> I wonder if the overhead of user space interacting with the kernel api is gonna be noticeable. ‘Luckily’, the overhead of antivirus software already can be q

> I wonder if the overhead of user space interacting with the kernel api is gonna be noticeable. ‘Luckily’, the overhead of antivirus software already can be quite high at times [1]. So, if this API can keep the number of kernel-userspace transitions down, I think the relative impact could be barely noticeable. [1] https://www.tomsguide.com/us/av-software-least-system-impact,review-6276.html https://www.tomsguide.com/us/av-software-least-system-impact...: “For example, McAfee Total Protection had a relatively light background impact, slowing down the Lenovo laptop by only 9% after installation”