10267 				   struct bpf_func_state *callee,
10272 			    struct bpf_func_state *callee, int insn_idx);
10278 	struct bpf_func_state *caller, *callee;  in setup_func_entry()  local
10294 	callee = kzalloc(sizeof(*callee), GFP_KERNEL);  in setup_func_entry()
10295 	if (!callee)  in setup_func_entry()
10297 	state->frame[state->curframe + 1] = callee;  in setup_func_entry()
10303 	init_func_state(env, callee,  in setup_func_entry()
10308 	err = set_callee_state_cb(env, caller, callee, callsite);  in setup_func_entry()
10318 	free_func_state(callee);  in setup_func_entry()
10452 	struct bpf_func_state *caller, *callee;  in push_callback_call()  local
10487 		callee = async_cb->frame[0];  in push_callback_call()
10488 		callee->async_entry_cnt = caller->async_entry_cnt + 1;  in push_callback_call()
10491 		err = set_callee_state_cb(env, caller, callee, insn_idx);  in push_callback_call()
10598 				   struct bpf_func_state *callee)  in map_set_for_each_callback_args()  argument
10605 	callee->regs[BPF_REG_1] = caller->regs[BPF_REG_1];  in map_set_for_each_callback_args()
10607 	callee->regs[BPF_REG_2].type = PTR_TO_MAP_KEY;  in map_set_for_each_callback_args()
10608 	__mark_reg_known_zero(&callee->regs[BPF_REG_2]);  in map_set_for_each_callback_args()
10609 	callee->regs[BPF_REG_2].map_ptr = caller->regs[BPF_REG_1].map_ptr;  in map_set_for_each_callback_args()
10611 	callee->regs[BPF_REG_3].type = PTR_TO_MAP_VALUE;  in map_set_for_each_callback_args()
10612 	__mark_reg_known_zero(&callee->regs[BPF_REG_3]);  in map_set_for_each_callback_args()
10613 	callee->regs[BPF_REG_3].map_ptr = caller->regs[BPF_REG_1].map_ptr;  in map_set_for_each_callback_args()
10616 	callee->regs[BPF_REG_4] = caller->regs[BPF_REG_3];  in map_set_for_each_callback_args()
10619 	__mark_reg_not_init(env, &callee->regs[BPF_REG_5]);  in map_set_for_each_callback_args()
10625 			    struct bpf_func_state *callee, int insn_idx)  in set_callee_state()  argument
10633 		callee->regs[i] = caller->regs[i];  in set_callee_state()
10639 				       struct bpf_func_state *callee,  in set_map_elem_callback_state()  argument
10654 	err = map->ops->map_set_for_each_callback_args(env, caller, callee);  in set_map_elem_callback_state()
10658 	callee->in_callback_fn = true;  in set_map_elem_callback_state()
10659 	callee->callback_ret_range = retval_range(0, 1);  in set_map_elem_callback_state()
10665 				   struct bpf_func_state *callee,  in set_loop_callback_state()  argument
10672 	callee->regs[BPF_REG_1].type = SCALAR_VALUE;  in set_loop_callback_state()
10673 	callee->regs[BPF_REG_2] = caller->regs[BPF_REG_3];  in set_loop_callback_state()
10676 	__mark_reg_not_init(env, &callee->regs[BPF_REG_3]);  in set_loop_callback_state()
10677 	__mark_reg_not_init(env, &callee->regs[BPF_REG_4]);  in set_loop_callback_state()
10678 	__mark_reg_not_init(env, &callee->regs[BPF_REG_5]);  in set_loop_callback_state()
10680 	callee->in_callback_fn = true;  in set_loop_callback_state()
10681 	callee->callback_ret_range = retval_range(0, 1);  in set_loop_callback_state()
10687 				    struct bpf_func_state *callee,  in set_timer_callback_state()  argument
10695 	callee->regs[BPF_REG_1].type = CONST_PTR_TO_MAP;  in set_timer_callback_state()
10696 	__mark_reg_known_zero(&callee->regs[BPF_REG_1]);  in set_timer_callback_state()
10697 	callee->regs[BPF_REG_1].map_ptr = map_ptr;  in set_timer_callback_state()
10699 	callee->regs[BPF_REG_2].type = PTR_TO_MAP_KEY;  in set_timer_callback_state()
10700 	__mark_reg_known_zero(&callee->regs[BPF_REG_2]);  in set_timer_callback_state()
10701 	callee->regs[BPF_REG_2].map_ptr = map_ptr;  in set_timer_callback_state()
10703 	callee->regs[BPF_REG_3].type = PTR_TO_MAP_VALUE;  in set_timer_callback_state()
10704 	__mark_reg_known_zero(&callee->regs[BPF_REG_3]);  in set_timer_callback_state()
10705 	callee->regs[BPF_REG_3].map_ptr = map_ptr;  in set_timer_callback_state()
10708 	__mark_reg_not_init(env, &callee->regs[BPF_REG_4]);  in set_timer_callback_state()
10709 	__mark_reg_not_init(env, &callee->regs[BPF_REG_5]);  in set_timer_callback_state()
10710 	callee->in_async_callback_fn = true;  in set_timer_callback_state()
10711 	callee->callback_ret_range = retval_range(0, 1);  in set_timer_callback_state()
10717 				       struct bpf_func_state *callee,  in set_find_vma_callback_state()  argument
10725 	callee->regs[BPF_REG_1] = caller->regs[BPF_REG_1];  in set_find_vma_callback_state()
10727 	callee->regs[BPF_REG_2].type = PTR_TO_BTF_ID;  in set_find_vma_callback_state()
10728 	__mark_reg_known_zero(&callee->regs[BPF_REG_2]);  in set_find_vma_callback_state()
10729 	callee->regs[BPF_REG_2].btf =  btf_vmlinux;  in set_find_vma_callback_state()
10730 	callee->regs[BPF_REG_2].btf_id = btf_tracing_ids[BTF_TRACING_TYPE_VMA];  in set_find_vma_callback_state()
10733 	callee->regs[BPF_REG_3] = caller->regs[BPF_REG_4];  in set_find_vma_callback_state()
10736 	__mark_reg_not_init(env, &callee->regs[BPF_REG_4]);  in set_find_vma_callback_state()
10737 	__mark_reg_not_init(env, &callee->regs[BPF_REG_5]);  in set_find_vma_callback_state()
10738 	callee->in_callback_fn = true;  in set_find_vma_callback_state()
10739 	callee->callback_ret_range = retval_range(0, 1);  in set_find_vma_callback_state()
10745 					   struct bpf_func_state *callee,  in set_user_ringbuf_callback_state()  argument
10752 	__mark_reg_not_init(env, &callee->regs[BPF_REG_0]);  in set_user_ringbuf_callback_state()
10753 	mark_dynptr_cb_reg(env, &callee->regs[BPF_REG_1], BPF_DYNPTR_TYPE_LOCAL);  in set_user_ringbuf_callback_state()
10754 	callee->regs[BPF_REG_2] = caller->regs[BPF_REG_3];  in set_user_ringbuf_callback_state()
10757 	__mark_reg_not_init(env, &callee->regs[BPF_REG_3]);  in set_user_ringbuf_callback_state()
10758 	__mark_reg_not_init(env, &callee->regs[BPF_REG_4]);  in set_user_ringbuf_callback_state()
10759 	__mark_reg_not_init(env, &callee->regs[BPF_REG_5]);  in set_user_ringbuf_callback_state()
10761 	callee->in_callback_fn = true;  in set_user_ringbuf_callback_state()
10762 	callee->callback_ret_range = retval_range(0, 1);  in set_user_ringbuf_callback_state()
10768 					 struct bpf_func_state *callee,  in set_rbtree_add_callback_state()  argument
10785 	mark_reg_graph_node(callee->regs, BPF_REG_1, &field->graph_root);  in set_rbtree_add_callback_state()
10786 	ref_set_non_owning(env, &callee->regs[BPF_REG_1]);  in set_rbtree_add_callback_state()
10787 	mark_reg_graph_node(callee->regs, BPF_REG_2, &field->graph_root);  in set_rbtree_add_callback_state()
10788 	ref_set_non_owning(env, &callee->regs[BPF_REG_2]);  in set_rbtree_add_callback_state()
10790 	__mark_reg_not_init(env, &callee->regs[BPF_REG_3]);  in set_rbtree_add_callback_state()
10791 	__mark_reg_not_init(env, &callee->regs[BPF_REG_4]);  in set_rbtree_add_callback_state()
10792 	__mark_reg_not_init(env, &callee->regs[BPF_REG_5]);  in set_rbtree_add_callback_state()
10793 	callee->in_callback_fn = true;  in set_rbtree_add_callback_state()
10794 	callee->callback_ret_range = retval_range(0, 1);  in set_rbtree_add_callback_state()
10808 	struct bpf_func_state *callee;  in in_rbtree_lock_required_cb()  local
10814 	callee = state->frame[state->curframe];  in in_rbtree_lock_required_cb()
10816 	if (!callee->in_callback_fn)  in in_rbtree_lock_required_cb()
10819 	kfunc_btf_id = insn[callee->callsite].imm;  in in_rbtree_lock_required_cb()
10835 	struct bpf_func_state *caller, *callee;  in prepare_func_exit()  local
10840 	callee = state->frame[state->curframe];  in prepare_func_exit()
10841 	r0 = &callee->regs[BPF_REG_0];  in prepare_func_exit()
10854 	if (callee->in_callback_fn) {  in prepare_func_exit()
10867 		if (!retval_range_within(callee->callback_ret_range, r0, false)) {  in prepare_func_exit()
10868 			verbose_invalid_scalar(env, r0, callee->callback_ret_range,  in prepare_func_exit()
10872 		if (!calls_callback(env, callee->callsite)) {  in prepare_func_exit()
10874 				*insn_idx, callee->callsite);  in prepare_func_exit()
10886 	in_callback_fn = callee->in_callback_fn;  in prepare_func_exit()
10888 		*insn_idx = callee->callsite;  in prepare_func_exit()
10890 		*insn_idx = callee->callsite + 1;  in prepare_func_exit()
10894 		print_verifier_state(env, state, callee->frameno, true);  in prepare_func_exit()
10900 	free_func_state(callee);  in prepare_func_exit()
17027 	struct bpf_subprog_info *caller, *callee;  in merge_callee_effects()  local
17030 	callee = find_containing_subprog(env, w);  in merge_callee_effects()
17031 	caller->changes_pkt_data |= callee->changes_pkt_data;  in merge_callee_effects()
17032 	caller->might_sleep |= callee->might_sleep;  in merge_callee_effects()