In the origin call case, if BPF_TRAMP_F_SKIP_FRAME is not set, it means
that the trampoline is not called, but "jmp".
Introduce the function bpf_trampoline_need_jmp() to check if the
trampoline is in "jmp" mode.
Do some adjustment on the "jmp" mode for the x86_64. The main adjustment
that we make is for the stack parameter passing case, as the stack
alignment logic changes in the "jmp" mode without the "rip". What's more,
the location of the parameters on the stack also changes.
Signed-off-by: Menglong Dong <dongml2@chinatelecom.cn>
---
arch/x86/net/bpf_jit_comp.c | 15 ++++++++++-----
include/linux/bpf.h | 12 ++++++++++++
2 files changed, 22 insertions(+), 5 deletions(-)
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index 2d300ab37cdd..21ce2b8457ec 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -2830,7 +2830,7 @@ static int get_nr_used_regs(const struct btf_func_model *m)
}
static void save_args(const struct btf_func_model *m, u8 **prog,
- int stack_size, bool for_call_origin)
+ int stack_size, bool for_call_origin, bool jmp)
{
int arg_regs, first_off = 0, nr_regs = 0, nr_stack_slots = 0;
int i, j;
@@ -2873,7 +2873,7 @@ static void save_args(const struct btf_func_model *m, u8 **prog,
*/
for (j = 0; j < arg_regs; j++) {
emit_ldx(prog, BPF_DW, BPF_REG_0, BPF_REG_FP,
- nr_stack_slots * 8 + 0x18);
+ nr_stack_slots * 8 + 16 + (!jmp) * 8);
emit_stx(prog, BPF_DW, BPF_REG_FP, BPF_REG_0,
-stack_size);
@@ -3267,7 +3267,12 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *rw_im
* should be 16-byte aligned. Following code depend on
* that stack_size is already 8-byte aligned.
*/
- stack_size += (stack_size % 16) ? 0 : 8;
+ if (bpf_trampoline_need_jmp(flags)) {
+ /* no rip in the "jmp" case */
+ stack_size += (stack_size % 16) ? 8 : 0;
+ } else {
+ stack_size += (stack_size % 16) ? 0 : 8;
+ }
}
arg_stack_off = stack_size;
@@ -3327,7 +3332,7 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *rw_im
emit_stx(&prog, BPF_DW, BPF_REG_FP, BPF_REG_0, -ip_off);
}
- save_args(m, &prog, regs_off, false);
+ save_args(m, &prog, regs_off, false, bpf_trampoline_need_jmp(flags));
if (flags & BPF_TRAMP_F_CALL_ORIG) {
/* arg1: mov rdi, im */
@@ -3360,7 +3365,7 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *rw_im
if (flags & BPF_TRAMP_F_CALL_ORIG) {
restore_regs(m, &prog, regs_off);
- save_args(m, &prog, arg_stack_off, true);
+ save_args(m, &prog, arg_stack_off, true, bpf_trampoline_need_jmp(flags));
if (flags & BPF_TRAMP_F_TAIL_CALL_CTX) {
/* Before calling the original function, load the
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index a47d67db3be5..d65a71042aa3 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -1263,6 +1263,18 @@ typedef void (*bpf_trampoline_exit_t)(struct bpf_prog *prog, u64 start,
bpf_trampoline_enter_t bpf_trampoline_enter(const struct bpf_prog *prog);
bpf_trampoline_exit_t bpf_trampoline_exit(const struct bpf_prog *prog);
+#ifdef CONFIG_DYNAMIC_FTRACE_WITH_JMP
+static inline bool bpf_trampoline_need_jmp(u64 flags)
+{
+ return flags & BPF_TRAMP_F_CALL_ORIG && !(flags & BPF_TRAMP_F_SKIP_FRAME);
+}
+#else
+static inline bool bpf_trampoline_need_jmp(u64 flags)
+{
+ return false;
+}
+#endif
+
struct bpf_ksym {
unsigned long start;
unsigned long end;
--
2.51.2On Fri, Nov 14, 2025 at 1:25 AM Menglong Dong <menglong8.dong@gmail.com> wrote: > > In the origin call case, if BPF_TRAMP_F_SKIP_FRAME is not set, it means > that the trampoline is not called, but "jmp". > > Introduce the function bpf_trampoline_need_jmp() to check if the > trampoline is in "jmp" mode. > > Do some adjustment on the "jmp" mode for the x86_64. The main adjustment > that we make is for the stack parameter passing case, as the stack > alignment logic changes in the "jmp" mode without the "rip". What's more, > the location of the parameters on the stack also changes. > > Signed-off-by: Menglong Dong <dongml2@chinatelecom.cn> > --- > arch/x86/net/bpf_jit_comp.c | 15 ++++++++++----- > include/linux/bpf.h | 12 ++++++++++++ > 2 files changed, 22 insertions(+), 5 deletions(-) > > diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c > index 2d300ab37cdd..21ce2b8457ec 100644 > --- a/arch/x86/net/bpf_jit_comp.c > +++ b/arch/x86/net/bpf_jit_comp.c > @@ -2830,7 +2830,7 @@ static int get_nr_used_regs(const struct btf_func_model *m) > } > > static void save_args(const struct btf_func_model *m, u8 **prog, > - int stack_size, bool for_call_origin) > + int stack_size, bool for_call_origin, bool jmp) I have an allergy to bool args. Please pass flags and do boll jmp_based_tramp = bpf_trampoline_uses_jmp(flags); I think bpf_trampoline_uses_jmp() is more descriptive than bpf_trampoline_need_jmp(). The actual math lgtm.
On Sat, Nov 15, 2025 at 2:22 AM Alexei Starovoitov <alexei.starovoitov@gmail.com> wrote: > > On Fri, Nov 14, 2025 at 1:25 AM Menglong Dong <menglong8.dong@gmail.com> wrote: > > > > In the origin call case, if BPF_TRAMP_F_SKIP_FRAME is not set, it means > > that the trampoline is not called, but "jmp". > > > > Introduce the function bpf_trampoline_need_jmp() to check if the > > trampoline is in "jmp" mode. > > > > Do some adjustment on the "jmp" mode for the x86_64. The main adjustment > > that we make is for the stack parameter passing case, as the stack > > alignment logic changes in the "jmp" mode without the "rip". What's more, > > the location of the parameters on the stack also changes. > > > > Signed-off-by: Menglong Dong <dongml2@chinatelecom.cn> > > --- > > arch/x86/net/bpf_jit_comp.c | 15 ++++++++++----- > > include/linux/bpf.h | 12 ++++++++++++ > > 2 files changed, 22 insertions(+), 5 deletions(-) > > > > diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c > > index 2d300ab37cdd..21ce2b8457ec 100644 > > --- a/arch/x86/net/bpf_jit_comp.c > > +++ b/arch/x86/net/bpf_jit_comp.c > > @@ -2830,7 +2830,7 @@ static int get_nr_used_regs(const struct btf_func_model *m) > > } > > > > static void save_args(const struct btf_func_model *m, u8 **prog, > > - int stack_size, bool for_call_origin) > > + int stack_size, bool for_call_origin, bool jmp) > > I have an allergy to bool args. > > Please pass flags and do > boll jmp_based_tramp = bpf_trampoline_uses_jmp(flags); Ok, I'll do this way in the next patch. > > I think bpf_trampoline_uses_jmp() is more descriptive than > bpf_trampoline_need_jmp(). ACK. > > The actual math lgtm.
© 2016 - 2026 Red Hat, Inc.