linux-kernel - Re: [PATCH bpf-next v10 00/12] bpf: fsession support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2026435.PYKUYFuaPT@7940hx>
Date: Thu, 22 Jan 2026 10:49:35 +0800
From: Menglong Dong <menglong.dong@...ux.dev>
To: Menglong Dong <menglong8.dong@...il.com>,
 Andrii Nakryiko <andrii.nakryiko@...il.com>
Cc: ast@...nel.org, andrii@...nel.org, daniel@...earbox.net,
 martin.lau@...ux.dev, eddyz87@...il.com, song@...nel.org,
 yonghong.song@...ux.dev, john.fastabend@...il.com, kpsingh@...nel.org,
 sdf@...ichev.me, haoluo@...gle.com, jolsa@...nel.org, davem@...emloft.net,
 dsahern@...nel.org, tglx@...utronix.de, mingo@...hat.com,
 jiang.biao@...ux.dev, bp@...en8.de, dave.hansen@...ux.intel.com,
 x86@...nel.org, hpa@...or.com, bpf@...r.kernel.org, netdev@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH bpf-next v10 00/12] bpf: fsession support

On 2026/1/22 08:09 Andrii Nakryiko <andrii.nakryiko@...il.com> write:
> On Thu, Jan 15, 2026 at 3:23 AM Menglong Dong <menglong8.dong@...il.com> wrote:
> >
> > Hi, all.
> >
> > In this version, I followed Andrii's suggestions in v9, and did many
> > adjustment.
> >
> > overall
> > -------
> > Sometimes, we need to hook both the entry and exit of a function with
> > TRACING. Therefore, we need define a FENTRY and a FEXIT for the target
> > function, which is not convenient.
> >
> > Therefore, we add a tracing session support for TRACING. Generally
> > speaking, it's similar to kprobe session, which can hook both the entry
> > and exit of a function with a single BPF program.
> >
> > We allow the usage of bpf_get_func_ret() to get the return value in the
> > fentry of the tracing session, as it will always get "0", which is safe
> > enough and is OK.
> >
> > Session cookie is also supported with the kfunc bpf_session_cookie().
> > In order to limit the stack usage, we limit the maximum number of cookies
> > to 4.
> >
> > kfunc design
> > ------------
> > In order to keep consistency with existing kfunc, we don't introduce new
> > kfunc for fsession. Instead, we reuse the existing kfunc
> > bpf_session_cookie() and bpf_session_is_return().
> >
> > The prototype of bpf_session_cookie() and bpf_session_is_return() don't
> > satisfy our needs, so we change their prototype by adding the argument
> > "void *ctx" to them.
> >
> > We inline bpf_session_cookie() and bpf_session_is_return() for fsession
> > in the verifier directly. Therefore, we don't need to introduce new
> > functions for them.
> >
> > architecture
> > ------------
> > The fsession stuff is arch related, so the -EOPNOTSUPP will be returned if
> > it is not supported yet by the arch. In this series, we only support
> > x86_64. And later, other arch will be implemented.
> >
> > Changes v9 -> v10:
> > * 1st patch: some small adjustment, such as use switch in
> >   bpf_prog_has_trampoline()
> > * 2nd patch: some adjustment to the commit log and comment
> > * 3rd patch:
> >   - drop the declaration of bpf_session_is_return() and
> >     bpf_session_cookie()
> >   - use vmlinux.h instead of bpf_kfuncs.h in uprobe_multi_session.c,
> >     kprobe_multi_session_cookie.c and uprobe_multi_session_cookie.c
> > * 4th patch:
> >   - some adjustment to the comment and commit log
> >   - rename the prefix from BPF_TRAMP_M_ tp BPF_TRAMP_SHIFT_
> 
> This is minor nit, but I think BPF_TRAMP_IS_RETURN_SHIFT and
> BPF_TRAMP_COOKIE_INDEX_SHIFT (note added INDEX, because that's what we
> store, not the cookie itself) makes more sense naming-wise and is more
> natural to read. Consider updating this.

Yeah, looks nice.

> 
> >   - remove the definition of BPF_TRAMP_M_NR_ARGS
> >   - check the program type in bpf_session_filter()
> > * 5th patch: some adjustment to the commit log
> > * 6th patch:
> >   - add the "reg" to the function arguments of emit_store_stack_imm64()
> >   - use the positive offset in emit_store_stack_imm64()
> > * 7th patch:
> >   - use "|" for func_meta instead of "+"
> >   - pass the "func_meta_off" to invoke_bpf() explicitly, instead of
> >     computing it with "stack_size + 8"
> >   - pass the "cookie_off" to invoke_bpf() instead of computing the current
> >     cookie index with "func_meta"
> > * 8th patch:
> >   - split the modification to bpftool to a separate patch
> > * v9: https://lore.kernel.org/bpf/20260110141115.537055-1-dongml2@chinatelecom.cn/
> >
> 
> Overall this looks great, I was actually trying to apply and push it
> despite those minor nits I left. But unfortunately there is some
> conflict, so you'll have to rebase and resend. Hopefully just one last
> time :)

Haha, sounds great! I'll follow your comment and rebase, and
send the next version later.

Thanks you the review ;)

> 
> > Changes v8 -> v9:
> > * remove the definition of bpf_fsession_cookie and bpf_fsession_is_return
> >   in the 4th and 5th patch
> > * rename emit_st_r0_imm64() to emit_store_stack_imm64() in the 6th patch
> > * v8: https://lore.kernel.org/bpf/20260108022450.88086-1-dongml2@chinatelecom.cn/
> >
[...]
> >
>