Re: [PATCH bpf-next 03/10] bpf: Support stack arguments for bpf functions

Yonghong Song
2026-04-03T04:05:59Z

On 4/2/26 4:38 PM, Amery Hung wrote:
> On Wed, Apr 1, 2026 at 6:28 PM Yonghong Song <yonghong.song@linux.dev> wrote:
>> Currently BPF functions (subprogs) are limited to 5 register arguments.
>> With [1], the compiler can emit code that passes additional arguments
>> via a dedicated stack area through bpf register
>> BPF_REG_STACK_ARG_BASE (r12), introduced in the previous patch.
>>
>> The following is an example to show how stack arguments are saved
>> and transferred between caller and callee:
>>
>> int foo(int a1, int a2, int a3, int a4, int a5, int a6, int a7) {
>> ...
>> bar(a1, a2, a3, a4, a5, a6, a7, a8);
>> ...
>> }
>>
>> The following is a illustration of stack allocation:
>>
>> Caller (foo) Callee (bar)
>> ============ ============
>> r12-relative stack arg area: r12-relative stack arg area:
>>
>> r12-8: [incoming arg 6] +--> r12-8: [incoming arg 6] (from caller's outgoing r12-24)
>> r12-16: [incoming arg 7] |+-> r12-16: [incoming arg 7] (from caller's outgoing r12-32)
>> ||+> r12-24: [incoming arg 8] (from caller's outgoing r12-40)
>> ---- incoming/outgoing boundary ||| ---- incoming/outgoing boundary
>> r12-24: [outgoing arg 6 to callee]+|| ...
>> r12-32: [outgoing arg 7 to callee]-+|
>> r12-40: [outgoing arg 8 to callee]--+
>>
>> The caller writes outgoing args past its own incoming area.
>> At the call site, the verifier transfers the caller's outgoing
>> slots into the callee's incoming slots.
>>
>> The verifier tracks stack arg slots separately from the regular r10
>> stack. A new 'bpf_stack_arg_state' structure mirrors the existing stack
>> slot tracking (spilled_ptr + slot_type[]) but lives in a dedicated
>> 'stack_arg_slots' array in bpf_func_state. This separation keeps the
>> stack arg area from interfering with the normal stack and frame pointer
>> (r10) bookkeeping.
>>
>> If the bpf function has more than one calls, e.g.,
>>
>> int foo(int a1, int a2, int a3, int a4, int a5, int a6, int a7) {
>> ...
>> bar1(a1, a2, a3, a4, a5, a6, a7, a8);
>> ...
>> bar2(a1, a2, a3, a4, a5, a6, a7, a8, a9);
>> ...
>> }
>>
>> The following is an illustration:
>>
>> Caller (foo) Callee (bar1)
>> ============ =============
>> r12-relative stack arg area: r12-relative stack arg area:
>>
>> r12-8: [incoming arg 6] +--> r12-8: [incoming arg 6] (from caller's outgoing r12-24)
>> r12-16: [incoming arg 7] |+-> r12-16: [incoming arg 7] (from caller's outgoing r12-32)
>> ||+> r12-24: [incoming arg 8] (from caller's outgoing r12-40)
>> ---- incoming/outgoing boundary ||| ---- incoming/outgoing boundary
>> r12-24: [outgoing arg 6 to callee]+|| ...
>> r12-32: [outgoing arg 7 to callee]-+|
>> r12-40: [outgoing arg 8 to callee]--+
>> ...
>> Back from bar1
>> ... Callee (bar2)
>> === =============
>> +---> r12-8: [incoming arg 6] (from caller's outgoing r12-24)
>> |+--> r12-16: [incoming arg 7] (from caller's outgoing r12-32)
>> ||+-> r12-24: [incoming arg 8] (from caller's outgoing r12-40)
>> |||+> r12-32: [incoming arg 9] (from caller's outgoing r12-48)
>> ---- incoming/outgoing boundary |||| ---- incoming/outgoing boundary
>> r12-24: [outgoing arg 6 to callee]+||| ...
>> r12-32: [outgoing arg 7 to callee]-+||
>> r12-40: [outgoing arg 8 to callee]--+|
>> r12-48: [outgoing arg 9 to callee]---+
>>
>> Global subprogs with >5 args are not yet supported.
>>
>> [1] https://github.com/llvm/llvm-project/pull/189060
>>
>> Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
>> ---
>> include/linux/bpf.h | 2 +
>> include/linux/bpf_verifier.h | 15 ++-
>> kernel/bpf/btf.c | 14 +-
>> kernel/bpf/verifier.c | 248 ++++++++++++++++++++++++++++++++---
>> 4 files changed, 257 insertions(+), 22 deletions(-)
>>
>> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
>> index e24c4a2e95f7..a0a1e14e4394 100644
>> --- a/include/linux/bpf.h
>> +++ b/include/linux/bpf.h
>> @@ -1666,6 +1666,8 @@ struct bpf_prog_aux {
>> u32 max_pkt_offset;
>> u32 max_tp_access;
>> u32 stack_depth;
>> + u16 incoming_stack_arg_depth;
>> + u16 stack_arg_depth; /* both incoming and max outgoing of stack arguments */
>> u32 id;
>> u32 func_cnt; /* used by non-func prog as the number of func progs */
>> u32 real_func_cnt; /* includes hidden progs, only used for JIT and freeing progs */
[...]
>> @@ -8054,10 +8195,23 @@ static int check_load_mem(struct bpf_verifier_env *env, struct bpf_insn *insn,
>> static int check_store_reg(struct bpf_verifier_env *env, struct bpf_insn *insn,
>> bool strict_alignment_once)
>> {
>> + struct bpf_verifier_state *vstate = env->cur_state;
>> + struct bpf_func_state *state = vstate->frame[vstate->curframe];
>> struct bpf_reg_state *regs = cur_regs(env);
>> enum bpf_reg_type dst_reg_type;
>> int err;
>>
>> + /* Handle stack arg write */
>> + if (insn->dst_reg == BPF_REG_STACK_ARG_BASE) {
>> + err = check_reg_arg(env, insn->src_reg, SRC_OP);
>> + if (err)
>> + return err;
>> + err = check_stack_arg_access(env, insn, "write");
>> + if (err)
>> + return err;
>> + return check_stack_arg_write(env, state, insn->off, insn->src_reg);
>> + }
>> +
>> /* check src1 operand */
>> err = check_reg_arg(env, insn->src_reg, SRC_OP);
>> if (err)
>> @@ -10940,8 +11094,10 @@ static int check_func_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
>> int *insn_idx)
>> {
>> struct bpf_verifier_state *state = env->cur_state;
>> + struct bpf_subprog_info *caller_info;
>> struct bpf_func_state *caller;
>> int err, subprog, target_insn;
>> + u16 callee_incoming;
>>
>> target_insn = *insn_idx + insn->imm + 1;
>> subprog = find_subprog(env, target_insn);
>> @@ -10993,6 +11149,15 @@ static int check_func_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
>> return 0;
>> }
>>
>> + /*
>> + * Track caller's outgoing stack arg depth (max across all callees).
>> + * This is needed so the JIT knows how much stack arg space to allocate.
>> + */
>> + caller_info = &env->subprog_info[caller->subprogno];
>> + callee_incoming = env->subprog_info[subprog].incoming_stack_arg_depth;
>> + if (callee_incoming > caller_info->outgoing_stack_arg_depth)
>> + caller_info->outgoing_stack_arg_depth = callee_incoming;
>> +
>> /* for regular function entry setup new frame and continue
>> * from that frame.
>> */
>> @@ -11048,13 +11213,41 @@ static int set_callee_state(struct bpf_verifier_env *env,
>> struct bpf_func_state *caller,
>> struct bpf_func_state *callee, int insn_idx)
>> {
> Taking note when reading the change to set_callee_state():
>
> The function is not called when handling callback function, which uses
> push_callback_call() -> setup_func_entry() -> callback specific
> set_callee_state_cb. So caller stack argument will not be transferred.
>
> This should be fine as callee's stack_arg_depth will remain zero and
> then when callee tries to do r12 based load, check_stack_arg_read()
> should reject the program. Not sure if this needs a selftest since
> callbacks' set_callee_state_cb will also transfer register state very
> intentionally.

All callback functions are carefully designed in kernel. So far all
callback functions are within 5 register parameters. I ignore them
for now. If in the future, there is a need for callback functions
with more than 5 arguments, we can deal with them at that time.

>
>> - int i;
>> + struct bpf_subprog_info *callee_info;
>> + int i, err;
>>
>> /* copy r1 - r5 args that callee can access. The copy includes parent
>> * pointers, which connects us up to the liveness chain
>> */
>> for (i = BPF_REG_1; i <= BPF_REG_5; i++)
>> callee->regs[i] = caller->regs[i]; …