From mboxrd@z Thu Jan 1 00:00:00 1970 Sender: Ingo Molnar Date: Fri, 22 Sep 2017 18:32:25 +0200 From: Ingo Molnar Message-ID: <20170922163225.bfrd5myl6d7deiim@gmail.com> References: <20170816151235.oamkdva6cwpc4cex@gmail.com> <20170817080920.5ljlkktngw2cisfg@gmail.com> <20170825080443.tvvr6wzs362cjcuu@gmail.com> <20170921155919.skpyt7dutod5ul4t@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Subject: [kernel-hardening] Re: x86: PIE support and option to extend KASLR randomization To: Thomas Garnier Cc: Herbert Xu , "David S . Miller" , Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , Peter Zijlstra , Josh Poimboeuf , Arnd Bergmann , Matthias Kaehlcke , Boris Ostrovsky , Juergen Gross , Paolo Bonzini , Radim =?utf-8?B?S3LEjW3DocWZ?= , Joerg Roedel , Tom Lendacky , Andy Lutomirski , Borislav Petkov , Brian Gerst , "Kirill A . Shutemov" , "Rafael J . Wysocki" , Len Brown , Pavel Machek , Tejun Heo , Christoph Lameter , Paul Gortmaker , Chris Metcalf , Andrew Morton , "Paul E . McKenney" , Nicolas Pitre , Christopher Li , "Rafael J . Wysocki" , Lukas Wunner , Mika Westerberg , Dou Liyang , Daniel Borkmann , Alexei Starovoitov , Masahiro Yamada , Markus Trippelsdorf , Steven Rostedt , Kees Cook , Rik van Riel , David Howells , Waiman Long , Kyle Huey , Peter Foley , Tim Chen , Catalin Marinas , Ard Biesheuvel , Michal Hocko , Matthew Wilcox , "H . J . Lu" , Paul Bolle , Rob Landley , Baoquan He , Daniel Micay , the arch/x86 maintainers , Linux Crypto Mailing List , LKML , xen-devel , kvm list , Linux PM list , linux-arch , Sparse Mailing-list , Kernel Hardening , Linus Torvalds , Peter Zijlstra , Borislav Petkov List-ID: * Thomas Garnier wrote: > On Thu, Sep 21, 2017 at 8:59 AM, Ingo Molnar wrote: > > > > ( Sorry about the delay in answering this. I could blame the delay on the merge > > window, but in reality I've been procrastinating this is due to the permanent, > > non-trivial impact PIE has on generated C code. ) > > > > * Thomas Garnier wrote: > > > >> 1) PIE sometime needs two instructions to represent a single > >> instruction on mcmodel=kernel. > > > > What again is the typical frequency of this occurring in an x86-64 defconfig > > kernel, with the very latest GCC? > > I am not sure what is the best way to measure that. If this is the dominant factor then 'sizeof vmlinux' ought to be enough: > With ORC: PIE .text is 0.814224% than baseline I.e. the overhead is +0.81% in both size and (roughly) in number of instructions executed. BTW., I think things improved with ORC because with ORC we have RBP as an extra register and with PIE we lose RBX - so register pressure in code generation is lower. Ok, I suspect we can try it, but my preconditions for merging it would be: 1) Linus doesn't NAK it (obviously) 2) we first implement the additional entropy bits that Linus suggested. does this work for you? Thanks, Ingo