[PATCH bpf-next 00/10] bpf: Support stack arguments for BPF functions and kfuncs

Yonghong Song
2026-04-02T01:27:38Z

Currently, bpf function calls and kfunc's are limited by 5 reg-level
parameters. For function calls with more than 5 parameters,
developers can use always inlining or pass a struct pointer
after packing more parameters in that struct. But there is
no workaround for kfunc if more than 5 parameters is needed.

This patch set lifts the 5-argument limit by introducing stack-based
argument passing for BPF functions and kfunc's, coordinated with
compiler support in LLVM [1]. The compiler emits stores/loads through
a new bpf register r12 (BPF_REG_STACK_ARG_BASE) to pass arguments beyond
the 5th, keeping the stack arg area separate from the r10-based program
stack. The maximum number of arguments is capped at MAX_BPF_FUNC_ARGS
(12), which is sufficient for the vast majority of use cases.

The x86_64 JIT translates r12-relative accesses to RBP-relative
native instructions. Each function's stack allocation is extended
by (incoming + max_outgoing) bytes to hold the stack arg area below
the program stack. This makes implementation easier as the r10 can
be reused for stack argument access. At BPF-to-BPF call sites, outgoing
args are pushed onto the native stack before CALL and popped after
return. For kfunc calls, args are marshaled per the x86_64 C calling
convention (arg 6 in R9, args 7+ on the native stack).

Global subprogs with >5 args are not yet supported. Only x86_64
is supported for now.

For the rest of patches, patches 1-5 added verifier support of
stack arguments for bpf-to-bpf functions and kfunc's. Patch 6
enables x86_64 for stack arguments. Patch 7 implemented JIT for
x86_64. Patches 8-10 are some selftests.

[1] https://github.com/llvm/llvm-project/pull/189060

Yonghong Song (10):
bpf: Introduce bpf register BPF_REG_STACK_ARG_BASE
bpf: Reuse MAX_BPF_FUNC_ARGS for maximum number of arguments
bpf: Support stack arguments for bpf functions
bpf: Support stack arguments for kfunc calls
bpf: Reject stack arguments in non-JITed programs
bpf: Enable stack argument support for x86_64
bpf,x86: Implement JIT support for stack arguments
selftests/bpf: Add tests for BPF function stack arguments
selftests/bpf: Add negative test for oversized kfunc stack argument
selftests/bpf: Add verifier tests for stack argument validation

arch/x86/net/bpf_jit_comp.c | 150 +++++++-
include/linux/bpf.h | 6 +
include/linux/bpf_verifier.h | 15 +-
include/linux/filter.h | 4 +-
kernel/bpf/btf.c | 21 +-
kernel/bpf/core.c | 12 +-
kernel/bpf/verifier.c | 351 ++++++++++++++++--
.../selftests/bpf/prog_tests/stack_arg.c | 143 +++++++
.../selftests/bpf/prog_tests/stack_arg_fail.c | 24 ++
.../selftests/bpf/prog_tests/verifier.c | 2 +
tools/testing/selftests/bpf/progs/stack_arg.c | 111 ++++++
.../selftests/bpf/progs/stack_arg_fail.c | 32 ++
.../selftests/bpf/progs/stack_arg_kfunc.c | 59 +++
.../selftests/bpf/progs/verifier_stack_arg.c | 122 ++++++
.../selftests/bpf/test_kmods/bpf_testmod.c | 29 ++
.../bpf/test_kmods/bpf_testmod_kfunc.h | 14 +
16 files changed, 1045 insertions(+), 50 deletions(-)
create mode 100644 tools/testing/selftests/bpf/prog_tests/stack_arg.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/stack_arg_fail.c
create mode 100644 tools/testing/selftests/bpf/progs/stack_arg.c
create mode 100644 tools/testing/selftests/bpf/progs/stack_arg_fail.c
create mode 100644 tools/testing/selftests/bpf/progs/stack_arg_kfunc.c
create mode 100644 tools/testing/selftests/bpf/progs/verifier_stack_arg.c

--
2.52.0