Re: [PATCH bpf-next v1 00/29] Exceptions - Resource Cleanup - Redux

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Wed, Nov 11, 2026 at 04:56 AM Kumar Kartikeya Dwivedi <memxor@gmail.com> wrote:
> This series allows the main program and its subprogs, static and global,
> to throw while holding resources. The unwinder releases the resources of
> every frame it discards.

Agree that we need bpf_throw() from everywhere.
Below is an idea for brainstorming. No code yet.

Drop elaboration in the verifier. Pads instead of descriptors.

Keep the analysis of what a frame holds at a site.
Change what comes out of it: not tables for a C unwinder, but landing pads.
A pad is BPF insns that the verifier adds after the main pass, like guards.
Then throw, cancel and rust panic are one mechanism:
unwind_goto / unwind_exit.

1. One unwinder

  site                                 the verifier emits
  -----------------------------------  ---------------------------------
  call bpf_throw                       r0 = cookie; goto pad
  loop guard, recursion check          may_goto pad
  call / callx of a subprog that may   unwind_goto pad, behind the call
  unwind, no unwind_goto behind it
  helper that runs a callback          unwind_goto pad, behind the call
  (your 'helpers have pads')
  arena load / store / atomic          unwind_goto pad, behind the access.
                                       JIT points the extable entry at it

  pad:  release calls
        r0 = 0
        unwind_exit          main prog: call exception_cb; exit

Every frame leaves through its epilogue. The frame at the site has R0-R9.
A frame that waits in a call has R6-R9 and its stack.
No stack walk, no asm entries, no saved register offsets, no site tables.
No void (*)(void *) wrappers: a pad calls the release kfunc with its type.
A frame of rust keeps its own pads. Nothing is skipped by construction.
Sites that need the same pad share it. Most sites hold nothing.

2. Three questions, answered apart

  WHO        The frame that acquired it since its entry.
  releases   What a callee returns with is the caller's.
             Or the callee that it was MOVED into: the caller keeps no
             live copy behind the call (R6-R9, stack).
             Decided at the call from the state and liveness.
             Nothing provisional. Nothing to settle after the pass.
  WHERE is   The prog's own live place, like your lattice: register,
  the handle spill, stack object, pointer to what the lock is in + delta,
             fixed address, load through a live pointer.
             The prog has to release it later, so the handle is live.
  WHETHER    The pc, when all states at the site agree.
  it is held Otherwise a DROP FLAG, as rustc and clang do it.

3. The drop flag

One hidden byte in the frame. The entry of the subprog zeroes the word.

  flag = 1   behind the insn of THIS frame that brought the resource:
             the acquiring call, the call of a subprog that returns
             with it, or the entry when it was moved in
  flag = 0   at the insn of THIS frame that takes it away:
             the releasing call, or the call that moves it out

        *(u8 *)(r10 - H) = 0
        if r7 == 0 goto skip
        call bpf_task_from_pid
        r6 = r0
        *(u8 *)(r10 - H) = 1
  skip: ... arena access, loop, call foo ...          -> pad
        if r7 == 0 goto out
        *(u8 *)(r10 - H) = 0
        r1 = r6
        call bpf_task_release
  pad:  r1 = *(u8 *)(r10 - H)
        if r1 == 0 goto done
        r1 = r6
        if r1 == 0 goto done
        call bpf_task_release
  done: r0 = 0
        unwind_exit

The stores are unconditional. bpf_res_spin_lock() needs a test of r0 first.
The flag has no handle in it. So there is no register to find at the
acquire, no compare chain at the release, no refresh after a call.
A flag is emitted only where the states at some site disagree.

Identity: a reference carries its origin, as in your set.
A join or a subsumption can pair two references with different origins.
Then the origins go into one set (union-find) and share a flag.
States are joined as today.
Sections become entries of refs[], so they have an origin too.

4. What I hope goes away, in your terms

  tables, unwinder, phases, asm entries,   pads
  registers recovered from prologues
  mirror                                   flag + the prog's own place
  NULL in the lattice                      flag. A pad tests for NULL too
  entry guarded by a scalar                flag
  descriptor per chain of calls            flag in the callee's frame:
                                           'differs by chain' is 'held
                                           on some paths' there
  provisional listings, transfer           move at the call
  other origins are not joined             union-find

What stays: classes, type -> release kfunc, the places, helpers have pads,
the return value of a cancelled prog, the struct_ops hook, the stack in
arena, bpf_throw() reads all registers and slots for liveness.

5. Where I'm looking for ideas.

 a. Several resources of one origin at once. rbtree_search pops nodes
    into an array in a loop that is walked. A flag per origin cannot say
    which.
 b. A callee releases what the caller keeps live, on some paths only.
    try_consume(obj). During the call the pc of the callee tells.
    Behind the call only the callee knows. Maybe: the callee has its own
    flag and returns it in a scratch register at exit and unwind_exit.
    R2 survives exit already for 16 byte returns.
    I think you're doing something like that in your followup patches.