iptables -t mangle -A ISTIO_DIVERT -j MARK --set-mark 1337
iptables -t mangle -A ISTIO_DIVERT -j ACCEPT
iptables -t mangle -A ISTIO_TPROXY ! -d 127.0.0.1/32 -p tcp -j TPROXY --tproxy-mark 1337/0xffffffff --on-port 15006
iptables -t mangle -A PREROUTING -p tcp -j ISTIO_INBOUND
iptables -t mangle -A ISTIO_INBOUND -p tcp -m conntrack --ctstate RELATED,ESTABLISHED -j ISTIO_DIVERT

	VMADDR_CID_ANY                              = 0xffffffff
	VMADDR_CID_HOST                             = 0x2
	VMADDR_CID_HYPERVISOR                       = 0x0
	VMADDR_CID_LOCAL                            = 0x1
	VMADDR_FLAG_TO_HOST                         = 0x1
	VMADDR_PORT_ANY                             = 0xffffffff
	VM_SOCKETS_INVALID_VERSION                  = 0xffffffff
	VQUIT                                       = 0x1

		// "--on-ip", "127.0.0.1",
		"--tproxy-mark", inpodTproxyMark,
	)

	// CLI: -A ISTIO_OUTPUT -m connmark --mark 0x111/0xfff -j CONNMARK --restore-mark --nfmask 0xffffffff --ctmask 0xffffffff
	//
	// DESC: Propagate/restore connmark (if we had one) for outbound
	iptablesBuilder.AppendRule(
		iptableslog.UndefinedCommand, ChainInpodOutput, iptablesconstants.MANGLE,
		"-m", "connmark",

		throw("cas1")
	}
	if z != 2 {
		throw("cas2")
	}

	z = 4
	if atomic.Cas(&z, 5, 6) {
		throw("cas3")
	}
	if z != 4 {
		throw("cas4")
	}

	z = 0xffffffff
	if !atomic.Cas(&z, 0xffffffff, 0xfffffffe) {
		throw("cas5")
	}
	if z != 0xfffffffe {
		throw("cas6")
	}

	m = [4]byte{1, 1, 1, 1}
	atomic.Or8(&m[1], 0xf0)

(ANDconst [0xFFFF] (MOVHreg x)) => (MOVHZreg x)

(AND (MOVDconst [c]) y:(MOVWZreg _))  && c&0xFFFFFFFF == 0xFFFFFFFF => y
(AND (MOVDconst [0xFFFFFFFF]) y:(MOVWreg x)) => (MOVWZreg x)
// normal case
(ANDconst [c] (MOVBZreg x)) => (ANDconst [c&0xFF] x)
(ANDconst [c] (MOVHZreg x)) => (ANDconst [c&0xFFFF] x)
(ANDconst [c] (MOVWZreg x)) => (ANDconst [c&0xFFFFFFFF] x)

// Eliminate unnecessary sign/zero extend following right shift

func op_bic(x, y uint32) uint32 {
	// arm64:`BIC\t`,-`AND`
	return x &^ y
}

func op_eon(x, y, z uint32, a []uint32, n, m uint64) uint64 {
	// arm64:`EON\t`,-`EOR`,-`MVN`
	a[0] = x ^ (y ^ 0xffffffff)

	// arm64:`EON\t`,-`EOR`,-`MVN`
	a[1] = ^(y ^ z)

	// arm64:`EON\t`,-`XOR`
	a[2] = x ^ ^z

	// arm64:`EON\t`,-`EOR`,-`MVN`
	return n ^ (m ^ 0xffffffffffffffff)
}

	PPPIOCSRASYNCMAP                 = 0x40047454
	PPPIOCSXASYNCMAP                 = 0x4020744f
	PPPIOCUNBRIDGECHAN               = 0x7434
	PPPIOCXFERUNIT                   = 0x744e
	PR_SET_PTRACER_ANY               = 0xffffffff
	PTRACE_GETFPREGS                 = 0xe
	PTRACE_GETFPXREGS                = 0x12
	PTRACE_GET_THREAD_AREA           = 0x19
	PTRACE_OLDSETOPTIONS             = 0x15
	PTRACE_SETFPREGS                 = 0xf

#define FS_MAX_KEY_SIZE                 64

// The code generator produces -0x1 for (~0), but an unsigned value is necessary
// for the tipc_subscr timeout __u32 field.
#undef TIPC_WAIT_FOREVER
#define TIPC_WAIT_FOREVER 0xffffffff

// Copied from linux/netfilter/nf_nat.h
// Including linux/netfilter/nf_nat.h here causes conflicts between linux/in.h
// and netinet/in.h.
#define NF_NAT_RANGE_MAP_IPS			(1 << 0)

// or return 0 if they cannot be combined.
func mergePPC64SldiSrw(sld, srw int64) int64 {
	if sld > srw || srw >= 32 {
		return 0
	}
	mask_r := uint32(0xFFFFFFFF) >> uint(srw)
	mask_l := uint32(0xFFFFFFFF) >> uint(sld)
	mask := (mask_r & mask_l) << uint(sld)
	return encodePPC64RotateMask((32-srw+sld)&31, int64(mask), 32)
}

	IN_CLASSC_NSHIFT              = 0x8
	IN_CLASSD_HOST                = 0xfffffff
	IN_CLASSD_NET                 = 0xf0000000
	IN_CLASSD_NSHIFT              = 0x1c
	IN_CLASSE_NET                 = 0xffffffff
	IN_LOOPBACKNET                = 0x7f
	IN_PRIVATE12_MASK             = 0xfff00000
	IN_PRIVATE12_NET              = 0xac100000
	IN_PRIVATE16_MASK             = 0xffff0000
	IN_PRIVATE16_NET              = 0xc0a80000