Re: [PATCH bpf-next 03/10] bpf: Support stack arguments for bpf functions

Yonghong Song
2026-04-03T04:11:05Z

On 4/2/26 4:38 PM, Alexei Starovoitov wrote:
> On Wed, Apr 1, 2026 at 6:27 PM Yonghong Song <yonghong.song@linux.dev> wrote:
>> Currently BPF functions (subprogs) are limited to 5 register arguments.
>> With [1], the compiler can emit code that passes additional arguments
>> via a dedicated stack area through bpf register
>> BPF_REG_STACK_ARG_BASE (r12), introduced in the previous patch.
>>
>> The following is an example to show how stack arguments are saved
>> and transferred between caller and callee:
>>
>> int foo(int a1, int a2, int a3, int a4, int a5, int a6, int a7) {
>> ...
>> bar(a1, a2, a3, a4, a5, a6, a7, a8);
>> ...
>> }
>>
>> The following is a illustration of stack allocation:
>>
>> Caller (foo) Callee (bar)
>> ============ ============
>> r12-relative stack arg area: r12-relative stack arg area:
>>
>> r12-8: [incoming arg 6] +--> r12-8: [incoming arg 6] (from caller's outgoing r12-24)
>> r12-16: [incoming arg 7] |+-> r12-16: [incoming arg 7] (from caller's outgoing r12-32)
>> ||+> r12-24: [incoming arg 8] (from caller's outgoing r12-40)
>> ---- incoming/outgoing boundary ||| ---- incoming/outgoing boundary
>> r12-24: [outgoing arg 6 to callee]+|| ...
>> r12-32: [outgoing arg 7 to callee]-+|
>> r12-40: [outgoing arg 8 to callee]--+
> I haven't looked at the patch itself only at this diagram.
> How does it suppose to map to x86 calling convention?
> The shift is unusual.
> x86 is using fp-N for outgoing and fp+N for incoming.
> Why can't we use the same?
>
This is not for jit. The above transfer is for verification purpose.
For example, for callee, a load 'rX = *(u64 *)(r12 - 8)' can easily
get the value rX in callee since the value is copied from caller to callee.