Fix eBPF compare-and-exchange instruction

Linux kernel's documentation tells in
https://www.kernel.org/doc/html/v6.0/bpf/instruction-set.html#atomic-operations

> The BPF_CMPXCHG operation atomically compares the value addressed by
> dst_reg + off with R0. If they match, the value addressed by
> dst_reg + off is replaced with src_reg. In either case, the value that
> was at dst_reg + off before the operation is zero-extended and loaded
> back to R0.

If the values don't match, *(dst_reg + off) is not supposed to be
modified.

Moreover, register R0 is always modified and the 32-bit instruction
truncates its value (with a zero-extension). This is also clear in the
implementation of BPF_CMPXCHG in
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/kernel/bpf/core.c?h=v6.18#n2186

    case BPF_CMPXCHG:
            if (BPF_SIZE(insn->code) == BPF_W)
                    BPF_R0 = (u32) atomic_cmpxchg(
                            (atomic_t *)(unsigned long) (DST + insn->off),
                            (u32) BPF_R0, (u32) SRC);
            else if (BPF_SIZE(insn->code) == BPF_DW)
                    BPF_R0 = (u64) atomic64_cmpxchg(
                            (atomic64_t *)(unsigned long) (DST + insn->off),
                            (u64) BPF_R0, (u64) SRC);

Fix the semantic of the compare-and-exchange instruction accordingly.

Author: niooss-ledger

Ghidra/Processors/eBPF/data/languages/eBPF.sinc

@@ -369,18 +369,18 @@ DST4: dst is dst { local tmp:4 = dst:4; export tmp; }
 
 :ACMP32 [dst + off], src  is imm=0xf1 & off & src & dst & op_ld_st_mode=0x6 & op_ld_st_size=0x0 & op_insn_class=0x3 {
     local tmp:4 = *:4 (dst + off);
-    if (R0:4 == tmp) goto <equal>;
-    R0 = zext(tmp);
-<equal>
+    if (R0:4 != tmp) goto <notEqual>;
     *:4 (dst + off) = src:4;
+<notEqual>
+    R0 = zext(tmp);
 }
 
 :ACMP [dst + off], src  is imm=0xf1 & off & src & dst & op_ld_st_mode=0x6 & op_ld_st_size=0x3 & op_insn_class=0x3 {
     local tmp:8 = *:8 (dst + off);
-    if (R0 == tmp) goto <equal>;
-    R0 = tmp;
-<equal>
+    if (R0 != tmp) goto <notEqual>;
     *:8 (dst + off) = src; 
+<notEqual>
+    R0 = tmp;
 }
 
 #Jump instructions (BPF_JMP, BPF_JMP32)