cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

xdp_direct_packet_access.c (48882B)

      1{
      2	"XDP pkt read, pkt_end mangling, bad access 1",
      3	.insns = {
      4	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
      5	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
      6		    offsetof(struct xdp_md, data_end)),
      7	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
      8	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
      9	BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 8),
     10	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
     11	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
     12	BPF_MOV64_IMM(BPF_REG_0, 0),
     13	BPF_EXIT_INSN(),
     14	},
     15	.errstr = "R3 pointer arithmetic on pkt_end",
     16	.result = REJECT,
     17	.prog_type = BPF_PROG_TYPE_XDP,
     18},
     19{
     20	"XDP pkt read, pkt_end mangling, bad access 2",
     21	.insns = {
     22	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
     23	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
     24		    offsetof(struct xdp_md, data_end)),
     25	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
     26	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
     27	BPF_ALU64_IMM(BPF_SUB, BPF_REG_3, 8),
     28	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
     29	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
     30	BPF_MOV64_IMM(BPF_REG_0, 0),
     31	BPF_EXIT_INSN(),
     32	},
     33	.errstr = "R3 pointer arithmetic on pkt_end",
     34	.result = REJECT,
     35	.prog_type = BPF_PROG_TYPE_XDP,
     36},
     37{
     38	"XDP pkt read, pkt_data' > pkt_end, corner case, good access",
     39	.insns = {
     40	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
     41	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
     42		    offsetof(struct xdp_md, data_end)),
     43	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
     44	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
     45	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
     46	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
     47	BPF_MOV64_IMM(BPF_REG_0, 0),
     48	BPF_EXIT_INSN(),
     49	},
     50	.result = ACCEPT,
     51	.prog_type = BPF_PROG_TYPE_XDP,
     52	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
     53},
     54{
     55	"XDP pkt read, pkt_data' > pkt_end, bad access 1",
     56	.insns = {
     57	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
     58	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
     59		    offsetof(struct xdp_md, data_end)),
     60	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
     61	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
     62	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
     63	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
     64	BPF_MOV64_IMM(BPF_REG_0, 0),
     65	BPF_EXIT_INSN(),
     66	},
     67	.errstr = "R1 offset is outside of the packet",
     68	.result = REJECT,
     69	.prog_type = BPF_PROG_TYPE_XDP,
     70	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
     71},
     72{
     73	"XDP pkt read, pkt_data' > pkt_end, bad access 2",
     74	.insns = {
     75	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
     76	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
     77		    offsetof(struct xdp_md, data_end)),
     78	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
     79	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
     80	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0),
     81	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
     82	BPF_MOV64_IMM(BPF_REG_0, 0),
     83	BPF_EXIT_INSN(),
     84	},
     85	.errstr = "R1 offset is outside of the packet",
     86	.result = REJECT,
     87	.prog_type = BPF_PROG_TYPE_XDP,
     88	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
     89},
     90{
     91	"XDP pkt read, pkt_data' > pkt_end, corner case +1, good access",
     92	.insns = {
     93	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
     94	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
     95		    offsetof(struct xdp_md, data_end)),
     96	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
     97	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9),
     98	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
     99	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9),
    100	BPF_MOV64_IMM(BPF_REG_0, 0),
    101	BPF_EXIT_INSN(),
    102	},
    103	.result = ACCEPT,
    104	.prog_type = BPF_PROG_TYPE_XDP,
    105	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    106},
    107{
    108	"XDP pkt read, pkt_data' > pkt_end, corner case -1, bad access",
    109	.insns = {
    110	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    111	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    112		    offsetof(struct xdp_md, data_end)),
    113	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    114	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
    115	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
    116	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
    117	BPF_MOV64_IMM(BPF_REG_0, 0),
    118	BPF_EXIT_INSN(),
    119	},
    120	.errstr = "R1 offset is outside of the packet",
    121	.result = REJECT,
    122	.prog_type = BPF_PROG_TYPE_XDP,
    123	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    124},
    125{
    126	"XDP pkt read, pkt_end > pkt_data', good access",
    127	.insns = {
    128	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    129	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    130		    offsetof(struct xdp_md, data_end)),
    131	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    132	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    133	BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
    134	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
    135	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
    136	BPF_MOV64_IMM(BPF_REG_0, 0),
    137	BPF_EXIT_INSN(),
    138	},
    139	.result = ACCEPT,
    140	.prog_type = BPF_PROG_TYPE_XDP,
    141	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    142},
    143{
    144	"XDP pkt read, pkt_end > pkt_data', corner case -1, bad access",
    145	.insns = {
    146	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    147	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    148		    offsetof(struct xdp_md, data_end)),
    149	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    150	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
    151	BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
    152	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
    153	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
    154	BPF_MOV64_IMM(BPF_REG_0, 0),
    155	BPF_EXIT_INSN(),
    156	},
    157	.errstr = "R1 offset is outside of the packet",
    158	.result = REJECT,
    159	.prog_type = BPF_PROG_TYPE_XDP,
    160	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    161},
    162{
    163	"XDP pkt read, pkt_end > pkt_data', bad access 2",
    164	.insns = {
    165	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    166	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    167		    offsetof(struct xdp_md, data_end)),
    168	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    169	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    170	BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
    171	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
    172	BPF_MOV64_IMM(BPF_REG_0, 0),
    173	BPF_EXIT_INSN(),
    174	},
    175	.errstr = "R1 offset is outside of the packet",
    176	.result = REJECT,
    177	.prog_type = BPF_PROG_TYPE_XDP,
    178	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    179},
    180{
    181	"XDP pkt read, pkt_end > pkt_data', corner case, good access",
    182	.insns = {
    183	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    184	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    185		    offsetof(struct xdp_md, data_end)),
    186	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    187	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
    188	BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
    189	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
    190	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
    191	BPF_MOV64_IMM(BPF_REG_0, 0),
    192	BPF_EXIT_INSN(),
    193	},
    194	.result = ACCEPT,
    195	.prog_type = BPF_PROG_TYPE_XDP,
    196	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    197},
    198{
    199	"XDP pkt read, pkt_end > pkt_data', corner case +1, good access",
    200	.insns = {
    201	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    202	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    203		    offsetof(struct xdp_md, data_end)),
    204	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    205	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    206	BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
    207	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
    208	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
    209	BPF_MOV64_IMM(BPF_REG_0, 0),
    210	BPF_EXIT_INSN(),
    211	},
    212	.result = ACCEPT,
    213	.prog_type = BPF_PROG_TYPE_XDP,
    214	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    215},
    216{
    217	"XDP pkt read, pkt_data' < pkt_end, good access",
    218	.insns = {
    219	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    220	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    221		    offsetof(struct xdp_md, data_end)),
    222	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    223	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    224	BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
    225	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
    226	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
    227	BPF_MOV64_IMM(BPF_REG_0, 0),
    228	BPF_EXIT_INSN(),
    229	},
    230	.result = ACCEPT,
    231	.prog_type = BPF_PROG_TYPE_XDP,
    232	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    233},
    234{
    235	"XDP pkt read, pkt_data' < pkt_end, corner case -1, bad access",
    236	.insns = {
    237	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    238	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    239		    offsetof(struct xdp_md, data_end)),
    240	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    241	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
    242	BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
    243	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
    244	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
    245	BPF_MOV64_IMM(BPF_REG_0, 0),
    246	BPF_EXIT_INSN(),
    247	},
    248	.errstr = "R1 offset is outside of the packet",
    249	.result = REJECT,
    250	.prog_type = BPF_PROG_TYPE_XDP,
    251	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    252},
    253{
    254	"XDP pkt read, pkt_data' < pkt_end, bad access 2",
    255	.insns = {
    256	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    257	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    258		    offsetof(struct xdp_md, data_end)),
    259	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    260	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    261	BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
    262	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
    263	BPF_MOV64_IMM(BPF_REG_0, 0),
    264	BPF_EXIT_INSN(),
    265	},
    266	.errstr = "R1 offset is outside of the packet",
    267	.result = REJECT,
    268	.prog_type = BPF_PROG_TYPE_XDP,
    269	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    270},
    271{
    272	"XDP pkt read, pkt_data' < pkt_end, corner case, good access",
    273	.insns = {
    274	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    275	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    276		    offsetof(struct xdp_md, data_end)),
    277	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    278	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
    279	BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
    280	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
    281	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
    282	BPF_MOV64_IMM(BPF_REG_0, 0),
    283	BPF_EXIT_INSN(),
    284	},
    285	.result = ACCEPT,
    286	.prog_type = BPF_PROG_TYPE_XDP,
    287	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    288},
    289{
    290	"XDP pkt read, pkt_data' < pkt_end, corner case +1, good access",
    291	.insns = {
    292	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    293	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    294		    offsetof(struct xdp_md, data_end)),
    295	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    296	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    297	BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
    298	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
    299	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
    300	BPF_MOV64_IMM(BPF_REG_0, 0),
    301	BPF_EXIT_INSN(),
    302	},
    303	.result = ACCEPT,
    304	.prog_type = BPF_PROG_TYPE_XDP,
    305	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    306},
    307{
    308	"XDP pkt read, pkt_end < pkt_data', corner case, good access",
    309	.insns = {
    310	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    311	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    312		    offsetof(struct xdp_md, data_end)),
    313	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    314	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    315	BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
    316	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
    317	BPF_MOV64_IMM(BPF_REG_0, 0),
    318	BPF_EXIT_INSN(),
    319	},
    320	.result = ACCEPT,
    321	.prog_type = BPF_PROG_TYPE_XDP,
    322	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    323},
    324{
    325	"XDP pkt read, pkt_end < pkt_data', bad access 1",
    326	.insns = {
    327	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    328	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    329		    offsetof(struct xdp_md, data_end)),
    330	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    331	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    332	BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
    333	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
    334	BPF_MOV64_IMM(BPF_REG_0, 0),
    335	BPF_EXIT_INSN(),
    336	},
    337	.errstr = "R1 offset is outside of the packet",
    338	.result = REJECT,
    339	.prog_type = BPF_PROG_TYPE_XDP,
    340	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    341},
    342{
    343	"XDP pkt read, pkt_end < pkt_data', bad access 2",
    344	.insns = {
    345	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    346	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    347		    offsetof(struct xdp_md, data_end)),
    348	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    349	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    350	BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0),
    351	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
    352	BPF_MOV64_IMM(BPF_REG_0, 0),
    353	BPF_EXIT_INSN(),
    354	},
    355	.errstr = "R1 offset is outside of the packet",
    356	.result = REJECT,
    357	.prog_type = BPF_PROG_TYPE_XDP,
    358	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    359},
    360{
    361	"XDP pkt read, pkt_end < pkt_data', corner case +1, good access",
    362	.insns = {
    363	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    364	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    365		    offsetof(struct xdp_md, data_end)),
    366	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    367	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9),
    368	BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
    369	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9),
    370	BPF_MOV64_IMM(BPF_REG_0, 0),
    371	BPF_EXIT_INSN(),
    372	},
    373	.result = ACCEPT,
    374	.prog_type = BPF_PROG_TYPE_XDP,
    375	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    376},
    377{
    378	"XDP pkt read, pkt_end < pkt_data', corner case -1, bad access",
    379	.insns = {
    380	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    381	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    382		    offsetof(struct xdp_md, data_end)),
    383	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    384	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
    385	BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
    386	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
    387	BPF_MOV64_IMM(BPF_REG_0, 0),
    388	BPF_EXIT_INSN(),
    389	},
    390	.errstr = "R1 offset is outside of the packet",
    391	.result = REJECT,
    392	.prog_type = BPF_PROG_TYPE_XDP,
    393	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    394},
    395{
    396	"XDP pkt read, pkt_data' >= pkt_end, good access",
    397	.insns = {
    398	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    399	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    400		    offsetof(struct xdp_md, data_end)),
    401	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    402	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    403	BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
    404	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
    405	BPF_MOV64_IMM(BPF_REG_0, 0),
    406	BPF_EXIT_INSN(),
    407	},
    408	.result = ACCEPT,
    409	.prog_type = BPF_PROG_TYPE_XDP,
    410	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    411},
    412{
    413	"XDP pkt read, pkt_data' >= pkt_end, corner case -1, bad access",
    414	.insns = {
    415	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    416	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    417		    offsetof(struct xdp_md, data_end)),
    418	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    419	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
    420	BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
    421	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
    422	BPF_MOV64_IMM(BPF_REG_0, 0),
    423	BPF_EXIT_INSN(),
    424	},
    425	.errstr = "R1 offset is outside of the packet",
    426	.result = REJECT,
    427	.prog_type = BPF_PROG_TYPE_XDP,
    428	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    429},
    430{
    431	"XDP pkt read, pkt_data' >= pkt_end, bad access 2",
    432	.insns = {
    433	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    434	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    435		    offsetof(struct xdp_md, data_end)),
    436	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    437	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    438	BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0),
    439	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
    440	BPF_MOV64_IMM(BPF_REG_0, 0),
    441	BPF_EXIT_INSN(),
    442	},
    443	.errstr = "R1 offset is outside of the packet",
    444	.result = REJECT,
    445	.prog_type = BPF_PROG_TYPE_XDP,
    446	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    447},
    448{
    449	"XDP pkt read, pkt_data' >= pkt_end, corner case, good access",
    450	.insns = {
    451	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    452	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    453		    offsetof(struct xdp_md, data_end)),
    454	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    455	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
    456	BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
    457	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
    458	BPF_MOV64_IMM(BPF_REG_0, 0),
    459	BPF_EXIT_INSN(),
    460	},
    461	.result = ACCEPT,
    462	.prog_type = BPF_PROG_TYPE_XDP,
    463	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    464},
    465{
    466	"XDP pkt read, pkt_data' >= pkt_end, corner case +1, good access",
    467	.insns = {
    468	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    469	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    470		    offsetof(struct xdp_md, data_end)),
    471	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    472	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    473	BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
    474	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
    475	BPF_MOV64_IMM(BPF_REG_0, 0),
    476	BPF_EXIT_INSN(),
    477	},
    478	.result = ACCEPT,
    479	.prog_type = BPF_PROG_TYPE_XDP,
    480	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    481},
    482{
    483	"XDP pkt read, pkt_end >= pkt_data', corner case, good access",
    484	.insns = {
    485	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    486	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    487		    offsetof(struct xdp_md, data_end)),
    488	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    489	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    490	BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
    491	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
    492	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
    493	BPF_MOV64_IMM(BPF_REG_0, 0),
    494	BPF_EXIT_INSN(),
    495	},
    496	.result = ACCEPT,
    497	.prog_type = BPF_PROG_TYPE_XDP,
    498	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    499},
    500{
    501	"XDP pkt read, pkt_end >= pkt_data', bad access 1",
    502	.insns = {
    503	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    504	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    505		    offsetof(struct xdp_md, data_end)),
    506	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    507	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    508	BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
    509	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
    510	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
    511	BPF_MOV64_IMM(BPF_REG_0, 0),
    512	BPF_EXIT_INSN(),
    513	},
    514	.errstr = "R1 offset is outside of the packet",
    515	.result = REJECT,
    516	.prog_type = BPF_PROG_TYPE_XDP,
    517	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    518},
    519{
    520	"XDP pkt read, pkt_end >= pkt_data', bad access 2",
    521	.insns = {
    522	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    523	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    524		    offsetof(struct xdp_md, data_end)),
    525	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    526	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    527	BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
    528	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
    529	BPF_MOV64_IMM(BPF_REG_0, 0),
    530	BPF_EXIT_INSN(),
    531	},
    532	.errstr = "R1 offset is outside of the packet",
    533	.result = REJECT,
    534	.prog_type = BPF_PROG_TYPE_XDP,
    535	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    536},
    537{
    538	"XDP pkt read, pkt_end >= pkt_data', corner case +1, good access",
    539	.insns = {
    540	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    541	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    542		    offsetof(struct xdp_md, data_end)),
    543	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    544	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9),
    545	BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
    546	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
    547	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9),
    548	BPF_MOV64_IMM(BPF_REG_0, 0),
    549	BPF_EXIT_INSN(),
    550	},
    551	.result = ACCEPT,
    552	.prog_type = BPF_PROG_TYPE_XDP,
    553	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    554},
    555{
    556	"XDP pkt read, pkt_end >= pkt_data', corner case -1, bad access",
    557	.insns = {
    558	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    559	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    560		    offsetof(struct xdp_md, data_end)),
    561	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    562	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
    563	BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
    564	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
    565	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
    566	BPF_MOV64_IMM(BPF_REG_0, 0),
    567	BPF_EXIT_INSN(),
    568	},
    569	.errstr = "R1 offset is outside of the packet",
    570	.result = REJECT,
    571	.prog_type = BPF_PROG_TYPE_XDP,
    572	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    573},
    574{
    575	"XDP pkt read, pkt_data' <= pkt_end, corner case, good access",
    576	.insns = {
    577	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    578	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    579		    offsetof(struct xdp_md, data_end)),
    580	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    581	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    582	BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
    583	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
    584	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
    585	BPF_MOV64_IMM(BPF_REG_0, 0),
    586	BPF_EXIT_INSN(),
    587	},
    588	.result = ACCEPT,
    589	.prog_type = BPF_PROG_TYPE_XDP,
    590	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    591},
    592{
    593	"XDP pkt read, pkt_data' <= pkt_end, bad access 1",
    594	.insns = {
    595	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    596	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    597		    offsetof(struct xdp_md, data_end)),
    598	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    599	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    600	BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
    601	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
    602	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
    603	BPF_MOV64_IMM(BPF_REG_0, 0),
    604	BPF_EXIT_INSN(),
    605	},
    606	.errstr = "R1 offset is outside of the packet",
    607	.result = REJECT,
    608	.prog_type = BPF_PROG_TYPE_XDP,
    609	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    610},
    611{
    612	"XDP pkt read, pkt_data' <= pkt_end, bad access 2",
    613	.insns = {
    614	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    615	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    616		    offsetof(struct xdp_md, data_end)),
    617	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    618	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    619	BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
    620	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
    621	BPF_MOV64_IMM(BPF_REG_0, 0),
    622	BPF_EXIT_INSN(),
    623	},
    624	.errstr = "R1 offset is outside of the packet",
    625	.result = REJECT,
    626	.prog_type = BPF_PROG_TYPE_XDP,
    627	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    628},
    629{
    630	"XDP pkt read, pkt_data' <= pkt_end, corner case +1, good access",
    631	.insns = {
    632	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    633	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    634		    offsetof(struct xdp_md, data_end)),
    635	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    636	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9),
    637	BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
    638	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
    639	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9),
    640	BPF_MOV64_IMM(BPF_REG_0, 0),
    641	BPF_EXIT_INSN(),
    642	},
    643	.result = ACCEPT,
    644	.prog_type = BPF_PROG_TYPE_XDP,
    645	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    646},
    647{
    648	"XDP pkt read, pkt_data' <= pkt_end, corner case -1, bad access",
    649	.insns = {
    650	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    651	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    652		    offsetof(struct xdp_md, data_end)),
    653	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    654	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
    655	BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
    656	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
    657	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
    658	BPF_MOV64_IMM(BPF_REG_0, 0),
    659	BPF_EXIT_INSN(),
    660	},
    661	.errstr = "R1 offset is outside of the packet",
    662	.result = REJECT,
    663	.prog_type = BPF_PROG_TYPE_XDP,
    664	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    665},
    666{
    667	"XDP pkt read, pkt_end <= pkt_data', good access",
    668	.insns = {
    669	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    670	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    671		    offsetof(struct xdp_md, data_end)),
    672	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    673	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    674	BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
    675	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
    676	BPF_MOV64_IMM(BPF_REG_0, 0),
    677	BPF_EXIT_INSN(),
    678	},
    679	.result = ACCEPT,
    680	.prog_type = BPF_PROG_TYPE_XDP,
    681	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    682},
    683{
    684	"XDP pkt read, pkt_end <= pkt_data', corner case -1, bad access",
    685	.insns = {
    686	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    687	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    688		    offsetof(struct xdp_md, data_end)),
    689	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    690	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
    691	BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
    692	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
    693	BPF_MOV64_IMM(BPF_REG_0, 0),
    694	BPF_EXIT_INSN(),
    695	},
    696	.errstr = "R1 offset is outside of the packet",
    697	.result = REJECT,
    698	.prog_type = BPF_PROG_TYPE_XDP,
    699	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    700},
    701{
    702	"XDP pkt read, pkt_end <= pkt_data', bad access 2",
    703	.insns = {
    704	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    705	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    706		    offsetof(struct xdp_md, data_end)),
    707	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    708	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    709	BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0),
    710	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
    711	BPF_MOV64_IMM(BPF_REG_0, 0),
    712	BPF_EXIT_INSN(),
    713	},
    714	.errstr = "R1 offset is outside of the packet",
    715	.result = REJECT,
    716	.prog_type = BPF_PROG_TYPE_XDP,
    717	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    718},
    719{
    720	"XDP pkt read, pkt_end <= pkt_data', corner case, good access",
    721	.insns = {
    722	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    723	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    724		    offsetof(struct xdp_md, data_end)),
    725	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    726	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
    727	BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
    728	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
    729	BPF_MOV64_IMM(BPF_REG_0, 0),
    730	BPF_EXIT_INSN(),
    731	},
    732	.result = ACCEPT,
    733	.prog_type = BPF_PROG_TYPE_XDP,
    734	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    735},
    736{
    737	"XDP pkt read, pkt_end <= pkt_data', corner case +1, good access",
    738	.insns = {
    739	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, offsetof(struct xdp_md, data)),
    740	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
    741		    offsetof(struct xdp_md, data_end)),
    742	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    743	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    744	BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
    745	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
    746	BPF_MOV64_IMM(BPF_REG_0, 0),
    747	BPF_EXIT_INSN(),
    748	},
    749	.result = ACCEPT,
    750	.prog_type = BPF_PROG_TYPE_XDP,
    751	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    752},
    753{
    754	"XDP pkt read, pkt_meta' > pkt_data, corner case, good access",
    755	.insns = {
    756	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
    757		    offsetof(struct xdp_md, data_meta)),
    758	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
    759	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    760	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    761	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
    762	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
    763	BPF_MOV64_IMM(BPF_REG_0, 0),
    764	BPF_EXIT_INSN(),
    765	},
    766	.result = ACCEPT,
    767	.prog_type = BPF_PROG_TYPE_XDP,
    768	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    769},
    770{
    771	"XDP pkt read, pkt_meta' > pkt_data, bad access 1",
    772	.insns = {
    773	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
    774		    offsetof(struct xdp_md, data_meta)),
    775	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
    776	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    777	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    778	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
    779	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
    780	BPF_MOV64_IMM(BPF_REG_0, 0),
    781	BPF_EXIT_INSN(),
    782	},
    783	.errstr = "R1 offset is outside of the packet",
    784	.result = REJECT,
    785	.prog_type = BPF_PROG_TYPE_XDP,
    786	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    787},
    788{
    789	"XDP pkt read, pkt_meta' > pkt_data, bad access 2",
    790	.insns = {
    791	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
    792		    offsetof(struct xdp_md, data_meta)),
    793	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
    794	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    795	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    796	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 0),
    797	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
    798	BPF_MOV64_IMM(BPF_REG_0, 0),
    799	BPF_EXIT_INSN(),
    800	},
    801	.errstr = "R1 offset is outside of the packet",
    802	.result = REJECT,
    803	.prog_type = BPF_PROG_TYPE_XDP,
    804	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    805},
    806{
    807	"XDP pkt read, pkt_meta' > pkt_data, corner case +1, good access",
    808	.insns = {
    809	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
    810		    offsetof(struct xdp_md, data_meta)),
    811	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
    812	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    813	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9),
    814	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
    815	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9),
    816	BPF_MOV64_IMM(BPF_REG_0, 0),
    817	BPF_EXIT_INSN(),
    818	},
    819	.result = ACCEPT,
    820	.prog_type = BPF_PROG_TYPE_XDP,
    821	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    822},
    823{
    824	"XDP pkt read, pkt_meta' > pkt_data, corner case -1, bad access",
    825	.insns = {
    826	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
    827		    offsetof(struct xdp_md, data_meta)),
    828	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
    829	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    830	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
    831	BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_3, 1),
    832	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
    833	BPF_MOV64_IMM(BPF_REG_0, 0),
    834	BPF_EXIT_INSN(),
    835	},
    836	.errstr = "R1 offset is outside of the packet",
    837	.result = REJECT,
    838	.prog_type = BPF_PROG_TYPE_XDP,
    839	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    840},
    841{
    842	"XDP pkt read, pkt_data > pkt_meta', good access",
    843	.insns = {
    844	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
    845		    offsetof(struct xdp_md, data_meta)),
    846	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
    847	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    848	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    849	BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
    850	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
    851	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
    852	BPF_MOV64_IMM(BPF_REG_0, 0),
    853	BPF_EXIT_INSN(),
    854	},
    855	.result = ACCEPT,
    856	.prog_type = BPF_PROG_TYPE_XDP,
    857	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    858},
    859{
    860	"XDP pkt read, pkt_data > pkt_meta', corner case -1, bad access",
    861	.insns = {
    862	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
    863		    offsetof(struct xdp_md, data_meta)),
    864	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
    865	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    866	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
    867	BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
    868	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
    869	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
    870	BPF_MOV64_IMM(BPF_REG_0, 0),
    871	BPF_EXIT_INSN(),
    872	},
    873	.errstr = "R1 offset is outside of the packet",
    874	.result = REJECT,
    875	.prog_type = BPF_PROG_TYPE_XDP,
    876	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    877},
    878{
    879	"XDP pkt read, pkt_data > pkt_meta', bad access 2",
    880	.insns = {
    881	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
    882		    offsetof(struct xdp_md, data_meta)),
    883	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
    884	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    885	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    886	BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
    887	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
    888	BPF_MOV64_IMM(BPF_REG_0, 0),
    889	BPF_EXIT_INSN(),
    890	},
    891	.errstr = "R1 offset is outside of the packet",
    892	.result = REJECT,
    893	.prog_type = BPF_PROG_TYPE_XDP,
    894	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    895},
    896{
    897	"XDP pkt read, pkt_data > pkt_meta', corner case, good access",
    898	.insns = {
    899	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
    900		    offsetof(struct xdp_md, data_meta)),
    901	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
    902	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    903	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
    904	BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
    905	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
    906	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
    907	BPF_MOV64_IMM(BPF_REG_0, 0),
    908	BPF_EXIT_INSN(),
    909	},
    910	.result = ACCEPT,
    911	.prog_type = BPF_PROG_TYPE_XDP,
    912	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    913},
    914{
    915	"XDP pkt read, pkt_data > pkt_meta', corner case +1, good access",
    916	.insns = {
    917	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
    918		    offsetof(struct xdp_md, data_meta)),
    919	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
    920	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    921	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    922	BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
    923	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
    924	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
    925	BPF_MOV64_IMM(BPF_REG_0, 0),
    926	BPF_EXIT_INSN(),
    927	},
    928	.result = ACCEPT,
    929	.prog_type = BPF_PROG_TYPE_XDP,
    930	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    931},
    932{
    933	"XDP pkt read, pkt_meta' < pkt_data, good access",
    934	.insns = {
    935	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
    936		    offsetof(struct xdp_md, data_meta)),
    937	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
    938	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    939	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    940	BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
    941	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
    942	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
    943	BPF_MOV64_IMM(BPF_REG_0, 0),
    944	BPF_EXIT_INSN(),
    945	},
    946	.result = ACCEPT,
    947	.prog_type = BPF_PROG_TYPE_XDP,
    948	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    949},
    950{
    951	"XDP pkt read, pkt_meta' < pkt_data, corner case -1, bad access",
    952	.insns = {
    953	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
    954		    offsetof(struct xdp_md, data_meta)),
    955	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
    956	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    957	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
    958	BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
    959	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
    960	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
    961	BPF_MOV64_IMM(BPF_REG_0, 0),
    962	BPF_EXIT_INSN(),
    963	},
    964	.errstr = "R1 offset is outside of the packet",
    965	.result = REJECT,
    966	.prog_type = BPF_PROG_TYPE_XDP,
    967	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    968},
    969{
    970	"XDP pkt read, pkt_meta' < pkt_data, bad access 2",
    971	.insns = {
    972	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
    973		    offsetof(struct xdp_md, data_meta)),
    974	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
    975	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    976	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
    977	BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
    978	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
    979	BPF_MOV64_IMM(BPF_REG_0, 0),
    980	BPF_EXIT_INSN(),
    981	},
    982	.errstr = "R1 offset is outside of the packet",
    983	.result = REJECT,
    984	.prog_type = BPF_PROG_TYPE_XDP,
    985	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    986},
    987{
    988	"XDP pkt read, pkt_meta' < pkt_data, corner case, good access",
    989	.insns = {
    990	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
    991		    offsetof(struct xdp_md, data_meta)),
    992	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
    993	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
    994	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
    995	BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
    996	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
    997	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
    998	BPF_MOV64_IMM(BPF_REG_0, 0),
    999	BPF_EXIT_INSN(),
   1000	},
   1001	.result = ACCEPT,
   1002	.prog_type = BPF_PROG_TYPE_XDP,
   1003	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1004},
   1005{
   1006	"XDP pkt read, pkt_meta' < pkt_data, corner case +1, good access",
   1007	.insns = {
   1008	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
   1009		    offsetof(struct xdp_md, data_meta)),
   1010	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
   1011	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   1012	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
   1013	BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
   1014	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
   1015	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
   1016	BPF_MOV64_IMM(BPF_REG_0, 0),
   1017	BPF_EXIT_INSN(),
   1018	},
   1019	.result = ACCEPT,
   1020	.prog_type = BPF_PROG_TYPE_XDP,
   1021	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1022},
   1023{
   1024	"XDP pkt read, pkt_data < pkt_meta', corner case, good access",
   1025	.insns = {
   1026	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
   1027		    offsetof(struct xdp_md, data_meta)),
   1028	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
   1029	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   1030	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
   1031	BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
   1032	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
   1033	BPF_MOV64_IMM(BPF_REG_0, 0),
   1034	BPF_EXIT_INSN(),
   1035	},
   1036	.result = ACCEPT,
   1037	.prog_type = BPF_PROG_TYPE_XDP,
   1038	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1039},
   1040{
   1041	"XDP pkt read, pkt_data < pkt_meta', bad access 1",
   1042	.insns = {
   1043	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
   1044		    offsetof(struct xdp_md, data_meta)),
   1045	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
   1046	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   1047	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
   1048	BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
   1049	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
   1050	BPF_MOV64_IMM(BPF_REG_0, 0),
   1051	BPF_EXIT_INSN(),
   1052	},
   1053	.errstr = "R1 offset is outside of the packet",
   1054	.result = REJECT,
   1055	.prog_type = BPF_PROG_TYPE_XDP,
   1056	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1057},
   1058{
   1059	"XDP pkt read, pkt_data < pkt_meta', bad access 2",
   1060	.insns = {
   1061	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
   1062		    offsetof(struct xdp_md, data_meta)),
   1063	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
   1064	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   1065	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
   1066	BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 0),
   1067	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
   1068	BPF_MOV64_IMM(BPF_REG_0, 0),
   1069	BPF_EXIT_INSN(),
   1070	},
   1071	.errstr = "R1 offset is outside of the packet",
   1072	.result = REJECT,
   1073	.prog_type = BPF_PROG_TYPE_XDP,
   1074	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1075},
   1076{
   1077	"XDP pkt read, pkt_data < pkt_meta', corner case +1, good access",
   1078	.insns = {
   1079	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
   1080		    offsetof(struct xdp_md, data_meta)),
   1081	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
   1082	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   1083	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9),
   1084	BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
   1085	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9),
   1086	BPF_MOV64_IMM(BPF_REG_0, 0),
   1087	BPF_EXIT_INSN(),
   1088	},
   1089	.result = ACCEPT,
   1090	.prog_type = BPF_PROG_TYPE_XDP,
   1091	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1092},
   1093{
   1094	"XDP pkt read, pkt_data < pkt_meta', corner case -1, bad access",
   1095	.insns = {
   1096	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
   1097		    offsetof(struct xdp_md, data_meta)),
   1098	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
   1099	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   1100	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
   1101	BPF_JMP_REG(BPF_JLT, BPF_REG_3, BPF_REG_1, 1),
   1102	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
   1103	BPF_MOV64_IMM(BPF_REG_0, 0),
   1104	BPF_EXIT_INSN(),
   1105	},
   1106	.errstr = "R1 offset is outside of the packet",
   1107	.result = REJECT,
   1108	.prog_type = BPF_PROG_TYPE_XDP,
   1109	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1110},
   1111{
   1112	"XDP pkt read, pkt_meta' >= pkt_data, good access",
   1113	.insns = {
   1114	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
   1115		    offsetof(struct xdp_md, data_meta)),
   1116	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
   1117	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   1118	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
   1119	BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
   1120	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
   1121	BPF_MOV64_IMM(BPF_REG_0, 0),
   1122	BPF_EXIT_INSN(),
   1123	},
   1124	.result = ACCEPT,
   1125	.prog_type = BPF_PROG_TYPE_XDP,
   1126	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1127},
   1128{
   1129	"XDP pkt read, pkt_meta' >= pkt_data, corner case -1, bad access",
   1130	.insns = {
   1131	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
   1132		    offsetof(struct xdp_md, data_meta)),
   1133	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
   1134	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   1135	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
   1136	BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
   1137	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
   1138	BPF_MOV64_IMM(BPF_REG_0, 0),
   1139	BPF_EXIT_INSN(),
   1140	},
   1141	.errstr = "R1 offset is outside of the packet",
   1142	.result = REJECT,
   1143	.prog_type = BPF_PROG_TYPE_XDP,
   1144	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1145},
   1146{
   1147	"XDP pkt read, pkt_meta' >= pkt_data, bad access 2",
   1148	.insns = {
   1149	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
   1150		    offsetof(struct xdp_md, data_meta)),
   1151	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
   1152	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   1153	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
   1154	BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 0),
   1155	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
   1156	BPF_MOV64_IMM(BPF_REG_0, 0),
   1157	BPF_EXIT_INSN(),
   1158	},
   1159	.errstr = "R1 offset is outside of the packet",
   1160	.result = REJECT,
   1161	.prog_type = BPF_PROG_TYPE_XDP,
   1162	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1163},
   1164{
   1165	"XDP pkt read, pkt_meta' >= pkt_data, corner case, good access",
   1166	.insns = {
   1167	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
   1168		    offsetof(struct xdp_md, data_meta)),
   1169	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
   1170	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   1171	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
   1172	BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
   1173	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
   1174	BPF_MOV64_IMM(BPF_REG_0, 0),
   1175	BPF_EXIT_INSN(),
   1176	},
   1177	.result = ACCEPT,
   1178	.prog_type = BPF_PROG_TYPE_XDP,
   1179	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1180},
   1181{
   1182	"XDP pkt read, pkt_meta' >= pkt_data, corner case +1, good access",
   1183	.insns = {
   1184	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
   1185		    offsetof(struct xdp_md, data_meta)),
   1186	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
   1187	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   1188	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
   1189	BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
   1190	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
   1191	BPF_MOV64_IMM(BPF_REG_0, 0),
   1192	BPF_EXIT_INSN(),
   1193	},
   1194	.result = ACCEPT,
   1195	.prog_type = BPF_PROG_TYPE_XDP,
   1196	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1197},
   1198{
   1199	"XDP pkt read, pkt_data >= pkt_meta', corner case, good access",
   1200	.insns = {
   1201	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
   1202		    offsetof(struct xdp_md, data_meta)),
   1203	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
   1204	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   1205	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
   1206	BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
   1207	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
   1208	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
   1209	BPF_MOV64_IMM(BPF_REG_0, 0),
   1210	BPF_EXIT_INSN(),
   1211	},
   1212	.result = ACCEPT,
   1213	.prog_type = BPF_PROG_TYPE_XDP,
   1214	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1215},
   1216{
   1217	"XDP pkt read, pkt_data >= pkt_meta', bad access 1",
   1218	.insns = {
   1219	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
   1220		    offsetof(struct xdp_md, data_meta)),
   1221	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
   1222	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   1223	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
   1224	BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
   1225	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
   1226	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
   1227	BPF_MOV64_IMM(BPF_REG_0, 0),
   1228	BPF_EXIT_INSN(),
   1229	},
   1230	.errstr = "R1 offset is outside of the packet",
   1231	.result = REJECT,
   1232	.prog_type = BPF_PROG_TYPE_XDP,
   1233	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1234},
   1235{
   1236	"XDP pkt read, pkt_data >= pkt_meta', bad access 2",
   1237	.insns = {
   1238	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
   1239		    offsetof(struct xdp_md, data_meta)),
   1240	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
   1241	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   1242	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
   1243	BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
   1244	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
   1245	BPF_MOV64_IMM(BPF_REG_0, 0),
   1246	BPF_EXIT_INSN(),
   1247	},
   1248	.errstr = "R1 offset is outside of the packet",
   1249	.result = REJECT,
   1250	.prog_type = BPF_PROG_TYPE_XDP,
   1251	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1252},
   1253{
   1254	"XDP pkt read, pkt_data >= pkt_meta', corner case +1, good access",
   1255	.insns = {
   1256	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
   1257		    offsetof(struct xdp_md, data_meta)),
   1258	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
   1259	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   1260	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9),
   1261	BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
   1262	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
   1263	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9),
   1264	BPF_MOV64_IMM(BPF_REG_0, 0),
   1265	BPF_EXIT_INSN(),
   1266	},
   1267	.result = ACCEPT,
   1268	.prog_type = BPF_PROG_TYPE_XDP,
   1269	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1270},
   1271{
   1272	"XDP pkt read, pkt_data >= pkt_meta', corner case -1, bad access",
   1273	.insns = {
   1274	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
   1275		    offsetof(struct xdp_md, data_meta)),
   1276	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
   1277	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   1278	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
   1279	BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_1, 1),
   1280	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
   1281	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
   1282	BPF_MOV64_IMM(BPF_REG_0, 0),
   1283	BPF_EXIT_INSN(),
   1284	},
   1285	.errstr = "R1 offset is outside of the packet",
   1286	.result = REJECT,
   1287	.prog_type = BPF_PROG_TYPE_XDP,
   1288	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1289},
   1290{
   1291	"XDP pkt read, pkt_meta' <= pkt_data, corner case, good access",
   1292	.insns = {
   1293	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
   1294		    offsetof(struct xdp_md, data_meta)),
   1295	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
   1296	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   1297	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
   1298	BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
   1299	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
   1300	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
   1301	BPF_MOV64_IMM(BPF_REG_0, 0),
   1302	BPF_EXIT_INSN(),
   1303	},
   1304	.result = ACCEPT,
   1305	.prog_type = BPF_PROG_TYPE_XDP,
   1306	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1307},
   1308{
   1309	"XDP pkt read, pkt_meta' <= pkt_data, bad access 1",
   1310	.insns = {
   1311	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
   1312		    offsetof(struct xdp_md, data_meta)),
   1313	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
   1314	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   1315	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
   1316	BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
   1317	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
   1318	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -4),
   1319	BPF_MOV64_IMM(BPF_REG_0, 0),
   1320	BPF_EXIT_INSN(),
   1321	},
   1322	.errstr = "R1 offset is outside of the packet",
   1323	.result = REJECT,
   1324	.prog_type = BPF_PROG_TYPE_XDP,
   1325	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1326},
   1327{
   1328	"XDP pkt read, pkt_meta' <= pkt_data, bad access 2",
   1329	.insns = {
   1330	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
   1331		    offsetof(struct xdp_md, data_meta)),
   1332	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
   1333	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   1334	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
   1335	BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
   1336	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
   1337	BPF_MOV64_IMM(BPF_REG_0, 0),
   1338	BPF_EXIT_INSN(),
   1339	},
   1340	.errstr = "R1 offset is outside of the packet",
   1341	.result = REJECT,
   1342	.prog_type = BPF_PROG_TYPE_XDP,
   1343	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1344},
   1345{
   1346	"XDP pkt read, pkt_meta' <= pkt_data, corner case +1, good access",
   1347	.insns = {
   1348	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
   1349		    offsetof(struct xdp_md, data_meta)),
   1350	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
   1351	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   1352	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 9),
   1353	BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
   1354	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
   1355	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -9),
   1356	BPF_MOV64_IMM(BPF_REG_0, 0),
   1357	BPF_EXIT_INSN(),
   1358	},
   1359	.result = ACCEPT,
   1360	.prog_type = BPF_PROG_TYPE_XDP,
   1361	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1362},
   1363{
   1364	"XDP pkt read, pkt_meta' <= pkt_data, corner case -1, bad access",
   1365	.insns = {
   1366	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
   1367		    offsetof(struct xdp_md, data_meta)),
   1368	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
   1369	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   1370	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
   1371	BPF_JMP_REG(BPF_JLE, BPF_REG_1, BPF_REG_3, 1),
   1372	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
   1373	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
   1374	BPF_MOV64_IMM(BPF_REG_0, 0),
   1375	BPF_EXIT_INSN(),
   1376	},
   1377	.errstr = "R1 offset is outside of the packet",
   1378	.result = REJECT,
   1379	.prog_type = BPF_PROG_TYPE_XDP,
   1380	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1381},
   1382{
   1383	"XDP pkt read, pkt_data <= pkt_meta', good access",
   1384	.insns = {
   1385	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
   1386		    offsetof(struct xdp_md, data_meta)),
   1387	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
   1388	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   1389	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
   1390	BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
   1391	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
   1392	BPF_MOV64_IMM(BPF_REG_0, 0),
   1393	BPF_EXIT_INSN(),
   1394	},
   1395	.result = ACCEPT,
   1396	.prog_type = BPF_PROG_TYPE_XDP,
   1397	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1398},
   1399{
   1400	"XDP pkt read, pkt_data <= pkt_meta', corner case -1, bad access",
   1401	.insns = {
   1402	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
   1403		    offsetof(struct xdp_md, data_meta)),
   1404	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
   1405	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   1406	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
   1407	BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
   1408	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
   1409	BPF_MOV64_IMM(BPF_REG_0, 0),
   1410	BPF_EXIT_INSN(),
   1411	},
   1412	.errstr = "R1 offset is outside of the packet",
   1413	.result = REJECT,
   1414	.prog_type = BPF_PROG_TYPE_XDP,
   1415	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1416},
   1417{
   1418	"XDP pkt read, pkt_data <= pkt_meta', bad access 2",
   1419	.insns = {
   1420	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
   1421		    offsetof(struct xdp_md, data_meta)),
   1422	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
   1423	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   1424	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
   1425	BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 0),
   1426	BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, -5),
   1427	BPF_MOV64_IMM(BPF_REG_0, 0),
   1428	BPF_EXIT_INSN(),
   1429	},
   1430	.errstr = "R1 offset is outside of the packet",
   1431	.result = REJECT,
   1432	.prog_type = BPF_PROG_TYPE_XDP,
   1433	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1434},
   1435{
   1436	"XDP pkt read, pkt_data <= pkt_meta', corner case, good access",
   1437	.insns = {
   1438	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
   1439		    offsetof(struct xdp_md, data_meta)),
   1440	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
   1441	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   1442	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 7),
   1443	BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
   1444	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -7),
   1445	BPF_MOV64_IMM(BPF_REG_0, 0),
   1446	BPF_EXIT_INSN(),
   1447	},
   1448	.result = ACCEPT,
   1449	.prog_type = BPF_PROG_TYPE_XDP,
   1450	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1451},
   1452{
   1453	"XDP pkt read, pkt_data <= pkt_meta', corner case +1, good access",
   1454	.insns = {
   1455	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
   1456		    offsetof(struct xdp_md, data_meta)),
   1457	BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
   1458	BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
   1459	BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
   1460	BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
   1461	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
   1462	BPF_MOV64_IMM(BPF_REG_0, 0),
   1463	BPF_EXIT_INSN(),
   1464	},
   1465	.result = ACCEPT,
   1466	.prog_type = BPF_PROG_TYPE_XDP,
   1467	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
   1468},