cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

helper_packet_access.c (14999B)

      1{
      2	"helper access to packet: test1, valid packet_ptr range",
      3	.insns = {
      4	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
      5	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
      6		    offsetof(struct xdp_md, data_end)),
      7	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
      8	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
      9	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
     10	BPF_LD_MAP_FD(BPF_REG_1, 0),
     11	BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
     12	BPF_MOV64_IMM(BPF_REG_4, 0),
     13	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_update_elem),
     14	BPF_MOV64_IMM(BPF_REG_0, 0),
     15	BPF_EXIT_INSN(),
     16	},
     17	.fixup_map_hash_8b = { 5 },
     18	.result_unpriv = ACCEPT,
     19	.result = ACCEPT,
     20	.prog_type = BPF_PROG_TYPE_XDP,
     21},
     22{
     23	"helper access to packet: test2, unchecked packet_ptr",
     24	.insns = {
     25	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
     26	BPF_LD_MAP_FD(BPF_REG_1, 0),
     27	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
     28	BPF_MOV64_IMM(BPF_REG_0, 0),
     29	BPF_EXIT_INSN(),
     30	},
     31	.fixup_map_hash_8b = { 1 },
     32	.result = REJECT,
     33	.errstr = "invalid access to packet",
     34	.prog_type = BPF_PROG_TYPE_XDP,
     35},
     36{
     37	"helper access to packet: test3, variable add",
     38	.insns = {
     39	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
     40	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
     41			offsetof(struct xdp_md, data_end)),
     42	BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
     43	BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
     44	BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
     45	BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
     46	BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
     47	BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
     48	BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
     49	BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
     50	BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
     51	BPF_LD_MAP_FD(BPF_REG_1, 0),
     52	BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
     53	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
     54	BPF_MOV64_IMM(BPF_REG_0, 0),
     55	BPF_EXIT_INSN(),
     56	},
     57	.fixup_map_hash_8b = { 11 },
     58	.result = ACCEPT,
     59	.prog_type = BPF_PROG_TYPE_XDP,
     60},
     61{
     62	"helper access to packet: test4, packet_ptr with bad range",
     63	.insns = {
     64	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
     65	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
     66		    offsetof(struct xdp_md, data_end)),
     67	BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
     68	BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
     69	BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
     70	BPF_MOV64_IMM(BPF_REG_0, 0),
     71	BPF_EXIT_INSN(),
     72	BPF_LD_MAP_FD(BPF_REG_1, 0),
     73	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
     74	BPF_MOV64_IMM(BPF_REG_0, 0),
     75	BPF_EXIT_INSN(),
     76	},
     77	.fixup_map_hash_8b = { 7 },
     78	.result = REJECT,
     79	.errstr = "invalid access to packet",
     80	.prog_type = BPF_PROG_TYPE_XDP,
     81},
     82{
     83	"helper access to packet: test5, packet_ptr with too short range",
     84	.insns = {
     85	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
     86	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
     87		    offsetof(struct xdp_md, data_end)),
     88	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
     89	BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
     90	BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
     91	BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
     92	BPF_LD_MAP_FD(BPF_REG_1, 0),
     93	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
     94	BPF_MOV64_IMM(BPF_REG_0, 0),
     95	BPF_EXIT_INSN(),
     96	},
     97	.fixup_map_hash_8b = { 6 },
     98	.result = REJECT,
     99	.errstr = "invalid access to packet",
    100	.prog_type = BPF_PROG_TYPE_XDP,
    101},
    102{
    103	"helper access to packet: test6, cls valid packet_ptr range",
    104	.insns = {
    105	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
    106		    offsetof(struct __sk_buff, data)),
    107	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    108		    offsetof(struct __sk_buff, data_end)),
    109	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    110	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    111	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 5),
    112	BPF_LD_MAP_FD(BPF_REG_1, 0),
    113	BPF_MOV64_REG(BPF_REG_3, BPF_REG_2),
    114	BPF_MOV64_IMM(BPF_REG_4, 0),
    115	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_update_elem),
    116	BPF_MOV64_IMM(BPF_REG_0, 0),
    117	BPF_EXIT_INSN(),
    118	},
    119	.fixup_map_hash_8b = { 5 },
    120	.result = ACCEPT,
    121	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
    122},
    123{
    124	"helper access to packet: test7, cls unchecked packet_ptr",
    125	.insns = {
    126	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
    127		    offsetof(struct __sk_buff, data)),
    128	BPF_LD_MAP_FD(BPF_REG_1, 0),
    129	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
    130	BPF_MOV64_IMM(BPF_REG_0, 0),
    131	BPF_EXIT_INSN(),
    132	},
    133	.fixup_map_hash_8b = { 1 },
    134	.result = REJECT,
    135	.errstr = "invalid access to packet",
    136	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
    137},
    138{
    139	"helper access to packet: test8, cls variable add",
    140	.insns = {
    141	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
    142			offsetof(struct __sk_buff, data)),
    143	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    144			offsetof(struct __sk_buff, data_end)),
    145	BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
    146	BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 8),
    147	BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 10),
    148	BPF_LDX_MEM(BPF_B, BPF_REG_5, BPF_REG_2, 0),
    149	BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
    150	BPF_ALU64_REG(BPF_ADD, BPF_REG_4, BPF_REG_5),
    151	BPF_MOV64_REG(BPF_REG_5, BPF_REG_4),
    152	BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 8),
    153	BPF_JMP_REG(BPF_JGT, BPF_REG_5, BPF_REG_3, 4),
    154	BPF_LD_MAP_FD(BPF_REG_1, 0),
    155	BPF_MOV64_REG(BPF_REG_2, BPF_REG_4),
    156	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
    157	BPF_MOV64_IMM(BPF_REG_0, 0),
    158	BPF_EXIT_INSN(),
    159	},
    160	.fixup_map_hash_8b = { 11 },
    161	.result = ACCEPT,
    162	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
    163},
    164{
    165	"helper access to packet: test9, cls packet_ptr with bad range",
    166	.insns = {
    167	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
    168		    offsetof(struct __sk_buff, data)),
    169	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    170		    offsetof(struct __sk_buff, data_end)),
    171	BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
    172	BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
    173	BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 2),
    174	BPF_MOV64_IMM(BPF_REG_0, 0),
    175	BPF_EXIT_INSN(),
    176	BPF_LD_MAP_FD(BPF_REG_1, 0),
    177	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
    178	BPF_MOV64_IMM(BPF_REG_0, 0),
    179	BPF_EXIT_INSN(),
    180	},
    181	.fixup_map_hash_8b = { 7 },
    182	.result = REJECT,
    183	.errstr = "invalid access to packet",
    184	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
    185},
    186{
    187	"helper access to packet: test10, cls packet_ptr with too short range",
    188	.insns = {
    189	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
    190		    offsetof(struct __sk_buff, data)),
    191	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    192		    offsetof(struct __sk_buff, data_end)),
    193	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, 1),
    194	BPF_MOV64_REG(BPF_REG_4, BPF_REG_2),
    195	BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 7),
    196	BPF_JMP_REG(BPF_JGT, BPF_REG_4, BPF_REG_3, 3),
    197	BPF_LD_MAP_FD(BPF_REG_1, 0),
    198	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
    199	BPF_MOV64_IMM(BPF_REG_0, 0),
    200	BPF_EXIT_INSN(),
    201	},
    202	.fixup_map_hash_8b = { 6 },
    203	.result = REJECT,
    204	.errstr = "invalid access to packet",
    205	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
    206},
    207{
    208	"helper access to packet: test11, cls unsuitable helper 1",
    209	.insns = {
    210	BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
    211		    offsetof(struct __sk_buff, data)),
    212	BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
    213		    offsetof(struct __sk_buff, data_end)),
    214	BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
    215	BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
    216	BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 7),
    217	BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_7, 4),
    218	BPF_MOV64_IMM(BPF_REG_2, 0),
    219	BPF_MOV64_IMM(BPF_REG_4, 42),
    220	BPF_MOV64_IMM(BPF_REG_5, 0),
    221	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_store_bytes),
    222	BPF_MOV64_IMM(BPF_REG_0, 0),
    223	BPF_EXIT_INSN(),
    224	},
    225	.result = REJECT,
    226	.errstr = "helper access to the packet",
    227	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
    228},
    229{
    230	"helper access to packet: test12, cls unsuitable helper 2",
    231	.insns = {
    232	BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
    233		    offsetof(struct __sk_buff, data)),
    234	BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
    235		    offsetof(struct __sk_buff, data_end)),
    236	BPF_MOV64_REG(BPF_REG_3, BPF_REG_6),
    237	BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 8),
    238	BPF_JMP_REG(BPF_JGT, BPF_REG_6, BPF_REG_7, 3),
    239	BPF_MOV64_IMM(BPF_REG_2, 0),
    240	BPF_MOV64_IMM(BPF_REG_4, 4),
    241	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_skb_load_bytes),
    242	BPF_MOV64_IMM(BPF_REG_0, 0),
    243	BPF_EXIT_INSN(),
    244	},
    245	.result = REJECT,
    246	.errstr = "helper access to the packet",
    247	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
    248},
    249{
    250	"helper access to packet: test13, cls helper ok",
    251	.insns = {
    252	BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
    253		    offsetof(struct __sk_buff, data)),
    254	BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
    255		    offsetof(struct __sk_buff, data_end)),
    256	BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
    257	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
    258	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
    259	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
    260	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
    261	BPF_MOV64_IMM(BPF_REG_2, 4),
    262	BPF_MOV64_IMM(BPF_REG_3, 0),
    263	BPF_MOV64_IMM(BPF_REG_4, 0),
    264	BPF_MOV64_IMM(BPF_REG_5, 0),
    265	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
    266	BPF_MOV64_IMM(BPF_REG_0, 0),
    267	BPF_EXIT_INSN(),
    268	},
    269	.result = ACCEPT,
    270	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
    271},
    272{
    273	"helper access to packet: test14, cls helper ok sub",
    274	.insns = {
    275	BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
    276		    offsetof(struct __sk_buff, data)),
    277	BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
    278		    offsetof(struct __sk_buff, data_end)),
    279	BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
    280	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
    281	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
    282	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
    283	BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 4),
    284	BPF_MOV64_IMM(BPF_REG_2, 4),
    285	BPF_MOV64_IMM(BPF_REG_3, 0),
    286	BPF_MOV64_IMM(BPF_REG_4, 0),
    287	BPF_MOV64_IMM(BPF_REG_5, 0),
    288	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
    289	BPF_MOV64_IMM(BPF_REG_0, 0),
    290	BPF_EXIT_INSN(),
    291	},
    292	.result = ACCEPT,
    293	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
    294},
    295{
    296	"helper access to packet: test15, cls helper fail sub",
    297	.insns = {
    298	BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
    299		    offsetof(struct __sk_buff, data)),
    300	BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
    301		    offsetof(struct __sk_buff, data_end)),
    302	BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
    303	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
    304	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
    305	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
    306	BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 12),
    307	BPF_MOV64_IMM(BPF_REG_2, 4),
    308	BPF_MOV64_IMM(BPF_REG_3, 0),
    309	BPF_MOV64_IMM(BPF_REG_4, 0),
    310	BPF_MOV64_IMM(BPF_REG_5, 0),
    311	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
    312	BPF_MOV64_IMM(BPF_REG_0, 0),
    313	BPF_EXIT_INSN(),
    314	},
    315	.result = REJECT,
    316	.errstr = "invalid access to packet",
    317	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
    318},
    319{
    320	"helper access to packet: test16, cls helper fail range 1",
    321	.insns = {
    322	BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
    323		    offsetof(struct __sk_buff, data)),
    324	BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
    325		    offsetof(struct __sk_buff, data_end)),
    326	BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
    327	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
    328	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
    329	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
    330	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
    331	BPF_MOV64_IMM(BPF_REG_2, 8),
    332	BPF_MOV64_IMM(BPF_REG_3, 0),
    333	BPF_MOV64_IMM(BPF_REG_4, 0),
    334	BPF_MOV64_IMM(BPF_REG_5, 0),
    335	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
    336	BPF_MOV64_IMM(BPF_REG_0, 0),
    337	BPF_EXIT_INSN(),
    338	},
    339	.result = REJECT,
    340	.errstr = "invalid access to packet",
    341	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
    342},
    343{
    344	"helper access to packet: test17, cls helper fail range 2",
    345	.insns = {
    346	BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
    347		    offsetof(struct __sk_buff, data)),
    348	BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
    349		    offsetof(struct __sk_buff, data_end)),
    350	BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
    351	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
    352	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
    353	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
    354	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
    355	BPF_MOV64_IMM(BPF_REG_2, -9),
    356	BPF_MOV64_IMM(BPF_REG_3, 0),
    357	BPF_MOV64_IMM(BPF_REG_4, 0),
    358	BPF_MOV64_IMM(BPF_REG_5, 0),
    359	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
    360	BPF_MOV64_IMM(BPF_REG_0, 0),
    361	BPF_EXIT_INSN(),
    362	},
    363	.result = REJECT,
    364	.errstr = "R2 min value is negative",
    365	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
    366},
    367{
    368	"helper access to packet: test18, cls helper fail range 3",
    369	.insns = {
    370	BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
    371		    offsetof(struct __sk_buff, data)),
    372	BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
    373		    offsetof(struct __sk_buff, data_end)),
    374	BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
    375	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
    376	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
    377	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
    378	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
    379	BPF_MOV64_IMM(BPF_REG_2, ~0),
    380	BPF_MOV64_IMM(BPF_REG_3, 0),
    381	BPF_MOV64_IMM(BPF_REG_4, 0),
    382	BPF_MOV64_IMM(BPF_REG_5, 0),
    383	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
    384	BPF_MOV64_IMM(BPF_REG_0, 0),
    385	BPF_EXIT_INSN(),
    386	},
    387	.result = REJECT,
    388	.errstr = "R2 min value is negative",
    389	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
    390},
    391{
    392	"helper access to packet: test19, cls helper range zero",
    393	.insns = {
    394	BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
    395		    offsetof(struct __sk_buff, data)),
    396	BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
    397		    offsetof(struct __sk_buff, data_end)),
    398	BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
    399	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
    400	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
    401	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
    402	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
    403	BPF_MOV64_IMM(BPF_REG_2, 0),
    404	BPF_MOV64_IMM(BPF_REG_3, 0),
    405	BPF_MOV64_IMM(BPF_REG_4, 0),
    406	BPF_MOV64_IMM(BPF_REG_5, 0),
    407	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
    408	BPF_MOV64_IMM(BPF_REG_0, 0),
    409	BPF_EXIT_INSN(),
    410	},
    411	.result = ACCEPT,
    412	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
    413},
    414{
    415	"helper access to packet: test20, pkt end as input",
    416	.insns = {
    417	BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
    418		    offsetof(struct __sk_buff, data)),
    419	BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
    420		    offsetof(struct __sk_buff, data_end)),
    421	BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
    422	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
    423	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
    424	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
    425	BPF_MOV64_REG(BPF_REG_1, BPF_REG_7),
    426	BPF_MOV64_IMM(BPF_REG_2, 4),
    427	BPF_MOV64_IMM(BPF_REG_3, 0),
    428	BPF_MOV64_IMM(BPF_REG_4, 0),
    429	BPF_MOV64_IMM(BPF_REG_5, 0),
    430	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
    431	BPF_MOV64_IMM(BPF_REG_0, 0),
    432	BPF_EXIT_INSN(),
    433	},
    434	.result = REJECT,
    435	.errstr = "R1 type=pkt_end expected=fp",
    436	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
    437},
    438{
    439	"helper access to packet: test21, wrong reg",
    440	.insns = {
    441	BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
    442		    offsetof(struct __sk_buff, data)),
    443	BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
    444		    offsetof(struct __sk_buff, data_end)),
    445	BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, 1),
    446	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
    447	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
    448	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_7, 6),
    449	BPF_MOV64_IMM(BPF_REG_2, 4),
    450	BPF_MOV64_IMM(BPF_REG_3, 0),
    451	BPF_MOV64_IMM(BPF_REG_4, 0),
    452	BPF_MOV64_IMM(BPF_REG_5, 0),
    453	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_csum_diff),
    454	BPF_MOV64_IMM(BPF_REG_0, 0),
    455	BPF_EXIT_INSN(),
    456	},
    457	.result = REJECT,
    458	.errstr = "invalid access to packet",
    459	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
    460},