linux-kernel - Re: [PATCH 1/3] Kprobes: Make kprobe modules more portable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 08 Aug 2006 18:28:28 +0100
From:	Paulo Marques <pmarques@...popie.com>
To:	Christoph Hellwig <hch@...radead.org>,
	Stephen Hemminger <shemminger@...l.org>,
	Ananth N Mavinakayanahalli <ananth@...ibm.com>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/3] Kprobes: Make kprobe modules more portable

Christoph Hellwig wrote:
> On Tue, Aug 08, 2006 at 09:34:00AM -0700, Stephen Hemminger wrote:
>> Okay, does this makes kprobe's the first reflective kernel interface.
> 
> Actually kallsyms_lookup_name was the first interface like that.  And lots
> of external kprobes used it like that - in fact tcp_probe.c is the first
> one I've seen doing it differently.  But kallsyms_lookup_name is a really
> awkward lowlevel buildingblock that's almost impossible to use correctly,
> so this patch hides it behind the proper kprobes interface.

Just one side note: kallsyms_lookup_name is _really_ inefficient. The 
kallsyms structure is tailored so that kallsyms_lookup (the most 
frequently used function) is really fast. Doing it the other way around 
involves a O(N) search, uncompressing every symbol name as it goes :P

I don't think this is really a performance problem for users like 
kprobes, but I just wanted people to keep in mind that there is a 
penalty involved in calling kallsyms_lookup_name.

-- 
Paulo Marques - www.grupopie.com

"The face of a child can say it all, especially the
mouth part of the face."
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/