+A+B) < 512
 774          */
 775         .result = ACCEPT,
 776 },
 777 {
 778         "calls: stack depth check using three frames. test2",
 779         .insns = {
 780         /* main */
 781         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
 782         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 5), /* call B */
 783         BPF_ST_MEM(BPF_B, BPF_REG_10, -32, 0),
 784         BPF_MOV64_IMM(BPF_REG_0, 0),
 785         BPF_EXIT_INSN(),
 786         /* A */
 787         BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
 788         BPF_EXIT_INSN(),
 789         /* B */
 790         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -3), /* call A */
 791         BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
 792         BPF_EXIT_INSN(),
 793         },
 794         .prog_type = BPF_PROG_TYPE_XDP,
 795         /* stack_main=32, stack_A=64, stack_B=256
 796          * and max(main+A, main+A+B) < 512
 797          */
 798         .result = ACCEPT,
 799 },
 800 {
 801         "calls: stack depth check using three frames. test3",
 802         .insns = {
 803         /* main */
 804         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 805         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 6), /* call A */
 806         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 807         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 8), /* call B */
 808         BPF_JMP_IMM(BPF_JGE, BPF_REG_6, 0, 1),
 809         BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
 810         BPF_MOV64_IMM(BPF_REG_0, 0),
 811         BPF_EXIT_INSN(),
 812         /* A */
 813         BPF_JMP_IMM(BPF_JLT, BPF_REG_1, 10, 1),
 814         BPF_EXIT_INSN(),
 815         BPF_ST_MEM(BPF_B, BPF_REG_10, -224, 0),
 816         BPF_JMP_IMM(BPF_JA, 0, 0, -3),
 817         /* B */
 818         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 2, 1),
 819         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -6), /* call A */
 820         BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
 821         BPF_EXIT_INSN(),
 822         },
 823         .prog_type = BPF_PROG_TYPE_XDP,
 824         /* stack_main=64, stack_A=224, stack_B=256
 825          * and max(main+A, main+A+B) > 512
 826          */
 827         .errstr = "combined stack",
 828         .result = REJECT,
 829 },
 830 {
 831         "calls: stack depth check using three frames. test4",
 832         /* void main(void) {
 833          *   func1(0);
 834          *   func1(1);
 835          *   func2(1);
 836          * }
 837          * void func1(int alloc_or_recurse) {
 838          *   if (alloc_or_recurse) {
 839          *     frame_pointer[-300] = 1;
 840          *   } else {
 841          *     func2(alloc_or_recurse);
 842          *   }
 843          * }
 844          * void func2(int alloc_or_recurse) {
 845          *   if (alloc_or_recurse) {
 846          *     frame_pointer[-300] = 1;
 847          *   }
 848          * }
 849          */
 850         .insns = {
 851         /* main */
 852         BPF_MOV64_IMM(BPF_REG_1, 0),
 853         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 6), /* call A */
 854         BPF_MOV64_IMM(BPF_REG_1, 1),
 855         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
 856         BPF_MOV64_IMM(BPF_REG_1, 1),
 857         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 7), /* call B */
 858         BPF_MOV64_IMM(BPF_REG_0, 0),
 859         BPF_EXIT_INSN(),
 860         /* A */
 861         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
 862         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
 863         BPF_EXIT_INSN(),
 864         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call B */
 865         BPF_EXIT_INSN(),
 866         /* B */
 867         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 868         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
 869         BPF_EXIT_INSN(),
 870         },
 871         .prog_type = BPF_PROG_TYPE_XDP,
 872         .result = REJECT,
 873         .errstr = "combined stack",
 874 },
 875 {
 876         "calls: stack depth check using three frames. test5",
 877         .insns = {
 878         /* main */
 879         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call A */
 880         BPF_EXIT_INSN(),
 881         /* A */
 882         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call B */
 883         BPF_EXIT_INSN(),
 884         /* B */
 885         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call C */
 886         BPF_EXIT_INSN(),
 887         /* C */
 888         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call D */
 889         BPF_EXIT_INSN(),
 890         /* D */
 891         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call E */
 892         BPF_EXIT_INSN(),
 893         /* E */
 894         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call F */
 895         BPF_EXIT_INSN(),
 896         /* F */
 897         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call G */
 898         BPF_EXIT_INSN(),
 899         /* G */
 900         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call H */
 901         BPF_EXIT_INSN(),
 902         /* H */
 903         BPF_MOV64_IMM(BPF_REG_0, 0),
 904         BPF_EXIT_INSN(),
 905         },
 906         .prog_type = BPF_PROG_TYPE_XDP,
 907         .errstr = "call stack",
 908         .result = REJECT,
 909 },
 910 {
 911         "calls: spill into caller stack frame",
 912         .insns = {
 913         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 914         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
 915         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
 916         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 917         BPF_EXIT_INSN(),
 918         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
 919         BPF_MOV64_IMM(BPF_REG_0, 0),
 920         BPF_EXIT_INSN(),
 921         },
 922         .prog_type = BPF_PROG_TYPE_XDP,
 923         .errstr = "cannot spill",
 924         .result = REJECT,
 925 },
 926 {
 927         "calls: write into caller stack frame",
 928         .insns = {
 929         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
 930         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
 931         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 932         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
 933         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
 934         BPF_EXIT_INSN(),
 935         BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 42),
 936         BPF_MOV64_IMM(BPF_REG_0, 0),
 937         BPF_EXIT_INSN(),
 938         },
 939         .prog_type = BPF_PROG_TYPE_XDP,
 940         .result = ACCEPT,
 941         .retval = 42,
 942 },
 943 {
 944         "calls: write into callee stack frame",
 945         .insns = {
 946         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
 947         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
 948         BPF_EXIT_INSN(),
 949         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
 950         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, -8),
 951         BPF_EXIT_INSN(),
 952         },
 953         .prog_type = BPF_PROG_TYPE_XDP,
 954         .errstr = "cannot return stack pointer",
 955         .result = REJECT,
 956 },
 957 {
 958         "calls: two calls with stack write and void return",
 959         .insns = {
 960         /* main prog */
 961         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 962         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
 963         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
 964         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 965         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
 966         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
 967         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
 968         BPF_EXIT_INSN(),
 969
 970         /* subprog 1 */
 971         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 972         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
 973         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
 974         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
 975         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 976         BPF_EXIT_INSN(),
 977
 978         /* subprog 2 */
 979         /* write into stack frame of main prog */
 980         BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 0),
 981         BPF_EXIT_INSN(), /* void return */
 982         },
 983         .prog_type = BPF_PROG_TYPE_XDP,
 984         .result = ACCEPT,
 985 },
 986 {
 987         "calls: ambiguous return value",
 988         .insns = {
 989         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 990         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
 991         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
 992         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 993         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
 994         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
 995         BPF_EXIT_INSN(),
 996         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 997         BPF_MOV64_IMM(BPF_REG_0, 0),
 998         BPF_EXIT_INSN(),
 999         },
1000         .errstr_unpriv = "allowed for root only",
1001         .result_unpriv = REJECT,
1002         .errstr = "R0 !read_ok",
1003         .result = REJECT,
1004 },
1005 {
1006         "calls: two calls that return map_value",
1007         .insns = {
1008         /* main prog */
1009         /* pass fp-16, fp-8 into a function */
1010         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1011         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1012         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1013         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1014         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
1015
1016         /* fetch map_value_ptr from the stack of this function */
1017         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
1018         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
1019         /* write into map value */
1020         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1021         /* fetch secound map_value_ptr from the stack */
1022         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
1023         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
1024         /* write into map value */
1025         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1026         BPF_MOV64_IMM(BPF_REG_0, 0),
1027         BPF_EXIT_INSN(),
1028
1029         /* subprog 1 */
1030         /* call 3rd function twice */
1031         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
1032         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
1033         /* first time with fp-8 */
1034         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
1035         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
1036         /* second time with fp-16 */
1037         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
1038         BPF_EXIT_INSN(),
1039
1040         /* subprog 2 */
1041         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
1042         /* lookup from map */
1043         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1044         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1045         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1046         BPF_LD_MAP_FD(BPF_REG_1, 0),
1047         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
1048         /* write map_value_ptr into stack frame of main prog */
1049         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
1050         BPF_MOV64_IMM(BPF_REG_0, 0),
1051         BPF_EXIT_INSN(), /* return 0 */
1052         },
1053         .prog_type = BPF_PROG_TYPE_XDP,
1054         .fixup_map_hash_8b = { 23 },
1055         .result = ACCEPT,
1056 },
1057 {
1058         "calls: two calls that return map_value with bool condition",
1059         .insns = {
1060         /* main prog */
1061         /* pass fp-16, fp-8 into a function */
1062         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1063         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1064         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1065         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1066         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
1067         BPF_MOV64_IMM(BPF_REG_0, 0),
1068         BPF_EXIT_INSN(),
1069
1070         /* subprog 1 */
1071         /* call 3rd function twice */
1072         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
1073         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
1074         /* first time with fp-8 */
1075         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 9),
1076         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
1077         /* fetch map_value_ptr from the stack of this function */
1078         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
1079         /* write into map value */
1080         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1081         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
1082         /* second time with fp-16 */
1083         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
1084         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
1085         /* fetch secound map_value_ptr from the stack */
1086         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
1087         /* write into map value */
1088         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1089         BPF_EXIT_INSN(),
1090
1091         /* subprog 2 */
1092         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
1093         /* lookup from map */
1094         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1095         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1096         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1097         BPF_LD_MAP_FD(BPF_REG_1, 0),
1098         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
1099         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
1100         BPF_MOV64_IMM(BPF_REG_0, 0),
1101         BPF_EXIT_INSN(), /* return 0 */
1102         /* write map_value_ptr into stack frame of main prog */
1103         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
1104         BPF_MOV64_IMM(BPF_REG_0, 1),
1105         BPF_EXIT_INSN(), /* return 1 */
1106         },
1107         .prog_type = BPF_PROG_TYPE_XDP,
1108         .fixup_map_hash_8b = { 23 },
1109         .result = ACCEPT,
1110 },
1111 {
1112         "calls: two calls that return map_value with incorrect bool check",
1113         .insns = {
1114         /* main prog */
1115         /* pass fp-16, fp-8 into a function */
1116         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1117         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1118         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1119         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1120         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
1121         BPF_MOV64_IMM(BPF_REG_0, 0),
1122         BPF_EXIT_INSN(),
1123
1124         /* subprog 1 */
1125         /* call 3rd function twice */
1126         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
1127         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
1128         /* first time with fp-8 */
1129         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 9),
1130         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
1131         /* fetch map_value_ptr from the stack of this function */
1132         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
1133         /* write into map value */
1134         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1135         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
1136         /* second time with fp-16 */
1137         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
1138         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
1139         /* fetch secound map_value_ptr from the stack */
1140         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
1141         /* write into map value */
1142         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1143         BPF_EXIT_INSN(),
1144
1145         /* subprog 2 */
1146         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
1147         /* lookup from map */
1148         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1149         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1150         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1151         BPF_LD_MAP_FD(BPF_REG_1, 0),
1152         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
1153         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
1154         BPF_MOV64_IMM(BPF_REG_0, 0),
1155         BPF_EXIT_INSN(), /* return 0 */
1156         /* write map_value_ptr into stack frame of main prog */
1157         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
1158         BPF_MOV64_IMM(BPF_REG_0, 1),
1159         BPF_EXIT_INSN(), /* return 1 */
1160         },
1161         .prog_type = BPF_PROG_TYPE_XDP,
1162         .fixup_map_hash_8b = { 23 },
1163         .result = REJECT,
1164         .errstr = "invalid read from stack off -16+0 size 8",
1165 },
1166 {
1167         "calls: two calls that receive map_value via arg=ptr_stack_of_caller. test1",
1168         .insns = {
1169         /* main prog */
1170         /* pass fp-16, fp-8 into a function */
1171         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1172         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1173         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1174         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1175         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
1176         BPF_MOV64_IMM(BPF_REG_0, 0),
1177         BPF_EXIT_INSN(),
1178
1179         /* subprog 1 */
1180         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
1181         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
1182         /* 1st lookup from map */
1183         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1184         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1185         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1186         BPF_LD_MAP_FD(BPF_REG_1, 0),
1187         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
1188         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
1189         BPF_MOV64_IMM(BPF_REG_8, 0),
1190         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1191         /* write map_value_ptr into stack frame of main prog at fp-8 */
1192         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
1193         BPF_MOV64_IMM(BPF_REG_8, 1),
1194
1195         /* 2nd lookup from map */
1196         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), /* 20 */
1197         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1198         BPF_LD_MAP_FD(BPF_REG_1, 0),
1199         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, /* 24 */
1200                      BPF_FUNC_map_lookup_elem),
1201         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
1202         BPF_MOV64_IMM(BPF_REG_9, 0),
1203         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1204         /* write map_value_ptr into stack frame of main prog at fp-16 */
1205         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
1206         BPF_MOV64_IMM(BPF_REG_9, 1),
1207
1208         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
1209         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), /* 30 */
1210         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
1211         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
1212         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
1213         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),  /* 34 */
1214         BPF_EXIT_INSN(),
1215
1216         /* subprog 2 */
1217         /* if arg2 == 1 do *arg1 = 0 */
1218         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
1219         /* fetch map_value_ptr from the stack of this function */
1220         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
1221         /* write into map value */
1222         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1223
1224         /* if arg4 == 1 do *arg3 = 0 */
1225         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
1226         /* fetch map_value_ptr from the stack of this function */
1227         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
1228         /* write into map value */
1229         BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 0),
1230         BPF_EXIT_INSN(),
1231         },
1232         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1233         .fixup_map_hash_8b = { 12, 22 },
1234         .result = REJECT,
1235         .errstr = "invalid access to map value, value_size=8 off=2 size=8",
1236         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
1237 },
1238 {
1239         "calls: two calls that receive map_value via arg=ptr_stack_of_caller. test2",
1240         .insns = {
1241         /* main prog */
1242         /* pass fp-16, fp-8 into a function */
1243         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1244         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1245         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1246         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1247         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
1248         BPF_MOV64_IMM(BPF_REG_0, 0),
1249         BPF_EXIT_INSN(),
1250
1251         /* subprog 1 */
1252         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
1253         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
1254         /* 1st lookup from map */
1255         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1256         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1257         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1258         BPF_LD_MAP_FD(BPF_REG_1, 0),
1259         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
1260         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
1261         BPF_MOV64_IMM(BPF_REG_8, 0),
1262         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1263         /* write map_value_ptr into stack frame of main prog at fp-8 */
1264         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
1265         BPF_MOV64_IMM(BPF_REG_8, 1),
1266
1267         /* 2nd lookup from map */
1268         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), /* 20 */
1269         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1270         BPF_LD_MAP_FD(BPF_REG_1, 0),
1271         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, /* 24 */
1272                      BPF_FUNC_map_lookup_elem),
1273         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
1274         BPF_MOV64_IMM(BPF_REG_9, 0),
1275         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1276         /* write map_value_ptr into stack frame of main prog at fp-16 */
1277         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
1278         BPF_MOV64_IMM(BPF_REG_9, 1),
1279
1280         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
1281         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), /* 30 */
1282         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
1283         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
1284         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
1285         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),  /* 34 */
1286         BPF_EXIT_INSN(),
1287
1288         /* subprog 2 */
1289         /* if arg2 == 1 do *arg1 = 0 */
1290         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
1291         /* fetch map_value_ptr from the stack of this function */
1292         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
1293         /* write into map value */
1294         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1295
1296         /* if arg4 == 1 do *arg3 = 0 */
1297         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
1298         /* fetch map_value_ptr from the stack of this function */
1299         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
1300         /* write into map value */
1301         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1302         BPF_EXIT_INSN(),
1303         },
1304         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1305         .fixup_map_hash_8b = { 12, 22 },
1306         .result = ACCEPT,
1307 },
1308 {
1309         "calls: two jumps that receive map_value via arg=ptr_stack_of_jumper. test3",
1310         .insns = {
1311         /* main prog */
1312         /* pass fp-16, fp-8 into a function */
1313         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1314         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1315         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1316         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1317         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2),
1318         BPF_MOV64_IMM(BPF_REG_0, 0),
1319         BPF_EXIT_INSN(),
1320
1321         /* subprog 1 */
1322         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
1323         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
1324         /* 1st lookup from map */
1325         BPF_ST_MEM(BPF_DW, BPF_REG_10, -24, 0),
1326         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1327         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -24),
1328         BPF_LD_MAP_FD(BPF_REG_1, 0),
1329         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
1330         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
1331         BPF_MOV64_IMM(BPF_REG_8, 0),
1332         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1333         /* write map_value_ptr into stack frame of main prog at fp-8 */
1334         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
1335         BPF_MOV64_IMM(BPF_REG_8, 1),
1336
1337         /* 2nd lookup from map */
1338         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1339         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -24),
1340         BPF_LD_MAP_FD(BPF_REG_1, 0),
1341         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
1342         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
1343         BPF_MOV64_IMM(BPF_REG_9, 0),  // 26
1344         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1345         /* write map_value_ptr into stack frame of main prog at fp-16 */
1346         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
1347         BPF_MOV64_IMM(BPF_REG_9, 1),
1348
1349         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
1350         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), // 30
1351         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
1352         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
1353         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
1354         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1), // 34
1355         BPF_JMP_IMM(BPF_JA, 0, 0, -30),
1356
1357         /* subprog 2 */
1358         /* if arg2 == 1 do *arg1 = 0 */
1359         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
1360         /* fetch map_value_ptr from the stack of this function */
1361         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
1362         /* write into map value */
1363         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1364
1365         /* if arg4 == 1 do *arg3 = 0 */
1366         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
1367         /* fetch map_value_ptr from the stack of this function */
1368         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
1369         /* write into map value */
1370         BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 0),
1371         BPF_JMP_IMM(BPF_JA, 0, 0, -8),
1372         },
1373         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1374         .fixup_map_hash_8b = { 12, 22 },
1375         .result = REJECT,
1376         .errstr = "invalid access to map value, value_size=8 off=2 size=8",
1377         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
1378 },
1379 {
1380         "calls: two calls that receive map_value_ptr_or_null via arg. test1",
1381         .insns = {
1382         /* main prog */
1383         /* pass fp-16, fp-8 into a function */
1384         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1385         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1386         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1387         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1388         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
1389         BPF_MOV64_IMM(BPF_REG_0, 0),
1390         BPF_EXIT_INSN(),
1391
1392         /* subprog 1 */
1393         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
1394         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
1395         /* 1st lookup from map */
1396         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1397         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1398         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1399         BPF_LD_MAP_FD(BPF_REG_1, 0),
1400         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
1401         /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
1402         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
1403         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
1404         BPF_MOV64_IMM(BPF_REG_8, 0),
1405         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
1406         BPF_MOV64_IMM(BPF_REG_8, 1),
1407
1408         /* 2nd lookup from map */
1409         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1410         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1411         BPF_LD_MAP_FD(BPF_REG_1, 0),
1412         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
1413         /* write map_value_ptr_or_null into stack frame of main prog at fp-16 */
1414         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
1415         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
1416         BPF_MOV64_IMM(BPF_REG_9, 0),
1417         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
1418         BPF_MOV64_IMM(BPF_REG_9, 1),
1419
1420         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
1421         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
1422         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
1423         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
1424         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
1425         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
1426         BPF_EXIT_INSN(),
1427
1428         /* subprog 2 */
1429         /* if arg2 == 1 do *arg1 = 0 */
1430         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
1431         /* fetch map_value_ptr from the stack of this function */
1432         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
1433         /* write into map value */
1434         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1435
1436         /* if arg4 == 1 do *arg3 = 0 */
1437         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
1438         /* fetch map_value_ptr from the stack of this function */
1439         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
1440         /* write into map value */
1441         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1442         BPF_EXIT_INSN(),
1443         },
1444         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1445         .fixup_map_hash_8b = { 12, 22 },
1446         .result = ACCEPT,
1447 },
1448 {
1449         "calls: two calls that receive map_value_ptr_or_null via arg. test2",
1450         .insns = {
1451         /* main prog */
1452         /* pass fp-16, fp-8 into a function */
1453         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1454         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1455         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1456         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1457         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
1458         BPF_MOV64_IMM(BPF_REG_0, 0),
1459         BPF_EXIT_INSN(),
1460
1461         /* subprog 1 */
1462         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
1463         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
1464         /* 1st lookup from map */
1465         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1466         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1467         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1468         BPF_LD_MAP_FD(BPF_REG_1, 0),
1469         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
1470         /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
1471         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
1472         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
1473         BPF_MOV64_IMM(BPF_REG_8, 0),
1474         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
1475         BPF_MOV64_IMM(BPF_REG_8, 1),
1476
1477         /* 2nd lookup from map */
1478         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1479         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1480         BPF_LD_MAP_FD(BPF_REG_1, 0),
1481         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
1482         /* write map_value_ptr_or_null into stack frame of main prog at fp-16 */
1483         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
1484         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
1485         BPF_MOV64_IMM(BPF_REG_9, 0),
1486         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
1487         BPF_MOV64_IMM(BPF_REG_9, 1),
1488
1489         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
1490         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
1491         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
1492         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
1493         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
1494         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
1495         BPF_EXIT_INSN(),
1496
1497         /* subprog 2 */
1498         /* if arg2 == 1 do *arg1 = 0 */
1499         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
1500         /* fetch map_value_ptr from the stack of this function */
1501         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
1502         /* write into map value */
1503         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1504
1505         /* if arg4 == 0 do *arg3 = 0 */
1506         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 0, 2),
1507         /* fetch map_value_ptr from the stack of this function */
1508         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
1509         /* write into map value */
1510         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1511         BPF_EXIT_INSN(),
1512         },
1513         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1514         .fixup_map_hash_8b = { 12, 22 },
1515         .result = REJECT,
1516         .errstr = "R0 invalid mem access 'inv'",
1517 },
1518 {
1519         "calls: pkt_ptr spill into caller stack",
1520         .insns = {
1521         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
1522         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
1523         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
1524         BPF_EXIT_INSN(),
1525
1526         /* subprog 1 */
1527         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1528                     offsetof(struct __sk_buff, data)),
1529         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1530                     offsetof(struct __sk_buff, data_end)),
1531         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1532         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1533         /* spill unchecked pkt_ptr into stack of caller */
1534         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
1535         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
1536         /* now the pkt range is verified, read pkt_ptr from stack */
1537         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
1538         /* write 4 bytes into packet */
1539         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
1540         BPF_EXIT_INSN(),
1541         },
1542         .result = ACCEPT,
1543         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1544         .retval = POINTER_VALUE,
1545         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
1546 },
1547 {
1548         "calls: pkt_ptr spill into caller stack 2",
1549         .insns = {
1550         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
1551         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
1552         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
1553         /* Marking is still kept, but not in all cases safe. */
1554         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
1555         BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
1556         BPF_EXIT_INSN(),
1557
1558         /* subprog 1 */
1559         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1560                     offsetof(struct __sk_buff, data)),
1561         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1562                     offsetof(struct __sk_buff, data_end)),
1563         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1564         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1565         /* spill unchecked pkt_ptr into stack of caller */
1566         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
1567         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
1568         /* now the pkt range is verified, read pkt_ptr from stack */
1569         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
1570         /* write 4 bytes into packet */
1571         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
1572         BPF_EXIT_INSN(),
1573         },
1574         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1575         .errstr = "invalid access to packet",
1576         .result = REJECT,
1577         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
1578 },
1579 {
1580         "calls: pkt_ptr spill into caller stack 3",
1581         .insns = {
1582         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
1583         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
1584         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
1585         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
1586         /* Marking is still kept and safe here. */
1587         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
1588         BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
1589         BPF_EXIT_INSN(),
1590
1591         /* subprog 1 */
1592         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1593                     offsetof(struct __sk_buff, data)),
1594         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1595                     offsetof(struct __sk_buff, data_end)),
1596         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1597         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1598         /* spill unchecked pkt_ptr into stack of caller */
1599         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
1600         BPF_MOV64_IMM(BPF_REG_5, 0),
1601         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
1602         BPF_MOV64_IMM(BPF_REG_5, 1),
1603         /* now the pkt range is verified, read pkt_ptr from stack */
1604         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
1605         /* write 4 bytes into packet */
1606         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
1607         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
1608         BPF_EXIT_INSN(),
1609         },
1610         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1611         .result = ACCEPT,
1612         .retval = 1,
1613         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
1614 },
1615 {
1616         "calls: pkt_ptr spill into caller stack 4",
1617         .insns = {
1618         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
1619         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
1620         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
1621         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
1622         /* Check marking propagated. */
1623         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
1624         BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
1625         BPF_EXIT_INSN(),
1626
1627         /* subprog 1 */
1628         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1629                     offsetof(struct __sk_buff, data)),
1630         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1631                     offsetof(struct __sk_buff, data_end)),
1632         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1633         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1634         /* spill unchecked pkt_ptr into stack of caller */
1635         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
1636         BPF_MOV64_IMM(BPF_REG_5, 0),
1637         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
1638         BPF_MOV64_IMM(BPF_REG_5, 1),
1639         /* don't read back pkt_ptr from stack here */
1640         /* write 4 bytes into packet */
1641         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
1642         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
1643         BPF_EXIT_INSN(),
1644         },
1645         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1646         .result = ACCEPT,
1647         .retval = 1,
1648         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
1649 },
1650 {
1651         "calls: pkt_ptr spill into caller stack 5",
1652         .insns = {
1653         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
1654         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
1655         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_1, 0),
1656         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
1657         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
1658         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
1659         BPF_EXIT_INSN(),
1660
1661         /* subprog 1 */
1662         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1663                     offsetof(struct __sk_buff, data)),
1664         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1665                     offsetof(struct __sk_buff, data_end)),
1666         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1667         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1668         BPF_MOV64_IMM(BPF_REG_5, 0),
1669         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
1670         /* spill checked pkt_ptr into stack of caller */
1671         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
1672         BPF_MOV64_IMM(BPF_REG_5, 1),
1673         /* don't read back pkt_ptr from stack here */
1674         /* write 4 bytes into packet */
1675         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
1676         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
1677         BPF_EXIT_INSN(),
1678         },
1679         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1680         .errstr = "same insn cannot be used with different",
1681         .result = REJECT,
1682         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
1683 },
1684 {
1685         "calls: pkt_ptr spill into caller stack 6",
1686         .insns = {
1687         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1688                     offsetof(struct __sk_buff, data_end)),
1689         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
1690         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
1691         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
1692         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
1693         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
1694         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
1695         BPF_EXIT_INSN(),
1696
1697         /* subprog 1 */
1698         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1699                     offsetof(struct __sk_buff, data)),
1700         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1701                     offsetof(struct __sk_buff, data_end)),
1702         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1703         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1704         BPF_MOV64_IMM(BPF_REG_5, 0),
1705         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
1706         /* spill checked pkt_ptr into stack of caller */
1707         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
1708         BPF_MOV64_IMM(BPF_REG_5, 1),
1709         /* don't read back pkt_ptr from stack here */
1710         /* write 4 bytes into packet */
1711         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
1712         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
1713         BPF_EXIT_INSN(),
1714         },
1715         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1716         .errstr = "R4 invalid mem access",
1717         .result = REJECT,
1718         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
1719 },
1720 {
1721         "calls: pkt_ptr spill into caller stack 7",
1722         .insns = {
1723         BPF_MOV64_IMM(BPF_REG_2, 0),
1724         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
1725         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
1726         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
1727         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
1728         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
1729         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
1730         BPF_EXIT_INSN(),
1731
1732         /* subprog 1 */
1733         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1734                     offsetof(struct __sk_buff, data)),
1735         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1736                     offsetof(struct __sk_buff, data_end)),
1737         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1738         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1739         BPF_MOV64_IMM(BPF_REG_5, 0),
1740         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
1741         /* spill checked pkt_ptr into stack of caller */
1742         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
1743         BPF_MOV64_IMM(BPF_REG_5, 1),
1744         /* don't read back pkt_ptr from stack here */
1745         /* write 4 bytes into packet */
1746         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
1747         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
1748         BPF_EXIT_INSN(),
1749         },
1750         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1751         .errstr = "R4 invalid mem access",
1752         .result = REJECT,
1753         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
1754 },
1755 {
1756         "calls: pkt_ptr spill into caller stack 8",
1757         .insns = {
1758         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1759                     offsetof(struct __sk_buff, data)),
1760         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1761                     offsetof(struct __sk_buff, data_end)),
1762         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1763         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1764         BPF_JMP_REG(BPF_JLE, BPF_REG_0, BPF_REG_3, 1),
1765         BPF_EXIT_INSN(),
1766         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
1767         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
1768         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
1769         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
1770         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
1771         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
1772         BPF_EXIT_INSN(),
1773
1774         /* subprog 1 */
1775         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1776                     offsetof(struct __sk_buff, data)),
1777         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1778                     offsetof(struct __sk_buff, data_end)),
1779         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1780         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1781         BPF_MOV64_IMM(BPF_REG_5, 0),
1782         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
1783         /* spill checked pkt_ptr into stack of caller */
1784         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
1785         BPF_MOV64_IMM(BPF_REG_5, 1),
1786         /* don't read back pkt_ptr from stack here */
1787         /* write 4 bytes into packet */
1788         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
1789         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
1790         BPF_EXIT_INSN(),
1791         },
1792         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1793         .result = ACCEPT,
1794         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
1795 },
1796 {
1797         "calls: pkt_ptr spill into caller stack 9",
1798         .insns = {
1799         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1800                     offsetof(struct __sk_buff, data)),
1801         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1802                     offsetof(struct __sk_buff, data_end)),
1803         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1804         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1805         BPF_JMP_REG(BPF_JLE, BPF_REG_0, BPF_REG_3, 1),
1806         BPF_EXIT_INSN(),
1807         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
1808         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
1809         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
1810         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
1811         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
1812         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
1813         BPF_EXIT_INSN(),
1814
1815         /* subprog 1 */
1816         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1817                     offsetof(struct __sk_buff, data)),
1818         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1819                     offsetof(struct __sk_buff, data_end)),
1820         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1821         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1822         BPF_MOV64_IMM(BPF_REG_5, 0),
1823         /* spill unchecked pkt_ptr into stack of caller */
1824         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
1825         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
1826         BPF_MOV64_IMM(BPF_REG_5, 1),
1827         /* don't read back pkt_ptr from stack here */
1828         /* write 4 bytes into packet */
1829         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
1830         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
1831         BPF_EXIT_INSN(),
1832         },
1833         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1834         .errstr = "invalid access to packet",
1835         .result = REJECT,
1836         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
1837 },
1838 {
1839         "calls: caller stack init to zero or map_value_or_null",
1840         .insns = {
1841         BPF_MOV64_IMM(BPF_REG_0, 0),
1842         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
1843         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1844         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1845         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
1846         /* fetch map_value_or_null or const_zero from stack */
1847         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
1848         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
1849         /* store into map_value */
1850         BPF_ST_MEM(BPF_W, BPF_REG_0, 0, 0),
1851         BPF_EXIT_INSN(),
1852
1853         /* subprog 1 */
1854         /* if (ctx == 0) return; */
1855         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 8),
1856         /* else bpf_map_lookup() and *(fp - 8) = r0 */
1857         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
1858         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1859         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1860         BPF_LD_MAP_FD(BPF_REG_1, 0),
1861         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1862         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
1863         /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
1864         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
1865         BPF_EXIT_INSN(),
1866         },
1867         .fixup_map_hash_8b = { 13 },
1868         .result = ACCEPT,
1869         .prog_type = BPF_PROG_TYPE_XDP,
1870 },
1871 {
1872         "calls: stack init to zero and pruning",
1873         .insns = {
1874         /* first make allocated_stack 16 byte */
1875         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, 0),
1876         /* now fork the execution such that the false branch
1877          * of JGT insn will be verified second and it skisp zero
1878          * init of fp-8 stack slot. If stack liveness marking
1879          * is missing live_read marks from call map_lookup
1880          * processing then pruning will incorrectly assume
1881          * that fp-8 stack slot was unused in the fall-through
1882          * branch and will accept the program incorrectly
1883          */
1884         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 2, 2),
1885         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1886         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1887         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1888         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1889         BPF_LD_MAP_FD(BPF_REG_1, 0),
1890         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
1891         BPF_EXIT_INSN(),
1892         },
1893         .fixup_map_hash_48b = { 6 },
1894         .errstr = "invalid indirect read from stack off -8+0 size 8",
1895         .result = REJECT,
1896         .prog_type = BPF_PROG_TYPE_XDP,
1897 },
1898 {
1899         "calls: ctx read at start of subprog",
1900         .insns = {
1901         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
1902         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
1903         BPF_JMP_REG(BPF_JSGT, BPF_REG_0, BPF_REG_0, 0),
1904         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
1905         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
1906         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
1907         BPF_EXIT_INSN(),
1908         BPF_LDX_MEM(BPF_B, BPF_REG_9, BPF_REG_1, 0),
1909         BPF_MOV64_IMM(BPF_REG_0, 0),
1910         BPF_EXIT_INSN(),
1911         },
1912         .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
1913         .errstr_unpriv = "function calls to other bpf functions are allowed for root only",
1914         .result_unpriv = REJECT,
1915         .result = ACCEPT,
1916 },
1917 {
1918         "calls: cross frame pruning",
1919         .insns = {
1920         /* r8 = !!random();
1921          * call pruner()
1922          * if (r8)
1923          *     do something bad;
1924          */
1925         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),
1926         BPF_MOV64_IMM(BPF_REG_8, 0),
1927         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
1928         BPF_MOV64_IMM(BPF_REG_8, 1),
1929         BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
1930         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
1931         BPF_JMP_IMM(BPF_JEQ, BPF_REG_8, 1, 1),
1932         BPF_LDX_MEM(BPF_B, BPF_REG_9, BPF_REG_1, 0),
1933         BPF_MOV64_IMM(BPF_REG_0, 0),
1934         BPF_EXIT_INSN(),
1935         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
1936         BPF_EXIT_INSN(),
1937         },
1938         .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
1939         .errstr_unpriv = "function calls to other bpf functions are allowed for root only",
1940         .errstr = "!read_ok",
1941         .result = REJECT,
1942 },