Messages in this thread | | | Date | Sat, 29 Aug 1998 15:14:40 +0200 | From | Alexander Kjeldaas <> | Subject | Re: Virtual Machines, JVM in kernel, hot-swapped kernel |
| |
On Fri, Aug 28, 1998 at 06:20:35PM -0300, Brandon S. Allbery KF8NH wrote: > In message <m0zCNTx-000aPKC@the-village.bc.nu>, Alan Cox writes: > | > | The BPF filters in 2.1.x and in BSD are very much byte code. BPF isnt turing > | complete and doesnt do a lot, but it is also quite possible to convert it to > | native code. Right now we dont do that but the hooks exist in the kernel > +--->8 > > Not sure I want native code; I prefer that it be sandboxed, even at the > price of speed. (Just what we need, a virus vector in the kernel... > although I suppose that modules already give us one such.) >
You are still sand-boxed even if you convert to native code. A naive conversion to native code such as done by the TYA Java JIT-compiler achieves significant speed improvements over interpretation.
An alternative if you want even better performance is to look into Proof-Carrying-Code which means that instead of having a JIT in the kernel, you have a proof-verifier. Instead of byte code you use native code with an accompanying proof. The proof shows that the code has no side-effects beyond the defined ones. This has been used to implement packets-filters in (research) kernels.
> What I was thinking of is something like the packet filtering used by > CheckPoint FireWall-1 (not available for Linux AFAIK); this involves a > kernel module which implements arbitrarily complex (limited by memory > assigned for bytecode and table storage) stateful packet filters. It runs > bytecode. (For those who've seen FW-1, the things you can do with their GUI > filter editor are a subset of its full capability; you have to write > low-level INSPECT code to use its full power. INSPECT is *not* a simple > language to work with, though, which is why I was thinking of more normal > languages such as Java or Icon.) > > BPF doesn't appear to be capable of supporting all of the capabilities of > this kind of filter, even ignoring the "stateful" part. >
US citizens might want to look into their "byte-code-in-the-kernel"-patent.
astor
-- Alexander Kjeldaas, Guardian Networks AS, Trondheim, Norway http://www.guardian.no/
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html
| |