linux-kernel - Re: [PATCH -mm] kprobes: kretprobe user entry-handler (updated)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 28 Jan 2008 15:34:24 +0530
From:	"Abhishek Sagar" <sagar.abhishek@...il.com>
To:	"Andrew Morton" <akpm@...ux-foundation.org>
Cc:	LKML <linux-kernel@...r.kernel.org>, jkenisto@...ibm.com,
	ananth@...ibm.com, "Andy Whitcroft" <apw@...dowen.org>
Subject: Re: [PATCH -mm] kprobes: kretprobe user entry-handler (updated)

On 1/28/08, Andrew Morton <akpm@...ux-foundation.org> wrote:
> Neither the changelog nor the newly-added documentation explain why Linux
> needs this feature.  What will it be used for??

There's a detailed discussion along with an example on this thread:
http://lkml.org/lkml/2007/11/13/58

and a bit on:
http://sourceware.org/ml/systemtap/2005-q3/msg00593.html

The real advantage of this patch is in scenarios where some data (like
function paramters, system time etc) needs to be shared between
function entry and exit. E.g: Viewing the change in system time across
a call to profile it. Here, we have a need to share data between the
entry and exit events of a function call. Also, the correct
association needs to be maintained between the corresponding function
entry-exit pairs. This is already done using a 'return-instance' in
kretprobes. This patch allows these instances to pouch some data as
well. The patch also has a module example which does trivial function
time-duration profiling using entry-handlers. It makes writing
function profilers simpler using kretprobes.

Currently, doing such a thing would require an extra kprobe to be
planted at function entry-point and whose pre-handler must have all
the complexity to do the function entry-exit data association. Also,
using an entry-handler is optional, and is completely backward
compatible.

> > +1.3.2 Kretprobe entry-handler
> > +
> > +Kretprobes also provides an optional user-specified handler which runs
>
> I think "caller-specified" would be a better term here.  Generally "user"
> refers to Aunt Tillie sitting at the keyboard.

Just followed suit from exising kprobes.txt which had quite a few
references to such a 'user'.

Cheerfully Acked by -> Aunt Tillie :-)

--
Thanks,
Abhishek
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/