- iptables
- iptables-save
- iptables-restore

But with the kernel legacy/nft split, there are parallel binaries for each of those, and again for ipv6 tables, so the actual potential binary set on any given linux machine can be some combination of:

- iptables-legacy
- iptables-nft
- ip6tables
- iptables-legacy-save
- iptables-nft-save
- iptables-legacy-restore
- iptables-nft-restore
- ip6tables-legacy

        renderer.addStandardOutputListener(listener)
        renderer.configure(LogLevel.INFO)
        def snapshot = renderer.snapshot()
        renderer.configure(LogLevel.DEBUG)

        when:
        renderer.restore(snapshot)
        renderer.onOutput(event('info', LogLevel.INFO))
        renderer.onOutput(event('debug', LogLevel.DEBUG))

        then:
        listener.value.readLines() == ['info']
    }

	JMP	finish

nosaveg:
	BL	(CTR)	// Call from VDSO

finish:
	MOVD	$0, R0		// Restore R0
	MOVD	0(R1), R3	// sec
	MOVD	8(R1), R5	// nsec
	MOVD	R15, R1		// Restore SP

	// Restore vdsoPC, vdsoSP
	// We don't worry about being signaled between the two stores.
	// If we are not in a signal handler, we'll restore vdsoSP to 0,
	// and no one will care about vdsoPC. If we are in a signal handler,

	newObj := makeObj("pvc1", "5", "")

	// Restore object that doesn't exist
	cache.Restore("nothing")

	// Add old object to cache.
	informer.add(oldObj)
	verify(ktesting.WithStep(tCtx, "after initial update"), cache, oldObj.GetName(), oldObj, oldObj)

	// Restore object.
	cache.Restore(oldObj.GetName())
	verify(ktesting.WithStep(tCtx, "after initial Restore"), cache, oldObj.GetName(), oldObj, oldObj)

	_ = b[1]            // bounds check
	x := *p             // load a byte
	y := uint16(x)      // zero extend to 16 bits
	b[0] = byte(y >> 8) // compute ROLW
	b[1] = byte(y)
	nop()               // spill/restore ROLW
	b[0] = byte(y >> 8) // use ROLW
	b[1] = byte(y)
}

//go:noinline
func f32(p *uint8, b []byte) {
	_ = b[3]             // bounds check
	x := *p              // load a byte

	SaveInto(table Table, buffer *bytes.Buffer) error
	// Restore runs `iptables-restore` passing data through []byte.
	// table is the Table to restore
	// data should be formatted like the output of SaveInto()
	// flush sets the presence of the "--noflush" flag. see: FlushFlag
	// counters sets the "--counters" flag. see: RestoreCountersFlag
	Restore(table Table, data []byte, flush FlushFlag, counters RestoreCountersFlag) error

	std     %f10, 16(%r15)
	std     %f11, 24(%r15)
	std     %f12, 32(%r15)
	std     %f13, 40(%r15)
	std     %f14, 48(%r15)
	std     %f15, 56(%r15)

	/* restore g pointer */
	lgr     %r13, %r3

	/* call fn */
	basr    %r14, %r2

	/* restore floating point registers */
	ld      %f8, 0(%r15)
	ld      %f9, 8(%r15)
	ld      %f10, 16(%r15)
	ld      %f11, 24(%r15)
	ld      %f12, 32(%r15)
	ld      %f13, 40(%r15)

    override val type: TYPE
        get() {
            val type = pointer.type
                ?: error("Cannot restore a PsiType from $pointer")

            @Suppress("UNCHECKED_CAST")
            return type as TYPE
        }

    override fun toString(): String {
        return pointer.type?.toString() ?: "Cannot restore a PsiType from $pointer"
    }

	testCases := []struct {
		description       string
		checkpointContent string
		expectedError     string
		expectedState     *stateMemory
	}{
		{
			"Restore non-existing checkpoint",
			"",
			"",
			&stateMemory{},
		},
		{
			"Restore valid checkpoint",
			`{
				"policyName":"static",

	BEQ	R19, nocgo
	MOVV	$_rt0_loong64_linux_lib_go(SB), R4
	MOVV	$0, R5
	JAL	(R19)
	JMP	restore

nocgo:
	MOVV	$0x800000, R4                     // stacksize = 8192KB
	MOVV	$_rt0_loong64_linux_lib_go(SB), R5
	MOVV	R4, 8(R3)
	MOVV	R5, 16(R3)
	MOVV	$runtime·newosproc0(SB), R19
	JAL	(R19)

restore:
	// Restore callee-save registers.
	RESTORE_R22_TO_R31(3*8)
	RESTORE_F24_TO_F31(13*8)
	RET