[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20200604045958.GA16097@pi3.com.pl>
Date: Thu, 4 Jun 2020 06:59:58 +0200
From: Adam Zabrocki <pi3@....com.pl>
To: lkrg-users@...ts.openwall.com
Subject: Re: Support for 5.7 linux kernel?
Hi,
Just FYI, I've pushed kprobe 'hack' to support v5.7 kernel.
Thanks,
Adam
On Wed, Jun 03, 2020 at 08:30:28PM +0300, Ilya Matveychikov wrote:
>
>
> > On Jun 3, 2020, at 7:06 PM, Adam Zabrocki <pi3@....com.pl> wrote:
> >
> > Hi Ilya,
> >
> > On Wed, Jun 03, 2020 at 12:49:12PM +0300, Ilya Matveychikov wrote:
> >> Hey Adam,
> >>
> >> I see 2 ways of getting kallsyms_lookup_name() address:
> >> - parsing /proc/kallsyms from the kernel using filp_open()
> >> - parsing /proc/kallsyms before loading LKRG and passing
> >> address of this symbol as module parameter
> >>
> >
> > Yes, these are possible options.
> >
> >> Any other options?
> >>
> >
> > In fact yes. I'm more thinking about the trick with kprobes. We are already
> > depended on it so it won't introduce any new one. In short, kprobes internally
> > do have/has access to kallsyms* API. We can try to put a kprobe on
> > kallsyms_lookup_name() function, extract the address where it was placed and
> > then remove it.
> >
>
> Yeah, I followed the link you mention right after sending the email. It???s
> a nice trick with kprobes. The funniest thing of all the story with
> kallsyms_lookup_name() unexport from the kernel is that it doesn???t
> change anything but only breaks some useful out-of-tree projects.
>
>
> > Thanks,
> > Adam
> >
> >>> On Jun 3, 2020, at 7:48 AM, Adam Zabrocki <pi3@....com.pl> wrote:
> >>>
> >>> Hi Mikhail,
> >>>
> >>> On Tue, Jun 02, 2020 at 10:17:44AM +0200, Mikhail Morfikov wrote:
> >>>> It looks like the lkrg module doesn't build for 5.7 linux kernel.
> >>>> Are there any plans to support the new stable mainline kernel in the near future?
> >>>
> >>> Thanks for reporting this problem. I've verified that and it looks like the
> >>> kernel maintainers unexported some symbols which LKRG uses:
> >>>
> >>> https://lkml.org/lkml/2020/5/5/478
> >>>
> >>> We need to think about the proper solution for that. We might go with the same
> >>> path as LTTs maintaners.
> >>>
> >>> Thanks,
> >>> Adam
> >>>
> >>> --
> >>> pi3 (pi3ki31ny) - pi3 (at) itsec pl
> >>> http://pi3.com.pl
> >>>
> >>
> >
> > --
> > pi3 (pi3ki31ny) - pi3 (at) itsec pl
> > http://pi3.com.pl
>
--
pi3 (pi3ki31ny) - pi3 (at) itsec pl
http://pi3.com.pl
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
