iptables -t mangle -A ISTIO_OUTPUT -m connmark --mark 0x111/0xfff -j CONNMARK --restore-mark --nfmask 0xffffffff --ctmask 0xffffffff
iptables -t nat -A ISTIO_OUTPUT ! -o lo -p udp -m udp --dport 53 -j REDIRECT --to-port 15053
iptables -t nat -A ISTIO_OUTPUT -p tcp -m mark --mark 0x111/0xfff -j ACCEPT

ip6tables -t mangle -A ISTIO_PRERT -p tcp -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
ip6tables -t mangle -A ISTIO_PRERT ! -d ::1/128 -p tcp -m mark ! --mark 0x539/0xfff -j TPROXY --on-port 15006 --tproxy-mark 0x111/0xfff

		{
			v:      0x2002,
			shift:  1,
			wantHi: 0x2000,
			wantLo: 0x1,
		},
		{
			v:      0xfffffe,
			shift:  1,
			wantHi: 0xffe000,
			wantLo: 0xfff,
		},
		{
			v:      0x1000ffe,
			shift:  1,
			wantHi: 0xfff000,
			wantLo: 0xfff,
		},
		{
			v:       0x1001000,
			shift:   1,
			wantErr: true,
		},
		{
			v:       0xfffffe,
			shift:   2,
			wantErr: true,
		},
		{

}

func maskshift(x uint64) uint64 {
	// arm64:"AND\t[$]4095, R[0-9]+",-"LSL",-"LSR",-"UBFIZ",-"UBFX"
	return ((x << 5) & (0xfff << 5)) >> 5
}

// bitfield ops
// bfi
func bfi1(x, y uint64) uint64 {
	// arm64:"BFI\t[$]4, R[0-9]+, [$]12",-"LSL",-"LSR",-"AND"
	return ((x & 0xfff) << 4) | (y & 0xffffffffffff000f)
}

func bfi2(x, y uint64) uint64 {
	// arm64:"BFI\t[$]12, R[0-9]+, [$]40",-"LSL",-"LSR",-"AND"

func calculatePCAlignedReloc(t objabi.RelocType, tgt int64, pc int64) int64 {
	if isRequestingLowPageBits(t) {
		// corresponding immediate field is 12 bits wide
		return tgt & 0xfff
	}

	pageDelta := (tgt >> 12) - (pc >> 12)
	if tgt&0xfff >= 0x800 {
		// adjust for sign-extended addition of the low bits
		pageDelta += 1
	}
	// corresponding immediate field is 20 bits wide
	return pageDelta & 0xfffff

			q |= 1;
		}
		if(n == 0)
			break;
	}
	if(rp)
		*rp = x;
	return q;
}

u32 tests[] = {
	0,
	1,
	2,
	3,
	4,
	5,
	6,
	7,
	8,
	9,
	10,
	11,
	31,
	0xFFF,
	0x1000,
	0x1001,
	0xF0F0F0,
	0xFFFFFF,
	0x1000000,
	0xF0F0F0F0,
	0xFFFFFFFF,
};

int
main(void)
{
	for(int i=0; i<nelem(tests); i++)
	for(int j=0; j<nelem(tests); j++) {

	skipDebugLog(t)
	runtime.ResetDebugLog()
	var varString = strings.Repeat("a", 4)
	runtime.Dlog().B(true).B(false).I(-42).I16(0x7fff).U64(^uint64(0)).Hex(0xfff).P(nil).S(varString).S("const string").End()
	got := dlogCanonicalize(runtime.DumpDebugLog())
	if want := "[] true false -42 32767 18446744073709551615 0xfff 0x0 aaaa const string\n"; got != want {
		t.Fatalf("want %q, got %q", want, got)
	}
}

func TestDebugLogSym(t *testing.T) {

	// Without the CPUID bit the kernel will not trap the instruction and the
	// process will be terminated with SIGILL.
	if ARM64.HasCPUID {
		midr := getMIDR()
		part_num := uint16((midr >> 4) & 0xfff)
		implementer := byte((midr >> 24) & 0xff)

		// d0c - NeoverseN1
		// d40 - NeoverseV1
		// d49 - NeoverseN2
		// d4f - NeoverseV2
		if implementer == 'A' && (part_num == 0xd0c || part_num == 0xd40 ||

	// 1....... 11111111 .....111 ........   x = 0xfff
	// ........ ........ 00001... .0001000   y = 0x101
	//
	// The 12 'w' bits (not all are shown) form the 3839'th code, with value
	// 0x000. Just after decoder.read returns that code, d.hi == 4095 and
	// d.last == 0.
	//
	// The 12 'x' bits form the 3840'th code, with value 0xfff or 4095. Just
	// after decoder.read returns that code, d.hi == 4095 and d.last ==

	var rules []*netlink.Rule
	families := []int{unix.AF_INET}
	if cfg.EnableIPv6 {
		families = append(families, unix.AF_INET6)
	}
	for _, family := range families {
		// Equiv:
		// ip rule add fwmark 0x111/0xfff pref 32764 lookup 100
		//
		// Adds in-pod rules for marking packets with the istio-specific TPROXY mark.
		// A very similar mechanism is used for sidecar TPROXY.
		//