From: Ihor Solodrai <ihor.solodrai@linux.dev>
To: Alexei Starovoitov <ast@kernel.org>,
Andrii Nakryiko <andrii@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Eduard Zingerman <eddyz87@gmail.com>,
Kumar Kartikeya Dwivedi <memxor@gmail.com>
Cc: Amery Hung <ameryhung@gmail.com>,
Emil Tsalapatis <emil@etsalapatis.com>,
Nicholas Carlini <npc@anthropic.com>,
bpf@vger.kernel.org, linux-kernel@vger.kernel.org,
kernel-team@meta.com
Subject: [PATCH bpf-next v4 1/6] bpf: Share map-backed callback register setup
Date: Fri, 13 Nov 2026 14:39:16 -0700 [thread overview]
Message-ID: <20261113213921.1646681-2-ihor.solodrai@linux.dev> (raw)
In-Reply-To: <20261113213921.1646681-1-ihor.solodrai@linux.dev>
Map iteration, timer, task-work and RCU callbacks repeat the same register
type, offset and map-metadata setup for their map, key and value arguments.
Use one initializer for map-backed callback registers. Leave argument
selection, value ids and callback-specific policy in each setter.
No functional change.
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
kernel/bpf/verifier.c | 81 +++++++++++--------------------------------
1 file changed, 21 insertions(+), 60 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index bb1659ce7a5c..a3d4a2d6de6a 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -12215,6 +12215,16 @@ static int check_func_callx(struct bpf_verifier_env *env, struct bpf_insn *insn,
return check_func_callx_one(env, reg->subprogno, insn_idx);
}
+static void mark_map_callback_reg(struct bpf_reg_state *reg,
+ const struct bpf_reg_state *map_reg,
+ enum bpf_reg_type type)
+{
+ reg->type = type;
+ __mark_reg_known_zero(reg);
+ reg->map_ptr = map_reg->map_ptr;
+ reg->map_uid = map_reg->map_uid;
+}
+
int map_set_for_each_callback_args(struct bpf_verifier_env *env,
struct bpf_func_state *caller,
struct bpf_func_state *callee)
@@ -12226,15 +12236,8 @@ int map_set_for_each_callback_args(struct bpf_verifier_env *env,
*/
callee->regs[BPF_REG_1] = caller->regs[BPF_REG_1];
- callee->regs[BPF_REG_2].type = PTR_TO_MAP_KEY;
- __mark_reg_known_zero(&callee->regs[BPF_REG_2]);
- callee->regs[BPF_REG_2].map_ptr = caller->regs[BPF_REG_1].map_ptr;
- callee->regs[BPF_REG_2].map_uid = caller->regs[BPF_REG_1].map_uid;
-
- callee->regs[BPF_REG_3].type = PTR_TO_MAP_VALUE;
- __mark_reg_known_zero(&callee->regs[BPF_REG_3]);
- callee->regs[BPF_REG_3].map_ptr = caller->regs[BPF_REG_1].map_ptr;
- callee->regs[BPF_REG_3].map_uid = caller->regs[BPF_REG_1].map_uid;
+ mark_map_callback_reg(&callee->regs[BPF_REG_2], &caller->regs[BPF_REG_1], PTR_TO_MAP_KEY);
+ mark_map_callback_reg(&callee->regs[BPF_REG_3], &caller->regs[BPF_REG_1], PTR_TO_MAP_VALUE);
callee->regs[BPF_REG_3].id = ++env->id_gen;
/* pointer to stack or null */
@@ -12325,26 +12328,12 @@ static int set_timer_callback_state(struct bpf_verifier_env *env,
struct bpf_func_state *callee,
int insn_idx)
{
- struct bpf_map *map_ptr = caller->regs[BPF_REG_1].map_ptr;
- u32 map_uid = caller->regs[BPF_REG_1].map_uid;
-
/* bpf_timer_set_callback(struct bpf_timer *timer, void *callback_fn);
* callback_fn(struct bpf_map *map, void *key, void *value);
*/
- callee->regs[BPF_REG_1].type = CONST_PTR_TO_MAP;
- __mark_reg_known_zero(&callee->regs[BPF_REG_1]);
- callee->regs[BPF_REG_1].map_ptr = map_ptr;
- callee->regs[BPF_REG_1].map_uid = map_uid;
-
- callee->regs[BPF_REG_2].type = PTR_TO_MAP_KEY;
- __mark_reg_known_zero(&callee->regs[BPF_REG_2]);
- callee->regs[BPF_REG_2].map_ptr = map_ptr;
- callee->regs[BPF_REG_2].map_uid = map_uid;
-
- callee->regs[BPF_REG_3].type = PTR_TO_MAP_VALUE;
- __mark_reg_known_zero(&callee->regs[BPF_REG_3]);
- callee->regs[BPF_REG_3].map_ptr = map_ptr;
- callee->regs[BPF_REG_3].map_uid = map_uid;
+ mark_map_callback_reg(&callee->regs[BPF_REG_1], &caller->regs[BPF_REG_1], CONST_PTR_TO_MAP);
+ mark_map_callback_reg(&callee->regs[BPF_REG_2], &caller->regs[BPF_REG_1], PTR_TO_MAP_KEY);
+ mark_map_callback_reg(&callee->regs[BPF_REG_3], &caller->regs[BPF_REG_1], PTR_TO_MAP_VALUE);
callee->regs[BPF_REG_3].id = ++env->id_gen;
/* unused */
@@ -12446,26 +12435,12 @@ static int set_task_work_schedule_callback_state(struct bpf_verifier_env *env,
struct bpf_func_state *callee,
int insn_idx)
{
- struct bpf_map *map_ptr = caller->regs[BPF_REG_3].map_ptr;
- u32 map_uid = caller->regs[BPF_REG_3].map_uid;
-
/*
* callback_fn(struct bpf_map *map, void *key, void *value);
*/
- callee->regs[BPF_REG_1].type = CONST_PTR_TO_MAP;
- __mark_reg_known_zero(&callee->regs[BPF_REG_1]);
- callee->regs[BPF_REG_1].map_ptr = map_ptr;
- callee->regs[BPF_REG_1].map_uid = map_uid;
-
- callee->regs[BPF_REG_2].type = PTR_TO_MAP_KEY;
- __mark_reg_known_zero(&callee->regs[BPF_REG_2]);
- callee->regs[BPF_REG_2].map_ptr = map_ptr;
- callee->regs[BPF_REG_2].map_uid = map_uid;
-
- callee->regs[BPF_REG_3].type = PTR_TO_MAP_VALUE;
- __mark_reg_known_zero(&callee->regs[BPF_REG_3]);
- callee->regs[BPF_REG_3].map_ptr = map_ptr;
- callee->regs[BPF_REG_3].map_uid = map_uid;
+ mark_map_callback_reg(&callee->regs[BPF_REG_1], &caller->regs[BPF_REG_3], CONST_PTR_TO_MAP);
+ mark_map_callback_reg(&callee->regs[BPF_REG_2], &caller->regs[BPF_REG_3], PTR_TO_MAP_KEY);
+ mark_map_callback_reg(&callee->regs[BPF_REG_3], &caller->regs[BPF_REG_3], PTR_TO_MAP_VALUE);
callee->regs[BPF_REG_3].id = ++env->id_gen;
/* unused */
@@ -12481,26 +12456,12 @@ static int set_rcu_callback_state(struct bpf_verifier_env *env,
struct bpf_func_state *callee,
int insn_idx)
{
- struct bpf_map *map_ptr = caller->regs[BPF_REG_2].map_ptr;
- u32 map_uid = caller->regs[BPF_REG_2].map_uid;
-
/*
* callback_fn(struct bpf_map *map, void *key, void *value);
*/
- callee->regs[BPF_REG_1].type = CONST_PTR_TO_MAP;
- __mark_reg_known_zero(&callee->regs[BPF_REG_1]);
- callee->regs[BPF_REG_1].map_ptr = map_ptr;
- callee->regs[BPF_REG_1].map_uid = map_uid;
-
- callee->regs[BPF_REG_2].type = PTR_TO_MAP_KEY;
- __mark_reg_known_zero(&callee->regs[BPF_REG_2]);
- callee->regs[BPF_REG_2].map_ptr = map_ptr;
- callee->regs[BPF_REG_2].map_uid = map_uid;
-
- callee->regs[BPF_REG_3].type = PTR_TO_MAP_VALUE;
- __mark_reg_known_zero(&callee->regs[BPF_REG_3]);
- callee->regs[BPF_REG_3].map_ptr = map_ptr;
- callee->regs[BPF_REG_3].map_uid = map_uid;
+ mark_map_callback_reg(&callee->regs[BPF_REG_1], &caller->regs[BPF_REG_2], CONST_PTR_TO_MAP);
+ mark_map_callback_reg(&callee->regs[BPF_REG_2], &caller->regs[BPF_REG_2], PTR_TO_MAP_KEY);
+ mark_map_callback_reg(&callee->regs[BPF_REG_3], &caller->regs[BPF_REG_2], PTR_TO_MAP_VALUE);
/* unused */
bpf_mark_reg_not_init(env, &callee->regs[BPF_REG_4]);
--
2.56.0
next prev parent reply other threads:[~2026-11-13 21:39 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-13 21:39 [PATCH bpf-next v4 0/6] bpf: Scope callback arguments to their frame Ihor Solodrai
2026-11-13 21:39 ` Ihor Solodrai [this message]
2026-11-13 21:39 ` [PATCH bpf-next v4 2/6] bpf: Rely on callback frame initialization defaults Ihor Solodrai
2026-11-13 21:39 ` [PATCH bpf-next v4 3/6] bpf: Scope the bpf_user_ringbuf_drain() dynptr to its callback frame Ihor Solodrai
2026-11-13 21:39 ` [PATCH bpf-next v4 4/6] selftests/bpf: Cover the user ringbuf callback dynptr lifetime Ihor Solodrai
2026-11-13 21:39 ` [PATCH bpf-next v4 5/6] bpf: Scope the bpf_for_each_map_elem() array key to the callback frame Ihor Solodrai
2026-11-13 21:39 ` [PATCH bpf-next v4 6/6] selftests/bpf: Cover callback-frame map key lifetime Ihor Solodrai
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261113213921.1646681-2-ihor.solodrai@linux.dev \
--to=ihor.solodrai@linux.dev \
--cc=ameryhung@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=emil@etsalapatis.com \
--cc=kernel-team@meta.com \
--cc=linux-kernel@vger.kernel.org \
--cc=memxor@gmail.com \
--cc=npc@anthropic.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®