5699 				   struct bpf_func_state *callee,
5708 	struct bpf_func_state *caller, *callee;  in __check_func_call()  local
5762 		callee = async_cb->frame[0];  in __check_func_call()
5763 		callee->async_entry_cnt = caller->async_entry_cnt + 1;  in __check_func_call()
5766 		err = set_callee_state_cb(env, caller, callee, *insn_idx);  in __check_func_call()
5777 	callee = kzalloc(sizeof(*callee), GFP_KERNEL);  in __check_func_call()
5778 	if (!callee)  in __check_func_call()
5780 	state->frame[state->curframe + 1] = callee;  in __check_func_call()
5786 	init_func_state(env, callee,  in __check_func_call()
5793 	err = copy_reference_state(callee, caller);  in __check_func_call()
5797 	err = set_callee_state_cb(env, caller, callee, *insn_idx);  in __check_func_call()
5813 		print_verifier_state(env, callee);  in __check_func_call()
5820 				   struct bpf_func_state *callee)  in map_set_for_each_callback_args()  argument
5827 	callee->regs[BPF_REG_1] = caller->regs[BPF_REG_1];  in map_set_for_each_callback_args()
5829 	callee->regs[BPF_REG_2].type = PTR_TO_MAP_KEY;  in map_set_for_each_callback_args()
5830 	__mark_reg_known_zero(&callee->regs[BPF_REG_2]);  in map_set_for_each_callback_args()
5831 	callee->regs[BPF_REG_2].map_ptr = caller->regs[BPF_REG_1].map_ptr;  in map_set_for_each_callback_args()
5833 	callee->regs[BPF_REG_3].type = PTR_TO_MAP_VALUE;  in map_set_for_each_callback_args()
5834 	__mark_reg_known_zero(&callee->regs[BPF_REG_3]);  in map_set_for_each_callback_args()
5835 	callee->regs[BPF_REG_3].map_ptr = caller->regs[BPF_REG_1].map_ptr;  in map_set_for_each_callback_args()
5838 	callee->regs[BPF_REG_4] = caller->regs[BPF_REG_3];  in map_set_for_each_callback_args()
5841 	__mark_reg_not_init(env, &callee->regs[BPF_REG_5]);  in map_set_for_each_callback_args()
5847 			    struct bpf_func_state *callee, int insn_idx)  in set_callee_state()  argument
5855 		callee->regs[i] = caller->regs[i];  in set_callee_state()
5877 				       struct bpf_func_state *callee,  in set_map_elem_callback_state()  argument
5896 	err = map->ops->map_set_for_each_callback_args(env, caller, callee);  in set_map_elem_callback_state()
5900 	callee->in_callback_fn = true;  in set_map_elem_callback_state()
5906 				    struct bpf_func_state *callee,  in set_timer_callback_state()  argument
5914 	callee->regs[BPF_REG_1].type = CONST_PTR_TO_MAP;  in set_timer_callback_state()
5915 	__mark_reg_known_zero(&callee->regs[BPF_REG_1]);  in set_timer_callback_state()
5916 	callee->regs[BPF_REG_1].map_ptr = map_ptr;  in set_timer_callback_state()
5918 	callee->regs[BPF_REG_2].type = PTR_TO_MAP_KEY;  in set_timer_callback_state()
5919 	__mark_reg_known_zero(&callee->regs[BPF_REG_2]);  in set_timer_callback_state()
5920 	callee->regs[BPF_REG_2].map_ptr = map_ptr;  in set_timer_callback_state()
5922 	callee->regs[BPF_REG_3].type = PTR_TO_MAP_VALUE;  in set_timer_callback_state()
5923 	__mark_reg_known_zero(&callee->regs[BPF_REG_3]);  in set_timer_callback_state()
5924 	callee->regs[BPF_REG_3].map_ptr = map_ptr;  in set_timer_callback_state()
5927 	__mark_reg_not_init(env, &callee->regs[BPF_REG_4]);  in set_timer_callback_state()
5928 	__mark_reg_not_init(env, &callee->regs[BPF_REG_5]);  in set_timer_callback_state()
5929 	callee->in_async_callback_fn = true;  in set_timer_callback_state()
5936 	struct bpf_func_state *caller, *callee;  in prepare_func_exit()  local
5940 	callee = state->frame[state->curframe];  in prepare_func_exit()
5941 	r0 = &callee->regs[BPF_REG_0];  in prepare_func_exit()
5955 	if (callee->in_callback_fn) {  in prepare_func_exit()
5973 	err = copy_reference_state(caller, callee);  in prepare_func_exit()
5977 	*insn_idx = callee->callsite + 1;  in prepare_func_exit()
5980 		print_verifier_state(env, callee);  in prepare_func_exit()
5985 	free_func_state(callee);  in prepare_func_exit()