Re: [RFC] security: replace indirect calls with static calls

2021-02-05 Thread Mathieu Desnoyers
- On Feb 5, 2021, at 10:40 AM, Peter Zijlstra pet...@infradead.org wrote: > On Fri, Feb 05, 2021 at 10:09:26AM -0500, Mathieu Desnoyers wrote: >> Then we should be able to generate the following using static keys as a >> jump table and N static calls: >> >> jump >> label_N: >> stack setu

Re: [RFC] security: replace indirect calls with static calls

2021-02-05 Thread Peter Zijlstra
On Fri, Feb 05, 2021 at 10:09:26AM -0500, Mathieu Desnoyers wrote: > Then we should be able to generate the following using static keys as a > jump table and N static calls: > > jump > label_N: > stack setup > call > label_N-1: > stack setup > call > label_N-2: > stack setup > call

Re: [RFC] security: replace indirect calls with static calls

2021-02-05 Thread Mathieu Desnoyers
On 20-Aug-2020 06:47:53 PM, Brendan Jackman wrote: > From: Paul Renauld > > LSMs have high overhead due to indirect function calls through > retpolines. This RPC proposes to replace these with static calls [1] > instead. > > This overhead is especially significant for the "bpf" LSM which support

Re: [RFC] security: replace indirect calls with static calls

2020-08-24 Thread Casey Schaufler
On 8/24/2020 10:04 AM, Brendan Jackman wrote: > On Mon, 24 Aug 2020 at 18:43, Casey Schaufler wrote: >> On 8/24/2020 8:20 AM, Brendan Jackman wrote: >>> On Fri, 21 Aug 2020 at 00:46, Casey Schaufler >>> wrote: On 8/20/2020 9:47 AM, Brendan Jackman wrote: >>> [...] What does NOP really

Re: [RFC] security: replace indirect calls with static calls

2020-08-24 Thread Brendan Jackman
On Mon, 24 Aug 2020 at 18:43, Casey Schaufler wrote: > > On 8/24/2020 8:20 AM, Brendan Jackman wrote: > > On Fri, 21 Aug 2020 at 00:46, Casey Schaufler > > wrote: > >> On 8/20/2020 9:47 AM, Brendan Jackman wrote: > > [...] > >> What does NOP really look like? > > The NOP is the same as a regular

Re: [RFC] security: replace indirect calls with static calls

2020-08-24 Thread Casey Schaufler
On 8/24/2020 8:20 AM, Brendan Jackman wrote: > On Fri, 21 Aug 2020 at 00:46, Casey Schaufler wrote: >> On 8/20/2020 9:47 AM, Brendan Jackman wrote: > [...] >> What does NOP really look like? > The NOP is the same as a regular function call but the CALL > instruction is replaced with a NOP instruct

Re: [RFC] security: replace indirect calls with static calls

2020-08-24 Thread Brendan Jackman
On Fri, 21 Aug 2020 at 00:46, Casey Schaufler wrote: > > On 8/20/2020 9:47 AM, Brendan Jackman wrote: [...] > What does NOP really look like? The NOP is the same as a regular function call but the CALL instruction is replaced with a NOP instruction. The code that sets up the call parameters is un

Re: [RFC] security: replace indirect calls with static calls

2020-08-24 Thread Brendan Jackman
On Mon, Aug 24, 2020 at 04:33:44PM +0200, Peter Zijlstra wrote: > On Mon, Aug 24, 2020 at 04:09:09PM +0200, Brendan Jackman wrote: > > > > > Why this trick with a switch statement? The table of static call is > > > > defined > > > > at compile time. The number of hook callbacks that will be defin

Re: [RFC] security: replace indirect calls with static calls

2020-08-24 Thread Peter Zijlstra
On Mon, Aug 24, 2020 at 04:09:09PM +0200, Brendan Jackman wrote: > > > Why this trick with a switch statement? The table of static call is > > > defined > > > at compile time. The number of hook callbacks that will be defined is > > > unknown at that time, and the table cannot be resized at runti

Re: [RFC] security: replace indirect calls with static calls

2020-08-24 Thread Brendan Jackman
On Thu, 20 Aug 2020 at 23:46, Kees Cook wrote: > > On Thu, Aug 20, 2020 at 06:47:53PM +0200, Brendan Jackman wrote: > > From: Paul Renauld > > > > LSMs have high overhead due to indirect function calls through > > retpolines. This RPC proposes to replace these with static calls [1] > > typo: RFC

Re: [RFC] security: replace indirect calls with static calls

2020-08-20 Thread Casey Schaufler
On 8/20/2020 9:47 AM, Brendan Jackman wrote: > From: Paul Renauld > > LSMs have high overhead due to indirect function calls through > retpolines. This RPC proposes to replace these with static calls [1] > instead. > > This overhead is especially significant for the "bpf" LSM which supports > the

Re: [RFC] security: replace indirect calls with static calls

2020-08-20 Thread Kees Cook
On Thu, Aug 20, 2020 at 06:47:53PM +0200, Brendan Jackman wrote: > From: Paul Renauld > > LSMs have high overhead due to indirect function calls through > retpolines. This RPC proposes to replace these with static calls [1] typo: RFC > instead. Yay! :) > [...] > This overhead prevents the ado

Re: [RFC] security: replace indirect calls with static calls

2020-08-20 Thread KP Singh
On Thu, Aug 20, 2020 at 8:43 PM James Morris wrote: > > On Thu, 20 Aug 2020, Brendan Jackman wrote: > > > With this implementation, any overhead of the indirect call in the LSM > > framework is completely mitigated (performance results: [7]). This > > facilitates the adoption of "bpf" LSM on produ

Re: [RFC] security: replace indirect calls with static calls

2020-08-20 Thread James Morris
On Thu, 20 Aug 2020, Brendan Jackman wrote: > With this implementation, any overhead of the indirect call in the LSM > framework is completely mitigated (performance results: [7]). This > facilitates the adoption of "bpf" LSM on production machines and also > benefits all other LSMs. This looks l

[RFC] security: replace indirect calls with static calls

2020-08-20 Thread Brendan Jackman
From: Paul Renauld LSMs have high overhead due to indirect function calls through retpolines. This RPC proposes to replace these with static calls [1] instead. This overhead is especially significant for the "bpf" LSM which supports the implementation of LSM hooks with eBPF programs (security/bp