All of lore.kernel.org
 help / color / mirror / Atom feed
From: Andy Lutomirski <luto@kernel.org>
To: PaX Team <pageexec@freemail.hu>
Cc: Andy Lutomirski <luto@kernel.org>,
	Mathias Krause <minipli@googlemail.com>,
	Thomas Gleixner <tglx@linutronix.de>,
	Kees Cook <keescook@chromium.org>,
	"kernel-hardening@lists.openwall.com" 
	<kernel-hardening@lists.openwall.com>,
	Mark Rutland <mark.rutland@arm.com>,
	Hoeun Ryu <hoeun.ryu@gmail.com>, Emese Revfy <re.emese@gmail.com>,
	Russell King <linux@armlinux.org.uk>, X86 ML <x86@kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"linux-arm-kernel@lists.infradead.org" 
	<linux-arm-kernel@lists.infradead.org>,
	Peter Zijlstra <peterz@infradead.org>
Subject: Re: [kernel-hardening] Re: [RFC v2][PATCH 04/11] x86: Implement __arch_rare_write_begin/unmap()
Date: Sun, 9 Apr 2017 17:10:16 -0700	[thread overview]
Message-ID: <CALCETrWvGLtObdk3V0k_Esa_L=EOf+Whe=6DpcJ7H_W8Z-5Btw@mail.gmail.com> (raw)
In-Reply-To: <58EA2D58.17782.6ADE22BD@pageexec.freemail.hu>

On Sun, Apr 9, 2017 at 5:47 AM, PaX Team <pageexec@freemail.hu> wrote:
> On 7 Apr 2017 at 21:58, Andy Lutomirski wrote:
>
>> On Fri, Apr 7, 2017 at 12:58 PM, PaX Team <pageexec@freemail.hu> wrote:
>> > On 7 Apr 2017 at 9:14, Andy Lutomirski wrote:
>> >> Then someone who cares about performance can benchmark the CR0.WP
>> >> approach against it and try to argue that it's a good idea.  This
>> >> benchmark should wait until I'm done with my PCID work, because PCID
>> >> is going to make use_mm() a whole heck of a lot faster.
>> >
>> > in my measurements switching PCID is hovers around 230 cycles for snb-ivb
>> > and 200-220 for hsw-skl whereas cr0 writes are around 230-240 cycles. there's
>> > of course a whole lot more impact for switching address spaces so it'll never
>> > be fast enough to beat cr0.wp.
>> >
>>
>> If I'm reading this right, you're saying that a non-flushing CR3 write
>> is about the same cost as a CR0.WP write.  If so, then why should CR0
>> be preferred over the (arch-neutral) CR3 approach?
>
> cr3 (page table switching) isn't arch neutral at all ;). you probably meant
> the higher level primitives except they're not enough to implement the scheme
> as discussed before since the enter/exit paths are very much arch dependent.

Yes.

>
> on x86 the cost of the pax_open/close_kernel primitives comes from the cr0
> writes and nothing else, use_mm suffers not only from the cr3 writes but
> also locking/atomic ops and cr4 writes on its path and the inevitable TLB
> entry costs. and if cpu vendors cared enough, they could make toggling cr0.wp
> a fast path in the microcode and reduce its overhead by an order of magnitude.
>

If the CR4 writes happen in for this use case, that's a bug.

>>  And why would switching address spaces obviously be much slower?
>> There'll be a very small number of TLB fills needed for the actual
>> protected access.
>
> you'll be duplicating TLB entries in the alternative PCID for both code
> and data, where they will accumulate (=take room away from the normal PCID
> and expose unwanted memory for access) unless you also flush them when
> switching back (which then will cost even more cycles). also i'm not sure
> that processors implement all the 12 PCID bits so depending on how many PCIDs
> you plan to use, you could be causing even more unnecessary TLB replacements.
>

Unless the CPU is rather dumber than I expect, the only duplicated
entries should be for the writable aliases of pages that are written.
The rest of the pages are global and should be shared for all PCIDs.

--Andy

WARNING: multiple messages have this Message-ID (diff)
From: luto@kernel.org (Andy Lutomirski)
To: linux-arm-kernel@lists.infradead.org
Subject: [kernel-hardening] Re: [RFC v2][PATCH 04/11] x86: Implement __arch_rare_write_begin/unmap()
Date: Sun, 9 Apr 2017 17:10:16 -0700	[thread overview]
Message-ID: <CALCETrWvGLtObdk3V0k_Esa_L=EOf+Whe=6DpcJ7H_W8Z-5Btw@mail.gmail.com> (raw)
In-Reply-To: <58EA2D58.17782.6ADE22BD@pageexec.freemail.hu>

On Sun, Apr 9, 2017 at 5:47 AM, PaX Team <pageexec@freemail.hu> wrote:
> On 7 Apr 2017 at 21:58, Andy Lutomirski wrote:
>
>> On Fri, Apr 7, 2017 at 12:58 PM, PaX Team <pageexec@freemail.hu> wrote:
>> > On 7 Apr 2017 at 9:14, Andy Lutomirski wrote:
>> >> Then someone who cares about performance can benchmark the CR0.WP
>> >> approach against it and try to argue that it's a good idea.  This
>> >> benchmark should wait until I'm done with my PCID work, because PCID
>> >> is going to make use_mm() a whole heck of a lot faster.
>> >
>> > in my measurements switching PCID is hovers around 230 cycles for snb-ivb
>> > and 200-220 for hsw-skl whereas cr0 writes are around 230-240 cycles. there's
>> > of course a whole lot more impact for switching address spaces so it'll never
>> > be fast enough to beat cr0.wp.
>> >
>>
>> If I'm reading this right, you're saying that a non-flushing CR3 write
>> is about the same cost as a CR0.WP write.  If so, then why should CR0
>> be preferred over the (arch-neutral) CR3 approach?
>
> cr3 (page table switching) isn't arch neutral at all ;). you probably meant
> the higher level primitives except they're not enough to implement the scheme
> as discussed before since the enter/exit paths are very much arch dependent.

Yes.

>
> on x86 the cost of the pax_open/close_kernel primitives comes from the cr0
> writes and nothing else, use_mm suffers not only from the cr3 writes but
> also locking/atomic ops and cr4 writes on its path and the inevitable TLB
> entry costs. and if cpu vendors cared enough, they could make toggling cr0.wp
> a fast path in the microcode and reduce its overhead by an order of magnitude.
>

If the CR4 writes happen in for this use case, that's a bug.

>>  And why would switching address spaces obviously be much slower?
>> There'll be a very small number of TLB fills needed for the actual
>> protected access.
>
> you'll be duplicating TLB entries in the alternative PCID for both code
> and data, where they will accumulate (=take room away from the normal PCID
> and expose unwanted memory for access) unless you also flush them when
> switching back (which then will cost even more cycles). also i'm not sure
> that processors implement all the 12 PCID bits so depending on how many PCIDs
> you plan to use, you could be causing even more unnecessary TLB replacements.
>

Unless the CPU is rather dumber than I expect, the only duplicated
entries should be for the writable aliases of pages that are written.
The rest of the pages are global and should be shared for all PCIDs.

--Andy

  reply	other threads:[~2017-04-10  0:10 UTC|newest]

Thread overview: 188+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-03-29 18:15 [RFC v2] Introduce rare_write() infrastructure Kees Cook
2017-03-29 18:15 ` [kernel-hardening] " Kees Cook
2017-03-29 18:15 ` Kees Cook
2017-03-29 18:15 ` [RFC v2][PATCH 01/11] " Kees Cook
2017-03-29 18:15   ` [kernel-hardening] " Kees Cook
2017-03-29 18:15   ` Kees Cook
2017-03-29 18:23   ` Kees Cook
2017-03-29 18:23     ` [kernel-hardening] " Kees Cook
2017-03-29 18:23     ` Kees Cook
2017-03-30  7:44     ` Ho-Eun Ryu
2017-03-30  7:44       ` [kernel-hardening] " Ho-Eun Ryu
2017-03-30  7:44       ` Ho-Eun Ryu
2017-03-30 17:02       ` Kees Cook
2017-03-30 17:02         ` [kernel-hardening] " Kees Cook
2017-03-30 17:02         ` Kees Cook
2017-04-07  8:09   ` Ho-Eun Ryu
2017-04-07  8:09     ` [kernel-hardening] " Ho-Eun Ryu
2017-04-07  8:09     ` Ho-Eun Ryu
2017-04-07 20:38     ` Kees Cook
2017-04-07 20:38       ` [kernel-hardening] " Kees Cook
2017-04-07 20:38       ` Kees Cook
2017-03-29 18:15 ` [RFC v2][PATCH 02/11] lkdtm: add test for " Kees Cook
2017-03-29 18:15   ` [kernel-hardening] " Kees Cook
2017-03-29 18:15   ` Kees Cook
2017-03-30  9:34   ` [kernel-hardening] " Ian Campbell
2017-03-30  9:34     ` Ian Campbell
2017-03-30 16:16     ` Kees Cook
2017-03-30 16:16       ` Kees Cook
2017-03-30 16:16       ` Kees Cook
2017-03-29 18:15 ` [RFC v2][PATCH 03/11] net: switch sock_diag handlers to rare_write() Kees Cook
2017-03-29 18:15   ` [kernel-hardening] " Kees Cook
2017-03-29 18:15   ` Kees Cook
2017-03-29 18:15 ` [RFC v2][PATCH 04/11] x86: Implement __arch_rare_write_begin/unmap() Kees Cook
2017-03-29 18:15   ` [kernel-hardening] " Kees Cook
2017-03-29 18:15   ` Kees Cook
2017-03-29 22:38   ` Andy Lutomirski
2017-03-29 22:38     ` [kernel-hardening] " Andy Lutomirski
2017-03-29 22:38     ` Andy Lutomirski
2017-03-30  1:41     ` Kees Cook
2017-03-30  1:41       ` [kernel-hardening] " Kees Cook
2017-03-30  1:41       ` Kees Cook
2017-04-05 23:57       ` Andy Lutomirski
2017-04-05 23:57         ` [kernel-hardening] " Andy Lutomirski
2017-04-05 23:57         ` Andy Lutomirski
2017-04-06  0:14         ` Kees Cook
2017-04-06  0:14           ` [kernel-hardening] " Kees Cook
2017-04-06  0:14           ` Kees Cook
2017-04-06 15:59           ` Andy Lutomirski
2017-04-06 15:59             ` [kernel-hardening] " Andy Lutomirski
2017-04-06 15:59             ` Andy Lutomirski
2017-04-07  8:34             ` [kernel-hardening] " Mathias Krause
2017-04-07  8:34               ` Mathias Krause
2017-04-07  8:34               ` Mathias Krause
2017-04-07  9:46               ` Thomas Gleixner
2017-04-07  9:46                 ` Thomas Gleixner
2017-04-07  9:46                 ` Thomas Gleixner
2017-04-07 10:51                 ` Mathias Krause
2017-04-07 10:51                   ` Mathias Krause
2017-04-07 10:51                   ` Mathias Krause
2017-04-07 13:14                   ` Thomas Gleixner
2017-04-07 13:14                     ` Thomas Gleixner
2017-04-07 13:14                     ` Thomas Gleixner
2017-04-07 13:30                     ` Mathias Krause
2017-04-07 13:30                       ` Mathias Krause
2017-04-07 13:30                       ` Mathias Krause
2017-04-07 16:14                       ` Andy Lutomirski
2017-04-07 16:14                         ` Andy Lutomirski
2017-04-07 16:14                         ` Andy Lutomirski
2017-04-07 16:22                         ` Mark Rutland
2017-04-07 16:22                           ` Mark Rutland
2017-04-07 16:22                           ` Mark Rutland
2017-04-07 19:58                         ` PaX Team
2017-04-07 19:58                           ` PaX Team
2017-04-07 19:58                           ` PaX Team
2017-04-08  4:58                           ` Andy Lutomirski
2017-04-08  4:58                             ` Andy Lutomirski
2017-04-08  4:58                             ` Andy Lutomirski
2017-04-09 12:47                             ` PaX Team
2017-04-09 12:47                               ` PaX Team
2017-04-09 12:47                               ` PaX Team
2017-04-10  0:10                               ` Andy Lutomirski [this message]
2017-04-10  0:10                                 ` Andy Lutomirski
2017-04-10  0:10                                 ` Andy Lutomirski
2017-04-10 10:42                                 ` PaX Team
2017-04-10 10:42                                   ` PaX Team
2017-04-10 10:42                                   ` PaX Team
2017-04-10 16:01                                   ` Andy Lutomirski
2017-04-10 16:01                                     ` Andy Lutomirski
2017-04-10 16:01                                     ` Andy Lutomirski
2017-04-07 20:44                         ` Thomas Gleixner
2017-04-07 20:44                           ` Thomas Gleixner
2017-04-07 20:44                           ` Thomas Gleixner
2017-04-07 21:20                           ` Kees Cook
2017-04-07 21:20                             ` Kees Cook
2017-04-07 21:20                             ` Kees Cook
2017-04-08  4:12                             ` Daniel Micay
2017-04-08  4:12                               ` Daniel Micay
2017-04-08  4:12                               ` Daniel Micay
2017-04-08  4:13                               ` Daniel Micay
2017-04-08  4:13                                 ` Daniel Micay
2017-04-08  4:13                                 ` Daniel Micay
2017-04-08  4:21                         ` Daniel Micay
2017-04-08  4:21                           ` Daniel Micay
2017-04-08  4:21                           ` Daniel Micay
2017-04-08  5:07                           ` Andy Lutomirski
2017-04-08  5:07                             ` Andy Lutomirski
2017-04-08  5:07                             ` Andy Lutomirski
2017-04-08  7:33                             ` Daniel Micay
2017-04-08  7:33                               ` Daniel Micay
2017-04-08  7:33                               ` Daniel Micay
2017-04-08 15:20                               ` Andy Lutomirski
2017-04-08 15:20                                 ` Andy Lutomirski
2017-04-08 15:20                                 ` Andy Lutomirski
2017-04-09 10:53                                 ` Ingo Molnar
2017-04-09 10:53                                   ` Ingo Molnar
2017-04-09 10:53                                   ` Ingo Molnar
2017-04-10 10:22                                 ` Mark Rutland
2017-04-10 10:22                                   ` Mark Rutland
2017-04-10 10:22                                   ` Mark Rutland
2017-04-09 20:24                             ` PaX Team
2017-04-09 20:24                               ` PaX Team
2017-04-09 20:24                               ` PaX Team
2017-04-10  0:31                               ` Andy Lutomirski
2017-04-10  0:31                                 ` Andy Lutomirski
2017-04-10  0:31                                 ` Andy Lutomirski
2017-04-10 19:47                                 ` PaX Team
2017-04-10 19:47                                   ` PaX Team
2017-04-10 19:47                                   ` PaX Team
2017-04-10 20:27                                   ` Andy Lutomirski
2017-04-10 20:27                                     ` Andy Lutomirski
2017-04-10 20:27                                     ` Andy Lutomirski
2017-04-10 20:13                               ` Kees Cook
2017-04-10 20:13                                 ` Kees Cook
2017-04-10 20:13                                 ` Kees Cook
2017-04-10 20:17                                 ` Andy Lutomirski
2017-04-10 20:17                                   ` Andy Lutomirski
2017-04-10 20:17                                   ` Andy Lutomirski
2017-04-07 19:25                       ` Thomas Gleixner
2017-04-07 19:25                         ` Thomas Gleixner
2017-04-07 19:25                         ` Thomas Gleixner
2017-04-07 14:45                   ` Peter Zijlstra
2017-04-07 14:45                     ` Peter Zijlstra
2017-04-07 14:45                     ` Peter Zijlstra
2017-04-10 10:29                     ` Mark Rutland
2017-04-10 10:29                       ` Mark Rutland
2017-04-10 10:29                       ` Mark Rutland
2017-04-07 19:52                 ` PaX Team
2017-04-07 19:52                   ` PaX Team
2017-04-07 19:52                   ` PaX Team
2017-04-10  8:26                   ` Thomas Gleixner
2017-04-10  8:26                     ` Thomas Gleixner
2017-04-10  8:26                     ` Thomas Gleixner
2017-04-10 19:55                     ` PaX Team
2017-04-10 19:55                       ` PaX Team
2017-04-10 19:55                       ` PaX Team
2017-04-07  9:37   ` Peter Zijlstra
2017-04-07  9:37     ` [kernel-hardening] " Peter Zijlstra
2017-04-07  9:37     ` Peter Zijlstra
2017-03-29 18:15 ` [RFC v2][PATCH 05/11] ARM: mm: dump: Add domain to output Kees Cook
2017-03-29 18:15   ` [kernel-hardening] " Kees Cook
2017-03-29 18:15   ` Kees Cook
2017-03-29 18:15 ` [RFC v2][PATCH 06/11] ARM: domains: Extract common USER domain init Kees Cook
2017-03-29 18:15   ` [kernel-hardening] " Kees Cook
2017-03-29 18:15   ` Kees Cook
2017-03-29 18:15 ` [RFC v2][PATCH 07/11] ARM: mm: set DOMAIN_WR_RARE for rodata Kees Cook
2017-03-29 18:15   ` [kernel-hardening] " Kees Cook
2017-03-29 18:15   ` Kees Cook
2017-03-29 18:16 ` [RFC v2][PATCH 08/11] ARM: Implement __arch_rare_write_begin/end() Kees Cook
2017-03-29 18:16   ` [kernel-hardening] " Kees Cook
2017-03-29 18:16   ` Kees Cook
2017-04-07  9:36   ` Peter Zijlstra
2017-04-07  9:36     ` [kernel-hardening] " Peter Zijlstra
2017-04-07  9:36     ` Peter Zijlstra
2017-03-29 18:16 ` [RFC v2][PATCH 09/11] list: add rare_write() list helpers Kees Cook
2017-03-29 18:16   ` [kernel-hardening] " Kees Cook
2017-03-29 18:16   ` Kees Cook
2017-03-29 18:16 ` [RFC v2][PATCH 10/11] gcc-plugins: Add constify plugin Kees Cook
2017-03-29 18:16   ` [kernel-hardening] " Kees Cook
2017-03-29 18:16   ` Kees Cook
2017-03-29 18:16 ` [RFC v2][PATCH 11/11] cgroups: force all struct cftype const Kees Cook
2017-03-29 18:16   ` [kernel-hardening] " Kees Cook
2017-03-29 18:16   ` Kees Cook
2017-03-29 19:00 ` [RFC v2] Introduce rare_write() infrastructure Russell King - ARM Linux
2017-03-29 19:00   ` [kernel-hardening] " Russell King - ARM Linux
2017-03-29 19:00   ` Russell King - ARM Linux
2017-03-29 19:14   ` Kees Cook
2017-03-29 19:14     ` [kernel-hardening] " Kees Cook
2017-03-29 19:14     ` Kees Cook

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CALCETrWvGLtObdk3V0k_Esa_L=EOf+Whe=6DpcJ7H_W8Z-5Btw@mail.gmail.com' \
    --to=luto@kernel.org \
    --cc=hoeun.ryu@gmail.com \
    --cc=keescook@chromium.org \
    --cc=kernel-hardening@lists.openwall.com \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux@armlinux.org.uk \
    --cc=mark.rutland@arm.com \
    --cc=minipli@googlemail.com \
    --cc=pageexec@freemail.hu \
    --cc=peterz@infradead.org \
    --cc=re.emese@gmail.com \
    --cc=tglx@linutronix.de \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.