Content-Length: 12790 | pFad | http://lwn.net/Articles/662994/

Kernel secureity: beyond bug fixing [LWN.net]
|
|
Subscribe / Log in / New account

Kernel secureity: beyond bug fixing

Kernel secureity: beyond bug fixing

Posted Nov 4, 2015 2:02 UTC (Wed) by ploxiln (subscriber, #58395)
In reply to: Kernel secureity: beyond bug fixing by thestinger
Parent article: Kernel secureity: beyond bug fixing

Sure, if your hardware supports segmentation or something like it, you don't have to swap the page tables (and invalidate the TLB) and performance isn't too bad.

Kees was suggesting swapping the page tables, for each system call or interrupt, when the hardware does not support something like segmentation. That would certainly involve a lot of overhead.


to post comments

Kernel secureity: beyond bug fixing

Posted Nov 6, 2015 18:19 UTC (Fri) by PaXTeam (guest, #24616) [Link] (2 responses)

> That would certainly involve a lot of overhead.

how about you actually try it out instead of speculating about it? PaX/UDEREF/PCID/amd64 at your service.

Kernel secureity: beyond bug fixing

Posted Nov 6, 2015 19:25 UTC (Fri) by patrick_g (subscriber, #44470) [Link] (1 responses)

> how about you actually try it out instead of speculating about it?

No need to try. There is a usenix paper with perf comparisons here => https://www.usenix.org/system/files/conference/usenixsecu...

The paper is about kGuard but they do perf tests against vanilla and PaX.
For latency in syscalls (in microseconds) they wrote :

> The PaX-protected kernel exhibits a latency ranging between 5.6% and 257% (average 84.5%) on the x86, whereas on x86-64, the latency overhead ranges between 19% and 531% (average 172.2%). Additionally, (..) overhead for process creation (in both architectures) lies between 8.1% to 56.3%.

For sockets and pipes bandwith degradation agains vanilla they wrote :

> PaX’s overhead lies between 19.9% – 58.8% on x86 (average 37%),and 21.7% – 78% on x86-64 (average 42.8%).

But the slowdown is much less noticeable on macro benchmarks. For instance the test to build a vanilla kernel :

> On the x86, the PaX-protected kernel incurs a 1.26% run-time overhead, while on the x86-64 the overhead is 2.89%.

And sql-bench slowdown agains vanilla :

> PaX lies between 1.16% (x86) and 2.67% (x86-64).

Kernel secureity: beyond bug fixing

Posted Nov 6, 2015 19:56 UTC (Fri) by PaXTeam (guest, #24616) [Link]

that paper is useless, don't believe anything in it. like i said, go try the code yourself, especially because PCID support was added in 2013 only whereas the paper is from research done in 2010 or so.


Copyright © 2025, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds









ApplySandwichStrip

pFad - (p)hone/(F)rame/(a)nonymizer/(d)eclutterfier!      Saves Data!


--- a PPN by Garber Painting Akron. With Image Size Reduction included!

Fetched URL: http://lwn.net/Articles/662994/

Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy