solana_bpf_loader_program/

lib.rs

#![cfg(feature = "agave-unstable-api")]
#![deny(clippy::arithmetic_side_effects)]
#![deny(clippy::indexing_slicing)]

#[cfg(feature = "svm-internal")]
use qualifier_attr::qualifiers;
use {
    solana_bincode::limited_deserialize,
    solana_instruction::AccountMeta,
    solana_instruction_error::InstructionError,
    solana_loader_v3_interface::{
        instruction::{MINIMUM_EXTEND_PROGRAM_BYTES, UpgradeableLoaderInstruction},
        state::UpgradeableLoaderState,
    },
    solana_program_runtime::{
        deploy_program,
        invoke_context::InvokeContext,
        program_cache_entry::{ProgramCacheEntry, ProgramCacheEntryOwner, ProgramCacheEntryType},
        sysvar_cache::get_sysvar_with_account_check,
        vm::execute,
    },
    solana_pubkey::Pubkey,
    solana_sbpf::{declare_builtin_function, elf::get_sbpf_version, program::SBPFVersion},
    solana_sdk_ids::{bpf_loader, bpf_loader_deprecated, bpf_loader_upgradeable, native_loader},
    solana_svm_log_collector::{LogCollector, ic_logger_msg},
    solana_svm_measure::measure::Measure,
    solana_svm_type_overrides::sync::Arc,
    solana_system_interface::{MAX_PERMITTED_DATA_LENGTH, instruction as system_instruction},
    solana_transaction_context::{IndexOfAccount, instruction::InstructionContext},
    std::{cell::RefCell, rc::Rc},
    wincode::SchemaRead,
};

#[cfg_attr(feature = "svm-internal", qualifiers(pub))]
const DEFAULT_LOADER_COMPUTE_UNITS: u64 = 570;
#[cfg_attr(feature = "svm-internal", qualifiers(pub))]
const DEPRECATED_LOADER_COMPUTE_UNITS: u64 = 1_140;
#[cfg_attr(feature = "svm-internal", qualifiers(pub))]
const UPGRADEABLE_LOADER_COMPUTE_UNITS: u64 = 2_370;

// `UpgradeableLoaderInstruction::Write`
const WRITE_INSTRUCTION_TAG: [u8; 4] = 1u32.to_le_bytes();

// u32 tag, u32 offset, u64 payload length
const WRITE_INSTRUCTION_HEADER_LEN: usize = 16;

fn parse_write_instruction(instruction_data: &[u8]) -> Result<(u32, &[u8]), InstructionError> {
    #[derive(SchemaRead)]
    struct WriteInstruction<'a> {
        tag: u32,
        offset: u32,
        bytes: &'a [u8],
    }

    let WriteInstruction { tag, offset, bytes } = wincode::deserialize(instruction_data)
        .map_err(|_| InstructionError::InvalidInstructionData)?;

    if tag.to_le_bytes() != WRITE_INSTRUCTION_TAG {
        // unreachable because we only call this in the relevant `match` arm but included for safety
        return Err(InstructionError::InvalidInstructionData);
    }

    if WRITE_INSTRUCTION_HEADER_LEN.saturating_add(bytes.len()) > solana_packet::PACKET_DATA_SIZE {
        return Err(InstructionError::InvalidInstructionData);
    }

    Ok((offset, bytes))
}

fn write_program_data(
    program_data_offset: usize,
    bytes: &[u8],
    instruction_context: &InstructionContext,
    log_collector: &Option<Rc<RefCell<LogCollector>>>,
) -> Result<(), InstructionError> {
    let mut program = instruction_context.try_borrow_instruction_account(0)?;
    let data = program.get_data_mut()?;
    let write_offset = program_data_offset.saturating_add(bytes.len());
    if data.len() < write_offset {
        ic_logger_msg!(
            log_collector,
            "Write overflow: {} < {}",
            data.len(),
            write_offset,
        );
        return Err(InstructionError::AccountDataTooSmall);
    }
    data.get_mut(program_data_offset..write_offset)
        .ok_or(InstructionError::AccountDataTooSmall)?
        .copy_from_slice(bytes);
    Ok(())
}

declare_builtin_function!(
    Entrypoint,
    fn rust(
        invoke_context: &mut InvokeContext<'static, 'static>,
        _arg0: u64,
        _arg1: u64,
        _arg2: u64,
        _arg3: u64,
        _arg4: u64,
    ) -> Result<u64, Box<dyn std::error::Error>> {
        process_instruction_inner(invoke_context)
    }
);

mod migration_authority {
    solana_pubkey::declare_id!("3Scf35jMNk2xXBD6areNjgMtXgp5ZspDhms8vdcbzC42");
}

#[cfg_attr(feature = "svm-internal", qualifiers(pub))]
pub(crate) fn process_instruction_inner<'a>(
    invoke_context: &mut InvokeContext<'a, 'a>,
) -> Result<u64, Box<dyn std::error::Error>> {
    let log_collector = invoke_context.get_log_collector();
    let transaction_context = &invoke_context.transaction_context;
    let instruction_context = transaction_context.get_current_instruction_context()?;
    let program_id = instruction_context.get_program_key()?;
    let owner_id = instruction_context.get_program_owner()?;

    // Program Management Instruction
    if native_loader::check_id(&owner_id) {
        let program_id = instruction_context.get_program_key()?;
        return if bpf_loader_upgradeable::check_id(program_id) {
            invoke_context
                .compute_meter
                .consume_checked(UPGRADEABLE_LOADER_COMPUTE_UNITS)?;
            process_loader_upgradeable_instruction(invoke_context)
        } else if bpf_loader::check_id(program_id) {
            invoke_context
                .compute_meter
                .consume_checked(DEFAULT_LOADER_COMPUTE_UNITS)?;
            ic_logger_msg!(
                log_collector,
                "BPF loader management instructions are no longer supported",
            );
            Err(InstructionError::UnsupportedProgramId)
        } else if bpf_loader_deprecated::check_id(program_id) {
            invoke_context
                .compute_meter
                .consume_checked(DEPRECATED_LOADER_COMPUTE_UNITS)?;
            ic_logger_msg!(log_collector, "Deprecated loader is no longer supported");
            Err(InstructionError::UnsupportedProgramId)
        } else {
            ic_logger_msg!(log_collector, "Invalid BPF loader id");
            Err(InstructionError::UnsupportedProgramId)
        }
        .map(|_| 0)
        .map_err(|error| Box::new(error) as Box<dyn std::error::Error>);
    }

    // Program Invocation
    let mut get_or_create_executor_time = Measure::start("get_or_create_executor_time");
    let executor = invoke_context
        .program_cache_for_tx_batch
        .find(program_id)
        .ok_or_else(|| {
            ic_logger_msg!(log_collector, "Program is not cached");
            InstructionError::UnsupportedProgramId
        })?;
    get_or_create_executor_time.stop();
    invoke_context.timings.get_or_create_executor_us += get_or_create_executor_time.as_us();

    match &executor.program {
        ProgramCacheEntryType::FailedVerification(_)
        | ProgramCacheEntryType::Closed
        | ProgramCacheEntryType::DelayVisibility => {
            ic_logger_msg!(log_collector, "Program is not deployed");
            Err(Box::new(InstructionError::UnsupportedProgramId) as Box<dyn std::error::Error>)
        }
        ProgramCacheEntryType::Loaded(executable) => execute(executable, invoke_context, &executor),
        _ => Err(Box::new(InstructionError::UnsupportedProgramId) as Box<dyn std::error::Error>),
    }
    .map(|_| 0)
}

fn process_loader_upgradeable_instruction(
    invoke_context: &mut InvokeContext,
) -> Result<(), InstructionError> {
    let log_collector = invoke_context.get_log_collector();
    let transaction_context = &invoke_context.transaction_context;
    let instruction_context = transaction_context.get_current_instruction_context()?;
    let instruction_data = instruction_context.get_instruction_data();
    let program_id = instruction_context.get_program_key()?;

    let instruction = if instruction_data.starts_with(&WRITE_INSTRUCTION_TAG) {
        // `Write` is parsed in-place in the match arm
        UpgradeableLoaderInstruction::Write {
            offset: 0,
            bytes: Vec::new(),
        }
    } else {
        limited_deserialize(instruction_data, solana_packet::PACKET_DATA_SIZE as u64)?
    };

    match instruction {
        UpgradeableLoaderInstruction::InitializeBuffer => {
            instruction_context.check_number_of_instruction_accounts(2)?;
            let mut buffer = instruction_context.try_borrow_instruction_account(0)?;

            if UpgradeableLoaderState::Uninitialized != buffer.get_state()? {
                ic_logger_msg!(log_collector, "Buffer account already initialized");
                return Err(InstructionError::AccountAlreadyInitialized);
            }

            let authority_key = Some(*instruction_context.get_key_of_instruction_account(1)?);

            buffer.set_state(&UpgradeableLoaderState::Buffer {
                authority_address: authority_key,
            })?;
        }
        UpgradeableLoaderInstruction::Write { .. } => {
            let (offset, payload) = parse_write_instruction(instruction_data)?;
            instruction_context.check_number_of_instruction_accounts(2)?;
            let buffer = instruction_context.try_borrow_instruction_account(0)?;

            if let UpgradeableLoaderState::Buffer { authority_address } = buffer.get_state()? {
                if authority_address.is_none() {
                    ic_logger_msg!(log_collector, "Buffer is immutable");
                    return Err(InstructionError::Immutable); // TODO better error code
                }
                let authority_key = Some(*instruction_context.get_key_of_instruction_account(1)?);
                if authority_address != authority_key {
                    ic_logger_msg!(log_collector, "Incorrect buffer authority provided");
                    return Err(InstructionError::IncorrectAuthority);
                }
                if !instruction_context.is_instruction_account_signer(1)? {
                    ic_logger_msg!(log_collector, "Buffer authority did not sign");
                    return Err(InstructionError::MissingRequiredSignature);
                }
            } else {
                ic_logger_msg!(log_collector, "Invalid Buffer account");
                return Err(InstructionError::InvalidAccountData);
            }
            drop(buffer);
            write_program_data(
                UpgradeableLoaderState::size_of_buffer_metadata().saturating_add(offset as usize),
                payload,
                &instruction_context,
                &log_collector,
            )?;
        }
        UpgradeableLoaderInstruction::DeployWithMaxDataLen { max_data_len } => {
            instruction_context.check_number_of_instruction_accounts(4)?;
            let payer_key = *instruction_context.get_key_of_instruction_account(0)?;
            let programdata_key = *instruction_context.get_key_of_instruction_account(1)?;
            let rent =
                get_sysvar_with_account_check::rent(invoke_context, &instruction_context, 4)?;
            let clock =
                get_sysvar_with_account_check::clock(invoke_context, &instruction_context, 5)?;
            instruction_context.check_number_of_instruction_accounts(8)?;
            let authority_key = Some(*instruction_context.get_key_of_instruction_account(7)?);

            // Verify Program account

            let program = instruction_context.try_borrow_instruction_account(2)?;
            if UpgradeableLoaderState::Uninitialized != program.get_state()? {
                ic_logger_msg!(log_collector, "Program account already initialized");
                return Err(InstructionError::AccountAlreadyInitialized);
            }
            if program.get_data().len() < UpgradeableLoaderState::size_of_program() {
                ic_logger_msg!(log_collector, "Program account too small");
                return Err(InstructionError::AccountDataTooSmall);
            }
            if program.get_lamports() < rent.minimum_balance(program.get_data().len()) {
                ic_logger_msg!(log_collector, "Program account not rent-exempt");
                return Err(InstructionError::ExecutableAccountNotRentExempt);
            }
            let new_program_id = *program.get_key();
            drop(program);

            // Verify Buffer account

            let buffer = instruction_context.try_borrow_instruction_account(3)?;
            if !buffer.is_writable() {
                ic_logger_msg!(log_collector, "Buffer account not writeable");
                return Err(InstructionError::InvalidArgument);
            }
            if buffer.get_owner() != program_id {
                ic_logger_msg!(log_collector, "Buffer account not owned by loader");
                return Err(InstructionError::IncorrectProgramId);
            }
            if let UpgradeableLoaderState::Buffer { authority_address } = buffer.get_state()? {
                if authority_address != authority_key {
                    ic_logger_msg!(log_collector, "Buffer and upgrade authority don't match");
                    return Err(InstructionError::IncorrectAuthority);
                }
                if !instruction_context.is_instruction_account_signer(7)? {
                    ic_logger_msg!(log_collector, "Upgrade authority did not sign");
                    return Err(InstructionError::MissingRequiredSignature);
                }
            } else {
                ic_logger_msg!(log_collector, "Invalid Buffer account");
                return Err(InstructionError::InvalidArgument);
            }
            let buffer_key = *buffer.get_key();
            let buffer_data_offset = UpgradeableLoaderState::size_of_buffer_metadata();
            let buffer_data_len = buffer.get_data().len().saturating_sub(buffer_data_offset);
            let programdata_data_offset = UpgradeableLoaderState::size_of_programdata_metadata();
            let programdata_len = UpgradeableLoaderState::size_of_programdata(max_data_len);
            if buffer.get_data().len() < UpgradeableLoaderState::size_of_buffer_metadata()
                || buffer_data_len == 0
            {
                ic_logger_msg!(log_collector, "Buffer account too small");
                return Err(InstructionError::InvalidAccountData);
            }
            drop(buffer);
            if max_data_len < buffer_data_len {
                ic_logger_msg!(
                    log_collector,
                    "Max data length is too small to hold Buffer data"
                );
                return Err(InstructionError::AccountDataTooSmall);
            }
            if programdata_len > MAX_PERMITTED_DATA_LENGTH as usize {
                ic_logger_msg!(log_collector, "Max data length is too large");
                return Err(InstructionError::InvalidArgument);
            }

            // Create ProgramData account
            let (derived_address, bump_seed) =
                Pubkey::find_program_address(&[new_program_id.as_ref()], program_id);
            if derived_address != programdata_key {
                ic_logger_msg!(log_collector, "ProgramData address is not derived");
                return Err(InstructionError::InvalidArgument);
            }

            // Drain the Buffer account to payer before paying for programdata account
            {
                let mut buffer = instruction_context.try_borrow_instruction_account(3)?;
                let mut payer = instruction_context.try_borrow_instruction_account(0)?;
                payer.checked_add_lamports(buffer.get_lamports())?;
                buffer.set_lamports(0)?;
            }

            let owner_id = *program_id;
            let mut instruction = system_instruction::create_account(
                &payer_key,
                &programdata_key,
                1.max(rent.minimum_balance(programdata_len)),
                programdata_len as u64,
                program_id,
            );

            // pass an extra account to avoid the overly strict UnbalancedInstruction error
            instruction
                .accounts
                .push(AccountMeta::new(buffer_key, false));

            invoke_context
                .native_invoke_signed(instruction, &[&[new_program_id.as_ref(), &[bump_seed]]])?;

            // Load and verify the program bits
            let transaction_context = &invoke_context.transaction_context;
            let instruction_context = transaction_context.get_current_instruction_context()?;
            let buffer = instruction_context.try_borrow_instruction_account(3)?;
            deploy_program!(
                invoke_context,
                &new_program_id,
                &owner_id,
                buffer
                    .get_data()
                    .get(buffer_data_offset..)
                    .ok_or(InstructionError::AccountDataTooSmall)?,
                clock.slot,
                invoke_context
                    .get_feature_set()
                    .disable_sbpf_v0_v1_v2_deployment,
            );
            drop(buffer);

            let transaction_context = &invoke_context.transaction_context;
            let instruction_context = transaction_context.get_current_instruction_context()?;

            // Update the ProgramData account and record the program bits
            {
                let mut programdata = instruction_context.try_borrow_instruction_account(1)?;
                programdata.set_state(&UpgradeableLoaderState::ProgramData {
                    slot: clock.slot,
                    upgrade_authority_address: authority_key,
                })?;
                let dst_slice = programdata
                    .get_data_mut()?
                    .get_mut(
                        programdata_data_offset
                            ..programdata_data_offset.saturating_add(buffer_data_len),
                    )
                    .ok_or(InstructionError::AccountDataTooSmall)?;
                let mut buffer = instruction_context.try_borrow_instruction_account(3)?;
                let src_slice = buffer
                    .get_data()
                    .get(buffer_data_offset..)
                    .ok_or(InstructionError::AccountDataTooSmall)?;
                dst_slice.copy_from_slice(src_slice);
                buffer.set_data_length(UpgradeableLoaderState::size_of_buffer(0))?;
            }

            // Update the Program account
            let mut program = instruction_context.try_borrow_instruction_account(2)?;
            program.set_state(&UpgradeableLoaderState::Program {
                programdata_address: programdata_key,
            })?;
            program.set_executable(true)?;
            drop(program);

            ic_logger_msg!(log_collector, "Deployed program {:?}", new_program_id);
        }
        UpgradeableLoaderInstruction::Upgrade => {
            instruction_context.check_number_of_instruction_accounts(3)?;
            let programdata_key = *instruction_context.get_key_of_instruction_account(0)?;
            let rent =
                get_sysvar_with_account_check::rent(invoke_context, &instruction_context, 4)?;
            let clock =
                get_sysvar_with_account_check::clock(invoke_context, &instruction_context, 5)?;
            instruction_context.check_number_of_instruction_accounts(7)?;
            let authority_key = Some(*instruction_context.get_key_of_instruction_account(6)?);

            let set_programdata_to_elf_len = invoke_context
                .get_feature_set()
                .loader_v3_set_program_data_to_elf_length;

            // Verify Program account

            let program = instruction_context.try_borrow_instruction_account(1)?;
            if !program.is_writable() {
                ic_logger_msg!(log_collector, "Program account not writeable");
                return Err(InstructionError::InvalidArgument);
            }
            if program.get_owner() != program_id {
                ic_logger_msg!(log_collector, "Program account not owned by loader");
                return Err(InstructionError::IncorrectProgramId);
            }
            if let UpgradeableLoaderState::Program {
                programdata_address,
            } = program.get_state()?
            {
                if programdata_address != programdata_key {
                    ic_logger_msg!(log_collector, "Program and ProgramData account mismatch");
                    return Err(InstructionError::InvalidArgument);
                }
            } else {
                ic_logger_msg!(log_collector, "Invalid Program account");
                return Err(InstructionError::InvalidAccountData);
            }
            let new_program_id = *program.get_key();
            drop(program);

            // Verify Buffer account

            let buffer = instruction_context.try_borrow_instruction_account(2)?;
            if !buffer.is_writable() {
                ic_logger_msg!(log_collector, "Buffer account not writeable");
                return Err(InstructionError::InvalidArgument);
            }
            if buffer.get_owner() != program_id {
                ic_logger_msg!(log_collector, "Buffer account not owned by loader");
                return Err(InstructionError::IncorrectProgramId);
            }
            if let UpgradeableLoaderState::Buffer { authority_address } = buffer.get_state()? {
                if authority_address != authority_key {
                    ic_logger_msg!(log_collector, "Buffer and upgrade authority don't match");
                    return Err(InstructionError::IncorrectAuthority);
                }
                if !instruction_context.is_instruction_account_signer(6)? {
                    ic_logger_msg!(log_collector, "Upgrade authority did not sign");
                    return Err(InstructionError::MissingRequiredSignature);
                }
            } else {
                ic_logger_msg!(log_collector, "Invalid Buffer account");
                return Err(InstructionError::InvalidArgument);
            }
            let buffer_lamports = buffer.get_lamports();
            let buffer_data_offset = UpgradeableLoaderState::size_of_buffer_metadata();
            let buffer_data_len = buffer.get_data().len().saturating_sub(buffer_data_offset);
            if buffer.get_data().len() < UpgradeableLoaderState::size_of_buffer_metadata()
                || buffer_data_len == 0
            {
                ic_logger_msg!(log_collector, "Buffer account too small");
                return Err(InstructionError::InvalidAccountData);
            }
            drop(buffer);

            // Verify ProgramData account

            let programdata = instruction_context.try_borrow_instruction_account(0)?;
            let programdata_data_offset = UpgradeableLoaderState::size_of_programdata_metadata();
            let (programdata_len, programdata_balance_required) = if set_programdata_to_elf_len {
                // SIMD-0433: we'll resize the programdata account to the new ELF.
                let new_len = programdata_data_offset.saturating_add(buffer_data_len);
                if new_len > MAX_PERMITTED_DATA_LENGTH as usize {
                    ic_logger_msg!(
                        log_collector,
                        "Resized ProgramData length of {} bytes exceeds max account data length",
                        new_len
                    );
                    return Err(InstructionError::InvalidAccountData);
                }
                (new_len, 1.max(rent.minimum_balance(new_len)))
            } else {
                // Before SIMD-0433 accounts must be expanded manually and cannot
                // change size here.
                let len = programdata.get_data().len();
                if len < UpgradeableLoaderState::size_of_programdata(buffer_data_len) {
                    ic_logger_msg!(log_collector, "ProgramData account not large enough");
                    return Err(InstructionError::AccountDataTooSmall);
                }
                (len, 1.max(rent.minimum_balance(len)))
            };
            if programdata.get_lamports().saturating_add(buffer_lamports)
                < programdata_balance_required
            {
                ic_logger_msg!(
                    log_collector,
                    "Buffer account balance too low to fund upgrade"
                );
                return Err(InstructionError::InsufficientFunds);
            }
            if let UpgradeableLoaderState::ProgramData {
                slot,
                upgrade_authority_address,
            } = programdata.get_state()?
            {
                if clock.slot == slot {
                    ic_logger_msg!(log_collector, "Program was deployed in this block already");
                    return Err(InstructionError::InvalidArgument);
                }
                if upgrade_authority_address.is_none() {
                    ic_logger_msg!(log_collector, "Program not upgradeable");
                    return Err(InstructionError::Immutable);
                }
                if upgrade_authority_address != authority_key {
                    ic_logger_msg!(log_collector, "Incorrect upgrade authority provided");
                    return Err(InstructionError::IncorrectAuthority);
                }
                if !instruction_context.is_instruction_account_signer(6)? {
                    ic_logger_msg!(log_collector, "Upgrade authority did not sign");
                    return Err(InstructionError::MissingRequiredSignature);
                }
            } else {
                ic_logger_msg!(log_collector, "Invalid ProgramData account");
                return Err(InstructionError::InvalidAccountData);
            };
            drop(programdata);

            // Load and verify the program bits
            let buffer = instruction_context.try_borrow_instruction_account(2)?;
            deploy_program!(
                invoke_context,
                &new_program_id,
                program_id,
                buffer
                    .get_data()
                    .get(buffer_data_offset..)
                    .ok_or(InstructionError::AccountDataTooSmall)?,
                clock.slot,
                invoke_context
                    .get_feature_set()
                    .disable_sbpf_v0_v1_v2_deployment,
            );
            drop(buffer);

            let transaction_context = &invoke_context.transaction_context;
            let instruction_context = transaction_context.get_current_instruction_context()?;

            // Update the ProgramData account
            let mut programdata = instruction_context.try_borrow_instruction_account(0)?;
            {
                programdata.set_data_length(programdata_len)?;
                programdata.set_state(&UpgradeableLoaderState::ProgramData {
                    slot: clock.slot,
                    upgrade_authority_address: authority_key,
                })?;
                let dst_slice = programdata
                    .get_data_mut()?
                    .get_mut(
                        programdata_data_offset
                            ..programdata_data_offset.saturating_add(buffer_data_len),
                    )
                    .ok_or(InstructionError::AccountDataTooSmall)?;
                let buffer = instruction_context.try_borrow_instruction_account(2)?;
                let src_slice = buffer
                    .get_data()
                    .get(buffer_data_offset..)
                    .ok_or(InstructionError::AccountDataTooSmall)?;
                dst_slice.copy_from_slice(src_slice);
            }
            programdata
                .get_data_mut()?
                .get_mut(programdata_data_offset.saturating_add(buffer_data_len)..)
                .ok_or(InstructionError::AccountDataTooSmall)?
                .fill(0);

            // Fund ProgramData to rent-exemption, spill the rest
            let mut buffer = instruction_context.try_borrow_instruction_account(2)?;
            let mut spill = instruction_context.try_borrow_instruction_account(3)?;
            spill.checked_add_lamports(
                programdata
                    .get_lamports()
                    .saturating_add(buffer_lamports)
                    .saturating_sub(programdata_balance_required),
            )?;
            buffer.set_lamports(0)?;
            programdata.set_lamports(programdata_balance_required)?;
            buffer.set_data_length(UpgradeableLoaderState::size_of_buffer(0))?;

            ic_logger_msg!(log_collector, "Upgraded program {:?}", new_program_id);
        }
        UpgradeableLoaderInstruction::SetAuthority => {
            instruction_context.check_number_of_instruction_accounts(2)?;
            let mut account = instruction_context.try_borrow_instruction_account(0)?;
            let present_authority_key = instruction_context.get_key_of_instruction_account(1)?;
            let new_authority = instruction_context.get_key_of_instruction_account(2).ok();

            match account.get_state()? {
                UpgradeableLoaderState::Buffer { authority_address } => {
                    if new_authority.is_none() {
                        ic_logger_msg!(log_collector, "Buffer authority is not optional");
                        return Err(InstructionError::IncorrectAuthority);
                    }
                    if authority_address.is_none() {
                        ic_logger_msg!(log_collector, "Buffer is immutable");
                        return Err(InstructionError::Immutable);
                    }
                    if authority_address != Some(*present_authority_key) {
                        ic_logger_msg!(log_collector, "Incorrect buffer authority provided");
                        return Err(InstructionError::IncorrectAuthority);
                    }
                    if !instruction_context.is_instruction_account_signer(1)? {
                        ic_logger_msg!(log_collector, "Buffer authority did not sign");
                        return Err(InstructionError::MissingRequiredSignature);
                    }
                    account.set_state(&UpgradeableLoaderState::Buffer {
                        authority_address: new_authority.cloned(),
                    })?;
                }
                UpgradeableLoaderState::ProgramData {
                    slot,
                    upgrade_authority_address,
                } => {
                    if upgrade_authority_address.is_none() {
                        ic_logger_msg!(log_collector, "Program not upgradeable");
                        return Err(InstructionError::Immutable);
                    }
                    if upgrade_authority_address != Some(*present_authority_key) {
                        ic_logger_msg!(log_collector, "Incorrect upgrade authority provided");
                        return Err(InstructionError::IncorrectAuthority);
                    }
                    if !instruction_context.is_instruction_account_signer(1)? {
                        ic_logger_msg!(log_collector, "Upgrade authority did not sign");
                        return Err(InstructionError::MissingRequiredSignature);
                    }
                    if invoke_context
                        .get_feature_set()
                        .disable_sbpf_v0_v1_v2_deployment
                        && new_authority.is_none()
                        && let Some(program) = account
                            .get_data()
                            .get(UpgradeableLoaderState::size_of_programdata_metadata()..)
                        && let Ok(sbpf_version) = get_sbpf_version(program)
                        && sbpf_version < SBPFVersion::V3
                    {
                        return Err(InstructionError::InvalidAccountData);
                    }
                    account.set_state(&UpgradeableLoaderState::ProgramData {
                        slot,
                        upgrade_authority_address: new_authority.cloned(),
                    })?;
                }
                _ => {
                    ic_logger_msg!(log_collector, "Account does not support authorities");
                    return Err(InstructionError::InvalidArgument);
                }
            }

            ic_logger_msg!(log_collector, "New authority {:?}", new_authority);
        }
        UpgradeableLoaderInstruction::SetAuthorityChecked => {
            if !invoke_context
                .get_feature_set()
                .enable_bpf_loader_set_authority_checked_ix
            {
                return Err(InstructionError::InvalidInstructionData);
            }

            instruction_context.check_number_of_instruction_accounts(3)?;
            let mut account = instruction_context.try_borrow_instruction_account(0)?;
            let present_authority_key = instruction_context.get_key_of_instruction_account(1)?;
            let new_authority_key = instruction_context.get_key_of_instruction_account(2)?;

            match account.get_state()? {
                UpgradeableLoaderState::Buffer { authority_address } => {
                    if authority_address.is_none() {
                        ic_logger_msg!(log_collector, "Buffer is immutable");
                        return Err(InstructionError::Immutable);
                    }
                    if authority_address != Some(*present_authority_key) {
                        ic_logger_msg!(log_collector, "Incorrect buffer authority provided");
                        return Err(InstructionError::IncorrectAuthority);
                    }
                    if !instruction_context.is_instruction_account_signer(1)? {
                        ic_logger_msg!(log_collector, "Buffer authority did not sign");
                        return Err(InstructionError::MissingRequiredSignature);
                    }
                    if !instruction_context.is_instruction_account_signer(2)? {
                        ic_logger_msg!(log_collector, "New authority did not sign");
                        return Err(InstructionError::MissingRequiredSignature);
                    }
                    account.set_state(&UpgradeableLoaderState::Buffer {
                        authority_address: Some(*new_authority_key),
                    })?;
                }
                UpgradeableLoaderState::ProgramData {
                    slot,
                    upgrade_authority_address,
                } => {
                    if upgrade_authority_address.is_none() {
                        ic_logger_msg!(log_collector, "Program not upgradeable");
                        return Err(InstructionError::Immutable);
                    }
                    if upgrade_authority_address != Some(*present_authority_key) {
                        ic_logger_msg!(log_collector, "Incorrect upgrade authority provided");
                        return Err(InstructionError::IncorrectAuthority);
                    }
                    if !instruction_context.is_instruction_account_signer(1)? {
                        ic_logger_msg!(log_collector, "Upgrade authority did not sign");
                        return Err(InstructionError::MissingRequiredSignature);
                    }
                    if !instruction_context.is_instruction_account_signer(2)? {
                        ic_logger_msg!(log_collector, "New authority did not sign");
                        return Err(InstructionError::MissingRequiredSignature);
                    }
                    account.set_state(&UpgradeableLoaderState::ProgramData {
                        slot,
                        upgrade_authority_address: Some(*new_authority_key),
                    })?;
                }
                _ => {
                    ic_logger_msg!(log_collector, "Account does not support authorities");
                    return Err(InstructionError::InvalidArgument);
                }
            }

            ic_logger_msg!(log_collector, "New authority {:?}", new_authority_key);
        }
        UpgradeableLoaderInstruction::Close => {
            instruction_context.check_number_of_instruction_accounts(2)?;
            if instruction_context.get_index_of_instruction_account_in_transaction(0)?
                == instruction_context.get_index_of_instruction_account_in_transaction(1)?
            {
                ic_logger_msg!(
                    log_collector,
                    "Recipient is the same as the account being closed"
                );
                return Err(InstructionError::InvalidArgument);
            }
            let mut close_account = instruction_context.try_borrow_instruction_account(0)?;
            let close_key = *close_account.get_key();
            let close_account_state = close_account.get_state()?;
            match close_account_state {
                UpgradeableLoaderState::Uninitialized => {
                    let mut recipient_account =
                        instruction_context.try_borrow_instruction_account(1)?;
                    recipient_account.checked_add_lamports(close_account.get_lamports())?;
                    close_account.set_lamports(0)?;
                    close_account
                        .set_data_length(UpgradeableLoaderState::size_of_uninitialized())?;
                    ic_logger_msg!(log_collector, "Closed Uninitialized {}", close_key);
                }
                UpgradeableLoaderState::Buffer { authority_address } => {
                    instruction_context.check_number_of_instruction_accounts(3)?;
                    drop(close_account);
                    common_close_account(&authority_address, &instruction_context, &log_collector)?;
                    ic_logger_msg!(log_collector, "Closed Buffer {}", close_key);
                }
                UpgradeableLoaderState::ProgramData {
                    slot,
                    upgrade_authority_address: authority_address,
                } => {
                    instruction_context.check_number_of_instruction_accounts(4)?;
                    drop(close_account);
                    let program_account = instruction_context.try_borrow_instruction_account(3)?;
                    let program_key = *program_account.get_key();

                    if !program_account.is_writable() {
                        ic_logger_msg!(log_collector, "Program account is not writable");
                        return Err(InstructionError::InvalidArgument);
                    }
                    if program_account.get_owner() != program_id {
                        ic_logger_msg!(log_collector, "Program account not owned by loader");
                        return Err(InstructionError::IncorrectProgramId);
                    }
                    let clock = invoke_context
                        .environment_config
                        .sysvar_cache()
                        .get_clock()?;
                    if clock.slot == slot {
                        ic_logger_msg!(log_collector, "Program was deployed in this block already");
                        return Err(InstructionError::InvalidArgument);
                    }

                    match program_account.get_state()? {
                        UpgradeableLoaderState::Program {
                            programdata_address,
                        } => {
                            if programdata_address != close_key {
                                ic_logger_msg!(
                                    log_collector,
                                    "ProgramData account does not match ProgramData account"
                                );
                                return Err(InstructionError::InvalidArgument);
                            }

                            drop(program_account);
                            common_close_account(
                                &authority_address,
                                &instruction_context,
                                &log_collector,
                            )?;
                            let clock = invoke_context
                                .environment_config
                                .sysvar_cache()
                                .get_clock()?;
                            invoke_context
                                .program_cache_for_tx_batch
                                .store_modified_entry(
                                    program_key,
                                    Arc::new(ProgramCacheEntry::new_closed_tombstone(
                                        clock.slot,
                                        ProgramCacheEntryOwner::LoaderV3,
                                    )),
                                );
                        }
                        _ => {
                            ic_logger_msg!(log_collector, "Invalid Program account");
                            return Err(InstructionError::InvalidArgument);
                        }
                    }

                    ic_logger_msg!(log_collector, "Closed Program {}", program_key);
                }
                _ => {
                    ic_logger_msg!(log_collector, "Account does not support closing");
                    return Err(InstructionError::InvalidArgument);
                }
            }
        }
        UpgradeableLoaderInstruction::ExtendProgram { additional_bytes } => {
            common_extend_program(invoke_context, additional_bytes, false)?;
        }
    }

    Ok(())
}

fn common_extend_program(
    invoke_context: &mut InvokeContext,
    additional_bytes: u32,
    check_authority: bool,
) -> Result<(), InstructionError> {
    let log_collector = invoke_context.get_log_collector();
    let transaction_context = &invoke_context.transaction_context;
    let instruction_context = transaction_context.get_current_instruction_context()?;
    let program_id = instruction_context.get_program_key()?;

    const PROGRAM_DATA_ACCOUNT_INDEX: IndexOfAccount = 0;
    const PROGRAM_ACCOUNT_INDEX: IndexOfAccount = 1;
    const AUTHORITY_ACCOUNT_INDEX: IndexOfAccount = 2;
    // The unused `system_program_account_index` is 3 if `check_authority` and 2 otherwise.
    let optional_payer_account_index = if check_authority { 4 } else { 3 };

    if additional_bytes == 0 {
        ic_logger_msg!(log_collector, "Additional bytes must be greater than 0");
        return Err(InstructionError::InvalidInstructionData);
    }

    let programdata_account =
        instruction_context.try_borrow_instruction_account(PROGRAM_DATA_ACCOUNT_INDEX)?;
    let programdata_key = *programdata_account.get_key();

    if program_id != programdata_account.get_owner() {
        ic_logger_msg!(log_collector, "ProgramData owner is invalid");
        return Err(InstructionError::InvalidAccountOwner);
    }
    if !programdata_account.is_writable() {
        ic_logger_msg!(log_collector, "ProgramData is not writable");
        return Err(InstructionError::InvalidArgument);
    }

    let program_account =
        instruction_context.try_borrow_instruction_account(PROGRAM_ACCOUNT_INDEX)?;
    if !program_account.is_writable() {
        ic_logger_msg!(log_collector, "Program account is not writable");
        return Err(InstructionError::InvalidArgument);
    }
    if program_account.get_owner() != program_id {
        ic_logger_msg!(log_collector, "Program account not owned by loader");
        return Err(InstructionError::InvalidAccountOwner);
    }
    let program_key = *program_account.get_key();
    match program_account.get_state()? {
        UpgradeableLoaderState::Program {
            programdata_address,
        } => {
            if programdata_address != programdata_key {
                ic_logger_msg!(
                    log_collector,
                    "Program account does not match ProgramData account"
                );
                return Err(InstructionError::InvalidArgument);
            }
        }
        _ => {
            ic_logger_msg!(log_collector, "Invalid Program account");
            return Err(InstructionError::InvalidAccountData);
        }
    }
    drop(program_account);

    let old_len = programdata_account.get_data().len();
    let new_len = old_len.saturating_add(additional_bytes as usize);
    if new_len > MAX_PERMITTED_DATA_LENGTH as usize {
        ic_logger_msg!(
            log_collector,
            "Extended ProgramData length of {} bytes exceeds max account data length of {} bytes",
            new_len,
            MAX_PERMITTED_DATA_LENGTH
        );
        return Err(InstructionError::InvalidRealloc);
    }

    if invoke_context
        .get_feature_set()
        .loader_v3_minimum_extend_program_size
    {
        // SIMD-0431: Minimum Extend Program Size
        //
        // All extensions must be >= 10 KiB in additional_bytes, unless
        // MAX_PERMITTED_DATA_LENGTH - current_len < 10 KiB. In that case,
        // additional_bytes must be equal to the remaining free space.
        let headroom = (MAX_PERMITTED_DATA_LENGTH as usize).saturating_sub(old_len);
        if additional_bytes < MINIMUM_EXTEND_PROGRAM_BYTES
            && (additional_bytes as usize) != headroom
        {
            ic_logger_msg!(
                log_collector,
                "ExtendProgram requires a minimum of {} additional bytes or to extend to maximum \
                 size, but only {} were requested",
                MINIMUM_EXTEND_PROGRAM_BYTES,
                additional_bytes,
            );
            return Err(InstructionError::InvalidArgument);
        }
    }

    let clock_slot = invoke_context
        .environment_config
        .sysvar_cache()
        .get_clock()
        .map(|clock| clock.slot)?;

    let upgrade_authority_address = if let UpgradeableLoaderState::ProgramData {
        slot,
        upgrade_authority_address,
    } = programdata_account.get_state()?
    {
        if clock_slot == slot {
            ic_logger_msg!(log_collector, "Program was extended in this block already");
            return Err(InstructionError::InvalidArgument);
        }

        if upgrade_authority_address.is_none() {
            ic_logger_msg!(
                log_collector,
                "Cannot extend ProgramData accounts that are not upgradeable"
            );
            return Err(InstructionError::Immutable);
        }

        if check_authority {
            let authority_key =
                Some(*instruction_context.get_key_of_instruction_account(AUTHORITY_ACCOUNT_INDEX)?);
            if upgrade_authority_address != authority_key {
                ic_logger_msg!(log_collector, "Incorrect upgrade authority provided");
                return Err(InstructionError::IncorrectAuthority);
            }
            if !instruction_context.is_instruction_account_signer(AUTHORITY_ACCOUNT_INDEX)? {
                ic_logger_msg!(log_collector, "Upgrade authority did not sign");
                return Err(InstructionError::MissingRequiredSignature);
            }
        }

        upgrade_authority_address
    } else {
        ic_logger_msg!(log_collector, "ProgramData state is invalid");
        return Err(InstructionError::InvalidAccountData);
    };

    let required_payment = {
        let balance = programdata_account.get_lamports();
        let rent = invoke_context
            .environment_config
            .sysvar_cache()
            .get_rent()?;
        let min_balance = rent.minimum_balance(new_len).max(1);
        min_balance.saturating_sub(balance)
    };

    // Borrowed accounts need to be dropped before native_invoke_signed
    drop(programdata_account);

    // Dereference the program ID to prevent overlapping mutable/immutable borrow of invoke context
    let program_id = *program_id;
    if required_payment > 0 {
        let payer_key =
            *instruction_context.get_key_of_instruction_account(optional_payer_account_index)?;

        invoke_context.native_invoke_signed(
            system_instruction::transfer(&payer_key, &programdata_key, required_payment),
            &[],
        )?;
    }

    let transaction_context = &invoke_context.transaction_context;
    let instruction_context = transaction_context.get_current_instruction_context()?;
    let mut programdata_account =
        instruction_context.try_borrow_instruction_account(PROGRAM_DATA_ACCOUNT_INDEX)?;
    programdata_account.set_data_length(new_len)?;

    let programdata_data_offset = UpgradeableLoaderState::size_of_programdata_metadata();

    deploy_program!(
        invoke_context,
        &program_key,
        &program_id,
        programdata_account
            .get_data()
            .get(programdata_data_offset..)
            .ok_or(InstructionError::AccountDataTooSmall)?,
        clock_slot,
        false, // disable_sbpf_v0_v1_v2_deployment // explicitly continue to allow them for extend program
    );
    drop(programdata_account);

    let mut programdata_account =
        instruction_context.try_borrow_instruction_account(PROGRAM_DATA_ACCOUNT_INDEX)?;
    programdata_account.set_state(&UpgradeableLoaderState::ProgramData {
        slot: clock_slot,
        upgrade_authority_address,
    })?;

    ic_logger_msg!(
        log_collector,
        "Extended ProgramData account by {} bytes",
        additional_bytes
    );

    Ok(())
}

fn common_close_account(
    authority_address: &Option<Pubkey>,
    instruction_context: &InstructionContext,
    log_collector: &Option<Rc<RefCell<LogCollector>>>,
) -> Result<(), InstructionError> {
    if authority_address.is_none() {
        ic_logger_msg!(log_collector, "Account is immutable");
        return Err(InstructionError::Immutable);
    }
    if *authority_address != Some(*instruction_context.get_key_of_instruction_account(2)?) {
        ic_logger_msg!(log_collector, "Incorrect authority provided");
        return Err(InstructionError::IncorrectAuthority);
    }
    if !instruction_context.is_instruction_account_signer(2)? {
        ic_logger_msg!(log_collector, "Authority did not sign");
        return Err(InstructionError::MissingRequiredSignature);
    }

    let mut close_account = instruction_context.try_borrow_instruction_account(0)?;
    let mut recipient_account = instruction_context.try_borrow_instruction_account(1)?;

    recipient_account.checked_add_lamports(close_account.get_lamports())?;
    close_account.set_lamports(0)?;
    close_account.set_data_length(UpgradeableLoaderState::size_of_uninitialized())?;
    close_account.set_state(&UpgradeableLoaderState::Uninitialized)?;
    Ok(())
}

#[cfg_attr(feature = "svm-internal", qualifiers(pub))]
mod test_utils {
    #[cfg(all(feature = "svm-internal", feature = "metrics"))]
    use solana_program_runtime::program_metrics::LoadProgramMetrics;
    #[cfg(feature = "svm-internal")]
    use {
        super::*, solana_account::ReadableAccount,
        solana_program_runtime::loaded_programs::ProgramRuntimeEnvironment,
        solana_syscalls::create_program_runtime_environment,
    };

    #[cfg(feature = "svm-internal")]
    fn check_loader_id(id: &Pubkey) -> bool {
        bpf_loader::check_id(id)
            || bpf_loader_deprecated::check_id(id)
            || bpf_loader_upgradeable::check_id(id)
    }

    #[cfg(feature = "svm-internal")]
    #[cfg_attr(feature = "svm-internal", qualifiers(pub))]
    fn load_all_invoked_programs(invoke_context: &mut InvokeContext) {
        let program_runtime_environment = create_program_runtime_environment(
            invoke_context.get_feature_set(),
            invoke_context.get_compute_budget(),
            false, /* deployment */
            false, /* debugging_features */
        )
        .unwrap();
        let num_accounts = invoke_context.transaction_context.get_number_of_accounts();
        for index in 0..num_accounts {
            let account = invoke_context
                .transaction_context
                .accounts()
                .try_borrow(index)
                .expect("Failed to get the account");

            let owner = account.owner();
            if check_loader_id(owner) {
                let programdata_data_offset = 0;
                let pubkey = invoke_context
                    .transaction_context
                    .get_key_of_account_at_index(index)
                    .expect("Failed to get account key");

                let programdata = account
                    .data()
                    .get(programdata_data_offset.min(account.data().len())..)
                    .unwrap();
                let loaded_program = ProgramCacheEntry::load(
                    owner,
                    ProgramRuntimeEnvironment::clone(&program_runtime_environment),
                    0,
                    programdata,
                    #[cfg(feature = "metrics")]
                    &mut LoadProgramMetrics::default(),
                )
                .map_err(|_| InstructionError::InvalidAccountData);
                if let Ok(loaded_program) = loaded_program {
                    invoke_context
                        .program_cache_for_tx_batch
                        .store_modified_entry(*pubkey, Arc::new(loaded_program));
                }
            }
        }
    }
}

#[cfg(test)]
mod tests {
    use {
        super::*,
        assert_matches::assert_matches,
        rand::Rng,
        solana_account::{
            AccountSharedData, ReadableAccount, WritableAccount,
            state_traits::StateMutWincode as StateMut,
        },
        solana_clock::Clock,
        solana_epoch_schedule::EpochSchedule,
        solana_instruction::AccountMeta,
        solana_instruction_error::InstructionError,
        solana_program_runtime::{
            invoke_context::mock_process_instruction_with_feature_set,
            loaded_programs::ProgramRuntimeEnvironment, program_metrics::ProgramStatistics,
            vm::calculate_heap_cost, with_mock_invoke_context,
        },
        solana_pubkey::Pubkey,
        solana_rent::Rent,
        solana_sbpf::program::{BuiltinFunctionDefinition, BuiltinProgram},
        solana_sdk_ids::{system_program, sysvar},
        solana_svm_feature_set::SVMFeatureSet,
        solana_svm_type_overrides::sync::atomic::{AtomicU64, Ordering},
        solana_sysvar_id::SysvarId,
        std::{fs::File, io::Read, ops::Range},
        test_case::test_case,
    };

    #[derive(Clone, Copy)]
    struct LoaderV3Features {
        /// SIMD-0433
        pub set_programdata_to_elf_length: bool,
    }

    impl LoaderV3Features {
        fn all_enabled() -> Self {
            Self {
                set_programdata_to_elf_length: true,
            }
        }
    }

    fn setup_features(feature_set: &mut SVMFeatureSet, loader_v3_features: LoaderV3Features) {
        let LoaderV3Features {
            set_programdata_to_elf_length,
        } = loader_v3_features;
        feature_set.loader_v3_set_program_data_to_elf_length = set_programdata_to_elf_length;
    }

    fn create_sysvar_account<T>(value: &T) -> AccountSharedData
    where
        T: wincode::Serialize<Src = T> + SysvarId,
    {
        let serialized_len = wincode::serialized_size(value).unwrap() as usize;
        let canonical_data_len = match T::id() {
            sysvar::clock::ID => solana_clock::SIZE,
            sysvar::epoch_schedule::ID => solana_epoch_schedule::SIZE,
            sysvar::rent::ID => solana_rent::SIZE,
            id => panic!("unsupported sysvar: {id}"),
        };
        let required_data_len = canonical_data_len.max(serialized_len);
        let mut account = AccountSharedData::new(1, required_data_len, &sysvar::id());
        wincode::serialize_into(account.data_as_mut_slice(), value).unwrap();
        account
    }

    // 10 iterations is intentionally low: `mock_process_instruction` runs on a
    // single thread, so additional `shuttle::check_random` iterations validate
    // only the harness wiring, not concurrent interleavings. Bump this if a
    // future refactor introduces `shuttle::thread::spawn` inside
    // `mock_process_instruction`.
    #[cfg(feature = "shuttle-test")]
    const MOCK_PROCESS_RANDOM_ITERATIONS: usize = 10;

    /// Wrapper around `mock_process_instruction_with_feature_set` that runs
    /// under `shuttle::check_random` when the `shuttle-test` feature is
    /// enabled, providing the Shuttle scheduler context required by
    /// `solana-svm-type-overrides`'s shuttle-aware atomic types. With default
    /// features, this is a thin pass-through to the harness with
    /// `Entrypoint::register` and an empty post-adjustment closure.
    ///
    /// The harness itself is single-threaded: the only
    /// Shuttle-backed atomic in the access path is
    /// `ProgramCacheEntry::latest_access_slot` (routed to
    /// `shuttle::sync::atomic::AtomicU64` by `solana_svm_type_overrides`), and
    /// it is touched from one Shuttle thread. Iteration-to-iteration variance
    /// under `shuttle::check_random` is solely scheduler bookkeeping noise, so
    /// any iteration's captured result is equivalent. If the harness ever
    /// spawns Shuttle threads internally, this last-write-wins capture must
    /// be re-evaluated.
    ///
    /// `setup` is typed as `fn(&mut InvokeContext)` (function pointer, not
    /// `impl Fn`) so it satisfies Shuttle's `Fn + Send + Sync + 'static` bound
    /// when captured by value into the inner closure. Callers must pass
    /// non-capturing closures or `fn` items; capturing closures will produce a
    /// fn-pointer coercion error at the call site.
    fn process_instruction_with_setup(
        program_id: &Pubkey,
        instruction_data: &[u8],
        transaction_accounts: Vec<(Pubkey, AccountSharedData)>,
        instruction_accounts: Vec<AccountMeta>,
        loader_v3_features: LoaderV3Features,
        expected_result: Result<(), InstructionError>,
        setup: fn(&mut InvokeContext),
    ) -> Vec<AccountSharedData> {
        let mut feature_set = SVMFeatureSet::all_enabled();
        setup_features(&mut feature_set, loader_v3_features);

        #[cfg(feature = "shuttle-test")]
        {
            let program_id = *program_id;
            let instruction_data = instruction_data.to_vec();
            let result = shuttle::sync::Arc::new(shuttle::sync::Mutex::new(None));
            let result_for_test = shuttle::sync::Arc::clone(&result);
            shuttle::check_random(
                move || {
                    let accounts = mock_process_instruction_with_feature_set(
                        &program_id,
                        &instruction_data,
                        transaction_accounts.clone(),
                        instruction_accounts.clone(),
                        expected_result.clone(),
                        Entrypoint::register,
                        setup,
                        |_invoke_context| {},
                        &feature_set,
                    );
                    *result_for_test.lock().unwrap() = Some(accounts);
                },
                MOCK_PROCESS_RANDOM_ITERATIONS,
            );

            // Consume the harness cell after Shuttle exits so extraction does
            // not call `shuttle::sync::Mutex::lock` outside the scheduler.
            let Ok(mut result) = shuttle::sync::Arc::try_unwrap(result) else {
                panic!("shuttle test result still has outstanding references")
            };
            result
                .get_mut()
                .unwrap()
                .take()
                .expect("shuttle test did not produce a result")
        }

        #[cfg(not(feature = "shuttle-test"))]
        mock_process_instruction_with_feature_set(
            program_id,
            instruction_data,
            transaction_accounts,
            instruction_accounts,
            expected_result,
            Entrypoint::register,
            setup,
            |_invoke_context| {},
            &feature_set,
        )
    }

    fn process_instruction(
        program_id: &Pubkey,
        instruction_data: &[u8],
        transaction_accounts: Vec<(Pubkey, AccountSharedData)>,
        instruction_accounts: Vec<AccountMeta>,
        expected_result: Result<(), InstructionError>,
    ) -> Vec<AccountSharedData> {
        process_instruction_with_setup(
            program_id,
            instruction_data,
            transaction_accounts,
            instruction_accounts,
            LoaderV3Features::all_enabled(),
            expected_result,
            |invoke_context| {
                test_utils::load_all_invoked_programs(invoke_context);
            },
        )
    }

    fn load_program_account_from_elf(loader_id: &Pubkey, path: &str) -> AccountSharedData {
        let mut file = File::open(path).expect("file open failed");
        let mut elf = Vec::new();
        file.read_to_end(&mut elf).unwrap();
        let rent = Rent::default();
        let mut program_account =
            AccountSharedData::new(rent.minimum_balance(elf.len()), 0, loader_id);
        program_account.set_data_from_slice(&elf);
        program_account.set_executable(true);
        program_account
    }

    #[test]
    fn test_bpf_loader_invoke_main() {
        let loader_id = bpf_loader::id();
        let program_id = Pubkey::new_unique();
        let program_account =
            load_program_account_from_elf(&loader_id, "test_elfs/out/sbpfv3_return_ok.so");
        let parameter_id = Pubkey::new_unique();
        let parameter_account = AccountSharedData::new(1, 0, &loader_id);
        let parameter_meta = AccountMeta {
            pubkey: parameter_id,
            is_signer: false,
            is_writable: false,
        };

        // Case: No program account
        process_instruction(
            &loader_id,
            &[],
            Vec::new(),
            Vec::new(),
            Err(InstructionError::UnsupportedProgramId),
        );

        // Case: Only a program account
        process_instruction(
            &program_id,
            &[],
            vec![(program_id, program_account.clone())],
            Vec::new(),
            Ok(()),
        );

        // Case: With program and parameter account
        process_instruction(
            &program_id,
            &[],
            vec![
                (program_id, program_account.clone()),
                (parameter_id, parameter_account.clone()),
            ],
            vec![parameter_meta.clone()],
            Ok(()),
        );

        // Case: With duplicate accounts
        process_instruction(
            &program_id,
            &[],
            vec![
                (program_id, program_account.clone()),
                (parameter_id, parameter_account.clone()),
            ],
            vec![parameter_meta.clone(), parameter_meta],
            Ok(()),
        );

        // Case: limited budget
        process_instruction_with_setup(
            &program_id,
            &[],
            vec![(program_id, program_account)],
            Vec::new(),
            LoaderV3Features::all_enabled(),
            Err(InstructionError::ProgramFailedToComplete),
            |invoke_context| {
                invoke_context.compute_meter.mock_set_remaining(0);
                test_utils::load_all_invoked_programs(invoke_context);
            },
        );

        // Case: Account not a program
        process_instruction_with_setup(
            &program_id,
            &[],
            vec![(program_id, parameter_account.clone())],
            Vec::new(),
            LoaderV3Features::all_enabled(),
            Err(InstructionError::UnsupportedProgramId),
            |invoke_context| {
                test_utils::load_all_invoked_programs(invoke_context);
            },
        );
        process_instruction(
            &program_id,
            &[],
            vec![(program_id, parameter_account)],
            Vec::new(),
            Err(InstructionError::UnsupportedProgramId),
        );
    }

    #[test]
    fn test_bpf_loader_serialize_unaligned() {
        let loader_id = bpf_loader_deprecated::id();
        let program_id = Pubkey::new_unique();
        let program_account =
            load_program_account_from_elf(&loader_id, "test_elfs/out/noop_unaligned.so");
        let parameter_id = Pubkey::new_unique();
        let parameter_account = AccountSharedData::new(1, 0, &loader_id);
        let parameter_meta = AccountMeta {
            pubkey: parameter_id,
            is_signer: false,
            is_writable: false,
        };

        // Case: With program and parameter account
        process_instruction(
            &program_id,
            &[],
            vec![
                (program_id, program_account.clone()),
                (parameter_id, parameter_account.clone()),
            ],
            vec![parameter_meta.clone()],
            Ok(()),
        );

        // Case: With duplicate accounts
        process_instruction(
            &program_id,
            &[],
            vec![
                (program_id, program_account),
                (parameter_id, parameter_account),
            ],
            vec![parameter_meta.clone(), parameter_meta],
            Ok(()),
        );
    }

    #[test]
    fn test_bpf_loader_serialize_aligned() {
        let loader_id = bpf_loader::id();
        let program_id = Pubkey::new_unique();
        let program_account =
            load_program_account_from_elf(&loader_id, "test_elfs/out/noop_aligned.so");
        let parameter_id = Pubkey::new_unique();
        let parameter_account = AccountSharedData::new(1, 0, &loader_id);
        let parameter_meta = AccountMeta {
            pubkey: parameter_id,
            is_signer: false,
            is_writable: false,
        };

        // Case: With program and parameter account
        process_instruction(
            &program_id,
            &[],
            vec![
                (program_id, program_account.clone()),
                (parameter_id, parameter_account.clone()),
            ],
            vec![parameter_meta.clone()],
            Ok(()),
        );

        // Case: With duplicate accounts
        process_instruction(
            &program_id,
            &[],
            vec![
                (program_id, program_account),
                (parameter_id, parameter_account),
            ],
            vec![parameter_meta.clone(), parameter_meta],
            Ok(()),
        );
    }

    #[test]
    fn test_bpf_loader_upgradeable_initialize_buffer() {
        let loader_id = bpf_loader_upgradeable::id();
        let buffer_address = Pubkey::new_unique();
        let buffer_account =
            AccountSharedData::new(1, UpgradeableLoaderState::size_of_buffer(9), &loader_id);
        let authority_address = Pubkey::new_unique();
        let authority_account =
            AccountSharedData::new(1, UpgradeableLoaderState::size_of_buffer(9), &loader_id);
        let instruction_data =
            bincode::serialize(&UpgradeableLoaderInstruction::InitializeBuffer).unwrap();
        let instruction_accounts = vec![
            AccountMeta {
                pubkey: buffer_address,
                is_signer: false,
                is_writable: true,
            },
            AccountMeta {
                pubkey: authority_address,
                is_signer: false,
                is_writable: false,
            },
        ];

        // Case: Success
        let accounts = process_instruction(
            &loader_id,
            &instruction_data,
            vec![
                (buffer_address, buffer_account),
                (authority_address, authority_account),
            ],
            instruction_accounts.clone(),
            Ok(()),
        );
        let state: UpgradeableLoaderState = accounts.first().unwrap().state().unwrap();
        assert_eq!(
            state,
            UpgradeableLoaderState::Buffer {
                authority_address: Some(authority_address)
            }
        );

        // Case: Already initialized
        let accounts = process_instruction(
            &loader_id,
            &instruction_data,
            vec![
                (buffer_address, accounts.first().unwrap().clone()),
                (authority_address, accounts.get(1).unwrap().clone()),
            ],
            instruction_accounts,
            Err(InstructionError::AccountAlreadyInitialized),
        );
        let state: UpgradeableLoaderState = accounts.first().unwrap().state().unwrap();
        assert_eq!(
            state,
            UpgradeableLoaderState::Buffer {
                authority_address: Some(authority_address)
            }
        );
    }

    #[test]
    fn test_bpf_loader_upgradeable_write() {
        let loader_id = bpf_loader_upgradeable::id();
        let buffer_address = Pubkey::new_unique();
        let mut buffer_account =
            AccountSharedData::new(1, UpgradeableLoaderState::size_of_buffer(9), &loader_id);
        let instruction_accounts = vec![
            AccountMeta {
                pubkey: buffer_address,
                is_signer: false,
                is_writable: true,
            },
            AccountMeta {
                pubkey: buffer_address,
                is_signer: true,
                is_writable: false,
            },
        ];

        // Case: Not initialized
        let instruction = bincode::serialize(&UpgradeableLoaderInstruction::Write {
            offset: 0,
            bytes: vec![42; 9],
        })
        .unwrap();
        process_instruction(
            &loader_id,
            &instruction,
            vec![(buffer_address, buffer_account.clone())],
            instruction_accounts.clone(),
            Err(InstructionError::InvalidAccountData),
        );

        // Case: Write entire buffer
        let instruction = bincode::serialize(&UpgradeableLoaderInstruction::Write {
            offset: 0,
            bytes: vec![42; 9],
        })
        .unwrap();
        buffer_account
            .set_state(&UpgradeableLoaderState::Buffer {
                authority_address: Some(buffer_address),
            })
            .unwrap();
        let accounts = process_instruction(
            &loader_id,
            &instruction,
            vec![(buffer_address, buffer_account.clone())],
            instruction_accounts.clone(),
            Ok(()),
        );
        let state: UpgradeableLoaderState = accounts.first().unwrap().state().unwrap();
        assert_eq!(
            state,
            UpgradeableLoaderState::Buffer {
                authority_address: Some(buffer_address)
            }
        );
        assert_eq!(
            &accounts
                .first()
                .unwrap()
                .data()
                .get(UpgradeableLoaderState::size_of_buffer_metadata()..)
                .unwrap(),
            &[42; 9]
        );

        // Case: Write portion of the buffer
        let instruction = bincode::serialize(&UpgradeableLoaderInstruction::Write {
            offset: 3,
            bytes: vec![42; 6],
        })
        .unwrap();
        let mut buffer_account =
            AccountSharedData::new(1, UpgradeableLoaderState::size_of_buffer(9), &loader_id);
        buffer_account
            .set_state(&UpgradeableLoaderState::Buffer {
                authority_address: Some(buffer_address),
            })
            .unwrap();
        let accounts = process_instruction(
            &loader_id,
            &instruction,
            vec![(buffer_address, buffer_account.clone())],
            instruction_accounts.clone(),
            Ok(()),
        );
        let state: UpgradeableLoaderState = accounts.first().unwrap().state().unwrap();
        assert_eq!(
            state,
            UpgradeableLoaderState::Buffer {
                authority_address: Some(buffer_address)
            }
        );
        assert_eq!(
            &accounts
                .first()
                .unwrap()
                .data()
                .get(UpgradeableLoaderState::size_of_buffer_metadata()..)
                .unwrap(),
            &[0, 0, 0, 42, 42, 42, 42, 42, 42]
        );

        // Case: overflow size
        let instruction = bincode::serialize(&UpgradeableLoaderInstruction::Write {
            offset: 0,
            bytes: vec![42; 10],
        })
        .unwrap();
        buffer_account
            .set_state(&UpgradeableLoaderState::Buffer {
                authority_address: Some(buffer_address),
            })
            .unwrap();
        process_instruction(
            &loader_id,
            &instruction,
            vec![(buffer_address, buffer_account.clone())],
            instruction_accounts.clone(),
            Err(InstructionError::AccountDataTooSmall),
        );

        // Case: overflow offset
        let instruction = bincode::serialize(&UpgradeableLoaderInstruction::Write {
            offset: 1,
            bytes: vec![42; 9],
        })
        .unwrap();
        buffer_account
            .set_state(&UpgradeableLoaderState::Buffer {
                authority_address: Some(buffer_address),
            })
            .unwrap();
        process_instruction(
            &loader_id,
            &instruction,
            vec![(buffer_address, buffer_account.clone())],
            instruction_accounts.clone(),
            Err(InstructionError::AccountDataTooSmall),
        );

        // Case: Not signed
        let instruction = bincode::serialize(&UpgradeableLoaderInstruction::Write {
            offset: 0,
            bytes: vec![42; 9],
        })
        .unwrap();
        buffer_account
            .set_state(&UpgradeableLoaderState::Buffer {
                authority_address: Some(buffer_address),
            })
            .unwrap();
        process_instruction(
            &loader_id,
            &instruction,
            vec![(buffer_address, buffer_account.clone())],
            vec![
                AccountMeta {
                    pubkey: buffer_address,
                    is_signer: false,
                    is_writable: false,
                },
                AccountMeta {
                    pubkey: buffer_address,
                    is_signer: false,
                    is_writable: false,
                },
            ],
            Err(InstructionError::MissingRequiredSignature),
        );

        // Case: wrong authority
        let authority_address = Pubkey::new_unique();
        let instruction = bincode::serialize(&UpgradeableLoaderInstruction::Write {
            offset: 1,
            bytes: vec![42; 9],
        })
        .unwrap();
        buffer_account
            .set_state(&UpgradeableLoaderState::Buffer {
                authority_address: Some(buffer_address),
            })
            .unwrap();
        process_instruction(
            &loader_id,
            &instruction,
            vec![
                (buffer_address, buffer_account.clone()),
                (authority_address, buffer_account.clone()),
            ],
            vec![
                AccountMeta {
                    pubkey: buffer_address,
                    is_signer: false,
                    is_writable: false,
                },
                AccountMeta {
                    pubkey: authority_address,
                    is_signer: false,
                    is_writable: false,
                },
            ],
            Err(InstructionError::IncorrectAuthority),
        );

        // Case: None authority
        let instruction = bincode::serialize(&UpgradeableLoaderInstruction::Write {
            offset: 1,
            bytes: vec![42; 9],
        })
        .unwrap();
        buffer_account
            .set_state(&UpgradeableLoaderState::Buffer {
                authority_address: None,
            })
            .unwrap();
        process_instruction(
            &loader_id,
            &instruction,
            vec![(buffer_address, buffer_account.clone())],
            instruction_accounts,
            Err(InstructionError::Immutable),
        );
    }

    fn truncate_data(account: &mut AccountSharedData, len: usize) {
        let mut data = account.data().to_vec();
        data.truncate(len);
        account.set_data_from_slice(&data);
    }

    #[test]
    fn test_write_instruction_matches_sdk() {
        let instruction = UpgradeableLoaderInstruction::Write {
            offset: 7,
            bytes: vec![1, 2, 3],
        };
        // If this pattern fails, it means UpgradeableLoaderInstruction::Write has been changed
        // in the SDK. WriteInstruction in parse_write_instruction() MUST be changed to match it.
        let UpgradeableLoaderInstruction::Write { offset, bytes } = &instruction else {
            unreachable!()
        };
        let serialized = bincode::serialize(&instruction).unwrap();
        assert!(serialized.starts_with(&WRITE_INSTRUCTION_TAG));
        assert_eq!(
            parse_write_instruction(&serialized).unwrap(),
            (*offset, bytes.as_slice())
        );
    }

    #[test]
    fn test_bpf_loader_upgradeable_write_parsing() {
        let loader_id = bpf_loader_upgradeable::id();
        let buffer_address = Pubkey::new_unique();
        let max_bytes = solana_packet::PACKET_DATA_SIZE - WRITE_INSTRUCTION_HEADER_LEN;
        let mut buffer_account = AccountSharedData::new(
            1,
            UpgradeableLoaderState::size_of_buffer(max_bytes + 1),
            &loader_id,
        );
        buffer_account
            .set_state(&UpgradeableLoaderState::Buffer {
                authority_address: Some(buffer_address),
            })
            .unwrap();
        let instruction_accounts = vec![
            AccountMeta {
                pubkey: buffer_address,
                is_signer: false,
                is_writable: true,
            },
            AccountMeta {
                pubkey: buffer_address,
                is_signer: true,
                is_writable: false,
            },
        ];
        // Hand-assembled `Write`, so the declared length and the bytes actually
        // present can disagree.
        let write = |declared_len: u64, present: usize, trailing: usize| {
            let mut data = WRITE_INSTRUCTION_TAG.to_vec();
            data.extend_from_slice(&0u32.to_le_bytes());
            data.extend_from_slice(&declared_len.to_le_bytes());
            data.extend(std::iter::repeat_n(42u8, present));
            data.extend(std::iter::repeat_n(7u8, trailing));
            data
        };

        // Case: Trailing bytes are ignored, only the declared payload is written
        let accounts = process_instruction(
            &loader_id,
            &write(9, 9, 100),
            vec![(buffer_address, buffer_account.clone())],
            instruction_accounts.clone(),
            Ok(()),
        );
        let (written, untouched) = accounts
            .first()
            .unwrap()
            .data()
            .get(UpgradeableLoaderState::size_of_buffer_metadata()..)
            .unwrap()
            .split_at(9);
        assert_eq!(written, &[42; 9]);
        assert!(untouched.iter().all(|byte| *byte == 0));

        // Case: Largest payload that fits under the limit
        process_instruction(
            &loader_id,
            &write(max_bytes as u64, max_bytes, 0),
            vec![(buffer_address, buffer_account.clone())],
            instruction_accounts.clone(),
            Ok(()),
        );

        // Case: One byte over the limit
        process_instruction(
            &loader_id,
            &write(max_bytes as u64 + 1, max_bytes + 1, 0),
            vec![(buffer_address, buffer_account.clone())],
            instruction_accounts.clone(),
            Err(InstructionError::InvalidInstructionData),
        );

        // Case: Declared length exceeds the bytes present
        process_instruction(
            &loader_id,
            &write(600, 512, 0),
            vec![(buffer_address, buffer_account.clone())],
            instruction_accounts.clone(),
            Err(InstructionError::InvalidInstructionData),
        );

        // Case: Absurd declared length
        process_instruction(
            &loader_id,
            &write(u64::MAX, 512, 0),
            vec![(buffer_address, buffer_account.clone())],
            instruction_accounts.clone(),
            Err(InstructionError::InvalidInstructionData),
        );

        // Case: Truncated header
        process_instruction(
            &loader_id,
            write(0, 0, 0)
                .get(..WRITE_INSTRUCTION_HEADER_LEN - 1)
                .unwrap(),
            vec![(buffer_address, buffer_account)],
            instruction_accounts,
            Err(InstructionError::InvalidInstructionData),
        );
    }

    #[test_case(true; "simd_0433_enabled")]
    #[test_case(false; "simd_0433_disabled")]
    fn test_bpf_loader_upgradeable_upgrade(set_programdata_to_elf_length: bool) {
        let mut file = File::open("test_elfs/out/sbpfv3_return_ok.so").expect("file open failed");
        let mut elf_orig = Vec::new();
        file.read_to_end(&mut elf_orig).unwrap();
        let mut file = File::open("test_elfs/out/sbpfv3_return_err.so").expect("file open failed");
        let mut elf_new = Vec::new();
        file.read_to_end(&mut elf_new).unwrap();
        assert_ne!(elf_orig.len(), elf_new.len());
        const SLOT: u64 = 42;
        let buffer_address = Pubkey::new_unique();
        let upgrade_authority_address = Pubkey::new_unique();

        fn get_accounts(
            buffer_address: &Pubkey,
            buffer_authority: &Pubkey,
            upgrade_authority_address: &Pubkey,
            elf_orig: &[u8],
            elf_new: &[u8],
        ) -> (Vec<(Pubkey, AccountSharedData)>, Vec<AccountMeta>) {
            let loader_id = bpf_loader_upgradeable::id();
            let program_address = Pubkey::new_unique();
            let spill_address = Pubkey::new_unique();
            let rent = Rent::default();
            let min_program_balance =
                1.max(rent.minimum_balance(UpgradeableLoaderState::size_of_program()));
            let min_programdata_balance = 1.max(rent.minimum_balance(
                UpgradeableLoaderState::size_of_programdata(elf_orig.len().max(elf_new.len())),
            ));
            let (programdata_address, _) =
                Pubkey::find_program_address(&[program_address.as_ref()], &loader_id);
            let mut buffer_account = AccountSharedData::new(
                1,
                UpgradeableLoaderState::size_of_buffer(elf_new.len()),
                &bpf_loader_upgradeable::id(),
            );
            buffer_account
                .set_state(&UpgradeableLoaderState::Buffer {
                    authority_address: Some(*buffer_authority),
                })
                .unwrap();
            buffer_account
                .data_as_mut_slice()
                .get_mut(UpgradeableLoaderState::size_of_buffer_metadata()..)
                .unwrap()
                .copy_from_slice(elf_new);
            let mut programdata_account = AccountSharedData::new(
                min_programdata_balance,
                UpgradeableLoaderState::size_of_programdata(elf_orig.len().max(elf_new.len())),
                &bpf_loader_upgradeable::id(),
            );
            programdata_account
                .set_state(&UpgradeableLoaderState::ProgramData {
                    slot: SLOT,
                    upgrade_authority_address: Some(*upgrade_authority_address),
                })
                .unwrap();
            let mut program_account = AccountSharedData::new(
                min_program_balance,
                UpgradeableLoaderState::size_of_program(),
                &bpf_loader_upgradeable::id(),
            );
            program_account.set_executable(true);
            program_account
                .set_state(&UpgradeableLoaderState::Program {
                    programdata_address,
                })
                .unwrap();
            let spill_account = AccountSharedData::new(0, 0, &Pubkey::new_unique());
            let rent_account = create_sysvar_account(&rent);
            let clock_account = create_sysvar_account(&Clock {
                slot: SLOT.saturating_add(1),
                ..Clock::default()
            });
            let upgrade_authority_account = AccountSharedData::new(1, 0, &Pubkey::new_unique());
            let transaction_accounts = vec![
                (programdata_address, programdata_account),
                (program_address, program_account),
                (*buffer_address, buffer_account),
                (spill_address, spill_account),
                (sysvar::rent::id(), rent_account),
                (sysvar::clock::id(), clock_account),
                (*upgrade_authority_address, upgrade_authority_account),
            ];
            let instruction_accounts = vec![
                AccountMeta {
                    pubkey: programdata_address,
                    is_signer: false,
                    is_writable: true,
                },
                AccountMeta {
                    pubkey: program_address,
                    is_signer: false,
                    is_writable: true,
                },
                AccountMeta {
                    pubkey: *buffer_address,
                    is_signer: false,
                    is_writable: true,
                },
                AccountMeta {
                    pubkey: spill_address,
                    is_signer: false,
                    is_writable: true,
                },
                AccountMeta {
                    pubkey: sysvar::rent::id(),
                    is_signer: false,
                    is_writable: false,
                },
                AccountMeta {
                    pubkey: sysvar::clock::id(),
                    is_signer: false,
                    is_writable: false,
                },
                AccountMeta {
                    pubkey: *upgrade_authority_address,
                    is_signer: true,
                    is_writable: false,
                },
            ];
            (transaction_accounts, instruction_accounts)
        }

        let process_instruction =
            |transaction_accounts: Vec<(Pubkey, AccountSharedData)>,
             instruction_accounts: Vec<AccountMeta>,
             expected_result: Result<(), InstructionError>| {
                let instruction_data =
                    bincode::serialize(&UpgradeableLoaderInstruction::Upgrade).unwrap();
                process_instruction_with_setup(
                    &bpf_loader_upgradeable::id(),
                    &instruction_data,
                    transaction_accounts,
                    instruction_accounts,
                    LoaderV3Features {
                        set_programdata_to_elf_length,
                    },
                    expected_result,
                    |_invoke_context| {},
                )
            };

        // Case: Success
        let (transaction_accounts, instruction_accounts) = get_accounts(
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf_orig,
            &elf_new,
        );
        let accounts = process_instruction(transaction_accounts, instruction_accounts, Ok(()));
        let starting_programdata_len =
            UpgradeableLoaderState::size_of_programdata(elf_orig.len().max(elf_new.len()));
        let starting_programdata_balance =
            Rent::default().minimum_balance(starting_programdata_len);
        let expected_programdata_len = if set_programdata_to_elf_length {
            UpgradeableLoaderState::size_of_programdata(elf_new.len())
        } else {
            starting_programdata_len
        };
        let expected_programdata_balance =
            Rent::default().minimum_balance(expected_programdata_len);
        assert_eq!(
            expected_programdata_len,
            accounts.first().unwrap().data().len()
        );
        assert_eq!(
            expected_programdata_balance,
            accounts.first().unwrap().lamports()
        );
        assert_eq!(0, accounts.get(2).unwrap().lamports());
        // The buffer's lone lamport, plus any rent freed by the retraction.
        assert_eq!(
            starting_programdata_balance
                .saturating_sub(expected_programdata_balance)
                .saturating_add(1),
            accounts.get(3).unwrap().lamports()
        );
        assert_eq!(
            UpgradeableLoaderState::size_of_buffer(0),
            accounts.get(2).unwrap().data().len()
        );
        let state: UpgradeableLoaderState = accounts.first().unwrap().state().unwrap();
        assert_eq!(
            state,
            UpgradeableLoaderState::ProgramData {
                slot: SLOT.saturating_add(1),
                upgrade_authority_address: Some(upgrade_authority_address)
            }
        );
        for (i, byte) in accounts
            .first()
            .unwrap()
            .data()
            .get(
                UpgradeableLoaderState::size_of_programdata_metadata()
                    ..UpgradeableLoaderState::size_of_programdata(elf_new.len()),
            )
            .unwrap()
            .iter()
            .enumerate()
        {
            assert_eq!(*elf_new.get(i).unwrap(), *byte);
        }

        // Case: not upgradable
        let (mut transaction_accounts, instruction_accounts) = get_accounts(
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf_orig,
            &elf_new,
        );
        transaction_accounts
            .get_mut(0)
            .unwrap()
            .1
            .set_state(&UpgradeableLoaderState::ProgramData {
                slot: SLOT,
                upgrade_authority_address: None,
            })
            .unwrap();
        process_instruction(
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::Immutable),
        );

        // Case: wrong authority
        let (mut transaction_accounts, mut instruction_accounts) = get_accounts(
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf_orig,
            &elf_new,
        );
        let invalid_upgrade_authority_address = Pubkey::new_unique();
        transaction_accounts.get_mut(6).unwrap().0 = invalid_upgrade_authority_address;
        instruction_accounts.get_mut(6).unwrap().pubkey = invalid_upgrade_authority_address;
        process_instruction(
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::IncorrectAuthority),
        );

        // Case: authority did not sign
        let (transaction_accounts, mut instruction_accounts) = get_accounts(
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf_orig,
            &elf_new,
        );
        instruction_accounts.get_mut(6).unwrap().is_signer = false;
        process_instruction(
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::MissingRequiredSignature),
        );

        // Case: Buffer account and spill account alias
        let (transaction_accounts, mut instruction_accounts) = get_accounts(
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf_orig,
            &elf_new,
        );
        *instruction_accounts.get_mut(3).unwrap() = instruction_accounts.get(2).unwrap().clone();
        process_instruction(
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::AccountBorrowFailed),
        );

        // Case: Programdata account and spill account alias
        let (transaction_accounts, mut instruction_accounts) = get_accounts(
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf_orig,
            &elf_new,
        );
        *instruction_accounts.get_mut(3).unwrap() = instruction_accounts.first().unwrap().clone();
        process_instruction(
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::AccountBorrowFailed),
        );

        // Case: Program account not a program
        let (transaction_accounts, mut instruction_accounts) = get_accounts(
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf_orig,
            &elf_new,
        );
        *instruction_accounts.get_mut(1).unwrap() = instruction_accounts.get(2).unwrap().clone();
        let instruction_data = bincode::serialize(&UpgradeableLoaderInstruction::Upgrade).unwrap();

        process_instruction_with_setup(
            &bpf_loader_upgradeable::id(),
            &instruction_data,
            transaction_accounts.clone(),
            instruction_accounts.clone(),
            LoaderV3Features {
                set_programdata_to_elf_length,
            },
            Err(InstructionError::InvalidAccountData),
            |invoke_context| {
                test_utils::load_all_invoked_programs(invoke_context);
            },
        );
        process_instruction(
            transaction_accounts.clone(),
            instruction_accounts.clone(),
            Err(InstructionError::InvalidAccountData),
        );

        // Case: Program account now owned by loader
        let (mut transaction_accounts, instruction_accounts) = get_accounts(
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf_orig,
            &elf_new,
        );
        transaction_accounts
            .get_mut(1)
            .unwrap()
            .1
            .set_owner(Pubkey::new_unique());
        process_instruction(
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::IncorrectProgramId),
        );

        // Case: Program account not writable
        let (transaction_accounts, mut instruction_accounts) = get_accounts(
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf_orig,
            &elf_new,
        );
        instruction_accounts.get_mut(1).unwrap().is_writable = false;
        process_instruction(
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::InvalidArgument),
        );

        // Case: Program account not initialized
        let (mut transaction_accounts, instruction_accounts) = get_accounts(
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf_orig,
            &elf_new,
        );
        transaction_accounts
            .get_mut(1)
            .unwrap()
            .1
            .set_state(&UpgradeableLoaderState::Uninitialized)
            .unwrap();
        process_instruction(
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::InvalidAccountData),
        );

        // Case: Program ProgramData account mismatch
        let (mut transaction_accounts, mut instruction_accounts) = get_accounts(
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf_orig,
            &elf_new,
        );
        let invalid_programdata_address = Pubkey::new_unique();
        transaction_accounts.get_mut(0).unwrap().0 = invalid_programdata_address;
        instruction_accounts.get_mut(0).unwrap().pubkey = invalid_programdata_address;
        process_instruction(
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::InvalidArgument),
        );

        // Case: Buffer account not initialized
        let (mut transaction_accounts, instruction_accounts) = get_accounts(
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf_orig,
            &elf_new,
        );
        transaction_accounts
            .get_mut(2)
            .unwrap()
            .1
            .set_state(&UpgradeableLoaderState::Uninitialized)
            .unwrap();
        process_instruction(
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::InvalidArgument),
        );

        // Case: Buffer account not writable
        for buffer_balance in [0, 1_000_000, 15 * 1_000_000_000] {
            let (mut transaction_accounts, mut instruction_accounts) = get_accounts(
                &buffer_address,
                &upgrade_authority_address,
                &upgrade_authority_address,
                &elf_orig,
                &elf_new,
            );
            transaction_accounts
                .get_mut(2)
                .unwrap()
                .1
                .set_lamports(buffer_balance);
            instruction_accounts.get_mut(2).unwrap().is_writable = false;
            process_instruction(
                transaction_accounts,
                instruction_accounts,
                Err(InstructionError::InvalidArgument),
            );
        }

        // Case: Buffer account not owned by loader: lamports scenario
        //
        // In `Upgrade`, the buffer's lamports are used to fund the additional
        // programdata rent directly, with the rest spilled to the spill
        // account. Then, the buffer's data is set to `size_of_buffer(0)`.
        let (mut transaction_accounts, instruction_accounts) = get_accounts(
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf_orig,
            &elf_new,
        );
        {
            // Let's make sure the programdata requires a top-up.
            let required_rent = |elf_len| {
                Rent::default()
                    .minimum_balance(UpgradeableLoaderState::size_of_programdata(elf_len))
            };
            let rent_orig = required_rent(elf_orig.len());
            let rent_new = required_rent(elf_new.len());
            let programdata = &mut transaction_accounts.first_mut().unwrap().1;
            programdata.set_lamports(rent_orig);
            let buffer = &mut transaction_accounts.get_mut(2).unwrap().1;
            buffer.set_owner(Pubkey::new_unique());
            buffer.set_lamports(rent_new);
        }
        process_instruction(
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::IncorrectProgramId),
        );

        // Case: Buffer account not owned by loader: shrink scenario
        //
        // Same as the above case, but give the buffer a lamports balance of
        // `0`, rendering its balance "unchanged" by the spill operation.
        let (mut transaction_accounts, instruction_accounts) = get_accounts(
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf_orig,
            &elf_new,
        );
        {
            // Set the buffer's lamports to zero.
            let buffer = &mut transaction_accounts.get_mut(2).unwrap().1;
            buffer.set_owner(Pubkey::new_unique());
            buffer.set_lamports(0);
        }
        process_instruction(
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::IncorrectProgramId),
        );

        // Case: Buffer account not owned by loader: no-op scenario
        //
        // Same as the above case, but also truncate the buffer's data to
        // `size_of_buffer(0)` - just the buffer metadata, no ELF - rendering
        // the closing resize "unchanged" as well.
        let (mut transaction_accounts, instruction_accounts) = get_accounts(
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf_orig,
            &elf_new,
        );
        {
            // Empty the buffer (metadata only) and zero its lamports.
            let buffer = &mut transaction_accounts.get_mut(2).unwrap().1;
            buffer.set_owner(Pubkey::new_unique());
            buffer.set_lamports(0);
            truncate_data(buffer, UpgradeableLoaderState::size_of_buffer(0));
        }
        process_instruction(
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::IncorrectProgramId),
        );

        // Case: Buffer account too big
        let (mut transaction_accounts, instruction_accounts) = get_accounts(
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf_orig,
            &elf_new,
        );
        transaction_accounts.get_mut(2).unwrap().1 = AccountSharedData::new(
            1,
            UpgradeableLoaderState::size_of_buffer(
                elf_orig.len().max(elf_new.len()).saturating_add(1),
            ),
            &bpf_loader_upgradeable::id(),
        );
        transaction_accounts
            .get_mut(2)
            .unwrap()
            .1
            .set_state(&UpgradeableLoaderState::Buffer {
                authority_address: Some(upgrade_authority_address),
            })
            .unwrap();
        process_instruction(
            transaction_accounts,
            instruction_accounts,
            if set_programdata_to_elf_length {
                Err(InstructionError::InsufficientFunds)
            } else {
                Err(InstructionError::AccountDataTooSmall)
            },
        );

        // Case: Buffer account too small
        let (mut transaction_accounts, instruction_accounts) = get_accounts(
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf_orig,
            &elf_new,
        );
        transaction_accounts
            .get_mut(2)
            .unwrap()
            .1
            .set_state(&UpgradeableLoaderState::Buffer {
                authority_address: Some(upgrade_authority_address),
            })
            .unwrap();
        truncate_data(&mut transaction_accounts.get_mut(2).unwrap().1, 5);
        process_instruction(
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::InvalidAccountData),
        );

        // Case: Mismatched buffer and program authority
        let (transaction_accounts, instruction_accounts) = get_accounts(
            &buffer_address,
            &buffer_address,
            &upgrade_authority_address,
            &elf_orig,
            &elf_new,
        );
        process_instruction(
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::IncorrectAuthority),
        );

        // Case: No buffer authority
        let (mut transaction_accounts, instruction_accounts) = get_accounts(
            &buffer_address,
            &buffer_address,
            &upgrade_authority_address,
            &elf_orig,
            &elf_new,
        );
        transaction_accounts
            .get_mut(2)
            .unwrap()
            .1
            .set_state(&UpgradeableLoaderState::Buffer {
                authority_address: None,
            })
            .unwrap();
        process_instruction(
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::IncorrectAuthority),
        );

        // Case: No buffer and program authority
        let (mut transaction_accounts, instruction_accounts) = get_accounts(
            &buffer_address,
            &buffer_address,
            &upgrade_authority_address,
            &elf_orig,
            &elf_new,
        );
        transaction_accounts
            .get_mut(0)
            .unwrap()
            .1
            .set_state(&UpgradeableLoaderState::ProgramData {
                slot: SLOT,
                upgrade_authority_address: None,
            })
            .unwrap();
        transaction_accounts
            .get_mut(2)
            .unwrap()
            .1
            .set_state(&UpgradeableLoaderState::Buffer {
                authority_address: None,
            })
            .unwrap();
        process_instruction(
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::IncorrectAuthority),
        );

        // Case: Upgrade to SBPFv0
        let mut file =
            File::open("test_elfs/out/sbpfv0_verifier_err.so").expect("file open failed");
        let mut elf_new = Vec::new();
        file.read_to_end(&mut elf_new).unwrap();
        let (transaction_accounts, instruction_accounts) = get_accounts(
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf_orig,
            &elf_new,
        );
        process_instruction(
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::InvalidAccountData),
        );
    }

    #[test]
    fn test_bpf_loader_upgradeable_upgrade_simd_0433() {
        let mut file = File::open("test_elfs/out/sbpfv3_return_err.so").expect("file open failed");
        let mut elf_small = Vec::new();
        file.read_to_end(&mut elf_small).unwrap();
        let mut file = File::open("test_elfs/out/sbpfv3_return_ok.so").expect("file open failed");
        let mut elf_large = Vec::new();
        file.read_to_end(&mut elf_large).unwrap();
        assert!(elf_small.len() < elf_large.len());
        const SLOT: u64 = 42;
        let upgrade_authority_address = Pubkey::new_unique();

        fn get_accounts(
            upgrade_authority_address: &Pubkey,
            elf_orig: &[u8],
            elf_new: &[u8],
            programdata_len: usize,
            programdata_lamports: u64,
            buffer_len: usize,
            buffer_lamports: u64,
        ) -> (Vec<(Pubkey, AccountSharedData)>, Vec<AccountMeta>) {
            assert!(programdata_len >= UpgradeableLoaderState::size_of_programdata(elf_orig.len()));
            assert!(buffer_len >= UpgradeableLoaderState::size_of_buffer(elf_new.len()));
            let loader_id = bpf_loader_upgradeable::id();
            let program_address = Pubkey::new_unique();
            let buffer_address = Pubkey::new_unique();
            let spill_address = Pubkey::new_unique();
            let rent = Rent::default();
            let (programdata_address, _) =
                Pubkey::find_program_address(&[program_address.as_ref()], &loader_id);

            let mut buffer_account =
                AccountSharedData::new(buffer_lamports, buffer_len, &loader_id);
            buffer_account
                .set_state(&UpgradeableLoaderState::Buffer {
                    authority_address: Some(*upgrade_authority_address),
                })
                .unwrap();
            let buffer_data_offset = UpgradeableLoaderState::size_of_buffer_metadata();
            buffer_account
                .data_as_mut_slice()
                .get_mut(buffer_data_offset..buffer_data_offset.saturating_add(elf_new.len()))
                .unwrap()
                .copy_from_slice(elf_new);

            let mut programdata_account =
                AccountSharedData::new(programdata_lamports, programdata_len, &loader_id);
            programdata_account
                .set_state(&UpgradeableLoaderState::ProgramData {
                    slot: SLOT,
                    upgrade_authority_address: Some(*upgrade_authority_address),
                })
                .unwrap();
            let programdata_data_offset = UpgradeableLoaderState::size_of_programdata_metadata();
            programdata_account
                .data_as_mut_slice()
                .get_mut(
                    programdata_data_offset..programdata_data_offset.saturating_add(elf_orig.len()),
                )
                .unwrap()
                .copy_from_slice(elf_orig);

            let mut program_account = AccountSharedData::new(
                rent.minimum_balance(UpgradeableLoaderState::size_of_program()),
                UpgradeableLoaderState::size_of_program(),
                &loader_id,
            );
            program_account.set_executable(true);
            program_account
                .set_state(&UpgradeableLoaderState::Program {
                    programdata_address,
                })
                .unwrap();

            let spill_account = AccountSharedData::new(0, 0, &Pubkey::new_unique());
            let rent_account = create_sysvar_account(&rent);
            let clock_account = create_sysvar_account(&Clock {
                slot: SLOT.saturating_add(1),
                ..Clock::default()
            });
            let upgrade_authority_account = AccountSharedData::new(1, 0, &Pubkey::new_unique());
            let transaction_accounts = vec![
                (programdata_address, programdata_account),
                (program_address, program_account),
                (buffer_address, buffer_account),
                (spill_address, spill_account),
                (sysvar::rent::id(), rent_account),
                (sysvar::clock::id(), clock_account),
                (*upgrade_authority_address, upgrade_authority_account),
            ];
            let instruction_accounts = vec![
                AccountMeta {
                    pubkey: programdata_address,
                    is_signer: false,
                    is_writable: true,
                },
                AccountMeta {
                    pubkey: program_address,
                    is_signer: false,
                    is_writable: true,
                },
                AccountMeta {
                    pubkey: buffer_address,
                    is_signer: false,
                    is_writable: true,
                },
                AccountMeta {
                    pubkey: spill_address,
                    is_signer: false,
                    is_writable: true,
                },
                AccountMeta {
                    pubkey: sysvar::rent::id(),
                    is_signer: false,
                    is_writable: false,
                },
                AccountMeta {
                    pubkey: sysvar::clock::id(),
                    is_signer: false,
                    is_writable: false,
                },
                AccountMeta {
                    pubkey: *upgrade_authority_address,
                    is_signer: true,
                    is_writable: false,
                },
            ];
            (transaction_accounts, instruction_accounts)
        }

        let process_instruction =
            |transaction_accounts: Vec<(Pubkey, AccountSharedData)>,
             instruction_accounts: Vec<AccountMeta>,
             expected_result: Result<(), InstructionError>| {
                let instruction_data =
                    bincode::serialize(&UpgradeableLoaderInstruction::Upgrade).unwrap();
                process_instruction_with_setup(
                    &bpf_loader_upgradeable::id(),
                    &instruction_data,
                    transaction_accounts,
                    instruction_accounts,
                    LoaderV3Features {
                        set_programdata_to_elf_length: true,
                    },
                    expected_result,
                    |_invoke_context| {},
                )
            };

        let rent = Rent::default();
        let programdata_data_offset = UpgradeableLoaderState::size_of_programdata_metadata();
        let small_len = UpgradeableLoaderState::size_of_programdata(elf_small.len());
        let large_len = UpgradeableLoaderState::size_of_programdata(elf_large.len());
        let small_balance = rent.minimum_balance(small_len);
        let large_balance = rent.minimum_balance(large_len);

        let assert_upgraded =
            |accounts: &[AccountSharedData], elf_new: &[u8], expected_len: usize| {
                let programdata = accounts.first().unwrap();
                // Programdata has expected length.,
                assert_eq!(expected_len, programdata.data().len());
                // Rent-exempt for its new size.
                assert_eq!(rent.minimum_balance(expected_len), programdata.lamports());
                // ELF is the new ELF.
                assert_eq!(
                    elf_new,
                    programdata
                        .data()
                        .get(
                            programdata_data_offset
                                ..programdata_data_offset.saturating_add(elf_new.len())
                        )
                        .unwrap()
                );
                // Metadata unchanged.
                let state: UpgradeableLoaderState = programdata.state().unwrap();
                assert_eq!(
                    UpgradeableLoaderState::ProgramData {
                        slot: SLOT.saturating_add(1),
                        upgrade_authority_address: Some(upgrade_authority_address),
                    },
                    state
                );
                // Buffer cleared.
                let buffer = accounts.get(2).unwrap();
                assert_eq!(0, buffer.lamports());
                assert_eq!(
                    UpgradeableLoaderState::size_of_buffer(0),
                    buffer.data().len()
                );
            };

        // Case: Shrink success
        let (transaction_accounts, instruction_accounts) = get_accounts(
            &upgrade_authority_address,
            &elf_large,
            &elf_small,
            large_len,
            large_balance,
            UpgradeableLoaderState::size_of_buffer(elf_small.len()),
            1,
        );
        let accounts = process_instruction(transaction_accounts, instruction_accounts, Ok(()));
        assert_upgraded(&accounts, &elf_small, small_len);
        assert_eq!(
            large_balance
                .saturating_sub(small_balance)
                .saturating_add(1),
            accounts.get(3).unwrap().lamports()
        );

        // Case: Shrink success overprovisioned programdata
        let extended_len = large_len.saturating_add(4096);
        let extended_balance = rent.minimum_balance(extended_len);
        let (transaction_accounts, instruction_accounts) = get_accounts(
            &upgrade_authority_address,
            &elf_large,
            &elf_small,
            extended_len,
            extended_balance,
            UpgradeableLoaderState::size_of_buffer(elf_small.len()),
            1,
        );
        let accounts = process_instruction(transaction_accounts, instruction_accounts, Ok(()));
        assert_upgraded(&accounts, &elf_small, small_len);
        assert_eq!(
            extended_balance
                .saturating_sub(small_balance)
                .saturating_add(1),
            accounts.get(3).unwrap().lamports()
        );

        // Case: Shrink success larger ELF
        //
        // The new ELF is bigger, but the account was over-provisioned past
        // even that, so it still retracts and still refunds rent.
        let extended_len = large_len.saturating_add(4096);
        let extended_balance = rent.minimum_balance(extended_len);
        let (transaction_accounts, instruction_accounts) = get_accounts(
            &upgrade_authority_address,
            &elf_small,
            &elf_large,
            extended_len,
            extended_balance,
            UpgradeableLoaderState::size_of_buffer(elf_large.len()),
            1,
        );
        let accounts = process_instruction(transaction_accounts, instruction_accounts, Ok(()));
        assert_upgraded(&accounts, &elf_large, large_len);
        assert!(small_len < large_len && large_len < extended_len);
        assert_eq!(
            extended_balance
                .saturating_sub(large_balance)
                .saturating_add(1),
            accounts.get(3).unwrap().lamports()
        );

        // Case: Shrink success overprovisioned buffer
        let padded_buffer_len =
            UpgradeableLoaderState::size_of_buffer(elf_small.len()).saturating_add(32);
        let padded_len = small_len.saturating_add(32);
        let padded_balance = rent.minimum_balance(padded_len);
        assert!(padded_len < large_len);
        let (transaction_accounts, instruction_accounts) = get_accounts(
            &upgrade_authority_address,
            &elf_large,
            &elf_small,
            large_len,
            large_balance,
            padded_buffer_len,
            1,
        );
        let accounts = process_instruction(transaction_accounts, instruction_accounts, Ok(()));
        assert_upgraded(&accounts, &elf_small, padded_len);
        // The padding should still be all zeroes.
        assert!(
            accounts
                .first()
                .unwrap()
                .data()
                .get(programdata_data_offset.saturating_add(elf_small.len())..)
                .unwrap()
                .iter()
                .all(|byte| *byte == 0)
        );
        assert_eq!(
            large_balance
                .saturating_sub(padded_balance)
                .saturating_add(1),
            accounts.get(3).unwrap().lamports()
        );

        // Case: Shrink success funded for the new size only
        let (transaction_accounts, instruction_accounts) = get_accounts(
            &upgrade_authority_address,
            &elf_large,
            &elf_small,
            large_len,
            small_balance, // <-- only enough for the new ELF
            UpgradeableLoaderState::size_of_buffer(elf_small.len()),
            0,
        );
        let accounts = process_instruction(transaction_accounts, instruction_accounts, Ok(()));
        assert_upgraded(&accounts, &elf_small, small_len);
        assert_eq!(0, accounts.get(3).unwrap().lamports());

        // Case: Shrink insufficient funds
        // Same as above, but 1 lamport shy.
        let (transaction_accounts, instruction_accounts) = get_accounts(
            &upgrade_authority_address,
            &elf_large,
            &elf_small,
            large_len,
            small_balance.saturating_sub(1),
            UpgradeableLoaderState::size_of_buffer(elf_small.len()),
            0,
        );
        process_instruction(
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::InsufficientFunds),
        );

        // Case: Grow success
        let (transaction_accounts, instruction_accounts) = get_accounts(
            &upgrade_authority_address,
            &elf_small,
            &elf_large,
            small_len,
            small_balance,
            UpgradeableLoaderState::size_of_buffer(elf_large.len()),
            large_balance,
        );
        let accounts = process_instruction(transaction_accounts, instruction_accounts, Ok(()));
        assert_upgraded(&accounts, &elf_large, large_len);
        // The buffer covered the new rent, so ProgramData's whole original
        // balance spills.
        assert_eq!(small_balance, accounts.get(3).unwrap().lamports());

        // Case: Grow success overprovisioned programdata
        let extended_len = small_len.saturating_add(50);
        let extended_balance = rent.minimum_balance(extended_len);
        assert!(extended_len < large_len);
        let (transaction_accounts, instruction_accounts) = get_accounts(
            &upgrade_authority_address,
            &elf_small,
            &elf_large,
            extended_len,
            extended_balance,
            UpgradeableLoaderState::size_of_buffer(elf_large.len()),
            large_balance,
        );
        let accounts = process_instruction(transaction_accounts, instruction_accounts, Ok(()));
        assert_upgraded(&accounts, &elf_large, large_len);
        // ProgramData lands on the new ELF's length, so the extra bytes are
        // overwritten. Again the buffer covers the rent, so the whole
        // ProgramData balance is swept.
        assert_eq!(extended_balance, accounts.get(3).unwrap().lamports());

        // Case: Grow success overprovisioned buffer
        let padded_buffer_len =
            UpgradeableLoaderState::size_of_buffer(elf_large.len()).saturating_add(64);
        let padded_len = large_len.saturating_add(64);
        let padded_balance = rent.minimum_balance(padded_len);
        let (transaction_accounts, instruction_accounts) = get_accounts(
            &upgrade_authority_address,
            &elf_small,
            &elf_large,
            small_len,
            padded_balance,
            padded_buffer_len,
            0,
        );
        let accounts = process_instruction(transaction_accounts, instruction_accounts, Ok(()));
        assert_upgraded(&accounts, &elf_large, padded_len);
        assert!(
            accounts
                .first()
                .unwrap()
                .data()
                .get(programdata_data_offset.saturating_add(elf_large.len())..)
                .unwrap()
                .iter()
                .all(|byte| *byte == 0)
        );
        assert_eq!(0, accounts.get(3).unwrap().lamports());

        // Case: Grow success funded by programdata
        let (transaction_accounts, instruction_accounts) = get_accounts(
            &upgrade_authority_address,
            &elf_small,
            &elf_large,
            small_len,
            large_balance,
            UpgradeableLoaderState::size_of_buffer(elf_large.len()),
            0,
        );
        let accounts = process_instruction(transaction_accounts, instruction_accounts, Ok(()));
        assert_upgraded(&accounts, &elf_large, large_len);
        // The buffer is empty; ProgramData's own balance covers the new rent.
        assert_eq!(0, accounts.get(3).unwrap().lamports());

        // Case: Grow, insufficient funds
        let deficit = large_balance.saturating_sub(small_balance);
        let (transaction_accounts, instruction_accounts) = get_accounts(
            &upgrade_authority_address,
            &elf_small,
            &elf_large,
            small_len,
            small_balance,
            UpgradeableLoaderState::size_of_buffer(elf_large.len()),
            deficit.saturating_sub(1), // <-- 1 lamport shy
        );
        process_instruction(
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::InsufficientFunds),
        );

        // Case: No resize, ELF length already matches
        let (transaction_accounts, instruction_accounts) = get_accounts(
            &upgrade_authority_address,
            &elf_large,
            &elf_large,
            large_len,
            large_balance,
            UpgradeableLoaderState::size_of_buffer(elf_large.len()),
            1,
        );
        let accounts = process_instruction(transaction_accounts, instruction_accounts, Ok(()));
        assert_upgraded(&accounts, &elf_large, large_len);
        // Just the buffer lamports get swept.
        assert_eq!(1, accounts.get(3).unwrap().lamports());

        // Case: Zero-length ELF in the buffer
        let (transaction_accounts, instruction_accounts) = get_accounts(
            &upgrade_authority_address,
            &elf_large,
            &[],
            large_len,
            large_balance,
            UpgradeableLoaderState::size_of_buffer(0),
            1,
        );
        process_instruction(
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::InvalidAccountData),
        );

        // Case: New length exceeds the max account data length
        let oversized_elf_len = (MAX_PERMITTED_DATA_LENGTH as usize)
            .saturating_sub(UpgradeableLoaderState::size_of_buffer_metadata());
        let mut oversized_elf = elf_large.clone();
        oversized_elf.resize(oversized_elf_len, 0);
        assert!(
            UpgradeableLoaderState::size_of_programdata(oversized_elf.len())
                > MAX_PERMITTED_DATA_LENGTH as usize
        );
        let (transaction_accounts, instruction_accounts) = get_accounts(
            &upgrade_authority_address,
            &elf_small,
            &oversized_elf,
            small_len,
            u64::MAX / 2,
            UpgradeableLoaderState::size_of_buffer(oversized_elf.len()),
            0,
        );
        process_instruction(
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::InvalidAccountData),
        );
    }

    #[test]
    fn test_bpf_loader_upgradeable_deploy_with_max_data_len() {
        let mut file = File::open("test_elfs/out/sbpfv3_return_ok.so").expect("file open failed");
        let mut elf = Vec::new();
        file.read_to_end(&mut elf).unwrap();
        const SLOT: u64 = 42;
        let payer_address = Pubkey::new_unique();
        let buffer_address = Pubkey::new_unique();
        let upgrade_authority_address = Pubkey::new_unique();

        fn get_accounts(
            payer_address: &Pubkey,
            buffer_address: &Pubkey,
            buffer_authority: &Pubkey,
            upgrade_authority_address: &Pubkey,
            elf: &[u8],
        ) -> (Vec<(Pubkey, AccountSharedData)>, Vec<AccountMeta>) {
            let loader_id = bpf_loader_upgradeable::id();
            let program_address = Pubkey::new_unique();
            let rent = Rent::default();
            let min_program_balance =
                1.max(rent.minimum_balance(UpgradeableLoaderState::size_of_program()));
            let min_programdata_balance =
                1.max(rent.minimum_balance(UpgradeableLoaderState::size_of_programdata(elf.len())));
            let (programdata_address, _) =
                Pubkey::find_program_address(&[program_address.as_ref()], &loader_id);
            let mut buffer_account = AccountSharedData::new(
                1,
                UpgradeableLoaderState::size_of_buffer(elf.len()),
                &bpf_loader_upgradeable::id(),
            );
            buffer_account
                .set_state(&UpgradeableLoaderState::Buffer {
                    authority_address: Some(*buffer_authority),
                })
                .unwrap();
            buffer_account
                .data_as_mut_slice()
                .get_mut(UpgradeableLoaderState::size_of_buffer_metadata()..)
                .unwrap()
                .copy_from_slice(elf);
            let programdata_account = AccountSharedData::new(0, 0, &system_program::id());
            let mut program_account = AccountSharedData::new(
                min_program_balance,
                UpgradeableLoaderState::size_of_program(),
                &bpf_loader_upgradeable::id(),
            );
            program_account
                .set_state(&UpgradeableLoaderState::Uninitialized)
                .unwrap();
            let payer_account = AccountSharedData::new(
                min_programdata_balance.saturating_add(1),
                0,
                &system_program::id(),
            );
            let rent_account = create_sysvar_account(&rent);
            let clock_account = create_sysvar_account(&Clock {
                slot: SLOT,
                ..Clock::default()
            });
            let system_program_account = AccountSharedData::new(0, 0, &native_loader::id());
            let upgrade_authority_account = AccountSharedData::new(1, 0, &Pubkey::new_unique());
            let transaction_accounts = vec![
                (*payer_address, payer_account),
                (programdata_address, programdata_account),
                (program_address, program_account),
                (*buffer_address, buffer_account),
                (sysvar::rent::id(), rent_account),
                (sysvar::clock::id(), clock_account),
                (system_program::id(), system_program_account),
                (*upgrade_authority_address, upgrade_authority_account),
            ];
            let instruction_accounts = vec![
                AccountMeta {
                    pubkey: *payer_address,
                    is_signer: true,
                    is_writable: true,
                },
                AccountMeta {
                    pubkey: programdata_address,
                    is_signer: false,
                    is_writable: true,
                },
                AccountMeta {
                    pubkey: program_address,
                    is_signer: false,
                    is_writable: true,
                },
                AccountMeta {
                    pubkey: *buffer_address,
                    is_signer: false,
                    is_writable: true,
                },
                AccountMeta {
                    pubkey: sysvar::rent::id(),
                    is_signer: false,
                    is_writable: false,
                },
                AccountMeta {
                    pubkey: sysvar::clock::id(),
                    is_signer: false,
                    is_writable: false,
                },
                AccountMeta {
                    pubkey: system_program::id(),
                    is_signer: false,
                    is_writable: false,
                },
                AccountMeta {
                    pubkey: *upgrade_authority_address,
                    is_signer: true,
                    is_writable: false,
                },
            ];
            (transaction_accounts, instruction_accounts)
        }

        fn process_instruction(
            max_data_len: usize,
            transaction_accounts: Vec<(Pubkey, AccountSharedData)>,
            instruction_accounts: Vec<AccountMeta>,
            expected_result: Result<(), InstructionError>,
        ) -> Vec<AccountSharedData> {
            let instruction_data =
                bincode::serialize(&UpgradeableLoaderInstruction::DeployWithMaxDataLen {
                    max_data_len,
                })
                .unwrap();
            process_instruction_with_setup(
                &bpf_loader_upgradeable::id(),
                &instruction_data,
                transaction_accounts,
                instruction_accounts,
                LoaderV3Features::all_enabled(),
                expected_result,
                |invoke_context| {
                    // Register the system program for CPI support.
                    invoke_context.program_cache_for_tx_batch.replenish(
                        system_program::id(),
                        Arc::new(ProgramCacheEntry::new_builtin(
                            solana_system_program::system_processor::Entrypoint::register,
                        )),
                    );
                },
            )
        }

        // Case: Success
        let (transaction_accounts, instruction_accounts) = get_accounts(
            &payer_address,
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf,
        );
        let programdata_address = instruction_accounts.get(1).unwrap().pubkey;
        let accounts = process_instruction(
            elf.len(),
            transaction_accounts,
            instruction_accounts,
            Ok(()),
        );
        let min_programdata_balance =
            Rent::default().minimum_balance(UpgradeableLoaderState::size_of_programdata(elf.len()));
        assert_eq!(min_programdata_balance, accounts.get(1).unwrap().lamports());
        assert_eq!(2, accounts.first().unwrap().lamports());
        assert_eq!(0, accounts.get(3).unwrap().lamports());
        assert_eq!(
            UpgradeableLoaderState::size_of_buffer(0),
            accounts.get(3).unwrap().data().len()
        );
        let state: UpgradeableLoaderState = accounts.get(1).unwrap().state().unwrap();
        assert_eq!(
            state,
            UpgradeableLoaderState::ProgramData {
                slot: SLOT,
                upgrade_authority_address: Some(upgrade_authority_address),
            }
        );
        for (i, byte) in accounts
            .get(1)
            .unwrap()
            .data()
            .get(
                UpgradeableLoaderState::size_of_programdata_metadata()
                    ..UpgradeableLoaderState::size_of_programdata(elf.len()),
            )
            .unwrap()
            .iter()
            .enumerate()
        {
            assert_eq!(*elf.get(i).unwrap(), *byte);
        }
        let state: UpgradeableLoaderState = accounts.get(2).unwrap().state().unwrap();
        assert_eq!(
            state,
            UpgradeableLoaderState::Program {
                programdata_address,
            }
        );
        assert!(accounts.get(2).unwrap().executable());

        // Case: wrong authority
        let (mut transaction_accounts, mut instruction_accounts) = get_accounts(
            &payer_address,
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf,
        );
        let invalid_upgrade_authority_address = Pubkey::new_unique();
        transaction_accounts.get_mut(7).unwrap().0 = invalid_upgrade_authority_address;
        instruction_accounts.get_mut(7).unwrap().pubkey = invalid_upgrade_authority_address;
        process_instruction(
            elf.len(),
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::IncorrectAuthority),
        );

        // Case: authority did not sign
        let (transaction_accounts, mut instruction_accounts) = get_accounts(
            &payer_address,
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf,
        );
        instruction_accounts.get_mut(7).unwrap().is_signer = false;
        process_instruction(
            elf.len(),
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::MissingRequiredSignature),
        );

        // Case: Buffer account and payer account alias
        let (transaction_accounts, mut instruction_accounts) = get_accounts(
            &payer_address,
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf,
        );
        *instruction_accounts.get_mut(0).unwrap() = instruction_accounts.get(3).unwrap().clone();
        process_instruction(
            elf.len(),
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::AccountBorrowFailed),
        );

        // Case: Program account not owned by loader
        //
        // Unlike `Upgrade`, `DeployWithMaxDataLen` has no explicit owner
        // check on the program account. Validation passes, and the failure
        // only surfaces at the end when the handler tries to mutate the
        // program's state — `set_state` requires the account to be owned by
        // the currently-executing program, so it trips
        // `ExternalAccountDataModified`.
        let (mut transaction_accounts, instruction_accounts) = get_accounts(
            &payer_address,
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf,
        );
        transaction_accounts
            .get_mut(2)
            .unwrap()
            .1
            .set_owner(Pubkey::new_unique());
        process_instruction(
            elf.len(),
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::ExternalAccountDataModified),
        );

        // Case: Program account not writable
        //
        // `DeployWithMaxDataLen` also lacks an explicit writability check on
        // the program account, so the failure again surfaces at
        // `set_state`, this time via the writability guard: a non-writable
        // account yields `ReadonlyDataModified`.
        let (transaction_accounts, mut instruction_accounts) = get_accounts(
            &payer_address,
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf,
        );
        instruction_accounts.get_mut(2).unwrap().is_writable = false;
        process_instruction(
            elf.len(),
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::ReadonlyDataModified),
        );

        // Case: Program account already initialized
        let (mut transaction_accounts, instruction_accounts) = get_accounts(
            &payer_address,
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf,
        );
        transaction_accounts
            .get_mut(2)
            .unwrap()
            .1
            .set_state(&UpgradeableLoaderState::Program {
                programdata_address: Pubkey::new_unique(),
            })
            .unwrap();
        process_instruction(
            elf.len(),
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::AccountAlreadyInitialized),
        );

        // Case: Program account too small
        let (mut transaction_accounts, instruction_accounts) = get_accounts(
            &payer_address,
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf,
        );
        truncate_data(&mut transaction_accounts.get_mut(2).unwrap().1, 5);
        process_instruction(
            elf.len(),
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::AccountDataTooSmall),
        );

        // Case: Program account not rent-exempt
        let (mut transaction_accounts, instruction_accounts) = get_accounts(
            &payer_address,
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf,
        );
        transaction_accounts.get_mut(2).unwrap().1.set_lamports(1);
        process_instruction(
            elf.len(),
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::ExecutableAccountNotRentExempt),
        );

        // Case: ProgramData address not derived
        let (mut transaction_accounts, mut instruction_accounts) = get_accounts(
            &payer_address,
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf,
        );
        let invalid_programdata_address = Pubkey::new_unique();
        transaction_accounts.get_mut(1).unwrap().0 = invalid_programdata_address;
        instruction_accounts.get_mut(1).unwrap().pubkey = invalid_programdata_address;
        process_instruction(
            elf.len(),
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::InvalidArgument),
        );

        // Case: Buffer account not initialized
        let (mut transaction_accounts, instruction_accounts) = get_accounts(
            &payer_address,
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf,
        );
        transaction_accounts
            .get_mut(3)
            .unwrap()
            .1
            .set_state(&UpgradeableLoaderState::Uninitialized)
            .unwrap();
        process_instruction(
            elf.len(),
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::InvalidArgument),
        );

        // Case: Buffer account not writable
        for buffer_balance in [0, 1_000_000, 15 * 1_000_000_000] {
            let (mut transaction_accounts, mut instruction_accounts) = get_accounts(
                &payer_address,
                &buffer_address,
                &upgrade_authority_address,
                &upgrade_authority_address,
                &elf,
            );
            transaction_accounts
                .get_mut(3)
                .unwrap()
                .1
                .set_lamports(buffer_balance);
            instruction_accounts.get_mut(3).unwrap().is_writable = false;
            process_instruction(
                elf.len(),
                transaction_accounts,
                instruction_accounts,
                Err(InstructionError::InvalidArgument),
            );
        }

        // Case: Buffer account not owned by loader: lamports scenario
        //
        // In `DeployWithMaxDataLen`, the buffer's lamports are drained to the
        // payer before the payer is debited for the programdata's rent. Then,
        // the buffer's data is set to `size_of_buffer(0)`.
        let (mut transaction_accounts, instruction_accounts) = get_accounts(
            &payer_address,
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf,
        );
        {
            // Let's make sure the programdata requires a top-up.
            let required_rent = Rent::default()
                .minimum_balance(UpgradeableLoaderState::size_of_programdata(elf.len()));
            let programdata = &transaction_accounts.get(1).unwrap().1;
            assert!(programdata.lamports() < required_rent);
            let buffer = &mut transaction_accounts.get_mut(3).unwrap().1;
            buffer.set_owner(Pubkey::new_unique());
            buffer.set_lamports(required_rent);
        }
        process_instruction(
            elf.len(),
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::IncorrectProgramId),
        );

        // Case: Buffer account not owned by loader: shrink scenario
        //
        // Same as the above case, but give the buffer a lamports balance of
        // `0`, rendering its balance "unchanged" by the drain operation.
        let (mut transaction_accounts, instruction_accounts) = get_accounts(
            &payer_address,
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf,
        );
        {
            // Set the buffer's lamports to zero.
            let buffer = &mut transaction_accounts.get_mut(3).unwrap().1;
            buffer.set_owner(Pubkey::new_unique());
            buffer.set_lamports(0);
        }
        process_instruction(
            elf.len(),
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::IncorrectProgramId),
        );

        // Case: Buffer account not owned by loader: no-op scenario
        //
        // Same as the above case, but also truncate the buffer's data to
        // `size_of_buffer(0)` - just the buffer metadata, no ELF - rendering
        // the closing resize "unchanged" as well.
        let (mut transaction_accounts, instruction_accounts) = get_accounts(
            &payer_address,
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf,
        );
        {
            // Empty the buffer (metadata only) and zero its lamports.
            let buffer = &mut transaction_accounts.get_mut(3).unwrap().1;
            buffer.set_owner(Pubkey::new_unique());
            buffer.set_lamports(0);
            truncate_data(buffer, UpgradeableLoaderState::size_of_buffer(0));
        }
        process_instruction(
            elf.len(),
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::IncorrectProgramId),
        );

        // Case: Max data length too small for Buffer data
        let (transaction_accounts, instruction_accounts) = get_accounts(
            &payer_address,
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf,
        );
        process_instruction(
            elf.len().saturating_sub(1),
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::AccountDataTooSmall),
        );

        // Case: Max data length too large
        let (transaction_accounts, instruction_accounts) = get_accounts(
            &payer_address,
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf,
        );
        process_instruction(
            MAX_PERMITTED_DATA_LENGTH as usize,
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::InvalidArgument),
        );

        // Case: Mismatched buffer authority
        let (transaction_accounts, instruction_accounts) = get_accounts(
            &payer_address,
            &buffer_address,
            &buffer_address,
            &upgrade_authority_address,
            &elf,
        );
        process_instruction(
            elf.len(),
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::IncorrectAuthority),
        );

        // Case: No buffer authority
        let (mut transaction_accounts, instruction_accounts) = get_accounts(
            &payer_address,
            &buffer_address,
            &buffer_address,
            &upgrade_authority_address,
            &elf,
        );
        transaction_accounts
            .get_mut(3)
            .unwrap()
            .1
            .set_state(&UpgradeableLoaderState::Buffer {
                authority_address: None,
            })
            .unwrap();
        process_instruction(
            elf.len(),
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::IncorrectAuthority),
        );

        // Case: Deploy SBPFv0
        let mut file =
            File::open("test_elfs/out/sbpfv0_verifier_err.so").expect("file open failed");
        let mut elf = Vec::new();
        file.read_to_end(&mut elf).unwrap();
        let (transaction_accounts, instruction_accounts) = get_accounts(
            &payer_address,
            &buffer_address,
            &upgrade_authority_address,
            &upgrade_authority_address,
            &elf,
        );
        process_instruction(
            elf.len(),
            transaction_accounts,
            instruction_accounts,
            Err(InstructionError::InvalidAccountData),
        );
    }

    #[test]
    fn test_bpf_loader_upgradeable_set_upgrade_authority() {
        let instruction = bincode::serialize(&UpgradeableLoaderInstruction::SetAuthority).unwrap();
        let loader_id = bpf_loader_upgradeable::id();
        let slot = 0;
        let upgrade_authority_address = Pubkey::new_unique();
        let upgrade_authority_account = AccountSharedData::new(1, 0, &Pubkey::new_unique());
        let new_upgrade_authority_address = Pubkey::new_unique();
        let new_upgrade_authority_account = AccountSharedData::new(1, 0, &Pubkey::new_unique());
        let program_address = Pubkey::new_unique();
        let (programdata_address, _) = Pubkey::find_program_address(
            &[program_address.as_ref()],
            &bpf_loader_upgradeable::id(),
        );
        let mut programdata_account = AccountSharedData::new(
            1,
            UpgradeableLoaderState::size_of_programdata(0),
            &bpf_loader_upgradeable::id(),
        );
        programdata_account
            .set_state(&UpgradeableLoaderState::ProgramData {
                slot,
                upgrade_authority_address: Some(upgrade_authority_address),
            })
            .unwrap();
        let programdata_meta = AccountMeta {
            pubkey: programdata_address,
            is_signer: false,
            is_writable: true,
        };
        let upgrade_authority_meta = AccountMeta {
            pubkey: upgrade_authority_address,
            is_signer: true,
            is_writable: false,
        };
        let new_upgrade_authority_meta = AccountMeta {
            pubkey: new_upgrade_authority_address,
            is_signer: false,
            is_writable: false,
        };

        // Case: Set to new authority
        let accounts = process_instruction(
            &loader_id,
            &instruction,
            vec![
                (programdata_address, programdata_account.clone()),
                (upgrade_authority_address, upgrade_authority_account.clone()),
                (
                    new_upgrade_authority_address,
                    new_upgrade_authority_account.clone(),
                ),
            ],
            vec![
                programdata_meta.clone(),
                upgrade_authority_meta.clone(),
                new_upgrade_authority_meta.clone(),
            ],
            Ok(()),
        );
        let state: UpgradeableLoaderState = accounts.first().unwrap().state().unwrap();
        assert_eq!(
            state,
            UpgradeableLoaderState::ProgramData {
                slot,
                upgrade_authority_address: Some(new_upgrade_authority_address),
            }
        );

        // Case: Finalize
        let accounts = process_instruction(
            &loader_id,
            &instruction,
            vec![
                (programdata_address, programdata_account.clone()),
                (upgrade_authority_address, upgrade_authority_account.clone()),
            ],
            vec![programdata_meta.clone(), upgrade_authority_meta.clone()],
            Ok(()),
        );
        let state: UpgradeableLoaderState = accounts.first().unwrap().state().unwrap();
        assert_eq!(
            state,
            UpgradeableLoaderState::ProgramData {
                slot,
                upgrade_authority_address: None,
            }
        );

        // Case: Finalize a SBPFv0 program
        let mut file =
            File::open("test_elfs/out/sbpfv0_verifier_err.so").expect("file open failed");
        let mut elf = Vec::new();
        file.read_to_end(&mut elf).unwrap();
        programdata_account.resize(UpgradeableLoaderState::size_of_programdata(elf.len()), 0);
        programdata_account
            .data_as_mut_slice()
            .get_mut(UpgradeableLoaderState::size_of_programdata_metadata()..)
            .unwrap()
            .copy_from_slice(&elf);
        process_instruction(
            &loader_id,
            &instruction,
            vec![
                (programdata_address, programdata_account.clone()),
                (upgrade_authority_address, upgrade_authority_account.clone()),
            ],
            vec![programdata_meta.clone(), upgrade_authority_meta.clone()],
            Err(InstructionError::InvalidAccountData),
        );

        // Case: Authority did not sign
        process_instruction(
            &loader_id,
            &instruction,
            vec![
                (programdata_address, programdata_account.clone()),
                (upgrade_authority_address, upgrade_authority_account.clone()),
            ],
            vec![
                programdata_meta.clone(),
                AccountMeta {
                    pubkey: upgrade_authority_address,
                    is_signer: false,
                    is_writable: false,
                },
            ],
            Err(InstructionError::MissingRequiredSignature),
        );

        // Case: wrong authority
        let invalid_upgrade_authority_address = Pubkey::new_unique();
        process_instruction(
            &loader_id,
            &instruction,
            vec![
                (programdata_address, programdata_account.clone()),
                (
                    invalid_upgrade_authority_address,
                    upgrade_authority_account.clone(),
                ),
                (new_upgrade_authority_address, new_upgrade_authority_account),
            ],
            vec![
                programdata_meta.clone(),
                AccountMeta {
                    pubkey: invalid_upgrade_authority_address,
                    is_signer: true,
                    is_writable: false,
                },
                new_upgrade_authority_meta,
            ],
            Err(InstructionError::IncorrectAuthority),
        );

        // Case: No authority
        programdata_account
            .set_state(&UpgradeableLoaderState::ProgramData {
                slot,
                upgrade_authority_address: None,
            })
            .unwrap();
        process_instruction(
            &loader_id,
            &instruction,
            vec![
                (programdata_address, programdata_account.clone()),
                (upgrade_authority_address, upgrade_authority_account.clone()),
            ],
            vec![programdata_meta.clone(), upgrade_authority_meta.clone()],
            Err(InstructionError::Immutable),
        );

        // Case: Not a ProgramData account
        programdata_account
            .set_state(&UpgradeableLoaderState::Program {
                programdata_address: Pubkey::new_unique(),
            })
            .unwrap();
        process_instruction(
            &loader_id,
            &instruction,
            vec![
                (programdata_address, programdata_account.clone()),
                (upgrade_authority_address, upgrade_authority_account),
            ],
            vec![programdata_meta, upgrade_authority_meta],
            Err(InstructionError::InvalidArgument),
        );
    }

    #[test]
    fn test_bpf_loader_upgradeable_set_upgrade_authority_checked() {
        let instruction =
            bincode::serialize(&UpgradeableLoaderInstruction::SetAuthorityChecked).unwrap();
        let loader_id = bpf_loader_upgradeable::id();
        let slot = 0;
        let upgrade_authority_address = Pubkey::new_unique();
        let upgrade_authority_account = AccountSharedData::new(1, 0, &Pubkey::new_unique());
        let new_upgrade_authority_address = Pubkey::new_unique();
        let new_upgrade_authority_account = AccountSharedData::new(1, 0, &Pubkey::new_unique());
        let program_address = Pubkey::new_unique();
        let (programdata_address, _) = Pubkey::find_program_address(
            &[program_address.as_ref()],
            &bpf_loader_upgradeable::id(),
        );
        let mut programdata_account = AccountSharedData::new(
            1,
            UpgradeableLoaderState::size_of_programdata(0),
            &bpf_loader_upgradeable::id(),
        );
        programdata_account
            .set_state(&UpgradeableLoaderState::ProgramData {
                slot,
                upgrade_authority_address: Some(upgrade_authority_address),
            })
            .unwrap();
        let programdata_meta = AccountMeta {
            pubkey: programdata_address,
            is_signer: false,
            is_writable: true,
        };
        let upgrade_authority_meta = AccountMeta {
            pubkey: upgrade_authority_address,
            is_signer: true,
            is_writable: false,
        };
        let new_upgrade_authority_meta = AccountMeta {
            pubkey: new_upgrade_authority_address,
            is_signer: true,
            is_writable: false,
        };

        // Case: Set to new authority
        let accounts = process_instruction(
            &loader_id,
            &instruction,
            vec![
                (programdata_address, programdata_account.clone()),
                (upgrade_authority_address, upgrade_authority_account.clone()),
                (
                    new_upgrade_authority_address,
                    new_upgrade_authority_account.clone(),
                ),
            ],
            vec![
                programdata_meta.clone(),
                upgrade_authority_meta.clone(),
                new_upgrade_authority_meta.clone(),
            ],
            Ok(()),
        );

        let state: UpgradeableLoaderState = accounts.first().unwrap().state().unwrap();
        assert_eq!(
            state,
            UpgradeableLoaderState::ProgramData {
                slot,
                upgrade_authority_address: Some(new_upgrade_authority_address),
            }
        );

        // Case: set to same authority
        process_instruction(
            &loader_id,
            &instruction,
            vec![
                (programdata_address, programdata_account.clone()),
                (upgrade_authority_address, upgrade_authority_account.clone()),
            ],
            vec![
                programdata_meta.clone(),
                upgrade_authority_meta.clone(),
                upgrade_authority_meta.clone(),
            ],
            Ok(()),
        );

        // Case: present authority not in instruction
        process_instruction(
            &loader_id,
            &instruction,
            vec![
                (programdata_address, programdata_account.clone()),
                (upgrade_authority_address, upgrade_authority_account.clone()),
                (
                    new_upgrade_authority_address,
                    new_upgrade_authority_account.clone(),
                ),
            ],
            vec![programdata_meta.clone(), new_upgrade_authority_meta.clone()],
            Err(InstructionError::MissingAccount),
        );

        // Case: new authority not in instruction
        process_instruction(
            &loader_id,
            &instruction,
            vec![
                (programdata_address, programdata_account.clone()),
                (upgrade_authority_address, upgrade_authority_account.clone()),
                (
                    new_upgrade_authority_address,
                    new_upgrade_authority_account.clone(),
                ),
            ],
            vec![programdata_meta.clone(), upgrade_authority_meta.clone()],
            Err(InstructionError::MissingAccount),
        );

        // Case: present authority did not sign
        process_instruction(
            &loader_id,
            &instruction,
            vec![
                (programdata_address, programdata_account.clone()),
                (upgrade_authority_address, upgrade_authority_account.clone()),
                (
                    new_upgrade_authority_address,
                    new_upgrade_authority_account.clone(),
                ),
            ],
            vec![
                programdata_meta.clone(),
                AccountMeta {
                    pubkey: upgrade_authority_address,
                    is_signer: false,
                    is_writable: false,
                },
                new_upgrade_authority_meta.clone(),
            ],
            Err(InstructionError::MissingRequiredSignature),
        );

        // Case: New authority did not sign
        process_instruction(
            &loader_id,
            &instruction,
            vec![
                (programdata_address, programdata_account.clone()),
                (upgrade_authority_address, upgrade_authority_account.clone()),
                (
                    new_upgrade_authority_address,
                    new_upgrade_authority_account.clone(),
                ),
            ],
            vec![
                programdata_meta.clone(),
                upgrade_authority_meta.clone(),
                AccountMeta {
                    pubkey: new_upgrade_authority_address,
                    is_signer: false,
                    is_writable: false,
                },
            ],
            Err(InstructionError::MissingRequiredSignature),
        );

        // Case: wrong present authority
        let invalid_upgrade_authority_address = Pubkey::new_unique();
        process_instruction(
            &loader_id,
            &instruction,
            vec![
                (programdata_address, programdata_account.clone()),
                (
                    invalid_upgrade_authority_address,
                    upgrade_authority_account.clone(),
                ),
                (new_upgrade_authority_address, new_upgrade_authority_account),
            ],
            vec![
                programdata_meta.clone(),
                AccountMeta {
                    pubkey: invalid_upgrade_authority_address,
                    is_signer: true,
                    is_writable: false,
                },
                new_upgrade_authority_meta.clone(),
            ],
            Err(InstructionError::IncorrectAuthority),
        );

        // Case: programdata is immutable
        programdata_account
            .set_state(&UpgradeableLoaderState::ProgramData {
                slot,
                upgrade_authority_address: None,
            })
            .unwrap();
        process_instruction(
            &loader_id,
            &instruction,
            vec![
                (programdata_address, programdata_account.clone()),
                (upgrade_authority_address, upgrade_authority_account.clone()),
            ],
            vec![
                programdata_meta.clone(),
                upgrade_authority_meta.clone(),
                new_upgrade_authority_meta.clone(),
            ],
            Err(InstructionError::Immutable),
        );

        // Case: Not a ProgramData account
        programdata_account
            .set_state(&UpgradeableLoaderState::Program {
                programdata_address: Pubkey::new_unique(),
            })
            .unwrap();
        process_instruction(
            &loader_id,
            &instruction,
            vec![
                (programdata_address, programdata_account.clone()),
                (upgrade_authority_address, upgrade_authority_account),
            ],
            vec![
                programdata_meta,
                upgrade_authority_meta,
                new_upgrade_authority_meta,
            ],
            Err(InstructionError::InvalidArgument),
        );
    }

    #[test]
    fn test_bpf_loader_upgradeable_set_buffer_authority() {
        let instruction = bincode::serialize(&UpgradeableLoaderInstruction::SetAuthority).unwrap();
        let loader_id = bpf_loader_upgradeable::id();
        let invalid_authority_address = Pubkey::new_unique();
        let authority_address = Pubkey::new_unique();
        let authority_account = AccountSharedData::new(1, 0, &Pubkey::new_unique());
        let new_authority_address = Pubkey::new_unique();
        let new_authority_account = AccountSharedData::new(1, 0, &Pubkey::new_unique());
        let buffer_address = Pubkey::new_unique();
        let mut buffer_account =
            AccountSharedData::new(1, UpgradeableLoaderState::size_of_buffer(0), &loader_id);
        buffer_account
            .set_state(&UpgradeableLoaderState::Buffer {
                authority_address: Some(authority_address),
            })
            .unwrap();
        let mut transaction_accounts = vec![
            (buffer_address, buffer_account.clone()),
            (authority_address, authority_account.clone()),
            (new_authority_address, new_authority_account.clone()),
        ];
        let buffer_meta = AccountMeta {
            pubkey: buffer_address,
            is_signer: false,
            is_writable: true,
        };
        let authority_meta = AccountMeta {
            pubkey: authority_address,
            is_signer: true,
            is_writable: false,
        };
        let new_authority_meta = AccountMeta {
            pubkey: new_authority_address,
            is_signer: false,
            is_writable: false,
        };

        // Case: New authority required
        let accounts = process_instruction(
            &loader_id,
            &instruction,
            transaction_accounts.clone(),
            vec![buffer_meta.clone(), authority_meta.clone()],
            Err(InstructionError::IncorrectAuthority),
        );
        let state: UpgradeableLoaderState = accounts.first().unwrap().state().unwrap();
        assert_eq!(
            state,
            UpgradeableLoaderState::Buffer {
                authority_address: Some(authority_address),
            }
        );

        // Case: Set to new authority
        buffer_account
            .set_state(&UpgradeableLoaderState::Buffer {
                authority_address: Some(authority_address),
            })
            .unwrap();
        let accounts = process_instruction(
            &loader_id,
            &instruction,
            transaction_accounts.clone(),
            vec![
                buffer_meta.clone(),
                authority_meta.clone(),
                new_authority_meta.clone(),
            ],
            Ok(()),
        );
        let state: UpgradeableLoaderState = accounts.first().unwrap().state().unwrap();
        assert_eq!(
            state,
            UpgradeableLoaderState::Buffer {
                authority_address: Some(new_authority_address),
            }
        );

        // Case: Authority did not sign
        process_instruction(
            &loader_id,
            &instruction,
            transaction_accounts.clone(),
            vec![
                buffer_meta.clone(),
                AccountMeta {
                    pubkey: authority_address,
                    is_signer: false,
                    is_writable: false,
                },
                new_authority_meta.clone(),
            ],
            Err(InstructionError::MissingRequiredSignature),
        );

        // Case: wrong authority
        process_instruction(
            &loader_id,
            &instruction,
            vec![
                (buffer_address, buffer_account.clone()),
                (invalid_authority_address, authority_account),
                (new_authority_address, new_authority_account),
            ],
            vec![
                buffer_meta.clone(),
                AccountMeta {
                    pubkey: invalid_authority_address,
                    is_signer: true,
                    is_writable: false,
                },
                new_authority_meta.clone(),
            ],
            Err(InstructionError::IncorrectAuthority),
        );

        // Case: No authority
        process_instruction(
            &loader_id,
            &instruction,
            transaction_accounts.clone(),
            vec![buffer_meta.clone(), authority_meta.clone()],
            Err(InstructionError::IncorrectAuthority),
        );

        // Case: Set to no authority
        transaction_accounts
            .get_mut(0)
            .unwrap()
            .1
            .set_state(&UpgradeableLoaderState::Buffer {
                authority_address: None,
            })
            .unwrap();
        process_instruction(
            &loader_id,
            &instruction,
            transaction_accounts.clone(),
            vec![
                buffer_meta.clone(),
                authority_meta.clone(),
                new_authority_meta.clone(),
            ],
            Err(InstructionError::Immutable),
        );

        // Case: Not a Buffer account
        transaction_accounts
            .get_mut(0)
            .unwrap()
            .1
            .set_state(&UpgradeableLoaderState::Program {
                programdata_address: Pubkey::new_unique(),
            })
            .unwrap();
        process_instruction(
            &loader_id,
            &instruction,
            transaction_accounts.clone(),
            vec![buffer_meta, authority_meta, new_authority_meta],
            Err(InstructionError::InvalidArgument),
        );
    }

    #[test]
    fn test_bpf_loader_upgradeable_set_buffer_authority_checked() {
        let instruction =
            bincode::serialize(&UpgradeableLoaderInstruction::SetAuthorityChecked).unwrap();
        let loader_id = bpf_loader_upgradeable::id();
        let invalid_authority_address = Pubkey::new_unique();
        let authority_address = Pubkey::new_unique();
        let authority_account = AccountSharedData::new(1, 0, &Pubkey::new_unique());
        let new_authority_address = Pubkey::new_unique();
        let new_authority_account = AccountSharedData::new(1, 0, &Pubkey::new_unique());
        let buffer_address = Pubkey::new_unique();
        let mut buffer_account =
            AccountSharedData::new(1, UpgradeableLoaderState::size_of_buffer(0), &loader_id);
        buffer_account
            .set_state(&UpgradeableLoaderState::Buffer {
                authority_address: Some(authority_address),
            })
            .unwrap();
        let mut transaction_accounts = vec![
            (buffer_address, buffer_account.clone()),
            (authority_address, authority_account.clone()),
            (new_authority_address, new_authority_account.clone()),
        ];
        let buffer_meta = AccountMeta {
            pubkey: buffer_address,
            is_signer: false,
            is_writable: true,
        };
        let authority_meta = AccountMeta {
            pubkey: authority_address,
            is_signer: true,
            is_writable: false,
        };
        let new_authority_meta = AccountMeta {
            pubkey: new_authority_address,
            is_signer: true,
            is_writable: false,
        };

        // Case: Set to new authority
        buffer_account
            .set_state(&UpgradeableLoaderState::Buffer {
                authority_address: Some(authority_address),
            })
            .unwrap();
        let accounts = process_instruction(
            &loader_id,
            &instruction,
            transaction_accounts.clone(),
            vec![
                buffer_meta.clone(),
                authority_meta.clone(),
                new_authority_meta.clone(),
            ],
            Ok(()),
        );
        let state: UpgradeableLoaderState = accounts.first().unwrap().state().unwrap();
        assert_eq!(
            state,
            UpgradeableLoaderState::Buffer {
                authority_address: Some(new_authority_address),
            }
        );

        // Case: set to same authority
        process_instruction(
            &loader_id,
            &instruction,
            transaction_accounts.clone(),
            vec![
                buffer_meta.clone(),
                authority_meta.clone(),
                authority_meta.clone(),
            ],
            Ok(()),
        );

        // Case: Missing current authority
        process_instruction(
            &loader_id,
            &instruction,
            transaction_accounts.clone(),
            vec![buffer_meta.clone(), new_authority_meta.clone()],
            Err(InstructionError::MissingAccount),
        );

        // Case: Missing new authority
        process_instruction(
            &loader_id,
            &instruction,
            transaction_accounts.clone(),
            vec![buffer_meta.clone(), authority_meta.clone()],
            Err(InstructionError::MissingAccount),
        );

        // Case: wrong present authority
        process_instruction(
            &loader_id,
            &instruction,
            vec![
                (buffer_address, buffer_account.clone()),
                (invalid_authority_address, authority_account),
                (new_authority_address, new_authority_account),
            ],
            vec![
                buffer_meta.clone(),
                AccountMeta {
                    pubkey: invalid_authority_address,
                    is_signer: true,
                    is_writable: false,
                },
                new_authority_meta.clone(),
            ],
            Err(InstructionError::IncorrectAuthority),
        );

        // Case: present authority did not sign
        process_instruction(
            &loader_id,
            &instruction,
            transaction_accounts.clone(),
            vec![
                buffer_meta.clone(),
                AccountMeta {
                    pubkey: authority_address,
                    is_signer: false,
                    is_writable: false,
                },
                new_authority_meta.clone(),
            ],
            Err(InstructionError::MissingRequiredSignature),
        );

        // Case: new authority did not sign
        process_instruction(
            &loader_id,
            &instruction,
            transaction_accounts.clone(),
            vec![
                buffer_meta.clone(),
                authority_meta.clone(),
                AccountMeta {
                    pubkey: new_authority_address,
                    is_signer: false,
                    is_writable: false,
                },
            ],
            Err(InstructionError::MissingRequiredSignature),
        );

        // Case: Not a Buffer account
        transaction_accounts
            .get_mut(0)
            .unwrap()
            .1
            .set_state(&UpgradeableLoaderState::Program {
                programdata_address: Pubkey::new_unique(),
            })
            .unwrap();
        process_instruction(
            &loader_id,
            &instruction,
            transaction_accounts.clone(),
            vec![
                buffer_meta.clone(),
                authority_meta.clone(),
                new_authority_meta.clone(),
            ],
            Err(InstructionError::InvalidArgument),
        );

        // Case: Buffer is immutable
        transaction_accounts
            .get_mut(0)
            .unwrap()
            .1
            .set_state(&UpgradeableLoaderState::Buffer {
                authority_address: None,
            })
            .unwrap();
        process_instruction(
            &loader_id,
            &instruction,
            transaction_accounts.clone(),
            vec![buffer_meta, authority_meta, new_authority_meta],
            Err(InstructionError::Immutable),
        );
    }

    #[test]
    fn test_bpf_loader_upgradeable_close() {
        let instruction = bincode::serialize(&UpgradeableLoaderInstruction::Close).unwrap();
        let loader_id = bpf_loader_upgradeable::id();
        let invalid_authority_address = Pubkey::new_unique();
        let authority_address = Pubkey::new_unique();
        let authority_account = AccountSharedData::new(1, 0, &Pubkey::new_unique());
        let recipient_address = Pubkey::new_unique();
        let recipient_account = AccountSharedData::new(1, 0, &Pubkey::new_unique());
        let buffer_address = Pubkey::new_unique();
        let mut buffer_account =
            AccountSharedData::new(1, UpgradeableLoaderState::size_of_buffer(128), &loader_id);
        buffer_account
            .set_state(&UpgradeableLoaderState::Buffer {
                authority_address: Some(authority_address),
            })
            .unwrap();
        let uninitialized_address = Pubkey::new_unique();
        let mut uninitialized_account = AccountSharedData::new(
            1,
            UpgradeableLoaderState::size_of_programdata(0),
            &loader_id,
        );
        uninitialized_account
            .set_state(&UpgradeableLoaderState::Uninitialized)
            .unwrap();
        let programdata_address = Pubkey::new_unique();
        let mut programdata_account = AccountSharedData::new(
            1,
            UpgradeableLoaderState::size_of_programdata(128),
            &loader_id,
        );
        programdata_account
            .set_state(&UpgradeableLoaderState::ProgramData {
                slot: 0,
                upgrade_authority_address: Some(authority_address),
            })
            .unwrap();
        let program_address = Pubkey::new_unique();
        let mut program_account =
            AccountSharedData::new(1, UpgradeableLoaderState::size_of_program(), &loader_id);
        program_account.set_executable(true);
        program_account
            .set_state(&UpgradeableLoaderState::Program {
                programdata_address,
            })
            .unwrap();
        let clock_account = create_sysvar_account(&Clock {
            slot: 1,
            ..Clock::default()
        });
        let transaction_accounts = vec![
            (buffer_address, buffer_account.clone()),
            (recipient_address, recipient_account.clone()),
            (authority_address, authority_account.clone()),
        ];
        let buffer_meta = AccountMeta {
            pubkey: buffer_address,
            is_signer: false,
            is_writable: true,
        };
        let recipient_meta = AccountMeta {
            pubkey: recipient_address,
            is_signer: false,
            is_writable: true,
        };
        let authority_meta = AccountMeta {
            pubkey: authority_address,
            is_signer: true,
            is_writable: false,
        };

        // Case: close a buffer account
        let accounts = process_instruction(
            &loader_id,
            &instruction,
            transaction_accounts,
            vec![
                buffer_meta.clone(),
                recipient_meta.clone(),
                authority_meta.clone(),
            ],
            Ok(()),
        );
        assert_eq!(0, accounts.first().unwrap().lamports());
        assert_eq!(2, accounts.get(1).unwrap().lamports());
        let state: UpgradeableLoaderState = accounts.first().unwrap().state().unwrap();
        assert_eq!(state, UpgradeableLoaderState::Uninitialized);
        assert_eq!(
            UpgradeableLoaderState::size_of_uninitialized(),
            accounts.first().unwrap().data().len()
        );

        // Case: close with wrong authority
        process_instruction(
            &loader_id,
            &instruction,
            vec![
                (buffer_address, buffer_account.clone()),
                (recipient_address, recipient_account.clone()),
                (invalid_authority_address, authority_account.clone()),
            ],
            vec![
                buffer_meta,
                recipient_meta.clone(),
                AccountMeta {
                    pubkey: invalid_authority_address,
                    is_signer: true,
                    is_writable: false,
                },
            ],
            Err(InstructionError::IncorrectAuthority),
        );

        // Case: close an uninitialized account
        let accounts = process_instruction(
            &loader_id,
            &instruction,
            vec![
                (uninitialized_address, uninitialized_account.clone()),
                (recipient_address, recipient_account.clone()),
                (invalid_authority_address, authority_account.clone()),
            ],
            vec![
                AccountMeta {
                    pubkey: uninitialized_address,
                    is_signer: false,
                    is_writable: true,
                },
                recipient_meta.clone(),
                authority_meta.clone(),
            ],
            Ok(()),
        );
        assert_eq!(0, accounts.first().unwrap().lamports());
        assert_eq!(2, accounts.get(1).unwrap().lamports());
        let state: UpgradeableLoaderState = accounts.first().unwrap().state().unwrap();
        assert_eq!(state, UpgradeableLoaderState::Uninitialized);
        assert_eq!(
            UpgradeableLoaderState::size_of_uninitialized(),
            accounts.first().unwrap().data().len()
        );

        // Case: close a program account with a non-writable program account
        process_instruction(
            &loader_id,
            &instruction,
            vec![
                (programdata_address, programdata_account.clone()),
                (recipient_address, recipient_account.clone()),
                (authority_address, authority_account.clone()),
                (program_address, program_account.clone()),
                (sysvar::clock::id(), clock_account.clone()),
            ],
            vec![
                AccountMeta {
                    pubkey: programdata_address,
                    is_signer: false,
                    is_writable: true,
                },
                recipient_meta.clone(),
                authority_meta.clone(),
                AccountMeta {
                    pubkey: program_address,
                    is_signer: false,
                    is_writable: false,
                },
            ],
            Err(InstructionError::InvalidArgument),
        );

        // Case: close a program account
        let accounts = process_instruction(
            &loader_id,
            &instruction,
            vec![
                (programdata_address, programdata_account.clone()),
                (recipient_address, recipient_account.clone()),
                (authority_address, authority_account.clone()),
                (program_address, program_account.clone()),
                (sysvar::clock::id(), clock_account.clone()),
            ],
            vec![
                AccountMeta {
                    pubkey: programdata_address,
                    is_signer: false,
                    is_writable: true,
                },
                recipient_meta,
                authority_meta,
                AccountMeta {
                    pubkey: program_address,
                    is_signer: false,
                    is_writable: true,
                },
            ],
            Ok(()),
        );
        assert_eq!(0, accounts.first().unwrap().lamports());
        assert_eq!(2, accounts.get(1).unwrap().lamports());
        let state: UpgradeableLoaderState = accounts.first().unwrap().state().unwrap();
        assert_eq!(state, UpgradeableLoaderState::Uninitialized);
        assert_eq!(
            UpgradeableLoaderState::size_of_uninitialized(),
            accounts.first().unwrap().data().len()
        );

        // Try to invoke closed account
        programdata_account = accounts.first().unwrap().clone();
        program_account = accounts.get(3).unwrap().clone();
        process_instruction(
            &program_address,
            &[],
            vec![
                (programdata_address, programdata_account.clone()),
                (program_address, program_account.clone()),
            ],
            Vec::new(),
            Err(InstructionError::UnsupportedProgramId),
        );

        // Case: Reopen should fail
        process_instruction(
            &loader_id,
            &bincode::serialize(&UpgradeableLoaderInstruction::DeployWithMaxDataLen {
                max_data_len: 0,
            })
            .unwrap(),
            vec![
                (recipient_address, recipient_account),
                (programdata_address, programdata_account),
                (program_address, program_account),
                (buffer_address, buffer_account),
                (sysvar::rent::id(), create_sysvar_account(&Rent::default())),
                (sysvar::clock::id(), clock_account),
                (
                    system_program::id(),
                    AccountSharedData::new(0, 0, &system_program::id()),
                ),
                (authority_address, authority_account),
            ],
            vec![
                AccountMeta {
                    pubkey: recipient_address,
                    is_signer: true,
                    is_writable: true,
                },
                AccountMeta {
                    pubkey: programdata_address,
                    is_signer: false,
                    is_writable: true,
                },
                AccountMeta {
                    pubkey: program_address,
                    is_signer: false,
                    is_writable: true,
                },
                AccountMeta {
                    pubkey: buffer_address,
                    is_signer: false,
                    is_writable: false,
                },
                AccountMeta {
                    pubkey: sysvar::rent::id(),
                    is_signer: false,
                    is_writable: false,
                },
                AccountMeta {
                    pubkey: sysvar::clock::id(),
                    is_signer: false,
                    is_writable: false,
                },
                AccountMeta {
                    pubkey: system_program::id(),
                    is_signer: false,
                    is_writable: false,
                },
                AccountMeta {
                    pubkey: authority_address,
                    is_signer: false,
                    is_writable: false,
                },
            ],
            Err(InstructionError::AccountAlreadyInitialized),
        );
    }

    /// fuzzing utility function
    fn fuzz<F>(
        bytes: &[u8],
        outer_iters: usize,
        inner_iters: usize,
        offset: Range<usize>,
        value: Range<u8>,
        work: F,
    ) where
        F: Fn(&mut [u8]),
    {
        let mut rng = rand::rng();
        for _ in 0..outer_iters {
            let mut mangled_bytes = bytes.to_vec();
            for _ in 0..inner_iters {
                let offset = rng.random_range(offset.start..offset.end);
                let value = rng.random_range(value.start..value.end);
                *mangled_bytes.get_mut(offset).unwrap() = value;
                work(&mut mangled_bytes);
            }
        }
    }

    #[test]
    #[ignore]
    fn test_fuzz() {
        let loader_id = bpf_loader::id();
        let program_id = Pubkey::new_unique();

        // Create program account
        let mut file = File::open("test_elfs/out/sbpfv3_return_ok.so").expect("file open failed");
        let mut elf = Vec::new();
        file.read_to_end(&mut elf).unwrap();

        // Mangle the whole file
        fuzz(
            &elf,
            1_000_000_000,
            100,
            0..elf.len(),
            0..255,
            |bytes: &mut [u8]| {
                let mut program_account = AccountSharedData::new(1, 0, &loader_id);
                program_account.set_data_from_slice(bytes);
                program_account.set_executable(true);
                process_instruction(
                    &program_id,
                    &[],
                    vec![(program_id, program_account)],
                    Vec::new(),
                    Ok(()),
                );
            },
        );
    }

    #[test]
    fn test_calculate_heap_cost() {
        let heap_cost = 8_u64;

        // heap allocations are in 32K block, `heap_cost` of CU is consumed per additional 32k

        // assert less than 32K heap should cost zero unit
        assert_eq!(0, calculate_heap_cost(31 * 1024, heap_cost));

        // assert exact 32K heap should be cost zero unit
        assert_eq!(0, calculate_heap_cost(32 * 1024, heap_cost));

        // assert slightly more than 32K heap should cost 1 * heap_cost
        assert_eq!(heap_cost, calculate_heap_cost(33 * 1024, heap_cost));

        // assert exact 64K heap should cost 1 * heap_cost
        assert_eq!(heap_cost, calculate_heap_cost(64 * 1024, heap_cost));
    }

    fn deploy_test_program(
        invoke_context: &mut InvokeContext,
        program_id: Pubkey,
    ) -> Result<(), InstructionError> {
        let mut file = File::open("test_elfs/out/sbpfv3_return_ok.so").expect("file open failed");
        let mut elf = Vec::new();
        file.read_to_end(&mut elf).unwrap();
        deploy_program!(
            invoke_context,
            &program_id,
            &bpf_loader_upgradeable::id(),
            &elf,
            2_u64,
            true, // disable_sbpf_v0_v1_v2_deployment
        );
        Ok(())
    }

    // Concurrency rationale: these tests construct `ProgramCacheEntry` instances
    // directly. The struct's `latest_access_slot: AtomicU64` field is defined in
    // `solana-program-runtime`; under the `shuttle-test` feature
    // `solana-svm-type-overrides` swaps `std::sync::atomic::AtomicU64` for
    // `shuttle::sync::atomic::AtomicU64`, whose Shuttle-backed operations
    // (load, fetch_max, and similar) must run inside an active Shuttle
    // scheduler. We therefore extract the test bodies into `do_test_*` helpers
    // and drive them via `shuttle::check_random` stubs when the feature is on.
    // We use `check_random` only (no `check_dfs` companion) because the test
    // bodies spawn no Shuttle threads, so DFS gives no meaningful interleaving
    // coverage; `check_random` is enough to provide the scheduler context.
    // This matches the single-scheduler pattern used in
    // `net-utils/src/token_bucket.rs` and `poh/src/record_channels.rs`.
    //
    // 100 iterations is intentionally low: the test bodies are single-threaded
    // (no `shuttle::thread::spawn`), so additional iterations validate only
    // the harness wiring, not concurrent interleavings. Bump this if a future
    // refactor introduces real concurrency in the test bodies.
    #[cfg(feature = "shuttle-test")]
    const PROGRAM_USAGE_COUNT_RANDOM_ITERATIONS: usize = 100;

    #[test]
    fn test_program_usage_count_on_upgrade() {
        #[cfg(feature = "shuttle-test")]
        shuttle::check_random(
            do_test_program_usage_count_on_upgrade,
            PROGRAM_USAGE_COUNT_RANDOM_ITERATIONS,
        );
        #[cfg(not(feature = "shuttle-test"))]
        do_test_program_usage_count_on_upgrade();
    }

    fn do_test_program_usage_count_on_upgrade() {
        let transaction_accounts = vec![(
            sysvar::epoch_schedule::id(),
            create_sysvar_account(&EpochSchedule::default()),
        )];
        with_mock_invoke_context!(invoke_context, transaction_context, transaction_accounts);
        let program_id = Pubkey::new_unique();
        let env = ProgramRuntimeEnvironment::from(BuiltinProgram::new_mock());
        let stats = ProgramStatistics {
            uses: 100.into(),
            ..Default::default()
        };
        let program = ProgramCacheEntry {
            program: ProgramCacheEntryType::Unloaded(env),
            account_owner: ProgramCacheEntryOwner::LoaderV2,
            deployment_slot: 0,
            stats: stats.into(),
            latest_access_slot: AtomicU64::new(0),
        };
        invoke_context
            .program_cache_for_tx_batch
            .replenish(program_id, Arc::new(program));
        invoke_context
            .program_cache_for_tx_batch
            .set_slot_for_tests(2);

        assert_matches!(
            deploy_test_program(&mut invoke_context, program_id,),
            Ok(())
        );

        let updated_program = invoke_context
            .program_cache_for_tx_batch
            .find(&program_id)
            .expect("Didn't find upgraded program in the cache");

        assert_eq!(updated_program.deployment_slot, 2);
        assert_eq!(updated_program.stats.uses.load(Ordering::Relaxed), 100);
    }

    #[test]
    fn test_program_usage_count_on_non_upgrade() {
        #[cfg(feature = "shuttle-test")]
        shuttle::check_random(
            do_test_program_usage_count_on_non_upgrade,
            PROGRAM_USAGE_COUNT_RANDOM_ITERATIONS,
        );
        #[cfg(not(feature = "shuttle-test"))]
        do_test_program_usage_count_on_non_upgrade();
    }

    fn do_test_program_usage_count_on_non_upgrade() {
        let transaction_accounts = vec![(
            sysvar::epoch_schedule::id(),
            create_sysvar_account(&EpochSchedule::default()),
        )];
        with_mock_invoke_context!(invoke_context, transaction_context, transaction_accounts);
        let program_id = Pubkey::new_unique();
        let env = ProgramRuntimeEnvironment::from(BuiltinProgram::new_mock());
        let stats = ProgramStatistics {
            uses: 100.into(),
            ..Default::default()
        };
        let program = ProgramCacheEntry {
            program: ProgramCacheEntryType::Unloaded(env),
            account_owner: ProgramCacheEntryOwner::LoaderV2,
            deployment_slot: 0,
            stats: stats.into(),
            latest_access_slot: AtomicU64::new(0),
        };
        invoke_context
            .program_cache_for_tx_batch
            .replenish(program_id, Arc::new(program));
        invoke_context
            .program_cache_for_tx_batch
            .set_slot_for_tests(2);

        let program_id2 = Pubkey::new_unique();
        assert_matches!(
            deploy_test_program(&mut invoke_context, program_id2),
            Ok(())
        );

        let program2 = invoke_context
            .program_cache_for_tx_batch
            .find(&program_id2)
            .expect("Didn't find upgraded program in the cache");

        assert_eq!(program2.deployment_slot, 2);
        assert_eq!(program2.stats.uses.load(Ordering::Relaxed), 0);
    }
}