root/tools/testing/selftests/bpf/verifier/calls.c

   1 {
   2         "calls: basic sanity",
   3         .insns = {
   4         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
   5         BPF_MOV64_IMM(BPF_REG_0, 1),
   6         BPF_EXIT_INSN(),
   7         BPF_MOV64_IMM(BPF_REG_0, 2),
   8         BPF_EXIT_INSN(),
   9         },
  10         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
  11         .result = ACCEPT,
  12 },
  13 {
  14         "calls: not on unpriviledged",
  15         .insns = {
  16         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
  17         BPF_MOV64_IMM(BPF_REG_0, 1),
  18         BPF_EXIT_INSN(),
  19         BPF_MOV64_IMM(BPF_REG_0, 2),
  20         BPF_EXIT_INSN(),
  21         },
  22         .errstr_unpriv = "function calls to other bpf functions are allowed for root only",
  23         .result_unpriv = REJECT,
  24         .result = ACCEPT,
  25         .retval = 1,
  26 },
  27 {
  28         "calls: div by 0 in subprog",
  29         .insns = {
  30         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
  31         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
  32         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
  33         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
  34                     offsetof(struct __sk_buff, data_end)),
  35         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
  36         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
  37         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
  38         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
  39         BPF_MOV64_IMM(BPF_REG_0, 1),
  40         BPF_EXIT_INSN(),
  41         BPF_MOV32_IMM(BPF_REG_2, 0),
  42         BPF_MOV32_IMM(BPF_REG_3, 1),
  43         BPF_ALU32_REG(BPF_DIV, BPF_REG_3, BPF_REG_2),
  44         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
  45                     offsetof(struct __sk_buff, data)),
  46         BPF_EXIT_INSN(),
  47         },
  48         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
  49         .result = ACCEPT,
  50         .retval = 1,
  51 },
  52 {
  53         "calls: multiple ret types in subprog 1",
  54         .insns = {
  55         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
  56         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
  57         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
  58         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
  59                     offsetof(struct __sk_buff, data_end)),
  60         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
  61         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
  62         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
  63         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
  64         BPF_MOV64_IMM(BPF_REG_0, 1),
  65         BPF_EXIT_INSN(),
  66         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
  67                     offsetof(struct __sk_buff, data)),
  68         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
  69         BPF_MOV32_IMM(BPF_REG_0, 42),
  70         BPF_EXIT_INSN(),
  71         },
  72         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
  73         .result = REJECT,
  74         .errstr = "R0 invalid mem access 'inv'",
  75 },
  76 {
  77         "calls: multiple ret types in subprog 2",
  78         .insns = {
  79         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
  80         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
  81         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
  82         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
  83                     offsetof(struct __sk_buff, data_end)),
  84         BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
  85         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 8),
  86         BPF_JMP_REG(BPF_JGT, BPF_REG_2, BPF_REG_1, 1),
  87         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
  88         BPF_MOV64_IMM(BPF_REG_0, 1),
  89         BPF_EXIT_INSN(),
  90         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
  91                     offsetof(struct __sk_buff, data)),
  92         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
  93         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 9),
  94         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
  95         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
  96         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
  97         BPF_LD_MAP_FD(BPF_REG_1, 0),
  98         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
  99         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
 100         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_6,
 101                     offsetof(struct __sk_buff, data)),
 102         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 64),
 103         BPF_EXIT_INSN(),
 104         },
 105         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 106         .fixup_map_hash_8b = { 16 },
 107         .result = REJECT,
 108         .errstr = "R0 min value is outside of the array range",
 109 },
 110 {
 111         "calls: overlapping caller/callee",
 112         .insns = {
 113         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 0),
 114         BPF_MOV64_IMM(BPF_REG_0, 1),
 115         BPF_EXIT_INSN(),
 116         },
 117         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 118         .errstr = "last insn is not an exit or jmp",
 119         .result = REJECT,
 120 },
 121 {
 122         "calls: wrong recursive calls",
 123         .insns = {
 124         BPF_JMP_IMM(BPF_JA, 0, 0, 4),
 125         BPF_JMP_IMM(BPF_JA, 0, 0, 4),
 126         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
 127         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
 128         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -2),
 129         BPF_MOV64_IMM(BPF_REG_0, 1),
 130         BPF_EXIT_INSN(),
 131         },
 132         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 133         .errstr = "jump out of range",
 134         .result = REJECT,
 135 },
 136 {
 137         "calls: wrong src reg",
 138         .insns = {
 139         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 2, 0, 0),
 140         BPF_MOV64_IMM(BPF_REG_0, 1),
 141         BPF_EXIT_INSN(),
 142         },
 143         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 144         .errstr = "BPF_CALL uses reserved fields",
 145         .result = REJECT,
 146 },
 147 {
 148         "calls: wrong off value",
 149         .insns = {
 150         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, -1, 2),
 151         BPF_MOV64_IMM(BPF_REG_0, 1),
 152         BPF_EXIT_INSN(),
 153         BPF_MOV64_IMM(BPF_REG_0, 2),
 154         BPF_EXIT_INSN(),
 155         },
 156         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 157         .errstr = "BPF_CALL uses reserved fields",
 158         .result = REJECT,
 159 },
 160 {
 161         "calls: jump back loop",
 162         .insns = {
 163         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -1),
 164         BPF_MOV64_IMM(BPF_REG_0, 1),
 165         BPF_EXIT_INSN(),
 166         },
 167         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 168         .errstr = "back-edge from insn 0 to 0",
 169         .result = REJECT,
 170 },
 171 {
 172         "calls: conditional call",
 173         .insns = {
 174         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 175                     offsetof(struct __sk_buff, mark)),
 176         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
 177         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
 178         BPF_MOV64_IMM(BPF_REG_0, 1),
 179         BPF_EXIT_INSN(),
 180         BPF_MOV64_IMM(BPF_REG_0, 2),
 181         BPF_EXIT_INSN(),
 182         },
 183         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 184         .errstr = "jump out of range",
 185         .result = REJECT,
 186 },
 187 {
 188         "calls: conditional call 2",
 189         .insns = {
 190         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 191                     offsetof(struct __sk_buff, mark)),
 192         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
 193         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
 194         BPF_MOV64_IMM(BPF_REG_0, 1),
 195         BPF_EXIT_INSN(),
 196         BPF_MOV64_IMM(BPF_REG_0, 2),
 197         BPF_EXIT_INSN(),
 198         BPF_MOV64_IMM(BPF_REG_0, 3),
 199         BPF_EXIT_INSN(),
 200         },
 201         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 202         .result = ACCEPT,
 203 },
 204 {
 205         "calls: conditional call 3",
 206         .insns = {
 207         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 208                     offsetof(struct __sk_buff, mark)),
 209         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
 210         BPF_JMP_IMM(BPF_JA, 0, 0, 4),
 211         BPF_MOV64_IMM(BPF_REG_0, 1),
 212         BPF_EXIT_INSN(),
 213         BPF_MOV64_IMM(BPF_REG_0, 1),
 214         BPF_JMP_IMM(BPF_JA, 0, 0, -6),
 215         BPF_MOV64_IMM(BPF_REG_0, 3),
 216         BPF_JMP_IMM(BPF_JA, 0, 0, -6),
 217         },
 218         .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
 219         .errstr_unpriv = "back-edge from insn",
 220         .result_unpriv = REJECT,
 221         .result = ACCEPT,
 222         .retval = 1,
 223 },
 224 {
 225         "calls: conditional call 4",
 226         .insns = {
 227         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 228                     offsetof(struct __sk_buff, mark)),
 229         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
 230         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
 231         BPF_MOV64_IMM(BPF_REG_0, 1),
 232         BPF_EXIT_INSN(),
 233         BPF_MOV64_IMM(BPF_REG_0, 1),
 234         BPF_JMP_IMM(BPF_JA, 0, 0, -5),
 235         BPF_MOV64_IMM(BPF_REG_0, 3),
 236         BPF_EXIT_INSN(),
 237         },
 238         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 239         .result = ACCEPT,
 240 },
 241 {
 242         "calls: conditional call 5",
 243         .insns = {
 244         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 245                     offsetof(struct __sk_buff, mark)),
 246         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
 247         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
 248         BPF_MOV64_IMM(BPF_REG_0, 1),
 249         BPF_EXIT_INSN(),
 250         BPF_MOV64_IMM(BPF_REG_0, 1),
 251         BPF_JMP_IMM(BPF_JA, 0, 0, -6),
 252         BPF_MOV64_IMM(BPF_REG_0, 3),
 253         BPF_EXIT_INSN(),
 254         },
 255         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 256         .result = ACCEPT,
 257         .retval = 1,
 258 },
 259 {
 260         "calls: conditional call 6",
 261         .insns = {
 262         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 263         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 264         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
 265         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, -3),
 266         BPF_EXIT_INSN(),
 267         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 268                     offsetof(struct __sk_buff, mark)),
 269         BPF_EXIT_INSN(),
 270         },
 271         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 272         .errstr = "infinite loop detected",
 273         .result = REJECT,
 274 },
 275 {
 276         "calls: using r0 returned by callee",
 277         .insns = {
 278         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 279         BPF_EXIT_INSN(),
 280         BPF_MOV64_IMM(BPF_REG_0, 2),
 281         BPF_EXIT_INSN(),
 282         },
 283         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 284         .result = ACCEPT,
 285 },
 286 {
 287         "calls: using uninit r0 from callee",
 288         .insns = {
 289         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 290         BPF_EXIT_INSN(),
 291         BPF_EXIT_INSN(),
 292         },
 293         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 294         .errstr = "!read_ok",
 295         .result = REJECT,
 296 },
 297 {
 298         "calls: callee is using r1",
 299         .insns = {
 300         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 301         BPF_EXIT_INSN(),
 302         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 303                     offsetof(struct __sk_buff, len)),
 304         BPF_EXIT_INSN(),
 305         },
 306         .prog_type = BPF_PROG_TYPE_SCHED_ACT,
 307         .result = ACCEPT,
 308         .retval = TEST_DATA_LEN,
 309 },
 310 {
 311         "calls: callee using args1",
 312         .insns = {
 313         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 314         BPF_EXIT_INSN(),
 315         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
 316         BPF_EXIT_INSN(),
 317         },
 318         .errstr_unpriv = "allowed for root only",
 319         .result_unpriv = REJECT,
 320         .result = ACCEPT,
 321         .retval = POINTER_VALUE,
 322 },
 323 {
 324         "calls: callee using wrong args2",
 325         .insns = {
 326         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 327         BPF_EXIT_INSN(),
 328         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
 329         BPF_EXIT_INSN(),
 330         },
 331         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 332         .errstr = "R2 !read_ok",
 333         .result = REJECT,
 334 },
 335 {
 336         "calls: callee using two args",
 337         .insns = {
 338         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 339         BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_6,
 340                     offsetof(struct __sk_buff, len)),
 341         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_6,
 342                     offsetof(struct __sk_buff, len)),
 343         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 344         BPF_EXIT_INSN(),
 345         BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
 346         BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
 347         BPF_EXIT_INSN(),
 348         },
 349         .errstr_unpriv = "allowed for root only",
 350         .result_unpriv = REJECT,
 351         .result = ACCEPT,
 352         .retval = TEST_DATA_LEN + TEST_DATA_LEN - ETH_HLEN - ETH_HLEN,
 353 },
 354 {
 355         "calls: callee changing pkt pointers",
 356         .insns = {
 357         BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1, offsetof(struct xdp_md, data)),
 358         BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
 359                     offsetof(struct xdp_md, data_end)),
 360         BPF_MOV64_REG(BPF_REG_8, BPF_REG_6),
 361         BPF_ALU64_IMM(BPF_ADD, BPF_REG_8, 8),
 362         BPF_JMP_REG(BPF_JGT, BPF_REG_8, BPF_REG_7, 2),
 363         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
 364         /* clear_all_pkt_pointers() has to walk all frames
 365          * to make sure that pkt pointers in the caller
 366          * are cleared when callee is calling a helper that
 367          * adjusts packet size
 368          */
 369         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
 370         BPF_MOV32_IMM(BPF_REG_0, 0),
 371         BPF_EXIT_INSN(),
 372         BPF_MOV64_IMM(BPF_REG_2, 0),
 373         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_xdp_adjust_head),
 374         BPF_EXIT_INSN(),
 375         },
 376         .result = REJECT,
 377         .errstr = "R6 invalid mem access 'inv'",
 378         .prog_type = BPF_PROG_TYPE_XDP,
 379         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
 380 },
 381 {
 382         "calls: ptr null check in subprog",
 383         .insns = {
 384         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 385         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 386         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
 387         BPF_LD_MAP_FD(BPF_REG_1, 0),
 388         BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),
 389         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
 390         BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
 391         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
 392         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
 393         BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6, 0),
 394         BPF_EXIT_INSN(),
 395         BPF_MOV64_IMM(BPF_REG_0, 0),
 396         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 397         BPF_MOV64_IMM(BPF_REG_0, 1),
 398         BPF_EXIT_INSN(),
 399         },
 400         .errstr_unpriv = "function calls to other bpf functions are allowed for root only",
 401         .fixup_map_hash_48b = { 3 },
 402         .result_unpriv = REJECT,
 403         .result = ACCEPT,
 404         .retval = 0,
 405 },
 406 {
 407         "calls: two calls with args",
 408         .insns = {
 409         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 410         BPF_EXIT_INSN(),
 411         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 412         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
 413         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
 414         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 415         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
 416         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
 417         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
 418         BPF_EXIT_INSN(),
 419         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 420                     offsetof(struct __sk_buff, len)),
 421         BPF_EXIT_INSN(),
 422         },
 423         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 424         .result = ACCEPT,
 425         .retval = TEST_DATA_LEN + TEST_DATA_LEN,
 426 },
 427 {
 428         "calls: calls with stack arith",
 429         .insns = {
 430         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 431         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
 432         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 433         BPF_EXIT_INSN(),
 434         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
 435         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 436         BPF_EXIT_INSN(),
 437         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -64),
 438         BPF_MOV64_IMM(BPF_REG_0, 42),
 439         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
 440         BPF_EXIT_INSN(),
 441         },
 442         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 443         .result = ACCEPT,
 444         .retval = 42,
 445 },
 446 {
 447         "calls: calls with misaligned stack access",
 448         .insns = {
 449         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 450         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -63),
 451         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 452         BPF_EXIT_INSN(),
 453         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -61),
 454         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 455         BPF_EXIT_INSN(),
 456         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -63),
 457         BPF_MOV64_IMM(BPF_REG_0, 42),
 458         BPF_STX_MEM(BPF_DW, BPF_REG_2, BPF_REG_0, 0),
 459         BPF_EXIT_INSN(),
 460         },
 461         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 462         .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
 463         .errstr = "misaligned stack access",
 464         .result = REJECT,
 465 },
 466 {
 467         "calls: calls control flow, jump test",
 468         .insns = {
 469         BPF_MOV64_IMM(BPF_REG_0, 42),
 470         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
 471         BPF_MOV64_IMM(BPF_REG_0, 43),
 472         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
 473         BPF_JMP_IMM(BPF_JA, 0, 0, -3),
 474         BPF_EXIT_INSN(),
 475         },
 476         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 477         .result = ACCEPT,
 478         .retval = 43,
 479 },
 480 {
 481         "calls: calls control flow, jump test 2",
 482         .insns = {
 483         BPF_MOV64_IMM(BPF_REG_0, 42),
 484         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
 485         BPF_MOV64_IMM(BPF_REG_0, 43),
 486         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
 487         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -3),
 488         BPF_EXIT_INSN(),
 489         },
 490         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 491         .errstr = "jump out of range from insn 1 to 4",
 492         .result = REJECT,
 493 },
 494 {
 495         "calls: two calls with bad jump",
 496         .insns = {
 497         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 498         BPF_EXIT_INSN(),
 499         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 500         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
 501         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
 502         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 503         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
 504         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
 505         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
 506         BPF_EXIT_INSN(),
 507         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 508                     offsetof(struct __sk_buff, len)),
 509         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, -3),
 510         BPF_EXIT_INSN(),
 511         },
 512         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 513         .errstr = "jump out of range from insn 11 to 9",
 514         .result = REJECT,
 515 },
 516 {
 517         "calls: recursive call. test1",
 518         .insns = {
 519         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 520         BPF_EXIT_INSN(),
 521         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -1),
 522         BPF_EXIT_INSN(),
 523         },
 524         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 525         .errstr = "back-edge",
 526         .result = REJECT,
 527 },
 528 {
 529         "calls: recursive call. test2",
 530         .insns = {
 531         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 532         BPF_EXIT_INSN(),
 533         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -3),
 534         BPF_EXIT_INSN(),
 535         },
 536         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 537         .errstr = "back-edge",
 538         .result = REJECT,
 539 },
 540 {
 541         "calls: unreachable code",
 542         .insns = {
 543         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 544         BPF_EXIT_INSN(),
 545         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 546         BPF_EXIT_INSN(),
 547         BPF_MOV64_IMM(BPF_REG_0, 0),
 548         BPF_EXIT_INSN(),
 549         BPF_MOV64_IMM(BPF_REG_0, 0),
 550         BPF_EXIT_INSN(),
 551         },
 552         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 553         .errstr = "unreachable insn 6",
 554         .result = REJECT,
 555 },
 556 {
 557         "calls: invalid call",
 558         .insns = {
 559         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 560         BPF_EXIT_INSN(),
 561         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, -4),
 562         BPF_EXIT_INSN(),
 563         },
 564         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 565         .errstr = "invalid destination",
 566         .result = REJECT,
 567 },
 568 {
 569         "calls: invalid call 2",
 570         .insns = {
 571         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 572         BPF_EXIT_INSN(),
 573         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 0x7fffffff),
 574         BPF_EXIT_INSN(),
 575         },
 576         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 577         .errstr = "invalid destination",
 578         .result = REJECT,
 579 },
 580 {
 581         "calls: jumping across function bodies. test1",
 582         .insns = {
 583         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
 584         BPF_MOV64_IMM(BPF_REG_0, 0),
 585         BPF_EXIT_INSN(),
 586         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -3),
 587         BPF_EXIT_INSN(),
 588         },
 589         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 590         .errstr = "jump out of range",
 591         .result = REJECT,
 592 },
 593 {
 594         "calls: jumping across function bodies. test2",
 595         .insns = {
 596         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 3),
 597         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
 598         BPF_MOV64_IMM(BPF_REG_0, 0),
 599         BPF_EXIT_INSN(),
 600         BPF_EXIT_INSN(),
 601         },
 602         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 603         .errstr = "jump out of range",
 604         .result = REJECT,
 605 },
 606 {
 607         "calls: call without exit",
 608         .insns = {
 609         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 610         BPF_EXIT_INSN(),
 611         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 612         BPF_EXIT_INSN(),
 613         BPF_MOV64_IMM(BPF_REG_0, 0),
 614         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -2),
 615         },
 616         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 617         .errstr = "not an exit",
 618         .result = REJECT,
 619 },
 620 {
 621         "calls: call into middle of ld_imm64",
 622         .insns = {
 623         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
 624         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
 625         BPF_MOV64_IMM(BPF_REG_0, 0),
 626         BPF_EXIT_INSN(),
 627         BPF_LD_IMM64(BPF_REG_0, 0),
 628         BPF_EXIT_INSN(),
 629         },
 630         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 631         .errstr = "last insn",
 632         .result = REJECT,
 633 },
 634 {
 635         "calls: call into middle of other call",
 636         .insns = {
 637         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
 638         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
 639         BPF_MOV64_IMM(BPF_REG_0, 0),
 640         BPF_EXIT_INSN(),
 641         BPF_MOV64_IMM(BPF_REG_0, 0),
 642         BPF_MOV64_IMM(BPF_REG_0, 0),
 643         BPF_EXIT_INSN(),
 644         },
 645         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 646         .errstr = "last insn",
 647         .result = REJECT,
 648 },
 649 {
 650         "calls: ld_abs with changing ctx data in callee",
 651         .insns = {
 652         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 653         BPF_LD_ABS(BPF_B, 0),
 654         BPF_LD_ABS(BPF_H, 0),
 655         BPF_LD_ABS(BPF_W, 0),
 656         BPF_MOV64_REG(BPF_REG_7, BPF_REG_6),
 657         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
 658         BPF_MOV64_REG(BPF_REG_6, BPF_REG_7),
 659         BPF_LD_ABS(BPF_B, 0),
 660         BPF_LD_ABS(BPF_H, 0),
 661         BPF_LD_ABS(BPF_W, 0),
 662         BPF_EXIT_INSN(),
 663         BPF_MOV64_IMM(BPF_REG_2, 1),
 664         BPF_MOV64_IMM(BPF_REG_3, 2),
 665         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_vlan_push),
 666         BPF_EXIT_INSN(),
 667         },
 668         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
 669         .errstr = "BPF_LD_[ABS|IND] instructions cannot be mixed",
 670         .result = REJECT,
 671 },
 672 {
 673         "calls: two calls with bad fallthrough",
 674         .insns = {
 675         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 676         BPF_EXIT_INSN(),
 677         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 678         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
 679         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
 680         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 681         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
 682         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
 683         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
 684         BPF_MOV64_REG(BPF_REG_0, BPF_REG_0),
 685         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
 686                     offsetof(struct __sk_buff, len)),
 687         BPF_EXIT_INSN(),
 688         },
 689         .prog_type = BPF_PROG_TYPE_TRACEPOINT,
 690         .errstr = "not an exit",
 691         .result = REJECT,
 692 },
 693 {
 694         "calls: two calls with stack read",
 695         .insns = {
 696         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 697         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
 698         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
 699         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 700         BPF_EXIT_INSN(),
 701         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 702         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 6),
 703         BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
 704         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 705         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
 706         BPF_ALU64_REG(BPF_ADD, BPF_REG_7, BPF_REG_0),
 707         BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
 708         BPF_EXIT_INSN(),
 709         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
 710         BPF_EXIT_INSN(),
 711         },
 712         .prog_type = BPF_PROG_TYPE_XDP,
 713         .result = ACCEPT,
 714 },
 715 {
 716         "calls: two calls with stack write",
 717         .insns = {
 718         /* main prog */
 719         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 720         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
 721         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
 722         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
 723         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
 724         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
 725         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
 726         BPF_EXIT_INSN(),
 727 
 728         /* subprog 1 */
 729         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 730         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
 731         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 7),
 732         BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
 733         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 734         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
 735         BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_0),
 736         BPF_MOV64_REG(BPF_REG_0, BPF_REG_8),
 737         /* write into stack frame of main prog */
 738         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
 739         BPF_EXIT_INSN(),
 740 
 741         /* subprog 2 */
 742         /* read from stack frame of main prog */
 743         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
 744         BPF_EXIT_INSN(),
 745         },
 746         .prog_type = BPF_PROG_TYPE_XDP,
 747         .result = ACCEPT,
 748 },
 749 {
 750         "calls: stack overflow using two frames (pre-call access)",
 751         .insns = {
 752         /* prog 1 */
 753         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
 754         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1),
 755         BPF_EXIT_INSN(),
 756 
 757         /* prog 2 */
 758         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
 759         BPF_MOV64_IMM(BPF_REG_0, 0),
 760         BPF_EXIT_INSN(),
 761         },
 762         .prog_type = BPF_PROG_TYPE_XDP,
 763         .errstr = "combined stack size",
 764         .result = REJECT,
 765 },
 766 {
 767         "calls: stack overflow using two frames (post-call access)",
 768         .insns = {
 769         /* prog 1 */
 770         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 2),
 771         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
 772         BPF_EXIT_INSN(),
 773 
 774         /* prog 2 */
 775         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
 776         BPF_MOV64_IMM(BPF_REG_0, 0),
 777         BPF_EXIT_INSN(),
 778         },
 779         .prog_type = BPF_PROG_TYPE_XDP,
 780         .errstr = "combined stack size",
 781         .result = REJECT,
 782 },
 783 {
 784         "calls: stack depth check using three frames. test1",
 785         .insns = {
 786         /* main */
 787         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
 788         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 5), /* call B */
 789         BPF_ST_MEM(BPF_B, BPF_REG_10, -32, 0),
 790         BPF_MOV64_IMM(BPF_REG_0, 0),
 791         BPF_EXIT_INSN(),
 792         /* A */
 793         BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
 794         BPF_EXIT_INSN(),
 795         /* B */
 796         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -3), /* call A */
 797         BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
 798         BPF_EXIT_INSN(),
 799         },
 800         .prog_type = BPF_PROG_TYPE_XDP,
 801         /* stack_main=32, stack_A=256, stack_B=64
 802          * and max(main+A, main+A+B) < 512
 803          */
 804         .result = ACCEPT,
 805 },
 806 {
 807         "calls: stack depth check using three frames. test2",
 808         .insns = {
 809         /* main */
 810         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
 811         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 5), /* call B */
 812         BPF_ST_MEM(BPF_B, BPF_REG_10, -32, 0),
 813         BPF_MOV64_IMM(BPF_REG_0, 0),
 814         BPF_EXIT_INSN(),
 815         /* A */
 816         BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
 817         BPF_EXIT_INSN(),
 818         /* B */
 819         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -3), /* call A */
 820         BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
 821         BPF_EXIT_INSN(),
 822         },
 823         .prog_type = BPF_PROG_TYPE_XDP,
 824         /* stack_main=32, stack_A=64, stack_B=256
 825          * and max(main+A, main+A+B) < 512
 826          */
 827         .result = ACCEPT,
 828 },
 829 {
 830         "calls: stack depth check using three frames. test3",
 831         .insns = {
 832         /* main */
 833         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 834         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 6), /* call A */
 835         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
 836         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 8), /* call B */
 837         BPF_JMP_IMM(BPF_JGE, BPF_REG_6, 0, 1),
 838         BPF_ST_MEM(BPF_B, BPF_REG_10, -64, 0),
 839         BPF_MOV64_IMM(BPF_REG_0, 0),
 840         BPF_EXIT_INSN(),
 841         /* A */
 842         BPF_JMP_IMM(BPF_JLT, BPF_REG_1, 10, 1),
 843         BPF_EXIT_INSN(),
 844         BPF_ST_MEM(BPF_B, BPF_REG_10, -224, 0),
 845         BPF_JMP_IMM(BPF_JA, 0, 0, -3),
 846         /* B */
 847         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 2, 1),
 848         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, -6), /* call A */
 849         BPF_ST_MEM(BPF_B, BPF_REG_10, -256, 0),
 850         BPF_EXIT_INSN(),
 851         },
 852         .prog_type = BPF_PROG_TYPE_XDP,
 853         /* stack_main=64, stack_A=224, stack_B=256
 854          * and max(main+A, main+A+B) > 512
 855          */
 856         .errstr = "combined stack",
 857         .result = REJECT,
 858 },
 859 {
 860         "calls: stack depth check using three frames. test4",
 861         /* void main(void) {
 862          *   func1(0);
 863          *   func1(1);
 864          *   func2(1);
 865          * }
 866          * void func1(int alloc_or_recurse) {
 867          *   if (alloc_or_recurse) {
 868          *     frame_pointer[-300] = 1;
 869          *   } else {
 870          *     func2(alloc_or_recurse);
 871          *   }
 872          * }
 873          * void func2(int alloc_or_recurse) {
 874          *   if (alloc_or_recurse) {
 875          *     frame_pointer[-300] = 1;
 876          *   }
 877          * }
 878          */
 879         .insns = {
 880         /* main */
 881         BPF_MOV64_IMM(BPF_REG_1, 0),
 882         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 6), /* call A */
 883         BPF_MOV64_IMM(BPF_REG_1, 1),
 884         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 4), /* call A */
 885         BPF_MOV64_IMM(BPF_REG_1, 1),
 886         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 7), /* call B */
 887         BPF_MOV64_IMM(BPF_REG_0, 0),
 888         BPF_EXIT_INSN(),
 889         /* A */
 890         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 2),
 891         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
 892         BPF_EXIT_INSN(),
 893         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call B */
 894         BPF_EXIT_INSN(),
 895         /* B */
 896         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 897         BPF_ST_MEM(BPF_B, BPF_REG_10, -300, 0),
 898         BPF_EXIT_INSN(),
 899         },
 900         .prog_type = BPF_PROG_TYPE_XDP,
 901         .result = REJECT,
 902         .errstr = "combined stack",
 903 },
 904 {
 905         "calls: stack depth check using three frames. test5",
 906         .insns = {
 907         /* main */
 908         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call A */
 909         BPF_EXIT_INSN(),
 910         /* A */
 911         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call B */
 912         BPF_EXIT_INSN(),
 913         /* B */
 914         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call C */
 915         BPF_EXIT_INSN(),
 916         /* C */
 917         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call D */
 918         BPF_EXIT_INSN(),
 919         /* D */
 920         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call E */
 921         BPF_EXIT_INSN(),
 922         /* E */
 923         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call F */
 924         BPF_EXIT_INSN(),
 925         /* F */
 926         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call G */
 927         BPF_EXIT_INSN(),
 928         /* G */
 929         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call H */
 930         BPF_EXIT_INSN(),
 931         /* H */
 932         BPF_MOV64_IMM(BPF_REG_0, 0),
 933         BPF_EXIT_INSN(),
 934         },
 935         .prog_type = BPF_PROG_TYPE_XDP,
 936         .errstr = "call stack",
 937         .result = REJECT,
 938 },
 939 {
 940         "calls: stack depth check in dead code",
 941         .insns = {
 942         /* main */
 943         BPF_MOV64_IMM(BPF_REG_1, 0),
 944         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call A */
 945         BPF_EXIT_INSN(),
 946         /* A */
 947         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 948         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 2), /* call B */
 949         BPF_MOV64_IMM(BPF_REG_0, 0),
 950         BPF_EXIT_INSN(),
 951         /* B */
 952         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call C */
 953         BPF_EXIT_INSN(),
 954         /* C */
 955         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call D */
 956         BPF_EXIT_INSN(),
 957         /* D */
 958         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call E */
 959         BPF_EXIT_INSN(),
 960         /* E */
 961         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call F */
 962         BPF_EXIT_INSN(),
 963         /* F */
 964         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call G */
 965         BPF_EXIT_INSN(),
 966         /* G */
 967         BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call H */
 968         BPF_EXIT_INSN(),
 969         /* H */
 970         BPF_MOV64_IMM(BPF_REG_0, 0),
 971         BPF_EXIT_INSN(),
 972         },
 973         .prog_type = BPF_PROG_TYPE_XDP,
 974         .errstr = "call stack",
 975         .result = REJECT,
 976 },
 977 {
 978         "calls: spill into caller stack frame",
 979         .insns = {
 980         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
 981         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
 982         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
 983         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
 984         BPF_EXIT_INSN(),
 985         BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
 986         BPF_MOV64_IMM(BPF_REG_0, 0),
 987         BPF_EXIT_INSN(),
 988         },
 989         .prog_type = BPF_PROG_TYPE_XDP,
 990         .errstr = "cannot spill",
 991         .result = REJECT,
 992 },
 993 {
 994         "calls: write into caller stack frame",
 995         .insns = {
 996         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
 997         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
 998         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
 999         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
1000         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
1001         BPF_EXIT_INSN(),
1002         BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 42),
1003         BPF_MOV64_IMM(BPF_REG_0, 0),
1004         BPF_EXIT_INSN(),
1005         },
1006         .prog_type = BPF_PROG_TYPE_XDP,
1007         .result = ACCEPT,
1008         .retval = 42,
1009 },
1010 {
1011         "calls: write into callee stack frame",
1012         .insns = {
1013         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
1014         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 42),
1015         BPF_EXIT_INSN(),
1016         BPF_MOV64_REG(BPF_REG_0, BPF_REG_10),
1017         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, -8),
1018         BPF_EXIT_INSN(),
1019         },
1020         .prog_type = BPF_PROG_TYPE_XDP,
1021         .errstr = "cannot return stack pointer",
1022         .result = REJECT,
1023 },
1024 {
1025         "calls: two calls with stack write and void return",
1026         .insns = {
1027         /* main prog */
1028         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1029         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1030         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1031         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1032         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1033         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
1034         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
1035         BPF_EXIT_INSN(),
1036 
1037         /* subprog 1 */
1038         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
1039         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
1040         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
1041         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
1042         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
1043         BPF_EXIT_INSN(),
1044 
1045         /* subprog 2 */
1046         /* write into stack frame of main prog */
1047         BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 0),
1048         BPF_EXIT_INSN(), /* void return */
1049         },
1050         .prog_type = BPF_PROG_TYPE_XDP,
1051         .result = ACCEPT,
1052 },
1053 {
1054         "calls: ambiguous return value",
1055         .insns = {
1056         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
1057         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
1058         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
1059         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
1060         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
1061         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
1062         BPF_EXIT_INSN(),
1063         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
1064         BPF_MOV64_IMM(BPF_REG_0, 0),
1065         BPF_EXIT_INSN(),
1066         },
1067         .errstr_unpriv = "allowed for root only",
1068         .result_unpriv = REJECT,
1069         .errstr = "R0 !read_ok",
1070         .result = REJECT,
1071 },
1072 {
1073         "calls: two calls that return map_value",
1074         .insns = {
1075         /* main prog */
1076         /* pass fp-16, fp-8 into a function */
1077         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1078         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1079         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1080         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1081         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 8),
1082 
1083         /* fetch map_value_ptr from the stack of this function */
1084         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
1085         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
1086         /* write into map value */
1087         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1088         /* fetch secound map_value_ptr from the stack */
1089         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -16),
1090         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
1091         /* write into map value */
1092         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1093         BPF_MOV64_IMM(BPF_REG_0, 0),
1094         BPF_EXIT_INSN(),
1095 
1096         /* subprog 1 */
1097         /* call 3rd function twice */
1098         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
1099         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
1100         /* first time with fp-8 */
1101         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
1102         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
1103         /* second time with fp-16 */
1104         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
1105         BPF_EXIT_INSN(),
1106 
1107         /* subprog 2 */
1108         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
1109         /* lookup from map */
1110         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1111         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1112         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1113         BPF_LD_MAP_FD(BPF_REG_1, 0),
1114         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
1115         /* write map_value_ptr into stack frame of main prog */
1116         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
1117         BPF_MOV64_IMM(BPF_REG_0, 0),
1118         BPF_EXIT_INSN(), /* return 0 */
1119         },
1120         .prog_type = BPF_PROG_TYPE_XDP,
1121         .fixup_map_hash_8b = { 23 },
1122         .result = ACCEPT,
1123 },
1124 {
1125         "calls: two calls that return map_value with bool condition",
1126         .insns = {
1127         /* main prog */
1128         /* pass fp-16, fp-8 into a function */
1129         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1130         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1131         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1132         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1133         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
1134         BPF_MOV64_IMM(BPF_REG_0, 0),
1135         BPF_EXIT_INSN(),
1136 
1137         /* subprog 1 */
1138         /* call 3rd function twice */
1139         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
1140         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
1141         /* first time with fp-8 */
1142         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 9),
1143         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
1144         /* fetch map_value_ptr from the stack of this function */
1145         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
1146         /* write into map value */
1147         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1148         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
1149         /* second time with fp-16 */
1150         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
1151         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
1152         /* fetch secound map_value_ptr from the stack */
1153         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
1154         /* write into map value */
1155         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1156         BPF_EXIT_INSN(),
1157 
1158         /* subprog 2 */
1159         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
1160         /* lookup from map */
1161         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1162         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1163         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1164         BPF_LD_MAP_FD(BPF_REG_1, 0),
1165         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
1166         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
1167         BPF_MOV64_IMM(BPF_REG_0, 0),
1168         BPF_EXIT_INSN(), /* return 0 */
1169         /* write map_value_ptr into stack frame of main prog */
1170         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
1171         BPF_MOV64_IMM(BPF_REG_0, 1),
1172         BPF_EXIT_INSN(), /* return 1 */
1173         },
1174         .prog_type = BPF_PROG_TYPE_XDP,
1175         .fixup_map_hash_8b = { 23 },
1176         .result = ACCEPT,
1177 },
1178 {
1179         "calls: two calls that return map_value with incorrect bool check",
1180         .insns = {
1181         /* main prog */
1182         /* pass fp-16, fp-8 into a function */
1183         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1184         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1185         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1186         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1187         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
1188         BPF_MOV64_IMM(BPF_REG_0, 0),
1189         BPF_EXIT_INSN(),
1190 
1191         /* subprog 1 */
1192         /* call 3rd function twice */
1193         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
1194         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
1195         /* first time with fp-8 */
1196         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 9),
1197         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 1, 2),
1198         /* fetch map_value_ptr from the stack of this function */
1199         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
1200         /* write into map value */
1201         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1202         BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
1203         /* second time with fp-16 */
1204         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
1205         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
1206         /* fetch secound map_value_ptr from the stack */
1207         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0),
1208         /* write into map value */
1209         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1210         BPF_EXIT_INSN(),
1211 
1212         /* subprog 2 */
1213         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
1214         /* lookup from map */
1215         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1216         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1217         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1218         BPF_LD_MAP_FD(BPF_REG_1, 0),
1219         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
1220         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
1221         BPF_MOV64_IMM(BPF_REG_0, 0),
1222         BPF_EXIT_INSN(), /* return 0 */
1223         /* write map_value_ptr into stack frame of main prog */
1224         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
1225         BPF_MOV64_IMM(BPF_REG_0, 1),
1226         BPF_EXIT_INSN(), /* return 1 */
1227         },
1228         .prog_type = BPF_PROG_TYPE_XDP,
1229         .fixup_map_hash_8b = { 23 },
1230         .result = REJECT,
1231         .errstr = "invalid read from stack off -16+0 size 8",
1232 },
1233 {
1234         "calls: two calls that receive map_value via arg=ptr_stack_of_caller. test1",
1235         .insns = {
1236         /* main prog */
1237         /* pass fp-16, fp-8 into a function */
1238         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1239         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1240         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1241         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1242         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
1243         BPF_MOV64_IMM(BPF_REG_0, 0),
1244         BPF_EXIT_INSN(),
1245 
1246         /* subprog 1 */
1247         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
1248         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
1249         /* 1st lookup from map */
1250         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1251         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1252         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1253         BPF_LD_MAP_FD(BPF_REG_1, 0),
1254         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
1255         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
1256         BPF_MOV64_IMM(BPF_REG_8, 0),
1257         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1258         /* write map_value_ptr into stack frame of main prog at fp-8 */
1259         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
1260         BPF_MOV64_IMM(BPF_REG_8, 1),
1261 
1262         /* 2nd lookup from map */
1263         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), /* 20 */
1264         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1265         BPF_LD_MAP_FD(BPF_REG_1, 0),
1266         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, /* 24 */
1267                      BPF_FUNC_map_lookup_elem),
1268         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
1269         BPF_MOV64_IMM(BPF_REG_9, 0),
1270         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1271         /* write map_value_ptr into stack frame of main prog at fp-16 */
1272         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
1273         BPF_MOV64_IMM(BPF_REG_9, 1),
1274 
1275         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
1276         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), /* 30 */
1277         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
1278         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
1279         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
1280         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),  /* 34 */
1281         BPF_EXIT_INSN(),
1282 
1283         /* subprog 2 */
1284         /* if arg2 == 1 do *arg1 = 0 */
1285         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
1286         /* fetch map_value_ptr from the stack of this function */
1287         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
1288         /* write into map value */
1289         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1290 
1291         /* if arg4 == 1 do *arg3 = 0 */
1292         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
1293         /* fetch map_value_ptr from the stack of this function */
1294         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
1295         /* write into map value */
1296         BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 0),
1297         BPF_EXIT_INSN(),
1298         },
1299         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1300         .fixup_map_hash_8b = { 12, 22 },
1301         .result = REJECT,
1302         .errstr = "invalid access to map value, value_size=8 off=2 size=8",
1303         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
1304 },
1305 {
1306         "calls: two calls that receive map_value via arg=ptr_stack_of_caller. test2",
1307         .insns = {
1308         /* main prog */
1309         /* pass fp-16, fp-8 into a function */
1310         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1311         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1312         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1313         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1314         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
1315         BPF_MOV64_IMM(BPF_REG_0, 0),
1316         BPF_EXIT_INSN(),
1317 
1318         /* subprog 1 */
1319         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
1320         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
1321         /* 1st lookup from map */
1322         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1323         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1324         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1325         BPF_LD_MAP_FD(BPF_REG_1, 0),
1326         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
1327         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
1328         BPF_MOV64_IMM(BPF_REG_8, 0),
1329         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1330         /* write map_value_ptr into stack frame of main prog at fp-8 */
1331         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
1332         BPF_MOV64_IMM(BPF_REG_8, 1),
1333 
1334         /* 2nd lookup from map */
1335         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), /* 20 */
1336         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1337         BPF_LD_MAP_FD(BPF_REG_1, 0),
1338         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, /* 24 */
1339                      BPF_FUNC_map_lookup_elem),
1340         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
1341         BPF_MOV64_IMM(BPF_REG_9, 0),
1342         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1343         /* write map_value_ptr into stack frame of main prog at fp-16 */
1344         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
1345         BPF_MOV64_IMM(BPF_REG_9, 1),
1346 
1347         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
1348         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), /* 30 */
1349         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
1350         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
1351         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
1352         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),  /* 34 */
1353         BPF_EXIT_INSN(),
1354 
1355         /* subprog 2 */
1356         /* if arg2 == 1 do *arg1 = 0 */
1357         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
1358         /* fetch map_value_ptr from the stack of this function */
1359         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
1360         /* write into map value */
1361         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1362 
1363         /* if arg4 == 1 do *arg3 = 0 */
1364         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
1365         /* fetch map_value_ptr from the stack of this function */
1366         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
1367         /* write into map value */
1368         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1369         BPF_EXIT_INSN(),
1370         },
1371         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1372         .fixup_map_hash_8b = { 12, 22 },
1373         .result = ACCEPT,
1374 },
1375 {
1376         "calls: two jumps that receive map_value via arg=ptr_stack_of_jumper. test3",
1377         .insns = {
1378         /* main prog */
1379         /* pass fp-16, fp-8 into a function */
1380         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1381         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1382         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1383         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1384         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 2),
1385         BPF_MOV64_IMM(BPF_REG_0, 0),
1386         BPF_EXIT_INSN(),
1387 
1388         /* subprog 1 */
1389         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
1390         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
1391         /* 1st lookup from map */
1392         BPF_ST_MEM(BPF_DW, BPF_REG_10, -24, 0),
1393         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1394         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -24),
1395         BPF_LD_MAP_FD(BPF_REG_1, 0),
1396         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
1397         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
1398         BPF_MOV64_IMM(BPF_REG_8, 0),
1399         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1400         /* write map_value_ptr into stack frame of main prog at fp-8 */
1401         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
1402         BPF_MOV64_IMM(BPF_REG_8, 1),
1403 
1404         /* 2nd lookup from map */
1405         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1406         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -24),
1407         BPF_LD_MAP_FD(BPF_REG_1, 0),
1408         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
1409         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
1410         BPF_MOV64_IMM(BPF_REG_9, 0),  // 26
1411         BPF_JMP_IMM(BPF_JA, 0, 0, 2),
1412         /* write map_value_ptr into stack frame of main prog at fp-16 */
1413         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
1414         BPF_MOV64_IMM(BPF_REG_9, 1),
1415 
1416         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
1417         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), // 30
1418         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
1419         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
1420         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
1421         BPF_JMP_IMM(BPF_JNE, BPF_REG_1, 0, 1), // 34
1422         BPF_JMP_IMM(BPF_JA, 0, 0, -30),
1423 
1424         /* subprog 2 */
1425         /* if arg2 == 1 do *arg1 = 0 */
1426         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
1427         /* fetch map_value_ptr from the stack of this function */
1428         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
1429         /* write into map value */
1430         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1431 
1432         /* if arg4 == 1 do *arg3 = 0 */
1433         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
1434         /* fetch map_value_ptr from the stack of this function */
1435         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
1436         /* write into map value */
1437         BPF_ST_MEM(BPF_DW, BPF_REG_0, 2, 0),
1438         BPF_JMP_IMM(BPF_JA, 0, 0, -8),
1439         },
1440         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1441         .fixup_map_hash_8b = { 12, 22 },
1442         .result = REJECT,
1443         .errstr = "invalid access to map value, value_size=8 off=2 size=8",
1444         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
1445 },
1446 {
1447         "calls: two calls that receive map_value_ptr_or_null via arg. test1",
1448         .insns = {
1449         /* main prog */
1450         /* pass fp-16, fp-8 into a function */
1451         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1452         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1453         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1454         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1455         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
1456         BPF_MOV64_IMM(BPF_REG_0, 0),
1457         BPF_EXIT_INSN(),
1458 
1459         /* subprog 1 */
1460         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
1461         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
1462         /* 1st lookup from map */
1463         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1464         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1465         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1466         BPF_LD_MAP_FD(BPF_REG_1, 0),
1467         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
1468         /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
1469         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
1470         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
1471         BPF_MOV64_IMM(BPF_REG_8, 0),
1472         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
1473         BPF_MOV64_IMM(BPF_REG_8, 1),
1474 
1475         /* 2nd lookup from map */
1476         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1477         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1478         BPF_LD_MAP_FD(BPF_REG_1, 0),
1479         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
1480         /* write map_value_ptr_or_null into stack frame of main prog at fp-16 */
1481         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
1482         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
1483         BPF_MOV64_IMM(BPF_REG_9, 0),
1484         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
1485         BPF_MOV64_IMM(BPF_REG_9, 1),
1486 
1487         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
1488         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
1489         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
1490         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
1491         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
1492         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
1493         BPF_EXIT_INSN(),
1494 
1495         /* subprog 2 */
1496         /* if arg2 == 1 do *arg1 = 0 */
1497         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
1498         /* fetch map_value_ptr from the stack of this function */
1499         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
1500         /* write into map value */
1501         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1502 
1503         /* if arg4 == 1 do *arg3 = 0 */
1504         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 1, 2),
1505         /* fetch map_value_ptr from the stack of this function */
1506         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
1507         /* write into map value */
1508         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1509         BPF_EXIT_INSN(),
1510         },
1511         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1512         .fixup_map_hash_8b = { 12, 22 },
1513         .result = ACCEPT,
1514 },
1515 {
1516         "calls: two calls that receive map_value_ptr_or_null via arg. test2",
1517         .insns = {
1518         /* main prog */
1519         /* pass fp-16, fp-8 into a function */
1520         BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
1521         BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
1522         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1523         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
1524         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
1525         BPF_MOV64_IMM(BPF_REG_0, 0),
1526         BPF_EXIT_INSN(),
1527 
1528         /* subprog 1 */
1529         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
1530         BPF_MOV64_REG(BPF_REG_7, BPF_REG_2),
1531         /* 1st lookup from map */
1532         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1533         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1534         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1535         BPF_LD_MAP_FD(BPF_REG_1, 0),
1536         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
1537         /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
1538         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
1539         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
1540         BPF_MOV64_IMM(BPF_REG_8, 0),
1541         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
1542         BPF_MOV64_IMM(BPF_REG_8, 1),
1543 
1544         /* 2nd lookup from map */
1545         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1546         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1547         BPF_LD_MAP_FD(BPF_REG_1, 0),
1548         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
1549         /* write map_value_ptr_or_null into stack frame of main prog at fp-16 */
1550         BPF_STX_MEM(BPF_DW, BPF_REG_7, BPF_REG_0, 0),
1551         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 2),
1552         BPF_MOV64_IMM(BPF_REG_9, 0),
1553         BPF_JMP_IMM(BPF_JA, 0, 0, 1),
1554         BPF_MOV64_IMM(BPF_REG_9, 1),
1555 
1556         /* call 3rd func with fp-8, 0|1, fp-16, 0|1 */
1557         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
1558         BPF_MOV64_REG(BPF_REG_2, BPF_REG_8),
1559         BPF_MOV64_REG(BPF_REG_3, BPF_REG_7),
1560         BPF_MOV64_REG(BPF_REG_4, BPF_REG_9),
1561         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
1562         BPF_EXIT_INSN(),
1563 
1564         /* subprog 2 */
1565         /* if arg2 == 1 do *arg1 = 0 */
1566         BPF_JMP_IMM(BPF_JNE, BPF_REG_2, 1, 2),
1567         /* fetch map_value_ptr from the stack of this function */
1568         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
1569         /* write into map value */
1570         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1571 
1572         /* if arg4 == 0 do *arg3 = 0 */
1573         BPF_JMP_IMM(BPF_JNE, BPF_REG_4, 0, 2),
1574         /* fetch map_value_ptr from the stack of this function */
1575         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
1576         /* write into map value */
1577         BPF_ST_MEM(BPF_DW, BPF_REG_0, 0, 0),
1578         BPF_EXIT_INSN(),
1579         },
1580         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1581         .fixup_map_hash_8b = { 12, 22 },
1582         .result = REJECT,
1583         .errstr = "R0 invalid mem access 'inv'",
1584 },
1585 {
1586         "calls: pkt_ptr spill into caller stack",
1587         .insns = {
1588         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
1589         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
1590         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 1),
1591         BPF_EXIT_INSN(),
1592 
1593         /* subprog 1 */
1594         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1595                     offsetof(struct __sk_buff, data)),
1596         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1597                     offsetof(struct __sk_buff, data_end)),
1598         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1599         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1600         /* spill unchecked pkt_ptr into stack of caller */
1601         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
1602         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
1603         /* now the pkt range is verified, read pkt_ptr from stack */
1604         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
1605         /* write 4 bytes into packet */
1606         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
1607         BPF_EXIT_INSN(),
1608         },
1609         .result = ACCEPT,
1610         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1611         .retval = POINTER_VALUE,
1612         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
1613 },
1614 {
1615         "calls: pkt_ptr spill into caller stack 2",
1616         .insns = {
1617         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
1618         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
1619         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
1620         /* Marking is still kept, but not in all cases safe. */
1621         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
1622         BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
1623         BPF_EXIT_INSN(),
1624 
1625         /* subprog 1 */
1626         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1627                     offsetof(struct __sk_buff, data)),
1628         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1629                     offsetof(struct __sk_buff, data_end)),
1630         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1631         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1632         /* spill unchecked pkt_ptr into stack of caller */
1633         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
1634         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
1635         /* now the pkt range is verified, read pkt_ptr from stack */
1636         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
1637         /* write 4 bytes into packet */
1638         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
1639         BPF_EXIT_INSN(),
1640         },
1641         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1642         .errstr = "invalid access to packet",
1643         .result = REJECT,
1644         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
1645 },
1646 {
1647         "calls: pkt_ptr spill into caller stack 3",
1648         .insns = {
1649         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
1650         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
1651         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
1652         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
1653         /* Marking is still kept and safe here. */
1654         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
1655         BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
1656         BPF_EXIT_INSN(),
1657 
1658         /* subprog 1 */
1659         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1660                     offsetof(struct __sk_buff, data)),
1661         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1662                     offsetof(struct __sk_buff, data_end)),
1663         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1664         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1665         /* spill unchecked pkt_ptr into stack of caller */
1666         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
1667         BPF_MOV64_IMM(BPF_REG_5, 0),
1668         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
1669         BPF_MOV64_IMM(BPF_REG_5, 1),
1670         /* now the pkt range is verified, read pkt_ptr from stack */
1671         BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_4, 0),
1672         /* write 4 bytes into packet */
1673         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
1674         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
1675         BPF_EXIT_INSN(),
1676         },
1677         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1678         .result = ACCEPT,
1679         .retval = 1,
1680         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
1681 },
1682 {
1683         "calls: pkt_ptr spill into caller stack 4",
1684         .insns = {
1685         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
1686         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
1687         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
1688         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 2),
1689         /* Check marking propagated. */
1690         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
1691         BPF_ST_MEM(BPF_W, BPF_REG_4, 0, 0),
1692         BPF_EXIT_INSN(),
1693 
1694         /* subprog 1 */
1695         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1696                     offsetof(struct __sk_buff, data)),
1697         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1698                     offsetof(struct __sk_buff, data_end)),
1699         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1700         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1701         /* spill unchecked pkt_ptr into stack of caller */
1702         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
1703         BPF_MOV64_IMM(BPF_REG_5, 0),
1704         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
1705         BPF_MOV64_IMM(BPF_REG_5, 1),
1706         /* don't read back pkt_ptr from stack here */
1707         /* write 4 bytes into packet */
1708         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
1709         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
1710         BPF_EXIT_INSN(),
1711         },
1712         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1713         .result = ACCEPT,
1714         .retval = 1,
1715         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
1716 },
1717 {
1718         "calls: pkt_ptr spill into caller stack 5",
1719         .insns = {
1720         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
1721         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
1722         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_1, 0),
1723         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
1724         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
1725         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
1726         BPF_EXIT_INSN(),
1727 
1728         /* subprog 1 */
1729         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1730                     offsetof(struct __sk_buff, data)),
1731         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1732                     offsetof(struct __sk_buff, data_end)),
1733         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1734         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1735         BPF_MOV64_IMM(BPF_REG_5, 0),
1736         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
1737         /* spill checked pkt_ptr into stack of caller */
1738         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
1739         BPF_MOV64_IMM(BPF_REG_5, 1),
1740         /* don't read back pkt_ptr from stack here */
1741         /* write 4 bytes into packet */
1742         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
1743         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
1744         BPF_EXIT_INSN(),
1745         },
1746         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1747         .errstr = "same insn cannot be used with different",
1748         .result = REJECT,
1749         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
1750 },
1751 {
1752         "calls: pkt_ptr spill into caller stack 6",
1753         .insns = {
1754         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1755                     offsetof(struct __sk_buff, data_end)),
1756         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
1757         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
1758         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
1759         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
1760         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
1761         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
1762         BPF_EXIT_INSN(),
1763 
1764         /* subprog 1 */
1765         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1766                     offsetof(struct __sk_buff, data)),
1767         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1768                     offsetof(struct __sk_buff, data_end)),
1769         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1770         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1771         BPF_MOV64_IMM(BPF_REG_5, 0),
1772         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
1773         /* spill checked pkt_ptr into stack of caller */
1774         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
1775         BPF_MOV64_IMM(BPF_REG_5, 1),
1776         /* don't read back pkt_ptr from stack here */
1777         /* write 4 bytes into packet */
1778         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
1779         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
1780         BPF_EXIT_INSN(),
1781         },
1782         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1783         .errstr = "R4 invalid mem access",
1784         .result = REJECT,
1785         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
1786 },
1787 {
1788         "calls: pkt_ptr spill into caller stack 7",
1789         .insns = {
1790         BPF_MOV64_IMM(BPF_REG_2, 0),
1791         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
1792         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
1793         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
1794         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
1795         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
1796         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
1797         BPF_EXIT_INSN(),
1798 
1799         /* subprog 1 */
1800         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1801                     offsetof(struct __sk_buff, data)),
1802         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1803                     offsetof(struct __sk_buff, data_end)),
1804         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1805         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1806         BPF_MOV64_IMM(BPF_REG_5, 0),
1807         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
1808         /* spill checked pkt_ptr into stack of caller */
1809         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
1810         BPF_MOV64_IMM(BPF_REG_5, 1),
1811         /* don't read back pkt_ptr from stack here */
1812         /* write 4 bytes into packet */
1813         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
1814         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
1815         BPF_EXIT_INSN(),
1816         },
1817         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1818         .errstr = "R4 invalid mem access",
1819         .result = REJECT,
1820         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
1821 },
1822 {
1823         "calls: pkt_ptr spill into caller stack 8",
1824         .insns = {
1825         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1826                     offsetof(struct __sk_buff, data)),
1827         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1828                     offsetof(struct __sk_buff, data_end)),
1829         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1830         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1831         BPF_JMP_REG(BPF_JLE, BPF_REG_0, BPF_REG_3, 1),
1832         BPF_EXIT_INSN(),
1833         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
1834         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
1835         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
1836         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
1837         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
1838         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
1839         BPF_EXIT_INSN(),
1840 
1841         /* subprog 1 */
1842         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1843                     offsetof(struct __sk_buff, data)),
1844         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1845                     offsetof(struct __sk_buff, data_end)),
1846         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1847         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1848         BPF_MOV64_IMM(BPF_REG_5, 0),
1849         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 3),
1850         /* spill checked pkt_ptr into stack of caller */
1851         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
1852         BPF_MOV64_IMM(BPF_REG_5, 1),
1853         /* don't read back pkt_ptr from stack here */
1854         /* write 4 bytes into packet */
1855         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
1856         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
1857         BPF_EXIT_INSN(),
1858         },
1859         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1860         .result = ACCEPT,
1861         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
1862 },
1863 {
1864         "calls: pkt_ptr spill into caller stack 9",
1865         .insns = {
1866         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1867                     offsetof(struct __sk_buff, data)),
1868         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1869                     offsetof(struct __sk_buff, data_end)),
1870         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1871         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1872         BPF_JMP_REG(BPF_JLE, BPF_REG_0, BPF_REG_3, 1),
1873         BPF_EXIT_INSN(),
1874         BPF_MOV64_REG(BPF_REG_4, BPF_REG_10),
1875         BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -8),
1876         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
1877         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 3),
1878         BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_10, -8),
1879         BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_4, 0),
1880         BPF_EXIT_INSN(),
1881 
1882         /* subprog 1 */
1883         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
1884                     offsetof(struct __sk_buff, data)),
1885         BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
1886                     offsetof(struct __sk_buff, data_end)),
1887         BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
1888         BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8),
1889         BPF_MOV64_IMM(BPF_REG_5, 0),
1890         /* spill unchecked pkt_ptr into stack of caller */
1891         BPF_STX_MEM(BPF_DW, BPF_REG_4, BPF_REG_2, 0),
1892         BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 2),
1893         BPF_MOV64_IMM(BPF_REG_5, 1),
1894         /* don't read back pkt_ptr from stack here */
1895         /* write 4 bytes into packet */
1896         BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0),
1897         BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
1898         BPF_EXIT_INSN(),
1899         },
1900         .prog_type = BPF_PROG_TYPE_SCHED_CLS,
1901         .errstr = "invalid access to packet",
1902         .result = REJECT,
1903         .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
1904 },
1905 {
1906         "calls: caller stack init to zero or map_value_or_null",
1907         .insns = {
1908         BPF_MOV64_IMM(BPF_REG_0, 0),
1909         BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8),
1910         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1911         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1912         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
1913         /* fetch map_value_or_null or const_zero from stack */
1914         BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
1915         BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
1916         /* store into map_value */
1917         BPF_ST_MEM(BPF_W, BPF_REG_0, 0, 0),
1918         BPF_EXIT_INSN(),
1919 
1920         /* subprog 1 */
1921         /* if (ctx == 0) return; */
1922         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 8),
1923         /* else bpf_map_lookup() and *(fp - 8) = r0 */
1924         BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
1925         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1926         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1927         BPF_LD_MAP_FD(BPF_REG_1, 0),
1928         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1929         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
1930         /* write map_value_ptr_or_null into stack frame of main prog at fp-8 */
1931         BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0),
1932         BPF_EXIT_INSN(),
1933         },
1934         .fixup_map_hash_8b = { 13 },
1935         .result = ACCEPT,
1936         .prog_type = BPF_PROG_TYPE_XDP,
1937 },
1938 {
1939         "calls: stack init to zero and pruning",
1940         .insns = {
1941         /* first make allocated_stack 16 byte */
1942         BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, 0),
1943         /* now fork the execution such that the false branch
1944          * of JGT insn will be verified second and it skisp zero
1945          * init of fp-8 stack slot. If stack liveness marking
1946          * is missing live_read marks from call map_lookup
1947          * processing then pruning will incorrectly assume
1948          * that fp-8 stack slot was unused in the fall-through
1949          * branch and will accept the program incorrectly
1950          */
1951         BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 2, 2),
1952         BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
1953         BPF_JMP_IMM(BPF_JA, 0, 0, 0),
1954         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
1955         BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
1956         BPF_LD_MAP_FD(BPF_REG_1, 0),
1957         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
1958         BPF_EXIT_INSN(),
1959         },
1960         .fixup_map_hash_48b = { 6 },
1961         .errstr = "invalid indirect read from stack off -8+0 size 8",
1962         .result = REJECT,
1963         .prog_type = BPF_PROG_TYPE_XDP,
1964 },
1965 {
1966         "calls: ctx read at start of subprog",
1967         .insns = {
1968         BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
1969         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 5),
1970         BPF_JMP_REG(BPF_JSGT, BPF_REG_0, BPF_REG_0, 0),
1971         BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
1972         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 2),
1973         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
1974         BPF_EXIT_INSN(),
1975         BPF_LDX_MEM(BPF_B, BPF_REG_9, BPF_REG_1, 0),
1976         BPF_MOV64_IMM(BPF_REG_0, 0),
1977         BPF_EXIT_INSN(),
1978         },
1979         .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
1980         .errstr_unpriv = "function calls to other bpf functions are allowed for root only",
1981         .result_unpriv = REJECT,
1982         .result = ACCEPT,
1983 },
1984 {
1985         "calls: cross frame pruning",
1986         .insns = {
1987         /* r8 = !!random();
1988          * call pruner()
1989          * if (r8)
1990          *     do something bad;
1991          */
1992         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),
1993         BPF_MOV64_IMM(BPF_REG_8, 0),
1994         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
1995         BPF_MOV64_IMM(BPF_REG_8, 1),
1996         BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
1997         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
1998         BPF_JMP_IMM(BPF_JEQ, BPF_REG_8, 1, 1),
1999         BPF_LDX_MEM(BPF_B, BPF_REG_9, BPF_REG_1, 0),
2000         BPF_MOV64_IMM(BPF_REG_0, 0),
2001         BPF_EXIT_INSN(),
2002         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
2003         BPF_EXIT_INSN(),
2004         },
2005         .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
2006         .errstr_unpriv = "function calls to other bpf functions are allowed for root only",
2007         .errstr = "!read_ok",
2008         .result = REJECT,
2009 },
2010 {
2011         "calls: cross frame pruning - liveness propagation",
2012         .insns = {
2013         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),
2014         BPF_MOV64_IMM(BPF_REG_8, 0),
2015         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
2016         BPF_MOV64_IMM(BPF_REG_8, 1),
2017         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32),
2018         BPF_MOV64_IMM(BPF_REG_9, 0),
2019         BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
2020         BPF_MOV64_IMM(BPF_REG_9, 1),
2021         BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
2022         BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 4),
2023         BPF_JMP_IMM(BPF_JEQ, BPF_REG_8, 1, 1),
2024         BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_2, 0),
2025         BPF_MOV64_IMM(BPF_REG_0, 0),
2026         BPF_EXIT_INSN(),
2027         BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 0),
2028         BPF_EXIT_INSN(),
2029         },
2030         .prog_type = BPF_PROG_TYPE_SOCKET_FILTER,
2031         .errstr_unpriv = "function calls to other bpf functions are allowed for root only",
2032         .errstr = "!read_ok",
2033         .result = REJECT,
2034 },