Gentoo Archives: gentoo-hardened

From: Pedro Venda <pjvenda@××××××××××××.org>
To: gentoo-hardened@l.g.o
Cc: Miguel Filipe <miguel.filipe@×××××.com>, grsecurity@××××××××××.net
Subject: [gentoo-hardened]
Date: Sun, 08 May 2005 21:44:33
Message-Id: 200505082244.32441.pjvenda@arrakis.dhis.org
In Reply to: [gentoo-hardened] PaX: pageexec or segmexec performance numbers? by Miguel Filipe
1 On Sunday 08 May 2005 21:47, Miguel Filipe wrote:
2 > Are there any numbers (benchmarks) about the performance penalty of
3 > pageexec and/or segmexec on intel x86 machines?
4 >
5 > The idea that I have is that page-exec on x86 involves a page-fault
6 > for every (execute) access to a new page that will be treated by
7 > pax... and that is performance-wise .. bad..
8
9 It's a page-fault for every access, whether it is write, read or execute.
10 Access type is verified later. Am I right?
11
12 > And that segmexec is a diferent approach that involves, mirroring the
13 > process address space on two segments with diferent "write"
14 > permissions, and compairing those two, to check if there was any
15 > overwrite of the code segment.
16 > This would mean doubling the mem-usage, at least for the code-segment
17 > in segmexec mode.
18 >
19 > I have the idea that segmexec is advised for being faster (on x86),
20 > but I don't have any numbers, and I was trying to understand the
21 > performance-wise consequences of each implementation.
22
23 Someone told me the same thing :-p
24
25 > And in arches that suport no-exec pages (has sparc or amd64), what are
26 > the performance penalties? Anyone can give me some pointers?
27
28 Using PAGEEXEC, supposedly none. right?
29
30 > stuff like: kernel compiles, mysql benches, or... any other benchmark
31 > is good for me.. just to "grasp" a idea...
32
33 On a simple SMP pentium III I can make such benchmarks :-)
34
35 regards,
36 pedro venda.
37 --
38
39 Pedro João Lopes Venda
40 email: pjvenda < at > arrakis.dhis.org
41 http://arrakis.dhis.org