[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-devel] x86: PIE support and option to extend KASLR randomization

On 21 September 2017 at 08:59, Ingo Molnar <mingo@xxxxxxxxxx> wrote:
> ( Sorry about the delay in answering this. I could blame the delay on the 
> merge
>   window, but in reality I've been procrastinating this is due to the 
> permanent,
>   non-trivial impact PIE has on generated C code. )
> * Thomas Garnier <thgarnie@xxxxxxxxxx> wrote:
>> 1) PIE sometime needs two instructions to represent a single
>> instruction on mcmodel=kernel.
> What again is the typical frequency of this occurring in an x86-64 defconfig
> kernel, with the very latest GCC?
> Also, to make sure: which unwinder did you use for your measurements,
> frame-pointers or ORC? Please use ORC only for future numbers, as
> frame-pointers is obsolete from a performance measurement POV.
>> 2) GCC does not optimize switches in PIE in order to reduce relocations:
> Hopefully this can either be fixed in GCC or at least influenced via a 
> compiler
> switch in the future.

There are somewhat related concerns in the ARM world, so it would be
good if we could work with the GCC developers to get a more high level
and arch neutral command line option (-mkernel-pie? sounds yummy!)
that stops the compiler from making inferences that only hold for
shared libraries and/or other hosted executables (GOT indirections,
avoiding text relocations etc). That way, we will also be able to drop
the 'hidden' visibility override at some point, which we currently
need to prevent the compiler from redirecting all global symbol
references via entries in the GOT.

All we really need is the ability to move the image around in virtual
memory, and things like reducing the CoW footprint or enabling ELF
symbol preemption are completely irrelevant for us.

Xen-devel mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.