bpf: Enable r11 based insns

BPF_REG_PARAMS (r11) is used for stack argument accesses and
the following are only insns with r11 presence:
    - load incoming stack arg
    - store register to outgoing stack arg
    - store immediate to outgoing stack arg

The detailed insn format can be found in is_stack_arg_ldx/st/stx()
helpers. After this patch, stack arg ldx/st/stx insns become valid
for kernel and these insns can be properly checked by verifier.

The LLVM compiler [1] implemented the above BPF_REG_PARAMS insns.

  [1] https://github.com/llvm/llvm-project/pull/189060

Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
Link: https://lore.kernel.org/r/20260513045059.2391192-1-yonghong.song@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index ebd13661933eaeda3ee5453dfca1cd8a92fa4041..b0d3c2d179e4be5c9af928bbd371eaf9a171c63f 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -18006,11 +18006,12 @@ static int check_and_resolve_insns(struct bpf_verifier_env *env)
                return err;
 
        for (i = 0; i < insn_cnt; i++, insn++) {
-               if (insn->dst_reg >= MAX_BPF_REG) {
+               if (insn->dst_reg >= MAX_BPF_REG &&
+                   !is_stack_arg_st(insn) && !is_stack_arg_stx(insn)) {
                        verbose(env, "R%d is invalid\n", insn->dst_reg);
                        return -EINVAL;
                }
-               if (insn->src_reg >= MAX_BPF_REG) {
+               if (insn->src_reg >= MAX_BPF_REG && !is_stack_arg_ldx(insn)) {
                        verbose(env, "R%d is invalid\n", insn->src_reg);
                        return -EINVAL;
                }