Re: [PATCH bpf-next v2 00/11] bpf: Support stack arguments for BPF functions and kfuncs

Yonghong Song
2026-04-05T17:09:05Z

On 4/5/26 9:53 AM, Yonghong Song wrote:
> Currently, bpf function calls and kfunc's are limited by 5 reg-level
> parameters. For function calls with more than 5 parameters,
> developers can use always inlining or pass a struct pointer
> after packing more parameters in that struct. But there is
> no workaround for kfunc if more than 5 parameters is needed.
>
> This patch set lifts the 5-argument limit by introducing stack-based
> argument passing for BPF functions and kfunc's, coordinated with
> compiler support in LLVM [1]. The compiler emits loads/stores through
> a new bpf register r12 (BPF_REG_STACK_ARG_BASE) to pass arguments beyond
> the 5th, keeping the stack arg area separate from the r10-based program
> stack. The maximum number of arguments is capped at MAX_BPF_FUNC_ARGS
> (12), which is sufficient for the vast majority of use cases.
>
> The x86_64 JIT translates r12-relative accesses to RBP-relative
> native instructions. Each function's stack allocation is extended
> by 'max_outgoing' bytes to hold the outgoing arg area below the
> program stack. This makes implementation easier as the r10 can be
> reused for stack argument access. At BPF-to-BPF call sites, outgoing
> args are pushed onto the native stack before CALL. The incoming
> parameters can directly get the value from pushed native stack from
> caller. For kfunc calls, args are marshaled per the x86_64 C calling
> convention (arg 6 in R9, args 7+ on the native stack).
>
> Global subprogs with >5 args are not yet supported. Only x86_64
> is supported for now.
>
> For the rest of patches, patches 1-6 added verifier support of
> stack arguments for bpf-to-bpf functions and kfunc's. Patch 7
> enables x86_64 for stack arguments. Patch 8 implemented JIT for
> x86_64. Patches 9-11 are some selftests.
>
> [1] https://github.com/llvm/llvm-project/pull/189060
>
> Changelogs:
> v1 -> v2:
> - v1: https://lore.kernel.org/bpf/20260402012727.3916819-1-yonghong.song@linux.dev/
> - Add stack_arg_safe() to do pruning for stack arguments.
> - Fix an issue with KF_ARG_PTR_TO_MEM_SIZE. Since a faked register is
> used, added verification log to indicate the start and end of such
> faked register usage.
> - For x86_64 JIT, copying incoming parameter values directly from caller's stack.
> - Add test cases with stack arguments e.g. mem, mem+size, dynptr, iter, etc.
>
> Yonghong Song (11):
> bpf: Introduce bpf register BPF_REG_STACK_ARG_BASE
> bpf: Reuse MAX_BPF_FUNC_ARGS for maximum number of arguments
> bpf: Support stack arguments for bpf functions
> bpf: Refactor process_iter_arg() to have proper argument index
> bpf: Support stack arguments for kfunc calls
> bpf: Reject stack arguments in non-JITed programs
> bpf: Enable stack argument support for x86_64
> bpf,x86: Implement JIT support for stack arguments
> selftests/bpf: Add tests for BPF function stack arguments
> selftests/bpf: Add negative test for greater-than-8-byte kfunc stack
> argument
> selftests/bpf: Add verifier tests for stack argument validation
>
> arch/x86/net/bpf_jit_comp.c | 140 +++++-
> include/linux/bpf.h | 6 +
> include/linux/bpf_verifier.h | 31 +-
> include/linux/filter.h | 4 +-
> kernel/bpf/btf.c | 21 +-
> kernel/bpf/core.c | 12 +-
> kernel/bpf/verifier.c | 474 ++++++++++++++++--
> .../selftests/bpf/prog_tests/stack_arg.c | 132 +++++
> .../selftests/bpf/prog_tests/stack_arg_fail.c | 24 +
> .../selftests/bpf/prog_tests/verifier.c | 2 +
> tools/testing/selftests/bpf/progs/stack_arg.c | 212 ++++++++
> .../selftests/bpf/progs/stack_arg_fail.c | 32 ++
> .../selftests/bpf/progs/stack_arg_kfunc.c | 164 ++++++
> .../selftests/bpf/progs/verifier_stack_arg.c | 302 +++++++++++
> .../selftests/bpf/test_kmods/bpf_testmod.c | 72 +++
> .../bpf/test_kmods/bpf_testmod_kfunc.h | 26 +
> 16 files changed, 1594 insertions(+), 60 deletions(-)
> create mode 100644 tools/testing/selftests/bpf/prog_tests/stack_arg.c
> create mode 100644 tools/testing/selftests/bpf/prog_tests/stack_arg_fail.c
> create mode 100644 tools/testing/selftests/bpf/progs/stack_arg.c
> create mode 100644 tools/testing/selftests/bpf/progs/stack_arg_fail.c
> create mode 100644 tools/testing/selftests/bpf/progs/stack_arg_kfunc.c
> create mode 100644 tools/testing/selftests/bpf/progs/verifier_stack_arg.c
>
Please ignore this patch set. Just discovered that there is a selftest failure
and a couple of 'UTF-8' issues. I will fix these issues and send the next revision
shortly.