lkml.org 
[lkml]   [2010]   [Sep]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: disabling group leader perf_event
  On 09/06/2010 06:48 PM, Alan Cox wrote:
>> No, I want the ability to terminate the code at any time and clean up
>> any resources used. We have exactly the same requirements for ordinary
>> userspace.
> So you intend to prevent its use at any point where we have a kernel only
> resource held in any way manner or form ? Remember we don't hold locks or
> many kinds of kernel resource across syscalls.

I don't think we can allow the downloaded code to hold any kernel
locks. If the locks are necessary for correct operation, then the
untrusted code can "forget" to take them. If they aren't necessary,
don't expose them in the first place. All APIs exposed to the code have
to be thread safe. We can allow locks that only protect user data
structures (and so we can just wipe them out if we need to kill the
code, just like with futexes[1]).

Other resources are easy, we do this everywhere, including for userspace.

> Likewise I'm interested
> how you will keep it compatible with real time ?

It's just like other executing any user code. Whatever thread executes
that code is impacted by its real time characteristics. If a
non-realtime thread executes it, who cares. If a real time thread
executes it, then it's up to the user to guarantee real time behaviour.
The kernel need only ensure that user code given by a low-priority task
is not executed in a high priority task.

>> So you do want to jit?
> Depends what you mean by jit. JIT normally implies compiling/recompiling
> as you go. Do we want to compile it once at load time - probably,
> assuming the tool is present.

That's jit enough for me. These would usually be small code snippets,
not megabytes of junk, though that would no doubt follow if we do a good
job.

We could probably s/netfilter/call to user code/ and remove tons of
potentially vulnerable kernel code, and gain lots of flexibility into
the bargain. I'd like to use this for kvm as well.


[1] Ignoring robust futexes, IIUC

--
I have a truly marvellous patch that fixes the bug which this
signature is too narrow to contain.



\
 
 \ /
  Last update: 2010-09-06 19:55    [from the cache]
©2003-2014 Jasper Spaans. Advertise on this site