Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Tue, 1 Dec 2020 12:22:32 +0000
From:   Brendan Jackman <jackmanb@google.com>
To:     Yonghong Song <yhs@fb.com>
Cc:     bpf@vger.kernel.org, Alexei Starovoitov <ast@kernel.org>,
        Daniel Borkmann <daniel@iogearbox.net>,
        KP Singh <kpsingh@chromium.org>,
        Florent Revest <revest@chromium.org>,
        linux-kernel@vger.kernel.org, Jann Horn <jannh@google.com>
Subject: Re: [PATCH v2 bpf-next 07/13] bpf: Add BPF_FETCH field / create
 atomic_fetch_add instruction
Message-ID: <20201201122232.GD2114905@google.com>
References: <20201127175738.1085417-1-jackmanb@google.com>
 <20201127175738.1085417-8-jackmanb@google.com>
 <d3a3c534-ae62-7703-9740-f3664c63459c@fb.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <d3a3c534-ae62-7703-9740-f3664c63459c@fb.com>
Precedence: bulk

On Fri, Nov 27, 2020 at 08:15:49PM -0800, Yonghong Song wrote:
> 
> 
> On 11/27/20 9:57 AM, Brendan Jackman wrote:
[...]
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index e8b41ccdfb90..cd4c03b25573 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
> > @@ -3602,7 +3602,11 @@ static int check_atomic(struct bpf_verifier_env *env, int insn_idx, struct bpf_i
> >   {
> >   	int err;
> > -	if (insn->imm != BPF_ADD) {
> > +	switch (insn->imm) {
> > +	case BPF_ADD:
> > +	case BPF_ADD | BPF_FETCH:
> > +		break;
> > +	default:
> >   		verbose(env, "BPF_ATOMIC uses invalid atomic opcode %02x\n", insn->imm);
> >   		return -EINVAL;
> >   	}
> > @@ -3631,7 +3635,7 @@ static int check_atomic(struct bpf_verifier_env *env, int insn_idx, struct bpf_i
> >   	    is_pkt_reg(env, insn->dst_reg) ||
> >   	    is_flow_key_reg(env, insn->dst_reg) ||
> >   	    is_sk_reg(env, insn->dst_reg)) {
> > -		verbose(env, "atomic stores into R%d %s is not allowed\n",
> > +		verbose(env, "BPF_ATOMIC stores into R%d %s is not allowed\n",
> >   			insn->dst_reg,
> >   			reg_type_str[reg_state(env, insn->dst_reg)->type]);
> >   		return -EACCES;
> > @@ -3644,8 +3648,20 @@ static int check_atomic(struct bpf_verifier_env *env, int insn_idx, struct bpf_i
> >   		return err;
> >   	/* check whether we can write into the same memory */
> > -	return check_mem_access(env, insn_idx, insn->dst_reg, insn->off,
> > -				BPF_SIZE(insn->code), BPF_WRITE, -1, true);
> > +	err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off,
> > +			       BPF_SIZE(insn->code), BPF_WRITE, -1, true);
> > +	if (err)
> > +		return err;
> > +
> > +	if (!(insn->imm & BPF_FETCH))
> > +		return 0;
> > +
> > +	/* check and record load of old value into src reg  */
> > +	err = check_reg_arg(env, insn->src_reg, DST_OP);
> > +	if (err)
> > +		return err;
> > +
> > +	return 0;
> >   }
> >   static int __check_stack_boundary(struct bpf_verifier_env *env, u32 regno,
> > @@ -9501,12 +9517,6 @@ static int do_check(struct bpf_verifier_env *env)
> >   		} else if (class == BPF_STX) {
> >   			enum bpf_reg_type *prev_dst_type, dst_reg_type;
> > -			if (((BPF_MODE(insn->code) != BPF_MEM &&
> > -			      BPF_MODE(insn->code) != BPF_ATOMIC) || insn->imm != 0)) {
> > -				verbose(env, "BPF_STX uses reserved fields\n");
> > -				return -EINVAL;
> > -			}
> > -
> >   			if (BPF_MODE(insn->code) == BPF_ATOMIC) {
> >   				err = check_atomic(env, env->insn_idx, insn);
> >   				if (err)
> > @@ -9515,6 +9525,11 @@ static int do_check(struct bpf_verifier_env *env)
> >   				continue;
> >   			}
> > +			if (BPF_MODE(insn->code) != BPF_MEM && insn->imm != 0) {
> 
> "||" here instead of "&&"?

Right - thanks again!