From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from 66-220-144-179.mail-mxout.facebook.com (66-220-144-179.mail-mxout.facebook.com [66.220.144.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7FA0333C195 for ; Fri, 24 Apr 2026 17:15:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=66.220.144.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777050929; cv=none; b=Zd+wJOtQsfM51LDBR2cGkym0Uc7FqEAzLJysJYa2dAaDi299mrajt8wxh1zrkYQ8OnVHyDMdsYHm5SZrXBSQhHWNZv1Fa0QUXdM19fBAJFSCTNe52Q0aqxyQHz6R3SIznlLCI1Qcoyj6uPy3QBb8YSf/hk8j/zKy3Ck/2E7/g78= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777050929; c=relaxed/simple; bh=c7y8WP5MOwxMzE8DPPyhTJYN5R1kjxSwgjdRmfB2ynY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=kriuLjHhz5EY2mAdqOQmGH2CmzyBgLeEDC02uq8rGGZ1i3ULoOgZT3znXWqKAdSQRDC7Mprxl1A8VbEyO+qzrubLRKuDIVDDkSl+qt4w/LcKLsoPvf/xBbgmBCl+GKqrXWF9B9ZlICVFRAAHNDhBe9a6BcStUgW47lVHrbFUUC0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.dev; spf=fail smtp.mailfrom=linux.dev; arc=none smtp.client-ip=66.220.144.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=linux.dev Received: by devvm16039.vll0.facebook.com (Postfix, from userid 128203) id 9BBE3474A653E; Fri, 24 Apr 2026 10:15:14 -0700 (PDT) From: Yonghong Song To: bpf@vger.kernel.org Cc: Alexei Starovoitov , Andrii Nakryiko , Daniel Borkmann , "Jose E . Marchesi" , kernel-team@fb.com, Martin KaFai Lau Subject: [PATCH bpf-next 08/18] bpf: Support stack arguments for kfunc calls Date: Fri, 24 Apr 2026 10:15:14 -0700 Message-ID: <20260424171514.2041929-1-yonghong.song@linux.dev> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260424171433.2034470-1-yonghong.song@linux.dev> References: <20260424171433.2034470-1-yonghong.song@linux.dev> Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Extend the stack argument mechanism to kfunc calls, allowing kfuncs with more than 5 parameters to receive additional arguments via the r11-based stack arg area. For kfuncs, the caller is a BPF program and the callee is a kernel function. The BPF program writes outgoing args at negative r11 offsets, following the same convention as BPF-to-BPF calls: Outgoing: r11 - 8 (arg6), ..., r11 - N*8 (last arg) The following is an example: int foo(int a1, int a2, int a3, int a4, int a5, int a6, int a7) { ... kfunc1(a1, a2, a3, a4, a5, a6, a7, a8); ... kfunc2(a1, a2, a3, a4, a5, a6, a7, a8, a9); ... } Caller (foo), generated by llvm =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D Incoming (positive offsets): r11+8: [incoming arg 6] r11+16: [incoming arg 7] Outgoing for kfunc1 (negative offsets): r11-8: [outgoing arg 6] r11-16: [outgoing arg 7] r11-24: [outgoing arg 8] Outgoing for kfunc2 (negative offsets): r11-8: [outgoing arg 6] r11-16: [outgoing arg 7] r11-24: [outgoing arg 8] r11-32: [outgoing arg 9] Later JIT will marshal outgoing arguments to the native calling convention for kfunc1() and kfunc2(). For kfunc calls where stack args are used as constant or size parameters, a mark_stack_arg_precision() helper is used to propagate precision within the current frame. There are two places where meta->release_regno needs to keep regno for later releasing the reference. Also, 'cur_aux(env)->arg_prog =3D= regno' is also keeping regno for later fixup. Since stack arguments don't have a= valid register number (regno is set to -1), these three cases are rejected for = now if the argument is on the stack. Signed-off-by: Yonghong Song --- kernel/bpf/verifier.c | 73 +++++++++++++++++++++++++++++++++---------- 1 file changed, 56 insertions(+), 17 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 6994536b4e04..43aeb04f488a 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -11559,14 +11559,12 @@ bool bpf_is_kfunc_pkt_changing(struct bpf_kfunc= _call_arg_meta *meta) } =20 static enum kfunc_ptr_arg_type -get_kfunc_ptr_arg_type(struct bpf_verifier_env *env, - struct bpf_kfunc_call_arg_meta *meta, +get_kfunc_ptr_arg_type(struct bpf_verifier_env *env, struct bpf_func_sta= te *caller, + struct bpf_reg_state *regs, struct bpf_kfunc_call_arg_meta *met= a, const struct btf_type *t, const struct btf_type *ref_t, const char *ref_tname, const struct btf_param *args, int arg, int nargs, argno_t argno, struct bpf_reg_state *reg) { - u32 regno =3D arg + 1; - struct bpf_reg_state *regs =3D cur_regs(env); bool arg_mem_size =3D false; =20 if (meta->func_id =3D=3D special_kfunc_list[KF_bpf_cast_to_kern_ctx] || @@ -11575,8 +11573,8 @@ get_kfunc_ptr_arg_type(struct bpf_verifier_env *e= nv, return KF_ARG_PTR_TO_CTX; =20 if (arg + 1 < nargs && - (is_kfunc_arg_mem_size(meta->btf, &args[arg + 1], ®s[regno + 1])= || - is_kfunc_arg_const_mem_size(meta->btf, &args[arg + 1], ®s[regno= + 1]))) + (is_kfunc_arg_mem_size(meta->btf, &args[arg + 1], get_func_arg_reg(= caller, regs, arg + 1)) || + is_kfunc_arg_const_mem_size(meta->btf, &args[arg + 1], get_= func_arg_reg(caller, regs, arg + 1)))) arg_mem_size =3D true; =20 /* In this function, we verify the kfunc's BTF as per the argument type= , @@ -12241,6 +12239,8 @@ static int check_kfunc_args(struct bpf_verifier_e= nv *env, struct bpf_kfunc_call_ int insn_idx) { const char *func_name =3D meta->func_name, *ref_tname; + struct bpf_func_state *caller =3D cur_func(env); + struct bpf_reg_state *regs =3D cur_regs(env); const struct btf *btf =3D meta->btf; const struct btf_param *args; struct btf_record *rec; @@ -12249,9 +12249,9 @@ static int check_kfunc_args(struct bpf_verifier_e= nv *env, struct bpf_kfunc_call_ =20 args =3D (const struct btf_param *)(meta->func_proto + 1); nargs =3D btf_type_vlen(meta->func_proto); - if (nargs > MAX_BPF_FUNC_REG_ARGS) { + if (nargs > MAX_BPF_FUNC_ARGS) { verbose(env, "Function %s has %d > %d args\n", func_name, nargs, - MAX_BPF_FUNC_REG_ARGS); + MAX_BPF_FUNC_ARGS); return -EINVAL; } if (nargs > MAX_BPF_FUNC_REG_ARGS && !bpf_jit_supports_stack_args()) { @@ -12260,15 +12260,20 @@ static int check_kfunc_args(struct bpf_verifier= _env *env, struct bpf_kfunc_call_ return -ENOTSUPP; } =20 + ret =3D check_outgoing_stack_args(env, caller, nargs); + if (ret) + return ret; + /* Check that BTF function arguments match actual types that the * verifier sees. */ for (i =3D 0; i < nargs; i++) { - struct bpf_reg_state *regs =3D cur_regs(env), *reg =3D ®s[i + 1]; + struct bpf_reg_state *reg =3D get_func_arg_reg(caller, regs, i); const struct btf_type *t, *ref_t, *resolve_ret; enum bpf_arg_type arg_type =3D ARG_DONTCARE; argno_t argno =3D argno_from_arg(i + 1); - u32 regno =3D i + 1, ref_id, type_size; + int regno =3D reg_from_argno(argno); + u32 ref_id, type_size; bool is_ret_buf_sz =3D false; int kf_arg_type; =20 @@ -12278,6 +12283,11 @@ static int check_kfunc_args(struct bpf_verifier_= env *env, struct bpf_kfunc_call_ verifier_bug(env, "Only 1 prog->aux argument supported per-kfunc"); return -EFAULT; } + if (regno < 0) { + verbose(env, "%s prog->aux cannot be a stack argument\n", + reg_arg_name(env, argno)); + return -EINVAL; + } meta->arg_prog =3D true; cur_aux(env)->arg_prog =3D regno; continue; @@ -12304,7 +12314,10 @@ static int check_kfunc_args(struct bpf_verifier_= env *env, struct bpf_kfunc_call_ reg_arg_name(env, argno)); return -EINVAL; } - ret =3D mark_chain_precision(env, regno); + if (regno >=3D 0) + ret =3D mark_chain_precision(env, regno); + else + ret =3D mark_stack_arg_precision(env, i); if (ret < 0) return ret; meta->arg_constant.found =3D true; @@ -12329,7 +12342,10 @@ static int check_kfunc_args(struct bpf_verifier_= env *env, struct bpf_kfunc_call_ } =20 meta->r0_size =3D reg->var_off.value; - ret =3D mark_chain_precision(env, regno); + if (regno >=3D 0) + ret =3D mark_chain_precision(env, regno); + else + ret =3D mark_stack_arg_precision(env, i); if (ret) return ret; } @@ -12357,14 +12373,21 @@ static int check_kfunc_args(struct bpf_verifier= _env *env, struct bpf_kfunc_call_ return -EFAULT; } meta->ref_obj_id =3D reg->ref_obj_id; - if (is_kfunc_release(meta)) + if (is_kfunc_release(meta)) { + if (regno < 0) { + verbose(env, "%s release arg cannot be a stack argument\n", + reg_arg_name(env, argno)); + return -EINVAL; + } meta->release_regno =3D regno; + } } =20 ref_t =3D btf_type_skip_modifiers(btf, t->type, &ref_id); ref_tname =3D btf_name_by_offset(btf, ref_t->name_off); =20 - kf_arg_type =3D get_kfunc_ptr_arg_type(env, meta, t, ref_t, ref_tname,= args, i, nargs, argno, reg); + kf_arg_type =3D get_kfunc_ptr_arg_type(env, caller, regs, meta, t, ref= _t, ref_tname, + args, i, nargs, argno, reg); if (kf_arg_type < 0) return kf_arg_type; =20 @@ -12514,6 +12537,11 @@ static int check_kfunc_args(struct bpf_verifier_= env *env, struct bpf_kfunc_call_ dynptr_arg_type |=3D DYNPTR_TYPE_FILE; } else if (meta->func_id =3D=3D special_kfunc_list[KF_bpf_dynptr_file= _discard]) { dynptr_arg_type |=3D DYNPTR_TYPE_FILE | OBJ_RELEASE; + if (regno < 0) { + verbose(env, "%s release arg cannot be a stack argument\n", + reg_arg_name(env, argno)); + return -EINVAL; + } meta->release_regno =3D regno; } else if (meta->func_id =3D=3D special_kfunc_list[KF_bpf_dynptr_clon= e] && (dynptr_arg_type & MEM_UNINIT)) { @@ -12668,9 +12696,9 @@ static int check_kfunc_args(struct bpf_verifier_e= nv *env, struct bpf_kfunc_call_ break; case KF_ARG_PTR_TO_MEM_SIZE: { - struct bpf_reg_state *buff_reg =3D ®s[regno]; + struct bpf_reg_state *buff_reg =3D reg; const struct btf_param *buff_arg =3D &args[i]; - struct bpf_reg_state *size_reg =3D ®s[regno + 1]; + struct bpf_reg_state *size_reg =3D get_func_arg_reg(caller, regs, i += 1); const struct btf_param *size_arg =3D &args[i + 1]; argno_t next_argno =3D argno_from_arg(i + 2); =20 @@ -13574,8 +13602,19 @@ static int check_kfunc_call(struct bpf_verifier_= env *env, struct bpf_insn *insn, clear_all_pkt_pointers(env); =20 nargs =3D btf_type_vlen(meta.func_proto); + if (nargs > MAX_BPF_FUNC_REG_ARGS) { + struct bpf_func_state *caller =3D cur_func(env); + struct bpf_subprog_info *caller_info =3D &env->subprog_info[caller->su= bprogno]; + u16 out_stack_arg_depth =3D (nargs - MAX_BPF_FUNC_REG_ARGS) * BPF_REG_= SIZE; + u16 stack_arg_depth =3D caller_info->incoming_stack_arg_depth + out_st= ack_arg_depth; + + if (stack_arg_depth > caller_info->stack_arg_depth) + caller_info->stack_arg_depth =3D stack_arg_depth; + invalidate_outgoing_stack_args(caller); + } + args =3D (const struct btf_param *)(meta.func_proto + 1); - for (i =3D 0; i < nargs; i++) { + for (i =3D 0; i < min_t(int, nargs, MAX_BPF_FUNC_REG_ARGS); i++) { u32 regno =3D i + 1; =20 t =3D btf_type_skip_modifiers(desc_btf, args[i].type, NULL); --=20 2.52.0