Re: [BUG] perf: bogus correlation of kernel symbols

[Dan Rosenberg <drosenberg@vsecurity.com>]

On Fri, 2011-05-20 at 15:11 +0200, Ingo Molnar wrote:

> We need to allocate the IDT dynamically: just kmalloc() it, update idt_descr 
> and do a load_idt(). Double check places that modify idt_descr or use 
> idt_table.
> 
> Note, you could do this as a side effect of a nice performance optimization: 
> would you be interested in allocating it in the percpu area, using 
> percpu_alloc()? That way the IDT is distributed between CPUs - this has 
> scalability advantages on NUMA systems and maybe even on SMP.
> 

Any suggestions on when this allocation should take place?  I'm hesitant
to touch anything in arch/x86/kernel/head_32.S, where the IDT is setup
and lidt idt_descr is called (on x86-32 anyway).  That means at some
point I'd have to copy the table into a region allocated with
alloc_percpu() and set up a new descriptor.  Seems like this should
happen before IRQ is enabled, but I'm not sure about the best place.

Also, I'd still welcome suggestions on generating entropy so early in
the boot process as to randomize the location at which the kernel is
decompressed.

On a related note, would there be obstacles to marking the IDT as
read-only?

Thanks,
Dan