xref: /linux/tools/testing/selftests/bpf/verifier/jmp32.c (revision 0e9ab8e4d44ae9d9aaf213bfd2c90bbe7289337b)
1 {
2 	"jset32: BPF_K",
3 	.insns = {
4 	BPF_DIRECT_PKT_R2,
5 	BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
6 	/* reg, high bits shouldn't be tested */
7 	BPF_JMP32_IMM(BPF_JSET, BPF_REG_7, -2, 1),
8 	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
9 	BPF_EXIT_INSN(),
10 
11 	BPF_JMP32_IMM(BPF_JSET, BPF_REG_7, 1, 1),
12 	BPF_EXIT_INSN(),
13 	BPF_MOV64_IMM(BPF_REG_0, 2),
14 	BPF_EXIT_INSN(),
15 	},
16 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
17 	.result = ACCEPT,
18 	.runs = 3,
19 	.retvals = {
20 		{ .retval = 0,
21 		  .data64 = { 1ULL << 63, }
22 		},
23 		{ .retval = 2,
24 		  .data64 = { 1, }
25 		},
26 		{ .retval = 2,
27 		  .data64 = { 1ULL << 63 | 1, }
28 		},
29 	},
30 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
31 },
32 {
33 	"jset32: BPF_X",
34 	.insns = {
35 	BPF_DIRECT_PKT_R2,
36 	BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
37 	BPF_LD_IMM64(BPF_REG_8, 0x8000000000000000),
38 	BPF_JMP32_REG(BPF_JSET, BPF_REG_7, BPF_REG_8, 1),
39 	BPF_JMP_IMM(BPF_JA, 0, 0, 1),
40 	BPF_EXIT_INSN(),
41 
42 	BPF_LD_IMM64(BPF_REG_8, 0x8000000000000001),
43 	BPF_JMP32_REG(BPF_JSET, BPF_REG_7, BPF_REG_8, 1),
44 	BPF_EXIT_INSN(),
45 	BPF_MOV64_IMM(BPF_REG_0, 2),
46 	BPF_EXIT_INSN(),
47 	},
48 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
49 	.result = ACCEPT,
50 	.runs = 3,
51 	.retvals = {
52 		{ .retval = 0,
53 		  .data64 = { 1ULL << 63, }
54 		},
55 		{ .retval = 2,
56 		  .data64 = { 1, }
57 		},
58 		{ .retval = 2,
59 		  .data64 = { 1ULL << 63 | 1, }
60 		},
61 	},
62 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
63 },
64 {
65 	"jset32: ignores upper bits",
66 	.insns = {
67 	BPF_MOV64_IMM(BPF_REG_0, 0),
68 	BPF_LD_IMM64(BPF_REG_7, 0x8000000000000000),
69 	BPF_LD_IMM64(BPF_REG_8, 0x8000000000000000),
70 	BPF_JMP_REG(BPF_JSET, BPF_REG_7, BPF_REG_8, 1),
71 	BPF_EXIT_INSN(),
72 	BPF_JMP32_REG(BPF_JSET, BPF_REG_7, BPF_REG_8, 1),
73 	BPF_MOV64_IMM(BPF_REG_0, 2),
74 	BPF_EXIT_INSN(),
75 	},
76 	.result = ACCEPT,
77 	.retval = 2,
78 },
79 {
80 	"jset32: min/max deduction",
81 	.insns = {
82 	BPF_RAND_UEXT_R7,
83 	BPF_MOV64_IMM(BPF_REG_0, 0),
84 	BPF_JMP32_IMM(BPF_JSET, BPF_REG_7, 0x10, 1),
85 	BPF_EXIT_INSN(),
86 	BPF_JMP32_IMM(BPF_JGE, BPF_REG_7, 0x10, 1),
87 	BPF_LDX_MEM(BPF_B, BPF_REG_8, BPF_REG_9, 0),
88 	BPF_EXIT_INSN(),
89 	},
90 	.errstr_unpriv = "R9 !read_ok",
91 	.result_unpriv = REJECT,
92 	.result = ACCEPT,
93 },
94 {
95 	"jeq32: BPF_K",
96 	.insns = {
97 	BPF_DIRECT_PKT_R2,
98 	BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
99 	BPF_JMP32_IMM(BPF_JEQ, BPF_REG_7, -1, 1),
100 	BPF_EXIT_INSN(),
101 	BPF_MOV64_IMM(BPF_REG_0, 2),
102 	BPF_EXIT_INSN(),
103 	},
104 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
105 	.result = ACCEPT,
106 	.runs = 2,
107 	.retvals = {
108 		{ .retval = 0,
109 		  .data64 = { -2, }
110 		},
111 		{ .retval = 2,
112 		  .data64 = { -1, }
113 		},
114 	},
115 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
116 },
117 {
118 	"jeq32: BPF_X",
119 	.insns = {
120 	BPF_DIRECT_PKT_R2,
121 	BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
122 	BPF_LD_IMM64(BPF_REG_8, 0x7000000000000001),
123 	BPF_JMP32_REG(BPF_JEQ, BPF_REG_7, BPF_REG_8, 1),
124 	BPF_EXIT_INSN(),
125 	BPF_MOV64_IMM(BPF_REG_0, 2),
126 	BPF_EXIT_INSN(),
127 	},
128 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
129 	.result = ACCEPT,
130 	.runs = 3,
131 	.retvals = {
132 		{ .retval = 0,
133 		  .data64 = { 2, }
134 		},
135 		{ .retval = 2,
136 		  .data64 = { 1, }
137 		},
138 		{ .retval = 2,
139 		  .data64 = { 1ULL << 63 | 1, }
140 		},
141 	},
142 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
143 },
144 {
145 	"jeq32: min/max deduction",
146 	.insns = {
147 	BPF_RAND_UEXT_R7,
148 	BPF_MOV64_IMM(BPF_REG_0, 0),
149 	BPF_JMP32_IMM(BPF_JEQ, BPF_REG_7, 0x10, 1),
150 	BPF_EXIT_INSN(),
151 	BPF_JMP32_IMM(BPF_JSGE, BPF_REG_7, 0xf, 1),
152 	BPF_LDX_MEM(BPF_B, BPF_REG_8, BPF_REG_9, 0),
153 	BPF_EXIT_INSN(),
154 	},
155 	.errstr_unpriv = "R9 !read_ok",
156 	.result_unpriv = REJECT,
157 	.result = ACCEPT,
158 },
159 {
160 	"jne32: BPF_K",
161 	.insns = {
162 	BPF_DIRECT_PKT_R2,
163 	BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
164 	BPF_JMP32_IMM(BPF_JNE, BPF_REG_7, -1, 1),
165 	BPF_EXIT_INSN(),
166 	BPF_MOV64_IMM(BPF_REG_0, 2),
167 	BPF_EXIT_INSN(),
168 	},
169 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
170 	.result = ACCEPT,
171 	.runs = 2,
172 	.retvals = {
173 		{ .retval = 2,
174 		  .data64 = { 1, }
175 		},
176 		{ .retval = 0,
177 		  .data64 = { -1, }
178 		},
179 	},
180 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
181 },
182 {
183 	"jne32: BPF_X",
184 	.insns = {
185 	BPF_DIRECT_PKT_R2,
186 	BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
187 	BPF_LD_IMM64(BPF_REG_8, 0x8000000000000001),
188 	BPF_JMP32_REG(BPF_JNE, BPF_REG_7, BPF_REG_8, 1),
189 	BPF_EXIT_INSN(),
190 	BPF_MOV64_IMM(BPF_REG_0, 2),
191 	BPF_EXIT_INSN(),
192 	},
193 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
194 	.result = ACCEPT,
195 	.runs = 3,
196 	.retvals = {
197 		{ .retval = 0,
198 		  .data64 = { 1, }
199 		},
200 		{ .retval = 2,
201 		  .data64 = { 2, }
202 		},
203 		{ .retval = 2,
204 		  .data64 = { 1ULL << 63 | 2, }
205 		},
206 	},
207 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
208 },
209 {
210 	"jne32: min/max deduction",
211 	.insns = {
212 	BPF_RAND_UEXT_R7,
213 	BPF_MOV64_IMM(BPF_REG_0, 0),
214 	BPF_JMP32_IMM(BPF_JNE, BPF_REG_7, 0x10, 1),
215 	BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x10, 1),
216 	BPF_EXIT_INSN(),
217 	BPF_LDX_MEM(BPF_B, BPF_REG_8, BPF_REG_9, 0),
218 	BPF_EXIT_INSN(),
219 	},
220 	.errstr_unpriv = "R9 !read_ok",
221 	.result_unpriv = REJECT,
222 	.result = ACCEPT,
223 },
224 {
225 	"jge32: BPF_K",
226 	.insns = {
227 	BPF_DIRECT_PKT_R2,
228 	BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
229 	BPF_JMP32_IMM(BPF_JGE, BPF_REG_7, UINT_MAX - 1, 1),
230 	BPF_EXIT_INSN(),
231 	BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
232 	BPF_EXIT_INSN(),
233 	},
234 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
235 	.result = ACCEPT,
236 	.runs = 3,
237 	.retvals = {
238 		{ .retval = 2,
239 		  .data64 = { UINT_MAX, }
240 		},
241 		{ .retval = 2,
242 		  .data64 = { UINT_MAX - 1, }
243 		},
244 		{ .retval = 0,
245 		  .data64 = { 0, }
246 		},
247 	},
248 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
249 },
250 {
251 	"jge32: BPF_X",
252 	.insns = {
253 	BPF_DIRECT_PKT_R2,
254 	BPF_LD_IMM64(BPF_REG_8, UINT_MAX | 1ULL << 32),
255 	BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
256 	BPF_JMP32_REG(BPF_JGE, BPF_REG_7, BPF_REG_8, 1),
257 	BPF_EXIT_INSN(),
258 	BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
259 	BPF_EXIT_INSN(),
260 	},
261 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
262 	.result = ACCEPT,
263 	.runs = 3,
264 	.retvals = {
265 		{ .retval = 2,
266 		  .data64 = { UINT_MAX, }
267 		},
268 		{ .retval = 0,
269 		  .data64 = { INT_MAX, }
270 		},
271 		{ .retval = 0,
272 		  .data64 = { (UINT_MAX - 1) | 2ULL << 32, }
273 		},
274 	},
275 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
276 },
277 {
278 	"jge32: min/max deduction",
279 	.insns = {
280 	BPF_RAND_UEXT_R7,
281 	BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
282 	BPF_LD_IMM64(BPF_REG_8, 0x7ffffff0 | 1ULL << 32),
283 	BPF_JMP32_REG(BPF_JGE, BPF_REG_7, BPF_REG_8, 1),
284 	BPF_EXIT_INSN(),
285 	BPF_JMP32_IMM(BPF_JGE, BPF_REG_7, 0x7ffffff0, 1),
286 	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
287 	BPF_EXIT_INSN(),
288 	},
289 	.errstr_unpriv = "R0 invalid mem access 'scalar'",
290 	.result_unpriv = REJECT,
291 	.result = ACCEPT,
292 	.retval = 2,
293 },
294 {
295 	"jgt32: BPF_K",
296 	.insns = {
297 	BPF_DIRECT_PKT_R2,
298 	BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
299 	BPF_JMP32_IMM(BPF_JGT, BPF_REG_7, UINT_MAX - 1, 1),
300 	BPF_EXIT_INSN(),
301 	BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
302 	BPF_EXIT_INSN(),
303 	},
304 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
305 	.result = ACCEPT,
306 	.runs = 3,
307 	.retvals = {
308 		{ .retval = 2,
309 		  .data64 = { UINT_MAX, }
310 		},
311 		{ .retval = 0,
312 		  .data64 = { UINT_MAX - 1, }
313 		},
314 		{ .retval = 0,
315 		  .data64 = { 0, }
316 		},
317 	},
318 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
319 },
320 {
321 	"jgt32: BPF_X",
322 	.insns = {
323 	BPF_DIRECT_PKT_R2,
324 	BPF_LD_IMM64(BPF_REG_8, (UINT_MAX - 1) | 1ULL << 32),
325 	BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
326 	BPF_JMP32_REG(BPF_JGT, BPF_REG_7, BPF_REG_8, 1),
327 	BPF_EXIT_INSN(),
328 	BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
329 	BPF_EXIT_INSN(),
330 	},
331 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
332 	.result = ACCEPT,
333 	.runs = 3,
334 	.retvals = {
335 		{ .retval = 2,
336 		  .data64 = { UINT_MAX, }
337 		},
338 		{ .retval = 0,
339 		  .data64 = { UINT_MAX - 1, }
340 		},
341 		{ .retval = 0,
342 		  .data64 = { (UINT_MAX - 1) | 2ULL << 32, }
343 		},
344 	},
345 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
346 },
347 {
348 	"jgt32: min/max deduction",
349 	.insns = {
350 	BPF_RAND_UEXT_R7,
351 	BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
352 	BPF_LD_IMM64(BPF_REG_8, 0x7ffffff0 | 1ULL << 32),
353 	BPF_JMP32_REG(BPF_JGT, BPF_REG_7, BPF_REG_8, 1),
354 	BPF_EXIT_INSN(),
355 	BPF_JMP_IMM(BPF_JGT, BPF_REG_7, 0x7ffffff0, 1),
356 	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
357 	BPF_EXIT_INSN(),
358 	},
359 	.errstr_unpriv = "R0 invalid mem access 'scalar'",
360 	.result_unpriv = REJECT,
361 	.result = ACCEPT,
362 	.retval = 2,
363 },
364 {
365 	"jle32: BPF_K",
366 	.insns = {
367 	BPF_DIRECT_PKT_R2,
368 	BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
369 	BPF_JMP32_IMM(BPF_JLE, BPF_REG_7, INT_MAX, 1),
370 	BPF_EXIT_INSN(),
371 	BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
372 	BPF_EXIT_INSN(),
373 	},
374 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
375 	.result = ACCEPT,
376 	.runs = 3,
377 	.retvals = {
378 		{ .retval = 2,
379 		  .data64 = { INT_MAX - 1, }
380 		},
381 		{ .retval = 0,
382 		  .data64 = { UINT_MAX, }
383 		},
384 		{ .retval = 2,
385 		  .data64 = { INT_MAX, }
386 		},
387 	},
388 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
389 },
390 {
391 	"jle32: BPF_X",
392 	.insns = {
393 	BPF_DIRECT_PKT_R2,
394 	BPF_LD_IMM64(BPF_REG_8, (INT_MAX - 1) | 2ULL << 32),
395 	BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
396 	BPF_JMP32_REG(BPF_JLE, BPF_REG_7, BPF_REG_8, 1),
397 	BPF_EXIT_INSN(),
398 	BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
399 	BPF_EXIT_INSN(),
400 	},
401 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
402 	.result = ACCEPT,
403 	.runs = 3,
404 	.retvals = {
405 		{ .retval = 0,
406 		  .data64 = { INT_MAX | 1ULL << 32, }
407 		},
408 		{ .retval = 2,
409 		  .data64 = { INT_MAX - 2, }
410 		},
411 		{ .retval = 0,
412 		  .data64 = { UINT_MAX, }
413 		},
414 	},
415 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
416 },
417 {
418 	"jle32: min/max deduction",
419 	.insns = {
420 	BPF_RAND_UEXT_R7,
421 	BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
422 	BPF_LD_IMM64(BPF_REG_8, 0x7ffffff0 | 1ULL << 32),
423 	BPF_JMP32_REG(BPF_JLE, BPF_REG_7, BPF_REG_8, 1),
424 	BPF_EXIT_INSN(),
425 	BPF_JMP32_IMM(BPF_JLE, BPF_REG_7, 0x7ffffff0, 1),
426 	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
427 	BPF_EXIT_INSN(),
428 	},
429 	.errstr_unpriv = "R0 invalid mem access 'scalar'",
430 	.result_unpriv = REJECT,
431 	.result = ACCEPT,
432 	.retval = 2,
433 },
434 {
435 	"jlt32: BPF_K",
436 	.insns = {
437 	BPF_DIRECT_PKT_R2,
438 	BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
439 	BPF_JMP32_IMM(BPF_JLT, BPF_REG_7, INT_MAX, 1),
440 	BPF_EXIT_INSN(),
441 	BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
442 	BPF_EXIT_INSN(),
443 	},
444 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
445 	.result = ACCEPT,
446 	.runs = 3,
447 	.retvals = {
448 		{ .retval = 0,
449 		  .data64 = { INT_MAX, }
450 		},
451 		{ .retval = 0,
452 		  .data64 = { UINT_MAX, }
453 		},
454 		{ .retval = 2,
455 		  .data64 = { INT_MAX - 1, }
456 		},
457 	},
458 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
459 },
460 {
461 	"jlt32: BPF_X",
462 	.insns = {
463 	BPF_DIRECT_PKT_R2,
464 	BPF_LD_IMM64(BPF_REG_8, INT_MAX | 2ULL << 32),
465 	BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
466 	BPF_JMP32_REG(BPF_JLT, BPF_REG_7, BPF_REG_8, 1),
467 	BPF_EXIT_INSN(),
468 	BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
469 	BPF_EXIT_INSN(),
470 	},
471 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
472 	.result = ACCEPT,
473 	.runs = 3,
474 	.retvals = {
475 		{ .retval = 0,
476 		  .data64 = { INT_MAX | 1ULL << 32, }
477 		},
478 		{ .retval = 0,
479 		  .data64 = { UINT_MAX, }
480 		},
481 		{ .retval = 2,
482 		  .data64 = { (INT_MAX - 1) | 3ULL << 32, }
483 		},
484 	},
485 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
486 },
487 {
488 	"jlt32: min/max deduction",
489 	.insns = {
490 	BPF_RAND_UEXT_R7,
491 	BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
492 	BPF_LD_IMM64(BPF_REG_8, 0x7ffffff0 | 1ULL << 32),
493 	BPF_JMP32_REG(BPF_JLT, BPF_REG_7, BPF_REG_8, 1),
494 	BPF_EXIT_INSN(),
495 	BPF_JMP_IMM(BPF_JSLT, BPF_REG_7, 0x7ffffff0, 1),
496 	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
497 	BPF_EXIT_INSN(),
498 	},
499 	.errstr_unpriv = "R0 invalid mem access 'scalar'",
500 	.result_unpriv = REJECT,
501 	.result = ACCEPT,
502 	.retval = 2,
503 },
504 {
505 	"jsge32: BPF_K",
506 	.insns = {
507 	BPF_DIRECT_PKT_R2,
508 	BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
509 	BPF_JMP32_IMM(BPF_JSGE, BPF_REG_7, -1, 1),
510 	BPF_EXIT_INSN(),
511 	BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
512 	BPF_EXIT_INSN(),
513 	},
514 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
515 	.result = ACCEPT,
516 	.runs = 3,
517 	.retvals = {
518 		{ .retval = 2,
519 		  .data64 = { 0, }
520 		},
521 		{ .retval = 2,
522 		  .data64 = { -1, }
523 		},
524 		{ .retval = 0,
525 		  .data64 = { -2, }
526 		},
527 	},
528 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
529 },
530 {
531 	"jsge32: BPF_X",
532 	.insns = {
533 	BPF_DIRECT_PKT_R2,
534 	BPF_LD_IMM64(BPF_REG_8, (__u32)-1 | 2ULL << 32),
535 	BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
536 	BPF_JMP32_REG(BPF_JSGE, BPF_REG_7, BPF_REG_8, 1),
537 	BPF_EXIT_INSN(),
538 	BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
539 	BPF_EXIT_INSN(),
540 	},
541 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
542 	.result = ACCEPT,
543 	.runs = 3,
544 	.retvals = {
545 		{ .retval = 2,
546 		  .data64 = { -1, }
547 		},
548 		{ .retval = 2,
549 		  .data64 = { 0x7fffffff | 1ULL << 32, }
550 		},
551 		{ .retval = 0,
552 		  .data64 = { -2, }
553 		},
554 	},
555 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
556 },
557 {
558 	"jsge32: min/max deduction",
559 	.insns = {
560 	BPF_RAND_UEXT_R7,
561 	BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
562 	BPF_LD_IMM64(BPF_REG_8, 0x7ffffff0 | 1ULL << 32),
563 	BPF_JMP32_REG(BPF_JSGE, BPF_REG_7, BPF_REG_8, 1),
564 	BPF_EXIT_INSN(),
565 	BPF_JMP_IMM(BPF_JSGE, BPF_REG_7, 0x7ffffff0, 1),
566 	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
567 	BPF_EXIT_INSN(),
568 	},
569 	.errstr_unpriv = "R0 invalid mem access 'scalar'",
570 	.result_unpriv = REJECT,
571 	.result = ACCEPT,
572 	.retval = 2,
573 },
574 {
575 	"jsgt32: BPF_K",
576 	.insns = {
577 	BPF_DIRECT_PKT_R2,
578 	BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
579 	BPF_JMP32_IMM(BPF_JSGT, BPF_REG_7, -1, 1),
580 	BPF_EXIT_INSN(),
581 	BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
582 	BPF_EXIT_INSN(),
583 	},
584 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
585 	.result = ACCEPT,
586 	.runs = 3,
587 	.retvals = {
588 		{ .retval = 0,
589 		  .data64 = { (__u32)-2, }
590 		},
591 		{ .retval = 0,
592 		  .data64 = { -1, }
593 		},
594 		{ .retval = 2,
595 		  .data64 = { 1, }
596 		},
597 	},
598 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
599 },
600 {
601 	"jsgt32: BPF_X",
602 	.insns = {
603 	BPF_DIRECT_PKT_R2,
604 	BPF_LD_IMM64(BPF_REG_8, 0x7ffffffe | 1ULL << 32),
605 	BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
606 	BPF_JMP32_REG(BPF_JSGT, BPF_REG_7, BPF_REG_8, 1),
607 	BPF_EXIT_INSN(),
608 	BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
609 	BPF_EXIT_INSN(),
610 	},
611 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
612 	.result = ACCEPT,
613 	.runs = 3,
614 	.retvals = {
615 		{ .retval = 0,
616 		  .data64 = { 0x7ffffffe, }
617 		},
618 		{ .retval = 0,
619 		  .data64 = { 0x1ffffffffULL, }
620 		},
621 		{ .retval = 2,
622 		  .data64 = { 0x7fffffff, }
623 		},
624 	},
625 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
626 },
627 {
628 	"jsgt32: min/max deduction",
629 	.insns = {
630 	BPF_RAND_SEXT_R7,
631 	BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
632 	BPF_LD_IMM64(BPF_REG_8, (__u32)(-2) | 1ULL << 32),
633 	BPF_JMP32_REG(BPF_JSGT, BPF_REG_7, BPF_REG_8, 1),
634 	BPF_EXIT_INSN(),
635 	BPF_JMP_IMM(BPF_JSGT, BPF_REG_7, -2, 1),
636 	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
637 	BPF_EXIT_INSN(),
638 	},
639 	.errstr_unpriv = "R0 invalid mem access 'scalar'",
640 	.result_unpriv = REJECT,
641 	.result = ACCEPT,
642 	.retval = 2,
643 },
644 {
645 	"jsle32: BPF_K",
646 	.insns = {
647 	BPF_DIRECT_PKT_R2,
648 	BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
649 	BPF_JMP32_IMM(BPF_JSLE, BPF_REG_7, -1, 1),
650 	BPF_EXIT_INSN(),
651 	BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
652 	BPF_EXIT_INSN(),
653 	},
654 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
655 	.result = ACCEPT,
656 	.runs = 3,
657 	.retvals = {
658 		{ .retval = 2,
659 		  .data64 = { (__u32)-2, }
660 		},
661 		{ .retval = 2,
662 		  .data64 = { -1, }
663 		},
664 		{ .retval = 0,
665 		  .data64 = { 1, }
666 		},
667 	},
668 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
669 },
670 {
671 	"jsle32: BPF_X",
672 	.insns = {
673 	BPF_DIRECT_PKT_R2,
674 	BPF_LD_IMM64(BPF_REG_8, 0x7ffffffe | 1ULL << 32),
675 	BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
676 	BPF_JMP32_REG(BPF_JSLE, BPF_REG_7, BPF_REG_8, 1),
677 	BPF_EXIT_INSN(),
678 	BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
679 	BPF_EXIT_INSN(),
680 	},
681 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
682 	.result = ACCEPT,
683 	.runs = 3,
684 	.retvals = {
685 		{ .retval = 2,
686 		  .data64 = { 0x7ffffffe, }
687 		},
688 		{ .retval = 2,
689 		  .data64 = { (__u32)-1, }
690 		},
691 		{ .retval = 0,
692 		  .data64 = { 0x7fffffff | 2ULL << 32, }
693 		},
694 	},
695 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
696 },
697 {
698 	"jsle32: min/max deduction",
699 	.insns = {
700 	BPF_RAND_UEXT_R7,
701 	BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
702 	BPF_LD_IMM64(BPF_REG_8, 0x7ffffff0 | 1ULL << 32),
703 	BPF_JMP32_REG(BPF_JSLE, BPF_REG_7, BPF_REG_8, 1),
704 	BPF_EXIT_INSN(),
705 	BPF_JMP_IMM(BPF_JSLE, BPF_REG_7, 0x7ffffff0, 1),
706 	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
707 	BPF_EXIT_INSN(),
708 	},
709 	.errstr_unpriv = "R0 invalid mem access 'scalar'",
710 	.result_unpriv = REJECT,
711 	.result = ACCEPT,
712 	.retval = 2,
713 },
714 {
715 	"jslt32: BPF_K",
716 	.insns = {
717 	BPF_DIRECT_PKT_R2,
718 	BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
719 	BPF_JMP32_IMM(BPF_JSLT, BPF_REG_7, -1, 1),
720 	BPF_EXIT_INSN(),
721 	BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
722 	BPF_EXIT_INSN(),
723 	},
724 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
725 	.result = ACCEPT,
726 	.runs = 3,
727 	.retvals = {
728 		{ .retval = 2,
729 		  .data64 = { (__u32)-2, }
730 		},
731 		{ .retval = 0,
732 		  .data64 = { -1, }
733 		},
734 		{ .retval = 0,
735 		  .data64 = { 1, }
736 		},
737 	},
738 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
739 },
740 {
741 	"jslt32: BPF_X",
742 	.insns = {
743 	BPF_DIRECT_PKT_R2,
744 	BPF_LD_IMM64(BPF_REG_8, 0x7fffffff | 1ULL << 32),
745 	BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_2, 0),
746 	BPF_JMP32_REG(BPF_JSLT, BPF_REG_7, BPF_REG_8, 1),
747 	BPF_EXIT_INSN(),
748 	BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
749 	BPF_EXIT_INSN(),
750 	},
751 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
752 	.result = ACCEPT,
753 	.runs = 3,
754 	.retvals = {
755 		{ .retval = 2,
756 		  .data64 = { 0x7ffffffe, }
757 		},
758 		{ .retval = 2,
759 		  .data64 = { 0xffffffff, }
760 		},
761 		{ .retval = 0,
762 		  .data64 = { 0x7fffffff | 2ULL << 32, }
763 		},
764 	},
765 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
766 },
767 {
768 	"jslt32: min/max deduction",
769 	.insns = {
770 	BPF_RAND_SEXT_R7,
771 	BPF_ALU32_IMM(BPF_MOV, BPF_REG_0, 2),
772 	BPF_LD_IMM64(BPF_REG_8, (__u32)(-1) | 1ULL << 32),
773 	BPF_JMP32_REG(BPF_JSLT, BPF_REG_7, BPF_REG_8, 1),
774 	BPF_EXIT_INSN(),
775 	BPF_JMP32_IMM(BPF_JSLT, BPF_REG_7, -1, 1),
776 	BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
777 	BPF_EXIT_INSN(),
778 	},
779 	.errstr_unpriv = "R0 invalid mem access 'scalar'",
780 	.result_unpriv = REJECT,
781 	.result = ACCEPT,
782 	.retval = 2,
783 },
784 {
785 	"jgt32: range bound deduction, reg op imm",
786 	.insns = {
787 	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
788 	BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
789 	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
790 	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
791 	BPF_LD_MAP_FD(BPF_REG_1, 0),
792 	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
793 	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
794 	BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
795 	BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
796 	BPF_EMIT_CALL(BPF_FUNC_get_cgroup_classid),
797 	BPF_JMP32_IMM(BPF_JGT, BPF_REG_0, 1, 5),
798 	BPF_MOV32_REG(BPF_REG_6, BPF_REG_0),
799 	BPF_ALU64_IMM(BPF_LSH, BPF_REG_6, 32),
800 	BPF_ALU64_IMM(BPF_RSH, BPF_REG_6, 32),
801 	BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_6),
802 	BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
803 	BPF_MOV32_IMM(BPF_REG_0, 0),
804 	BPF_EXIT_INSN(),
805 	},
806 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
807 	.fixup_map_hash_48b = { 4 },
808 	.result = ACCEPT,
809 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
810 },
811 {
812 	"jgt32: range bound deduction, reg1 op reg2, reg1 unknown",
813 	.insns = {
814 	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
815 	BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
816 	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
817 	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
818 	BPF_LD_MAP_FD(BPF_REG_1, 0),
819 	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
820 	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
821 	BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
822 	BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
823 	BPF_EMIT_CALL(BPF_FUNC_get_cgroup_classid),
824 	BPF_MOV32_IMM(BPF_REG_2, 1),
825 	BPF_JMP32_REG(BPF_JGT, BPF_REG_0, BPF_REG_2, 5),
826 	BPF_MOV32_REG(BPF_REG_6, BPF_REG_0),
827 	BPF_ALU64_IMM(BPF_LSH, BPF_REG_6, 32),
828 	BPF_ALU64_IMM(BPF_RSH, BPF_REG_6, 32),
829 	BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_6),
830 	BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
831 	BPF_MOV32_IMM(BPF_REG_0, 0),
832 	BPF_EXIT_INSN(),
833 	},
834 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
835 	.fixup_map_hash_48b = { 4 },
836 	.result = ACCEPT,
837 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
838 },
839 {
840 	"jle32: range bound deduction, reg1 op reg2, reg2 unknown",
841 	.insns = {
842 	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
843 	BPF_MOV64_REG(BPF_REG_8, BPF_REG_1),
844 	BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
845 	BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
846 	BPF_LD_MAP_FD(BPF_REG_1, 0),
847 	BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
848 	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 10),
849 	BPF_MOV64_REG(BPF_REG_1, BPF_REG_8),
850 	BPF_MOV64_REG(BPF_REG_8, BPF_REG_0),
851 	BPF_EMIT_CALL(BPF_FUNC_get_cgroup_classid),
852 	BPF_MOV32_IMM(BPF_REG_2, 1),
853 	BPF_JMP32_REG(BPF_JLE, BPF_REG_2, BPF_REG_0, 5),
854 	BPF_MOV32_REG(BPF_REG_6, BPF_REG_0),
855 	BPF_ALU64_IMM(BPF_LSH, BPF_REG_6, 32),
856 	BPF_ALU64_IMM(BPF_RSH, BPF_REG_6, 32),
857 	BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_6),
858 	BPF_ST_MEM(BPF_B, BPF_REG_8, 0, 0),
859 	BPF_MOV32_IMM(BPF_REG_0, 0),
860 	BPF_EXIT_INSN(),
861 	},
862 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
863 	.fixup_map_hash_48b = { 4 },
864 	.result = ACCEPT,
865 	.flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
866 },
867 {
868 	"jeq32/jne32: bounds checking",
869 	.insns = {
870 	BPF_MOV64_IMM(BPF_REG_6, 563),
871 	BPF_MOV64_IMM(BPF_REG_2, 0),
872 	BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0),
873 	BPF_ALU64_IMM(BPF_NEG, BPF_REG_2, 0),
874 	BPF_ALU32_REG(BPF_OR, BPF_REG_2, BPF_REG_6),
875 	BPF_JMP32_IMM(BPF_JNE, BPF_REG_2, 8, 5),
876 	BPF_JMP_IMM(BPF_JSGE, BPF_REG_2, 500, 2),
877 	BPF_MOV64_IMM(BPF_REG_0, 2),
878 	BPF_EXIT_INSN(),
879 	BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
880 	BPF_EXIT_INSN(),
881 	BPF_MOV64_IMM(BPF_REG_0, 1),
882 	BPF_EXIT_INSN(),
883 	},
884 	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
885 	.result = ACCEPT,
886 	.retval = 1,
887 },
888