From: "Alexei Starovoitov" <alexei.starovoitov@gmail.com>
To: "Eduard Zingerman" <eddyz87@gmail.com>, <bpf@vger.kernel.org>
Cc: <daniel@iogearbox.net>, <andrii@kernel.org>, <memxor@gmail.com>,
<a.s.protopopov@gmail.com>
Subject: Re: [PATCH bpf-next 04/17] bpf: Prepare static analysis passes for callx instruction
Date: Wed, 23 Sep 2026 23:51:01 +0000 [thread overview]
Message-ID: <DLN3KYEZPIQR.30NJCCM978VV1@gmail.com> (raw)
In-Reply-To: <7917b7dbfbc2d206b0b4c22d2352f5b4700125f0.camel@gmail.com>
On Wed, Sep 23, 2026 at 04:10 PM Eduard Zingerman <eddyz87@gmail.com> wrote:
>> - alive = bpf_calls_callback(env, callsite)
>> + alive = callee_stack_access_at_callsite(env, callsite)
>> ? is_live_before(instance, callsite, rel, half_spi)
>> : is_live_before(instance, callsite + 1, rel, half_spi);
>> if (alive)
>
> I don't understand this change.
> The original reasoning is that callback calling function can call the
> callback many times and the callback might access stack slots from
> outer frames. Hence is_live_before(... callsite ...).
> callx only calls target once.
It's not about the number of calls.
analyze_subprog() doesn't know the callee of callx and doesn't create
an instance for it at this callsite. While the verifier is in the
callee lookup_instance() finds its standalone depth 0 instance that
knows nothing about outer frames. What the callee may read in the
caller's stack is recorded as may_read of callx insn itself by
record_call_access(). That's in live_before(callsite), but not in
live_before(callsite + 1).
callx_callee_reads_caller_stack_ok in patch 15 is a test case for this.
Without this hunk fp-8 is dead.
next prev parent reply other threads:[~2026-09-23 23:51 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-22 1:13 [PATCH bpf-next 00/17] bpf: Indirect calls of bpf subprogs (callx) Alexei Starovoitov
2026-09-22 1:13 ` [PATCH bpf-next 01/17] bpf: Fix infinite loop in check_max_stack_depth() Alexei Starovoitov
2026-09-22 2:01 ` bot+bpf-ci
2026-09-22 2:56 ` Alexei Starovoitov
2026-09-23 22:35 ` Eduard Zingerman
2026-09-22 1:13 ` [PATCH bpf-next 02/17] selftests/bpf: Test recursion through a global function and a callback Alexei Starovoitov
2026-09-22 1:13 ` [PATCH bpf-next 03/17] bpf: Don't fold loads from insn_array maps into constants Alexei Starovoitov
2026-09-23 22:39 ` Eduard Zingerman
2026-09-23 23:12 ` Alexei Starovoitov
2026-09-24 0:19 ` bot+bpf-ci
2026-09-22 1:13 ` [PATCH bpf-next 04/17] bpf: Prepare static analysis passes for callx instruction Alexei Starovoitov
2026-09-23 23:10 ` Eduard Zingerman
2026-09-23 23:51 ` Alexei Starovoitov [this message]
2026-09-22 1:13 ` [PATCH bpf-next 05/17] bpf: Add callx instruction to call bpf subprogs indirectly Alexei Starovoitov
2026-09-24 0:09 ` Eduard Zingerman
2026-09-22 1:13 ` [PATCH bpf-next 06/17] bpf: Add callx calls to the call graph Alexei Starovoitov
2026-09-22 1:27 ` sashiko-bot
2026-09-22 2:54 ` Alexei Starovoitov
2026-09-22 1:13 ` [PATCH bpf-next 07/17] bpf, x86: Add JIT support for callx Alexei Starovoitov
2026-09-22 1:27 ` sashiko-bot
2026-09-22 2:53 ` Alexei Starovoitov
2026-09-22 1:13 ` [PATCH bpf-next 08/17] bpf, arm64: " Alexei Starovoitov
2026-09-22 15:05 ` Puranjay Mohan
2026-09-22 1:13 ` [PATCH bpf-next 09/17] bpf: Discover subprogs described by func_info Alexei Starovoitov
2026-09-22 1:13 ` [PATCH bpf-next 10/17] bpf: Recognize pointers to functions in read-only maps Alexei Starovoitov
2026-09-22 1:31 ` sashiko-bot
2026-09-22 3:01 ` Alexei Starovoitov
2026-09-24 0:46 ` bot+bpf-ci
2026-09-24 2:12 ` Alexei Starovoitov
2026-09-22 1:13 ` [PATCH bpf-next 11/17] libbpf: Support pointers to static functions in data when linking Alexei Starovoitov
2026-09-22 1:13 ` [PATCH bpf-next 12/17] libbpf: Resolve pointers to functions in read-only data Alexei Starovoitov
2026-09-24 0:33 ` bot+bpf-ci
2026-09-24 2:13 ` Alexei Starovoitov
2026-09-22 1:13 ` [PATCH bpf-next 13/17] libbpf: Treat .data.rel.ro as " Alexei Starovoitov
2026-09-22 1:13 ` [PATCH bpf-next 14/17] libbpf: Support pointers to functions in read-only data in light skeleton Alexei Starovoitov
2026-09-22 2:01 ` bot+bpf-ci
2026-09-22 2:55 ` Alexei Starovoitov
2026-09-22 1:13 ` [PATCH bpf-next 15/17] selftests/bpf: Add tests for callx Alexei Starovoitov
2026-09-24 0:33 ` bot+bpf-ci
2026-09-24 2:13 ` Alexei Starovoitov
2026-09-22 1:13 ` [PATCH bpf-next 16/17] selftests/bpf: Add tests for callx through pointers in read-only data Alexei Starovoitov
2026-09-22 2:01 ` bot+bpf-ci
2026-09-24 0:33 ` bot+bpf-ci
2026-09-22 1:13 ` [PATCH bpf-next 17/17] bpf, docs: Document callx instruction Alexei Starovoitov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DLN3KYEZPIQR.30NJCCM978VV1@gmail.com \
--to=alexei.starovoitov@gmail.com \
--cc=a.s.protopopov@gmail.com \
--cc=andrii@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=memxor@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.