* [PATCH bpf-next v1 1/2] bpf: Share map-backed callback register setup
@ 2026-11-06 23:21 Ihor Solodrai
2026-11-06 23:21 ` [PATCH bpf-next v1 2/2] bpf: Rely on callback frame initialization defaults Ihor Solodrai
0 siblings, 1 reply; 2+ messages in thread
From: Ihor Solodrai @ 2026-11-06 23:21 UTC (permalink / raw)
To: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
Eduard Zingerman, Kumar Kartikeya Dwivedi
Cc: Amery Hung, Emil Tsalapatis, Nicholas Carlini, bpf, linux-kernel,
kernel-team
Map iteration, timer, task-work and RCU callbacks repeat the same register
type, offset and map-metadata setup for their map, key and value arguments.
Use one initializer for map-backed callback registers. Leave argument
selection, value ids and callback-specific policy in each setter.
No functional change.
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
kernel/bpf/verifier.c | 81 +++++++++++--------------------------------
1 file changed, 21 insertions(+), 60 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 1b58a1796a2e..389488e4e7a7 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -11958,6 +11958,16 @@ static int check_func_callx(struct bpf_verifier_env *env, struct bpf_insn *insn,
return check_static_func_call(env, subprog, insn_idx);
}
+static void mark_map_callback_reg(struct bpf_reg_state *reg,
+ const struct bpf_reg_state *map_reg,
+ enum bpf_reg_type type)
+{
+ reg->type = type;
+ __mark_reg_known_zero(reg);
+ reg->map_ptr = map_reg->map_ptr;
+ reg->map_uid = map_reg->map_uid;
+}
+
int map_set_for_each_callback_args(struct bpf_verifier_env *env,
struct bpf_func_state *caller,
struct bpf_func_state *callee)
@@ -11969,15 +11979,8 @@ int map_set_for_each_callback_args(struct bpf_verifier_env *env,
*/
callee->regs[BPF_REG_1] = caller->regs[BPF_REG_1];
- callee->regs[BPF_REG_2].type = PTR_TO_MAP_KEY;
- __mark_reg_known_zero(&callee->regs[BPF_REG_2]);
- callee->regs[BPF_REG_2].map_ptr = caller->regs[BPF_REG_1].map_ptr;
- callee->regs[BPF_REG_2].map_uid = caller->regs[BPF_REG_1].map_uid;
-
- callee->regs[BPF_REG_3].type = PTR_TO_MAP_VALUE;
- __mark_reg_known_zero(&callee->regs[BPF_REG_3]);
- callee->regs[BPF_REG_3].map_ptr = caller->regs[BPF_REG_1].map_ptr;
- callee->regs[BPF_REG_3].map_uid = caller->regs[BPF_REG_1].map_uid;
+ mark_map_callback_reg(&callee->regs[BPF_REG_2], &caller->regs[BPF_REG_1], PTR_TO_MAP_KEY);
+ mark_map_callback_reg(&callee->regs[BPF_REG_3], &caller->regs[BPF_REG_1], PTR_TO_MAP_VALUE);
callee->regs[BPF_REG_3].id = ++env->id_gen;
/* pointer to stack or null */
@@ -12068,26 +12071,12 @@ static int set_timer_callback_state(struct bpf_verifier_env *env,
struct bpf_func_state *callee,
int insn_idx)
{
- struct bpf_map *map_ptr = caller->regs[BPF_REG_1].map_ptr;
- u32 map_uid = caller->regs[BPF_REG_1].map_uid;
-
/* bpf_timer_set_callback(struct bpf_timer *timer, void *callback_fn);
* callback_fn(struct bpf_map *map, void *key, void *value);
*/
- callee->regs[BPF_REG_1].type = CONST_PTR_TO_MAP;
- __mark_reg_known_zero(&callee->regs[BPF_REG_1]);
- callee->regs[BPF_REG_1].map_ptr = map_ptr;
- callee->regs[BPF_REG_1].map_uid = map_uid;
-
- callee->regs[BPF_REG_2].type = PTR_TO_MAP_KEY;
- __mark_reg_known_zero(&callee->regs[BPF_REG_2]);
- callee->regs[BPF_REG_2].map_ptr = map_ptr;
- callee->regs[BPF_REG_2].map_uid = map_uid;
-
- callee->regs[BPF_REG_3].type = PTR_TO_MAP_VALUE;
- __mark_reg_known_zero(&callee->regs[BPF_REG_3]);
- callee->regs[BPF_REG_3].map_ptr = map_ptr;
- callee->regs[BPF_REG_3].map_uid = map_uid;
+ mark_map_callback_reg(&callee->regs[BPF_REG_1], &caller->regs[BPF_REG_1], CONST_PTR_TO_MAP);
+ mark_map_callback_reg(&callee->regs[BPF_REG_2], &caller->regs[BPF_REG_1], PTR_TO_MAP_KEY);
+ mark_map_callback_reg(&callee->regs[BPF_REG_3], &caller->regs[BPF_REG_1], PTR_TO_MAP_VALUE);
callee->regs[BPF_REG_3].id = ++env->id_gen;
/* unused */
@@ -12189,26 +12178,12 @@ static int set_task_work_schedule_callback_state(struct bpf_verifier_env *env,
struct bpf_func_state *callee,
int insn_idx)
{
- struct bpf_map *map_ptr = caller->regs[BPF_REG_3].map_ptr;
- u32 map_uid = caller->regs[BPF_REG_3].map_uid;
-
/*
* callback_fn(struct bpf_map *map, void *key, void *value);
*/
- callee->regs[BPF_REG_1].type = CONST_PTR_TO_MAP;
- __mark_reg_known_zero(&callee->regs[BPF_REG_1]);
- callee->regs[BPF_REG_1].map_ptr = map_ptr;
- callee->regs[BPF_REG_1].map_uid = map_uid;
-
- callee->regs[BPF_REG_2].type = PTR_TO_MAP_KEY;
- __mark_reg_known_zero(&callee->regs[BPF_REG_2]);
- callee->regs[BPF_REG_2].map_ptr = map_ptr;
- callee->regs[BPF_REG_2].map_uid = map_uid;
-
- callee->regs[BPF_REG_3].type = PTR_TO_MAP_VALUE;
- __mark_reg_known_zero(&callee->regs[BPF_REG_3]);
- callee->regs[BPF_REG_3].map_ptr = map_ptr;
- callee->regs[BPF_REG_3].map_uid = map_uid;
+ mark_map_callback_reg(&callee->regs[BPF_REG_1], &caller->regs[BPF_REG_3], CONST_PTR_TO_MAP);
+ mark_map_callback_reg(&callee->regs[BPF_REG_2], &caller->regs[BPF_REG_3], PTR_TO_MAP_KEY);
+ mark_map_callback_reg(&callee->regs[BPF_REG_3], &caller->regs[BPF_REG_3], PTR_TO_MAP_VALUE);
callee->regs[BPF_REG_3].id = ++env->id_gen;
/* unused */
@@ -12224,26 +12199,12 @@ static int set_rcu_callback_state(struct bpf_verifier_env *env,
struct bpf_func_state *callee,
int insn_idx)
{
- struct bpf_map *map_ptr = caller->regs[BPF_REG_2].map_ptr;
- u32 map_uid = caller->regs[BPF_REG_2].map_uid;
-
/*
* callback_fn(struct bpf_map *map, void *key, void *value);
*/
- callee->regs[BPF_REG_1].type = CONST_PTR_TO_MAP;
- __mark_reg_known_zero(&callee->regs[BPF_REG_1]);
- callee->regs[BPF_REG_1].map_ptr = map_ptr;
- callee->regs[BPF_REG_1].map_uid = map_uid;
-
- callee->regs[BPF_REG_2].type = PTR_TO_MAP_KEY;
- __mark_reg_known_zero(&callee->regs[BPF_REG_2]);
- callee->regs[BPF_REG_2].map_ptr = map_ptr;
- callee->regs[BPF_REG_2].map_uid = map_uid;
-
- callee->regs[BPF_REG_3].type = PTR_TO_MAP_VALUE;
- __mark_reg_known_zero(&callee->regs[BPF_REG_3]);
- callee->regs[BPF_REG_3].map_ptr = map_ptr;
- callee->regs[BPF_REG_3].map_uid = map_uid;
+ mark_map_callback_reg(&callee->regs[BPF_REG_1], &caller->regs[BPF_REG_2], CONST_PTR_TO_MAP);
+ mark_map_callback_reg(&callee->regs[BPF_REG_2], &caller->regs[BPF_REG_2], PTR_TO_MAP_KEY);
+ mark_map_callback_reg(&callee->regs[BPF_REG_3], &caller->regs[BPF_REG_2], PTR_TO_MAP_VALUE);
/* unused */
bpf_mark_reg_not_init(env, &callee->regs[BPF_REG_4]);
base-commit: 3e18218484126afb9da722080659c038cb2256ab
--
2.56.0
^ permalink raw reply [flat|nested] 2+ messages in thread* [PATCH bpf-next v1 2/2] bpf: Rely on callback frame initialization defaults
2026-11-06 23:21 [PATCH bpf-next v1 1/2] bpf: Share map-backed callback register setup Ihor Solodrai
@ 2026-11-06 23:21 ` Ihor Solodrai
0 siblings, 0 replies; 2+ messages in thread
From: Ihor Solodrai @ 2026-11-06 23:21 UTC (permalink / raw)
To: Alexei Starovoitov, Andrii Nakryiko, Daniel Borkmann,
Eduard Zingerman, Kumar Kartikeya Dwivedi
Cc: Amery Hung, Emil Tsalapatis, Nicholas Carlini, bpf, linux-kernel,
kernel-team
Both callback entry paths call init_func_state(), which initializes all
registers to NOT_INIT and the callback return range to zero.
Callback setters repeat resets for unused registers, and the timer setter
repeats the default return range. Leave those defaults to frame
initialization and set only arguments and callback-specific state in the
setters.
No functional change.
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
kernel/bpf/verifier.c | 31 -------------------------------
1 file changed, 31 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 389488e4e7a7..831a9c0f8c45 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -11985,9 +11985,6 @@ int map_set_for_each_callback_args(struct bpf_verifier_env *env,
/* pointer to stack or null */
callee->regs[BPF_REG_4] = caller->regs[BPF_REG_3];
-
- /* unused */
- bpf_mark_reg_not_init(env, &callee->regs[BPF_REG_5]);
return 0;
}
@@ -12056,11 +12053,6 @@ static int set_loop_callback_state(struct bpf_verifier_env *env,
callee->regs[BPF_REG_1].type = SCALAR_VALUE;
callee->regs[BPF_REG_2] = caller->regs[BPF_REG_3];
- /* unused */
- bpf_mark_reg_not_init(env, &callee->regs[BPF_REG_3]);
- bpf_mark_reg_not_init(env, &callee->regs[BPF_REG_4]);
- bpf_mark_reg_not_init(env, &callee->regs[BPF_REG_5]);
-
callee->in_callback_fn = true;
callee->callback_ret_range = retval_range(0, 1);
return 0;
@@ -12079,11 +12071,7 @@ static int set_timer_callback_state(struct bpf_verifier_env *env,
mark_map_callback_reg(&callee->regs[BPF_REG_3], &caller->regs[BPF_REG_1], PTR_TO_MAP_VALUE);
callee->regs[BPF_REG_3].id = ++env->id_gen;
- /* unused */
- bpf_mark_reg_not_init(env, &callee->regs[BPF_REG_4]);
- bpf_mark_reg_not_init(env, &callee->regs[BPF_REG_5]);
callee->in_async_callback_fn = true;
- callee->callback_ret_range = retval_range(0, 0);
return 0;
}
@@ -12106,10 +12094,6 @@ static int set_find_vma_callback_state(struct bpf_verifier_env *env,
/* pointer to stack or null */
callee->regs[BPF_REG_3] = caller->regs[BPF_REG_4];
-
- /* unused */
- bpf_mark_reg_not_init(env, &callee->regs[BPF_REG_4]);
- bpf_mark_reg_not_init(env, &callee->regs[BPF_REG_5]);
callee->in_callback_fn = true;
/* bpf_find_vma() runs the callback under mmap_lock and RCU. */
callee->in_rcu_callback_fn = true;
@@ -12126,15 +12110,9 @@ static int set_user_ringbuf_callback_state(struct bpf_verifier_env *env,
* callback_ctx, u64 flags);
* callback_fn(const struct bpf_dynptr_t* dynptr, void *callback_ctx);
*/
- bpf_mark_reg_not_init(env, &callee->regs[BPF_REG_0]);
mark_dynptr_cb_reg(env, &callee->regs[BPF_REG_1], BPF_DYNPTR_TYPE_LOCAL);
callee->regs[BPF_REG_2] = caller->regs[BPF_REG_3];
- /* unused */
- bpf_mark_reg_not_init(env, &callee->regs[BPF_REG_3]);
- bpf_mark_reg_not_init(env, &callee->regs[BPF_REG_4]);
- bpf_mark_reg_not_init(env, &callee->regs[BPF_REG_5]);
-
callee->in_callback_fn = true;
callee->callback_ret_range = retval_range(0, 1);
return 0;
@@ -12165,9 +12143,6 @@ static int set_rbtree_add_callback_state(struct bpf_verifier_env *env,
mark_reg_graph_node(callee->regs, BPF_REG_2, &field->graph_root);
ref_set_non_owning(env, &callee->regs[BPF_REG_2]);
- bpf_mark_reg_not_init(env, &callee->regs[BPF_REG_3]);
- bpf_mark_reg_not_init(env, &callee->regs[BPF_REG_4]);
- bpf_mark_reg_not_init(env, &callee->regs[BPF_REG_5]);
callee->in_callback_fn = true;
callee->callback_ret_range = retval_range(0, 1);
return 0;
@@ -12186,9 +12161,6 @@ static int set_task_work_schedule_callback_state(struct bpf_verifier_env *env,
mark_map_callback_reg(&callee->regs[BPF_REG_3], &caller->regs[BPF_REG_3], PTR_TO_MAP_VALUE);
callee->regs[BPF_REG_3].id = ++env->id_gen;
- /* unused */
- bpf_mark_reg_not_init(env, &callee->regs[BPF_REG_4]);
- bpf_mark_reg_not_init(env, &callee->regs[BPF_REG_5]);
callee->in_async_callback_fn = true;
callee->callback_ret_range = retval_range(S32_MIN, S32_MAX);
return 0;
@@ -12206,9 +12178,6 @@ static int set_rcu_callback_state(struct bpf_verifier_env *env,
mark_map_callback_reg(&callee->regs[BPF_REG_2], &caller->regs[BPF_REG_2], PTR_TO_MAP_KEY);
mark_map_callback_reg(&callee->regs[BPF_REG_3], &caller->regs[BPF_REG_2], PTR_TO_MAP_VALUE);
- /* unused */
- bpf_mark_reg_not_init(env, &callee->regs[BPF_REG_4]);
- bpf_mark_reg_not_init(env, &callee->regs[BPF_REG_5]);
callee->in_async_callback_fn = true;
callee->callback_ret_range = retval_range(S32_MIN, S32_MAX);
return 0;
--
2.56.0
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-11-06 23:21 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-11-06 23:21 [PATCH bpf-next v1 1/2] bpf: Share map-backed callback register setup Ihor Solodrai
2026-11-06 23:21 ` [PATCH bpf-next v1 2/2] bpf: Rely on callback frame initialization defaults Ihor Solodrai
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®