[PATCH bpf-next v6 11/17] bpf: Enable r11 based insns

[Yonghong Song <yonghong.song@linux.dev>]

BPF_REG_PARAMS (r11) is used for stack argument accesses and
the following are the only insns with r11 presence:
    - BPF_LDX | BPF_MEM | BPF_DW (load incoming stack arg)
    - BPF_STX | BPF_MEM | BPF_DW (store register to outgoing stack arg)
    - BPF_ST  | BPF_MEM | BPF_DW (store immediate to outgoing stack arg)

The LLVM compiler [1] implemented the above BPF_REG_PARAMS
insns.

  [1] https://github.com/llvm/llvm-project/pull/189060

Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
---
 kernel/bpf/verifier.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index e952ebcc2f8f..2a346e4f28e1 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -18791,13 +18791,24 @@ static int check_and_resolve_insns(struct bpf_verifier_env *env)
 		return err;
 
 	for (i = 0; i < insn_cnt; i++, insn++) {
+		u8 class = BPF_CLASS(insn->code);
+		u8 mode = BPF_MODE(insn->code);
+		u8 size = BPF_SIZE(insn->code);
+
 		if (insn->dst_reg >= MAX_BPF_REG) {
-			verbose(env, "R%d is invalid\n", insn->dst_reg);
-			return -EINVAL;
+			if (insn->dst_reg != BPF_REG_PARAMS ||
+			    (class != BPF_ST  && class != BPF_STX) ||
+			     mode != BPF_MEM || size != BPF_DW) {
+				verbose(env, "R%d is invalid\n", insn->dst_reg);
+				return -EINVAL;
+			}
 		}
 		if (insn->src_reg >= MAX_BPF_REG) {
-			verbose(env, "R%d is invalid\n", insn->src_reg);
-			return -EINVAL;
+			if (insn->src_reg != BPF_REG_PARAMS ||
+			    insn->code != (BPF_LDX | BPF_MEM | BPF_DW)) {
+				verbose(env, "R%d is invalid\n", insn->src_reg);
+				return -EINVAL;
+			}
 		}
 		if (insn[0].code == (BPF_LD | BPF_IMM | BPF_DW)) {
 			struct bpf_insn_aux_data *aux;
-- 
2.52.0