Re: disabling group leader perf_event

From: Avi Kivity <avi@redhat.com>
To: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: "Ingo Molnar" <mingo@elte.hu>,
	"Pekka Enberg" <penberg@cs.helsinki.fi>,
	"Tom Zanussi" <tzanussi@gmail.com>,
	"Frédéric Weisbecker" <fweisbec@gmail.com>,
	"Steven Rostedt" <rostedt@goodmis.org>,
	"Arnaldo Carvalho de Melo" <acme@redhat.com>,
	"Peter Zijlstra" <peterz@infradead.org>,
	linux-perf-users@vger.kernel.org,
	linux-kernel <linux-kernel@vger.kernel.org>
Subject: Re: disabling group leader perf_event
Date: Mon, 06 Sep 2010 20:50:55 +0300	[thread overview]
Message-ID: <4C8529FF.6090500@redhat.com> (raw)
In-Reply-To: <20100906164824.339cd82e@lxorguk.ukuu.org.uk>

  On 09/06/2010 06:48 PM, Alan Cox wrote:
>> No, I want the ability to terminate the code at any time and clean up
>> any resources used.  We have exactly the same requirements for ordinary
>> userspace.
> So you intend to prevent its use at any point where we have a kernel only
> resource held in any way manner or form ? Remember we don't hold locks or
> many kinds of kernel resource across syscalls.

I don't think we can allow the downloaded code to hold any kernel 
locks.  If the locks are necessary for correct operation, then the 
untrusted code can "forget" to take them.  If they aren't necessary, 
don't expose them in the first place.  All APIs exposed to the code have 
to be thread safe.  We can allow locks that only protect user data 
structures (and so we can just wipe them out if we need to kill the 
code, just like with futexes[1]).

Other resources are easy, we do this everywhere, including for userspace.

> Likewise I'm interested
> how you will keep it compatible with real time ?

It's just like other executing any user code.  Whatever thread executes 
that code is impacted by its real time characteristics.  If a 
non-realtime thread executes it, who cares.  If a real time thread 
executes it, then it's up to the user to guarantee real time behaviour.  
The kernel need only ensure that user code given by a low-priority task 
is not executed in a high priority task.

>> So you do want to jit?
> Depends what you mean by jit. JIT normally implies compiling/recompiling
> as you go. Do we want to compile it once at load time - probably,
> assuming the tool is present.

That's jit enough for me.  These would usually be small code snippets, 
not megabytes of junk, though that would no doubt follow if we do a good 
job.

We could probably s/netfilter/call to user code/ and remove tons of 
potentially vulnerable kernel code, and gain lots of flexibility into 
the bargain.  I'd like to use this for kvm as well.

[1] Ignoring robust futexes, IIUC

-- 
I have a truly marvellous patch that fixes the bug which this
signature is too narrow to contain.