Re: [PATCH] x86/entry/64: randomize kernel stack offset upon syscall

From: Ingo Molnar
Date: Thu May 02 2019 - 12:43:54 EST

* Andy Lutomirski <luto@xxxxxxxxxx> wrote:

> > 8 gigabits/sec sounds good throughput in principle, if there's no
> > scalability pathologies with that.
> The latency is horrible.

Latency would be amortized via batching anyway, so 8 gigabits/sec
suggests something on the order of magnitude of 4 bits per cycle, right?
With 64 bits extraction at a time that would be 16 cycles per 64-bit
word, which isn't too bad, is it?

But you are right that get_random_bytes() is probably faster, and also
more generic.

> > It would also be nice to know whether RDRAND does buffering
> > *internally*,
> Not in a useful way :(

Too bad ...

> > Any non-CPU source of randomness for system calls and plans to add
> > several extra function calls to every x86 system call is crazy talk I
> > believe...
> I think that, in practice, the only real downside to enabling this
> thing will be the jitter in syscall times. Although we could decide
> that the benefit is a bit dubious and the whole thing isn't worth it.
> But it will definitely be optional.

Making it "optional" is not really a technical argument in any way
though, either distros enable it in which case it's a de-facto default
setting, or they don't, in which case it de-facto almost doesn't exist.