netdev - Re: [PATCH bpf-next v6 00/10] bpf: fsession support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3389151.aeNJFYEL58@7940hx>
Date: Tue, 06 Jan 2026 11:04:47 +0800
From: Menglong Dong <menglong.dong@...ux.dev>
To: Menglong Dong <menglong8.dong@...il.com>,
 Andrii Nakryiko <andrii.nakryiko@...il.com>, ast@...nel.org
Cc: andrii@...nel.org, daniel@...earbox.net, martin.lau@...ux.dev,
 eddyz87@...il.com, song@...nel.org, yonghong.song@...ux.dev,
 john.fastabend@...il.com, kpsingh@...nel.org, sdf@...ichev.me,
 haoluo@...gle.com, jolsa@...nel.org, davem@...emloft.net, dsahern@...nel.org,
 tglx@...utronix.de, mingo@...hat.com, jiang.biao@...ux.dev, bp@...en8.de,
 dave.hansen@...ux.intel.com, x86@...nel.org, hpa@...or.com,
 bpf@...r.kernel.org, netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH bpf-next v6 00/10] bpf: fsession support

On 2026/1/6 05:20 Andrii Nakryiko <andrii.nakryiko@...il.com> write:
> On Sun, Jan 4, 2026 at 4:28 AM Menglong Dong <menglong8.dong@...il.com> wrote:
> >
> > Hi, all.
> >
[......]
> > Maybe it's possible to reuse the existing bpf_session_cookie() and
> > bpf_session_is_return(). First, we move the nr_regs from stack to struct
> > bpf_tramp_run_ctx, as Andrii suggested before. Then, we define the session
> > cookies as flexible array in bpf_tramp_run_ctx like this:
> >     struct bpf_tramp_run_ctx {
> >         struct bpf_run_ctx run_ctx;
> >         u64 bpf_cookie;
> >         struct bpf_run_ctx *saved_run_ctx;
> >         u64 func_meta; /* nr_args, cookie_index, etc */
> >         u64 fsession_cookies[];
> >     };
> >
> > The problem of this approach is that we can't inlined the bpf helper
> > anymore, such as get_func_arg, get_func_ret, get_func_arg_cnt, etc, as
> > we can't use the "current" in BPF assembly.
> >
> 
> We can, as Alexei suggested on your other patch set. Is this still a
> valid concern?

Yeah, with the support of BPF_MOV64_PERCPU_REG, it's much easier
now.

So what approach should I use now? Change the prototype of
bpf_session_is_return/bpf_session_cookie, as Alexei suggested, or
use the approach here? I think both works, and I'm a little torn
now. Any suggestions?

Thanks!
Menglong Dong

> 
> I think having separate duplicated ksession and fsession specific
> bpf_[f]session_{is_return,session_cookie}() APIs is really bad and
> confusing long-term.
> 
> > So maybe it's better to use the new kfunc for now? And I'm analyzing that
> 
> there is no "for now", this decision will be with us for a really long time...
> 
> > if it is possible to inline "current" in verifier. Maybe we can convert to
> > the solu
[......]
> >
>